espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-08-04 21:24:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

flash encryption: Also always disable ROM BASIC console when enabling flash encryption

Browse Source
This commit is contained in:
Angus Gratton
2017-08-22 15:40:53 +10:00
committed by Angus Gratton
parent 1e22bcdfde
commit 7a18575af8
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
components/bootloader/Kconfig.projbuild
View File

@@ -168,12 +168,17 @@ menu "Potentially insecure options"
config SECURE_BOOT_ALLOW_ROM_BASIC config SECURE_BOOT_ALLOW_ROM_BASIC
bool "Leave ROM BASIC Interpreter available on reset" bool "Leave ROM BASIC Interpreter available on reset"
depends on SECURE_BOOT_INSECURE depends on SECURE_BOOT_INSECURE || FLASH_ENCRYPTION_INSECURE
default N default N
help help
If not set (default), bootloader permanently disables ROM BASIC (on UART console) as a fallback if the bootloader image becomes invalid. This happens on first boot. By default, the BASIC ROM Console starts on reset if no valid bootloader is
read from the flash.
Only set this option in testing environments. When either flash encryption or secure boot are enabled, the default is to
disable this BASIC fallback mode permanently via efuse.
If this option is set, this efuse is not burned and the BASIC ROM Console may
remain accessible. Only set this option in testing environments.
config SECURE_BOOT_ALLOW_JTAG config SECURE_BOOT_ALLOW_JTAG
bool "Allow JTAG Debugging" bool "Allow JTAG Debugging"

6
components/bootloader_support/src/flash_encrypt.c
View File

@@ -139,6 +139,12 @@ static esp_err_t initialise_flash_encryption(void)
#else #else
ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED"); ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
#endif #endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_ROM_BASIC
ESP_LOGI(TAG, "Disable ROM BASIC interpreter fallback...");
new_wdata6 |= EFUSE_RD_CONSOLE_DEBUG_DISABLE;
#else
ESP_LOGW(TAG, "Not disabling ROM BASIC fallback - SECURITY COMPROMISED");
#endif
if (new_wdata6 != 0) { if (new_wdata6 != 0) {
REG_WRITE(EFUSE_BLK0_WDATA6_REG, new_wdata6); REG_WRITE(EFUSE_BLK0_WDATA6_REG, new_wdata6);