espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-10-04 02:50:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

flash encryption: add option to require flash encryption to be enabled

Browse Source 
In testing environment, to avoid accidentally enabling flash
encryption on a device, CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED
can be set. If set, the bootloader will refuse to boot if flash
encryption is not enabled, instead of enabling it.
This commit is contained in:
Ivan Grokhotkov
2019-07-27 08:55:30 +02:00
parent a37694741c
commit a0256b9e9d
2 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
components/bootloader/Kconfig.projbuild
View File

@@ -515,6 +515,20 @@ menu "Security features"
Only set this option in testing environments.
config SECURE_FLASH_REQUIRE_ALREADY_ENABLED
bool "Require flash encryption to be already enabled"
depends on SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
default N
help
If not set (default), and flash encryption is not yet enabled in eFuses, the 2nd stage bootloader
will enable flash encryption: generate the flash encryption key and program eFuses.
If this option is set, and flash encryption is not yet enabled, the bootloader will error out and
reboot.
If flash encryption is enabled in eFuses, this option does not change the bootloader behavior.
Only use this option in testing environments, to avoid accidentally enabling flash encryption on
the wrong device. The device needs to have flash encryption already enabled using espefuse.py.
endmenu # Potentially Insecure
endmenu # Security features