feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

secure_boot: Fix warning when UART ROM DL mode is disabled

Browse Source 
*Additionally use updated calls to enable rom secure download mode
This commit is contained in:
Aditya Patwardhan
2021-11-11 10:29:50 +05:30
committed by bot
parent 36e1d1c180
commit 2c0081b286
5 changed files with 55 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
components/bootloader_support/src/esp32/secure_boot_secure_features.c
View File

@ -79,7 +79,7 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
return err; return err;
} }
#else #else
ESP_LOGW(TAG, "Not disabling ROM Download mode - SECURITY COMPROMISED"); ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
#endif #endif
#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS #ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS

15
components/bootloader_support/src/esp32c3/secure_boot_secure_features.c
View File

@ -20,9 +20,20 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
ESP_LOGI(TAG, "Enabling Security download mode..."); ESP_LOGI(TAG, "Enabling Security download mode...");
esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD); esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not enable Security download mode...");
return err;
}
#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
ESP_LOGI(TAG, "Disable ROM Download mode...");
esp_err_t err = esp_efuse_disable_rom_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not disable ROM Download mode...");
return err;
}
#else #else
ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED"); ESP_LOGW(TAG, "UART ROM download mode kept enabled - SECURITY COMPROMISED");
#endif #endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG

18
components/bootloader_support/src/esp32h2/secure_boot.c
View File

@ -250,11 +250,23 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT); esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
esp_err_t err = ESP_FAIL;
#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
ESP_LOGI(TAG, "Enabling Security download mode..."); ESP_LOGI(TAG, "Enabling Security download mode...");
esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD); err = esp_efuse_enable_rom_secure_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not enable Security download mode...");
return err;
}
#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
ESP_LOGI(TAG, "Disable ROM Download mode...");
err = esp_efuse_disable_rom_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not disable ROM Download mode...");
return err;
}
#else #else
ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED"); ESP_LOGW(TAG, "UART download mode kept enabled - SECURITY COMPROMISED");
#endif #endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
@ -272,7 +284,7 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN); esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
esp_err_t err = esp_efuse_batch_write_commit(); err = esp_efuse_batch_write_commit();
if (err != ESP_OK) { if (err != ESP_OK) {
ESP_LOGE(TAG, "Error programming security eFuses (err=0x%x).", err); ESP_LOGE(TAG, "Error programming security eFuses (err=0x%x).", err);
return err; return err;

15
components/bootloader_support/src/esp32s2/secure_boot_secure_features.c
View File

@ -21,9 +21,20 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
ESP_LOGI(TAG, "Enabling Security download mode..."); ESP_LOGI(TAG, "Enabling Security download mode...");
esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD); esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not enable Security download mode...");
return err;
}
#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
ESP_LOGI(TAG, "Disable ROM Download mode...");
esp_err_t err = esp_efuse_disable_rom_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not disable ROM Download mode...");
return err;
}
#else #else
ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED"); ESP_LOGW(TAG, "UART ROM download mode kept enabled - SECURITY COMPROMISED");
#endif #endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG

15
components/bootloader_support/src/esp32s3/secure_boot_secure_features.c
View File

@ -20,9 +20,20 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
ESP_LOGI(TAG, "Enabling Security download mode..."); ESP_LOGI(TAG, "Enabling Security download mode...");
esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD); esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not enable Security download mode...");
return err;
}
#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
ESP_LOGI(TAG, "Disable ROM Download mode...");
esp_err_t err = esp_efuse_disable_rom_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not disable ROM Download mode...");
return err;
}
#else #else
ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED"); ESP_LOGW(TAG, "UART ROM download mode kept enabled - SECURITY COMPROMISED");
#endif #endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG