From c990ca4e2078b7a04060616a8e4129595ac19691 Mon Sep 17 00:00:00 2001 From: Angus Gratton Date: Wed, 26 Sep 2018 16:57:44 +1000 Subject: [PATCH 1/2] bootloader: Don't enable secure boot or flash encryption for 3/4 Coding Scheme --- components/bootloader_support/src/flash_encrypt.c | 5 +++++ components/bootloader_support/src/secure_boot.c | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/components/bootloader_support/src/flash_encrypt.c b/components/bootloader_support/src/flash_encrypt.c index 290a02a911..957caee16e 100644 --- a/components/bootloader_support/src/flash_encrypt.c +++ b/components/bootloader_support/src/flash_encrypt.c @@ -62,6 +62,11 @@ esp_err_t esp_flash_encrypt_check_and_update(void) static esp_err_t initialise_flash_encryption(void) { + if (REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_CODING_SCHEME_M) { + ESP_LOGE(TAG, "Flash Encryption is currently not supported on hardware with 3/4 Coding Scheme (CODING_SCHEME efuse set)"); + return ESP_ERR_NOT_SUPPORTED; + } + /* Before first flash encryption pass, need to initialise key & crypto config */ /* Generate key */ diff --git a/components/bootloader_support/src/secure_boot.c b/components/bootloader_support/src/secure_boot.c index ef9744ffc8..6355bcd7c5 100644 --- a/components/bootloader_support/src/secure_boot.c +++ b/components/bootloader_support/src/secure_boot.c @@ -111,6 +111,11 @@ esp_err_t esp_secure_boot_permanently_enable(void) { return ESP_OK; } + if (REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_CODING_SCHEME_M) { + ESP_LOGE(TAG, "Secure Boot is currently not supported on hardware with 3/4 Coding Scheme (CODING_SCHEME efuse set)"); + return ESP_ERR_NOT_SUPPORTED; + } + err = esp_image_verify_bootloader(&image_len); if (err != ESP_OK) { ESP_LOGE(TAG, "bootloader image appears invalid! error %d", err); From 674cf7520e3dea7d20383eb55074da0db19ffbd2 Mon Sep 17 00:00:00 2001 From: Angus Gratton Date: Thu, 27 Sep 2018 10:12:00 +1000 Subject: [PATCH 2/2] esptool: Update to v2.5.1 Release notes: https://github.com/espressif/esptool/releases/tag/v2.5.1 Needed to no longer burn keys if 3/4 Coding Scheme is enabled. --- components/esptool_py/esptool | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/esptool_py/esptool b/components/esptool_py/esptool index 4dab24e1b2..59b8dd8bfe 160000 --- a/components/esptool_py/esptool +++ b/components/esptool_py/esptool @@ -1 +1 @@ -Subproject commit 4dab24e1b28632d270adf7305fe0d008d1acee99 +Subproject commit 59b8dd8bfe3927dc11ffc06603fa082cb0f523bb