Skip to content

Commit f22daec

Browse files
mahavirjmahavirj
committed
Merge branch 'feature/secure_set_efuses_to_prevent_brick_chip' into 'master'
security: write-protect DIS_ICAHE and DIS_DCACHE Closes IDF-5177 See merge request espressif/esp-idf!22640
2 parents 79b92b8 + a3232e4 commit f22daec

37 files changed

+251
-27
lines changed

‎components/bootloader/Kconfig.projbuild

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -841,6 +841,10 @@ menu "Security features"
841841

842842
endchoice
843843

844+
config SECURE_FLASH_HAS_WRITE_PROTECTION_CACHE
845+
bool
846+
default y if (SOC_EFUSE_DIS_ICACHE || IDF_TARGET_ESP32) && SECURE_FLASH_ENC_ENABLED
847+
844848
menu "Potentially insecure options"
845849
visible if SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT || SECURE_BOOT_INSECURE || SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT # NOERROR
846850

@@ -867,6 +871,7 @@ menu "Security features"
867871
config SECURE_BOOT_ALLOW_JTAG
868872
bool "Allow JTAG Debugging"
869873
depends on SECURE_BOOT_INSECURE || SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
874+
select SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE if SECURE_FLASH_HAS_WRITE_PROTECTION_CACHE
870875
default N
871876
help
872877
If not set (default), the bootloader will permanently disable JTAG (across entire chip) on first boot
@@ -924,6 +929,7 @@ menu "Security features"
924929
config SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
925930
bool "Leave UART bootloader encryption enabled"
926931
depends on SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
932+
select SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE if SECURE_FLASH_HAS_WRITE_PROTECTION_CACHE
927933
default N
928934
help
929935
If not set (default), the bootloader will permanently disable UART bootloader encryption access on
@@ -946,6 +952,7 @@ menu "Security features"
946952
bool "Leave UART bootloader flash cache enabled"
947953
depends on SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT && (IDF_TARGET_ESP32 || SOC_EFUSE_DIS_DOWNLOAD_ICACHE || SOC_EFUSE_DIS_DOWNLOAD_DCACHE) # NOERROR
948954
default N
955+
select SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE if SECURE_FLASH_HAS_WRITE_PROTECTION_CACHE
949956
help
950957
If not set (default), the bootloader will permanently disable UART bootloader flash cache access on
951958
first boot. If set, the UART bootloader will still be able to access the flash cache.
@@ -966,6 +973,40 @@ menu "Security features"
966973
Only use this option in testing environments, to avoid accidentally enabling flash encryption on
967974
the wrong device. The device needs to have flash encryption already enabled using espefuse.py.
968975

976+
config SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE
977+
bool "Skip write-protection of DIS_CACHE (DIS_ICACHE, DIS_DCACHE)"
978+
default n
979+
depends on SECURE_FLASH_HAS_WRITE_PROTECTION_CACHE
980+
help
981+
If not set (default, recommended), on the first boot the bootloader will burn the write-protection of
982+
DIS_CACHE(for ESP32) or DIS_ICACHE/DIS_DCACHE(for other chips) eFuse when Flash Encryption is enabled.
983+
Write protection for cache disable efuse prevents the chip from being blocked if it is set by accident.
984+
App and bootloader use cache so disabling it makes the chip useless for IDF.
985+
Due to other eFuses are linked with the same write protection bit (see the list below) then
986+
write-protection will not be done if these SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC,
987+
SECURE_BOOT_ALLOW_JTAG or SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE options are selected
988+
to give a chance to turn on the chip into the release mode later.
989+
990+
List of eFuses with the same write protection bit:
991+
ESP32: MAC, MAC_CRC, DISABLE_APP_CPU, DISABLE_BT, DIS_CACHE, VOL_LEVEL_HP_INV.
992+
993+
ESP32-C3: DIS_ICACHE, DIS_USB_JTAG, DIS_DOWNLOAD_ICACHE, DIS_USB_SERIAL_JTAG,
994+
DIS_FORCE_DOWNLOAD, DIS_TWAI, JTAG_SEL_ENABLE, DIS_PAD_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT.
995+
996+
ESP32-C6: SWAP_UART_SDIO_EN, DIS_ICACHE, DIS_USB_JTAG, DIS_DOWNLOAD_ICACHE,
997+
DIS_USB_SERIAL_JTAG, DIS_FORCE_DOWNLOAD, DIS_TWAI, JTAG_SEL_ENABLE,
998+
DIS_PAD_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT.
999+
1000+
ESP32-H2: DIS_ICACHE, DIS_USB_JTAG, POWERGLITCH_EN, DIS_FORCE_DOWNLOAD, SPI_DOWNLOAD_MSPI_DIS,
1001+
DIS_TWAI, JTAG_SEL_ENABLE, DIS_PAD_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT.
1002+
1003+
ESP32-S2: DIS_ICACHE, DIS_DCACHE, DIS_DOWNLOAD_ICACHE, DIS_DOWNLOAD_DCACHE,
1004+
DIS_FORCE_DOWNLOAD, DIS_USB, DIS_TWAI, DIS_BOOT_REMAP, SOFT_DIS_JTAG,
1005+
HARD_DIS_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT.
1006+
1007+
ESP32-S3: DIS_ICACHE, DIS_DCACHE, DIS_DOWNLOAD_ICACHE, DIS_DOWNLOAD_DCACHE,
1008+
DIS_FORCE_DOWNLOAD, DIS_USB_OTG, DIS_TWAI, DIS_APP_CPU, DIS_PAD_JTAG,
1009+
DIS_DOWNLOAD_MANUAL_ENCRYPT, DIS_USB_JTAG, DIS_USB_SERIAL_JTAG, STRAP_JTAG_SEL, USB_PHY_SEL.
9691010
endmenu # Potentially Insecure
9701011

9711012
config SECURE_FLASH_CHECK_ENC_EN_IN_APP

‎components/bootloader_support/src/esp32/flash_encryption_secure_features.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,5 +79,13 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
7979
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_EFUSE_RD_DISABLE);
8080
#endif
8181

82+
#ifndef CONFIG_SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE
83+
// Set write-protection for DIS_ICACHE to prevent bricking chip in case it will be set accidentally.
84+
// esp32 has DIS_ICACHE. Write-protection bit = 3.
85+
// List of eFuses with the same write protection bit:
86+
// MAC, MAC_CRC, DISABLE_APP_CPU, DISABLE_BT, DIS_CACHE, VOL_LEVEL_HP_INV.
87+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
88+
#endif
89+
8290
return ESP_OK;
8391
}

‎components/bootloader_support/src/esp32c3/flash_encryption_secure_features.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,5 +46,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
4646
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
4747
#endif
4848

49+
#ifndef CONFIG_SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE
50+
// Set write-protection for DIS_ICACHE to prevent bricking chip in case it will be set accidentally.
51+
// esp32c3 has DIS_ICACHE. Write-protection bit = 2.
52+
// List of eFuses with the same write protection bit:
53+
// DIS_ICACHE, DIS_USB_JTAG, DIS_DOWNLOAD_ICACHE, DIS_USB_SERIAL_JTAG,
54+
// DIS_FORCE_DOWNLOAD, DIS_TWAI, JTAG_SEL_ENABLE, DIS_PAD_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT.
55+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_ICACHE);
56+
#endif
57+
4958
return ESP_OK;
5059
}

‎components/bootloader_support/src/esp32c6/flash_encryption_secure_features.c

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -46,5 +46,15 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
4646
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
4747
#endif
4848

49+
#ifndef CONFIG_SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE
50+
// Set write-protection for DIS_ICACHE to prevent bricking chip in case it will be set accidentally.
51+
// esp32c6 has DIS_ICACHE. Write-protection bit = 2.
52+
// List of eFuses with the same write protection bit:
53+
// SWAP_UART_SDIO_EN, DIS_ICACHE, DIS_USB_JTAG, DIS_DOWNLOAD_ICACHE,
54+
// DIS_USB_SERIAL_JTAG, DIS_FORCE_DOWNLOAD, DIS_TWAI, JTAG_SEL_ENABLE,
55+
// DIS_PAD_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT.
56+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_ICACHE);
57+
#endif
58+
4959
return ESP_OK;
5060
}

‎components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,5 +39,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
3939
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
4040
#endif
4141

42+
#ifndef CONFIG_SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE
43+
// Set write-protection for DIS_ICACHE to prevent bricking chip in case it will be set accidentally.
44+
// esp32h2 has DIS_ICACHE. Write-protection bit = 2.
45+
// List of eFuses with the same write protection bit:
46+
// DIS_ICACHE, DIS_USB_JTAG, POWERGLITCH_EN, DIS_FORCE_DOWNLOAD, SPI_DOWNLOAD_MSPI_DIS,
47+
// DIS_TWAI, JTAG_SEL_ENABLE, DIS_PAD_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT
48+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_ICACHE);
49+
#endif
50+
4251
return ESP_OK;
4352
}

‎components/bootloader_support/src/esp32h4/flash_encryption_secure_features.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,5 +46,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
4646
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
4747
#endif
4848

49+
#ifndef CONFIG_SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE
50+
// Set write-protection for DIS_ICACHE to prevent bricking chip in case it will be set accidentally.
51+
// esp32h4 has DIS_ICACHE. Write-protection bit = 2.
52+
// List of eFuses with the same write protection bit:
53+
// DIS_ICACHE, DIS_USB_JTAG, POWERGLITCH_EN, DIS_FORCE_DOWNLOAD, SPI_DOWNLOAD_MSPI_DIS,
54+
// DIS_TWAI, JTAG_SEL_ENABLE, DIS_PAD_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT
55+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_ICACHE);
56+
#endif
57+
4958
return ESP_OK;
5059
}

‎components/bootloader_support/src/esp32s2/flash_encryption_secure_features.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,15 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
4747
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
4848
#endif
4949

50+
#ifndef CONFIG_SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE
51+
// Set write-protection for DIS_ICACHE and DIS_DCACHE to prevent bricking chip in case it will be set accidentally.
52+
// esp32s2 has DIS_ICACHE and DIS_DCACHE. Write-protection bit = 2 for both.
53+
// List of eFuses with the same write protection bit:
54+
// DIS_ICACHE, DIS_DCACHE, DIS_DOWNLOAD_ICACHE, DIS_DOWNLOAD_DCACHE,
55+
// DIS_FORCE_DOWNLOAD, DIS_USB, DIS_TWAI, DIS_BOOT_REMAP, SOFT_DIS_JTAG,
56+
// HARD_DIS_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT.
57+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_ICACHE);
58+
#endif
59+
5060
return ESP_OK;
5161
}

‎components/bootloader_support/src/esp32s3/flash_encryption_secure_features.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,15 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
4747
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
4848
#endif
4949

50+
#ifndef CONFIG_SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE
51+
// Set write-protection for DIS_ICACHE and DIS_DCACHE to prevent bricking chip in case it will be set accidentally.
52+
// esp32s3 has DIS_ICACHE and DIS_DCACHE. Write-protection bit = 2 for both.
53+
// List of eFuses with the same write protection bit:
54+
// DIS_ICACHE, DIS_DCACHE, DIS_DOWNLOAD_ICACHE, DIS_DOWNLOAD_DCACHE,
55+
// DIS_FORCE_DOWNLOAD, DIS_USB_OTG, DIS_TWAI, DIS_APP_CPU, DIS_PAD_JTAG,
56+
// DIS_DOWNLOAD_MANUAL_ENCRYPT, DIS_USB_JTAG, DIS_USB_SERIAL_JTAG, STRAP_JTAG_SEL, USB_PHY_SEL.
57+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_ICACHE);
58+
#endif
59+
5060
return ESP_OK;
5161
}

‎components/bootloader_support/src/flash_encrypt.c

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,14 @@ void esp_flash_encryption_set_release_mode(void)
201201
#endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
202202
#endif // !CONFIG_IDF_TARGET_ESP32
203203

204+
#ifdef CONFIG_IDF_TARGET_ESP32
205+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
206+
#else
207+
#if SOC_EFUSE_DIS_ICACHE
208+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_ICACHE);
209+
#endif
210+
#endif // !CONFIG_IDF_TARGET_ESP32
211+
204212
#if CONFIG_SOC_SUPPORTS_SECURE_DL_MODE
205213
esp_efuse_enable_rom_secure_download_mode();
206214
#else
@@ -273,6 +281,12 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
273281
ESP_LOGW(TAG, "Not disabled ROM BASIC interpreter fallback (set CONSOLE_DEBUG_DISABLE->1)");
274282
}
275283

284+
secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
285+
result &= secure;
286+
if (!secure) {
287+
ESP_LOGW(TAG, "Not write-protected DIS_CACHE (set WR_DIS_DIS_CACHE->1)");
288+
}
289+
276290
secure = esp_efuse_read_field_bit(ESP_EFUSE_RD_DIS_BLK1);
277291
result &= secure;
278292
if (!secure) {
@@ -377,6 +391,14 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
377391
}
378392
#endif
379393

394+
#if SOC_EFUSE_DIS_ICACHE
395+
secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_DIS_ICACHE);
396+
result &= secure;
397+
if (!secure) {
398+
ESP_LOGW(TAG, "Not write-protected DIS_ICACHE (set WR_DIS_DIS_ICACHE->1)");
399+
}
400+
#endif
401+
380402
esp_efuse_purpose_t purposes[] = {
381403
#if SOC_FLASH_ENCRYPTION_XTS_AES_256
382404
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1,

‎components/efuse/efuse_table_gen.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -439,7 +439,7 @@ def to_struct(self, debug):
439439
str(self.get_bit_count()) + '}, \t // ' + self.comment])
440440

441441
def get_alt_names(self):
442-
result = re.search(r'\[(.*?)\]', self.comment)
442+
result = re.search(r'^\[(.*?)\]', self.comment)
443443
if result:
444444
return result.group(1).split()
445445
return []

‎components/efuse/esp32/esp_efuse_table.c

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2017-2022 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -9,7 +9,7 @@
99
#include <assert.h>
1010
#include "esp_efuse_table.h"
1111

12-
// md5_digest_table 6256f9b7c6783e0b651bf52b5b162aa8
12+
// md5_digest_table c5ac3aa2d3a97d98ced4f4fccf48c328
1313
// This file was generated from the file esp_efuse_table.csv. DO NOT CHANGE THIS FILE MANUALLY.
1414
// If you want to change some fields, you need to change esp_efuse_table.csv file
1515
// then run `efuse_common_table` or `efuse_custom_table` command it will generate this file.
@@ -99,6 +99,10 @@ static const esp_efuse_desc_t UART_DOWNLOAD_DIS[] = {
9999
{EFUSE_BLK0, 27, 1}, // Disable UART download mode. Valid for ESP32 V3 and newer,
100100
};
101101

102+
static const esp_efuse_desc_t WR_DIS[] = {
103+
{EFUSE_BLK0, 0, 16}, // [] Efuse write disable mask,
104+
};
105+
102106
static const esp_efuse_desc_t WR_DIS_EFUSE_RD_DISABLE[] = {
103107
{EFUSE_BLK0, 0, 1}, // Write protection for EFUSE_RD_DISABLE,
104108
};
@@ -107,6 +111,10 @@ static const esp_efuse_desc_t WR_DIS_FLASH_CRYPT_CNT[] = {
107111
{EFUSE_BLK0, 2, 1}, // Flash encrypt. Write protection FLASH_CRYPT_CNT,
108112
};
109113

114+
static const esp_efuse_desc_t WR_DIS_DIS_CACHE[] = {
115+
{EFUSE_BLK0, 3, 1}, // [] wr_dis of DIS_CACHE,
116+
};
117+
110118
static const esp_efuse_desc_t WR_DIS_BLK1[] = {
111119
{EFUSE_BLK0, 7, 1}, // Flash encrypt. Write protection encryption key. EFUSE_WR_DIS_BLK1,
112120
};
@@ -294,6 +302,11 @@ const esp_efuse_desc_t* ESP_EFUSE_UART_DOWNLOAD_DIS[] = {
294302
NULL
295303
};
296304

305+
const esp_efuse_desc_t* ESP_EFUSE_WR_DIS[] = {
306+
&WR_DIS[0], // [] Efuse write disable mask
307+
NULL
308+
};
309+
297310
const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_EFUSE_RD_DISABLE[] = {
298311
&WR_DIS_EFUSE_RD_DISABLE[0], // Write protection for EFUSE_RD_DISABLE
299312
NULL
@@ -304,6 +317,11 @@ const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_FLASH_CRYPT_CNT[] = {
304317
NULL
305318
};
306319

320+
const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_DIS_CACHE[] = {
321+
&WR_DIS_DIS_CACHE[0], // [] wr_dis of DIS_CACHE
322+
NULL
323+
};
324+
307325
const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_BLK1[] = {
308326
&WR_DIS_BLK1[0], // Flash encrypt. Write protection encryption key. EFUSE_WR_DIS_BLK1
309327
NULL

‎components/efuse/esp32/esp_efuse_table.csv

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,13 @@ UART_DOWNLOAD_DIS, EFUSE_BLK0, 27, 1, Disable UART download mode.
4949

5050
# Write protection #
5151
####################
52-
WR_DIS_EFUSE_RD_DISABLE,EFUSE_BLK0, 0, 1, Write protection for EFUSE_RD_DISABLE
53-
WR_DIS_FLASH_CRYPT_CNT, EFUSE_BLK0, 2, 1, Flash encrypt. Write protection FLASH_CRYPT_CNT, UART_DOWNLOAD_DIS. EFUSE_WR_DIS_FLASH_CRYPT_CNT
54-
WR_DIS_BLK1, EFUSE_BLK0, 7, 1, Flash encrypt. Write protection encryption key. EFUSE_WR_DIS_BLK1
55-
WR_DIS_BLK2, EFUSE_BLK0, 8, 1, Security boot. Write protection security key. EFUSE_WR_DIS_BLK2
56-
WR_DIS_BLK3, EFUSE_BLK0, 9, 1, Write protection for EFUSE_BLK3. EFUSE_WR_DIS_BLK3
52+
WR_DIS, EFUSE_BLK0, 0, 16, [] Efuse write disable mask
53+
WR_DIS.EFUSE_RD_DISABLE,EFUSE_BLK0, 0, 1, Write protection for EFUSE_RD_DISABLE
54+
WR_DIS.FLASH_CRYPT_CNT, EFUSE_BLK0, 2, 1, Flash encrypt. Write protection FLASH_CRYPT_CNT, UART_DOWNLOAD_DIS. EFUSE_WR_DIS_FLASH_CRYPT_CNT
55+
WR_DIS.DIS_CACHE, EFUSE_BLK0, 3, 1, [] wr_dis of DIS_CACHE
56+
WR_DIS.BLK1, EFUSE_BLK0, 7, 1, Flash encrypt. Write protection encryption key. EFUSE_WR_DIS_BLK1
57+
WR_DIS.BLK2, EFUSE_BLK0, 8, 1, Security boot. Write protection security key. EFUSE_WR_DIS_BLK2
58+
WR_DIS.BLK3, EFUSE_BLK0, 9, 1, Write protection for EFUSE_BLK3. EFUSE_WR_DIS_BLK3
5759

5860
# Read protection #
5961
###################

‎components/efuse/esp32/include/esp_efuse_table.h

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2017-2022 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -10,7 +10,7 @@ extern "C" {
1010

1111
#include "esp_efuse.h"
1212

13-
// md5_digest_table 6256f9b7c6783e0b651bf52b5b162aa8
13+
// md5_digest_table c5ac3aa2d3a97d98ced4f4fccf48c328
1414
// This file was generated from the file esp_efuse_table.csv. DO NOT CHANGE THIS FILE MANUALLY.
1515
// If you want to change some fields, you need to change esp_efuse_table.csv file
1616
// then run `efuse_common_table` or `efuse_custom_table` command it will generate this file.
@@ -34,8 +34,10 @@ extern const esp_efuse_desc_t* ESP_EFUSE_FLASH_CRYPT_CNT[];
3434
extern const esp_efuse_desc_t* ESP_EFUSE_DISABLE_JTAG[];
3535
extern const esp_efuse_desc_t* ESP_EFUSE_CONSOLE_DEBUG_DISABLE[];
3636
extern const esp_efuse_desc_t* ESP_EFUSE_UART_DOWNLOAD_DIS[];
37+
extern const esp_efuse_desc_t* ESP_EFUSE_WR_DIS[];
3738
extern const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_EFUSE_RD_DISABLE[];
3839
extern const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_FLASH_CRYPT_CNT[];
40+
extern const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_DIS_CACHE[];
3941
extern const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_BLK1[];
4042
extern const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_BLK2[];
4143
extern const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_BLK3[];

‎components/efuse/esp32c3/esp_efuse_table.c

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2017-2022 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -9,7 +9,7 @@
99
#include <assert.h>
1010
#include "esp_efuse_table.h"
1111

12-
// md5_digest_table d006c80095638b5dbdc8649bf7e04dce
12+
// md5_digest_table 2bf0cfccdc9e055a493d80400a248794
1313
// This file was generated from the file esp_efuse_table.csv. DO NOT CHANGE THIS FILE MANUALLY.
1414
// If you want to change some fields, you need to change esp_efuse_table.csv file
1515
// then run `efuse_common_table` or `efuse_custom_table` command it will generate this file.
@@ -23,6 +23,10 @@ static const esp_efuse_desc_t WR_DIS_RD_DIS[] = {
2323
{EFUSE_BLK0, 0, 1}, // Write protection for RD_DIS_KEY0 RD_DIS_KEY1 RD_DIS_KEY2 RD_DIS_KEY3 RD_DIS_KEY4 RD_DIS_KEY5 RD_DIS_SYS_DATA_PART2,
2424
};
2525

26+
static const esp_efuse_desc_t WR_DIS_DIS_ICACHE[] = {
27+
{EFUSE_BLK0, 2, 1}, // [] wr_dis of DIS_ICACHE,
28+
};
29+
2630
static const esp_efuse_desc_t WR_DIS_GROUP_1[] = {
2731
{EFUSE_BLK0, 2, 1}, // Write protection for DIS_ICACHE DIS_DOWNLOAD_ICACHE DIS_FORCE_DOWNLOAD DIS_USB DIS_CAN SOFT_DIS_JTAG DIS_DOWNLOAD_MANUAL_ENCRYPT,
2832
};
@@ -515,6 +519,11 @@ const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_RD_DIS[] = {
515519
NULL
516520
};
517521

522+
const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_DIS_ICACHE[] = {
523+
&WR_DIS_DIS_ICACHE[0], // [] wr_dis of DIS_ICACHE
524+
NULL
525+
};
526+
518527
const esp_efuse_desc_t* ESP_EFUSE_WR_DIS_GROUP_1[] = {
519528
&WR_DIS_GROUP_1[0], // Write protection for DIS_ICACHE DIS_DOWNLOAD_ICACHE DIS_FORCE_DOWNLOAD DIS_USB DIS_CAN SOFT_DIS_JTAG DIS_DOWNLOAD_MANUAL_ENCRYPT
520529
NULL

‎components/efuse/esp32c3/esp_efuse_table.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
# EFUSE_RD_WR_DIS_REG #
1616
WR_DIS, EFUSE_BLK0, 0, 32, Write protection
1717
WR_DIS.RD_DIS, EFUSE_BLK0, 0, 1, Write protection for RD_DIS_KEY0 RD_DIS_KEY1 RD_DIS_KEY2 RD_DIS_KEY3 RD_DIS_KEY4 RD_DIS_KEY5 RD_DIS_SYS_DATA_PART2
18+
WR_DIS.DIS_ICACHE, EFUSE_BLK0, 2, 1, [] wr_dis of DIS_ICACHE
1819
WR_DIS.GROUP_1, EFUSE_BLK0, 2, 1, Write protection for DIS_ICACHE DIS_DOWNLOAD_ICACHE DIS_FORCE_DOWNLOAD DIS_USB DIS_CAN SOFT_DIS_JTAG DIS_DOWNLOAD_MANUAL_ENCRYPT
1920
WR_DIS.GROUP_2, EFUSE_BLK0, 3, 1, Write protection for WDT_DELAY_SEL
2021
WR_DIS.SPI_BOOT_CRYPT_CNT, EFUSE_BLK0, 4, 1, Write protection for SPI_BOOT_CRYPT_CNT

0 commit comments

Comments
 (0)