rafaelcaricio/mch2022-talktopics
1
0
Fork 0
forked from mirrors/mch2022-template-app
Code Issues Pull requests Projects Releases Wiki Activity

Add efuse protection function

Browse source
This commit is contained in:
Renze Nicolai 2022-05-12 22:41:31 +02:00
parent ccae27506e
commit 0986203a68
16 changed files with 52 additions and 1674 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
components/mch2022-efuse/CMakeLists.txt Normal file
View file

@ -0,0 +1,6 @@
idf_component_register(
SRCS "esp_efuse_custom_table.c" "efuse.c"
INCLUDE_DIRS "."
"include"
REQUIRES "spi_flash"
)

37
efuse/main/main.c → components/mch2022-efuse/efuse.c
View file

@ -8,7 +8,38 @@
#include "esp_efuse_table.h"
#include "esp_efuse_custom_table.h"
void print_state() {
static const char *TAG = "efuse";
void halt(const char* reason) {
ESP_LOGE(TAG, "Failed efuse write operation: %s", reason);
while (true) {
vTaskDelay(1000 / portTICK_PERIOD_MS);
}
}
void efuse_protect() {
// XPD settings
if (esp_efuse_write_field_bit(ESP_EFUSE_XPD_SDIO_REG) != ESP_OK) halt("XPD_SDIO_REG"); // Enable the VDD_SDIO voltage regulator
if (esp_efuse_write_field_bit(ESP_EFUSE_SDIO_TIEH) != ESP_OK) halt("SDIO_TIEH"); // Set VDD_SDIO voltage regulator output to 3.3v
if (esp_efuse_write_field_bit(ESP_EFUSE_SDIO_FORCE) != ESP_OK) halt("SDIO_FORCE"); // Enable VDD_SDIO efuse override
// Debug settings
if (esp_efuse_write_field_bit(ESP_EFUSE_CONSOLE_DEBUG_DISABLE) != ESP_OK) halt("CONSOLE_DEBUG_DISABLE"); // Disable BASIC ROM console
// Write protect
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_FLASH_CRYPT_CNT) != ESP_OK) halt("WR_DIS_FLASH_CRYPT_CNT"); // Prevent disabling UART download mode
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_MAC_AND_CHIP_INFO) != ESP_OK) halt("WR_DIS_MAC_AND_CHIP_INFO"); // Prevent writing to MAC address fuses
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_XPD) != ESP_OK) halt("WR_DIS_XPD"); // Write protect XPD settings
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SPI_PAD) != ESP_OK) halt("WR_DIS_SPI_PAD"); // Pin mapping for SPI flash and PSRAM
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SCHEME_KEY_CRYPT) != ESP_OK) halt("WR_DIS_SCHEME_KEY_CRYPT"); // Disable flash encryption
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ABS_DONE_0) != ESP_OK) halt("WR_DIS_ABS_DONE_0"); // Disable secure boot V1
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ABS_DONE_1) != ESP_OK) halt("WR_DIS_ABS_DONE_1"); // Disable secure boot V2
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_CONSOLE_DEBUG_AND_DISABLE_DL_CRYPT) != ESP_OK) halt("WR_DIS_CONSOLE_DEBUG_AND_DISABLE_DL_CRYPT"); // Write protect download mode functions
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_BLK3) != ESP_OK) halt("WR_DIS_BLK3"); // Write protect block 3 (to prevent changing MAC version)
if (esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_EFUSE_RD_DISABLE) != ESP_OK) halt("WR_DIS_EFUSE_RD_DISABLE"); // Write protect read disable and ADC vref
}
void efuse_print_state() {
esp_chip_info_t chip_info;
esp_chip_info(&chip_info);
uint8_t mac_address[6];
@ -72,7 +103,3 @@ void print_state() {
printf("Read disabled for EFUSE block 3: %s\n", rd_blk3 ? "yes" : "no");
fflush(stdout);
}
void app_main(void) {
print_state();
}

0
efuse/main/esp_efuse_custom_table.c → components/mch2022-efuse/esp_efuse_custom_table.c
View file

0
efuse/main/esp_efuse_custom_table.csv → components/mch2022-efuse/esp_efuse_custom_table.csv
View file

Can't render this file because it contains an unexpected character in line 1 and column 53.

4
components/mch2022-efuse/include/efuse.h Normal file
View file

@ -0,0 +1,4 @@
#pragma once
void efuse_print_state();
void efuse_protect();

0
efuse/main/include/esp_efuse_custom_table.h → components/mch2022-efuse/include/esp_efuse_custom_table.h
View file

2
efuse/.gitignore vendored
View file

@ -1,2 +0,0 @@
sdkconfig.old
build

6
efuse/CMakeLists.txt
View file

@ -1,6 +0,0 @@
# The following lines of boilerplate have to be in your project's
# CMakeLists in this exact order for cmake to work correctly
cmake_minimum_required(VERSION 3.5)
include($ENV{IDF_PATH}/tools/cmake/project.cmake)
project(appfs-test)

8
efuse/Makefile
View file

@ -1,8 +0,0 @@
#
# This is a project Makefile. It is assumed the directory this Makefile resides in is a
# project subdirectory.
#
PROJECT_NAME := hello-world
include $(IDF_PATH)/make/project.mk

39
efuse/burn.sh
View file

@ -1,39 +0,0 @@
#!/bin/bash
set -e # Exit script on error
if [ "$#" -ne 1 ]; then
echo "Usage: $0 <port>"
exit 1
fi
PORT=$1
echo "Burning e-fuses for MCH2022 badge on port $PORT..."
# Set the flash/psram voltage to 3.3V
espefuse.py --port $PORT --do-not-confirm set_flash_voltage 3.3V # Ignore GPIO12 (MTDI) and force flash/psram voltage (using XPD efuses)
# Write protect the basic system settings
espefuse.py --port $PORT --do-not-confirm write_protect_efuse MAC # Disables writing to MAC, MAC_CRC, CIP_VER_REV1, CHIP_VERSION, CHIP_PACKAGE fuses
espefuse.py --port $PORT --do-not-confirm write_protect_efuse CODING_SCHEME # Disables writing to CODING_SCHEME, KEY_STATUS, FLASH_CRYPT_CONFIG, BLK3_PART_RESERVE
# Write protect the XPD fuses
espefuse.py --port $PORT --do-not-confirm write_protect_efuse XPD_SDIO_FORCE # Disables writing to XPD_SDIO_FORCE, XPD_SDIO_REG and XPD_SDIO_TIEH
# Write protect the SPI pad fuses
espefuse.py --port $PORT --do-not-confirm write_protect_efuse SPI_PAD_CONFIG_CLK # Disables writing to CHIP_VER_REV2 and all SPI_PAD_CONFIG_X fuses
# Write protect the JTAG disable fuse (don't allow people to disable JTAG)
espefuse.py --port $PORT --do-not-confirm write_protect_efuse JTAG_DISABLE
# Disable the BASIC ROM console (it causes problems with waking up from deep sleep)
espefuse.py --port $PORT --do-not-confirm burn_efuse CONSOLE_DEBUG_DISABLE
# Write protect the download mode disable efuse
espefuse.py --port $PORT --do-not-confirm write_protect_efuse UART_DOWNLOAD_DIS # Disables writing to FLASH_CRYPT_CNT, UART_DOWNLOAD_DIS and EFUSE_WR_DIS_FLASH_CRYPT_CNT
# Write protect the secure boot fuses (don't allow people to enable secure boot)
espefuse.py --port $PORT --do-not-confirm write_protect_efuse DISABLE_DL_ENCRYPT # Disables writing to CONSOLE_DEBUG_DISABLE, DISABLE_DL_ENCRYPT, DISABLE_DL_DECRYPT and DISABLE_DL_CACHE
espefuse.py --port $PORT --do-not-confirm write_protect_efuse ABS_DONE_0
espefuse.py --port $PORT --do-not-confirm write_protect_efuse ABS_DONE_1

6
efuse/main/CMakeLists.txt
View file

@ -1,6 +0,0 @@
idf_component_register(
SRCS "main.c"
"esp_efuse_custom_table.c"
INCLUDE_DIRS "."
"include"
)

4
efuse/main/component.mk
View file

@ -1,4 +0,0 @@
#
# "main" pseudo-component makefile.
#
# (Uses default behaviour of compiling all source files in directory, adding 'include' to include path.)

7
efuse/partitions.csv
View file

@ -1,7 +0,0 @@
# Name, Type, SubType, Offset, Size, Flags
nvs, data, nvs, 0x9000, 0x4000
otadata, data, ota, 0xd000, 0x2000
phy_init, data, phy, 0xf000, 0x1000
ota_0, 0, ota_0, 0x10000, 1856K
ota_1, 0, ota_1, , 1856K
locfd, data, fat, , 12608K
1 # Name, Type, SubType, Offset, Size, Flags
2 nvs, data, nvs, 0x9000, 0x4000
3 otadata, data, ota, 0xd000, 0x2000
4 phy_init, data, phy, 0xf000, 0x1000
5 ota_0, 0, ota_0, 0x10000, 1856K
6 ota_1, 0, ota_1, , 1856K
7 locfd, data, fat, , 12608K

1581
efuse/sdkconfig
View file

File diff suppressed because it is too large Load diff

16
main/esp_efuse_custom_table.csv
View file

@ -1,16 +0,0 @@
# After editing this file, run the command manually "make efuse_custom_table" or "idf.py efuse_custom_table"
# WR_DIS_EFUSE_RD_DISABLE, EFUSE_BLK0, 0, 1, Write protection for RD_DIS, ADC_VREF
WR_DIS_WR_DIS, EFUSE_BLK0, 1, 1, Write protection for WR_DIS
# WR_DIS_FLASH_CRYPT_CNT, EFUSE_BLK0, 2, 1, Write protection for FLASH_CRYPT_CNT, UART_DOWNLOAD_DIS
WR_DIS_MAC_AND_CHIP_INFO, EFUSE_BLK0, 3, 1, Write protection for MAC, MAC_CRC, CIP_VER_REV1, CHIP_VERSION, CHIP_PACKAGE
WR_DIS_XPD, EFUSE_BLK0, 5, 1, Write protection for XPD_SDIO_FORCE, XPD_SDIO_REG, XPD_SDIO_TIEH
WR_DIS_SPI_PAD, EFUSE_BLK0, 6, 1, Write protection for CHIP_VER_REV2, SPI_PAD_CONFIG
# WR_DIS_BLK1, EFUSE_BLK0, 7, 1, Write protection for WR_DIS_BLK1
# WR_DIS_BLK2, EFUSE_BLK0, 8, 1, Write protection for WR_DIS_BLK2
# WR_DIS_BLK3, EFUSE_BLK0, 9, 1, Write protection for WR_DIS_BLK3, MAC_VERSION
WR_DIS_SCHEME_KEY_CRYPT, EFUSE_BLK0, 10, 1, Write protection for CODING_SCHEME, KEY_STATUS, FLASH_CRYPT_CONFIG, BLK3_PART_RESERVE
WR_DIS_ABS_DONE_0, EFUSE_BLK0, 12, 1, Write protection for ABS_DONE_0
WR_DIS_ABS_DONE_1, EFUSE_BLK0, 13, 1, Write protection for ABS_DONE_1
WR_DIS_JTAG_DISABLE, EFUSE_BLK0, 14, 1, Write protection for JTAG_DISABLE
WR_DIS_CONSOLE_DEBUG_AND_DISABLE_DL_CRYPT, EFUSE_BLK0, 15, 1, Write protection for CONSOLE_DEBUG_DISABLE, DISABLE_DL
Can't render this file because it contains an unexpected character in line 1 and column 53.

10
main/main.c
View file

@ -33,6 +33,8 @@
#include "esp32/rom/crc.h"
#include "efuse.h"
static const char *TAG = "main";
typedef enum action {
@ -282,6 +284,8 @@ void app_main(void) {
/* Initialize hardware */
efuse_protect();
bool lcdReady = false;
res = board_init(&lcdReady);
@ -299,6 +303,7 @@ void app_main(void) {
BNO055* bno055 = get_bno055();
RP2040* rp2040 = get_rp2040();
/* Start AppFS */
graphics_task(pax_buffer, ili9341, framebuffer, NULL, "AppFS init...");
res = appfs_init();
if (res != ESP_OK) {
@ -308,6 +313,7 @@ void app_main(void) {
}
ESP_LOGI(TAG, "AppFS initialized");
/* Start NVS */
graphics_task(pax_buffer, ili9341, framebuffer, NULL, "NVS init...");
res = nvs_init();
if (res != ESP_OK) {
@ -317,6 +323,7 @@ void app_main(void) {
}
ESP_LOGI(TAG, "NVS initialized");
/* Start SD card */
graphics_task(pax_buffer, ili9341, framebuffer, NULL, "Mount SD card...");
res = mount_sd(SD_CMD, SD_CLK, SD_D0, SD_PWR, "/sd", false, 5);
bool sdcard_ready = (res == ESP_OK);
@ -325,12 +332,15 @@ void app_main(void) {
graphics_task(pax_buffer, ili9341, framebuffer, NULL, "SD card mounted");
}
/* Start LEDs */
ws2812_init(GPIO_LED_DATA);
uint8_t ledBuffer[15] = {50, 0, 0, 50, 0, 0, 50, 0, 0, 50, 0, 0, 50, 0, 0};
ws2812_send_data(ledBuffer, sizeof(ledBuffer));
/* Start RP2040 firmware update check */
rp2040_updater(rp2040, pax_buffer, ili9341, framebuffer);
/* Launcher menu */
while (true) {
menu_action_t menu_action;
appfs_handle_t appfs_fd;