Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

change(bootloader): honor SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS during first boot

Browse Source 
Previously the bootloader unconditionally revoked unused secure boot key
digest slots while permanently enabling secure boot on the first boot,
ignoring CONFIG_SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS. Now the config is
honored on this path too: when set, the unused digest slots are left
un-revoked. This is safe as long as the debug and download interfaces are
disabled.

Update the Kconfig help and the Secure Boot v2 guide (en and zh_CN)
accordingly.
This commit is contained in:
Mahavir Jain
2026-06-16 13:29:49 +05:30
parent 4e09adff8d
commit b08669af99
4 changed files with 8 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader_support/src/secure_boot_v2/secure_boot.c
+4
View File
@@ -347,8 +347,12 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
if (boot_key_digests.num_digests < SECURE_BOOT_NUM_BLOCKS) {
/* The revocation index can be 0, 1, 2. Bootloader count can be 1,2,3. */
for (unsigned i = boot_key_digests.num_digests; i < SECURE_BOOT_NUM_BLOCKS; i++) {
#ifndef CONFIG_SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS
ESP_LOGI(TAG, "Revoking empty key digest slot (%d)...", i);
esp_efuse_set_digest_revoke(i);
#else
ESP_LOGW(TAG, "Unused key digest slot (%d) left un-revoked due to the config SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS", i);
#endif
}
}
#endif // SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS