feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

Merge branch 'fix/disallow_enabling_sb_sha384_when_sb_sha256_is_enabled_p4' into 'master'

Browse Source 
fix(efuse): Disallow enabling SB using SHA-384 when SB using SHA-256 is enabled (ESP32-P4 ECO5)

Closes IDF-14063

See merge request espressif/esp-idf!42884
This commit is contained in:
Mahavir Jain
2025-11-11 17:11:47 +05:30
parent 1611f123a7 3090e91e60
commit 619cbb85b3
8 changed files with 33 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader/Kconfig.projbuild
+1 -1
View File
@@ -974,7 +974,7 @@ menu "Security features"
config SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA
bool "Skip write-protection of SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH"
default y if SECURE_FLASH_PSEUDO_ROUND_FUNC
default y if SECURE_FLASH_PSEUDO_ROUND_FUNC && !SECURE_FLASH_ENCRYPTION_MODE_RELEASE
default n
depends on SOC_ECDSA_SUPPORT_CURVE_P384 && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
help
components/efuse/esp32h4/esp_efuse_table.c
+5 -5
View File
@@ -9,7 +9,7 @@
#include <assert.h>
#include "esp_efuse_table.h"
// md5_digest_table 39c442690c2273d557b5bb0db99fbe04
// md5_digest_table 00c61e1122b40bab1153117e162a713c
// This file was generated from the file esp_efuse_table.csv. DO NOT CHANGE THIS FILE MANUALLY.
// If you want to change some fields, you need to change esp_efuse_table.csv file
// then run `efuse_common_table` or `efuse_custom_table` command it will generate this file.
@@ -407,8 +407,8 @@ static const esp_efuse_desc_t ECC_FORCE_CONST_TIME[] = {
{EFUSE_BLK0, 99, 1}, // [] Represents whether to force ecc to use const-time calculation mode. 1: Enable. 0: Disable,
};
static const esp_efuse_desc_t ECDSA_P384_ENABLE[] = {
{EFUSE_BLK0, 100, 1}, // [] Represents if the chip supports ECDSA P384,
static const esp_efuse_desc_t SECURE_BOOT_SHA384_EN[] = {
{EFUSE_BLK0, 100, 1}, // [] Represents if the chip supports Secure Boot using SHA-384,
};
static const esp_efuse_desc_t SECURE_BOOT_EN[] = {
@@ -1099,8 +1099,8 @@ const esp_efuse_desc_t* ESP_EFUSE_ECC_FORCE_CONST_TIME[] = {
NULL
};
const esp_efuse_desc_t* ESP_EFUSE_ECDSA_P384_ENABLE[] = {
&ECDSA_P384_ENABLE[0], // [] Represents if the chip supports ECDSA P384
const esp_efuse_desc_t* ESP_EFUSE_SECURE_BOOT_SHA384_EN[] = {
&SECURE_BOOT_SHA384_EN[0], // [] Represents if the chip supports Secure Boot using SHA-384
NULL
};
components/efuse/esp32h4/esp_efuse_table.csv
+1 -1
View File
@@ -109,7 +109,7 @@ SEC_DPA_LEVEL, EFUSE_BLK0, 94, 2, [] Repres
XTS_DPA_PSEUDO_LEVEL, EFUSE_BLK0, 96, 2, [] Represents the pseudo round level of xts-aes anti-dpa attack. 3: High. 2: Moderate 1. Low 0: Disabled
XTS_DPA_CLK_ENABLE, EFUSE_BLK0, 98, 1, [] Represents whether xts-aes anti-dpa attack clock is enabled. 1. Enable. 0: Disable.
ECC_FORCE_CONST_TIME, EFUSE_BLK0, 99, 1, [] Represents whether to force ecc to use const-time calculation mode. 1: Enable. 0: Disable
ECDSA_P384_ENABLE, EFUSE_BLK0, 100, 1, [] Represents if the chip supports ECDSA P384
SECURE_BOOT_SHA384_EN, EFUSE_BLK0, 100, 1, [] Represents if the chip supports Secure Boot using SHA-384
SECURE_BOOT_EN, EFUSE_BLK0, 101, 1, [] Represents whether secure boot is enabled or disabled. 1: enabled 0: disabled
SECURE_BOOT_AGGRESSIVE_REVOKE, EFUSE_BLK0, 102, 1, [] Represents whether revoking aggressive secure boot is enabled or disabled. 1: enabled. 0: disabled
KM_DISABLE_DEPLOY_MODE, EFUSE_BLK0, 103, 5, [] Represents whether the new key deployment of key manager is disabled. Bit0: Represents whether the new ECDSA key deployment is disabled0: Enabled1: DisabledBit1: Represents whether the new XTS-AES (flash and PSRAM) key deployment is disabled0: Enabled1: DisabledBit2: Represents whether the new HMAC key deployment is disabled0: Enabled1: DisabledBit3: Represents whether the new DS key deployment is disabled0: Enabled1: Disabled
Can't render this file because it contains an unexpected character in line 8 and column 53.
components/efuse/esp32h4/include/esp_efuse_table.h
+2 -2
View File
@@ -10,7 +10,7 @@ extern "C" {
#include "esp_efuse.h"
// md5_digest_table 39c442690c2273d557b5bb0db99fbe04
// md5_digest_table 00c61e1122b40bab1153117e162a713c
// This file was generated from the file esp_efuse_table.csv. DO NOT CHANGE THIS FILE MANUALLY.
// If you want to change some fields, you need to change esp_efuse_table.csv file
// then run `efuse_common_table` or `efuse_custom_table` command it will generate this file.
@@ -145,7 +145,7 @@ extern const esp_efuse_desc_t* ESP_EFUSE_SEC_DPA_LEVEL[];
extern const esp_efuse_desc_t* ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[];
extern const esp_efuse_desc_t* ESP_EFUSE_XTS_DPA_CLK_ENABLE[];
extern const esp_efuse_desc_t* ESP_EFUSE_ECC_FORCE_CONST_TIME[];
extern const esp_efuse_desc_t* ESP_EFUSE_ECDSA_P384_ENABLE[];
extern const esp_efuse_desc_t* ESP_EFUSE_SECURE_BOOT_SHA384_EN[];
extern const esp_efuse_desc_t* ESP_EFUSE_SECURE_BOOT_EN[];
extern const esp_efuse_desc_t* ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE[];
extern const esp_efuse_desc_t* ESP_EFUSE_KM_DISABLE_DEPLOY_MODE[];
components/esp_security/src/init.c
+5 -2
View File
@@ -94,7 +94,7 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
#if CONFIG_SECURE_BOOT_V2_ENABLED
// H2, H21
#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
// Also write protects the ECDSA_CURVE_MODE efuse bit.
// Also write protects the ECC_FORCE_CONST_TIME efuse bit.
if (ecdsa_ll_is_configurable_curve_supported()) {
err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
if (err != ESP_OK) {
@@ -106,10 +106,13 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
#if !CONFIG_SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA
// C5
#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS && !CONFIG_IDF_TARGET_ESP32P4
// Since SECURE_BOOT_SHA384_EN, XTS_DPA_PSEUDO_LEVEL, and ECC_FORCE_CONST_TIME share the
// same write-protection bit, these efuses should only be write-protected after all of
// them have been programmed.
// Note: ESP32-P4 lacks WR_DIS_SECURE_BOOT_SHA384_EN bit, so it relies on software protection
// in the efuse write APIs (see esp_efuse_api.c) to prevent unauthorized programming of
// SECURE_BOOT_SHA384_EN when Secure Boot using SHA-256 is enabled.
err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to write protect the SECURE_BOOT_SHA384_EN efuse bit.");
components/soc/esp32c5/register/soc/efuse_reg.h
+1 -1
View File
@@ -726,7 +726,7 @@ extern "C" {
#define EFUSE_RD_RESERVE_0_158_M (EFUSE_RD_RESERVE_0_158_V << EFUSE_RD_RESERVE_0_158_S)
#define EFUSE_RD_RESERVE_0_158_V 0x00000001U
#define EFUSE_RD_RESERVE_0_158_S 30
/** EFUSE_ECDSA_P384_ENABLE : RO; bitpos: [31]; default: 0;
/** EFUSE_SECURE_BOOT_SHA384_EN : RO; bitpos: [31]; default: 0;
* Represents if the chip supports Secure Boot using SHA-384
*/
#define EFUSE_SECURE_BOOT_SHA384_EN (BIT(31))
components/soc/esp32h4/register/soc/efuse_reg.h
+12 -12
View File
@@ -399,13 +399,13 @@ extern "C" {
#define EFUSE_ECC_FORCE_CONST_TIME_M (EFUSE_ECC_FORCE_CONST_TIME_V << EFUSE_ECC_FORCE_CONST_TIME_S)
#define EFUSE_ECC_FORCE_CONST_TIME_V 0x00000001U
#define EFUSE_ECC_FORCE_CONST_TIME_S 3
/** EFUSE_ECDSA_P384_ENABLE : RO; bitpos: [4]; default: 0;
* Represents if the chip supports ECDSA P384
/** EFUSE_SECURE_BOOT_SHA384_EN : RO; bitpos: [4]; default: 0;
* Represents if the chip supports Secure Boot using SHA-384
*/
#define EFUSE_ECDSA_P384_ENABLE (BIT(4))
#define EFUSE_ECDSA_P384_ENABLE_M (EFUSE_ECDSA_P384_ENABLE_V << EFUSE_ECDSA_P384_ENABLE_S)
#define EFUSE_ECDSA_P384_ENABLE_V 0x00000001U
#define EFUSE_ECDSA_P384_ENABLE_S 4
#define EFUSE_SECURE_BOOT_SHA384_EN (BIT(4))
#define EFUSE_SECURE_BOOT_SHA384_EN_M (EFUSE_SECURE_BOOT_SHA384_EN_V << EFUSE_SECURE_BOOT_SHA384_EN_S)
#define EFUSE_SECURE_BOOT_SHA384_EN_V 0x00000001U
#define EFUSE_SECURE_BOOT_SHA384_EN_S 4
/** EFUSE_SECURE_BOOT_EN : RO; bitpos: [5]; default: 0;
* Represents whether secure boot is enabled or disabled.
* 1: enabled
@@ -1935,13 +1935,13 @@ extern "C" {
#define EFUSE_ECC_FORCE_CONST_TIME_ERR_M (EFUSE_ECC_FORCE_CONST_TIME_ERR_V << EFUSE_ECC_FORCE_CONST_TIME_ERR_S)
#define EFUSE_ECC_FORCE_CONST_TIME_ERR_V 0x00000001U
#define EFUSE_ECC_FORCE_CONST_TIME_ERR_S 3
/** EFUSE_ECDSA_P384_ENABLE_ERR : RO; bitpos: [4]; default: 0;
* Represents the programming error of EFUSE_ECDSA_P384_ENABLE
/** EFUSE_SECURE_BOOT_SHA384_EN_ERR : RO; bitpos: [4]; default: 0;
* Represents the programming error of EFUSE_SECURE_BOOT_SHA384_EN
*/
#define EFUSE_ECDSA_P384_ENABLE_ERR (BIT(4))
#define EFUSE_ECDSA_P384_ENABLE_ERR_M (EFUSE_ECDSA_P384_ENABLE_ERR_V << EFUSE_ECDSA_P384_ENABLE_ERR_S)
#define EFUSE_ECDSA_P384_ENABLE_ERR_V 0x00000001U
#define EFUSE_ECDSA_P384_ENABLE_ERR_S 4
#define EFUSE_SECURE_BOOT_SHA384_EN_ERR (BIT(4))
#define EFUSE_SECURE_BOOT_SHA384_EN_ERR_M (EFUSE_SECURE_BOOT_SHA384_EN_ERR_V << EFUSE_SECURE_BOOT_SHA384_EN_ERR_S)
#define EFUSE_SECURE_BOOT_SHA384_EN_ERR_V 0x00000001U
#define EFUSE_SECURE_BOOT_SHA384_EN_ERR_S 4
/** EFUSE_SECURE_BOOT_EN_ERR : RO; bitpos: [5]; default: 0;
* Represents the programming error of EFUSE_SECURE_BOOT_EN
*/
components/soc/esp32h4/register/soc/efuse_struct.h
+6 -6
View File
@@ -229,10 +229,10 @@ typedef union {
* 0: Disable.
*/
uint32_t ecc_force_const_time:1;
/** ecdsa_p384_enable : RO; bitpos: [4]; default: 0;
* Represents if the chip supports ECDSA P384
/** secure_boot_sha384_en : RO; bitpos: [4]; default: 0;
* Represents if the chip supports Secure Boot using SHA-384
*/
uint32_t ecdsa_p384_enable:1;
uint32_t secure_boot_sha384_en:1;
/** secure_boot_en : RO; bitpos: [5]; default: 0;
* Represents whether secure boot is enabled or disabled.
* 1: enabled
@@ -873,10 +873,10 @@ typedef union {
* Represents the programming error of EFUSE_ECC_FORCE_CONST_TIME
*/
uint32_t ecc_force_const_time_err:1;
/** ecdsa_p384_enable_err : RO; bitpos: [4]; default: 0;
* Represents the programming error of EFUSE_ECDSA_P384_ENABLE
/** secure_boot_sha384_en_err : RO; bitpos: [4]; default: 0;
* Represents the programming error of EFUSE_secure_boot_sha384_en
*/
uint32_t ecdsa_p384_enable_err:1;
uint32_t secure_boot_sha384_en_err:1;
/** secure_boot_en_err : RO; bitpos: [5]; default: 0;
* Represents the programming error of EFUSE_SECURE_BOOT_EN
*/