feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

Merge branch 'fix/enable_pseudo_round_func_in_flash_enc_release_mode' into 'master'

Browse Source 
fix(bootloader_support): Enable pseudo round function hen flash encryption release mode is enabled for H2-ECO5

See merge request espressif/esp-idf!36523
This commit is contained in:
Mahavir Jain
2025-01-23 17:16:32 +08:00
parent 893e3269d0 f6be421a48
commit 706b5e44d3
13 changed files with 54 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
View File

@@ -1,15 +1,18 @@
/* /*
* SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
#include <stdint.h>
#include <strings.h> #include <strings.h>
#include "esp_flash_encrypt.h" #include "esp_flash_encrypt.h"
#include "esp_secure_boot.h" #include "esp_secure_boot.h"
#include "esp_efuse.h" #include "esp_efuse.h"
#include "esp_efuse_table.h" #include "esp_efuse_table.h"
#include "esp_log.h" #include "esp_log.h"
#include "hal/spi_flash_encrypted_ll.h"
#include "soc/soc_caps.h"
#include "sdkconfig.h" #include "sdkconfig.h"
static __attribute__((unused)) const char *TAG = "flash_encrypt"; static __attribute__((unused)) const char *TAG = "flash_encrypt";
@@ -33,6 +36,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT); esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND)
if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
}
#endif
#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS) #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
// This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
// otherwise the Flash Encryption key cannot be read protected // otherwise the Flash Encryption key cannot be read protected

7
components/bootloader_support/src/flash_encrypt.c
View File

@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -12,6 +12,7 @@
#include "esp_flash_encrypt.h" #include "esp_flash_encrypt.h"
#include "esp_secure_boot.h" #include "esp_secure_boot.h"
#include "hal/efuse_hal.h" #include "hal/efuse_hal.h"
#include "hal/spi_flash_encrypted_ll.h"
#include "hal/spi_flash_encrypt_hal.h" #include "hal/spi_flash_encrypt_hal.h"
#include "soc/soc_caps.h" #include "soc/soc_caps.h"
@@ -210,8 +211,10 @@ void esp_flash_encryption_set_release_mode(void)
#endif // !CONFIG_IDF_TARGET_ESP32 #endif // !CONFIG_IDF_TARGET_ESP32
#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND #ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
uint8_t xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW; uint8_t xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW;
esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count); esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
}
#endif #endif
#ifdef CONFIG_IDF_TARGET_ESP32 #ifdef CONFIG_IDF_TARGET_ESP32
@@ -476,12 +479,14 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
result &= secure; result &= secure;
#if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND #if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
uint8_t xts_pseudo_level = 0; uint8_t xts_pseudo_level = 0;
esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count); esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
if (!xts_pseudo_level) { if (!xts_pseudo_level) {
result &= false; result &= false;
ESP_LOGW(TAG, "Not enabled XTS-AES pseudo rounds function (set XTS_DPA_PSEUDO_LEVEL->1 or more)"); ESP_LOGW(TAG, "Not enabled XTS-AES pseudo rounds function (set XTS_DPA_PSEUDO_LEVEL->1 or more)");
} }
}
#endif #endif
return result; return result;

1
components/hal/esp32/include/hal/spi_flash_encrypted_ll.h
View File

@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include "soc/dport_reg.h" #include "soc/dport_reg.h"
#include "soc/flash_encryption_reg.h" #include "soc/flash_encryption_reg.h"

7
components/hal/esp32c2/include/hal/spi_flash_encrypted_ll.h
View File

@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>
@@ -24,7 +25,7 @@
extern "C" { extern "C" {
#endif #endif
/// Choose type of chip you want to encrypt manully /// Choose type of chip you want to encrypt manually
typedef enum typedef enum
{ {
FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip. FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip.
@@ -51,7 +52,7 @@ static inline void spi_flash_encrypt_ll_disable(void)
} }
/** /**
* Choose type of chip you want to encrypt manully * Choose type of chip you want to encrypt manually
* *
* @param type The type of chip to be encrypted * @param type The type of chip to be encrypted
* *

7
components/hal/esp32c3/include/hal/spi_flash_encrypted_ll.h
View File

@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>
@@ -24,7 +25,7 @@
extern "C" { extern "C" {
#endif #endif
/// Choose type of chip you want to encrypt manully /// Choose type of chip you want to encrypt manually
typedef enum typedef enum
{ {
FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip. FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip.
@@ -51,7 +52,7 @@ static inline void spi_flash_encrypt_ll_disable(void)
} }
/** /**
* Choose type of chip you want to encrypt manully * Choose type of chip you want to encrypt manually
* *
* @param type The type of chip to be encrypted * @param type The type of chip to be encrypted
* *

1
components/hal/esp32c5/include/hal/spi_flash_encrypted_ll.h
View File

@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>

7
components/hal/esp32c6/include/hal/spi_flash_encrypted_ll.h
View File

@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>
@@ -24,7 +25,7 @@
extern "C" { extern "C" {
#endif #endif
/// Choose type of chip you want to encrypt manully /// Choose type of chip you want to encrypt manually
typedef enum typedef enum
{ {
FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip. FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip.
@@ -51,7 +52,7 @@ static inline void spi_flash_encrypt_ll_disable(void)
} }
/** /**
* Choose type of chip you want to encrypt manully * Choose type of chip you want to encrypt manually
* *
* @param type The type of chip to be encrypted * @param type The type of chip to be encrypted
* *

1
components/hal/esp32c61/include/hal/spi_flash_encrypted_ll.h
View File

@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>

1
components/hal/esp32h2/include/hal/spi_flash_encrypted_ll.h
View File

@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>

1
components/hal/esp32h21/include/hal/spi_flash_encrypted_ll.h
View File

@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>

7
components/hal/esp32p4/include/hal/spi_flash_encrypted_ll.h
View File

@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>
@@ -24,7 +25,7 @@
extern "C" { extern "C" {
#endif #endif
/// Choose type of chip you want to encrypt manully /// Choose type of chip you want to encrypt manually
typedef enum typedef enum
{ {
FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip. FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip.
@@ -51,7 +52,7 @@ static inline void spi_flash_encrypt_ll_disable(void)
} }
/** /**
* Choose type of chip you want to encrypt manully * Choose type of chip you want to encrypt manually
* *
* @param type The type of chip to be encrypted * @param type The type of chip to be encrypted
* *

7
components/hal/esp32s2/include/hal/spi_flash_encrypted_ll.h
View File

@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>
@@ -24,7 +25,7 @@
extern "C" { extern "C" {
#endif #endif
/// Choose type of chip you want to encrypt manully /// Choose type of chip you want to encrypt manually
typedef enum typedef enum
{ {
FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip. FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip.
@@ -61,7 +62,7 @@ static inline void spi_flash_encrypt_ll_disable(void)
} }
/** /**
* Choose type of chip you want to encrypt manully * Choose type of chip you want to encrypt manually
* *
* @param type The type of chip to be encrypted * @param type The type of chip to be encrypted
* *

7
components/hal/esp32s3/include/hal/spi_flash_encrypted_ll.h
View File

@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -11,6 +11,7 @@
******************************************************************************/ ******************************************************************************/
// The Lowlevel layer for SPI Flash Encryption. // The Lowlevel layer for SPI Flash Encryption.
#pragma once
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>
@@ -24,7 +25,7 @@
extern "C" { extern "C" {
#endif #endif
/// Choose type of chip you want to encrypt manully /// Choose type of chip you want to encrypt manually
typedef enum typedef enum
{ {
FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip. FLASH_ENCRYPTION_MANU = 0, ///!< Manually encrypt the flash chip.
@@ -51,7 +52,7 @@ static inline void spi_flash_encrypt_ll_disable(void)
} }
/** /**
* Choose type of chip you want to encrypt manully * Choose type of chip you want to encrypt manually
* *
* @param type The type of chip to be encrypted * @param type The type of chip to be encrypted
* *