pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'fix/change_write_protection_bit_of_shared_security_efuses_v5.5' into 'release/v5.5'

Browse Source 
Reorder write protection bits of some shared security efuses (v5.5)

See merge request espressif/esp-idf!42033
This commit is contained in:
Mahavir Jain
2025-10-15 09:38:59 +05:30
parent 4cc95c4a71 175a6510f5
commit 042f29dd66
17 changed files with 123 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_security/src/init.c
+38 -3
View File
@@ -23,6 +23,10 @@
#include "hal/key_mgr_types.h"
#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */
#if SOC_ECDSA_SUPPORTED
#include "hal/ecdsa_ll.h"
#endif
__attribute__((unused)) static const char *TAG = "esp_security";
static void esp_key_mgr_init(void)
@@ -57,6 +61,8 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
esp_crypto_dpa_protection_startup();
#endif
esp_err_t err = ESP_FAIL;
#if CONFIG_ESP_CRYPTO_FORCE_ECC_CONSTANT_TIME_POINT_MUL
bool force_constant_time = true;
#if CONFIG_IDF_TARGET_ESP32H2
@@ -66,7 +72,7 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
#endif
if (!esp_efuse_read_field_bit(ESP_EFUSE_ECC_FORCE_CONST_TIME) && force_constant_time) {
ESP_EARLY_LOGD(TAG, "Forcefully enabling ECC constant time operations");
esp_err_t err = esp_efuse_write_field_bit(ESP_EFUSE_ECC_FORCE_CONST_TIME);
err = esp_efuse_write_field_bit(ESP_EFUSE_ECC_FORCE_CONST_TIME);
if (err != ESP_OK) {
ESP_EARLY_LOGE(TAG, "Enabling ECC constant time operations forcefully failed.");
return err;
@@ -75,13 +81,42 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
#endif
#if CONFIG_ESP_ECDSA_ENABLE_P192_CURVE
esp_err_t err = esp_efuse_enable_ecdsa_p192_curve_mode();
err = esp_efuse_enable_ecdsa_p192_curve_mode();
if (err != ESP_OK) {
return err;
}
#endif
return ESP_OK;
#if CONFIG_SECURE_BOOT_V2_ENABLED
// H2, H21
#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
// Also write protects the ECDSA_CURVE_MODE efuse bit.
if (ecdsa_ll_is_configurable_curve_supported()) {
err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to write protect the ECDSA_CURVE_MODE efuse bit.");
return err;
}
}
#endif
#if !CONFIG_SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA
// C5
#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
// Since SECURE_BOOT_SHA384_EN, XTS_DPA_PSEUDO_LEVEL, and ECC_FORCE_CONST_TIME share the
// same write-protection bit, these efuses should only be write-protected after all of
// them have been programmed.
err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to write protect the SECURE_BOOT_SHA384_EN efuse bit.");
return err;
}
#endif
#endif
#endif
err = ESP_OK;
return err;
}
void esp_security_init_include_impl(void)