fix(bootloader_support): Reorder write protection bits of some shared security efuses

components/bootloader_support/src/secure_boot.c

@@ -429,6 +429,13 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
     }
 
 #if SOC_ECDSA_SUPPORT_CURVE_P384
+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+    secure = esp_efuse_read_field_bit(ESP_EFUSE_SECURE_BOOT_SHA384_EN);
+    result &= secure;
+    if (!secure) {
+        ESP_LOGW(TAG, "Not enabled Secure Boot using SHA-384 mode (set SECURE_BOOT_SHA384_EN->1)");
+    }
+#else
     /* When using Secure Boot with SHA-384, the efuse bit representing Secure Boot with SHA-384 would already be programmed.
      * But in the case of the existing Secure Boot V2 schemes using SHA-256, the efuse bit representing
      * Secure Boot with SHA-384 needs to be write-protected, so that an attacker cannot perform a denial-of-service
@@ -439,6 +446,7 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
     if (!secure) {
         ESP_LOGW(TAG, "Not write-protected secure boot using SHA-384 mode (set WR_DIS_SECURE_BOOT_SHA384_EN->1)");
     }
+#endif
 #endif
 
     secure = (num_keys != 0);