Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bootloader_support): Reorder write protection bits of some shared security efuses

Browse Source
This commit is contained in:
harshal.patil
2025-09-30 15:37:25 +05:30
parent 8574a0a609
commit b40f14cff6
4 changed files with 9 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader/Kconfig.projbuild
+3 -2
View File
@@ -1136,8 +1136,9 @@ menu "Security features"
config SECURE_FLASH_PSEUDO_ROUND_FUNC config SECURE_FLASH_PSEUDO_ROUND_FUNC
bool "Permanently enable XTS-AES's pseudo rounds function" bool "Permanently enable XTS-AES's pseudo rounds function"
default y default y if SECURE_FLASH_ENCRYPTION_MODE_RELEASE
depends on SECURE_FLASH_ENCRYPTION_MODE_RELEASE && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND default n
depends on SECURE_FLASH_ENC_ENABLED && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
help help
If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function. If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
Note: Enabling this config would burn an efuse. Note: Enabling this config would burn an efuse.
components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
+1 -1
View File
@@ -36,7 +36,7 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT); esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND) #if defined(CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC)
if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) { if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function..."); ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH; uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
components/bootloader_support/src/flash_encrypt.c
-7
View File
@@ -210,13 +210,6 @@ void esp_flash_encryption_set_release_mode(void)
#endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED #endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
#endif // !CONFIG_IDF_TARGET_ESP32 #endif // !CONFIG_IDF_TARGET_ESP32
#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
uint8_t xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW;
esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
}
#endif
#ifdef CONFIG_IDF_TARGET_ESP32 #ifdef CONFIG_IDF_TARGET_ESP32
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE); esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
#else #else
components/esp_security/src/init.c
+5 -3
View File
@@ -42,6 +42,8 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
esp_crypto_dpa_protection_startup(); esp_crypto_dpa_protection_startup();
#endif #endif
esp_err_t err = ESP_FAIL;
#if CONFIG_ESP_CRYPTO_FORCE_ECC_CONSTANT_TIME_POINT_MUL #if CONFIG_ESP_CRYPTO_FORCE_ECC_CONSTANT_TIME_POINT_MUL
bool force_constant_time = true; bool force_constant_time = true;
#if CONFIG_IDF_TARGET_ESP32H2 #if CONFIG_IDF_TARGET_ESP32H2
@@ -51,7 +53,7 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
#endif #endif
if (!esp_efuse_read_field_bit(ESP_EFUSE_ECC_FORCE_CONST_TIME) && force_constant_time) { if (!esp_efuse_read_field_bit(ESP_EFUSE_ECC_FORCE_CONST_TIME) && force_constant_time) {
ESP_EARLY_LOGD(TAG, "Forcefully enabling ECC constant time operations"); ESP_EARLY_LOGD(TAG, "Forcefully enabling ECC constant time operations");
esp_err_t err = esp_efuse_write_field_bit(ESP_EFUSE_ECC_FORCE_CONST_TIME); err = esp_efuse_write_field_bit(ESP_EFUSE_ECC_FORCE_CONST_TIME);
if (err != ESP_OK) { if (err != ESP_OK) {
ESP_EARLY_LOGE(TAG, "Enabling ECC constant time operations forcefully failed."); ESP_EARLY_LOGE(TAG, "Enabling ECC constant time operations forcefully failed.");
return err; return err;
@@ -60,14 +62,14 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
#endif #endif
#if CONFIG_ESP_ECDSA_ENABLE_P192_CURVE #if CONFIG_ESP_ECDSA_ENABLE_P192_CURVE
esp_err_t err;
err = esp_efuse_enable_ecdsa_p192_curve_mode(); err = esp_efuse_enable_ecdsa_p192_curve_mode();
if (err != ESP_OK) { if (err != ESP_OK) {
return err; return err;
} }
#endif #endif
return ESP_OK; err = ESP_OK;
return err;
} }
void esp_security_init_include_impl(void) void esp_security_init_include_impl(void)