Skip to content

Commit 0fb8c2a

Browse files
nileshkale123nileshkale123
committed
feat: enabled ECDSA-P192 support for ESP32H2
1 parent 574f037 commit 0fb8c2a

File tree

15 files changed

+137
-42
lines changed

15 files changed

+137
-42
lines changed

‎components/bootloader_support/src/esp32h2/secure_boot_secure_features.c‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
/*
2-
* SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
66

77
#include <strings.h>
8+
#include "hal/ecdsa_ll.h"
89
#include "esp_flash_encrypt.h"
910
#include "esp_secure_boot.h"
1011
#include "esp_efuse.h"
@@ -36,6 +37,12 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
3637
ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
3738
#endif
3839

40+
#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
41+
if (ecdsa_ll_is_configurable_curve_supported()) {
42+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
43+
}
44+
#endif
45+
3946
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
4047
ESP_LOGI(TAG, "Disable hardware & software JTAG...");
4148
esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);

‎components/bootloader_support/src/secure_boot.c‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@
1212
#include "esp_secure_boot.h"
1313
#include "hal/efuse_hal.h"
1414

15+
#ifdef SOC_ECDSA_SUPPORTED
16+
#include "hal/ecdsa_ll.h"
17+
#endif
18+
1519
#ifndef BOOTLOADER_BUILD
1620
static __attribute__((unused)) const char *TAG = "secure_boot";
1721

@@ -341,15 +345,17 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
341345
}
342346

343347
#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
344-
secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
345-
if (!secure) {
346-
uint8_t current_curve;
347-
esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
348-
if (err == ESP_OK) {
349-
if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
350-
// If not P256 mode
351-
result &= secure;
352-
ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
348+
if (ecdsa_ll_is_configurable_curve_supported()) {
349+
secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
350+
if (!secure) {
351+
uint8_t current_curve;
352+
esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
353+
if (err == ESP_OK) {
354+
if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
355+
// If not P256 mode
356+
result &= secure;
357+
ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
358+
}
353359
}
354360
}
355361
}

‎components/efuse/src/esp_efuse_fields.c‎

Lines changed: 40 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,11 @@
1818
#include "sys/param.h"
1919
#include "soc/soc_caps.h"
2020
#include "hal/efuse_ll.h"
21+
#include "hal/efuse_hal.h"
22+
23+
#ifdef SOC_ECDSA_SUPPORTED
24+
#include "hal/ecdsa_ll.h"
25+
#endif /* SOC_ECDSA_SUPPORTED */
2126

2227
static __attribute__((unused)) const char *TAG = "efuse";
2328

@@ -88,8 +93,12 @@ esp_err_t esp_efuse_update_secure_version(uint32_t secure_version)
8893
bool esp_efuse_is_ecdsa_p192_curve_supported(void)
8994
{
9095
#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
91-
uint32_t current_curve = efuse_ll_get_ecdsa_curve_mode();
92-
return (current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT);
96+
if (ecdsa_ll_is_configurable_curve_supported()) {
97+
uint32_t current_curve = efuse_hal_get_ecdsa_curve_mode();
98+
return (current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT);
99+
} else {
100+
return true;
101+
}
93102
#else
94103
return true;
95104
#endif /* SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED */
@@ -98,8 +107,12 @@ bool esp_efuse_is_ecdsa_p192_curve_supported(void)
98107
bool esp_efuse_is_ecdsa_p256_curve_supported(void)
99108
{
100109
#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
101-
uint32_t current_curve = efuse_ll_get_ecdsa_curve_mode();
102-
return (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT);
110+
if (ecdsa_ll_is_configurable_curve_supported()) {
111+
uint32_t current_curve = efuse_hal_get_ecdsa_curve_mode();
112+
return (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT);
113+
} else {
114+
return true;
115+
}
103116
#else
104117
return true;
105118
#endif /* SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED */
@@ -109,30 +122,32 @@ bool esp_efuse_is_ecdsa_p256_curve_supported(void)
109122
#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
110123
esp_err_t esp_efuse_enable_ecdsa_p192_curve_mode(void)
111124
{
112-
esp_err_t err;
113-
uint8_t current_curve, next_curve;
114-
115-
current_curve = efuse_ll_get_ecdsa_curve_mode();
116-
// Check if already in desired state
117-
if (current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT) {
118-
ESP_EARLY_LOGD(TAG, "ECDSA P-192 curve mode is already enabled");
119-
return ESP_OK;
120-
}
121125

122-
// Check if write is disabled or already locked to P256
123-
if (esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE) || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
124-
ESP_EARLY_LOGE(TAG, "ECDSA curve mode is locked, cannot enable P-192 curve");
125-
return ESP_FAIL;
126-
}
126+
if (ecdsa_ll_is_configurable_curve_supported()) {
127+
esp_err_t err;
128+
uint8_t current_curve, next_curve;
127129

128-
// Attempt to write new curve mode
129-
next_curve = ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT;
130-
err = esp_efuse_write_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &next_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
131-
if (err != ESP_OK) {
132-
ESP_EARLY_LOGE(TAG, "Failed to enable ECDSA P-192 curve %d", err);
133-
return err;
134-
}
130+
current_curve = efuse_hal_get_ecdsa_curve_mode();
131+
// Check if already in desired state
132+
if (current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT) {
133+
ESP_EARLY_LOGD(TAG, "ECDSA P-192 curve mode is already enabled");
134+
return ESP_OK;
135+
}
135136

137+
// Check if write is disabled or already locked to P256
138+
if (esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE) || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
139+
ESP_EARLY_LOGE(TAG, "ECDSA curve mode is locked, cannot enable P-192 curve");
140+
return ESP_FAIL;
141+
}
142+
143+
// Attempt to write new curve mode
144+
next_curve = ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT;
145+
err = esp_efuse_write_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &next_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
146+
if (err != ESP_OK) {
147+
ESP_EARLY_LOGE(TAG, "Failed to enable ECDSA P-192 curve %d", err);
148+
return err;
149+
}
150+
}
136151
return ESP_OK;
137152
}
138153
#endif /* SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED */

‎components/hal/esp32h2/efuse_hal.c‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
/*
2-
* SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
66

77
#include <sys/param.h>
88
#include "sdkconfig.h"
99
#include "soc/soc_caps.h"
10+
#include "soc/chip_revision.h"
1011
#include "hal/assert.h"
1112
#include "hal/efuse_hal.h"
1213
#include "hal/efuse_ll.h"
@@ -79,6 +80,16 @@ void efuse_hal_rs_calculate(const void *data, void *rs_values)
7980
ets_efuse_rs_calculate(data, rs_values);
8081
}
8182

83+
uint32_t efuse_hal_get_ecdsa_curve_mode(void)
84+
{
85+
if (ESP_CHIP_REV_ABOVE(efuse_hal_chip_revision(), 102)) {
86+
return efuse_ll_get_ecdsa_curve_mode();
87+
} else {
88+
// Curve mode is not configurable for previous versions
89+
return 0;
90+
}
91+
}
92+
8293
/******************* eFuse control functions *************************/
8394

8495
bool efuse_hal_is_coding_error_in_block(unsigned block)

‎components/hal/esp32h2/include/hal/ecdsa_ll.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -378,6 +378,16 @@ static inline int ecdsa_ll_get_operation_result(void)
378378
return REG_GET_BIT(ECDSA_RESULT_REG, ECDSA_OPERATION_RESULT);
379379
}
380380

381+
/**
382+
* @brief Check if the ECDSA curves configuration is supported
383+
* The ECDSA curves configuration is only avliable in chip version
384+
* above 1.2 in ESP32-H2
385+
*/
386+
static inline bool ecdsa_ll_is_configurable_curve_supported(void)
387+
{
388+
return ESP_CHIP_REV_ABOVE(efuse_hal_chip_revision(), 102);
389+
}
390+
381391
#ifdef __cplusplus
382392
}
383393
#endif

‎components/hal/esp32h2/include/hal/efuse_hal.h‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -54,6 +54,13 @@ void efuse_hal_program(uint32_t block);
5454
*/
5555
void efuse_hal_rs_calculate(const void *data, void *rs_values);
5656

57+
/**
58+
* @brief Get ECDSA curve mode
59+
*
60+
* @return ECDSA curve mode
61+
*/
62+
uint32_t efuse_hal_get_ecdsa_curve_mode(void);
63+
5764
/**
5865
* @brief Checks coding error in a block
5966
*

‎components/hal/esp32h2/include/hal/efuse_ll.h‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -21,6 +21,11 @@ extern "C" {
2121

2222
/******************* eFuse fields *************************/
2323

24+
__attribute__((always_inline)) static inline uint32_t efuse_ll_get_ecdsa_curve_mode(void)
25+
{
26+
return EFUSE.rd_repeat_data0.ecdsa_curve_mode;
27+
}
28+
2429
__attribute__((always_inline)) static inline uint32_t efuse_ll_get_flash_crypt_cnt(void)
2530
{
2631
return EFUSE.rd_repeat_data1.spi_boot_crypt_cnt;

‎components/hal/esp32h21/efuse_hal.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -81,6 +81,11 @@ void efuse_hal_rs_calculate(const void *data, void *rs_values)
8181
ets_efuse_rs_calculate(data, rs_values);
8282
}
8383

84+
uint32_t efuse_hal_get_ecdsa_curve_mode(void)
85+
{
86+
return efuse_ll_get_ecdsa_curve_mode();
87+
}
88+
8489
/******************* eFuse control functions *************************/
8590

8691
bool efuse_hal_is_coding_error_in_block(unsigned block)

‎components/hal/esp32h21/include/hal/ecdsa_ll.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -420,6 +420,13 @@ static inline int ecdsa_ll_check_k_value(void)
420420
return REG_GET_BIT(ECDSA_RESULT_REG, ECDSA_K_VALUE_WARNING);
421421
}
422422

423+
/**
424+
* @brief Check if the ECDSA curves configuration is supported
425+
*/
426+
static inline bool ecdsa_ll_is_configurable_curve_supported(void)
427+
{
428+
return true;
429+
}
423430

424431
#ifdef __cplusplus
425432
}

‎components/hal/esp32h21/include/hal/efuse_hal.h‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -56,6 +56,13 @@ void efuse_hal_program(uint32_t block);
5656
*/
5757
void efuse_hal_rs_calculate(const void *data, void *rs_values);
5858

59+
/**
60+
* @brief Get ECDSA curve mode
61+
*
62+
* @return ECDSA curve mode
63+
*/
64+
uint32_t efuse_hal_get_ecdsa_curve_mode(void);
65+
5966
/**
6067
* @brief Checks coding error in a block
6168
*

0 commit comments

Comments
 (0)