Skip to content

Commit f7724ee

Browse files
mahavirjmahavirj
committed
Merge branch 'feature/enable_secure_boot_for_esp32h21' into 'master'
feat: enable secure boot support for esp32h21 Closes IDF-11500 and IDF-12161 See merge request espressif/esp-idf!36618
2 parents f66a750 + c658582 commit f7724ee

File tree

15 files changed

+160
-118
lines changed

15 files changed

+160
-118
lines changed

‎components/bootloader_support/include/esp_secure_boot.h‎

Lines changed: 3 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -14,27 +14,8 @@
1414
#include "sdkconfig.h"
1515
#include "esp_rom_crc.h"
1616
#include "hal/efuse_ll.h"
17-
18-
#if CONFIG_IDF_TARGET_ESP32
19-
#include "esp32/rom/secure_boot.h"
20-
#elif CONFIG_IDF_TARGET_ESP32S2
21-
#include "esp32s2/rom/secure_boot.h"
22-
#elif CONFIG_IDF_TARGET_ESP32C3
23-
#include "esp32c3/rom/secure_boot.h"
24-
#elif CONFIG_IDF_TARGET_ESP32S3
25-
#include "esp32s3/rom/secure_boot.h"
26-
#elif CONFIG_IDF_TARGET_ESP32C2
27-
#include "esp32c2/rom/secure_boot.h"
28-
#elif CONFIG_IDF_TARGET_ESP32C6
29-
#include "esp32c6/rom/secure_boot.h"
30-
#elif CONFIG_IDF_TARGET_ESP32H2
31-
#include "esp32h2/rom/secure_boot.h"
32-
#elif CONFIG_IDF_TARGET_ESP32P4
33-
#include "esp32p4/rom/secure_boot.h"
34-
#elif CONFIG_IDF_TARGET_ESP32C5
35-
#include "esp32c5/rom/secure_boot.h"
36-
#elif CONFIG_IDF_TARGET_ESP32C61
37-
#include "esp32c61/rom/secure_boot.h"
17+
#if !CONFIG_IDF_TARGET_LINUX
18+
#include "rom/secure_boot.h"
3819
#endif
3920

4021
#ifdef CONFIG_SECURE_BOOT_V1_ENABLED

‎components/bootloader_support/private_include/bootloader_signature.h‎

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -8,28 +8,7 @@
88
#include "sdkconfig.h"
99
#include <esp_err.h>
1010
#include <stdint.h>
11-
12-
#if CONFIG_IDF_TARGET_ESP32
13-
#include "esp32/rom/secure_boot.h"
14-
#elif CONFIG_IDF_TARGET_ESP32S2
15-
#include "esp32s2/rom/secure_boot.h"
16-
#elif CONFIG_IDF_TARGET_ESP32C3
17-
#include "esp32c3/rom/secure_boot.h"
18-
#elif CONFIG_IDF_TARGET_ESP32S3
19-
#include "esp32s3/rom/secure_boot.h"
20-
#elif CONFIG_IDF_TARGET_ESP32C2
21-
#include "esp32c2/rom/secure_boot.h"
22-
#elif CONFIG_IDF_TARGET_ESP32C6
23-
#include "esp32c6/rom/secure_boot.h"
24-
#elif CONFIG_IDF_TARGET_ESP32H2
25-
#include "esp32h2/rom/secure_boot.h"
26-
#elif CONFIG_IDF_TARGET_ESP32P4
27-
#include "esp32p4/rom/secure_boot.h"
28-
#elif CONFIG_IDF_TARGET_ESP32C5
29-
#include "esp32c5/rom/secure_boot.h"
30-
#elif CONFIG_IDF_TARGET_ESP32C61
31-
#include "esp32c61/rom/secure_boot.h"
32-
#endif
11+
#include "rom/secure_boot.h"
3312

3413
#ifdef __cplusplus
3514
extern "C" {

‎components/bootloader_support/src/esp32h21/secure_boot_secure_features.c‎

Lines changed: 55 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -16,7 +16,59 @@ static __attribute__((unused)) const char *TAG = "secure_boot";
1616

1717
esp_err_t esp_secure_boot_enable_secure_features(void)
1818
{
19-
//TODO: [ESP32H21] IDF-11500
20-
abort();
19+
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
20+
21+
#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
22+
ESP_LOGI(TAG, "Enabling Security download mode...");
23+
esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
24+
if (err != ESP_OK) {
25+
ESP_LOGE(TAG, "Could not enable Security download mode...");
26+
return err;
27+
}
28+
#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
29+
ESP_LOGI(TAG, "Disable ROM Download mode...");
30+
esp_err_t err = esp_efuse_disable_rom_download_mode();
31+
if (err != ESP_OK) {
32+
ESP_LOGE(TAG, "Could not disable ROM Download mode...");
33+
return err;
34+
}
35+
#else
36+
ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
37+
#endif
38+
39+
#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
40+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
41+
#endif
42+
43+
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
44+
ESP_LOGI(TAG, "Disable hardware & software JTAG...");
45+
esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
46+
esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
47+
esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count);
48+
#else
49+
ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
50+
#endif
51+
52+
#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
53+
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
54+
#endif
55+
56+
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
57+
58+
#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
59+
bool rd_dis_now = true;
60+
#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
61+
/* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
62+
when Flash Encryption is being enabled */
63+
rd_dis_now = esp_flash_encryption_enabled();
64+
#endif
65+
if (rd_dis_now) {
66+
ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
67+
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
68+
}
69+
#else
70+
ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
71+
#endif
72+
2173
return ESP_OK;
2274
}

‎components/bootloader_support/src/secure_boot.c‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -340,6 +340,21 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
340340
#endif
341341
}
342342

343+
#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
344+
secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
345+
if (!secure) {
346+
uint8_t current_curve;
347+
esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
348+
if (err == ESP_OK) {
349+
if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
350+
// If not P256 mode
351+
result &= secure;
352+
ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
353+
}
354+
}
355+
}
356+
#endif
357+
343358
#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
344359
secure = esp_efuse_read_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
345360
result &= secure;

‎components/bootloader_support/src/secure_boot_v2/secure_boot_signature_priv.h‎

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,10 @@
11
/*
2-
* SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
66
#include "esp_secure_boot.h"
7-
8-
#if CONFIG_IDF_TARGET_ESP32
9-
#include "esp32/rom/secure_boot.h"
10-
#elif CONFIG_IDF_TARGET_ESP32S2
11-
#include "esp32s2/rom/secure_boot.h"
12-
#elif CONFIG_IDF_TARGET_ESP32C3
13-
#include "esp32c3/rom/secure_boot.h"
14-
#elif CONFIG_IDF_TARGET_ESP32S3
15-
#include "esp32s3/rom/secure_boot.h"
16-
#elif CONFIG_IDF_TARGET_ESP32C2
17-
#include "esp32c2/rom/secure_boot.h"
18-
#elif CONFIG_IDF_TARGET_ESP32C6
19-
#include "esp32c6/rom/secure_boot.h"
20-
#elif CONFIG_IDF_TARGET_ESP32H2
21-
#include "esp32h2/rom/secure_boot.h"
22-
#elif CONFIG_IDF_TARGET_ESP32P4
23-
#include "esp32p4/rom/secure_boot.h"
24-
#elif CONFIG_IDF_TARGET_ESP32C5
25-
#include "esp32c5/rom/secure_boot.h"
26-
#elif CONFIG_IDF_TARGET_ESP32C61
27-
#include "esp32c61/rom/secure_boot.h"
28-
#endif
7+
#include "rom/secure_boot.h"
298

309
esp_err_t verify_ecdsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, const ets_secure_boot_sig_block_t *trusted_block);
3110

‎components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_app.c‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -48,6 +48,18 @@ static esp_err_t validate_signature_block(const ets_secure_boot_sig_block_t *blo
4848
ESP_LOGE(TAG, "%s signing scheme selected but signature block generated for %s scheme", esp_secure_boot_get_scheme_name(ESP_SECURE_BOOT_SCHEME), esp_secure_boot_get_scheme_name(block->version));
4949
return ESP_FAIL;
5050
}
51+
52+
#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED && CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
53+
if (block->ecdsa.key.curve_id == ECDSA_CURVE_P192) {
54+
// Enabling ECDSA-192 Curve mode
55+
esp_err_t err = esp_efuse_enable_ecdsa_p192_curve_mode();
56+
if (err != ESP_OK) {
57+
ESP_LOGE(TAG, "Failed to enable ECDSA-192 curve mode: %d", err);
58+
return err;
59+
}
60+
}
61+
#endif
62+
5163
return ESP_OK;
5264
}
5365

‎components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -65,6 +65,18 @@ static esp_err_t validate_signature_block(const ets_secure_boot_sig_block_t *blo
6565
ESP_LOGE(TAG, "%s signing scheme selected but signature block generated for %s scheme", esp_secure_boot_get_scheme_name(ESP_SECURE_BOOT_SCHEME), esp_secure_boot_get_scheme_name(block->version));
6666
return ESP_FAIL;
6767
}
68+
69+
#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED && CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
70+
if (block->ecdsa.key.curve_id == ECDSA_CURVE_P192) {
71+
// Enabling ECDSA-192 Curve mode
72+
esp_err_t err = esp_efuse_enable_ecdsa_p192_curve_mode();
73+
if (err != ESP_OK) {
74+
ESP_LOGE(TAG, "Failed to enable ECDSA-192 curve mode: %d", err);
75+
return err;
76+
}
77+
}
78+
#endif
79+
6880
return ESP_OK;
6981
}
7082

‎components/efuse/esp32h21/esp_efuse_fields.c‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -65,12 +65,7 @@ esp_err_t esp_efuse_enable_ecdsa_p192_curve_mode(void)
6565
esp_err_t err;
6666
uint8_t current_curve, next_curve;
6767

68-
err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
69-
if (err != ESP_OK) {
70-
ESP_EARLY_LOGE(TAG, "Failed to read ECDSA curve mode");
71-
return err;
72-
}
73-
68+
current_curve = efuse_ll_get_ecdsa_curve_mode();
7469
// Check if already in desired state
7570
if (current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT) {
7671
ESP_EARLY_LOGD(TAG, "ECDSA P-192 curve mode is already enabled");

‎components/esp_security/src/init.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,7 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
6060
#endif
6161

6262
#if CONFIG_ESP_ECDSA_ENABLE_P192_CURVE
63-
esp_err_t err;
64-
err = esp_efuse_enable_ecdsa_p192_curve_mode();
63+
esp_err_t err = esp_efuse_enable_ecdsa_p192_curve_mode();
6564
if (err != ESP_OK) {
6665
return err;
6766
}

‎components/soc/esp32h21/include/soc/Kconfig.soc_caps.in‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,10 @@ config SOC_FLASH_ENC_SUPPORTED
7979
bool
8080
default y
8181

82+
config SOC_SECURE_BOOT_SUPPORTED
83+
bool
84+
default y
85+
8286
config SOC_SPI_FLASH_SUPPORTED
8387
bool
8488
default y

0 commit comments

Comments
 (0)