alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge branch 'feature/hmac_downstream_jtag_v4.3' into 'release/v4.3'

Browse Source 
hmac: Added Downstream JTAG enable mode for esp32c3 (v4.3)

See merge request espressif/esp-idf!15203
This commit is contained in:
Mahavir Jain 2021-09-16 04:20:14 +00:00
commit 316674a096
5 changed files with 103 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
components/esp32c3/esp_hmac.c
View File

@ -16,14 +16,20 @@
#include "driver/periph_ctrl.h"
#include "esp32c3/rom/hmac.h"
#include "esp32c3/rom/ets_sys.h"
#include "esp_efuse.h"
#include "esp_efuse_table.h"
#include "esp_hmac.h"
#include "esp_log.h"
#include "esp_crypto_lock.h"
#include "soc/hwcrypto_reg.h"
#include "hal/hmac_hal.h"
#define SHA256_BLOCK_SZ 64
#define SHA256_PAD_SZ 8
static const char *TAG = "esp_hmac";
/**
* @brief Apply the HMAC padding without the embedded length.
*
@ -130,3 +136,53 @@ esp_err_t esp_hmac_calculate(hmac_key_id_t key_id,
return ESP_OK;
}
static ets_efuse_block_t convert_key_type(hmac_key_id_t key_id) {
return ETS_EFUSE_BLOCK_KEY0 + (ets_efuse_block_t) key_id;
}
esp_err_t esp_hmac_jtag_enable(hmac_key_id_t key_id, const uint8_t *token)
{
int ets_status;
esp_err_t err = ESP_OK;
if ((!token) || (key_id >= HMAC_KEY_MAX))
return ESP_ERR_INVALID_ARG;
/* Check if JTAG is permanently disabled by HW Disable eFuse */
if (esp_efuse_read_field_bit(ESP_EFUSE_DIS_PAD_JTAG)) {
ESP_LOGE(TAG, "JTAG disabled permanently.");
return ESP_FAIL;
}
esp_crypto_hmac_lock_acquire();
ets_status = ets_jtag_enable_temporarily(token, convert_key_type(key_id));
if (ets_status != ETS_OK) {
// ets_jtag_enable_temporarily returns either ETS_OK or ETS_FAIL
err = ESP_FAIL;
ESP_LOGE(TAG, "JTAG re-enabling failed (%d)", err);
}
ESP_LOGD(TAG, "HMAC computation in downstream mode is completed.");
ets_hmac_disable();
esp_crypto_hmac_lock_release();
return err;
}
esp_err_t esp_hmac_jtag_disable()
{
esp_crypto_hmac_lock_acquire();
REG_SET_BIT(HMAC_SET_INVALIDATE_JTAG_REG, HMAC_INVALIDATE_JTAG);
esp_crypto_hmac_lock_release();
ESP_LOGD(TAG, "Invalidate JTAG result register. JTAG disabled.");
return ESP_OK;
}

29
components/esp32c3/include/esp_hmac.h
View File

@ -60,6 +60,35 @@ esp_err_t esp_hmac_calculate(hmac_key_id_t key_id,
size_t message_len,
uint8_t *hmac);
/**
* @brief Use HMAC peripheral in Downstream mode to re-enable the JTAG, if it is not permanently disabled by HW.
* In downstream mode, HMAC calculations performed by peripheral are used internally and not provided back to user.
*
* @param key_id Determines which of the 6 key blocks in the efuses should be used for the HMAC calculation.
* The corresponding purpose field of the key block in the efuse must be set to HMAC downstream purpose.
*
* @param token Pre calculated HMAC value of the 32-byte 0x00 using SHA-256 and the known private HMAC key. The key is already
* programmed to a eFuse key block. The key block number is provided as the first parameter to this function.
*
* @return
* * ESP_OK, if the calculation was successful,
* if the calculated HMAC value matches with provided token,
* JTAG will be re-enable otherwise JTAG will remain disabled.
* Return value does not indicate the JTAG status.
* * ESP_FAIL, if the hmac calculation failed or JTAG is permanently disabled by EFUSE_HARD_DIS_JTAG eFuse parameter.
* * ESP_ERR_INVALID_ARG, invalid input arguments
*/
esp_err_t esp_hmac_jtag_enable(hmac_key_id_t key_id, const uint8_t *token);
/**
* @brief Disable the JTAG which might be enabled using the HMAC downstream mode. This function just clears the result generated
* by calling esp_hmac_jtag_enable() API.
*
* @return
* * ESP_OK return ESP_OK after writing the HMAC_SET_INVALIDATE_JTAG_REG with value 1.
*/
esp_err_t esp_hmac_jtag_disable(void);
#ifdef __cplusplus
}
#endif

13
components/esp32s2/esp_hmac.c
View File

@ -55,7 +55,8 @@ esp_err_t esp_hmac_calculate(hmac_key_id_t key_id,
esp_err_t esp_hmac_jtag_enable(hmac_key_id_t key_id, const uint8_t *token)
{
esp_err_t err;
int ets_status;
esp_err_t err = ESP_OK;
if ((!token) || (key_id >= HMAC_KEY_MAX))
return ESP_ERR_INVALID_ARG;
@ -77,10 +78,10 @@ esp_err_t esp_hmac_jtag_enable(hmac_key_id_t key_id, const uint8_t *token)
REG_WRITE(DPORT_JTAG_CTRL_0_REG + i, __builtin_bswap32(key_word));
}
err = ets_hmac_calculate_downstream(convert_key_type(key_id), ETS_EFUSE_KEY_PURPOSE_HMAC_DOWN_JTAG);
if (err != ETS_OK) {
ESP_LOGE(TAG, "HMAC downstream JTAG enable mode setting failed.");
return ESP_FAIL;
ets_status = ets_hmac_calculate_downstream(convert_key_type(key_id), ETS_EFUSE_KEY_PURPOSE_HMAC_DOWN_JTAG);
if (ets_status != ETS_OK) {
err = ESP_FAIL;
ESP_LOGE(TAG, "HMAC downstream JTAG enable mode setting failed. (%d)", err);
}
ESP_LOGD(TAG, "HMAC computation in downstream mode is completed.");
@ -89,7 +90,7 @@ esp_err_t esp_hmac_jtag_enable(hmac_key_id_t key_id, const uint8_t *token)
esp_crypto_dma_lock_release();
return ESP_OK;
return err;
}
esp_err_t esp_hmac_jtag_disable()

45
components/esp32s2/test/test_hmac.c
View File

@ -29,17 +29,12 @@ typedef struct {
uint8_t result[32];
} hmac_result;
static const ets_efuse_block_t key_block = ETS_EFUSE_BLOCK_KEY4;
static const char *TAG = "test_hmac";
static void setup_keyblock(void) {
static void setup_keyblock(esp_efuse_block_t key_block, esp_efuse_purpose_t purpose) {
const uint8_t key_data[32] = {
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,
25,26,27,28,29,30,31,32
};
int ets_status = ets_efuse_write_key(key_block,
ETS_EFUSE_KEY_PURPOSE_HMAC_UP,
key_data, sizeof(key_data));
esp_err_t status = esp_efuse_write_key(key_block, purpose, key_data, sizeof(key_data));
if (ets_status == ESP_OK) {
printf("written key!\n");
@ -52,10 +47,7 @@ TEST_CASE("HMAC 'downstream' JTAG Enable mode", "[hw_crypto]")
{
int ets_status;
const uint8_t key_data[32] = {
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,
25,26,27,28,29,30,31,32
};
setup_keyblock(EFUSE_BLK_KEY3, ESP_EFUSE_KEY_PURPOSE_HMAC_DOWN_JTAG);
// Results calculated with Python:
//
@ -67,31 +59,13 @@ TEST_CASE("HMAC 'downstream' JTAG Enable mode", "[hw_crypto]")
0x8e, 0x6c, 0x3e, 0x8e, 0x6e, 0x17, 0x62, 0x5c, 0x50, 0xac, 0x66, 0xa9, 0xa8, 0x57, 0x94, 0x9b
};
ets_status = ets_efuse_write_key(ETS_EFUSE_BLOCK_KEY3,
ETS_EFUSE_KEY_PURPOSE_HMAC_DOWN_JTAG,
key_data, sizeof(key_data));
if (ets_status == ESP_OK) {
ESP_LOGI(TAG, "HMAC_DOWN_JTAG key programmed!");
} else {
ESP_LOGW(TAG, "HMAC_DOWN_JTAG key programming failed, \
maybe written already. Continuing");
}
TEST_ASSERT_MESSAGE(ESP_OK == esp_efuse_batch_write_begin(),
"Error programming security efuse.\n");
ets_status = esp_efuse_set_read_protect(ETS_EFUSE_BLOCK_KEY3);
if (ets_status != ESP_OK) {
ESP_LOGW(TAG, "EFUSE_BLOCK read protect setting failed. \
Not a must prerequisite to run this test case. Continuing");
}
ets_status = esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count);
ets_status = esp_efuse_write_field_bit(ESP_EFUSE_SOFT_DIS_JTAG);
if (ets_status != ESP_OK) {
ESP_LOGI(TAG, "JTAG Disable temporarily failed. \
May be disabled already. Continuing the test.");
}
TEST_ASSERT_MESSAGE(ets_status == ESP_OK || ets_status == ESP_ERR_EFUSE_CNT_IS_FULL,
"JTAG Disable temporarily failed.\n");
TEST_ASSERT_MESSAGE(ESP_OK == esp_efuse_batch_write_commit(),
"Error programming security efuse.\n");
@ -110,7 +84,7 @@ TEST_CASE("HMAC 'upstream' MAC generation with zeroes", "[hw_crypto]")
{
uint8_t hmac[32];
setup_keyblock();
setup_keyblock(EFUSE_BLK_KEY4, ESP_EFUSE_KEY_PURPOSE_HMAC_UP);
const uint8_t zeroes[128] = { };
// Produce the HMAC of various numbers of zeroes
@ -205,7 +179,7 @@ TEST_CASE("HMAC 'upstream' MAC generation from data", "[hw_crypto]")
{
uint8_t hmac[32];
setup_keyblock();
setup_keyblock(EFUSE_BLK_KEY4, ESP_EFUSE_KEY_PURPOSE_HMAC_UP);
// 257 characters of pseudo-Latin from lipsum.com (not Copyright)
const char *message = "Deleniti voluptas explicabo et assumenda. Sed et aliquid minus quis. Praesentium cupiditate quia nemo est. Laboriosam pariatur ut distinctio tenetur. Sunt architecto iure aspernatur soluta ut recusandae. Ut quibusdam occaecati ut qui sit dignissimos eaque..";
@ -1005,7 +979,8 @@ TEST_CASE("HMAC 'upstream' wait lock", "[hw_crypto]")
// 257 characters of pseudo-Latin from lipsum.com (not Copyright)
const char *message = "Deleniti voluptas explicabo et assumenda. Sed et aliquid minus quis. Praesentium cupiditate quia nemo est. Laboriosam pariatur ut distinctio tenetur. Sunt architecto iure aspernatur soluta ut recusandae. Ut quibusdam occaecati ut qui sit dignissimos eaque..";
setup_keyblock();
setup_keyblock(EFUSE_BLK_KEY4, ESP_EFUSE_KEY_PURPOSE_HMAC_UP);
static const hmac_result results[] = {
{ .msglen = 255,
.result = { 0x59, 0x52, 0x50, 0x4, 0xb6, 0x28, 0xf9, 0x28, 0x7f, 0x6c, 0x37, 0xba, 0xfb, 0xb2, 0x58, 0xe7, 0xa, 0xac, 0x6c, 0x4a, 0xef, 0x66, 0x6, 0x7b, 0x1, 0x1f, 0x4c, 0xa4, 0xe5, 0xe5, 0x29, 0x5d },

1
components/soc/esp32c3/include/soc/hwcrypto_reg.h
View File

@ -133,6 +133,7 @@
#define HMAC_SET_MESSAGE_END_REG ((DR_REG_HMAC_BASE) + 0x58)
#define HMAC_SET_RESULT_FINISH_REG ((DR_REG_HMAC_BASE) + 0x5c)
#define HMAC_SET_INVALIDATE_JTAG_REG ((DR_REG_HMAC_BASE) + 0x60)
#define HMAC_INVALIDATE_JTAG BIT(0)
#define HMAC_SET_INVALIDATE_DS_REG ((DR_REG_HMAC_BASE) + 0x64)
#define HMAC_QUERY_ERROR_REG ((DR_REG_HMAC_BASE) + 0x68)
#define HMAC_QUERY_BUSY_REG ((DR_REG_HMAC_BASE) + 0x6c)