feat(esp_security): support s31 security clock management

components/esp_hal_security/esp32/include/hal/sec_ll.h

@@ -0,0 +1,26 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "soc/clk_tree_defs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source
+ *
+ * @note Not supported. No-op.
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    (void)src;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32c2/include/hal/sec_ll.h

@@ -0,0 +1,26 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "soc/clk_tree_defs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source
+ *
+ * @note Not supported. No-op.
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    (void)src;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32c3/include/hal/sec_ll.h

@@ -0,0 +1,26 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "soc/clk_tree_defs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source
+ *
+ * @note Not supported. No-op.
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    (void)src;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32c5/include/hal/sec_ll.h

@@ -0,0 +1,39 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include <stdint.h>
+#include "soc/clk_tree_defs.h"
+#include "soc/pcr_struct.h"
+#include "hal/assert.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source.
+ *
+ * @param src Clock source (SOC_MOD_CLK_XTAL, SOC_MOD_CLK_RC_FAST, or SOC_MOD_CLK_SPLL)
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    uint32_t reg_val = 3;
+    if (src == SOC_MOD_CLK_XTAL) {
+        reg_val = 0;
+    } else if (src == SOC_MOD_CLK_RC_FAST) {
+        reg_val = 1;
+    } else if (src == SOC_MOD_CLK_SPLL) {
+        reg_val = 2;
+    } else {
+        HAL_ASSERT(false);
+    }
+    PCR.sec_conf.sec_clk_sel = reg_val;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32c6/include/hal/sec_ll.h

@@ -0,0 +1,26 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "soc/clk_tree_defs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source
+ *
+ * @note Not supported. No-op.
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    (void)src;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32c61/include/hal/sec_ll.h

@@ -0,0 +1,39 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include <stdint.h>
+#include "soc/clk_tree_defs.h"
+#include "soc/pcr_struct.h"
+#include "hal/assert.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source.
+ *
+ * @param src Clock source (SOC_MOD_CLK_XTAL, SOC_MOD_CLK_RC_FAST, or SOC_MOD_CLK_SPLL)
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    uint32_t reg_val = 3;
+    if (src == SOC_MOD_CLK_XTAL) {
+        reg_val = 0;
+    } else if (src == SOC_MOD_CLK_RC_FAST) {
+        reg_val = 1;
+    } else if (src == SOC_MOD_CLK_SPLL) {
+        reg_val = 2;
+    } else {
+        HAL_ASSERT(false);
+    }
+    PCR.sec_conf.sec_clk_sel = reg_val;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32h2/include/hal/sec_ll.h

@@ -0,0 +1,41 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include <stdint.h>
+#include "soc/clk_tree_defs.h"
+#include "soc/pcr_struct.h"
+#include "hal/assert.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source.
+ *
+ * @param src Clock source (SOC_MOD_CLK_XTAL, SOC_MOD_CLK_RC_FAST, SOC_MOD_CLK_PLL_F64M, or SOC_MOD_CLK_PLL_F96M)
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    uint32_t reg_val = 3;
+    if (src == SOC_MOD_CLK_XTAL) {
+        reg_val = 0;
+    } else if (src == SOC_MOD_CLK_RC_FAST) {
+        reg_val = 1;
+    } else if (src == SOC_MOD_CLK_PLL_F64M) {
+        reg_val = 2;
+    } else if (src == SOC_MOD_CLK_PLL_F96M) {
+        reg_val = 3;
+    } else {
+        HAL_ASSERT(false);
+    }
+    PCR.sec_conf.sec_clk_sel = reg_val;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32h21/include/hal/sec_ll.h

@@ -0,0 +1,41 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include <stdint.h>
+#include "soc/clk_tree_defs.h"
+#include "soc/pcr_struct.h"
+#include "hal/assert.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source.
+ *
+ * @param src Clock source (SOC_MOD_CLK_XTAL, SOC_MOD_CLK_RC_FAST, SOC_MOD_CLK_XTAL_X2_F64M, or SOC_MOD_CLK_PLL_F96M)
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    uint32_t reg_val = 3;
+    if (src == SOC_MOD_CLK_XTAL) {
+        reg_val = 0;
+    } else if (src == SOC_MOD_CLK_RC_FAST) {
+        reg_val = 1;
+    } else if (src == SOC_MOD_CLK_XTAL_X2_F64M) {
+        reg_val = 2;
+    } else if (src == SOC_MOD_CLK_PLL_F96M) {
+        reg_val = 3;
+    } else {
+        HAL_ASSERT(false);
+    }
+    PCR.sec_conf.sec_clk_sel = reg_val;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32h4/include/hal/sec_ll.h

@@ -0,0 +1,41 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include <stdint.h>
+#include "soc/clk_tree_defs.h"
+#include "soc/pcr_struct.h"
+#include "hal/assert.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source.
+ *
+ * @param src Clock source (SOC_MOD_CLK_XTAL, SOC_MOD_CLK_RC_FAST, SOC_MOD_CLK_XTAL_X2_F64M, or SOC_MOD_CLK_PLL_F96M)
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    uint32_t reg_val = 3;
+    if (src == SOC_MOD_CLK_XTAL) {
+        reg_val = 0;
+    } else if (src == SOC_MOD_CLK_RC_FAST) {
+        reg_val = 1;
+    } else if (src == SOC_MOD_CLK_XTAL_X2_F64M) {
+        reg_val = 2;
+    } else if (src == SOC_MOD_CLK_PLL_F96M) {
+        reg_val = 3;
+    } else {
+        HAL_ASSERT(false);
+    }
+    PCR.sec_conf.sec_clk_sel = reg_val;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32p4/include/hal/sec_ll.h

@@ -0,0 +1,41 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include <stdint.h>
+#include "soc/clk_tree_defs.h"
+#include "soc/hp_sys_clkrst_struct.h"
+#include "hal/assert.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source.
+ *
+ * @param src Clock source (SOC_MOD_CLK_XTAL, SOC_MOD_CLK_RC_FAST, SOC_MOD_CLK_PLL_F240M, or SOC_MOD_CLK_PLL_F160M)
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    uint32_t reg_val = 3;
+    if (src == SOC_MOD_CLK_XTAL) {
+        reg_val = 0;
+    } else if (src == SOC_MOD_CLK_RC_FAST) {
+        reg_val = 1;
+    } else if (src == SOC_MOD_CLK_PLL_F240M) {
+        reg_val = 2;
+    } else if (src == SOC_MOD_CLK_PLL_F160M) {
+        reg_val = 3;
+    } else {
+        HAL_ASSERT(false);
+    }
+    HP_SYS_CLKRST.peri_clk_ctrl25.reg_crypto_clk_src_sel = reg_val;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32s2/include/hal/sec_ll.h

@@ -0,0 +1,26 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "soc/clk_tree_defs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source
+ *
+ * @note Not supported. No-op.
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    (void)src;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32s3/include/hal/sec_ll.h

@@ -0,0 +1,26 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "soc/clk_tree_defs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source
+ *
+ * @note Not supported. No-op.
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    (void)src;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hal_security/esp32s31/include/hal/sec_ll.h

@@ -0,0 +1,39 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include <stdint.h>
+#include "soc/clk_tree_defs.h"
+#include "soc/hp_sys_clkrst_struct.h"
+#include "hal/assert.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Select crypto clock source.
+ *
+ * @param src Clock source (SOC_MOD_CLK_XTAL, SOC_MOD_CLK_RC_FAST, or SOC_MOD_CLK_PLL_F240M)
+ */
+static inline __attribute__((always_inline)) void sec_ll_crypto_clk_src_sel(soc_module_clk_t src)
+{
+    uint32_t reg_val = 3;
+    if (src == SOC_MOD_CLK_XTAL) {
+        reg_val = 0;
+    } else if (src == SOC_MOD_CLK_RC_FAST) {
+        reg_val = 1;
+    } else if (src == SOC_MOD_CLK_PLL_F240M) {
+        reg_val = 2;
+    } else {
+        HAL_ASSERT(false);
+    }
+    HP_SYS_CLKRST.crypto_ctrl0.reg_crypto_clk_src_sel = reg_val;
+}
+
+#ifdef __cplusplus
+}
+#endif

components/esp_security/CMakeLists.txt

@@ -9,7 +9,7 @@ endif()
 
 set(srcs "")
 set(requires esp_hal_security)
-set(priv_requires esp_hw_support hal efuse)
+set(priv_requires esp_hw_support hal efuse esp_hal_clock)
 set(priv_includes "src/${IDF_TARGET}")
 
 if(NOT non_os_build)

components/esp_security/src/esp32c5/esp_crypto_clk.h

@@ -1,20 +1,19 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
-#include "soc/soc.h"
-#include "soc/pcr_reg.h"
-
 #pragma once
 
 #include <stdbool.h>
+#include "hal/sec_ll.h"
+#include "soc/clk_tree_defs.h"
 
 void esp_crypto_common_clk_enable(bool enable);
 
 static inline void esp_crypto_clk_init(void)
 {
     // Set crypto clock (`clk_sec`) to use 480M SPLL clock
-    REG_SET_FIELD(PCR_SEC_CONF_REG, PCR_SEC_CLK_SEL, 0x2);
+    sec_ll_crypto_clk_src_sel(SOC_MOD_CLK_SPLL);
 }

components/esp_security/src/esp32c61/esp_crypto_clk.h

@@ -1,20 +1,19 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
-#include "soc/soc.h"
-#include "soc/pcr_reg.h"
-
 #pragma once
 
 #include <stdbool.h>
+#include "hal/sec_ll.h"
+#include "soc/clk_tree_defs.h"
 
 void esp_crypto_common_clk_enable(bool enable);
 
 static inline void esp_crypto_clk_init(void)
 {
     // Set crypto clock (`clk_sec`) to use 480M SPLL clock
-    REG_SET_FIELD(PCR_SEC_CONF_REG, PCR_SEC_CLK_SEL, 0x2);
+    sec_ll_crypto_clk_src_sel(SOC_MOD_CLK_SPLL);
 }

components/esp_security/src/esp32h2/esp_crypto_clk.h

@@ -1,20 +1,19 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
-#include "soc/soc.h"
-#include "soc/pcr_reg.h"
-
 #pragma once
 
 #include <stdbool.h>
+#include "hal/sec_ll.h"
+#include "soc/clk_tree_defs.h"
 
 void esp_crypto_common_clk_enable(bool enable);
 
 static inline void esp_crypto_clk_init(void)
 {
     // Set crypto clock (`clk_sec`) to use 96M PLL clock
-    REG_SET_FIELD(PCR_SEC_CONF_REG, PCR_SEC_CLK_SEL, 0x3);
+    sec_ll_crypto_clk_src_sel(SOC_MOD_CLK_PLL_F96M);
 }

components/esp_security/src/esp32h21/esp_crypto_clk.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -7,6 +7,7 @@
 #include "soc/soc.h"
 #include "soc/pcr_reg.h"
 #include "esp_private/esp_clk_tree_common.h"
+#include "hal/sec_ll.h"
 
 #pragma once
 
@@ -18,5 +19,5 @@ static inline void esp_crypto_clk_init(void)
 {
     // Set crypto clock (`clk_sec`) to use 96M PLL clock
     esp_clk_tree_enable_src(SOC_MOD_CLK_PLL_F96M, true);
-    REG_SET_FIELD(PCR_SEC_CONF_REG, PCR_SEC_CLK_SEL, 0x3);
+    sec_ll_crypto_clk_src_sel(SOC_MOD_CLK_PLL_F96M);
 }

components/esp_security/src/esp32h4/esp_crypto_clk.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -7,6 +7,7 @@
 #include "soc/soc.h"
 #include "soc/pcr_reg.h"
 #include "esp_private/esp_clk_tree_common.h"
+#include "hal/sec_ll.h"
 
 #pragma once
 
@@ -18,5 +19,5 @@ static inline void esp_crypto_clk_init(void)
 {
     // Set crypto clock (`clk_sec`) to use 96M PLL clock
     esp_clk_tree_enable_src(SOC_MOD_CLK_PLL_F96M, true);
-    REG_SET_FIELD(PCR_SEC_CONF_REG, PCR_SEC_CLK_SEL, 0x3);
+    sec_ll_crypto_clk_src_sel(SOC_MOD_CLK_PLL_F96M);
 }

components/esp_security/src/esp32p4/esp_crypto_clk.h

@@ -1,14 +1,15 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
-#include "soc/soc.h"
-#include "soc/hp_sys_clkrst_reg.h"
-#include "esp_private/esp_clk_tree_common.h"
+
 #pragma once
 
 #include <stdbool.h>
+#include "hal/sec_ll.h"
+#include "soc/clk_tree_defs.h"
+#include "esp_private/esp_clk_tree_common.h"
 
 void esp_crypto_common_clk_enable(bool enable);
 
@@ -16,5 +17,5 @@ static inline void esp_crypto_clk_init(void)
 {
     // Set crypto clock (`clk_sec`) to use 240M PLL clock
     esp_clk_tree_enable_src(SOC_MOD_CLK_PLL_F240M, true);
-    REG_SET_FIELD(HP_SYS_CLKRST_PERI_CLK_CTRL25_REG, HP_SYS_CLKRST_REG_CRYPTO_CLK_SRC_SEL, 0x2);
+    sec_ll_crypto_clk_src_sel(SOC_MOD_CLK_PLL_F240M);
 }

components/esp_security/src/esp32s31/esp_crypto_clk.c

@@ -4,35 +4,55 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+#include "esp_attr.h"
 #include "esp_crypto_clk.h"
 #include "soc/clk_tree_defs.h"
 #include "soc/hp_sys_clkrst_struct.h"
+#include "hal/clk_gate_ll.h"
+#include "esp_private/esp_clk_tree_common.h"
 #if !NON_OS_BUILD
 #include "esp_private/critical_section.h"
 #endif
 
 #if !NON_OS_BUILD
 DEFINE_CRIT_SECTION_LOCK_STATIC(s_crypto_common_clk_mux);
+#define CRYPTO_CLK_LOCK()   esp_os_enter_critical_safe(&s_crypto_common_clk_mux)
+#define CRYPTO_CLK_UNLOCK() esp_os_exit_critical_safe(&s_crypto_common_clk_mux)
+#else
+#define CRYPTO_CLK_LOCK()
+#define CRYPTO_CLK_UNLOCK()
 #endif
+
 static int s_crypto_common_clk_ref_cnt;
 
+static void esp_crypto_pll_f240m_enable(bool enable)
+{
+#if !NON_OS_BUILD
+    esp_clk_tree_enable_src(SOC_MOD_CLK_PLL_F240M, enable);
+#else
+    /* Bootloader: BBPLL is already on; no esp_clk_tree in NON_OS. */
+    _clk_gate_ll_ref_240m_clk_en(enable);
+#endif
+}
+
+FORCE_INLINE_ATTR void esp_crypto_periph_clk_enable(bool enable)
+{
+    HP_SYS_CLKRST.crypto_ctrl0.reg_crypto_sys_clk_en = enable;
+    HP_SYS_CLKRST.crypto_ctrl0.reg_crypto_sec_clk_en = enable;
+}
+
 void esp_crypto_common_clk_enable(bool enable)
 {
-#if !NON_OS_BUILD
-    esp_os_enter_critical_safe(&s_crypto_common_clk_mux);
-#endif
+    CRYPTO_CLK_LOCK();
     if (enable) {
         if (s_crypto_common_clk_ref_cnt++ == 0) {
-            HP_SYS_CLKRST.crypto_ctrl0.reg_crypto_sys_clk_en = 1;
-            HP_SYS_CLKRST.crypto_ctrl0.reg_crypto_sec_clk_en = 1;
-        }
-    } else {
-        if (s_crypto_common_clk_ref_cnt > 0 && --s_crypto_common_clk_ref_cnt == 0) {
-            HP_SYS_CLKRST.crypto_ctrl0.reg_crypto_sec_clk_en = 0;
-            HP_SYS_CLKRST.crypto_ctrl0.reg_crypto_sys_clk_en = 0;
+            /* Parent: PLL_F240M (see esp_crypto_clk_init() REG_CRYPTO_CLK_SRC_SEL). */
+            esp_crypto_pll_f240m_enable(true);
+            esp_crypto_periph_clk_enable(true);
         }
+    } else if (s_crypto_common_clk_ref_cnt > 0 && --s_crypto_common_clk_ref_cnt == 0) {
+        esp_crypto_periph_clk_enable(false);
+        esp_crypto_pll_f240m_enable(false);
     }
-#if !NON_OS_BUILD
-    esp_os_exit_critical_safe(&s_crypto_common_clk_mux);
-#endif
+    CRYPTO_CLK_UNLOCK();
 }

components/esp_security/src/esp32s31/esp_crypto_clk.h

@@ -7,14 +7,13 @@
 #pragma once
 
 #include <stdbool.h>
-#include "soc/soc.h"
-#include "soc/hp_sys_clkrst_reg.h"
-#include "soc/hp_sys_clkrst_struct.h"
+#include "hal/sec_ll.h"
+#include "soc/clk_tree_defs.h"
 
 static inline void esp_crypto_clk_init(void)
 {
     // Set crypto clock (`clk_sec`) to use 240M PLL clock
-    REG_SET_FIELD(HP_SYS_CLKRST_CRYPTO_CTRL0_REG, HP_SYS_CLKRST_REG_CRYPTO_CLK_SRC_SEL, 0x2);
+    sec_ll_crypto_clk_src_sel(SOC_MOD_CLK_PLL_F240M);
 }
 
 void esp_crypto_common_clk_enable(bool enable);

components/esp_system/CMakeLists.txt

@@ -89,7 +89,7 @@ else()
 
     idf_component_register(SRCS "${srcs}"
                         INCLUDE_DIRS include
-                        PRIV_REQUIRES spi_flash esp_timer esp_mm
+                        PRIV_REQUIRES spi_flash esp_timer esp_mm esp_hal_security
                                       esp_hal_mspi esp_hal_wdt esp_hal_uart esp_hal_clock esp_hal_dma
                                     # [refactor-todo] requirements due to init code,
                                     # should be removable once using component init functions

components/esp_system/port/soc/esp32s31/system_internal.c

@@ -26,6 +26,7 @@
 #endif
 #include "esp_private/cache_err_int.h"
 #include "hal/uart_ll.h"
+#include "hal/sec_ll.h"
 #include "esp_memory_utils.h"
 
 #define ALIGN_DOWN(val, align)  ((val) & ~((align) - 1))
@@ -51,6 +52,9 @@ void esp_system_reset_modules_on_exit(void)
 
     CLEAR_PERI_REG_MASK(HP_SYSTEM_ECC_MEM_LP_CTRL_REG, HP_SYSTEM_ECC_MEM_LP_EN);
     SET_PERI_REG_MASK(HP_SYSTEM_ECC_MEM_LP_CTRL_REG, HP_SYSTEM_ECC_MEM_LP_FORCE_CTRL);
+    // Reset the clock source selection to an always-on source (XTAL), otherwise if the clock source
+    // is disabled, will get stuck in ROM encryption related ops.
+    sec_ll_crypto_clk_src_sel(SOC_MOD_CLK_XTAL);
 }
 
 static void IRAM_ATTR __attribute__((noinline, noreturn)) esp_restart_noos_inner(void)

components/espcoredump/src/core_dump_sha.c

@@ -1,12 +1,14 @@
 /*
- * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 #include "sdkconfig.h"
 
 #include <string.h>
+#include "hal/sec_ll.h"
 #include "esp_core_dump_types.h"
+#include "esp_crypto_periph_clk.h"
 
 const static char TAG[] __attribute__((unused)) = "esp_core_dump_sha";
 
@@ -40,6 +42,9 @@ static void core_dump_sha256_finish(core_dump_sha_ctx_t *sha_ctx)
 
 static void core_dump_sha256_start(core_dump_sha_ctx_t *sha_ctx)
 {
+    /* Back to always on clock source since the crypto clock source selected in
+       esp_crypto_clk_init may be disabled */
+    sec_ll_crypto_clk_src_sel(SOC_MOD_CLK_XTAL);
     /* Enable SHA hardware */
     ets_sha_enable();
     ets_sha_init(&sha_ctx->ctx, SHA2_256);