Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'feat/enable_sb_and_fe_support_for_esp32s31_v6.1' into 'release/v6.1'

Browse Source 
feat: enable Secure Boot, Flash Encryption and Key Manager support in ESP32S31 (v6.1)

See merge request espressif/esp-idf!49161
This commit is contained in:
Jiang Jiang Jian
2026-06-10 11:13:43 +08:00
parent e406662397 6b6e99be49
commit 895974c34d
11 changed files with 845 additions and 293 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader_support/src/esp32s31/flash_encryption_secure_features.c
+37 -36
View File
@@ -5,65 +5,66 @@
*/
#include <strings.h>
#include "esp_flash_encrypt.h"
#include "esp_secure_boot.h"
#include "esp_efuse.h"
#include "esp_efuse_table.h"
#include "esp_log.h"
#include "sdkconfig.h"
#include "esp_crypto_periph_clk.h"
#include "esp_key_mgr.h"
#include "hal/key_mgr_hal.h"
#include "hal/key_mgr_ll.h"
ESP_LOG_ATTR_TAG(TAG, "flash_encrypt");
esp_err_t esp_flash_encryption_enable_secure_features(void)
{
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
ESP_LOGI(TAG, "Enabling Security download mode...");
esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not enable Security download mode...");
return err;
}
#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
ESP_LOGI(TAG, "Disable ROM Download mode...");
esp_err_t err = esp_efuse_disable_rom_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not disable ROM Download mode...");
return err;
}
#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
ESP_LOGI(TAG, "Disable UART bootloader encryption...");
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
#else
ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
ESP_LOGW(TAG, "Not disabling UART bootloader encryption");
#endif
#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
ESP_LOGI(TAG, "Disable UART bootloader cache...");
esp_efuse_write_field_bit(ESP_EFUSE_SPI_DOWNLOAD_MSPI_DIS);
#else
ESP_LOGW(TAG, "Not disabling UART bootloader cache - SECURITY COMPROMISED");
#endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
ESP_LOGI(TAG, "Disable hardware & software JTAG...");
ESP_LOGI(TAG, "Disable JTAG...");
esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count);
#else
ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
#endif
#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
#if CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC
ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
#endif
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
bool rd_dis_now = true;
#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
/* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
when Flash Encryption is being enabled */
rd_dis_now = esp_efuse_is_flash_encryption_enabled();
#endif
if (rd_dis_now) {
ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
}
#else
ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
// This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
// otherwise the Flash Encryption key cannot be read protected
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
#endif
return ESP_OK;
}
esp_err_t esp_flash_encryption_use_efuse_key(void)
{
esp_crypto_key_mgr_enable_periph_clk(true);
// Force Key Manager to use eFuse key for XTS-AES operation
key_mgr_hal_set_key_usage(ESP_KEY_MGR_FLASH_XTS_AES_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
return ESP_OK;
}
components/bootloader_support/src/esp32s31/secure_boot_secure_features.c
+73
View File
@@ -0,0 +1,73 @@
/*
* SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <strings.h>
#include "esp_secure_boot.h"
#include "esp_efuse.h"
#include "esp_efuse_table.h"
#include "esp_log.h"
#include "sdkconfig.h"
ESP_LOG_ATTR_TAG(TAG, "secure_boot");
esp_err_t esp_secure_boot_enable_secure_features(void)
{
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
ESP_LOGI(TAG, "Enabling Security download mode...");
esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not enable Security download mode...");
return err;
}
#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
ESP_LOGI(TAG, "Disable ROM Download mode...");
esp_err_t err = esp_efuse_disable_rom_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not disable ROM Download mode...");
return err;
}
#else
ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
#endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
ESP_LOGI(TAG, "Disable hardware & software JTAG...");
esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count);
#else
ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
#endif
#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
#endif
#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_SHA384_EN);
#endif
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
bool rd_dis_now = true;
#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
/* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
when Flash Encryption is being enabled */
rd_dis_now = esp_efuse_is_flash_encryption_enabled();
#endif
if (rd_dis_now) {
ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
}
#else
ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
#endif
return ESP_OK;
}
components/bootloader_support/src/secure_boot_v2/secure_boot_ecdsa_signature.c
+7 -2
View File
@@ -58,7 +58,12 @@ esp_err_t verify_ecdsa_signature_block(const ets_secure_boot_signature_t *sig_bl
return ESP_ERR_INVALID_ARG;
}
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDSA(PSA_ALG_SHA_256));
#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
const psa_algorithm_t alg = PSA_ALG_ECDSA(PSA_ALG_SHA_384);
#else
const psa_algorithm_t alg = PSA_ALG_ECDSA(PSA_ALG_SHA_256);
#endif
psa_set_key_algorithm(&key_attributes, alg);
psa_set_key_type(&key_attributes, PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve_family));
/* Prepare the public key data from X and Y coordinates */
@@ -95,7 +100,7 @@ esp_err_t verify_ecdsa_signature_block(const ets_secure_boot_signature_t *sig_bl
}
/* Verify the signature */
status = psa_verify_hash(key_handle, PSA_ALG_ECDSA(PSA_ALG_SHA_256),
status = psa_verify_hash(key_handle, alg,
image_digest, ESP_SECURE_BOOT_DIGEST_LEN,
signature, 2 * key_size);
components/esp_hal_mspi/esp32s31/include/hal/spi_flash_encrypted_ll.h
+57 -14
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -15,11 +15,12 @@
#include <stdbool.h>
#include <string.h>
#include "soc/system_reg.h"
#include "soc/hwcrypto_reg.h"
#include "soc/hp_system_reg.h"
#include "soc/spi_mem_c_reg.h"
#include "soc/soc.h"
#include "soc/soc_caps.h"
#include "hal/assert.h"
#include "hal/spi_flash_encrypt_types.h"
#ifdef __cplusplus
extern "C" {
@@ -36,7 +37,9 @@ typedef enum {
*/
static inline void spi_flash_encrypt_ll_enable(void)
{
// TODO: ["ESP32S31"] IDF-14628
REG_SET_BIT(HP_SYSTEM_CRYPTO_CTRL_REG,
HP_SYSTEM_REG_ENABLE_DOWNLOAD_MANUAL_ENCRYPT |
HP_SYSTEM_REG_ENABLE_SPI_MANUAL_ENCRYPT);
}
/*
@@ -44,7 +47,8 @@ static inline void spi_flash_encrypt_ll_enable(void)
*/
static inline void spi_flash_encrypt_ll_disable(void)
{
// TODO: ["ESP32S31"] IDF-14628
REG_CLR_BIT(HP_SYSTEM_CRYPTO_CTRL_REG,
HP_SYSTEM_REG_ENABLE_SPI_MANUAL_ENCRYPT);
}
/**
@@ -56,7 +60,9 @@ static inline void spi_flash_encrypt_ll_disable(void)
*/
static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type)
{
// TODO: ["ESP32S31"] IDF-14628
// Our hardware only support flash encryption
HAL_ASSERT(type == FLASH_ENCRYPTION_MANU);
REG_SET_FIELD(SPI_MEM_C_XTS_DESTINATION_REG, SPI_XTS_DESTINATION, type);
}
/**
@@ -66,7 +72,8 @@ static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type)
*/
static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size)
{
// TODO: ["ESP32S31"] IDF-14628
// Desired block should not be larger than the block size.
REG_SET_FIELD(SPI_MEM_C_XTS_LINESIZE_REG, SPI_XTS_LINESIZE, size >> 5);
}
/**
@@ -79,7 +86,9 @@ static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size)
*/
static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const uint32_t* buffer, uint32_t size)
{
// TODO: ["ESP32S31"] IDF-14628
uint32_t plaintext_offs = (address % SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX);
HAL_ASSERT(plaintext_offs + size <= SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX);
memcpy((void *)(SPI_MEM_C_XTS_PLAIN_BASE_REG + plaintext_offs), buffer, size);
}
/**
@@ -89,7 +98,7 @@ static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const u
*/
static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr)
{
// TODO: ["ESP32S31"] IDF-14628
REG_SET_FIELD(SPI_MEM_C_XTS_PHYSICAL_ADDRESS_REG, SPI_XTS_PHYSICAL_ADDRESS, flash_addr);
}
/**
@@ -97,7 +106,7 @@ static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr)
*/
static inline void spi_flash_encrypt_ll_calculate_start(void)
{
// TODO: ["ESP32S31"] IDF-14628
REG_SET_FIELD(SPI_MEM_C_XTS_TRIGGER_REG, SPI_XTS_TRIGGER, 1);
}
/**
@@ -105,7 +114,8 @@ static inline void spi_flash_encrypt_ll_calculate_start(void)
*/
static inline void spi_flash_encrypt_ll_calculate_wait_idle(void)
{
// TODO: ["ESP32S31"] IDF-14628
while (REG_GET_FIELD(SPI_MEM_C_XTS_STATE_REG, SPI_XTS_STATE) == 0x1) {
}
}
/**
@@ -113,7 +123,9 @@ static inline void spi_flash_encrypt_ll_calculate_wait_idle(void)
*/
static inline void spi_flash_encrypt_ll_done(void)
{
// TODO: ["ESP32S31"] IDF-14628
REG_SET_BIT(SPI_MEM_C_XTS_RELEASE_REG, SPI_XTS_RELEASE);
while (REG_GET_FIELD(SPI_MEM_C_XTS_STATE_REG, SPI_XTS_STATE) != 0x3) {
}
}
/**
@@ -121,7 +133,7 @@ static inline void spi_flash_encrypt_ll_done(void)
*/
static inline void spi_flash_encrypt_ll_destroy(void)
{
// TODO: ["ESP32S31"] IDF-14628
REG_SET_BIT(SPI_MEM_C_XTS_DESTROY_REG, SPI_XTS_DESTROY);
}
/**
@@ -132,7 +144,38 @@ static inline void spi_flash_encrypt_ll_destroy(void)
*/
static inline bool spi_flash_encrypt_ll_check(uint32_t address, uint32_t length)
{
return 0;//((address % length) == 0) ? true : false;
return ((address % length) == 0) ? true : false;
}
/**
* @brief Enable the pseudo-round function during XTS-AES operations
*
* @param mode set the mode for pseudo rounds, zero to disable, with increasing security upto three.
* @param base basic number of pseudo rounds, zero if disable
* @param increment increment number of pseudo rounds, zero if disable
* @param key_rng_cnt update frequency of the pseudo-key, zero if disable
*/
static inline void spi_flash_encrypt_ll_enable_pseudo_rounds(esp_xts_aes_psuedo_rounds_state_t mode, uint8_t base, uint8_t increment, uint8_t key_rng_cnt)
{
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_MODE_PSEUDO, mode);
if (mode != ESP_XTS_AES_PSEUDO_ROUNDS_DISABLE) {
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_BASE, base);
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_INC, increment);
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_RNG_CNT, key_rng_cnt);
} else {
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_BASE, 0);
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_INC, 0);
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_RNG_CNT, 0);
}
}
/**
* @brief Check if the pseudo round function is supported
*/
static inline bool spi_flash_encrypt_ll_is_pseudo_rounds_function_supported(void)
{
return true;
}
#ifdef __cplusplus
components/esp_rom/esp32s31/include/esp32s31/rom/ecdsa.h
+5 -2
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -13,10 +13,13 @@ extern "C" {
#endif
#define ETS_DIGEST_LEN 32 /* SHA-256, bytes */
#define ETS_DIGEST_SHA256_LEN 32 /* SHA-256, bytes */
#define ETS_DIGEST_SHA384_LEN 48 /* SHA-384, bytes */
typedef enum {
ECDSA_CURVE_P192 = 1,
ECDSA_CURVE_P256 = 2
ECDSA_CURVE_P256 = 2,
ECDSA_CURVE_P384 = 3
} ECDSA_CURVE;
int ets_ecdsa_verify(const uint8_t *key, const uint8_t *sig, ECDSA_CURVE curve_id, const uint8_t *digest, uint8_t *verified_digest);
components/esp_rom/esp32s31/include/esp32s31/rom/secure_boot.h
+21 -1
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -88,6 +88,25 @@ struct ets_secure_boot_sig_block {
#elif CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
struct __attribute((packed)) ets_secure_boot_sig_block {
uint8_t magic_byte;
uint8_t version;
uint8_t sha_version;
uint8_t _reserved2;
uint8_t image_digest[48];
struct {
struct {
uint8_t curve_id;
uint8_t point[96]; /* X followed by Y (both little-endian) */
} key;
uint8_t signature[96]; /* r followed by s (both little-endian) */
uint8_t padding[951];
} ecdsa;
uint32_t block_crc;
uint8_t _padding[16];
};
#else
struct __attribute((packed)) ets_secure_boot_sig_block {
uint8_t magic_byte;
uint8_t version;
@@ -106,6 +125,7 @@ struct __attribute((packed)) ets_secure_boot_sig_block {
uint8_t _padding[16];
};
#endif
#endif
ESP_STATIC_ASSERT(sizeof(ets_secure_boot_sig_block_t) == 1216, "invalid sig block size");
components/esp_security/src/init.c
+5 -5
View File
@@ -115,14 +115,14 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
#endif
#if !CONFIG_SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA
// C5
#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS && !CONFIG_IDF_TARGET_ESP32P4
#if SOC_EFUSE_SECURE_BOOT_P384_WR_DIS && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
// Since SECURE_BOOT_SHA384_EN, XTS_DPA_PSEUDO_LEVEL, and ECC_FORCE_CONST_TIME share the
// same write-protection bit, these efuses should only be write-protected after all of
// them have been programmed.
// Note: ESP32-P4 lacks WR_DIS_SECURE_BOOT_SHA384_EN bit, so it relies on software protection
// in the efuse write APIs (see esp_efuse_api.c) to prevent unauthorized programming of
// SECURE_BOOT_SHA384_EN when Secure Boot using SHA-256 is enabled.
// Note: targets without SOC_EFUSE_SECURE_BOOT_P384_WR_DIS (e.g. ESP32-P4, ESP32-S31) lack
// the WR_DIS_SECURE_BOOT_SHA384_EN bit and rely on software protection in the efuse write
// APIs (see esp_efuse_api.c) to prevent unauthorized programming of SECURE_BOOT_SHA384_EN
// when Secure Boot using SHA-256 is enabled.
err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to write protect the SECURE_BOOT_SHA384_EN efuse bit.");
components/soc/esp32s31/include/soc/Kconfig.soc_caps.in
+60
View File
@@ -199,6 +199,14 @@ config SOC_ECDSA_SUPPORTED
bool
default y
config SOC_FLASH_ENC_SUPPORTED
bool
default y
config SOC_SECURE_BOOT_SUPPORTED
bool
default y
config SOC_BOD_SUPPORTED
bool
default y
@@ -1159,6 +1167,14 @@ config SOC_EFUSE_ECDSA_KEY_P384
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_EFUSE_XTS_AES_KEY_256
bool
default y
config SOC_HUK_SUPPORTED
bool
default y
@@ -1175,6 +1191,18 @@ config SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
bool
default y
config SOC_KEY_MANAGER_FE_KEY_DEPLOY
bool
default y
config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
bool
default y
config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256
bool
default y
config SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
bool
default y
@@ -1187,14 +1215,46 @@ config SOC_LCDCAM_CAM_SUPPORT_RGB_YUV_CONV
bool
default y
config SOC_SECURE_BOOT_V2_RSA
bool
default y
config SOC_SECURE_BOOT_V2_ECC
bool
default n
config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS
int
default 3
config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
bool
default y
config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_128
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_256
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
bool
default y
config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX
int
default 64
components/soc/esp32s31/include/soc/soc_caps.h
+16 -7
View File
@@ -73,8 +73,8 @@
#define SOC_ECC_SUPPORTED 1
#define SOC_ECC_EXTENDED_MODES_SUPPORTED 1
#define SOC_ECDSA_SUPPORTED 1
// #define SOC_FLASH_ENC_SUPPORTED 1 // TODO: [ESP32S31] IDF-14628
// #define SOC_SECURE_BOOT_SUPPORTED 1 // TODO: [ESP32S31] IDF-14629
#define SOC_FLASH_ENC_SUPPORTED 1
#define SOC_SECURE_BOOT_SUPPORTED 1
#define SOC_BOD_SUPPORTED 1
// #define SOC_APM_SUPPORTED 1 // TODO: [ESP32S31] IDF-14620
#define SOC_PAU_SUPPORTED 1
@@ -437,29 +437,38 @@
#define SOC_EFUSE_ECDSA_KEY 1
#define SOC_EFUSE_ECDSA_KEY_P192 1
#define SOC_EFUSE_ECDSA_KEY_P384 1
#define SOC_EFUSE_XTS_AES_KEY_128 1
#define SOC_EFUSE_XTS_AES_KEY_256 1
/*-------------------------- HUK CAPS----------------------------*/
#define SOC_HUK_SUPPORTED 1
/*-------------------------- Key Manager CAPS----------------------------*/
// TODO: [ESP32S31] IDF-14626
#define SOC_KEY_MANAGER_SUPPORTED 1
#define SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT 1 /*!< Key manager supports key deployment */
#define SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY 1 /*!< Key manager responsible to deploy ECDSA key */
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY 1 /*!< Key manager responsible to deploy Flash Encryption key */
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 1 /*!< Key manager responsible to deploy the XTS-AES-128 key */
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 1 /*!< Key manager responsible to deploy the XTS-AES-256 key */
#define SOC_KEY_MANAGER_HMAC_KEY_DEPLOY 1 /*!< Key manager responsible to deploy HMAC key */
#define SOC_KEY_MANAGER_DS_KEY_DEPLOY 1 /*!< Key manager responsible to deploy DS key */
// SOC_KEY_MANAGER_FE_KEY_DEPLOY (incl. XTS-AES-128/256) will be enabled along with Flash Encryption support.
/*--------------------------- CAM ---------------------------------*/
#define SOC_LCDCAM_CAM_SUPPORT_RGB_YUV_CONV (1)
/*-------------------------- Secure Boot CAPS----------------------------*/
// TODO: [ESP32S31] IDF-14629
#define SOC_SECURE_BOOT_V2_RSA 1
#define SOC_SECURE_BOOT_V2_ECC 0
#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3
#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1
#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1
/*-------------------------- Flash Encryption CAPS----------------------------*/
// TODO: [ESP32S31] IDF-14628
#define SOC_FLASH_ENCRYPTION_XTS_AES 1
#define SOC_FLASH_ENCRYPTION_XTS_AES 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1 /* SOC_EFUSE_XTS_AES_KEY_128 (1) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 (1) */
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1 /* SOC_EFUSE_XTS_AES_KEY_256 (1) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 (1) */
#define SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND 1
#define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64)
/*------------------------Bootloader CAPS---------------------------------*/