Merge branch 'fix/disable-key-mgr_v6.1' into 'release/v6.1'

Disable Key Manager support (v6.1) See merge request espressif/esp-idf!51390
2026-09-22 13:01:16 +03:00 · 2026-08-27 12:29:18 +05:30
parent 7b18822f6d a827d27b12
commit 9058e758d7
28 changed files with 44 additions and 52 deletions
--- a/components/esp_hal_security/CMakeLists.txt
+++ b/components/esp_hal_security/CMakeLists.txt
@@ -72,8 +72,11 @@ elseif(NOT BOOTLOADER_BUILD)
 endif()

 # Key Manager and HUK HAL (available in both bootloader and app builds)
-if(CONFIG_SOC_KEY_MANAGER_SUPPORTED)
+if(CONFIG_SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT)
    list(APPEND srcs "key_mgr_hal.c")
+endif()
+
+if(CONFIG_SOC_HUK_SUPPORTED)
    list(APPEND srcs "huk_hal.c")
 endif()

--- a/components/esp_hal_security/ecdsa_hal.c
+++ b/components/esp_hal_security/ecdsa_hal.c
@@ -49,7 +49,7 @@ static void configure_ecdsa_periph(ecdsa_hal_config_t *conf)
        key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
 #endif
    }
-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
    else {
        if (!key_mgr_ll_is_supported()) {
            HAL_ASSERT(false && "Key manager is not supported");
--- a/components/esp_hal_security/esp32c5/include/hal/huk_ll.h
+++ b/components/esp_hal_security/esp32c5/include/hal/huk_ll.h
@@ -13,7 +13,7 @@

 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_HUK_SUPPORTED

 #include <stdint.h>
 #include <stdbool.h>
--- a/components/esp_hal_security/esp32p4/include/hal/huk_ll.h
+++ b/components/esp_hal_security/esp32p4/include/hal/huk_ll.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -13,7 +13,7 @@

 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_HUK_SUPPORTED

 #include <stdint.h>
 #include <stdbool.h>
--- a/components/esp_hal_security/esp32s31/include/hal/huk_ll.h
+++ b/components/esp_hal_security/esp32s31/include/hal/huk_ll.h
@@ -13,7 +13,7 @@

 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_HUK_SUPPORTED

 #include <stdint.h>
 #include <stdbool.h>
--- a/components/esp_hal_security/huk_hal.c
+++ b/components/esp_hal_security/huk_hal.c
@@ -14,7 +14,7 @@
 #include "esp_err.h"
 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_HUK_SUPPORTED
 esp_huk_state_t huk_hal_get_state(void)
 {
    return huk_ll_get_state();
--- a/components/esp_hal_security/include/hal/huk_types.h
+++ b/components/esp_hal_security/include/hal/huk_types.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -7,7 +7,7 @@

 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_HUK_SUPPORTED

 #include "esp_assert.h"
 #include "rom/km.h"
--- a/components/esp_hal_security/include/hal/key_mgr_hal.h
+++ b/components/esp_hal_security/include/hal/key_mgr_hal.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -9,7 +9,7 @@

 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
 #include "hal/key_mgr_types.h"

 #ifdef __cplusplus
@@ -138,4 +138,4 @@ void key_mgr_hal_set_date_info(const uint32_t date_info);
 #ifdef __cplusplus
 }
 #endif
-#endif /* SOC_KEY_MANAGER_SUPPORTED */
+#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */
--- a/components/esp_hal_security/test_apps/crypto/main/Kconfig.projbuild
+++ b/components/esp_hal_security/test_apps/crypto/main/Kconfig.projbuild
@@ -46,8 +46,11 @@ menu "Test App Configuration"
        bool
        default n if IDF_TARGET_ESP32P4 && ESP32P4_SELECTS_REV_LESS_V3
        default y
-        depends on SOC_KEY_MANAGER_SUPPORTED
+        depends on SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
        help
            A hidden config to determine if the Key Manager tests should be included.
+            The tests build the esp_key_mgr driver from source so that the Key Manager
+            hardware stays covered by CI even on targets where IDF does not support
+            the Key Manager (SOC_KEY_MANAGER_SUPPORTED = 0).

 endmenu
--- a/components/esp_rom/esp32c5/include/esp32c5/rom/key_mgr.h
+++ b/components/esp_rom/esp32c5/include/esp32c5/rom/key_mgr.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -8,7 +8,6 @@

 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED

 #include "rom/ets_sys.h"
 #include "esp_attr.h"
@@ -112,4 +111,3 @@ struct km_deploy_ops {
 #if __cplusplus
 }
 #endif
-#endif
--- a/components/esp_rom/esp32c5/include/esp32c5/rom/km.h
+++ b/components/esp_rom/esp32c5/include/esp32c5/rom/km.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -8,7 +8,6 @@
 #define _KM_H

 #include "soc/soc_caps.h"
-#if SOC_KEY_MANAGER_SUPPORTED

 #include <stdint.h>
 #include "soc/soc.h"
@@ -58,6 +57,5 @@ int esp_rom_km_huk_risk(void);
 #ifdef __cplusplus
 }
 #endif
-#endif /* SOC_KEY_MANAGER_SUPPORTED */

 #endif /* _KM_H */
--- a/components/esp_rom/esp32p4/include/esp32p4/rom/key_mgr.h
+++ b/components/esp_rom/esp32p4/include/esp32p4/rom/key_mgr.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -7,7 +7,6 @@

 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED
 #include <stdint.h>
 #include "esp_attr.h"
 #include "ets_sys.h"
@@ -109,4 +108,3 @@ struct km_deploy_ops {
 #if __cplusplus
 }
 #endif
-#endif
--- a/components/esp_rom/esp32p4/include/esp32p4/rom/km.h
+++ b/components/esp_rom/esp32p4/include/esp32p4/rom/km.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -8,7 +8,6 @@
 #define _KM_H

 #include "soc/soc_caps.h"
-#if SOC_KEY_MANAGER_SUPPORTED

 #include <stdint.h>
 #include "soc/soc.h"
@@ -58,6 +57,5 @@ int esp_rom_km_huk_risk(void);
 #ifdef __cplusplus
 }
 #endif
-#endif

 #endif /* _KM_H */
--- a/components/esp_rom/esp32s31/include/esp32s31/rom/key_mgr.h
+++ b/components/esp_rom/esp32s31/include/esp32s31/rom/key_mgr.h
@@ -7,7 +7,6 @@

 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED
 #include <stdint.h>
 #include "esp_attr.h"
 #include "ets_sys.h"
@@ -109,4 +108,3 @@ struct km_deploy_ops {
 #if __cplusplus
 }
 #endif
-#endif
--- a/components/esp_rom/esp32s31/include/esp32s31/rom/km.h
+++ b/components/esp_rom/esp32s31/include/esp32s31/rom/km.h
@@ -8,7 +8,6 @@
 #define _KM_H

 #include "soc/soc_caps.h"
-#if SOC_KEY_MANAGER_SUPPORTED

 #include <stdint.h>
 #include "soc/soc.h"
@@ -58,6 +57,5 @@ int esp_rom_km_huk_risk(void);
 #ifdef __cplusplus
 }
 #endif
-#endif

 #endif /* _KM_H */
--- a/components/esp_security/CMakeLists.txt
+++ b/components/esp_security/CMakeLists.txt
@@ -49,7 +49,7 @@ else()  # BOOTLOADER_BUILD
    list(APPEND srcs "src/esp_crypto_lock.c" "src/esp_crypto_periph_clk.c"
                    "src/${target}/esp_crypto_clk.c")

-    if(CONFIG_SOC_KEY_MANAGER_FE_KEY_DEPLOY)
+    if(CONFIG_SOC_KEY_MANAGER_SUPPORTED AND CONFIG_SOC_KEY_MANAGER_FE_KEY_DEPLOY)
        list(APPEND srcs "src/esp_key_mgr.c")
    endif()
 endif()
--- a/components/esp_security/include/esp_crypto_lock.h
+++ b/components/esp_security/include/esp_crypto_lock.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -122,7 +122,7 @@ void esp_crypto_ecdsa_lock_acquire(void);
 void esp_crypto_ecdsa_lock_release(void);
 #endif /* SOC_ECDSA_SUPPORTED */

-#ifdef SOC_KEY_MANAGER_SUPPORTED
+#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
 /**
 * @brief Acquire lock for Key Manager peripheral
 *
@@ -134,7 +134,7 @@ void esp_crypto_key_manager_lock_acquire(void);
 *
 */
 void esp_crypto_key_manager_lock_release(void);
-#endif /* SOC_KEY_MANAGER_SUPPORTED */
+#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */

 #ifdef __cplusplus
 }
--- a/components/esp_security/include/esp_key_mgr.h
+++ b/components/esp_security/include/esp_key_mgr.h
@@ -8,7 +8,7 @@
 #include "esp_err.h"
 #include "soc/soc_caps.h"

-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT

 #ifdef __cplusplus
 extern "C" {
--- a/components/esp_security/src/esp_crypto_lock.c
+++ b/components/esp_security/src/esp_crypto_lock.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -52,10 +52,10 @@ static _lock_t s_crypto_ecdsa_lock;
 #endif /* SOC_ECDSA_USES_MPI */
 #endif /* SOC_ECDSA_SUPPORTED */

-#ifdef SOC_KEY_MANAGER_SUPPORTED
+#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
 /* Lock for Key Manager peripheral */
 static _lock_t s_crypto_key_manager_lock;
-#endif /* SOC_KEY_MANAGER_SUPPORTED */
+#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */

 #ifdef SOC_HMAC_SUPPORTED
 void esp_crypto_hmac_lock_acquire(void)
@@ -159,7 +159,7 @@ void esp_crypto_ecdsa_lock_release(void)
 }
 #endif /* SOC_ECDSA_SUPPORTED */

-#ifdef SOC_KEY_MANAGER_SUPPORTED
+#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
 void esp_crypto_key_manager_lock_acquire(void)
 {
    _lock_acquire(&s_crypto_key_manager_lock);
@@ -169,7 +169,7 @@ void esp_crypto_key_manager_lock_release(void)
 {
    _lock_release(&s_crypto_key_manager_lock);
 }
-#endif /* SOC_KEY_MANAGER_SUPPORTED */
+#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */
 #else /* NON_OS_BUILD */
 #ifdef SOC_HMAC_SUPPORTED
 void esp_crypto_hmac_lock_acquire(void) {}
@@ -213,9 +213,9 @@ void esp_crypto_ecdsa_lock_acquire(void) {}
 void esp_crypto_ecdsa_lock_release(void) {}
 #endif /* SOC_ECDSA_SUPPORTED */

-#ifdef SOC_KEY_MANAGER_SUPPORTED
+#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
 void esp_crypto_key_manager_lock_acquire(void) {}

 void esp_crypto_key_manager_lock_release(void) {}
-#endif /* SOC_KEY_MANAGER_SUPPORTED */
+#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */
 #endif /* !NON_OS_BUILD */
--- a/components/esp_security/src/esp_crypto_periph_clk.c
+++ b/components/esp_security/src/esp_crypto_periph_clk.c
@@ -32,7 +32,7 @@
 #if SOC_ECDSA_SUPPORTED
 #include "hal/ecdsa_ll.h"
 #endif
-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
 #include "hal/key_mgr_ll.h"
 #endif
 /* Crypto DMA, shared between AES and SHA */
@@ -154,7 +154,7 @@ void esp_crypto_ecdsa_enable_periph_clk(bool enable)
 }
 #endif

-#if SOC_KEY_MANAGER_SUPPORTED
+#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
 void esp_crypto_key_mgr_enable_periph_clk(bool enable)
 {
    KEY_MANAGER_RCC_ATOMIC() {
--- a/components/esp_security/src/esp_key_mgr.c
+++ b/components/esp_security/src/esp_key_mgr.c
@@ -20,7 +20,6 @@
 #include "hal/huk_hal.h"
 #include "rom/key_mgr.h"

-#if SOC_KEY_MANAGER_SUPPORTED
 static const char *TAG = "esp_key_mgr";

 ESP_STATIC_ASSERT(sizeof(esp_key_mgr_key_recovery_info_t) == sizeof(struct huk_key_block), "Size of esp_key_mgr_key_recovery_info_t should match huk_key_block (from ROM)");
@@ -1072,4 +1071,3 @@ cleanup:
    esp_key_mgr_release_hardware(true);
    return esp_ret;
 }
-#endif
--- a/components/soc/esp32c5/include/soc/Kconfig.soc_caps.in
+++ b/components/soc/esp32c5/include/soc/Kconfig.soc_caps.in
@@ -257,7 +257,7 @@ config SOC_RNG_SUPPORTED

 config SOC_KEY_MANAGER_SUPPORTED
    bool
-    default y
+    default n

 config SOC_HUK_SUPPORTED
    bool
--- a/components/soc/esp32c5/include/soc/soc_caps.h
+++ b/components/soc/esp32c5/include/soc/soc_caps.h
@@ -86,7 +86,7 @@
 #define SOC_SPI_FLASH_SUPPORTED         1
 #define SOC_ECDSA_SUPPORTED             1
 #define SOC_RNG_SUPPORTED               1
-#define SOC_KEY_MANAGER_SUPPORTED       1
+#define SOC_KEY_MANAGER_SUPPORTED       0
 #define SOC_HUK_SUPPORTED               1
 #define SOC_MODEM_CLOCK_SUPPORTED       1
 #define SOC_REGI2C_SUPPORTED            1
--- a/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in
+++ b/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in
@@ -221,7 +221,7 @@ config SOC_ECDSA_SUPPORTED

 config SOC_KEY_MANAGER_SUPPORTED
    bool
-    default y
+    default n

 config SOC_HUK_SUPPORTED
    bool
--- a/components/soc/esp32p4/include/soc/soc_caps.h
+++ b/components/soc/esp32p4/include/soc/soc_caps.h
@@ -77,7 +77,7 @@
 #define SOC_ECC_SUPPORTED               1
 #define SOC_ECC_EXTENDED_MODES_SUPPORTED   1
 #define SOC_ECDSA_SUPPORTED             1
-#define SOC_KEY_MANAGER_SUPPORTED       1
+#define SOC_KEY_MANAGER_SUPPORTED       0
 #define SOC_HUK_SUPPORTED               1
 #define SOC_FLASH_ENC_SUPPORTED         1
 #define SOC_SECURE_BOOT_SUPPORTED       1
--- a/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in
+++ b/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in
@@ -1197,7 +1197,7 @@ config SOC_HUK_SUPPORTED

 config SOC_KEY_MANAGER_SUPPORTED
    bool
-    default y
+    default n

 config SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
    bool
--- a/components/soc/esp32s31/include/soc/soc_caps.h
+++ b/components/soc/esp32s31/include/soc/soc_caps.h
@@ -447,7 +447,7 @@
 #define SOC_HUK_SUPPORTED                       1

 /*-------------------------- Key Manager CAPS----------------------------*/
-#define SOC_KEY_MANAGER_SUPPORTED                   1
+#define SOC_KEY_MANAGER_SUPPORTED                   0
 #define SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT      1 /*!< Key manager supports key deployment */
 #define SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY            1 /*!< Key manager responsible to deploy ECDSA key */
 #define SOC_KEY_MANAGER_FE_KEY_DEPLOY               1 /*!< Key manager responsible to deploy Flash Encryption key */
--- a/examples/security/flash_encryption/README.md
+++ b/examples/security/flash_encryption/README.md
@@ -71,7 +71,7 @@ FATFS encryption example uses two additional partitions in the partition table.

 > **Note:** This feature is only available on targets with the Key Manager peripheral: **ESP32-C5** and **ESP32-P4**.

-On supported targets, the Flash Encryption key can be deployed into and managed by the [Key Manager](https://docs.espressif.com/projects/esp-idf/en/latest/esp32c5/api-reference/peripherals/key_manager.html) peripheral instead of an eFuse block. This means the plaintext key material is never stored in eFuses, RAM, or flash - it is bound to the device's Hardware Unique Key (HUK) and accessible only to hardware peripherals.
+On supported targets, the Flash Encryption key can be deployed into and managed by the [Key Manager](../../../docs/en/api-reference/peripherals/key_manager.rst) peripheral instead of an eFuse block. This means the plaintext key material is never stored in eFuses, RAM, or flash - it is bound to the device's Hardware Unique Key (HUK) and accessible only to hardware peripherals.

 For the full workflow (key deployment, eFuse programming, and boot sequence), refer to the [Flash Encryption documentation](https://docs.espressif.com/projects/esp-idf/en/latest/esp32c5/security/flash-encryption.html).