feat: enable Secure Boot, Flash Encryption and Key Manager support for S31

2026-09-22 13:01:16 +03:00 · 2026-05-20 15:27:56 +05:30
parent 9cede1d920
commit ae1ec76e82
10 changed files with 838 additions and 291 deletions
--- a/components/bootloader_support/src/esp32s31/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32s31/flash_encryption_secure_features.c
@@ -5,65 +5,66 @@
 */

 #include <strings.h>
+#include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
 #include "esp_efuse_table.h"
 #include "esp_log.h"
 #include "sdkconfig.h"
+#include "esp_crypto_periph_clk.h"
+#include "esp_key_mgr.h"
+#include "hal/key_mgr_hal.h"
+#include "hal/key_mgr_ll.h"

 ESP_LOG_ATTR_TAG(TAG, "flash_encrypt");

 esp_err_t esp_flash_encryption_enable_secure_features(void)
 {
-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
-
-#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
-    ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
-    if (err != ESP_OK) {
-        ESP_LOGE(TAG, "Could not enable Security download mode...");
-        return err;
-    }
-#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
-    ESP_LOGI(TAG, "Disable ROM Download mode...");
-    esp_err_t err = esp_efuse_disable_rom_download_mode();
-    if (err != ESP_OK) {
-        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
-        return err;
-    }
+#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
+    ESP_LOGI(TAG, "Disable UART bootloader encryption...");
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
 #else
-    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "Not disabling UART bootloader encryption");
+#endif
+
+#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
+    ESP_LOGI(TAG, "Disable UART bootloader cache...");
+    esp_efuse_write_field_bit(ESP_EFUSE_SPI_DOWNLOAD_MSPI_DIS);
+#else
+    ESP_LOGW(TAG, "Not disabling UART bootloader cache - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
-    ESP_LOGI(TAG, "Disable hardware & software JTAG...");
+    ESP_LOGI(TAG, "Disable JTAG...");
    esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
    esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
-    esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count);
 #else
    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
 #endif

-#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
-    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
+
+#if CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC
+    ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
+    uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
+    esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
 #endif

-    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
-
-#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
-    bool rd_dis_now = true;
-#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
-    /* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
-       when Flash Encryption is being enabled */
-    rd_dis_now = esp_efuse_is_flash_encryption_enabled();
-#endif
-    if (rd_dis_now) {
-        ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
-        esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
-    }
-#else
-    ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
+#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
+    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
+    // otherwise the Flash Encryption key cannot be read protected
+    esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
 #endif

    return ESP_OK;
 }
+
+esp_err_t esp_flash_encryption_use_efuse_key(void)
+{
+    esp_crypto_key_mgr_enable_periph_clk(true);
+
+    // Force Key Manager to use eFuse key for XTS-AES operation
+    key_mgr_hal_set_key_usage(ESP_KEY_MGR_FLASH_XTS_AES_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
+
+    return ESP_OK;
+}
--- a/components/bootloader_support/src/esp32s31/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32s31/secure_boot_secure_features.c
@@ -0,0 +1,73 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <strings.h>
+#include "esp_secure_boot.h"
+#include "esp_efuse.h"
+#include "esp_efuse_table.h"
+#include "esp_log.h"
+#include "sdkconfig.h"
+
+ESP_LOG_ATTR_TAG(TAG, "secure_boot");
+
+esp_err_t esp_secure_boot_enable_secure_features(void)
+{
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
+
+#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Enabling Security download mode...");
+    esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    esp_err_t err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
+#else
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
+#endif
+
+#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
+    ESP_LOGI(TAG, "Disable hardware & software JTAG...");
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
+    esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count);
+#else
+    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
+#endif
+
+#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
+    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
+#endif
+
+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_SHA384_EN);
+#endif
+
+    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
+
+#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
+    bool rd_dis_now = true;
+#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
+    /* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
+       when Flash Encryption is being enabled */
+    rd_dis_now = esp_efuse_is_flash_encryption_enabled();
+#endif
+    if (rd_dis_now) {
+        ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
+        esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
+    }
+#else
+    ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
+#endif
+
+    return ESP_OK;
+}