Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat: enable Secure Boot, Flash Encryption and Key Manager support for S31

Browse Source
This commit is contained in:
nilesh.kale
2026-05-20 15:27:56 +05:30
parent 9cede1d920
commit ae1ec76e82
10 changed files with 838 additions and 291 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
components/esp_security/src/init.c
View File

@@ -115,14 +115,14 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
#endif
#if !CONFIG_SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA
// C5
#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS && !CONFIG_IDF_TARGET_ESP32P4
#if SOC_EFUSE_SECURE_BOOT_P384_WR_DIS && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
// Since SECURE_BOOT_SHA384_EN, XTS_DPA_PSEUDO_LEVEL, and ECC_FORCE_CONST_TIME share the
// same write-protection bit, these efuses should only be write-protected after all of
// them have been programmed.
// Note: ESP32-P4 lacks WR_DIS_SECURE_BOOT_SHA384_EN bit, so it relies on software protection
// in the efuse write APIs (see esp_efuse_api.c) to prevent unauthorized programming of
// SECURE_BOOT_SHA384_EN when Secure Boot using SHA-256 is enabled.
// Note: targets without SOC_EFUSE_SECURE_BOOT_P384_WR_DIS (e.g. ESP32-P4, ESP32-S31) lack
// the WR_DIS_SECURE_BOOT_SHA384_EN bit and rely on software protection in the efuse write
// APIs (see esp_efuse_api.c) to prevent unauthorized programming of SECURE_BOOT_SHA384_EN
// when Secure Boot using SHA-256 is enabled.
err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to write protect the SECURE_BOOT_SHA384_EN efuse bit.");