ESP32-S2 disables the brownout detector before deep sleep; if sleep is
rejected, re-init it so BOD is not left disabled (PM-519).
Co-authored-by: Cursor <cursoragent@cursor.com>
change(esp_tee): Force non-deterministic ECDSA signing for TEE secure storage keys
Closes IDF-15937 and IDF-15939
See merge request espressif/esp-idf!50355
The bootloader programs only unlocked PMA entries (no PMP), so the layout is
not a bootloader<->application ABI; the application resets all entries, programs
them in ascending order from IRAM, and locks everything. Verified on ESP32-H4 v0.1.
Every other SOC_*_HIGH macro in soc.h is an exclusive region end;
SOC_RAM_ICACHE1_HIGH was the inclusive last byte (0x40867fff). This
also made the reclaimed ICache1 heap region in single core mode
(components/heap/port/esp32h4/memory_layout.c, sized as HIGH - LOW)
one byte short. Change the value to the exclusive end 0x40868000 and
drop the +1 compensation at the SOC_HP_RAM_HIGH definition.
esp_mspi_align.c resolves PSRAM encryption state through esp_psram, a
dependency esp_hw_support declares only outside the no-OS builds. Nothing
in the bootloader calls the helper, so drop the source there rather than
keep one whose dependency cannot be satisfied. ESP-TEE still builds it,
as its mbedtls port calls into it.
Both PSRAM layouts were mapped as a single RWX window, so everything in external
RAM - the heap included - was executable.
PSRAM used as data only is now RW, and under XIP-from-PSRAM it is split per
section as ESP32-P4 does: .text RX, .rodata read-only, and the MMU-page
alignment gaps and the reclaimed heap RW, so neither is executable.
Both describe the layout that esp_psram_init() produces, and the entries are
locked, so - again as on ESP32-P4 - they are only narrowed when
CONFIG_SPIRAM_PRE_CONFIGURE_MEMORY_PROTECTION says that layout applies. Without
it the application owns the region and PSRAM stays RWX.
The per-section entries cost one PMP entry more than the 16 available, so the CPU
subsystem and peripheral windows are chained as TOR entries, taking one entry
instead of three.
soc.h is corrected against the S31 bus address map: the peripheral window base
was 1 MB too low, and the LP peripheral top, derived from a register base plus a
size rather than from the map, was 16 KB short. SOC_NON_CACHEABLE_OFFSET_FLASH
is added.
The bootloader locks PMA entries on core 0 only (PMA is per-hart), so
core 1 applies its PMA configuration with effective writes. Executing
that from flash momentarily makes the flash aperture non-cacheable
while reprogramming its entry, which executes ciphertext with flash
encryption enabled (illegal instruction -> CPU lockup).
Run esp_cpu_configure_invalid_regions() from IRAM: it reprograms the PMA
entry that keeps the flash aperture cacheable, so an instruction fetched
from flash inside the reprogramming window bypasses the cache and, with
flash encryption enabled, executes ciphertext (illegal instruction ->
CPU lockup).
Also move the PSRAM PMA entry to index 7 so that the application layout
matches the entry earlier bootloaders programmed and locked, keeping the
full layout effective under such bootloaders.
Freezing PMP entry indices as a bootloader<->application ABI (pmp_layout.h)
is only needed on targets where an already-shipped bootloader locks PMP
entries (C5, C6, C61, H2, P4). No such bootloader has ever shipped for
ESP32-S31 and, per the v6.2 PMP ownership policy, the bootloader never
configures or locks any PMP entry on this target - so there is no ABI to
freeze. Program all entries by plain index (as on ESP32-H4/H21) and state
that the application-owned layout is not an ABI.
The critical section port already disables interrupts and reads the core id for
the whole section, but spinlock_acquire()/spinlock_release() then disabled
interrupts again to the same level and re-read the core id register.
Add spinlock_acquire_impl()/spinlock_release_impl(), which take a caller-supplied
owner id and skip interrupt management, and reuse them from
spinlock_acquire()/spinlock_release() to avoid duplicated code. The Xtensa and
RISC-V ports now read the core id once and call the impl variants, removing one
core id read and one interrupt mask/restore per critical section enter and exit.
Closes https://github.com/espressif/esp-idf/issues/18908
