IDF master d93887f9f (#5336)

* Update toolchain

* Update package_esp32_index.template.json

* add optional component dependencies after Kconfig options are known (#5404)

Until this commit, Kconfig options (e.g. CONFIG_TINYUSB_ENABLED) were
used in conditions preceding idf_component_register to determine which
components need to be added to `arduino` component requirements.
However the Kconfig options aren't known at the early expansion stage,
when the component CMakeLists.txt files are expanded the first time
and requirements are evaluated. So all the conditions evaluated as if
the options were not set.
This commit changes the logic to only add these components as
dependencies when the Kconfig options are known. Dependencies become
"weak", which means that if one of the components isn't included into
the build for some reason, it is not added as a dependency.
This may happen, for example, if the component is not present in the
`components` directory or is excluded by setting `COMPONENTS` variable
in the project CMakeLists.txt file.
This also ensures that if the component is not present, it will not be
added as a dependency, and this will allow the build to proceed.

Follow-up to https://github.com/espressif/arduino-esp32/pull/5391.
Closes https://github.com/espressif/arduino-esp32/issues/5319.

* IDF master d93887f9f

* PlatformIO updates for CI (#5387)

* Update PlatformIO CI build script

- Switch to the latest toolchains 8.4.0 for ESP32, ESP32S2, ESP32C3
- Use PlatformIO from master branch for better robustness

* Update package.json for PlatformIO

Co-authored-by: Ivan Grokhotkov <ivan@espressif.com>
Co-authored-by: Valerii Koval <valeros@users.noreply.github.com>

tools/sdk/esp32/include/bootloader_support/include/bootloader_common.h

@@ -17,6 +17,8 @@
 #include "esp32s3/rom/rtc.h"
 #elif CONFIG_IDF_TARGET_ESP32C3
 #include "esp32c3/rom/rtc.h"
+#elif CONFIG_IDF_TARGET_ESP32H2
+#include "esp32h2/rom/rtc.h"
 #endif
 
 #ifdef __cplusplus

tools/sdk/esp32/include/bootloader_support/include/esp_app_format.h

@@ -15,7 +15,8 @@ typedef enum {
     ESP_CHIP_ID_ESP32 = 0x0000,  /*!< chip ID: ESP32 */
     ESP_CHIP_ID_ESP32S2 = 0x0002,  /*!< chip ID: ESP32-S2 */
     ESP_CHIP_ID_ESP32C3 = 0x0005, /*!< chip ID: ESP32-C3 */
-    ESP_CHIP_ID_ESP32S3 = 0x0006, /*!< chip ID: ESP32-S3 */
+    ESP_CHIP_ID_ESP32S3 = 0x0009, /*!< chip ID: ESP32-S3 */
+    ESP_CHIP_ID_ESP32H2 = 0x000A, /*!< chip ID: ESP32-H2 */  // ESP32H2-TODO: IDF-3475
     ESP_CHIP_ID_INVALID = 0xFFFF /*!< Invalid chip ID (we defined it to make sure the esp_chip_id_t is 2 bytes size) */
 } __attribute__((packed)) esp_chip_id_t;
 

tools/sdk/esp32/include/bootloader_support/include/esp_flash_encrypt.h

@@ -14,6 +14,11 @@
 #include "soc/efuse_periph.h"
 #include "sdkconfig.h"
 
+#ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
+#include "esp_efuse.h"
+#include "esp_efuse_table.h"
+#endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -43,9 +48,17 @@ static inline /** @cond */ IRAM_ATTR /** @endcond */ bool esp_flash_encryption_e
 {
     uint32_t flash_crypt_cnt = 0;
 #if CONFIG_IDF_TARGET_ESP32
-    flash_crypt_cnt = REG_GET_FIELD(EFUSE_BLK0_RDATA0_REG, EFUSE_RD_FLASH_CRYPT_CNT);
+    #ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
+        flash_crypt_cnt = REG_GET_FIELD(EFUSE_BLK0_RDATA0_REG, EFUSE_RD_FLASH_CRYPT_CNT);
+    #else
+        esp_efuse_read_field_blob(ESP_EFUSE_FLASH_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_FLASH_CRYPT_CNT[0]->bit_count);
+    #endif
 #else
-    flash_crypt_cnt = REG_GET_FIELD(EFUSE_RD_REPEAT_DATA1_REG, EFUSE_SPI_BOOT_CRYPT_CNT);
+    #ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
+        flash_crypt_cnt = REG_GET_FIELD(EFUSE_RD_REPEAT_DATA1_REG, EFUSE_SPI_BOOT_CRYPT_CNT);
+    #else
+        esp_efuse_read_field_blob(ESP_EFUSE_SPI_BOOT_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_SPI_BOOT_CRYPT_CNT[0]->bit_count);
+    #endif
 #endif
     /* __builtin_parity is in flash, so we calculate parity inline */
     bool enabled = false;
@@ -151,6 +164,23 @@ esp_flash_enc_mode_t esp_get_flash_encryption_mode(void);
  */
 void esp_flash_encryption_init_checks(void);
 
+/** @brief Set all secure eFuse features related to flash encryption
+ *
+ * @return
+ *  - ESP_OK - Successfully
+ */
+esp_err_t esp_flash_encryption_enable_secure_features(void);
+
+/** @brief Switches Flash Encryption from "Development" to "Release"
+ *
+ * If already in "Release" mode, the function will do nothing.
+ * If flash encryption efuse is not enabled yet then abort.
+ * It burns:
+ *  - "disable encrypt in dl mode"
+ *  - set FLASH_CRYPT_CNT efuse to max
+ */
+void esp_flash_encryption_set_release_mode(void);
+
 #ifdef __cplusplus
 }
 #endif

tools/sdk/esp32/include/bootloader_support/include/esp_secure_boot.h

@@ -25,6 +25,9 @@
 #elif CONFIG_IDF_TARGET_ESP32S3
 #include "esp32s3/rom/efuse.h"
 #include "esp32s3/rom/secure_boot.h"
+#elif CONFIG_IDF_TARGET_ESP32H2
+#include "esp32h2/rom/efuse.h"
+#include "esp32h2/rom/secure_boot.h"
 #endif
 
 #ifdef CONFIG_SECURE_BOOT_V1_ENABLED
@@ -44,6 +47,11 @@ extern "C" {
 
 #define ESP_SECURE_BOOT_DIGEST_LEN 32
 
+#ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
+#include "esp_efuse.h"
+#include "esp_efuse_table.h"
+#endif
+
 /** @brief Is secure boot currently enabled in hardware?
  *
  * This means that the ROM bootloader code will only boot
@@ -55,12 +63,24 @@ static inline bool esp_secure_boot_enabled(void)
 {
 #if CONFIG_IDF_TARGET_ESP32
     #ifdef CONFIG_SECURE_BOOT_V1_ENABLED
-        return REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_RD_ABS_DONE_0;
+        #ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
+            return REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_RD_ABS_DONE_0;
+        #else
+            return esp_efuse_read_field_bit(ESP_EFUSE_ABS_DONE_0);
+        #endif
     #elif CONFIG_SECURE_BOOT_V2_ENABLED
-        return ets_use_secure_boot_v2();
+        #ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
+            return ets_use_secure_boot_v2();
+        #else
+            return esp_efuse_read_field_bit(ESP_EFUSE_ABS_DONE_1);
+        #endif
     #endif
 #else
-    return esp_rom_efuse_is_secure_boot_enabled();
+    #ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
+        return esp_rom_efuse_is_secure_boot_enabled();
+    #else
+        return esp_efuse_read_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
+    #endif
 #endif
     return false; /* Secure Boot not enabled in menuconfig */
 }
@@ -263,6 +283,13 @@ esp_err_t esp_secure_boot_get_signature_blocks_for_running_app(bool digest_publi
 
 #endif // !BOOTLOADER_BUILD && CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
 
+/** @brief Set all secure eFuse features related to secure_boot
+ *
+ * @return
+ *  - ESP_OK - Successfully
+ */
+esp_err_t esp_secure_boot_enable_secure_features(void);
+
 #ifdef __cplusplus
 }
 #endif