From 74005ed2f5bad97fc82f5bb04abf1818a00e0edd Mon Sep 17 00:00:00 2001 From: Mahavir Jain Date: Thu, 31 Mar 2022 17:43:50 +0530 Subject: [PATCH] soc: add capability macros for security features - Security features covers "secure boot", "flash encryption" etc. - ECO revision specific modifications still need to be handled through kconfig itself, as soc_caps.h is processed before ECO revision selection - This will simplify addition of security features for newer chips by using these SOC capability macros --- .../soc/esp32/include/soc/Kconfig.soc_caps.in | 20 +++++-- components/soc/esp32/include/soc/soc_caps.h | 12 +++- .../esp32c2/include/soc/Kconfig.soc_caps.in | 40 +++++++------ components/soc/esp32c2/include/soc/soc_caps.h | 13 +++-- .../esp32c3/include/soc/Kconfig.soc_caps.in | 48 ++++++++++------ components/soc/esp32c3/include/soc/soc_caps.h | 17 ++++-- .../esp32h2/include/soc/Kconfig.soc_caps.in | 40 ++++++++++--- components/soc/esp32h2/include/soc/soc_caps.h | 13 ++++- .../esp32s2/include/soc/Kconfig.soc_caps.in | 56 ++++++++++++------- components/soc/esp32s2/include/soc/soc_caps.h | 16 ++++-- .../esp32s3/include/soc/Kconfig.soc_caps.in | 56 ++++++++++++------- components/soc/esp32s3/include/soc/soc_caps.h | 16 ++++-- 12 files changed, 241 insertions(+), 106 deletions(-) diff --git a/components/soc/esp32/include/soc/Kconfig.soc_caps.in b/components/soc/esp32/include/soc/Kconfig.soc_caps.in index 9c61ff279e..14c981046c 100644 --- a/components/soc/esp32/include/soc/Kconfig.soc_caps.in +++ b/components/soc/esp32/include/soc/Kconfig.soc_caps.in @@ -75,10 +75,6 @@ config SOC_CCOMP_TIMER_SUPPORTED bool default y -config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS - bool - default y - config SOC_RTC_FAST_MEM_SUPPORTED bool default y @@ -115,6 +111,14 @@ config SOC_SHA_SUPPORTED bool default y +config SOC_FLASH_ENC_SUPPORTED + bool + default y + +config SOC_SECURE_BOOT_SUPPORTED + bool + default y + config SOC_ADC_RTC_CTRL_SUPPORTED bool default y @@ -571,6 +575,14 @@ config SOC_AES_SUPPORT_AES_256 bool default y +config SOC_SECURE_BOOT_V1 + bool + default y + +config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS + bool + default y + config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX int default 32 diff --git a/components/soc/esp32/include/soc/soc_caps.h b/components/soc/esp32/include/soc/soc_caps.h index 234869cea1..5ff1f07b28 100644 --- a/components/soc/esp32/include/soc/soc_caps.h +++ b/components/soc/esp32/include/soc/soc_caps.h @@ -78,7 +78,6 @@ #define SOC_CPU_CORES_NUM 2 #define SOC_ULP_SUPPORTED 1 #define SOC_CCOMP_TIMER_SUPPORTED 1 -#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 1 #define SOC_RTC_FAST_MEM_SUPPORTED 1 #define SOC_RTC_SLOW_MEM_SUPPORTED 1 #define SOC_I2S_SUPPORTED 1 @@ -88,6 +87,8 @@ #define SOC_AES_SUPPORTED 1 #define SOC_MPI_SUPPORTED 1 #define SOC_SHA_SUPPORTED 1 +#define SOC_FLASH_ENC_SUPPORTED 1 +#define SOC_SECURE_BOOT_SUPPORTED 1 /*-------------------------- ADC CAPS ----------------------------------------*/ /** @@ -319,6 +320,15 @@ #define SOC_AES_SUPPORT_AES_192 (1) #define SOC_AES_SUPPORT_AES_256 (1) +/*-------------------------- Secure Boot CAPS----------------------------*/ +/* + * ESP32 ECO3 revision also supports `SOC_SECURE_BOOT_V2_RSA` but for that we will need selected ECO + * version from `Kconfig`, which is not possible while generating `Kconfig.soc_caps.in` from this header. + * Hence, for now we are handling this special capability in bootloader "security" configuration itself. + */ +#define SOC_SECURE_BOOT_V1 1 +#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 1 + /*-------------------------- Flash Encryption CAPS----------------------------*/ #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (32) diff --git a/components/soc/esp32c2/include/soc/Kconfig.soc_caps.in b/components/soc/esp32c2/include/soc/Kconfig.soc_caps.in index 0343113898..a03acaf634 100644 --- a/components/soc/esp32c2/include/soc/Kconfig.soc_caps.in +++ b/components/soc/esp32c2/include/soc/Kconfig.soc_caps.in @@ -35,14 +35,6 @@ config SOC_SUPPORTS_SECURE_DL_MODE bool default y -config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS - bool - default y - -config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS - bool - default n - config SOC_EFUSE_KEY_PURPOSE_FIELD bool default n @@ -59,14 +51,6 @@ config SOC_RTC_SLOW_MEM_SUPPORTED bool default n -config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY - bool - default n - -config SOC_FLASH_ENCRYPTION_XTS_AES - bool - default y - config SOC_SHA_SUPPORTED bool default n @@ -75,6 +59,14 @@ config SOC_ECC_SUPPORTED bool default y +config SOC_FLASH_ENC_SUPPORTED + bool + default y + +config SOC_SECURE_BOOT_SUPPORTED + bool + default y + config SOC_ADC_DIG_CTRL_SUPPORTED bool default y @@ -431,10 +423,26 @@ config SOC_TOUCH_SENSOR_NUM int default 0 +config SOC_SECURE_BOOT_V2_ECC + bool + default y + +config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS + bool + default y + config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX int default 32 +config SOC_FLASH_ENCRYPTION_XTS_AES + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_128 + bool + default n + config SOC_UART_NUM int default 2 diff --git a/components/soc/esp32c2/include/soc/soc_caps.h b/components/soc/esp32c2/include/soc/soc_caps.h index f59ed617f0..11fe98e3a5 100644 --- a/components/soc/esp32c2/include/soc/soc_caps.h +++ b/components/soc/esp32c2/include/soc/soc_caps.h @@ -33,16 +33,15 @@ #define SOC_WIFI_SUPPORTED 0 // Enable during bringup, IDF-3905 #define SOC_ASYNC_MEMCPY_SUPPORTED 1 #define SOC_SUPPORTS_SECURE_DL_MODE 1 -#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 1 -#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 0 #define SOC_EFUSE_KEY_PURPOSE_FIELD 0 #define SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK 1 #define SOC_RTC_FAST_MEM_SUPPORTED 0 #define SOC_RTC_SLOW_MEM_SUPPORTED 0 -#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 0 -#define SOC_FLASH_ENCRYPTION_XTS_AES 1 + #define SOC_SHA_SUPPORTED 0 // This will be enabled with IDF-3830 #define SOC_ECC_SUPPORTED 1 +#define SOC_FLASH_ENC_SUPPORTED 1 +#define SOC_SECURE_BOOT_SUPPORTED 1 /*-------------------------- ADC CAPS -------------------------------*/ /*!< SAR ADC Module*/ @@ -224,8 +223,14 @@ /*-------------------------- TOUCH SENSOR CAPS -------------------------------*/ #define SOC_TOUCH_SENSOR_NUM (0U) /*! No touch sensors on ESP32-C2 */ +/*-------------------------- Secure Boot CAPS----------------------------*/ +#define SOC_SECURE_BOOT_V2_ECC 1 +#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 1 + /*-------------------------- Flash Encryption CAPS----------------------------*/ #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (32) +#define SOC_FLASH_ENCRYPTION_XTS_AES 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES_128 0 // This will be enabled with IDF-3899 /*-------------------------- UART CAPS ---------------------------------------*/ // ESP32-C2 has 2 UARTs diff --git a/components/soc/esp32c3/include/soc/Kconfig.soc_caps.in b/components/soc/esp32c3/include/soc/Kconfig.soc_caps.in index a06174d3df..e2046cf987 100644 --- a/components/soc/esp32c3/include/soc/Kconfig.soc_caps.in +++ b/components/soc/esp32c3/include/soc/Kconfig.soc_caps.in @@ -43,10 +43,6 @@ config SOC_TEMP_SENSOR_SUPPORTED bool default y -config SOC_FLASH_ENCRYPTION_XTS_AES - bool - default y - config SOC_XT_WDT_SUPPORTED bool default y @@ -59,14 +55,6 @@ config SOC_SUPPORTS_SECURE_DL_MODE bool default y -config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS - int - default 3 - -config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS - bool - default y - config SOC_EFUSE_KEY_PURPOSE_FIELD bool default y @@ -79,10 +67,6 @@ config SOC_RTC_SLOW_MEM_SUPPORTED bool default n -config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY - bool - default y - config SOC_I2S_SUPPORTED bool default y @@ -119,6 +103,14 @@ config SOC_DIG_SIGN_SUPPORTED bool default y +config SOC_FLASH_ENC_SUPPORTED + bool + default y + +config SOC_SECURE_BOOT_SUPPORTED + bool + default y + config SOC_AES_SUPPORT_DMA bool default y @@ -607,10 +599,34 @@ config SOC_TWAI_SUPPORTS_RX_STATUS bool default y +config SOC_SECURE_BOOT_V2_RSA + bool + default y + +config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS + int + default 3 + +config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS + bool + default y + +config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY + bool + default y + config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX int default 32 +config SOC_FLASH_ENCRYPTION_XTS_AES + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_128 + bool + default y + config SOC_UART_NUM int default 2 diff --git a/components/soc/esp32c3/include/soc/soc_caps.h b/components/soc/esp32c3/include/soc/soc_caps.h index dc7805d960..1071b6155c 100644 --- a/components/soc/esp32c3/include/soc/soc_caps.h +++ b/components/soc/esp32c3/include/soc/soc_caps.h @@ -35,16 +35,12 @@ #define SOC_ASYNC_MEMCPY_SUPPORTED 1 #define SOC_USB_SERIAL_JTAG_SUPPORTED 1 #define SOC_TEMP_SENSOR_SUPPORTED 1 -#define SOC_FLASH_ENCRYPTION_XTS_AES 1 #define SOC_XT_WDT_SUPPORTED 1 #define SOC_WIFI_SUPPORTED 1 #define SOC_SUPPORTS_SECURE_DL_MODE 1 -#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 -#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1 #define SOC_EFUSE_KEY_PURPOSE_FIELD 1 #define SOC_RTC_FAST_MEM_SUPPORTED 1 #define SOC_RTC_SLOW_MEM_SUPPORTED 0 -#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1 #define SOC_I2S_SUPPORTED 1 #define SOC_RMT_SUPPORTED 1 #define SOC_SIGMADELTA_SUPPORTED 1 @@ -54,6 +50,11 @@ #define SOC_SHA_SUPPORTED 1 #define SOC_HMAC_SUPPORTED 1 #define SOC_DIG_SIGN_SUPPORTED 1 +#define SOC_FLASH_ENC_SUPPORTED 1 +/* Secure boot is only supported in ESP32-C3 revision > ECO3. We check ECO revision in + * bootloader "security" configuration and accordingly prevent its usage for ECO2 and + * earlier revisions */ +#define SOC_SECURE_BOOT_SUPPORTED 1 /*-------------------------- AES CAPS -----------------------------------------*/ #define SOC_AES_SUPPORT_DMA (1) @@ -291,8 +292,16 @@ #define SOC_TWAI_BRP_MAX 16384 #define SOC_TWAI_SUPPORTS_RX_STATUS 1 +/*-------------------------- Secure Boot CAPS----------------------------*/ +#define SOC_SECURE_BOOT_V2_RSA 1 +#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 +#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1 +#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1 + /*-------------------------- Flash Encryption CAPS----------------------------*/ #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (32) +#define SOC_FLASH_ENCRYPTION_XTS_AES 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1 /*-------------------------- UART CAPS ---------------------------------------*/ // ESP32-C3 has 2 UARTs diff --git a/components/soc/esp32h2/include/soc/Kconfig.soc_caps.in b/components/soc/esp32h2/include/soc/Kconfig.soc_caps.in index b826034b13..a5439cb851 100644 --- a/components/soc/esp32h2/include/soc/Kconfig.soc_caps.in +++ b/components/soc/esp32h2/include/soc/Kconfig.soc_caps.in @@ -47,10 +47,6 @@ config SOC_SUPPORTS_SECURE_DL_MODE bool default y -config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS - int - default 3 - config SOC_EFUSE_KEY_PURPOSE_FIELD bool default y @@ -67,10 +63,6 @@ config SOC_RTC_SLOW_MEM_SUPPORTED bool default n -config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY - bool - default y - config SOC_I2S_SUPPORTED bool default y @@ -107,6 +99,14 @@ config SOC_ECC_SUPPORTED bool default n +config SOC_FLASH_ENC_SUPPORTED + bool + default y + +config SOC_SECURE_BOOT_SUPPORTED + bool + default y + config SOC_AES_SUPPORT_DMA bool default y @@ -591,10 +591,34 @@ config SOC_TWAI_SUPPORTS_RX_STATUS bool default y +config SOC_SECURE_BOOT_V2_RSA + bool + default y + +config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS + int + default 3 + +config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS + bool + default y + +config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY + bool + default y + config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX int default 32 +config SOC_FLASH_ENCRYPTION_XTS_AES + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_128 + bool + default y + config SOC_UART_NUM int default 2 diff --git a/components/soc/esp32h2/include/soc/soc_caps.h b/components/soc/esp32h2/include/soc/soc_caps.h index b07fce3379..688b08d5fb 100644 --- a/components/soc/esp32h2/include/soc/soc_caps.h +++ b/components/soc/esp32h2/include/soc/soc_caps.h @@ -44,12 +44,10 @@ #define SOC_ASYNC_MEMCPY_SUPPORTED 1 #define SOC_USB_SERIAL_JTAG_SUPPORTED 1 #define SOC_SUPPORTS_SECURE_DL_MODE 1 -#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 #define SOC_EFUSE_KEY_PURPOSE_FIELD 1 #define SOC_TEMP_SENSOR_SUPPORTED 1 #define SOC_RTC_FAST_MEM_SUPPORTED 1 #define SOC_RTC_SLOW_MEM_SUPPORTED 0 -#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1 #define SOC_I2S_SUPPORTED 1 #define SOC_RMT_SUPPORTED 1 #define SOC_SIGMADELTA_SUPPORTED 1 @@ -59,6 +57,9 @@ #define SOC_HMAC_SUPPORTED 1 #define SOC_DIG_SIGN_SUPPORTED 1 #define SOC_ECC_SUPPORTED 0 // This will be enabled with IDF-3397 +#define SOC_FLASH_ENC_SUPPORTED 1 +#define SOC_SECURE_BOOT_SUPPORTED 1 + /*-------------------------- AES CAPS -----------------------------------------*/ #define SOC_AES_SUPPORT_DMA (1) @@ -302,8 +303,16 @@ #define SOC_TWAI_BRP_MAX 16384 #define SOC_TWAI_SUPPORTS_RX_STATUS 1 +/*-------------------------- Secure Boot CAPS----------------------------*/ +#define SOC_SECURE_BOOT_V2_RSA 1 +#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 +#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1 +#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1 + /*-------------------------- Flash Encryption CAPS----------------------------*/ #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (32) +#define SOC_FLASH_ENCRYPTION_XTS_AES 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1 /*-------------------------- UART CAPS ---------------------------------------*/ // ESP32-H2 has 2 UARTs diff --git a/components/soc/esp32s2/include/soc/Kconfig.soc_caps.in b/components/soc/esp32s2/include/soc/Kconfig.soc_caps.in index c4ad57a9ed..13250f74fc 100644 --- a/components/soc/esp32s2/include/soc/Kconfig.soc_caps.in +++ b/components/soc/esp32s2/include/soc/Kconfig.soc_caps.in @@ -59,14 +59,6 @@ config SOC_ASYNC_MEMCPY_SUPPORTED bool default y -config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS - int - default 3 - -config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS - bool - default y - config SOC_EFUSE_KEY_PURPOSE_FIELD bool default y @@ -79,14 +71,6 @@ config SOC_CACHE_SUPPORT_WRAP bool default y -config SOC_FLASH_ENCRYPTION_XTS_AES - bool - default y - -config SOC_FLASH_ENCRYPTION_XTS_AES_256 - bool - default y - config SOC_RTC_FAST_MEM_SUPPORTED bool default y @@ -103,10 +87,6 @@ config SOC_XT_WDT_SUPPORTED bool default y -config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY - bool - default y - config SOC_I2S_SUPPORTED bool default y @@ -143,6 +123,14 @@ config SOC_DIG_SIGN_SUPPORTED bool default y +config SOC_FLASH_ENC_SUPPORTED + bool + default y + +config SOC_SECURE_BOOT_SUPPORTED + bool + default y + config SOC_ADC_RTC_CTRL_SUPPORTED bool default y @@ -707,10 +695,38 @@ config SOC_AES_SUPPORT_GCM bool default y +config SOC_SECURE_BOOT_V2_RSA + bool + default y + +config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS + int + default 3 + +config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS + bool + default y + +config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY + bool + default y + config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX int default 64 +config SOC_FLASH_ENCRYPTION_XTS_AES + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_128 + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_256 + bool + default y + config SOC_AES_CRYPTO_DMA bool default y diff --git a/components/soc/esp32s2/include/soc/soc_caps.h b/components/soc/esp32s2/include/soc/soc_caps.h index 18ebe84e30..b38a02f993 100644 --- a/components/soc/esp32s2/include/soc/soc_caps.h +++ b/components/soc/esp32s2/include/soc/soc_caps.h @@ -53,18 +53,13 @@ #define SOC_ULP_SUPPORTED 1 #define SOC_CCOMP_TIMER_SUPPORTED 1 #define SOC_ASYNC_MEMCPY_SUPPORTED 1 -#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 -#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1 #define SOC_EFUSE_KEY_PURPOSE_FIELD 1 #define SOC_TEMP_SENSOR_SUPPORTED 1 #define SOC_CACHE_SUPPORT_WRAP 1 -#define SOC_FLASH_ENCRYPTION_XTS_AES 1 -#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1 #define SOC_RTC_FAST_MEM_SUPPORTED 1 #define SOC_RTC_SLOW_MEM_SUPPORTED 1 #define SOC_PSRAM_DMA_CAPABLE 1 #define SOC_XT_WDT_SUPPORTED 1 -#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1 #define SOC_I2S_SUPPORTED 1 #define SOC_RMT_SUPPORTED 1 #define SOC_SIGMADELTA_SUPPORTED 1 @@ -74,6 +69,8 @@ #define SOC_SHA_SUPPORTED 1 #define SOC_HMAC_SUPPORTED 1 #define SOC_DIG_SIGN_SUPPORTED 1 +#define SOC_FLASH_ENC_SUPPORTED 1 +#define SOC_SECURE_BOOT_SUPPORTED 1 /*-------------------------- ADC CAPS ----------------------------------------*/ @@ -332,8 +329,17 @@ #define SOC_AES_SUPPORT_DMA (1) #define SOC_AES_SUPPORT_GCM (1) +/*-------------------------- Secure Boot CAPS----------------------------*/ +#define SOC_SECURE_BOOT_V2_RSA 1 +#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 +#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1 +#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1 + /*-------------------------- Flash Encryption CAPS----------------------------*/ #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64) +#define SOC_FLASH_ENCRYPTION_XTS_AES 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1 /* Has "crypto DMA", which is shared with SHA */ #define SOC_AES_CRYPTO_DMA (1) diff --git a/components/soc/esp32s3/include/soc/Kconfig.soc_caps.in b/components/soc/esp32s3/include/soc/Kconfig.soc_caps.in index e3fe1f47fe..4b1ccb59ed 100644 --- a/components/soc/esp32s3/include/soc/Kconfig.soc_caps.in +++ b/components/soc/esp32s3/include/soc/Kconfig.soc_caps.in @@ -135,14 +135,6 @@ config SOC_SUPPORTS_SECURE_DL_MODE bool default y -config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS - int - default 3 - -config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS - bool - default y - config SOC_EFUSE_KEY_PURPOSE_FIELD bool default y @@ -151,10 +143,6 @@ config SOC_SDMMC_HOST_SUPPORTED bool default y -config SOC_FLASH_ENCRYPTION_XTS_AES - bool - default y - config SOC_RTC_FAST_MEM_SUPPORTED bool default y @@ -163,14 +151,6 @@ config SOC_RTC_SLOW_MEM_SUPPORTED bool default y -config SOC_FLASH_ENCRYPTION_XTS_AES_256 - bool - default y - -config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY - bool - default y - config SOC_PSRAM_DMA_CAPABLE bool default y @@ -219,6 +199,14 @@ config SOC_DIG_SIGN_SUPPORTED bool default y +config SOC_FLASH_ENC_SUPPORTED + bool + default y + +config SOC_SECURE_BOOT_SUPPORTED + bool + default y + config SOC_APPCPU_HAS_CLOCK_GATING_BUG bool default y @@ -839,10 +827,38 @@ config SOC_PM_SUPPORT_DEEPSLEEP_CHECK_STUB_ONLY bool default y +config SOC_SECURE_BOOT_V2_RSA + bool + default y + +config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS + int + default 3 + +config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS + bool + default y + +config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY + bool + default y + config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX int default 64 +config SOC_FLASH_ENCRYPTION_XTS_AES + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_128 + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_256 + bool + default y + config SOC_WIFI_HW_TSF bool default y diff --git a/components/soc/esp32s3/include/soc/soc_caps.h b/components/soc/esp32s3/include/soc/soc_caps.h index cdf43d6479..e8384523b2 100644 --- a/components/soc/esp32s3/include/soc/soc_caps.h +++ b/components/soc/esp32s3/include/soc/soc_caps.h @@ -44,15 +44,10 @@ #define SOC_CCOMP_TIMER_SUPPORTED 1 #define SOC_ASYNC_MEMCPY_SUPPORTED 1 #define SOC_SUPPORTS_SECURE_DL_MODE 1 -#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 -#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1 #define SOC_EFUSE_KEY_PURPOSE_FIELD 1 #define SOC_SDMMC_HOST_SUPPORTED 1 -#define SOC_FLASH_ENCRYPTION_XTS_AES 1 #define SOC_RTC_FAST_MEM_SUPPORTED 1 #define SOC_RTC_SLOW_MEM_SUPPORTED 1 -#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1 -#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1 #define SOC_PSRAM_DMA_CAPABLE 1 #define SOC_XT_WDT_SUPPORTED 1 #define SOC_I2S_SUPPORTED 1 @@ -65,6 +60,8 @@ #define SOC_SHA_SUPPORTED 1 #define SOC_HMAC_SUPPORTED 1 #define SOC_DIG_SIGN_SUPPORTED 1 +#define SOC_FLASH_ENC_SUPPORTED 1 +#define SOC_SECURE_BOOT_SUPPORTED 1 /*-------------------------- SOC CAPS ----------------------------------------*/ @@ -364,10 +361,17 @@ #define SOC_PM_SUPPORT_DEEPSLEEP_CHECK_STUB_ONLY (1) +/*-------------------------- Secure Boot CAPS----------------------------*/ +#define SOC_SECURE_BOOT_V2_RSA 1 +#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 +#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1 +#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1 /*-------------------------- Flash Encryption CAPS----------------------------*/ #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64) - +#define SOC_FLASH_ENCRYPTION_XTS_AES 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1 /*-------------------------- WI-FI HARDWARE TSF CAPS -------------------------------*/ #define SOC_WIFI_HW_TSF (1)