Merge branch 'bugfix/fix_assert_in_passkey_reply_4_2' into 'release/v4.2'

Bugfix/fix assert in passkey reply [backport v4.2]

See merge request espressif/esp-idf!10974

.flake8

@@ -141,15 +141,17 @@ exclude =
     __pycache__,
     # submodules
         components/bootloader/subproject/components/micro-ecc/micro-ecc,
+        components/bt/host/nimble/nimble,
         components/esptool_py/esptool,
         components/expat/expat,
         components/json/cJSON,
         components/libsodium/libsodium,
         components/mbedtls/mbedtls,
         components/nghttp/nghttp2,
-        components/bt/host/nimble/nimble,
+        components/tinyusb,
         components/unity/unity,
         examples/build_system/cmake/import_lib/main/lib/tinyxml2,
+        examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib,
     # other third-party libraries
         tools/kconfig_new/kconfiglib.py,
         tools/kconfig_new/menuconfig.py,
@@ -162,4 +164,4 @@ exclude =
         components/wifi_provisioning/python/wifi_config_pb2.py,
         components/wifi_provisioning/python/wifi_constants_pb2.py,
         components/esp_local_ctrl/python/esp_local_ctrl_pb2.py,
-        examples/provisioning/custom_config/components/custom_provisioning/python/custom_config_pb2.py,
+        examples/provisioning/legacy/custom_config/components/custom_provisioning/python/custom_config_pb2.py,

.github/ISSUE_TEMPLATE/bug_report.md

@@ -38,7 +38,7 @@ If the issue cannot be solved after the steps before, please follow these instru
 - Development Kit:      [ESP32-Wrover-Kit|ESP32-DevKitC|ESP32-PICO-Kit|ESP32-LyraT|ESP32-LyraTD-MSC|none]
 - Kit version (for WroverKit/PicoKit/DevKitC): [v1|v2|v3|v4]
 - Module or chip used:  [ESP32-WROOM-32|ESP32-WROOM-32D|ESP32-WROOM-32U|ESP32-WROVER|ESP32-WROVER-I|ESP32-WROVER-B|ESP32-WROVER-IB|ESP32-SOLO-1|ESP32-PICO-D4|ESP32]
-- IDF version (run ``git describe --tags`` to find it):
+- IDF version (run ``git describe`` to find it):
     // v3.2-dev-1148-g96cd3b75c
 - Build System:         [Make|CMake|idf.py]
 - Compiler version (run ``xtensa-esp32-elf-gcc --version`` to find it):

.github/workflows/python_lint.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [2.7, 3.5, 3.6, 3.7]
+        python-version: [2.7, 3.5, 3.6, 3.7, 3.8]
 
     steps:
       - name: Checkout
@@ -24,9 +24,10 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
+          export IDF_PATH=${GITHUB_WORKSPACE}
           pip install --upgrade pip
           pip install -r requirements.txt
       - name: Lint with flake8
         run: |
           pip install flake8
-          flake8 . --config=.flake8
+          flake8 . --config=.flake8 --benchmark

.gitignore

@@ -27,13 +27,7 @@ examples/**/sdkconfig.old
 examples/**/build
 
 # Doc build artifacts
-docs/*/_build/
-docs/*/doxygen-warning-log.txt
-docs/*/sphinx-warning-log.txt
-docs/*/sphinx-warning-log-sanitized.txt
-docs/*/xml/
-docs/*/xml_in/
-docs/*/man/
+docs/_build/
 docs/doxygen_sqlite3.db
 
 # Downloaded font files
@@ -46,6 +40,15 @@ tools/unit-test-app/sdkconfig.old
 tools/unit-test-app/build
 tools/unit-test-app/builds
 tools/unit-test-app/output
+tools/unit-test-app/test_configs
+
+# Unit Test CMake compile log folder
+log_ut_cmake
+
+# test application build files
+tools/test_apps/**/build
+tools/test_apps/**/sdkconfig
+tools/test_apps/**/sdkconfig.old
 
 # IDF monitor test
 tools/test_idf_monitor/outputs
@@ -79,4 +82,4 @@ flake8_output.txt
 build
 
 # lock files for examples and components
-dependencies.lock
+dependencies.lock

.gitlab-ci.yml

@@ -6,7 +6,7 @@ stages:
   - target_test
   - post_check
   - deploy
-  - post_check
+  - post_deploy
 
 variables:
 # System environment
@@ -16,9 +16,8 @@ variables:
 
 # GitLab-CI environment
 
-  # more attempts for more robust
-  GET_SOURCES_ATTEMPTS: "10"
-  ARTIFACT_DOWNLOAD_ATTEMPTS: "10"
+  # XXX_ATTEMPTS variables (https://docs.gitlab.com/ce/ci/yaml/README.html#job-stages-attempts) are not defined here.
+  # Use values from  "CI / CD Settings" - "Variables".
 
   # GIT_STRATEGY is not defined here.
   # Use an option from  "CI / CD Settings" - "General pipelines".
@@ -34,48 +33,33 @@ variables:
   # tell build system do not check submodule update as we download archive instead of clone
   IDF_SKIP_CHECK_SUBMODULES: 1
 
-  UNIT_TEST_BUILD_SYSTEM: cmake
-  EXAMPLE_TEST_BUILD_SYSTEM: cmake
-# IDF environment
-
   IDF_PATH: "$CI_PROJECT_DIR"
   BATCH_BUILD: "1"
   V: "0"
   APPLY_BOT_FILTER_SCRIPT: "$CI_PROJECT_DIR/tools/ci/apply_bot_filter.py"
   CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"
-  CUSTOM_TOOLCHAIN_PATH: "/opt/xtensa-custom"
 
-# Docker images
+  # Docker images
   BOT_DOCKER_IMAGE_TAG: ":latest"
-# target test config file, used by assign test job
+  # target test config file, used by assign test job
   CI_TARGET_TEST_CONFIG_FILE: "$CI_PROJECT_DIR/tools/ci/config/target-test.yml"
+  # target test repo parameters
+  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
+  CI_AUTO_TEST_SCRIPT_REPO_URL: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/auto_test_script.git"
+  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v3.1"
 
+  # Versioned esp-idf-doc env image to use for all document building jobs
+  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v7"
 
 
 # before each job, we need to check if this job is filtered by bot stage/job filter
 .apply_bot_filter: &apply_bot_filter
   python $APPLY_BOT_FILTER_SCRIPT || exit 0
 
-.setup_custom_toolchain: &setup_custom_toolchain |
-  if [ "$IDF_XTENSA_TOOLCHAIN_URL" ] ; then
-  echo "Use a custom toolchain: ${IDF_XTENSA_TOOLCHAIN_URL:-Unknown}"
-  rm -rf "$CUSTOM_TOOLCHAIN_PATH" &&
-  mkdir -p -v "$CUSTOM_TOOLCHAIN_PATH" &&
-  pushd "$CUSTOM_TOOLCHAIN_PATH" &&
-  curl -sSL -o xtensa-custom.xxx "$IDF_XTENSA_TOOLCHAIN_URL" &&
-  ls -l xtensa-custom.xxx &&
-  tar xf xtensa-custom.xxx --strip-components 1 &&
-  ls -l . &&
-  popd
-  PATH=$CUSTOM_TOOLCHAIN_PATH/bin:$PATH
-  export PATH
-  fi
-
-.cleanup_custom_toolchain: &cleanup_custom_toolchain |
-  echo "Cleaning up $CUSTOM_TOOLCHAIN_PATH"
-  rm -rf "$CUSTOM_TOOLCHAIN_PATH"
-
 .setup_tools_unless_target_test: &setup_tools_unless_target_test |
+  if [[ -n "$IDF_DONT_USE_MIRRORS" ]]; then
+  export IDF_MIRROR_PREFIX_MAP=
+  fi
   if [[ "$SETUP_TOOLS" == "1" || "$CI_JOB_STAGE" != "target_test" ]]; then
   tools/idf_tools.py --non-interactive install && eval "$(tools/idf_tools.py --non-interactive export)" || exit 1
   fi
@@ -96,13 +80,9 @@ before_script:
   - echo -e "Host gitlab.espressif.cn\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
   # Set some options and environment for CI
   - source tools/ci/configure_ci_environment.sh
-
   - *setup_tools_unless_target_test
-
   - *fetch_submodules
 
-  - *setup_custom_toolchain
-
 # used for check scripts which we want to run unconditionally
 .before_script_lesser_nofilter:
   variables:
@@ -111,7 +91,6 @@ before_script:
     - echo "Not setting up GitLab key, not fetching submodules, not applying bot filter"
     - source tools/ci/setup_python.sh
     - source tools/ci/configure_ci_environment.sh
-    - *setup_custom_toolchain
 
 # used for everything else where we want to do no prep, except for bot filter
 .before_script_lesser:
@@ -123,10 +102,6 @@ before_script:
     # apply bot filter in before script
     - *apply_bot_filter
     - source tools/ci/configure_ci_environment.sh
-    - *setup_custom_toolchain
-
-after_script:
-  - *cleanup_custom_toolchain
 
 .check_job_template:
   stage: pre_check
@@ -142,7 +117,14 @@ after_script:
   tags:
     - host_test
   dependencies: []
-  extends: .before_script_lesser_nofilter
+  extends: .before_script_lesser
+
+.python_lint_template:
+  stage: pre_check
+  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  tags:
+    - host_test
+  dependencies: []
 
 .macos_build_template:
   stage: build
@@ -151,9 +133,17 @@ after_script:
   dependencies: []
   before_script:
     - *apply_bot_filter
+    - $IDF_PATH/tools/idf_tools.py install-python-env
+    # On macOS, these tools need to be installed
+    - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
+    # This adds tools (compilers) and the version-specific Python environment to PATH
     - *setup_tools_unless_target_test
-    - *setup_custom_toolchain
+    # Install packages required by CI scripts into IDF Python environment
+    - pip install -r $IDF_PATH/tools/ci/python_packages/ttfw_idf/requirements.txt
     - source tools/ci/configure_ci_environment.sh
+    # Part of tools/ci/setup_python.sh; we don't use pyenv on macOS, so can't run the rest of the script.
+    - export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"
+    - *fetch_submodules
 
 include:
   - '/tools/ci/config/pre_check.yml'
@@ -163,3 +153,4 @@ include:
   - '/tools/ci/config/target-test.yml'
   - '/tools/ci/config/post_check.yml'
   - '/tools/ci/config/deploy.yml'
+  - '/tools/ci/config/post_deploy.yml'

.gitmodules

@@ -79,3 +79,10 @@
 	path = components/esp_wifi/lib
 	url = ../../espressif/esp32-wifi-lib.git
 
+[submodule "components/tinyusb/tinyusb"]
+	path = components/tinyusb/tinyusb
+	url = ../../espressif/tinyusb.git
+
+[submodule "examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib"]
+	path = examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib
+	url = ../../espressif/esp-cryptoauthlib.git

CMakeLists.txt

@@ -1,6 +1,12 @@
 cmake_minimum_required(VERSION 3.5)
 project(esp-idf C CXX ASM)
 
+if(CMAKE_CURRENT_LIST_DIR STREQUAL CMAKE_SOURCE_DIR)
+    message(FATAL_ERROR "Current directory '${CMAKE_CURRENT_LIST_DIR}' is not buildable. "
+    "Change directories to one of the example projects in '${CMAKE_CURRENT_LIST_DIR}/examples' and try "
+    "again.")
+endif()
+
 unset(compile_options)
 unset(c_compile_options)
 unset(cxx_compile_options)
@@ -10,15 +16,31 @@ unset(link_options)
 # Add the following build specifications here, since these seem to be dependent
 # on config values on the root Kconfig.
 
-if(CONFIG_COMPILER_OPTIMIZATION_SIZE)
-    list(APPEND compile_options "-Os")
-    list(APPEND compile_options "-freorder-blocks")
-elseif(CONFIG_COMPILER_OPTIMIZATION_DEFAULT)
-    list(APPEND compile_options "-Og")
-elseif(CONFIG_COMPILER_OPTIMIZATION_NONE)
-    list(APPEND compile_options "-O0")
-elseif(CONFIG_COMPILER_OPTIMIZATION_PERF)
-    list(APPEND compile_options "-O2")
+if(NOT BOOTLOADER_BUILD)
+
+    if(CONFIG_COMPILER_OPTIMIZATION_SIZE)
+        list(APPEND compile_options "-Os")
+        list(APPEND compile_options "-freorder-blocks")
+    elseif(CONFIG_COMPILER_OPTIMIZATION_DEFAULT)
+        list(APPEND compile_options "-Og")
+    elseif(CONFIG_COMPILER_OPTIMIZATION_NONE)
+        list(APPEND compile_options "-O0")
+    elseif(CONFIG_COMPILER_OPTIMIZATION_PERF)
+        list(APPEND compile_options "-O2")
+    endif()
+
+else()  # BOOTLOADER_BUILD
+
+    if(CONFIG_BOOTLOADER_COMPILER_OPTIMIZATION_SIZE)
+        list(APPEND compile_options "-Os")
+        list(APPEND compile_options "-freorder-blocks")
+    elseif(CONFIG_BOOTLOADER_COMPILER_OPTIMIZATION_DEBUG)
+        list(APPEND compile_options "-Og")
+    elseif(CONFIG_BOOTLOADER_COMPILER_OPTIMIZATION_NONE)
+        list(APPEND compile_options "-O0")
+    elseif(CONFIG_BOOTLOADER_COMPILER_OPTIMIZATION_PERF)
+        list(APPEND compile_options "-O2")
+    endif()
 
 endif()
 

CONTRIBUTING.rst

@@ -6,7 +6,7 @@ We welcome contributions to the esp-idf project!
 How to Contribute
 -----------------
 
-Contributions to esp-idf - fixing bugs, adding features, adding documentation - are welcome. We accept contributions via `Github Pull Requests <https://help.github.com/articles/about-pull-requests/>`_.
+Contributions to esp-idf - fixing bugs, adding features, adding documentation - are welcome. We accept contributions via `Github Pull Requests <https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests>`_.
 
 Before Contributing
 -------------------
@@ -27,7 +27,7 @@ Before sending us a Pull Request, please consider this list of points:
 
 * Example contributions are also welcome. Please check the :doc:`creating-examples` guide for these.
 
-* If the contribution contains multiple commits, are they grouped together into logical changes (one major change per pull request)? Are any commits with names like "fixed typo" `squashed into previous commits <http://eli.thegreenplace.net/2014/02/19/squashing-github-pull-requests-into-a-single-commit/>`_?
+* If the contribution contains multiple commits, are they grouped together into logical changes (one major change per pull request)? Are any commits with names like "fixed typo" `squashed into previous commits <https://eli.thegreenplace.net/2014/02/19/squashing-github-pull-requests-into-a-single-commit/>`_?
 
 * If you're unsure about any of these points, please open the Pull Request anyhow and then ask us for feedback.
 

Kconfig

@@ -24,34 +24,32 @@ mainmenu "Espressif IoT Development Framework Configuration"
         bool
         default "y" if IDF_TARGET="esp32"
 
-    config IDF_TARGET_ESP32S2BETA
+    config IDF_TARGET_ESP32S2
         bool
-        default "y" if IDF_TARGET="esp32s2beta"
+        default "y" if IDF_TARGET="esp32s2"
         select FREERTOS_UNICORE
 
     config IDF_FIRMWARE_CHIP_ID
         hex
         default 0x0000 if IDF_TARGET_ESP32
-        # note: S2 beta uses Chip ID 0 still, S2 will use 0x0002
-        default 0x0000 if IDF_TARGET_ESP32S2BETA
+        default 0x0002 if IDF_TARGET_ESP32S2
         default 0xFFFF
 
     menu "SDK tool configuration"
         config SDK_TOOLPREFIX
             string "Compiler toolchain path/prefix"
             default "xtensa-esp32-elf-" if IDF_TARGET_ESP32
-            default "xtensa-esp32s2-elf-" if IDF_TARGET_ESP32S2BETA
+            default "xtensa-esp32s2-elf-" if IDF_TARGET_ESP32S2
             help
                 The prefix/path that is used to call the toolchain. The default setting assumes
                 a crosstool-ng gcc setup that is in your PATH.
 
         config SDK_PYTHON
-            string "Python 2 interpreter"
+            string "Python interpreter"
             depends on !IDF_CMAKE
             default "python"
             help
-                The executable name/path that is used to run python. On some systems Python 2.x
-                may need to be invoked as python2.
+                The executable name/path that is used to run python.
 
                 (Note: This option is used with the legacy GNU Make build system only.)
 
@@ -135,8 +133,8 @@ mainmenu "Espressif IoT Development Framework Configuration"
                     CONFIG_APP_BUILD_TYPE_ELF_RAM=y
                     CONFIG_VFS_SUPPORT_TERMIOS=
                     CONFIG_NEWLIB_NANO_FORMAT=y
-                    CONFIG_ESP32_PANIC_PRINT_HALT=y
-                    CONFIG_ESP32_DEBUG_STUBS_ENABLE=
+                    CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT=y
+                    CONFIG_ESP_DEBUG_STUBS_ENABLE=
                     CONFIG_ESP_ERR_TO_NAME_LOOKUP=
 
 
@@ -172,7 +170,7 @@ mainmenu "Espressif IoT Development Framework Configuration"
             prompt "Optimization Level"
             default COMPILER_OPTIMIZATION_DEFAULT
             help
-                This option sets compiler optimization level (gcc -O argument).
+                This option sets compiler optimization level (gcc -O argument) for the app.
 
                 - The "Default" setting will add the -0g flag to CFLAGS.
                 - The "Size" setting will add the -0s flag to CFLAGS.
@@ -190,6 +188,9 @@ mainmenu "Espressif IoT Development Framework Configuration"
 
                 Note that custom optimization levels may be unsupported.
 
+                Compiler optimization for the IDF bootloader is set separately,
+                see the BOOTLOADER_COMPILER_OPTIMIZATION setting.
+
             config COMPILER_OPTIMIZATION_DEFAULT
                 bool "Debug (-Og)"
             config COMPILER_OPTIMIZATION_SIZE

README.md

@@ -2,9 +2,7 @@
 
 * [中文版](./README_CN.md)
 
-[![Documentation Status](https://readthedocs.com/projects/espressif-esp-idf/badge/?version=latest)](https://docs.espressif.com/projects/esp-idf/en/latest/?badge=latest)
-
-ESP-IDF is the official development framework for the [ESP32](https://espressif.com/en/products/hardware/esp32/overview) chip.
+ESP-IDF is the official development framework for the **ESP32** and **ESP32-S** Series SoCs provided for Windows, Linux and macOS.
 
 # Developing With ESP-IDF
 
@@ -12,8 +10,12 @@ ESP-IDF is the official development framework for the [ESP32](https://espressif.
 
 See setup guides for detailed instructions to set up the ESP-IDF:
 
-* [Getting Started Guide for the stable ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/)
-* [Getting Started Guide for the latest (master branch) ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)
+| Chip | Getting Started Guides for ESP-IDF |
+|:----:|:----|
+| <img src="docs/_static/chip-esp32.svg" height="85" alt="ESP32"> |  <ul><li>[stable](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/) version</li><li>[latest (master branch)](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/) version</li></ul> |
+| <img src="docs/_static/chip-esp32-s2.svg" height="100" alt="ESP32-S2"> | <ul><li>[latest (master branch)](https://docs.espressif.com/projects/esp-idf/en/latest/esp32s2/get-started/) version</li></ul> |
+
+**Note:** Each ESP-IDF release has its own documentation. Please see Section [Versions](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/versions.html) how to find documentation and how to checkout specific release of ESP-IDF.
 
 ### Non-GitHub forks
 
@@ -37,25 +39,16 @@ See the Getting Started guide links above for a detailed setup guide. This is a
 
 ## Setup Build Environment
 
-(See Getting Started guide for a full list of required steps with details.)
+(See the Getting Started guide listed above for a full list of required steps with more details.)
 
-* Install host build dependencies mentioned in Getting Started guide.
-* Add `tools/` directory to the PATH
-* Run `python -m pip install -r requirements.txt` to install Python dependencies
+* Install host build dependencies mentioned in the Getting Started guide.
+* Run the install script to set up the build environment. The options include `install.bat` or `install.ps1` for Windows, and `install.sh` or `install.fish` for Unix shells.
+* Run the export script on Windows (`export.bat`) or source it on Unix (`source export.sh`) in every shell environment before using ESP-IDF.
 
 ## Configuring the Project
 
-`idf.py menuconfig`
-
-* Opens a text-based configuration menu for the project.
-* Use up & down arrow keys to navigate the menu.
-* Use Enter key to go into a submenu, Escape key to go out or to exit.
-* Type `?` to see a help screen. Enter key exits the help screen.
-* Use Space key, or `Y` and `N` keys to enable (Yes) and disable (No) configuration items with checkboxes "`[*]`"
-* Pressing `?` while highlighting a configuration item displays help about that item.
-* Type `/` to search the configuration items.
-
-Once done configuring, press Escape multiple times to exit and say "Yes" to save the new configuration when prompted.
+* `idf.py set-target <chip_name>` sets the target of the project to `<chip_name>`. Run `idf.py set-target` without any arguments to see a list of supported targets.
+* `idf.py menuconfig` opens a text-based configuration menu where you can configure the project.
 
 ## Compiling the Project
 
@@ -77,7 +70,7 @@ You don't need to run `idf.py build` before running `idf.py flash`, `idf.py flas
 
 ## Viewing Serial Output
 
-The `idf.py monitor` target uses the [idf_monitor tool](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html) to display serial output from the ESP32. idf_monitor also has a range of features to decode crash output and interact with the device. [Check the documentation page for details](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
+The `idf.py monitor` target uses the [idf_monitor tool](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html) to display serial output from ESP32 or ESP32-S Series SoCs. idf_monitor also has a range of features to decode crash output and interact with the device. [Check the documentation page for details](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
 
 Exit the monitor by typing Ctrl-].
 

README_CN.md

@@ -2,9 +2,7 @@
 
 * [English Version](./README.md)
 
-[![Documentation Status](https://readthedocs.com/projects/espressif-esp-idf/badge/?version=latest)](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/?badge=latest)
-
-ESP-IDF 是由乐鑫官方推出的针对 [ESP32](https://espressif.com/en/products/hardware/esp32/overview) 系列芯片的开发框架。
+ESP-IDF 是由乐鑫官方推出的针对 **ESP32** 和 **ESP32-S2** 系列芯片的开发框架。
 
 # 使用 ESP-IDF 进行开发
 
@@ -12,8 +10,13 @@ ESP-IDF 是由乐鑫官方推出的针对 [ESP32](https://espressif.com/en/produ
 
 请参阅如下指南搭建 ESP-IDF 的开发环境：
 
-* [ESP-IDF 稳定版本的入门指南](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/)
-* [ESP-IDF 开发版本（master 分支）的入门指南](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)
+| 芯片 | ESP-IDF 入门指南 |
+|:----:|:----|
+| <img src="docs/_static/chip-esp32.svg" height="85" alt="ESP32"> | <ul><li>[稳定](https://docs.espressif.com/projects/esp-idf/zh_CN/stable/get-started/) 版</li><li>[最新（master 分支)](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/get-started/) 版本</li></ul> |
+| <img src="docs/_static/chip-esp32-s2.svg" height="100" alt="ESP32-S2"> | <ul><li>[最新（master 分支)](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32s2/get-started/) 版本</li></ul> |
+
+**注意：** 每个 ESP-IDF 版本都有其对应的文档。 请参阅 [版本](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32/versions.html) 部分，如何查找文档以及如何检出ESP-IDF的特定发行版。
+
 
 ### 非 GitHub 分叉的 ESP-IDF 项目
 
@@ -74,7 +77,7 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu
 
 ## 观察串口输入
 
-`idf.py monitor` 会调用 [idf_monitor 工具](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html)来显示 ESP32 的串口输出。`idf_monitor` 还包含一系列的功能来解析程序崩溃后的输出结果并与设备进行交互。更多详细内容，请参阅[文档](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
+`idf.py monitor` 会调用 [idf_monitor 工具](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html)来显示 ESP32 和 ESP32-S2 的串口输出。`idf_monitor` 还包含一系列的功能来解析程序崩溃后的输出结果并与设备进行交互。更多详细内容，请参阅[文档](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
 
 输入 `Ctrl-]` 可退出监视器。
 

components/app_trace/CMakeLists.txt

@@ -39,4 +39,4 @@ target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-c
 
 # Force app_trace to also appear later than gcov in link line
 idf_component_get_property(app_trace app_trace COMPONENT_LIB)
-target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> ${LIBC})
+target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)

components/app_trace/app_trace.c

@@ -158,7 +158,7 @@
 #include <sys/param.h>
 #include "soc/soc.h"
 #include "soc/dport_reg.h"
-#if CONFIG_IDF_TARGET_ESP32S2BETA
+#if CONFIG_IDF_TARGET_ESP32S2
 #include "soc/sensitive_reg.h"
 #endif
 #include "eri.h"
@@ -210,7 +210,7 @@ const static char *TAG = "esp_apptrace";
 #define TRACEMEM_MUX_BLK0_ONLY                  1
 #define TRACEMEM_MUX_BLK1_ONLY                  2
 #define TRACEMEM_MUX_PROBLK1_APPBLK0            3
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
 #define TRACEMEM_MUX_BLK0_NUM                   19
 #define TRACEMEM_MUX_BLK1_NUM                   20
 #define TRACEMEM_BLK_NUM2ADDR(_n_)              (0x3FFB8000UL + 0x4000UL*((_n_)-4))
@@ -244,7 +244,7 @@ static volatile uint8_t *s_trax_blocks[] = {
     (volatile uint8_t *) 0x3FFFC000,
     (volatile uint8_t *) 0x3FFF8000
 };
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
 static volatile uint8_t *s_trax_blocks[] = {
     (volatile uint8_t *)TRACEMEM_BLK_NUM2ADDR(TRACEMEM_MUX_BLK0_NUM),
     (volatile uint8_t *)TRACEMEM_BLK_NUM2ADDR(TRACEMEM_MUX_BLK1_NUM)
@@ -435,7 +435,7 @@ static inline void esp_apptrace_trax_select_memory_block(int block_num)
     // select memory block to be exposed to the TRAX module (accessed by host)
 #if CONFIG_IDF_TARGET_ESP32
     DPORT_WRITE_PERI_REG(DPORT_TRACEMEM_MUX_MODE_REG, block_num ? TRACEMEM_MUX_BLK0_ONLY : TRACEMEM_MUX_BLK1_ONLY);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     DPORT_WRITE_PERI_REG(DPORT_PMS_OCCUPY_3_REG, block_num ? BIT(TRACEMEM_MUX_BLK0_NUM-4) : BIT(TRACEMEM_MUX_BLK1_NUM-4));
 #endif
 }

components/app_trace/app_trace_util.c

@@ -18,8 +18,8 @@
 #include "sdkconfig.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/clk.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/clk.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/clk.h"
 #endif
 
 ///////////////////////////////////////////////////////////////////////////////

components/app_trace/gcov/gcov_rtio.c

@@ -23,11 +23,11 @@
 #include "soc/timer_periph.h"
 #include "esp_app_trace.h"
 #include "esp_private/dbg_stubs.h"
-#include "hal/timer_ll.h"
+#include "hal/wdt_hal.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/libc_stubs.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/libc_stubs.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/libc_stubs.h"
 #endif
 
 #if CONFIG_APPTRACE_GCOV_ENABLE
@@ -68,8 +68,12 @@ static int esp_dbg_stub_gcov_dump_do(void)
     int ret = ESP_OK;
     FILE* old_stderr = stderr;
     FILE* old_stdout = stdout;
-    struct syscall_stub_table* old_table = syscall_table_ptr_pro;
+    static struct syscall_stub_table *old_tables[portNUM_PROCESSORS];
 
+    old_tables[0] = syscall_table_ptr_pro;
+#if portNUM_PROCESSORS > 1
+    old_tables[1] = syscall_table_ptr_app;
+#endif
     ESP_EARLY_LOGV(TAG, "Alloc apptrace down buf %d bytes", ESP_GCOV_DOWN_BUF_SIZE);
     void *down_buf = malloc(ESP_GCOV_DOWN_BUF_SIZE);
     if (down_buf == NULL) {
@@ -80,12 +84,14 @@ static int esp_dbg_stub_gcov_dump_do(void)
     esp_apptrace_down_buffer_config(down_buf, ESP_GCOV_DOWN_BUF_SIZE);
     ESP_EARLY_LOGV(TAG, "Dump data...");
     // incase of dual-core chip APP and PRO CPUs share the same table, so it is safe to save only PRO's table
-    memcpy(&s_gcov_stub_table, old_table, sizeof(s_gcov_stub_table));
+    memcpy(&s_gcov_stub_table, syscall_table_ptr_pro, sizeof(s_gcov_stub_table));
     s_gcov_stub_table._lock_acquire_recursive = &gcov_stub_lock_acquire_recursive;
     s_gcov_stub_table._lock_release_recursive = &gcov_stub_lock_release_recursive;
     s_gcov_stub_table._lock_try_acquire_recursive = &gcov_stub_lock_try_acquire_recursive,
-
     syscall_table_ptr_pro = &s_gcov_stub_table;
+#if portNUM_PROCESSORS > 1
+    syscall_table_ptr_app = &s_gcov_stub_table;
+#endif
     stderr = (FILE*) &__sf_fake_stderr;
     stdout = (FILE*) &__sf_fake_stdout;
     __gcov_dump();
@@ -93,8 +99,10 @@ static int esp_dbg_stub_gcov_dump_do(void)
     __gcov_reset();
     stdout = old_stdout;
     stderr = old_stderr;
-    syscall_table_ptr_pro = old_table;
-
+    syscall_table_ptr_pro = old_tables[0];
+#if portNUM_PROCESSORS > 1
+    syscall_table_ptr_app = old_tables[1];
+#endif
     ESP_EARLY_LOGV(TAG, "Free apptrace down buf");
     free(down_buf);
     ESP_EARLY_LOGV(TAG, "Finish file transfer session");
@@ -102,6 +110,7 @@ static int esp_dbg_stub_gcov_dump_do(void)
     if (ret != ESP_OK) {
         ESP_EARLY_LOGE(TAG, "Failed to send files transfer stop cmd (%d)!", ret);
     }
+    ESP_EARLY_LOGV(TAG, "exit %d", ret);
     return ret;
 }
 
@@ -133,14 +142,16 @@ void esp_gcov_dump(void)
     esp_cpu_stall(other_core);
 #endif
     while (!esp_apptrace_host_is_connected(ESP_APPTRACE_DEST_TRAX)) {
-        // to avoid complains that task watchdog got triggered for other tasks
-        timer_ll_wdt_set_protect(&TIMERG0, false);
-        timer_ll_wdt_feed(&TIMERG0);
-        timer_ll_wdt_set_protect(&TIMERG0, true);
-        // to avoid reboot on INT_WDT
-        timer_ll_wdt_set_protect(&TIMERG1, false);
-        timer_ll_wdt_feed(&TIMERG1);
-        timer_ll_wdt_set_protect(&TIMERG1, true);
+        wdt_hal_context_t twdt = {.inst = WDT_MWDT0, .mwdt_dev = &TIMERG0};
+        wdt_hal_context_t iwdt = {.inst = WDT_MWDT1, .mwdt_dev = &TIMERG1};
+        //Feed the Task Watchdog (TG0) to prevent it from timing out
+        wdt_hal_write_protect_disable(&twdt);
+        wdt_hal_feed(&twdt);
+        wdt_hal_write_protect_enable(&twdt);
+        //Likewise, feed the Interrupt Watchdog (TG1) to prevent a reboot
+        wdt_hal_write_protect_disable(&iwdt);
+        wdt_hal_feed(&iwdt);
+        wdt_hal_write_protect_enable(&iwdt);
     }
 
     esp_dbg_stub_gcov_dump_do();
@@ -153,7 +164,9 @@ void esp_gcov_dump(void)
 void *gcov_rtio_fopen(const char *path, const char *mode)
 {
     ESP_EARLY_LOGV(TAG, "%s '%s' '%s'", __FUNCTION__, path, mode);
-    return esp_apptrace_fopen(ESP_APPTRACE_DEST_TRAX, path, mode);
+    void *f = esp_apptrace_fopen(ESP_APPTRACE_DEST_TRAX, path, mode);
+    ESP_EARLY_LOGV(TAG, "%s ret %p", __FUNCTION__, f);
+    return f;
 }
 
 int gcov_rtio_fclose(void *stream)

components/app_trace/project_include.cmake

@@ -5,12 +5,24 @@ function(idf_create_coverage_report report_dir)
     set(gcov_tool ${CONFIG_SDK_TOOLPREFIX}gcov)
     idf_build_get_property(project_name PROJECT_NAME)
 
-    add_custom_target(lcov-report
+    add_custom_target(pre-cov-report
         COMMENT "Generating coverage report in: ${report_dir}"
         COMMAND ${CMAKE_COMMAND} -E echo "Using gcov: ${gcov_tool}"
         COMMAND ${CMAKE_COMMAND} -E make_directory ${report_dir}/html
+        )
+
+    add_custom_target(lcov-report
+        COMMENT "WARNING: lcov-report is deprecated. Please use gcovr-report instead."
         COMMAND lcov --gcov-tool ${gcov_tool} -c -d ${CMAKE_CURRENT_BINARY_DIR} -o ${report_dir}/${project_name}.info
-        COMMAND genhtml -o ${report_dir}/html ${report_dir}/${project_name}.info)
+        COMMAND genhtml -o ${report_dir}/html ${report_dir}/${project_name}.info
+        DEPENDS pre-cov-report
+        )
+
+    add_custom_target(gcovr-report
+        COMMAND gcovr -r ${project_dir} --gcov-executable ${gcov_tool} -s --html-details ${report_dir}/html/index.html
+        WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+        DEPENDS pre-cov-report
+        )
 endfunction()
 
 # idf_clean_coverage_report
@@ -20,4 +32,4 @@ function(idf_clean_coverage_report report_dir)
     add_custom_target(cov-data-clean
         COMMENT "Clean coverage report in: ${report_dir}"
         COMMAND ${CMAKE_COMMAND} -E remove_directory ${report_dir})
-endfunction()
+endfunction()

components/app_trace/sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c

@@ -66,9 +66,9 @@ Revision: $Rev: 3734 $
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/ets_sys.h"
 #include "esp32/clk.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/ets_sys.h"
-#include "esp32s2beta/clk.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/ets_sys.h"
+#include "esp32s2/clk.h"
 #endif
 #include "esp_app_trace.h"
 #include "esp_app_trace_util.h"
@@ -78,9 +78,9 @@ Revision: $Rev: 3734 $
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/ets_sys.h"
 #include "esp32/clk.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/ets_sys.h"
-#include "esp32s2beta/clk.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/ets_sys.h"
+#include "esp32s2/clk.h"
 #endif
 
 
@@ -140,7 +140,7 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 // CCOUNT is incremented at CPU frequency
 #if CONFIG_IDF_TARGET_ESP32
 #define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ * 1000000)
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
 #define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32S2_DEFAULT_CPU_FREQ_MHZ * 1000000)
 #endif
 #endif // TS_USE_CCOUNT

components/app_trace/sys_view/esp32/SEGGER_RTT_esp32.c

@@ -20,8 +20,8 @@
 
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/ets_sys.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/ets_sys.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/ets_sys.h"
 #endif
 #include "esp_app_trace.h"
 

components/app_trace/test/CMakeLists.txt

@@ -1,3 +1,3 @@
 idf_component_register(SRC_DIRS "."
-                    INCLUDE_DIRS "."
-                    REQUIRES unity)
+                    PRIV_INCLUDE_DIRS "."
+                    PRIV_REQUIRES unity)

components/app_update/CMakeLists.txt

@@ -7,11 +7,18 @@ idf_component_register(SRCS "esp_ota_ops.c"
 # linker will ignore this structure as it has no other files depending on it.
 target_link_libraries(${COMPONENT_LIB} INTERFACE "-u esp_app_desc")
 
+if(CONFIG_APP_PROJECT_VER_FROM_CONFIG)
+    # Ignore current PROJECT_VER (which was set in __project_get_revision()).
+    # Gets the version from the CONFIG_APP_PROJECT_VER.
+    idf_build_set_property(PROJECT_VER "${CONFIG_APP_PROJECT_VER}")
+endif()
+
 # cut PROJECT_VER and PROJECT_NAME to required 32 characters.
 idf_build_get_property(project_ver PROJECT_VER)
 idf_build_get_property(project_name PROJECT_NAME)
 string(SUBSTRING "${project_ver}" 0 31 PROJECT_VER_CUT)
 string(SUBSTRING "${project_name}" 0 31 PROJECT_NAME_CUT)
+message(STATUS "App \"${PROJECT_NAME_CUT}\" version: ${PROJECT_VER_CUT}")
 
 set_source_files_properties(
     SOURCE "esp_app_desc.c"
@@ -55,6 +62,11 @@ if(NOT BOOTLOADER_BUILD)
                         --partition-table-offset ${PARTITION_TABLE_OFFSET}
                         erase_otadata)
 
-        esptool_py_flash_project_args(otadata ${otadata_offset} "${blank_otadata_file}" FLASH_IN_PROJECT)
+        idf_component_get_property(main_args esptool_py FLASH_ARGS)
+        idf_component_get_property(sub_args esptool_py FLASH_SUB_ARGS)
+        esptool_py_flash_target(otadata-flash "${main_args}" "${sub_args}")
+        esptool_py_flash_target_image(otadata-flash otadata "${otadata_offset}" "${blank_otadata_file}")
+
+        esptool_py_flash_target_image(flash otadata "${otadata_offset}" "${blank_otadata_file}")
     endif()
 endif()

components/app_update/Kconfig.projbuild

@@ -22,4 +22,28 @@ menu "Application manager"
             The PROJECT_NAME variable from the build system will not affect the firmware image.
             This value will not be contained in the esp_app_desc structure.
 
+    config APP_PROJECT_VER_FROM_CONFIG
+        bool "Get the project version from Kconfig"
+        default n
+        help
+            If this is enabled, then config item APP_PROJECT_VER will be used for the variable PROJECT_VER.
+            Other ways to set PROJECT_VER will be ignored.
+
+    config APP_PROJECT_VER
+        string "Project version"
+        default "1"
+        depends on APP_PROJECT_VER_FROM_CONFIG
+        help
+            Project version
+
+    config APP_RETRIEVE_LEN_ELF_SHA
+        int "The length of APP ELF SHA is stored in RAM(chars)"
+        default 16
+        range 8 64
+        help
+            At startup, the app will read this many hex characters from the embedded APP ELF SHA-256 hash value
+            and store it in static RAM. This ensures the app ELF SHA-256 value is always available
+            if it needs to be printed by the panic handler code.
+            Changing this value will change the size of a static buffer, in bytes.
+
 endmenu # "Application manager"

components/app_update/component.mk

@@ -8,49 +8,49 @@
 COMPONENT_ADD_LDFLAGS += -u esp_app_desc
 
 ifndef IS_BOOTLOADER_BUILD
-GET_PROJECT_VER ?=
-ifeq ("${PROJECT_VER}", "")
-ifeq ("$(wildcard ${PROJECT_PATH}/version.txt)","")
+    # If ``CONFIG_APP_PROJECT_VER_FROM_CONFIG`` option is set, the value of ``CONFIG_APP_PROJECT_VER`` will be used
+    # Else, if ``PROJECT_VER`` variable set in project Makefile file, its value will be used.
+    # Else, if the ``$PROJECT_PATH/version.txt`` exists, its contents will be used as ``PROJECT_VER``.
+    # Else, if the project is located inside a Git repository, the output of git describe will be used.
+    # Otherwise, ``PROJECT_VER`` will be "1".
+    ifdef CONFIG_APP_PROJECT_VER_FROM_CONFIG
+        PROJECT_VER:= $(CONFIG_APP_PROJECT_VER)
+    else
+        ifneq ("${PROJECT_VER}", "")
+            PROJECT_VER:= $(PROJECT_VER)
+        else
+            ifneq ("$(wildcard ${PROJECT_PATH}/version.txt)","")
+                PROJECT_VER := $(shell cat ${PROJECT_PATH}/version.txt)
+            else
+                GIT_PROJECT_VER := $(shell cd ${PROJECT_PATH} && git describe --always --tags --dirty 2> /dev/null)
+                ifeq ("${GIT_PROJECT_VER}", "")
+                    PROJECT_VER := "1"
+                    $(info Project is not inside a git repository, or git repository has no commits)
+                    $(info will not use 'git describe' to determine PROJECT_VER.)
+                else
+                    PROJECT_VER:= $(GIT_PROJECT_VER)
+                endif # a git repository
+            endif # version.txt
+        endif # PROJECT_VER
+    endif # CONFIG_APP_PROJECT_VER_FROM_CONFIG
 
-GET_PROJECT_VER := $(shell cd ${PROJECT_PATH} && git describe --always --tags --dirty 2> /dev/null)
-ifeq ("${GET_PROJECT_VER}", "")
-GET_PROJECT_VER := "1"
-$(info Project is not inside a git repository, will not use 'git describe' to determine PROJECT_VER.)
-endif
+    # cut PROJECT_VER and PROJECT_NAME to required 32 characters.
+    PROJECT_VER_CUT  := $(shell echo "$(PROJECT_VER)"  | cut -c 1-31)
+    PROJECT_NAME_CUT := $(shell echo "$(PROJECT_NAME)" | cut -c 1-31)
 
-else
-# read from version.txt
-GET_PROJECT_VER := $(shell cat ${PROJECT_PATH}/version.txt)
-endif
-endif
-# If ``PROJECT_VER`` variable set in project Makefile file, its value will be used.
-# Else, if the ``$PROJECT_PATH/version.txt`` exists, its contents will be used as ``PROJECT_VER``.
-# Else, if the project is located inside a Git repository, the output of git describe will be used.
-# Otherwise, ``PROJECT_VER`` will be "1".
+    $(info App "$(PROJECT_NAME_CUT)" version: $(PROJECT_VER_CUT))
 
-ifeq ("${PROJECT_VER}", "")
-PROJECT_VER:= $(GET_PROJECT_VER)
-else
-PROJECT_VER:= $(PROJECT_VER)
-endif
+    NEW_DEFINES:= "$(PROJECT_VER_CUT) $(PROJECT_NAME_CUT) $(IDF_VER)"
+    ifeq ("$(wildcard ${TMP_DEFINES})","")
+        OLD_DEFINES:= ""
+    else
+        OLD_DEFINES:= "$(shell cat $(TMP_DEFINES))"
+    endif
 
-# cut PROJECT_VER and PROJECT_NAME to required 32 characters.
-PROJECT_VER_CUT  := $(shell echo "$(PROJECT_VER)"  | cut -c 1-31)
-PROJECT_NAME_CUT := $(shell echo "$(PROJECT_NAME)" | cut -c 1-31)
+    # If NEW_DEFINES (PROJECT_VER, PROJECT_NAME) were changed then rebuild only esp_app_desc.
+    ifneq (${NEW_DEFINES}, ${OLD_DEFINES})
+        $(shell echo $(NEW_DEFINES) > $(TMP_DEFINES); rm -f esp_app_desc.o;)
+    endif
 
-$(info App "$(PROJECT_NAME_CUT)" version: $(PROJECT_VER_CUT))
-
-NEW_DEFINES:= "$(PROJECT_VER_CUT) $(PROJECT_NAME_CUT) $(IDF_VER)"
-ifeq ("$(wildcard ${TMP_DEFINES})","")
-OLD_DEFINES:= ""
-else
-OLD_DEFINES:= "$(shell cat $(TMP_DEFINES))"
-endif
-
-# If NEW_DEFINES (PROJECT_VER, PROJECT_NAME) were changed then rebuild only esp_app_desc.
-ifneq (${NEW_DEFINES}, ${OLD_DEFINES})
-$(shell echo $(NEW_DEFINES) > $(TMP_DEFINES); rm -f esp_app_desc.o;)
-endif
-
-esp_app_desc.o: CPPFLAGS += -D PROJECT_VER=\""$(PROJECT_VER_CUT)"\" -D PROJECT_NAME=\""$(PROJECT_NAME_CUT)"\"
-endif
+    esp_app_desc.o: CPPFLAGS += -D PROJECT_VER=\""$(PROJECT_VER_CUT)"\" -D PROJECT_NAME=\""$(PROJECT_NAME_CUT)"\"
+endif # IS_BOOTLOADER_BUILD

components/app_update/esp_app_desc.c

@@ -72,13 +72,35 @@ static inline char IRAM_ATTR to_hex_digit(unsigned val)
     return (val < 10) ? ('0' + val) : ('a' + val - 10);
 }
 
+__attribute__((constructor)) void esp_ota_init_app_elf_sha256(void)
+{
+    esp_ota_get_app_elf_sha256(NULL, 0);
+}
+
+/* The esp_app_desc.app_elf_sha256 should be possible to print in panic handler during cache is disabled.
+ * But because the cache is disabled the reading esp_app_desc.app_elf_sha256 is not right and
+ * can lead to a complete lock-up of the CPU.
+ * For this reason we do a reading of esp_app_desc.app_elf_sha256 while start up in esp_ota_init_app_elf_sha256() 
+ * and keep it in the static s_app_elf_sha256 value.
+ */
 int IRAM_ATTR esp_ota_get_app_elf_sha256(char* dst, size_t size)
 {
-    size_t n = MIN((size - 1) / 2, sizeof(esp_app_desc.app_elf_sha256));
-    const uint8_t* src = esp_app_desc.app_elf_sha256;
+    static char s_app_elf_sha256[CONFIG_APP_RETRIEVE_LEN_ELF_SHA / 2];
+    static bool first_call = true;
+    if (first_call) {
+        first_call = false;
+        const uint8_t* src = esp_app_desc.app_elf_sha256;
+        for (size_t i = 0; i < sizeof(s_app_elf_sha256); ++i) {
+            s_app_elf_sha256[i] = src[i];
+        }
+    }
+    if (dst == NULL || size == 0) {
+        return 0;
+    }
+    size_t n = MIN((size - 1) / 2, sizeof(s_app_elf_sha256));
     for (size_t i = 0; i < n; ++i) {
-        dst[2*i] = to_hex_digit(src[i] >> 4);
-        dst[2*i + 1] = to_hex_digit(src[i] & 0xf);
+        dst[2*i] = to_hex_digit(s_app_elf_sha256[i] >> 4);
+        dst[2*i + 1] = to_hex_digit(s_app_elf_sha256[i] & 0xf);
     }
     dst[2*n] = 0;
     return 2*n + 1;

components/app_update/esp_ota_ops.c

@@ -41,6 +41,12 @@
 #include "esp_system.h"
 #include "esp_efuse.h"
 
+#ifdef CONFIG_IDF_TARGET_ESP32
+#include "esp32/rom/crc.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/crc.h"
+#include "esp32s2/rom/secure_boot.h"
+#endif
 
 #define SUB_TYPE_ID(i) (i & 0x0F)
 
@@ -157,7 +163,8 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp
     if ((image_size == 0) || (image_size == OTA_SIZE_UNKNOWN)) {
         ret = esp_partition_erase_range(partition, 0, partition->size);
     } else {
-        ret = esp_partition_erase_range(partition, 0, (image_size / SPI_FLASH_SEC_SIZE + 1) * SPI_FLASH_SEC_SIZE);
+        const int aligned_erase_size = (image_size + SPI_FLASH_SEC_SIZE - 1) & ~(SPI_FLASH_SEC_SIZE - 1);
+        ret = esp_partition_erase_range(partition, 0, aligned_erase_size);
     }
 
     if (ret != ESP_OK) {
@@ -249,6 +256,43 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
     return ESP_ERR_INVALID_ARG;
 }
 
+esp_err_t esp_ota_write_with_offset(esp_ota_handle_t handle, const void *data, size_t size, uint32_t offset)
+{
+    const uint8_t *data_bytes = (const uint8_t *)data;
+    esp_err_t ret;
+    ota_ops_entry_t *it;
+
+    if (data == NULL) {
+        ESP_LOGE(TAG, "write data is invalid");
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    // find ota handle in linked list
+    for (it = LIST_FIRST(&s_ota_ops_entries_head); it != NULL; it = LIST_NEXT(it, entries)) {
+        if (it->handle == handle) {
+            // must erase the partition before writing to it
+            assert(it->erased_size > 0 && "must erase the partition before writing to it");
+
+            /* esp_ota_write_with_offset is used to write data in non contiguous manner.
+             * Hence, unaligned data(less than 16 bytes) cannot be cached if flash encryption is enabled.
+             */
+            if (esp_flash_encryption_enabled() && (size % 16)) {
+                ESP_LOGE(TAG, "Size should be 16byte aligned for flash encryption case");
+                return ESP_ERR_INVALID_ARG;
+            }
+            ret = esp_partition_write(it->part, offset, data_bytes, size);
+            if (ret == ESP_OK) {
+                it->wrote_size += size;
+            }
+            return ret;
+        }
+    }
+
+    // OTA handle is not found in linked list
+    ESP_LOGE(TAG,"OTA handle not found");
+    return ESP_ERR_INVALID_ARG;
+}
+
 esp_err_t esp_ota_end(esp_ota_handle_t handle)
 {
     ota_ops_entry_t *it;
@@ -820,3 +864,24 @@ esp_err_t esp_ota_erase_last_boot_app_partition(void)
 
     return ESP_OK;
 }
+
+#if CONFIG_IDF_TARGET_ESP32S2 && CONFIG_SECURE_BOOT_V2_ENABLED
+esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_index_t index) {
+
+    if (!esp_secure_boot_enabled()) {
+        ESP_LOGE(TAG, "Secure boot v2 has not been enabled.");
+        return ESP_FAIL;
+    }
+
+    if (index != SECURE_BOOT_PUBLIC_KEY_INDEX_0 &&
+         index != SECURE_BOOT_PUBLIC_KEY_INDEX_1 &&
+         index != SECURE_BOOT_PUBLIC_KEY_INDEX_2) {
+        ESP_LOGE(TAG, "Invalid Index found for public key revocation %d.", index);
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ets_secure_boot_revoke_public_key_digest(index);
+    ESP_LOGI(TAG, "Revoked signature block %d.", index);
+    return ESP_OK;
+}
+#endif

components/app_update/include/esp_ota_ops.h

@@ -117,6 +117,29 @@ esp_err_t esp_ota_begin(const esp_partition_t* partition, size_t image_size, esp
  */
 esp_err_t esp_ota_write(esp_ota_handle_t handle, const void* data, size_t size);
 
+/**
+ * @brief   Write OTA update data to partition
+ *
+ * This function can write data in non contiguous manner.
+ * If flash encryption is enabled, data should be 16 byte aligned.
+ *
+ * @param handle  Handle obtained from esp_ota_begin
+ * @param data    Data buffer to write
+ * @param size    Size of data buffer in bytes
+ * @param offset  Offset in flash partition
+ *
+ * @note While performing OTA, if the packets arrive out of order, esp_ota_write_with_offset() can be used to write data in non contiguous manner.
+ *       Use of esp_ota_write_with_offset() in combination with esp_ota_write() is not recommended.
+ *
+ * @return
+ *    - ESP_OK: Data was written to flash successfully.
+ *    - ESP_ERR_INVALID_ARG: handle is invalid.
+ *    - ESP_ERR_OTA_VALIDATE_FAILED: First byte of image contains invalid app image magic byte.
+ *    - ESP_ERR_FLASH_OP_TIMEOUT or ESP_ERR_FLASH_OP_FAIL: Flash write failed.
+ *    - ESP_ERR_OTA_SELECT_INFO_INVALID: OTA data partition has invalid contents
+ */
+esp_err_t esp_ota_write_with_offset(esp_ota_handle_t handle, const void *data, size_t size, uint32_t offset);
+
 /**
  * @brief Finish OTA update and validate newly written app image.
  *
@@ -276,6 +299,34 @@ esp_err_t esp_ota_erase_last_boot_app_partition(void);
  */
 bool esp_ota_check_rollback_is_possible(void);
 
+#if CONFIG_IDF_TARGET_ESP32S2 && (CONFIG_SECURE_BOOT_V2_ENABLED || __DOXYGEN__)
+
+/**
+ * Secure Boot V2 public key indexes.
+ */
+typedef enum {
+    SECURE_BOOT_PUBLIC_KEY_INDEX_0,     /*!< Points to the 0th index of the Secure Boot v2 public key */
+    SECURE_BOOT_PUBLIC_KEY_INDEX_1,     /*!< Points to the 1st index of the Secure Boot v2 public key */
+    SECURE_BOOT_PUBLIC_KEY_INDEX_2      /*!< Points to the 2nd index of the Secure Boot v2 public key */
+} esp_ota_secure_boot_public_key_index_t;
+
+/**
+ * @brief Revokes the old signature digest. To be called in the application after the rollback logic.
+ *
+ * Relevant for Secure boot v2 on ESP32-S2 where upto 3 key digests can be stored (Key #N-1, Key #N, Key #N+1).
+ * When key #N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key #N-1 & Key #N.
+ * After successfully booting the OTA app should call this function to revoke Key #N-1.
+ *
+ * @param index - The index of the signature block to be revoked
+ *
+ * @return
+ *        - ESP_OK: If revocation is successful.
+ *        - ESP_ERR_INVALID_ARG: If the index of the public key to be revoked is incorrect.
+ *        - ESP_FAIL: If secure boot v2 has not been enabled.
+ */
+esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_index_t index);
+#endif /* CONFIG_IDF_TARGET_ESP32S2 */
+
 #ifdef __cplusplus
 }
 #endif

components/app_update/test/CMakeLists.txt

@@ -1,4 +1,4 @@
 idf_component_register(SRC_DIRS "."
-                       INCLUDE_DIRS "."
-                       REQUIRES unity test_utils app_update bootloader_support nvs_flash
+                       PRIV_INCLUDE_DIRS "."
+                       PRIV_REQUIRES unity test_utils app_update bootloader_support nvs_flash
                       )

components/app_update/test/test_app_desc.c

@@ -4,7 +4,7 @@
 
 TEST_CASE("esp_ota_get_app_elf_sha256 test", "[esp_app_desc]")
 {
-    const int sha256_hex_len = 64;
+    const int sha256_hex_len = CONFIG_APP_RETRIEVE_LEN_ELF_SHA;
     char dst[sha256_hex_len + 2];
     const char fill = 0xcc;
     int res;

components/app_update/test/test_ota_ops.c

@@ -84,7 +84,7 @@ TEST_CASE("esp_ota_get_next_update_partition logic", "[ota]")
     TEST_ASSERT_EQUAL_PTR(ota_0, p);
 }
 
-TEST_CASE("esp_ota_get_partition_description ", "[ota]")
+TEST_CASE("esp_ota_get_partition_description", "[ota]")
 {
     const esp_partition_t *running = esp_ota_get_running_partition();
     TEST_ASSERT_NOT_NULL(running);

components/app_update/test/test_switch_ota.c

@@ -10,9 +10,9 @@
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/spi_flash.h"
 #include "esp32/rom/rtc.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/spi_flash.h"
-#include "esp32s2beta/rom/rtc.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/spi_flash.h"
+#include "esp32s2/rom/rtc.h"
 #endif
 
 #include "freertos/FreeRTOS.h"
@@ -48,9 +48,34 @@ static void copy_app_partition(esp_ota_handle_t update_handle, const esp_partiti
 {
     const void *partition_bin = NULL;
     spi_flash_mmap_handle_t  data_map;
+    ESP_LOGI(TAG, "start the copy process");
     TEST_ESP_OK(esp_partition_mmap(curr_app, 0, curr_app->size, SPI_FLASH_MMAP_DATA, &partition_bin, &data_map));
     TEST_ESP_OK(esp_ota_write(update_handle, (const void *)partition_bin, curr_app->size));
     spi_flash_munmap(data_map);
+    ESP_LOGI(TAG, "finish the copy process");
+}
+
+/* @brief Copies a current app to next partition using handle.
+ *
+ * @param[in] update_handle - Handle of API ota.
+ * @param[in] cur_app - Current app.
+ */
+static void copy_app_partition_with_offset(esp_ota_handle_t update_handle, const esp_partition_t *curr_app)
+{
+    const void *partition_bin = NULL;
+    spi_flash_mmap_handle_t  data_map;
+    ESP_LOGI(TAG, "start the copy process");
+    uint32_t offset = 0, bytes_to_write = curr_app->size;
+    uint32_t write_bytes;
+    while (bytes_to_write > 0) {
+        write_bytes = (bytes_to_write > (4 * 1024)) ? (4 * 1024) : bytes_to_write;
+        TEST_ESP_OK(esp_partition_mmap(curr_app, offset, write_bytes, SPI_FLASH_MMAP_DATA, &partition_bin, &data_map));
+        TEST_ESP_OK(esp_ota_write_with_offset(update_handle, (const void *)partition_bin, write_bytes, offset));
+        spi_flash_munmap(data_map);
+        bytes_to_write -= write_bytes;
+        offset += write_bytes;
+    }
+    ESP_LOGI(TAG, "finish the copy process");
 }
 
 #if defined(CONFIG_BOOTLOADER_FACTORY_RESET) || defined(CONFIG_BOOTLOADER_APP_TEST)
@@ -103,6 +128,26 @@ static void copy_current_app_to_next_part(const esp_partition_t *cur_app_partiti
     TEST_ESP_OK(esp_ota_set_boot_partition(next_app_partition));
 }
 
+/* @brief Copies a current app to next partition (OTA0-15) and then configure OTA data for a new boot partition.
+ *
+ * @param[in] cur_app_partition - Current app.
+ * @param[in] next_app_partition - Next app for boot.
+ */
+static void copy_current_app_to_next_part_with_offset(const esp_partition_t *cur_app_partition, const esp_partition_t *next_app_partition)
+{
+    esp_ota_get_next_update_partition(NULL);
+    TEST_ASSERT_NOT_EQUAL(NULL, next_app_partition);
+    ESP_LOGI(TAG, "Writing to partition subtype %d at offset 0x%x", next_app_partition->subtype, next_app_partition->address);
+
+    esp_ota_handle_t update_handle = 0;
+    TEST_ESP_OK(esp_ota_begin(next_app_partition, OTA_SIZE_UNKNOWN, &update_handle));
+
+    copy_app_partition_with_offset(update_handle, cur_app_partition);
+
+    TEST_ESP_OK(esp_ota_end(update_handle));
+    TEST_ESP_OK(esp_ota_set_boot_partition(next_app_partition));
+}
+
 /* @brief Erase otadata partition
  */
 static void erase_ota_data(void)
@@ -116,6 +161,7 @@ static void erase_ota_data(void)
  */
 static void reboot_as_deep_sleep(void)
 {
+    ESP_LOGI(TAG, "reboot as deep sleep");
     esp_sleep_enable_timer_wakeup(2000);
     esp_deep_sleep_start();
 }
@@ -125,10 +171,21 @@ static void reboot_as_deep_sleep(void)
 static void copy_current_app_to_next_part_and_reboot(void)
 {
     const esp_partition_t *cur_app = esp_ota_get_running_partition();
+    ESP_LOGI(TAG, "copy current app to next part");
     copy_current_app_to_next_part(cur_app, get_next_update_partition());
     reboot_as_deep_sleep();
 }
 
+/* @brief Copies a current app to next partition (OTA0-15) using esp_ota_write_with_offest(), after that ESP is rebooting and run this (the next) OTAx.
+ */
+static void copy_current_app_to_next_part_with_offset_and_reboot(void)
+{
+    const esp_partition_t *cur_app = esp_ota_get_running_partition();
+    ESP_LOGI(TAG, "copy current app to next part");
+    copy_current_app_to_next_part_with_offset(cur_app, get_next_update_partition());
+    reboot_as_deep_sleep();
+}
+
 /* @brief Get running app.
  *
  * @return The next partition of OTA(OTA0-15).
@@ -256,6 +313,7 @@ static void start_test(void)
     ESP_LOGI(TAG, "boot count 1 - reset");
     boot_count = 1;
     erase_ota_data();
+    ESP_LOGI(TAG, "ota_data erased");
     reboot_as_deep_sleep();
 }
 
@@ -735,3 +793,32 @@ static void test_erase_last_app_rollback(void)
 // 4 Stage: run OTA1           -> check it -> erase OTA0 and rollback                          -> reboot
 // 5 Stage: run factory        -> check it -> erase OTA_DATA for next tests                    -> PASS
 TEST_CASE_MULTIPLE_STAGES("Test erase_last_boot_app_partition. factory, OTA1, OTA0, factory", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET, SW_CPU_RESET]", start_test, test_erase_last_app_flow, test_erase_last_app_flow, test_erase_last_app_flow, test_erase_last_app_rollback);
+
+static void test_flow6(void)
+{
+    boot_count++;
+    ESP_LOGI(TAG, "boot count %d", boot_count);
+    const esp_partition_t *cur_app = get_running_firmware();
+    switch (boot_count) {
+        case 2:
+            ESP_LOGI(TAG, "Factory");
+            TEST_ASSERT_EQUAL(ESP_PARTITION_SUBTYPE_APP_FACTORY, cur_app->subtype);
+            copy_current_app_to_next_part_with_offset_and_reboot();
+            break;
+        case 3:
+            ESP_LOGI(TAG, "OTA0");
+            TEST_ASSERT_EQUAL(ESP_PARTITION_SUBTYPE_APP_OTA_0, cur_app->subtype);
+            mark_app_valid();
+            erase_ota_data();
+            break;
+        default:
+            erase_ota_data();
+            TEST_FAIL_MESSAGE("Unexpected stage");
+            break;
+    }
+}
+
+// 1 Stage: After POWER_RESET erase OTA_DATA for this test              -> reboot through deep sleep.
+// 2 Stage: run factory -> check it -> copy factory to OTA0             -> reboot  --//--
+// 3 Stage: run OTA0    -> check it -> erase OTA_DATA for next tests    -> PASS
+TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0 using esp_ota_write_with_offset", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow6, test_flow6);

components/bootloader/CMakeLists.txt

@@ -5,17 +5,17 @@ if(BOOTLOADER_BUILD OR NOT CONFIG_APP_BUILD_BOOTLOADER)
     return()
 endif()
 
+add_dependencies(bootloader partition_table_bin)
+
 # When secure boot is enabled, do not flash bootloader along with invocation of `idf.py flash`
-if(NOT CONFIG_SECURE_BOOT_ENABLED)
+if(NOT CONFIG_SECURE_BOOT)
     set(flash_bootloader FLASH_IN_PROJECT)
 endif()
 
-# Set values used in flash_bootloader_args.in and generate flash file
-# for bootloader
-esptool_py_flash_project_args(bootloader 0x1000
-                            ${BOOTLOADER_BUILD_DIR}/bootloader.bin
-                            ${flash_bootloader}
-                            FLASH_FILE_TEMPLATE flash_bootloader_args.in)
-
 esptool_py_custom_target(bootloader-flash bootloader "bootloader")
-add_dependencies(bootloader partition_table)
+esptool_py_flash_target_image(bootloader-flash bootloader "0x1000" "${BOOTLOADER_BUILD_DIR}/bootloader.bin")
+
+# Also attach an image to the project flash target
+if(NOT CONFIG_SECURE_BOOT)
+    esptool_py_flash_target_image(flash bootloader "0x1000" "${BOOTLOADER_BUILD_DIR}/bootloader.bin")
+endif()

components/bootloader/Kconfig.projbuild

@@ -1,4 +1,29 @@
 menu "Bootloader config"
+
+    choice BOOTLOADER_COMPILER_OPTIMIZATION
+        prompt "Bootloader optimization Level"
+        default BOOTLOADER_COMPILER_OPTIMIZATION_SIZE
+        help
+            This option sets compiler optimization level (gcc -O argument)
+            for the bootloader.
+
+            - The default "Size" setting will add the -0s flag to CFLAGS.
+            - The "Debug" setting will add the -Og flag to CFLAGS.
+            - The "Performance" setting will add the -O2 flag to CFLAGS.
+            - The "None" setting will add the -O0 flag to CFLAGS.
+
+            Note that custom optimization levels may be unsupported.
+
+        config BOOTLOADER_COMPILER_OPTIMIZATION_SIZE
+            bool "Size (-Os)"
+        config BOOTLOADER_COMPILER_OPTIMIZATION_DEBUG
+            bool "Debug (-Og)"
+        config BOOTLOADER_COMPILER_OPTIMIZATION_PERF
+            bool "Optimize for performance (-O2)"
+        config BOOTLOADER_COMPILER_OPTIMIZATION_NONE
+            bool "Debug without optimization (-O0)"
+    endchoice
+
     choice BOOTLOADER_LOG_LEVEL
         bool "Bootloader log verbosity"
         default BOOTLOADER_LOG_LEVEL_INFO
@@ -28,20 +53,34 @@ menu "Bootloader config"
         default 4 if BOOTLOADER_LOG_LEVEL_DEBUG
         default 5 if BOOTLOADER_LOG_LEVEL_VERBOSE
 
+    config BOOTLOADER_SPI_CUSTOM_WP_PIN
+        bool "Use custom SPI Flash WP Pin when flash pins set in eFuse (read help)"
+        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+        default y if BOOTLOADER_SPI_WP_PIN != 7  # backwards compatibility, can remove in IDF 5
+        default n
+        help
+            This setting is only used if the SPI flash pins have been overridden by setting the eFuses
+            SPI_PAD_CONFIG_xxx, and the SPI flash mode is QIO or QOUT.
+
+            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka
+            ESP32 pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. The same pin is also used
+            for external SPIRAM if it is enabled.
+
+            If this config item is set to N (default), the correct WP pin will be automatically used for any
+            Espressif chip or module with integrated flash. If a custom setting is needed, set this config item to
+            Y and specify the GPIO number connected to the WP.
+
     config BOOTLOADER_SPI_WP_PIN
-        int "SPI Flash WP Pin when customising pins via eFuse (read help)"
+        int "Custom SPI Flash WP Pin"
         range 0 33
         default 7
-        depends on ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT
+        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+        #depends on BOOTLOADER_SPI_CUSTOM_WP_PIN  # backwards compatibility, can uncomment in IDF 5
         help
-            This value is ignored unless flash mode is set to QIO or QOUT *and* the SPI flash pins have been
-            overriden by setting the eFuses SPI_PAD_CONFIG_xxx.
+            The option "Use custom SPI Flash WP Pin" must be set or this value is ignored
 
-            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka ESP32
-            pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. That pin number is compiled into the
-            bootloader instead.
-
-            The default value (GPIO 7) is correct for WP pin on ESP32-D2WD integrated flash.
+            If burning a customized set of SPI flash pins in eFuse and using QIO or QOUT mode for flash, set this
+            value to the GPIO number of the SPI flash WP pin.
 
     choice BOOTLOADER_VDDSDIO_BOOST
         bool "VDDSDIO LDO voltage"
@@ -206,11 +245,11 @@ menu "Bootloader config"
         depends on BOOTLOADER_APP_ANTI_ROLLBACK
         range 1 32 if IDF_TARGET_ESP32
         default 32 if IDF_TARGET_ESP32
-        range 1 16 if IDF_TARGET_ESP32S2BETA
-        default 16 if IDF_TARGET_ESP32S2BETA
+        range 1 16 if IDF_TARGET_ESP32S2
+        default 16 if IDF_TARGET_ESP32S2
         help
             The size of the efuse secure version field.
-            Its length is limited to 32 bits for ESP32 and 16 bits for ESP32S2BETA.
+            Its length is limited to 32 bits for ESP32 and 16 bits for ESP32-S2.
             This determines how many times the security version can be increased.
 
     config BOOTLOADER_EFUSE_SECURE_VERSION_EMULATE
@@ -224,7 +263,7 @@ menu "Bootloader config"
 
     config BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP
         bool "Skip image validation when exiting deep sleep"
-        depends on (SECURE_BOOT_ENABLED && SECURE_BOOT_INSECURE) || !SECURE_BOOT_ENABLED
+        depends on (SECURE_BOOT && SECURE_BOOT_INSECURE) || !SECURE_BOOT
         default n
         help
             This option disables the normal validation of an image coming out of
@@ -279,12 +318,12 @@ menu "Security features"
     config SECURE_SIGNED_ON_BOOT
         bool
         default y
-        depends on SECURE_BOOT_ENABLED || SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
+        depends on SECURE_BOOT || SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
 
     config SECURE_SIGNED_ON_UPDATE
         bool
         default y
-        depends on SECURE_BOOT_ENABLED || SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
+        depends on SECURE_BOOT || SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
 
     config SECURE_SIGNED_APPS
         bool
@@ -298,8 +337,7 @@ menu "Security features"
 
     config SECURE_SIGNED_APPS_NO_SECURE_BOOT
         bool "Require signed app images"
-        default n
-        depends on !SECURE_BOOT_ENABLED
+        depends on !SECURE_BOOT
         help
             Require apps to be signed to verify their integrity.
 
@@ -308,6 +346,35 @@ menu "Security features"
             against remote network access, but not physical access. Compared to using hardware Secure Boot this option
             is much simpler to implement.
 
+    choice SECURE_SIGNED_APPS_SCHEME
+        bool "App Signing Scheme"
+        depends on SECURE_BOOT || SECURE_SIGNED_APPS_NO_SECURE_BOOT
+        default SECURE_SIGNED_APPS_ECDSA_SCHEME if SECURE_BOOT_V1_ENABLED
+        default SECURE_SIGNED_APPS_RSA_SCHEME if SECURE_BOOT_V2_ENABLED
+        help
+            Select the Secure App signing scheme. Depends on the Chip Revision.
+            There are two options:
+            1. ECDSA based secure boot scheme. (Only choice for Secure Boot V1)
+            Supported in ESP32 and ESP32-ECO3.
+            2. The RSA based secure boot scheme. (Only choice for Secure Boot V2)
+            Supported in ESP32-ECO3. (ESP32 Chip Revision 3 onwards)
+
+        config SECURE_SIGNED_APPS_ECDSA_SCHEME
+            bool "ECDSA"
+            depends on IDF_TARGET_ESP32 && (SECURE_SIGNED_APPS_NO_SECURE_BOOT || SECURE_BOOT_V1_ENABLED)
+            help
+                Embeds the ECDSA public key in the bootloader and signs the application with an ECDSA key.
+
+                Refer to the documentation before enabling.
+
+        config SECURE_SIGNED_APPS_RSA_SCHEME
+            bool "RSA"
+            depends on (ESP32_REV_MIN_3 || IDF_TARGET_ESP32S2) && SECURE_BOOT_V2_ENABLED
+            help
+                Appends the RSA-3072 based Signature block to the application.
+                Refer to <Secure Boot Version 2 documentation link> before enabling.
+    endchoice
+
     config SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
         bool "Bootloader verifies app signatures"
         default n
@@ -334,23 +401,50 @@ menu "Security features"
             If hardware secure boot is not enabled, this option still adds significant security against network-based
             attackers by preventing spoofing of OTA updates.
 
-    config SECURE_BOOT_ENABLED
-        bool "Enable hardware secure boot in bootloader (READ DOCS FIRST)"
+    config SECURE_BOOT
+        bool "Enable hardware Secure Boot in bootloader (READ DOCS FIRST)"
         default n
         help
-            Build a bootloader which enables secure boot on first boot.
+            Build a bootloader which enables Secure Boot on first boot.
 
-            Once enabled, secure boot will not boot a modified bootloader. The bootloader will only load a partition
+            Once enabled, Secure Boot will not boot a modified bootloader. The bootloader will only load a partition
             table or boot an app if the data has a verified digital signature. There are implications for reflashing
             updated apps once secure boot is enabled.
 
             When enabling secure boot, JTAG and ROM BASIC Interpreter are permanently disabled by default.
 
-            Refer to https://docs.espressif.com/projects/esp-idf/en/latest/security/secure-boot.html before enabling.
+    choice SECURE_BOOT_VERSION
+        bool "Select secure boot version"
+        default SECURE_BOOT_V2_ENABLED if ESP32_REV_MIN_3
+        depends on SECURE_BOOT
+        help
+            Select the Secure Boot Version. Depends on the Chip Revision.
+            Secure Boot V2 is the new RSA based secure boot scheme.
+            Supported in ESP32-ECO3. (ESP32 Chip Revision 3 onwards)
+            Secure Boot V1 is the AES based secure boot scheme.
+            Supported in ESP32 and ESP32-ECO3.
+
+        config SECURE_BOOT_V1_ENABLED
+            bool "Enable Secure Boot version 1"
+            depends on IDF_TARGET_ESP32
+            help
+                Build a bootloader which enables secure boot version 1 on first boot.
+                Refer to the Secure Boot section of the ESP-IDF Programmer's Guide for this version before enabling.
+
+        config SECURE_BOOT_V2_ENABLED
+            bool "Enable Secure Boot version 2"
+            depends on ESP32_REV_MIN_3 || IDF_TARGET_ESP32S2
+            select SECURE_ENABLE_SECURE_ROM_DL_MODE if IDF_TARGET_ESP32S2 && !SECURE_INSECURE_ALLOW_DL_MODE
+            select SECURE_DISABLE_ROM_DL_MODE if ESP32_REV_MIN_3 && !SECURE_INSECURE_ALLOW_DL_MODE
+            help
+                Build a bootloader which enables Secure Boot version 2 on first boot.
+                Refer to Secure Boot V2 section of the ESP-IDF Programmer's Guide for this version before enabling.
+
+    endchoice
 
     choice SECURE_BOOTLOADER_MODE
         bool "Secure bootloader mode"
-        depends on SECURE_BOOT_ENABLED
+        depends on SECURE_BOOT_V1_ENABLED
         default SECURE_BOOTLOADER_ONE_TIME_FLASH
 
         config SECURE_BOOTLOADER_ONE_TIME_FLASH
@@ -385,7 +479,8 @@ menu "Security features"
             If enabled (default), these binary files are signed as part of the build process. The file named in
             "Secure boot private signing key" will be used to sign the image.
 
-            If disabled, unsigned app/partition data will be built. They must be signed manually using espsecure.py
+            If disabled, unsigned app/partition data will be built. They must be signed manually using espsecure.py.
+            Version 1 to enable ECDSA Based Secure Boot and Version 2 to enable RSA based Secure Boot.
             (for example, on a remote signing server.)
 
     config SECURE_BOOT_SIGNING_KEY
@@ -395,28 +490,32 @@ menu "Security features"
         help
             Path to the key file used to sign app images.
 
-            Key file is an ECDSA private key (NIST256p curve) in PEM format.
+            Key file is an ECDSA private key (NIST256p curve) in PEM format for Secure Boot V1.
+            Key file is an RSA private key in PEM format for Secure Boot V2.
 
             Path is evaluated relative to the project directory.
 
             You can generate a new signing key by running the following command:
             espsecure.py generate_signing_key secure_boot_signing_key.pem
 
-            See https://docs.espressif.com/projects/esp-idf/en/latest/security/secure-boot.html for details.
+            See the Secure Boot section of the ESP-IDF Programmer's Guide for this version for details.
 
     config SECURE_BOOT_VERIFICATION_KEY
         string "Secure boot public signature verification key"
-        depends on SECURE_SIGNED_APPS && !SECURE_BOOT_BUILD_SIGNED_BINARIES
+        depends on SECURE_SIGNED_APPS && !SECURE_BOOT_BUILD_SIGNED_BINARIES && !SECURE_SIGNED_APPS_RSA_SCHEME
         default "signature_verification_key.bin"
         help
-            Path to a public key file used to verify signed images. This key is compiled into the bootloader and/or
+            Path to a public key file used to verify signed images.
+            Secure Boot V1: This ECDSA public key is compiled into the bootloader and/or
             app, to verify app images.
+            Secure Boot V2: This RSA public key is compiled into the signature block at
+            the end of the bootloader/app.
 
             Key file is in raw binary format, and can be extracted from a
             PEM formatted private key using the espsecure.py
             extract_public_key command.
 
-            Refer to https://docs.espressif.com/projects/esp-idf/en/latest/security/secure-boot.html before enabling.
+            Refer to the Secure Boot section of the ESP-IDF Programmer's Guide for this version before enabling.
 
     choice SECURE_BOOTLOADER_KEY_ENCODING
         bool "Hardware Key Encoding"
@@ -443,7 +542,7 @@ menu "Security features"
 
     config SECURE_BOOT_INSECURE
         bool "Allow potentially insecure options"
-        depends on SECURE_BOOT_ENABLED
+        depends on SECURE_BOOT
         default N
         help
             You can disable some of the default protections offered by secure boot, in order to enable testing or a
@@ -451,7 +550,7 @@ menu "Security features"
 
             Only enable these options if you are very sure.
 
-            Refer to https://docs.espressif.com/projects/esp-idf/en/latest/security/secure-boot.html before enabling.
+            Refer to the Secure Boot section of the ESP-IDF Programmer's Guide for this version before enabling.
 
     config SECURE_FLASH_ENC_ENABLED
         bool "Enable flash encryption on boot (READ DOCS FIRST)"
@@ -468,7 +567,7 @@ menu "Security features"
     choice SECURE_FLASH_ENCRYPTION_KEYSIZE
         bool "Size of generated AES-XTS key"
         default SECURE_FLASH_ENCRYPTION_AES128
-        depends on IDF_TARGET_ESP32S2BETA && SECURE_FLASH_ENC_ENABLED
+        depends on IDF_TARGET_ESP32S2 && SECURE_FLASH_ENC_ENABLED
         help
             Size of generated AES-XTS key.
 
@@ -495,7 +594,7 @@ menu "Security features"
             Select Release mode only for production or manufacturing. Once enabled you can not reflash using UART
             bootloader
 
-            Refer to https://docs.espressif.com/projects/esp-idf/en/latest/security/secure-boot.html and
+            Refer to the Secure Boot section of the ESP-IDF Programmer's Guide for this version and
             https://docs.espressif.com/projects/esp-idf/en/latest/security/flash-encryption.html for details.
 
         config SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
@@ -504,6 +603,7 @@ menu "Security features"
 
         config SECURE_FLASH_ENCRYPTION_MODE_RELEASE
             bool "Release"
+            select SECURE_ENABLE_SECURE_ROM_DL_MODE
 
     endchoice
 
@@ -518,7 +618,7 @@ menu "Security features"
 
         config SECURE_BOOT_ALLOW_ROM_BASIC
             bool "Leave ROM BASIC Interpreter available on reset"
-            depends on SECURE_BOOT_INSECURE || SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+            depends on (SECURE_BOOT_INSECURE || SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT) && IDF_TARGET_ESP32
             default N
             help
                 By default, the BASIC ROM Console starts on reset if no valid bootloader is
@@ -557,6 +657,31 @@ menu "Security features"
                 image to this length. It is generally not recommended to set this option, unless you have a legacy
                 partitioning scheme which doesn't support 64KB aligned partition lengths.
 
+        config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
+            bool "Allow additional read protecting of efuses"
+            depends on SECURE_BOOT_INSECURE && SECURE_BOOT_V2_ENABLED
+            help
+                If not set (default, recommended), on first boot the bootloader will burn the WR_DIS_RD_DIS
+                efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
+
+                If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
+                Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse holding the public
+                key digest, causing an immediate denial of service and possibly allowing an additional fault
+                injection attack to bypass the signature protection.
+
+        config SECURE_INSECURE_ALLOW_DL_MODE
+            bool "Don't automatically restrict UART download mode"
+            depends on SECURE_BOOT_INSECURE && SECURE_BOOT_V2_ENABLED
+            default N
+            help
+                By default, enabling either flash encryption in release mode or secure boot will automatically
+                disable UART download mode on ESP32 ECO3, or enable secure download mode on newer chips.
+                This is recommended to reduce the attack surface of the chip.
+
+                To allow the full UART download mode to stay enabled, enable this option and ensure
+                the options SECURE_DISABLE_ROM_DL_MODE and SECURE_ENABLE_SECURE_ROM_DL_MODE are disabled as applicable.
+                This is not recommended.
+
         config SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
             bool "Leave UART bootloader encryption enabled"
             depends on SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
@@ -569,7 +694,7 @@ menu "Security features"
 
         config SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC
             bool "Leave UART bootloader decryption enabled"
-            depends on SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+            depends on SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT && IDF_TARGET_ESP32
             default N
             help
                 If not set (default), the bootloader will permanently disable UART bootloader decryption access on
@@ -603,5 +728,48 @@ menu "Security features"
                 the wrong device. The device needs to have flash encryption already enabled using espefuse.py.
 
     endmenu  # Potentially Insecure
+
+    config SECURE_DISABLE_ROM_DL_MODE
+        bool "Permanently disable ROM Download Mode"
+        depends on !IDF_TARGET_ESP32 || ESP32_REV_MIN_3
+        default n
+        help
+            If set, during startup the app will burn an eFuse bit to permanently disable the UART ROM
+            Download Mode. This prevents any future use of esptool.py, espefuse.py and similar tools.
+
+            Once disabled, if the SoC is booted with strapping pins set for ROM Download Mode
+            then an error is printed instead.
+
+            It is recommended to enable this option in any production application where Flash
+            Encryption and/or Secure Boot is enabled and access to Download Mode is not required.
+
+            It is also possible to permanently disable Download Mode by calling
+            esp_efuse_disable_rom_download_mode() at runtime.
+
+    config SECURE_ENABLE_SECURE_ROM_DL_MODE
+        bool "Permanently switch to ROM UART Secure Download mode"
+        depends on IDF_TARGET_ESP32S2 && !SECURE_DISABLE_ROM_DL_MODE
+        help
+            If set, during startup the app will burn an eFuse bit to permanently switch the UART ROM
+            Download Mode into a separate Secure Download mode. This option can only work if
+            Download Mode is not already disabled by eFuse.
+
+            Secure Download mode limits the use of Download Mode functions to simple flash read,
+            write and erase operations, plus a command to return a summary of currently enabled
+            security features.
+
+            Secure Download mode is not compatible with the esptool.py flasher stub feature,
+            espefuse.py, read/writing memory or registers, encrypted download, or any other
+            features that interact with unsupported Download Mode commands.
+
+            Secure Download mode should be enabled in any application where Flash Encryption
+            and/or Secure Boot is enabled. Disabling this option does not immediately cancel
+            the benefits of the security features, but it increases the potential "attack
+            surface" for an attacker to try and bypass them with a successful physical attack.
+
+            It is also possible to enable secure download mode at runtime by calling
+            esp_efuse_enable_rom_secure_download_mode()
+
+
 endmenu  # Security features
 

components/bootloader/Makefile.projbuild

@@ -45,7 +45,7 @@ clean: bootloader-clean
 bootloader-list-components:
 	$(BOOTLOADER_MAKE) list-components
 
-ifndef CONFIG_SECURE_BOOT_ENABLED
+ifndef CONFIG_SECURE_BOOT
 # If secure boot disabled, bootloader flashing is integrated
 # with 'make flash' and no warnings are printed.
 
@@ -102,7 +102,7 @@ endif
 bootloader: $(BOOTLOADER_DIGEST_BIN)
 	@echo $(SEPARATOR)
 	@echo "Bootloader built and secure digest generated. First time flash command is:"
-	@echo "$(ESPEFUSEPY) burn_key secure_boot $(SECURE_BOOTLOADER_KEY)"
+	@echo "$(ESPEFUSEPY) burn_key secure_boot_v1 $(SECURE_BOOTLOADER_KEY)"
 	@echo "$(ESPTOOLPY_WRITE_FLASH) $(BOOTLOADER_OFFSET) $(BOOTLOADER_BIN)"
 	@echo $(SEPARATOR)
 	@echo "To reflash the bootloader after initial flash:"
@@ -115,13 +115,35 @@ $(BOOTLOADER_DIGEST_BIN): $(BOOTLOADER_BIN) $(SECURE_BOOTLOADER_KEY) | check_pyt
 	@echo "DIGEST $(notdir $@)"
 	$(ESPSECUREPY) digest_secure_bootloader -k $(SECURE_BOOTLOADER_KEY) -o $@ $<
 
-else # CONFIG_SECURE_BOOT_ENABLED && !CONFIG_SECURE_BOOTLOADER_REFLASHABLE && !CONFIG_SECURE_BOOTLOADER_ONE_TIME_FLASH
+else ifdef CONFIG_SECURE_BOOT_V2_ENABLED
+BOOTLOADER_SIGNED_BIN := $(BOOTLOADER_BUILD_DIR)/bootloader-signed.bin
+ifdef CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES
+bootloader: $(BOOTLOADER_BIN) $(SDKCONFIG_MAKEFILE) | check_python_dependencies
+	$(ESPSECUREPY) sign_data --keyfile $(SECURE_BOOT_SIGNING_KEY) --version 2 \
+	-o $(BOOTLOADER_SIGNED_BIN) $(BOOTLOADER_BIN)
+else
+bootloader: $(BOOTLOADER_BIN) $(SDKCONFIG_MAKEFILE) | check_python_dependencies
+	@echo "Bootloader not signed. Sign the bootloader before flashing."
+	@echo "To sign the bootloader, you can use this command:"
+	@echo "espsecure.py sign_data --keyfile SECURE_BOOT_SIGNING_KEY --version 2 $(BOOTLOADER_BIN)"
+endif
+	@echo $(SEPARATOR)
+	@echo "Use the following command to flash the bootloader:"
+ifdef CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES
+	@echo "$(ESPTOOLPY_WRITE_FLASH) $(BOOTLOADER_OFFSET) $(BOOTLOADER_SIGNED_BIN)"
+else
+	@echo "$(ESPTOOLPY_WRITE_FLASH) $(BOOTLOADER_OFFSET) $(BOOTLOADER_BIN)"
+endif
+	@echo $(SEPARATOR)
+
+else # CONFIG_SECURE_BOOT && !CONFIG_SECURE_BOOTLOADER_REFLASHABLE \
+&& !CONFIG_SECURE_BOOTLOADER_ONE_TIME_FLASH && !CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
 bootloader:
 	@echo "Invalid bootloader target: bad sdkconfig?"
 	@exit 1
 endif
 
-ifndef CONFIG_SECURE_BOOT_ENABLED
+ifndef CONFIG_SECURE_BOOT
 # don't build bootloader by default if secure boot is enabled
 all_binaries: $(BOOTLOADER_BIN)
 endif
@@ -131,3 +153,8 @@ bootloader-clean: $(SDKCONFIG_MAKEFILE)
 ifdef CONFIG_SECURE_BOOTLOADER_REFLASHABLE
 	rm -f $(SECURE_BOOTLOADER_KEY) $(BOOTLOADER_DIGEST_BIN)
 endif
+ifdef CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+ifdef CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES
+	rm -f $(BOOTLOADER_SIGNED_BIN)
+endif
+endif

components/bootloader/flash_bootloader_args.in

@@ -1,4 +0,0 @@
---flash_mode ${ESPFLASHMODE}
---flash_size ${ESPFLASHSIZE}
---flash_freq ${ESPFLASHFREQ}
-${OFFSET} ${IMAGE}

components/bootloader/project_include.cmake

@@ -19,8 +19,8 @@ set(bootloader_binary_files
 
 idf_build_get_property(project_dir PROJECT_DIR)
 
-# There are some additional processing when CONFIG_CONFIG_SECURE_SIGNED_APPS. This happens
-# when either CONFIG_SECURE_BOOT_ENABLED or SECURE_BOOT_BUILD_SIGNED_BINARIES.
+# There are some additional processing when CONFIG_SECURE_SIGNED_APPS. This happens
+# when either CONFIG_SECURE_BOOT_V1_ENABLED or CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES.
 # For both cases, the user either sets binaries to be signed during build or not
 # using CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES.
 #
@@ -29,7 +29,13 @@ idf_build_get_property(project_dir PROJECT_DIR)
 if(CONFIG_SECURE_SIGNED_APPS)
     add_custom_target(gen_secure_boot_keys)
 
-    if(CONFIG_SECURE_BOOT_ENABLED)
+    if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
+        set(secure_apps_signing_scheme "1")
+    elseif(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
+        set(secure_apps_signing_scheme "2")
+    endif()
+
+    if(CONFIG_SECURE_BOOT_V1_ENABLED)
         # Check that the configuration is sane
         if((CONFIG_SECURE_BOOTLOADER_REFLASHABLE AND CONFIG_SECURE_BOOTLOADER_ONE_TIME_FLASH) OR
             (NOT CONFIG_SECURE_BOOTLOADER_REFLASHABLE AND NOT CONFIG_SECURE_BOOTLOADER_ONE_TIME_FLASH))
@@ -60,7 +66,8 @@ if(CONFIG_SECURE_SIGNED_APPS)
             # (to pick up a new signing key if one exists, etc.)
             fail_at_build_time(gen_secure_boot_signing_key
                 "Secure Boot Signing Key ${CONFIG_SECURE_BOOT_SIGNING_KEY} does not exist. Generate using:"
-                "\tespsecure.py generate_signing_key ${CONFIG_SECURE_BOOT_SIGNING_KEY}")
+                "\tespsecure.py generate_signing_key --version ${secure_apps_signing_scheme} \
+                ${CONFIG_SECURE_BOOT_SIGNING_KEY}")
         else()
             add_custom_target(gen_secure_boot_signing_key)
         endif()
@@ -70,7 +77,7 @@ if(CONFIG_SECURE_SIGNED_APPS)
         set(ver_key_arg)
 
         add_dependencies(gen_secure_boot_keys gen_secure_boot_signing_key)
-    else()
+    elseif(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
 
         get_filename_component(secure_boot_verification_key
             ${CONFIG_SECURE_BOOT_VERIFICATION_KEY}
@@ -83,7 +90,7 @@ if(CONFIG_SECURE_SIGNED_APPS)
             fail_at_build_time(gen_secure_boot_verification_key
                 "Secure Boot Verification Public Key ${CONFIG_SECURE_BOOT_VERIFICATION_KEY} does not exist."
                 "\tThis can be extracted from the private signing key."
-                "\tSee docs/security/secure-boot.rst for details.")
+                "\tSee docs/security/secure-boot-v1.rst for details.")
         else()
             add_custom_target(gen_secure_boot_verification_key)
         endif()

components/bootloader/sdkconfig.rename

@@ -20,3 +20,6 @@ CONFIG_FLASH_ENCRYPTION_INSECURE                            CONFIG_SECURE_FLASH_
 CONFIG_FLASH_ENCRYPTION_UART_BOOTLOADER_ALLOW_ENCRYPT       CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
 CONFIG_FLASH_ENCRYPTION_UART_BOOTLOADER_ALLOW_DECRYPT       CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC
 CONFIG_FLASH_ENCRYPTION_UART_BOOTLOADER_ALLOW_CACHE         CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
+
+# Secure Boot Scheme
+CONFIG_SECURE_BOOT_ENABLED                                  CONFIG_SECURE_BOOT_V1_ENABLED

components/bootloader/subproject/CMakeLists.txt

@@ -29,9 +29,16 @@ project(bootloader)
 idf_build_set_property(COMPILE_DEFINITIONS "-DBOOTLOADER_BUILD=1" APPEND)
 idf_build_set_property(COMPILE_OPTIONS "-fno-stack-protector" APPEND)
 
+idf_component_get_property(main_args esptool_py FLASH_ARGS)
+idf_component_get_property(sub_args esptool_py FLASH_SUB_ARGS)
+
+# String for printing flash command
+string(REPLACE ";" " " esptoolpy_write_flash
+    "${ESPTOOLPY} --port=(PORT) --baud=(BAUD) ${main_args} "
+    "write_flash ${sub_args}")
+
 string(REPLACE ";" " " espsecurepy "${ESPSECUREPY}")
 string(REPLACE ";" " " espefusepy "${ESPEFUSEPY}")
-set(esptoolpy_write_flash "${ESPTOOLPY_WRITE_FLASH_STR}")
 
 if(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
     if(CONFIG_SECURE_BOOTLOADER_KEY_ENCODING_192BIT)
@@ -83,6 +90,39 @@ if(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
     add_custom_target (gen_bootloader_digest_bin ALL DEPENDS "${bootloader_digest_bin}")
 endif()
 
+if(CONFIG_SECURE_BOOT_V2_ENABLED)
+    if(CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES)
+        get_filename_component(secure_boot_signing_key
+            "${SECURE_BOOT_SIGNING_KEY}" ABSOLUTE BASE_DIR "${project_dir}")
+
+        if(NOT EXISTS "${secure_boot_signing_key}")
+        message(FATAL_ERROR
+            "Secure Boot Signing Key Not found."
+            "\nGenerate the Secure Boot V2 RSA-PSS 3072 Key."
+            "\nTo generate one, you can use this command:"
+            "\n\t${espsecurepy} generate_signing_key --version 2 ${SECURE_BOOT_SIGNING_KEY}")
+        endif()
+
+        set(bootloader_unsigned_bin "bootloader-unsigned.bin")
+        add_custom_command(OUTPUT ".signed_bin_timestamp"
+            COMMAND ${CMAKE_COMMAND} -E copy "${CMAKE_BINARY_DIR}/${PROJECT_BIN}" "${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
+            COMMAND ${ESPSECUREPY} sign_data --version 2 --keyfile "${secure_boot_signing_key}"
+            -o "${CMAKE_BINARY_DIR}/${PROJECT_BIN}" "${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
+            COMMAND ${CMAKE_COMMAND} -E echo "Generated signed binary image ${build_dir}/${PROJECT_BIN}"
+            "from ${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
+            COMMAND ${CMAKE_COMMAND} -E md5sum "${CMAKE_BINARY_DIR}/${PROJECT_BIN}" > "${CMAKE_BINARY_DIR}/.signed_bin_timestamp"
+            DEPENDS "${build_dir}/.bin_timestamp"
+            VERBATIM
+            COMMENT "Generated the signed Bootloader")
+    else()
+        add_custom_command(OUTPUT ".signed_bin_timestamp"
+        VERBATIM
+        COMMENT "Bootloader generated but not signed")
+    endif()
+
+    add_custom_target (gen_signed_bootloader ALL DEPENDS "${build_dir}/.signed_bin_timestamp")
+endif()
+
 if(CONFIG_SECURE_BOOTLOADER_ONE_TIME_FLASH)
     add_custom_command(TARGET bootloader.elf POST_BUILD
         COMMAND ${CMAKE_COMMAND} -E echo
@@ -107,7 +147,7 @@ elseif(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
         COMMAND ${CMAKE_COMMAND} -E echo
             "Burn secure boot key to efuse using:"
         COMMAND ${CMAKE_COMMAND} -E echo
-            "\t${espefusepy} burn_key secure_boot ${secure_bootloader_key}"
+            "\t${espefusepy} burn_key secure_boot_v1 ${secure_bootloader_key}"
         COMMAND ${CMAKE_COMMAND} -E echo
             "First time flash command is:"
         COMMAND ${CMAKE_COMMAND} -E echo
@@ -126,4 +166,36 @@ elseif(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
             "* Not recommended to re-use the same secure boot keyfile on multiple production devices."
         DEPENDS gen_secure_bootloader_key gen_bootloader_digest_bin
         VERBATIM)
+elseif(CONFIG_SECURE_BOOT_V2_ENABLED AND CONFIG_IDF_TARGET_ESP32S2)
+    add_custom_command(TARGET bootloader.elf POST_BUILD
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "=============================================================================="
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "Bootloader built. Secure boot enabled, so bootloader not flashed automatically."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "To sign the bootloader with additional private keys."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "\t${espsecurepy} sign_data -k secure_boot_signing_key2.pem -v 2 --append_signatures -o signed_bootloader.bin build/bootloader/bootloader.bin"
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "Secure boot enabled, so bootloader not flashed automatically."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "\t${esptoolpy_write_flash} ${BOOTLOADER_OFFSET} ${CMAKE_BINARY_DIR}/bootloader.bin"
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "=============================================================================="
+    DEPENDS gen_signed_bootloader
+    VERBATIM)
+elseif(CONFIG_SECURE_BOOT_V2_ENABLED)
+    add_custom_command(TARGET bootloader.elf POST_BUILD
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "=============================================================================="
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "Bootloader built. Secure boot enabled, so bootloader not flashed automatically."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "Secure boot enabled, so bootloader not flashed automatically."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "\t${esptoolpy_write_flash} ${BOOTLOADER_OFFSET} ${CMAKE_BINARY_DIR}/bootloader.bin"
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "=============================================================================="
+    DEPENDS gen_signed_bootloader
+    VERBATIM)
 endif()

components/bootloader/subproject/components/micro-ecc/CMakeLists.txt

@@ -1,3 +1,3 @@
-# only compile the "micro-ecc/uECC.c" source file
-idf_component_register(SRCS "micro-ecc/uECC.c"
-                    INCLUDE_DIRS micro-ecc)
+# only compile the "uECC_verify_antifault.c" file which includes the "micro-ecc/uECC.c" source file
+idf_component_register(SRCS "uECC_verify_antifault.c"
+                    INCLUDE_DIRS . micro-ecc)

components/bootloader/subproject/components/micro-ecc/component.mk

@@ -1,8 +1,6 @@
-# only compile the micro-ecc/uECC.c source file
-# (SRCDIRS is needed so build system can find the source file)
-COMPONENT_SRCDIRS := micro-ecc
-COMPONENT_OBJS := micro-ecc/uECC.o
+# only compile the "uECC_verify_antifault.c" file which includes the "micro-ecc/uECC.c" source file
+COMPONENT_SRCDIRS := .
 
-COMPONENT_ADD_INCLUDEDIRS := micro-ecc
+COMPONENT_ADD_INCLUDEDIRS := . micro-ecc
 
 COMPONENT_SUBMODULES := micro-ecc

components/bootloader/subproject/components/micro-ecc/uECC_verify_antifault.c

@@ -0,0 +1,141 @@
+/* Copyright 2014, Kenneth MacKay. Licensed under the BSD 2-clause license.
+
+   Modifications Copyright 2020, Espressif Systems (Shanghai) PTE LTD. Licensed under the BSD
+   2-clause license.
+*/
+
+/* uECC_verify() calls a number of static functions form here and
+   uses other definitions, so we just build that whole source file here and then append
+   our modified version uECC_verify_antifault(). */
+#include "micro-ecc/uECC.c"
+
+/* Version of uECC_verify() which also copies message_hash into verified_hash,
+   but only if the signature is valid. Does this in an FI resistant way.
+*/
+int uECC_verify_antifault(const uint8_t *public_key,
+                const uint8_t *message_hash,
+                unsigned hash_size,
+                const uint8_t *signature,
+                uECC_Curve curve,
+                uint8_t *verified_hash) {
+    uECC_word_t u1[uECC_MAX_WORDS], u2[uECC_MAX_WORDS];
+    uECC_word_t z[uECC_MAX_WORDS];
+    uECC_word_t sum[uECC_MAX_WORDS * 2];
+    uECC_word_t rx[uECC_MAX_WORDS];
+    uECC_word_t ry[uECC_MAX_WORDS];
+    uECC_word_t tx[uECC_MAX_WORDS];
+    uECC_word_t ty[uECC_MAX_WORDS];
+    uECC_word_t tz[uECC_MAX_WORDS];
+    const uECC_word_t *points[4];
+    const uECC_word_t *point;
+    bitcount_t num_bits;
+    bitcount_t i;
+#if uECC_VLI_NATIVE_LITTLE_ENDIAN
+    uECC_word_t *_public = (uECC_word_t *)public_key;
+#else
+    uECC_word_t _public[uECC_MAX_WORDS * 2];
+#endif    
+    uECC_word_t r[uECC_MAX_WORDS], s[uECC_MAX_WORDS];
+    wordcount_t num_words = curve->num_words;
+    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+
+    rx[num_n_words - 1] = 0;
+    r[num_n_words - 1] = 0;
+    s[num_n_words - 1] = 0;
+
+#if uECC_VLI_NATIVE_LITTLE_ENDIAN
+    bcopy((uint8_t *) r, signature, curve->num_bytes);
+    bcopy((uint8_t *) s, signature + curve->num_bytes, curve->num_bytes);
+#else
+    uECC_vli_bytesToNative(_public, public_key, curve->num_bytes);
+    uECC_vli_bytesToNative(
+        _public + num_words, public_key + curve->num_bytes, curve->num_bytes);
+    uECC_vli_bytesToNative(r, signature, curve->num_bytes);
+    uECC_vli_bytesToNative(s, signature + curve->num_bytes, curve->num_bytes);
+#endif
+
+    /* r, s must not be 0. */
+    if (uECC_vli_isZero(r, num_words) || uECC_vli_isZero(s, num_words)) {
+        return 0;
+    }
+
+    /* r, s must be < n. */
+    if (uECC_vli_cmp(curve->n, r, num_n_words) != 1 ||
+            uECC_vli_cmp(curve->n, s, num_n_words) != 1) {
+        return 0;
+    }
+
+    /* Calculate u1 and u2. */
+    uECC_vli_modInv(z, s, curve->n, num_n_words); /* z = 1/s */
+    u1[num_n_words - 1] = 0;
+    bits2int(u1, message_hash, hash_size, curve);
+    uECC_vli_modMult(u1, u1, z, curve->n, num_n_words); /* u1 = e/s */
+    uECC_vli_modMult(u2, r, z, curve->n, num_n_words); /* u2 = r/s */
+
+    /* Calculate sum = G + Q. */
+    uECC_vli_set(sum, _public, num_words);
+    uECC_vli_set(sum + num_words, _public + num_words, num_words);
+    uECC_vli_set(tx, curve->G, num_words);
+    uECC_vli_set(ty, curve->G + num_words, num_words);
+    uECC_vli_modSub(z, sum, tx, curve->p, num_words); /* z = x2 - x1 */
+    XYcZ_add(tx, ty, sum, sum + num_words, curve);
+    uECC_vli_modInv(z, z, curve->p, num_words); /* z = 1/z */
+    apply_z(sum, sum + num_words, z, curve);
+
+    /* Use Shamir's trick to calculate u1*G + u2*Q */
+    points[0] = 0;
+    points[1] = curve->G;
+    points[2] = _public;
+    points[3] = sum;
+    num_bits = smax(uECC_vli_numBits(u1, num_n_words),
+                    uECC_vli_numBits(u2, num_n_words));
+
+    point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
+                   ((!!uECC_vli_testBit(u2, num_bits - 1)) << 1)];
+    uECC_vli_set(rx, point, num_words);
+    uECC_vli_set(ry, point + num_words, num_words);
+    uECC_vli_clear(z, num_words);
+    z[0] = 1;
+
+    for (i = num_bits - 2; i >= 0; --i) {
+        uECC_word_t index;
+        curve->double_jacobian(rx, ry, z, curve);
+
+        index = (!!uECC_vli_testBit(u1, i)) | ((!!uECC_vli_testBit(u2, i)) << 1);
+        point = points[index];
+        if (point) {
+            uECC_vli_set(tx, point, num_words);
+            uECC_vli_set(ty, point + num_words, num_words);
+            apply_z(tx, ty, z, curve);
+            uECC_vli_modSub(tz, rx, tx, curve->p, num_words); /* Z = x2 - x1 */
+            XYcZ_add(tx, ty, rx, ry, curve);
+            uECC_vli_modMult_fast(z, z, tz, curve);
+        }
+    }
+
+    uECC_vli_modInv(z, z, curve->p, num_words); /* Z = 1/Z */
+    apply_z(rx, ry, z, curve);
+
+    /* v = x1 (mod n) */
+    if (uECC_vli_cmp(curve->n, rx, num_n_words) != 1) {
+        uECC_vli_sub(rx, rx, curve->n, num_n_words);
+    }
+
+    /* Anti-FI addition. Copy message_hash into verified_hash, but do it in a
+       way that it will only happen if v == r (ie, rx == r)
+    */
+    const uECC_word_t *mhash_words = (const uECC_word_t *)message_hash;
+    uECC_word_t *vhash_words = (uECC_word_t *)verified_hash;
+    unsigned hash_words = hash_size / sizeof(uECC_word_t);
+    for (int w = 0; w < hash_words; w++) {
+        /* note: using curve->num_words here to encourage compiler to re-read this variable */
+        vhash_words[w] = mhash_words[w] ^ rx[w % curve->num_words] ^ r[w % curve->num_words];
+    }
+    /* Curve may be longer than hash, in which case keep reading the rest of the bytes */
+    for (int w = hash_words; w < curve->num_words; w++) {
+        vhash_words[w % hash_words] |= rx[w] ^ r[w];
+    }
+
+    /* Accept only if v == r. */
+    return (int)(uECC_vli_equal(rx, r, num_words));
+}

components/bootloader/subproject/components/micro-ecc/uECC_verify_antifault.h

@@ -0,0 +1,18 @@
+/* Copyright 2014, Kenneth MacKay. Licensed under the BSD 2-clause license.
+
+   Modifications Copyright 2020, Espressif Systems (Shanghai) PTE LTD. Licensed under the BSD
+   2-clause license.
+*/
+#pragma once
+#include "uECC.h"
+
+/* Version uECC_verify() that also copies message_hash to verified_hash
+   if the signature is valid, and does it in a way that is harder to attack
+   with fault injection.
+*/
+int uECC_verify_antifault(const uint8_t *public_key,
+                          const uint8_t *message_hash,
+                          unsigned hash_size,
+                          const uint8_t *signature,
+                          uECC_Curve curve,
+                          uint8_t *verified_hash);

components/bootloader/subproject/main/component.mk

@@ -17,6 +17,9 @@ ifdef CONFIG_IDF_TARGET_ESP32
     ifndef CONFIG_SPI_FLASH_ROM_DRIVER_PATCH
         LINKER_SCRIPTS += $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.spiflash.ld
     endif
+    ifdef CONFIG_ESP32_REV_MIN_3 
+        LINKER_SCRIPTS += $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.eco3.ld
+    endif
 endif
 
 COMPONENT_ADD_LDFLAGS += -L $(COMPONENT_PATH) $(addprefix -T ,$(LINKER_SCRIPTS))

components/bootloader/subproject/main/ld/esp32/bootloader.ld

@@ -11,8 +11,6 @@ Linker file used to link the bootloader.
 
 MEMORY
 {
-  /* I/O */
-  dport0_seg (RW) :                 	org = 0x3FF00000, len = 0x10
   /* IRAM POOL1, used for APP CPU cache. Bootloader runs from here during the final stage of loading the app because APP CPU is still held in reset, the main app enables APP CPU cache */
   iram_loader_seg (RWX) :           org = 0x40078000, len = 0x8000  /* 32KB, APP CPU cache */
   /* 63kB, IRAM. We skip the first 1k to prevent the entry point being
@@ -44,6 +42,8 @@ SECTIONS
     *libbootloader_support.a:bootloader_common.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
+    *libbootloader_support.a:bootloader_efuse_esp32.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*)
@@ -53,7 +53,7 @@ SECTIONS
     *libbootloader_support.a:secure_boot_signatures.*(.literal .text .literal.* .text.*)
     *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
     *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
-    *libsoc.a:rtc_wdt.*(.literal .text .literal.* .text.*)
+    *libsoc.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
     *libsoc.a:rtc_clk.*(.literal .text .literal.* .text.*)
     *libefuse.a:*.*(.literal .text .literal.* .text.*)
     *(.fini.literal)
@@ -75,6 +75,7 @@ SECTIONS
   .dram0.bss (NOLOAD) :
   {
     . = ALIGN (8);
+    _dram_start = ABSOLUTE(.);
     _bss_start = ABSOLUTE(.);
     *(.dynsbss)
     *(.sbss)
@@ -151,6 +152,7 @@ SECTIONS
     *(.gnu.linkonce.lit4.*)
     _lit4_end = ABSOLUTE(.);
     . = ALIGN(4);
+    _dram_end = ABSOLUTE(.);
   } >dram_seg
 
   .iram.text :

components/bootloader/subproject/main/ld/esp32s2/bootloader.ld

@@ -1,22 +1,13 @@
-/*
-Linker file used to link the bootloader.
-*/
+/* Simplified memory map for the bootloader.
+ * Make sure the bootloader can load into main memory without overwriting itself.
+ */
 
 
-/* Simplified memory map for the bootloader
-
-   The main purpose is to make sure the bootloader can load into main memory
-   without overwriting itself.
-*/
-
 MEMORY
 {
-  /* I/O */
-  dport0_seg (RW) :                 org = 0x3FF00000, len = 0x10
-  iram_loader_seg (RWX) :           org = 0x40062000, len = 0x4000  /* 16KB, IRAM */
-  iram_seg (RWX) :                  org = 0x40066000, len = 0x4000  /* 16KB, IRAM */
-  /* 8k at the end of DRAM, before ROM data & stack */
-  dram_seg (RW) :                   org = 0x3FFFA000, len = 0x2000
+  iram_seg (RWX) :                  org = 0x4004c000, len = 0x4000  /* SRAM Block 13 */
+  iram_loader_seg (RWX) :           org = 0x40050000, len = 0x6000  /* SRAM Block 14 & part of 15 */
+  dram_seg (RW) :                   org = 0x3FFE6000, len = 0x4B00  /* Part SRAM Blocks 15 & 16, ROM static buffer starts at end of this region (reclaimed after app runs) */
 }
 
 /*  Default entry point:  */
@@ -37,6 +28,8 @@ SECTIONS
     *libbootloader_support.a:bootloader_common.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
+    *libbootloader_support.a:bootloader_efuse_esp32s2.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*)
@@ -46,7 +39,8 @@ SECTIONS
     *libbootloader_support.a:secure_boot_signatures.*(.literal .text .literal.* .text.*)
     *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
     *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
-    *libsoc.a:rtc_wdt.*(.literal .text .literal.* .text.*)
+    *libsoc.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libsoc.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
     *libefuse.a:*.*(.literal .text .literal.* .text.*)
     *(.fini.literal)
     *(.fini)
@@ -67,6 +61,7 @@ SECTIONS
   .dram0.bss (NOLOAD) :
   {
     . = ALIGN (8);
+    _dram_start = ABSOLUTE(.);
     _bss_start = ABSOLUTE(.);
     *(.dynsbss)
     *(.sbss)
@@ -143,7 +138,7 @@ SECTIONS
     *(.gnu.linkonce.lit4.*)
     _lit4_end = ABSOLUTE(.);
     . = ALIGN(4);
-    _heap_start = ABSOLUTE(.);
+    _dram_end = ABSOLUTE(.);
   } >dram_seg
 
   .iram.text :

components/bootloader/subproject/main/ld/esp32s2/bootloader.rom.ld

@@ -0,0 +1,13 @@
+/*
+ * ESP32S2 ROM address table
+ * Generated for ROM with MD5sum: 0a2c7ec5109c17884606d23b47045796
+*/
+PROVIDE (ets_update_cpu_frequency = 0x4000d8a4);
+
+PROVIDE (MD5Final = 0x4000530c);
+PROVIDE (MD5Init = 0x4000526c);
+PROVIDE (MD5Update = 0x4000528c);
+/* bootloader will use following functions from xtensa hal library */
+xthal_get_ccount = 0x4001aa90;
+xthal_get_ccompare = 0x4001aabc;
+xthal_set_ccompare = 0x4001aa98;

components/bootloader/subproject/main/ld/esp32s2beta/bootloader.rom.ld

@@ -1,14 +0,0 @@
-/*
- * ESP32S2 ROM address table
- * Generated for ROM with MD5sum: f054d40c5f6b9207d3827460a6f5748c
-*/
-PROVIDE ( ets_update_cpu_frequency = 0x4000d954 );
-
-/* ToDo: Following address may need modification */
-PROVIDE ( MD5Final = 0x400056e8 );
-PROVIDE ( MD5Init = 0x40005648 );
-PROVIDE ( MD5Update = 0x40005668 );
-/* bootloader will use following functions from xtensa hal library */
-xthal_get_ccount = 0x40015cbc;
-xthal_get_ccompare = 0x40015ce8;
-xthal_set_ccompare = 0x40015cc4;

components/bootloader_support/CMakeLists.txt

@@ -2,40 +2,50 @@ set(srcs
     "src/bootloader_clock.c"
     "src/bootloader_common.c"
     "src/bootloader_flash.c"
+    "src/bootloader_mem.c"
     "src/bootloader_random.c"
+    "src/bootloader_random_${IDF_TARGET}.c"
     "src/bootloader_utility.c"
     "src/esp_image_format.c"
+    "src/flash_encrypt.c"
     "src/flash_partitions.c"
     "src/flash_qio_mode.c"
     "src/bootloader_flash_config_${IDF_TARGET}.c"
     "src/bootloader_efuse_${IDF_TARGET}.c"
     )
 
-if(IDF_TARGET STREQUAL "esp32")
-    # Not supported on ESP32S2Beta yet
-    list(APPEND srcs "src/flash_encrypt.c")
-endif()
-
 if(BOOTLOADER_BUILD)
     set(include_dirs "include" "include_bootloader")
     set(priv_requires micro-ecc spi_flash efuse)
     list(APPEND srcs
-        "src/bootloader_init.c"
-        "src/${IDF_TARGET}/bootloader_sha.c"
-        "src/${IDF_TARGET}/flash_encrypt.c"
-        "src/${IDF_TARGET}/secure_boot_signatures.c"
-        "src/${IDF_TARGET}/secure_boot.c"
-        "src/${IDF_TARGET}/bootloader_${IDF_TARGET}.c"
-        )
+    "src/bootloader_init.c"
+    "src/${IDF_TARGET}/bootloader_sha.c"
+    "src/${IDF_TARGET}/flash_encrypt.c"
+    "src/${IDF_TARGET}/bootloader_${IDF_TARGET}.c"
+    )
 else()
     list(APPEND srcs
-        "src/idf/bootloader_sha.c"
-        "src/idf/secure_boot_signatures.c")
+        "src/idf/bootloader_sha.c")
     set(include_dirs "include")
     set(priv_include_dirs "include_bootloader")
     set(priv_requires spi_flash mbedtls efuse)
 endif()
 
+if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME OR CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
+    if(BOOTLOADER_BUILD)
+        list(APPEND srcs
+        "src/${IDF_TARGET}/secure_boot_signatures.c")
+    else()
+        list(APPEND srcs
+            "src/idf/secure_boot_signatures.c")
+    endif()
+endif()
+
+if(CONFIG_SECURE_BOOT AND BOOTLOADER_BUILD)
+    list(APPEND srcs
+        "src/${IDF_TARGET}/secure_boot.c")
+endif()
+
 set(requires soc) #unfortunately the header directly uses SOC registers
 
 idf_component_register(SRCS "${srcs}"
@@ -44,7 +54,7 @@ idf_component_register(SRCS "${srcs}"
                     REQUIRES "${requires}"
                     PRIV_REQUIRES "${priv_requires}")
 
-if(CONFIG_SECURE_SIGNED_APPS)
+if(CONFIG_SECURE_SIGNED_APPS AND (CONFIG_SECURE_BOOT_V1_ENABLED OR CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME))
     if(BOOTLOADER_BUILD)
         # Whether CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES or not, we need verification key to embed
         # in the library.

components/bootloader_support/component.mk

@@ -19,14 +19,27 @@ ifndef IS_BOOTLOADER_BUILD
 COMPONENT_OBJEXCLUDE := src/bootloader_init.o
 endif
 
-COMPONENT_OBJEXCLUDE += src/bootloader_flash_config_esp32s2beta.o \
-			src/bootloader_efuse_esp32s2beta.o
+COMPONENT_OBJEXCLUDE += src/bootloader_flash_config_esp32s2.o \
+			src/bootloader_efuse_esp32s2.o \
+			src/bootloader_random_esp32s2.o
+
+ifndef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
+ifndef CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+COMPONENT_OBJEXCLUDE += src/$(IDF_TARGET)/secure_boot_signatures.o \
+			src/idf/secure_boot_signatures.o
+endif
+endif
+
+ifndef CONFIG_SECURE_BOOT
+COMPONENT_OBJEXCLUDE += src/$(IDF_TARGET)/secure_boot.o
+endif
 
 #
 # Secure boot signing key support
 #
 ifdef CONFIG_SECURE_SIGNED_APPS
 
+ifdef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
 # this path is created relative to the component build directory
 SECURE_BOOT_VERIFICATION_KEY := $(abspath signature_verification_key.bin)
 
@@ -41,7 +54,7 @@ ORIG_SECURE_BOOT_VERIFICATION_KEY := $(call resolvepath,$(call dequote,$(CONFIG_
 $(ORIG_SECURE_BOOT_VERIFICATION_KEY):
 	@echo "Secure boot verification public key '$@' missing."
 	@echo "This can be extracted from the private signing key, see"
-	@echo "docs/security/secure-boot.rst for details."
+	@echo "docs/security/secure-boot-v1.rst for details."
 	exit 1
 
 # copy it into the build dir, so the secure boot verification key has
@@ -55,4 +68,5 @@ COMPONENT_EXTRA_CLEAN += $(SECURE_BOOT_VERIFICATION_KEY)
 
 COMPONENT_EMBED_FILES := $(SECURE_BOOT_VERIFICATION_KEY)
 
+endif #CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
 endif #CONFIG_SECURE_SIGNED_APPS

components/bootloader_support/include/bootloader_common.h

@@ -19,8 +19,8 @@
 // RESET_REASON is declared in rom/rtc.h
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/rtc.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/rtc.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/rtc.h"
 #endif
 
 #ifdef __cplusplus

components/bootloader_support/include/bootloader_flash_config.h

@@ -14,6 +14,7 @@
 
 #pragma once
 
+#include "sdkconfig.h"
 #include "esp_image_format.h"
 
 #ifdef __cplusplus
@@ -66,6 +67,22 @@ void bootloader_flash_gpio_config(const esp_image_header_t* pfhdr);
  */
 void bootloader_flash_dummy_config(const esp_image_header_t* pfhdr);
 
+#ifdef CONFIG_IDF_TARGET_ESP32
+/**
+ * @brief Return the pin number used for custom SPI flash and/or SPIRAM WP pin
+ *
+ * Can be determined by eFuse values in most cases, or overriden in configuration
+ *
+ * This value is only meaningful if the other SPI flash pins are overriden via eFuse.
+ *
+ * This value is only meaningful if flash is set to QIO or QOUT mode, or if
+ * SPIRAM is enabled.
+ *
+ * @return Pin number to use, or -1 if the default should be kept
+ */
+int bootloader_flash_get_wp_pin(void);
+#endif
+
 #ifdef __cplusplus
 }
 #endif

components/bootloader_support/include/bootloader_mem.h

@@ -0,0 +1,24 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void bootloader_init_mem(void);
+
+#ifdef __cplusplus
+}
+#endif

components/bootloader_support/include/esp_app_format.h

@@ -19,6 +19,7 @@
  */
 typedef enum {
     ESP_CHIP_ID_ESP32 = 0x0000,  /*!< chip ID: ESP32 */
+    ESP_CHIP_ID_ESP32S2 = 0x0002,  /*!< chip ID: ESP32S2 */
     ESP_CHIP_ID_INVALID = 0xFFFF /*!< Invalid chip ID (we defined it to make sure the esp_chip_id_t is 2 bytes size) */
 } __attribute__((packed)) esp_chip_id_t;
 

components/bootloader_support/include/esp_flash_encrypt.h

@@ -52,7 +52,7 @@ static inline /** @cond */ IRAM_ATTR /** @endcond */ bool esp_flash_encryption_e
     uint32_t flash_crypt_cnt;
 #if CONFIG_IDF_TARGET_ESP32
     flash_crypt_cnt = REG_GET_FIELD(EFUSE_BLK0_RDATA0_REG, EFUSE_RD_FLASH_CRYPT_CNT);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     flash_crypt_cnt = REG_GET_FIELD(EFUSE_RD_REPEAT_DATA1_REG, EFUSE_SPI_BOOT_CRYPT_CNT);
 #endif
     /* __builtin_parity is in flash, so we calculate parity inline */
@@ -128,6 +128,10 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length);
  * is enabled but secure boot is not used. This should protect against
  * serial re-flashing of an unauthorised code in absence of secure boot.
  *
+ * @note On ESP32 V3 only, write protecting FLASH_CRYPT_CNT will also prevent
+ * disabling UART Download Mode. If both are wanted, call
+ * esp_efuse_disable_rom_download_mode() before calling this function.
+ *
  */
 void esp_flash_write_protect_crypt_cnt(void);
 

components/bootloader_support/include/esp_secure_boot.h

@@ -16,13 +16,18 @@
 #include <stdbool.h>
 #include <esp_err.h>
 #include "soc/efuse_periph.h"
+#include "esp_image_format.h"
 
 #include "sdkconfig.h"
-#if CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/efuse.h"
+#if CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/efuse.h"
+#else
+#include "esp32/rom/secure_boot.h"
 #endif
 
-#ifdef CONFIG_SECURE_BOOT_ENABLED
+typedef struct ets_secure_boot_signature ets_secure_boot_signature_t;
+
+#ifdef CONFIG_SECURE_BOOT_V1_ENABLED
 #if !defined(CONFIG_SECURE_SIGNED_ON_BOOT) || !defined(CONFIG_SECURE_SIGNED_ON_UPDATE) || !defined(CONFIG_SECURE_SIGNED_APPS)
 #error "internal sdkconfig error, secure boot should always enable all signature options"
 #endif
@@ -47,16 +52,23 @@ extern "C" {
 static inline bool esp_secure_boot_enabled(void)
 {
 #if CONFIG_IDF_TARGET_ESP32
-    return REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_RD_ABS_DONE_0;
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+    #ifdef CONFIG_SECURE_BOOT_V1_ENABLED
+        return REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_RD_ABS_DONE_0;
+    #elif CONFIG_SECURE_BOOT_V2_ENABLED
+        return ets_use_secure_boot_v2();
+    #endif
+#elif CONFIG_IDF_TARGET_ESP32S2
     return ets_efuse_secure_boot_enabled();
 #endif
+    return false; /* Secure Boot not enabled in menuconfig */
 }
 
 /** @brief Generate secure digest from bootloader image
  *
  * @important This function is intended to be called from bootloader code only.
  *
+ * This function is only used in the context of the Secure Boot V1 scheme.
+ * 
  * If secure boot is not yet enabled for bootloader, this will:
  *     1) generate the secure boot key and burn it on EFUSE
  *        (without enabling R/W protection)
@@ -73,18 +85,17 @@ static inline bool esp_secure_boot_enabled(void)
  */
 esp_err_t esp_secure_boot_generate_digest(void);
 
-/** @brief Enable secure boot if it is not already enabled.
+/** @brief Enable secure boot V1 if it is not already enabled.
  *
- * @important If this function succeeds, secure boot is permanently
+ * @important If this function succeeds, secure boot V1 is permanently
  * enabled on the chip via efuse.
  *
  * @important This function is intended to be called from bootloader code only.
  *
- * @important This will enable r/w protection of secure boot key on EFUSE,
- * therefore it is to be ensured that esp_secure_boot_generate_digest()
- * is called before this
- *
- * If secure boot is not yet enabled for bootloader, this will
+ * @important In case of Secure Boot V1, this will enable r/w protection 
+ * of secure boot key on EFUSE, therefore it is to be ensured that 
+ * esp_secure_boot_generate_digest() is called before this .If secure boot is not 
+ * yet enabled for bootloader, this will
  *     1) enable R/W protection of secure boot key on EFUSE
  *     2) enable secure boot by blowing the EFUSE_RD_ABS_DONE_0 efuse.
  *
@@ -100,35 +111,97 @@ esp_err_t esp_secure_boot_generate_digest(void);
  */
 esp_err_t esp_secure_boot_permanently_enable(void);
 
-/** @brief Verify the secure boot signature (determinstic ECDSA w/ SHA256) appended to some binary data in flash.
+/** @brief Enables secure boot V2 if it is not already enabled.
  *
- * Public key is compiled into the calling program. See docs/security/secure-boot.rst for details.
+ * @important If this function succeeds, secure boot V2 is permanently
+ * enabled on the chip via efuse.
+ *
+ * @important This function is intended to be called from bootloader code only.
+ * 
+ * @important In case of Secure Boot V2, this will enable write protection 
+ * of secure boot key on EFUSE in BLK2. .If secure boot is not 
+ * yet enabled for bootloader, this will
+ *     1) enable W protection of secure boot key on EFUSE
+ *     2) enable secure boot by blowing the EFUSE_RD_ABS_DONE_1 efuse.
+ *
+ * This function does not verify secure boot of the bootloader (the
+ * ROM bootloader does this.)
+ *
+ * @param image_data Image metadata of the application to be loaded.
+ * 
+ * Will fail if efuses have been part-burned in a way that indicates
+ * secure boot should not or could not be correctly enabled.
+ *
+ * @return ESP_ERR_INVALID_STATE if efuse state doesn't allow
+ * secure boot to be enabled cleanly. ESP_OK if secure boot
+ * is enabled on this chip from now on.
+ */
+esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *image_data);
+
+/** @brief Verify the secure boot signature appended to some binary data in flash.
+ *
+ * For ECDSA Scheme (Secure Boot V1) - deterministic ECDSA w/ SHA256 image
+ * For RSA Scheme (Secure Boot V2) - RSA-PSS Verification of the SHA-256 image
+ * 
+ * Public key is compiled into the calling program in the ECDSA Scheme.
+ * See the apt docs/security/secure-boot-v1.rst or docs/security/secure-boot-v2.rst for details.
  *
  * @param src_addr Starting offset of the data in flash.
  * @param length Length of data in bytes. Signature is appended -after- length bytes.
  *
  * If flash encryption is enabled, the image will be transparently decrypted while being verified.
  *
+ * @note This function doesn't have any fault injection resistance so should not be called
+ * during a secure boot itself (but can be called when verifying an update, etc.)
+ *
  * @return ESP_OK if signature is valid, ESP_ERR_INVALID_STATE if
  * signature fails, ESP_FAIL for other failures (ie can't read flash).
  */
 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length);
 
-/** @brief Verify the secure boot signature block (deterministic ECDSA w/ SHA256) based on the SHA256 hash of some data.
- *
- * Similar to esp_secure_boot_verify_signature(), but can be used when the digest is precalculated.
- * @param sig_block Pointer to signature block data
- * @param image_digest Pointer to 32 byte buffer holding SHA-256 hash.
- *
- */
-
 /** @brief Secure boot verification block, on-flash data format. */
 typedef struct {
     uint32_t version;
     uint8_t signature[64];
 } esp_secure_boot_sig_block_t;
 
-esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest);
+/** @brief Verify the ECDSA secure boot signature block for Secure Boot V1.
+ *
+ *  Calculates Deterministic ECDSA w/ SHA256 based on the SHA256 hash of the image. ECDSA signature
+ *  verification must be enabled in project configuration to use this function.
+ *
+ * Similar to esp_secure_boot_verify_signature(), but can be used when the digest is precalculated.
+ * @param sig_block Pointer to ECDSA signature block data
+ * @param image_digest Pointer to 32 byte buffer holding SHA-256 hash.
+ * @param verified_digest Pointer to 32 byte buffer that will receive verified digest if verification completes. (Used during bootloader implementation only, result is invalid otherwise.)
+ *
+ */
+esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
+
+
+/** @brief Verify the RSA secure boot signature block for Secure Boot V2.
+ *
+ *  Performs RSA-PSS Verification of the SHA-256 image based on the public key
+ *  in the signature block, compared against the public key digest stored in efuse.
+ *
+ * Similar to esp_secure_boot_verify_signature(), but can be used when the digest is precalculated.
+ * @param sig_block Pointer to RSA signature block data
+ * @param image_digest Pointer to 32 byte buffer holding SHA-256 hash.
+ * @param verified_digest Pointer to 32 byte buffer that will receive verified digest if verification completes. (Used during bootloader implementation only, result is invalid otherwise.)
+ *
+ */
+esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
+
+/** @brief Legacy ECDSA verification function
+ *
+ * @note Deprecated, call either esp_secure_boot_verify_ecdsa_signature_block() or esp_secure_boot_verify_rsa_signature_block() instead.
+ *
+ * @param sig_block Pointer to ECDSA signature block data
+ * @param image_digest Pointer to 32 byte buffer holding SHA-256 hash.
+ */
+esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest)
+    __attribute__((deprecated("use esp_secure_boot_verify_ecdsa_signature_block instead")));
+
 
 #define FLASH_OFFS_SECURE_BOOT_IV_DIGEST 0
 

components/bootloader_support/include_bootloader/bootloader_flash.h

@@ -18,9 +18,11 @@
 #include <stdbool.h>
 #include <stdint.h>
 #include <esp_err.h>
+#include <esp_spi_flash.h> /* including in bootloader for error values */
 
 #define FLASH_SECTOR_SIZE 0x1000
 #define FLASH_BLOCK_SIZE 0x10000
+#define MMAP_ALIGNED_MASK 0x0000FFFF
 
 /* Provide a Flash API for bootloader_support code,
    that can be used from bootloader or app code.

components/bootloader_support/include_bootloader/bootloader_utility.h

@@ -108,3 +108,17 @@ esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_he
  * @param label Label to print at beginning of log line.
  */
 void bootloader_debug_buffer(const void *buffer, size_t length, const char *label);
+
+/** @brief Generates the digest of the data between offset & offset+length.
+ *
+ * This function should be used when the size of the data is larger than 3.2MB.
+ * The MMU capacity is 3.2MB (50 pages - 64KB each). This function generates the SHA-256 
+ * of the data in chunks of 3.2MB, considering the MMU capacity. 
+ * 
+ * @param[in]  flash_offset  Offset of the data in flash.
+ * @param[in]  len           Length of data in bytes.
+ * @param[out] digest        Pointer to buffer where the digest is written, if ESP_OK is returned. 
+ * 
+ * @return ESP_OK if secure boot digest is generated successfully.
+ */
+esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);

components/bootloader_support/src/bootloader_clock.c

@@ -16,13 +16,14 @@
 #include "soc/rtc.h"
 #include "soc/dport_reg.h"
 #include "soc/efuse_periph.h"
+#include "soc/rtc_cntl_reg.h"
 
 #ifdef CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/uart.h"
 #include "esp32/rom/rtc.h"
-#else
-#include "esp32s2beta/rom/uart.h"
-#include "esp32s2beta/rom/rtc.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/uart.h"
+#include "esp32s2/rom/rtc.h"
 #endif
 
 void bootloader_clock_configure(void)
@@ -34,15 +35,15 @@ void bootloader_clock_configure(void)
     // and will be done with the bootloader much earlier than UART FIFO is empty.
     uart_tx_wait_idle(0);
 
+    /* Set CPU to 80MHz. Keep other clocks unmodified. */
+    int cpu_freq_mhz = 80;
+    
+#if CONFIG_IDF_TARGET_ESP32
     /* On ESP32 rev 0, switching to 80/160 MHz if clock was previously set to
      * 240 MHz may cause the chip to lock up (see section 3.5 of the errata
      * document). For rev. 0, switch to 240 instead if it has been enabled
      * previously.
      */
-#if CONFIG_IDF_TARGET_ESP32
-    /* Set CPU to 80MHz. Keep other clocks unmodified. */
-    int cpu_freq_mhz = 80;
-
     uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
     if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
             DPORT_REG_GET_FIELD(DPORT_CPU_PER_CONF_REG, DPORT_CPUPERIOD_SEL) == DPORT_CPUPERIOD_SEL_240) {
@@ -53,11 +54,9 @@ void bootloader_clock_configure(void)
     rtc_clk_config_t clk_cfg = RTC_CLK_CONFIG_DEFAULT();
 #if CONFIG_IDF_TARGET_ESP32
     clk_cfg.xtal_freq = CONFIG_ESP32_XTAL_FREQ;
-    clk_cfg.cpu_freq_mhz = cpu_freq_mhz;
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    clk_cfg.xtal_freq = RTC_XTAL_FREQ_40M;
-    clk_cfg.cpu_freq = RTC_CPU_FREQ_80M;
 #endif
+    /* ESP32-S2 doesn't have XTAL_FREQ choice, always 40MHz */
+    clk_cfg.cpu_freq_mhz = cpu_freq_mhz;
     clk_cfg.slow_freq = rtc_clk_slow_freq_get();
     clk_cfg.fast_freq = rtc_clk_fast_freq_get();
     rtc_clk_init(clk_cfg);
@@ -66,11 +65,20 @@ void bootloader_clock_configure(void)
      * part of the start up time by enabling 32k XTAL early.
      * App startup code will wait until the oscillator has started up.
      */
-#ifdef CONFIG_ESP32_RTC_CLK_SRC_EXT_CRYS
+
+    /* TODO: move the clock option into esp_system, so that this doesn't have
+     * to continue:
+     */
+#if CONFIG_ESP32_RTC_CLK_SRC_EXT_CRYS
     if (!rtc_clk_32k_enabled()) {
         rtc_clk_32k_bootstrap(CONFIG_ESP32_RTC_XTAL_BOOTSTRAP_CYCLES);
     }
 #endif
+#if CONFIG_ESP32S2_RTC_CLK_SRC_EXT_CRYS
+    if (!rtc_clk_32k_enabled()) {
+        rtc_clk_32k_bootstrap(0);
+    }
+#endif
 }
 
 #ifdef BOOTLOADER_BUILD

components/bootloader_support/src/bootloader_common.c

@@ -21,15 +21,16 @@
 #include "esp32/rom/spi_flash.h"
 #include "esp32/rom/crc.h"
 #include "esp32/rom/gpio.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/spi_flash.h"
-#include "esp32s2beta/rom/crc.h"
-#include "esp32s2beta/rom/ets_sys.h"
-#include "esp32s2beta/rom/gpio.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/spi_flash.h"
+#include "esp32s2/rom/crc.h"
+#include "esp32s2/rom/ets_sys.h"
+#include "esp32s2/rom/gpio.h"
 #endif
 #include "esp_flash_partitions.h"
 #include "bootloader_flash.h"
 #include "bootloader_common.h"
+#include "bootloader_utility.h"
 #include "soc/gpio_periph.h"
 #include "soc/rtc.h"
 #include "soc/efuse_reg.h"
@@ -187,22 +188,7 @@ esp_err_t bootloader_common_get_sha256_of_partition (uint32_t address, uint32_t
         size = data.image_len;
     }
     // If image is type by data then hash is calculated for entire image.
-    const void *partition_bin = bootloader_mmap(address, size);
-    if (partition_bin == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", address, size);
-        return ESP_FAIL;
-    }
-    bootloader_sha256_handle_t sha_handle = bootloader_sha256_start();
-    if (sha_handle == NULL) {
-        bootloader_munmap(partition_bin);
-        return ESP_ERR_NO_MEM;
-    }
-    bootloader_sha256_data(sha_handle, partition_bin, size);
-    bootloader_sha256_finish(sha_handle, out_sha_256);
-
-    bootloader_munmap(partition_bin);
-
-    return ESP_OK;
+    return bootloader_sha256_flash_contents(address, size, out_sha_256);
 }
 
 int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata, bool *valid_two_otadata, bool max)
@@ -248,13 +234,15 @@ esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t
         return ESP_ERR_INVALID_ARG;
     }
 
-    const uint8_t *image = bootloader_mmap(partition->offset, partition->size);
+    const uint32_t app_desc_offset = sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t);
+    const uint32_t mmap_size = app_desc_offset + sizeof(esp_app_desc_t);
+    const uint8_t *image = bootloader_mmap(partition->offset, mmap_size);
     if (image == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, partition->size);
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, mmap_size);
         return ESP_FAIL;
     }
 
-    memcpy(app_desc, image + sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t), sizeof(esp_app_desc_t));
+    memcpy(app_desc, image + app_desc_offset, sizeof(esp_app_desc_t));
     bootloader_munmap(image);
 
     if (app_desc->magic_word != ESP_APP_DESC_MAGIC_WORD) {

components/bootloader_support/src/bootloader_efuse_esp32s2.c

@@ -16,14 +16,9 @@
 #include "bootloader_clock.h"
 #include "bootloader_common.h"
 
-int bootloader_clock_get_rated_freq_mhz()
-{
-    /* No known limitation: all chips are 240MHz rated */
-    return 240;
-}
-
 uint8_t bootloader_common_get_chip_revision(void)
 {
-    /* No other revisions for ESP32-S2beta */
+    // should return the same value as esp_efuse_get_chip_ver()
+    /* No other revisions for ESP32-S2 */
     return 0;
 }

components/bootloader_support/src/bootloader_flash.c

@@ -15,10 +15,9 @@
 
 #include <bootloader_flash.h>
 #include <esp_log.h>
-#include <esp_spi_flash.h> /* including in bootloader for error values */
 #include <esp_flash_encrypt.h>
-#if CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/spi_flash.h"
+#if CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/spi_flash.h"
 #endif
 
 #ifndef BOOTLOADER_BUILD
@@ -72,7 +71,7 @@ esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool
     if (write_encrypted) {
 #if CONFIG_IDF_TARGET_ESP32
         return spi_flash_write_encrypted(dest_addr, src, size);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
         return SPI_Encrypt_Write(dest_addr, src, size);
 #endif
     } else {
@@ -92,13 +91,14 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
 
 #else
 /* Bootloader version, uses ROM functions only */
-#include <soc/dport_reg.h>
+#include "soc/dport_reg.h"
 #if CONFIG_IDF_TARGET_ESP32
-#include <esp32/rom/spi_flash.h>
-#include <esp32/rom/cache.h>
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include <esp32s2beta/rom/spi_flash.h>
-#include <esp32s2beta/rom/cache.h>
+#include "esp32/rom/spi_flash.h"
+#include "esp32/rom/cache.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/spi_flash.h"
+#include "esp32s2/rom/cache.h"
+#include "soc/cache_memory.h"
 #endif
 static const char *TAG = "bootloader_flash";
 
@@ -110,7 +110,7 @@ static const char *TAG = "bootloader_flash";
 #define MMU_SIZE          (0x320000)
 #define MMU_BLOCK50_VADDR (MMU_BLOCK0_VADDR + MMU_SIZE)
 #define FLASH_READ_VADDR MMU_BLOCK50_VADDR
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
 /* Use first 63 blocks in MMU for bootloader_mmap,
    63th block for bootloader_flash_read
 */
@@ -121,7 +121,7 @@ static const char *TAG = "bootloader_flash";
 #endif
 
 #define MMU_FREE_PAGES    (MMU_SIZE / FLASH_BLOCK_SIZE)
-    
+
 static bool mapped;
 
 // Current bootloader mapping (ab)used for bootloader_read()
@@ -152,7 +152,7 @@ const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
 #if CONFIG_IDF_TARGET_ESP32
     Cache_Read_Disable(0);
     Cache_Flush(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     uint32_t autoload = Cache_Suspend_ICache();
     Cache_Invalidate_ICache_All();
 #endif
@@ -160,21 +160,21 @@ const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
              src_addr & MMU_FLASH_MASK, count, size, src_addr, src_addr_aligned );
 #if CONFIG_IDF_TARGET_ESP32
     int e = cache_flash_mmu_set(0, 0, MMU_BLOCK0_VADDR, src_addr_aligned, 64, count);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    int e = Cache_Ibus_MMU_Set(DPORT_MMU_ACCESS_FLASH, MMU_BLOCK0_VADDR, src_addr_aligned, 64, count, 0);
+#elif CONFIG_IDF_TARGET_ESP32S2
+    int e = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, MMU_BLOCK0_VADDR, src_addr_aligned, 64, count, 0);
 #endif
     if (e != 0) {
         ESP_LOGE(TAG, "cache_flash_mmu_set failed: %d\n", e);
 #if CONFIG_IDF_TARGET_ESP32
         Cache_Read_Enable(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
         Cache_Resume_ICache(autoload);
 #endif
         return NULL;
     }
 #if CONFIG_IDF_TARGET_ESP32
     Cache_Read_Enable(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     Cache_Resume_ICache(autoload);
 #endif
 
@@ -191,7 +191,7 @@ void bootloader_munmap(const void *mapping)
         Cache_Read_Disable(0);
         Cache_Flush(0);
         mmu_init(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
         //TODO, save the autoload value.
         Cache_Suspend_ICache();
         Cache_Invalidate_ICache_All();
@@ -221,13 +221,13 @@ static esp_err_t bootloader_flash_read_no_decrypt(size_t src_addr, void *dest, s
 #if CONFIG_IDF_TARGET_ESP32
     Cache_Read_Disable(0);
     Cache_Flush(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     uint32_t autoload = Cache_Suspend_ICache();
 #endif
     esp_rom_spiflash_result_t r = esp_rom_spiflash_read(src_addr, dest, size);
 #if CONFIG_IDF_TARGET_ESP32
     Cache_Read_Enable(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     Cache_Resume_ICache(autoload);
 #endif
 
@@ -247,21 +247,21 @@ static esp_err_t bootloader_flash_read_allow_decrypt(size_t src_addr, void *dest
 #if CONFIG_IDF_TARGET_ESP32
             Cache_Read_Disable(0);
             Cache_Flush(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
             uint32_t autoload = Cache_Suspend_ICache();
             Cache_Invalidate_ICache_All();
 #endif
             ESP_LOGD(TAG, "mmu set block paddr=0x%08x (was 0x%08x)", map_at, current_read_mapping);
 #if CONFIG_IDF_TARGET_ESP32
             int e = cache_flash_mmu_set(0, 0, FLASH_READ_VADDR, map_at, 64, 1);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-            int e = Cache_Ibus_MMU_Set(DPORT_MMU_ACCESS_FLASH, FLASH_READ_VADDR, map_at, 64, 1, 0);
+#elif CONFIG_IDF_TARGET_ESP32S2
+            int e = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, MMU_BLOCK63_VADDR, map_at, 64, 1, 0);
 #endif
             if (e != 0) {
                 ESP_LOGE(TAG, "cache_flash_mmu_set failed: %d\n", e);
 #if CONFIG_IDF_TARGET_ESP32
                 Cache_Read_Enable(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
                 Cache_Resume_ICache(autoload);
 #endif
                 return ESP_FAIL;
@@ -269,7 +269,7 @@ static esp_err_t bootloader_flash_read_allow_decrypt(size_t src_addr, void *dest
             current_read_mapping = map_at;
 #if CONFIG_IDF_TARGET_ESP32
             Cache_Read_Enable(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
             Cache_Resume_ICache(autoload);
 #endif
         }
@@ -326,7 +326,7 @@ esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool
     if (write_encrypted) {
 #if CONFIG_IDF_TARGET_ESP32
         return spi_to_esp_err(esp_rom_spiflash_write_encrypted(dest_addr, src, size));
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
         // TODO: use the same ROM AP here
         return spi_to_esp_err(SPI_Encrypt_Write(dest_addr, src, size));
 #endif

components/bootloader_support/src/bootloader_flash_config_esp32.c

@@ -25,6 +25,7 @@
 #include "soc/spi_reg.h"
 #include "soc/spi_caps.h"
 #include "flash_qio_mode.h"
+#include "bootloader_common.h"
 #include "bootloader_flash_config.h"
 
 void bootloader_flash_update_id(void)
@@ -62,6 +63,7 @@ void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t* pfhdr)
             break;
     }
     esp_rom_spiflash_config_clk(spi_clk_div, 0);
+    esp_rom_spiflash_config_clk(spi_clk_div, 1);
 }
 
 void IRAM_ATTR bootloader_flash_gpio_config(const esp_image_header_t* pfhdr)
@@ -74,18 +76,11 @@ void IRAM_ATTR bootloader_flash_gpio_config(const esp_image_header_t* pfhdr)
     uint32_t chip_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
     uint32_t pkg_ver = chip_ver & 0x7;
 
-    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
-        // For ESP32D2WD the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
-        // For ESP32PICOD2 the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
-        // For ESP32PICOD4 the SPI pins are already configured
+    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302) {
+        // For ESP32D2WD or ESP32-PICO series,the SPI pins are already configured
         // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
@@ -162,4 +157,33 @@ void IRAM_ATTR bootloader_flash_dummy_config(const esp_image_header_t* pfhdr)
 
     SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + g_rom_spiflash_dummy_len_plus[0],
             SPI_USR_DUMMY_CYCLELEN_S);
-}
+}
+
+#define ESP32_D2WD_WP_GPIO 7 /* ESP32-D2WD & ESP32-PICO-D4 has this GPIO wired to WP pin of flash */
+#define ESP32_PICO_V3_GPIO 18 /* ESP32-PICO-V3* use this GPIO for WP pin of flash */
+
+int bootloader_flash_get_wp_pin(void)
+{
+#if CONFIG_BOOTLOADER_SPI_CUSTOM_WP_PIN
+    return CONFIG_BOOTLOADER_SPI_WP_PIN; // can be set for bootloader when QIO or QOUT config in use
+#elif CONFIG_SPIRAM_CUSTOM_SPIWP_SD3_PIN
+    return CONFIG_SPIRAM_SPIWP_SD3_PIN; // can be set for app when DIO or DOUT config used for PSRAM only
+#else
+    // no custom value, find it based on the package eFuse value
+    uint8_t chip_ver;
+    uint32_t pkg_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
+    switch(pkg_ver) {
+    case EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5:
+        return ESP32_D2WD_WP_GPIO;
+    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2:
+    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4:
+        /* Same package IDs are used for ESP32-PICO-V3 and ESP32-PICO-D4, silicon version differentiates */
+        chip_ver = bootloader_common_get_chip_revision();
+        return (chip_ver < 3) ? ESP32_D2WD_WP_GPIO : ESP32_PICO_V3_GPIO;
+    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302:
+        return ESP32_PICO_V3_GPIO;
+    default:
+        return SPI_WP_GPIO_NUM;
+    }
+#endif
+}

components/bootloader_support/src/bootloader_flash_config_esp32s2.c

@@ -0,0 +1,85 @@
+// Copyright 2019 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include <stdbool.h>
+#include <assert.h>
+#include "string.h"
+#include "sdkconfig.h"
+#include "esp_err.h"
+#include "esp_log.h"
+#include "esp32s2/rom/gpio.h"
+#include "esp32s2/rom/spi_flash.h"
+#include "esp32s2/rom/efuse.h"
+#include "soc/gpio_periph.h"
+#include "soc/efuse_reg.h"
+#include "soc/spi_reg.h"
+#include "soc/spi_mem_reg.h"
+#include "soc/spi_caps.h"
+#include "flash_qio_mode.h"
+#include "bootloader_flash_config.h"
+#include "bootloader_common.h"
+
+#define FLASH_IO_MATRIX_DUMMY_40M   0
+#define FLASH_IO_MATRIX_DUMMY_80M   0
+
+#define FLASH_IO_DRIVE_GD_WITH_1V8PSRAM    3
+
+void bootloader_flash_update_id()
+{
+    g_rom_flashchip.device_id = bootloader_read_flash_id();
+}
+
+void IRAM_ATTR bootloader_flash_cs_timing_config()
+{
+    SET_PERI_REG_MASK(SPI_MEM_USER_REG(0), SPI_MEM_CS_HOLD_M | SPI_MEM_CS_SETUP_M);
+    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(0), SPI_MEM_CS_HOLD_TIME_V, 0, SPI_MEM_CS_HOLD_TIME_S);
+    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(0), SPI_MEM_CS_SETUP_TIME_V, 0, SPI_MEM_CS_SETUP_TIME_S);
+    SET_PERI_REG_MASK(SPI_MEM_USER_REG(1), SPI_MEM_CS_HOLD_M | SPI_MEM_CS_SETUP_M);
+    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(1), SPI_MEM_CS_HOLD_TIME_V, 1, SPI_MEM_CS_HOLD_TIME_S);
+    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(1), SPI_MEM_CS_SETUP_TIME_V, 0, SPI_MEM_CS_SETUP_TIME_S);
+}
+
+void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t* pfhdr)
+{
+    uint32_t spi_clk_div = 0;
+    switch (pfhdr->spi_speed) {
+        case ESP_IMAGE_SPI_SPEED_80M:
+            spi_clk_div = 1;
+            break;
+        case ESP_IMAGE_SPI_SPEED_40M:
+            spi_clk_div = 2;
+            break;
+        case ESP_IMAGE_SPI_SPEED_26M:
+            spi_clk_div = 3;
+            break;
+        case ESP_IMAGE_SPI_SPEED_20M:
+            spi_clk_div = 4;
+            break;
+        default:
+            break;
+    }
+    esp_rom_spiflash_config_clk(spi_clk_div, 0);
+    esp_rom_spiflash_config_clk(spi_clk_div, 1);
+}
+
+void IRAM_ATTR bootloader_flash_set_dummy_out(void)
+{
+    REG_SET_BIT(SPI_MEM_CTRL_REG(0), SPI_MEM_FDUMMY_OUT | SPI_MEM_D_POL | SPI_MEM_Q_POL);
+    REG_SET_BIT(SPI_MEM_CTRL_REG(1), SPI_MEM_FDUMMY_OUT | SPI_MEM_D_POL | SPI_MEM_Q_POL);
+}
+
+void IRAM_ATTR bootloader_flash_dummy_config(const esp_image_header_t* pfhdr)
+{
+    bootloader_configure_spi_pins(1);
+    bootloader_flash_set_dummy_out();
+}

components/bootloader_support/src/bootloader_flash_config_esp32s2beta.c

@@ -1,118 +0,0 @@
-// Copyright 2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-#include <stdbool.h>
-#include <assert.h>
-#include "string.h"
-#include "sdkconfig.h"
-#include "esp_err.h"
-#include "esp_log.h"
-#include "esp32s2beta/rom/gpio.h"
-#include "esp32s2beta/rom/spi_flash.h"
-#include "esp32s2beta/rom/efuse.h"
-#include "soc/gpio_periph.h"
-#include "soc/efuse_reg.h"
-#include "soc/spi_reg.h"
-#include "soc/spi_mem_reg.h"
-#include "soc/spi_caps.h"
-#include "flash_qio_mode.h"
-#include "bootloader_flash_config.h"
-#include "bootloader_common.h"
-
-#define FLASH_IO_MATRIX_DUMMY_40M   0
-#define FLASH_IO_MATRIX_DUMMY_80M   0
-
-#define FLASH_IO_DRIVE_GD_WITH_1V8PSRAM    3
-
-void bootloader_flash_update_id()
-{
-    g_rom_flashchip.device_id = bootloader_read_flash_id();
-}
-
-void IRAM_ATTR bootloader_flash_cs_timing_config()
-{
-    SET_PERI_REG_MASK(SPI_USER_REG(0), SPI_CS_HOLD_M | SPI_CS_SETUP_M);
-    SET_PERI_REG_BITS(SPI_CTRL2_REG(0), SPI_CS_HOLD_TIME_V, 1, SPI_CS_HOLD_TIME_S);
-    SET_PERI_REG_BITS(SPI_CTRL2_REG(0), SPI_CS_SETUP_TIME_V, 0, SPI_CS_SETUP_TIME_S);
-    SET_PERI_REG_MASK(SPI_USER_REG(1), SPI_CS_HOLD_M | SPI_CS_SETUP_M);
-    SET_PERI_REG_BITS(SPI_CTRL2_REG(1), SPI_CS_HOLD_TIME_V, 1, SPI_CS_HOLD_TIME_S);
-    SET_PERI_REG_BITS(SPI_CTRL2_REG(1), SPI_CS_SETUP_TIME_V, 0, SPI_CS_SETUP_TIME_S);
-}
-
-void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t* pfhdr)
-{
-    uint32_t spi_clk_div = 0;
-    switch (pfhdr->spi_speed) {
-        case ESP_IMAGE_SPI_SPEED_80M:
-            spi_clk_div = 1;
-            break;
-        case ESP_IMAGE_SPI_SPEED_40M:
-            spi_clk_div = 2;
-            break;
-        case ESP_IMAGE_SPI_SPEED_26M:
-            spi_clk_div = 3;
-            break;
-        case ESP_IMAGE_SPI_SPEED_20M:
-            spi_clk_div = 4;
-            break;
-        default:
-            break;
-    }
-    esp_rom_spiflash_config_clk(spi_clk_div, 0);
-}
-
-void IRAM_ATTR bootloader_flash_gpio_config(const esp_image_header_t* pfhdr)
-{
-
-}
-
-void IRAM_ATTR bootloader_flash_dummy_config(const esp_image_header_t* pfhdr)
-{
-    int spi_cache_dummy = 0;
-    int drv = 2;
-    switch (pfhdr->spi_mode) {
-    case ESP_IMAGE_SPI_MODE_QIO:
-        spi_cache_dummy = SPI0_R_QIO_DUMMY_CYCLELEN;
-        break;
-    case ESP_IMAGE_SPI_MODE_DIO:
-        spi_cache_dummy = SPI0_R_DIO_DUMMY_CYCLELEN;   //qio 3
-        break;
-    case ESP_IMAGE_SPI_MODE_QOUT:
-    case ESP_IMAGE_SPI_MODE_DOUT:
-    default:
-        spi_cache_dummy = SPI0_R_FAST_DUMMY_CYCLELEN;
-        break;
-    }
-
-    /* dummy_len_plus values defined in ROM for SPI flash configuration */
-    extern uint8_t g_rom_spiflash_dummy_len_plus[];
-    switch (pfhdr->spi_speed) {
-    case ESP_IMAGE_SPI_SPEED_80M:
-        g_rom_spiflash_dummy_len_plus[0] = FLASH_IO_MATRIX_DUMMY_80M;
-        g_rom_spiflash_dummy_len_plus[1] = FLASH_IO_MATRIX_DUMMY_80M;
-        SET_PERI_REG_BITS(SPI_MEM_USER1_REG(0), SPI_MEM_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + FLASH_IO_MATRIX_DUMMY_80M,
-                          SPI_MEM_USR_DUMMY_CYCLELEN_S);  //DUMMY
-        drv = 3;
-        break;
-    case ESP_IMAGE_SPI_SPEED_40M:
-        g_rom_spiflash_dummy_len_plus[0] = FLASH_IO_MATRIX_DUMMY_40M;
-        g_rom_spiflash_dummy_len_plus[1] = FLASH_IO_MATRIX_DUMMY_40M;
-        SET_PERI_REG_BITS(SPI_MEM_USER1_REG(0), SPI_MEM_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + FLASH_IO_MATRIX_DUMMY_40M,
-                          SPI_MEM_USR_DUMMY_CYCLELEN_S);  //DUMMY
-        break;
-    default:
-        break;
-    }
-
-    bootloader_configure_spi_pins(drv);
-}

components/bootloader_support/src/bootloader_init.c

@@ -14,6 +14,7 @@
 #include <string.h>
 #include <stdint.h>
 #include "sdkconfig.h"
+#include "esp_attr.h"
 #include "esp_log.h"
 #include "bootloader_init.h"
 #include "bootloader_flash.h"
@@ -22,15 +23,13 @@
 #include "bootloader_clock.h"
 #include "bootloader_common.h"
 #include "esp_flash_encrypt.h"
-#include "hal/timer_ll.h"
 #include "soc/cpu.h"
 #include "soc/rtc.h"
-#include "soc/rtc_wdt.h"
-
+#include "hal/wdt_hal.h"
 
 static const char *TAG = "boot";
 
-esp_image_header_t bootloader_image_hdr;
+esp_image_header_t WORD_ALIGNED_ATTR bootloader_image_hdr;
 
 void bootloader_clear_bss_section(void)
 {
@@ -61,21 +60,34 @@ esp_err_t bootloader_check_bootloader_validity(void)
 
 void bootloader_config_wdt(void)
 {
+    /*
+     * At this point, the flashboot protection of RWDT and MWDT0 will have been
+     * automatically enabled. We can disable flashboot protection as it's not
+     * needed anymore. If configured to do so, we also initialize the RWDT to
+     * protect the remainder of the bootloader process.
+     */
+    //Disable RWDT flashboot protection.
+    wdt_hal_context_t rtc_wdt_ctx = {.inst = WDT_RWDT, .rwdt_dev = &RTCCNTL};
+    wdt_hal_write_protect_disable(&rtc_wdt_ctx);
+    wdt_hal_set_flashboot_en(&rtc_wdt_ctx, false);
+    wdt_hal_write_protect_enable(&rtc_wdt_ctx);
+
 #ifdef CONFIG_BOOTLOADER_WDT_ENABLE
+    //Initialize and start RWDT to protect the  for bootloader if configured to do so
     ESP_LOGD(TAG, "Enabling RTCWDT(%d ms)", CONFIG_BOOTLOADER_WDT_TIME_MS);
-    rtc_wdt_protect_off();
-    rtc_wdt_disable();
-    rtc_wdt_set_length_of_reset_signal(RTC_WDT_SYS_RESET_SIG, RTC_WDT_LENGTH_3_2us);
-    rtc_wdt_set_length_of_reset_signal(RTC_WDT_CPU_RESET_SIG, RTC_WDT_LENGTH_3_2us);
-    rtc_wdt_set_stage(RTC_WDT_STAGE0, RTC_WDT_STAGE_ACTION_RESET_RTC);
-    rtc_wdt_set_time(RTC_WDT_STAGE0, CONFIG_BOOTLOADER_WDT_TIME_MS);
-    rtc_wdt_enable();
-    rtc_wdt_protect_on();
-#else /* disable watch dog */
-    rtc_wdt_disable();
+    wdt_hal_init(&rtc_wdt_ctx, WDT_RWDT, 0, false);
+    uint32_t stage_timeout_ticks = (uint32_t)((uint64_t)CONFIG_BOOTLOADER_WDT_TIME_MS * rtc_clk_slow_freq_get_hz() / 1000);
+    wdt_hal_write_protect_disable(&rtc_wdt_ctx);
+    wdt_hal_config_stage(&rtc_wdt_ctx, WDT_STAGE0, stage_timeout_ticks, WDT_STAGE_ACTION_RESET_RTC);
+    wdt_hal_enable(&rtc_wdt_ctx);
+    wdt_hal_write_protect_enable(&rtc_wdt_ctx);
 #endif
-    timer_ll_wdt_set_protect(&TIMERG0, false);
-    timer_ll_wdt_flashboot_en(&TIMERG0, false);
+
+    //Disable MWDT0 flashboot protection. But only after we've enabled the RWDT first so that there's not gap in WDT protection.
+    wdt_hal_context_t wdt_ctx = {.inst = WDT_MWDT0, .mwdt_dev = &TIMERG0};
+    wdt_hal_write_protect_disable(&wdt_ctx);
+    wdt_hal_set_flashboot_en(&wdt_ctx, false);
+    wdt_hal_write_protect_enable(&wdt_ctx);
 }
 
 void bootloader_enable_random(void)

components/bootloader_support/src/bootloader_mem.c

@@ -0,0 +1,48 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <stdbool.h>
+
+#include "xtensa/config/core.h"
+#include "hal/cpu_hal.h"
+#include "hal/mpu_hal.h"
+#include "hal/mpu_types.h"
+#include "soc/mpu_caps.h"
+#include "bootloader_mem.h"
+#include "xt_instr_macros.h"
+#include "xtensa/config/specreg.h"
+
+static inline void cpu_configure_region_protection(void)
+{
+    /* Currently, the only supported chips esp32 and esp32s2
+     * have the same configuration. Move this to the port layer once
+     * more chips with different configurations are supported.
+     * 
+     * Both chips have the address space divided into 8 regions, 512MB each.
+     */
+    const int illegal_regions[] = {0, 4, 5, 6, 7}; // 0x00000000, 0x80000000, 0xa0000000, 0xc0000000, 0xe0000000
+    for (int i = 0; i < sizeof(illegal_regions) / sizeof(illegal_regions[0]); ++i) {
+        mpu_hal_set_region_access(illegal_regions[i], MPU_REGION_ILLEGAL);
+    }
+
+    mpu_hal_set_region_access(1, MPU_REGION_RW); // 0x20000000
+}
+
+void bootloader_init_mem(void)
+{
+    cpu_hal_init_hwloop();
+
+    // protect memory region
+    cpu_configure_region_protection();
+}

components/bootloader_support/src/bootloader_random.c

@@ -1,4 +1,4 @@
-// Copyright 2010-2016 Espressif Systems (Shanghai) PTE LTD
+// Copyright 2010-2020 Espressif Systems (Shanghai) PTE LTD
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -11,15 +11,10 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
+#include "sdkconfig.h"
 #include "bootloader_random.h"
 #include "soc/cpu.h"
 #include "soc/wdev_reg.h"
-#include "soc/rtc_periph.h"
-#include "soc/sens_periph.h"
-#include "soc/syscon_periph.h"
-#include "soc/dport_reg.h"
-#include "soc/i2s_periph.h"
-#include "esp_log.h"
 
 #ifndef BOOTLOADER_BUILD
 #include "esp_system.h"
@@ -35,9 +30,7 @@ void bootloader_fill_random(void *buffer, size_t length)
 {
     uint8_t *buffer_bytes = (uint8_t *)buffer;
     uint32_t random;
-#if CONFIG_IDF_TARGET_ESP32
     uint32_t start, now;
-#endif
 
     assert(buffer != NULL);
 
@@ -50,152 +43,14 @@ void bootloader_fill_random(void *buffer, size_t length)
                as-is, we repeatedly read the RNG register and XOR all
                values.
             */
-#if CONFIG_IDF_TARGET_ESP32
             random = REG_READ(WDEV_RND_REG);
             RSR(CCOUNT, start);
             do {
                 random ^= REG_READ(WDEV_RND_REG);
                 RSR(CCOUNT, now);
             } while (now - start < 80 * 32 * 2); /* extra factor of 2 is precautionary */
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-            // ToDo: Get random from register
-            random = 12345678;
-#endif
         }
         buffer_bytes[i] = random >> ((i % 4) * 8);
     }
 }
 #endif // BOOTLOADER_BUILD
-
-void bootloader_random_enable(void)
-{
-    /* Ensure the hardware RNG is enabled following a soft reset.  This should always be the case already (this clock is
-       never disabled while the CPU is running), this is a "belts and braces" type check.
-     */
-#ifdef BOOTLOADER_BUILD
-    DPORT_SET_PERI_REG_MASK(DPORT_WIFI_CLK_EN_REG, DPORT_WIFI_CLK_RNG_EN);
-#else
-    periph_module_enable(PERIPH_RNG_MODULE);
-#endif // BOOTLOADER_BUILD
-
-    /* Enable SAR ADC in test mode to feed ADC readings of the 1.1V
-       reference via I2S into the RNG entropy input.
-
-       Note: I2S requires the PLL to be running, so the call to rtc_set_cpu_freq(CPU_80M)
-       in early bootloader startup must have been made.
-    */
-    SET_PERI_REG_BITS(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_DTEST_RTC, 2, RTC_CNTL_DTEST_RTC_S);
-    SET_PERI_REG_MASK(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_ENT_RTC);
-#if CONFIG_IDF_TARGET_ESP32
-    SET_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_SAR2_EN_TEST);
-
-#ifdef BOOTLOADER_BUILD
-    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
-#else
-    periph_module_enable(PERIPH_I2S0_MODULE);
-#endif // BOOTLOADER_BUILD
-    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_ULP_CP_FORCE_START_TOP);
-    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_ULP_CP_START_TOP);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    SET_PERI_REG_MASK(SENS_SAR_MEAS2_CTRL1_REG, SENS_SAR2_EN_TEST);
-    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
-    CLEAR_PERI_REG_MASK(RTC_CNTL_ULP_CP_CTRL_REG, RTC_CNTL_ULP_CP_FORCE_START_TOP);
-    CLEAR_PERI_REG_MASK(RTC_CNTL_ULP_CP_CTRL_REG, RTC_CNTL_ULP_CP_START_TOP);
-#endif
-
-    // Test pattern configuration byte 0xAD:
-    //--[7:4] channel_sel: 10-->en_test
-    //--[3:2] bit_width  : 3-->12bit
-    //--[1:0] atten      : 1-->3dB attenuation
-    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB1_REG, 0xADADADAD);
-    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB2_REG, 0xADADADAD);
-    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB3_REG, 0xADADADAD);
-    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB4_REG, 0xADADADAD);
-#if CONFIG_IDF_TARGET_ESP32
-    SET_PERI_REG_BITS(SENS_SAR_MEAS_WAIT2_REG, SENS_FORCE_XPD_SAR, 3, SENS_FORCE_XPD_SAR_S);
-    SET_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);
-    SET_PERI_REG_MASK(SENS_SAR_READ_CTRL2_REG, SENS_SAR2_DIG_FORCE);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    SET_PERI_REG_BITS(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 3, SENS_FORCE_XPD_SAR_S);
-    SET_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
-#endif
-
-#if CONFIG_IDF_TARGET_ESP32
-    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR2_MUX);
-#endif
-    SET_PERI_REG_BITS(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR_CLK_DIV, 4, SYSCON_SARADC_SAR_CLK_DIV_S);
-
-    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_RSTB_WAIT, 8, SYSCON_SARADC_RSTB_WAIT_S); /* was 1 */
-#if CONFIG_IDF_TARGET_ESP32
-    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_START_WAIT, 10, SYSCON_SARADC_START_WAIT_S);
-#endif
-    SET_PERI_REG_BITS(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_WORK_MODE, 0, SYSCON_SARADC_WORK_MODE_S);
-    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR_SEL);
-    CLEAR_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_DATA_SAR_SEL);
-
-    SET_PERI_REG_BITS(I2S_SAMPLE_RATE_CONF_REG(0), I2S_RX_BCK_DIV_NUM, 20, I2S_RX_BCK_DIV_NUM_S);
-
-    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_DATA_TO_I2S);
-
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
-    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
-    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
-    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
-    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
-}
-
-void bootloader_random_disable(void)
-{
-    /* Reset some i2s configuration (possibly redundant as we reset entire
-       I2S peripheral further down). */
-    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
-    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
-    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
-
-    /* Disable i2s clock */
-#ifdef BOOTLOADER_BUILD
-    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
-#else
-    periph_module_disable(PERIPH_I2S0_MODULE);
-#endif // BOOTLOADER_BUILD
-
-    /* Restore SYSCON mode registers */
-#if CONFIG_IDF_TARGET_ESP32
-    CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);
-    CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL2_REG, SENS_SAR2_DIG_FORCE);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
-#endif
-
-#if CONFIG_IDF_TARGET_ESP32
-    /* Restore SAR ADC mode */
-    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_SAR2_EN_TEST);
-    CLEAR_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR2_MUX
-                        | SYSCON_SARADC_SAR_SEL | SYSCON_SARADC_DATA_TO_I2S);
-    SET_PERI_REG_BITS(SENS_SAR_MEAS_WAIT2_REG, SENS_FORCE_XPD_SAR, 0, SENS_FORCE_XPD_SAR_S);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS2_CTRL1_REG, SENS_SAR2_EN_TEST);
-    CLEAR_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR_SEL | SYSCON_SARADC_DATA_TO_I2S);
-    SET_PERI_REG_BITS(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 0, SENS_FORCE_XPD_SAR_S);
-#endif
-
-#if CONFIG_IDF_TARGET_ESP32
-    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_START_WAIT, 8, SYSCON_SARADC_START_WAIT_S);
-#endif
-
-    /* Reset i2s peripheral */
-#ifdef BOOTLOADER_BUILD
-    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, DPORT_I2S0_RST);
-    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, DPORT_I2S0_RST);
-#else
-    periph_module_reset(PERIPH_I2S0_MODULE);
-#endif
-
-    /* Disable pull supply voltage to SAR ADC */
-    CLEAR_PERI_REG_MASK(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_ENT_RTC);
-    SET_PERI_REG_BITS(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_DTEST_RTC, 0, RTC_CNTL_DTEST_RTC_S);
-}

components/bootloader_support/src/bootloader_random_esp32.c

@@ -0,0 +1,128 @@
+// Copyright 2016-2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include "sdkconfig.h"
+#include "bootloader_random.h"
+#include "soc/rtc_periph.h"
+#include "soc/sens_periph.h"
+#include "soc/syscon_periph.h"
+#include "soc/dport_reg.h"
+#include "soc/i2s_periph.h"
+#include "esp_log.h"
+#include "soc/io_mux_reg.h"
+
+#ifndef BOOTLOADER_BUILD
+#include "driver/periph_ctrl.h"
+#endif
+
+void bootloader_random_enable(void)
+{
+    /* Ensure the hardware RNG is enabled following a soft reset.  This should always be the case already (this clock is
+       never disabled while the CPU is running), this is a "belts and braces" type check.
+     */
+#ifdef BOOTLOADER_BUILD
+    DPORT_SET_PERI_REG_MASK(DPORT_WIFI_CLK_EN_REG, DPORT_WIFI_CLK_RNG_EN);
+#else
+    periph_module_enable(PERIPH_RNG_MODULE);
+#endif // BOOTLOADER_BUILD
+
+    /* Enable SAR ADC in test mode to feed ADC readings of the 1.1V
+       reference via I2S into the RNG entropy input.
+
+       Note: I2S requires the PLL to be running, so the call to rtc_set_cpu_freq(CPU_80M)
+       in early bootloader startup must have been made.
+    */
+    SET_PERI_REG_BITS(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_DTEST_RTC, 2, RTC_CNTL_DTEST_RTC_S);
+    SET_PERI_REG_MASK(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_ENT_RTC);
+    SET_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_SAR2_EN_TEST);
+
+#ifdef BOOTLOADER_BUILD
+    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
+#else
+    periph_module_enable(PERIPH_I2S0_MODULE);
+#endif // BOOTLOADER_BUILD
+    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_ULP_CP_FORCE_START_TOP);
+    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_ULP_CP_START_TOP);
+
+    // Test pattern configuration byte 0xAD:
+    //--[7:4] channel_sel: 10-->en_test
+    //--[3:2] bit_width  : 3-->12bit
+    //--[1:0] atten      : 1-->3dB attenuation
+    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB1_REG, 0xADADADAD);
+    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB2_REG, 0xADADADAD);
+    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB3_REG, 0xADADADAD);
+    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB4_REG, 0xADADADAD);
+    SET_PERI_REG_BITS(SENS_SAR_MEAS_WAIT2_REG, SENS_FORCE_XPD_SAR, 3, SENS_FORCE_XPD_SAR_S);
+    SET_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);
+    SET_PERI_REG_MASK(SENS_SAR_READ_CTRL2_REG, SENS_SAR2_DIG_FORCE);
+
+    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR2_MUX);
+    SET_PERI_REG_BITS(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR_CLK_DIV, 4, SYSCON_SARADC_SAR_CLK_DIV_S);
+    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_RSTB_WAIT, 8, SYSCON_SARADC_RSTB_WAIT_S); /* was 1 */
+    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_START_WAIT, 10, SYSCON_SARADC_START_WAIT_S);
+    SET_PERI_REG_BITS(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_WORK_MODE, 0, SYSCON_SARADC_WORK_MODE_S);
+    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR_SEL);
+    CLEAR_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_DATA_SAR_SEL);
+    SET_PERI_REG_BITS(I2S_SAMPLE_RATE_CONF_REG(0), I2S_RX_BCK_DIV_NUM, 20, I2S_RX_BCK_DIV_NUM_S);
+    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_DATA_TO_I2S);
+
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
+    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
+    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
+    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
+    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
+}
+
+void bootloader_random_disable(void)
+{
+    /* Reset some i2s configuration (possibly redundant as we reset entire
+       I2S peripheral further down). */
+    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
+    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
+    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
+
+    /* Disable i2s clock */
+#ifdef BOOTLOADER_BUILD
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
+#else
+    periph_module_disable(PERIPH_I2S0_MODULE);
+#endif // BOOTLOADER_BUILD
+
+    /* Restore SYSCON mode registers */
+    CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);
+    CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL2_REG, SENS_SAR2_DIG_FORCE);
+
+    /* Restore SAR ADC mode */
+    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_SAR2_EN_TEST);
+    CLEAR_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR2_MUX
+                        | SYSCON_SARADC_SAR_SEL | SYSCON_SARADC_DATA_TO_I2S);
+    SET_PERI_REG_BITS(SENS_SAR_MEAS_WAIT2_REG, SENS_FORCE_XPD_SAR, 0, SENS_FORCE_XPD_SAR_S);
+
+    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_START_WAIT, 8, SYSCON_SARADC_START_WAIT_S);
+
+    /* Reset i2s peripheral */
+#ifdef BOOTLOADER_BUILD
+    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, DPORT_I2S0_RST);
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, DPORT_I2S0_RST);
+#else
+    periph_module_reset(PERIPH_I2S0_MODULE);
+#endif
+
+    /* Disable pull supply voltage to SAR ADC */
+    CLEAR_PERI_REG_MASK(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_ENT_RTC);
+    SET_PERI_REG_BITS(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_DTEST_RTC, 0, RTC_CNTL_DTEST_RTC_S);
+}

components/bootloader_support/src/bootloader_random_esp32s2.c

@@ -0,0 +1,106 @@
+// Copyright 2019-2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include "sdkconfig.h"
+#include "bootloader_random.h"
+#include "soc/rtc_periph.h"
+#include "soc/sens_periph.h"
+#include "soc/syscon_periph.h"
+#include "soc/dport_reg.h"
+#include "soc/i2s_periph.h"
+#include "esp_log.h"
+#include "soc/io_mux_reg.h"
+#include "soc/apb_saradc_reg.h"
+#include "regi2c_ctrl.h"
+#include "hal/adc_ll.h"
+
+#ifndef BOOTLOADER_BUILD
+#include "driver/periph_ctrl.h"
+#endif
+
+void bootloader_random_enable(void)
+{
+    /* Ensure the Wifi clock for RNG modiule is enabled following a soft reset.  This should always be the case already
+       (this clock is never disabled while the CPU is running), this is a "belt and braces" type check.
+     */
+#ifdef BOOTLOADER_BUILD
+    DPORT_SET_PERI_REG_MASK(DPORT_WIFI_CLK_EN_REG, DPORT_WIFI_CLK_RNG_EN);
+#else
+    periph_module_enable(PERIPH_RNG_MODULE);
+#endif // BOOTLOADER_BUILD
+
+    // Enable 8M clock source for RNG (this is actually enough to produce strong random results,
+    // but enabling the SAR ADC as well adds some insurance.)
+    REG_SET_BIT(RTC_CNTL_CLK_CONF_REG, RTC_CNTL_DIG_CLK8M_EN);
+
+    // Enable SAR ADC to read a disconnected input for additional entropy
+    SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN0_REG,DPORT_APB_SARADC_CLK_EN);
+
+    REG_SET_FIELD(APB_SARADC_APB_ADC_CLKM_CONF_REG, APB_SARADC_CLK_SEL, 2);
+
+    CLEAR_PERI_REG_MASK(RTC_CNTL_ANA_CONF_REG, RTC_CNTL_SAR_I2C_FORCE_PD_M);
+    SET_PERI_REG_MASK(RTC_CNTL_ANA_CONF_REG, RTC_CNTL_SAR_I2C_FORCE_PU_M);
+    CLEAR_PERI_REG_MASK(ANA_CONFIG_REG, BIT(18));
+    SET_PERI_REG_MASK(ANA_CONFIG2_REG, BIT(16));
+
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_DREF_ADDR, 0x4);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR2_DREF_ADDR, 0x4);
+
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENCAL_REF_ADDR, 1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_TSENS_ADDR, 1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
+
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR1_PATT_LEN, 0);
+    WRITE_PERI_REG(APB_SARADC_SAR1_PATT_TAB1_REG,0xafffffff);    // set adc1 channel & bitwidth & atten
+
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR2_PATT_LEN, 0);
+    WRITE_PERI_REG(APB_SARADC_SAR2_PATT_TAB1_REG,0xafffffff); //set adc2 channel & bitwidth & atten
+
+    SET_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG,SENS_SAR1_DIG_FORCE);
+
+    REG_SET_FIELD(APB_SARADC_CTRL_REG,APB_SARADC_WORK_MODE, 1);
+
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL2_REG,APB_SARADC_MEAS_NUM_LIMIT);
+
+    REG_SET_FIELD(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 3);
+
+    SET_PERI_REG_MASK(APB_SARADC_CTRL2_REG,APB_SARADC_TIMER_SEL);
+
+    REG_SET_FIELD(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_TARGET, 100);
+
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL_REG,APB_SARADC_START_FORCE);
+
+    SET_PERI_REG_MASK(APB_SARADC_CTRL2_REG,APB_SARADC_TIMER_EN);
+}
+
+void bootloader_random_disable(void)
+{
+    /* Restore internal I2C bus state */
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_DREF_ADDR, 0x1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR2_DREF_ADDR, 0x1);
+
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENCAL_REF_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_TSENS_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
+
+    /* Restore SARADC to default mode */
+    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
+    SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN0_REG, DPORT_APB_SARADC_CLK_EN);
+    SET_PERI_REG_BITS(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 0, SENS_FORCE_XPD_SAR_S);
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_EN);
+
+    /* Note: the 8M CLK entropy source continues running even after this function is called,
+       but as mentioned above it's better to enable Wi-Fi or BT or call bootloader_random_enable()
+       in order to get a secondary entropy source.
+    */
+}

components/bootloader_support/src/bootloader_utility.c

@@ -29,16 +29,18 @@
 #include "esp32/rom/uart.h"
 #include "esp32/rom/gpio.h"
 #include "esp32/rom/secure_boot.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/cache.h"
-#include "esp32s2beta/rom/efuse.h"
-#include "esp32s2beta/rom/ets_sys.h"
-#include "esp32s2beta/rom/spi_flash.h"
-#include "esp32s2beta/rom/crc.h"
-#include "esp32s2beta/rom/rtc.h"
-#include "esp32s2beta/rom/uart.h"
-#include "esp32s2beta/rom/gpio.h"
-#include "esp32s2beta/rom/secure_boot.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/cache.h"
+#include "esp32s2/rom/efuse.h"
+#include "esp32s2/rom/ets_sys.h"
+#include "esp32s2/rom/spi_flash.h"
+#include "esp32s2/rom/crc.h"
+#include "esp32s2/rom/rtc.h"
+#include "esp32s2/rom/uart.h"
+#include "esp32s2/rom/gpio.h"
+#include "esp32s2/rom/secure_boot.h"
+#include "soc/extmem_reg.h"
+#include "soc/cache_memory.h"
 #else
 #error "Unsupported IDF_TARGET"
 #endif
@@ -376,7 +378,7 @@ int bootloader_utility_get_selected_boot_partition(const bootloader_state_t *bs)
 #endif // CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
 
 #ifdef CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
-            if(otadata[active_otadata].ota_state == ESP_OTA_IMG_VALID) {
+            if (otadata[active_otadata].ota_state == ESP_OTA_IMG_VALID) {
                 update_anti_rollback(&bs->ota[boot_index]);
             }
 #endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
@@ -439,7 +441,7 @@ static void set_actual_ota_seq(const bootloader_state_t *bs, int index)
 void bootloader_utility_load_boot_image_from_deep_sleep(void)
 {
     if (rtc_get_reset_reason(0) == DEEPSLEEP_RESET) {
-        esp_partition_pos_t* partition = bootloader_common_get_rtc_retain_mem_partition();
+        esp_partition_pos_t *partition = bootloader_common_get_rtc_retain_mem_partition();
         if (partition != NULL) {
             esp_image_metadata_t image_data;
             if (bootloader_load_image_no_verify(partition, &image_data) == ESP_OK) {
@@ -555,11 +557,19 @@ static void load_image(const esp_image_metadata_t *image_data)
      * then Step 6 enables secure boot.
      */
 
-#if defined(CONFIG_SECURE_BOOT_ENABLED) || defined(CONFIG_SECURE_FLASH_ENC_ENABLED)
+#if defined(CONFIG_SECURE_BOOT) || defined(CONFIG_SECURE_FLASH_ENC_ENABLED)
     esp_err_t err;
 #endif
 
-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef CONFIG_SECURE_BOOT_V2_ENABLED
+    err = esp_secure_boot_v2_permanently_enable(image_data);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Secure Boot v2 failed (%d)", err);
+        return;
+    }
+#endif
+
+#ifdef CONFIG_SECURE_BOOT_V1_ENABLED
     /* Steps 1 & 2 (see above for full description):
      *   1) Generate secure boot EFUSE key
      *   2) Compute digest of plaintext bootloader
@@ -586,7 +596,7 @@ static void load_image(const esp_image_metadata_t *image_data)
     }
 #endif
 
-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef CONFIG_SECURE_BOOT_V1_ENABLED
     /* Step 6 (see above for full description):
      *   6) Burn EFUSE to enable secure boot
      */
@@ -613,9 +623,7 @@ static void load_image(const esp_image_metadata_t *image_data)
 #endif
 
     ESP_LOGI(TAG, "Disabling RNG early entropy source...");
-#if !CONFIG_IDF_ENV_FPGA
     bootloader_random_disable();
-#endif
 
     // copy loaded segments to RAM, set up caches for mapped segments, and start application
     unpack_load_app(image_data);
@@ -679,7 +687,7 @@ static void set_cache_and_start_app(
 #if CONFIG_IDF_TARGET_ESP32
     Cache_Read_Disable(0);
     Cache_Flush(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     uint32_t autoload = Cache_Suspend_ICache();
     Cache_Invalidate_ICache_All();
 #endif
@@ -687,19 +695,23 @@ static void set_cache_and_start_app(
     /* Clear the MMU entries that are already set up,
        so the new app only has the mappings it creates.
     */
+#if CONFIG_IDF_TARGET_ESP32
     for (int i = 0; i < DPORT_FLASH_MMU_TABLE_SIZE; i++) {
         DPORT_PRO_FLASH_MMU_TABLE[i] = DPORT_FLASH_MMU_TABLE_INVALID_VAL;
     }
-
+#elif CONFIG_IDF_TARGET_ESP32S2
+    for (int i = 0; i < FLASH_MMU_TABLE_SIZE; i++) {
+        FLASH_MMU_TABLE[i] = MMU_TABLE_INVALID_VAL;
+    }
+#endif
     uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK;
     uint32_t drom_page_count = bootloader_cache_pages_to_map(drom_size, drom_load_addr);
     ESP_LOGV(TAG, "d mmu set paddr=%08x vaddr=%08x size=%d n=%d",
              drom_addr & MMU_FLASH_MASK, drom_load_addr_aligned, drom_size, drom_page_count);
 #if CONFIG_IDF_TARGET_ESP32
     rc = cache_flash_mmu_set(0, 0, drom_load_addr_aligned, drom_addr & MMU_FLASH_MASK, 64, drom_page_count);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    rc = Cache_Ibus_MMU_Set(DPORT_MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000,
-                                64, drom_page_count, 0);
+#elif CONFIG_IDF_TARGET_ESP32S2
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count, 0);
 #endif
     ESP_LOGV(TAG, "rc=%d", rc);
 #if CONFIG_IDF_TARGET_ESP32
@@ -712,27 +724,17 @@ static void set_cache_and_start_app(
              irom_addr & MMU_FLASH_MASK, irom_load_addr_aligned, irom_size, irom_page_count);
 #if CONFIG_IDF_TARGET_ESP32
     rc = cache_flash_mmu_set(0, 0, irom_load_addr_aligned, irom_addr & MMU_FLASH_MASK, 64, irom_page_count);
-    ESP_LOGV(TAG, "rc=%d", rc);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    uint32_t iram1_used = 0, irom0_used = 0;
+#elif CONFIG_IDF_TARGET_ESP32S2
+    uint32_t iram1_used = 0;
     if (irom_load_addr + irom_size > IRAM1_ADDRESS_LOW) {
         iram1_used = 1;
     }
-    if (irom_load_addr + irom_size > IROM0_ADDRESS_LOW) {
-        irom0_used = 1;
+    if (iram1_used) {
+        rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, IRAM0_ADDRESS_LOW, 0, 64, 64, 1);
+        rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, IRAM1_ADDRESS_LOW, 0, 64, 64, 1);
+        REG_CLR_BIT(EXTMEM_PRO_ICACHE_CTRL1_REG, EXTMEM_PRO_ICACHE_MASK_IRAM1);
     }
-    if (iram1_used || irom0_used) {
-        rc = Cache_Ibus_MMU_Set(DPORT_MMU_ACCESS_FLASH, IRAM0_ADDRESS_LOW, 0, 64, 64, 1);
-        rc = Cache_Ibus_MMU_Set(DPORT_MMU_ACCESS_FLASH, IRAM1_ADDRESS_LOW, 0, 64, 64, 1);
-        REG_SET_BIT(DPORT_CACHE_SOURCE_1_REG, DPORT_PRO_CACHE_I_SOURCE_PRO_IRAM1);
-        REG_CLR_BIT(DPORT_PRO_ICACHE_CTRL1_REG, DPORT_PRO_ICACHE_MASK_IRAM1);
-        if (irom0_used) {
-            rc = Cache_Ibus_MMU_Set(DPORT_MMU_ACCESS_FLASH, IROM0_ADDRESS_LOW, 0, 64, 64, 1);
-            REG_SET_BIT(DPORT_CACHE_SOURCE_1_REG, DPORT_PRO_CACHE_I_SOURCE_PRO_IROM0);
-            REG_CLR_BIT(DPORT_PRO_ICACHE_CTRL1_REG, DPORT_PRO_ICACHE_MASK_IROM0);
-        }
-    }
-    rc = Cache_Ibus_MMU_Set(DPORT_MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
 #endif
     ESP_LOGV(TAG, "rc=%d", rc);
 #if CONFIG_IDF_TARGET_ESP32
@@ -746,12 +748,12 @@ static void set_cache_and_start_app(
                        (DPORT_APP_CACHE_MASK_IRAM0) | (DPORT_APP_CACHE_MASK_IRAM1 & 0) |
                        (DPORT_APP_CACHE_MASK_IROM0 & 0) | DPORT_APP_CACHE_MASK_DROM0 |
                        DPORT_APP_CACHE_MASK_DRAM1 );
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    DPORT_REG_CLR_BIT( DPORT_PRO_ICACHE_CTRL1_REG, (DPORT_PRO_ICACHE_MASK_IRAM0) | (DPORT_PRO_ICACHE_MASK_IRAM1 & 0) | (DPORT_PRO_ICACHE_MASK_IROM0 & 0) | DPORT_PRO_ICACHE_MASK_DROM0 );
+#elif CONFIG_IDF_TARGET_ESP32S2
+    REG_CLR_BIT( EXTMEM_PRO_ICACHE_CTRL1_REG, (EXTMEM_PRO_ICACHE_MASK_IRAM0) | (EXTMEM_PRO_ICACHE_MASK_IRAM1 & 0) | EXTMEM_PRO_ICACHE_MASK_DROM0 );
 #endif
 #if CONFIG_IDF_TARGET_ESP32
     Cache_Read_Enable(0);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     Cache_Resume_ICache(autoload);
 #endif
     // Application will need to do Cache_Flush(1) and Cache_Read_Enable(1)
@@ -816,3 +818,38 @@ void bootloader_debug_buffer(const void *buffer, size_t length, const char *labe
     ESP_LOGD(TAG, "%s: %s", label, hexbuf);
 #endif
 }
+
+esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
+{
+
+    if (digest == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    /* Handling firmware images larger than MMU capacity */
+    uint32_t mmu_free_pages_count = bootloader_mmap_get_free_pages();
+    bootloader_sha256_handle_t sha_handle = NULL;
+
+    sha_handle = bootloader_sha256_start();
+    if (sha_handle == NULL) {
+        return ESP_ERR_NO_MEM;
+    }
+
+    while (len > 0) {
+        uint32_t mmu_page_offset = ((flash_offset & MMAP_ALIGNED_MASK) != 0) ? 1 : 0; /* Skip 1st MMU Page if it is already populated */
+        uint32_t partial_image_len = MIN(len, ((mmu_free_pages_count - mmu_page_offset) * SPI_FLASH_MMU_PAGE_SIZE)); /* Read the image that fits in the free MMU pages */
+
+        const void * image = bootloader_mmap(flash_offset, partial_image_len);
+        if (image == NULL) {
+            bootloader_sha256_finish(sha_handle, NULL);
+            return ESP_FAIL;
+        }
+        bootloader_sha256_data(sha_handle, image, partial_image_len);
+        bootloader_munmap(image);
+
+        flash_offset += partial_image_len;
+        len -= partial_image_len;
+    }
+    bootloader_sha256_finish(sha_handle, digest);
+    return ESP_OK;
+}

components/bootloader_support/src/esp32/bootloader_esp32.c

@@ -22,10 +22,12 @@
 #include "bootloader_clock.h"
 #include "bootloader_common.h"
 #include "bootloader_flash_config.h"
+#include "bootloader_mem.h"
 
 #include "soc/cpu.h"
 #include "soc/dport_reg.h"
 #include "soc/efuse_reg.h"
+#include "soc/gpio_periph.h"
 #include "soc/gpio_sig_map.h"
 #include "soc/io_mux_reg.h"
 #include "soc/rtc.h"
@@ -53,18 +55,11 @@ void bootloader_configure_spi_pins(int drv)
     uint32_t chip_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
     uint32_t pkg_ver = chip_ver & 0x7;
 
-    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
-        // For ESP32D2WD the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
-        // For ESP32PICOD2 the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
-        // For ESP32PICOD4 the SPI pins are already configured
+    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302) {
+        // For ESP32D2WD or ESP32-PICO series,the SPI pins are already configured
         // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
@@ -362,9 +357,6 @@ static void wdt_reset_info_dump(int cpu)
         lsstat = DPORT_REG_READ(DPORT_APP_CPU_RECORD_PDEBUGLS0STAT_REG);
         lsaddr = DPORT_REG_READ(DPORT_APP_CPU_RECORD_PDEBUGLS0ADDR_REG);
         lsdata = DPORT_REG_READ(DPORT_APP_CPU_RECORD_PDEBUGLS0DATA_REG);
-#else
-        ESP_LOGE(TAG, "WDT reset info: &s CPU not support!\n", cpu_name);
-        return;
 #endif
     }
 
@@ -405,14 +397,16 @@ static void bootloader_check_wdt_reset(void)
     if (wdt_rst) {
         // if reset by WDT dump info from trace port
         wdt_reset_info_dump(0);
+#if !CONFIG_FREERTOS_UNICORE
         wdt_reset_info_dump(1);
+#endif
     }
     wdt_reset_cpu0_info_enable();
 }
 
 void abort(void)
 {
-#if !CONFIG_ESP32_PANIC_SILENT_REBOOT
+#if !CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT
     ets_printf("abort() was called at PC 0x%08x\r\n", (intptr_t)__builtin_return_address(0) - 3);
 #endif
     if (esp_cpu_in_ocd_debug_mode()) {
@@ -425,10 +419,9 @@ void abort(void)
 esp_err_t bootloader_init(void)
 {
     esp_err_t ret = ESP_OK;
-    // workaround for tensilica erratum572
-    cpu_init_memctl();
-    // protect memory region
-    cpu_configure_region_protection();
+
+    bootloader_init_mem();
+
     // check that static RAM is after the stack
 #ifndef NDEBUG
     {

components/bootloader_support/src/esp32/flash_encrypt.c

@@ -22,7 +22,7 @@
 #include "esp_efuse.h"
 #include "esp_log.h"
 #include "esp32/rom/secure_boot.h"
-#include "soc/rtc_wdt.h"
+#include "hal/wdt_hal.h"
 
 #include "esp32/rom/cache.h"
 #include "esp32/rom/spi_flash.h"   /* TODO: Remove this */
@@ -73,6 +73,10 @@ esp_err_t esp_flash_encrypt_check_and_update(void)
 
 static esp_err_t initialise_flash_encryption(void)
 {
+    uint32_t new_wdata0 = 0;
+    uint32_t new_wdata5 = 0;
+    uint32_t new_wdata6 = 0;
+
     uint32_t coding_scheme = REG_GET_FIELD(EFUSE_BLK0_RDATA6_REG, EFUSE_CODING_SCHEME);
     if (coding_scheme != EFUSE_CODING_SCHEME_VAL_NONE && coding_scheme != EFUSE_CODING_SCHEME_VAL_34) {
         ESP_LOGE(TAG, "Unknown/unsupported CODING_SCHEME value 0x%x", coding_scheme);
@@ -97,11 +101,10 @@ static esp_err_t initialise_flash_encryption(void)
         && REG_READ(EFUSE_BLK1_RDATA7_REG) == 0) {
         ESP_LOGI(TAG, "Generating new flash encryption key...");
         esp_efuse_write_random_key(EFUSE_BLK1_WDATA0_REG);
-        esp_efuse_burn_new_values();
+        // defer efuse programming step to the end
 
         ESP_LOGI(TAG, "Read & write protecting new key...");
-        REG_WRITE(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_BLK1 | EFUSE_RD_DIS_BLK1);
-        esp_efuse_burn_new_values();
+        new_wdata0 |= EFUSE_WR_DIS_BLK1 | EFUSE_RD_DIS_BLK1;
     } else {
 
         if(!(efuse_key_read_protected && efuse_key_write_protected)) {
@@ -122,34 +125,36 @@ static esp_err_t initialise_flash_encryption(void)
        operation does nothing. Please note this is not recommended!
     */
     ESP_LOGI(TAG, "Setting CRYPT_CONFIG efuse to 0xF");
-    REG_WRITE(EFUSE_BLK0_WDATA5_REG, EFUSE_FLASH_CRYPT_CONFIG_M);
-    esp_efuse_burn_new_values();
+    new_wdata5 |= EFUSE_FLASH_CRYPT_CONFIG_M;
 
-    uint32_t new_wdata6 = 0;
 #ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
     ESP_LOGI(TAG, "Disable UART bootloader encryption...");
     new_wdata6 |= EFUSE_DISABLE_DL_ENCRYPT;
 #else
     ESP_LOGW(TAG, "Not disabling UART bootloader encryption");
 #endif
+
 #ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC
     ESP_LOGI(TAG, "Disable UART bootloader decryption...");
     new_wdata6 |= EFUSE_DISABLE_DL_DECRYPT;
 #else
     ESP_LOGW(TAG, "Not disabling UART bootloader decryption - SECURITY COMPROMISED");
 #endif
+
 #ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
     ESP_LOGI(TAG, "Disable UART bootloader MMU cache...");
     new_wdata6 |= EFUSE_DISABLE_DL_CACHE;
 #else
     ESP_LOGW(TAG, "Not disabling UART bootloader MMU cache - SECURITY COMPROMISED");
 #endif
+
 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
     ESP_LOGI(TAG, "Disable JTAG...");
     new_wdata6 |= EFUSE_RD_DISABLE_JTAG;
 #else
     ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
 #endif
+
 #ifndef CONFIG_SECURE_BOOT_ALLOW_ROM_BASIC
     ESP_LOGI(TAG, "Disable ROM BASIC interpreter fallback...");
     new_wdata6 |= EFUSE_RD_CONSOLE_DEBUG_DISABLE;
@@ -157,10 +162,16 @@ static esp_err_t initialise_flash_encryption(void)
     ESP_LOGW(TAG, "Not disabling ROM BASIC fallback - SECURITY COMPROMISED");
 #endif
 
-    if (new_wdata6 != 0) {
-        REG_WRITE(EFUSE_BLK0_WDATA6_REG, new_wdata6);
-        esp_efuse_burn_new_values();
-    }
+#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
+    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
+    // otherwise the Flash Encryption key cannot be read protected
+    new_wdata0 |= EFUSE_WR_DIS_RD_DIS;
+#endif
+
+    REG_WRITE(EFUSE_BLK0_WDATA0_REG, new_wdata0);
+    REG_WRITE(EFUSE_BLK0_WDATA5_REG, new_wdata5);
+    REG_WRITE(EFUSE_BLK0_WDATA6_REG, new_wdata6);
+    esp_efuse_burn_new_values();
 
     return ESP_OK;
 }
@@ -210,16 +221,19 @@ static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_cry
 
     ESP_LOGD(TAG, "All flash regions checked for encryption pass");
 
+    uint32_t new_flash_crypt_cnt;
+#ifdef CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
+    // Go straight to max, permanently enabled
+    ESP_LOGI(TAG, "Setting FLASH_CRYPT_CNT for permanent encryption");
+    new_flash_crypt_cnt = EFUSE_FLASH_CRYPT_CNT;
+#else
     /* Set least significant 0-bit in flash_crypt_cnt */
     int ffs_inv = __builtin_ffs((~flash_crypt_cnt) & EFUSE_RD_FLASH_CRYPT_CNT);
     /* ffs_inv shouldn't be zero, as zero implies flash_crypt_cnt == EFUSE_RD_FLASH_CRYPT_CNT (0x7F) */
-    uint32_t new_flash_crypt_cnt = flash_crypt_cnt + (1 << (ffs_inv - 1));
+    new_flash_crypt_cnt = flash_crypt_cnt + (1 << (ffs_inv - 1));
+#endif
     ESP_LOGD(TAG, "FLASH_CRYPT_CNT 0x%x -> 0x%x", flash_crypt_cnt, new_flash_crypt_cnt);
     uint32_t wdata0_reg = ((new_flash_crypt_cnt & EFUSE_FLASH_CRYPT_CNT) << EFUSE_FLASH_CRYPT_CNT_S);
-#ifdef CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
-    ESP_LOGI(TAG, "Write protecting FLASH_CRYPT_CNT eFuse");
-    wdata0_reg |= EFUSE_WR_DIS_FLASH_CRYPT_CNT;
-#endif
 
     REG_WRITE(EFUSE_BLK0_WDATA0_REG, wdata0_reg);
     esp_efuse_burn_new_values();
@@ -236,13 +250,24 @@ static esp_err_t encrypt_bootloader(void)
     /* Check for plaintext bootloader (verification will fail if it's already encrypted) */
     if (esp_image_verify_bootloader(&image_length) == ESP_OK) {
         ESP_LOGD(TAG, "bootloader is plaintext. Encrypting...");
+
+#if CONFIG_SECURE_BOOT_V2_ENABLED
+        // Account for the signature sector after the bootloader
+        image_length = (image_length + FLASH_SECTOR_SIZE - 1) & ~(FLASH_SECTOR_SIZE - 1);
+        image_length += FLASH_SECTOR_SIZE;
+        if (ESP_BOOTLOADER_OFFSET + image_length > ESP_PARTITION_TABLE_OFFSET) {
+            ESP_LOGE(TAG, "Bootloader is too large to fit Secure Boot V2 signature sector and partition table (configured offset 0x%x)", ESP_PARTITION_TABLE_OFFSET);
+            return ESP_ERR_INVALID_STATE;
+        }
+#endif // CONFIG_SECURE_BOOT_V2_ENABLED
+
         err = esp_flash_encrypt_region(ESP_BOOTLOADER_OFFSET, image_length);
         if (err != ESP_OK) {
             ESP_LOGE(TAG, "Failed to encrypt bootloader in place: 0x%x", err);
             return err;
         }
 
-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef CONFIG_SECURE_BOOT_V1_ENABLED
         /* If secure boot is enabled and bootloader was plaintext, also
          * need to encrypt secure boot IV+digest.
          */
@@ -334,8 +359,11 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length)
         return ESP_FAIL;
     }
 
+    wdt_hal_context_t rtc_wdt_ctx = {.inst = WDT_RWDT, .rwdt_dev = &RTCCNTL};
     for (size_t i = 0; i < data_length; i += FLASH_SECTOR_SIZE) {
-        rtc_wdt_feed();
+        wdt_hal_write_protect_disable(&rtc_wdt_ctx);
+        wdt_hal_feed(&rtc_wdt_ctx);
+        wdt_hal_write_protect_enable(&rtc_wdt_ctx);
         uint32_t sec_start = i + src_addr;
         err = bootloader_flash_read(sec_start, buf, FLASH_SECTOR_SIZE, false);
         if (err != ESP_OK) {
@@ -355,4 +383,4 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length)
  flash_failed:
     ESP_LOGE(TAG, "flash operation failed: 0x%x", err);
     return err;
-}
+}

components/bootloader_support/src/esp32/secure_boot.c

@@ -20,10 +20,12 @@
 
 #include "esp32/rom/cache.h"
 #include "esp32/rom/ets_sys.h"
-#include "esp32/rom/secure_boot.h"
+#include "esp32/rom/crc.h"
 
 #include "soc/efuse_periph.h"
 #include "soc/rtc_periph.h"
+#include "bootloader_sha.h"
+#include "bootloader_utility.h"
 
 #include "sdkconfig.h"
 
@@ -38,8 +40,8 @@
  * from the bootloader code.
  */
 
-static const char* TAG = "secure_boot";
-
+#ifdef CONFIG_SECURE_BOOT_V1_ENABLED
+static const char *TAG = "secure_boot_v1";
 /**
  *  @function :     secure_boot_generate
  *  @description:   generate boot digest (aka "abstract") & iv
@@ -94,12 +96,6 @@ static bool secure_boot_generate(uint32_t image_len){
     return true;
 }
 
-/* Burn values written to the efuse write registers */
-static inline void burn_efuses(void)
-{
-    esp_efuse_burn_new_values();
-}
-
 esp_err_t esp_secure_boot_generate_digest(void)
 {
     esp_err_t err;
@@ -139,7 +135,7 @@ esp_err_t esp_secure_boot_generate_digest(void)
         && REG_READ(EFUSE_BLK2_RDATA7_REG) == 0) {
         ESP_LOGI(TAG, "Generating new secure boot key...");
         esp_efuse_write_random_key(EFUSE_BLK2_WDATA0_REG);
-        burn_efuses();
+        esp_efuse_burn_new_values();
     } else {
         ESP_LOGW(TAG, "Using pre-loaded secure boot key in EFUSE block 2");
     }
@@ -162,6 +158,9 @@ esp_err_t esp_secure_boot_generate_digest(void)
 
 esp_err_t esp_secure_boot_permanently_enable(void)
 {
+    uint32_t new_wdata0 = 0;
+    uint32_t new_wdata6 = 0;
+
     if (esp_secure_boot_enabled()) {
         ESP_LOGI(TAG, "bootloader secure boot is already enabled, continuing..");
         return ESP_OK;
@@ -173,8 +172,7 @@ esp_err_t esp_secure_boot_permanently_enable(void)
     if (efuse_key_read_protected == false
         && efuse_key_write_protected == false) {
         ESP_LOGI(TAG, "Read & write protecting new key...");
-        REG_WRITE(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_BLK2 | EFUSE_RD_DIS_BLK2);
-        burn_efuses();
+        new_wdata0 = EFUSE_WR_DIS_BLK2 | EFUSE_RD_DIS_BLK2;
         efuse_key_read_protected = true;
         efuse_key_write_protected = true;
     }
@@ -191,7 +189,7 @@ esp_err_t esp_secure_boot_permanently_enable(void)
     ESP_LOGI(TAG, "blowing secure boot efuse...");
     ESP_LOGD(TAG, "before updating, EFUSE_BLK0_RDATA6 %x", REG_READ(EFUSE_BLK0_RDATA6_REG));
 
-    uint32_t new_wdata6 = EFUSE_RD_ABS_DONE_0;
+    new_wdata6 |= EFUSE_RD_ABS_DONE_0;
 
 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
     ESP_LOGI(TAG, "Disable JTAG...");
@@ -207,8 +205,9 @@ esp_err_t esp_secure_boot_permanently_enable(void)
     ESP_LOGW(TAG, "Not disabling ROM BASIC fallback - SECURITY COMPROMISED");
 #endif
 
+    REG_WRITE(EFUSE_BLK0_WDATA0_REG, new_wdata0);
     REG_WRITE(EFUSE_BLK0_WDATA6_REG, new_wdata6);
-    burn_efuses();
+    esp_efuse_burn_new_values();
     uint32_t after = REG_READ(EFUSE_BLK0_RDATA6_REG);
     ESP_LOGD(TAG, "after updating, EFUSE_BLK0_RDATA6 %x", after);
     if (after & EFUSE_RD_ABS_DONE_0) {
@@ -219,3 +218,208 @@ esp_err_t esp_secure_boot_permanently_enable(void)
         return ESP_ERR_INVALID_STATE;
     }
 }
+#elif CONFIG_SECURE_BOOT_V2_ENABLED
+
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
+static const char *TAG = "secure_boot_v2";
+
+#define SIG_BLOCK_MAGIC_BYTE 0xe7
+#define CRC_SIGN_BLOCK_LEN 1196
+#define SIG_BLOCK_PADDING 4096
+
+#define DIGEST_LEN 32
+
+static esp_err_t validate_signature_block(const ets_secure_boot_signature_t *sig_block, uint8_t *digest)
+{
+    uint32_t crc = crc32_le(0, (uint8_t *)sig_block, CRC_SIGN_BLOCK_LEN);
+    if (sig_block->block[0].magic_byte == SIG_BLOCK_MAGIC_BYTE && sig_block->block[0].block_crc == crc && !memcmp(digest, sig_block->block[0].image_digest, DIGEST_LEN)) {
+        ESP_LOGI(TAG, "valid signature block found");
+        return ESP_OK;
+    }
+    return ESP_FAIL;
+}
+
+static esp_err_t secure_boot_v2_digest_generate(uint32_t flash_offset, uint32_t flash_size, uint8_t *public_key_digest)
+{
+    esp_err_t ret = ESP_FAIL;
+
+    uint8_t image_digest[DIGEST_LEN] = {0};
+    size_t sig_block_addr = flash_offset + ALIGN_UP(flash_size, FLASH_SECTOR_SIZE);
+    ret = bootloader_sha256_flash_contents(flash_offset, sig_block_addr - flash_offset, image_digest);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "error generating image digest, %d", ret);
+        return ret;
+    }
+
+    ESP_LOGD(TAG, "reading signature block");
+    const ets_secure_boot_signature_t *sig_block = bootloader_mmap(sig_block_addr, sizeof(ets_secure_boot_signature_t));
+    if (sig_block == NULL) {
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", sig_block_addr, sizeof(ets_secure_boot_signature_t));
+        return ret;
+    }
+
+    /* Validating Signature block */
+    ret = validate_signature_block(sig_block, image_digest);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "signature block (address 0x%x) validation failed %d", sig_block_addr, ret);
+        goto done;
+    }
+
+    /* Verifying Signature block */
+    uint8_t verified_digest[DIGEST_LEN] = {0};
+
+    /* Generating the SHA of the public key components in the signature block */
+    bootloader_sha256_handle_t sig_block_sha;
+    sig_block_sha = bootloader_sha256_start();
+    bootloader_sha256_data(sig_block_sha, &sig_block->block[0].key, sizeof(sig_block->block[0].key));
+    bootloader_sha256_finish(sig_block_sha, public_key_digest);
+
+    secure_boot_v2_status_t error;
+    error = ets_secure_boot_verify_signature(sig_block, image_digest, public_key_digest, verified_digest);
+    if (error != SBV2_SUCCESS) {
+        ESP_LOGE(TAG, "secure boot v2 verification failed %d", error);
+        ret = ESP_FAIL;
+        goto done;
+    } else {
+        ret = ESP_OK;
+    }
+
+done:
+    bootloader_munmap(sig_block);
+    return ret;
+}
+
+esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *image_data)
+{
+    uint32_t new_wdata0 = 0;
+    uint32_t new_wdata6 = 0;
+
+    ESP_LOGI(TAG, "enabling secure boot v2...");
+    esp_err_t ret;
+    if (esp_secure_boot_enabled()) {
+        ESP_LOGI(TAG, "secure boot v2 is already enabled. Continuing..");
+        return ESP_OK;
+    }
+
+    uint32_t coding_scheme = REG_GET_FIELD(EFUSE_BLK0_RDATA6_REG, EFUSE_CODING_SCHEME);
+    if (coding_scheme != EFUSE_CODING_SCHEME_VAL_NONE) {
+        ESP_LOGE(TAG, "No coding schemes are supported in secure boot v2.(Detected scheme: 0x%x)", coding_scheme);
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
+    /* Verify the bootloader */
+    esp_image_metadata_t bootloader_data = { 0 };
+    ret = esp_image_verify_bootloader_data(&bootloader_data);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "bootloader image appears invalid! error %d", ret);
+        return ret;
+    }
+
+    uint8_t boot_pub_key_digest[DIGEST_LEN];
+    uint32_t dis_reg = REG_READ(EFUSE_BLK0_RDATA0_REG);
+    bool efuse_key_read_protected = dis_reg & EFUSE_RD_DIS_BLK2;
+    bool efuse_key_write_protected = dis_reg & EFUSE_WR_DIS_BLK2;
+    if (efuse_key_write_protected == false
+        && efuse_key_read_protected == false
+        && REG_READ(EFUSE_BLK2_RDATA0_REG) == 0
+        && REG_READ(EFUSE_BLK2_RDATA1_REG) == 0
+        && REG_READ(EFUSE_BLK2_RDATA2_REG) == 0
+        && REG_READ(EFUSE_BLK2_RDATA3_REG) == 0
+        && REG_READ(EFUSE_BLK2_RDATA4_REG) == 0
+        && REG_READ(EFUSE_BLK2_RDATA5_REG) == 0
+        && REG_READ(EFUSE_BLK2_RDATA6_REG) == 0
+        && REG_READ(EFUSE_BLK2_RDATA7_REG) == 0) {
+        /* Verifies the signature block appended to the image matches with the signature block of the app to be loaded */
+        ret = secure_boot_v2_digest_generate(bootloader_data.start_addr, bootloader_data.image_len - SIG_BLOCK_PADDING, boot_pub_key_digest);
+        if (ret != ESP_OK) {
+            ESP_LOGE(TAG, "Public key digest generation failed");
+            return ret;
+        }
+
+        ESP_LOGI(TAG, "Burning public key hash to efuse.");
+        uint32_t *boot_public_key_digest_ptr = (uint32_t *) boot_pub_key_digest;
+        for (int i = 0; i < 8 ; i++) {
+            REG_WRITE(EFUSE_BLK2_WDATA0_REG + 4 * i, boot_public_key_digest_ptr[i]);
+            ESP_LOGD(TAG, "EFUSE_BLKx_WDATA%d_REG = 0x%08x", i, boot_public_key_digest_ptr[i]);
+        }
+
+        ESP_LOGI(TAG, "Write protecting public key digest...");
+        new_wdata0 |= EFUSE_WR_DIS_BLK2;
+        efuse_key_write_protected = true;
+        efuse_key_read_protected = false;
+    } else {
+        ESP_LOGW(TAG, "Using pre-loaded secure boot v2 public key digest in EFUSE block 2");
+    }
+
+    uint8_t app_pub_key_digest[DIGEST_LEN];
+    ret = secure_boot_v2_digest_generate(image_data->start_addr, image_data->image_len - SIG_BLOCK_PADDING, app_pub_key_digest);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "Application signature block is invalid.");
+        return ret;
+    }
+
+    /* Confirming if the public key in the bootloader's signature block matches with the one in the application's signature block */
+    if (memcmp(boot_pub_key_digest, app_pub_key_digest, DIGEST_LEN) != 0) {
+        ESP_LOGE(TAG, "Application not signed with a valid private key.");
+        return ESP_FAIL;
+    }
+
+    if (efuse_key_read_protected) {
+        ESP_LOGE(TAG, "Efuse BLK2 (public key digest) is read protected. Refusing to blow secure boot efuse.");
+        return ESP_ERR_INVALID_STATE;
+    }
+    if (!efuse_key_write_protected) {
+        ESP_LOGE(TAG, "Efuse BLK2 (public key digest) is not write protected. Refusing to blow secure boot efuse.");
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    ESP_LOGI(TAG, "blowing secure boot efuse...");
+    ESP_LOGD(TAG, "before updating, EFUSE_BLK0_RDATA6 %x", REG_READ(EFUSE_BLK0_RDATA6_REG));
+
+    new_wdata6 |= EFUSE_RD_ABS_DONE_1;
+
+#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
+    ESP_LOGI(TAG, "Disable JTAG...");
+    new_wdata6 |= EFUSE_RD_DISABLE_JTAG;
+#else
+    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
+#endif
+
+#ifndef CONFIG_SECURE_BOOT_ALLOW_ROM_BASIC
+    ESP_LOGI(TAG, "Disable ROM BASIC interpreter fallback...");
+    new_wdata6 |= EFUSE_RD_CONSOLE_DEBUG_DISABLE;
+#else
+    ESP_LOGW(TAG, "Not disabling ROM BASIC fallback - SECURITY COMPROMISED");
+#endif
+
+#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
+    bool rd_dis_now = true;
+#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
+    /* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
+       when Flash Encryption is being enabled */
+    rd_dis_now = esp_flash_encryption_enabled();
+#endif
+    if (rd_dis_now) {
+        ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
+        new_wdata0 |= EFUSE_WR_DIS_RD_DIS;
+    }
+#else
+    ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
+#endif
+
+    REG_WRITE(EFUSE_BLK0_WDATA0_REG, new_wdata0);
+    REG_WRITE(EFUSE_BLK0_WDATA6_REG, new_wdata6);
+    esp_efuse_burn_new_values();
+    uint32_t after = REG_READ(EFUSE_BLK0_RDATA6_REG);
+    ESP_LOGD(TAG, "after updating, EFUSE_BLK0_RDATA0 0x%08x EFUSE_BLK0_RDATA6 0x%08x",
+             REG_READ(EFUSE_BLK0_RDATA0_REG), after);
+    if (after & EFUSE_RD_ABS_DONE_1) {
+        ESP_LOGI(TAG, "secure boot v2 is now enabled.");
+        return ESP_OK;
+    } else {
+        ESP_LOGE(TAG, " secure boot v2 not enabled, EFUSE_RD_ABS_DONE_1 is probably write protected!");
+        return ESP_ERR_INVALID_STATE;
+    }
+}
+
+#endif // CONFIG_SECURE_BOOT_V2_ENABLED

components/bootloader_support/src/esp32/secure_boot_signatures.c

@@ -15,62 +15,40 @@
 
 #include "bootloader_flash.h"
 #include "bootloader_sha.h"
+#include "bootloader_utility.h"
 #include "esp_log.h"
 #include "esp_image_format.h"
 #include "esp_secure_boot.h"
 #include "esp_spi_flash.h"
+#include "esp_fault.h"
 #include "esp32/rom/sha.h"
-#include "uECC.h"
+#include "uECC_verify_antifault.h"
 
 #include <sys/param.h>
+#include <string.h>
 
 static const char *TAG = "secure_boot";
+#define DIGEST_LEN 32
 
+#ifdef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
 extern const uint8_t signature_verification_key_start[] asm("_binary_signature_verification_key_bin_start");
 extern const uint8_t signature_verification_key_end[] asm("_binary_signature_verification_key_bin_end");
 
 #define SIGNATURE_VERIFICATION_KEYLEN 64
 
-#define DIGEST_LEN 32
-
-/* Mmap source address mask */
-#define MMAP_ALIGNED_MASK 0x0000FFFF
-
 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 {
     uint8_t digest[DIGEST_LEN];
-    const uint8_t *data;
+    uint8_t verified_digest[DIGEST_LEN] = { 0 }; /* ignored in this function */
     const esp_secure_boot_sig_block_t *sigblock;
 
     ESP_LOGD(TAG, "verifying signature src_addr 0x%x length 0x%x", src_addr, length);
 
-    bootloader_sha256_handle_t handle = bootloader_sha256_start();
-
-    uint32_t free_page_count = bootloader_mmap_get_free_pages();
-    ESP_LOGD(TAG, "free data page_count 0x%08x", free_page_count);
-
-    int32_t data_len_remain = length;
-    uint32_t data_addr = src_addr;
-    while (data_len_remain > 0) {
-        uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
-        /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
-        uint32_t data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
-        data = (const uint8_t *) bootloader_mmap(data_addr, data_len);
-        if(!data) {
-            ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", data_addr, data_len);
-            bootloader_sha256_finish(handle, NULL);
-            return ESP_FAIL;
-        }
-        bootloader_sha256_data(handle, data, data_len);
-        bootloader_munmap(data);
-
-        data_addr += data_len;
-        data_len_remain -= data_len;
+    esp_err_t err = bootloader_sha256_flash_contents(src_addr, length, digest);
+    if (err != ESP_OK) {
+        return err;
     }
 
-    /* Done! Get the digest */
-    bootloader_sha256_finish(handle, digest);
-
     // Map the signature block
     sigblock = (const esp_secure_boot_sig_block_t *) bootloader_mmap(src_addr + length, sizeof(esp_secure_boot_sig_block_t));
     if(!sigblock) {
@@ -78,7 +56,7 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
         return ESP_FAIL;
     }
     // Verify the signature
-    esp_err_t err = esp_secure_boot_verify_signature_block(sigblock, digest);
+    err = esp_secure_boot_verify_ecdsa_signature_block(sigblock, digest, verified_digest);
     // Unmap
     bootloader_munmap(sigblock);
 
@@ -86,6 +64,12 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 }
 
 esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest)
+{
+    uint8_t verified_digest[DIGEST_LEN] = { 0 };
+    return esp_secure_boot_verify_ecdsa_signature_block(sig_block, image_digest, verified_digest);
+}
+
+esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
 {
     ptrdiff_t keylen;
 
@@ -103,11 +87,98 @@ esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block
     ESP_LOGD(TAG, "Verifying secure boot signature");
 
     bool is_valid;
-    is_valid = uECC_verify(signature_verification_key_start,
+    is_valid = uECC_verify_antifault(signature_verification_key_start,
                            image_digest,
                            DIGEST_LEN,
                            sig_block->signature,
-                           uECC_secp256r1());
+                           uECC_secp256r1(),
+                           verified_digest);
     ESP_LOGD(TAG, "Verification result %d", is_valid);
+
     return is_valid ? ESP_OK : ESP_ERR_IMAGE_INVALID;
 }
+
+#elif CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
+
+esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
+{
+    uint8_t digest[DIGEST_LEN] = {0};
+    uint8_t verified_digest[DIGEST_LEN] = {0}; // ignored in this function
+    const uint8_t *data;
+
+    /* Padding to round off the input to the nearest 4k boundary */
+    int padded_length = ALIGN_UP(length, FLASH_SECTOR_SIZE);
+    ESP_LOGD(TAG, "verifying src_addr 0x%x length", src_addr, padded_length);
+
+    data = bootloader_mmap(src_addr, padded_length + sizeof(ets_secure_boot_signature_t));
+    if (data == NULL) {
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", src_addr, padded_length);
+        return ESP_FAIL;
+    }
+
+    /* Calculate digest of main image */
+    esp_err_t err = bootloader_sha256_flash_contents(src_addr, padded_length, digest);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Digest calculation failed 0x%x, 0x%x", src_addr, padded_length);
+        bootloader_munmap(data);
+        return err;
+    }
+
+    const ets_secure_boot_signature_t *sig_block = (const ets_secure_boot_signature_t *)(data + padded_length);
+    err = esp_secure_boot_verify_rsa_signature_block(sig_block, digest, verified_digest);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Secure Boot V2 verification failed.");
+    }
+
+    bootloader_munmap(data);
+    return err;
+}
+
+esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
+{
+    secure_boot_v2_status_t r;
+    uint8_t efuse_trusted_digest[DIGEST_LEN] = {0}, sig_block_trusted_digest[DIGEST_LEN] = {0};
+
+    memcpy(efuse_trusted_digest, (uint8_t *)EFUSE_BLK2_RDATA0_REG, DIGEST_LEN); /* EFUSE_BLK2_RDATA0_REG - Stores the Secure Boot Public Key Digest */
+
+    if (!ets_use_secure_boot_v2()) {
+        ESP_LOGI(TAG, "Secure Boot eFuse bit(ABS_DONE_1) not yet programmed.");
+
+        /* Generating the SHA of the public key components in the signature block */
+        bootloader_sha256_handle_t sig_block_sha;
+        sig_block_sha = bootloader_sha256_start();
+        bootloader_sha256_data(sig_block_sha, &sig_block->block[0].key, sizeof(sig_block->block[0].key));
+        bootloader_sha256_finish(sig_block_sha, (unsigned char *)sig_block_trusted_digest);
+
+#if CONFIG_SECURE_BOOT_V2_ENABLED
+        if (memcmp(efuse_trusted_digest, sig_block_trusted_digest, DIGEST_LEN) != 0) {
+            /* Most likely explanation for this is that BLK2 is empty, and we're going to burn it
+               after we verify that the signature is valid. However, if BLK2 is not empty then we need to
+               fail here.
+            */
+            bool all_zeroes = true;
+            for (int i = 0; i < DIGEST_LEN; i++) {
+                all_zeroes = all_zeroes && (efuse_trusted_digest[i] == 0);
+            }
+            if (!all_zeroes) {
+                ESP_LOGE(TAG, "Different public key digest burned to eFuse BLK2");
+                return ESP_ERR_INVALID_STATE;
+            }
+        }
+
+        ESP_FAULT_ASSERT(!ets_use_secure_boot_v2());
+#endif
+
+        memcpy(efuse_trusted_digest, sig_block_trusted_digest, DIGEST_LEN);
+    }
+
+    ESP_LOGI(TAG, "Verifying with RSA-PSS...");
+    r = ets_secure_boot_verify_signature(sig_block, image_digest, efuse_trusted_digest, verified_digest);
+    if (r != SBV2_SUCCESS) {
+        ESP_LOGE(TAG, "Secure Boot V2 verification failed.");
+    }
+
+    return (r == SBV2_SUCCESS) ? ESP_OK : ESP_ERR_IMAGE_INVALID;
+}
+#endif

components/bootloader_support/src/esp32s2/bootloader_esp32s2.c

@@ -15,21 +15,23 @@
 #include "sdkconfig.h"
 #include "bootloader_common.h"
 #include "soc/efuse_reg.h"
+#include "soc/gpio_periph.h"
 #include "soc/gpio_sig_map.h"
 #include "soc/io_mux_reg.h"
-#include "esp32s2beta/rom/efuse.h"
-#include "esp32s2beta/rom/gpio.h"
-#include "esp32s2beta/rom/spi_flash.h"
+#include "esp32s2/rom/efuse.h"
+#include "esp32s2/rom/gpio.h"
+#include "esp32s2/rom/spi_flash.h"
 
 #include "bootloader_init.h"
 #include "bootloader_clock.h"
 #include "bootloader_flash_config.h"
+#include "bootloader_mem.h"
 
-#include "esp32s2beta/rom/cache.h"
-#include "esp32s2beta/rom/ets_sys.h"
-#include "esp32s2beta/rom/spi_flash.h"
-#include "esp32s2beta/rom/rtc.h"
-#include "esp32s2beta/rom/uart.h"
+#include "esp32s2/rom/cache.h"
+#include "esp32s2/rom/ets_sys.h"
+#include "esp32s2/rom/spi_flash.h"
+#include "esp32s2/rom/rtc.h"
+#include "esp32s2/rom/uart.h"
 #include "esp_attr.h"
 #include "esp_log.h"
 #include "esp_image_format.h"
@@ -37,54 +39,41 @@
 #include "soc/assist_debug_reg.h"
 #include "soc/cpu.h"
 #include "soc/dport_reg.h"
+#include "soc/extmem_reg.h"
 #include "soc/rtc.h"
 #include "soc/spi_periph.h"
+#include <string.h>
 
 static const char *TAG = "boot.esp32s2";
-
-#define FLASH_CLK_IO SPI_CLK_GPIO_NUM
-#define FLASH_CS_IO SPI_CS0_GPIO_NUM
-#define FLASH_SPIQ_IO SPI_Q_GPIO_NUM
-#define FLASH_SPID_IO SPI_D_GPIO_NUM
-#define FLASH_SPIWP_IO SPI_WP_GPIO_NUM
-#define FLASH_SPIHD_IO SPI_HD_GPIO_NUM
-
 void bootloader_configure_spi_pins(int drv)
 {
     const uint32_t spiconfig = ets_efuse_get_spiconfig();
-    if (spiconfig == EFUSE_SPICONFIG_SPI_DEFAULTS) {
-        gpio_matrix_out(FLASH_CS_IO, SPICS0_OUT_IDX, 0, 0);
-        gpio_matrix_out(FLASH_SPIQ_IO, SPIQ_OUT_IDX, 0, 0);
-        gpio_matrix_in(FLASH_SPIQ_IO, SPIQ_IN_IDX, 0);
-        gpio_matrix_out(FLASH_SPID_IO, SPID_OUT_IDX, 0, 0);
-        gpio_matrix_in(FLASH_SPID_IO, SPID_IN_IDX, 0);
-        gpio_matrix_out(FLASH_SPIWP_IO, SPIWP_OUT_IDX, 0, 0);
-        gpio_matrix_in(FLASH_SPIWP_IO, SPIWP_IN_IDX, 0);
-        gpio_matrix_out(FLASH_SPIHD_IO, SPIHD_OUT_IDX, 0, 0);
-        gpio_matrix_in(FLASH_SPIHD_IO, SPIHD_IN_IDX, 0);
-        //select pin function gpio
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SPIHD_U, PIN_FUNC_GPIO);
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SPIWP_U, PIN_FUNC_GPIO);
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SPICS0_U, PIN_FUNC_GPIO);
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SPIQ_U, PIN_FUNC_GPIO);
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SPID_U, PIN_FUNC_GPIO);
-        // flash clock signal should come from IO MUX.
-        // set drive ability for clock
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SPICLK_U, FUNC_SPICLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SPICLK_U, FUN_DRV, drv, FUN_DRV_S);
+    uint8_t wp_pin = ets_efuse_get_wp_pad();
+    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
+    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
+    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
+    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
+    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
+    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    if (spiconfig == 0) {
 
-#if CONFIG_SPIRAM_TYPE_ESPPSRAM32 || CONFIG_SPIRAM_TYPE_ESPPSRAM64
-        uint32_t flash_id = g_rom_flashchip.device_id;
-        if (flash_id == FLASH_ID_GD25LQ32C) {
-            // Set drive ability for 1.8v flash in 80Mhz.
-            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SPIHD_U, FUN_DRV, 3, FUN_DRV_S);
-            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SPIWP_U, FUN_DRV, 3, FUN_DRV_S);
-            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SPICS0_U, FUN_DRV, 3, FUN_DRV_S);
-            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SPICLK_U, FUN_DRV, 3, FUN_DRV_S);
-            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SPIQ_U, FUN_DRV, 3, FUN_DRV_S);
-            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SPID_U, FUN_DRV, 3, FUN_DRV_S);
-        }
-#endif
+    } else {
+        clk_gpio_num = spiconfig         & 0x3f;
+        q_gpio_num = (spiconfig >> 6)    & 0x3f;
+        d_gpio_num = (spiconfig >> 12)   & 0x3f;
+        cs0_gpio_num = (spiconfig >> 18) & 0x3f;
+        hd_gpio_num = (spiconfig >> 24)  & 0x3f;
+        wp_gpio_num = wp_pin;
+    }
+    gpio_pad_set_drv(clk_gpio_num, drv);
+    gpio_pad_set_drv(q_gpio_num,   drv);
+    gpio_pad_set_drv(d_gpio_num,   drv);
+    gpio_pad_set_drv(cs0_gpio_num, drv);
+    if (hd_gpio_num <= MAX_PAD_GPIO_NUM) {
+        gpio_pad_set_drv(hd_gpio_num, drv);
+    }
+    if (wp_gpio_num <= MAX_PAD_GPIO_NUM) {
+        gpio_pad_set_drv(wp_gpio_num, drv);
     }
 }
 
@@ -97,7 +86,7 @@ static void bootloader_reset_mmu(void)
 
     /* normal ROM boot exits with DROM0 cache unmasked,
     but serial bootloader exits with it masked. */
-    DPORT_REG_CLR_BIT(DPORT_PRO_ICACHE_CTRL1_REG, DPORT_PRO_ICACHE_MASK_DROM0);
+    REG_CLR_BIT(EXTMEM_PRO_ICACHE_CTRL1_REG, EXTMEM_PRO_ICACHE_MASK_DROM0);
 }
 
 static void update_flash_config(const esp_image_header_t *bootloader_hdr)
@@ -201,7 +190,6 @@ static void print_flash_info(const esp_image_header_t *bootloader_hdr)
 
 static void IRAM_ATTR bootloader_init_flash_configure(void)
 {
-    bootloader_flash_gpio_config(&bootloader_image_hdr);
     bootloader_flash_dummy_config(&bootloader_image_hdr);
     bootloader_flash_cs_timing_config();
 }
@@ -236,7 +224,7 @@ static void bootloader_init_uart_console(void)
 #else // CONFIG_ESP_CONSOLE_UART_NONE
     const int uart_num = CONFIG_ESP_CONSOLE_UART_NUM;
 
-    uartAttach();
+    uartAttach(NULL);
     ets_install_uart_printf();
 
     // Wait for UART FIFO to be empty.
@@ -251,15 +239,15 @@ static void bootloader_init_uart_console(void)
     uart_tx_switch(uart_num);
     // If console is attached to UART1 or if non-default pins are used,
     // need to reconfigure pins using GPIO matrix
-    if (uart_num != 0 || uart_tx_gpio != 1 || uart_rx_gpio != 3) {
-        // Change pin mode for GPIO1/3 from UART to GPIO
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_U0RXD_U, FUNC_U0RXD_GPIO3);
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_U0TXD_U, FUNC_U0TXD_GPIO1);
+    if (uart_num != 0 || uart_tx_gpio != 43 || uart_rx_gpio != 44) {
+        // Change pin mode UART to GPIO
+        PIN_FUNC_SELECT(PERIPHS_IO_MUX_U0RXD_U, FUNC_U0RXD_GPIO44);
+        PIN_FUNC_SELECT(PERIPHS_IO_MUX_U0TXD_U, FUNC_U0TXD_GPIO43);
         // Route GPIO signals to/from pins
         // (arrays should be optimized away by the compiler)
-        const uint32_t tx_idx_list[3] = {U0TXD_OUT_IDX, U1TXD_OUT_IDX, U2TXD_OUT_IDX};
-        const uint32_t rx_idx_list[3] = {U0RXD_IN_IDX, U1RXD_IN_IDX, U2RXD_IN_IDX};
-        const uint32_t uart_reset[3] = {DPORT_UART_RST, DPORT_UART1_RST, DPORT_UART2_RST};
+        const uint32_t tx_idx_list[2] = {U0TXD_OUT_IDX, U1TXD_OUT_IDX};
+        const uint32_t rx_idx_list[2] = {U0RXD_IN_IDX, U1RXD_IN_IDX};
+        const uint32_t uart_reset[2] = {DPORT_UART_RST, DPORT_UART1_RST};
         const uint32_t tx_idx = tx_idx_list[uart_num];
         const uint32_t rx_idx = rx_idx_list[uart_num];
 
@@ -329,7 +317,7 @@ static void bootloader_check_wdt_reset(void)
 
     rst_reas[0] = rtc_get_reset_reason(0);
     if (rst_reas[0] == RTCWDT_SYS_RESET || rst_reas[0] == TG0WDT_SYS_RESET || rst_reas[0] == TG1WDT_SYS_RESET ||
-            rst_reas[0] == TG0WDT_CPU_RESET || rst_reas[0] == TG1WDT_CPU_RESET || rst_reas[0] == RTCWDT_CPU_RESET) {
+        rst_reas[0] == TG0WDT_CPU_RESET || rst_reas[0] == TG1WDT_CPU_RESET || rst_reas[0] == RTCWDT_CPU_RESET) {
         ESP_LOGW(TAG, "PRO CPU has been reset by WDT.");
         wdt_rst = 1;
     }
@@ -342,7 +330,7 @@ static void bootloader_check_wdt_reset(void)
 
 void abort(void)
 {
-#if !CONFIG_ESP32S2_PANIC_SILENT_REBOOT
+#if !CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT
     ets_printf("abort() was called at PC 0x%08x\r\n", (intptr_t)__builtin_return_address(0) - 3);
 #endif
     if (esp_cpu_in_ocd_debug_mode()) {
@@ -352,11 +340,19 @@ void abort(void)
     }
 }
 
+static void bootloader_super_wdt_auto_feed(void)
+{
+    REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_AUTO_FEED_EN);
+}
+
 esp_err_t bootloader_init(void)
 {
     esp_err_t ret = ESP_OK;
+    bootloader_super_wdt_auto_feed();
     // protect memory region
-    cpu_configure_region_protection();
+
+    bootloader_init_mem();
+
     /* check that static RAM is after the stack */
 #ifndef NDEBUG
     {

components/bootloader_support/src/esp32s2/bootloader_sha.c

@@ -17,7 +17,7 @@
 #include <assert.h>
 #include <sys/param.h>
 
-#include "esp32s2beta/rom/sha.h"
+#include "esp32s2/rom/sha.h"
 
 static SHA_CTX ctx;
 

components/bootloader_support/src/esp32s2/flash_encrypt.c

@@ -22,69 +22,103 @@
 #include "esp_flash_partitions.h"
 #include "esp_secure_boot.h"
 #include "esp_log.h"
-#include "esp32s2beta/rom/secure_boot.h"
-#include "esp32s2beta/rom/cache.h"
-#include "esp32s2beta/rom/efuse.h"
+#include "esp32s2/rom/secure_boot.h"
+#include "esp32s2/rom/cache.h"
+#include "esp32s2/rom/efuse.h"
+#include "esp_efuse.h"
+#include "esp_efuse_table.h"
+#include "hal/wdt_hal.h"
 
 static const char *TAG = "flash_encrypt";
 
 /* Static functions for stages of flash encryption */
 static esp_err_t initialise_flash_encryption(void);
-static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_crypt_wr_dis);
+static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_crypt_wr_dis) __attribute__((unused));
 static esp_err_t encrypt_bootloader(void);
 static esp_err_t encrypt_and_load_partition_table(esp_partition_info_t *partition_table, int *num_partitions);
 static esp_err_t encrypt_partition(int index, const esp_partition_info_t *partition);
 
 esp_err_t esp_flash_encrypt_check_and_update(void)
 {
-    // TODO: not clear why this is read from DATA1 and written to PGM_DATA2
-    uint32_t cnt = REG_GET_FIELD(EFUSE_RD_REPEAT_DATA1_REG, EFUSE_SPI_BOOT_CRYPT_CNT);
-    ESP_LOGV(TAG, "SPI_BOOT_CRYPT_CNT 0x%x", cnt);
+    uint8_t flash_crypt_wr_dis = 0;
+    uint32_t flash_crypt_cnt = 0;
 
-    bool flash_crypt_wr_dis = false; // TODO: check if CRYPT_CNT is write disabled
+    esp_efuse_read_field_blob(ESP_EFUSE_SPI_BOOT_CRYPT_CNT, &flash_crypt_cnt, 3);
+    esp_efuse_read_field_blob(ESP_EFUSE_WR_DIS_SPI_BOOT_CRYPT_CNT, &flash_crypt_wr_dis, 1);
+
+    ESP_LOGV(TAG, "SPI_BOOT_CRYPT_CNT 0x%x", flash_crypt_cnt);
+    ESP_LOGV(TAG, "EFUSE_WR_DIS_SPI_BOOT_CRYPT_CNT 0x%x", flash_crypt_wr_dis);
 
     _Static_assert(EFUSE_SPI_BOOT_CRYPT_CNT == 0x7, "assuming CRYPT_CNT is only 3 bits wide");
 
-    if (cnt == 1 || cnt == 3 || cnt == 7) {
+    if (__builtin_parity(flash_crypt_cnt) == 1) {
         /* Flash is already encrypted */
-        int left;
-        if (cnt == 7 /* || disabled */) {
-            left = 0;
-        } else if (cnt == 3) {
-            left = 1;
-        } else {
-            left = 2;
+        int left = (flash_crypt_cnt == 1) ? 1 : 0;
+        if (flash_crypt_wr_dis) {
+            left = 0; /* can't update FLASH_CRYPT_CNT, no more flashes */
         }
         ESP_LOGI(TAG, "flash encryption is enabled (%d plaintext flashes left)", left);
         return ESP_OK;
-    }
-    else {
+    } else {
+
+#ifndef CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED
         /* Flash is not encrypted, so encrypt it! */
-        return encrypt_flash_contents(cnt, flash_crypt_wr_dis);
+        return encrypt_flash_contents(flash_crypt_cnt, flash_crypt_wr_dis);
+#else
+        ESP_LOGE(TAG, "flash encryption is not enabled, and SECURE_FLASH_REQUIRE_ALREADY_ENABLED "
+                      "is set, refusing to boot.");
+        return ESP_ERR_INVALID_STATE;
+#endif // CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED
+
     }
 }
 
-static esp_err_t initialise_flash_encryption(void)
+static bool s_key_dis_read(ets_efuse_block_t block)
 {
-    /* Before first flash encryption pass, need to initialise key & crypto config */
+    unsigned key_num = block - ETS_EFUSE_BLOCK_KEY0;
+    return REG_GET_FIELD(EFUSE_RD_REPEAT_DATA0_REG, EFUSE_RD_DIS) & (EFUSE_RD_DIS_KEY0 << key_num);
+}
 
-    /* Find out if a key is already set */
-    bool has_aes128 = ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY, NULL);
-    bool has_aes256_1 = ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1, NULL);
-    bool has_aes256_2 = ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2, NULL);
+static bool s_key_dis_write(ets_efuse_block_t block)
+{
+    unsigned key_num = block - ETS_EFUSE_BLOCK_KEY0;
+    return REG_GET_FIELD(EFUSE_RD_WR_DIS_REG, EFUSE_WR_DIS) & (EFUSE_WR_DIS_KEY0 << key_num);
+}
 
+static esp_err_t check_and_generate_encryption_keys(void)
+{
+    esp_err_t err = ESP_ERR_INVALID_STATE;
+    ets_efuse_block_t aes_128_key_block;
+    ets_efuse_block_t aes_256_key_block_1;
+    ets_efuse_block_t aes_256_key_block_2;
+
+    bool has_aes128 = ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY, &aes_128_key_block);
+    bool has_aes256_1 = ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1, &aes_256_key_block_1);
+    bool has_aes256_2 = ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2, &aes_256_key_block_2);
     bool has_key = has_aes128 || (has_aes256_1 && has_aes256_2);
+    bool dis_write = false;
+    bool dis_read = false;
+
+    // If there are keys set, they must be write and read protected!
+    if(has_key && has_aes128) {
+        dis_write = s_key_dis_write(aes_128_key_block);
+        dis_read = s_key_dis_read(aes_128_key_block);
+    } else if (has_key && has_aes256_1 && has_aes256_2) {
+        dis_write = s_key_dis_write(aes_256_key_block_1) && s_key_dis_write(aes_256_key_block_2);
+        dis_read = s_key_dis_read(aes_256_key_block_1) && s_key_dis_read(aes_256_key_block_2);
+    }
 
     if (!has_key && (has_aes256_1 || has_aes256_2)) {
         ESP_LOGE(TAG, "Invalid efuse key blocks: Both AES-256 key blocks must be set.");
         return ESP_ERR_INVALID_STATE;
     }
 
-    if (has_key) {
-        ESP_LOGI(TAG, "Using pre-existing key in efuse");
+    if(has_key && (!dis_read || !dis_write)) {
+        ESP_LOGE(TAG, "Invalid key state, a key was set but not read and write protected.");
+        return ESP_ERR_INVALID_STATE;
+    }
 
-        ESP_LOGE(TAG, "TODO: Check key is read & write protected"); // TODO
-    } else {
+    if(!has_key && !dis_write && !dis_read) {
         ESP_LOGI(TAG, "Generating new flash encryption key...");
 #ifdef CONFIG_SECURE_FLASH_ENCRYPTION_AES256
         const unsigned BLOCKS_NEEDED = 2;
@@ -102,26 +136,84 @@ static esp_err_t initialise_flash_encryption(void)
         }
 
         for(ets_efuse_purpose_t purpose = PURPOSE_START; purpose <= PURPOSE_END; purpose++) {
-            uint32_t buf[8];
+            uint32_t buf[8] = {0};
             bootloader_fill_random(buf, sizeof(buf));
             ets_efuse_block_t block = ets_efuse_find_unused_key_block();
             ESP_LOGD(TAG, "Writing ETS_EFUSE_BLOCK_KEY%d with purpose %d",
                      block - ETS_EFUSE_BLOCK_KEY0, purpose);
-            bootloader_debug_buffer(buf, sizeof(buf), "Key content");
+
+            /* Note: everything else in this function is deferred as a batch write, but we write the
+               key (and write protect it) immediately as it's too fiddly to manage unused key blocks, etc.
+               in bootloader size footprint otherwise. */
             int r = ets_efuse_write_key(block, purpose, buf, sizeof(buf));
-            bzero(buf, sizeof(buf));
             if (r != 0) {
-                ESP_LOGE(TAG, "Failed to write efuse block %d with purpose %d. Can't continue.");
+                ESP_LOGE(TAG, "Failed to write efuse block %d with purpose %d. Can't continue.",
+                        block, purpose);
                 return ESP_FAIL;
             }
-        }
 
+            /* assuming numbering of esp_efuse_block_t matches ets_efuse_block_t */
+            _Static_assert((int)EFUSE_BLK_KEY0 == (int)ETS_EFUSE_BLOCK_KEY0, "esp_efuse_block_t doesn't match ets_efuse_block_t");
+            _Static_assert((int)EFUSE_BLK_KEY1 == (int)ETS_EFUSE_BLOCK_KEY1, "esp_efuse_block_t doesn't match ets_efuse_block_t");
+            _Static_assert((int)EFUSE_BLK_KEY2 == (int)ETS_EFUSE_BLOCK_KEY2, "esp_efuse_block_t doesn't match ets_efuse_block_t");
+            _Static_assert((int)EFUSE_BLK_KEY3 == (int)ETS_EFUSE_BLOCK_KEY3, "esp_efuse_block_t doesn't match ets_efuse_block_t");
+            _Static_assert((int)EFUSE_BLK_KEY4 == (int)ETS_EFUSE_BLOCK_KEY4, "esp_efuse_block_t doesn't match ets_efuse_block_t");
+            _Static_assert((int)EFUSE_BLK_KEY5 == (int)ETS_EFUSE_BLOCK_KEY5, "esp_efuse_block_t doesn't match ets_efuse_block_t");
+
+            // protect this block against reading after key is set (writing is done by ets_efuse_write_key)
+            err = esp_efuse_set_read_protect(block);
+            if(err != ESP_OK) {
+                ESP_LOGE(TAG, "Failed to set read protect to efuse block %d. Can't continue.", block);
+                return err;
+            }
+        }
         ESP_LOGD(TAG, "Key generation complete");
+        return ESP_OK;
+
+    } else {
+        ESP_LOGI(TAG, "Using pre-existing key in efuse");
+        return ESP_OK;
+    }
+}
+
+static esp_err_t initialise_flash_encryption(void)
+{
+    esp_efuse_batch_write_begin(); /* Batch all efuse writes at the end of this function */
+
+    esp_err_t key_state = check_and_generate_encryption_keys();
+    if(key_state != ESP_OK) {
+        esp_efuse_batch_write_cancel();
+        return key_state;
     }
 
-    ESP_LOGE(TAG, "TODO: burn remaining security protection bits"); // TODO
+#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
+    ESP_LOGI(TAG, "Disable UART bootloader encryption...");
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
+#else
+    ESP_LOGW(TAG, "Not disabling UART bootloader encryption");
+#endif
 
-    return ESP_OK;
+#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
+    ESP_LOGI(TAG, "Disable UART bootloader cache...");
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_DCACHE);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
+#else
+    ESP_LOGW(TAG, "Not disabling UART bootloader cache - SECURITY COMPROMISED");
+#endif
+
+#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
+    ESP_LOGI(TAG, "Disable JTAG...");
+    esp_efuse_write_field_bit(ESP_EFUSE_HARD_DIS_JTAG);
+#else
+    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
+#endif
+
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_BOOT_REMAP);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+
+    esp_err_t err = esp_efuse_batch_write_commit();
+
+    return err;
 }
 
 /* Encrypt all flash data that should be encrypted */
@@ -134,7 +226,7 @@ static esp_err_t encrypt_flash_contents(uint32_t spi_boot_crypt_cnt, bool flash_
     /* If the last spi_boot_crypt_cnt bit is burned or write-disabled, the
        device can't re-encrypt itself. */
     if (flash_crypt_wr_dis || spi_boot_crypt_cnt == EFUSE_SPI_BOOT_CRYPT_CNT) {
-        ESP_LOGE(TAG, "Cannot re-encrypt data (SPI_BOOT_CRYPT_CNT 0x%02x write disabled %d", spi_boot_crypt_cnt, flash_crypt_wr_dis);
+        ESP_LOGE(TAG, "Cannot re-encrypt data SPI_BOOT_CRYPT_CNT 0x%02x write disabled %d", spi_boot_crypt_cnt, flash_crypt_wr_dis);
         return ESP_FAIL;
     }
 
@@ -156,10 +248,7 @@ static esp_err_t encrypt_flash_contents(uint32_t spi_boot_crypt_cnt, bool flash_
         return err;
     }
 
-    /* Now iterate the just-loaded partition table, looking for entries to encrypt
-     */
-
-    /* Go through each partition and encrypt if necessary */
+    /* Now iterate the just-loaded partition table, looking for entries to encrypt */
     for (int i = 0; i < num_partitions; i++) {
         err = encrypt_partition(i, &partition_table[i]);
         if (err != ESP_OK) {
@@ -172,13 +261,17 @@ static esp_err_t encrypt_flash_contents(uint32_t spi_boot_crypt_cnt, bool flash_
     /* Set least significant 0-bit in spi_boot_crypt_cnt */
     int ffs_inv = __builtin_ffs((~spi_boot_crypt_cnt) & 0x7);
     /* ffs_inv shouldn't be zero, as zero implies spi_boot_crypt_cnt == 0xFF */
-    uint32_t new_spi_boot_crypt_cnt = spi_boot_crypt_cnt + (1 << (ffs_inv - 1));
-    ESP_LOGD(TAG, "SPI_BOOT_CRYPT_CNT 0x%x -> 0x%x", spi_boot_crypt_cnt, new_spi_boot_crypt_cnt);
+    uint32_t new_spi_boot_crypt_cnt = (1 << (ffs_inv - 1));
+    ESP_LOGD(TAG, "SPI_BOOT_CRYPT_CNT 0x%x -> 0x%x", spi_boot_crypt_cnt, new_spi_boot_crypt_cnt + spi_boot_crypt_cnt);
 
-    ets_efuse_clear_program_registers();
-    REG_SET_FIELD(EFUSE_PGM_DATA2_REG, EFUSE_SPI_BOOT_CRYPT_CNT, new_spi_boot_crypt_cnt);
-    ets_efuse_program(ETS_EFUSE_BLOCK0);
+    esp_efuse_write_field_blob(ESP_EFUSE_SPI_BOOT_CRYPT_CNT, &new_spi_boot_crypt_cnt, 3);
 
+#ifdef CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
+    //Secure SPI boot cnt after its update if needed.
+    const uint32_t spi_boot_cnt_wr_dis = 1;
+    ESP_LOGI(TAG, "Write protecting SPI_CRYPT_CNT eFuse");
+    esp_efuse_write_field_blob(ESP_EFUSE_WR_DIS_SPI_BOOT_CRYPT_CNT, &spi_boot_cnt_wr_dis, 1);
+#endif
     ESP_LOGI(TAG, "Flash encryption completed");
 
     return ESP_OK;
@@ -191,21 +284,30 @@ static esp_err_t encrypt_bootloader(void)
     /* Check for plaintext bootloader (verification will fail if it's already encrypted) */
     if (esp_image_verify_bootloader(&image_length) == ESP_OK) {
         ESP_LOGD(TAG, "bootloader is plaintext. Encrypting...");
+
+#if CONFIG_SECURE_BOOT_V2_ENABLED
+        // Account for the signature sector after the bootloader
+        image_length = (image_length + FLASH_SECTOR_SIZE - 1) & ~(FLASH_SECTOR_SIZE - 1);
+        image_length += FLASH_SECTOR_SIZE;
+        if (ESP_BOOTLOADER_OFFSET + image_length > ESP_PARTITION_TABLE_OFFSET) {
+            ESP_LOGE(TAG, "Bootloader is too large to fit Secure Boot V2 signature sector and partition table (configured offset 0x%x)", ESP_PARTITION_TABLE_OFFSET);
+            return ESP_ERR_INVALID_SIZE;
+        }
+#endif // CONFIG_SECURE_BOOT_V2_ENABLED
+
         err = esp_flash_encrypt_region(ESP_BOOTLOADER_OFFSET, image_length);
         if (err != ESP_OK) {
             ESP_LOGE(TAG, "Failed to encrypt bootloader in place: 0x%x", err);
             return err;
-        }
-
-        if (esp_secure_boot_enabled()) {
-            // TODO: anything different for secure boot?
-        }
+        } 
+        
+        ESP_LOGI(TAG, "bootloader encrypted successfully");
+        return err;
     }
     else {
         ESP_LOGW(TAG, "no valid bootloader was found");
+        return ESP_ERR_NOT_FOUND;
     }
-
-    return ESP_OK;
 }
 
 static esp_err_t encrypt_and_load_partition_table(esp_partition_info_t *partition_table, int *num_partitions)
@@ -232,6 +334,7 @@ static esp_err_t encrypt_and_load_partition_table(esp_partition_info_t *partitio
     }
 
     /* Valid partition table loded */
+    ESP_LOGI(TAG, "partition table encrypted and loaded successfully");
     return ESP_OK;
 }
 
@@ -280,7 +383,13 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length)
         return ESP_FAIL;
     }
 
+    wdt_hal_context_t rtc_wdt_ctx = {.inst = WDT_RWDT, .rwdt_dev = &RTCCNTL};
     for (size_t i = 0; i < data_length; i += FLASH_SECTOR_SIZE) {
+
+        wdt_hal_write_protect_disable(&rtc_wdt_ctx);
+        wdt_hal_feed(&rtc_wdt_ctx);
+        wdt_hal_write_protect_enable(&rtc_wdt_ctx);
+
         uint32_t sec_start = i + src_addr;
         err = bootloader_flash_read(sec_start, buf, FLASH_SECTOR_SIZE, false);
         if (err != ESP_OK) {

components/bootloader_support/src/esp32s2/secure_boot.c

@@ -0,0 +1,325 @@
+// Copyright 2015-2018 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include <string.h>
+
+#include "esp_log.h"
+#include "esp_secure_boot.h"
+#include "soc/efuse_reg.h"
+
+#include "bootloader_flash.h"
+#include "bootloader_sha.h"
+#include "bootloader_utility.h"
+
+#include "esp32s2/rom/crc.h"
+#include "esp_efuse.h"
+#include "esp_efuse_table.h"
+
+#include "esp32s2/rom/efuse.h"
+#include "esp32s2/rom/secure_boot.h"
+
+static const char *TAG = "secure_boot_v2";
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
+
+#define SIG_BLOCK_MAGIC_BYTE 0xe7
+#define CRC_SIGN_BLOCK_LEN 1196
+#define SIG_BLOCK_PADDING 4096
+
+#define DIGEST_LEN 32
+
+/* A signature block is valid when it has correct magic byte, crc and image digest. */
+static esp_err_t validate_signature_block(const ets_secure_boot_sig_block_t *block, int block_num, const uint8_t *image_digest)
+{
+    uint32_t crc = crc32_le(0, (uint8_t *)block, CRC_SIGN_BLOCK_LEN);
+    if (block->magic_byte != SIG_BLOCK_MAGIC_BYTE) {
+        // All signature blocks have been parsed, no new signature block present.
+        ESP_LOGD(TAG, "Signature block(%d) invalid/absent.", block_num);
+        return ESP_FAIL;
+    }
+    if (block->block_crc != crc) {
+        ESP_LOGE(TAG, "Magic byte correct but incorrect crc.");
+        return ESP_FAIL;
+    }
+    if (memcmp(image_digest, block->image_digest, DIGEST_LEN)) {
+        ESP_LOGE(TAG, "Magic byte & CRC correct but incorrect image digest.");
+        return ESP_FAIL;
+    } else {
+        ESP_LOGD(TAG, "valid signature block(%d) found", block_num);
+        return ESP_OK;
+    }
+
+    return ESP_FAIL;
+}
+
+/* Structure to hold public key digests calculated from the signature blocks of a single image.
+
+   Each image can have one or more signature blocks (up to SECURE_BOOT_NUM_BLOCKS). Each signature block
+   includes a public key.
+
+   Different to the ROM ets_secure_boot_key_digests_t structure which holds pointers to eFuse data with digests,
+   in this data structure the digest data is included.
+*/
+typedef struct {
+    uint8_t key_digests[SECURE_BOOT_NUM_BLOCKS][DIGEST_LEN];
+    unsigned num_digests; /* Number of valid digests, starting at index 0 */
+} image_sig_public_key_digests_t;
+
+/* Generates the public key digests of the valid public keys in an image's
+   signature block, verifies each signature, and stores the key digests in the
+   public_key_digests structure.
+
+   @param flash_offset Image offset in flash
+   @param flash_size Image size in flash (not including signature block)
+   @param[out] public_key_digests Pointer to structure to hold the key digests for valid sig blocks
+
+
+   Note that this function doesn't read any eFuses, so it doesn't know if the
+   keys are ultimately trusted by the hardware or not
+
+   @return - ESP_OK if no signatures failed to verify, or if no valid signature blocks are found at all.
+           - ESP_FAIL if there's a valid signature block that doesn't verify using the included public key (unexpected!)
+*/
+static esp_err_t s_calculate_image_public_key_digests(uint32_t flash_offset, uint32_t flash_size, image_sig_public_key_digests_t *public_key_digests)
+{
+    esp_err_t ret;
+    uint8_t image_digest[DIGEST_LEN] = {0};
+    uint8_t __attribute__((aligned(4))) key_digest[DIGEST_LEN] = {0};
+    size_t sig_block_addr = flash_offset + ALIGN_UP(flash_size, FLASH_SECTOR_SIZE);
+
+    ESP_LOGD(TAG, "calculating public key digests for sig blocks of image offset 0x%x (sig block offset 0x%x)", flash_offset, sig_block_addr);
+
+    bzero(public_key_digests, sizeof(image_sig_public_key_digests_t));
+
+    ret = bootloader_sha256_flash_contents(flash_offset, sig_block_addr - flash_offset, image_digest);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "error generating image digest, %d", ret);
+        return ret;
+    }
+
+    ESP_LOGD(TAG, "reading signatures");
+    const ets_secure_boot_signature_t *signatures = bootloader_mmap(sig_block_addr, sizeof(ets_secure_boot_signature_t));
+    if (signatures == NULL) {
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", sig_block_addr, sizeof(ets_secure_boot_signature_t));
+        return ESP_FAIL;
+    }
+
+    for (int i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+        const ets_secure_boot_sig_block_t *block = &signatures->block[i];
+
+        ret = validate_signature_block(block, i, image_digest);
+        if (ret != ESP_OK) {
+            ret = ESP_OK;  // past the last valid signature block
+            break;
+        }
+
+        /* Generating the SHA of the public key components in the signature block */
+        bootloader_sha256_handle_t sig_block_sha;
+        sig_block_sha = bootloader_sha256_start();
+        bootloader_sha256_data(sig_block_sha, &block->key, sizeof(block->key));
+        bootloader_sha256_finish(sig_block_sha, key_digest);
+
+        // Check we can verify the image using this signature and this key
+        uint8_t temp_verified_digest[DIGEST_LEN];
+        bool verified = ets_rsa_pss_verify(&block->key, block->signature, image_digest, temp_verified_digest);
+
+        if (!verified) {
+            /* We don't expect this: the signature blocks before we enable secure boot should all be verifiable or invalid,
+               so this is a fatal error
+            */
+            ret = ESP_FAIL;
+            ESP_LOGE(TAG, "Secure boot key (%d) verification failed.", i);
+            break;
+        }
+        ESP_LOGD(TAG, "Signature block (%d) is verified", i);
+        /* Copy the key digest to the buffer provided by the caller */
+        memcpy((void *)public_key_digests->key_digests[i], key_digest, DIGEST_LEN);
+        public_key_digests->num_digests++;
+    }
+
+    if (ret == ESP_OK && public_key_digests->num_digests > 0) {
+        ESP_LOGI(TAG, "Digests successfully calculated, %d valid signatures (image offset 0x%x)",
+                 public_key_digests->num_digests, flash_offset);
+    }
+
+    bootloader_munmap(signatures);
+    return ret;
+}
+
+esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *image_data)
+{
+    ESP_LOGI(TAG, "enabling secure boot v2 - ESP32-S2...");
+
+    if (esp_secure_boot_enabled()) {
+        ESP_LOGI(TAG, "secure boot v2 is already enabled, continuing..");
+        return ESP_OK;
+    }
+
+    esp_err_t ret;
+    /* Verify the bootloader */
+    esp_image_metadata_t bootloader_data = { 0 };
+    ret = esp_image_verify_bootloader_data(&bootloader_data);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "bootloader image appears invalid! error %d", ret);
+        return ret;
+    }
+
+    /* Check if secure boot digests are present */
+    bool has_secure_boot_digest = ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST0, NULL);
+    has_secure_boot_digest |= ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST1, NULL);
+    has_secure_boot_digest |= ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST2, NULL);
+    ESP_LOGI(TAG, "Secure boot digests %s", has_secure_boot_digest ? "already present":"absent, generating..");
+
+    ets_efuse_clear_program_registers();
+    if (!has_secure_boot_digest) {
+        image_sig_public_key_digests_t boot_key_digests = {0};
+        image_sig_public_key_digests_t app_key_digests = {0};
+
+        /* Generate the bootloader public key digests */
+        ret = s_calculate_image_public_key_digests(bootloader_data.start_addr, bootloader_data.image_len - SIG_BLOCK_PADDING, &boot_key_digests);
+        if (ret != ESP_OK) {
+            ESP_LOGE(TAG, "Bootloader signature block is invalid");
+            return ret;
+        }
+
+        if (boot_key_digests.num_digests == 0) {
+            ESP_LOGE(TAG, "No valid bootloader signature blocks found.");
+            return ESP_FAIL;
+        }
+        ESP_LOGI(TAG, "%d signature block(s) found appended to the bootloader.", boot_key_digests.num_digests);
+
+        int unused_key_slots = ets_efuse_count_unused_key_blocks();
+        if (boot_key_digests.num_digests > unused_key_slots) {
+            ESP_LOGE(TAG, "Bootloader signatures(%d) more than available key slots(%d).", boot_key_digests.num_digests, unused_key_slots);
+            return ESP_FAIL;
+        }
+
+        for (int i = 0; i < boot_key_digests.num_digests; i++) {
+            ets_efuse_block_t block;
+            const uint32_t secure_boot_key_purpose[SECURE_BOOT_NUM_BLOCKS] = { ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST0,
+                                ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST1, ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST2 };
+
+            block = ets_efuse_find_unused_key_block();
+            if (block == ETS_EFUSE_BLOCK_MAX) {
+                ESP_LOGE(TAG, "No more unused key blocks available.");
+                return ESP_FAIL;
+            }
+
+            int r = ets_efuse_write_key(block, secure_boot_key_purpose[i], boot_key_digests.key_digests[i], DIGEST_LEN);
+            if (r != 0) {
+                ESP_LOGE(TAG, "Failed to write efuse block %d with purpose %d. Can't continue.", block, secure_boot_key_purpose[i]);
+                return ESP_FAIL;
+            }
+
+            // Note: write key will write protect both the block and the purpose eFuse, always
+        }
+
+        /* Generate the application public key digests */
+        ret = s_calculate_image_public_key_digests(image_data->start_addr, image_data->image_len - SIG_BLOCK_PADDING, &app_key_digests);
+        if (ret != ESP_OK) {
+            ESP_LOGE(TAG, "App signature block is invalid.");
+            return ret;
+        }
+
+        if (app_key_digests.num_digests == 0) {
+            ESP_LOGE(TAG, "No valid applications signature blocks found.");
+            return ESP_FAIL;
+        }
+
+        ESP_LOGI(TAG, "%d signature block(s) found appended to the app.", app_key_digests.num_digests);
+        if (app_key_digests.num_digests > boot_key_digests.num_digests) {
+            ESP_LOGW(TAG, "App has %d signature blocks but bootloader only has %d. Some keys missing from bootloader?");
+        }
+
+        /* Confirm if at least one public key from the application matches a public key in the bootloader
+           (Also, ensure if that public revoke bit is not set for the matched key) */
+        bool match = false;
+        const uint32_t revoke_bits[SECURE_BOOT_NUM_BLOCKS] = { EFUSE_SECURE_BOOT_KEY_REVOKE0,
+                                EFUSE_SECURE_BOOT_KEY_REVOKE1, EFUSE_SECURE_BOOT_KEY_REVOKE2 };
+
+        for (int i = 0; i < boot_key_digests.num_digests; i++) {
+
+            if (REG_GET_BIT(EFUSE_RD_REPEAT_DATA1_REG, revoke_bits[i])) {
+                ESP_LOGI(TAG, "Key block(%d) has been revoked.", i);
+                continue; // skip if the key block is revoked
+            }
+
+            for (int j = 0; j < app_key_digests.num_digests; j++) {
+                if (!memcmp(boot_key_digests.key_digests[i], app_key_digests.key_digests[j], DIGEST_LEN)) {
+                    ESP_LOGI(TAG, "Application key(%d) matches with bootloader key(%d).", j, i);
+                    match = true;
+                }
+            }
+        }
+
+        if (match == false) {
+            ESP_LOGE(TAG, "No application key digest matches the bootloader key digest.");
+            return ESP_FAIL;
+        }
+
+        /* Revoke the empty signature blocks */
+        if (boot_key_digests.num_digests < SECURE_BOOT_NUM_BLOCKS) {
+            /* The revocation index can be 0, 1, 2. Bootloader count can be 1,2,3. */
+            for (uint8_t i = boot_key_digests.num_digests; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+                ESP_LOGI(TAG, "Revoking empty key digest slot (%d)...", i);
+                ets_secure_boot_revoke_public_key_digest(i);
+            }
+        }
+    }
+
+    esp_err_t err = esp_efuse_batch_write_begin();
+    if (err != ESP_OK) {
+        ESP_LOGI(TAG, "Error batch programming security eFuses.");
+        return err;
+    }
+
+    __attribute__((unused)) static const uint8_t enable = 1;
+
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_BOOT_REMAP);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+
+#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Enabling Security download mode...");
+    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+#else
+    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+#endif
+
+#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
+    ESP_LOGI(TAG, "Disable hardware & software JTAG...");
+    esp_efuse_write_field_bit(ESP_EFUSE_HARD_DIS_JTAG);
+    esp_efuse_write_field_bit(ESP_EFUSE_SOFT_DIS_JTAG);
+#else
+    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
+#endif
+
+#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
+    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
+#endif
+
+    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
+
+    err = esp_efuse_batch_write_commit();
+    if (err != ESP_OK) {
+        ESP_LOGI(TAG, "Error programming security eFuses.");
+        return err;
+    }
+
+#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
+    assert(ets_efuse_secure_boot_aggressive_revoke_enabled());
+#endif
+
+    assert(ets_efuse_secure_boot_enabled());
+    ESP_LOGI(TAG, "Secure boot permanently enabled");
+
+    return ESP_OK;
+}

components/bootloader_support/src/esp32s2/secure_boot_signatures.c

@@ -0,0 +1,93 @@
+// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include "sdkconfig.h"
+
+#include <string.h>
+#include "esp_fault.h"
+#include "bootloader_flash.h"
+#include "bootloader_sha.h"
+#include "bootloader_utility.h"
+#include "esp_log.h"
+#include "esp_image_format.h"
+#include "esp_secure_boot.h"
+#include "esp32s2/rom/secure_boot.h"
+
+static const char* TAG = "secure_boot";
+
+#define DIGEST_LEN 32
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
+
+esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
+{
+    uint8_t digest[DIGEST_LEN];
+    uint8_t verified_digest[DIGEST_LEN] = { 0 }; /* Note: this function doesn't do any anti-FI checks on this buffer */
+    const uint8_t *data;
+
+    ESP_LOGD(TAG, "verifying signature src_addr 0x%x length 0x%x", src_addr, length);
+
+    /* Padding to round off the input to the nearest 4k boundary */
+    int padded_length = ALIGN_UP(length, FLASH_SECTOR_SIZE);
+    ESP_LOGD(TAG, "verifying src_addr 0x%x length", src_addr, padded_length);
+
+    data = bootloader_mmap(src_addr, length + sizeof(struct ets_secure_boot_sig_block));
+    if (data == NULL) {
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", src_addr, length+sizeof(ets_secure_boot_signature_t));
+        return ESP_FAIL;
+    }
+
+    /* Calculate digest of main image */
+    esp_err_t err = bootloader_sha256_flash_contents(src_addr, padded_length, digest);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Digest calculation failed 0x%x, 0x%x", src_addr, padded_length);
+        bootloader_munmap(data);
+        return err;
+    }
+
+    const ets_secure_boot_signature_t *sig = (const ets_secure_boot_signature_t *)(data + length);
+    int r = esp_secure_boot_verify_rsa_signature_block(sig, digest, verified_digest);
+    bootloader_munmap(data);
+
+    return (r == ETS_OK) ? ESP_OK : ESP_FAIL;
+}
+
+esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
+{
+    ets_secure_boot_key_digests_t trusted_keys;
+    ets_secure_boot_key_digests_t trusted_key_copies[2];
+    ETS_STATUS r;
+    ets_secure_boot_status_t sb_result;
+
+    memset(&trusted_keys, 0, sizeof(ets_secure_boot_key_digests_t));
+    memset(trusted_key_copies, 0, 2 * sizeof(ets_secure_boot_key_digests_t));
+
+    if (!esp_secure_boot_enabled()) {
+        return ESP_OK;
+    }
+
+    r = ets_secure_boot_read_key_digests(&trusted_keys);
+    if (r != ETS_OK) {
+        ESP_LOGI(TAG, "Could not read secure boot digests!");
+        return ESP_FAIL;
+    }
+
+    // Create the copies for FI checks (assuming result is ETS_OK, if it's not then it'll fail the fault check anyhow)
+    ets_secure_boot_read_key_digests(&trusted_key_copies[0]);
+    ets_secure_boot_read_key_digests(&trusted_key_copies[1]);
+    ESP_FAULT_ASSERT(memcmp(&trusted_keys, &trusted_key_copies[0], sizeof(ets_secure_boot_key_digests_t)) == 0);
+    ESP_FAULT_ASSERT(memcmp(&trusted_keys, &trusted_key_copies[1], sizeof(ets_secure_boot_key_digests_t)) == 0);
+
+    ESP_LOGI(TAG, "Verifying with RSA-PSS boot...");
+    sb_result = ets_secure_boot_verify_signature(sig_block, image_digest, &trusted_keys, verified_digest);
+    return (sb_result == SB_SUCCESS) ? ESP_OK : ESP_FAIL;
+}

components/bootloader_support/src/esp32s2beta/secure_boot.c

@@ -1,45 +0,0 @@
-// Copyright 2015-2018 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-#include "esp_secure_boot.h"
-#include "esp_log.h"
-#include "esp32s2beta/rom/secure_boot.h"
-
-#define TAG "secure_boot"
-
-esp_err_t esp_secure_boot_permanently_enable(void)
-{
-    uint8_t hash[32];
-
-    if (ets_efuse_secure_boot_enabled())
-    {
-        ESP_LOGI(TAG, "secure boot is already enabled, continuing..");
-        return ESP_OK;
-    }
-
-    ESP_LOGI(TAG, "Verifying bootloader signature...\n");
-    int r = ets_secure_boot_verify_bootloader(hash, false);
-    if (r != ESP_OK) {
-        ESP_LOGE(TAG, "Failed to verify bootloader signature");
-        return r;
-    }
-
-    ets_efuse_clear_program_registers();
-    REG_SET_BIT(EFUSE_PGM_DATA3_REG, EFUSE_SECURE_BOOT_EN);
-    ets_efuse_program(ETS_EFUSE_BLOCK0);
-
-    assert(ets_efuse_secure_boot_enabled());
-    ESP_LOGI(TAG, "Secure boot permanently enabled");
-
-    return ESP_OK;
-}

components/bootloader_support/src/esp32s2beta/secure_boot_signatures.c

@@ -1,92 +0,0 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-#include "sdkconfig.h"
-
-#include "bootloader_flash.h"
-#include "bootloader_sha.h"
-#include "esp_log.h"
-#include "esp_image_format.h"
-#include "esp32s2beta/rom/secure_boot.h"
-
-static const char* TAG = "secure_boot";
-
-#define DIGEST_LEN 32
-
-esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
-{
-    ets_secure_boot_key_digests_t trusted_keys = { 0 };
-    uint8_t digest[DIGEST_LEN];
-    const uint8_t *data;
-
-    ESP_LOGD(TAG, "verifying signature src_addr 0x%x length 0x%x", src_addr, length);
-
-    if ((src_addr + length) % 4096 != 0) {
-        ESP_LOGE(TAG, "addr 0x%x length 0x%x doesn't end on a sector boundary", src_addr, length);
-        return ESP_ERR_INVALID_ARG;
-    }
-
-    data = bootloader_mmap(src_addr, length + sizeof(struct ets_secure_boot_sig_block));
-    if(data == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", src_addr, length+sizeof(ets_secure_boot_signature_t));
-        return ESP_FAIL;
-    }
-
-    // Calculate digest of main image
-#ifdef BOOTLOADER_BUILD
-    bootloader_sha256_handle_t handle = bootloader_sha256_start();
-    bootloader_sha256_data(handle, data, length);
-    bootloader_sha256_finish(handle, digest);
-#else
-    /* Use thread-safe esp-idf SHA function */
-    esp_sha(SHA2_256, data, length, digest);
-#endif
-
-    int r = ets_secure_boot_read_key_digests(&trusted_keys);
-
-    if (r == ETS_OK) {
-        const ets_secure_boot_signature_t *sig = (const ets_secure_boot_signature_t *)(data + length);
-        // TODO: calling this function in IDF app context is unsafe
-        r = ets_secure_boot_verify_signature(sig, digest, &trusted_keys);
-    }
-    bootloader_munmap(data);
-
-    return (r == ETS_OK) ? ESP_OK : ESP_FAIL;
-}
-
-esp_err_t esp_secure_boot_verify_signature_block(uint32_t sig_block_flash_offs, const uint8_t *image_digest)
-{
-    ets_secure_boot_key_digests_t trusted_keys;
-
-    assert(sig_block_flash_offs % 4096 == 0); // TODO: enforce this in a better way
-
-    const ets_secure_boot_signature_t *sig = bootloader_mmap(sig_block_flash_offs, sizeof(ets_secure_boot_signature_t));
-
-    if (sig == NULL) {
-        ESP_LOGE(TAG, "Failed to mmap data at offset 0x%x", sig_block_flash_offs);
-        return ESP_FAIL;
-    }
-
-    int r = ets_secure_boot_read_key_digests(&trusted_keys);
-    if (r != 0) {
-        ESP_LOGE(TAG, "No trusted key digests were found in efuse!");
-    } else {
-        ESP_LOGD(TAG, "Verifying with RSA-PSS...");
-        // TODO: calling this function in IDF app context is unsafe
-        r = ets_secure_boot_verify_signature(sig, image_digest, &trusted_keys);
-    }
-
-    bootloader_munmap(sig);
-
-    return (r == 0) ? ESP_OK : ESP_ERR_IMAGE_INVALID;
-}

components/bootloader_support/src/esp_image_format.c

@@ -16,19 +16,22 @@
 #include <soc/cpu.h>
 #include <bootloader_utility.h>
 #include <esp_secure_boot.h>
+#include <esp_fault.h>
 #include <esp_log.h>
+#include <esp_attr.h>
 #include <esp_spi_flash.h>
 #include <bootloader_flash.h>
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
 #include "bootloader_util.h"
 #include "bootloader_common.h"
+#include "soc/soc_memory_layout.h"
 #if CONFIG_IDF_TARGET_ESP32
-#include <esp32/rom/rtc.h>
-#include <esp32/rom/secure_boot.h>
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include <esp32s2beta/rom/rtc.h>
-#include <esp32s2beta/rom/secure_boot.h>
+#include "esp32/rom/rtc.h"
+#include "esp32/rom/secure_boot.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/rtc.h"
+#include "esp32s2/rom/secure_boot.h"
 #endif
 
 /* Checking signatures as part of verifying images is necessary:
@@ -37,11 +40,11 @@
 */
 #ifdef BOOTLOADER_BUILD
 #ifdef CONFIG_SECURE_SIGNED_ON_BOOT
-#define SECURE_BOOT_CHECK_SIGNATURE
+#define SECURE_BOOT_CHECK_SIGNATURE 1
 #endif
 #else /* !BOOTLOADER_BUILD */
 #ifdef CONFIG_SECURE_SIGNED_ON_UPDATE
-#define SECURE_BOOT_CHECK_SIGNATURE
+#define SECURE_BOOT_CHECK_SIGNATURE 1
 #endif
 #endif
 
@@ -55,18 +58,12 @@ static const char *TAG = "esp_image";
 /* Headroom to ensure between stack SP (at time of checking) and data loaded from flash */
 #define STACK_LOAD_HEADROOM 32768
 
-/* Mmap source address mask */
-#define MMAP_ALIGNED_MASK 0x0000FFFF
-
 #ifdef BOOTLOADER_BUILD
 /* 64 bits of random data to obfuscate loaded RAM with, until verification is complete
    (Means loaded code isn't executable until after the secure boot check.)
 */
 static uint32_t ram_obfs_value[2];
 
-/* Range of IRAM used by the loader, defined in ld script */
-extern int _loader_text_start;
-extern int _loader_text_end;
 #endif
 
 /* Return true if load_addr is an address the bootloader should load into */
@@ -97,7 +94,7 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
 
 static esp_err_t verify_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data);
 
-static esp_err_t __attribute__((unused)) verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data);
+static esp_err_t __attribute__((unused)) verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest);
 static esp_err_t __attribute__((unused)) verify_simple_hash(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data);
 
 static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_t *part, esp_image_metadata_t *data)
@@ -107,7 +104,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     bool do_verify = (mode == ESP_IMAGE_LOAD) || (mode == ESP_IMAGE_VERIFY) || (mode == ESP_IMAGE_VERIFY_SILENT);
 #else
     bool do_load   = false; // Can't load the image in app mode
-    bool do_verify = true;	// In app mode is avalible only verify mode
+    bool do_verify = true;  // In app mode is available only verify mode
 #endif
     bool silent    = (mode == ESP_IMAGE_VERIFY_SILENT);
     esp_err_t err = ESP_OK;
@@ -115,6 +112,11 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     uint32_t checksum_word = ESP_ROM_CHECKSUM_INITIAL;
     uint32_t *checksum = NULL;
     bootloader_sha256_handle_t sha_handle = NULL;
+#if SECURE_BOOT_CHECK_SIGNATURE
+     /* used for anti-FI checks */
+    uint8_t image_digest[HASH_LEN] = { [ 0 ... 31] = 0xEE };
+    uint8_t verified_digest[HASH_LEN] = { [ 0 ... 31 ] = 0x01 };
+#endif
 
     if (data == NULL || part == NULL) {
         return ESP_ERR_INVALID_ARG;
@@ -172,6 +174,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     for (int i = 0; i < data->image.segment_count; i++) {
         esp_image_segment_header_t *header = &data->segments[i];
         ESP_LOGV(TAG, "loading segment header %d at offset 0x%x", i, next_addr);
+
         err = process_segment(i, next_addr, header, silent, do_load, sha_handle, checksum);
         if (err != ESP_OK) {
             goto err;
@@ -197,14 +200,14 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
             }
         }
 
-        /* For secure boot on ESP32, we don't calculate SHA or verify signautre on bootloaders.
-           For ESP32S2, we do verify signature on botoloaders which includes the SHA calculation.
+        /* For secure boot V1 on ESP32, we don't calculate SHA or verify signature on bootloaders.
+           For Secure Boot V2, we do verify signature on bootloader which includes the SHA calculation.
 
            (For non-secure boot, we don't verify any SHA-256 hash appended to the bootloader because
            esptool.py may have rewritten the header - rely on esptool.py having verified the bootloader at flashing time, instead.)
         */
         bool verify_sha;
-#if defined(CONFIG_SECURE_BOOT_ENABLED) && defined(CONFIG_IDF_TARGET_ESP32S2BETA)
+#if CONFIG_SECURE_BOOT_V2_ENABLED
         verify_sha = true;
 #else // ESP32, or ESP32S2 without secure boot enabled
         verify_sha = (data->start_addr != ESP_BOOTLOADER_OFFSET);
@@ -217,8 +220,17 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
 
 #ifdef SECURE_BOOT_CHECK_SIGNATURE
             // secure boot images have a signature appended
-            err = verify_secure_boot_signature(sha_handle, data);
-#else
+#if defined(BOOTLOADER_BUILD) && !defined(CONFIG_SECURE_BOOT)
+            // If secure boot is not enabled in hardware, then
+            // skip the signature check in bootloader when the debugger is attached.
+            // This is done to allow for breakpoints in Flash.
+            if (!esp_cpu_in_ocd_debug_mode()) {
+#else // CONFIG_SECURE_BOOT
+            if (true) {
+#endif // end checking for JTAG
+                err = verify_secure_boot_signature(sha_handle, data, image_digest, verified_digest);
+            }
+#else // SECURE_BOOT_CHECK_SIGNATURE
             // No secure boot, but SHA-256 can be appended for basic corruption detection
             if (sha_handle != NULL && !esp_cpu_in_ocd_debug_mode()) {
                 err = verify_simple_hash(sha_handle, data);
@@ -250,7 +262,28 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     }
 
 #ifdef BOOTLOADER_BUILD
-    if (do_load && ram_obfs_value[0] != 0 && ram_obfs_value[1] != 0) { // Need to deobfuscate RAM
+
+#ifdef SECURE_BOOT_CHECK_SIGNATURE
+    /* If signature was checked in bootloader build, verified_digest should equal image_digest
+
+       This is to detect any fault injection that caused signature verification to not complete normally.
+
+       Any attack which bypasses this check should be of limited use as the RAM contents are still obfuscated, therefore we do the check
+       immediately before we deobfuscate.
+
+       Note: the conditions for making this check are the same as for setting verify_sha above, but on ESP32 SB V1 we move the test for
+       "only verify signature in bootloader" into the macro so it's tested multiple times.
+     */
+#if CONFIG_SECURE_BOOT_V2_ENABLED
+    ESP_FAULT_ASSERT(!esp_secure_boot_enabled() || memcmp(image_digest, verified_digest, HASH_LEN) == 0);
+#else // Secure Boot V1 on ESP32, only verify signatures for apps not bootloaders
+    ESP_FAULT_ASSERT(data->start_addr == ESP_BOOTLOADER_OFFSET || memcmp(image_digest, verified_digest, HASH_LEN) == 0);
+#endif
+
+#endif // SECURE_BOOT_CHECK_SIGNATURE
+
+    // Deobfuscate RAM
+    if (do_load && ram_obfs_value[0] != 0 && ram_obfs_value[1] != 0) {
         for (int i = 0; i < data->image.segment_count; i++) {
             uint32_t load_addr = data->segments[i].load_addr;
             if (should_load(load_addr)) {
@@ -277,7 +310,7 @@ err:
     // Prevent invalid/incomplete data leaking out
     bzero(data, sizeof(esp_image_metadata_t));
     return err;
-    }
+}
 
 esp_err_t bootloader_load_image(const esp_partition_pos_t *part, esp_image_metadata_t *data)
 {
@@ -336,6 +369,127 @@ static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t
     return err;
 }
 
+#ifdef BOOTLOADER_BUILD
+/* Check the region load_addr - load_end doesn't overlap any memory used by the bootloader, registers, or other invalid memory
+ */
+static bool verify_load_addresses(int segment_index, intptr_t load_addr, intptr_t load_end, bool print_error, bool no_recurse)
+{
+    /* Addresses of static data and the "loader" section of bootloader IRAM, all defined in ld script */
+    const char *reason = NULL;
+    extern int _dram_start, _dram_end, _loader_text_start, _loader_text_end;
+    void *load_addr_p = (void *)load_addr;
+    void *load_end_p = (void *)load_end;
+
+    if (load_end == load_addr) {
+        return true; // zero-length segments are fine
+    }
+    assert(load_end > load_addr); // data_len<16MB is checked in verify_segment_header() which is called before this, so this should always be true
+
+    if (esp_ptr_in_dram(load_addr_p) && esp_ptr_in_dram(load_end_p)) { /* Writing to DRAM */
+        /* Check if we're clobbering the stack */
+        intptr_t sp = (intptr_t)get_sp();
+        if (bootloader_util_regions_overlap(sp - STACK_LOAD_HEADROOM, SOC_ROM_STACK_START,
+                                           load_addr, load_end)) {
+            reason = "overlaps bootloader stack";
+            goto invalid;
+        }
+
+        /* Check if we're clobbering static data
+
+           (_dram_start.._dram_end includes bss, data, rodata sections in DRAM)
+         */
+        if (bootloader_util_regions_overlap((intptr_t)&_dram_start, (intptr_t)&_dram_end, load_addr, load_end)) {
+            reason = "overlaps bootloader data";
+            goto invalid;
+        }
+
+        /* LAST DRAM CHECK (recursive): for D/IRAM, check the equivalent IRAM addresses if needed
+
+           Allow for the possibility that even though both pointers are IRAM, only part of the region is in a D/IRAM
+           section. In which case we recurse to check the part which falls in D/IRAM.
+
+           Note: We start with SOC_DIRAM_DRAM_LOW/HIGH and convert that address to IRAM to account for any reversing of word order
+           (chip-specific).
+         */
+        if (!no_recurse && bootloader_util_regions_overlap(SOC_DIRAM_DRAM_LOW, SOC_DIRAM_DRAM_HIGH, load_addr, load_end)) {
+            intptr_t iram_load_addr, iram_load_end;
+
+            if (esp_ptr_in_diram_dram(load_addr_p)) {
+                iram_load_addr = (intptr_t)esp_ptr_diram_dram_to_iram(load_addr_p);
+            } else {
+                iram_load_addr = (intptr_t)esp_ptr_diram_dram_to_iram((void *)SOC_DIRAM_DRAM_LOW);
+            }
+
+            if (esp_ptr_in_diram_dram(load_end_p)) {
+                iram_load_end = (intptr_t)esp_ptr_diram_dram_to_iram(load_end_p);
+            } else {
+                iram_load_end = (intptr_t)esp_ptr_diram_dram_to_iram((void *)SOC_DIRAM_DRAM_HIGH);
+            }
+
+            if (iram_load_end < iram_load_addr) {
+                return verify_load_addresses(segment_index, iram_load_end, iram_load_addr, print_error, true);
+            } else {
+                return verify_load_addresses(segment_index, iram_load_addr, iram_load_end, print_error, true);
+            }
+        }
+    }
+    else if (esp_ptr_in_iram(load_addr_p) && esp_ptr_in_iram(load_end_p)) { /* Writing to IRAM */
+        /* Check for overlap of 'loader' section of IRAM */
+        if (bootloader_util_regions_overlap((intptr_t)&_loader_text_start, (intptr_t)&_loader_text_end,
+                                            load_addr, load_end)) {
+            reason = "overlaps loader IRAM";
+            goto invalid;
+        }
+
+        /* LAST IRAM CHECK (recursive): for D/IRAM, check the equivalent DRAM address if needed
+
+           Allow for the possibility that even though both pointers are IRAM, only part of the region is in a D/IRAM
+           section. In which case we recurse to check the part which falls in D/IRAM.
+           Note: We start with SOC_DIRAM_IRAM_LOW/HIGH and convert that address to DRAM to account for any reversing of word order
+           (chip-specific).
+         */
+        if (!no_recurse && bootloader_util_regions_overlap(SOC_DIRAM_IRAM_LOW, SOC_DIRAM_IRAM_HIGH, load_addr, load_end)) {
+            intptr_t dram_load_addr, dram_load_end;
+
+            if (esp_ptr_in_diram_iram(load_addr_p)) {
+                dram_load_addr = (intptr_t)esp_ptr_diram_iram_to_dram(load_addr_p);
+            } else {
+                dram_load_addr = (intptr_t)esp_ptr_diram_iram_to_dram((void *)SOC_DIRAM_IRAM_LOW);
+            }
+
+            if (esp_ptr_in_diram_iram(load_end_p)) {
+                dram_load_end = (intptr_t)esp_ptr_diram_iram_to_dram(load_end_p);
+            } else {
+                dram_load_end = (intptr_t)esp_ptr_diram_iram_to_dram((void *)SOC_DIRAM_IRAM_HIGH);
+            }
+
+            if (dram_load_end < dram_load_addr) {
+                return verify_load_addresses(segment_index, dram_load_end, dram_load_addr, print_error, true);
+            } else {
+                return verify_load_addresses(segment_index, dram_load_addr, dram_load_end, print_error, true);
+            }
+        }
+    /* Sections entirely in RTC memory won't overlap with a vanilla bootloader but are valid load addresses, thus skipping them from the check */
+    } else if (esp_ptr_in_rtc_iram_fast(load_addr_p) && esp_ptr_in_rtc_iram_fast(load_end_p)){
+        return true;
+    } else if (esp_ptr_in_rtc_dram_fast(load_addr_p) && esp_ptr_in_rtc_dram_fast(load_end_p)){
+        return true;
+    } else if (esp_ptr_in_rtc_slow(load_addr_p) && esp_ptr_in_rtc_slow(load_end_p)) {
+        return true;
+    } else { /* Not a DRAM or an IRAM or RTC Fast IRAM, RTC Fast DRAM or RTC Slow address */
+        reason = "bad load address range";
+        goto invalid;
+    }
+    return true;
+
+ invalid:
+    if (print_error) {
+        ESP_LOGE(TAG, "Segment %d 0x%08x-0x%08x invalid: %s", segment_index, load_addr, load_end, reason);
+    }
+    return false;
+}
+#endif // BOOTLOADER_BUILD
+
 static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
 {
     esp_err_t err;
@@ -378,34 +532,9 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
 
 #ifdef BOOTLOADER_BUILD
     /* Before loading segment, check it doesn't clobber bootloader RAM. */
-    if (do_load) {
-        const intptr_t load_end = load_addr + data_len;
-        if (load_end < (intptr_t) SOC_DRAM_HIGH) {
-            /* Writing to DRAM */
-            intptr_t sp = (intptr_t)get_sp();
-            if (load_end > sp - STACK_LOAD_HEADROOM) {
-                /* Bootloader .data/.rodata/.bss is above the stack, so this
-                 * also checks that we aren't overwriting these segments.
-                 *
-                 * TODO: This assumes specific arrangement of sections we have
-                 * in the ESP32. Rewrite this in a generic way to support other
-                 * layouts.
-                 */
-                ESP_LOGE(TAG, "Segment %d end address 0x%08x too high (bootloader stack 0x%08x limit 0x%08x)",
-                         index, load_end, sp, sp - STACK_LOAD_HEADROOM);
-                return ESP_ERR_IMAGE_INVALID;
-            }
-        } else {
-            /* Writing to IRAM */
-            const intptr_t loader_iram_start = (intptr_t) &_loader_text_start;
-            const intptr_t loader_iram_end = (intptr_t) &_loader_text_end;
-
-            if (bootloader_util_regions_overlap(loader_iram_start, loader_iram_end,
-                                                load_addr, load_end)) {
-                ESP_LOGE(TAG, "Segment %d (0x%08x-0x%08x) overlaps bootloader IRAM (0x%08x-0x%08x)",
-                         index, load_addr, load_end, loader_iram_start, loader_iram_end);
-                return ESP_ERR_IMAGE_INVALID;
-            }
+    if (do_load && data_len > 0) {
+        if (!verify_load_addresses(index, load_addr, load_addr + data_len, true, false)) {
+            return ESP_ERR_IMAGE_INVALID;
         }
     }
 #endif // BOOTLOADER_BUILD
@@ -415,6 +544,10 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
 
     int32_t data_len_remain = data_len;
     while (data_len_remain > 0) {
+#if SECURE_BOOT_CHECK_SIGNATURE && defined(BOOTLOADER_BUILD)
+        /* Double check the address verification done above */
+        ESP_FAULT_ASSERT(!do_load || verify_load_addresses(0, load_addr, load_addr + data_len_remain, false, false));
+#endif
         uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
         /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
         data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
@@ -440,7 +573,7 @@ static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, ui
 {
     // If we are not loading, and the checksum is empty, skip processing this
     // segment for data
-    if(!do_load && checksum == NULL) {
+    if (!do_load && checksum == NULL) {
         ESP_LOGD(TAG, "skipping checksum for segment");
         return ESP_OK;
     }
@@ -599,7 +732,7 @@ static esp_err_t verify_checksum(bootloader_sha256_handle_t sha_handle, uint32_t
     length = (length + 15) & ~15; // Pad to next full 16 byte block
 
     // Verify checksum
-    uint8_t buf[16];
+    WORD_ALIGNED_ATTR uint8_t buf[16];
     esp_err_t err = bootloader_flash_read(data->start_addr + unpadded_length, buf, length - unpadded_length, true);
     uint8_t calc = buf[length - unpadded_length - 1];
     uint8_t checksum = (checksum_word >> 24)
@@ -623,9 +756,9 @@ static esp_err_t verify_checksum(bootloader_sha256_handle_t sha_handle, uint32_t
     return ESP_OK;
 }
 
-static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data)
+static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest)
 {
-    uint8_t image_hash[HASH_LEN] = { 0 };
+#ifdef SECURE_BOOT_CHECK_SIGNATURE
     uint32_t end = data->start_addr + data->image_len;
 
     ESP_LOGI(TAG, "Verifying image signature...");
@@ -638,25 +771,36 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
         bootloader_munmap(simple_hash);
     }
 
-#ifdef CONFIG_IDF_TARGET_ESP32S2BETA
-    // Pad to 4096 byte sector boundary
-    if (end % FLASH_SECTOR_SIZE != 0) {
-        uint32_t pad_len = FLASH_SECTOR_SIZE - (end % FLASH_SECTOR_SIZE);
-        const void *padding = bootloader_mmap(end, pad_len);
-        bootloader_sha256_data(sha_handle, padding, pad_len);
+#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+    // End of the image needs to be padded all the way to a 4KB boundary, after the simple hash
+    // (for apps they are usually already padded due to --secure-pad-v2, only a problem if this option was not used.)
+    uint32_t padded_end = (end + FLASH_SECTOR_SIZE - 1) & ~(FLASH_SECTOR_SIZE-1);
+    if (padded_end > end) {
+        const void *padding = bootloader_mmap(end, padded_end - end);
+        bootloader_sha256_data(sha_handle, padding, padded_end - end);
         bootloader_munmap(padding);
-        end += pad_len;
+        end = padded_end;
     }
 #endif
 
-    bootloader_sha256_finish(sha_handle, image_hash);
+    bootloader_sha256_finish(sha_handle, image_digest);
 
     // Log the hash for debugging
-    bootloader_debug_buffer(image_hash, HASH_LEN, "Calculated secure boot hash");
+    bootloader_debug_buffer(image_digest, HASH_LEN, "Calculated secure boot hash");
 
     // Use hash to verify signature block
-    const esp_secure_boot_sig_block_t *sig_block = bootloader_mmap(data->start_addr + data->image_len, sizeof(esp_secure_boot_sig_block_t));
-    esp_err_t err = esp_secure_boot_verify_signature_block(sig_block, image_hash);
+    esp_err_t err = ESP_ERR_IMAGE_INVALID;
+    const void *sig_block;
+#ifdef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
+    ESP_FAULT_ASSERT(memcmp(image_digest, verified_digest, HASH_LEN) != 0); /* sanity check that these values start differently */
+    sig_block = bootloader_mmap(data->start_addr + data->image_len, sizeof(esp_secure_boot_sig_block_t));
+    err = esp_secure_boot_verify_ecdsa_signature_block(sig_block, image_digest, verified_digest);
+#elif CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+    ESP_FAULT_ASSERT(memcmp(image_digest, verified_digest, HASH_LEN) != 0);  /* sanity check that these values start differently */
+    sig_block = bootloader_mmap(end, sizeof(ets_secure_boot_signature_t));
+    err = esp_secure_boot_verify_rsa_signature_block(sig_block, image_digest, verified_digest);
+#endif
+
     bootloader_munmap(sig_block);
     if (err != ESP_OK) {
         ESP_LOGE(TAG, "Secure boot signature verification failed");
@@ -677,11 +821,12 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
         return ESP_ERR_IMAGE_INVALID;
     }
 
-#if CONFIG_IDF_TARGET_ESP32S2BETA
+#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
     // Adjust image length result to include the appended signature
     data->image_len = end - data->start_addr + sizeof(ets_secure_boot_signature_t);
 #endif
 
+#endif // SECURE_BOOT_CHECK_SIGNATURE
     return ESP_OK;
 }
 

components/bootloader_support/src/flash_encrypt.c

@@ -20,6 +20,14 @@
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 
+#if CONFIG_IDF_TARGET_ESP32
+#define CRYPT_CNT ESP_EFUSE_FLASH_CRYPT_CNT
+#define WR_DIS_CRYPT_CNT ESP_EFUSE_WR_DIS_FLASH_CRYPT_CNT
+#elif CONFIG_IDF_TARGET_ESP32S2
+#define CRYPT_CNT ESP_EFUSE_SPI_BOOT_CRYPT_CNT
+#define WR_DIS_CRYPT_CNT ESP_EFUSE_WR_DIS_SPI_BOOT_CRYPT_CNT
+#endif
+
 #ifndef BOOTLOADER_BUILD
 static const char *TAG = "flash_encrypt";
 
@@ -31,16 +39,22 @@ void esp_flash_encryption_init_checks()
     // FLASH_CRYPT_CNT *must* be write protected. This will have happened automatically
     // if bootloader is IDF V4.0 or newer but may not have happened for previous ESP-IDF bootloaders.
 #ifdef CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef CONFIG_SECURE_BOOT
     if (esp_secure_boot_enabled() && esp_flash_encryption_enabled()) {
-        uint8_t flash_crypt_cnt_wr_dis = 0;
-        esp_efuse_read_field_blob(ESP_EFUSE_WR_DIS_FLASH_CRYPT_CNT, &flash_crypt_cnt_wr_dis, 1);
+        bool flash_crypt_cnt_wr_dis = esp_efuse_read_field_bit(WR_DIS_CRYPT_CNT);
         if (!flash_crypt_cnt_wr_dis) {
-            ESP_EARLY_LOGE(TAG, "Flash encryption & Secure Boot together requires FLASH_CRYPT_CNT efuse to be write protected. Fixing now...");
+            uint8_t flash_crypt_cnt = 0;
+            esp_efuse_read_field_blob(CRYPT_CNT, &flash_crypt_cnt,  CRYPT_CNT[0]->bit_count);
+            if (flash_crypt_cnt == (1<<(CRYPT_CNT[0]->bit_count))-1) {
+                // If encryption counter is already max, no need to write protect it
+                // (this distinction is important on ESP32 ECO3 where write-procted FLASH_CRYPT_CNT also write-protects UART_DL_DIS)
+                return;
+            }
+            ESP_LOGE(TAG, "Flash encryption & Secure Boot together requires FLASH_CRYPT_CNT efuse to be write protected. Fixing now...");
             esp_flash_write_protect_crypt_cnt();
         }
     }
-#endif // CONFIG_SECURE_BOOT_ENABLED
+#endif // CONFIG_SECURE_BOOT
 #endif // CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
 
     // Second check is to print a warning or error if the current running flash encryption mode
@@ -48,43 +62,67 @@ void esp_flash_encryption_init_checks()
     mode = esp_get_flash_encryption_mode();
     if (mode == ESP_FLASH_ENC_MODE_DEVELOPMENT) {
 #ifdef CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
-        ESP_EARLY_LOGE(TAG, "Flash encryption settings error: app is configured for RELEASE but efuses are set for DEVELOPMENT");
-        ESP_EARLY_LOGE(TAG, "Mismatch found in security options in bootloader menuconfig and efuse settings. Device is not secure.");
+        ESP_LOGE(TAG, "Flash encryption settings error: app is configured for RELEASE but efuses are set for DEVELOPMENT");
+        ESP_LOGE(TAG, "Mismatch found in security options in bootloader menuconfig and efuse settings. Device is not secure.");
 #else
-        ESP_EARLY_LOGW(TAG, "Flash encryption mode is DEVELOPMENT (not secure)");
+        ESP_LOGW(TAG, "Flash encryption mode is DEVELOPMENT (not secure)");
 #endif
     } else if (mode == ESP_FLASH_ENC_MODE_RELEASE) {
-        ESP_EARLY_LOGI(TAG, "Flash encryption mode is RELEASE");
+        ESP_LOGI(TAG, "Flash encryption mode is RELEASE");
     }
 }
 #endif
 
 void esp_flash_write_protect_crypt_cnt(void)
 {
-    uint8_t flash_crypt_cnt_wr_dis = 0;
-    esp_efuse_read_field_blob(ESP_EFUSE_WR_DIS_FLASH_CRYPT_CNT, &flash_crypt_cnt_wr_dis, 1);
-    if (!flash_crypt_cnt_wr_dis) {
-        esp_efuse_write_field_cnt(ESP_EFUSE_WR_DIS_FLASH_CRYPT_CNT, 1);
-    }
+    esp_efuse_write_field_bit(WR_DIS_CRYPT_CNT);
 }
 
 esp_flash_enc_mode_t esp_get_flash_encryption_mode(void)
 {
-    uint8_t efuse_flash_crypt_cnt_wr_protected = 0;
+    bool flash_crypt_cnt_wr_dis = false;
+#if CONFIG_IDF_TARGET_ESP32   
     uint8_t dis_dl_enc = 0, dis_dl_dec = 0, dis_dl_cache = 0;
+#elif CONFIG_IDF_TARGET_ESP32S2
+    uint8_t  dis_dl_enc = 0; 
+    uint8_t dis_dl_icache = 0; 
+    uint8_t dis_dl_dcache = 0; 
+
+#endif
+
     esp_flash_enc_mode_t mode = ESP_FLASH_ENC_MODE_DEVELOPMENT;
 
     if (esp_flash_encryption_enabled()) {
         /* Check if FLASH CRYPT CNT is write protected */
-        esp_efuse_read_field_blob(ESP_EFUSE_WR_DIS_FLASH_CRYPT_CNT, &efuse_flash_crypt_cnt_wr_protected, 1);
-        if (efuse_flash_crypt_cnt_wr_protected) {
-            esp_efuse_read_field_blob(ESP_EFUSE_DISABLE_DL_CACHE, &dis_dl_cache, 1);
-            esp_efuse_read_field_blob(ESP_EFUSE_DISABLE_DL_ENCRYPT, &dis_dl_enc, 1);
-            esp_efuse_read_field_blob(ESP_EFUSE_DISABLE_DL_DECRYPT, &dis_dl_dec, 1);
+
+        flash_crypt_cnt_wr_dis = esp_efuse_read_field_bit(WR_DIS_CRYPT_CNT);
+        if (!flash_crypt_cnt_wr_dis) {
+            uint8_t flash_crypt_cnt = 0;
+            esp_efuse_read_field_blob(CRYPT_CNT, &flash_crypt_cnt, CRYPT_CNT[0]->bit_count);
+            if (flash_crypt_cnt == (1 << (CRYPT_CNT[0]->bit_count)) - 1) {
+                flash_crypt_cnt_wr_dis = true;
+            }
+        }
+
+        if (flash_crypt_cnt_wr_dis) {
+
+#if CONFIG_IDF_TARGET_ESP32
+            dis_dl_cache = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_CACHE);
+            dis_dl_enc = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_ENCRYPT);
+            dis_dl_dec = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_DECRYPT);
             /* Check if DISABLE_DL_DECRYPT, DISABLE_DL_ENCRYPT & DISABLE_DL_CACHE are set */
             if ( dis_dl_cache && dis_dl_enc && dis_dl_dec ) {
                 mode = ESP_FLASH_ENC_MODE_RELEASE;
             }
+#elif CONFIG_IDF_TARGET_ESP32S2
+            dis_dl_enc = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
+            dis_dl_icache = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
+            dis_dl_dcache = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_DCACHE);
+
+            if (dis_dl_enc && dis_dl_icache && dis_dl_dcache) {
+                mode = ESP_FLASH_ENC_MODE_RELEASE;
+            }
+#endif
         }
     } else {
         mode = ESP_FLASH_ENC_MODE_DISABLED;

components/bootloader_support/src/flash_qio_mode.c

@@ -13,15 +13,16 @@
 // limitations under the License.
 #include <stddef.h>
 #include <stdint.h>
+#include "bootloader_flash_config.h"
 #include "flash_qio_mode.h"
 #include "esp_log.h"
 #include "esp_err.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/spi_flash.h"
 #include "esp32/rom/efuse.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/spi_flash.h"
-#include "esp32s2beta/rom/efuse.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/spi_flash.h"
+#include "esp32s2/rom/efuse.h"
 #include "soc/spi_mem_struct.h"
 #endif
 #include "soc/spi_struct.h"
@@ -33,7 +34,7 @@
 /* SPI flash controller */
 #if CONFIG_IDF_TARGET_ESP32
 #define SPIFLASH SPI1
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
 #define SPIFLASH SPIMEM1
 #endif
 
@@ -84,12 +85,6 @@ static unsigned read_status_8b_xmc25qu64a(void);
 /* Write 8 bit status of XM25QU64A */
 static void write_status_8b_xmc25qu64a(unsigned new_status);
 
-#define ESP32_D2WD_WP_GPIO 7 /* ESP32-D2WD has this GPIO wired to WP pin of flash */
-
-#ifndef CONFIG_BOOTLOADER_SPI_WP_PIN // Set in menuconfig if SPI flasher config is set to a quad mode
-#define CONFIG_BOOTLOADER_SPI_WP_PIN ESP32_D2WD_WP_GPIO
-#endif
-
 /* Array of known flash chips and data to enable Quad I/O mode
 
    Manufacturer & flash ID can be tested by running "esptool.py
@@ -141,7 +136,7 @@ uint32_t bootloader_read_flash_id(void)
     return id;
 }
 
-#if CONFIG_IDF_TARGET_ESP32S2BETA
+#if CONFIG_IDF_TARGET_ESP32S2
 #define FLASH_WRAP_CMD   0x77
 typedef enum {
     FLASH_WRAP_MODE_8B  = 0,
@@ -212,7 +207,7 @@ void bootloader_enable_qio_mode(void)
     enable_qio_mode(chip_data[i].read_status_fn,
                     chip_data[i].write_status_fn,
                     chip_data[i].status_qio_bit);
-#if CONFIG_IDF_TARGET_ESP32S2BETA
+#if CONFIG_IDF_TARGET_ESP32S2
     spi_flash_wrap_set(FLASH_WRAP_MODE_DISABLE);
 #endif
 }
@@ -224,24 +219,6 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
     uint32_t status;
     const uint32_t spiconfig = ets_efuse_get_spiconfig();
 
-#if CONFIG_IDF_TARGET_ESP32
-    if (spiconfig != EFUSE_SPICONFIG_SPI_DEFAULTS && spiconfig != EFUSE_SPICONFIG_HSPI_DEFAULTS) {
-        // spiconfig specifies a custom efuse pin configuration. This config defines all pins -except- WP,
-        // which is compiled into the bootloader instead.
-        //
-        // Most commonly an overriden pin mapping means ESP32-D2WD or ESP32-PICOD4.
-        //Warn if chip is ESP32-D2WD/ESP32-PICOD4 but someone has changed the WP pin
-        //assignment from that chip's WP pin.
-        uint32_t pkg_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
-        if (CONFIG_BOOTLOADER_SPI_WP_PIN != ESP32_D2WD_WP_GPIO  &&
-                (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5 ||
-                 pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2 ||
-                 pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4)) {
-            ESP_LOGW(TAG, "Chip is ESP32-D2WD/ESP32-PICOD4 but flash WP pin is different value to internal flash");
-        }
-    }
-#endif
-
     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
 
     status = read_status_fn();
@@ -276,13 +253,10 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
     esp_rom_spiflash_config_readmode(mode);
 
 #if CONFIG_IDF_TARGET_ESP32
-    esp_rom_spiflash_select_qio_pins(CONFIG_BOOTLOADER_SPI_WP_PIN, spiconfig);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    if (ets_efuse_get_wp_pad() <= MAX_PAD_GPIO_NUM) {
-        esp_rom_spiflash_select_qio_pins(ets_efuse_get_wp_pad(), spiconfig);
-    } else {
-        esp_rom_spiflash_select_qio_pins(CONFIG_BOOTLOADER_SPI_WP_PIN, spiconfig);
-    }
+    int wp_pin = bootloader_flash_get_wp_pin();
+    esp_rom_spiflash_select_qio_pins(wp_pin, spiconfig);
+#elif CONFIG_IDF_TARGET_ESP32S2
+    esp_rom_spiflash_select_qio_pins(ets_efuse_get_wp_pad(), spiconfig);
 #endif
     return ESP_OK;
 }
@@ -340,7 +314,7 @@ static uint32_t execute_flash_command(uint8_t command, uint32_t mosi_data, uint8
     uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
 #if CONFIG_IDF_TARGET_ESP32
     SPIFLASH.ctrl.val = SPI_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     SPIFLASH.ctrl.val = SPI_MEM_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
 #endif
     SPIFLASH.user.usr_dummy = 0;
@@ -352,13 +326,13 @@ static uint32_t execute_flash_command(uint8_t command, uint32_t mosi_data, uint8
     SPIFLASH.user.usr_miso = miso_len > 0;
 #if CONFIG_IDF_TARGET_ESP32
     SPIFLASH.miso_dlen.usr_miso_dbitlen = miso_len ? (miso_len - 1) : 0;
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     SPIFLASH.miso_dlen.usr_miso_bit_len = miso_len ? (miso_len - 1) : 0;
 #endif
     SPIFLASH.user.usr_mosi = mosi_len > 0;
 #if CONFIG_IDF_TARGET_ESP32
     SPIFLASH.mosi_dlen.usr_mosi_dbitlen = mosi_len ? (mosi_len - 1) : 0;
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
     SPIFLASH.mosi_dlen.usr_mosi_bit_len = mosi_len ? (mosi_len - 1) : 0;
 #endif
     SPIFLASH.data_buf[0] = mosi_data;

components/bootloader_support/src/idf/bootloader_sha.c

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 #include "bootloader_sha.h"
+#include "bootloader_flash.h"
 #include <stdbool.h>
 #include <string.h>
 #include <assert.h>
@@ -50,4 +51,5 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
     }
     mbedtls_sha256_free(ctx);
     free(handle);
+    handle = NULL;
 }

components/bootloader_support/src/idf/secure_boot_signatures.c

@@ -15,46 +15,60 @@
 
 #include "bootloader_flash.h"
 #include "bootloader_sha.h"
+#include "bootloader_utility.h"
 #include "esp_log.h"
 #include "esp_image_format.h"
 #include "esp_secure_boot.h"
 #include "mbedtls/sha256.h"
 #include "mbedtls/x509.h"
+#include "mbedtls/md.h"
+#include "mbedtls/platform.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include <string.h>
+#include <sys/param.h>
+#include "esp_secure_boot.h"
 
-static const char *TAG = "secure_boot";
+#ifdef CONFIG_IDF_TARGET_ESP32S2
+#include <esp32s2/rom/secure_boot.h>
+#endif
+
+#define DIGEST_LEN 32
+
+#ifdef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
+static const char *TAG = "secure_boot_v1";
 
 extern const uint8_t signature_verification_key_start[] asm("_binary_signature_verification_key_bin_start");
 extern const uint8_t signature_verification_key_end[] asm("_binary_signature_verification_key_bin_end");
 
 #define SIGNATURE_VERIFICATION_KEYLEN 64
 
-#define DIGEST_LEN 32
-
 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 {
     uint8_t digest[DIGEST_LEN];
-    const uint8_t *data;
+    uint8_t verified_digest[DIGEST_LEN];
     const esp_secure_boot_sig_block_t *sigblock;
 
     ESP_LOGD(TAG, "verifying signature src_addr 0x%x length 0x%x", src_addr, length);
 
-    data = bootloader_mmap(src_addr, length + sizeof(esp_secure_boot_sig_block_t));
-    if (data == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", src_addr, length + sizeof(esp_secure_boot_sig_block_t));
-        return ESP_FAIL;
+    esp_err_t err = bootloader_sha256_flash_contents(src_addr, length, digest);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Digest calculation failed 0x%x, 0x%x", src_addr, length);
+        return err;
     }
 
-    // Calculate digest of main image
-    mbedtls_sha256_ret(data, length, digest, 0);
-
     // Map the signature block and verify the signature
-    sigblock = (const esp_secure_boot_sig_block_t *)(data + length);
-    esp_err_t err = esp_secure_boot_verify_signature_block(sigblock, digest);
-    bootloader_munmap(data);
+    sigblock = (const esp_secure_boot_sig_block_t *)bootloader_mmap(src_addr + length, sizeof(esp_secure_boot_sig_block_t));
+    if (sigblock == NULL) {
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", src_addr + length, sizeof(esp_secure_boot_sig_block_t));
+        return ESP_FAIL;
+    }
+    err = esp_secure_boot_verify_ecdsa_signature_block(sigblock, digest, verified_digest);
+    bootloader_munmap(sigblock);
     return err;
 }
 
-esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest)
+esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
 {
 #if !(defined(CONFIG_MBEDTLS_ECDSA_C) && defined(CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED))
     ESP_LOGE(TAG, "Signature verification requires ECDSA & SECP256R1 curve enabled");
@@ -62,6 +76,9 @@ esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block
 #else
     ptrdiff_t keylen;
 
+    /* Note: in IDF app image verification we don't add any fault injection resistance, boot-time checks only */
+    memset(verified_digest, 0, DIGEST_LEN);
+
     keylen = signature_verification_key_end - signature_verification_key_start;
     if (keylen != SIGNATURE_VERIFICATION_KEYLEN) {
         ESP_LOGE(TAG, "Embedded public verification key has wrong length %d", keylen);
@@ -123,3 +140,198 @@ cleanup:
     return ret == 0 ? ESP_OK : ESP_ERR_IMAGE_INVALID;
 #endif // CONFIG_MBEDTLS_ECDSA_C && CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED
 }
+
+#elif CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+
+static const char *TAG = "secure_boot_v2";
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
+#define RSA_KEY_SIZE 384 /* RSA 3072 Bits */
+
+#if CONFIG_IDF_TARGET_ESP32S2
+inline static bool digest_matches(const void *trusted, const void *computed)
+{
+    if (trusted == NULL) {
+        return false;
+    }
+
+    // 'trusted' is probably a pointer to read-only efuse registers,
+    // which only support word reads. memcmp() cannot be guaranteed
+    // to do word reads, so we make a local copy here (we know that
+    // memcpy() will do word operations if it can).
+    uint8_t __attribute__((aligned(4))) trusted_local[ETS_DIGEST_LEN];
+    uint8_t __attribute__((aligned(4))) computed_local[ETS_DIGEST_LEN];
+
+    memcpy(trusted_local, trusted, ETS_DIGEST_LEN);
+    memcpy(computed_local, computed, ETS_DIGEST_LEN);
+    return memcmp(trusted_local, computed_local, ETS_DIGEST_LEN) == 0;
+}
+#endif /* CONFIG_IDF_TARGET_ESP32S2 */
+
+esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
+{
+    uint8_t digest[DIGEST_LEN] = {0};
+    uint8_t verified_digest[DIGEST_LEN] = {0};
+
+    /* Rounding off length to the upper 4k boundary */
+    uint32_t padded_length = ALIGN_UP(length, FLASH_SECTOR_SIZE);
+    ESP_LOGD(TAG, "verifying signature src_addr 0x%x length 0x%x", src_addr, length);
+
+    esp_err_t err = bootloader_sha256_flash_contents(src_addr, padded_length, digest);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Digest calculation failed 0x%x, 0x%x", src_addr, padded_length);
+        return err;
+    }
+
+    const ets_secure_boot_signature_t *sig_block = bootloader_mmap(src_addr + padded_length, sizeof(ets_secure_boot_signature_t));
+    if (sig_block == NULL) {
+        ESP_LOGE(TAG, "Failed to mmap data at offset 0x%x", src_addr + padded_length);
+        return ESP_FAIL;
+    }
+
+    err = esp_secure_boot_verify_rsa_signature_block(sig_block, digest, verified_digest);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Secure Boot V2 verification failed.");
+    }
+    bootloader_munmap(sig_block);
+    return err;
+}
+
+esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
+{
+    uint8_t i = 0;
+#if CONFIG_SECURE_BOOT_V2_ENABLED /* Verify key against efuse block */
+    uint8_t sig_block_key_digest[SECURE_BOOT_NUM_BLOCKS][DIGEST_LEN] = {0};
+
+    /* Note: in IDF verification we don't add any fault injection resistance, as we don't expect this to be called
+       during boot-time verification. */
+    memset(verified_digest, 0, DIGEST_LEN);
+
+    /* Generating the SHA of the public key components in the signature block */
+    for (i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+        bootloader_sha256_handle_t sig_block_sha;
+        sig_block_sha = bootloader_sha256_start();
+        bootloader_sha256_data(sig_block_sha, &sig_block->block[i].key, sizeof(sig_block->block[i].key));
+        bootloader_sha256_finish(sig_block_sha, (unsigned char *)sig_block_key_digest[i]);
+    }
+
+#if CONFIG_IDF_TARGET_ESP32
+    uint8_t efuse_trusted_digest[DIGEST_LEN] = {0};
+    memcpy(efuse_trusted_digest, (uint8_t *) EFUSE_BLK2_RDATA0_REG, sizeof(efuse_trusted_digest));
+
+    if (memcmp(efuse_trusted_digest, sig_block_key_digest[0], DIGEST_LEN) != 0) {
+        const uint8_t zeroes[DIGEST_LEN] = {0};
+        /* Can't continue if secure boot is enabled, OR if a different digest is already written in efuse BLK2
+
+           (If BLK2 is empty and Secure Boot is disabled then we assume that it will be enabled later.)
+         */
+        if (esp_secure_boot_enabled() || memcmp(efuse_trusted_digest, zeroes, DIGEST_LEN) != 0) {
+            ESP_LOGE(TAG, "Public key digest in eFuse BLK2 and the signature block don't match.");
+            return ESP_FAIL;
+        }
+    }
+#elif CONFIG_IDF_TARGET_ESP32S2
+    bool match = false;
+    ets_secure_boot_key_digests_t efuse_trusted_digest;
+    ETS_STATUS r;
+    r = ets_secure_boot_read_key_digests(&efuse_trusted_digest);
+    if (r != 0) {
+        ESP_LOGI(TAG, "Could not read secure boot digests!");
+        return ESP_FAIL;
+    }
+#endif /* CONFIG_IDF_TARGET_ESP32 */
+#endif /* CONFIG_SECURE_BOOT_V2_ENABLED */
+
+    ESP_LOGI(TAG, "Verifying with RSA-PSS...");
+    int ret = 0;
+    mbedtls_rsa_context pk;
+    mbedtls_entropy_context entropy;
+    mbedtls_ctr_drbg_context ctr_drbg;
+    unsigned char *sig_be = calloc(1, RSA_KEY_SIZE);
+    unsigned char *buf = calloc(1, RSA_KEY_SIZE);
+    if (sig_be == NULL || buf == NULL) {
+        return ESP_ERR_NO_MEM;
+    }
+
+    mbedtls_entropy_init(&entropy);
+    mbedtls_ctr_drbg_init(&ctr_drbg);
+    ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);
+    if (ret != 0) {
+        ESP_LOGE(TAG, "mbedtls_ctr_drbg_seed returned -0x%04x\n", ret);
+        goto exit;
+    }
+
+    for (i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+#if CONFIG_IDF_TARGET_ESP32S2
+        for (uint8_t j = 0; j < SECURE_BOOT_NUM_BLOCKS; j++) {
+            if (digest_matches(efuse_trusted_digest.key_digests[j], sig_block_key_digest[i])) {
+                ESP_LOGI(TAG, "eFuse key matches(%d) matches the application key(%d).", j, i);
+                match = true;
+                break;
+            }
+        }
+        if (match == false) {
+            continue; // Skip the public keys whose digests don't match.
+        }
+# endif
+
+        const mbedtls_mpi N = { .s = 1,
+                                .n = sizeof(sig_block->block[i].key.n)/sizeof(mbedtls_mpi_uint),
+                                .p = (void *)sig_block->block[i].key.n,
+        };
+        const mbedtls_mpi e = { .s = 1,
+                                .n = sizeof(sig_block->block[i].key.e)/sizeof(mbedtls_mpi_uint), // 1
+                                .p = (void *)&sig_block->block[i].key.e,
+        };
+        mbedtls_rsa_init(&pk, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA256);
+        ret = mbedtls_rsa_import(&pk, &N, NULL, NULL, NULL, &e);
+        if (ret != 0) {
+            ESP_LOGE(TAG, "Failed mbedtls_rsa_import, err: %d", ret);
+            goto exit;
+        }
+
+        ret = mbedtls_rsa_complete(&pk);
+        if (ret != 0) {
+            ESP_LOGE(TAG, "Failed mbedtls_rsa_complete, err: %d", ret);
+            goto exit;
+        }
+
+        ret = mbedtls_rsa_check_pubkey(&pk);
+        if (ret != 0) {
+            ESP_LOGI(TAG, "Key is not an RSA key -%0x", -ret);
+            goto exit;
+        }
+
+        /* Signature needs to be byte swapped into BE representation */
+        for (int j = 0; j < RSA_KEY_SIZE; j++) {
+            sig_be[RSA_KEY_SIZE- j - 1] = sig_block->block[i].signature[j];
+        }
+
+        ret = mbedtls_rsa_public( &pk, sig_be, buf);
+        if (ret != 0) {
+            ESP_LOGE(TAG, "mbedtls_rsa_public failed, err: %d", ret);
+            goto exit;
+        }
+
+        ret = mbedtls_rsa_rsassa_pss_verify( &pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA256, DIGEST_LEN, 
+                                            sig_block->block[i].image_digest, sig_be);
+        if (ret != 0) {
+            ESP_LOGE(TAG, "Failed mbedtls_rsa_rsassa_pss_verify, err: %d", ret);
+        } else {
+            ESP_LOGI(TAG, "Signature verified successfully!");
+        }
+        exit:
+            mbedtls_rsa_free(&pk);
+            if (ret == 0) {
+                break;
+            }
+    }
+    
+    free(sig_be);
+    free(buf);
+#if CONFIG_IDF_TARGET_ESP32
+    return (ret != 0) ? ESP_ERR_IMAGE_INVALID: ESP_OK;
+#elif CONFIG_IDF_TARGET_ESP32S2
+    return (ret != 0 || match == false) ? ESP_ERR_IMAGE_INVALID: ESP_OK;
+#endif /* CONFIG_IDF_TARGET_ESP32 */
+}
+#endif

components/bootloader_support/test/CMakeLists.txt

@@ -1,3 +1,3 @@
 idf_component_register(SRC_DIRS "."
-                    INCLUDE_DIRS "."
-                    REQUIRES unity bootloader_support app_update)
+                    PRIV_INCLUDE_DIRS "."
+                    PRIV_REQUIRES unity bootloader_support app_update)

components/bootloader_support/test/test_verify_image.c

@@ -33,7 +33,7 @@ TEST_CASE("Verify bootloader image in flash", "[bootloader_support]")
     TEST_ASSERT_EQUAL(data.image_len, bootloader_length);
 }
 
-#if !TEMPORARY_DISABLED_FOR_TARGETS(ESP32S2BETA)
+#if !TEMPORARY_DISABLED_FOR_TARGETS(ESP32S2)
 TEST_CASE("Verify unit test app image", "[bootloader_support]")
 {
     esp_image_metadata_t data = { 0 };

components/bt/CMakeLists.txt

@@ -47,6 +47,7 @@ if(CONFIG_BT_ENABLED)
             host/bluedroid/btc/profile/esp/blufi/include
             host/bluedroid/btc/profile/esp/include
             host/bluedroid/btc/profile/std/a2dp/include
+            host/bluedroid/btc/profile/std/hid/include
             host/bluedroid/btc/profile/std/include
             host/bluedroid/btc/include
             host/bluedroid/stack/btm/include
@@ -166,6 +167,8 @@ if(CONFIG_BT_ENABLED)
                    "host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c"
                    "host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c"
                    "host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c"
+                   "host/bluedroid/btc/profile/std/hid/hidh_api.c"
+                   "host/bluedroid/btc/profile/std/hid/hidh_conn.c"
                    "host/bluedroid/btc/profile/std/gap/btc_gap_ble.c"
                    "host/bluedroid/btc/profile/std/gap/btc_gap_bt.c"
                    "host/bluedroid/btc/profile/std/gap/bta_gap_bt_co.c"
@@ -312,6 +315,7 @@ if(CONFIG_BT_ENABLED)
     if(CONFIG_BLE_MESH)
         list(APPEND include_dirs
                     "esp_ble_mesh/mesh_common/include"
+                    "esp_ble_mesh/mesh_common/tinycrypt/include"
                     "esp_ble_mesh/mesh_core"
                     "esp_ble_mesh/mesh_core/include"
                     "esp_ble_mesh/mesh_core/storage"
@@ -323,7 +327,8 @@ if(CONFIG_BT_ENABLED)
                     "esp_ble_mesh/api/models/include"
                     "esp_ble_mesh/api")
 
-        list(APPEND srcs "esp_ble_mesh/api/core/esp_ble_mesh_common_api.c"
+        list(APPEND srcs "esp_ble_mesh/api/core/esp_ble_mesh_ble_api.c"
+                    "esp_ble_mesh/api/core/esp_ble_mesh_common_api.c"
                     "esp_ble_mesh/api/core/esp_ble_mesh_local_data_operation_api.c"
                     "esp_ble_mesh/api/core/esp_ble_mesh_low_power_api.c"
                     "esp_ble_mesh/api/core/esp_ble_mesh_networking_api.c"
@@ -342,11 +347,27 @@ if(CONFIG_BT_ENABLED)
                     "esp_ble_mesh/btc/btc_ble_mesh_prov.c"
                     "esp_ble_mesh/btc/btc_ble_mesh_sensor_model.c"
                     "esp_ble_mesh/btc/btc_ble_mesh_time_scene_model.c"
-                    "esp_ble_mesh/mesh_common/mesh_aes_encrypt.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/aes_decrypt.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/aes_encrypt.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/cbc_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ccm_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/cmac_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ctr_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ctr_prng.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc_dh.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc_dsa.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc_platform_specific.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/hmac_prng.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/hmac.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/sha256.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/utils.c"
                     "esp_ble_mesh/mesh_common/mesh_atomic.c"
                     "esp_ble_mesh/mesh_common/mesh_buf.c"
                     "esp_ble_mesh/mesh_common/mesh_common.c"
                     "esp_ble_mesh/mesh_common/mesh_kernel.c"
+                    "esp_ble_mesh/mesh_common/mesh_mutex.c"
+                    "esp_ble_mesh/mesh_common/mesh_timer.c"
                     "esp_ble_mesh/mesh_common/mesh_util.c"
                     "esp_ble_mesh/mesh_core/storage/settings_nvs.c"
                     "esp_ble_mesh/mesh_core/access.c"
@@ -355,14 +376,15 @@ if(CONFIG_BT_ENABLED)
                     "esp_ble_mesh/mesh_core/cfg_cli.c"
                     "esp_ble_mesh/mesh_core/cfg_srv.c"
                     "esp_ble_mesh/mesh_core/crypto.c"
+                    "esp_ble_mesh/mesh_core/fast_prov.c"
                     "esp_ble_mesh/mesh_core/friend.c"
                     "esp_ble_mesh/mesh_core/health_cli.c"
                     "esp_ble_mesh/mesh_core/health_srv.c"
+                    "esp_ble_mesh/mesh_core/local_operation.c"
                     "esp_ble_mesh/mesh_core/lpn.c"
                     "esp_ble_mesh/mesh_core/main.c"
                     "esp_ble_mesh/mesh_core/net.c"
                     "esp_ble_mesh/mesh_core/prov.c"
-                    "esp_ble_mesh/mesh_core/provisioner_beacon.c"
                     "esp_ble_mesh/mesh_core/provisioner_main.c"
                     "esp_ble_mesh/mesh_core/provisioner_prov.c"
                     "esp_ble_mesh/mesh_core/proxy_client.c"
@@ -370,12 +392,12 @@ if(CONFIG_BT_ENABLED)
                     "esp_ble_mesh/mesh_core/settings.c"
                     "esp_ble_mesh/mesh_core/test.c"
                     "esp_ble_mesh/mesh_core/transport.c"
+                    "esp_ble_mesh/mesh_models/common/device_property.c"
                     "esp_ble_mesh/mesh_models/client/client_common.c"
                     "esp_ble_mesh/mesh_models/client/generic_client.c"
                     "esp_ble_mesh/mesh_models/client/lighting_client.c"
                     "esp_ble_mesh/mesh_models/client/sensor_client.c"
                     "esp_ble_mesh/mesh_models/client/time_scene_client.c"
-                    "esp_ble_mesh/mesh_models/server/device_property.c"
                     "esp_ble_mesh/mesh_models/server/generic_server.c"
                     "esp_ble_mesh/mesh_models/server/lighting_server.c"
                     "esp_ble_mesh/mesh_models/server/sensor_server.c"
@@ -481,6 +503,7 @@ if(CONFIG_BT_ENABLED)
                     "host/nimble/nimble/nimble/host/src/ble_hs_adv.c"
                     "host/nimble/nimble/nimble/host/src/ble_hs_hci.c"
                     "host/nimble/nimble/nimble/host/src/ble_hs_hci_util.c"
+                    "host/nimble/nimble/nimble/host/src/ble_hs_resolv.c"
                     "host/nimble/nimble/nimble/host/store/ram/src/ble_store_ram.c"
                     "host/nimble/nimble/nimble/host/store/config/src/ble_store_config.c"
                     "host/nimble/nimble/nimble/host/store/config/src/ble_store_nvs.c"
@@ -496,7 +519,8 @@ if(CONFIG_BT_ENABLED)
                     "host/nimble/nimble/porting/nimble/src/mem.c"
                     "host/nimble/nimble/porting/nimble/src/os_mbuf.c"
                     "host/nimble/nimble/porting/nimble/src/os_cputime.c"
-                    "host/nimble/esp-hci/src/esp_nimble_hci.c")
+                    "host/nimble/esp-hci/src/esp_nimble_hci.c"
+                    "host/nimble/port/src/esp_nimble_mem.c")
 
         if (CONFIG_BLE_MESH)
             list(APPEND srcs "esp_ble_mesh/mesh_core/nimble_host/mesh_bearer_adapt.c")
@@ -532,13 +556,15 @@ if(CONFIG_BT_ENABLED)
 
         endif()
     endif()
+
 endif()
 
 # requirements can't depend on config
 idf_component_register(SRCS "${srcs}"
                 INCLUDE_DIRS "${include_dirs}"
                 PRIV_INCLUDE_DIRS "${priv_include_dirs}"
-                REQUIRES nvs_flash soc)
+                REQUIRES nvs_flash soc esp_timer
+                PRIV_REQUIRES esp_ipc)
 
 if(CONFIG_BT_ENABLED)
     target_compile_options(${COMPONENT_LIB} PRIVATE -Wno-implicit-fallthrough -Wno-unused-const-variable)

components/bt/Kconfig

@@ -1,4 +1,5 @@
 menu "Bluetooth"
+    visible if IDF_TARGET_ESP32
 
     config BT_ENABLED
         bool "Bluetooth"
@@ -78,6 +79,47 @@ menu "Bluetooth"
             default 1 if BTDM_CTRL_BR_EDR_SCO_DATA_PATH_PCM
             default 0
 
+        menuconfig BTDM_CTRL_PCM_ROLE_EDGE_CONFIG
+            bool "PCM Signal Config (Role and Polar)"
+            depends on BTDM_CTRL_BR_EDR_SCO_DATA_PATH_PCM
+            default y
+
+        choice BTDM_CTRL_PCM_ROLE
+            prompt "PCM Role"
+            depends on BTDM_CTRL_PCM_ROLE_EDGE_CONFIG
+            help
+                PCM role can be configured as PCM master or PCM slave
+
+            config BTDM_CTRL_PCM_ROLE_MASTER
+                bool "PCM Master"
+            config BTDM_CTRL_PCM_ROLE_SLAVE
+                bool "PCM Slave"
+        endchoice
+
+        choice BTDM_CTRL_PCM_POLAR
+            prompt "PCM Polar"
+            depends on BTDM_CTRL_PCM_ROLE_EDGE_CONFIG
+            help
+                PCM polarity can be configured as Falling Edge or Rising Edge
+
+            config BTDM_CTRL_PCM_POLAR_FALLING_EDGE
+                bool "Falling Edge"
+            config BTDM_CTRL_PCM_POLAR_RISING_EDGE
+                bool "Rising Edge"
+        endchoice
+
+        config BTDM_CTRL_PCM_ROLE_EFF
+            int
+            default 0 if BTDM_CTRL_PCM_ROLE_MASTER
+            default 1 if BTDM_CTRL_PCM_ROLE_SLAVE
+            default 0
+
+        config BTDM_CTRL_PCM_POLAR_EFF
+            int
+            default 0 if BTDM_CTRL_PCM_POLAR_FALLING_EDGE
+            default 1 if BTDM_CTRL_PCM_POLAR_RISING_EDGE
+            default 0
+
         config BTDM_CTRL_AUTO_LATENCY
             bool "Auto latency"
             depends on BTDM_CTRL_MODE_BTDM
@@ -91,6 +133,19 @@ menu "Bluetooth"
             default BTDM_CTRL_AUTO_LATENCY if BTDM_CTRL_MODE_BTDM
             default n
 
+        config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT
+            bool "Legacy Authentication Vendor Specific Event Enable"
+            depends on BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+            default y
+            help
+                To protect from BIAS attack during Legacy authentication,
+                Legacy authentication Vendor specific event should be enabled
+
+        config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT_EFF
+            bool
+            default BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT if BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+            default 0
+
 
         config BTDM_CTRL_BLE_MAX_CONN_EFF
             int
@@ -333,7 +388,7 @@ menu "Bluetooth"
 
         config BTDM_CTRL_FULL_SCAN_SUPPORTED
             bool "BLE full scan feature supported"
-            depends on BTDM_CONTROLLER_MODE_BLE_ONLY || BTDM_CONTROLLER_MODE_BTDM
+            depends on BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM
             default y
             help
                 The full scan function is mainly used to provide BLE scan performance.
@@ -432,6 +487,7 @@ endmenu
 
 menuconfig BLE_MESH
     bool "ESP BLE Mesh Support"
+    depends on BT_ENABLED
     help
         This option enables ESP BLE Mesh support. The specific features that are
         available may depend on other features that have been enabled in the

components/bt/common/btc/core/btc_task.c

@@ -68,7 +68,7 @@
 
 #define BTC_TASK_PINNED_TO_CORE         (TASK_PINNED_TO_CORE)
 #define BTC_TASK_STACK_SIZE             (BT_BTC_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)	//by menuconfig
-#define BTC_TASK_NAME                   "btcT"
+#define BTC_TASK_NAME                   "BTC_TASK"
 #define BTC_TASK_PRIO                   (BT_TASK_MAX_PRIORITIES - 6)
 
 osi_thread_t *btc_thread;
@@ -185,6 +185,15 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
     return BT_STATUS_SUCCESS;
 }
 
+/**
+ * transfer an message to another module in the different task.
+ * @param  msg       message
+ * @param  arg       paramter
+ * @param  arg_len   length of paramter
+ * @param  copy_func deep copy function
+ * @return           BT_STATUS_SUCCESS: success
+ *                   others: fail
+ */
 bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func)
 {
     btc_msg_t lmsg;
@@ -214,6 +223,34 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg
 
 }
 
+/**
+ * transfer an message to another module in tha same task.
+ * @param  msg       message
+ * @param  arg       paramter
+ * @return           BT_STATUS_SUCCESS: success
+ *                   others: fail
+ */
+bt_status_t btc_inter_profile_call(btc_msg_t *msg, void *arg)
+{
+    if (msg == NULL) {
+        return BT_STATUS_PARM_INVALID;
+    }
+
+    msg->arg = arg;
+    switch (msg->sig) {
+    case BTC_SIG_API_CALL:
+        profile_tab[msg->pid].btc_call(msg);
+        break;
+    case BTC_SIG_API_CB:
+        profile_tab[msg->pid].btc_cb(msg);
+        break;
+    default:
+        break;
+    }
+    return BT_STATUS_SUCCESS;
+}
+
+
 #if BTC_DYNAMIC_MEMORY
 
 static void btc_deinit_mem(void) {
@@ -331,9 +368,9 @@ error_exit:;
 }
 #endif ///BTC_DYNAMIC_MEMORY
 
-int btc_init(void)
+bt_status_t btc_init(void)
 {
-    btc_thread = osi_thread_create("BTC_TASK", BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE, 2);
+    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE, 2);
     if (btc_thread == NULL) {
         return BT_STATUS_NOMEM;
     }
@@ -378,3 +415,8 @@ bool btc_check_queue_is_congest(void)
     return false;
 }
 
+int get_btc_work_queue_size(void)
+{
+    return osi_thread_queue_wait_size(btc_thread, 0);
+}
+

components/bt/common/btc/include/btc/btc_task.h

@@ -96,10 +96,29 @@ typedef struct {
 
 typedef void (* btc_arg_deep_copy_t)(btc_msg_t *msg, void *dst, void *src);
 
+/**
+ * transfer an message to another module in the different task.
+ * @param  msg       message
+ * @param  arg       paramter
+ * @param  arg_len   length of paramter
+ * @param  copy_func deep copy function
+ * @return           BT_STATUS_SUCCESS: success
+ *                   others: fail
+ */
 bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func);
 
-int btc_init(void);
+/**
+ * transfer an message to another module in tha same task.
+ * @param  msg       message
+ * @param  arg       paramter
+ * @return           BT_STATUS_SUCCESS: success
+ *                   others: fail
+ */
+bt_status_t btc_inter_profile_call(btc_msg_t *msg, void *arg);
+
+bt_status_t btc_init(void);
 void btc_deinit(void);
 bool btc_check_queue_is_congest(void);
+int get_btc_work_queue_size(void);
 
 #endif /* __BTC_TASK_H__ */

components/bt/common/include/bt_user_config.h

@@ -40,14 +40,14 @@
 /**********************************************************
  * Thread/Task reference
  **********************************************************/
-#ifdef CONFIG_BLUEDROID_PINNED_TO_CORE
-#define UC_TASK_PINNED_TO_CORE              (CONFIG_BLUEDROID_PINNED_TO_CORE < portNUM_PROCESSORS ? CONFIG_BLUEDROID_PINNED_TO_CORE : tskNO_AFFINITY)
+#ifdef CONFIG_BT_BLUEDROID_PINNED_TO_CORE
+#define UC_TASK_PINNED_TO_CORE              (CONFIG_BT_BLUEDROID_PINNED_TO_CORE < portNUM_PROCESSORS ? CONFIG_BT_BLUEDROID_PINNED_TO_CORE : tskNO_AFFINITY)
 #else
 #define UC_TASK_PINNED_TO_CORE              (0)
 #endif
 
-#ifdef CONFIG_BTC_TASK_STACK_SIZE
-#define UC_BTC_TASK_STACK_SIZE              CONFIG_BTC_TASK_STACK_SIZE
+#ifdef CONFIG_BT_BTC_TASK_STACK_SIZE
+#define UC_BTC_TASK_STACK_SIZE              CONFIG_BT_BTC_TASK_STACK_SIZE
 #else
 #define UC_BTC_TASK_STACK_SIZE              4096
 #endif

components/bt/common/osi/config.c

@@ -267,6 +267,7 @@ bool config_remove_key(config_t *config, const char *section, const char *key)
     assert(config != NULL);
     assert(section != NULL);
     assert(key != NULL);
+    bool ret;
 
     section_t *sec = section_find(config, section);
     entry_t *entry = entry_find(config, section, key);
@@ -274,7 +275,12 @@ bool config_remove_key(config_t *config, const char *section, const char *key)
         return false;
     }
 
-    return list_remove(sec->entries, entry);
+    ret = list_remove(sec->entries, entry);
+    if (list_length(sec->entries) == 0) {
+        OSI_TRACE_DEBUG("%s remove section name:%s",__func__, section);
+        ret &= config_remove_section(config, section);
+    }
+    return ret;
 }
 
 const config_section_node_t *config_section_begin(const config_t *config)

components/bt/common/osi/include/osi/list.h

@@ -22,6 +22,10 @@ list_t *list_new(list_free_cb callback);
 
 
 list_node_t *list_free_node(list_t *list, list_node_t *node);
+
+// similar with list_free_node, this function doesn't free the node data
+list_node_t *list_delete_node(list_t *list, list_node_t *node);
+
 // Frees the list. This function accepts NULL as an argument, in which case it
 // behaves like a no-op.
 void list_free(list_t *list);
@@ -75,6 +79,9 @@ bool list_append(list_t *list, void *data);
 
 bool list_remove(list_t *list, void *data);
 
+// similar with list_remove, but do not free the node data
+bool list_delete(list_t *list, void *data);
+
 // Removes all elements in the list. Calling this function will return the list to the
 // same state it was in after |list_new|. |list| may not be NULL.
 void list_clear(list_t *list);

components/bt/common/osi/list.c

@@ -186,6 +186,36 @@ bool list_remove(list_t *list, void *data)
     return false;
 }
 
+bool list_delete(list_t *list, void *data)
+{
+    assert(list != NULL);
+    assert(data != NULL);
+
+    if (list_is_empty(list)) {
+        return false;
+    }
+
+    if (list->head->data == data) {
+        list_node_t *next = list_delete_node(list, list->head);
+        if (list->tail == list->head) {
+            list->tail = next;
+        }
+        list->head = next;
+        return true;
+    }
+
+    for (list_node_t *prev = list->head, *node = list->head->next; node; prev = node, node = node->next)
+        if (node->data == data) {
+            prev->next = list_delete_node(list, node);
+            if (list->tail == node) {
+                list->tail = prev;
+            }
+            return true;
+        }
+
+    return false;
+}
+
 void list_clear(list_t *list)
 {
     assert(list != NULL);
@@ -251,3 +281,17 @@ list_node_t *list_free_node(list_t *list, list_node_t *node)
 
     return next;
 }
+
+// remove the element from list but do not free the node data
+list_node_t *list_delete_node(list_t *list, list_node_t *node)
+{
+    assert(list != NULL);
+    assert(node != NULL);
+
+    list_node_t *next = node->next;
+
+    osi_free(node);
+    --list->length;
+
+    return next;
+}

components/bt/component.mk

@@ -45,6 +45,7 @@ COMPONENT_PRIV_INCLUDEDIRS +=   host/bluedroid/bta/include                   \
                                 host/bluedroid/btc/profile/std/gatt/include  \
                                 host/bluedroid/btc/profile/std/gap/include   \
                                 host/bluedroid/btc/profile/std/a2dp/include  \
+                                host/bluedroid/btc/profile/std/hid/include   \
                                 host/bluedroid/btc/profile/std/include       \
                                 host/bluedroid/btc/include                   \
                                 host/bluedroid/btif/include                  \
@@ -96,6 +97,7 @@ COMPONENT_SRCDIRS +=    host/bluedroid/bta/dm                      \
                         host/bluedroid/btc/profile/std/spp         \
                         host/bluedroid/btc/profile/std/hf_ag       \
                         host/bluedroid/btc/profile/std/hf_client   \
+                        host/bluedroid/btc/profile/std/hid         \
                         host/bluedroid/btc/profile                 \
                         host/bluedroid/stack/btm                   \
                         host/bluedroid/stack/btu                   \
@@ -137,6 +139,7 @@ endif
 
 ifdef CONFIG_BLE_MESH
 COMPONENT_ADD_INCLUDEDIRS += esp_ble_mesh/mesh_common/include           \
+                             esp_ble_mesh/mesh_common/tinycrypt/include \
                              esp_ble_mesh/mesh_core                     \
                              esp_ble_mesh/mesh_core/include             \
                              esp_ble_mesh/mesh_core/storage             \
@@ -149,9 +152,11 @@ COMPONENT_ADD_INCLUDEDIRS += esp_ble_mesh/mesh_common/include           \
                              esp_ble_mesh/api
 
 COMPONENT_SRCDIRS += esp_ble_mesh/mesh_common               \
+                     esp_ble_mesh/mesh_common/tinycrypt/src \
                      esp_ble_mesh/mesh_core                 \
                      esp_ble_mesh/mesh_core/storage         \
                      esp_ble_mesh/btc                       \
+                     esp_ble_mesh/mesh_models/common        \
                      esp_ble_mesh/mesh_models/client        \
                      esp_ble_mesh/mesh_models/server        \
                      esp_ble_mesh/api/core                  \
@@ -197,7 +202,8 @@ COMPONENT_SRCDIRS += host/nimble/nimble/nimble/host/src
                      host/nimble/nimble/nimble/host/util/src                       \
                      host/nimble/nimble/nimble/host/store/ram/src                  \
                      host/nimble/nimble/nimble/host/store/config/src               \
-                     host/nimble/esp-hci/src
+                     host/nimble/esp-hci/src                                       \
+                     host/nimble/port/src
 
 ifndef CONFIG_BT_NIMBLE_CRYPTO_STACK_MBEDTLS
 COMPONENT_SRCDIRS += host/nimble/nimble/ext/tinycrypt/src

components/bt/controller/bt.c

@@ -79,14 +79,6 @@
 #define BTDM_MIN_SLEEP_DURATION          (12) // threshold of interval in slots to allow to fall into modem sleep
 #define BTDM_MODEM_WAKE_UP_DELAY         (4)  // delay in slots of modem wake up procedure, including re-enable PHY/RF
 
-#ifdef CONFIG_PM_ENABLE
-#ifndef CONFIG_BTDM_LPCLK_SEL_MAIN_XTAL
-#define BTDM_ALLOW_LIGHT_SLEEP 1
-#else
-#define BTDM_ALLOW_LIGHT_SLEEP 0
-#endif
-#endif
-
 #define BT_DEBUG(...)
 #define BT_API_CALL_CHECK(info, api_call, ret) \
 do{\
@@ -98,7 +90,7 @@ do{\
 } while(0)
 
 #define OSI_FUNCS_TIME_BLOCKING  0xffffffff
-#define OSI_VERSION              0x00010001
+#define OSI_VERSION              0x00010002
 #define OSI_MAGIC_VALUE          0xFADEBEAD
 
 /* SPIRAM Configuration */
@@ -175,6 +167,8 @@ struct osi_funcs_t {
     void (* _btdm_sleep_exit_phase1)(void);  /* called from ISR */
     void (* _btdm_sleep_exit_phase2)(void);  /* called from ISR */
     void (* _btdm_sleep_exit_phase3)(void);  /* called from task */
+    bool (* _coex_bt_wakeup_request)(void);
+    void (* _coex_bt_wakeup_request_end)(void);
     int (* _coex_bt_request)(uint32_t event, uint32_t latency, uint32_t duration);
     int (* _coex_bt_release)(uint32_t event);
     int (* _coex_register_bt_cb)(coex_func_cb_t cb);
@@ -183,6 +177,7 @@ struct osi_funcs_t {
     uint32_t _magic;
 };
 
+typedef void (*workitem_handler_t)(void* arg);
 
 /* External functions or values
  ************************************************************************
@@ -199,13 +194,14 @@ extern void btdm_controller_disable(void);
 extern uint8_t btdm_controller_get_mode(void);
 extern const char *btdm_controller_get_compile_version(void);
 extern void btdm_rf_bb_init_phase2(void); // shall be called after PHY/RF is enabled
+extern int btdm_dispatch_work_to_controller(workitem_handler_t callback, void *arg, bool blocking);
 /* Sleep */
 extern void btdm_controller_enable_sleep(bool enable);
 extern void btdm_controller_set_sleep_mode(uint8_t mode);
 extern uint8_t btdm_controller_get_sleep_mode(void);
 extern bool btdm_power_state_active(void);
-extern void btdm_wakeup_request(bool request_lock);
-extern void btdm_wakeup_request_end(void);
+extern void btdm_wakeup_request(void);
+extern void btdm_in_wakeup_requesting_set(bool in_wakeup_requesting);
 /* Low Power Clock */
 extern bool btdm_lpclk_select_src(uint32_t sel);
 extern bool btdm_lpclk_set_div(uint32_t div);
@@ -288,8 +284,9 @@ static uint32_t IRAM_ATTR btdm_us_2_lpcycles(uint32_t us);
 static bool IRAM_ATTR btdm_sleep_check_duration(uint32_t *slot_cnt);
 static void btdm_sleep_enter_phase1_wrapper(uint32_t lpcycles);
 static void btdm_sleep_enter_phase2_wrapper(void);
-static void IRAM_ATTR btdm_sleep_exit_phase1_wrapper(void);
 static void btdm_sleep_exit_phase3_wrapper(void);
+static bool coex_bt_wakeup_request(void);
+static void coex_bt_wakeup_request_end(void);
 
 /* Local variable definition
  ***************************************************************************
@@ -334,9 +331,11 @@ static const struct osi_funcs_t osi_funcs_ro = {
     ._btdm_sleep_check_duration = btdm_sleep_check_duration,
     ._btdm_sleep_enter_phase1 = btdm_sleep_enter_phase1_wrapper,
     ._btdm_sleep_enter_phase2 = btdm_sleep_enter_phase2_wrapper,
-    ._btdm_sleep_exit_phase1 = btdm_sleep_exit_phase1_wrapper,
+    ._btdm_sleep_exit_phase1 = NULL,
     ._btdm_sleep_exit_phase2 = NULL,
     ._btdm_sleep_exit_phase3 = btdm_sleep_exit_phase3_wrapper,
+    ._coex_bt_wakeup_request = coex_bt_wakeup_request,
+    ._coex_bt_wakeup_request_end = coex_bt_wakeup_request_end,
     ._coex_bt_request = coex_bt_request_wrapper,
     ._coex_bt_release = coex_bt_release_wrapper,
     ._coex_register_bt_cb = coex_register_bt_cb_wrapper,
@@ -384,16 +383,22 @@ static DRAM_ATTR portMUX_TYPE global_int_mux = portMUX_INITIALIZER_UNLOCKED;
 static DRAM_ATTR uint32_t btdm_lpcycle_us = 0;
 static DRAM_ATTR uint8_t btdm_lpcycle_us_frac = 0; // number of fractional bit for btdm_lpcycle_us
 
+#if CONFIG_BTDM_MODEM_SLEEP_MODE_ORIG
+// used low power clock
+static DRAM_ATTR uint8_t btdm_lpclk_sel;
+#endif /* #ifdef CONFIG_BTDM_MODEM_SLEEP_MODE_ORIG */
+
+static DRAM_ATTR QueueHandle_t s_wakeup_req_sem = NULL;
 #ifdef CONFIG_PM_ENABLE
 static DRAM_ATTR esp_timer_handle_t s_btdm_slp_tmr;
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock;
-static DRAM_ATTR QueueHandle_t s_pm_lock_sem = NULL;
-#if !BTDM_ALLOW_LIGHT_SLEEP
+static bool s_pm_lock_acquired = true;
+static DRAM_ATTR bool s_btdm_allow_light_sleep;
 // pm_lock to prevent light sleep when using main crystal as Bluetooth low power clock
 static DRAM_ATTR esp_pm_lock_handle_t s_light_sleep_pm_lock;
-#endif /* #if !BTDM_ALLOW_LIGHT_SLEEP */
 static void btdm_slp_tmr_callback(void *arg);
-#endif
+#endif /* #ifdef CONFIG_PM_ENABLE */
+
 
 static inline void btdm_check_and_init_bb(void)
 {
@@ -848,8 +853,10 @@ static void btdm_sleep_enter_phase2_wrapper(void)
         esp_modem_sleep_enter(MODEM_BLE_MODULE);
         esp_modem_sleep_enter(MODEM_CLASSIC_BT_MODULE);
 #ifdef CONFIG_PM_ENABLE
-        esp_pm_lock_release(s_pm_lock);
-        semphr_give_wrapper(s_pm_lock_sem);
+        if (s_pm_lock_acquired) {
+            esp_pm_lock_release(s_pm_lock);
+            s_pm_lock_acquired = false;
+        }
 #endif
     } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
         esp_modem_sleep_enter(MODEM_BLE_MODULE);
@@ -858,17 +865,15 @@ static void btdm_sleep_enter_phase2_wrapper(void)
     }
 }
 
-static void IRAM_ATTR btdm_sleep_exit_phase1_wrapper(void)
+static void btdm_sleep_exit_phase3_wrapper(void)
 {
 #ifdef CONFIG_PM_ENABLE
-    if (semphr_take_from_isr_wrapper(s_pm_lock_sem, NULL) == pdTRUE) {
+    if (!s_pm_lock_acquired) {
+        s_pm_lock_acquired = true;
         esp_pm_lock_acquire(s_pm_lock);
     }
 #endif
-}
 
-static void btdm_sleep_exit_phase3_wrapper(void)
-{
     if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
         esp_modem_sleep_exit(MODEM_BLE_MODULE);
         esp_modem_sleep_exit(MODEM_CLASSIC_BT_MODULE);
@@ -884,14 +889,113 @@ static void btdm_sleep_exit_phase3_wrapper(void)
 }
 
 #ifdef CONFIG_PM_ENABLE
-static void IRAM_ATTR btdm_slp_tmr_callback(void *arg)
+static void btdm_slp_tmr_customer_callback(void * arg)
 {
-    if (semphr_take_wrapper(s_pm_lock_sem, 0) == pdTRUE) {
+    (void)(arg);
+
+    if (!s_pm_lock_acquired) {
+        s_pm_lock_acquired = true;
         esp_pm_lock_acquire(s_pm_lock);
     }
 }
+
+static void IRAM_ATTR btdm_slp_tmr_callback(void *arg)
+{
+    (void)(arg);
+    btdm_dispatch_work_to_controller(btdm_slp_tmr_customer_callback, NULL, true);
+}
 #endif
 
+#define BTDM_ASYNC_WAKEUP_REQ_HCI       0
+#define BTDM_ASYNC_WAKEUP_REQ_COEX      1
+#define BTDM_ASYNC_WAKEUP_REQ_CTRL_DISA 2
+#define BTDM_ASYNC_WAKEUP_REQMAX        3
+
+static void btdm_wakeup_request_callback(void * arg)
+{
+    (void)(arg);
+
+#if CONFIG_PM_ENABLE
+    if (!s_pm_lock_acquired) {
+        s_pm_lock_acquired = true;
+        esp_pm_lock_acquire(s_pm_lock);
+    }
+    esp_timer_stop(s_btdm_slp_tmr);
+#endif
+    btdm_wakeup_request();
+
+    semphr_give_wrapper(s_wakeup_req_sem);
+}
+
+static bool async_wakeup_request(int event)
+{
+    bool do_wakeup_request = false;
+
+    switch (event) {
+        case BTDM_ASYNC_WAKEUP_REQ_HCI:
+            btdm_in_wakeup_requesting_set(true);
+            // NO break
+        case BTDM_ASYNC_WAKEUP_REQ_CTRL_DISA:
+            if (!btdm_power_state_active()) {
+                do_wakeup_request = true;
+
+                btdm_dispatch_work_to_controller(btdm_wakeup_request_callback, NULL, true);
+                semphr_take_wrapper(s_wakeup_req_sem, OSI_FUNCS_TIME_BLOCKING);
+            }
+            break;
+        case BTDM_ASYNC_WAKEUP_REQ_COEX:
+            if (!btdm_power_state_active()) {
+                do_wakeup_request = true;
+#if CONFIG_PM_ENABLE
+                if (!s_pm_lock_acquired) {
+                    s_pm_lock_acquired = true;
+                    esp_pm_lock_acquire(s_pm_lock);
+                }
+                esp_timer_stop(s_btdm_slp_tmr);
+#endif
+                btdm_wakeup_request();
+            }
+            break;
+        default:
+            return false;
+    }
+
+    return do_wakeup_request;
+}
+
+static void async_wakeup_request_end(int event)
+{
+    bool request_lock = false;
+    switch (event) {
+        case BTDM_ASYNC_WAKEUP_REQ_HCI:
+            request_lock = true;
+            break;
+        case BTDM_ASYNC_WAKEUP_REQ_COEX:
+        case BTDM_ASYNC_WAKEUP_REQ_CTRL_DISA:
+            request_lock = false;
+            break;
+        default:
+            return;
+    }
+
+    if (request_lock) {
+        btdm_in_wakeup_requesting_set(false);
+    }
+
+    return;
+}
+
+static bool coex_bt_wakeup_request(void)
+{
+    return async_wakeup_request(BTDM_ASYNC_WAKEUP_REQ_COEX);
+}
+
+static void coex_bt_wakeup_request_end(void)
+{
+    async_wakeup_request_end(BTDM_ASYNC_WAKEUP_REQ_COEX);
+    return;
+}
+
 bool esp_vhci_host_check_send_available(void)
 {
     return API_vhci_host_check_send_available();
@@ -899,24 +1003,11 @@ bool esp_vhci_host_check_send_available(void)
 
 void esp_vhci_host_send_packet(uint8_t *data, uint16_t len)
 {
-    bool do_wakeup_request = false;
-
-    if (!btdm_power_state_active()) {
-#if CONFIG_PM_ENABLE
-        if (semphr_take_wrapper(s_pm_lock_sem, 0)) {
-            esp_pm_lock_acquire(s_pm_lock);
-        }
-        esp_timer_stop(s_btdm_slp_tmr);
-#endif
-        do_wakeup_request = true;
-        btdm_wakeup_request(true);
-    }
+    async_wakeup_request(BTDM_ASYNC_WAKEUP_REQ_HCI);
 
     API_vhci_host_send_packet(data, len);
 
-    if (do_wakeup_request) {
-        btdm_wakeup_request_end();
-    }
+    async_wakeup_request_end(BTDM_ASYNC_WAKEUP_REQ_HCI);
 }
 
 esp_err_t esp_vhci_host_register_callback(const esp_vhci_host_callback_t *callback)
@@ -975,7 +1066,7 @@ static esp_err_t try_heap_caps_add_region(intptr_t start, intptr_t end)
 esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode)
 {
     bool update = true;
-    intptr_t mem_start, mem_end;
+    intptr_t mem_start=(intptr_t) NULL, mem_end=(intptr_t) NULL;
 
     if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
         return ESP_ERR_INVALID_STATE;
@@ -1085,6 +1176,11 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     esp_err_t err;
     uint32_t btdm_cfg_mask = 0;
 
+    //if all the bt available memory was already released, cannot initialize bluetooth controller
+    if (btdm_dram_available_region[0].mode == ESP_BT_MODE_IDLE) {
+        return ESP_ERR_INVALID_STATE;
+    }
+    
     osi_funcs_p = (struct osi_funcs_t *)malloc_internal_wrapper(sizeof(struct osi_funcs_t));
     if (osi_funcs_p == NULL) {
         return ESP_ERR_NO_MEM;
@@ -1099,11 +1195,6 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         return ESP_ERR_INVALID_STATE;
     }
 
-    //if all the bt available memory was already released, cannot initialize bluetooth controller
-    if (btdm_dram_available_region[0].mode == ESP_BT_MODE_IDLE) {
-        return ESP_ERR_INVALID_STATE;
-    }
-
     if (cfg == NULL) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -1133,12 +1224,73 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     memset(btdm_queue_table, 0, sizeof(btdm_queue_item_t) * BTDM_MAX_QUEUE_NUM);
 #endif
 
-#ifdef CONFIG_PM_ENABLE
-#if !BTDM_ALLOW_LIGHT_SLEEP
-    if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
+    s_wakeup_req_sem = semphr_create_wrapper(1, 0);
+    if (s_wakeup_req_sem == NULL) {
+        err = ESP_ERR_NO_MEM;
         goto error;
     }
-#endif /* #if !BTDM_ALLOW_LIGHT_SLEEP */
+
+    btdm_controller_mem_init();
+
+    periph_module_enable(PERIPH_BT_MODULE);
+
+#ifdef CONFIG_PM_ENABLE
+    s_btdm_allow_light_sleep = false;
+#endif
+
+    // set default sleep clock cycle and its fractional bits
+    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+
+#if CONFIG_BTDM_MODEM_SLEEP_MODE_ORIG
+
+    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
+#if CONFIG_BTDM_LPCLK_SEL_EXT_32K_XTAL
+    // check whether or not EXT_CRYS is working
+    if (rtc_clk_slow_freq_get() == RTC_SLOW_FREQ_32K_XTAL) {
+        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL32K; // set default value
+#ifdef CONFIG_PM_ENABLE
+        s_btdm_allow_light_sleep = true;
+#endif
+    } else {
+        ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
+                 "light sleep mode will not be able to apply when bluetooth is enabled");
+        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
+    }
+#else
+    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
+#endif
+
+    bool select_src_ret, set_div_ret;
+    if (btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
+        set_div_ret = btdm_lpclk_set_div(rtc_clk_xtal_freq_get() * 2 - 1);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
+        set_div_ret = btdm_lpclk_set_div(0);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
+            (1000000 >> (15 - RTC_CLK_CAL_FRACT));
+        assert(btdm_lpcycle_us != 0);
+    }
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
+
+#elif CONFIG_BTDM_MODEM_SLEEP_MODE_EVED
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
+#else
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+#endif
+
+#ifdef CONFIG_PM_ENABLE
+    if (!s_btdm_allow_light_sleep) {
+        if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
+            goto error;
+        }
+    }
     if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
         goto error;
     }
@@ -1151,42 +1303,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto error;
     }
 
-    s_pm_lock_sem = semphr_create_wrapper(1, 0);
-    if (s_pm_lock_sem == NULL) {
-        err = ESP_ERR_NO_MEM;
-        goto error;
-    }
-#endif
-
-    btdm_controller_mem_init();
-
-    periph_module_enable(PERIPH_BT_MODULE);
-
-    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-    btdm_lpcycle_us = 32 << btdm_lpcycle_us_frac;
-#if CONFIG_BTDM_MODEM_SLEEP_MODE_ORIG
-    bool select_src_ret = false;
-    bool set_div_ret = false;
-#if CONFIG_BTDM_LPCLK_SEL_MAIN_XTAL
-    select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-    set_div_ret = btdm_lpclk_set_div(rtc_clk_xtal_freq_get() * 2 - 1);
-    assert(select_src_ret && set_div_ret);
-    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
-#elif CONFIG_BTDM_LPCLK_SEL_EXT_32K_XTAL
-    select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
-    set_div_ret = btdm_lpclk_set_div(0);
-    assert(select_src_ret && set_div_ret);
-    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-    btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
-        (1000000 >> (15 - RTC_CLK_CAL_FRACT));
-    assert(btdm_lpcycle_us != 0);
-#endif // CONFIG_BTDM_LPCLK_SEL_XX
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
-#elif CONFIG_BTDM_MODEM_SLEEP_MODE_EVED
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
-#else
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+    s_pm_lock_acquired = true;
 #endif
 
     btdm_cfg_mask = btdm_config_mask_load();
@@ -1208,12 +1325,12 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
 error:
 #ifdef CONFIG_PM_ENABLE
-#if !BTDM_ALLOW_LIGHT_SLEEP
-    if (s_light_sleep_pm_lock != NULL) {
-        esp_pm_lock_delete(s_light_sleep_pm_lock);
-        s_light_sleep_pm_lock = NULL;
+    if (!s_btdm_allow_light_sleep) {
+        if (s_light_sleep_pm_lock != NULL) {
+            esp_pm_lock_delete(s_light_sleep_pm_lock);
+            s_light_sleep_pm_lock = NULL;
+        }
     }
-#endif /* #if !BTDM_ALLOW_LIGHT_SLEEP */
     if (s_pm_lock != NULL) {
         esp_pm_lock_delete(s_pm_lock);
         s_pm_lock = NULL;
@@ -1222,11 +1339,11 @@ error:
         esp_timer_delete(s_btdm_slp_tmr);
         s_btdm_slp_tmr = NULL;
     }
-    if (s_pm_lock_sem) {
-        semphr_delete_wrapper(s_pm_lock_sem);
-        s_pm_lock_sem = NULL;
-    }
 #endif
+    if (s_wakeup_req_sem) {
+        semphr_delete_wrapper(s_wakeup_req_sem);
+        s_wakeup_req_sem = NULL;
+    }
     return err;
 }
 
@@ -1241,18 +1358,17 @@ esp_err_t esp_bt_controller_deinit(void)
     periph_module_disable(PERIPH_BT_MODULE);
 
 #ifdef CONFIG_PM_ENABLE
-#if !BTDM_ALLOW_LIGHT_SLEEP
-    esp_pm_lock_delete(s_light_sleep_pm_lock);
-    s_light_sleep_pm_lock = NULL;
-#endif /* #if !BTDM_ALLOW_LIGHT_SLEEP */
-    esp_pm_lock_delete(s_pm_lock);
-    s_pm_lock = NULL;
+    if (!s_btdm_allow_light_sleep) {
+        esp_pm_lock_delete(s_light_sleep_pm_lock);
+        s_light_sleep_pm_lock = NULL;
+    }
     esp_timer_stop(s_btdm_slp_tmr);
     esp_timer_delete(s_btdm_slp_tmr);
     s_btdm_slp_tmr = NULL;
-    semphr_delete_wrapper(s_pm_lock_sem);
-    s_pm_lock_sem = NULL;
+    s_pm_lock_acquired = false;
 #endif
+    semphr_delete_wrapper(s_wakeup_req_sem);
+    s_wakeup_req_sem = NULL;
 
 #if CONFIG_SPIRAM_USE_MALLOC
     vSemaphoreDelete(btdm_queue_table_mux);
@@ -1285,9 +1401,9 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     }
 
 #ifdef CONFIG_PM_ENABLE
-#if !BTDM_ALLOW_LIGHT_SLEEP
-    esp_pm_lock_acquire(s_light_sleep_pm_lock);
-#endif /* #if !BTDM_ALLOW_LIGHT_SLEEP */
+    if (!s_btdm_allow_light_sleep) {
+        esp_pm_lock_acquire(s_light_sleep_pm_lock);
+    }
     esp_pm_lock_acquire(s_pm_lock);
 #endif
 
@@ -1325,9 +1441,9 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
         }
         esp_phy_rf_deinit(PHY_BT_MODULE);
 #ifdef CONFIG_PM_ENABLE
-#if !BTDM_ALLOW_LIGHT_SLEEP
-        esp_pm_lock_release(s_light_sleep_pm_lock);
-#endif /* #if !BTDM_ALLOW_LIGHT_SLEEP */
+        if (!s_btdm_allow_light_sleep) {
+            esp_pm_lock_release(s_light_sleep_pm_lock);
+        }
         esp_pm_lock_release(s_pm_lock);
 #endif
         return ESP_ERR_INVALID_STATE;
@@ -1347,9 +1463,7 @@ esp_err_t esp_bt_controller_disable(void)
     // disable modem sleep and wake up from sleep mode
     if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
         btdm_controller_enable_sleep(false);
-        if (!btdm_power_state_active()) {
-            btdm_wakeup_request(false);
-        }
+        async_wakeup_request(BTDM_ASYNC_WAKEUP_REQ_CTRL_DISA);
         while (!btdm_power_state_active()) {
             ets_delay_us(1000);
         }
@@ -1368,9 +1482,9 @@ esp_err_t esp_bt_controller_disable(void)
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
 #ifdef CONFIG_PM_ENABLE
-#if !BTDM_ALLOW_LIGHT_SLEEP
-    esp_pm_lock_release(s_light_sleep_pm_lock);
-#endif /* #if !BTDM_ALLOW_LIGHT_SLEEP */
+    if (!s_btdm_allow_light_sleep) {
+        esp_pm_lock_release(s_light_sleep_pm_lock);
+    }
     esp_pm_lock_release(s_pm_lock);
 #endif
 
@@ -1469,26 +1583,6 @@ esp_err_t esp_bt_sleep_disable (void)
     return status;
 }
 
-bool esp_bt_controller_is_sleeping(void)
-{
-    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED ||
-        btdm_controller_get_sleep_mode() != BTDM_MODEM_SLEEP_MODE_ORIG) {
-        return false;
-    }
-
-    return !btdm_power_state_active();
-}
-
-void esp_bt_controller_wakeup_request(void)
-{
-    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED ||
-        btdm_controller_get_sleep_mode() != BTDM_MODEM_SLEEP_MODE_ORIG) {
-        return;
-    }
-
-    btdm_wakeup_request(false);
-}
-
 esp_err_t esp_bredr_sco_datapath_set(esp_sco_data_path_t data_path)
 {
     if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {

components/bt/esp_ble_mesh/Kconfig.in

@@ -9,8 +9,8 @@ if BLE_MESH
     config BLE_MESH_USE_DUPLICATE_SCAN
         bool "Support Duplicate Scan in BLE Mesh"
         depends on BT_BLUEDROID_ENABLED
-        select BLE_SCAN_DUPLICATE
-        select BLE_MESH_SCAN_DUPLICATE_EN
+        select BTDM_BLE_SCAN_DUPL
+        select BTDM_BLE_MESH_SCAN_DUPL_EN
         default y
         help
             Enable this option to allow using specific duplicate scan filter
@@ -18,6 +18,83 @@ if BLE_MESH
             option in the Bluetooth Controller section in menuconfig, which is
             "Scan Duplicate By Device Address and Advertising Data".
 
+    choice BLE_MESH_MEM_ALLOC_MODE
+        prompt "Memory allocation strategy"
+        default BLE_MESH_MEM_ALLOC_MODE_INTERNAL
+        help
+            Allocation strategy for BLE Mesh stack, essentially provides ability to
+            allocate all required dynamic allocations from,
+
+            - Internal DRAM memory only
+            - External SPIRAM memory only
+            - Either internal or external memory based on default malloc()
+              behavior in ESP-IDF
+            - Internal IRAM memory wherever applicable else internal DRAM
+
+            Recommended mode here is always internal, since that is most preferred
+            from security perspective. But if application requirement does not allow
+            sufficient free internal memory then alternate mode can be selected.
+
+        config BLE_MESH_MEM_ALLOC_MODE_INTERNAL
+            bool "Internal DRAM"
+
+        config BLE_MESH_MEM_ALLOC_MODE_EXTERNAL
+            bool "External SPIRAM"
+            depends on ESP32_SPIRAM_SUPPORT
+
+        config BLE_MESH_MEM_ALLOC_MODE_DEFAULT
+            bool "Default alloc mode"
+            depends on ESP32_SPIRAM_SUPPORT
+            help
+                Enable this option to use the default memory allocation strategy when
+                external SPIRAM is enabled. See the SPIRAM options for more details.
+
+        config BLE_MESH_MEM_ALLOC_MODE_IRAM_8BIT
+            bool "Internal IRAM"
+            depends on ESP32_IRAM_AS_8BIT_ACCESSIBLE_MEMORY
+            help
+                Allows to use IRAM memory region as 8bit accessible region. Every
+                unaligned (8bit or 16bit) access will result in an exception and
+                incur penalty of certain clock cycles per unaligned read/write.
+
+    endchoice # BLE_MESH_MEM_ALLOC_MODE
+
+    config BLE_MESH_FREERTOS_STATIC_ALLOC
+        bool "Enable FreeRTOS static allocation"
+        depends on FREERTOS_SUPPORT_STATIC_ALLOCATION && (ESP32_SPIRAM_SUPPORT || ESP32_IRAM_AS_8BIT_ACCESSIBLE_MEMORY)
+        default n
+        help
+            Enable this option to use FreeRTOS static allocation APIs for BLE Mesh,
+            which provides the ability to use different dynamic memory (i.e. SPIRAM
+            or IRAM) for FreeRTOS objects.
+            If this option is disabled, the FreeRTOS static allocation APIs will not
+            be used, and internal DRAM will be allocated for FreeRTOS objects.
+
+    choice BLE_MESH_FREERTOS_STATIC_ALLOC_MODE
+        prompt "Memory allocation for FreeRTOS objects"
+        depends on BLE_MESH_FREERTOS_STATIC_ALLOC
+        help
+            Choose the memory to be used for FreeRTOS objects.
+
+        config BLE_MESH_FREERTOS_STATIC_ALLOC_EXTERNAL
+            bool "External SPIRAM"
+            depends on ESP32_SPIRAM_SUPPORT
+            help
+                If enabled, BLE Mesh allocates dynamic memory from external SPIRAM for
+                FreeRTOS objects, i.e. mutex, queue, and task stack. External SPIRAM
+                can only be used for task stack when SPIRAM_ALLOW_STACK_EXTERNAL_MEMORY
+                is enabled. See the SPIRAM options for more details.
+
+        config BLE_MESH_FREERTOS_STATIC_ALLOC_IRAM_8BIT
+            bool "Internal IRAM"
+            depends on ESP32_IRAM_AS_8BIT_ACCESSIBLE_MEMORY
+            help
+                If enabled, BLE Mesh allocates dynamic memory from internal IRAM for
+                FreeRTOS objects, i.e. mutex, queue. Note: IRAM region cannot be used
+                as task stack.
+
+    endchoice # BLE_MESH_FREERTOS_STATIC_ALLOC_MODE
+
     config BLE_MESH_FAST_PROV
         bool "Enable BLE Mesh Fast Provisioning"
         select BLE_MESH_NODE
@@ -49,7 +126,7 @@ if BLE_MESH
 
         config BLE_MESH_WAIT_FOR_PROV_MAX_DEV_NUM
             int "Maximum number of unprovisioned devices that can be added to device queue"
-            default 20
+            default 10
             range 1 100
             help
                 This option specifies how many unprovisioned devices can be added to device
@@ -57,25 +134,14 @@ if BLE_MESH
                 queue in the bottom layer which is used to store unprovisioned device
                 information (e.g. Device UUID, address).
 
-        config BLE_MESH_MAX_STORED_NODES
-            int "Maximum number of nodes whose information can be stored"
-            default 20
-            range BLE_MESH_MAX_PROV_NODES 1000
-            help
-                This option specifies the maximum number of nodes whose information can be
-                stored by a Provisioner in its upper layer.
-                Users can change this value according to the number of nodes whose information
-                (e.g. Device UUID, unicast address, element number) are going to be stored by
-                a Provisioner. And the nodes include the provisioned ones and user-added ones.
-
         config BLE_MESH_MAX_PROV_NODES
             int "Maximum number of devices that can be provisioned by Provisioner"
-            default 20
+            default 10
             range 1 1000
             help
                 This option specifies how many devices can be provisioned by a Provisioner.
                 This value indicates the maximum number of unprovisioned devices which can be
-                provisioned by a Provisioner. For instance，if the value is 6, it means the
+                provisioned by a Provisioner. For instance, if the value is 6, it means the
                 Provisioner can provision up to 6 unprovisioned devices.
                 Theoretically a Provisioner without the limitation of its memory can provision
                 up to 32766 unprovisioned devices, here we limit the maximum number to 100
@@ -116,7 +182,7 @@ if BLE_MESH
 
         config BLE_MESH_PROVISIONER_APP_KEY_COUNT
             int "Maximum number of application keys that can be owned by Provisioner"
-            default 9
+            default 3
             range 1 4096
             help
                 This option specifies how many application keys the Provisioner can have.
@@ -168,15 +234,6 @@ if BLE_MESH
             ability to act as a proxy between a Mesh GATT Client and a Mesh network.
             This option should be enabled if a node is going to be a Proxy Server.
 
-    config BLE_MESH_GATT_PROXY_CLIENT
-        bool "BLE Mesh GATT Proxy Client"
-        select BLE_MESH_PROXY
-        default n
-        help
-            This option enables support for Mesh GATT Proxy Client. The Proxy Client
-            can use the GATT bearer to send mesh messages to a node that supports the
-            advertising bearer.
-
     config BLE_MESH_NODE_ID_TIMEOUT
         int "Node Identity advertising timeout"
         depends on BLE_MESH_GATT_PROXY_SERVER
@@ -191,23 +248,28 @@ if BLE_MESH
             node, it will start to advertise using Node Identity during the time
             set by this option. And after that, Network ID will be advertised.
 
-    if BLE_MESH_PROXY
+    config BLE_MESH_PROXY_FILTER_SIZE
+        int "Maximum number of filter entries per Proxy Client"
+        depends on BLE_MESH_GATT_PROXY_SERVER
+        default 4
+        range 1 32767
+        help
+            This option specifies how many Proxy Filter entries the local node supports.
+            The entries of Proxy filter (whitelist or blacklist) are used to store a
+            list of addresses which can be used to decide which messages will be forwarded
+            to the Proxy Client by the Proxy Server.
 
-        config BLE_MESH_PROXY_FILTER_SIZE
-            int "Maximum number of filter entries per Proxy Client"
-            default 1
-            default 3 if BLE_MESH_GATT_PROXY_SERVER
-            range 1 32767
-            help
-                This option specifies how many Proxy Filter entries the local node supports.
-                The entries of Proxy filter (whitelist or blacklist) are used to store a
-                list of addresses which can be used to decide which messages will be forwarded
-                to the Proxy Client by the Proxy Server.
-
-    endif # BLE_MESH_PROXY
+    config BLE_MESH_GATT_PROXY_CLIENT
+        bool "BLE Mesh GATT Proxy Client"
+        select BLE_MESH_PROXY
+        default n
+        help
+            This option enables support for Mesh GATT Proxy Client. The Proxy Client
+            can use the GATT bearer to send mesh messages to a node that supports the
+            advertising bearer.
 
     config BLE_MESH_NET_BUF_POOL_USAGE
-        bool "BLE Mesh net buffer pool usage tracking"
+        bool
         default y
         help
             Enable BLE Mesh net buffer pool tracking. This option is used to introduce another
@@ -215,16 +277,42 @@ if BLE_MESH
             devices. Recommend to enable this option as default.
 
     config BLE_MESH_SETTINGS
-        bool "Store BLE Mesh Node configuration persistently"
+        bool "Store BLE Mesh configuration persistently"
         default n
         help
-            When selected, the BLE Mesh stack will take care of storing/restoring the
-            BLE Mesh configuration persistently in flash. Currently this only supports
-            storing BLE Mesh node configuration.
-            Currently enabling this option will only store BLE Mesh nodes' information
-            in the flash.
+            When selected, the BLE Mesh stack will take care of storing/restoring the BLE
+            Mesh configuration persistently in flash.
+            If the device is a BLE Mesh node, when this option is enabled, the configuration
+            of the device will be stored persistently, including unicast address, NetKey,
+            AppKey, etc.
+            And if the device is a BLE Mesh Provisioner, the information of the device will
+            be stored persistently, including the information of provisioned nodes, NetKey,
+            AppKey, etc.
 
     if BLE_MESH_SETTINGS
+
+        config BLE_MESH_SPECIFIC_PARTITION
+            bool "Use a specific NVS partition for BLE Mesh"
+            default n
+            help
+                When selected, the mesh stack will use a specified NVS partition instead of
+                default NVS partition. Note that the specified partition must be registered
+                with NVS using nvs_flash_init_partition() API, and the partition must exists
+                in the csv file.
+                When Provisioner needs to store a large amount of nodes' information in the
+                flash (e.g. more than 20), this option is recommended to be enabled.
+
+        if BLE_MESH_SPECIFIC_PARTITION
+
+            config BLE_MESH_PARTITION_NAME
+                string "Name of the NVS partition for BLE Mesh"
+                default "ble_mesh"
+                help
+                    This value defines the name of the specified NVS partition used by the
+                    mesh stack.
+
+        endif # BLE_MESH_SPECIFIC_PARTITION
+
         config BLE_MESH_STORE_TIMEOUT
             int "Delay (in seconds) before storing anything persistently"
             range 0 1000000
@@ -239,7 +327,7 @@ if BLE_MESH
         config BLE_MESH_SEQ_STORE_RATE
             int "How often the sequence number gets updated in storage"
             range 0 1000000
-            default 128
+            default 6
             help
                 This value defines how often the local sequence number gets updated in
                 persistent storage (i.e. flash). e.g. a value of 100 means that the
@@ -267,6 +355,29 @@ if BLE_MESH
                 introduce message replay attacks and system security will be in a
                 vulnerable state.
 
+        config BLE_MESH_SETTINGS_BACKWARD_COMPATIBILITY
+            bool "A specific option for settings backward compatibility"
+            depends on BLE_MESH_NODE
+            default n
+            help
+                This option is created to solve the issue of failure in recovering
+                node information after mesh stack updates. In the old version mesh
+                stack, there is no key of "mesh/role" in nvs. In the new version
+                mesh stack, key of "mesh/role" is added in nvs, recovering node
+                information needs to check "mesh/role" key in nvs and implements
+                selective recovery of mesh node information. Therefore, there may
+                be failure in recovering node information during node restarting
+                after OTA.
+
+                The new version mesh stack adds the option of "mesh/role" because
+                we have added the support of storing Provisioner information, while
+                the old version only supports storing node information.
+
+                If users are updating their nodes from old version to new version,
+                we recommend enabling this option, so that system could set the flag
+                in advance before recovering node information and make sure the node
+                information recovering could work as expected.
+
     endif  # if BLE_MESH_SETTINGS
 
     config BLE_MESH_SUBNET_COUNT
@@ -319,6 +430,11 @@ if BLE_MESH
             The replay protection list is used to prevent a node from replay attack,
             which will store the source address and sequence number of the received
             mesh messages.
+            For Provisioner, the replay protection list size should not be smaller than
+            the maximum number of nodes whose information can be stored. And the element
+            number of each node should also be taken into consideration. For example, if
+            Provisioner can provision up to 20 nodes and each node contains two elements,
+            then the replay protection list size of Provisioner should be at least 40.
 
     config BLE_MESH_MSG_CACHE_SIZE
         int "Network message cache size"
@@ -343,6 +459,24 @@ if BLE_MESH
             SDU size is 60 bytes, which leaves 56 bytes for application layer data
             using a 4-byte MIC, or 52 bytes using an 8-byte MIC.
 
+    config BLE_MESH_SUPPORT_BLE_ADV
+        bool "Support sending normal BLE advertising packets"
+        default n
+        help
+            When selected, users can send normal BLE advertising packets
+            with specific API.
+
+    if BLE_MESH_SUPPORT_BLE_ADV
+
+        config BLE_MESH_BLE_ADV_BUF_COUNT
+            int "Number of advertising buffers for BLE advertising packets"
+            default 3
+            range 1 255
+            help
+                Number of advertising buffers for BLE packets available.
+
+    endif # BLE_MESH_SUPPORT_BLE_ADV
+
     config BLE_MESH_IVU_DIVIDER
         int "Divider for IV Update state refresh timer"
         default 4
@@ -403,7 +537,7 @@ if BLE_MESH
 
     config BLE_MESH_TX_SEG_MAX
         int "Maximum number of segments in outgoing messages"
-        default 20
+        default 32
         range 2 32
         help
             Maximum number of segments supported for outgoing messages.
@@ -765,9 +899,9 @@ if BLE_MESH
                 Enable support for Generic Default Transition Time client model.
 
         config BLE_MESH_GENERIC_POWER_ONOFF_CLI
-            bool "Generic Power Onoff Client Model"
+            bool "Generic Power OnOff Client Model"
             help
-                Enable support for Generic Power Onoff client model.
+                Enable support for Generic Power OnOff client model.
 
         config BLE_MESH_GENERIC_POWER_LEVEL_CLI
             bool "Generic Power Level Client Model"
@@ -853,6 +987,26 @@ if BLE_MESH
                 This option adds extra self-tests which are run every time BLE Mesh
                 networking is initialized.
 
+        if BLE_MESH_SELF_TEST
+
+            config BLE_MESH_TEST_AUTO_ENTER_NETWORK
+                bool "Unprovisioned device enters mesh network automatically"
+                default y
+                help
+                    With this option enabled, an unprovisioned device can automatically
+                    enters mesh network using a specific test function without the pro-
+                    visioning procedure. And on the Provisioner side, a test function
+                    needs to be invoked to add the node information into the mesh stack.
+
+            config BLE_MESH_TEST_USE_WHITE_LIST
+                bool "Use white list to filter mesh advertising packets"
+                default n
+                help
+                    With this option enabled, users can use white list to filter mesh
+                    advertising packets while scanning.
+
+        endif # BLE_MESH_SELF_TEST
+
         config BLE_MESH_SHELL
             bool "Enable BLE Mesh shell"
             default n

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_ble_api.c

@@ -0,0 +1,73 @@
+// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <stdint.h>
+#include <string.h>
+
+#include "btc/btc_manage.h"
+
+#include "esp_err.h"
+
+#include "btc_ble_mesh_prov.h"
+#include "esp_ble_mesh_defs.h"
+
+#if CONFIG_BLE_MESH_SUPPORT_BLE_ADV
+
+esp_err_t esp_ble_mesh_start_ble_advertising(const esp_ble_mesh_ble_adv_param_t *param,
+                                             const esp_ble_mesh_ble_adv_data_t *data)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (param == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_START_BLE_ADVERTISING;
+
+    memcpy(&arg.start_ble_advertising.param, param, sizeof(esp_ble_mesh_ble_adv_param_t));
+    if (data) {
+        memcpy(&arg.start_ble_advertising.data, data, sizeof(esp_ble_mesh_ble_adv_data_t));
+    }
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_stop_ble_advertising(uint8_t index)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (index >= CONFIG_BLE_MESH_BLE_ADV_BUF_COUNT) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_STOP_BLE_ADVERTISING;
+
+    arg.stop_ble_advertising.index = index;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+#endif /* CONFIG_BLE_MESH_SUPPORT_BLE_ADV */

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_common_api.c

@@ -17,10 +17,6 @@
 #include "freertos/FreeRTOS.h"
 #include "freertos/semphr.h"
 
-#include "btc/btc_task.h"
-#include "btc/btc_manage.h"
-#include "osi/alarm.h"
-
 #include "esp_err.h"
 
 #include "btc_ble_mesh_prov.h"
@@ -31,7 +27,7 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
     btc_ble_mesh_prov_args_t arg = {0};
     SemaphoreHandle_t semaphore = NULL;
     btc_msg_t msg = {0};
-    esp_err_t ret;
+    esp_err_t ret = ESP_OK;
 
     if (prov == NULL || comp == NULL) {
         return ESP_ERR_INVALID_ARG;
@@ -46,7 +42,7 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
 
     // Create a semaphore
     if ((semaphore = xSemaphoreCreateCounting(1, 0)) == NULL) {
-        LOG_ERROR("%s, Failed to allocate memory for the semaphore", __func__);
+        BT_ERR("Failed to create semaphore");
         return ESP_ERR_NO_MEM;
     }
 
@@ -61,7 +57,7 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
 
     if (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL) != BT_STATUS_SUCCESS) {
         vSemaphoreDelete(semaphore);
-        LOG_ERROR("%s, BLE Mesh initialise failed", __func__);
+        BT_ERR("Failed to start mesh init");
         return ESP_FAIL;
     }
 
@@ -73,3 +69,24 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
     return ESP_OK;
 }
 
+esp_err_t esp_ble_mesh_deinit(esp_ble_mesh_deinit_param_t *param)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (param == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    arg.mesh_deinit.param.erase_flash = param->erase_flash;
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_DEINIT_MESH;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+