I want to enable secure boot in ESP32-S3, but I checked in menuconfig, and it doesn't support it. How can I enable it?

[SanjayEIC]

I am using Zephyr RTOS
Board :- esp32s3

[rftafas]

Hi.

Without a bootloader, this won't be available. You need MCUboot. But just using "regular" MCUboot won't work either. To get security features, you need to use Espressif Port of MCUboot.

• Instructions here: https://docs.mcuboot.com/readme-espressif.html
• Yes, you need ESP-IDF installed for now.
• Yes, you generate 2 images independently.
• No, this is not a Fork. It is just a different port within MCUboot main repo.
• We are working to improve Zephyr and MCUboot-Espressif Port relation, but not there yet.
• This is not a bug neither a missing feature. We (Espressif team) do not have plans to port security features to Zephyr Port of MCUboot.

This can be closed or, better yet, moved to discussion.

[SanjayEIC]

Thank you so much for update.

[SanjayEIC]

Hi @rftafas

I have tried to enable Secure boot on ESP32-S3 for the past few days with limited success.
We have implemented whole procedure per guide: https://docs.mcuboot.com/readme-espressif.html

Regarding ESP-IDF, I am using ESP-IDF 5.1.4 & ZephyrRTOS 3.6.0

Bootloader configuration :-

mcuboot/boot/espressif/port/esp32s3/bootloader.conf

CONFIG_ESP_SIGN_RSA=y
CONFIG_ESP_SIGN_RSA_LEN=3072
CONFIG_ESP_USE_MBEDTLS=y

Hardware Secure Boot related options
CONFIG_SECURE_SIGNED_ON_BOOT=1
CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME=1
CONFIG_SECURE_BOOT=1
CONFIG_SECURE_BOOT_V2_ENABLED=1
CONFIG_SECURE_BOOT_SUPPORTS_RSA=1

Hardware Flash Encryption related options
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=1
CONFIG_SECURE_BOOT_ALLOW_JTAG=1

Options for enabling eFuse emulation in Flash
CONFIG_EFUSE_VIRTUAL=1
CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH=1

Bootloader :-

mkdir -p Path/bootloader/mcuboot/boot/espressif/build

cmake -S Path bootloader/mcuboot/boot/espressif -B Path/bootloader/mcuboot/boot/espressif/build -DCMAKE_TOOLCHAIN_FILE=Path/bootloader/mcuboot/boot/espressif/tools/toolchain-esp32s3.cmake -DMCUBOOT_TARGET=esp32s3 -DESP_HAL_PATH=$IDF_PATH -DMCUBOOT_FLASH_PORT=/dev/ttyUSB0 -G Ninja

cd Path/bootloader/mcuboot/boot/espressif/build

ninja

generate key :-
openssl genpkey -algorithm RSA -out mcuboot_private.pem -pkeyopt rsa_keygen_bits:3072

Sign binaries :-

python3 path/bootloader/mcuboot/mcuboot/scripts/imgtool.py sign
--key /path/bootloader/mcuboot/boot/espressif/key/mcuboot_private.pem
--header-size 32 --align 4 --version 1.0.0
--slot-size 0x00100000
/path/build/zephyr/zephyr.bin
/path/build/zephyr/application_image_signed.bin

python3 /home/sanjay/SM/bootloader/mcuboot/mcuboot/scripts/imgtool.py sign
--key /home/sanjay/SM/bootloader/mcuboot/boot/espressif/key/mcuboot_private.pem
--header-size 32 --align 4 --version 1.0.0
--pad-header --slot-size 0x00100000
/home/sanjay/SM/bootloader/mcuboot/boot/espressif/build/mcuboot_esp32s3.bin
/home/sanjay/SM/bootloader/mcuboot/boot/espressif/build/mcuboot_esp32s3_signed.bin

Flash signed binaries :-

Application :-
esptool.py --chip esp32s3 --port /dev/ttyUSB0 --baud 460800 write_flash 0x10000
path/application_image_signed.bin

Bootloader :-
esptool.py --chip esp32s3 --port /dev/ttyUSB0 --baud 460800 write_flash 0x0
path/mcuboot_esp32s3_signed.bin

Getting this type of log continuous

Build:Mar 27 2021
rst:0x7 (TG0WDT_SYS_RST),boot:0x9 (SPI_FAST_FLASH_BOOT)
Saved PC:0x40043ac8
SPIWP:0xee
mode:DIO, clock div:1
load:0x3fce3808,len:0x44c
load:0x403c9700,len:0xbe4
load:0x73e290dd,len:0xdda79069
Invalid image block, can't boot.
ets_main.c 329

if any suggestion regarding this