Merge branch 'feature/esp_tee_h2_v5.5' into 'release/v5.5'

feat(esp_tee): Support for ESP32-H2 (v5.5)

See merge request espressif/esp-idf!39311

components/esp_hw_support/port/esp32h2/CMakeLists.txt

@@ -1,3 +1,5 @@
+idf_build_get_property(non_os_build NON_OS_BUILD)
+
 set(srcs "rtc_clk_init.c"
          "rtc_clk.c"
          "pmu_param.c"
@@ -7,7 +9,7 @@ set(srcs "rtc_clk_init.c"
          "chip_info.c"
          )
 
-if(NOT BOOTLOADER_BUILD)
+if(NOT non_os_build)
     list(APPEND srcs "sar_periph_ctrl.c")
 endif()
 

components/esp_hw_support/port/esp32h2/cpu_region_protect.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -112,6 +112,14 @@ void esp_cpu_configure_region_protection(void)
     //
     esp_cpu_configure_invalid_regions();
 
+    /* NOTE: When ESP-TEE is active, only configure invalid memory regions in bootloader
+     * to prevent errors before TEE initialization. TEE will handle all other
+     * memory protection.
+     */
+#if CONFIG_SECURE_ENABLE_TEE && BOOTLOADER_BUILD
+    return;
+#endif
+
     //
     // Configure all the valid address regions using PMP
     //

components/esp_hw_support/port/esp32h2/esp_cpu_intr.c

@@ -6,6 +6,7 @@
 
 #include "esp_cpu.h"
 #include "esp_riscv_intr.h"
+#include "sdkconfig.h"
 
 void esp_cpu_intr_get_desc(int core_id, int intr_num, esp_cpu_intr_desc_t *intr_desc_ret)
 {
@@ -15,7 +16,18 @@ void esp_cpu_intr_get_desc(int core_id, int intr_num, esp_cpu_intr_desc_t *intr_
      * Interrupts 3, 4 and 7 are unavailable for PULP CPU as they are bound to Core-Local Interrupts (CLINT)
      */
     // [TODO: IDF-2465]
-    const uint32_t rsvd_mask = BIT(3) | BIT(4) | BIT(6) | BIT(7);
+    const uint32_t base_rsvd_mask = BIT(3) | BIT(4) | BIT(6) | BIT(7);
+
+    /* On the ESP32-H2, interrupt 14 is reserved for ESP-TEE
+     * for operations related to secure peripherals under its control
+     * (e.g. AES, SHA, APM)
+     */
+#if CONFIG_SECURE_ENABLE_TEE
+    const uint32_t rsvd_mask = base_rsvd_mask | BIT(14);
+#else
+    const uint32_t rsvd_mask = base_rsvd_mask;
+#endif
+
 
     intr_desc_ret->priority = 1;
     intr_desc_ret->type = ESP_CPU_INTR_TYPE_NA;