From 154f61ab9db9e305d61a8cb4db63569271b63132 Mon Sep 17 00:00:00 2001 From: "nilesh.kale" Date: Thu, 16 Jul 2026 15:05:49 +0530 Subject: [PATCH] fix(bootloader_support): enable XTS-AES pseudo rounds for ESP32-P4 Burn XTS_DPA_PSEUDO_LEVEL efuse on P4 (rev >= 3.0) as done for other targets. --- components/bootloader/Kconfig.projbuild | 2 ++ .../src/esp32p4/flash_encryption_secure_features.c | 11 ++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/components/bootloader/Kconfig.projbuild b/components/bootloader/Kconfig.projbuild index 3705448c597..788299dd03a 100644 --- a/components/bootloader/Kconfig.projbuild +++ b/components/bootloader/Kconfig.projbuild @@ -1129,6 +1129,8 @@ menu "Security features" default y if SECURE_FLASH_ENCRYPTION_MODE_RELEASE default n depends on SECURE_FLASH_ENC_ENABLED && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND + # ESP32-P4 revisions < v3.0 do not support the XTS-AES pseudo rounds function + depends on !ESP32P4_SELECTS_REV_LESS_V3 help If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function. Note: Enabling this config would burn an efuse. diff --git a/components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c b/components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c index ce8c93c811e..87e69a97a0a 100644 --- a/components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c +++ b/components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -14,6 +14,7 @@ #include "hal/key_mgr_hal.h" #include "hal/key_mgr_ll.h" #include "hal/mspi_ll.h" +#include "hal/spi_flash_encrypted_ll.h" static __attribute__((unused)) const char *TAG = "flash_encrypt"; @@ -43,6 +44,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void) esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT); +#if CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC + if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) { + ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function..."); + uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH; + esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count); + } +#endif + #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS) // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot // otherwise the Flash Encryption key cannot be read protected