mirror of
https://github.com/espressif/esp-idf.git
synced 2026-10-02 03:00:34 +03:00
Merge branch 'feat/add_flash_encryption_support_for_esp32h4' into 'master'
feat: enable flash encryption support in ESP32H4 Closes IDF-12261, IDF-12969, and IDF-12506 See merge request espressif/esp-idf!45613
This commit is contained in:
Nilesh Kale
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
* SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
@@ -12,12 +12,45 @@
|
||||
#include "esp_log.h"
|
||||
#include "sdkconfig.h"
|
||||
|
||||
//TODO: [ESP32H4] IDF-12261
|
||||
|
||||
ESP_LOG_ATTR_TAG(TAG, "flash_encrypt");
|
||||
|
||||
esp_err_t esp_flash_encryption_enable_secure_features(void)
|
||||
{
|
||||
abort();
|
||||
#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
|
||||
ESP_LOGI(TAG, "Disable UART bootloader encryption...");
|
||||
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
|
||||
#else
|
||||
ESP_LOGW(TAG, "Not disabling UART bootloader encryption");
|
||||
#endif
|
||||
|
||||
#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
|
||||
ESP_LOGI(TAG, "Disable UART bootloader cache...");
|
||||
esp_efuse_write_field_bit(ESP_EFUSE_SPI_DOWNLOAD_MSPI_DIS);
|
||||
#else
|
||||
ESP_LOGW(TAG, "Not disabling UART bootloader cache - SECURITY COMPROMISED");
|
||||
#endif
|
||||
|
||||
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
|
||||
ESP_LOGI(TAG, "Disable JTAG...");
|
||||
esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
|
||||
esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
|
||||
#else
|
||||
ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
|
||||
#endif
|
||||
|
||||
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
|
||||
|
||||
#if defined(CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC) && CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC
|
||||
ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
|
||||
uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
|
||||
esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
|
||||
#endif
|
||||
|
||||
#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
|
||||
// This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
|
||||
// otherwise the Flash Encryption key cannot be read protected
|
||||
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
|
||||
#endif
|
||||
|
||||
return ESP_OK;
|
||||
}
|
||||
|
||||
@@ -31,6 +31,7 @@ def test_parlio(dut: Dut) -> None:
|
||||
],
|
||||
indirect=True,
|
||||
)
|
||||
@pytest.mark.temp_skip_ci(targets=['esp32h4'], reason='cannot pass') # TODO: IDF-15613
|
||||
@idf_parametrize(
|
||||
'target', soc_filtered_targets('SOC_PARLIO_SUPPORTED == 1 and SOC_FLASH_ENC_SUPPORTED == 1'), indirect=['target']
|
||||
)
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
* SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
@@ -16,12 +16,11 @@
|
||||
#include <stdbool.h>
|
||||
#include <string.h>
|
||||
#include "soc/hp_system_reg.h"
|
||||
#include "soc/xts_aes_reg.h"
|
||||
#include "soc/spi_mem_reg.h"
|
||||
#include "soc/soc.h"
|
||||
#include "soc/soc_caps.h"
|
||||
#include "hal/assert.h"
|
||||
|
||||
//TODO: [ESP32H4] IDF-12261 inherited from verification branch, need check
|
||||
#include "hal/spi_flash_encrypt_types.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@@ -63,7 +62,7 @@ static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type)
|
||||
{
|
||||
// Our hardware only support flash encryption
|
||||
HAL_ASSERT(type == FLASH_ENCRYPTION_MANU);
|
||||
REG_SET_FIELD(XTS_AES_DESTINATION_REG(0), XTS_AES_DESTINATION, type);
|
||||
REG_SET_FIELD(SPI_MEM_XTS_DESTINATION_REG(0), SPI_XTS_DESTINATION, type);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -74,7 +73,7 @@ static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type)
|
||||
static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size)
|
||||
{
|
||||
// Desired block should not be larger than the block size.
|
||||
REG_SET_FIELD(XTS_AES_LINESIZE_REG(0), XTS_AES_LINESIZE, size >> 5);
|
||||
REG_SET_FIELD(SPI_MEM_XTS_LINESIZE_REG(0), SPI_XTS_LINESIZE, size >> 5);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -89,7 +88,7 @@ static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const u
|
||||
{
|
||||
uint32_t plaintext_offs = (address % SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX);
|
||||
HAL_ASSERT(plaintext_offs + size <= SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX);
|
||||
memcpy((void *)(XTS_AES_PLAIN_MEM(0) + plaintext_offs), buffer, size);
|
||||
memcpy((void *)(SPI_MEM_XTS_PLAIN_BASE_REG(0) + plaintext_offs), buffer, size);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -99,7 +98,7 @@ static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const u
|
||||
*/
|
||||
static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr)
|
||||
{
|
||||
REG_SET_FIELD(XTS_AES_PHYSICAL_ADDRESS_REG(0), XTS_AES_PHYSICAL_ADDRESS, flash_addr);
|
||||
REG_SET_FIELD(SPI_MEM_XTS_PHYSICAL_ADDRESS_REG(0), SPI_XTS_PHYSICAL_ADDRESS, flash_addr);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -107,7 +106,7 @@ static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr)
|
||||
*/
|
||||
static inline void spi_flash_encrypt_ll_calculate_start(void)
|
||||
{
|
||||
REG_SET_FIELD(XTS_AES_TRIGGER_REG(0), XTS_AES_TRIGGER, 1);
|
||||
REG_SET_FIELD(SPI_MEM_XTS_TRIGGER_REG(0), SPI_XTS_TRIGGER, 1);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -115,7 +114,7 @@ static inline void spi_flash_encrypt_ll_calculate_start(void)
|
||||
*/
|
||||
static inline void spi_flash_encrypt_ll_calculate_wait_idle(void)
|
||||
{
|
||||
while (REG_GET_FIELD(XTS_AES_STATE_REG(0), XTS_AES_STATE) == 0x1) {
|
||||
while (REG_GET_FIELD(SPI_MEM_XTS_STATE_REG(0), SPI_XTS_STATE) == 0x1) {
|
||||
}
|
||||
}
|
||||
|
||||
@@ -124,8 +123,8 @@ static inline void spi_flash_encrypt_ll_calculate_wait_idle(void)
|
||||
*/
|
||||
static inline void spi_flash_encrypt_ll_done(void)
|
||||
{
|
||||
REG_SET_BIT(XTS_AES_RELEASE_REG(0), XTS_AES_RELEASE);
|
||||
while (REG_GET_FIELD(XTS_AES_STATE_REG(0), XTS_AES_STATE) != 0x3) {
|
||||
REG_SET_BIT(SPI_MEM_XTS_RELEASE_REG(0), SPI_XTS_RELEASE);
|
||||
while (REG_GET_FIELD(SPI_MEM_XTS_STATE_REG(0), SPI_XTS_STATE) != 0x3) {
|
||||
}
|
||||
}
|
||||
|
||||
@@ -134,7 +133,7 @@ static inline void spi_flash_encrypt_ll_done(void)
|
||||
*/
|
||||
static inline void spi_flash_encrypt_ll_destroy(void)
|
||||
{
|
||||
REG_SET_BIT(XTS_AES_DESTROY_REG(0), XTS_AES_DESTROY);
|
||||
REG_SET_BIT(SPI_MEM_XTS_DESTROY_REG(0), SPI_XTS_DESTROY);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -148,6 +147,37 @@ static inline bool spi_flash_encrypt_ll_check(uint32_t address, uint32_t length)
|
||||
return ((address % length) == 0) ? true : false;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Enable the pseudo-round function during XTS-AES operations
|
||||
*
|
||||
* @param mode set the mode for pseudo rounds, zero to disable, with increasing security upto three.
|
||||
* @param base basic number of pseudo rounds, zero if disable
|
||||
* @param increment increment number of pseudo rounds, zero if disable
|
||||
* @param key_rng_cnt update frequency of the pseudo-key, zero if disable
|
||||
*/
|
||||
static inline void spi_flash_encrypt_ll_enable_pseudo_rounds(esp_xts_aes_psuedo_rounds_state_t mode, uint8_t base, uint8_t increment, uint8_t key_rng_cnt)
|
||||
{
|
||||
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_MODE_PSEUDO, mode);
|
||||
|
||||
if (mode != ESP_XTS_AES_PSEUDO_ROUNDS_DISABLE) {
|
||||
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_BASE, base);
|
||||
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_INC, increment);
|
||||
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_RNG_CNT, key_rng_cnt);
|
||||
} else {
|
||||
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_BASE, 0);
|
||||
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_INC, 0);
|
||||
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_RNG_CNT, 0);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Check if the pseudo round function is supported
|
||||
*/
|
||||
static inline bool spi_flash_encrypt_ll_is_pseudo_rounds_function_supported(void)
|
||||
{
|
||||
return true;
|
||||
}
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -1,127 +0,0 @@
|
||||
/**
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0 OR MIT
|
||||
*/
|
||||
#pragma once
|
||||
|
||||
#include "soc/soc.h"
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#define XTS_AES_PLAIN_MEM(i) (REG_SPI_MEM_BASE(i) + 0x300)
|
||||
/* XTS_AES_PLAIN : R/W ;bitpos:[31:0] ;default: 32'h0 ; */
|
||||
/*description: This field is only used to generate include file in c case. This field is useles
|
||||
s. Please do not use this field..*/
|
||||
#define XTS_AES_PLAIN 0xFFFFFFFF
|
||||
#define XTS_AES_PLAIN_M ((XTS_AES_PLAIN_V)<<(XTS_AES_PLAIN_S))
|
||||
#define XTS_AES_PLAIN_V 0xFFFFFFFF
|
||||
#define XTS_AES_PLAIN_S 0
|
||||
|
||||
#define XTS_AES_LINESIZE_REG(i) (REG_SPI_MEM_BASE(i) + 0x340)
|
||||
/* XTS_AES_LINESIZE : R/W ;bitpos:[1:0] ;default: 2'h0 ; */
|
||||
/*description: This bits stores the line-size parameter which will be used in manual encryption
|
||||
calculation. It decides how many bytes will be encrypted one time. 0: 16-bytes,
|
||||
1: 32-bytes, 2: 64-bytes, 3:reserved..*/
|
||||
#define XTS_AES_LINESIZE 0x00000003
|
||||
#define XTS_AES_LINESIZE_M ((XTS_AES_LINESIZE_V)<<(XTS_AES_LINESIZE_S))
|
||||
#define XTS_AES_LINESIZE_V 0x3
|
||||
#define XTS_AES_LINESIZE_S 0
|
||||
|
||||
#define XTS_AES_DESTINATION_REG(i) (REG_SPI_MEM_BASE(i) + 0x344)
|
||||
/* XTS_AES_DESTINATION : R/W ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: This bit stores the destination parameter which will be used in manual encryption
|
||||
n calculation. 0: flash(default), 1: psram(reserved). Only default value can be
|
||||
used..*/
|
||||
#define XTS_AES_DESTINATION (BIT(0))
|
||||
#define XTS_AES_DESTINATION_M (BIT(0))
|
||||
#define XTS_AES_DESTINATION_V 0x1
|
||||
#define XTS_AES_DESTINATION_S 0
|
||||
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_REG(i) (REG_SPI_MEM_BASE(i) + 0x348)
|
||||
/* XTS_AES_PHYSICAL_ADDRESS : R/W ;bitpos:[25:0] ;default: 26'h0 ; */
|
||||
/*description: This bits stores the physical-address parameter which will be used in manual enc
|
||||
ryption calculation. This value should aligned with byte number decided by line-
|
||||
size parameter..*/
|
||||
#define XTS_AES_PHYSICAL_ADDRESS 0x03FFFFFF
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_M ((XTS_AES_PHYSICAL_ADDRESS_V)<<(XTS_AES_PHYSICAL_ADDRESS_S))
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_V 0x3FFFFFF
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_S 0
|
||||
|
||||
#define XTS_AES_TRIGGER_REG(i) (REG_SPI_MEM_BASE(i) + 0x34C)
|
||||
/* XTS_AES_TRIGGER : WT ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: Set this bit to trigger the process of manual encryption calculation. This actio
|
||||
n should only be asserted when manual encryption status is 0. After this action,
|
||||
manual encryption status becomes 1. After calculation is done, manual encryption
|
||||
n status becomes 2..*/
|
||||
#define XTS_AES_TRIGGER (BIT(0))
|
||||
#define XTS_AES_TRIGGER_M (BIT(0))
|
||||
#define XTS_AES_TRIGGER_V 0x1
|
||||
#define XTS_AES_TRIGGER_S 0
|
||||
|
||||
#define XTS_AES_RELEASE_REG(i) (REG_SPI_MEM_BASE(i) + 0x350)
|
||||
/* XTS_AES_RELEASE : WT ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: Set this bit to release encrypted result to mspi. This action should only be ass
|
||||
erted when manual encryption status is 2. After this action, manual encryption s
|
||||
tatus will become 3..*/
|
||||
#define XTS_AES_RELEASE (BIT(0))
|
||||
#define XTS_AES_RELEASE_M (BIT(0))
|
||||
#define XTS_AES_RELEASE_V 0x1
|
||||
#define XTS_AES_RELEASE_S 0
|
||||
|
||||
#define XTS_AES_DESTROY_REG(i) (REG_SPI_MEM_BASE(i) + 0x354)
|
||||
/* XTS_AES_DESTROY : WT ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: Set this bit to destroy encrypted result. This action should be asserted only wh
|
||||
en manual encryption status is 3. After this action, manual encryption status wi
|
||||
ll become 0..*/
|
||||
#define XTS_AES_DESTROY (BIT(0))
|
||||
#define XTS_AES_DESTROY_M (BIT(0))
|
||||
#define XTS_AES_DESTROY_V 0x1
|
||||
#define XTS_AES_DESTROY_S 0
|
||||
|
||||
#define XTS_AES_STATE_REG(i) (REG_SPI_MEM_BASE(i) + 0x358)
|
||||
/* XTS_AES_STATE : RO ;bitpos:[1:0] ;default: 2'h0 ; */
|
||||
/*description: This bits stores the status of manual encryption. 0: idle, 1: busy of encryption
|
||||
calculation, 2: encryption calculation is done but the encrypted result is invi
|
||||
sible to mspi, 3: the encrypted result is visible to mspi..*/
|
||||
#define XTS_AES_STATE 0x00000003
|
||||
#define XTS_AES_STATE_M ((XTS_AES_STATE_V)<<(XTS_AES_STATE_S))
|
||||
#define XTS_AES_STATE_V 0x3
|
||||
#define XTS_AES_STATE_S 0
|
||||
|
||||
#define XTS_AES_DATE_REG(i) (REG_SPI_MEM_BASE(i) + 0x35C)
|
||||
/* XTS_AES_DATE : R/W ;bitpos:[29:0] ;default: 30'h20201010 ; */
|
||||
/*description: This bits stores the last modified-time of manual encryption feature..*/
|
||||
#define XTS_AES_DATE 0x3FFFFFFF
|
||||
#define XTS_AES_DATE_M ((XTS_AES_DATE_V)<<(XTS_AES_DATE_S))
|
||||
#define XTS_AES_DATE_V 0x3FFFFFFF
|
||||
|
||||
#define XTS_AES_DPA_CTRL_REG(i) (REG_SPI_MEM_BASE(i) + 0x388)
|
||||
/* XTS_AES_CRYPT_DPA_SELECT_REGISTER : R/W ;bitpos:[4] ;default: 1'b0 ; */
|
||||
/*description: 1: MSPI XTS DPA clock gate is controlled by SPI_CRYPT_CALC_D_DPA_EN and SPI_CRYP
|
||||
T_SECURITY_LEVEL. 0: Controlled by efuse bits..*/
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER (BIT(4))
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER_M (BIT(4))
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER_V 0x1
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER_S 4
|
||||
/* XTS_AES_CRYPT_CALC_D_DPA_EN : R/W ;bitpos:[3] ;default: 1'b1 ; */
|
||||
/*description: Only available when SPI_CRYPT_SECURITY_LEVEL is not 0. 1: Enable DPA in the calc
|
||||
ulation that using key 1 or key 2. 0: Enable DPA only in the calculation that us
|
||||
ing key 1..*/
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN (BIT(3))
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN_M (BIT(3))
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN_V 0x1
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN_S 3
|
||||
/* XTS_AES_CRYPT_SECURITY_LEVEL : R/W ;bitpos:[2:0] ;default: 3'd7 ; */
|
||||
/*description: Set the security level of spi mem cryption. 0: Shut off cryption DPA function. 1-
|
||||
7: The bigger the number is, the more secure the cryption is. (Note that the per
|
||||
formance of cryption will decrease together with this number increasing).*/
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL 0x00000007
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL_M ((XTS_AES_CRYPT_SECURITY_LEVEL_V)<<(XTS_AES_CRYPT_SECURITY_LEVEL_S))
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL_V 0x7
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL_S 0
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
@@ -1,128 +0,0 @@
|
||||
/**
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0 OR MIT
|
||||
*/
|
||||
#pragma once
|
||||
|
||||
#include "soc/soc.h"
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#define XTS_AES_PLAIN_MEM(i) (REG_SPI_MEM_BASE(i) + 0x300)
|
||||
/* XTS_AES_PLAIN : R/W ;bitpos:[31:0] ;default: 32'h0 ; */
|
||||
/*description: This field is only used to generate include file in c case. This field is useles
|
||||
s. Please do not use this field..*/
|
||||
#define XTS_AES_PLAIN 0xFFFFFFFF
|
||||
#define XTS_AES_PLAIN_M ((XTS_AES_PLAIN_V)<<(XTS_AES_PLAIN_S))
|
||||
#define XTS_AES_PLAIN_V 0xFFFFFFFF
|
||||
#define XTS_AES_PLAIN_S 0
|
||||
|
||||
#define XTS_AES_LINESIZE_REG(i) (REG_SPI_MEM_BASE(i) + 0x340)
|
||||
/* XTS_AES_LINESIZE : R/W ;bitpos:[1:0] ;default: 2'h0 ; */
|
||||
/*description: This bits stores the line-size parameter which will be used in manual encryption
|
||||
calculation. It decides how many bytes will be encrypted one time. 0: 16-bytes,
|
||||
1: 32-bytes, 2: 64-bytes, 3:reserved..*/
|
||||
#define XTS_AES_LINESIZE 0x00000003
|
||||
#define XTS_AES_LINESIZE_M ((XTS_AES_LINESIZE_V)<<(XTS_AES_LINESIZE_S))
|
||||
#define XTS_AES_LINESIZE_V 0x3
|
||||
#define XTS_AES_LINESIZE_S 0
|
||||
|
||||
#define XTS_AES_DESTINATION_REG(i) (REG_SPI_MEM_BASE(i) + 0x344)
|
||||
/* XTS_AES_DESTINATION : R/W ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: This bit stores the destination parameter which will be used in manual encryption
|
||||
n calculation. 0: flash(default), 1: psram(reserved). Only default value can be
|
||||
used..*/
|
||||
#define XTS_AES_DESTINATION (BIT(0))
|
||||
#define XTS_AES_DESTINATION_M (BIT(0))
|
||||
#define XTS_AES_DESTINATION_V 0x1
|
||||
#define XTS_AES_DESTINATION_S 0
|
||||
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_REG(i) (REG_SPI_MEM_BASE(i) + 0x348)
|
||||
/* XTS_AES_PHYSICAL_ADDRESS : R/W ;bitpos:[25:0] ;default: 26'h0 ; */
|
||||
/*description: This bits stores the physical-address parameter which will be used in manual enc
|
||||
ryption calculation. This value should aligned with byte number decided by line-
|
||||
size parameter..*/
|
||||
#define XTS_AES_PHYSICAL_ADDRESS 0x03FFFFFF
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_M ((XTS_AES_PHYSICAL_ADDRESS_V)<<(XTS_AES_PHYSICAL_ADDRESS_S))
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_V 0x3FFFFFF
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_S 0
|
||||
|
||||
#define XTS_AES_TRIGGER_REG(i) (REG_SPI_MEM_BASE(i) + 0x34C)
|
||||
/* XTS_AES_TRIGGER : WT ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: Set this bit to trigger the process of manual encryption calculation. This actio
|
||||
n should only be asserted when manual encryption status is 0. After this action,
|
||||
manual encryption status becomes 1. After calculation is done, manual encryption
|
||||
n status becomes 2..*/
|
||||
#define XTS_AES_TRIGGER (BIT(0))
|
||||
#define XTS_AES_TRIGGER_M (BIT(0))
|
||||
#define XTS_AES_TRIGGER_V 0x1
|
||||
#define XTS_AES_TRIGGER_S 0
|
||||
|
||||
#define XTS_AES_RELEASE_REG(i) (REG_SPI_MEM_BASE(i) + 0x350)
|
||||
/* XTS_AES_RELEASE : WT ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: Set this bit to release encrypted result to mspi. This action should only be ass
|
||||
erted when manual encryption status is 2. After this action, manual encryption s
|
||||
tatus will become 3..*/
|
||||
#define XTS_AES_RELEASE (BIT(0))
|
||||
#define XTS_AES_RELEASE_M (BIT(0))
|
||||
#define XTS_AES_RELEASE_V 0x1
|
||||
#define XTS_AES_RELEASE_S 0
|
||||
|
||||
#define XTS_AES_DESTROY_REG(i) (REG_SPI_MEM_BASE(i) + 0x354)
|
||||
/* XTS_AES_DESTROY : WT ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: Set this bit to destroy encrypted result. This action should be asserted only wh
|
||||
en manual encryption status is 3. After this action, manual encryption status wi
|
||||
ll become 0..*/
|
||||
#define XTS_AES_DESTROY (BIT(0))
|
||||
#define XTS_AES_DESTROY_M (BIT(0))
|
||||
#define XTS_AES_DESTROY_V 0x1
|
||||
#define XTS_AES_DESTROY_S 0
|
||||
|
||||
#define XTS_AES_STATE_REG(i) (REG_SPI_MEM_BASE(i) + 0x358)
|
||||
/* XTS_AES_STATE : RO ;bitpos:[1:0] ;default: 2'h0 ; */
|
||||
/*description: This bits stores the status of manual encryption. 0: idle, 1: busy of encryption
|
||||
calculation, 2: encryption calculation is done but the encrypted result is invi
|
||||
sible to mspi, 3: the encrypted result is visible to mspi..*/
|
||||
#define XTS_AES_STATE 0x00000003
|
||||
#define XTS_AES_STATE_M ((XTS_AES_STATE_V)<<(XTS_AES_STATE_S))
|
||||
#define XTS_AES_STATE_V 0x3
|
||||
#define XTS_AES_STATE_S 0
|
||||
|
||||
#define XTS_AES_DATE_REG(i) (REG_SPI_MEM_BASE(i) + 0x35C)
|
||||
/* XTS_AES_DATE : R/W ;bitpos:[29:0] ;default: 30'h20201010 ; */
|
||||
/*description: This bits stores the last modified-time of manual encryption feature..*/
|
||||
#define XTS_AES_DATE 0x3FFFFFFF
|
||||
#define XTS_AES_DATE_M ((XTS_AES_DATE_V)<<(XTS_AES_DATE_S))
|
||||
#define XTS_AES_DATE_V 0x3FFFFFFF
|
||||
#define XTS_AES_DATE_S 0
|
||||
|
||||
#define XTS_AES_DPA_CTRL_REG(i) (REG_SPI_MEM_BASE(i) + 0x388)
|
||||
/* XTS_AES_CRYPT_DPA_SELECT_REGISTER : R/W ;bitpos:[4] ;default: 1'b0 ; */
|
||||
/*description: 1: MSPI XTS DPA clock gate is controlled by SPI_CRYPT_CALC_D_DPA_EN and SPI_CRYP
|
||||
T_SECURITY_LEVEL. 0: Controlled by efuse bits..*/
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER (BIT(4))
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER_M (BIT(4))
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER_V 0x1
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER_S 4
|
||||
/* XTS_AES_CRYPT_CALC_D_DPA_EN : R/W ;bitpos:[3] ;default: 1'b1 ; */
|
||||
/*description: Only available when SPI_CRYPT_SECURITY_LEVEL is not 0. 1: Enable DPA in the calc
|
||||
ulation that using key 1 or key 2. 0: Enable DPA only in the calculation that us
|
||||
ing key 1..*/
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN (BIT(3))
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN_M (BIT(3))
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN_V 0x1
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN_S 3
|
||||
/* XTS_AES_CRYPT_SECURITY_LEVEL : R/W ;bitpos:[2:0] ;default: 3'd7 ; */
|
||||
/*description: Set the security level of spi mem cryption. 0: Shut off cryption DPA function. 1-
|
||||
7: The bigger the number is, the more secure the cryption is. (Note that the per
|
||||
formance of cryption will decrease together with this number increasing).*/
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL 0x00000007
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL_M ((XTS_AES_CRYPT_SECURITY_LEVEL_V)<<(XTS_AES_CRYPT_SECURITY_LEVEL_S))
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL_V 0x7
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL_S 0
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
@@ -149,7 +149,7 @@ config SOC_ECC_EXTENDED_MODES_SUPPORTED
|
||||
|
||||
config SOC_FLASH_ENC_SUPPORTED
|
||||
bool
|
||||
default n
|
||||
default y
|
||||
|
||||
config SOC_SECURE_BOOT_SUPPORTED
|
||||
bool
|
||||
@@ -1011,6 +1011,10 @@ config SOC_FLASH_ENCRYPTION_XTS_AES
|
||||
bool
|
||||
default y
|
||||
|
||||
config SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS
|
||||
bool
|
||||
default y
|
||||
|
||||
config SOC_FLASH_ENCRYPTION_XTS_AES_128
|
||||
bool
|
||||
default y
|
||||
@@ -1019,6 +1023,10 @@ config SOC_FLASH_ENCRYPTION_XTS_AES_256
|
||||
bool
|
||||
default y
|
||||
|
||||
config SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
|
||||
bool
|
||||
default y
|
||||
|
||||
config SOC_APM_CTRL_FILTER_SUPPORTED
|
||||
bool
|
||||
default y
|
||||
|
||||
@@ -71,9 +71,8 @@
|
||||
#define SOC_HMAC_SUPPORTED 1
|
||||
#define SOC_ECC_SUPPORTED 1
|
||||
#define SOC_ECC_EXTENDED_MODES_SUPPORTED 1
|
||||
#define SOC_FLASH_ENC_SUPPORTED 0 // TODO: [ESP32H4] IDF-12261
|
||||
#define SOC_FLASH_ENC_SUPPORTED 1
|
||||
#define SOC_SECURE_BOOT_SUPPORTED 1
|
||||
|
||||
#define SOC_BOD_SUPPORTED 1
|
||||
// #define SOC_APM_SUPPORTED 1 // TODO: [ESP32H4] IDF-12256
|
||||
#define SOC_PMU_SUPPORTED 1 // TODO: [ESP32H4] IDF-12286
|
||||
@@ -436,9 +435,11 @@
|
||||
|
||||
/*-------------------------- Flash Encryption CAPS----------------------------*/
|
||||
#define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64)
|
||||
#define SOC_FLASH_ENCRYPTION_XTS_AES 1
|
||||
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1
|
||||
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1
|
||||
#define SOC_FLASH_ENCRYPTION_XTS_AES 1
|
||||
#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS 1
|
||||
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1
|
||||
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1
|
||||
#define SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND 1
|
||||
|
||||
/*-------------------------- APM CAPS ----------------------------------------*/
|
||||
#define SOC_APM_CTRL_FILTER_SUPPORTED 1 /*!< Support for APM control filter */
|
||||
|
||||
@@ -1,129 +0,0 @@
|
||||
/**
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0 OR MIT
|
||||
*/
|
||||
#pragma once
|
||||
|
||||
#include "soc/spi1_mem_reg.h"
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
//TODO: [ESP32H4] IDF-12506 inherit from verify code, need check
|
||||
|
||||
#define XTS_AES_PLAIN_MEM(i) (REG_SPI_MEM_BASE(i) + 0x300)
|
||||
/* XTS_AES_PLAIN : R/W ;bitpos:[31:0] ;default: 32'h0 ; */
|
||||
/*description: This field is only used to generate include file in c case. This field is useles
|
||||
s. Please do not use this field..*/
|
||||
#define XTS_AES_PLAIN 0xFFFFFFFF
|
||||
#define XTS_AES_PLAIN_M ((XTS_AES_PLAIN_V)<<(XTS_AES_PLAIN_S))
|
||||
#define XTS_AES_PLAIN_V 0xFFFFFFFF
|
||||
#define XTS_AES_PLAIN_S 0
|
||||
|
||||
#define XTS_AES_LINESIZE_REG(i) (REG_SPI_MEM_BASE(i) + 0x340)
|
||||
/* XTS_AES_LINESIZE : R/W ;bitpos:[1:0] ;default: 2'h0 ; */
|
||||
/*description: This bits stores the line-size parameter which will be used in manual encryption
|
||||
calculation. It decides how many bytes will be encrypted one time. 0: 16-bytes,
|
||||
1: 32-bytes, 2: 64-bytes, 3:reserved..*/
|
||||
#define XTS_AES_LINESIZE 0x00000003
|
||||
#define XTS_AES_LINESIZE_M ((XTS_AES_LINESIZE_V)<<(XTS_AES_LINESIZE_S))
|
||||
#define XTS_AES_LINESIZE_V 0x3
|
||||
#define XTS_AES_LINESIZE_S 0
|
||||
|
||||
#define XTS_AES_DESTINATION_REG(i) (REG_SPI_MEM_BASE(i) + 0x344)
|
||||
/* XTS_AES_DESTINATION : R/W ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: This bit stores the destination parameter which will be used in manual encryption
|
||||
n calculation. 0: flash(default), 1: psram(reserved). Only default value can be
|
||||
used..*/
|
||||
#define XTS_AES_DESTINATION (BIT(0))
|
||||
#define XTS_AES_DESTINATION_M (BIT(0))
|
||||
#define XTS_AES_DESTINATION_V 0x1
|
||||
#define XTS_AES_DESTINATION_S 0
|
||||
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_REG(i) (REG_SPI_MEM_BASE(i) + 0x348)
|
||||
/* XTS_AES_PHYSICAL_ADDRESS : R/W ;bitpos:[25:0] ;default: 26'h0 ; */
|
||||
/*description: This bits stores the physical-address parameter which will be used in manual enc
|
||||
ryption calculation. This value should aligned with byte number decided by line-
|
||||
size parameter..*/
|
||||
#define XTS_AES_PHYSICAL_ADDRESS 0x03FFFFFF
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_M ((XTS_AES_PHYSICAL_ADDRESS_V)<<(XTS_AES_PHYSICAL_ADDRESS_S))
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_V 0x3FFFFFF
|
||||
#define XTS_AES_PHYSICAL_ADDRESS_S 0
|
||||
|
||||
#define XTS_AES_TRIGGER_REG(i) (REG_SPI_MEM_BASE(i) + 0x34C)
|
||||
/* XTS_AES_TRIGGER : WT ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: Set this bit to trigger the process of manual encryption calculation. This actio
|
||||
n should only be asserted when manual encryption status is 0. After this action,
|
||||
manual encryption status becomes 1. After calculation is done, manual encryption
|
||||
n status becomes 2..*/
|
||||
#define XTS_AES_TRIGGER (BIT(0))
|
||||
#define XTS_AES_TRIGGER_M (BIT(0))
|
||||
#define XTS_AES_TRIGGER_V 0x1
|
||||
#define XTS_AES_TRIGGER_S 0
|
||||
|
||||
#define XTS_AES_RELEASE_REG(i) (REG_SPI_MEM_BASE(i) + 0x350)
|
||||
/* XTS_AES_RELEASE : WT ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: Set this bit to release encrypted result to mspi. This action should only be ass
|
||||
erted when manual encryption status is 2. After this action, manual encryption s
|
||||
tatus will become 3..*/
|
||||
#define XTS_AES_RELEASE (BIT(0))
|
||||
#define XTS_AES_RELEASE_M (BIT(0))
|
||||
#define XTS_AES_RELEASE_V 0x1
|
||||
#define XTS_AES_RELEASE_S 0
|
||||
|
||||
#define XTS_AES_DESTROY_REG(i) (REG_SPI_MEM_BASE(i) + 0x354)
|
||||
/* XTS_AES_DESTROY : WT ;bitpos:[0] ;default: 1'b0 ; */
|
||||
/*description: Set this bit to destroy encrypted result. This action should be asserted only wh
|
||||
en manual encryption status is 3. After this action, manual encryption status wi
|
||||
ll become 0..*/
|
||||
#define XTS_AES_DESTROY (BIT(0))
|
||||
#define XTS_AES_DESTROY_M (BIT(0))
|
||||
#define XTS_AES_DESTROY_V 0x1
|
||||
#define XTS_AES_DESTROY_S 0
|
||||
|
||||
#define XTS_AES_STATE_REG(i) (REG_SPI_MEM_BASE(i) + 0x358)
|
||||
/* XTS_AES_STATE : RO ;bitpos:[1:0] ;default: 2'h0 ; */
|
||||
/*description: This bits stores the status of manual encryption. 0: idle, 1: busy of encryption
|
||||
calculation, 2: encryption calculation is done but the encrypted result is invi
|
||||
sible to mspi, 3: the encrypted result is visible to mspi..*/
|
||||
#define XTS_AES_STATE 0x00000003
|
||||
#define XTS_AES_STATE_M ((XTS_AES_STATE_V)<<(XTS_AES_STATE_S))
|
||||
#define XTS_AES_STATE_V 0x3
|
||||
#define XTS_AES_STATE_S 0
|
||||
|
||||
#define XTS_AES_DATE_REG(i) (REG_SPI_MEM_BASE(i) + 0x35C)
|
||||
/* XTS_AES_DATE : R/W ;bitpos:[29:0] ;default: 30'h20201010 ; */
|
||||
/*description: This bits stores the last modified-time of manual encryption feature..*/
|
||||
#define XTS_AES_DATE 0x3FFFFFFF
|
||||
#define XTS_AES_DATE_M ((XTS_AES_DATE_V)<<(XTS_AES_DATE_S))
|
||||
#define XTS_AES_DATE_V 0x3FFFFFFF
|
||||
|
||||
#define XTS_AES_DPA_CTRL_REG(i) (REG_SPI_MEM_BASE(i) + 0x388)
|
||||
/* XTS_AES_CRYPT_DPA_SELECT_REGISTER : R/W ;bitpos:[4] ;default: 1'b0 ; */
|
||||
/*description: 1: MSPI XTS DPA clock gate is controlled by SPI_CRYPT_CALC_D_DPA_EN and SPI_CRYP
|
||||
T_SECURITY_LEVEL. 0: Controlled by efuse bits..*/
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER (BIT(4))
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER_M (BIT(4))
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER_V 0x1
|
||||
#define XTS_AES_CRYPT_DPA_SELECT_REGISTER_S 4
|
||||
/* XTS_AES_CRYPT_CALC_D_DPA_EN : R/W ;bitpos:[3] ;default: 1'b1 ; */
|
||||
/*description: Only available when SPI_CRYPT_SECURITY_LEVEL is not 0. 1: Enable DPA in the calc
|
||||
ulation that using key 1 or key 2. 0: Enable DPA only in the calculation that us
|
||||
ing key 1..*/
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN (BIT(3))
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN_M (BIT(3))
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN_V 0x1
|
||||
#define XTS_AES_CRYPT_CALC_D_DPA_EN_S 3
|
||||
/* XTS_AES_CRYPT_SECURITY_LEVEL : R/W ;bitpos:[2:0] ;default: 3'd7 ; */
|
||||
/*description: Set the security level of spi mem cryption. 0: Shut off cryption DPA function. 1-
|
||||
7: The bigger the number is, the more secure the cryption is. (Note that the per
|
||||
formance of cryption will decrease together with this number increasing).*/
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL 0x00000007
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL_M ((XTS_AES_CRYPT_SECURITY_LEVEL_V)<<(XTS_AES_CRYPT_SECURITY_LEVEL_S))
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL_V 0x7
|
||||
#define XTS_AES_CRYPT_SECURITY_LEVEL_S 0
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
@@ -45,9 +45,9 @@ components/spi_flash/test_apps/esp_flash_stress:
|
||||
|
||||
components/spi_flash/test_apps/flash_encryption:
|
||||
disable:
|
||||
- if: IDF_TARGET in ["esp32h4", "esp32s31"]
|
||||
- if: IDF_TARGET in ["esp32s31"]
|
||||
temporary: true
|
||||
reason: not support yet # TODO: [ESP32H4] IDF-12261 [ESP32S31] IDF-14628
|
||||
reason: not support yet # TODO: [ESP32S31] IDF-14628
|
||||
disable_test:
|
||||
- if: IDF_TARGET in ["esp32c2", "esp32s2", "esp32c6", "esp32h2", "esp32p4", "esp32c5", "esp32c61", "esp32h21", "esp32h4"]
|
||||
temporary: true
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-H21 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
|
||||
| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | --------- | -------- | -------- | -------- |
|
||||
| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-H21 | ESP32-H4 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
|
||||
| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | --------- | -------- | -------- | -------- | -------- |
|
||||
|
||||
## Prepare runner
|
||||
|
||||
|
||||
Reference in New Issue
Block a user