Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bootloader_support): enable XTS-AES pseudo rounds for ESP32-P4

Browse Source 
Burn XTS_DPA_PSEUDO_LEVEL efuse on P4 (rev >= 3.0) as done for other targets.
This commit is contained in:
nilesh.kale
2026-07-16 15:05:49 +05:30
parent 7ef8b58873
commit 446c4fb6c3
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
components/bootloader/Kconfig.projbuild
View File

@@ -1166,6 +1166,8 @@ menu "Security features"
default y if SECURE_FLASH_ENCRYPTION_MODE_RELEASE
default n
depends on SECURE_FLASH_ENC_ENABLED && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
# ESP32-P4 revisions < v3.0 do not support the XTS-AES pseudo rounds function
depends on !ESP32P4_SELECTS_REV_LESS_V3
help
If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
Note: Enabling this config would burn an efuse.

11
components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -16,6 +16,7 @@
#include "hal/key_mgr_hal.h"
#include "hal/key_mgr_ll.h"
#include "hal/mspi_ll.h"
#include "hal/spi_flash_encrypted_ll.h"
ESP_LOG_ATTR_TAG(TAG, "flash_encrypt");
@@ -45,6 +46,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
#if CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC
if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
}
#endif
#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
// This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
// otherwise the Flash Encryption key cannot be read protected