From 0b3e8bda5b71bc2eb6f12663084a8e99286393ef Mon Sep 17 00:00:00 2001
From: Chen Chen <chenchen@espressif.com>
Date: Mon, 20 Jul 2026 14:39:36 +0800
Subject: [PATCH] test(i2s): run flash encryption tests on real hardware

Use dedicated encrypted runners so I2S tests cover the actual flash encryption data path.
This replaces coverage that only observed the virtual eFuse software state.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../test_apps/.build-test-rules.yml           |  1 +
 .../test_apps/i2s/pytest_i2s.py               | 35 +++++++++++++++++++
 .../test_apps/i2s/sdkconfig.ci.flash_enc      |  9 +++++
 3 files changed, 45 insertions(+)
 create mode 100644 components/esp_driver_i2s/test_apps/i2s/sdkconfig.ci.flash_enc

diff --git a/components/esp_driver_i2s/test_apps/.build-test-rules.yml b/components/esp_driver_i2s/test_apps/.build-test-rules.yml
index 09769644f68..a8f395c9c0f 100644
--- a/components/esp_driver_i2s/test_apps/.build-test-rules.yml
+++ b/components/esp_driver_i2s/test_apps/.build-test-rules.yml
@@ -3,6 +3,7 @@
 components/esp_driver_i2s/test_apps/i2s:
   disable:
     - if: SOC_I2S_SUPPORTED != 1
+    - if: CONFIG_NAME == "flash_enc" and SOC_FLASH_ENC_SUPPORTED != 1
   depends_components:
     - esp_driver_i2s
     - esp_driver_pcnt
diff --git a/components/esp_driver_i2s/test_apps/i2s/pytest_i2s.py b/components/esp_driver_i2s/test_apps/i2s/pytest_i2s.py
index 6a973559cd5..19f2cb6c950 100644
--- a/components/esp_driver_i2s/test_apps/i2s/pytest_i2s.py
+++ b/components/esp_driver_i2s/test_apps/i2s/pytest_i2s.py
@@ -76,3 +76,38 @@ def test_i2s_esp32c5_rev1(dut: Dut) -> None:
 )
 def test_i2s_psram(dut: Dut) -> None:
     dut.run_all_single_board_cases()
+
+
+@pytest.mark.flash_encryption_f4r8
+@pytest.mark.parametrize(
+    'config',
+    [
+        'flash_enc',
+    ],
+    indirect=True,
+)
+@idf_parametrize('target', ['esp32s3'], indirect=['target'])
+def test_i2s_with_flash_encryption_esp32s3_f4r8(dut: Dut) -> None:
+    dut.run_all_single_board_cases()
+
+
+@pytest.mark.flash_encryption
+@pytest.mark.parametrize(
+    'config',
+    [
+        'flash_enc',
+    ],
+    indirect=True,
+)
+@idf_parametrize(
+    'target',
+    soc_filtered_targets(
+        'SOC_I2S_SUPPORTED == 1 and '
+        'SOC_PSRAM_DMA_CAPABLE == 1 and '
+        'SOC_FLASH_ENC_SUPPORTED == 1 and '
+        'IDF_TARGET not in ["esp32s3"]'
+    ),
+    indirect=['target'],
+)
+def test_i2s_with_flash_encryption(dut: Dut) -> None:
+    dut.run_all_single_board_cases()
diff --git a/components/esp_driver_i2s/test_apps/i2s/sdkconfig.ci.flash_enc b/components/esp_driver_i2s/test_apps/i2s/sdkconfig.ci.flash_enc
new file mode 100644
index 00000000000..5be9651c381
--- /dev/null
+++ b/components/esp_driver_i2s/test_apps/i2s/sdkconfig.ci.flash_enc
@@ -0,0 +1,9 @@
+CONFIG_PARTITION_TABLE_OFFSET=0x9000
+CONFIG_SECURE_FLASH_ENC_ENABLED=y
+CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT=y
+CONFIG_SECURE_BOOT_ALLOW_ROM_BASIC=y
+CONFIG_SECURE_BOOT_ALLOW_JTAG=y
+CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
+CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC=y
+CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=y
+CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y