Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(nvs_flash): Use h/w accelerated AES-ECB for XTS-AES operations

Browse Source
This commit is contained in:
harshal.patil
2026-02-11 15:40:10 +05:30
parent caefb5741b
commit 9253fbadbc
8 changed files with 59 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/nvs_flash/src/nvs_bootloader_xts_aes.c
+8 -9
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -257,21 +257,20 @@ int nvs_bootloader_aes_crypt_xts(nvs_bootloader_xts_aes_context *ctx,
#endif /* CONFIG_ESP_ROM_HAS_MBEDTLS_CRYPTO_LIB */
#else /* BOOTLOADER_BUILD && !CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL_BOOTLOADER */
#define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
#include "mbedtls/private/aes.h"
#include "nvs_xts_aes.h"
static mbedtls_aes_xts_context ctx_xts;
static XTS_CONTEXT ctx_xts;
void nvs_bootloader_xts_aes_init(nvs_bootloader_xts_aes_context *ctx)
{
(void) ctx;
mbedtls_aes_xts_init(&ctx_xts);
XTS_FUNC(xts_init)(&ctx_xts);
}
void nvs_bootloader_xts_aes_free(nvs_bootloader_xts_aes_context *ctx)
{
(void) ctx;
mbedtls_aes_xts_free(&ctx_xts);
XTS_FUNC(xts_free)(&ctx_xts);
}
int nvs_bootloader_xts_aes_setkey(nvs_bootloader_xts_aes_context *ctx,
@@ -279,7 +278,7 @@ int nvs_bootloader_xts_aes_setkey(nvs_bootloader_xts_aes_context *ctx,
unsigned int key_bytes)
{
(void) ctx;
return mbedtls_aes_xts_setkey_dec(&ctx_xts, key, key_bytes * 8);
return XTS_FUNC(xts_setkey_dec)(&ctx_xts, key, key_bytes * 8);
}
/*
* XTS-AES buffer encryption/decryption
@@ -292,8 +291,8 @@ int nvs_bootloader_aes_crypt_xts(nvs_bootloader_xts_aes_context *ctx,
unsigned char *output)
{
(void) ctx;
int mbedtls_aes_mode = mode == AES_ENC ? MBEDTLS_AES_ENCRYPT : MBEDTLS_AES_DECRYPT;
return mbedtls_aes_crypt_xts(&ctx_xts, mbedtls_aes_mode, length, data_unit, input, output);
int xts_mode = mode == AES_ENC ? XTS_MODE(ENCRYPT) : XTS_MODE(DECRYPT);
return XTS_FUNC(crypt_xts)(&ctx_xts, xts_mode, length, data_unit, input, output);
}
#endif /* !(BOOTLOADER_BUILD && !CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL_BOOTLOADER) */
#endif /* !SOC_AES_SUPPORTED */
components/nvs_flash/src/nvs_encrypted_partition.cpp
+9 -8
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2019-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -7,6 +7,7 @@
#include "nvs_encrypted_partition.hpp"
#include "nvs_types.hpp"
#include "nvs_constants.h"
#include "nvs_xts_aes.h"
namespace nvs {
@@ -22,14 +23,14 @@ esp_err_t NVSEncryptedPartition::init(nvs_sec_cfg_t* cfg)
{
uint8_t* eky = reinterpret_cast<uint8_t*>(cfg);
mbedtls_aes_xts_init(&mEctxt);
mbedtls_aes_xts_init(&mDctxt);
XTS_FUNC(xts_init)(&mEctxt);
XTS_FUNC(xts_init)(&mDctxt);
if (mbedtls_aes_xts_setkey_enc(&mEctxt, eky, 2 * NVS_KEY_SIZE * 8) != 0) {
if (XTS_FUNC(xts_setkey_enc)(&mEctxt, eky, 2 * NVS_KEY_SIZE * 8) != 0) {
return ESP_ERR_NVS_XTS_CFG_FAILED;
}
if (mbedtls_aes_xts_setkey_dec(&mDctxt, eky, 2 * NVS_KEY_SIZE * 8) != 0) {
if (XTS_FUNC(xts_setkey_dec)(&mDctxt, eky, 2 * NVS_KEY_SIZE * 8) != 0) {
return ESP_ERR_NVS_XTS_CFG_FAILED;
}
@@ -61,7 +62,7 @@ esp_err_t NVSEncryptedPartition::read(size_t src_offset, void* dst, size_t size)
uint8_t *destination = reinterpret_cast<uint8_t*>(dst);
if (mbedtls_aes_crypt_xts(&mDctxt, MBEDTLS_AES_DECRYPT, size, data_unit, destination, destination) != 0) {
if (XTS_FUNC(crypt_xts)(&mDctxt, XTS_MODE(DECRYPT), size, data_unit, destination, destination) != 0) {
return ESP_ERR_NVS_XTS_DECR_FAILED;
}
@@ -97,8 +98,8 @@ esp_err_t NVSEncryptedPartition::write(size_t addr, const void* src, size_t size
uint32_t *addr_loc = (uint32_t*) &data_unit[0];
*addr_loc = relAddr + offset;
if (mbedtls_aes_crypt_xts(&mEctxt,
MBEDTLS_AES_ENCRYPT,
if (XTS_FUNC(crypt_xts)(&mEctxt,
XTS_MODE(ENCRYPT),
entrySize,
data_unit,
buf + offset,
components/nvs_flash/src/nvs_encrypted_partition.hpp
+4 -10
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2019-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -7,15 +7,9 @@
#include "sdkconfig.h" // For CONFIG_NVS_BDL_STACK
/* NOTE: Using legacy mbedtls XTS API until PSA Crypto adds XTS support
* With TF-PSA-Crypto 1.0, AES headers moved to mbedtls/private/.
* Need MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS to access XTS functions.
*/
#define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
#include "mbedtls/private/aes.h"
#include "nvs_flash.h"
#include "nvs_partition.hpp"
#include "nvs_xts_aes.h"
namespace nvs {
/**
@@ -73,8 +67,8 @@ public:
esp_err_t write(size_t dst_offset, const void* src, size_t size) override;
protected:
mbedtls_aes_xts_context mEctxt; // AES context for encryption
mbedtls_aes_xts_context mDctxt; // AES context for decryption
XTS_CONTEXT mEctxt; // AES context for encryption
XTS_CONTEXT mDctxt; // AES context for decryption
};
} // nvs