Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat: enable flash encryption for ESP32-H4

Browse Source
This commit is contained in:
nilesh.kale
2026-05-20 09:29:20 +05:30
parent dca2e6c10a
commit cae147af08
10 changed files with 375 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader_support/src/esp32h4/flash_encryption_secure_features.c
+37 -4
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -12,12 +12,45 @@
#include "esp_log.h"
#include "sdkconfig.h"
//TODO: [ESP32H4] IDF-12261
ESP_LOG_ATTR_TAG(TAG, "flash_encrypt");
esp_err_t esp_flash_encryption_enable_secure_features(void)
{
abort();
#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
ESP_LOGI(TAG, "Disable UART bootloader encryption...");
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
#else
ESP_LOGW(TAG, "Not disabling UART bootloader encryption");
#endif
#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
ESP_LOGI(TAG, "Disable UART bootloader cache...");
esp_efuse_write_field_bit(ESP_EFUSE_SPI_DOWNLOAD_MSPI_DIS);
#else
ESP_LOGW(TAG, "Not disabling UART bootloader cache - SECURITY COMPROMISED");
#endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
ESP_LOGI(TAG, "Disable JTAG...");
esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
#else
ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
#endif
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
#if defined(CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC) && CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC
ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
#endif
#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
// This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
// otherwise the Flash Encryption key cannot be read protected
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
#endif
return ESP_OK;
}
components/esp_driver_parlio/test_apps/parlio/pytest_parlio_unity.py
+1
View File
@@ -31,6 +31,7 @@ def test_parlio(dut: Dut) -> None:
],
indirect=True,
)
@pytest.mark.temp_skip_ci(targets=['esp32h4'], reason='cannot pass') # TODO: IDF-15613
@idf_parametrize(
'target', soc_filtered_targets('SOC_PARLIO_SUPPORTED == 1 and SOC_FLASH_ENC_SUPPORTED == 1'), indirect=['target']
)
components/esp_hal_mspi/esp32h4/include/hal/spi_flash_encrypted_ll.h
+36 -3
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -17,11 +17,11 @@
#include <string.h>
#include "soc/hp_system_reg.h"
#include "soc/xts_aes_reg.h"
#include "soc/spi_mem_reg.h"
#include "soc/soc.h"
#include "soc/soc_caps.h"
#include "hal/assert.h"
//TODO: [ESP32H4] IDF-12261 inherited from verification branch, need check
#include "hal/spi_flash_encrypt_types.h"
#ifdef __cplusplus
extern "C" {
@@ -148,6 +148,39 @@ static inline bool spi_flash_encrypt_ll_check(uint32_t address, uint32_t length)
return ((address % length) == 0) ? true : false;
}
#if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
/**
* @brief Enable the pseudo-round function during XTS-AES operations
*
* @param mode set the mode for pseudo rounds, zero to disable, with increasing security upto three.
* @param base basic number of pseudo rounds, zero if disable
* @param increment increment number of pseudo rounds, zero if disable
* @param key_rng_cnt update frequency of the pseudo-key, zero if disable
*/
static inline void spi_flash_encrypt_ll_enable_pseudo_rounds(esp_xts_aes_psuedo_rounds_state_t mode, uint8_t base, uint8_t increment, uint8_t key_rng_cnt)
{
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_MODE_PSEUDO, mode);
if (mode != ESP_XTS_AES_PSEUDO_ROUNDS_DISABLE) {
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_BASE, base);
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_INC, increment);
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_RNG_CNT, key_rng_cnt);
} else {
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_BASE, 0);
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_INC, 0);
REG_SET_FIELD(SPI_MEM_XTS_PSEUDO_ROUND_CONF_REG(0), SPI_MEM_PSEUDO_RNG_CNT, 0);
}
}
/**
* @brief Check if the pseudo round function is supported
*/
static inline bool spi_flash_encrypt_ll_is_pseudo_rounds_function_supported(void)
{
return true;
}
#endif
#ifdef __cplusplus
}
#endif
components/soc/esp32h4/include/soc/Kconfig.soc_caps.in
+9 -1
View File
@@ -149,7 +149,7 @@ config SOC_ECC_EXTENDED_MODES_SUPPORTED
config SOC_FLASH_ENC_SUPPORTED
bool
default n
default y
config SOC_SECURE_BOOT_SUPPORTED
bool
@@ -1007,6 +1007,10 @@ config SOC_FLASH_ENCRYPTION_XTS_AES
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_128
bool
default y
@@ -1015,6 +1019,10 @@ config SOC_FLASH_ENCRYPTION_XTS_AES_256
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
bool
default y
config SOC_APM_CTRL_FILTER_SUPPORTED
bool
default y
components/soc/esp32h4/include/soc/soc_caps.h
+6 -5
View File
@@ -71,9 +71,8 @@
#define SOC_HMAC_SUPPORTED 1
#define SOC_ECC_SUPPORTED 1
#define SOC_ECC_EXTENDED_MODES_SUPPORTED 1
#define SOC_FLASH_ENC_SUPPORTED 0 // TODO: [ESP32H4] IDF-12261
#define SOC_FLASH_ENC_SUPPORTED 1
#define SOC_SECURE_BOOT_SUPPORTED 1
#define SOC_BOD_SUPPORTED 1
// #define SOC_APM_SUPPORTED 1 // TODO: [ESP32H4] IDF-12256
#define SOC_PMU_SUPPORTED 1 // TODO: [ESP32H4] IDF-12286
@@ -435,9 +434,11 @@
/*-------------------------- Flash Encryption CAPS----------------------------*/
#define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64)
#define SOC_FLASH_ENCRYPTION_XTS_AES 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1
#define SOC_FLASH_ENCRYPTION_XTS_AES 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND 1
/*-------------------------- APM CAPS ----------------------------------------*/
#define SOC_APM_CTRL_FILTER_SUPPORTED 1 /*!< Support for APM control filter */
components/soc/esp32h4/include/soc/xts_aes_reg.h
-2
View File
@@ -10,8 +10,6 @@
extern "C" {
#endif
//TODO: [ESP32H4] IDF-12506 inherit from verify code, need check
#define XTS_AES_PLAIN_MEM(i) (REG_SPI_MEM_BASE(i) + 0x300)
/* XTS_AES_PLAIN : R/W ;bitpos:[31:0] ;default: 32'h0 ; */
/*description: This field is only used to generate include file in c case. This field is useles
components/spi_flash/test_apps/.build-test-rules.yml
+2 -2
View File
@@ -45,9 +45,9 @@ components/spi_flash/test_apps/esp_flash_stress:
components/spi_flash/test_apps/flash_encryption:
disable:
- if: IDF_TARGET in ["esp32h4", "esp32s31"]
- if: IDF_TARGET in ["esp32s31"]
temporary: true
reason: not support yet # TODO: [ESP32H4] IDF-12261 [ESP32S31] IDF-14628
reason: not support yet # TODO: [ESP32S21] IDF-14628
disable_test:
- if: IDF_TARGET in ["esp32c2", "esp32s2", "esp32c6", "esp32h2", "esp32p4", "esp32c5", "esp32c61", "esp32h21", "esp32h4"]
temporary: true
components/spi_flash/test_apps/flash_encryption/README.md
+2 -2
View File
@@ -1,5 +1,5 @@
| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-H21 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | --------- | -------- | -------- | -------- |
| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-H21 | ESP32-H4 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | --------- | -------- | -------- | -------- | -------- |
## Prepare runner