From 3c5d2e6b5843da853fb81067eb2bd287f7fbd735 Mon Sep 17 00:00:00 2001
From: Mahavir Jain <mahavir@espressif.com>
Date: Wed, 12 Nov 2025 17:50:18 +0530
Subject: [PATCH] fix(esp_system): limit CPU clock to 160MHz in ESP32-C5 for
 flash encryption

Encrypted flash write operation sometimes result in random corruption in
certain bytes. Root cause points to sudden current surge due to involvement of
encryption block overwhelming LDO supply. More details will be provided
in the ESP32-C5 SoC Errata document.

This fix limits the CPU clock to 160MHz for flash encryption enabled
case. Failing encrypted flash write tests could successfully pass in
this configuration. Going ahead, a dynamic clock adjustment in flash
driver will be considered to mitigate this issue.
---
 components/esp_security/src/init.c                 | 10 ++++++++++
 components/esp_system/port/soc/esp32c5/Kconfig.cpu |  8 +++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/components/esp_security/src/init.c b/components/esp_security/src/init.c
index 9189f90bf3..d73fda5c88 100644
--- a/components/esp_security/src/init.c
+++ b/components/esp_security/src/init.c
@@ -55,6 +55,16 @@ static void esp_key_mgr_init(void)
 
 ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
 {
+#if CONFIG_IDF_TARGET_ESP32C5
+    // Check for unsupported configuration: flash encryption with CPU frequency > 160MHz
+    // Manual encrypted flash writes are not stable at higher CPU clock.
+    // Please refer to the ESP32-C5 SoC Errata document for more details.
+    if (efuse_hal_flash_encryption_enabled() && CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ > 160) {
+        ESP_EARLY_LOGE(TAG, "Flash encryption with CPU frequency > 160MHz is not supported. Please reconfigure the CPU frequency.");
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+#endif
+
     esp_crypto_clk_init();
 
 #if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
diff --git a/components/esp_system/port/soc/esp32c5/Kconfig.cpu b/components/esp_system/port/soc/esp32c5/Kconfig.cpu
index 0ce4f03b2b..cf42222229 100644
--- a/components/esp_system/port/soc/esp32c5/Kconfig.cpu
+++ b/components/esp_system/port/soc/esp32c5/Kconfig.cpu
@@ -1,9 +1,12 @@
 choice ESP_DEFAULT_CPU_FREQ_MHZ
     prompt "CPU frequency"
     default ESP_DEFAULT_CPU_FREQ_MHZ_40 if IDF_ENV_FPGA
+    default ESP_DEFAULT_CPU_FREQ_MHZ_160 if SECURE_FLASH_ENC_ENABLED
     default ESP_DEFAULT_CPU_FREQ_MHZ_240
     help
-        CPU frequency to be set on application startup.
+        CPU frequency to be set on application startup. For flash encryption enabled case,
+        the default CPU frequency is 160MHz as the encrypted flash writes are not stable at
+        higher CPU clock. Please see SoC Errata document for details.
 
     config ESP_DEFAULT_CPU_FREQ_MHZ_40
         bool "40 MHz"
@@ -13,6 +16,9 @@ choice ESP_DEFAULT_CPU_FREQ_MHZ
     config ESP_DEFAULT_CPU_FREQ_MHZ_160
         bool "160 MHz"
     config ESP_DEFAULT_CPU_FREQ_MHZ_240
+        # Encrypted flash writes aren't supported at 240 MHz.
+        # Please see SoC Errata document for details.
+        depends on !SECURE_FLASH_ENC_ENABLED
         bool "240 MHz"
 endchoice