diff --git a/components/esp32/CMakeLists.txt b/components/esp32/CMakeLists.txt
index c66f3958c9..0f6a92246f 100644
--- a/components/esp32/CMakeLists.txt
+++ b/components/esp32/CMakeLists.txt
@@ -101,5 +101,19 @@ else()
         target_compile_options(${COMPONENT_LIB} PUBLIC -mfix-esp32-psram-cache-issue)
         # also, make sure we link with this option so correct toolchain libs are pulled in
         target_link_libraries(${COMPONENT_LIB} PUBLIC -mfix-esp32-psram-cache-issue)
+        # set strategy selected
+        # note that we don't need to set link options as the library linked is independent of this
+        if(CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_DUPLDST)
+            target_compile_options(${COMPONENT_LIB} PUBLIC -mfix-esp32-psram-cache-strategy=dupldst)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC -mfix-esp32-psram-cache-strategy=dupldst)
+        endif()
+        if(CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_MEMW)
+            target_compile_options(${COMPONENT_LIB} PUBLIC -mfix-esp32-psram-cache-strategy=memw)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC -mfix-esp32-psram-cache-strategy=memw)
+        endif()
+        if(CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_NOPS)
+            target_compile_options(${COMPONENT_LIB} PUBLIC -mfix-esp32-psram-cache-strategy=nops)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC -mfix-esp32-psram-cache-strategy=nops)
+        endif()
     endif()
 endif()
diff --git a/components/esp32/Kconfig b/components/esp32/Kconfig
index 072638015b..ab7a975044 100644
--- a/components/esp32/Kconfig
+++ b/components/esp32/Kconfig
@@ -129,6 +129,40 @@ menu "ESP32-specific"
 
                 The workaround is not required for ESP32 revision 3 and above.
 
+        menu "SPIRAM cache workaround debugging"
+
+            choice SPIRAM_CACHE_WORKAROUND_STRATEGY
+                prompt "Workaround strategy"
+                depends on SPIRAM_CACHE_WORKAROUND
+                default SPIRAM_CACHE_WORKAROUND_STRATEGY_MEMW
+                help
+                    Select the workaround strategy. Note that the strategy for precompiled
+                    libraries (libgcc, newlib, bt, wifi) is not affected by this selection.
+
+                    Unless you know you need a different strategy, it's suggested you stay
+                    with the default MEMW strategy. Note that DUPLDST can interfere with hardware
+                    encryption and this will be automatically disabled if this workaround is selected.
+                    'Insert nops' is the workaround that was used in older esp-idf versions. This workaround
+                    still can cause faulty data transfers from/to SPI RAM in some situation.
+
+                config SPIRAM_CACHE_WORKAROUND_STRATEGY_MEMW
+                    bool "Insert memw after vulnerable instructions (default)"
+
+                config SPIRAM_CACHE_WORKAROUND_STRATEGY_DUPLDST
+                    bool "Duplicate LD/ST for 32-bit, memw for 8/16 bit"
+
+                config SPIRAM_CACHE_WORKAROUND_STRATEGY_NOPS
+                    bool "Insert nops between vulnerable loads/stores (old strategy, obsolete)"
+            endchoice
+
+            #This needs to be Y only for the dupldst workaround
+            config SPIRAM_WORKAROUND_NEED_VOLATILE_SPINLOCK
+                bool
+                default "y" if SPIRAM_CACHE_WORKAROUND_STRATEGY_DUPLDST
+
+
+        endmenu
+
         config SPIRAM_BANKSWITCH_ENABLE
             bool "Enable bank switching for >4MiB external RAM"
             default y
diff --git a/components/esp32/Makefile.projbuild b/components/esp32/Makefile.projbuild
index d13dbe2d0b..476cead53e 100644
--- a/components/esp32/Makefile.projbuild
+++ b/components/esp32/Makefile.projbuild
@@ -1,9 +1,24 @@
 # Enable psram cache bug workaround in compiler if selected
+
 ifdef CONFIG_SPIRAM_CACHE_WORKAROUND
-CFLAGS+=-mfix-esp32-psram-cache-issue
-CXXFLAGS+=-mfix-esp32-psram-cache-issue
-LDFLAGS+=-mfix-esp32-psram-cache-issue
+SPIRAM_CACHE_WORKAROUND_FLAGS = -mfix-esp32-psram-cache-issue
+
+ifdef CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_DUPLDST
+SPIRAM_CACHE_WORKAROUND_FLAGS += -mfix-esp32-psram-cache-strategy=dupldst
 endif
+ifdef CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_MEMW
+SPIRAM_CACHE_WORKAROUND_FLAGS += -mfix-esp32-psram-cache-strategy=memw
+endif
+ifdef CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_NOPS
+SPIRAM_CACHE_WORKAROUND_FLAGS += -mfix-esp32-psram-cache-strategy=nops
+endif
+
+CFLAGS+=$(SPIRAM_CACHE_WORKAROUND_FLAGS)
+CXXFLAGS+=$(SPIRAM_CACHE_WORKAROUND_FLAGS)
+LDFLAGS+=$(SPIRAM_CACHE_WORKAROUND_FLAGS)
+endif
+
+
 
 # Enable dynamic esp_timer overflow value if building unit tests
 ifneq ("$(filter esp32,$(TEST_COMPONENTS_LIST))","")
diff --git a/components/esp32/project_include.cmake b/components/esp32/project_include.cmake
index aa0ac286fa..e53f240380 100644
--- a/components/esp32/project_include.cmake
+++ b/components/esp32/project_include.cmake
@@ -4,6 +4,16 @@ if(CONFIG_SPIRAM_CACHE_WORKAROUND)
     # non-IDF CMakeLists.txt file is imported into a component) don't depend
     # on the esp32 component so don't get the extra flag. This handles that case.
     idf_build_set_property(COMPILE_OPTIONS "-mfix-esp32-psram-cache-issue" APPEND)
+    # note that we don't need to set link options as the library linked is independent of this
+    if(CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_DUPLDST)
+        idf_build_set_property(COMPILE_OPTIONS "-mfix-esp32-psram-cache-strategy=dupldst" APPEND)
+    endif()
+    if(CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_MEMW)
+        idf_build_set_property(COMPILE_OPTIONS "-mfix-esp32-psram-cache-strategy=memw" APPEND)
+    endif()
+    if(CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_NOPS)
+        idf_build_set_property(COMPILE_OPTIONS "-mfix-esp32-psram-cache-strategy=nops" APPEND)
+    endif()
 endif()
 
 # Check toolchain is configured properly in cmake
diff --git a/components/freertos/include/freertos/portmacro.h b/components/freertos/include/freertos/portmacro.h
index 010f60f250..f0cf16e0fc 100644
--- a/components/freertos/include/freertos/portmacro.h
+++ b/components/freertos/include/freertos/portmacro.h
@@ -133,6 +133,12 @@ typedef unsigned portBASE_TYPE	UBaseType_t;
 #include "sdkconfig.h"
 #include "esp_attr.h"
 
+#ifdef CONFIG_SPIRAM_WORKAROUND_NEED_VOLATILE_SPINLOCK
+#define NEED_VOLATILE_MUX volatile
+#else
+#define NEED_VOLATILE_MUX
+#endif
+
 /* "mux" data structure (spinlock) */
 typedef struct {
 	/* owner field values:
@@ -146,12 +152,12 @@ typedef struct {
 	 *
 	 * Any value other than portMUX_FREE_VAL, CORE_ID_REGVAL_PRO, CORE_ID_REGVAL_APP indicates corruption
 	 */
-	uint32_t owner;
+	NEED_VOLATILE_MUX uint32_t owner;
 	/* count field:
 	 * If mux is unlocked, count should be zero.
 	 * If mux is locked, count is non-zero & represents the number of recursive locks on the mux.
 	 */
-	uint32_t count;
+	NEED_VOLATILE_MUX uint32_t count;
 #ifdef CONFIG_FREERTOS_PORTMUX_DEBUG
 	const char *lastLockedFn;
 	int lastLockedLine;
diff --git a/components/idf_test/include/idf_performance.h b/components/idf_test/include/idf_performance.h
index ac3d1e97f2..d6def65ac7 100644
--- a/components/idf_test/include/idf_performance.h
+++ b/components/idf_test/include/idf_performance.h
@@ -38,8 +38,8 @@
 #define IDF_PERFORMANCE_MAX_ISR_ENTER_CYCLES                                    290
 #define IDF_PERFORMANCE_MAX_ISR_EXIT_CYCLES                                     565
 
-#define IDF_PERFORMANCE_MIN_SDIO_THROUGHPUT_MBSEC_TOHOST_4BIT                   12500
-#define IDF_PERFORMANCE_MIN_SDIO_THROUGHPUT_MBSEC_FRHOST_4BIT                   12500
+#define IDF_PERFORMANCE_MIN_SDIO_THROUGHPUT_MBSEC_TOHOST_4BIT                   12200
+#define IDF_PERFORMANCE_MIN_SDIO_THROUGHPUT_MBSEC_FRHOST_4BIT                   12200
 #define IDF_PERFORMANCE_MIN_SDIO_THROUGHPUT_MBSEC_TOHOST_1BIT                   4000
 #define IDF_PERFORMANCE_MIN_SDIO_THROUGHPUT_MBSEC_FRHOST_1BIT                   4000
 #define IDF_PERFORMANCE_MIN_SDIO_THROUGHPUT_MBSEC_TOHOST_SPI                    1000
diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig
index 646b1d3b8b..220310b239 100644
--- a/components/mbedtls/Kconfig
+++ b/components/mbedtls/Kconfig
@@ -132,6 +132,7 @@ menu "mbedTLS"
     config MBEDTLS_HARDWARE_AES
         bool "Enable hardware AES acceleration"
         default y
+        depends on !SPIRAM_CACHE_WORKAROUND_STRATEGY_DUPLDST
         help
             Enable hardware accelerated AES encryption & decryption.
 
@@ -141,6 +142,7 @@ menu "mbedTLS"
     config MBEDTLS_HARDWARE_MPI
         bool "Enable hardware MPI (bignum) acceleration"
         default y
+        depends on !SPIRAM_CACHE_WORKAROUND_STRATEGY_DUPLDST
         help
             Enable hardware accelerated multiple precision integer operations.
 
@@ -152,6 +154,7 @@ menu "mbedTLS"
     config MBEDTLS_HARDWARE_SHA
         bool "Enable hardware SHA acceleration"
         default y
+        depends on !SPIRAM_CACHE_WORKAROUND_STRATEGY_DUPLDST
         help
             Enable hardware accelerated SHA1, SHA256, SHA384 & SHA512 in mbedTLS.
 
diff --git a/tools/ci/test_build_system_cmake.sh b/tools/ci/test_build_system_cmake.sh
index 5be358c1d9..13706da097 100755
--- a/tools/ci/test_build_system_cmake.sh
+++ b/tools/ci/test_build_system_cmake.sh
@@ -444,6 +444,21 @@ function run_tests()
     grep -q '"command"' build/compile_commands.json || failure "compile_commands.json missing or has no no 'commands' in it"
     (grep '"command"' build/compile_commands.json | grep -v mfix-esp32-psram-cache-issue) && failure "All commands in compile_commands.json should use PSRAM cache workaround"
     rm -r build
+    #Test for various strategies
+    for strat in MEMW NOPS DUPLDST; do
+        rm -r build sdkconfig.defaults sdkconfig sdkconfig.defaults.esp32
+        stratlc=`echo $strat | tr A-Z a-z`
+        mkdir build && touch build/sdkconfig
+        echo "CONFIG_ESP32_SPIRAM_SUPPORT=y" > sdkconfig.defaults
+        echo "CONFIG_SPIRAM_CACHE_WORKAROUND_STRATEGY_$strat=y"  >> sdkconfig.defaults
+        echo "CONFIG_SPIRAM_CACHE_WORKAROUND=y" >> sdkconfig.defaults
+        # note: we do 'reconfigure' here, as we just need to run cmake
+        idf.py reconfigure
+        grep -q '"command"' build/compile_commands.json || failure "compile_commands.json missing or has no no 'commands' in it"
+        (grep '"command"' build/compile_commands.json | grep -v mfix-esp32-psram-cache-strategy=$stratlc) && failure "All commands in compile_commands.json should use PSRAM cache workaround strategy $strat when selected"
+        echo ${PWD}
+        rm -r sdkconfig.defaults build
+    done
 
     print_status "Displays partition table when executing target partition_table"
     idf.py partition_table | grep -E "# Espressif .+ Partition Table"