diff --git a/components/bootloader_support/src/esp32s31/flash_encryption_secure_features.c b/components/bootloader_support/src/esp32s31/flash_encryption_secure_features.c index 9e43e3e236c..33b0b524cee 100644 --- a/components/bootloader_support/src/esp32s31/flash_encryption_secure_features.c +++ b/components/bootloader_support/src/esp32s31/flash_encryption_secure_features.c @@ -5,65 +5,66 @@ */ #include +#include "esp_flash_encrypt.h" #include "esp_secure_boot.h" #include "esp_efuse.h" #include "esp_efuse_table.h" #include "esp_log.h" #include "sdkconfig.h" +#include "esp_crypto_periph_clk.h" +#include "esp_key_mgr.h" +#include "hal/key_mgr_hal.h" +#include "hal/key_mgr_ll.h" ESP_LOG_ATTR_TAG(TAG, "flash_encrypt"); esp_err_t esp_flash_encryption_enable_secure_features(void) { - esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT); - -#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE - ESP_LOGI(TAG, "Enabling Security download mode..."); - esp_err_t err = esp_efuse_enable_rom_secure_download_mode(); - if (err != ESP_OK) { - ESP_LOGE(TAG, "Could not enable Security download mode..."); - return err; - } -#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE - ESP_LOGI(TAG, "Disable ROM Download mode..."); - esp_err_t err = esp_efuse_disable_rom_download_mode(); - if (err != ESP_OK) { - ESP_LOGE(TAG, "Could not disable ROM Download mode..."); - return err; - } +#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC + ESP_LOGI(TAG, "Disable UART bootloader encryption..."); + esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT); #else - ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED"); + ESP_LOGW(TAG, "Not disabling UART bootloader encryption"); +#endif + +#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE + ESP_LOGI(TAG, "Disable UART bootloader cache..."); + esp_efuse_write_field_bit(ESP_EFUSE_SPI_DOWNLOAD_MSPI_DIS); +#else + ESP_LOGW(TAG, "Not disabling UART bootloader cache - SECURITY COMPROMISED"); #endif #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG - ESP_LOGI(TAG, "Disable hardware & software JTAG..."); + ESP_LOGI(TAG, "Disable JTAG..."); esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG); esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG); - esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count); #else ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED"); #endif -#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE - esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE); + esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT); + +#if CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC + ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function..."); + uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH; + esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count); #endif - esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN); - -#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS - bool rd_dis_now = true; -#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED - /* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot - when Flash Encryption is being enabled */ - rd_dis_now = esp_efuse_is_flash_encryption_enabled(); -#endif - if (rd_dis_now) { - ESP_LOGI(TAG, "Prevent read disabling of additional efuses..."); - esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS); - } -#else - ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED"); +#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS) + // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot + // otherwise the Flash Encryption key cannot be read protected + esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS); #endif return ESP_OK; } + +esp_err_t esp_flash_encryption_use_efuse_key(void) +{ + esp_crypto_key_mgr_enable_periph_clk(true); + + // Force Key Manager to use eFuse key for XTS-AES operation + key_mgr_hal_set_key_usage(ESP_KEY_MGR_FLASH_XTS_AES_KEY, ESP_KEY_MGR_USE_EFUSE_KEY); + + return ESP_OK; +} diff --git a/components/bootloader_support/src/esp32s31/secure_boot_secure_features.c b/components/bootloader_support/src/esp32s31/secure_boot_secure_features.c new file mode 100644 index 00000000000..d688aaabfd1 --- /dev/null +++ b/components/bootloader_support/src/esp32s31/secure_boot_secure_features.c @@ -0,0 +1,73 @@ +/* + * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD + * + * SPDX-License-Identifier: Apache-2.0 + */ + +#include +#include "esp_secure_boot.h" +#include "esp_efuse.h" +#include "esp_efuse_table.h" +#include "esp_log.h" +#include "sdkconfig.h" + +ESP_LOG_ATTR_TAG(TAG, "secure_boot"); + +esp_err_t esp_secure_boot_enable_secure_features(void) +{ + esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT); + +#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE + ESP_LOGI(TAG, "Enabling Security download mode..."); + esp_err_t err = esp_efuse_enable_rom_secure_download_mode(); + if (err != ESP_OK) { + ESP_LOGE(TAG, "Could not enable Security download mode..."); + return err; + } +#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE + ESP_LOGI(TAG, "Disable ROM Download mode..."); + esp_err_t err = esp_efuse_disable_rom_download_mode(); + if (err != ESP_OK) { + ESP_LOGE(TAG, "Could not disable ROM Download mode..."); + return err; + } +#else + ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED"); +#endif + +#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG + ESP_LOGI(TAG, "Disable hardware & software JTAG..."); + esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG); + esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG); + esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count); +#else + ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED"); +#endif + +#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE + esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE); +#endif + +#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS + esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_SHA384_EN); +#endif + + esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN); + +#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS + bool rd_dis_now = true; +#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED + /* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot + when Flash Encryption is being enabled */ + rd_dis_now = esp_efuse_is_flash_encryption_enabled(); +#endif + if (rd_dis_now) { + ESP_LOGI(TAG, "Prevent read disabling of additional efuses..."); + esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS); + } +#else + ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED"); +#endif + + return ESP_OK; +} diff --git a/components/esp_hal_mspi/esp32s31/include/hal/spi_flash_encrypted_ll.h b/components/esp_hal_mspi/esp32s31/include/hal/spi_flash_encrypted_ll.h index 4fc34dfc77a..1db22a17b1c 100644 --- a/components/esp_hal_mspi/esp32s31/include/hal/spi_flash_encrypted_ll.h +++ b/components/esp_hal_mspi/esp32s31/include/hal/spi_flash_encrypted_ll.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -15,11 +15,12 @@ #include #include -#include "soc/system_reg.h" -#include "soc/hwcrypto_reg.h" +#include "soc/hp_system_reg.h" +#include "soc/spi_mem_c_reg.h" #include "soc/soc.h" #include "soc/soc_caps.h" #include "hal/assert.h" +#include "hal/spi_flash_encrypt_types.h" #ifdef __cplusplus extern "C" { @@ -36,7 +37,9 @@ typedef enum { */ static inline void spi_flash_encrypt_ll_enable(void) { - // TODO: ["ESP32S31"] IDF-14628 + REG_SET_BIT(HP_SYSTEM_CRYPTO_CTRL_REG, + HP_SYSTEM_REG_ENABLE_DOWNLOAD_MANUAL_ENCRYPT | + HP_SYSTEM_REG_ENABLE_SPI_MANUAL_ENCRYPT); } /* @@ -44,7 +47,8 @@ static inline void spi_flash_encrypt_ll_enable(void) */ static inline void spi_flash_encrypt_ll_disable(void) { - // TODO: ["ESP32S31"] IDF-14628 + REG_CLR_BIT(HP_SYSTEM_CRYPTO_CTRL_REG, + HP_SYSTEM_REG_ENABLE_SPI_MANUAL_ENCRYPT); } /** @@ -56,7 +60,9 @@ static inline void spi_flash_encrypt_ll_disable(void) */ static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type) { - // TODO: ["ESP32S31"] IDF-14628 + // Our hardware only support flash encryption + HAL_ASSERT(type == FLASH_ENCRYPTION_MANU); + REG_SET_FIELD(SPI_MEM_C_XTS_DESTINATION_REG, SPI_XTS_DESTINATION, type); } /** @@ -66,7 +72,8 @@ static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type) */ static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size) { - // TODO: ["ESP32S31"] IDF-14628 + // Desired block should not be larger than the block size. + REG_SET_FIELD(SPI_MEM_C_XTS_LINESIZE_REG, SPI_XTS_LINESIZE, size >> 5); } /** @@ -79,7 +86,9 @@ static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size) */ static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const uint32_t* buffer, uint32_t size) { - // TODO: ["ESP32S31"] IDF-14628 + uint32_t plaintext_offs = (address % SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX); + HAL_ASSERT(plaintext_offs + size <= SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX); + memcpy((void *)(SPI_MEM_C_XTS_PLAIN_BASE_REG + plaintext_offs), buffer, size); } /** @@ -89,7 +98,7 @@ static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const u */ static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr) { - // TODO: ["ESP32S31"] IDF-14628 + REG_SET_FIELD(SPI_MEM_C_XTS_PHYSICAL_ADDRESS_REG, SPI_XTS_PHYSICAL_ADDRESS, flash_addr); } /** @@ -97,7 +106,7 @@ static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr) */ static inline void spi_flash_encrypt_ll_calculate_start(void) { - // TODO: ["ESP32S31"] IDF-14628 + REG_SET_FIELD(SPI_MEM_C_XTS_TRIGGER_REG, SPI_XTS_TRIGGER, 1); } /** @@ -105,7 +114,8 @@ static inline void spi_flash_encrypt_ll_calculate_start(void) */ static inline void spi_flash_encrypt_ll_calculate_wait_idle(void) { - // TODO: ["ESP32S31"] IDF-14628 + while (REG_GET_FIELD(SPI_MEM_C_XTS_STATE_REG, SPI_XTS_STATE) == 0x1) { + } } /** @@ -113,7 +123,9 @@ static inline void spi_flash_encrypt_ll_calculate_wait_idle(void) */ static inline void spi_flash_encrypt_ll_done(void) { - // TODO: ["ESP32S31"] IDF-14628 + REG_SET_BIT(SPI_MEM_C_XTS_RELEASE_REG, SPI_XTS_RELEASE); + while (REG_GET_FIELD(SPI_MEM_C_XTS_STATE_REG, SPI_XTS_STATE) != 0x3) { + } } /** @@ -121,7 +133,7 @@ static inline void spi_flash_encrypt_ll_done(void) */ static inline void spi_flash_encrypt_ll_destroy(void) { - // TODO: ["ESP32S31"] IDF-14628 + REG_SET_BIT(SPI_MEM_C_XTS_DESTROY_REG, SPI_XTS_DESTROY); } /** @@ -132,7 +144,38 @@ static inline void spi_flash_encrypt_ll_destroy(void) */ static inline bool spi_flash_encrypt_ll_check(uint32_t address, uint32_t length) { - return 0;//((address % length) == 0) ? true : false; + return ((address % length) == 0) ? true : false; +} + +/** + * @brief Enable the pseudo-round function during XTS-AES operations + * + * @param mode set the mode for pseudo rounds, zero to disable, with increasing security upto three. + * @param base basic number of pseudo rounds, zero if disable + * @param increment increment number of pseudo rounds, zero if disable + * @param key_rng_cnt update frequency of the pseudo-key, zero if disable + */ +static inline void spi_flash_encrypt_ll_enable_pseudo_rounds(esp_xts_aes_psuedo_rounds_state_t mode, uint8_t base, uint8_t increment, uint8_t key_rng_cnt) +{ + REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_MODE_PSEUDO, mode); + + if (mode != ESP_XTS_AES_PSEUDO_ROUNDS_DISABLE) { + REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_BASE, base); + REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_INC, increment); + REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_RNG_CNT, key_rng_cnt); + } else { + REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_BASE, 0); + REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_INC, 0); + REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_RNG_CNT, 0); + } +} + +/** + * @brief Check if the pseudo round function is supported + */ +static inline bool spi_flash_encrypt_ll_is_pseudo_rounds_function_supported(void) +{ + return true; } #ifdef __cplusplus diff --git a/components/esp_rom/esp32s31/include/esp32s31/rom/ecdsa.h b/components/esp_rom/esp32s31/include/esp32s31/rom/ecdsa.h index 86aa6709e0d..152cf837024 100644 --- a/components/esp_rom/esp32s31/include/esp32s31/rom/ecdsa.h +++ b/components/esp_rom/esp32s31/include/esp32s31/rom/ecdsa.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -13,10 +13,13 @@ extern "C" { #endif #define ETS_DIGEST_LEN 32 /* SHA-256, bytes */ +#define ETS_DIGEST_SHA256_LEN 32 /* SHA-256, bytes */ +#define ETS_DIGEST_SHA384_LEN 48 /* SHA-384, bytes */ typedef enum { ECDSA_CURVE_P192 = 1, - ECDSA_CURVE_P256 = 2 + ECDSA_CURVE_P256 = 2, + ECDSA_CURVE_P384 = 3 } ECDSA_CURVE; int ets_ecdsa_verify(const uint8_t *key, const uint8_t *sig, ECDSA_CURVE curve_id, const uint8_t *digest, uint8_t *verified_digest); diff --git a/components/esp_rom/esp32s31/include/esp32s31/rom/secure_boot.h b/components/esp_rom/esp32s31/include/esp32s31/rom/secure_boot.h index e626f73f8c0..a7a0c72b09b 100644 --- a/components/esp_rom/esp32s31/include/esp32s31/rom/secure_boot.h +++ b/components/esp_rom/esp32s31/include/esp32s31/rom/secure_boot.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -88,6 +88,25 @@ struct ets_secure_boot_sig_block { #elif CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME +#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS +struct __attribute((packed)) ets_secure_boot_sig_block { + uint8_t magic_byte; + uint8_t version; + uint8_t sha_version; + uint8_t _reserved2; + uint8_t image_digest[48]; + struct { + struct { + uint8_t curve_id; + uint8_t point[96]; /* X followed by Y (both little-endian) */ + } key; + uint8_t signature[96]; /* r followed by s (both little-endian) */ + uint8_t padding[951]; + } ecdsa; + uint32_t block_crc; + uint8_t _padding[16]; +}; +#else struct __attribute((packed)) ets_secure_boot_sig_block { uint8_t magic_byte; uint8_t version; @@ -106,6 +125,7 @@ struct __attribute((packed)) ets_secure_boot_sig_block { uint8_t _padding[16]; }; #endif +#endif ESP_STATIC_ASSERT(sizeof(ets_secure_boot_sig_block_t) == 1216, "invalid sig block size"); diff --git a/components/esp_security/src/init.c b/components/esp_security/src/init.c index 5ba36cb47e2..11d262e98ec 100644 --- a/components/esp_security/src/init.c +++ b/components/esp_security/src/init.c @@ -115,14 +115,14 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103) #endif #if !CONFIG_SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA -// C5 -#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS && !CONFIG_IDF_TARGET_ESP32P4 +#if SOC_EFUSE_SECURE_BOOT_P384_WR_DIS && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS // Since SECURE_BOOT_SHA384_EN, XTS_DPA_PSEUDO_LEVEL, and ECC_FORCE_CONST_TIME share the // same write-protection bit, these efuses should only be write-protected after all of // them have been programmed. - // Note: ESP32-P4 lacks WR_DIS_SECURE_BOOT_SHA384_EN bit, so it relies on software protection - // in the efuse write APIs (see esp_efuse_api.c) to prevent unauthorized programming of - // SECURE_BOOT_SHA384_EN when Secure Boot using SHA-256 is enabled. + // Note: targets without SOC_EFUSE_SECURE_BOOT_P384_WR_DIS (e.g. ESP32-P4, ESP32-S31) lack + // the WR_DIS_SECURE_BOOT_SHA384_EN bit and rely on software protection in the efuse write + // APIs (see esp_efuse_api.c) to prevent unauthorized programming of SECURE_BOOT_SHA384_EN + // when Secure Boot using SHA-256 is enabled. err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN); if (err != ESP_OK) { ESP_LOGE(TAG, "Failed to write protect the SECURE_BOOT_SHA384_EN efuse bit."); diff --git a/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in b/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in index a8bf900c0ff..d586f69afcd 100644 --- a/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in +++ b/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in @@ -199,6 +199,14 @@ config SOC_ECDSA_SUPPORTED bool default y +config SOC_FLASH_ENC_SUPPORTED + bool + default y + +config SOC_SECURE_BOOT_SUPPORTED + bool + default y + config SOC_BOD_SUPPORTED bool default y @@ -1139,6 +1147,14 @@ config SOC_EFUSE_ECDSA_KEY_P384 bool default y +config SOC_EFUSE_XTS_AES_KEY_128 + bool + default y + +config SOC_EFUSE_XTS_AES_KEY_256 + bool + default y + config SOC_HUK_SUPPORTED bool default y @@ -1155,6 +1171,18 @@ config SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY bool default y +config SOC_KEY_MANAGER_FE_KEY_DEPLOY + bool + default y + +config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 + bool + default y + +config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 + bool + default y + config SOC_KEY_MANAGER_HMAC_KEY_DEPLOY bool default y @@ -1167,14 +1195,46 @@ config SOC_LCDCAM_CAM_SUPPORT_RGB_YUV_CONV bool default y +config SOC_SECURE_BOOT_V2_RSA + bool + default y + +config SOC_SECURE_BOOT_V2_ECC + bool + default n + config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS int default 3 +config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS + bool + default y + +config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY + bool + default y + config SOC_FLASH_ENCRYPTION_XTS_AES bool default y +config SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_128 + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_256 + bool + default y + +config SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND + bool + default y + config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX int default 64 diff --git a/components/soc/esp32s31/include/soc/soc_caps.h b/components/soc/esp32s31/include/soc/soc_caps.h index 8907cf8458b..64f3fe1b6a4 100644 --- a/components/soc/esp32s31/include/soc/soc_caps.h +++ b/components/soc/esp32s31/include/soc/soc_caps.h @@ -75,8 +75,8 @@ #define SOC_ECC_SUPPORTED 1 #define SOC_ECC_EXTENDED_MODES_SUPPORTED 1 #define SOC_ECDSA_SUPPORTED 1 -// #define SOC_FLASH_ENC_SUPPORTED 1 // TODO: [ESP32S31] IDF-14628 -// #define SOC_SECURE_BOOT_SUPPORTED 1 // TODO: [ESP32S31] IDF-14629 +#define SOC_FLASH_ENC_SUPPORTED 1 +#define SOC_SECURE_BOOT_SUPPORTED 1 #define SOC_BOD_SUPPORTED 1 // #define SOC_APM_SUPPORTED 1 // TODO: [ESP32S31] IDF-14620 #define SOC_PAU_SUPPORTED 1 @@ -431,29 +431,38 @@ #define SOC_EFUSE_ECDSA_KEY 1 #define SOC_EFUSE_ECDSA_KEY_P192 1 #define SOC_EFUSE_ECDSA_KEY_P384 1 +#define SOC_EFUSE_XTS_AES_KEY_128 1 +#define SOC_EFUSE_XTS_AES_KEY_256 1 /*-------------------------- HUK CAPS----------------------------*/ #define SOC_HUK_SUPPORTED 1 /*-------------------------- Key Manager CAPS----------------------------*/ -// TODO: [ESP32S31] IDF-14626 #define SOC_KEY_MANAGER_SUPPORTED 1 #define SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT 1 /*!< Key manager supports key deployment */ #define SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY 1 /*!< Key manager responsible to deploy ECDSA key */ +#define SOC_KEY_MANAGER_FE_KEY_DEPLOY 1 /*!< Key manager responsible to deploy Flash Encryption key */ +#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 1 /*!< Key manager responsible to deploy the XTS-AES-128 key */ +#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 1 /*!< Key manager responsible to deploy the XTS-AES-256 key */ #define SOC_KEY_MANAGER_HMAC_KEY_DEPLOY 1 /*!< Key manager responsible to deploy HMAC key */ #define SOC_KEY_MANAGER_DS_KEY_DEPLOY 1 /*!< Key manager responsible to deploy DS key */ -// SOC_KEY_MANAGER_FE_KEY_DEPLOY (incl. XTS-AES-128/256) will be enabled along with Flash Encryption support. /*--------------------------- CAM ---------------------------------*/ #define SOC_LCDCAM_CAM_SUPPORT_RGB_YUV_CONV (1) /*-------------------------- Secure Boot CAPS----------------------------*/ -// TODO: [ESP32S31] IDF-14629 +#define SOC_SECURE_BOOT_V2_RSA 1 +#define SOC_SECURE_BOOT_V2_ECC 0 #define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 +#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1 +#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1 /*-------------------------- Flash Encryption CAPS----------------------------*/ -// TODO: [ESP32S31] IDF-14628 -#define SOC_FLASH_ENCRYPTION_XTS_AES 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS 1 +#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1 /* SOC_EFUSE_XTS_AES_KEY_128 (1) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 (1) */ +#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1 /* SOC_EFUSE_XTS_AES_KEY_256 (1) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 (1) */ +#define SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND 1 #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64) /*------------------------Bootloader CAPS---------------------------------*/ diff --git a/docs/en/security/esp32s31_log.inc b/docs/en/security/esp32s31_log.inc index 984eb9675d8..a95e66ad80c 100644 --- a/docs/en/security/esp32s31_log.inc +++ b/docs/en/security/esp32s31_log.inc @@ -3,129 +3,298 @@ .. code-block:: none - ESP-ROM:esp32s31-20210327 - Build:Mar 27 2021 - rst:0x1 (POWERON),boot:0x8 (SPI_FAST_FLASH_BOOT) - SPIWP:0xee - mode:DIO, clock div:1 - load:0x3fcd0270,len:0x2598 - load:0x403b6000,len:0x878 - load:0x403ba000,len:0x3dd4 - entry 0x403b61c0 - I (27) boot: ESP-IDF v4.4-dev-2003-g72fdecc1b7-dirty 2nd stage bootloader - I (28) boot: compile time 14:15:37 - I (28) boot: chip revision: 0 - I (32) boot.esp32s31: SPI Speed : 80MHz - I (36) boot.esp32s31: SPI Mode : DIO - I (41) boot.esp32s31: SPI Flash Size : 2MB - I (46) boot: Enabling RNG early entropy source... - I (58) boot: Partition Table: - I (62) boot: ## Label Usage Type ST Offset Length - I (69) boot: 0 nvs WiFi data 01 02 0000a000 00006000 - I (76) boot: 1 storage Unknown data 01 ff 00010000 00001000 - I (84) boot: 2 factory factory app 00 00 00020000 00100000 - I (91) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 - I (99) boot: End of partition table - I (103) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map - I (117) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) load - I (122) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) load - I (134) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map - I (156) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) load - I (162) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) load - I (167) boot: Loaded app from partition at offset 0x20000 - I (168) boot: Checking flash encryption... - I (173) efuse: Batch mode of writing fields is enabled - I (179) flash_encrypt: Generating new flash encryption key... - I (188) efuse: Writing EFUSE_BLK_KEY0 with purpose 4 - W (194) flash_encrypt: Not disabling UART bootloader encryption - I (197) flash_encrypt: Disable UART bootloader cache... - I (203) flash_encrypt: Disable JTAG... - I (212) efuse: Batch mode. Prepared fields are committed - I (214) esp_image: segment 0: paddr=00000020 vaddr=3fcd0270 size=02598h ( 9624) - I (223) esp_image: segment 1: paddr=000025c0 vaddr=403b6000 size=00878h ( 2168) - I (230) esp_image: segment 2: paddr=00002e40 vaddr=403ba000 size=03dd4h ( 15828) - I (534) flash_encrypt: bootloader encrypted successfully - I (578) flash_encrypt: partition table encrypted and loaded successfully - I (578) flash_encrypt: Encrypting partition 1 at offset 0x10000 (length 0x1000)... - I (628) flash_encrypt: Done encrypting - I (629) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map - I (636) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) - I (640) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) - I (651) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map - I (675) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) - I (679) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) - I (680) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x100000)... - I (11571) flash_encrypt: Done encrypting - I (11571) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)... - I (11617) flash_encrypt: Done encrypting - I (11618) flash_encrypt: Flash encryption completed - I (11623) boot: Resetting with flash encryption enabled... + ESP-ROM:esp32s31-20251218 + Build:Jan 21 2026 + rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT) + SPI mode:DIO, clock div:1 + load:0x2f074230,len:0x2944 + load:0x2f06a2b0,len:0xa20 + load:0x2f06cfb0,len:0x4690 + entry 0x2f06a304 + I (33) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader + I (34) boot: compile time May 22 2026 17:30:12 + I (35) boot: Multicore bootloader + I (38) boot: chip revision: v0.0 + I (39) boot: efuse block revision: v0.0 + I (42) boot.esp32s31: SPI Speed : 80MHz + I (46) boot.esp32s31: SPI Mode : DIO + I (50) boot.esp32s31: SPI Flash Size : 4MB + I (54) boot: Enabling RNG early entropy source... + I (59) boot: Partition Table: + I (61) boot: ## Label Usage Type ST Offset Length + I (67) boot: 0 nvs WiFi data 01 02 0000e000 00006000 + I (74) boot: 1 storage Unknown data 01 ff 00014000 00001000 + I (80) boot: 2 factory factory app 00 00 00020000 00100000 + I (87) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 + I (93) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000 + I (100) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000 + I (107) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000 + I (115) boot: End of partition table + I (117) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (145) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load + I (157) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (201) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load + I (209) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load + I (221) boot: Loaded app from partition at offset 0x20000 + I (222) boot: Checking flash encryption... + I (223) efuse: Batch mode of writing fields is enabled + I (224) flash_encrypt: Generating new flash encryption key... + I (244) efuse: Writing EFUSE_BLK_KEY0 with purpose 2 + I (249) efuse: Writing EFUSE_BLK_KEY1 with purpose 3 + I (259) flash_encrypt: Disable UART bootloader cache... + I (264) flash_encrypt: Disable JTAG... + I (269) efuse: BURN BLOCK5 + I (272) efuse: BURN BLOCK5 - OK (write block == read block) + I (277) efuse: BURN BLOCK4 + I (279) efuse: BURN BLOCK4 - OK (write block == read block) + I (283) efuse: BURN BLOCK0 + I (287) efuse: BURN BLOCK0 - OK (write block == read block) + I (291) efuse: BURN BLOCK0 + I (294) efuse: BURN BLOCK0 - OK (all write block bits are set) + I (298) efuse: Batch mode. Prepared fields are committed + I (304) esp_image: segment 0: paddr=00002020 vaddr=2f074230 size=02944h ( 10564) + I (314) esp_image: segment 1: paddr=0000496c vaddr=2f06a2b0 size=00a20h ( 2592) + I (320) esp_image: segment 2: paddr=00005394 vaddr=2f06cfb0 size=04690h ( 18064) + I (1187) flash_encrypt: bootloader encrypted successfully + I (1292) flash_encrypt: partition table encrypted and loaded successfully + I (1293) flash_encrypt: Encrypting partition 1 at offset 0x14000 (length 0x1000)... + I (1398) flash_encrypt: Done encrypting + I (1400) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (1415) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) + I (1426) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (1470) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) + I (1477) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) + I (1484) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x379a0)... + I (7433) flash_encrypt: Done encrypting + I (7433) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)... + I (7529) flash_encrypt: Done encrypting + I (7529) flash_encrypt: Encrypting partition 5 at offset 0x127000 (length 0x96000)... + I (22094) flash_encrypt: Done encrypting + I (22095) efuse: BURN BLOCK0 + I (22096) efuse: BURN BLOCK0 - OK (all write block bits are set) + I (22098) flash_encrypt: Flash encryption completed + I (22099) boot: Resetting with flash encryption enabled... + ------ + +.. first_boot_enc_km + +.. code-block:: none + + ESP-ROM:esp32s31-20251218 + Build:Jan 21 2026 + rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT) + SPI mode:DIO, clock div:1 + load:0x2f074230,len:0x2964 + load:0x2f06a2b0,len:0xa20 + load:0x2f06cfb0,len:0x4b24 + entry 0x2f06a304 + I (33) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader + I (34) boot: compile time May 22 2026 17:33:18 + I (35) boot: Multicore bootloader + I (38) boot: chip revision: v0.0 + I (39) boot: efuse block revision: v0.0 + I (42) boot.esp32s31: SPI Speed : 80MHz + I (46) boot.esp32s31: SPI Mode : DIO + I (50) boot.esp32s31: SPI Flash Size : 4MB + I (54) boot: Enabling RNG early entropy source... + I (59) boot: Partition Table: + I (61) boot: ## Label Usage Type ST Offset Length + I (67) boot: 0 nvs WiFi data 01 02 0000e000 00006000 + I (74) boot: 1 storage Unknown data 01 ff 00014000 00001000 + I (80) boot: 2 factory factory app 00 00 00020000 00100000 + I (87) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 + I (93) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000 + I (100) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000 + I (107) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000 + I (115) boot: End of partition table + I (117) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (145) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load + I (157) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (201) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load + I (209) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load + I (221) boot: Loaded app from partition at offset 0x20000 + I (222) boot: Checking flash encryption... + I (223) efuse: Batch mode of writing fields is enabled + I (224) flash_encrypt: Deploying new flash encryption key using Key Manager + I (383) flash_encrypt: Disable UART bootloader cache... + I (384) flash_encrypt: Disable JTAG... + I (385) efuse: BURN BLOCK0 + I (389) efuse: BURN BLOCK0 - OK (write block == read block) + I (393) efuse: Batch mode. Prepared fields are committed + I (398) esp_image: segment 0: paddr=00002020 vaddr=2f074230 size=02964h ( 10596) + I (409) esp_image: segment 1: paddr=0000498c vaddr=2f06a2b0 size=00a20h ( 2592) + I (415) esp_image: segment 2: paddr=000053b4 vaddr=2f06cfb0 size=04b24h ( 19236) + I (1267) flash_encrypt: bootloader encrypted successfully + I (1368) flash_encrypt: partition table encrypted and loaded successfully + I (1369) flash_encrypt: Encrypting partition 1 at offset 0x14000 (length 0x1000)... + I (1472) flash_encrypt: Done encrypting + I (1473) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (1489) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) + I (1499) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (1543) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) + I (1551) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) + I (1558) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x379a0)... + I (7451) flash_encrypt: Done encrypting + I (7451) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)... + I (7548) flash_encrypt: Done encrypting + I (7549) flash_encrypt: Encrypting partition 5 at offset 0x127000 (length 0x96000)... + I (22115) flash_encrypt: Done encrypting + I (22116) efuse: BURN BLOCK0 + I (22118) efuse: BURN BLOCK0 - OK (all write block bits are set) + I (22119) flash_encrypt: Flash encryption completed + I (22121) boot: Resetting with flash encryption enabled... + + +------ + + .. already_en_enc .. code-block:: none - ESP-ROM:esp32s31-20210327 - Build:Mar 27 2021 - rst:0x3 (RTC_SW_SYS_RST),boot:0x8 (SPI_FAST_FLASH_BOOT) - Saved PC:0x403bb1d6 - SPIWP:0xee - mode:DIO, clock div:1 - load:0x3fcd0270,len:0x2598 - load:0x403b6000,len:0x878 - load:0x403ba000,len:0x3dd4 - entry 0x403b61c0 - I (35) boot: ESP-IDF v4.4-dev-2003-g72fdecc1b7-dirty 2nd stage bootloader - I (35) boot: compile time 14:15:37 - I (35) boot: chip revision: 0 - I (39) boot.esp32s31: SPI Speed : 80MHz - I (44) boot.esp32s31: SPI Mode : DIO - I (48) boot.esp32s31: SPI Flash Size : 2MB - I (53) boot: Enabling RNG early entropy source... - I (65) boot: Partition Table: - I (69) boot: ## Label Usage Type ST Offset Length - I (76) boot: 0 nvs WiFi data 01 02 0000a000 00006000 - I (84) boot: 1 storage Unknown data 01 ff 00010000 00001000 - I (91) boot: 2 factory factory app 00 00 00020000 00100000 - I (99) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 - I (106) boot: End of partition table - I (110) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map - I (126) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) load - I (129) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) load - I (141) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map - I (166) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) load - I (172) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) load - I (177) boot: Loaded app from partition at offset 0x20000 - I (178) boot: Checking flash encryption... - I (183) flash_encrypt: flash encryption is enabled (1 plaintext flashes left) - I (190) boot: Disabling RNG early entropy source... - I (214) cpu_start: Pro cpu up. - I (214) cpu_start: Starting app cpu, entry point is 0x40374fa8 - I (0) cpu_start: App cpu up. - I (228) cpu_start: Pro cpu start user code - I (228) cpu_start: cpu freq: 160000000 - I (228) cpu_start: Application information: - I (231) cpu_start: Project name: flash_encryption - I (237) cpu_start: App version: v4.4-dev-2003-g72fdecc1b7-dirty - I (244) cpu_start: Compile time: Jul 12 2021 14:15:34 - I (250) cpu_start: ELF file SHA256: a7e6343c6a1c2215... - I (256) cpu_start: ESP-IDF: v4.4-dev-2003-g72fdecc1b7-dirty - I (263) heap_init: Initializing. RAM available for dynamic allocation: - I (270) heap_init: At 3FC92810 len 0004D7F0 (309 KiB): D/IRAM - I (277) heap_init: At 3FCE0000 len 0000EE34 (59 KiB): STACK/DRAM - I (283) heap_init: At 3FCF0000 len 00008000 (32 KiB): DRAM - I (290) spi_flash: detected chip: generic - I (294) spi_flash: flash io: dio - W (298) spi_flash: Detected size(8192k) larger than the size in the binary image header(2048k). Using the size in the binary image header. - I (311) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure) - I (318) cpu_start: Starting scheduler on PRO CPU. - I (0) cpu_start: Starting scheduler on APP CPU. + ESP-ROM:esp32s31-20251218 + Build:Jan 21 2026 + rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT) + use legacy efuse key + SPI mode:DIO, clock div:1 + load:0x2f074230,len:0x2944 + load:0x2f06a2b0,len:0xa20 + load:0x2f06cfb0,len:0x4690 + entry 0x2f06a304 + I (35) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader + I (36) boot: compile time May 22 2026 17:30:12 + I (37) boot: Multicore bootloader + I (40) boot: chip revision: v0.0 + I (41) boot: efuse block revision: v0.0 + I (44) boot.esp32s31: SPI Speed : 80MHz + I (48) boot.esp32s31: SPI Mode : DIO + I (52) boot.esp32s31: SPI Flash Size : 4MB + I (56) boot: Enabling RNG early entropy source... + I (61) boot: Partition Table: + I (63) boot: ## Label Usage Type ST Offset Length + I (69) boot: 0 nvs WiFi data 01 02 0000e000 00006000 + I (76) boot: 1 storage Unknown data 01 ff 00014000 00001000 + I (82) boot: 2 factory factory app 00 00 00020000 00100000 + I (89) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 + I (95) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000 + I (102) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000 + I (108) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000 + I (117) boot: End of partition table + I (119) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (149) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load + I (162) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (212) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load + I (221) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load + I (233) boot: Loaded app from partition at offset 0x20000 + I (234) boot: Checking flash encryption... + I (234) flash_encrypt: flash encryption is enabled (1 plaintext flashes left) + I (237) boot: Disabling RNG early entropy source... + I (254) cpu_start: Multicore app + I (257) cpu_start: Pro cpu start user code + I (258) cpu_start: cpu freq: 40000000 Hz + I (262) app_init: Application information: + I (266) app_init: Project name: flash_encryption + I (270) app_init: App version: v6.1-dev-5047-ga20ab68fd55-dirt + I (276) app_init: Compile time: May 22 2026 17:30:25 + I (281) app_init: ELF file SHA256: cebb4e540... + I (286) app_init: ESP-IDF: v6.1-dev-5047-ga20ab68fd55-dirt + I (292) efuse_init: Min chip rev: v0.0 + I (295) efuse_init: Max chip rev: v0.99 + I (299) efuse_init: Chip rev: v0.0 + I (303) heap_init: Initializing. RAM available for dynamic allocation: + I (310) heap_init: At 2F00DA20 len 0006D590 (437 KiB): RAM + I (315) heap_init: At 2F07AFB0 len 000041C0 (16 KiB): RAM + I (320) heap_init: At 2E000000 len 00007FE8 (31 KiB): RTCRAM + I (327) spi_flash: detected chip: gd + I (329) spi_flash: flash io: dio + W (332) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure) + I (339) sleep_gpio: Configure to isolate all GPIO pins in sleep state + I (345) sleep_gpio: Enable automatic switching of GPIO sleep configuration + I (353) main_task: Started on CPU0 + I (373) main_task: Calling app_main() Example to check Flash Encryption status - This is esp32s31 chip with 2 CPU core(s), WiFi/BLE/IEEE802.15.4, silicon revision 0, 2MB external flash + This is esp32s31 chip with 2 CPU core(s), WiFi/BLE, silicon revision v0.0, 4MB external flash FLASH_CRYPT_CNT eFuse value is 1 Flash encryption feature is enabled in DEVELOPMENT mode + +------ + + +.. already_en_enc_km + +.. code-block:: none + + ESP-ROM:esp32s31-20251218 + Build:Jan 21 2026 + rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT) + use sector0 for km info + use KM derived key + SPI mode:DIO, clock div:1 + load:0x2f074230,len:0x2964 + load:0x2f06a2b0,len:0xa20 + load:0x2f06cfb0,len:0x4b24 + entry 0x2f06a304 + I (37) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader + I (38) boot: compile time May 22 2026 17:33:18 + I (39) boot: Multicore bootloader + I (42) boot: chip revision: v0.0 + I (43) boot: efuse block revision: v0.0 + I (46) boot.esp32s31: SPI Speed : 80MHz + I (50) boot.esp32s31: SPI Mode : DIO + I (54) boot.esp32s31: SPI Flash Size : 4MB + I (58) boot: Enabling RNG early entropy source... + I (62) boot: Partition Table: + I (65) boot: ## Label Usage Type ST Offset Length + I (71) boot: 0 nvs WiFi data 01 02 0000e000 00006000 + I (78) boot: 1 storage Unknown data 01 ff 00014000 00001000 + I (84) boot: 2 factory factory app 00 00 00020000 00100000 + I (91) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 + I (97) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000 + I (104) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000 + I (110) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000 + I (119) boot: End of partition table + I (121) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (151) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load + I (164) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (214) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load + I (223) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load + I (235) boot: Loaded app from partition at offset 0x20000 + I (236) boot: Checking flash encryption... + I (236) flash_encrypt: flash encryption is enabled (1 plaintext flashes left) + I (239) boot: Disabling RNG early entropy source... + I (256) cpu_start: Multicore app + I (259) cpu_start: Pro cpu start user code + I (260) cpu_start: cpu freq: 40000000 Hz + I (264) app_init: Application information: + I (268) app_init: Project name: flash_encryption + I (272) app_init: App version: v6.1-dev-5047-ga20ab68fd55-dirt + I (278) app_init: Compile time: May 22 2026 17:33:32 + I (283) app_init: ELF file SHA256: 3907456c7... + I (288) app_init: ESP-IDF: v6.1-dev-5047-ga20ab68fd55-dirt + I (294) efuse_init: Min chip rev: v0.0 + I (297) efuse_init: Max chip rev: v0.99 + I (301) efuse_init: Chip rev: v0.0 + I (305) heap_init: Initializing. RAM available for dynamic allocation: + I (312) heap_init: At 2F00DA20 len 0006D590 (437 KiB): RAM + I (317) heap_init: At 2F07AFB0 len 000041C0 (16 KiB): RAM + I (322) heap_init: At 2E000000 len 00007FE8 (31 KiB): RTCRAM + I (329) spi_flash: detected chip: gd + I (331) spi_flash: flash io: dio + W (334) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure) + I (341) sleep_gpio: Configure to isolate all GPIO pins in sleep state + I (347) sleep_gpio: Enable automatic switching of GPIO sleep configuration + I (355) main_task: Started on CPU0 + I (375) main_task: Calling app_main() + + Example to check Flash Encryption status + This is esp32s31 chip with 2 CPU core(s), WiFi/BLE, silicon revision v0.0, 4MB external flash + FLASH_CRYPT_CNT eFuse value is 1 + Flash encryption feature is enabled in DEVELOPMENT mode + + ------ diff --git a/docs/zh_CN/security/esp32s31_log.inc b/docs/zh_CN/security/esp32s31_log.inc index 984eb9675d8..a95e66ad80c 100644 --- a/docs/zh_CN/security/esp32s31_log.inc +++ b/docs/zh_CN/security/esp32s31_log.inc @@ -3,129 +3,298 @@ .. code-block:: none - ESP-ROM:esp32s31-20210327 - Build:Mar 27 2021 - rst:0x1 (POWERON),boot:0x8 (SPI_FAST_FLASH_BOOT) - SPIWP:0xee - mode:DIO, clock div:1 - load:0x3fcd0270,len:0x2598 - load:0x403b6000,len:0x878 - load:0x403ba000,len:0x3dd4 - entry 0x403b61c0 - I (27) boot: ESP-IDF v4.4-dev-2003-g72fdecc1b7-dirty 2nd stage bootloader - I (28) boot: compile time 14:15:37 - I (28) boot: chip revision: 0 - I (32) boot.esp32s31: SPI Speed : 80MHz - I (36) boot.esp32s31: SPI Mode : DIO - I (41) boot.esp32s31: SPI Flash Size : 2MB - I (46) boot: Enabling RNG early entropy source... - I (58) boot: Partition Table: - I (62) boot: ## Label Usage Type ST Offset Length - I (69) boot: 0 nvs WiFi data 01 02 0000a000 00006000 - I (76) boot: 1 storage Unknown data 01 ff 00010000 00001000 - I (84) boot: 2 factory factory app 00 00 00020000 00100000 - I (91) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 - I (99) boot: End of partition table - I (103) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map - I (117) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) load - I (122) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) load - I (134) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map - I (156) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) load - I (162) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) load - I (167) boot: Loaded app from partition at offset 0x20000 - I (168) boot: Checking flash encryption... - I (173) efuse: Batch mode of writing fields is enabled - I (179) flash_encrypt: Generating new flash encryption key... - I (188) efuse: Writing EFUSE_BLK_KEY0 with purpose 4 - W (194) flash_encrypt: Not disabling UART bootloader encryption - I (197) flash_encrypt: Disable UART bootloader cache... - I (203) flash_encrypt: Disable JTAG... - I (212) efuse: Batch mode. Prepared fields are committed - I (214) esp_image: segment 0: paddr=00000020 vaddr=3fcd0270 size=02598h ( 9624) - I (223) esp_image: segment 1: paddr=000025c0 vaddr=403b6000 size=00878h ( 2168) - I (230) esp_image: segment 2: paddr=00002e40 vaddr=403ba000 size=03dd4h ( 15828) - I (534) flash_encrypt: bootloader encrypted successfully - I (578) flash_encrypt: partition table encrypted and loaded successfully - I (578) flash_encrypt: Encrypting partition 1 at offset 0x10000 (length 0x1000)... - I (628) flash_encrypt: Done encrypting - I (629) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map - I (636) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) - I (640) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) - I (651) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map - I (675) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) - I (679) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) - I (680) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x100000)... - I (11571) flash_encrypt: Done encrypting - I (11571) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)... - I (11617) flash_encrypt: Done encrypting - I (11618) flash_encrypt: Flash encryption completed - I (11623) boot: Resetting with flash encryption enabled... + ESP-ROM:esp32s31-20251218 + Build:Jan 21 2026 + rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT) + SPI mode:DIO, clock div:1 + load:0x2f074230,len:0x2944 + load:0x2f06a2b0,len:0xa20 + load:0x2f06cfb0,len:0x4690 + entry 0x2f06a304 + I (33) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader + I (34) boot: compile time May 22 2026 17:30:12 + I (35) boot: Multicore bootloader + I (38) boot: chip revision: v0.0 + I (39) boot: efuse block revision: v0.0 + I (42) boot.esp32s31: SPI Speed : 80MHz + I (46) boot.esp32s31: SPI Mode : DIO + I (50) boot.esp32s31: SPI Flash Size : 4MB + I (54) boot: Enabling RNG early entropy source... + I (59) boot: Partition Table: + I (61) boot: ## Label Usage Type ST Offset Length + I (67) boot: 0 nvs WiFi data 01 02 0000e000 00006000 + I (74) boot: 1 storage Unknown data 01 ff 00014000 00001000 + I (80) boot: 2 factory factory app 00 00 00020000 00100000 + I (87) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 + I (93) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000 + I (100) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000 + I (107) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000 + I (115) boot: End of partition table + I (117) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (145) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load + I (157) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (201) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load + I (209) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load + I (221) boot: Loaded app from partition at offset 0x20000 + I (222) boot: Checking flash encryption... + I (223) efuse: Batch mode of writing fields is enabled + I (224) flash_encrypt: Generating new flash encryption key... + I (244) efuse: Writing EFUSE_BLK_KEY0 with purpose 2 + I (249) efuse: Writing EFUSE_BLK_KEY1 with purpose 3 + I (259) flash_encrypt: Disable UART bootloader cache... + I (264) flash_encrypt: Disable JTAG... + I (269) efuse: BURN BLOCK5 + I (272) efuse: BURN BLOCK5 - OK (write block == read block) + I (277) efuse: BURN BLOCK4 + I (279) efuse: BURN BLOCK4 - OK (write block == read block) + I (283) efuse: BURN BLOCK0 + I (287) efuse: BURN BLOCK0 - OK (write block == read block) + I (291) efuse: BURN BLOCK0 + I (294) efuse: BURN BLOCK0 - OK (all write block bits are set) + I (298) efuse: Batch mode. Prepared fields are committed + I (304) esp_image: segment 0: paddr=00002020 vaddr=2f074230 size=02944h ( 10564) + I (314) esp_image: segment 1: paddr=0000496c vaddr=2f06a2b0 size=00a20h ( 2592) + I (320) esp_image: segment 2: paddr=00005394 vaddr=2f06cfb0 size=04690h ( 18064) + I (1187) flash_encrypt: bootloader encrypted successfully + I (1292) flash_encrypt: partition table encrypted and loaded successfully + I (1293) flash_encrypt: Encrypting partition 1 at offset 0x14000 (length 0x1000)... + I (1398) flash_encrypt: Done encrypting + I (1400) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (1415) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) + I (1426) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (1470) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) + I (1477) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) + I (1484) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x379a0)... + I (7433) flash_encrypt: Done encrypting + I (7433) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)... + I (7529) flash_encrypt: Done encrypting + I (7529) flash_encrypt: Encrypting partition 5 at offset 0x127000 (length 0x96000)... + I (22094) flash_encrypt: Done encrypting + I (22095) efuse: BURN BLOCK0 + I (22096) efuse: BURN BLOCK0 - OK (all write block bits are set) + I (22098) flash_encrypt: Flash encryption completed + I (22099) boot: Resetting with flash encryption enabled... + ------ + +.. first_boot_enc_km + +.. code-block:: none + + ESP-ROM:esp32s31-20251218 + Build:Jan 21 2026 + rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT) + SPI mode:DIO, clock div:1 + load:0x2f074230,len:0x2964 + load:0x2f06a2b0,len:0xa20 + load:0x2f06cfb0,len:0x4b24 + entry 0x2f06a304 + I (33) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader + I (34) boot: compile time May 22 2026 17:33:18 + I (35) boot: Multicore bootloader + I (38) boot: chip revision: v0.0 + I (39) boot: efuse block revision: v0.0 + I (42) boot.esp32s31: SPI Speed : 80MHz + I (46) boot.esp32s31: SPI Mode : DIO + I (50) boot.esp32s31: SPI Flash Size : 4MB + I (54) boot: Enabling RNG early entropy source... + I (59) boot: Partition Table: + I (61) boot: ## Label Usage Type ST Offset Length + I (67) boot: 0 nvs WiFi data 01 02 0000e000 00006000 + I (74) boot: 1 storage Unknown data 01 ff 00014000 00001000 + I (80) boot: 2 factory factory app 00 00 00020000 00100000 + I (87) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 + I (93) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000 + I (100) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000 + I (107) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000 + I (115) boot: End of partition table + I (117) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (145) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load + I (157) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (201) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load + I (209) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load + I (221) boot: Loaded app from partition at offset 0x20000 + I (222) boot: Checking flash encryption... + I (223) efuse: Batch mode of writing fields is enabled + I (224) flash_encrypt: Deploying new flash encryption key using Key Manager + I (383) flash_encrypt: Disable UART bootloader cache... + I (384) flash_encrypt: Disable JTAG... + I (385) efuse: BURN BLOCK0 + I (389) efuse: BURN BLOCK0 - OK (write block == read block) + I (393) efuse: Batch mode. Prepared fields are committed + I (398) esp_image: segment 0: paddr=00002020 vaddr=2f074230 size=02964h ( 10596) + I (409) esp_image: segment 1: paddr=0000498c vaddr=2f06a2b0 size=00a20h ( 2592) + I (415) esp_image: segment 2: paddr=000053b4 vaddr=2f06cfb0 size=04b24h ( 19236) + I (1267) flash_encrypt: bootloader encrypted successfully + I (1368) flash_encrypt: partition table encrypted and loaded successfully + I (1369) flash_encrypt: Encrypting partition 1 at offset 0x14000 (length 0x1000)... + I (1472) flash_encrypt: Done encrypting + I (1473) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (1489) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) + I (1499) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (1543) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) + I (1551) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) + I (1558) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x379a0)... + I (7451) flash_encrypt: Done encrypting + I (7451) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)... + I (7548) flash_encrypt: Done encrypting + I (7549) flash_encrypt: Encrypting partition 5 at offset 0x127000 (length 0x96000)... + I (22115) flash_encrypt: Done encrypting + I (22116) efuse: BURN BLOCK0 + I (22118) efuse: BURN BLOCK0 - OK (all write block bits are set) + I (22119) flash_encrypt: Flash encryption completed + I (22121) boot: Resetting with flash encryption enabled... + + +------ + + .. already_en_enc .. code-block:: none - ESP-ROM:esp32s31-20210327 - Build:Mar 27 2021 - rst:0x3 (RTC_SW_SYS_RST),boot:0x8 (SPI_FAST_FLASH_BOOT) - Saved PC:0x403bb1d6 - SPIWP:0xee - mode:DIO, clock div:1 - load:0x3fcd0270,len:0x2598 - load:0x403b6000,len:0x878 - load:0x403ba000,len:0x3dd4 - entry 0x403b61c0 - I (35) boot: ESP-IDF v4.4-dev-2003-g72fdecc1b7-dirty 2nd stage bootloader - I (35) boot: compile time 14:15:37 - I (35) boot: chip revision: 0 - I (39) boot.esp32s31: SPI Speed : 80MHz - I (44) boot.esp32s31: SPI Mode : DIO - I (48) boot.esp32s31: SPI Flash Size : 2MB - I (53) boot: Enabling RNG early entropy source... - I (65) boot: Partition Table: - I (69) boot: ## Label Usage Type ST Offset Length - I (76) boot: 0 nvs WiFi data 01 02 0000a000 00006000 - I (84) boot: 1 storage Unknown data 01 ff 00010000 00001000 - I (91) boot: 2 factory factory app 00 00 00020000 00100000 - I (99) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 - I (106) boot: End of partition table - I (110) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map - I (126) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) load - I (129) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) load - I (141) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map - I (166) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) load - I (172) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) load - I (177) boot: Loaded app from partition at offset 0x20000 - I (178) boot: Checking flash encryption... - I (183) flash_encrypt: flash encryption is enabled (1 plaintext flashes left) - I (190) boot: Disabling RNG early entropy source... - I (214) cpu_start: Pro cpu up. - I (214) cpu_start: Starting app cpu, entry point is 0x40374fa8 - I (0) cpu_start: App cpu up. - I (228) cpu_start: Pro cpu start user code - I (228) cpu_start: cpu freq: 160000000 - I (228) cpu_start: Application information: - I (231) cpu_start: Project name: flash_encryption - I (237) cpu_start: App version: v4.4-dev-2003-g72fdecc1b7-dirty - I (244) cpu_start: Compile time: Jul 12 2021 14:15:34 - I (250) cpu_start: ELF file SHA256: a7e6343c6a1c2215... - I (256) cpu_start: ESP-IDF: v4.4-dev-2003-g72fdecc1b7-dirty - I (263) heap_init: Initializing. RAM available for dynamic allocation: - I (270) heap_init: At 3FC92810 len 0004D7F0 (309 KiB): D/IRAM - I (277) heap_init: At 3FCE0000 len 0000EE34 (59 KiB): STACK/DRAM - I (283) heap_init: At 3FCF0000 len 00008000 (32 KiB): DRAM - I (290) spi_flash: detected chip: generic - I (294) spi_flash: flash io: dio - W (298) spi_flash: Detected size(8192k) larger than the size in the binary image header(2048k). Using the size in the binary image header. - I (311) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure) - I (318) cpu_start: Starting scheduler on PRO CPU. - I (0) cpu_start: Starting scheduler on APP CPU. + ESP-ROM:esp32s31-20251218 + Build:Jan 21 2026 + rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT) + use legacy efuse key + SPI mode:DIO, clock div:1 + load:0x2f074230,len:0x2944 + load:0x2f06a2b0,len:0xa20 + load:0x2f06cfb0,len:0x4690 + entry 0x2f06a304 + I (35) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader + I (36) boot: compile time May 22 2026 17:30:12 + I (37) boot: Multicore bootloader + I (40) boot: chip revision: v0.0 + I (41) boot: efuse block revision: v0.0 + I (44) boot.esp32s31: SPI Speed : 80MHz + I (48) boot.esp32s31: SPI Mode : DIO + I (52) boot.esp32s31: SPI Flash Size : 4MB + I (56) boot: Enabling RNG early entropy source... + I (61) boot: Partition Table: + I (63) boot: ## Label Usage Type ST Offset Length + I (69) boot: 0 nvs WiFi data 01 02 0000e000 00006000 + I (76) boot: 1 storage Unknown data 01 ff 00014000 00001000 + I (82) boot: 2 factory factory app 00 00 00020000 00100000 + I (89) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 + I (95) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000 + I (102) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000 + I (108) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000 + I (117) boot: End of partition table + I (119) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (149) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load + I (162) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (212) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load + I (221) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load + I (233) boot: Loaded app from partition at offset 0x20000 + I (234) boot: Checking flash encryption... + I (234) flash_encrypt: flash encryption is enabled (1 plaintext flashes left) + I (237) boot: Disabling RNG early entropy source... + I (254) cpu_start: Multicore app + I (257) cpu_start: Pro cpu start user code + I (258) cpu_start: cpu freq: 40000000 Hz + I (262) app_init: Application information: + I (266) app_init: Project name: flash_encryption + I (270) app_init: App version: v6.1-dev-5047-ga20ab68fd55-dirt + I (276) app_init: Compile time: May 22 2026 17:30:25 + I (281) app_init: ELF file SHA256: cebb4e540... + I (286) app_init: ESP-IDF: v6.1-dev-5047-ga20ab68fd55-dirt + I (292) efuse_init: Min chip rev: v0.0 + I (295) efuse_init: Max chip rev: v0.99 + I (299) efuse_init: Chip rev: v0.0 + I (303) heap_init: Initializing. RAM available for dynamic allocation: + I (310) heap_init: At 2F00DA20 len 0006D590 (437 KiB): RAM + I (315) heap_init: At 2F07AFB0 len 000041C0 (16 KiB): RAM + I (320) heap_init: At 2E000000 len 00007FE8 (31 KiB): RTCRAM + I (327) spi_flash: detected chip: gd + I (329) spi_flash: flash io: dio + W (332) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure) + I (339) sleep_gpio: Configure to isolate all GPIO pins in sleep state + I (345) sleep_gpio: Enable automatic switching of GPIO sleep configuration + I (353) main_task: Started on CPU0 + I (373) main_task: Calling app_main() Example to check Flash Encryption status - This is esp32s31 chip with 2 CPU core(s), WiFi/BLE/IEEE802.15.4, silicon revision 0, 2MB external flash + This is esp32s31 chip with 2 CPU core(s), WiFi/BLE, silicon revision v0.0, 4MB external flash FLASH_CRYPT_CNT eFuse value is 1 Flash encryption feature is enabled in DEVELOPMENT mode + +------ + + +.. already_en_enc_km + +.. code-block:: none + + ESP-ROM:esp32s31-20251218 + Build:Jan 21 2026 + rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT) + use sector0 for km info + use KM derived key + SPI mode:DIO, clock div:1 + load:0x2f074230,len:0x2964 + load:0x2f06a2b0,len:0xa20 + load:0x2f06cfb0,len:0x4b24 + entry 0x2f06a304 + I (37) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader + I (38) boot: compile time May 22 2026 17:33:18 + I (39) boot: Multicore bootloader + I (42) boot: chip revision: v0.0 + I (43) boot: efuse block revision: v0.0 + I (46) boot.esp32s31: SPI Speed : 80MHz + I (50) boot.esp32s31: SPI Mode : DIO + I (54) boot.esp32s31: SPI Flash Size : 4MB + I (58) boot: Enabling RNG early entropy source... + I (62) boot: Partition Table: + I (65) boot: ## Label Usage Type ST Offset Length + I (71) boot: 0 nvs WiFi data 01 02 0000e000 00006000 + I (78) boot: 1 storage Unknown data 01 ff 00014000 00001000 + I (84) boot: 2 factory factory app 00 00 00020000 00100000 + I (91) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 + I (97) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000 + I (104) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000 + I (110) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000 + I (119) boot: End of partition table + I (121) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map + I (151) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load + I (164) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map + I (214) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load + I (223) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load + I (235) boot: Loaded app from partition at offset 0x20000 + I (236) boot: Checking flash encryption... + I (236) flash_encrypt: flash encryption is enabled (1 plaintext flashes left) + I (239) boot: Disabling RNG early entropy source... + I (256) cpu_start: Multicore app + I (259) cpu_start: Pro cpu start user code + I (260) cpu_start: cpu freq: 40000000 Hz + I (264) app_init: Application information: + I (268) app_init: Project name: flash_encryption + I (272) app_init: App version: v6.1-dev-5047-ga20ab68fd55-dirt + I (278) app_init: Compile time: May 22 2026 17:33:32 + I (283) app_init: ELF file SHA256: 3907456c7... + I (288) app_init: ESP-IDF: v6.1-dev-5047-ga20ab68fd55-dirt + I (294) efuse_init: Min chip rev: v0.0 + I (297) efuse_init: Max chip rev: v0.99 + I (301) efuse_init: Chip rev: v0.0 + I (305) heap_init: Initializing. RAM available for dynamic allocation: + I (312) heap_init: At 2F00DA20 len 0006D590 (437 KiB): RAM + I (317) heap_init: At 2F07AFB0 len 000041C0 (16 KiB): RAM + I (322) heap_init: At 2E000000 len 00007FE8 (31 KiB): RTCRAM + I (329) spi_flash: detected chip: gd + I (331) spi_flash: flash io: dio + W (334) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure) + I (341) sleep_gpio: Configure to isolate all GPIO pins in sleep state + I (347) sleep_gpio: Enable automatic switching of GPIO sleep configuration + I (355) main_task: Started on CPU0 + I (375) main_task: Calling app_main() + + Example to check Flash Encryption status + This is esp32s31 chip with 2 CPU core(s), WiFi/BLE, silicon revision v0.0, 4MB external flash + FLASH_CRYPT_CNT eFuse value is 1 + Flash encryption feature is enabled in DEVELOPMENT mode + + ------