Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat: enable Secure Boot, Flash Encryption and Key Manager support for S31

Browse Source
This commit is contained in:
nilesh.kale
2026-06-02 13:09:44 +05:30
parent 9cede1d920
commit ae1ec76e82
10 changed files with 838 additions and 291 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader_support/src/esp32s31/flash_encryption_secure_features.c
+36 -35
View File
@@ -5,65 +5,66 @@
*/ */
#include <strings.h> #include <strings.h>
#include "esp_flash_encrypt.h"
#include "esp_secure_boot.h" #include "esp_secure_boot.h"
#include "esp_efuse.h" #include "esp_efuse.h"
#include "esp_efuse_table.h" #include "esp_efuse_table.h"
#include "esp_log.h" #include "esp_log.h"
#include "sdkconfig.h" #include "sdkconfig.h"
#include "esp_crypto_periph_clk.h"
#include "esp_key_mgr.h"
#include "hal/key_mgr_hal.h"
#include "hal/key_mgr_ll.h"
ESP_LOG_ATTR_TAG(TAG, "flash_encrypt"); ESP_LOG_ATTR_TAG(TAG, "flash_encrypt");
esp_err_t esp_flash_encryption_enable_secure_features(void) esp_err_t esp_flash_encryption_enable_secure_features(void)
{ {
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT); #ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
ESP_LOGI(TAG, "Disable UART bootloader encryption...");
#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
ESP_LOGI(TAG, "Enabling Security download mode...");
esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not enable Security download mode...");
return err;
}
#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
ESP_LOGI(TAG, "Disable ROM Download mode...");
esp_err_t err = esp_efuse_disable_rom_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not disable ROM Download mode...");
return err;
}
#else #else
ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED"); ESP_LOGW(TAG, "Not disabling UART bootloader encryption");
#endif
#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
ESP_LOGI(TAG, "Disable UART bootloader cache...");
esp_efuse_write_field_bit(ESP_EFUSE_SPI_DOWNLOAD_MSPI_DIS);
#else
ESP_LOGW(TAG, "Not disabling UART bootloader cache - SECURITY COMPROMISED");
#endif #endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
ESP_LOGI(TAG, "Disable hardware & software JTAG..."); ESP_LOGI(TAG, "Disable JTAG...");
esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG); esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG); esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count);
#else #else
ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED"); ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
#endif #endif
#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
#if CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC
ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
#endif #endif
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN); #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
// This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS // otherwise the Flash Encryption key cannot be read protected
bool rd_dis_now = true;
#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
/* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
when Flash Encryption is being enabled */
rd_dis_now = esp_efuse_is_flash_encryption_enabled();
#endif
if (rd_dis_now) {
ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS); esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
}
#else
ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
#endif #endif
return ESP_OK; return ESP_OK;
} }
esp_err_t esp_flash_encryption_use_efuse_key(void)
{
esp_crypto_key_mgr_enable_periph_clk(true);
// Force Key Manager to use eFuse key for XTS-AES operation
key_mgr_hal_set_key_usage(ESP_KEY_MGR_FLASH_XTS_AES_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
return ESP_OK;
}
components/bootloader_support/src/esp32s31/secure_boot_secure_features.c
+73
View File
@@ -0,0 +1,73 @@
/*
* SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <strings.h>
#include "esp_secure_boot.h"
#include "esp_efuse.h"
#include "esp_efuse_table.h"
#include "esp_log.h"
#include "sdkconfig.h"
ESP_LOG_ATTR_TAG(TAG, "secure_boot");
esp_err_t esp_secure_boot_enable_secure_features(void)
{
esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
ESP_LOGI(TAG, "Enabling Security download mode...");
esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not enable Security download mode...");
return err;
}
#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
ESP_LOGI(TAG, "Disable ROM Download mode...");
esp_err_t err = esp_efuse_disable_rom_download_mode();
if (err != ESP_OK) {
ESP_LOGE(TAG, "Could not disable ROM Download mode...");
return err;
}
#else
ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
#endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
ESP_LOGI(TAG, "Disable hardware & software JTAG...");
esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
esp_efuse_write_field_cnt(ESP_EFUSE_SOFT_DIS_JTAG, ESP_EFUSE_SOFT_DIS_JTAG[0]->bit_count);
#else
ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
#endif
#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
#endif
#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_SHA384_EN);
#endif
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
bool rd_dis_now = true;
#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
/* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
when Flash Encryption is being enabled */
rd_dis_now = esp_efuse_is_flash_encryption_enabled();
#endif
if (rd_dis_now) {
ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
}
#else
ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
#endif
return ESP_OK;
}
components/esp_hal_mspi/esp32s31/include/hal/spi_flash_encrypted_ll.h
+57 -14
View File
@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -15,11 +15,12 @@
#include <stdbool.h> #include <stdbool.h>
#include <string.h> #include <string.h>
#include "soc/system_reg.h" #include "soc/hp_system_reg.h"
#include "soc/hwcrypto_reg.h" #include "soc/spi_mem_c_reg.h"
#include "soc/soc.h" #include "soc/soc.h"
#include "soc/soc_caps.h" #include "soc/soc_caps.h"
#include "hal/assert.h" #include "hal/assert.h"
#include "hal/spi_flash_encrypt_types.h"
#ifdef __cplusplus #ifdef __cplusplus
extern "C" { extern "C" {
@@ -36,7 +37,9 @@ typedef enum {
*/ */
static inline void spi_flash_encrypt_ll_enable(void) static inline void spi_flash_encrypt_ll_enable(void)
{ {
// TODO: ["ESP32S31"] IDF-14628 REG_SET_BIT(HP_SYSTEM_CRYPTO_CTRL_REG,
HP_SYSTEM_REG_ENABLE_DOWNLOAD_MANUAL_ENCRYPT |
HP_SYSTEM_REG_ENABLE_SPI_MANUAL_ENCRYPT);
} }
/* /*
@@ -44,7 +47,8 @@ static inline void spi_flash_encrypt_ll_enable(void)
*/ */
static inline void spi_flash_encrypt_ll_disable(void) static inline void spi_flash_encrypt_ll_disable(void)
{ {
// TODO: ["ESP32S31"] IDF-14628 REG_CLR_BIT(HP_SYSTEM_CRYPTO_CTRL_REG,
HP_SYSTEM_REG_ENABLE_SPI_MANUAL_ENCRYPT);
} }
/** /**
@@ -56,7 +60,9 @@ static inline void spi_flash_encrypt_ll_disable(void)
*/ */
static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type) static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type)
{ {
// TODO: ["ESP32S31"] IDF-14628 // Our hardware only support flash encryption
HAL_ASSERT(type == FLASH_ENCRYPTION_MANU);
REG_SET_FIELD(SPI_MEM_C_XTS_DESTINATION_REG, SPI_XTS_DESTINATION, type);
} }
/** /**
@@ -66,7 +72,8 @@ static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type)
*/ */
static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size) static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size)
{ {
// TODO: ["ESP32S31"] IDF-14628 // Desired block should not be larger than the block size.
REG_SET_FIELD(SPI_MEM_C_XTS_LINESIZE_REG, SPI_XTS_LINESIZE, size >> 5);
} }
/** /**
@@ -79,7 +86,9 @@ static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size)
*/ */
static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const uint32_t* buffer, uint32_t size) static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const uint32_t* buffer, uint32_t size)
{ {
// TODO: ["ESP32S31"] IDF-14628 uint32_t plaintext_offs = (address % SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX);
HAL_ASSERT(plaintext_offs + size <= SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX);
memcpy((void *)(SPI_MEM_C_XTS_PLAIN_BASE_REG + plaintext_offs), buffer, size);
} }
/** /**
@@ -89,7 +98,7 @@ static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const u
*/ */
static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr) static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr)
{ {
// TODO: ["ESP32S31"] IDF-14628 REG_SET_FIELD(SPI_MEM_C_XTS_PHYSICAL_ADDRESS_REG, SPI_XTS_PHYSICAL_ADDRESS, flash_addr);
} }
/** /**
@@ -97,7 +106,7 @@ static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr)
*/ */
static inline void spi_flash_encrypt_ll_calculate_start(void) static inline void spi_flash_encrypt_ll_calculate_start(void)
{ {
// TODO: ["ESP32S31"] IDF-14628 REG_SET_FIELD(SPI_MEM_C_XTS_TRIGGER_REG, SPI_XTS_TRIGGER, 1);
} }
/** /**
@@ -105,7 +114,8 @@ static inline void spi_flash_encrypt_ll_calculate_start(void)
*/ */
static inline void spi_flash_encrypt_ll_calculate_wait_idle(void) static inline void spi_flash_encrypt_ll_calculate_wait_idle(void)
{ {
// TODO: ["ESP32S31"] IDF-14628 while (REG_GET_FIELD(SPI_MEM_C_XTS_STATE_REG, SPI_XTS_STATE) == 0x1) {
}
} }
/** /**
@@ -113,7 +123,9 @@ static inline void spi_flash_encrypt_ll_calculate_wait_idle(void)
*/ */
static inline void spi_flash_encrypt_ll_done(void) static inline void spi_flash_encrypt_ll_done(void)
{ {
// TODO: ["ESP32S31"] IDF-14628 REG_SET_BIT(SPI_MEM_C_XTS_RELEASE_REG, SPI_XTS_RELEASE);
while (REG_GET_FIELD(SPI_MEM_C_XTS_STATE_REG, SPI_XTS_STATE) != 0x3) {
}
} }
/** /**
@@ -121,7 +133,7 @@ static inline void spi_flash_encrypt_ll_done(void)
*/ */
static inline void spi_flash_encrypt_ll_destroy(void) static inline void spi_flash_encrypt_ll_destroy(void)
{ {
// TODO: ["ESP32S31"] IDF-14628 REG_SET_BIT(SPI_MEM_C_XTS_DESTROY_REG, SPI_XTS_DESTROY);
} }
/** /**
@@ -132,7 +144,38 @@ static inline void spi_flash_encrypt_ll_destroy(void)
*/ */
static inline bool spi_flash_encrypt_ll_check(uint32_t address, uint32_t length) static inline bool spi_flash_encrypt_ll_check(uint32_t address, uint32_t length)
{ {
return 0;//((address % length) == 0) ? true : false; return ((address % length) == 0) ? true : false;
}
/**
* @brief Enable the pseudo-round function during XTS-AES operations
*
* @param mode set the mode for pseudo rounds, zero to disable, with increasing security upto three.
* @param base basic number of pseudo rounds, zero if disable
* @param increment increment number of pseudo rounds, zero if disable
* @param key_rng_cnt update frequency of the pseudo-key, zero if disable
*/
static inline void spi_flash_encrypt_ll_enable_pseudo_rounds(esp_xts_aes_psuedo_rounds_state_t mode, uint8_t base, uint8_t increment, uint8_t key_rng_cnt)
{
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_MODE_PSEUDO, mode);
if (mode != ESP_XTS_AES_PSEUDO_ROUNDS_DISABLE) {
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_BASE, base);
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_INC, increment);
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_RNG_CNT, key_rng_cnt);
} else {
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_BASE, 0);
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_INC, 0);
REG_SET_FIELD(SPI_MEM_C_XTS_PSEUDO_ROUND_CONF_REG, SPI_MEM_C_PSEUDO_RNG_CNT, 0);
}
}
/**
* @brief Check if the pseudo round function is supported
*/
static inline bool spi_flash_encrypt_ll_is_pseudo_rounds_function_supported(void)
{
return true;
} }
#ifdef __cplusplus #ifdef __cplusplus
components/esp_rom/esp32s31/include/esp32s31/rom/ecdsa.h
+5 -2
View File
@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -13,10 +13,13 @@ extern "C" {
#endif #endif
#define ETS_DIGEST_LEN 32 /* SHA-256, bytes */ #define ETS_DIGEST_LEN 32 /* SHA-256, bytes */
#define ETS_DIGEST_SHA256_LEN 32 /* SHA-256, bytes */
#define ETS_DIGEST_SHA384_LEN 48 /* SHA-384, bytes */
typedef enum { typedef enum {
ECDSA_CURVE_P192 = 1, ECDSA_CURVE_P192 = 1,
ECDSA_CURVE_P256 = 2 ECDSA_CURVE_P256 = 2,
ECDSA_CURVE_P384 = 3
} ECDSA_CURVE; } ECDSA_CURVE;
int ets_ecdsa_verify(const uint8_t *key, const uint8_t *sig, ECDSA_CURVE curve_id, const uint8_t *digest, uint8_t *verified_digest); int ets_ecdsa_verify(const uint8_t *key, const uint8_t *sig, ECDSA_CURVE curve_id, const uint8_t *digest, uint8_t *verified_digest);
components/esp_rom/esp32s31/include/esp32s31/rom/secure_boot.h
+21 -1
View File
@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -88,6 +88,25 @@ struct ets_secure_boot_sig_block {
#elif CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME #elif CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
struct __attribute((packed)) ets_secure_boot_sig_block {
uint8_t magic_byte;
uint8_t version;
uint8_t sha_version;
uint8_t _reserved2;
uint8_t image_digest[48];
struct {
struct {
uint8_t curve_id;
uint8_t point[96]; /* X followed by Y (both little-endian) */
} key;
uint8_t signature[96]; /* r followed by s (both little-endian) */
uint8_t padding[951];
} ecdsa;
uint32_t block_crc;
uint8_t _padding[16];
};
#else
struct __attribute((packed)) ets_secure_boot_sig_block { struct __attribute((packed)) ets_secure_boot_sig_block {
uint8_t magic_byte; uint8_t magic_byte;
uint8_t version; uint8_t version;
@@ -106,6 +125,7 @@ struct __attribute((packed)) ets_secure_boot_sig_block {
uint8_t _padding[16]; uint8_t _padding[16];
}; };
#endif #endif
#endif
ESP_STATIC_ASSERT(sizeof(ets_secure_boot_sig_block_t) == 1216, "invalid sig block size"); ESP_STATIC_ASSERT(sizeof(ets_secure_boot_sig_block_t) == 1216, "invalid sig block size");
components/esp_security/src/init.c
+5 -5
View File
@@ -115,14 +115,14 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
#endif #endif
#if !CONFIG_SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA #if !CONFIG_SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA
// C5 #if SOC_EFUSE_SECURE_BOOT_P384_WR_DIS && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS && !CONFIG_IDF_TARGET_ESP32P4
// Since SECURE_BOOT_SHA384_EN, XTS_DPA_PSEUDO_LEVEL, and ECC_FORCE_CONST_TIME share the // Since SECURE_BOOT_SHA384_EN, XTS_DPA_PSEUDO_LEVEL, and ECC_FORCE_CONST_TIME share the
// same write-protection bit, these efuses should only be write-protected after all of // same write-protection bit, these efuses should only be write-protected after all of
// them have been programmed. // them have been programmed.
// Note: ESP32-P4 lacks WR_DIS_SECURE_BOOT_SHA384_EN bit, so it relies on software protection // Note: targets without SOC_EFUSE_SECURE_BOOT_P384_WR_DIS (e.g. ESP32-P4, ESP32-S31) lack
// in the efuse write APIs (see esp_efuse_api.c) to prevent unauthorized programming of // the WR_DIS_SECURE_BOOT_SHA384_EN bit and rely on software protection in the efuse write
// SECURE_BOOT_SHA384_EN when Secure Boot using SHA-256 is enabled. // APIs (see esp_efuse_api.c) to prevent unauthorized programming of SECURE_BOOT_SHA384_EN
// when Secure Boot using SHA-256 is enabled.
err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN); err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN);
if (err != ESP_OK) { if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to write protect the SECURE_BOOT_SHA384_EN efuse bit."); ESP_LOGE(TAG, "Failed to write protect the SECURE_BOOT_SHA384_EN efuse bit.");
components/soc/esp32s31/include/soc/Kconfig.soc_caps.in
+60
View File
@@ -199,6 +199,14 @@ config SOC_ECDSA_SUPPORTED
bool bool
default y default y
config SOC_FLASH_ENC_SUPPORTED
bool
default y
config SOC_SECURE_BOOT_SUPPORTED
bool
default y
config SOC_BOD_SUPPORTED config SOC_BOD_SUPPORTED
bool bool
default y default y
@@ -1139,6 +1147,14 @@ config SOC_EFUSE_ECDSA_KEY_P384
bool bool
default y default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_EFUSE_XTS_AES_KEY_256
bool
default y
config SOC_HUK_SUPPORTED config SOC_HUK_SUPPORTED
bool bool
default y default y
@@ -1155,6 +1171,18 @@ config SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
bool bool
default y default y
config SOC_KEY_MANAGER_FE_KEY_DEPLOY
bool
default y
config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
bool
default y
config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256
bool
default y
config SOC_KEY_MANAGER_HMAC_KEY_DEPLOY config SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
bool bool
default y default y
@@ -1167,14 +1195,46 @@ config SOC_LCDCAM_CAM_SUPPORT_RGB_YUV_CONV
bool bool
default y default y
config SOC_SECURE_BOOT_V2_RSA
bool
default y
config SOC_SECURE_BOOT_V2_ECC
bool
default n
config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS
int int
default 3 default 3
config SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
bool
default y
config SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES config SOC_FLASH_ENCRYPTION_XTS_AES
bool bool
default y default y
config SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_128
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_256
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
bool
default y
config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX
int int
default 64 default 64
components/soc/esp32s31/include/soc/soc_caps.h
+15 -6
View File
@@ -75,8 +75,8 @@
#define SOC_ECC_SUPPORTED 1 #define SOC_ECC_SUPPORTED 1
#define SOC_ECC_EXTENDED_MODES_SUPPORTED 1 #define SOC_ECC_EXTENDED_MODES_SUPPORTED 1
#define SOC_ECDSA_SUPPORTED 1 #define SOC_ECDSA_SUPPORTED 1
// #define SOC_FLASH_ENC_SUPPORTED 1 // TODO: [ESP32S31] IDF-14628 #define SOC_FLASH_ENC_SUPPORTED 1
// #define SOC_SECURE_BOOT_SUPPORTED 1 // TODO: [ESP32S31] IDF-14629 #define SOC_SECURE_BOOT_SUPPORTED 1
#define SOC_BOD_SUPPORTED 1 #define SOC_BOD_SUPPORTED 1
// #define SOC_APM_SUPPORTED 1 // TODO: [ESP32S31] IDF-14620 // #define SOC_APM_SUPPORTED 1 // TODO: [ESP32S31] IDF-14620
#define SOC_PAU_SUPPORTED 1 #define SOC_PAU_SUPPORTED 1
@@ -431,29 +431,38 @@
#define SOC_EFUSE_ECDSA_KEY 1 #define SOC_EFUSE_ECDSA_KEY 1
#define SOC_EFUSE_ECDSA_KEY_P192 1 #define SOC_EFUSE_ECDSA_KEY_P192 1
#define SOC_EFUSE_ECDSA_KEY_P384 1 #define SOC_EFUSE_ECDSA_KEY_P384 1
#define SOC_EFUSE_XTS_AES_KEY_128 1
#define SOC_EFUSE_XTS_AES_KEY_256 1
/*-------------------------- HUK CAPS----------------------------*/ /*-------------------------- HUK CAPS----------------------------*/
#define SOC_HUK_SUPPORTED 1 #define SOC_HUK_SUPPORTED 1
/*-------------------------- Key Manager CAPS----------------------------*/ /*-------------------------- Key Manager CAPS----------------------------*/
// TODO: [ESP32S31] IDF-14626
#define SOC_KEY_MANAGER_SUPPORTED 1 #define SOC_KEY_MANAGER_SUPPORTED 1
#define SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT 1 /*!< Key manager supports key deployment */ #define SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT 1 /*!< Key manager supports key deployment */
#define SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY 1 /*!< Key manager responsible to deploy ECDSA key */ #define SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY 1 /*!< Key manager responsible to deploy ECDSA key */
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY 1 /*!< Key manager responsible to deploy Flash Encryption key */
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 1 /*!< Key manager responsible to deploy the XTS-AES-128 key */
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 1 /*!< Key manager responsible to deploy the XTS-AES-256 key */
#define SOC_KEY_MANAGER_HMAC_KEY_DEPLOY 1 /*!< Key manager responsible to deploy HMAC key */ #define SOC_KEY_MANAGER_HMAC_KEY_DEPLOY 1 /*!< Key manager responsible to deploy HMAC key */
#define SOC_KEY_MANAGER_DS_KEY_DEPLOY 1 /*!< Key manager responsible to deploy DS key */ #define SOC_KEY_MANAGER_DS_KEY_DEPLOY 1 /*!< Key manager responsible to deploy DS key */
// SOC_KEY_MANAGER_FE_KEY_DEPLOY (incl. XTS-AES-128/256) will be enabled along with Flash Encryption support.
/*--------------------------- CAM ---------------------------------*/ /*--------------------------- CAM ---------------------------------*/
#define SOC_LCDCAM_CAM_SUPPORT_RGB_YUV_CONV (1) #define SOC_LCDCAM_CAM_SUPPORT_RGB_YUV_CONV (1)
/*-------------------------- Secure Boot CAPS----------------------------*/ /*-------------------------- Secure Boot CAPS----------------------------*/
// TODO: [ESP32S31] IDF-14629 #define SOC_SECURE_BOOT_V2_RSA 1
#define SOC_SECURE_BOOT_V2_ECC 0
#define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3 #define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS 3
#define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS 1
#define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY 1
/*-------------------------- Flash Encryption CAPS----------------------------*/ /*-------------------------- Flash Encryption CAPS----------------------------*/
// TODO: [ESP32S31] IDF-14628
#define SOC_FLASH_ENCRYPTION_XTS_AES 1 #define SOC_FLASH_ENCRYPTION_XTS_AES 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1 /* SOC_EFUSE_XTS_AES_KEY_128 (1) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 (1) */
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1 /* SOC_EFUSE_XTS_AES_KEY_256 (1) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 (1) */
#define SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND 1
#define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64) #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64)
/*------------------------Bootloader CAPS---------------------------------*/ /*------------------------Bootloader CAPS---------------------------------*/
docs/en/security/esp32s31_log.inc
+282 -113
View File
@@ -3,129 +3,298 @@
.. code-block:: none .. code-block:: none
ESP-ROM:esp32s31-20210327 ESP-ROM:esp32s31-20251218
Build:Mar 27 2021 Build:Jan 21 2026
rst:0x1 (POWERON),boot:0x8 (SPI_FAST_FLASH_BOOT) rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT)
SPIWP:0xee SPI mode:DIO, clock div:1
mode:DIO, clock div:1 load:0x2f074230,len:0x2944
load:0x3fcd0270,len:0x2598 load:0x2f06a2b0,len:0xa20
load:0x403b6000,len:0x878 load:0x2f06cfb0,len:0x4690
load:0x403ba000,len:0x3dd4 entry 0x2f06a304
entry 0x403b61c0 I (33) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader
I (27) boot: ESP-IDF v4.4-dev-2003-g72fdecc1b7-dirty 2nd stage bootloader I (34) boot: compile time May 22 2026 17:30:12
I (28) boot: compile time 14:15:37 I (35) boot: Multicore bootloader
I (28) boot: chip revision: 0 I (38) boot: chip revision: v0.0
I (32) boot.esp32s31: SPI Speed : 80MHz I (39) boot: efuse block revision: v0.0
I (36) boot.esp32s31: SPI Mode : DIO I (42) boot.esp32s31: SPI Speed : 80MHz
I (41) boot.esp32s31: SPI Flash Size : 2MB I (46) boot.esp32s31: SPI Mode : DIO
I (46) boot: Enabling RNG early entropy source... I (50) boot.esp32s31: SPI Flash Size : 4MB
I (58) boot: Partition Table: I (54) boot: Enabling RNG early entropy source...
I (62) boot: ## Label Usage Type ST Offset Length I (59) boot: Partition Table:
I (69) boot: 0 nvs WiFi data 01 02 0000a000 00006000 I (61) boot: ## Label Usage Type ST Offset Length
I (76) boot: 1 storage Unknown data 01 ff 00010000 00001000 I (67) boot: 0 nvs WiFi data 01 02 0000e000 00006000
I (84) boot: 2 factory factory app 00 00 00020000 00100000 I (74) boot: 1 storage Unknown data 01 ff 00014000 00001000
I (91) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 I (80) boot: 2 factory factory app 00 00 00020000 00100000
I (99) boot: End of partition table I (87) boot: 3 nvs_key NVS keys 01 04 00120000 00001000
I (103) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map I (93) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000
I (117) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) load I (100) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000
I (122) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) load I (107) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000
I (134) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map I (115) boot: End of partition table
I (156) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) load I (117) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (162) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) load I (145) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load
I (167) boot: Loaded app from partition at offset 0x20000 I (157) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (168) boot: Checking flash encryption... I (201) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load
I (173) efuse: Batch mode of writing fields is enabled I (209) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load
I (179) flash_encrypt: Generating new flash encryption key... I (221) boot: Loaded app from partition at offset 0x20000
I (188) efuse: Writing EFUSE_BLK_KEY0 with purpose 4 I (222) boot: Checking flash encryption...
W (194) flash_encrypt: Not disabling UART bootloader encryption I (223) efuse: Batch mode of writing fields is enabled
I (197) flash_encrypt: Disable UART bootloader cache... I (224) flash_encrypt: Generating new flash encryption key...
I (203) flash_encrypt: Disable JTAG... I (244) efuse: Writing EFUSE_BLK_KEY0 with purpose 2
I (212) efuse: Batch mode. Prepared fields are committed I (249) efuse: Writing EFUSE_BLK_KEY1 with purpose 3
I (214) esp_image: segment 0: paddr=00000020 vaddr=3fcd0270 size=02598h ( 9624) I (259) flash_encrypt: Disable UART bootloader cache...
I (223) esp_image: segment 1: paddr=000025c0 vaddr=403b6000 size=00878h ( 2168) I (264) flash_encrypt: Disable JTAG...
I (230) esp_image: segment 2: paddr=00002e40 vaddr=403ba000 size=03dd4h ( 15828) I (269) efuse: BURN BLOCK5
I (534) flash_encrypt: bootloader encrypted successfully I (272) efuse: BURN BLOCK5 - OK (write block == read block)
I (578) flash_encrypt: partition table encrypted and loaded successfully I (277) efuse: BURN BLOCK4
I (578) flash_encrypt: Encrypting partition 1 at offset 0x10000 (length 0x1000)... I (279) efuse: BURN BLOCK4 - OK (write block == read block)
I (628) flash_encrypt: Done encrypting I (283) efuse: BURN BLOCK0
I (629) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map I (287) efuse: BURN BLOCK0 - OK (write block == read block)
I (636) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) I (291) efuse: BURN BLOCK0
I (640) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) I (294) efuse: BURN BLOCK0 - OK (all write block bits are set)
I (651) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map I (298) efuse: Batch mode. Prepared fields are committed
I (675) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) I (304) esp_image: segment 0: paddr=00002020 vaddr=2f074230 size=02944h ( 10564)
I (679) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) I (314) esp_image: segment 1: paddr=0000496c vaddr=2f06a2b0 size=00a20h ( 2592)
I (680) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x100000)... I (320) esp_image: segment 2: paddr=00005394 vaddr=2f06cfb0 size=04690h ( 18064)
I (11571) flash_encrypt: Done encrypting I (1187) flash_encrypt: bootloader encrypted successfully
I (11571) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)... I (1292) flash_encrypt: partition table encrypted and loaded successfully
I (11617) flash_encrypt: Done encrypting I (1293) flash_encrypt: Encrypting partition 1 at offset 0x14000 (length 0x1000)...
I (11618) flash_encrypt: Flash encryption completed I (1398) flash_encrypt: Done encrypting
I (11623) boot: Resetting with flash encryption enabled... I (1400) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (1415) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408)
I (1426) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (1470) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356)
I (1477) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480)
I (1484) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x379a0)...
I (7433) flash_encrypt: Done encrypting
I (7433) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)...
I (7529) flash_encrypt: Done encrypting
I (7529) flash_encrypt: Encrypting partition 5 at offset 0x127000 (length 0x96000)...
I (22094) flash_encrypt: Done encrypting
I (22095) efuse: BURN BLOCK0
I (22096) efuse: BURN BLOCK0 - OK (all write block bits are set)
I (22098) flash_encrypt: Flash encryption completed
I (22099) boot: Resetting with flash encryption enabled...
------ ------
.. first_boot_enc_km
.. code-block:: none
ESP-ROM:esp32s31-20251218
Build:Jan 21 2026
rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT)
SPI mode:DIO, clock div:1
load:0x2f074230,len:0x2964
load:0x2f06a2b0,len:0xa20
load:0x2f06cfb0,len:0x4b24
entry 0x2f06a304
I (33) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader
I (34) boot: compile time May 22 2026 17:33:18
I (35) boot: Multicore bootloader
I (38) boot: chip revision: v0.0
I (39) boot: efuse block revision: v0.0
I (42) boot.esp32s31: SPI Speed : 80MHz
I (46) boot.esp32s31: SPI Mode : DIO
I (50) boot.esp32s31: SPI Flash Size : 4MB
I (54) boot: Enabling RNG early entropy source...
I (59) boot: Partition Table:
I (61) boot: ## Label Usage Type ST Offset Length
I (67) boot: 0 nvs WiFi data 01 02 0000e000 00006000
I (74) boot: 1 storage Unknown data 01 ff 00014000 00001000
I (80) boot: 2 factory factory app 00 00 00020000 00100000
I (87) boot: 3 nvs_key NVS keys 01 04 00120000 00001000
I (93) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000
I (100) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000
I (107) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000
I (115) boot: End of partition table
I (117) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (145) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load
I (157) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (201) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load
I (209) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load
I (221) boot: Loaded app from partition at offset 0x20000
I (222) boot: Checking flash encryption...
I (223) efuse: Batch mode of writing fields is enabled
I (224) flash_encrypt: Deploying new flash encryption key using Key Manager
I (383) flash_encrypt: Disable UART bootloader cache...
I (384) flash_encrypt: Disable JTAG...
I (385) efuse: BURN BLOCK0
I (389) efuse: BURN BLOCK0 - OK (write block == read block)
I (393) efuse: Batch mode. Prepared fields are committed
I (398) esp_image: segment 0: paddr=00002020 vaddr=2f074230 size=02964h ( 10596)
I (409) esp_image: segment 1: paddr=0000498c vaddr=2f06a2b0 size=00a20h ( 2592)
I (415) esp_image: segment 2: paddr=000053b4 vaddr=2f06cfb0 size=04b24h ( 19236)
I (1267) flash_encrypt: bootloader encrypted successfully
I (1368) flash_encrypt: partition table encrypted and loaded successfully
I (1369) flash_encrypt: Encrypting partition 1 at offset 0x14000 (length 0x1000)...
I (1472) flash_encrypt: Done encrypting
I (1473) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (1489) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408)
I (1499) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (1543) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356)
I (1551) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480)
I (1558) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x379a0)...
I (7451) flash_encrypt: Done encrypting
I (7451) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)...
I (7548) flash_encrypt: Done encrypting
I (7549) flash_encrypt: Encrypting partition 5 at offset 0x127000 (length 0x96000)...
I (22115) flash_encrypt: Done encrypting
I (22116) efuse: BURN BLOCK0
I (22118) efuse: BURN BLOCK0 - OK (all write block bits are set)
I (22119) flash_encrypt: Flash encryption completed
I (22121) boot: Resetting with flash encryption enabled...
------
.. already_en_enc .. already_en_enc
.. code-block:: none .. code-block:: none
ESP-ROM:esp32s31-20210327 ESP-ROM:esp32s31-20251218
Build:Mar 27 2021 Build:Jan 21 2026
rst:0x3 (RTC_SW_SYS_RST),boot:0x8 (SPI_FAST_FLASH_BOOT) rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT)
Saved PC:0x403bb1d6 use legacy efuse key
SPIWP:0xee SPI mode:DIO, clock div:1
mode:DIO, clock div:1 load:0x2f074230,len:0x2944
load:0x3fcd0270,len:0x2598 load:0x2f06a2b0,len:0xa20
load:0x403b6000,len:0x878 load:0x2f06cfb0,len:0x4690
load:0x403ba000,len:0x3dd4 entry 0x2f06a304
entry 0x403b61c0 I (35) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader
I (35) boot: ESP-IDF v4.4-dev-2003-g72fdecc1b7-dirty 2nd stage bootloader I (36) boot: compile time May 22 2026 17:30:12
I (35) boot: compile time 14:15:37 I (37) boot: Multicore bootloader
I (35) boot: chip revision: 0 I (40) boot: chip revision: v0.0
I (39) boot.esp32s31: SPI Speed : 80MHz I (41) boot: efuse block revision: v0.0
I (44) boot.esp32s31: SPI Mode : DIO I (44) boot.esp32s31: SPI Speed : 80MHz
I (48) boot.esp32s31: SPI Flash Size : 2MB I (48) boot.esp32s31: SPI Mode : DIO
I (53) boot: Enabling RNG early entropy source... I (52) boot.esp32s31: SPI Flash Size : 4MB
I (65) boot: Partition Table: I (56) boot: Enabling RNG early entropy source...
I (69) boot: ## Label Usage Type ST Offset Length I (61) boot: Partition Table:
I (76) boot: 0 nvs WiFi data 01 02 0000a000 00006000 I (63) boot: ## Label Usage Type ST Offset Length
I (84) boot: 1 storage Unknown data 01 ff 00010000 00001000 I (69) boot: 0 nvs WiFi data 01 02 0000e000 00006000
I (91) boot: 2 factory factory app 00 00 00020000 00100000 I (76) boot: 1 storage Unknown data 01 ff 00014000 00001000
I (99) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 I (82) boot: 2 factory factory app 00 00 00020000 00100000
I (106) boot: End of partition table I (89) boot: 3 nvs_key NVS keys 01 04 00120000 00001000
I (110) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map I (95) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000
I (126) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) load I (102) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000
I (129) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) load I (108) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000
I (141) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map I (117) boot: End of partition table
I (166) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) load I (119) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (172) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) load I (149) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load
I (177) boot: Loaded app from partition at offset 0x20000 I (162) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (178) boot: Checking flash encryption... I (212) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load
I (183) flash_encrypt: flash encryption is enabled (1 plaintext flashes left) I (221) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load
I (190) boot: Disabling RNG early entropy source... I (233) boot: Loaded app from partition at offset 0x20000
I (214) cpu_start: Pro cpu up. I (234) boot: Checking flash encryption...
I (214) cpu_start: Starting app cpu, entry point is 0x40374fa8 I (234) flash_encrypt: flash encryption is enabled (1 plaintext flashes left)
I (0) cpu_start: App cpu up. I (237) boot: Disabling RNG early entropy source...
I (228) cpu_start: Pro cpu start user code I (254) cpu_start: Multicore app
I (228) cpu_start: cpu freq: 160000000 I (257) cpu_start: Pro cpu start user code
I (228) cpu_start: Application information: I (258) cpu_start: cpu freq: 40000000 Hz
I (231) cpu_start: Project name: flash_encryption I (262) app_init: Application information:
I (237) cpu_start: App version: v4.4-dev-2003-g72fdecc1b7-dirty I (266) app_init: Project name: flash_encryption
I (244) cpu_start: Compile time: Jul 12 2021 14:15:34 I (270) app_init: App version: v6.1-dev-5047-ga20ab68fd55-dirt
I (250) cpu_start: ELF file SHA256: a7e6343c6a1c2215... I (276) app_init: Compile time: May 22 2026 17:30:25
I (256) cpu_start: ESP-IDF: v4.4-dev-2003-g72fdecc1b7-dirty I (281) app_init: ELF file SHA256: cebb4e540...
I (263) heap_init: Initializing. RAM available for dynamic allocation: I (286) app_init: ESP-IDF: v6.1-dev-5047-ga20ab68fd55-dirt
I (270) heap_init: At 3FC92810 len 0004D7F0 (309 KiB): D/IRAM I (292) efuse_init: Min chip rev: v0.0
I (277) heap_init: At 3FCE0000 len 0000EE34 (59 KiB): STACK/DRAM I (295) efuse_init: Max chip rev: v0.99
I (283) heap_init: At 3FCF0000 len 00008000 (32 KiB): DRAM I (299) efuse_init: Chip rev: v0.0
I (290) spi_flash: detected chip: generic I (303) heap_init: Initializing. RAM available for dynamic allocation:
I (294) spi_flash: flash io: dio I (310) heap_init: At 2F00DA20 len 0006D590 (437 KiB): RAM
W (298) spi_flash: Detected size(8192k) larger than the size in the binary image header(2048k). Using the size in the binary image header. I (315) heap_init: At 2F07AFB0 len 000041C0 (16 KiB): RAM
I (311) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure) I (320) heap_init: At 2E000000 len 00007FE8 (31 KiB): RTCRAM
I (318) cpu_start: Starting scheduler on PRO CPU. I (327) spi_flash: detected chip: gd
I (0) cpu_start: Starting scheduler on APP CPU. I (329) spi_flash: flash io: dio
W (332) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure)
I (339) sleep_gpio: Configure to isolate all GPIO pins in sleep state
I (345) sleep_gpio: Enable automatic switching of GPIO sleep configuration
I (353) main_task: Started on CPU0
I (373) main_task: Calling app_main()
Example to check Flash Encryption status Example to check Flash Encryption status
This is esp32s31 chip with 2 CPU core(s), WiFi/BLE/IEEE802.15.4, silicon revision 0, 2MB external flash This is esp32s31 chip with 2 CPU core(s), WiFi/BLE, silicon revision v0.0, 4MB external flash
FLASH_CRYPT_CNT eFuse value is 1 FLASH_CRYPT_CNT eFuse value is 1
Flash encryption feature is enabled in DEVELOPMENT mode Flash encryption feature is enabled in DEVELOPMENT mode
------
.. already_en_enc_km
.. code-block:: none
ESP-ROM:esp32s31-20251218
Build:Jan 21 2026
rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT)
use sector0 for km info
use KM derived key
SPI mode:DIO, clock div:1
load:0x2f074230,len:0x2964
load:0x2f06a2b0,len:0xa20
load:0x2f06cfb0,len:0x4b24
entry 0x2f06a304
I (37) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader
I (38) boot: compile time May 22 2026 17:33:18
I (39) boot: Multicore bootloader
I (42) boot: chip revision: v0.0
I (43) boot: efuse block revision: v0.0
I (46) boot.esp32s31: SPI Speed : 80MHz
I (50) boot.esp32s31: SPI Mode : DIO
I (54) boot.esp32s31: SPI Flash Size : 4MB
I (58) boot: Enabling RNG early entropy source...
I (62) boot: Partition Table:
I (65) boot: ## Label Usage Type ST Offset Length
I (71) boot: 0 nvs WiFi data 01 02 0000e000 00006000
I (78) boot: 1 storage Unknown data 01 ff 00014000 00001000
I (84) boot: 2 factory factory app 00 00 00020000 00100000
I (91) boot: 3 nvs_key NVS keys 01 04 00120000 00001000
I (97) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000
I (104) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000
I (110) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000
I (119) boot: End of partition table
I (121) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (151) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load
I (164) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (214) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load
I (223) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load
I (235) boot: Loaded app from partition at offset 0x20000
I (236) boot: Checking flash encryption...
I (236) flash_encrypt: flash encryption is enabled (1 plaintext flashes left)
I (239) boot: Disabling RNG early entropy source...
I (256) cpu_start: Multicore app
I (259) cpu_start: Pro cpu start user code
I (260) cpu_start: cpu freq: 40000000 Hz
I (264) app_init: Application information:
I (268) app_init: Project name: flash_encryption
I (272) app_init: App version: v6.1-dev-5047-ga20ab68fd55-dirt
I (278) app_init: Compile time: May 22 2026 17:33:32
I (283) app_init: ELF file SHA256: 3907456c7...
I (288) app_init: ESP-IDF: v6.1-dev-5047-ga20ab68fd55-dirt
I (294) efuse_init: Min chip rev: v0.0
I (297) efuse_init: Max chip rev: v0.99
I (301) efuse_init: Chip rev: v0.0
I (305) heap_init: Initializing. RAM available for dynamic allocation:
I (312) heap_init: At 2F00DA20 len 0006D590 (437 KiB): RAM
I (317) heap_init: At 2F07AFB0 len 000041C0 (16 KiB): RAM
I (322) heap_init: At 2E000000 len 00007FE8 (31 KiB): RTCRAM
I (329) spi_flash: detected chip: gd
I (331) spi_flash: flash io: dio
W (334) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure)
I (341) sleep_gpio: Configure to isolate all GPIO pins in sleep state
I (347) sleep_gpio: Enable automatic switching of GPIO sleep configuration
I (355) main_task: Started on CPU0
I (375) main_task: Calling app_main()
Example to check Flash Encryption status
This is esp32s31 chip with 2 CPU core(s), WiFi/BLE, silicon revision v0.0, 4MB external flash
FLASH_CRYPT_CNT eFuse value is 1
Flash encryption feature is enabled in DEVELOPMENT mode
------ ------
docs/zh_CN/security/esp32s31_log.inc
+282 -113
View File
@@ -3,129 +3,298 @@
.. code-block:: none .. code-block:: none
ESP-ROM:esp32s31-20210327 ESP-ROM:esp32s31-20251218
Build:Mar 27 2021 Build:Jan 21 2026
rst:0x1 (POWERON),boot:0x8 (SPI_FAST_FLASH_BOOT) rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT)
SPIWP:0xee SPI mode:DIO, clock div:1
mode:DIO, clock div:1 load:0x2f074230,len:0x2944
load:0x3fcd0270,len:0x2598 load:0x2f06a2b0,len:0xa20
load:0x403b6000,len:0x878 load:0x2f06cfb0,len:0x4690
load:0x403ba000,len:0x3dd4 entry 0x2f06a304
entry 0x403b61c0 I (33) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader
I (27) boot: ESP-IDF v4.4-dev-2003-g72fdecc1b7-dirty 2nd stage bootloader I (34) boot: compile time May 22 2026 17:30:12
I (28) boot: compile time 14:15:37 I (35) boot: Multicore bootloader
I (28) boot: chip revision: 0 I (38) boot: chip revision: v0.0
I (32) boot.esp32s31: SPI Speed : 80MHz I (39) boot: efuse block revision: v0.0
I (36) boot.esp32s31: SPI Mode : DIO I (42) boot.esp32s31: SPI Speed : 80MHz
I (41) boot.esp32s31: SPI Flash Size : 2MB I (46) boot.esp32s31: SPI Mode : DIO
I (46) boot: Enabling RNG early entropy source... I (50) boot.esp32s31: SPI Flash Size : 4MB
I (58) boot: Partition Table: I (54) boot: Enabling RNG early entropy source...
I (62) boot: ## Label Usage Type ST Offset Length I (59) boot: Partition Table:
I (69) boot: 0 nvs WiFi data 01 02 0000a000 00006000 I (61) boot: ## Label Usage Type ST Offset Length
I (76) boot: 1 storage Unknown data 01 ff 00010000 00001000 I (67) boot: 0 nvs WiFi data 01 02 0000e000 00006000
I (84) boot: 2 factory factory app 00 00 00020000 00100000 I (74) boot: 1 storage Unknown data 01 ff 00014000 00001000
I (91) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 I (80) boot: 2 factory factory app 00 00 00020000 00100000
I (99) boot: End of partition table I (87) boot: 3 nvs_key NVS keys 01 04 00120000 00001000
I (103) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map I (93) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000
I (117) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) load I (100) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000
I (122) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) load I (107) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000
I (134) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map I (115) boot: End of partition table
I (156) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) load I (117) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (162) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) load I (145) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load
I (167) boot: Loaded app from partition at offset 0x20000 I (157) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (168) boot: Checking flash encryption... I (201) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load
I (173) efuse: Batch mode of writing fields is enabled I (209) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load
I (179) flash_encrypt: Generating new flash encryption key... I (221) boot: Loaded app from partition at offset 0x20000
I (188) efuse: Writing EFUSE_BLK_KEY0 with purpose 4 I (222) boot: Checking flash encryption...
W (194) flash_encrypt: Not disabling UART bootloader encryption I (223) efuse: Batch mode of writing fields is enabled
I (197) flash_encrypt: Disable UART bootloader cache... I (224) flash_encrypt: Generating new flash encryption key...
I (203) flash_encrypt: Disable JTAG... I (244) efuse: Writing EFUSE_BLK_KEY0 with purpose 2
I (212) efuse: Batch mode. Prepared fields are committed I (249) efuse: Writing EFUSE_BLK_KEY1 with purpose 3
I (214) esp_image: segment 0: paddr=00000020 vaddr=3fcd0270 size=02598h ( 9624) I (259) flash_encrypt: Disable UART bootloader cache...
I (223) esp_image: segment 1: paddr=000025c0 vaddr=403b6000 size=00878h ( 2168) I (264) flash_encrypt: Disable JTAG...
I (230) esp_image: segment 2: paddr=00002e40 vaddr=403ba000 size=03dd4h ( 15828) I (269) efuse: BURN BLOCK5
I (534) flash_encrypt: bootloader encrypted successfully I (272) efuse: BURN BLOCK5 - OK (write block == read block)
I (578) flash_encrypt: partition table encrypted and loaded successfully I (277) efuse: BURN BLOCK4
I (578) flash_encrypt: Encrypting partition 1 at offset 0x10000 (length 0x1000)... I (279) efuse: BURN BLOCK4 - OK (write block == read block)
I (628) flash_encrypt: Done encrypting I (283) efuse: BURN BLOCK0
I (629) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map I (287) efuse: BURN BLOCK0 - OK (write block == read block)
I (636) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) I (291) efuse: BURN BLOCK0
I (640) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) I (294) efuse: BURN BLOCK0 - OK (all write block bits are set)
I (651) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map I (298) efuse: Batch mode. Prepared fields are committed
I (675) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) I (304) esp_image: segment 0: paddr=00002020 vaddr=2f074230 size=02944h ( 10564)
I (679) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) I (314) esp_image: segment 1: paddr=0000496c vaddr=2f06a2b0 size=00a20h ( 2592)
I (680) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x100000)... I (320) esp_image: segment 2: paddr=00005394 vaddr=2f06cfb0 size=04690h ( 18064)
I (11571) flash_encrypt: Done encrypting I (1187) flash_encrypt: bootloader encrypted successfully
I (11571) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)... I (1292) flash_encrypt: partition table encrypted and loaded successfully
I (11617) flash_encrypt: Done encrypting I (1293) flash_encrypt: Encrypting partition 1 at offset 0x14000 (length 0x1000)...
I (11618) flash_encrypt: Flash encryption completed I (1398) flash_encrypt: Done encrypting
I (11623) boot: Resetting with flash encryption enabled... I (1400) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (1415) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408)
I (1426) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (1470) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356)
I (1477) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480)
I (1484) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x379a0)...
I (7433) flash_encrypt: Done encrypting
I (7433) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)...
I (7529) flash_encrypt: Done encrypting
I (7529) flash_encrypt: Encrypting partition 5 at offset 0x127000 (length 0x96000)...
I (22094) flash_encrypt: Done encrypting
I (22095) efuse: BURN BLOCK0
I (22096) efuse: BURN BLOCK0 - OK (all write block bits are set)
I (22098) flash_encrypt: Flash encryption completed
I (22099) boot: Resetting with flash encryption enabled...
------ ------
.. first_boot_enc_km
.. code-block:: none
ESP-ROM:esp32s31-20251218
Build:Jan 21 2026
rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT)
SPI mode:DIO, clock div:1
load:0x2f074230,len:0x2964
load:0x2f06a2b0,len:0xa20
load:0x2f06cfb0,len:0x4b24
entry 0x2f06a304
I (33) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader
I (34) boot: compile time May 22 2026 17:33:18
I (35) boot: Multicore bootloader
I (38) boot: chip revision: v0.0
I (39) boot: efuse block revision: v0.0
I (42) boot.esp32s31: SPI Speed : 80MHz
I (46) boot.esp32s31: SPI Mode : DIO
I (50) boot.esp32s31: SPI Flash Size : 4MB
I (54) boot: Enabling RNG early entropy source...
I (59) boot: Partition Table:
I (61) boot: ## Label Usage Type ST Offset Length
I (67) boot: 0 nvs WiFi data 01 02 0000e000 00006000
I (74) boot: 1 storage Unknown data 01 ff 00014000 00001000
I (80) boot: 2 factory factory app 00 00 00020000 00100000
I (87) boot: 3 nvs_key NVS keys 01 04 00120000 00001000
I (93) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000
I (100) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000
I (107) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000
I (115) boot: End of partition table
I (117) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (145) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load
I (157) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (201) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load
I (209) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load
I (221) boot: Loaded app from partition at offset 0x20000
I (222) boot: Checking flash encryption...
I (223) efuse: Batch mode of writing fields is enabled
I (224) flash_encrypt: Deploying new flash encryption key using Key Manager
I (383) flash_encrypt: Disable UART bootloader cache...
I (384) flash_encrypt: Disable JTAG...
I (385) efuse: BURN BLOCK0
I (389) efuse: BURN BLOCK0 - OK (write block == read block)
I (393) efuse: Batch mode. Prepared fields are committed
I (398) esp_image: segment 0: paddr=00002020 vaddr=2f074230 size=02964h ( 10596)
I (409) esp_image: segment 1: paddr=0000498c vaddr=2f06a2b0 size=00a20h ( 2592)
I (415) esp_image: segment 2: paddr=000053b4 vaddr=2f06cfb0 size=04b24h ( 19236)
I (1267) flash_encrypt: bootloader encrypted successfully
I (1368) flash_encrypt: partition table encrypted and loaded successfully
I (1369) flash_encrypt: Encrypting partition 1 at offset 0x14000 (length 0x1000)...
I (1472) flash_encrypt: Done encrypting
I (1473) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (1489) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408)
I (1499) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (1543) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356)
I (1551) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480)
I (1558) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x379a0)...
I (7451) flash_encrypt: Done encrypting
I (7451) flash_encrypt: Encrypting partition 3 at offset 0x120000 (length 0x1000)...
I (7548) flash_encrypt: Done encrypting
I (7549) flash_encrypt: Encrypting partition 5 at offset 0x127000 (length 0x96000)...
I (22115) flash_encrypt: Done encrypting
I (22116) efuse: BURN BLOCK0
I (22118) efuse: BURN BLOCK0 - OK (all write block bits are set)
I (22119) flash_encrypt: Flash encryption completed
I (22121) boot: Resetting with flash encryption enabled...
------
.. already_en_enc .. already_en_enc
.. code-block:: none .. code-block:: none
ESP-ROM:esp32s31-20210327 ESP-ROM:esp32s31-20251218
Build:Mar 27 2021 Build:Jan 21 2026
rst:0x3 (RTC_SW_SYS_RST),boot:0x8 (SPI_FAST_FLASH_BOOT) rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT)
Saved PC:0x403bb1d6 use legacy efuse key
SPIWP:0xee SPI mode:DIO, clock div:1
mode:DIO, clock div:1 load:0x2f074230,len:0x2944
load:0x3fcd0270,len:0x2598 load:0x2f06a2b0,len:0xa20
load:0x403b6000,len:0x878 load:0x2f06cfb0,len:0x4690
load:0x403ba000,len:0x3dd4 entry 0x2f06a304
entry 0x403b61c0 I (35) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader
I (35) boot: ESP-IDF v4.4-dev-2003-g72fdecc1b7-dirty 2nd stage bootloader I (36) boot: compile time May 22 2026 17:30:12
I (35) boot: compile time 14:15:37 I (37) boot: Multicore bootloader
I (35) boot: chip revision: 0 I (40) boot: chip revision: v0.0
I (39) boot.esp32s31: SPI Speed : 80MHz I (41) boot: efuse block revision: v0.0
I (44) boot.esp32s31: SPI Mode : DIO I (44) boot.esp32s31: SPI Speed : 80MHz
I (48) boot.esp32s31: SPI Flash Size : 2MB I (48) boot.esp32s31: SPI Mode : DIO
I (53) boot: Enabling RNG early entropy source... I (52) boot.esp32s31: SPI Flash Size : 4MB
I (65) boot: Partition Table: I (56) boot: Enabling RNG early entropy source...
I (69) boot: ## Label Usage Type ST Offset Length I (61) boot: Partition Table:
I (76) boot: 0 nvs WiFi data 01 02 0000a000 00006000 I (63) boot: ## Label Usage Type ST Offset Length
I (84) boot: 1 storage Unknown data 01 ff 00010000 00001000 I (69) boot: 0 nvs WiFi data 01 02 0000e000 00006000
I (91) boot: 2 factory factory app 00 00 00020000 00100000 I (76) boot: 1 storage Unknown data 01 ff 00014000 00001000
I (99) boot: 3 nvs_key NVS keys 01 04 00120000 00001000 I (82) boot: 2 factory factory app 00 00 00020000 00100000
I (106) boot: End of partition table I (89) boot: 3 nvs_key NVS keys 01 04 00120000 00001000
I (110) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=08118h ( 33048) map I (95) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000
I (126) esp_image: segment 1: paddr=00028140 vaddr=3fc8fa30 size=023f4h ( 9204) load I (102) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000
I (129) esp_image: segment 2: paddr=0002a53c vaddr=40374000 size=05adch ( 23260) load I (108) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000
I (141) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=1a710h (108304) map I (117) boot: End of partition table
I (166) esp_image: segment 4: paddr=0004a738 vaddr=40379adc size=05f48h ( 24392) load I (119) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (172) esp_image: segment 5: paddr=00050688 vaddr=600fe000 size=00010h ( 16) load I (149) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load
I (177) boot: Loaded app from partition at offset 0x20000 I (162) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (178) boot: Checking flash encryption... I (212) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load
I (183) flash_encrypt: flash encryption is enabled (1 plaintext flashes left) I (221) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load
I (190) boot: Disabling RNG early entropy source... I (233) boot: Loaded app from partition at offset 0x20000
I (214) cpu_start: Pro cpu up. I (234) boot: Checking flash encryption...
I (214) cpu_start: Starting app cpu, entry point is 0x40374fa8 I (234) flash_encrypt: flash encryption is enabled (1 plaintext flashes left)
I (0) cpu_start: App cpu up. I (237) boot: Disabling RNG early entropy source...
I (228) cpu_start: Pro cpu start user code I (254) cpu_start: Multicore app
I (228) cpu_start: cpu freq: 160000000 I (257) cpu_start: Pro cpu start user code
I (228) cpu_start: Application information: I (258) cpu_start: cpu freq: 40000000 Hz
I (231) cpu_start: Project name: flash_encryption I (262) app_init: Application information:
I (237) cpu_start: App version: v4.4-dev-2003-g72fdecc1b7-dirty I (266) app_init: Project name: flash_encryption
I (244) cpu_start: Compile time: Jul 12 2021 14:15:34 I (270) app_init: App version: v6.1-dev-5047-ga20ab68fd55-dirt
I (250) cpu_start: ELF file SHA256: a7e6343c6a1c2215... I (276) app_init: Compile time: May 22 2026 17:30:25
I (256) cpu_start: ESP-IDF: v4.4-dev-2003-g72fdecc1b7-dirty I (281) app_init: ELF file SHA256: cebb4e540...
I (263) heap_init: Initializing. RAM available for dynamic allocation: I (286) app_init: ESP-IDF: v6.1-dev-5047-ga20ab68fd55-dirt
I (270) heap_init: At 3FC92810 len 0004D7F0 (309 KiB): D/IRAM I (292) efuse_init: Min chip rev: v0.0
I (277) heap_init: At 3FCE0000 len 0000EE34 (59 KiB): STACK/DRAM I (295) efuse_init: Max chip rev: v0.99
I (283) heap_init: At 3FCF0000 len 00008000 (32 KiB): DRAM I (299) efuse_init: Chip rev: v0.0
I (290) spi_flash: detected chip: generic I (303) heap_init: Initializing. RAM available for dynamic allocation:
I (294) spi_flash: flash io: dio I (310) heap_init: At 2F00DA20 len 0006D590 (437 KiB): RAM
W (298) spi_flash: Detected size(8192k) larger than the size in the binary image header(2048k). Using the size in the binary image header. I (315) heap_init: At 2F07AFB0 len 000041C0 (16 KiB): RAM
I (311) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure) I (320) heap_init: At 2E000000 len 00007FE8 (31 KiB): RTCRAM
I (318) cpu_start: Starting scheduler on PRO CPU. I (327) spi_flash: detected chip: gd
I (0) cpu_start: Starting scheduler on APP CPU. I (329) spi_flash: flash io: dio
W (332) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure)
I (339) sleep_gpio: Configure to isolate all GPIO pins in sleep state
I (345) sleep_gpio: Enable automatic switching of GPIO sleep configuration
I (353) main_task: Started on CPU0
I (373) main_task: Calling app_main()
Example to check Flash Encryption status Example to check Flash Encryption status
This is esp32s31 chip with 2 CPU core(s), WiFi/BLE/IEEE802.15.4, silicon revision 0, 2MB external flash This is esp32s31 chip with 2 CPU core(s), WiFi/BLE, silicon revision v0.0, 4MB external flash
FLASH_CRYPT_CNT eFuse value is 1 FLASH_CRYPT_CNT eFuse value is 1
Flash encryption feature is enabled in DEVELOPMENT mode Flash encryption feature is enabled in DEVELOPMENT mode
------
.. already_en_enc_km
.. code-block:: none
ESP-ROM:esp32s31-20251218
Build:Jan 21 2026
rst:0x1 (POWERON),boot:0x58 (SPI_FAST_FLASH_BOOT)
use sector0 for km info
use KM derived key
SPI mode:DIO, clock div:1
load:0x2f074230,len:0x2964
load:0x2f06a2b0,len:0xa20
load:0x2f06cfb0,len:0x4b24
entry 0x2f06a304
I (37) boot: ESP-IDF v6.1-dev-5047-ga20ab68fd55-dirt 2nd stage bootloader
I (38) boot: compile time May 22 2026 17:33:18
I (39) boot: Multicore bootloader
I (42) boot: chip revision: v0.0
I (43) boot: efuse block revision: v0.0
I (46) boot.esp32s31: SPI Speed : 80MHz
I (50) boot.esp32s31: SPI Mode : DIO
I (54) boot.esp32s31: SPI Flash Size : 4MB
I (58) boot: Enabling RNG early entropy source...
I (62) boot: Partition Table:
I (65) boot: ## Label Usage Type ST Offset Length
I (71) boot: 0 nvs WiFi data 01 02 0000e000 00006000
I (78) boot: 1 storage Unknown data 01 ff 00014000 00001000
I (84) boot: 2 factory factory app 00 00 00020000 00100000
I (91) boot: 3 nvs_key NVS keys 01 04 00120000 00001000
I (97) boot: 4 custom_nvs WiFi data 01 02 00121000 00006000
I (104) boot: 5 fat_encrypted Unknown data 01 81 00127000 00096000
I (110) boot: 6 fat_not_encr Unknown data 01 81 001bd000 00096000
I (119) boot: End of partition table
I (121) esp_image: segment 0: paddr=00020020 vaddr=40030020 size=09cb0h ( 40112) map
I (151) esp_image: segment 1: paddr=00029cd8 vaddr=2f000000 size=06340h ( 25408) load
I (164) esp_image: segment 2: paddr=00030020 vaddr=40000020 size=21c2ch (138284) map
I (214) esp_image: segment 3: paddr=00051c54 vaddr=2f006340 size=03814h ( 14356) load
I (223) esp_image: segment 4: paddr=00055470 vaddr=2f009b80 size=02508h ( 9480) load
I (235) boot: Loaded app from partition at offset 0x20000
I (236) boot: Checking flash encryption...
I (236) flash_encrypt: flash encryption is enabled (1 plaintext flashes left)
I (239) boot: Disabling RNG early entropy source...
I (256) cpu_start: Multicore app
I (259) cpu_start: Pro cpu start user code
I (260) cpu_start: cpu freq: 40000000 Hz
I (264) app_init: Application information:
I (268) app_init: Project name: flash_encryption
I (272) app_init: App version: v6.1-dev-5047-ga20ab68fd55-dirt
I (278) app_init: Compile time: May 22 2026 17:33:32
I (283) app_init: ELF file SHA256: 3907456c7...
I (288) app_init: ESP-IDF: v6.1-dev-5047-ga20ab68fd55-dirt
I (294) efuse_init: Min chip rev: v0.0
I (297) efuse_init: Max chip rev: v0.99
I (301) efuse_init: Chip rev: v0.0
I (305) heap_init: Initializing. RAM available for dynamic allocation:
I (312) heap_init: At 2F00DA20 len 0006D590 (437 KiB): RAM
I (317) heap_init: At 2F07AFB0 len 000041C0 (16 KiB): RAM
I (322) heap_init: At 2E000000 len 00007FE8 (31 KiB): RTCRAM
I (329) spi_flash: detected chip: gd
I (331) spi_flash: flash io: dio
W (334) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure)
I (341) sleep_gpio: Configure to isolate all GPIO pins in sleep state
I (347) sleep_gpio: Enable automatic switching of GPIO sleep configuration
I (355) main_task: Started on CPU0
I (375) main_task: Calling app_main()
Example to check Flash Encryption status
This is esp32s31 chip with 2 CPU core(s), WiFi/BLE, silicon revision v0.0, 4MB external flash
FLASH_CRYPT_CNT eFuse value is 1
Flash encryption feature is enabled in DEVELOPMENT mode
------ ------