Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ESP32] Support flash encryption and nvs encryption #20414

Merged
merged 1 commit into from
Jul 9, 2022
Merged

[ESP32] Support flash encryption and nvs encryption #20414

merged 1 commit into from
Jul 9, 2022

Conversation

shubhamdp
Copy link
Contributor

Problem

Change overview

  • Added an option to encrypt the factory partition.
  • Securely initialize the NVS partition if NVS encryption is enabled
  • Added user guide for flash encryption in lighting-app/esp32

Testing

  • Manually tested: Generated the encrypted factory partition and flashed it and performed commissioning

@github-actions
Copy link

github-actions bot commented Jul 7, 2022 •
edited
Loading

PR #20414: Size comparison from 1107d8e to 297b540

Increases (3 builds for cc13x2_26x2, cyw30739, telink)
platform target config section 1107d8e 297b540 change % change
cc13x2_26x2 shell LP_CC2652R7 (read/write) 188784 188792 8 0.0
cyw30739 ota-requestor-no-progress-logging cyw930739m2evb_01 (read/write) 582198 582206 8 0.0
.app_xip_area 461816 461824 8 0.0
telink light-switch-app tlsr9518adk80d (read/write) 796628 796636 8 0.0
text 565128 565130 2 0.0
Decreases (1 build for cc13x2_26x2)
platform target config section 1107d8e 297b540 change % change
cc13x2_26x2 shell LP_CC2652R7 (read only) 657942 657934 -8 -0.0
.text 572780 572772 -8 -0.0
Full report (30 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
platform target config section 1107d8e 297b540 change % change
cc13x2_26x2 all-clusters-app LP_CC2652R7 (read only) 665443 665443 0 0.0
(read/write) 185780 185780 0 0.0
.bss 74116 74116 0 0.0
.data 3356 3356 0 0.0
.rodata 88067 88067 0 0.0
.text 577060 577060 0 0.0
all-clusters-minimal-app LP_CC2652R7 (read only) 631443 631443 0 0.0
(read/write) 157684 157684 0 0.0
.bss 73412 73412 0 0.0
.data 3356 3356 0 0.0
.rodata 77307 77307 0 0.0
.text 553812 553812 0 0.0
lock-ftd LP_CC2652R7 (read only) 668343 668343 0 0.0
(read/write) 173024 173024 0 0.0
.bss 71148 71148 0 0.0
.data 3280 3280 0 0.0
.rodata 76207 76207 0 0.0
.text 591656 591656 0 0.0
lock-mtd LP_CC2652R7 (read only) 617759 617759 0 0.0
(read/write) 144264 144264 0 0.0
.bss 66868 66868 0 0.0
.data 3280 3280 0 0.0
.rodata 76087 76087 0 0.0
.text 541184 541184 0 0.0
pump-app LP_CC2652R7 (read only) 677703 677703 0 0.0
(read/write) 164512 164512 0 0.0
.bss 71228 71228 0 0.0
.data 3280 3280 0 0.0
.rodata 88431 88431 0 0.0
.text 588788 588788 0 0.0
pump-controller-app LP_CC2652R7 (read only) 663527 663527 0 0.0
(read/write) 178808 178808 0 0.0
.bss 71348 71348 0 0.0
.data 3276 3276 0 0.0
.rodata 84295 84295 0 0.0
.text 578752 578752 0 0.0
shell LP_CC2652R7 (read only) 657942 657934 -8 -0.0
(read/write) 188784 188792 8 0.0
.bss 76420 76420 0 0.0
.data 3360 3360 0 0.0
.rodata 84846 84846 0 0.0
.text 572780 572772 -8 -0.0
cyw30739 light cyw930739m2evb_01 (read/write) 579134 579134 0 0.0
.app_xip_area 457904 457904 0 0.0
.bss 64184 64184 0 0.0
.data 716 716 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
lock cyw930739m2evb_01 (read/write) 584862 584862 0 0.0
.app_xip_area 458896 458896 0 0.0
.bss 68912 68912 0 0.0
.data 720 720 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
ota-requestor-no-progress-logging cyw930739m2evb_01 (read/write) 582198 582206 8 0.0
.app_xip_area 461816 461824 8 0.0
.bss 63392 63392 0 0.0
.data 660 660 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
efr32 lighting-app BRD4161A (read/write) 1080652 1080652 0 0.0
.bss 132996 132996 0 0.0
.data 2048 2048 0 0.0
.text 945588 945588 0 0.0
BRD4161A+rpc (read only) 983040 983040 0 0.0
(read/write) 151948 151948 0 0.0
.bss 149676 149676 0 0.0
.data 2260 2260 0 0.0
.text 983032 983032 0 0.0
BRD4161A+rs911x (read/write) 946756 946756 0 0.0
.bss 140768 140768 0 0.0
.data 2048 2048 0 0.0
.text 803920 803920 0 0.0
lock-app BRD4161A+wf200 (read/write) 1127288 1127288 0 0.0
.bss 144184 144184 0 0.0
.data 2060 2060 0 0.0
.text 981020 981020 0 0.0
window-app BRD4161A (read/write) 1074436 1074436 0 0.0
.bss 134468 134468 0 0.0
.data 2076 2076 0 0.0
.text 937868 937868 0 0.0
esp32 all-clusters-app c3devkit (read only) 1019366 1019366 0 0.0
(read/write) 1485050 1485050 0 0.0
.dram0.bss 70080 70080 0 0.0
.dram0.data 14600 14600 0 0.0
.flash.rodata 214936 214936 0 0.0
.flash.text 1019366 1019366 0 0.0
.iram0.text 62902 62902 0 0.0
m5stack (read only) 1073243 1073243 0 0.0
(read/write) 487136 487136 0 0.0
.dram0.bss 75600 75600 0 0.0
.dram0.data 34144 34144 0 0.0
.flash.rodata 245396 245396 0 0.0
.flash.text 1067859 1067859 0 0.0
.iram0.text 123267 123267 0 0.0
k32w light k32w061+release (read/write) 658192 658192 0 0.0
.bss 69516 69516 0 0.0
.data 1992 1992 0 0.0
.text 580884 580884 0 0.0
lock k32w061+release (read/write) 684788 684788 0 0.0
.bss 69980 69980 0 0.0
.data 2004 2004 0 0.0
.text 607004 607004 0 0.0
linux chip-tool-no-interactive-ipv6only arm64 (read only) 9971956 9971956 0 0.0
(read/write) 680689 680689 0 0.0
.bss 42609 42609 0 0.0
.data 1152 1152 0 0.0
.data.rel.ro 619624 619624 0 0.0
.dynamic 528 528 0 0.0
.got 13488 13488 0 0.0
.init 24 24 0 0.0
.init_array 192 192 0 0.0
.rodata 475572 475572 0 0.0
.text 7944804 7944804 0 0.0
thermostat-no-ble arm64 (read only) 2592644 2592644 0 0.0
(read/write) 158289 158289 0 0.0
.bss 65249 65249 0 0.0
.data 1704 1704 0 0.0
.data.rel.ro 83240 83240 0 0.0
.dynamic 528 528 0 0.0
.got 5072 5072 0 0.0
.init 24 24 0 0.0
.init_array 400 400 0 0.0
.rodata 165348 165348 0 0.0
.text 2187520 2187520 0 0.0
mbed lock-app CY8CPROTO_062_4343W+release (read only) 6224 6224 0 0.0
(read/write) 2447400 2447400 0 0.0
.bss 213940 213940 0 0.0
.data 5872 5872 0 0.0
.text 1410044 1410044 0 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 (read/write) 1173807 1173807 0 0.0
bss 142900 142900 0 0.0
rodata 141376 141376 0 0.0
text 810640 810640 0 0.0
all-clusters-minimal-app nrf52840dk_nrf52840 (read/write) 1154691 1154691 0 0.0
bss 142136 142136 0 0.0
rodata 133308 133308 0 0.0
text 800360 800360 0 0.0
p6 all-clusters-app default (read/write) 2563088 2563088 0 0.0
.bss 149120 149120 0 0.0
.data 2776 2776 0 0.0
.text 1521352 1521352 0 0.0
all-clusters-minimal-app default (read/write) 2508952 2508952 0 0.0
.bss 148400 148400 0 0.0
.data 2776 2776 0 0.0
.text 1467216 1467216 0 0.0
light-app default (read/write) 2439240 2439240 0 0.0
.bss 140456 140456 0 0.0
.data 2592 2592 0 0.0
.text 1397504 1397504 0 0.0
lock-app default (read/write) 2465672 2465672 0 0.0
.bss 140304 140304 0 0.0
.data 2600 2600 0 0.0
.text 1423936 1423936 0 0.0
telink light-switch-app tlsr9518adk80d (read/write) 796628 796636 8 0.0
bss 70576 70576 0 0.0
noinit 40416 40416 0 0.0
text 565128 565130 2 0.0
lighting-app tlsr9518adk80d (read/write) 816464 816464 0 0.0
bss 71420 71420 0 0.0
noinit 40416 40416 0 0.0
text 581456 581456 0 0.0

@shubhamdp
[ESP32] Support flash encryption and nvs encryption
11b447f 
- Added an option to encrypt the factory partition.
- Securely initialize the NVS partition if NVS encryption is enabled
- Added user guide for flash encryption in lighting-app/esp32
@shubhamdp shubhamdp force-pushed the esp32_encrypt_factory_partition branch from 297b540 to 11b447f Compare July 7, 2022 11:45
@github-actions
Copy link

github-actions bot commented Jul 7, 2022 •
edited
Loading

PR #20414: Size comparison from 1107d8e to 11b447f

Decreases (5 builds for cc13x2_26x2, k32w, nrfconnect, telink)
platform target config section 1107d8e 11b447f change % change
cc13x2_26x2 all-clusters-minimal-app LP_CC2652R7 (read only) 631443 631435 -8 -0.0
.text 553812 553804 -8 -0.0
k32w lock k32w061+release (read/write) 684788 684772 -16 -0.0
.text 607004 606988 -16 -0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 text 810640 810636 -4 -0.0
all-clusters-minimal-app nrf52840dk_nrf52840 text 800360 800356 -4 -0.0
telink lighting-app tlsr9518adk80d text 581456 581454 -2 -0.0
Full report (30 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
platform target config section 1107d8e 11b447f change % change
cc13x2_26x2 all-clusters-app LP_CC2652R7 (read only) 665443 665443 0 0.0
(read/write) 185780 185780 0 0.0
.bss 74116 74116 0 0.0
.data 3356 3356 0 0.0
.rodata 88067 88067 0 0.0
.text 577060 577060 0 0.0
all-clusters-minimal-app LP_CC2652R7 (read only) 631443 631435 -8 -0.0
(read/write) 157684 157684 0 0.0
.bss 73412 73412 0 0.0
.data 3356 3356 0 0.0
.rodata 77307 77307 0 0.0
.text 553812 553804 -8 -0.0
lock-ftd LP_CC2652R7 (read only) 668343 668343 0 0.0
(read/write) 173024 173024 0 0.0
.bss 71148 71148 0 0.0
.data 3280 3280 0 0.0
.rodata 76207 76207 0 0.0
.text 591656 591656 0 0.0
lock-mtd LP_CC2652R7 (read only) 617759 617759 0 0.0
(read/write) 144264 144264 0 0.0
.bss 66868 66868 0 0.0
.data 3280 3280 0 0.0
.rodata 76087 76087 0 0.0
.text 541184 541184 0 0.0
pump-app LP_CC2652R7 (read only) 677703 677703 0 0.0
(read/write) 164512 164512 0 0.0
.bss 71228 71228 0 0.0
.data 3280 3280 0 0.0
.rodata 88431 88431 0 0.0
.text 588788 588788 0 0.0
pump-controller-app LP_CC2652R7 (read only) 663527 663527 0 0.0
(read/write) 178808 178808 0 0.0
.bss 71348 71348 0 0.0
.data 3276 3276 0 0.0
.rodata 84295 84295 0 0.0
.text 578752 578752 0 0.0
shell LP_CC2652R7 (read only) 657942 657942 0 0.0
(read/write) 188784 188784 0 0.0
.bss 76420 76420 0 0.0
.data 3360 3360 0 0.0
.rodata 84846 84846 0 0.0
.text 572780 572780 0 0.0
cyw30739 light cyw930739m2evb_01 (read/write) 579134 579134 0 0.0
.app_xip_area 457904 457904 0 0.0
.bss 64184 64184 0 0.0
.data 716 716 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
lock cyw930739m2evb_01 (read/write) 584862 584862 0 0.0
.app_xip_area 458896 458896 0 0.0
.bss 68912 68912 0 0.0
.data 720 720 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
ota-requestor-no-progress-logging cyw930739m2evb_01 (read/write) 582198 582198 0 0.0
.app_xip_area 461816 461816 0 0.0
.bss 63392 63392 0 0.0
.data 660 660 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
efr32 lighting-app BRD4161A (read/write) 1080652 1080652 0 0.0
.bss 132996 132996 0 0.0
.data 2048 2048 0 0.0
.text 945588 945588 0 0.0
BRD4161A+rpc (read only) 983040 983040 0 0.0
(read/write) 151948 151948 0 0.0
.bss 149676 149676 0 0.0
.data 2260 2260 0 0.0
.text 983032 983032 0 0.0
BRD4161A+rs911x (read/write) 946756 946756 0 0.0
.bss 140768 140768 0 0.0
.data 2048 2048 0 0.0
.text 803920 803920 0 0.0
lock-app BRD4161A+wf200 (read/write) 1127288 1127288 0 0.0
.bss 144184 144184 0 0.0
.data 2060 2060 0 0.0
.text 981020 981020 0 0.0
window-app BRD4161A (read/write) 1074436 1074436 0 0.0
.bss 134468 134468 0 0.0
.data 2076 2076 0 0.0
.text 937868 937868 0 0.0
esp32 all-clusters-app c3devkit (read only) 1019366 1019366 0 0.0
(read/write) 1485050 1485050 0 0.0
.dram0.bss 70080 70080 0 0.0
.dram0.data 14600 14600 0 0.0
.flash.rodata 214936 214936 0 0.0
.flash.text 1019366 1019366 0 0.0
.iram0.text 62902 62902 0 0.0
m5stack (read only) 1073243 1073243 0 0.0
(read/write) 487136 487136 0 0.0
.dram0.bss 75600 75600 0 0.0
.dram0.data 34144 34144 0 0.0
.flash.rodata 245396 245396 0 0.0
.flash.text 1067859 1067859 0 0.0
.iram0.text 123267 123267 0 0.0
k32w light k32w061+release (read/write) 658192 658192 0 0.0
.bss 69516 69516 0 0.0
.data 1992 1992 0 0.0
.text 580884 580884 0 0.0
lock k32w061+release (read/write) 684788 684772 -16 -0.0
.bss 69980 69980 0 0.0
.data 2004 2004 0 0.0
.text 607004 606988 -16 -0.0
linux chip-tool-no-interactive-ipv6only arm64 (read only) 9971956 9971956 0 0.0
(read/write) 680689 680689 0 0.0
.bss 42609 42609 0 0.0
.data 1152 1152 0 0.0
.data.rel.ro 619624 619624 0 0.0
.dynamic 528 528 0 0.0
.got 13488 13488 0 0.0
.init 24 24 0 0.0
.init_array 192 192 0 0.0
.rodata 475572 475572 0 0.0
.text 7944804 7944804 0 0.0
thermostat-no-ble arm64 (read only) 2592644 2592644 0 0.0
(read/write) 158289 158289 0 0.0
.bss 65249 65249 0 0.0
.data 1704 1704 0 0.0
.data.rel.ro 83240 83240 0 0.0
.dynamic 528 528 0 0.0
.got 5072 5072 0 0.0
.init 24 24 0 0.0
.init_array 400 400 0 0.0
.rodata 165348 165348 0 0.0
.text 2187520 2187520 0 0.0
mbed lock-app CY8CPROTO_062_4343W+release (read only) 6224 6224 0 0.0
(read/write) 2447400 2447400 0 0.0
.bss 213940 213940 0 0.0
.data 5872 5872 0 0.0
.text 1410044 1410044 0 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 (read/write) 1173807 1173807 0 0.0
bss 142900 142900 0 0.0
rodata 141376 141376 0 0.0
text 810640 810636 -4 -0.0
all-clusters-minimal-app nrf52840dk_nrf52840 (read/write) 1154691 1154691 0 0.0
bss 142136 142136 0 0.0
rodata 133308 133308 0 0.0
text 800360 800356 -4 -0.0
p6 all-clusters-app default (read/write) 2563088 2563088 0 0.0
.bss 149120 149120 0 0.0
.data 2776 2776 0 0.0
.text 1521352 1521352 0 0.0
all-clusters-minimal-app default (read/write) 2508952 2508952 0 0.0
.bss 148400 148400 0 0.0
.data 2776 2776 0 0.0
.text 1467216 1467216 0 0.0
light-app default (read/write) 2439240 2439240 0 0.0
.bss 140456 140456 0 0.0
.data 2592 2592 0 0.0
.text 1397504 1397504 0 0.0
lock-app default (read/write) 2465672 2465672 0 0.0
.bss 140304 140304 0 0.0
.data 2600 2600 0 0.0
.text 1423936 1423936 0 0.0
telink light-switch-app tlsr9518adk80d (read/write) 796628 796628 0 0.0
bss 70576 70576 0 0.0
noinit 40416 40416 0 0.0
text 565128 565128 0 0.0
lighting-app tlsr9518adk80d (read/write) 816464 816464 0 0.0
bss 71420 71420 0 0.0
noinit 40416 40416 0 0.0
text 581456 581454 -2 -0.0

@andy31415 andy31415 merged commit 776c06d into project-chip:master Jul 9, 2022
github-actions bot pushed a commit that referenced this pull request Jul 9, 2022
@shubhamdp @web-flow
[ESP32] Support flash encryption and nvs encryption (#20414)
de9bb55 
- Added an option to encrypt the factory partition.
- Securely initialize the NVS partition if NVS encryption is enabled
- Added user guide for flash encryption in lighting-app/esp32
@shubhamdp shubhamdp deleted the esp32_encrypt_factory_partition branch July 9, 2022 15:10
woody-apple added a commit that referenced this pull request Jul 9, 2022
@woody-apple @shubhamdp
[ESP32] Support flash encryption and nvs encryption (#20414) (#20530)
563de1f 
- Added an option to encrypt the factory partition.
- Securely initialize the NVS partition if NVS encryption is enabled
- Added user guide for flash encryption in lighting-app/esp32

Co-authored-by: Shubham Patil <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@chshu chshu chshu approved these changes

@tcarmelveilleux tcarmelveilleux tcarmelveilleux approved these changes

@anush-apple anush-apple Awaiting requested review from anush-apple

@arkq arkq Awaiting requested review from arkq

@Byungjoo-Lee Byungjoo-Lee Awaiting requested review from Byungjoo-Lee

@bzbarsky-apple bzbarsky-apple Awaiting requested review from bzbarsky-apple

@carol-apple carol-apple Awaiting requested review from carol-apple

@chrisdecenzo chrisdecenzo Awaiting requested review from chrisdecenzo

@chulspro chulspro Awaiting requested review from chulspro

@Damian-Nordic Damian-Nordic Awaiting requested review from Damian-Nordic

@dhrishi dhrishi Awaiting requested review from dhrishi

@electrocucaracha electrocucaracha Awaiting requested review from electrocucaracha

@franck-apple franck-apple Awaiting requested review from franck-apple

@gjc13 gjc13 Awaiting requested review from gjc13

@harimau-qirex harimau-qirex Awaiting requested review from harimau-qirex

@harsha-rajendran harsha-rajendran Awaiting requested review from harsha-rajendran

@hawk248 hawk248 Awaiting requested review from hawk248

@isiu-apple isiu-apple Awaiting requested review from isiu-apple

@jelderton jelderton Awaiting requested review from jelderton

@jepenven-silabs jepenven-silabs Awaiting requested review from jepenven-silabs

@jmartinez-silabs jmartinez-silabs Awaiting requested review from jmartinez-silabs

@jtung-apple jtung-apple Awaiting requested review from jtung-apple

@kghost kghost Awaiting requested review from kghost

@kpschoedel kpschoedel Awaiting requested review from kpschoedel

@lazarkov lazarkov Awaiting requested review from lazarkov

@LuDuda LuDuda Awaiting requested review from LuDuda

@mlepage-google mlepage-google Awaiting requested review from mlepage-google

@mrjerryjohns mrjerryjohns Awaiting requested review from mrjerryjohns

@msandstedt msandstedt Awaiting requested review from msandstedt

@rgoliver rgoliver Awaiting requested review from rgoliver

@robszewczyk robszewczyk Awaiting requested review from robszewczyk

@saurabhst saurabhst Awaiting requested review from saurabhst

@selissia selissia Awaiting requested review from selissia

@tecimovic tecimovic Awaiting requested review from tecimovic

@tehampson tehampson Awaiting requested review from tehampson

@vijs vijs Awaiting requested review from vijs

@vivien-apple vivien-apple Awaiting requested review from vivien-apple

@wbschiller wbschiller Awaiting requested review from wbschiller

@woody-apple woody-apple Awaiting requested review from woody-apple

@xylophone21 xylophone21 Awaiting requested review from xylophone21

@yufengwangca yufengwangca Awaiting requested review from yufengwangca

Assignees
No one assigned
Labels
esp32 examples platform review - approved scripts
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[ESP32] Support NVS encryption in factory partition generation tool
4 participants
@shubhamdp @tcarmelveilleux @chshu @andy31415