You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by xi...@apache.org on 2021/12/30 04:35:50 UTC

[incubator-nuttx] branch master updated (944f6e9 -> 7332053)

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx.git.


    from 944f6e9  boards/sim: recovered eth0 interface in sim:tcpblaster configuration
     new 340e0c8  xtensa/esp32: Build MCUboot bootloader with Flash Encryption support
     new b6addaa  xtensa/esp32: Enable the creation of encrypted Flash partitions
     new 80da9ab  xtensa/esp32: Move assertions after logging to improve debugging
     new 7332053  boards/esp32: Restrict FS options when Flash Encryption is enabled

The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 arch/xtensa/src/esp32/Bootloader.mk                |  7 ++
 arch/xtensa/src/esp32/Kconfig                      | 15 ++++
 arch/xtensa/src/esp32/Kconfig.security             | 99 +++++++++++++++++++++-
 arch/xtensa/src/esp32/esp32_spiflash.c             | 28 ++++--
 arch/xtensa/src/esp32/esp32_spiflash.h             |  3 +-
 boards/xtensa/esp32/common/Kconfig                 | 12 +++
 .../xtensa/esp32/common/src/esp32_board_spiflash.c | 27 +++++-
 7 files changed, 176 insertions(+), 15 deletions(-)

[incubator-nuttx] 04/04: boards/esp32: Restrict FS options when Flash Encryption is enabled

Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx.git

commit 7332053e5cee5c1cb17b53960d51897501e60584
Author: Gustavo Henrique Nihei <gu...@espressif.com>
AuthorDate: Fri Oct 22 15:37:35 2021 -0300

    boards/esp32: Restrict FS options when Flash Encryption is enabled
    
    Some incompatibilities exist between the encryption block of the SPI
    Flash peripheral and the algorithms of some file systems. LittleFS is
    currently the only supported file system which is known to work
    correctly when Flash Encryption is enabled.
    
    Signed-off-by: Gustavo Henrique Nihei <gu...@espressif.com>
---
 boards/xtensa/esp32/common/Kconfig | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/boards/xtensa/esp32/common/Kconfig b/boards/xtensa/esp32/common/Kconfig
index 72b7913..7448a6d 100644
--- a/boards/xtensa/esp32/common/Kconfig
+++ b/boards/xtensa/esp32/common/Kconfig
@@ -32,14 +32,26 @@ choice ESP32_SPIFLASH_FS
 		bool "SmartFS"
 		select FS_SMARTFS
 		select MTD_SMART
+		depends on !ESP32_SECURE_FLASH_ENC_ENABLED
+
+	comment "SmartFS not supported with Flash Encryption"
+		depends on ESP32_SECURE_FLASH_ENC_ENABLED
 
 	config ESP32_SPIFLASH_NXFFS
 		bool "NXFFS"
 		select FS_NXFFS
+		depends on !ESP32_SECURE_FLASH_ENC_ENABLED
+
+	comment "NXFFS not supported with Flash Encryption"
+		depends on ESP32_SECURE_FLASH_ENC_ENABLED
 
 	config ESP32_SPIFLASH_SPIFFS
 		bool "SPIFFS"
 		select FS_SPIFFS
+		depends on !ESP32_SECURE_FLASH_ENC_ENABLED
+
+	comment "SPIFFS not supported with Flash Encryption"
+		depends on ESP32_SECURE_FLASH_ENC_ENABLED
 
 	config ESP32_SPIFLASH_LITTLEFS
 		bool "LittleFS"

[incubator-nuttx] 01/04: xtensa/esp32: Build MCUboot bootloader with Flash Encryption support

Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx.git

commit 340e0c8a8fbfe993522e58bfec02337a327d1ff2
Author: Gustavo Henrique Nihei <gu...@espressif.com>
AuthorDate: Wed Oct 6 10:27:07 2021 -0300

    xtensa/esp32: Build MCUboot bootloader with Flash Encryption support
    
    Signed-off-by: Gustavo Henrique Nihei <gu...@espressif.com>
---
 arch/xtensa/src/esp32/Bootloader.mk    |  7 +++
 arch/xtensa/src/esp32/Kconfig.security | 99 ++++++++++++++++++++++++++++++++--
 2 files changed, 102 insertions(+), 4 deletions(-)

diff --git a/arch/xtensa/src/esp32/Bootloader.mk b/arch/xtensa/src/esp32/Bootloader.mk
index d29ed00..6044f1e 100644
--- a/arch/xtensa/src/esp32/Bootloader.mk
+++ b/arch/xtensa/src/esp32/Bootloader.mk
@@ -80,6 +80,13 @@ ifeq ($(CONFIG_ESP32_APP_FORMAT_MCUBOOT),y)
 		$(if $(CONFIG_ESP32_SECURE_BOOT_ALLOW_EFUSE_RD_DIS),$(call cfg_en,CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)) \
 		$(if $(CONFIG_ESP32_SECURE_DISABLE_ROM_DL_MODE),$(call cfg_en,CONFIG_SECURE_DISABLE_ROM_DL_MODE)) \
 		$(if $(CONFIG_ESP32_SECURE_INSECURE_ALLOW_DL_MODE),$(call cfg_en,CONFIG_SECURE_INSECURE_ALLOW_DL_MODE)) \
+		$(if $(CONFIG_ESP32_SECURE_FLASH_ENC_ENABLED),$(call cfg_en,CONFIG_SECURE_FLASH_ENC_ENABLED)) \
+		$(if $(CONFIG_ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT),$(call cfg_en,CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT)) \
+		$(if $(CONFIG_ESP32_SECURE_FLASH_ENCRYPTION_MODE_RELEASE),$(call cfg_en,CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE)) \
+		$(if $(CONFIG_ESP32_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC),$(call cfg_en,CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC)) \
+		$(if $(CONFIG_ESP32_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC),$(call cfg_en,CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC)) \
+		$(if $(CONFIG_ESP32_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE),$(call cfg_en,CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE)) \
+		$(if $(CONFIG_ESP32_SECURE_FLASH_REQUIRE_ALREADY_ENABLED),$(call cfg_en,CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED)) \
 		$(call cfg_val,CONFIG_ESP_BOOTLOADER_SIZE,0xF000) \
 		$(call cfg_val,CONFIG_ESP_APPLICATION_PRIMARY_START_ADDRESS,$(CONFIG_ESP32_OTA_PRIMARY_SLOT_OFFSET)) \
 		$(call cfg_val,CONFIG_ESP_APPLICATION_SIZE,$(CONFIG_ESP32_OTA_SLOT_SIZE)) \
diff --git a/arch/xtensa/src/esp32/Kconfig.security b/arch/xtensa/src/esp32/Kconfig.security
index c1a863c..b79b2f50 100644
--- a/arch/xtensa/src/esp32/Kconfig.security
+++ b/arch/xtensa/src/esp32/Kconfig.security
@@ -100,8 +100,54 @@ config ESP32_SECURE_BOOT_INSECURE
 
 endif # ESP32_SECURE_BOOT
 
+comment "Flash Encryption"
+
+config ESP32_SECURE_FLASH_ENC_ENABLED
+	bool "Enable Flash Encryption on boot (READ HELP FIRST)"
+	default n
+	depends on ESP32_APP_FORMAT_MCUBOOT
+	---help---
+		If this option is set, flash contents will be encrypted by the bootloader on first boot.
+
+		Note: After first boot, the system will be permanently encrypted. Re-flashing an encrypted
+		system is complicated and not always possible.
+
+		Read https://docs.espressif.com/projects/esp-idf/en/latest/security/flash-encryption.html
+		before enabling.
+
+if ESP32_SECURE_FLASH_ENC_ENABLED
+
+comment "Flash Encryption support requires building bootloader from source (ESP32_BOOTLOADER_BUILD_FROM_SOURCE)"
+	depends on !ESP32_BOOTLOADER_BUILD_FROM_SOURCE
+
+choice ESP32_SECURE_FLASH_ENCRYPTION_MODE
+	bool "Enable usage mode"
+	default ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+	---help---
+		By default, Development mode is enabled which allows ROM download mode to perform Flash Encryption
+		operations (plaintext is sent to the device, and it encrypts it internally and writes ciphertext
+		to flash). This mode is not secure, it's possible for an attacker to write their own chosen plaintext
+		to flash.
+
+		Release mode should always be selected for production or manufacturing. Once enabled it's no longer
+		possible for the device in ROM Download Mode to use the Flash Encryption hardware.
+
+		Refer to the Flash Encryption section of the ESP-IDF Programmer's Guide for details:
+		https://docs.espressif.com/projects/esp-idf/en/latest/esp32/security/flash-encryption.html#flash-encryption-configuration
+
+	config ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+		bool "Development (NOT SECURE)"
+		select ESP32_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
+
+	config ESP32_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
+		bool "Release"
+
+endchoice
+
+endif # ESP32_SECURE_FLASH_ENC_ENABLED
+
 menu "Potentially insecure options"
-	visible if ESP32_SECURE_BOOT_INSECURE
+	visible if ESP32_SECURE_BOOT_INSECURE || ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
 
 	# NOTE: Options in this menu NEED to have ESP32_SECURE_BOOT_INSECURE
 	# and/or ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT in "depends on", as the menu
@@ -112,7 +158,7 @@ menu "Potentially insecure options"
 config ESP32_SECURE_BOOT_ALLOW_ROM_BASIC
 	bool "Leave ROM BASIC Interpreter available on reset"
 	default n
-	depends on ESP32_SECURE_BOOT_INSECURE
+	depends on ESP32_SECURE_BOOT_INSECURE || ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
 	---help---
 		By default, the BASIC ROM Console starts on reset if no valid bootloader is
 		read from the flash.
@@ -126,7 +172,7 @@ config ESP32_SECURE_BOOT_ALLOW_ROM_BASIC
 config ESP32_SECURE_BOOT_ALLOW_JTAG
 	bool "Allow JTAG Debugging"
 	default n
-	depends on ESP32_SECURE_BOOT_INSECURE
+	depends on ESP32_SECURE_BOOT_INSECURE || ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
 	---help---
 		If not set (default), the bootloader will permanently disable JTAG (across entire chip) on first boot
 		when either Secure Boot or Flash Encryption is enabled.
@@ -156,12 +202,57 @@ config ESP32_SECURE_BOOT_ALLOW_EFUSE_RD_DIS
 		then it is __NOT__ possible to read/write efuses using espefuse.py utility.
 		However, efuse can be read/written from the application.
 
+config ESP32_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
+	bool "Leave UART bootloader encryption enabled"
+	default n
+	depends on ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+	---help---
+		If not set (default), the bootloader will permanently disable UART bootloader encryption access on
+		first boot. If set, the UART bootloader will still be able to access hardware encryption.
+
+		It is recommended to only set this option in testing environments.
+
+config ESP32_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC
+	bool "Leave UART bootloader decryption enabled"
+	default n
+	depends on ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+	---help---
+		If not set (default), the bootloader will permanently disable UART bootloader decryption access on
+		first boot. If set, the UART bootloader will still be able to access hardware decryption.
+
+		Only set this option in testing environments. Setting this option allows complete bypass of flash
+		encryption.
+
+config ESP32_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
+	bool "Leave UART bootloader flash cache enabled"
+	default n
+	depends on ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+	---help---
+		If not set (default), the bootloader will permanently disable UART bootloader flash cache access on
+		first boot. If set, the UART bootloader will still be able to access the flash cache.
+
+		Only set this option in testing environments.
+
+config ESP32_SECURE_FLASH_REQUIRE_ALREADY_ENABLED
+	bool "Require Flash Encryption to be already enabled"
+	default n
+	depends on ESP32_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+	---help---
+		If not set (default), and Flash Encryption is not yet enabled in eFuses, the 2nd stage bootloader
+		will enable Flash Encryption: generate the Flash Encryption key and program eFuses.
+		If this option is set, and Flash Encryption is not yet enabled, the bootloader will error out and
+		reboot.
+		If Flash Encryption is enabled in eFuses, this option does not change the bootloader behavior.
+
+		Only use this option in testing environments, to avoid accidentally enabling Flash Encryption on
+		the wrong device. The device needs to have Flash Encryption already enabled using espefuse.py.
+
 endmenu # Potentially insecure options
 
 choice ESP32_SECURE_UART_ROM_DL_MODE
 	bool "UART ROM download mode"
 	default ESP32_SECURE_INSECURE_ALLOW_DL_MODE
-	depends on ESP32_SECURE_BOOT
+	depends on ESP32_SECURE_BOOT || ESP32_SECURE_FLASH_ENC_ENABLED
 
 	config ESP32_SECURE_DISABLE_ROM_DL_MODE
 		bool "Permanently disabled (recommended)"

[incubator-nuttx] 02/04: xtensa/esp32: Enable the creation of encrypted Flash partitions

Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx.git

commit b6addaa4c7436997a08553baf3edbe82272654cc
Author: Gustavo Henrique Nihei <gu...@espressif.com>
AuthorDate: Tue Oct 19 11:44:30 2021 -0300

    xtensa/esp32: Enable the creation of encrypted Flash partitions
    
    Signed-off-by: Gustavo Henrique Nihei <gu...@espressif.com>
---
 arch/xtensa/src/esp32/Kconfig                      | 15 ++++++++++++
 arch/xtensa/src/esp32/esp32_spiflash.c             | 22 ++++++++++++++----
 arch/xtensa/src/esp32/esp32_spiflash.h             |  3 ++-
 .../xtensa/esp32/common/src/esp32_board_spiflash.c | 27 +++++++++++++++++++---
 4 files changed, 59 insertions(+), 8 deletions(-)

diff --git a/arch/xtensa/src/esp32/Kconfig b/arch/xtensa/src/esp32/Kconfig
index 5d204b3..f2092d3 100644
--- a/arch/xtensa/src/esp32/Kconfig
+++ b/arch/xtensa/src/esp32/Kconfig
@@ -851,6 +851,11 @@ if ESP32_HAVE_OTA_PARTITION
 
 comment "Application Image OTA Update support"
 
+config ESP32_OTA_PARTITION_ENCRYPT
+	bool "Encrypt OTA partitions"
+	default y
+	depends on ESP32_SECURE_FLASH_ENC_ENABLED
+
 config ESP32_OTA_PRIMARY_SLOT_OFFSET
 	hex "Application image primary slot offset"
 	default 0x10000
@@ -887,6 +892,11 @@ endif
 
 comment "General storage MTD configuration"
 
+config ESP32_STORAGE_MTD_ENCRYPT
+	bool "Encrypt Storage MTD partition"
+	default y
+	depends on ESP32_SECURE_FLASH_ENC_ENABLED
+
 config ESP32_STORAGE_MTD_OFFSET
 	hex "Storage MTD base address in SPI Flash"
 	default 0x180000 if !ESP32_HAVE_OTA_PARTITION
@@ -1148,6 +1158,11 @@ config ESP32_WIFI_FS_MOUNTPT
 	---help---
 		Mount point of Wi-Fi storage file system.
 
+config ESP32_WIFI_MTD_ENCRYPT
+	bool "Encrypt Wi-Fi MTD partition"
+	default y
+	depends on ESP32_SECURE_FLASH_ENC_ENABLED
+
 config ESP32_WIFI_MTD_OFFSET
 	hex "Wi-Fi MTD partition offset"
 	default 0x280000 if !ESP32_HAVE_OTA_PARTITION
diff --git a/arch/xtensa/src/esp32/esp32_spiflash.c b/arch/xtensa/src/esp32/esp32_spiflash.c
index 14cf18a..753a05e 100644
--- a/arch/xtensa/src/esp32/esp32_spiflash.c
+++ b/arch/xtensa/src/esp32/esp32_spiflash.c
@@ -1974,22 +1974,36 @@ static int esp32_ioctl(struct mtd_dev_s *dev, int cmd,
  * Input Parameters:
  *   mtd_offset - MTD Partition offset from the base address in SPI Flash.
  *   mtd_size   - Size for the MTD partition.
+ *   encrypted  - Flag indicating whether the newly allocated partition will
+ *                have its content encrypted.
  *
  * Returned Value:
- *   ESP32 SPI Flash MTD data pointer if success or NULL if fail
+ *   ESP32 SPI Flash MTD data pointer if success or NULL if fail.
  *
  ****************************************************************************/
 
 struct mtd_dev_s *esp32_spiflash_alloc_mtdpart(uint32_t mtd_offset,
-                                                   uint32_t mtd_size)
+                                               uint32_t mtd_size,
+                                               bool encrypted)
 {
-  struct esp32_spiflash_s *priv = &g_esp32_spiflash1;
-  esp32_spiflash_chip_t *chip = priv->chip;
+  struct esp32_spiflash_s *priv;
+  esp32_spiflash_chip_t *chip;
   struct mtd_dev_s *mtd_part;
   uint32_t blocks;
   uint32_t startblock;
   uint32_t size;
 
+  if (encrypted)
+    {
+      priv = &g_esp32_spiflash1_encrypt;
+    }
+  else
+    {
+      priv = &g_esp32_spiflash1;
+    }
+
+  chip = priv->chip;
+
   ASSERT((mtd_offset + mtd_size) <= chip->chip_size);
   ASSERT((mtd_offset % chip->sector_size) == 0);
   ASSERT((mtd_size % chip->sector_size) == 0);
diff --git a/arch/xtensa/src/esp32/esp32_spiflash.h b/arch/xtensa/src/esp32/esp32_spiflash.h
index b814e18..38337ad 100644
--- a/arch/xtensa/src/esp32/esp32_spiflash.h
+++ b/arch/xtensa/src/esp32/esp32_spiflash.h
@@ -64,7 +64,8 @@ extern "C"
  ****************************************************************************/
 
 struct mtd_dev_s *esp32_spiflash_alloc_mtdpart(uint32_t mtd_offset,
-                                                   uint32_t mtd_size);
+                                               uint32_t mtd_size,
+                                               bool encrypted);
 
 /****************************************************************************
  * Name: esp32_spiflash_get_mtd
diff --git a/boards/xtensa/esp32/common/src/esp32_board_spiflash.c b/boards/xtensa/esp32/common/src/esp32_board_spiflash.c
index 945c072..5259cae 100644
--- a/boards/xtensa/esp32/common/src/esp32_board_spiflash.c
+++ b/boards/xtensa/esp32/common/src/esp32_board_spiflash.c
@@ -51,6 +51,24 @@
 
 #define ARRAYSIZE(x)                (sizeof((x)) / sizeof((x)[0]))
 
+#ifdef CONFIG_ESP32_OTA_PARTITION_ENCRYPT
+#  define OTA_ENCRYPT true
+#else
+#  define OTA_ENCRYPT false
+#endif
+
+#ifdef CONFIG_ESP32_WIFI_MTD_ENCRYPT
+#  define WIFI_ENCRYPT true
+#else
+#  define WIFI_ENCRYPT false
+#endif
+
+#ifdef CONFIG_ESP32_STORAGE_MTD_ENCRYPT
+#  define STORAGE_ENCRYPT true
+#else
+#  define STORAGE_ENCRYPT false
+#endif
+
 /****************************************************************************
  * Private Types
  ****************************************************************************/
@@ -113,7 +131,8 @@ static int init_ota_partitions(void)
   for (int i = 0; i < ARRAYSIZE(g_ota_partition_table); ++i)
     {
       const struct ota_partition_s *part = &g_ota_partition_table[i];
-      mtd = esp32_spiflash_alloc_mtdpart(part->offset, part->size);
+      mtd = esp32_spiflash_alloc_mtdpart(part->offset, part->size,
+                                         OTA_ENCRYPT);
 
       ret = ftl_initialize(i, mtd);
       if (ret < 0)
@@ -350,7 +369,8 @@ static int init_wifi_partition(void)
   FAR struct mtd_dev_s *mtd;
 
   mtd = esp32_spiflash_alloc_mtdpart(CONFIG_ESP32_WIFI_MTD_OFFSET,
-                                     CONFIG_ESP32_WIFI_MTD_SIZE);
+                                     CONFIG_ESP32_WIFI_MTD_SIZE,
+                                     WIFI_ENCRYPT);
   if (!mtd)
     {
       ferr("ERROR: Failed to alloc MTD partition of SPI Flash\n");
@@ -414,7 +434,8 @@ static int init_storage_partition(void)
   FAR struct mtd_dev_s *mtd;
 
   mtd = esp32_spiflash_alloc_mtdpart(CONFIG_ESP32_STORAGE_MTD_OFFSET,
-                                     CONFIG_ESP32_STORAGE_MTD_SIZE);
+                                     CONFIG_ESP32_STORAGE_MTD_SIZE,
+                                     STORAGE_ENCRYPT);
   if (!mtd)
     {
       ferr("ERROR: Failed to alloc MTD partition of SPI Flash\n");

[incubator-nuttx] 03/04: xtensa/esp32: Move assertions after logging to improve debugging

Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx.git

commit 80da9abd6ab8a5110840fb110338e05cc23edde4
Author: Gustavo Henrique Nihei <gu...@espressif.com>
AuthorDate: Fri Oct 22 17:02:57 2021 -0300

    xtensa/esp32: Move assertions after logging to improve debugging
    
    Signed-off-by: Gustavo Henrique Nihei <gu...@espressif.com>
---
 arch/xtensa/src/esp32/esp32_spiflash.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/xtensa/src/esp32/esp32_spiflash.c b/arch/xtensa/src/esp32/esp32_spiflash.c
index 753a05e..e0a1a7b 100644
--- a/arch/xtensa/src/esp32/esp32_spiflash.c
+++ b/arch/xtensa/src/esp32/esp32_spiflash.c
@@ -2004,10 +2004,6 @@ struct mtd_dev_s *esp32_spiflash_alloc_mtdpart(uint32_t mtd_offset,
 
   chip = priv->chip;
 
-  ASSERT((mtd_offset + mtd_size) <= chip->chip_size);
-  ASSERT((mtd_offset % chip->sector_size) == 0);
-  ASSERT((mtd_size % chip->sector_size) == 0);
-
   finfo("ESP32 SPI Flash information:\n");
   finfo("\tID = 0x%x\n", chip->device_id);
   finfo("\tStatus mask = %x\n", chip->status_mask);
@@ -2016,6 +2012,10 @@ struct mtd_dev_s *esp32_spiflash_alloc_mtdpart(uint32_t mtd_offset,
   finfo("\tSector size = %d KB\n", chip->sector_size / 1024);
   finfo("\tBlock size = %d KB\n", chip->block_size / 1024);
 
+  ASSERT((mtd_offset + mtd_size) <= chip->chip_size);
+  ASSERT((mtd_offset % chip->sector_size) == 0);
+  ASSERT((mtd_size % chip->sector_size) == 0);
+
   if (mtd_size == 0)
     {
       size = chip->chip_size - mtd_offset;