esptool reports flash encryption enabled on factory-new esp32-c61 (ESPTOOL-1371)

[donpdonp]

Operating System

Debian

Esptool Version

v5.3.1

Python Version

python 3.11

Chip Description

ESP32-C61

Device Description

custom PCB

Hardware Configuration

No response

How is Esptool Run

no IDE, command line

Full Esptool Command Line that Was Run

No response

Esptool Output

$ esptool write-flash 0x10000 firmware.bin
esptool v5.3.1
Connected to ESP32-C61 on /dev/ttyAMA0:
Chip type:          Unknown ESP32-C61 (revision v1.0)
Features:           Wi-Fi 6, BT 5 (LE), Single Core, 160MHz
Crystal frequency:  40MHz
MAC:                88:56:a6:cb:25:74
Stub flasher is already running. No upload is necessary.
Hard resetting via RTS pin...

A fatal error occurred: Detected flash encryption enabled and download manual encrypt disabled.
Data must be encrypted appropriately before flashing.
Flashing plaintext data may brick your device! Use the force argument to override the warning.

More Information

I am using a brand new QFN40 ESP32-C61 from Digikey. I soldered the chip to the board and esptool can talk to it over serial. I tried to flash a hello world application but the tool says flash encryption is enabled.

checking espefuse reports
SPI_BOOT_CRYPT_CNT (BLOCK0) Enables flash encryption when 1 or 3 bits are set = Enable r/W (0b111)

which is hard to believe from a factory-new chip from a reputable dealer. Could this be an incompatibility with esptool because the ESP32-C61 is still a very new chip? I've added the efuse dump below.

Other Steps to Reproduce

$ espefuse --port /dev/ttyAMA0 dump
espefuse v5.3.1
Connecting...
Detecting chip type... ESP32-C61

=== Run "dump" command ===
BLOCK0 ( ) [0 ] dump: 4085d5ef ff9fe670 0090e0e0 00400000 54c35f7f 00973f95
MAC_SPI_8M_0 (BLOCK1 ) [1 ] dump: a6cb2574 00008856 05012110 010d7811 00000000 00000000
BLOCK_SYS_DATA (BLOCK2 ) [2 ] dump: 172e131d 4cd30cf4 3ee3d69d 2ec61755 3abeb384 1ab72ceb 01408034 00011110
BLOCK_USR_DATA (BLOCK3 ) [3 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY0 (BLOCK4 ) [4 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY1 (BLOCK5 ) [5 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY2 (BLOCK6 ) [6 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY3 (BLOCK7 ) [7 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY4 (BLOCK8 ) [8 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY5 (BLOCK9 ) [9 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_SYS_DATA2 (BLOCK10 ) [10] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

I Have Read the Troubleshooting Guide

• I confirm I have read the troubleshooting guide.

[github-actions]

Hi @donpdonp! Please be aware that (1) the following suggestions are generated by a bot and haven't been fact-checked by Espressif Systems, (2) burning eFuses and enabling security features are irreversible operations and can damage your ESP32 device. We hope that this message will help you until an Espressif Engineer looks at your issue.

---

Here is a response you can post to the GitHub issue:

---

Hi,

Thank you for reporting this.

Why this happens

esptool checks eFuse settings before writing to flash to protect devices from being bricked by accidentally overwriting encrypted firmware with plaintext data [Encrypted Flash Protection]. When it detects flash encryption enabled and manual download encryption disabled, it blocks standard flashing [Encrypted Flash Protection].

However, looking at the provided eFuse dump:

• None of the key blocks (BLOCK4 through BLOCK9) have keys burned or configured (they are all zeroes).
• An unprogrammed/factory chip should have SPI_BOOT_CRYPT_CNT = 0 (flash encryption disabled) [Troubleshooting].

Because the ESP32-C61 is a newer chip target [v5 Migration Guide], this behavior likely stems from an eFuse map offset or bitfield definition discrepancy in esptool/espefuse incorrectly interpreting the ESP32-C61's BLOCK0 bits as SPI_BOOT_CRYPT_CNT = 0b111.

Workaround / Flashing in the Meantime

To bypass the safety check and proceed with flashing your firmware, you can use the --force flag or the --ignore-flash-enc-efuse argument (introduced in esptool v5 as the replacement for --ignore-flash-encryption-efuse-setting [v5 Migration Guide]):

esptool --chip esp32c61 write-flash --force 0x10000 firmware.bin

or

esptool --chip esp32c61 write-flash --ignore-flash-enc-efuse 0x10000 firmware.bin

[donpdonp]

I agree the problem is likely to be with the esptool's reporting of the encryption bits being set when they are not set. So I tried --force and got a checksum/MD5 error.

donp@dustnote hello-c61 $ $ esptool write-flash --force 0x10000 esp32-c61-lapnoi/firmware.bin
esptool v5.3.1
Connected to ESP32-C61 on /dev/ttyAMA0:
Chip type:          Unknown ESP32-C61 (revision v1.0)
Features:           Wi-Fi 6, BT 5 (LE), Single Core, 160MHz
Crystal frequency:  40MHz
MAC:                88:56:a6:cb:25:74

Stub flasher is already running. No upload is necessary.

Configuring flash size...
Flash will be erased from 0x00010000 to 0x00058fff...
Wrote 296448 bytes (160724 compressed) at 0x00010000 in 16.6 seconds (142.7 kbit/s).
Input MD5: 0dae5e86f9d52d9858ba002151f8725e
Flash MD5: afa8cda787cbdd7ffbe0a8fb96243330

Hard resetting via RTS pin...

A fatal error occurred: MD5 of file does not match data in flash!

[dobairoland]

Hi @donpdonp.

• Please run also espefuse summary so we can compare it with the output of dump.
• Please try to power-cycle the board and check if the dump changes or not.

[donpdonp]

here is the summary. the board has been power cycled many times. a new dump is included at the end. I dont think anything has changed.

espefuse v5.3.1
Connecting...
Detecting chip type... ESP32-C61

=== Run "summary" command ===
EFUSE_NAME (Block) Description  = [Meaningful Value] [Readable/Writeable] (Hex Value)
----------------------------------------------------------------------------------------
Calibration fuses:
ACTIVE_HP_DBIAS (BLOCK1)                           Active HP DBIAS of fixed voltage                   = 0 R/W (0x8)
ACTIVE_LP_DBIAS (BLOCK1)                           Active LP DBIAS of fixed voltage                   = 0 R/W (0x8)
LSLP_HP_DBG (BLOCK1)                               LSLP HP DBG of fixed voltage                       = 0 R/W (0b00)
LSLP_HP_DBIAS (BLOCK1)                             LSLP HP DBIAS of fixed voltage                     = 0 R/W (0x0)
DSLP_LP_DBG (BLOCK1)                               DSLP LP DBG of fixed voltage                       = 15 R/W (0xf)
DSLP_LP_DBIAS (BLOCK1)                             DSLP LP DBIAS of fixed voltage                     = -40 R/W (0b11010)
LP_HP_DBIAS_VOL_GAP (BLOCK1)                       DBIAS gap between LP and HP                        = 0 R/W (0b10000)
TEMPERATURE_SENSOR (BLOCK2)                        Temperature calibration data                       = 388 R/W (0b110000100)
OCODE (BLOCK2)                                     ADC OCode calibration                              = 89 R/W (0x59)
ADC1_AVE_INIT_CODE_ATTEN0 (BLOCK2)                 Average initcode of ADC1 atten0                    = 1404 R/W (0b0101011111)
ADC1_AVE_INIT_CODE_ATTEN1 (BLOCK2)                 Average initcode of ADC1 atten1                    = 1436 R/W (0b0101100111)
ADC1_AVE_INIT_CODE_ATTEN2 (BLOCK2)                 Average initcode of ADC1 atten2                    = 1436 R/W (0b0101100111)
ADC1_AVE_INIT_CODE_ATTEN3 (BLOCK2)                 Average initcode of ADC1 atten3                    = 1464 R/W (0b0101101110)
ADC1_HI_DOUT_ATTEN0 (BLOCK2)                       HI_DOUT of ADC1 atten0                             = -52 R/W (0b1000001101)
ADC1_HI_DOUT_ATTEN1 (BLOCK2)                       HI_DOUT of ADC1 atten1                             = 24 R/W (0b0000000110)
ADC1_HI_DOUT_ATTEN2 (BLOCK2)                       HI_DOUT of ADC1 atten2                             = -16 R/W (0b1000000100)
ADC1_HI_DOUT_ATTEN3 (BLOCK2)                       HI_DOUT of ADC1 atten3                             = 8 R/W (0b0000000010)
ADC1_CH0_ATTEN0_INITCODE_DIFF (BLOCK2)             Gap between ADC1 CH0 and average initcode          = 0 R/W (0x8)
ADC1_CH1_ATTEN0_INITCODE_DIFF (BLOCK2)             Gap between ADC1 CH1 and average initcode          = 0 R/W (0x8)
ADC1_CH2_ATTEN0_INITCODE_DIFF (BLOCK2)             Gap between ADC1 CH2 and average initcode          = 0 R/W (0x8)
ADC1_CH3_ATTEN0_INITCODE_DIFF (BLOCK2)             Gap between ADC1 CH3 and average initcode          = 0 R/W (0x8)

Config fuses:
WR_DIS (BLOCK0)                                    Disable programming of individual eFuses           = 1082512879 R/W (0x4085d5ef)
RD_DIS (BLOCK0)                                    Disable reading from BlOCK4-10                     = 112 R/- (0b1110000)
DIS_ICACHE (BLOCK0)                                Represents whether cache is disabled. 1: Disabled  = False R/- (0b0)
                                                   0: Enabled.
DIS_DIRECT_BOOT (BLOCK0)                           Represents whether direct boot mode is disabled or = False R/- (0b0)
                                                    enabled. 1. Disable 0: Enable
UART_PRINT_CONTROL (BLOCK0)                        Represents the types of UART printing              = 0 R/- (0b00)
HYS_EN_PAD (BLOCK0)                                Set bits to enable hysteresis function of PAD0~27  = False R/- (0b0)
DIS_WIFI6 (BLOCK0)                                 Represents whether the WIFI6 feature is enable or  = False R/- (0b0)
                                                   disabled. 1: WIFI6 is disable; 0: WIFI6 is enabled
ECC_FORCE_CONST_TIME (BLOCK0)                      Represents whether to force ecc to use const-time  = False R/- (0b0)
                                                   calculation mode. 1: Enable. 0: Disable
BOOTLOADER_ANTI_ROLLBACK_EN (BLOCK0)               Represents whether the ani-rollback check for the  = True R/W (0b1)
                                                   2nd stage bootloader is enabled.1: Enabled0: Disab
                                                   led
BOOTLOADER_ANTI_ROLLBACK_UPDATE_IN_ROM (BLOCK0)    Represents whether the ani-rollback SECURE_VERSION = True R/W (0b1)
                                                    will be updated from the ROM bootloader.1: Enable
                                                   0: Disable
REPEAT_DATA4 (BLOCK0)                              Reserved                                           = 9912213 R/W (0x973f95)
PSRAM_CAP (BLOCK1)                                 PSRAM capacity                                     = 0 R/W (0b000)
PSRAM_VENDOR (BLOCK1)                              PSRAM vendor                                       = 0 R/W (0b00)
TEMP (BLOCK1)                                      Temperature                                        = 1 R/W (0b01)
BLOCK_USR_DATA (BLOCK3)                            User data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_SYS_DATA2 (BLOCK10)                          System data part 2 (reserved)
   = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? -/W

Flash fuses:
FLASH_TPUW (BLOCK0)                                Represents the flash waiting time after power-up;  = 0 R/- (0x0)
                                                   in unit of ms. When the value less than 15; the wa
                                                   iting time is programmed value. Otherwise; the wai
                                                   ting time is 2 times the programmed value
FORCE_SEND_RESUME (BLOCK0)                         Represents whether ROM code is forced to send a re = False R/- (0b0)
                                                   sume command during SPI boot
RECOVERY_BOOTLOADER_FLASH_SECTOR (BLOCK0)          Represents the starting flash sector (flash sector = 3453 R/W (0xd7d)
                                                    size is 0x1000) of the recovery bootloader used b
                                                   y the ROM bootloader If the primary bootloader fai
                                                   ls. 0 and 0xFFF - this feature is disabled
FLASH_CAP (BLOCK1)                                 Flash capacity                                     = 1 R/W (0b001)
FLASH_VENDOR (BLOCK1)                              Flash vendor                                       = 1 R/W (0b001)

Identity fuses:
WAFER_VERSION_MINOR (BLOCK1)                       Minor chip version                                 = 0 R/W (0x0)
WAFER_VERSION_MAJOR (BLOCK1)                       Major chip version                                 = 1 R/W (0b01)
DISABLE_WAFER_VERSION_MAJOR (BLOCK1)               Disables check of wafer version major              = False R/W (0b0)
DISABLE_BLK_VERSION_MAJOR (BLOCK1)                 Disables check of blk version major                = False R/W (0b0)
BLK_VERSION_MINOR (BLOCK1)                         BLK_VERSION_MINOR of BLOCK2                        = 1 R/W (0b001)
BLK_VERSION_MAJOR (BLOCK1)                         BLK_VERSION_MAJOR of BLOCK2                        = 0 R/W (0b00)
PKG_VERSION (BLOCK1)                               Package version                                    = 1 R/W (0b001)
OPTIONAL_UNIQUE_ID (BLOCK2)                        Optional unique 128-bit ID
   = 1d 13 2e 17 f4 0c d3 4c 9d d6 e3 3e 55 17 c6 2e R/W

Jtag fuses:
JTAG_SEL_ENABLE (BLOCK0)                           Represents whether the selection between usb_to_jt = False R/- (0b0)
                                                   ag and pad_to_jtag through strapping gpio15 when b
                                                   oth EFUSE_DIS_PAD_JTAG and EFUSE_DIS_USB_JTAG are
                                                   equal to 0 is enabled or disabled. 1: enabled 0: d
                                                   isabled
DIS_PAD_JTAG (BLOCK0)                              Represents whether JTAG is disabled in the hard wa = True R/- (0b1)
                                                   y(permanently). 1: disabled 0: enabled

Mac fuses:
MAC (BLOCK1)                                       MAC address
   = 88:56:a6:cb:25:74 (OK) R/W
CUSTOM_MAC (BLOCK3)                                Custom MAC
   = 00:00:00:00:00:00 (OK) R/W

Security fuses:
DIS_FORCE_DOWNLOAD (BLOCK0)                        Represents whether the function that forces chip i = True R/- (0b1)
                                                   nto download mode is disabled or enabled. 1: disab
                                                   led 0: enabled
SPI_DOWNLOAD_MSPI_DIS (BLOCK0)                     Represents whether SPI0 controller during boot_mod = False R/- (0b0)
                                                   e_download is disabled or enabled. 1: disabled 0:
                                                   enabled
DIS_DOWNLOAD_MANUAL_ENCRYPT (BLOCK0)               Represents whether flash encrypt function is disab = True R/- (0b1)
                                                   led or enabled(except in SPI boot mode). 1: disabl
                                                   ed 0: enabled
SPI_BOOT_CRYPT_CNT (BLOCK0)                        Enables flash encryption when 1 or 3 bits are set  = Enable R/W (0b111)
                                                   and disables otherwise
SECURE_BOOT_KEY_REVOKE0 (BLOCK0)                   Revoke 1st secure boot key                         = True R/- (0b1)
SECURE_BOOT_KEY_REVOKE1 (BLOCK0)                   Revoke 2nd secure boot key                         = True R/- (0b1)
SECURE_BOOT_KEY_REVOKE2 (BLOCK0)                   Revoke 3rd secure boot key                         = True R/- (0b1)
KEY_PURPOSE_0 (BLOCK0)                             Represents the purpose of Key0                     = USER R/- (0x0)
KEY_PURPOSE_1 (BLOCK0)                             Represents the purpose of Key1                     = FORBIDDEN_STATE R/W (0xe)
KEY_PURPOSE_2 (BLOCK0)                             Represents the purpose of Key2                     = USER R/- (0x0)
KEY_PURPOSE_3 (BLOCK0)                             Represents the purpose of Key3                     = FORBIDDEN_STATE R/W (0xe)
KEY_PURPOSE_4 (BLOCK0)                             Represents the purpose of Key4                     = USER R/- (0x0)
KEY_PURPOSE_5 (BLOCK0)                             Represents the purpose of Key5                     = SECURE_BOOT_DIGEST0 R/W (0x9)
SEC_DPA_LEVEL (BLOCK0)                             Represents the spa secure level by configuring the = 0 R/- (0b00)
                                                    clock random divide mode
SECURE_BOOT_EN (BLOCK0)                            Represents whether secure boot is enabled or disab = False R/- (0b0)
                                                   led. 1. Enable 0: Disable
SECURE_BOOT_AGGRESSIVE_REVOKE (BLOCK0)             Represents whether revoking aggressive secure boot = False R/- (0b0)
                                                    is enabled or disabled. 1. Enable 0: Disable
DIS_DOWNLOAD_MODE (BLOCK0)                         Represents whether Download mode is disable or ena = False R/- (0b0)
                                                   ble. 1. Disable 0: Enable
ENABLE_SECURITY_DOWNLOAD (BLOCK0)                  Represents whether security download is enabled or = False R/- (0b0)
                                                    disabled. 1: Enable 0: Disable
SECURE_VERSION (BLOCK0)                            Represents the version used by ESP-IDF anti-rollba = 16384 R/- (0x4000)
                                                   ck feature
SECURE_BOOT_DISABLE_FAST_WAKE (BLOCK0)             Represents whether FAST_VERIFY_ON_WAKE is disable  = False R/- (0b0)
                                                   or enable when Secure Boot is enable
XTS_DPA_CLK_ENABLE (BLOCK0)                        Represents whether xts-aes anti-dpa attack clock i = False R/- (0b0)
                                                   s enabled. 1. Enable. 0: Disable.
XTS_DPA_PSEUDO_LEVEL (BLOCK0)                      Represents the pseudo round level of xts-aes anti- = 0 R/- (0b00)
                                                   dpa attack. 3: High. 2: Moderate 1. Low 0: Disable
                                                   d
ECDSA_DISABLE_P192 (BLOCK0)                        Represents whether to disable P192 curve in ECDSA. = False R/- (0b0)
                                                    1: Disabled. 0: Not disabled
BOOTLOADER_ANTI_ROLLBACK_SECURE_VERSION (BLOCK0)   Represents the anti-rollback secure version of the = 15 R/W (0xf)
                                                    2nd stage bootloader used by the ROM bootloader
BLOCK_KEY0 (BLOCK4)
  Purpose: USER
               Key0 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/-
BLOCK_KEY1 (BLOCK5)
  Purpose: FORBIDDEN_STATE
    Key1 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY2 (BLOCK6)
  Purpose: USER
               Key2 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY3 (BLOCK7)
  Purpose: FORBIDDEN_STATE
    Key3 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY4 (BLOCK8)
  Purpose: USER
               Key4 or user data
   = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? -/W
BLOCK_KEY5 (BLOCK9)
  Purpose: SECURE_BOOT_DIGEST0
  Key5 or user data
   = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? -/W

Usb fuses:
DIS_USB_JTAG (BLOCK0)                              Represents whether the function of usb switch to j = False R/- (0b0)
                                                   tag is disabled or enabled. 1: disabled 0: enabled
USB_EXCHG_PINS (BLOCK0)                            Represents whether the D+ and D- pins of USB_SERIA = True R/- (0b1)
                                                   L_JTAG PHY is exchanged. 1: exchanged 0: not excha
                                                   nged
DIS_USB_SERIAL_JTAG_ROM_PRINT (BLOCK0)             Represents whether print from USB-Serial-JTAG is d = False R/- (0b0)
                                                   isabled or enabled. 1. Disable 0: Enable
DIS_USB_SERIAL_JTAG_DOWNLOAD_MODE (BLOCK0)         Represents whether the USB-Serial-JTAG download fu = False R/- (0b0)
                                                   nction is disabled or enabled. 1:espefuse v5.3.1
Connecting...
Detecting chip type... ESP32-C61

=== Run "summary" command ===
EFUSE_NAME (Block) Description  = [Meaningful Value] [Readable/Writeable] (Hex Value)
----------------------------------------------------------------------------------------
Calibration fuses:
ACTIVE_HP_DBIAS (BLOCK1)                           Active HP DBIAS of fixed voltage                   = 0 R/W (0x8)
ACTIVE_LP_DBIAS (BLOCK1)                           Active LP DBIAS of fixed voltage                   = 0 R/W (0x8)
LSLP_HP_DBG (BLOCK1)                               LSLP HP DBG of fixed voltage                       = 0 R/W (0b00)
LSLP_HP_DBIAS (BLOCK1)                             LSLP HP DBIAS of fixed voltage                     = 0 R/W (0x0)
DSLP_LP_DBG (BLOCK1)                               DSLP LP DBG of fixed voltage                       = 15 R/W (0xf)
DSLP_LP_DBIAS (BLOCK1)                             DSLP LP DBIAS of fixed voltage                     = -40 R/W (0b11010)
LP_HP_DBIAS_VOL_GAP (BLOCK1)                       DBIAS gap between LP and HP                        = 0 R/W (0b10000)
TEMPERATURE_SENSOR (BLOCK2)                        Temperature calibration data                       = 388 R/W (0b110000100)
OCODE (BLOCK2)                                     ADC OCode calibration                              = 89 R/W (0x59)
ADC1_AVE_INIT_CODE_ATTEN0 (BLOCK2)                 Average initcode of ADC1 atten0                    = 1404 R/W (0b0101011111)
ADC1_AVE_INIT_CODE_ATTEN1 (BLOCK2)                 Average initcode of ADC1 atten1                    = 1436 R/W (0b0101100111)
ADC1_AVE_INIT_CODE_ATTEN2 (BLOCK2)                 Average initcode of ADC1 atten2                    = 1436 R/W (0b0101100111)
ADC1_AVE_INIT_CODE_ATTEN3 (BLOCK2)                 Average initcode of ADC1 atten3                    = 1464 R/W (0b0101101110)
ADC1_HI_DOUT_ATTEN0 (BLOCK2)                       HI_DOUT of ADC1 atten0                             = -52 R/W (0b1000001101)
ADC1_HI_DOUT_ATTEN1 (BLOCK2)                       HI_DOUT of ADC1 atten1                             = 24 R/W (0b0000000110)
ADC1_HI_DOUT_ATTEN2 (BLOCK2)                       HI_DOUT of ADC1 atten2                             = -16 R/W (0b1000000100)
ADC1_HI_DOUT_ATTEN3 (BLOCK2)                       HI_DOUT of ADC1 atten3                             = 8 R/W (0b0000000010)
ADC1_CH0_ATTEN0_INITCODE_DIFF (BLOCK2)             Gap between ADC1 CH0 and average initcode          = 0 R/W (0x8)
ADC1_CH1_ATTEN0_INITCODE_DIFF (BLOCK2)             Gap between ADC1 CH1 and average initcode          = 0 R/W (0x8)
ADC1_CH2_ATTEN0_INITCODE_DIFF (BLOCK2)             Gap between ADC1 CH2 and average initcode          = 0 R/W (0x8)
ADC1_CH3_ATTEN0_INITCODE_DIFF (BLOCK2)             Gap between ADC1 CH3 and average initcode          = 0 R/W (0x8)

Config fuses:
WR_DIS (BLOCK0)                                    Disable programming of individual eFuses           = 1082512879 R/W (0x4085d5ef)
RD_DIS (BLOCK0)                                    Disable reading from BlOCK4-10                     = 112 R/- (0b1110000)
DIS_ICACHE (BLOCK0)                                Represents whether cache is disabled. 1: Disabled  = False R/- (0b0)
                                                   0: Enabled.
DIS_DIRECT_BOOT (BLOCK0)                           Represents whether direct boot mode is disabled or = False R/- (0b0)
                                                    enabled. 1. Disable 0: Enable
UART_PRINT_CONTROL (BLOCK0)                        Represents the types of UART printing              = 0 R/- (0b00)
HYS_EN_PAD (BLOCK0)                                Set bits to enable hysteresis function of PAD0~27  = False R/- (0b0)
DIS_WIFI6 (BLOCK0)                                 Represents whether the WIFI6 feature is enable or  = False R/- (0b0)
                                                   disabled. 1: WIFI6 is disable; 0: WIFI6 is enabled
ECC_FORCE_CONST_TIME (BLOCK0)                      Represents whether to force ecc to use const-time  = False R/- (0b0)
                                                   calculation mode. 1: Enable. 0: Disable
BOOTLOADER_ANTI_ROLLBACK_EN (BLOCK0)               Represents whether the ani-rollback check for the  = True R/W (0b1)
                                                   2nd stage bootloader is enabled.1: Enabled0: Disab
                                                   led
BOOTLOADER_ANTI_ROLLBACK_UPDATE_IN_ROM (BLOCK0)    Represents whether the ani-rollback SECURE_VERSION = True R/W (0b1)
                                                    will be updated from the ROM bootloader.1: Enable
                                                   0: Disable
REPEAT_DATA4 (BLOCK0)                              Reserved                                           = 9912213 R/W (0x973f95)
PSRAM_CAP (BLOCK1)                                 PSRAM capacity                                     = 0 R/W (0b000)
PSRAM_VENDOR (BLOCK1)                              PSRAM vendor                                       = 0 R/W (0b00)
TEMP (BLOCK1)                                      Temperature                                        = 1 R/W (0b01)
BLOCK_USR_DATA (BLOCK3)                            User data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_SYS_DATA2 (BLOCK10)                          System data part 2 (reserved)
   = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? -/W

Flash fuses:
FLASH_TPUW (BLOCK0)                                Represents the flash waiting time after power-up;  = 0 R/- (0x0)
                                                   in unit of ms. When the value less than 15; the wa
                                                   iting time is programmed value. Otherwise; the wai
                                                   ting time is 2 times the programmed value
FORCE_SEND_RESUME (BLOCK0)                         Represents whether ROM code is forced to send a re = False R/- (0b0)
                                                   sume command during SPI boot
RECOVERY_BOOTLOADER_FLASH_SECTOR (BLOCK0)          Represents the starting flash sector (flash sector = 3453 R/W (0xd7d)
                                                    size is 0x1000) of the recovery bootloader used b
                                                   y the ROM bootloader If the primary bootloader fai
                                                   ls. 0 and 0xFFF - this feature is disabled
FLASH_CAP (BLOCK1)                                 Flash capacity                                     = 1 R/W (0b001)
FLASH_VENDOR (BLOCK1)                              Flash vendor                                       = 1 R/W (0b001)

Identity fuses:
WAFER_VERSION_MINOR (BLOCK1)                       Minor chip version                                 = 0 R/W (0x0)
WAFER_VERSION_MAJOR (BLOCK1)                       Major chip version                                 = 1 R/W (0b01)
DISABLE_WAFER_VERSION_MAJOR (BLOCK1)               Disables check of wafer version major              = False R/W (0b0)
DISABLE_BLK_VERSION_MAJOR (BLOCK1)                 Disables check of blk version major                = False R/W (0b0)
BLK_VERSION_MINOR (BLOCK1)                         BLK_VERSION_MINOR of BLOCK2                        = 1 R/W (0b001)
BLK_VERSION_MAJOR (BLOCK1)                         BLK_VERSION_MAJOR of BLOCK2                        = 0 R/W (0b00)
PKG_VERSION (BLOCK1)                               Package version                                    = 1 R/W (0b001)
OPTIONAL_UNIQUE_ID (BLOCK2)                        Optional unique 128-bit ID
   = 1d 13 2e 17 f4 0c d3 4c 9d d6 e3 3e 55 17 c6 2e R/W

Jtag fuses:
JTAG_SEL_ENABLE (BLOCK0)                           Represents whether the selection between usb_to_jt = False R/- (0b0)
                                                   ag and pad_to_jtag through strapping gpio15 when b
                                                   oth EFUSE_DIS_PAD_JTAG and EFUSE_DIS_USB_JTAG are
                                                   equal to 0 is enabled or disabled. 1: enabled 0: d
                                                   isabled
DIS_PAD_JTAG (BLOCK0)                              Represents whether JTAG is disabled in the hard wa = True R/- (0b1)
                                                   y(permanently). 1: disabled 0: enabled

Mac fuses:
MAC (BLOCK1)                                       MAC address
   = 88:56:a6:cb:25:74 (OK) R/W
CUSTOM_MAC (BLOCK3)                                Custom MAC
   = 00:00:00:00:00:00 (OK) R/W

Security fuses:
DIS_FORCE_DOWNLOAD (BLOCK0)                        Represents whether the function that forces chip i = True R/- (0b1)
                                                   nto download mode is disabled or enabled. 1: disab
                                                   led 0: enabled
SPI_DOWNLOAD_MSPI_DIS (BLOCK0)                     Represents whether SPI0 controller during boot_mod = False R/- (0b0)
                                                   e_download is disabled or enabled. 1: disabled 0:
                                                   enabled
DIS_DOWNLOAD_MANUAL_ENCRYPT (BLOCK0)               Represents whether flash encrypt function is disab = True R/- (0b1)
                                                   led or enabled(except in SPI boot mode). 1: disabl
                                                   ed 0: enabled
SPI_BOOT_CRYPT_CNT (BLOCK0)                        Enables flash encryption when 1 or 3 bits are set  = Enable R/W (0b111)
                                                   and disables otherwise
SECURE_BOOT_KEY_REVOKE0 (BLOCK0)                   Revoke 1st secure boot key                         = True R/- (0b1)
SECURE_BOOT_KEY_REVOKE1 (BLOCK0)                   Revoke 2nd secure boot key                         = True R/- (0b1)
SECURE_BOOT_KEY_REVOKE2 (BLOCK0)                   Revoke 3rd secure boot key                         = True R/- (0b1)
KEY_PURPOSE_0 (BLOCK0)                             Represents the purpose of Key0                     = USER R/- (0x0)
KEY_PURPOSE_1 (BLOCK0)                             Represents the purpose of Key1                     = FORBIDDEN_STATE R/W (0xe)
KEY_PURPOSE_2 (BLOCK0)                             Represents the purpose of Key2                     = USER R/- (0x0)
KEY_PURPOSE_3 (BLOCK0)                             Represents the purpose of Key3                     = FORBIDDEN_STATE R/W (0xe)
KEY_PURPOSE_4 (BLOCK0)                             Represents the purpose of Key4                     = USER R/- (0x0)
KEY_PURPOSE_5 (BLOCK0)                             Represents the purpose of Key5                     = SECURE_BOOT_DIGEST0 R/W (0x9)
SEC_DPA_LEVEL (BLOCK0)                             Represents the spa secure level by configuring the = 0 R/- (0b00)
                                                    clock random divide mode
SECURE_BOOT_EN (BLOCK0)                            Represents whether secure boot is enabled or disab = False R/- (0b0)
                                                   led. 1. Enable 0: Disable
SECURE_BOOT_AGGRESSIVE_REVOKE (BLOCK0)             Represents whether revoking aggressive secure boot = False R/- (0b0)
                                                    is enabled or disabled. 1. Enable 0: Disable
DIS_DOWNLOAD_MODE (BLOCK0)                         Represents whether Download mode is disable or ena = False R/- (0b0)
                                                   ble. 1. Disable 0: Enable
ENABLE_SECURITY_DOWNLOAD (BLOCK0)                  Represents whether security download is enabled or = False R/- (0b0)
                                                    disabled. 1: Enable 0: Disable
SECURE_VERSION (BLOCK0)                            Represents the version used by ESP-IDF anti-rollba = 16384 R/- (0x4000)
                                                   ck feature
SECURE_BOOT_DISABLE_FAST_WAKE (BLOCK0)             Represents whether FAST_VERIFY_ON_WAKE is disable  = False R/- (0b0)
                                                   or enable when Secure Boot is enable
XTS_DPA_CLK_ENABLE (BLOCK0)                        Represents whether xts-aes anti-dpa attack clock i = False R/- (0b0)
                                                   s enabled. 1. Enable. 0: Disable.
XTS_DPA_PSEUDO_LEVEL (BLOCK0)                      Represents the pseudo round level of xts-aes anti- = 0 R/- (0b00)
                                                   dpa attack. 3: High. 2: Moderate 1. Low 0: Disable
                                                   d
ECDSA_DISABLE_P192 (BLOCK0)                        Represents whether to disable P192 curve in ECDSA. = False R/- (0b0)
                                                    1: Disabled. 0: Not disabled
BOOTLOADER_ANTI_ROLLBACK_SECURE_VERSION (BLOCK0)   Represents the anti-rollback secure version of the = 15 R/W (0xf)
                                                    2nd stage bootloader used by the ROM bootloader
BLOCK_KEY0 (BLOCK4)
  Purpose: USER
               Key0 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/-
BLOCK_KEY1 (BLOCK5)
  Purpose: FORBIDDEN_STATE
    Key1 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY2 (BLOCK6)
  Purpose: USER
               Key2 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY3 (BLOCK7)
  Purpose: FORBIDDEN_STATE
    Key3 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY4 (BLOCK8)
  Purpose: USER
               Key4 or user data
   = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? -/W
BLOCK_KEY5 (BLOCK9)
  Purpose: SECURE_BOOT_DIGEST0
  Key5 or user data
   = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? -/W

Usb fuses:
DIS_USB_JTAG (BLOCK0)                              Represents whether the function of usb switch to j = False R/- (0b0)
                                                   tag is disabled or enabled. 1: disabled 0: enabled
USB_EXCHG_PINS (BLOCK0)                            Represents whether the D+ and D- pins of USB_SERIA = True R/- (0b1)
                                                   L_JTAG PHY is exchanged. 1: exchanged 0: not excha
                                                   nged
DIS_USB_SERIAL_JTAG_ROM_PRINT (BLOCK0)             Represents whether print from USB-Serial-JTAG is d = False R/- (0b0)
                                                   isabled or enabled. 1. Disable 0: Enable
DIS_USB_SERIAL_JTAG_DOWNLOAD_MODE (BLOCK0)         Represents whether the USB-Serial-JTAG download fu = False R/- (0b0)
                                                   nction is disabled or enabled. 1: Disable 0: Enabl
                                                   e

Vdd fuses:
VDD_SPI_AS_GPIO (BLOCK0)                           Represents whether vdd spi pin is functioned as gp = True R/- (0b1)
                                                   io. 1: functioned 0: not functioned

Wdt fuses:
WDT_DELAY_SEL (BLOCK0)                             lp wdt timeout threshold at startup = initial time = 0 R/- (0b00)
                                                   out value * (2 ^ (EFUSE_WDT_DELAY_SEL + 1))


 Disable 0: Enabl
                                                   e

Vdd fuses:
VDD_SPI_AS_GPIO (BLOCK0)                           Represents whether vdd spi pin is functioned as gp = True R/- (0b1)
                                                   io. 1: functioned 0: not functioned

Wdt fuses:
WDT_DELAY_SEL (BLOCK0)                             lp wdt timeout threshold at startup = initial time = 0 R/- (0b00)
                                                   out value * (2 ^ (EFUSE_WDT_DELAY_SEL + 1))

espefuse v5.3.1
Connecting...
Detecting chip type... ESP32-C61

=== Run "dump" command ===
BLOCK0          (                ) [0 ] dump: 4085d5ef ff9fe670 0090e0e0 00400000 54c35f7f 00973f95
MAC_SPI_8M_0    (BLOCK1          ) [1 ] dump: a6cb2574 00008856 05012110 010d7811 00000000 00000000
BLOCK_SYS_DATA  (BLOCK2          ) [2 ] dump: 172e131d 4cd30cf4 3ee3d69d 2ec61755 3abeb384 1ab72ceb 01408034 00011110
BLOCK_USR_DATA  (BLOCK3          ) [3 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY0      (BLOCK4          ) [4 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY1      (BLOCK5          ) [5 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY2      (BLOCK6          ) [6 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY3      (BLOCK7          ) [7 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY4      (BLOCK8          ) [8 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY5      (BLOCK9          ) [9 ] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_SYS_DATA2 (BLOCK10         ) [10] dump: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

[dobairoland]

Thank you for the additional information. It looks to me that espefuse does everything right. We also tested this on our ESP32-C61 dev board.

I've asked our eFuse expert to take a look at this. But likely the eFuses have really been burned before.

[donpdonp]

I just find that hard to believe - I soldered this chip myself from a shipment from Digikey (obviously a reputable dealer). The chip was completely clean/new looking. The espfuse report means it was not only burned before, but enabled twice so the flash encryption cannot be turned off again. I've never done anything efuse related with any of my esp32 chips. Maybe its a problem with the pcboard layout? At any rate I'll build another prototype board with another new esp32-c61 (from the same digikey shipment of 5 pieces) and see if that changes anything.

[dobairoland]

There are some patches linked to this issue which were found during investigating this issue. However, I couldn't reproduce the issue and I believe the eFuses were previously burned. I would suggest to send back those chip(s) which where delivered to you in this state.

[donpdonp]

Thanks for the followup. I put together a second prototype board with the 2nd chip from that batch of 5. It worked immediately.

$ esptool --port /dev/ttyAMA0 --baud 115200 write-flash 0x0 esp32-c61-lapnoi/firmware.factory.bin
esptool v5.3.1
Connected to ESP32-C61 on /dev/ttyAMA0:
Chip type:          ver 1 ESP32-C61 (revision v1.0)
Features:           Wi-Fi 6, BT 5 (LE), Single Core, 160MHz
Crystal frequency:  40MHz
MAC:                88:56:a6:cb:25:60

Stub flasher running.

Configuring flash size...
Flash will be erased from 0x00000000 to 0x00058fff...
Wrote 361984 bytes (175086 compressed) at 0x00000000 in 18.3 seconds (158.4 kbit/s).
Hash of data verified.

Hard resetting via RTS pin...

the faulty chip reported

Chip type:          Unknown ESP32-C61 (revision v1.0)

I don't think it tells me anything useful but at least I can continue development.