fix(nvs_flash): Remove the forceful selection of NVS_ENCRYPTION with flash encryption

- This change will introduce a breaking change for SoCs with the HMAC
  peripheral. Turning on flash encryption will no longer enable NVS
  encryption automatically.

Closes https://github.com/espressif/esp-idf/issues/12549

components/bootloader/Kconfig.projbuild

@@ -833,7 +833,6 @@ menu "Security features"
         bool "Enable flash encryption on boot (READ DOCS FIRST)"
         default N
         select SPI_FLASH_ENABLE_ENCRYPTED_READ_WRITE
-        select NVS_ENCRYPTION
         help
             If this option is set, flash contents will be encrypted by the bootloader on first boot.
 

components/nvs_flash/test_apps/main/test_nvs.c

@@ -97,12 +97,6 @@ TEST_CASE("nvs_flash_init_partition_ptr() works correctly", "[nvs]")
 }
 
 #ifdef CONFIG_SOC_HMAC_SUPPORTED
-/* TODO: This test does not run in CI as the runner assigned has
- * flash encryption enabled by default. Enabling flash encryption
- * 'selects' NVS encryption; a new runner needs to be setup
- * for testing the HMAC NVS encryption scheme without flash encryption
- * enabled for this test.
- */
 TEST_CASE("test nvs encryption with HMAC-based scheme without toggling any config options", "[nvs_encr_hmac]")
 {
     nvs_handle_t handle;

components/nvs_flash/test_apps/pytest_nvs_flash.py

@@ -26,6 +26,13 @@ def test_nvs_flash_encr_hmac(dut: IdfDut) -> None:
     dut.run_all_single_board_cases()
 
 
+@pytest.mark.esp32c3
+@pytest.mark.nvs_encr_hmac
+@pytest.mark.parametrize('config', ['nvs_encr_hmac_no_cfg_esp32c3'], indirect=True)
+def test_nvs_flash_encr_hmac_no_cfg(dut: IdfDut) -> None:
+    dut.run_all_single_board_cases(group='nvs_encr_hmac', timeout=120)
+
+
 @pytest.mark.flash_encryption
 @pytest.mark.parametrize('config', CONFIGS_NVS_ENCR_FLASH_ENC, indirect=True)
 def test_nvs_flash_encr_flash_enc(dut: IdfDut) -> None:

components/nvs_flash/test_apps/sdkconfig.ci.nvs_encr_hmac_no_cfg_esp32c3

@@ -0,0 +1,22 @@
+# Restricting to ESP32C3
+CONFIG_IDF_TARGET="esp32c3"
+
+# NOTE: The runner for this test-app has flash-encryption enabled
+# Partition Table
+CONFIG_PARTITION_TABLE_CUSTOM=y
+CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="partitions_nvs_encr_flash_enc.csv"
+CONFIG_PARTITION_TABLE_FILENAME="partitions_nvs_encr_flash_enc.csv"
+CONFIG_PARTITION_TABLE_OFFSET=0x9000
+
+# Enabling Flash Encryption
+CONFIG_SECURE_FLASH_ENC_ENABLED=y
+CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT=y
+CONFIG_SECURE_BOOT_ALLOW_ROM_BASIC=y
+CONFIG_SECURE_BOOT_ALLOW_JTAG=y
+CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
+CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC=y
+CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=y
+CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
+
+# Disabling NVS encryption
+CONFIG_NVS_ENCRYPTION=n