ESP32-C3 flash encryption & secure boot

原创

已于 2022-01-26 00:18:24 修改 · 2.9k 阅读

8 ·

CC 4.0 BY-SA版权

文章标签：

#flash

于 2021-12-21 17:47:43 首次发布

本文介绍ESP32-C3芯片如何启用安全启动和闪存加密，包括配置步骤、生成签名密钥、调整分区表地址及手动烧录等关键环节。

本篇文档用来记录同时使能 ESP32-C3 flash 加密以及 secure boot 的流程。
测试环境如下：

硬件： ESP32-C3(revision 3)
idf 版本：v4.4-dev-3042-g220590d599

文章目录

未使能前，设备的 efuse 信息

$ esptool.py flash_id                                                                                                                                                                                 
esptool.py v3.2-dev
Found 2 serial ports
Serial port /dev/ttyUSB0
Connecting....
Detecting chip type... ESP32-C3
Chip is ESP32-C3 (revision 3)
Features: Wi-Fi
Crystal is 40MHz
MAC: 7c:df:a1:61:bd:20
Uploading stub...
Running stub...
Stub running...
Manufacturer: 20
Device: 4016
Detected flash size: 4MB
Hard resetting via RTS pin...

$ espefuse.py --chip esp32c3 summary
Connecting....
espefuse.py v3.2-dev
EFUSE_NAME (Block) Description  = [Meaningful Value] [Readable/Writeable] (Hex Value)
----------------------------------------------------------------------------------------
Calibration fuses:
TEMP_SENSOR_CAL (BLOCK2)                           Temperature calibration                            = -15.100000000000001 R/W (0b110010111)
ADC1_MODE0_D2 (BLOCK2)                             ADC1 calibration 1                                 = -208 R/W (0xb4)
ADC1_MODE1_D2 (BLOCK2)                             ADC1 calibration 2                                 = 348 R/W (0x57)
ADC1_MODE2_D2 (BLOCK2)                             ADC1 calibration 3                                 = -16 R/W (0x84)
ADC1_MODE3_D2 (BLOCK2)                             ADC1 calibration 4                                 = 184 R/W (0x2e)
ADC2_MODE0_D2 (BLOCK2)                             ADC2 calibration 5                                 = -200 R/W (0xb2)
ADC2_MODE1_D2 (BLOCK2)                             ADC2 calibration 6                                 = -488 R/W (0xfa)
ADC2_MODE2_D2 (BLOCK2)                             ADC2 calibration 7                                 = -396 R/W (0xe3)
ADC2_MODE3_D2 (BLOCK2)                             ADC2 calibration 8                                 = -12 R/W (0x83)
ADC1_MODE0_D1 (BLOCK2)                             ADC1 calibration 9                                 = 4 R/W (0b000001)
ADC1_MODE1_D1 (BLOCK2)                             ADC1 calibration 10                                = -100 R/W (0b111001)
ADC1_MODE2_D1 (BLOCK2)                             ADC1 calibration 11                                = 100 R/W (0b011001)
ADC1_MODE3_D1 (BLOCK2)                             ADC1 calibration 12                                = 8 R/W (0b000010)
ADC2_MODE0_D1 (BLOCK2)                             ADC2 calibration 13                                = 0 R/W (0b000000)
ADC2_MODE1_D1 (BLOCK2)                             ADC2 calibration 14                                = 0 R/W (0b000000)
ADC2_MODE2_D1 (BLOCK2)                             ADC2 calibration 15                                = 0 R/W (0b000000)
ADC2_MODE3_D1 (BLOCK2)                             ADC2 calibration 16                                = 0 R/W (0b000000)

Config fuses:
DIS_ICACHE (BLOCK0)                                Disables ICache                                    = False R/W (0b0)
DIS_DOWNLOAD_ICACHE (BLOCK0)                       Disables Icache when SoC is in Download mode       = False R/W (0b0)
DIS_FORCE_DOWNLOAD (BLOCK0)                        Disables forcing chip into Download mode           = False R/W (0b0)
DIS_CAN (BLOCK0)                                   Disables the TWAI Controller hardware              = False R/W (0b0)
VDD_SPI_AS_GPIO (BLOCK0)                           Set this bit to vdd spi pin function as gpio       = False R/W (0b0)
BTLC_GPIO_ENABLE (BLOCK0)                          Enable btlc gpio                                   = 0 R/W (0b00)
POWERGLITCH_EN (BLOCK0)                            Set this bit to enable power glitch function       = False R/W (0b0)
POWER_GLITCH_DSENSE (BLOCK0)                       Sample delay configuration of power glitch         = 0 R/W (0b00)
DIS_LEGACY_SPI_BOOT (BLOCK0)                       Disables Legacy SPI boot mode                      = False R/W (0b0)
UART_PRINT_CHANNEL (BLOCK0)                        Selects the default UART for printing boot msg     = UART0 R/W (0b0)
UART_PRINT_CONTROL (BLOCK0)                        Sets the default UART boot message output mode     = Enabled R/W (0b00)
FORCE_SEND_RESUME (BLOCK0)                         Force ROM code to send a resume command during SPI = False R/W (0b0)
                                                    bootduring SPI boot                              
BLOCK_USR_DATA (BLOCK3)                            User data                                         
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W 

Efuse fuses:
WR_DIS (BLOCK0)                                    Disables programming of individual eFuses          = 0 R/W (0x00000000)
RD_DIS (BLOCK0)                                    Disables software reading from BLOCK4-10           = 0 R/W (0b0000000)

Flash Config fuses:
FLASH_TPUW (BLOCK0)                                Configures flash startup delay after SoC power-up, = 0 R/W (0x0)
                                                    unit is (ms/2). When the value is 15, delay is 7.
                                                   5 ms                                              
FLASH_ECC_MODE (BLOCK0)                            Set this bit to set flsah ecc mode.               
   = flash ecc 16to18 byte mode R/W (0b0)
FLASH_TYPE (BLOCK0)                                Selects SPI flash type                             = 4 data lines R/W (0b0)
FLASH_PAGE_SIZE (BLOCK0)                           Flash page size                                    = 0 R/W (0b00)
FLASH_ECC_EN (BLOCK0)                              Enable ECC for flash boot                          = False R/W (0b0)

Identity fuses:
SECURE_VERSION (BLOCK0)                            Secure version (used by ESP-IDF anti-rollback feat = 0 R/W (0x0000)
                                                   ure)                                              
MAC (BLOCK1)                                       Factory MAC Address                               
   = 7c:df:a1:61:bd:20 (OK) R/W 
WAFER_VERSION (BLOCK1)                             WAFER version                                      = 3 R/W (0b011)
PKG_VERSION (BLOCK1)                               Package version                                    = ESP32-C3 R/W (0b000)
BLOCK1_VERSION (BLOCK1)                            BLOCK1 efuse version                               = 4 R/W (0b100)
OPTIONAL_UNIQUE_ID (BLOCK2)                        Optional unique 128-bit ID                        
   = a6 22 f8 ea 75 8e 71 7c ac d6 4c 9c b5 13 80 11 R/W 
BLOCK2_VERSION (BLOCK2)                            Version of BLOCK2                                  = With calibration R/W (0b001)
CUSTOM_MAC (BLOCK3)                                Custom MAC Address                                
   = 00:00:00:00:00:00 (OK) R/W 

Jtag Config fuses:
JTAG_SEL_ENABLE (BLOCK0)

最低0.47元/天解锁文章