本篇文档用来记录同时使能 ESP32-C3 flash 加密以及 secure boot 的流程。
测试环境如下：
- 硬件： ESP32-C3(revision 3)
- idf 版本：v4.4-dev-3042-g220590d599
文章目录
未使能前，设备的 efuse 信息
$ esptool.py flash_id
esptool.py v3.2-dev
Found 2 serial ports
Serial port /dev/ttyUSB0
Connecting....
Detecting chip type... ESP32-C3
Chip is ESP32-C3 (revision 3)
Features: Wi-Fi
Crystal is 40MHz
MAC: 7c:df:a1:61:bd:20
Uploading stub...
Running stub...
Stub running...
Manufacturer: 20
Device: 4016
Detected flash size: 4MB
Hard resetting via RTS pin...
$ espefuse.py --chip esp32c3 summary
Connecting....
espefuse.py v3.2-dev
EFUSE_NAME (Block) Description = [Meaningful Value] [Readable/Writeable] (Hex Value)
----------------------------------------------------------------------------------------
Calibration fuses:
TEMP_SENSOR_CAL (BLOCK2) Temperature calibration = -15.100000000000001 R/W (0b110010111)
ADC1_MODE0_D2 (BLOCK2) ADC1 calibration 1 = -208 R/W (0xb4)
ADC1_MODE1_D2 (BLOCK2) ADC1 calibration 2 = 348 R/W (0x57)
ADC1_MODE2_D2 (BLOCK2) ADC1 calibration 3 = -16 R/W (0x84)
ADC1_MODE3_D2 (BLOCK2) ADC1 calibration 4 = 184 R/W (0x2e)
ADC2_MODE0_D2 (BLOCK2) ADC2 calibration 5 = -200 R/W (0xb2)
ADC2_MODE1_D2 (BLOCK2) ADC2 calibration 6 = -488 R/W (0xfa)
ADC2_MODE2_D2 (BLOCK2) ADC2 calibration 7 = -396 R/W (0xe3)
ADC2_MODE3_D2 (BLOCK2) ADC2 calibration 8 = -12 R/W (0x83)
ADC1_MODE0_D1 (BLOCK2) ADC1 calibration 9 = 4 R/W (0b000001)
ADC1_MODE1_D1 (BLOCK2) ADC1 calibration 10 = -100 R/W (0b111001)
ADC1_MODE2_D1 (BLOCK2) ADC1 calibration 11 = 100 R/W (0b011001)
ADC1_MODE3_D1 (BLOCK2) ADC1 calibration 12 = 8 R/W (0b000010)
ADC2_MODE0_D1 (BLOCK2) ADC2 calibration 13 = 0 R/W (0b000000)
ADC2_MODE1_D1 (BLOCK2) ADC2 calibration 14 = 0 R/W (0b000000)
ADC2_MODE2_D1 (BLOCK2) ADC2 calibration 15 = 0 R/W (0b000000)
ADC2_MODE3_D1 (BLOCK2) ADC2 calibration 16 = 0 R/W (0b000000)
Config fuses:
DIS_ICACHE (BLOCK0) Disables ICache = False R/W (0b0)
DIS_DOWNLOAD_ICACHE (BLOCK0) Disables Icache when SoC is in Download mode = False R/W (0b0)
DIS_FORCE_DOWNLOAD (BLOCK0) Disables forcing chip into Download mode = False R/W (0b0)
DIS_CAN (BLOCK0) Disables the TWAI Controller hardware = False R/W (0b0)
VDD_SPI_AS_GPIO (BLOCK0) Set this bit to vdd spi pin function as gpio = False R/W (0b0)
BTLC_GPIO_ENABLE (BLOCK0) Enable btlc gpio = 0 R/W (0b00)
POWERGLITCH_EN (BLOCK0) Set this bit to enable power glitch function = False R/W (0b0)
POWER_GLITCH_DSENSE (BLOCK0) Sample delay configuration of power glitch = 0 R/W (0b00)
DIS_LEGACY_SPI_BOOT (BLOCK0) Disables Legacy SPI boot mode = False R/W (0b0)
UART_PRINT_CHANNEL (BLOCK0) Selects the default UART for printing boot msg = UART0 R/W (0b0)
UART_PRINT_CONTROL (BLOCK0) Sets the default UART boot message output mode = Enabled R/W (0b00)
FORCE_SEND_RESUME (BLOCK0) Force ROM code to send a resume command during SPI = False R/W (0b0)
bootduring SPI boot
BLOCK_USR_DATA (BLOCK3) User data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
Efuse fuses:
WR_DIS (BLOCK0) Disables programming of individual eFuses = 0 R/W (0x00000000)
RD_DIS (BLOCK0) Disables software reading from BLOCK4-10 = 0 R/W (0b0000000)
Flash Config fuses:
FLASH_TPUW (BLOCK0) Configures flash startup delay after SoC power-up, = 0 R/W (0x0)
unit is (ms/2). When the value is 15, delay is 7.
5 ms
FLASH_ECC_MODE (BLOCK0) Set this bit to set flsah ecc mode.
= flash ecc 16to18 byte mode R/W (0b0)
FLASH_TYPE (BLOCK0) Selects SPI flash type = 4 data lines R/W (0b0)
FLASH_PAGE_SIZE (BLOCK0) Flash page size = 0 R/W (0b00)
FLASH_ECC_EN (BLOCK0) Enable ECC for flash boot = False R/W (0b0)
Identity fuses:
SECURE_VERSION (BLOCK0) Secure version (used by ESP-IDF anti-rollback feat = 0 R/W (0x0000)
ure)
MAC (BLOCK1) Factory MAC Address
= 7c:df:a1:61:bd:20 (OK) R/W
WAFER_VERSION (BLOCK1) WAFER version = 3 R/W (0b011)
PKG_VERSION (BLOCK1) Package version = ESP32-C3 R/W (0b000)
BLOCK1_VERSION (BLOCK1) BLOCK1 efuse version = 4 R/W (0b100)
OPTIONAL_UNIQUE_ID (BLOCK2) Optional unique 128-bit ID
= a6 22 f8 ea 75 8e 71 7c ac d6 4c 9c b5 13 80 11 R/W
BLOCK2_VERSION (BLOCK2) Version of BLOCK2 = With calibration R/W (0b001)
CUSTOM_MAC (BLOCK3) Custom MAC Address
= 00:00:00:00:00:00 (OK) R/W
Jtag Config fuses:
JTAG_SEL_ENABLE (BLOCK0) Set this bit to enable selection between usb_to_jt = False R/W (0b0)
ag and pad_to_jtag through strapping gpio10 when b
oth reg_dis_usb_jtag and reg_dis_pad_jtag are equa
l to 0.
SOFT_DIS_JTAG (BLOCK0) Software disables JTAG. When software disabled, JT = 0 R/W (0b000)
AG can be activated temporarily by HMAC peripheral
DIS_PAD_JTAG (BLOCK0) Permanently disable JTAG access via pads. USB JTAG = False R/W (0b0)
is controlled separately.
Security fuses:
DIS_DOWNLOAD_MANUAL_ENCRYPT (BLOCK0) Disables flash encryption when in download boot mo = False R/W (0b0)
des
SPI_BOOT_CRYPT_CNT (BLOCK0) Enables encryption and decryption, when an SPI boo = Disable R/W (0b000)
t mode is set. Enabled when 1 or 3 bits are set,di
sabled otherwise
SECURE_BOOT_KEY_REVOKE0 (BLOCK0) If set, revokes use of secure boot key digest 0 = False R/W (0b0)
SECURE_BOOT_KEY_REVOKE1 (BLOCK0) If set, revokes use of secure boot key digest 1 = False R/W (0b0)
SECURE_BOOT_KEY_REVOKE2 (BLOCK0) If set, revokes use of secure boot key digest 2 = False R/W (0b0)
KEY_PURPOSE_0 (BLOCK0) KEY0 purpose = USER R/W (0x0)
KEY_PURPOSE_1 (BLOCK0) KEY1 purpose = USER R/W (0x0)
KEY_PURPOSE_2 (BLOCK0) KEY2 purpose = USER R/W (0x0)
KEY_PURPOSE_3 (BLOCK0) KEY3 purpose = USER R/W (0x0)
KEY_PURPOSE_4 (BLOCK0) KEY4 purpose = USER R/W (0x0)
KEY_PURPOSE_5 (BLOCK0) KEY5 purpose = USER R/W (0x0)
SECURE_BOOT_EN (BLOCK0) Enables secure boot = False R/W (0b0)
SECURE_BOOT_AGGRESSIVE_REVOKE (BLOCK0) Enables aggressive secure boot key revocation mode = False R/W (0b0)
DIS_DOWNLOAD_MODE (BLOCK0) Disables all Download boot modes = False R/W (0b0)
ENABLE_SECURITY_DOWNLOAD (BLOCK0) Enables secure UART download mode (read/write flas = False R/W (0b0)
h only)
BLOCK_KEY0 (BLOCK4)
Purpose: USER
Encryption key0 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY1 (BLOCK5)
Purpose: USER
Encryption key1 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY2 (BLOCK6)
Purpose: USER
Encryption key2 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY3 (BLOCK7)
Purpose: USER
Encryption key3 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY4 (BLOCK8)
Purpose: USER
Encryption key4 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY5 (BLOCK9)
Purpose: USER
Encryption key5 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_SYS_DATA2 (BLOCK10) System data (part 2)
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
Spi_Pad_Config fuses:
SPI_PAD_CONFIG_CLK (BLOCK1) SPI CLK pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_Q (BLOCK1) SPI Q (D1) pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D (BLOCK1) SPI D (D0) pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_CS (BLOCK1) SPI CS pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_HD (BLOCK1) SPI HD (D3) pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_WP (BLOCK1) SPI WP (D2) pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_DQS (BLOCK1) SPI DQS pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D4 (BLOCK1) SPI D4 pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D5 (BLOCK1) SPI D5 pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D6 (BLOCK1) SPI D6 pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D7 (BLOCK1) SPI D7 pad = 0 R/W (0b000000)
Usb Config fuses:
DIS_USB_JTAG (BLOCK0) Disables USB JTAG. JTAG access via pads is control = False R/W (0b0)
led separately
DIS_USB_DEVICE (BLOCK0) Disables USB DEVICE = False R/W (0b0)
DIS_USB (BLOCK0) Disables the USB OTG hardware = False R/W (0b0)
USB_EXCHG_PINS (BLOCK0) Exchanges USB D+ and D- pins = False R/W (0b0)
DIS_USB_DOWNLOAD_MODE (BLOCK0) Disables use of USB in UART download boot mode = False R/W (0b0)
Vdd_Spi Config fuses:
PIN_POWER_SELECTION (BLOCK0) GPIO33-GPIO37 power supply selection in ROM code = VDD3P3_CPU R/W (0b0)
Wdt Config fuses:
WDT_DELAY_SEL (BLOCK0) Selects RTC WDT timeout threshold at startup = False R/W (0b0)
使能 flash 加密和 secure boot
通过 menuconfig 使能
参考链接：How To Enable Secure Boot V2
如果使能
Sign binaries during build, 将会在构建过程中对 app/partition bin 进行签名，Secure boot private signing key中指定的文件将用于对 app/partition bin 进行签名。
如果该选项禁用，将会生成未签名的 app/partition bin，必须使用espsecure.py手动签名。
可使用下面的命令手动签名：
espsecure.py sign_data --version 2 --keyfile ./my_signing_key.pem --output ./image_signed.bin image-unsigned.bin
可参考 Manual Commands
调整分区表地址
使能 flash 加密以及 secure boot 后，生成的 bootloader bin 会变大，可以通过调整分区表地址增大 bootloader 分区大小，下图将分区表的地址从默认的 0x8000 调整到 0xF000。
生成签名密钥
$ espsecure.py generate_signing_key --version 2 secure_boot_signing_key.pem
espsecure.py v3.2-dev
RSA 3072 private key in PEM format written to secure_boot_signing_key.pem
执行 idf.py bootloader
$ idf.py bootloader
...
==============================================================================
Bootloader built. Secure boot enabled, so bootloader not flashed automatically.
To sign the bootloader with additional private keys.
/home/mali/.espressif/python_env/idf4.4_py3.8_env/bin/python /home/mali/esp/esp32/master/components/esptool_py/esptool/espsecure.py sign_data -k secure_boot_signing_key2.pem -v 2 --append_signatures -o signed_bootloader.bin build/bootloader/bootloader.bin
Secure boot enabled, so bootloader not flashed automatically.
/home/mali/.espressif/python_env/idf4.4_py3.8_env/bin/python /home/mali/esp/esp32/master/components/esptool_py/esptool/esptool.py --chip esp32c3 --port=(PORT) --baud=(BAUD) --before=default_reset --after=no_reset --no-stub write_flash --flash_mode dio --flash_freq 80m --flash_size 2MB 0x0 /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/bootloader.bin
==============================================================================
[91/93] Generating binary image from built executable
esptool.py v3.2-dev
Merged 1 ELF section
Generated /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/bootloader.bin
[92/93] cd /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/esp-idf/esptool_py && /home/mali/.espressif/python_env/idf4.4_py3.8_env/bin/python /home/mali/esp/esp32/master/components/partition_table/check_sizes.py --offset 0xf000 bootloader 0x0 /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/bootloader.bin
Bootloader binary size 0x9440 bytes. 0x5bc0 bytes (38%) free.
[93/93] Generated the signed Bootloader
espsecure.py v3.2-dev
Padding data contents by 3008 bytes so signature sector aligns at sector boundary
1 signing key(s) found.
Signed 40960 bytes of data from /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/bootloader-unsigned.bin. Signature sector now has 1 signature blocks.
Generated signed binary image /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/bootloader.bin from /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/bootloader-unsigned.bin
[8/8] Completed 'bootloader'
Bootloader build complete.
secure boot 使能的情况下，bootloader bin 不会自动烧录，需要根据提示的烧录指令手动烧录。
在上面的日志可以看到，提示的烧录指令如下：
/home/mali/esp/esp32/master/components/esptool_py/esptool/esptool.py --chip esp32c3 --port=(PORT) --baud=(BAUD) --before=default_reset --after=no_reset --no-stub write_flash --flash_mode dio --flash_freq 80m --flash_size 2MB 0x0 /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/bootloader.bin
可以指定端口和波特率，也可以使用默认的数值进行烧录，如下：
$ /home/mali/.espressif/python_env/idf4.4_py3.8_env/bin/python /home/mali/esp/esp32/master/components/esptool_py/esptool/esptool.py --chip esp32c3 --before=default_reset --after=no_reset --no-stub write_flash --flash_mode dio --flash_freq 80m --flash_size 2MB 0x0 /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/bootloader.bin
esptool.py v3.2-dev
Found 2 serial ports
Serial port /dev/ttyUSB0
Connecting....
Chip is ESP32-C3 (revision 3)
Features: Wi-Fi
Crystal is 40MHz
MAC: 7c:df:a1:61:bd:20
Enabling default SPI flash mode...
Configuring flash size...
Flash will be erased from 0x00000000 to 0x0000afff...
Erasing flash...
Took 0.40s to erase flash block
Wrote 45056 bytes at 0x00000000 in 4.6 seconds (77.8 kbit/s)...
Hash of data verified.
Leaving...
Staying in bootloader.
执行 idf.py build，生成 app/partition bin
$ idf.py build
Executing action: all (aliases: build)
Running ninja in directory /home/mali/esp/esp32/master/examples/get-started/hello_world/build
Executing "ninja all"...
[7/967] Performing build step for 'bootloader'
[1/1] cd /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/esp-idf/esptool_py && /home/mali/.espressif/python_env/idf4.4_py3.8_env/bin/python /home/mali/esp/esp32/master/components/partition_table/check_sizes.py --offset 0xf000 bootloader 0x0 /home/mali/esp/esp32/master/examples/get-started/hello_world/build/bootloader/bootloader.bin
Bootloader binary size 0xb000 bytes. 0x4000 bytes (27%) free.
[963/965] Generating binary image from built executable
esptool.py v3.2-dev
Merged 1 ELF section
Generated /home/mali/esp/esp32/master/examples/get-started/hello_world/build/hello-world-unsigned.bin
[964/965] Generating signed binary image
espsecure.py v3.2-dev
1 signing key(s) found.
Signed 196608 bytes of data from /home/mali/esp/esp32/master/examples/get-started/hello_world/build/hello-world-unsigned.bin. Signature sector now has 1 signature blocks.
Generated signed binary image /home/mali/esp/esp32/master/examples/get-started/hello_world/build/hello-world.bin from /home/mali/esp/esp32/master/examples/get-started/hello_world/build/hello-world-unsigned.bin
[965/965] cd /home/mali/esp/esp32/master/examples/get-started/hello_world/build/esp-idf/esptool_py &&...artition-table.bin /home/mali/esp/esp32/master/examples/get-started/hello_world/build/hello-world.bin
hello-world.bin binary size 0x31000 bytes. Smallest app partition is 0x100000 bytes. 0xcf000 bytes (81%) free.
Project build complete. To flash, run this command:
/home/mali/.espressif/python_env/idf4.4_py3.8_env/bin/python ../../../components/esptool_py/esptool/esptool.py -p (PORT) -b 460800 --before default_reset --after no_reset --chip esp32c3 --no-stub write_flash --flash_mode dio --flash_size keep --flash_freq 80m 0xf000 build/partition_table/partition-table.bin 0x20000 build/hello-world.bin
or run 'idf.py -p (PORT) flash'
重启设备
$ idf.py monitor
Executing action: monitor
Serial port /dev/ttyUSB0
Connecting....
Detecting chip type... ESP32-C3
Running idf_monitor in directory /home/mali/esp/esp32/master/examples/get-started/hello_world
Executing "/home/mali/.espressif/python_env/idf4.4_py3.8_env/bin/python /home/mali/esp/esp32/master/tools/idf_monitor.py -p /dev/ttyUSB0 -b 115200 --toolchain-prefix riscv32-esp-elf- --target esp32c3 --decode-panic backtrace /home/mali/esp/esp32/master/examples/get-started/hello_world/build/hello-world.elf -m '/home/mali/.espressif/python_env/idf4.4_py3.8_env/bin/python' '/home/mali/esp/esp32/master/tools/idf.py'"...
--- idf_monitor on /dev/ttyUSB0 115200 ---
--- Quit: Ctrl+] | Menu: Ctrl+T | Help: Ctrl+T followed by Ctrl+H ---
ESP-ROM:esp32c3-api1-20210207
Build:Feb 7 2021
rst:0x1 (POWERON),boot:0xc (SPI_FAST_FLASH_BOOT)
SPIWP:0xee
mode:DIO, clock div:1
load:0x3fcd6268,len:0x35d8
load:0x403ce000,len:0x930
load:0x403d0000,len:0x54e4
entry 0x403ce000
I (36) boot: ESP-IDF v4.4-dev-3042-g220590d599-dirty 2nd stage bootloader
I (36) boot: compile time 20:04:19
I (36) boot: chip revision: 3
I (40) boot.esp32c3: SPI Speed : 80MHz
I (44) boot.esp32c3: SPI Mode : DIO
I (49) boot.esp32c3: SPI Flash Size : 2MB
I (54) boot: Enabling RNG early entropy source...
I (59) boot: Partition Table:
I (63) boot: ## Label Usage Type ST Offset Length
I (70) boot: 0 nvs WiFi data 01 02 00010000 00006000
I (78) boot: 1 phy_init RF data 01 01 00016000 00001000
I (85) boot: 2 factory factory app 00 00 00020000 00100000
I (93) boot: End of partition table
I (97) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=07258h ( 29272) map
I (110) esp_image: segment 1: paddr=00027280 vaddr=3fc89e00 size=015bch ( 5564) load
I (115) esp_image: segment 2: paddr=00028844 vaddr=40380000 size=077d4h ( 30676) load
I (128) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=16fb4h ( 94132) map
I (145) esp_image: segment 4: paddr=00046fdc vaddr=403877d4 size=024bch ( 9404) load
I (147) esp_image: segment 5: paddr=000494a0 vaddr=50000000 size=00010h ( 16) load
I (150) esp_image: segment 6: paddr=000494b8 vaddr=00000000 size=06b18h ( 27416)
I (163) esp_image: Verifying image signature...
I (164) secure_boot_v2: Secure boot V2 is not enabled yet and eFuse digest keys are not set
I (173) secure_boot_v2: Verifying with RSA-PSS...
I (181) secure_boot_v2: Signature verified successfully!
I (187) boot: Loaded app from partition at offset 0x20000
I (190) secure_boot_v2: enabling secure boot v2...
I (196) efuse: Batch mode of writing fields is enabled
I (202) esp_image: segment 0: paddr=00000020 vaddr=3fcd6268 size=035d8h ( 13784)
I (212) esp_image: segment 1: paddr=00003600 vaddr=403ce000 size=00930h ( 2352)
I (218) esp_image: segment 2: paddr=00003f38 vaddr=403d0000 size=054e4h ( 21732)
I (229) esp_image: Verifying image signature...
I (232) secure_boot_v2: Secure boot V2 is not enabled yet and eFuse digest keys are not set
I (241) secure_boot_v2: Verifying with RSA-PSS...
I (249) secure_boot_v2: Signature verified successfully!
I (252) secure_boot_v2: Secure boot digests absent, generating..
I (265) secure_boot_v2: Digests successfully calculated, 1 valid signatures (image offset 0x0)
I (268) secure_boot_v2: 1 signature block(s) found appended to the bootloader.
I (275) secure_boot_v2: Burning public key hash to eFuse
I (283) efuse: Writing EFUSE_BLK_KEY0 with purpose 9
I (308) secure_boot_v2: Digests successfully calculated, 1 valid signatures (image offset 0x20000)
I (308) secure_boot_v2: 1 signature block(s) found appended to the app.
I (314) secure_boot_v2: Application key(0) matches with bootloader key(0).
I (321) secure_boot_v2: Revoking empty key digest slot (1)...
I (328) secure_boot_v2: Revoking empty key digest slot (2)...
I (334) secure_boot_v2: blowing secure boot efuse...
I (340) secure_boot: Enabling Security download mode...
I (346) secure_boot: Disable hardware & software JTAG...
I (357) efuse: Batch mode. Prepared fields are committed
I (358) secure_boot_v2: Secure boot permanently enabled
I (364) boot: Checking flash encryption...
I (369) efuse: Batch mode of writing fields is enabled
I (374) flash_encrypt: Generating new flash encryption key...
I (383) efuse: Writing EFUSE_BLK_KEY1 with purpose 4
W (387) flash_encrypt: Not disabling UART bootloader encryption
I (393) flash_encrypt: Disable UART bootloader cache...
I (399) flash_encrypt: Disable JTAG...
I (408) efuse: Batch mode. Prepared fields are committed
I (409) esp_image: segment 0: paddr=00000020 vaddr=3fcd6268 size=035d8h ( 13784)
I (419) esp_image: segment 1: paddr=00003600 vaddr=403ce000 size=00930h ( 2352)
I (426) esp_image: segment 2: paddr=00003f38 vaddr=403d0000 size=054e4h ( 21732)
I (437) esp_image: Verifying image signature...
I (439) secure_boot_v2: Verifying with RSA-PSS...
I (447) secure_boot_v2: Signature verified successfully!
I (964) flash_encrypt: bootloader encrypted successfully
I (1011) flash_encrypt: partition table encrypted and loaded successfully
I (1012) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=07258h ( 29272) map
I (1021) esp_image: segment 1: paddr=00027280 vaddr=3fc89e00 size=015bch ( 5564)
I (1025) esp_image: segment 2: paddr=00028844 vaddr=40380000 size=077d4h ( 30676)
I (1037) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=16fb4h ( 94132) map
I (1055) esp_image: segment 4: paddr=00046fdc vaddr=403877d4 size=024bch ( 9404)
I (1057) esp_image: segment 5: paddr=000494a0 vaddr=50000000 size=00010h ( 16)
I (1061) esp_image: segment 6: paddr=000494b8 vaddr=00000000 size=06b18h ( 27416)
I (1073) esp_image: Verifying image signature...
I (1074) secure_boot_v2: Verifying with RSA-PSS...
I (1083) secure_boot_v2: Signature verified successfully!
I (1086) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x100000)...
I (12900) flash_encrypt: Done encrypting
I (12902) flash_encrypt: Flash encryption completed
I (12902) boot: Resetting with flash encryption enabled...
ESP-ROM:esp32c3-api1-20210207
Build:Feb 7 2021
rst:0x3 (RTC_SW_SYS_RST),boot:0xc (SPI_FAST_FLASH_BOOT)
Saved PC:0x403d13c6
SPIWP:0xee
mode:DIO, clock div:1
Valid secure boot key blocks: 0
secure boot verification succeeded
load:0x3fcd6268,len:0x35d8
load:0x403ce000,len:0x930
load:0x403d0000,len:0x54e4
entry 0x403ce000
I (80) boot: ESP-IDF v4.4-dev-3042-g220590d599-dirty 2nd stage bootloader
I (80) boot: compile time 20:04:19
I (80) boot: chip revision: 3
I (84) boot.esp32c3: SPI Speed : 80MHz
I (89) boot.esp32c3: SPI Mode : DIO
I (93) boot.esp32c3: SPI Flash Size : 2MB
I (98) boot: Enabling RNG early entropy source...
I (103) boot: Partition Table:
I (107) boot: ## Label Usage Type ST Offset Length
I (114) boot: 0 nvs WiFi data 01 02 00010000 00006000
I (122) boot: 1 phy_init RF data 01 01 00016000 00001000
I (129) boot: 2 factory factory app 00 00 00020000 00100000
I (137) boot: End of partition table
I (141) esp_image: segment 0: paddr=00020020 vaddr=3c020020 size=07258h ( 29272) map
I (155) esp_image: segment 1: paddr=00027280 vaddr=3fc89e00 size=015bch ( 5564) load
I (159) esp_image: segment 2: paddr=00028844 vaddr=40380000 size=077d4h ( 30676) load
I (173) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=16fb4h ( 94132) map
I (191) esp_image: segment 4: paddr=00046fdc vaddr=403877d4 size=024bch ( 9404) load
I (193) esp_image: segment 5: paddr=000494a0 vaddr=50000000 size=00010h ( 16) load
I (197) esp_image: segment 6: paddr=000494b8 vaddr=00000000 size=06b18h ( 27416)
I (209) esp_image: Verifying image signature...
I (210) secure_boot_v2: Verifying with RSA-PSS...
I (218) secure_boot_v2: Signature verified successfully!
I (224) boot: Loaded app from partition at offset 0x20000
I (227) secure_boot_v2: enabling secure boot v2...
I (233) secure_boot_v2: secure boot v2 is already enabled, continuing..
I (240) boot: Checking flash encryption...
I (245) flash_encrypt: flash encryption is enabled (1 plaintext flashes left)
I (253) boot: Disabling RNG early entropy source...
I (269) cpu_start: Pro cpu up.
I (278) cpu_start: Pro cpu start user code
I (278) cpu_start: cpu freq: 160000000
I (278) cpu_start: Application information:
I (281) cpu_start: Project name: hello-world
I (286) cpu_start: App version: list-1448-g220590d599-dirty
I (293) cpu_start: Compile time: Dec 15 2021 20:11:19
I (299) cpu_start: ELF file SHA256: 9f73efaf38751407...
I (305) cpu_start: ESP-IDF: v4.4-dev-3042-g220590d599-dirty
I (312) heap_init: Initializing. RAM available for dynamic allocation:
I (319) heap_init: At 3FC8C380 len 00033C80 (207 KiB): DRAM
I (325) heap_init: At 3FCC0000 len 0001F060 (124 KiB): STACK/DRAM
I (332) heap_init: At 50000010 len 00001FF0 (7 KiB): RTCRAM
I (339) spi_flash: detected chip: generic
I (343) spi_flash: flash io: dio
W (347) spi_flash: Detected size(4096k) larger than the size in the binary image header(2048k). Using the size in the binary image header.
W (360) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure)
I (368) sleep: Configure to isolate all GPIO pins in sleep state
I (374) sleep: Enable automatic switching of GPIO sleep configuration
I (381) cpu_start: Starting scheduler.
Hello world!
This is esp32c3 chip with 1 CPU core(s), WiFi/BLE, silicon revision 3, 2MB external flash
Minimum free heap size: 329848 bytes
如果将
UART ROM download mode设置为Permanently switch to Secure mode,则无法读取设备的 efuse 值。
参考 UART ROM download mode
$ espefuse.py --chip esp32c3 summary
Connecting....
Traceback (most recent call last):
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espefuse.py", line 148, in <module>
_main()
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espefuse.py", line 141, in _main
main()
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espefuse.py", line 119, in main
efuses, efuse_operations = get_efuses(esp, just_print_help, debug_mode, args1.do_not_confirm)
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espefuse.py", line 77, in get_efuses
return (efuse.EspEfuses(esp, skip_connect, debug_mode, do_not_confirm), efuse.operations)
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espressif/efuse/esp32c3/fields.py", line 84, in __init__
self.blocks = [EfuseBlock(self, self.Blocks.get(block), skip_read=skip_connect) for block in self.Blocks.BLOCKS]
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espressif/efuse/esp32c3/fields.py", line 84, in <listcomp>
self.blocks = [EfuseBlock(self, self.Blocks.get(block), skip_read=skip_connect) for block in self.Blocks.BLOCKS]
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espressif/efuse/esp32c3/fields.py", line 42, in __init__
super(EfuseBlock, self).__init__(parent, param, skip_read=skip_read)
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espressif/efuse/base_fields.py", line 141, in __init__
self.read()
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espressif/efuse/base_fields.py", line 187, in read
words = self.get_words()
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espressif/efuse/base_fields.py", line 184, in get_words
return [self.parent.read_reg(offs) for offs in get_offsets(self)]
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espressif/efuse/base_fields.py", line 184, in <listcomp>
return [self.parent.read_reg(offs) for offs in get_offsets(self)]
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/espressif/efuse/base_fields.py", line 352, in read_reg
return self._esp.read_reg(addr)
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/esptool.py", line 702, in read_reg
val, data = self.command(self.ESP_READ_REG, struct.pack('<I', addr), timeout=timeout)
File "/home/mali/esp/esp32/master/components/esptool_py/esptool/esptool.py", line 477, in command
raise UnsupportedCommandError(self, op)
esptool.UnsupportedCommandError: This command (0xa) is not supported in Secure Download Mode
2711
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
