Espressif ESP32-C3 (Legacy) — NuttX latest documentation (2024)

Installing

First, create a directory to hold the toolchain:

$ mkdir -p /path/to/your/toolchain/riscv-none-elf-gcc

Download and extract toolchain:

$ curl -s -L "https://github.com/xpack-dev-tools/riscv-none-elf-gcc-xpack/releases/download/v12.3.0-2/xpack-riscv-none-elf-gcc-12.3.0-2-linux-x64.tar.gz" \| tar -C /path/to/your/toolchain/riscv-none-elf-gcc --strip-components 1 -xz

Add the toolchain to your PATH:

$ echo "export PATH=/path/to/your/toolchain/riscv-none-elf-gcc/bin:$PATH" >> ~/.bashrc

You can edit your shell’s rc files if you don’t use bash.

Secure Boot

Secure Boot protects a device from running any unauthorized (i.e., unsigned) code by checking thateach piece of software that is being booted is signed. On an ESP32-C3, these pieces of software includethe second stage bootloader and each application binary. Note that the first stage bootloader does notrequire signing as it is ROM code thus cannot be changed. This is achieved using specific hardware inconjunction with MCUboot (read more about MCUboot here).

The Secure Boot process on the ESP32-C3 involves the following steps performed:

1. The first stage bootloader verifies the second stage bootloader’s RSA-PSS signature. If the verification is successful,the first stage bootloader loads and executes the second stage bootloader.

2. When the second stage bootloader loads a particular application image, the application’s signature (RSA, ECDSA or ED25519) is verifiedby MCUboot.If the verification is successful, the application image is executed.

Flash Encryption

Flash encryption is intended for encrypting the contents of the ESP32-C3’s off-chip flash memory. Once this feature is enabled,firmware is flashed as plaintext, and then the data is encrypted in place on the first boot. As a result, physical readoutof flash will not be sufficient to recover most flash contents.

Prerequisites

First of all, we need to install imgtool (a MCUboot utility application to manipulate binaryimages) and esptool (the ESP32-C3 toolkit):

$ pip install imgtool esptool

We also need to make sure that the python modules are added to PATH:

$ echo "PATH=$PATH:/home/$USER/.local/bin" >> ~/.bashrc

Now, we will create a folder to store the generated keys (such as ~/signing_keys):

$ mkdir ~/signing_keys && cd ~/signing_keys

With all set up, we can now generate keys to sign the bootloader and application binary images,respectively, of the compiled project:

$ espsecure.py generate_signing_key --version 2 bootloader_signing_key.pem$ imgtool keygen --key app_signing_key.pem --type rsa-3072

Enabling Secure Boot and Flash Encryption

To enable Secure Boot for the current project, go to the project’s NuttX directory, execute make menuconfig and the following steps:

1. Enable experimental features in Build Setup ‣ Show experimental options;

2. Enable MCUboot in Application Configuration ‣ Bootloader Utilities ‣ MCUboot;

3. Change image type to MCUboot-bootable format in System Type ‣ Application Image Configuration ‣ Application Image Format;

4. Enable building MCUboot from the source code by selecting Build binaries from source;in System Type ‣ Application Image Configuration ‣ Source for bootloader binaries;

5. Enable Secure Boot in System Type ‣ Application Image Configuration ‣ Enable hardware Secure Boot in bootloader;

6. If you want to protect the SPI Bus against data sniffing, you can enable Flash Encryption inSystem Type ‣ Application Image Configuration ‣ Enable Flash Encryption on boot.

Now you can design an update and confirm agent to your application. Check the MCUboot design guide and theMCUboot Espressif port documentation formore information on how to apply MCUboot. Also check some notes about the NuttX MCUboot port,the MCUboot porting guide and someexamples of MCUboot applied in Nuttx applications.

After you developed an application which implements all desired functions, you need to flash it into the primary image slotof the device (it will automatically be in the confirmed state, you can learn more about imageconfirmation here).To flash to the primary image slot, select Application image primary slot inSystem Type ‣ Application Image Configuration ‣ Target slot for image flashingand compile it using make -j ESPSEC_KEYDIR=~/signing_keys.

When creating update images, make sure to change System Type ‣ Application Image Configuration ‣ Target slot for image flashingto Application image secondary slot.