ESP32-P4 eFuse 字段总览深入解析 ESP-IDF 中 idf.py efuse-summary 命令的完整输出【免费下载链接】esp-idfEspressif IoT Development Framework. Official development framework for Espressif SoCs.项目地址: https://gitcode.com/GitHub_Trending/es/esp-idfeFuse电子熔丝是 ESP32-P4 芯片上一组“一次编程、不可逆”的微小存储位用于固化 MAC 地址、芯片身份、安全启动密钥、Flash 加密参数等关键系统信息。本文以 ESP-IDF 官方 API 参考文档中针对 ESP32-P4 的 eFuse 摘要示例为主体逐字段解读idf.py efuse-summary命令的完整输出并结合仓库中的 eFuse 定义表CSV与 CLI 源码帮助你在量产烧录、安全部署与出厂校验时准确读懂每一个 eFuse 字段的位置、含义与当前取值。一、背景eFuse Manager 组件与 efuse-summary 命令在 ESP-IDF 中eFuse 的统一管理由eFuse Manager组件components/efuse承担它包含三部分核心能力详见 eFuse Manager 文档一种用 CSV 表格定义 eFuse 数据字段的格式efuse_table_gen.py工具将 CSV 转换为 C 结构表示生成工具一组读取/写入 eFuse 字段的 C API如 esp_efuse_api.c。idf.py通过efuse-*系列子命令直接暴露了 eFuse Manager 的部分能力。其中idf.py efuse-summary与 esptool 中的espefuse summary等价用于打印芯片上所有 eFuse 字段的含义、可读/可写状态与十六进制取值。命令定义位于 serial_ext.py除了EFUSE_OPTS端口、波特率、--virt虚拟 eFuse 等通用选项外还支持--format摘要输出格式可选json、summary、value-only三种可选的位置参数efuse-name只输出指定字段的摘要。在 QEMU 等自动化测试中该命令也会被实际调用例如 test_idf_qemu.py 中以efuse-summary --formatsummary作为构建后检查步骤。ESP32-P4 的 eFuse 块布局与部分旧型号不同ESP32-P4 拥有11 个 eFuse 块EFUSE_BLK0 ~ EFUSE_BLK10每块 256 位每块再细分为 8 个 32 位寄存器EFUSE_BLK0、EFUSE_BLK1、EFUSE_BLK2完全用于系统参数EFUSE_BLK3又称EFUSE_BLK_USER_DATA可用于用户参数其中后 48 位被规划为 Custom MACEFUSE_BLK4~EFUSE_BLK9即 KEY0 ~ KEY5可存放 Secure Boot / Flash Encryption 密钥若两功能均未启用也可作用户数据EFUSE_BLK10EFUSE_BLK_SYS_DATA_PART2预留给系统参数主要是 ADC/温度传感器校准数据。这一布局与摘要输出中的 “BLOCK” 标注一一对应下文逐类解读。二、命令完整输出ESP32-P4 原始 eFuse 状态示例以下是官方文档 espefuse_summary_ESP32-P4.rst 中给出的完整示例输出对应一块所有 eFuse 均为 0未烧录的芯片。每行的格式为EFUSE_NAME (Block) 描述 [含义化取值] [可读/可写] (十六进制值)。idf.py efuse-summary Executing action: efuse-summary (...) EFUSE_NAME (Block) Description [Meaningful Value] [Readable/Writeable] (Hex Value) ---------------------------------------------------------------------------------------- Config fuses: WR_DIS (BLOCK0) Disable programming of individual eFuses 0 R/W (0x00000000) RD_DIS (BLOCK0) Disable reading from BlOCK4-10 0 R/W (0b0000000) POWERGLITCH_EN (BLOCK0) Represents whether power glitch function is enable False R/W (0b0) d. 1: enabled. 0: disabled DIS_TWAI (BLOCK0) Represents whether TWAI function is disabled or en False R/W (0b0) abled. 1: disabled. 0: enabled KM_HUK_GEN_STATE (BLOCK0) Set this bit to control validation of HUK generate 0 R/W (0b000000000) mode. Odd of 1 is invalid; even of 1 is valid KM_RND_SWITCH_CYCLE (BLOCK0) Set bits to control key manager random number swit 0 R/W (0b00) ch cycle. 0: control by register. 1: 8 km clk cycl es. 2: 16 km cycles. 3: 32 km cycles KM_DEPLOY_ONLY_ONCE (BLOCK0) Set each bit to control whether corresponding key 0 R/W (0x0) can only be deployed once. 1 is true; 0 is false. Bit0: ecdsa. Bit1: xts. Bit2: hmac. Bit3: ds DIS_DIRECT_BOOT (BLOCK0) Represents whether direct boot mode is disabled or False R/W (0b0) enabled. 1: disabled. 0: enabled UART_PRINT_CONTROL (BLOCK0) Represents the type of UART printing. 00: force en 0 R/W (0b00) able printing. 01: enable printing when GPIO8 is r eset at low level. 10: enable printing when GPIO8 is reset at high level. 11: force disable printing HYS_EN_PAD (BLOCK0) Represents whether the hysteresis function of corr False R/W (0b0) esponding PAD is enabled. 1: enabled. 0:disabled DCDC_VSET (BLOCK0) Set the dcdc voltage default 0 R/W (0b00000) PXA0_TIEH_SEL_0 (BLOCK0) TBD 0 R/W (0b00) PXA0_TIEH_SEL_1 (BLOCK0) TBD 0 R/W (0b00) PXA0_TIEH_SEL_2 (BLOCK0) TBD 0 R/W (0b00) PXA0_TIEH_SEL_3 (BLOCK0) TBD 0 R/W (0b00) KM_DISABLE_DEPLOY_MODE (BLOCK0) TBD 0 R/W (0x0) HP_PWR_SRC_SEL (BLOCK0) HP system power source select. 0:LDO. 1: DCDC False R/W (0b0) DCDC_VSET_EN (BLOCK0) Select dcdc vset use efuse_dcdc_vset False R/W (0b0) DIS_SWD (BLOCK0) Set this bit to disable super-watchdog False R/W (0b0) PSRAM_CAP (BLOCK1) PSRAM capacity 0 R/W (0b00) PSRAM_TEMP (BLOCK1) PSRAM temperature 0 R/W (0b00) PSRAM_VENDOR (BLOCK1) PSRAM vendor 0 R/W (0b00) BLOCK_USR_DATA (BLOCK3) User data 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W BLOCK_SYS_DATA2 (BLOCK10) System data part 2 (reserved) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W Flash fuses: FLASH_TYPE (BLOCK0) The type of interfaced flash. 0: four data lines; False R/W (0b0) 1: eight data lines FLASH_PAGE_SIZE (BLOCK0) Set flash page size 0 R/W (0b00) FLASH_ECC_EN (BLOCK0) Set this bit to enable ecc for flash boot False R/W (0b0) FLASH_TPUW (BLOCK0) Represents the flash waiting time after power-up; 0 R/W (0x0) in unit of ms. When the value less than 15; the wa iting time is the programmed value. Otherwise; the waiting time is 2 times the programmed value FORCE_SEND_RESUME (BLOCK0) Represents whether ROM code is forced to send a re False R/W (0b0) sume command during SPI boot. 1: forced. 0:not for ced FLASH_CAP (BLOCK1) Flash capacity 0 R/W (0b000) FLASH_TEMP (BLOCK1) Flash temperature 0 R/W (0b00) FLASH_VENDOR (BLOCK1) Flash vendor 0 R/W (0b000) Identity fuses: WAFER_VERSION_MINOR (BLOCK1) Minor chip version 0 R/W (0x0) WAFER_VERSION_MAJOR (BLOCK1) Major chip version 0 R/W (0b00) DISABLE_WAFER_VERSION_MAJOR (BLOCK1) Disables check of wafer version major False R/W (0b0) DISABLE_BLK_VERSION_MAJOR (BLOCK1) Disables check of blk version major False R/W (0b0) BLK_VERSION_MINOR (BLOCK1) BLK_VERSION_MINOR of BLOCK2 0 R/W (0b000) BLK_VERSION_MAJOR (BLOCK1) BLK_VERSION_MAJOR of BLOCK2 0 R/W (0b00) PKG_VERSION (BLOCK1) Package version 0 R/W (0b000) OPTIONAL_UNIQUE_ID (BLOCK2) Optional unique 128-bit ID 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W Jtag fuses: JTAG_SEL_ENABLE (BLOCK0) Represents whether the selection between usb_to_jt False R/W (0b0) ag and pad_to_jtag through strapping gpio15 when b oth EFUSE_DIS_PAD_JTAG and EFUSE_DIS_USB_JTAG are equal to 0 is enabled or disabled. 1: enabled. 0: disabled SOFT_DIS_JTAG (BLOCK0) Represents whether JTAG is disabled in soft way. O 0 R/W (0b000) dd number: disabled. Even number: enabled DIS_PAD_JTAG (BLOCK0) Represents whether JTAG is disabled in the hard wa False R/W (0b0) y(permanently). 1: disabled. 0: enabled Mac fuses: MAC (BLOCK1) MAC address 60:55:f9:f8:80:40 (OK) R/W CUSTOM_MAC (BLOCK3) Custom MAC 00:00:00:00:00:00 (OK) R/W Security fuses: DIS_FORCE_DOWNLOAD (BLOCK0) Represents whether the function that forces chip i False R/W (0b0) nto download mode is disabled or enabled. 1: disab led. 0: enabled SPI_DOWNLOAD_MSPI_DIS (BLOCK0) Set this bit to disable accessing MSPI flash/MSPI False R/W (0b0) ram by SYS AXI matrix during boot_mode_download DIS_DOWNLOAD_MANUAL_ENCRYPT (BLOCK0) Represents whether flash encrypt function is disab False R/W (0b0) led or enabled(except in SPI boot mode). 1: disable d. 0: enabled FORCE_USE_KEY_MANAGER_KEY (BLOCK0) Set each bit to control whether corresponding key 0 R/W (0x0) must come from key manager.. 1 is true; 0 is false . Bit0: ecdsa. Bit1: xts. Bit2: hmac. Bit3: ds FORCE_DISABLE_SW_INIT_KEY (BLOCK0) Set this bit to disable software written init key; False R/W (0b0) and force use efuse_init_key XTS_KEY_LENGTH_256 (BLOCK0) Set this bit to configure flash encryption use xts False R/W (0b0) -128 key; else use xts-256 key SPI_BOOT_CRYPT_CNT (BLOCK0) Enables flash encryption when 1 or 3 bits are set Disable R/W (0b000) and disables otherwise SECURE_BOOT_KEY_REVOKE0 (BLOCK0) Revoke 1st secure boot key False R/W (0b0) SECURE_BOOT_KEY_REVOKE1 (BLOCK0) Revoke 2nd secure boot key False R/W (0b0) SECURE_BOOT_KEY_REVOKE2 (BLOCK0) Revoke 3rd secure boot key False R/W (0b0) KEY_PURPOSE_0 (BLOCK0) Represents the purpose of Key0 USER R/W (0x0) KEY_PURPOSE_1 (BLOCK0) Represents the purpose of Key1 USER R/W (0x0) KEY_PURPOSE_2 (BLOCK0) Represents the purpose of Key2 USER R/W (0x0) KEY_PURPOSE_3 (BLOCK0) Represents the purpose of Key3 USER R/W (0x0) KEY_PURPOSE_4 (BLOCK0) Represents the purpose of Key4 USER R/W (0x0) KEY_PURPOSE_5 (BLOCK0) Represents the purpose of Key5 USER R/W (0x0) SEC_DPA_LEVEL (BLOCK0) Represents the spa secure level by configuring the 0 R/W (0b00) clock random divide mode ECDSA_ENABLE_SOFT_K (BLOCK0) Represents whether hardware random number k is for False R/W (0b0) ced used in ESDCA. 1: force used. 0: not force use d CRYPT_DPA_ENABLE (BLOCK0) Represents whether anti-dpa attack is enabled. 1:e False R/W (0b0) nabled. 0: disabled SECURE_BOOT_EN (BLOCK0) Represents whether secure boot is enabled or disab False R/W (0b0) led. 1: enabled. 0: disabled SECURE_BOOT_AGGRESSIVE_REVOKE (BLOCK0) Represents whether revoking aggressive secure boot False R/W (0b0) is enabled or disabled. 1: enabled. 0: disabled DIS_DOWNLOAD_MODE (BLOCK0) Represents whether Download mode is disabled or en False R/W (0b0) abled. 1: disabled. 0: enabled LOCK_KM_KEY (BLOCK0) TBD False R/W (0b0) ENABLE_SECURITY_DOWNLOAD (BLOCK0) Represents whether security download is enabled or False R/W (0b0) disabled. 1: enabled. 0: disabled SECURE_VERSION (BLOCK0) Represents the version used by ESP-IDF anti-rollba 0 R/W (0x0000) ck feature SECURE_BOOT_DISABLE_FAST_WAKE (BLOCK0) Represents whether FAST VERIFY ON WAKE is disabled False R/W (0b0) or enabled when Secure Boot is enabled. 1: disable d. 0: enabled BLOCK_KEY0 (BLOCK4) Purpose: USER Key0 or user data 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W BLOCK_KEY1 (BLOCK5) Purpose: USER Key1 or user data 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W BLOCK_KEY2 (BLOCK6) Purpose: USER Key2 or user data 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W BLOCK_KEY3 (BLOCK7) Purpose: USER Key3 or user data 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W BLOCK_KEY4 (BLOCK8) Purpose: USER Key4 or user data 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W BLOCK_KEY5 (BLOCK9) Purpose: USER Key5 or user data 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W Usb fuses: USB_DEVICE_EXCHG_PINS (BLOCK0) Enable usb device exchange pins of D and D- False R/W (0b0) USB_OTG11_EXCHG_PINS (BLOCK0) Enable usb otg11 exchange pins of D and D- False R/W (0b0) DIS_USB_JTAG (BLOCK0) Represents whether the function of usb switch to j False R/W (0b0) tag is disabled or enabled. 1: disabled. 0: enable d USB_PHY_SEL (BLOCK0) TBD False R/W (0b0) DIS_USB_OTG_DOWNLOAD_MODE (BLOCK0) Set this bit to disable download via USB-OTG False R/W (0b0) DIS_USB_SERIAL_JTAG_ROM_PRINT (BLOCK0) Represents whether print from USB-Serial-JTAG is d False R/W (0b0) isabled or enabled. 1: disabled. 0: enabled DIS_USB_SERIAL_JTAG_DOWNLOAD_MODE (BLOCK0) Represents whether the USB-Serial-JTAG download fu False R/W (0b0) nction is disabled or enabled. 1: disabled. 0: ena bled Wdt fuses: WDT_DELAY_SEL (BLOCK0) Represents whether RTC watchdog timeout threshold 0 R/W (0b00) is selected at startup. 1: selected. 0: not select ed DIS_WDT (BLOCK0) Set this bit to disable watch dog False R/W (0b0)说明示例中所有取值均为 0未烧录状态R/W表示该字段当前可读且可写。一旦某个位被烧成 1即不可再改回 0因此烧录前务必先用efuse-summary/efuse-dump确认现场状态。三、逐类字段解读含义、位域与取值以下各表在原文档描述的基础上进一步标注了字段在 esp_efuse_table.csv 中的块号与位偏移方便你对照 TRM 定位到具体寄存器位。3.1 Config fuses通用配置类字段位置BLOCK:位示例值含义与取值WR_DISBLK0: bit 0–310x00000000写保护总控。每个位禁止对其关联 eFuse 字段再次编程烧成 1 后关联字段永久只读见 CSV L14RD_DISBLK0: bit 32–380b0000000禁止读取BLOCK4–10KEY0–KEY5 及 SYS_DATA2共 7 个位一一对应CSV L144POWERGLITCH_ENBLK0: bit 420b01 使能 power glitch 防护功能0 关闭DIS_TWAIBLK0: bit 460b01 永久禁用 TWAICAN功能0 使能KM_HUK_GEN_STATEBLK0: bit 58–660b000000000控制 KeyManager HUK 生成模式的校验1 的个数为奇数则状态无效偶数则有效KM_RND_SWITCH_CYCLEBLK0: bit 67–680b00KeyManager 随机数切换周期0 由寄存器控制1 8 个 km clk 周期2 163 32KM_DEPLOY_ONLY_ONCEBLK0: bit 69–720x0每位控制对应密钥是否只允许部署一次。Bit0: ecdsa, Bit1: xts, Bit2: hmac, Bit3: dsDIS_DIRECT_BOOTBLK0: bit 1290b01 禁用 direct boot 模式0 使能UART_PRINT_CONTROLBLK0: bit 134–1350b00UART 打印控制00 强制打印01 GPIO8 复位为低时允许打印10 GPIO8 复位为高时允许打印11 强制关闭打印HYS_EN_PADBLK0: bit 1540b01 使能对应 PAD 的滞回hysteresis功能DCDC_VSETBLK0: bit 155–1590b00000设置 DCDC 电压默认值PXA0_TIEH_SEL_0..3BLK0: bit 160–167各0b004 组 2 位字段官方描述暂为 TBDKM_DISABLE_DEPLOY_MODEBLK0: bit 168–1710x04 位字段官方描述暂为 TBDHP_PWR_SRC_SELBLK0: bit 1780b0HP高性能域系统电源选择0 为 LDO1 为 DCDCDCDC_VSET_ENBLK0: bit 1790b0选择是否使用efuse_dcdc_vset提供的 DCDC 电压设定DIS_SWDBLK0: bit 1810b01 禁用 super-watchdogSWD 硬件看门狗PSRAM_CAPBLK1: bit 77–790b00板载 PSRAM 容量标识PSRAM_TEMPBLK1: bit 80–810b00PSRAM 温度等级标识PSRAM_VENDORBLK1: bit 82–830b00PSRAM 厂商标识BLOCK_USR_DATABLK3: 256 位32 字节全 0用户数据区USER_DATACSV L277可存放自定义参数BLOCK_SYS_DATA2BLK10: 256 位32 字节全 0系统数据第 2 区保留实际存放 ADC/温度传感器校准值3.2 Flash fusesFlash 引导类字段位置示例值含义与取值FLASH_TYPEBLK0: bit 1190b0所接 Flash 类型0 为四数据线Quad1 为八数据线OctalFLASH_PAGE_SIZEBLK0: bit 120–1210b00设置 Flash 页大小FLASH_ECC_ENBLK0: bit 1220b01 为 Flash 引导启用 ECCFLASH_TPUWBLK0: bit 124–1270x0上电后 Flash 就绪等待时间ms。编程值 15 时等待该值否则等待 2 倍编程值FORCE_SEND_RESUMEBLK0: bit 1360b01 强制 ROM 在 SPI boot 过程中发送 resume 命令FLASH_CAPBLK10b000Flash 容量标识FLASH_TEMPBLK10b00Flash 温度等级标识FLASH_VENDORBLK10b000Flash 厂商标识这些字段在量产时用于让 ROM 引导代码正确识别 Flash 型号、上电时序烧录前务必与所贴 Flash 料号核对。3.3 Identity fuses芯片身份类字段位置示例值含义WAFER_VERSION_MINORBLK1: bit 64–670x0芯片小版本号WAFER_VERSION_MAJORBLK1: bit 68–69另有 MSB 在 bit 870b00芯片主版本号DISABLE_WAFER_VERSION_MAJORBLK1: bit 700b0禁用 wafer 主版本号校验DISABLE_BLK_VERSION_MAJORBLK1: bit 710b0禁用块blk主版本号校验BLK_VERSION_MINORBLK1: bit 72–740b000BLOCK2 的小版本号BLK_VERSION_MAJORBLK1: bit 75–760b00BLOCK2 的主版本号PKG_VERSIONBLK1: bit 84–860b000封装package版本号OPTIONAL_UNIQUE_IDBLK2: bit 0–12716 字节全 0可选的 128 位唯一 IDCSV L264可由产线写入用于设备唯一标识3.4 Jtag fuses调试接口类字段位置示例值含义JTAG_SEL_ENABLEBLK0: bit 470b0当DIS_PAD_JTAG与DIS_USB_JTAG均为 0 时是否允许通过 strapping GPIO15 在 usb_to_jtag 与 pad_to_jtag 之间选择1 使能0 禁用SOFT_DIS_JTAGBLK0: bit 48–500b000软方式禁用 JTAG1 的个数为奇数时禁用偶数时使能3 位编码提供容错DIS_PAD_JTAGBLK0: bit 510b0硬方式永久禁用 JTAG 引脚调试1 禁用0 使能配套 USB 类中的DIS_USB_JTAGBLK0 bit 41可单独关闭 USB-Serial-JTAG 的 JTAG 切换功能。三者组合即“量产前永久关闭全部调试通道”的标准操作。3.5 Mac fusesMAC 地址类字段位置示例值说明MACBLK1: bit 0–4760:55:f9:f8:80:40 (OK)工厂 MAC 地址MAC_FACTORYCSV L231-L236非连续位序分 6 段存放(OK)表示 CRC 校验通过CUSTOM_MACBLK3: bit 200–24700:00:00:00:00:00 (OK)自定义 MAC位于用户数据区末尾USER_DATA.MAC_CUSTOMCSV L278未写入时读回全 0ESP32-P4 无内置工厂烧录的 MAC出厂芯片该字段为 0产线可通过espefuse或esp_efuse_write_field()写入并校验。3.6 Security fuses安全类这是与 Secure Boot / Flash Encryption 部署关系最紧密的一组字段位置示例值含义DIS_FORCE_DOWNLOADBLK0: bit 440b01 禁用“强制进入 download 模式”的 strapping 功能SPI_DOWNLOAD_MSPI_DISBLK0: bit 450b01 禁止在 download 模式下由 SYS AXI 矩阵访问 MSPI flash/ramDIS_DOWNLOAD_MANUAL_ENCRYPTBLK0: bit 520b01 禁用除 SPI boot 模式外的手动 Flash 加密功能FORCE_USE_KEY_MANAGER_KEYBLK0: bit 73–760x0每位控制对应密钥必须来自 KeyManagerBit0 ecdsa / Bit1 xts / Bit2 hmac / Bit3 dsFORCE_DISABLE_SW_INIT_KEYBLK0: bit 770b01 禁用软件写入的 init key强制使用efuse_init_keyXTS_KEY_LENGTH_256BLK0: bit 780b01 时 Flash 加密使用 XTS-128 密钥否则使用 XTS-256SPI_BOOT_CRYPT_CNTBLK0: bit 82–840b000DisableFlash 加密总开关3 位中烧 1 位或 3 位即取值为 1 或 7时使能加密其余取值关闭。官方取值表为{0: Disable, 1: Enable, 3: Disable, 7: Enable}CSV L190SECURE_BOOT_KEY_REVOKE0/1/2BLK0: bit 85–87均0b0分别撤销第 1/2/3 把 Secure Boot 密钥实现密钥轮换KEY_PURPOSE_0~KEY_PURPOSE_5BLK0: bit 88–111各 4 位均USER指定 KEY0–KEY5 块的用途示例中为 USER可设为 ECDSA、XTS、HMAC 等SEC_DPA_LEVELBLK0: bit 112–1130b00通过配置时钟随机分频模式设置 DPA 防护安全等级ECDSA_ENABLE_SOFT_KBLK0: bit 1140b01 在 ECDSA 签名中强制使用硬件随机数 kCRYPT_DPA_ENABLEBLK0: bit 1150b01 使能反 DPA 攻击SECURE_BOOT_ENBLK0: bit 1160b0Secure Boot 总开关1 使能0 禁用SECURE_BOOT_AGGRESSIVE_REVOKEBLK0: bit 1170b0使能 Secure Boot 的激进撤销aggressive revoke模式DIS_DOWNLOAD_MODEBLK0: bit 1280b01 永久禁用 Download 模式烧录口彻底关闭LOCK_KM_KEYBLK0: bit 1310b0官方描述暂为 TBDENABLE_SECURITY_DOWNLOADBLK0: bit 1330b01 使能安全下载security downloadSECURE_VERSIONBLK0: bit 137–15216 位0x0000ESP-IDF 防回滚anti-rollback版本号OTA 时单调递增CSV L218SECURE_BOOT_DISABLE_FAST_WAKEBLK0: bit 1530b0Secure Boot 使能时1 禁用唤醒时的 FAST VERIFY ON WAKEBLOCK_KEY0~BLOCK_KEY5BLK4–BLK9各 256 位32 字节全 0六块密钥区摘要中显示其当前用途Purpose: USER与原始值3.7 Usb fusesUSB 类字段位置示例值含义USB_DEVICE_EXCHG_PINSBLK0: bit 390b01 交换 USB Device 的 D/D- 引脚USB_OTG11_EXCHG_PINSBLK0: bit 400b01 交换 USB OTG1.1 的 D/D- 引脚DIS_USB_JTAGBLK0: bit 410b01 禁用 USB 切换 JTAG 功能USB_PHY_SELBLK0: bit 570b0官方描述暂为 TBDDIS_USB_OTG_DOWNLOAD_MODEBLK0: bit 1230b01 禁用通过 USB-OTG 的下载DIS_USB_SERIAL_JTAG_ROM_PRINTBLK0: bit 1300b01 禁用 USB-Serial-JTAG 的 ROM 打印DIS_USB_SERIAL_JTAG_DOWNLOAD_MODEBLK0: bit 1320b01 禁用 USB-Serial-JTAG 下载功能3.8 Wdt fuses看门狗类字段位置示例值含义WDT_DELAY_SELBLK0: bit 80–810b002 位选择启动时 RTC 看门狗超时门限1 选中0 未选中DIS_WDTBLK0: bit 1800b01 永久禁用RTC看门狗四、从输出到源码字段是如何定义的efuse-summary的字段名、分类与描述并非硬编码而是来自 eFuse 定义表。ESP32-P4 的公共表为 esp_efuse_table.csv其记录格式为field_name, efuse_block, bit_start, bit_count, comment例如SPI_BOOT_CRYPT_CNT, EFUSE_BLK0, 82, 3, [] Enables flash encryption when 1 or 3 bits are set and disables otherwise {0: Disable; 1: Enable; 3: Disable; 7: Enable} SECURE_VERSION, EFUSE_BLK0, 137, 16, [] Represents the version used by ESP-IDF anti-rollback feature构建时efuse_table_gen.py会校验字段名唯一、位域不重叠并生成 C 结构esp_efuse_desc_t数组产物包括 esp_efuse_table.c、esp_efuse_fields.c 等修改 CSV 后需手动执行idf.py efuse-common-table重新生成CSV 文件头部注释中有明确提示。从源码结构看摘要中按 Config / Flash / Identity / Jtag / Mac / Security / Usb / Wdt 的分组即来自表格字段到功能类别的映射而--formatjson输出的每个字段对象会包含bit_len、block、pos、word、readable、writeable、value等属性efuse.rst 给出了MAC字段的 JSON 示例可供 CMake 或脚本程序化消费。五、配合使用的其他 eFuse 命令与技巧原始寄存器转储idf.py efuse-dump输出全部 11 个块的 32 位寄存器原始值及读错误寄存器err__regs、EFUSE_RD_RS_ERR0/1_REG用于编码错误排查。同一文档章节中的 P4 示例见 espefuse_summary_ESP32-P4_dump.rst Run dump command BLOCK0 ( ) [0 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 MAC_SPI_8M_0 (BLOCK1 ) [1 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 BLOCK_SYS_DATA (BLOCK2 ) [2 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ...--file-name选项可将每块存为独立 binblk0.bin …再配合burn-block-data回写到另一颗芯片便于产线复制。构建期读取espefuse_get_json_summary()/espefuse_get_efuse()两个 CMake 函数可在CMakeLists.txt中构建期获取 JSON 摘要并按字段取值例如读出MAC的value文档中还介绍了efuse-filter自定义目标可随时用idf.py efuse-filter读取指定字段。虚拟 eFuse 调试KconfigCONFIG_EFUSE_VIRTUAL会将 eFuse 虚拟到 RAM写操作只是模拟不会真正烧片适合单元测试CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH进一步把虚拟 eFuse 持久化到 flashpartition.csv需包含efuse_em, data, efuse, , 0x2000分区可在重启后保持烧录状态用于测试 Secure Boot 与 Flash Encryption。注意若芯片并未真正烧录密钥与SPI_BOOT_CRYPT_CNT该选项只提供测试路径实际 flash 并不会被加密。Token Dump离线导出 eFuse 状态当 UART 下载被禁用、安全下载已部署或设备处于远程时可直接读取 eFuse 很困难。Token 机制以单行带 CRC32 的字符串EFSR/EFSW/EFSRW三种快照编码 eFuse 状态设备端可用esp_efuse_token_dump()生成、esp_efuse_token_burn()应用暂存写入主机端可用espefuse --token EFS... summary离线解码。典型场景包括产线出厂后的安全配置核验、编码错误现场取证与审计留档。WR_DIS 延迟烧录WR_DIS写保护在 BLOCK0 批处理写入时会在其他数据之后单独烧录确保只有在其他 BLOCK0 数据成功烧录后才施加写保护利用烧写重试机制从编码错误中恢复。六、实践建议小结烧录前先摘要任何写入操作前先运行idf.py efuse-summary需要时加--formatjson便于脚本处理确认目标字段当前值杜绝误烧不可逆位量产安全序列典型顺序为写入密钥块BLOCK_KEY0/1→ 设置KEY_PURPOSE_x→ 烧SECURE_BOOT_EN/SPI_BOOT_CRYPT_CNT→ 提升SECURE_VERSION→ 关闭调试DIS_PAD_JTAG、DIS_USB_JTAG→ 最后烧WR_DIS/RD_DIS施加保护保留升级能力若未来需要轮换 Secure Boot 密钥避免提前烧SECURE_BOOT_KEY_REVOKE与过高的SECURE_VERSION16 位仅约 65535 个等级核对 Flash/PSRAM 标识FLASH_CAP/TEMP/VENDOR、PSRAM_CAP/TEMP/VENDOR、FLASH_TYPE等标识字段应与实际料号一致否则 ROM 引导行为可能异常。以上字段与命令行为均以当前仓库文档及 components/efuse/esp32p4 下的定义表为准如需更权威的寄存器级说明请查阅 ESP32-P4 TRM 的 eFuse Controller 章节文档中已给出引用入口。【免费下载链接】esp-idfEspressif IoT Development Framework. Official development framework for Espressif SoCs.项目地址: https://gitcode.com/GitHub_Trending/es/esp-idf创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考