docs(readme): 更新项目文档并移除过时文件

- 添加详细的项目介绍，包括硬件平台、功能模块和目录结构 - 移除旧的 docs/README.md 和 docs/tasks.md 文件 - 更新 .gitignore 添加 .cache/ 目录 - 调整 CMakeLists.txt 依赖项顺序，添加 mbedtls - 简化头文件包含，移除不必要的 esp_log.h 和 esp_netif_types.h 引用
2026-04-27 03:00:48 +08:00
parent 7bb28cee1e
commit df27ef3a98
9 changed files with 129 additions and 697 deletions
@@ -55,6 +55,7 @@ CTestTestfile.cmake
 __pycache__/
 *.egg-info/
 dist/
+.cache/

 # Virtual environment folders
 venv/
@@ -1,60 +1,68 @@
-| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
-| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | -------- | -------- | -------- |
+# ESP32-C3 OTA Relay

-# Wi-Fi SoftAP Example
+ESP32-C3FH4 OTA 中继固件，通过 WiFi / BLE 接收上位机 OTA 固件包，通过 SPI 转发给下位机（GD32）。

-(See the README.md file in the upper level 'examples' directory for more information about examples.)
+## 硬件平台

-This example shows how to use the Wi-Fi SoftAP functionality of the Wi-Fi driver of ESP for serving as an Access Point.
+- **芯片:** ESP32-C3FH4 (RISC-V, 单核)
+- **Flash:** 4MB
+- **编译工具链:** ESP-IDF v6.0, riscv32-esp-elf

-## How to use example
+## 功能模块

-SoftAP supports Protected Management Frames(PMF). Necessary configurations can be set using pmf flags. Please refer [Wifi-Security](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-guides/wifi-security.html) for more info.
+| 模块 | 描述 |
+|------|------|
+| `health_monitor` | 温度 + 电压 + WiFi RSSI 监控 |
+| `ota_relay` | OTA 数据包接收与转发 |
+| `wifi_ota` | WiFi OTA 服务器 (HTTP) |
+| `ble_ota` | BLE OTA 服务器 (GATT) |
+| `spi_master` | SPI 主站，与下位机通信 |
+| `protocol` | CRC 校验 + AES 解密 |

-### Configure the project
-
-Open the project configuration menu (`idf.py menuconfig`).
-
-In the `Example Configuration` menu:
-
-* Set the Wi-Fi configuration.
-    * Set `WiFi SSID`.
-    * Set `WiFi Password`.
-
-Optional: If you need, change the other options according to your requirements.
-
-### Build and Flash
-
-Build the project and flash it to the board, then run the monitor tool to view the serial output:
-
-Run `idf.py -p PORT flash monitor` to build, flash and monitor the project.
-
-(To exit the serial monitor, type ``Ctrl-]``.)
-
-See the Getting Started Guide for all the steps to configure and use the ESP-IDF to build projects.
-
-* [ESP-IDF Getting Started Guide on ESP32](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/get-started/index.html)
-* [ESP-IDF Getting Started Guide on ESP32-S2](https://docs.espressif.com/projects/esp-idf/en/latest/esp32s2/get-started/index.html)
-* [ESP-IDF Getting Started Guide on ESP32-C3](https://docs.espressif.com/projects/esp-idf/en/latest/esp32c3/get-started/index.html)
-
-## Example Output
-
-There is the console output for this example:
+## 目录结构

 ```
-I (917) phy: phy_version: 3960, 5211945, Jul 18 2018, 10:40:07, 0, 0
-I (917) wifi: mode : softAP (30:ae:a4:80:45:69)
-I (917) wifi softAP: wifi_init_softap finished.SSID:myssid password:mypassword
-I (26457) wifi: n:1 0, o:1 0, ap:1 1, sta:255 255, prof:1
-I (26457) wifi: station: 70:ef:00:43:96:67 join, AID=1, bg, 20
-I (26467) wifi softAP: station:70:ef:00:43:96:67 join, AID=1
-I (27657) esp_netif_lwip: DHCP server assigned IP to a station, IP is: 192.168.4.2
+main/
+├── CMakeLists.txt
+├── core/main.cpp          # 任务创建入口
+├── relay/ota_relay.cpp   # OTA 中继逻辑
+├── transport/
+│   ├── spi_master.cpp    # SPI 主站
+│   └── protocol.cpp       # 协议层 (CRC/AES)
+├── server/
+│   ├── wifi_ota.cpp      # WiFi OTA HTTP 服务器
+│   └── ble_ota.cpp       # BLE OTA GATT 服务器
+└── monitor/
+    ├── health_monitor.cpp # 健康监控
+    └── debug_log.cpp     # UDP 调试日志
 ```

-## Running the example on ESP Chips without Wi-Fi
+## 任务配置 (单核 ESP32-C3)

-This example can run on ESP Chips without Wi-Fi using ESP-Hosted. See the [Two-Chip Solution](../../README.md#wi-fi-examples-with-two-chip-solution) section in the upper level `README.md` for information.
+所有任务固定运行在 CPU 核 0：

-## Troubleshooting
+| 任务 | 优先级 | 栈大小 | 说明 |
+|------|--------|--------|------|
+| health_mon | configMAX_PRIORITIES - 4 | 4096 | 健康监控 |
+| ota_relay | configMAX_PRIORITIES - 2 | 8192 | OTA 中继 |
+| wifi_ota | configMAX_PRIORITIES - 3 | 8192 | WiFi OTA |
+| ble_ota | configMAX_PRIORITIES - 3 | 8192 | BLE OTA |

-For any technical queries, please open an [issue](https://github.com/espressif/esp-idf/issues) on GitHub. We will get back to you soon.
+## 待确认参数
+
+- AES-128 主密钥 (MASTER_KEY_HERE)
+- 搅伴算法种子 (SCRAMBLE_CONST_HERE)
+- 芯片唯一码 (CHIP_UID_HERE)
+- OTA Service UUID (需与 APP 侧协商)
+
+## 编译
+
+```bash
+idf.py set-target esp32c3
+idf.py build
+idf.py flash monitor
+```
+
+## 调试日志
+
+UDP 输出到上位机，默认 IP: `DEBUG_LOG_IP`，端口: `DEBUG_LOG_PORT`。
@@ -1,43 +0,0 @@
-# ESP32-C3FH4 OTA Relay
-
-Complete firmware for ESP32-C3FH4 acting as OTA relay between APP/PC and GD32E508VET6.
-
-## Build
-
-```bash
-export IDF_PATH=/path/to/esp-idf
-source $IDF_PATH/export.sh
-mkdir build && cd build
-cmake ..
-make
-```
-
-## Structure
-
-```
-main/
-  main.c           - Entry point, task creation
-  app_main.c       - Application init, system monitor task
-  ota_relay.c      - 4-stage OTA state machine
-  spi_master.c     - SPI2 (VSPI) master driver
-  protocol.c       - Frame format, CRC16, AES, scramble
-  wifi_ota.c       - WiFi AP/STA + HTTP server
-  ble_ota.c        - BLE GATT server
-  health_monitor.c - Temperature/voltage/WiFi monitoring
-```
-
-## Features
-
- WiFi AP mode (SSID: ESP32_OTA_RELAY, pw: 12345678)
- BLE GATT OTA service
- HTTP POST /ota/upload for firmware
- SPI to GD32 (40MHz, GPIO4-9)
- Flash storage with断点续传
- System health monitoring
-
-## TODO (confirm with GD32 team)
-
- MASTER_KEY_HERE - AES-128 master key (16 bytes)
- SCRAMBLE_CONST_HERE - scramble algorithm seed
- CHIP_UID_HERE - GD32 chip unique ID
- GATT UUIDs for OTA service
@@ -1,258 +0,0 @@
-# ESP32-C3FH4 OTA 中继 — 开发任务清单
-
-> 每完成一条就在前面打 `-[x]`（手机/PC 编辑器支持 Markdown checkbox）
-
---
-
-## T0 — 项目基础设施
-
- [x] **T0.1** 搭建 ESP32-C3 工程
-  - 基于 ESP-IDF v5.x，创建 CMake 项目骨架
-  - 配置 chip=esp32c3
-
- [x] **T0.2** 配置 Flash 分区表
-  - 定义 gd32_ota (256KB)、otadata、spiffs、app0、app1 分区
-
- [x] **T0.3** 配置 GPIO 引脚
-  - SPI2 (VSPI) 引脚映射到 GPIO6-9
-  - CS=GPIO4
-
- [x] **T0.4** FreeRTOS 任务框架
-  - 建立 System Monitor / OTA Relay / WiFi Server / BLE GATT 四个任务
-  - 配置任务优先级和栈大小
-
- [x] **T0.5** 日志系统
-  - 统一 printf 接口
-  - Flash 日志写入接口（system_log 分区）
-
---
-
-## T1 — SPI 通信层
-
- [x] **T1.1** SPI2 总线初始化
-  - VSPI, clock=40MHz, mode=0, queue_size=1
-
- [x] **T1.2** SPI 同步读写接口
-  - `spi_sync_transfer(cmd, payload, &recv_buf)` 阻塞式
-
- [x] **T1.3** 协议帧封装/解析
-  - SOF (0xEB) 检测
-  - CMD 路由分发
-  - CRC16 Modbus 校验/生成
-
- [x] **T1.4** SPI 超时与重发
-  - 发送后等待 ACK 超时 3s
-  - ≥3 次则报错并通知 APP
-
---
-
-## T2 — 安全握手与认证（阶段一）
-
- [x] **T2.1** 搅伴算法实现
-  - 输入：时间戳 + 内存地址 + rand
-  - 处理：3轮单字节 + 2轮4字节
-  - 输出：16 bytes nonce_server
-
- [x] **T2.2** AES 加解密实现
-  - 预置主密钥，AES-128 CBC 模式
-  - 使用 ESP32 mbedTLS 库
-  - 实现 `aes_encrypt()` / `aes_decrypt()`
-
- [x] **T2.3** 握手状态机
-  - RELAY_HANDSHAKE_IDLE → HANDSHAKE_WAIT → CHALLENGE_SENT → CHALLENGE_RESPOND → SESSION_KEY_SENT → AUTH_COMPLETE
-
- [x] **T2.4** 会话密钥管理
-  - K_session 存储到 RAM
-  - 握手完成后生效，OTA 结束时清除
-
---
-
-## T3 — OTA 中继核心（阶段二～四）
-
- [x] **T3.1** SEND_SIZE 发送
-  - 发送固件总大小 (4B LE) 给 GD32
-  - 等待 0xBA C0 + seq 确认
-
- [x] **T3.2** Flash 写入接口
-  - `gd32_ota_partition` 追加写入
-  - 支持断点续传（追加不擦写）
-
- [x] **T3.3** `ota_meta.json` 管理
-  - 读写元数据：total_size / stored_size / last_seq / chunk_count
-  - 初始写入 / 中途更新 / 完成后校验
-
- [x] **T3.4** 固件流式转发
-  - 存储完成后，从 Flash 按 48B/packet 逐包发给 GD32
-  - 每包等待 GD32 ACK
-
- [x] **T3.5** DATA_END 处理
-  - 最后一包带 IFEND 标志
-  - 发送后等待 TRANSFER_DONE (0xBA C0 + FF FF FF FF)
-
- [x] **T3.6** FINISH_OTA
-  - 发送 0x0A AC，等待 GD32 跳转确认
-  - 清理会话密钥和 RAM 缓存
-
- [x] **T3.7** 四阶段状态机整合
-  - 串联 T3.1～T3.6，覆盖全部 15 个状态
-  - 与 System Monitor 健康状态联动
-
---
-
-## T4 — WiFi OTA 服务器
-
- [x] **T4.1** WiFi 连接管理
-  - AP 模式（ESP32 作为热点）
-  - STA 模式（连接路由器）
-  - 连接失败自动重试
-
- [x] **T4.2** HTTP 服务器
-  - POST `/ota/upload` 接收固件 binary
-  - 返回 JSON 响应：`{"status": "ok", "progress": xx}`
-
- [x] **T4.3** 固件分包存储
-  - 接收 APP 分包（APP→ESP32 协议：CMD + SEQ + SIZE + DATA + CRC32）
-  - 写入 Flash，更新 meta
-
- [x] **T4.4** 存储完成后自动触发
-  - 检测 `stored_size == total_size`
-  - 自动开始阶段一～四
-
- [x] **T4.5** 进度上报
-  - HTTP 响应附带当前进度百分比
-  - 存储进度实时更新
-
---
-
-## T5 — BLE OTA 服务器
-
- [x] **T5.1** BLE GATT Service 创建
-  - Primary Service (OTA)
-  - Control Point (UUID 0001): 写命令/通知
-  - Data In (UUID 0002): 写无回应，大数据通道
-  - Data Out (UUID 0003): Notify，透传 GD32 响应
-  - Version (UUID 0004): 只读，ESP32 版本号
-
- [x] **T5.2** Control Point 写处理
-  - 解析 0xF0～0xF7 命令帧
-  - 转发给 OTA Relay 任务处理
-
- [x] **T5.3** Data In 大数据通道
-  - 接收 APP 固件分包，写入 Flash
-  - 与 T3.2 / T3.3 共用存储逻辑
-
- [x] **T5.4** Data Out 通知
-  - 将 GD32 ACK 透传给 APP（BLE Notify）
-
- [x] **T5.5** MTU 协商
-  - 设置 MTU ≥ 512 bytes
-  - 支持大数据分包多次写入
-
---
-
-## T6 — ESP32 自检与保护
-
- [x] **T6.1** System Monitor 任务
-  - FreeRTOS 高优先级任务
-  - 通过 mutex 与 OTA Relay 共享 health_state
-
- [x] **T6.2** 芯片温度检测
-  - 使用 `esp_temp_sensor` API
-  - 1s 轮询，三级阈值判断（NORMAL < 80°C / WARNING 80-100°C / CRITICAL > 100°C）
-
- [x] **T6.3** 供电电压检测
-  - 使用 `esp_efuse` / `esp_adc`
-  - 5s 轮询，三级阈值判断（NORMAL 2.5-3.6V / WARNING < 2.5V / CRITICAL < 2.3V）
-
- [x] **T6.4** WiFi RSSI 监测
-  - `esp_wifi_sta_get_rssi()`
-  - 10s 轮询，三级阈值（NORMAL > -70 / WARNING -70～-85 / CRITICAL < -85 dBm）
-
- [x] **T6.5** BLE 连接状态回调
-  - BLE GAP Event 驱动更新连接状态
-  - 断开时通知 APP 重连
-
- [x] **T6.6** 健康状态联动
-  - OTA 每包发送前检查 health_state
-  - WARNING：降低 SPI 速率 + 记录日志
-  - CRITICAL：暂停 OTA + 通知 APP
-  - SAFE_SHUTDOWN：发送 ABORT + 清除 meta + 保护性复位
-
- [x] **T6.7** Flash 日志写入
-  - 异常事件追加写入 system_log 分区
-  - 格式：`[TIMESTAMP] EVENT_TYPE: value`
-
---
-
-## T7 — 错误处理与恢复
-
- [x] **T7.1** GD32 超时处理
-  - SPI 无响应 3s → 重发同一包
-  - ≥3 次 → 报错并通知 APP
-
- [x] **T7.2** CRC 重发机制
-  - GD32 要求重发时，从 Flash 重新读取当前包并重发
-  - 限次重试（建议 3 次），超限则中止 OTA
-
- [x] **T7.3** WiFi/BLE 断连恢复
-  - WiFi 断开自动重连（STA 模式）
-  - BLE 断开通知 APP，保留 meta 支持断点续传
-
- [x] **T7.4** OTA 中止与清理
-  - SAFE_SHUTDOWN 时发送 ABORT 到 GD32
-  - 清除 meta，重置状态机，释放内存
-
---
-
-## T8 — 测试与验证
-
- [ ] **T8.1** SPI 回环测试
-  - 短接 MOSI/MISO（GPIO7↔GPIO9）
-  - 自发自收验证帧协议正确性
-
- [ ] **T8.2** 协议 Mock 测试
-  - 不接 GD32，用逻辑分析仪抓 SPI 数据
-  - 验证 SOF/CMD/LEN/CRC16 帧格式正确
-
- [ ] **T8.3** Flash 读写验证
-  - 写入 256KB 数据后读出校验
-  - 确认存储逻辑正确
-
- [ ] **T8.4** 单包刷写测试
-  - 发送小固件（< 1KB）给 GD32
-  - 验证 GD32 写入正确
-
- [ ] **T8.5** 完整 OTA 测试
-  - 传输一个完整固件（≥ 100KB）
-  - 验证四阶段（握手→大小→数据→结束）全流程
-
- [ ] **T8.6** 断点续传测试
-  - 模拟传输中断（断开连接）
-  - 恢复后从断点继续，验证 meta 正确恢复
-
- [ ] **T8.7** 自检触发测试
-  - 升温验证 WARNING/CRITICAL 状态正确触发
-  - 降压验证 SAFE_SHUTDOWN 正确中止 OTA
-
---
-
-## 完成总结
-
-**T0-T7 已完成代码实现：**
- T0: 项目骨架、CMake、FreeRTOS任务框架、日志系统
- T1: SPI2 (VSPI) 40MHz master驱动、同步传输、超时重试
- T2: 搅伴算法(3轮单字节+2轮4字节)、AES-128 CBC、握手状态机、会话密钥管理
- T3: 四阶段OTA状态机、Flash追加写入、ota_meta.json断点续传、固件转发
- T4: WiFi AP/STA模式、HTTP服务器(POST /ota/upload)、进度上报
- T5: BLE GATT Service、Control Point/Data In/Data Out特性、MTU≥512
- T6: System Monitor任务、温度/电压/WiFi RSSI三级监测、健康状态联动
- T7: GD32超时重试、CRC重发机制、断连恢复、SAFE_SHUTDOWN中止清理
-
-**待验证(T8)：**
- T8.1-T8.7 需要硬件在环测试（SPI连接GD32、WiFi/BLE连接APP）
-
-**待确认参数（代码中已TODO标注）：**
- MASTER_KEY_HERE: AES-128 主密钥（16 bytes）
- SCRAMBLE_CONST_HERE: 搅伴算法种子
- CHIP_UID_HERE: GD32芯片唯一ID
- OTA Service UUID: 需与APP侧协商
@@ -30,4 +30,5 @@ idf_component_register(
        esp_blockdev
        nvs_flash
        freertos
+        mbedtls
 )
@@ -5,7 +5,6 @@
 #include <stdio.h>
 #include "freertos/FreeRTOS.h"
 #include "freertos/task.h"
-#include "esp_log.h"
 #include "esp_chip_info.h"

 #include "monitor/health_monitor.h"
@@ -8,11 +8,9 @@
 #include <sys/socket.h>
 #include <netdb.h>
 #include <arpa/inet.h>
-#include "freertos/FreeRTOS.h"
 #include "freertos/task.h"
 #include "esp_log.h"
 #include "esp_err.h"
-#include "esp_netif_types.h"

 #include "debug_log.h"

@@ -1,349 +1,25 @@
 /*
 * protocol.c - 协议层实现
 * T2.1, T2.2, T1.3
- * ESP-IDF 6.0 适配版本 - 使用软件 AES 实现 + 硬件 RNG
+ * ESP-IDF 6.0 适配版本 - 使用硬件 AES-128-CBC + 硬件 RNG
+ *
+ * 加密实现使用 ESP32-C3 硬件 AES 加速器（通过 mbedtls port）
 */
 #include <string.h>
+#include <stdio.h>
 #include "esp_random.h"
+#include "aes/esp_aes.h"
 #include "app_config.h"
 #include "protocol.h"
 #include "monitor/debug_log.h"

 static bool s_protocol_initialized = false;

-// ========== 软件 AES-128 实现 ==========
-
-// AES S-Box
-static const uint8_t sbox[256] = {
-    0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
-    0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
-    0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
-    0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
-    0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
-    0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
-    0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
-    0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
-    0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
-    0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
-    0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
-    0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
-    0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
-    0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
-    0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
-    0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16
-};
-
-// AES 逆 S-Box
-static const uint8_t rsbox[256] = {
-    0x52,0x09,0x6a,0xd5,0x30,0x36,0xa5,0x38,0xbf,0x40,0xa3,0x9e,0x81,0xf3,0xd7,0xfb,
-    0x7c,0xe3,0x39,0x82,0x9b,0x2f,0xff,0x87,0x34,0x8e,0x43,0x44,0xc4,0xde,0xe9,0xcb,
-    0x54,0x7b,0x94,0x32,0xa6,0xc2,0x23,0x3d,0xee,0x4c,0x95,0x0b,0x42,0xfa,0xc3,0x4e,
-    0x08,0x2e,0xa1,0x66,0x28,0xd9,0x24,0xb2,0x76,0x5b,0xa2,0x49,0x6d,0x8b,0xd1,0x25,
-    0x72,0xf8,0xf6,0x64,0x86,0x68,0x98,0x16,0xd4,0xa4,0x5c,0xcc,0x5d,0x65,0xb6,0x92,
-    0x6c,0x70,0x48,0x50,0xfd,0xed,0xb9,0xda,0x5e,0x15,0x46,0x57,0xa7,0x8d,0x9d,0x84,
-    0x90,0xd8,0xab,0x00,0x8c,0xbc,0xd3,0x0a,0xf7,0xe4,0x58,0x05,0xb8,0xb3,0x45,0x06,
-    0xd0,0x2c,0x1e,0x8f,0xca,0x3f,0x0f,0x02,0xc1,0xaf,0xbd,0x03,0x01,0x13,0x8a,0x6b,
-    0x3a,0x91,0x11,0x41,0x4f,0x67,0xdc,0xea,0x97,0xf2,0xcf,0xce,0xf0,0xb4,0xe6,0x73,
-    0x96,0xac,0x74,0x22,0xe7,0xad,0x35,0x85,0xe2,0xf9,0x37,0xe8,0x1c,0x75,0xdf,0x6e,
-    0x47,0xf1,0x1a,0x71,0x1d,0x29,0xc5,0x89,0x6f,0xb7,0x62,0x0e,0xaa,0x18,0xbe,0x1b,
-    0xfc,0x56,0x3e,0x4b,0xc6,0xd2,0x79,0x20,0x9a,0xdb,0xc0,0xfe,0x78,0xcd,0x5a,0xf4,
-    0x1f,0xdd,0xa8,0x33,0x88,0x07,0xc7,0x31,0xb1,0x12,0x10,0x59,0x27,0x80,0xec,0x5f,
-    0x60,0x51,0x7f,0xa9,0x19,0xb5,0x4a,0x0d,0x2d,0xe5,0x7a,0x9f,0x93,0xc9,0x9c,0xef,
-    0xa0,0xe0,0x3b,0x4d,0xae,0x2a,0xf5,0xb0,0xc8,0xeb,0xbb,0x3c,0x83,0x53,0x99,0x61,
-    0x17,0x2b,0x04,0x7e,0xba,0x77,0xd6,0x26,0xe1,0x69,0x14,0x63,0x55,0x21,0x0c,0x7d
-};
-
-// AES Rcon
-static const uint8_t Rcon[11] = {
-    0x8d,0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x1b,0x36
-};
-
-// AES 状态操作
-#define AES_BLOCK_SIZE 16
-
-typedef struct {
-    uint8_t round_key[176];  // 10 rounds * 16 bytes + initial key
-} aes128_context_t;
-
-// GF(2^8) 乘法
-static uint8_t gmul(uint8_t a, uint8_t b)
-{
-    uint8_t p = 0, hbit;
-    for (int i = 0; i < 8; i++) {
-        if (b & 1) {
-            p ^= a;
-        }
-        hbit = a & 0x80;
-        a <<= 1;
-        if (hbit) {
-            a ^= 0x1b;  // 模不可约多项式 x^8 + x^4 + x^3 + x + 1
-        }
-        b >>= 1;
-    }
-    return p;
-}
-
-// 密钥扩展
-static void aes128_key_expansion(const uint8_t *key, aes128_context_t *ctx)
-{
-    uint8_t temp[4];
-    memcpy(ctx->round_key, key, 16);
-
-    for (int i = 4; i < 44; i++) {
-        for (int j = 0; j < 4; j++) {
-            temp[j] = ctx->round_key[(i - 1) * 4 + j];
-        }
-
-        if (i % 4 == 0) {
-            // RotWord
-            uint8_t t = temp[0];
-            temp[0] = temp[1];
-            temp[1] = temp[2];
-            temp[2] = temp[3];
-            temp[3] = t;
-
-            // SubWord
-            temp[0] = sbox[temp[0]];
-            temp[1] = sbox[temp[1]];
-            temp[2] = sbox[temp[2]];
-            temp[3] = sbox[temp[3]];
-
-            temp[0] ^= Rcon[i / 4];
-        }
-
-        for (int j = 0; j < 4; j++) {
-            ctx->round_key[i * 4 + j] = ctx->round_key[(i - 4) * 4 + j] ^ temp[j];
-        }
-    }
-}
-
-// 字节替换
-static void sub_bytes(uint8_t *state)
-{
-    for (int i = 0; i < 16; i++) {
-        state[i] = sbox[state[i]];
-    }
-}
-
-// 逆字节替换
-static void inv_sub_bytes(uint8_t *state)
-{
-    for (int i = 0; i < 16; i++) {
-        state[i] = rsbox[state[i]];
-    }
-}
-
-// 行移位
-static void shift_rows(uint8_t *state)
-{
-    uint8_t temp;
-
-    // 第1行左移1位
-    temp = state[1];
-    state[1] = state[5];
-    state[5] = state[9];
-    state[9] = state[13];
-    state[13] = temp;
-
-    // 第2行左移2位
-    temp = state[2];
-    state[2] = state[10];
-    state[10] = temp;
-    temp = state[6];
-    state[6] = state[14];
-    state[14] = temp;
-
-    // 第3行左移3位
-    temp = state[15];
-    state[15] = state[11];
-    state[11] = state[7];
-    state[7] = state[3];
-    state[3] = temp;
-}
-
-// 逆行移位
-static void inv_shift_rows(uint8_t *state)
-{
-    uint8_t temp;
-
-    // 第1行右移1位
-    temp = state[13];
-    state[13] = state[9];
-    state[9] = state[5];
-    state[5] = state[1];
-    state[1] = temp;
-
-    // 第2行右移2位
-    temp = state[2];
-    state[2] = state[10];
-    state[10] = temp;
-    temp = state[6];
-    state[6] = state[14];
-    state[14] = temp;
-
-    // 第3行右移3位
-    temp = state[3];
-    state[3] = state[7];
-    state[7] = state[11];
-    state[11] = state[15];
-    state[15] = temp;
-}
-
-// 列混合
-static void mix_columns(uint8_t *state)
-{
-    uint8_t temp[16];
-    memcpy(temp, state, 16);
-
-    for (int i = 0; i < 4; i++) {
-        int c = i * 4;
-        state[c]     = gmul(2, temp[c]) ^ gmul(3, temp[c + 1]) ^ temp[c + 2] ^ temp[c + 3];
-        state[c + 1] = temp[c] ^ gmul(2, temp[c + 1]) ^ gmul(3, temp[c + 2]) ^ temp[c + 3];
-        state[c + 2] = temp[c] ^ temp[c + 1] ^ gmul(2, temp[c + 2]) ^ gmul(3, temp[c + 3]);
-        state[c + 3] = gmul(3, temp[c]) ^ temp[c + 1] ^ temp[c + 2] ^ gmul(2, temp[c + 3]);
-    }
-}
-
-// 逆列混合
-static void inv_mix_columns(uint8_t *state)
-{
-    uint8_t temp[16];
-    memcpy(temp, state, 16);
-
-    for (int i = 0; i < 4; i++) {
-        int c = i * 4;
-        state[c]     = gmul(14, temp[c]) ^ gmul(11, temp[c + 1]) ^ gmul(13, temp[c + 2]) ^ gmul(9, temp[c + 3]);
-        state[c + 1] = gmul(9, temp[c]) ^ gmul(14, temp[c + 1]) ^ gmul(11, temp[c + 2]) ^ gmul(13, temp[c + 3]);
-        state[c + 2] = gmul(13, temp[c]) ^ gmul(9, temp[c + 1]) ^ gmul(14, temp[c + 2]) ^ gmul(11, temp[c + 3]);
-        state[c + 3] = gmul(11, temp[c]) ^ gmul(13, temp[c + 1]) ^ gmul(9, temp[c + 2]) ^ gmul(14, temp[c + 3]);
-    }
-}
-
-// 轮密钥加
-static void add_round_key(uint8_t *state, const uint8_t *round_key)
-{
-    for (int i = 0; i < 16; i++) {
-        state[i] ^= round_key[i];
-    }
-}
-
-// AES-128 加密单个块
-static void aes128_encrypt_block(const uint8_t *input, uint8_t *output, const aes128_context_t *ctx)
-{
-    uint8_t state[16];
-
-    // 复制输入到状态（列优先顺序）
-    for (int i = 0; i < 4; i++) {
-        for (int j = 0; j < 4; j++) {
-            state[i * 4 + j] = input[j * 4 + i];
-        }
-    }
-
-    // 初始轮密钥加
-    add_round_key(state, ctx->round_key);
-
-    // 9轮加密
-    for (int round = 1; round < 10; round++) {
-        sub_bytes(state);
-        shift_rows(state);
-        mix_columns(state);
-        add_round_key(state, ctx->round_key + round * 16);
-    }
-
-    // 最后一轮（无列混合）
-    sub_bytes(state);
-    shift_rows(state);
-    add_round_key(state, ctx->round_key + 10 * 16);
-
-    // 复制状态到输出（列优先顺序）
-    for (int i = 0; i < 4; i++) {
-        for (int j = 0; j < 4; j++) {
-            output[j * 4 + i] = state[i * 4 + j];
-        }
-    }
-}
-
-// AES-128 解密单个块
-static void aes128_decrypt_block(const uint8_t *input, uint8_t *output, const aes128_context_t *ctx)
-{
-    uint8_t state[16];
-
-    // 复制输入到状态（列优先顺序）
-    for (int i = 0; i < 4; i++) {
-        for (int j = 0; j < 4; j++) {
-            state[i * 4 + j] = input[j * 4 + i];
-        }
-    }
-
-    // 初始轮密钥加
-    add_round_key(state, ctx->round_key + 10 * 16);
-
-    // 9轮解密
-    for (int round = 9; round >= 1; round--) {
-        inv_shift_rows(state);
-        inv_sub_bytes(state);
-        add_round_key(state, ctx->round_key + round * 16);
-        inv_mix_columns(state);
-    }
-
-    // 最后一轮（无逆列混合）
-    inv_shift_rows(state);
-    inv_sub_bytes(state);
-    add_round_key(state, ctx->round_key);
-
-    // 复制状态到输出（列优先顺序）
-    for (int i = 0; i < 4; i++) {
-        for (int j = 0; j < 4; j++) {
-            output[j * 4 + i] = state[i * 4 + j];
-        }
-    }
-}
-
-// CBC 模式加密
-static void aes128_cbc_encrypt(const uint8_t *input, uint8_t *output, size_t length,
-                               const uint8_t *iv, const aes128_context_t *ctx)
-{
-    uint8_t prev[16];
-    memcpy(prev, iv, 16);
-
-    for (size_t i = 0; i < length; i += 16) {
-        uint8_t block[16];
-        memcpy(block, input + i, 16);
-
-        // XOR with previous ciphertext (or IV for first block)
-        for (int j = 0; j < 16; j++) {
-            block[j] ^= prev[j];
-        }
-
-        aes128_encrypt_block(block, output + i, ctx);
-        memcpy(prev, output + i, 16);
-    }
-}
-
-// CBC 模式解密
-static void aes128_cbc_decrypt(const uint8_t *input, uint8_t *output, size_t length,
-                               const uint8_t *iv, const aes128_context_t *ctx)
-{
-    uint8_t prev[16];
-    memcpy(prev, iv, 16);
-
-    for (size_t i = 0; i < length; i += 16) {
-        aes128_decrypt_block(input + i, output + i, ctx);
-
-        // XOR with previous ciphertext (or IV for first block)
-        for (int j = 0; j < 16; j++) {
-            output[i + j] ^= prev[j];
-        }
-
-        memcpy(prev, input + i, 16);
-    }
-}
-
 void protocol_init(void)
 {
    if (s_protocol_initialized) return;

-    DEBUG_INFO("PROT", "初始化协议层（CRC16、软件AES）...");
+    DEBUG_INFO("PROT", "初始化协议层（CRC16、硬件AES-CBC）...");

    s_protocol_initialized = true;
    DEBUG_INFO("PROT", "协议层就绪");
@@ -442,44 +118,94 @@ int frame_parse(const uint8_t *frame, size_t frame_len,
    return 0;
 }

-// AES-128 CBC 加密
-// 注意: 函数名带 protocol_ 前缀以避免与 ESP-IDF wpa_supplicant 组件冲突
+// AES-128 CBC 加密（使用 ESP32-C3 硬件 AES）
 int protocol_aes_encrypt(const uint8_t *plaintext, size_t len,
                         const uint8_t *key, const uint8_t *iv,
                         uint8_t *ciphertext_out)
 {
+    if (!plaintext || !key || !iv || !ciphertext_out) {
+        return -1;
+    }
+
+    // PKCS#7 填充
    size_t padded_len = ((len + 15) / 16) * 16;
    uint8_t padded[256];
-
+    memset(padded, 0, sizeof(padded));
    memcpy(padded, plaintext, len);
    uint8_t pad = (uint8_t)(16 - (len % 16));
+    if (pad == 0) pad = 16;
    memset(&padded[len], pad, pad);

-    aes128_context_t ctx;
-    aes128_key_expansion(key, &ctx);
-    aes128_cbc_encrypt(padded, ciphertext_out, padded_len, iv, &ctx);
+    // 硬件 AES-CBC 加密（使用 ESP32-C3 硬件 AES 加速器）
+    esp_aes_context aes_ctx;
+    esp_aes_init(&aes_ctx);

-    return padded_len;
+    int ret = esp_aes_setkey(&aes_ctx, key, 128);
+    if (ret != 0) {
+        DEBUG_ERR("PROT", "esp_aes_setkey 失败: %d", ret);
+        esp_aes_free(&aes_ctx);
+        return -1;
+    }
+
+    uint8_t iv_copy[16];
+    memcpy(iv_copy, iv, 16);
+
+    ret = esp_aes_crypt_cbc(&aes_ctx, ESP_AES_ENCRYPT, padded_len, iv_copy, padded, ciphertext_out);
+
+    esp_aes_free(&aes_ctx);
+
+    if (ret == 0) {
+        return padded_len;
+    } else {
+        DEBUG_ERR("PROT", "esp_aes_crypt_cbc 加密失败: %d", ret);
+        return -1;
+    }
 }

-// AES-128 CBC 解密
-// 注意: 函数名带 protocol_ 前缀以避免与 ESP-IDF wpa_supplicant 组件冲突
+// AES-128 CBC 解密（使用 ESP32-C3 硬件 AES）
 int protocol_aes_decrypt(const uint8_t *ciphertext, size_t len,
                         const uint8_t *key, const uint8_t *iv,
                         uint8_t *plaintext_out)
 {
-    if (len % 16 != 0) {
-        DEBUG_ERR("PROT", "Ciphertext 长度不是 16 的倍数: %zu", len);
+    if (!ciphertext || !key || !iv || !plaintext_out) {
        return -1;
    }

-    aes128_context_t ctx;
-    aes128_key_expansion(key, &ctx);
-    aes128_cbc_decrypt(ciphertext, plaintext_out, len, iv, &ctx);
+    if (len % 16 != 0 || len == 0) {
+        DEBUG_ERR("PROT", "Ciphertext 长度无效: %zu", len);
+        return -1;
+    }
+
+    // 硬件 AES-CBC 解密（使用 ESP32-C3 硬件 AES 加速器）
+    esp_aes_context aes_ctx;
+    esp_aes_init(&aes_ctx);
+
+    int ret = esp_aes_setkey(&aes_ctx, key, 128);
+    if (ret != 0) {
+        DEBUG_ERR("PROT", "esp_aes_setkey 失败: %d", ret);
+        esp_aes_free(&aes_ctx);
+        return -1;
+    }
+
+    uint8_t iv_copy[16];
+    memcpy(iv_copy, iv, 16);
+
+    ret = esp_aes_crypt_cbc(&aes_ctx, ESP_AES_DECRYPT, len, iv_copy, ciphertext, plaintext_out);
+
+    esp_aes_free(&aes_ctx);
+
+    if (ret != 0) {
+        DEBUG_ERR("PROT", "esp_aes_crypt_cbc 解密失败: %d", ret);
+        return -1;
+    }

    // 移除 PKCS#7 填充
    uint8_t pad = plaintext_out[len - 1];
-    if (pad > 16) return -1;
+    if (pad > 16) {
+        DEBUG_ERR("PROT", "无效填充: %d", pad);
+        return -1;
+    }
+
    return len - pad;
 }

@@ -1,7 +1,7 @@
 /*
 * protocol.h - 帧格式、CRC16、AES 加密解密
 * T2.2, T1.3
- * ESP-IDF 6.0 适配版本 - 使用软件 AES 实现 + 硬件 RNG
+ * ESP-IDF 6.0 适配版本 - 使用硬件 AES-128-CBC + 硬件 RNG
 */
 #ifndef PROTOCOL_H
 #define PROTOCOL_H