Secure boot and Flash encryption
Posted: Wed Jul 18, 2018 10:03 am
Hello,
I am bit confused on the order of things to follow while enabling the secure boot and flash encryption.
The procedure I take is :
(I have the latest idf version)
-------------------------------------
1) make clean
2) make menuconfig (where I enable the secure boot (reflashable) and flash encryption on boot).
3) make
4) make bootloader
all make commands signing the bins with the a "secure_boot_signing_key.pem"
The commands I use to flash the device are :
1)for a 512kb spiffs partition
python /data/esp/esp-idf/components/esptool_py/esptool/esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 2000000 --before default_reset --after no_reset write_flash --flash_size detect 0x310000 /home/cte/spiffs.img
2)for the actual firmware and partitions
python /data/esp/esp-idf/components/esptool_py/esptool/esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 2000000 --before default_reset --after no_reset write_flash -z --flash_mode dio --flash_freq 40m --flash_size detect 0x10000 /data/esp/iot/build/firmware.bin 0x8000 /data/esp/iot/build/partitions.bin
3)for the bootloader
a)first time
python /data/esp/esp-idf/components/esptool_py/esptool/espefuse.py burn_key secure_boot /data/esp/iot/build/bootloader/secure-bootloader-key.bin
python /data/esp/esp-idf/components/esptool_py/esptool/esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 2000000 --before default_reset --after no_reset write_flash -z --flash_mode dio --flash_freq 40m --flash_size detect 0x1000 /data/esp/iot/build/bootloader/bootloader.bin
b)for next times
python /data/esp/esp-idf/components/esptool_py/esptool/esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 2000000 --before default_reset --after no_reset write_flash -z --flash_mode dio --flash_freq 40m --flash_size detect 0x0 /data/esp/iot/build/bootloader/bootloader-reflash-digest.bin
All "flash" commands report "Staying in bootloader."
Then I run :
make monitor
And I get the following output when I have enabled "Verbose" output on (Bootloader log verbosity)
---------------------------------------------------------------------------
I (35) boot: ESP-IDF v3.2-dev-209-gbe81d2c 2nd stage bootloader
I (35) boot: compile time 11:22:46
I (35) boot: Enabling RNG early entropy source...
D (35) boot: magic e9
D (35) boot: segments 04
D (35) boot: spi_mode 02
D (36) boot: spi_speed 0f
D (36) boot: spi_size 02
I (36) boot: SPI Speed : 80MHz
I (36) boot: SPI Mode : DIO
I (36) boot: SPI Flash Size : 4MB
D (37) bootloader_flash: mmu set paddr=00000000 count=1
D (37) boot: mapped partition table 0x8000 at 0x3f408000
E (37) flash_parts: partition 0 invalid magic number 0x195
E (38) boot: Failed to verify partition table
E (38) boot: load partition table error!
user code done
---------------------------------------------------------------------------
and the following when I have enabled "No output" (Bootloader log verbosity)
---------------------------------------------------------------------------
Fatal exception (28): LoadProhibited
epc1=0x400813cc, epc2=0x00000000, epc3=0x00000000, excvaddr=0x0000002d, depc=0x00000000
0x400813cc: xPortGetCoreID at /data/esp/esp-idf/components/freertos/include/freertos/portable.h:208
(inlined by) ipc_task at /data/esp/esp-idf/components/esp32/ipc.c:47
---------------------------------------------------------------------------
and if I press the reset button I get
---------------------------------------------------------------------------
Fatal exception (0): IllegalInstruction
epc1=0x400813cc, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000
0x400813cc: xPortGetCoreID at /data/esp/esp-idf/components/freertos/include/freertos/portable.h:208
(inlined by) ipc_task at /data/esp/esp-idf/components/esp32/ipc.c:47
---------------------------------------------------------------------------
My partitions.csv looks like :
---------------------------------------------------------------------------
nvs,data,nvs,0x9000,16K
otadata,data,ota,0xd000,8K
phy_init,data,phy,0xf000,4K
factory,app,factory,0x10000,1M
ota_0,app,ota_0,0x110000,1M
ota_1,app,ota_1,0x210000,1M
storage,data,spiffs,,512K
---------------------------------------------------------------------------
I tried the same with different SPI speeds and always use make erase_flash at the beginning of the cycle.
Sorry for the long post
Regards
Chris
PS : If I disable the secure boot and flash encryption and then build, my firmware works as it should..
I am bit confused on the order of things to follow while enabling the secure boot and flash encryption.
The procedure I take is :
(I have the latest idf version)
-------------------------------------
1) make clean
2) make menuconfig (where I enable the secure boot (reflashable) and flash encryption on boot).
3) make
4) make bootloader
all make commands signing the bins with the a "secure_boot_signing_key.pem"
The commands I use to flash the device are :
1)for a 512kb spiffs partition
python /data/esp/esp-idf/components/esptool_py/esptool/esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 2000000 --before default_reset --after no_reset write_flash --flash_size detect 0x310000 /home/cte/spiffs.img
2)for the actual firmware and partitions
python /data/esp/esp-idf/components/esptool_py/esptool/esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 2000000 --before default_reset --after no_reset write_flash -z --flash_mode dio --flash_freq 40m --flash_size detect 0x10000 /data/esp/iot/build/firmware.bin 0x8000 /data/esp/iot/build/partitions.bin
3)for the bootloader
a)first time
python /data/esp/esp-idf/components/esptool_py/esptool/espefuse.py burn_key secure_boot /data/esp/iot/build/bootloader/secure-bootloader-key.bin
python /data/esp/esp-idf/components/esptool_py/esptool/esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 2000000 --before default_reset --after no_reset write_flash -z --flash_mode dio --flash_freq 40m --flash_size detect 0x1000 /data/esp/iot/build/bootloader/bootloader.bin
b)for next times
python /data/esp/esp-idf/components/esptool_py/esptool/esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 2000000 --before default_reset --after no_reset write_flash -z --flash_mode dio --flash_freq 40m --flash_size detect 0x0 /data/esp/iot/build/bootloader/bootloader-reflash-digest.bin
All "flash" commands report "Staying in bootloader."
Then I run :
make monitor
And I get the following output when I have enabled "Verbose" output on (Bootloader log verbosity)
---------------------------------------------------------------------------
I (35) boot: ESP-IDF v3.2-dev-209-gbe81d2c 2nd stage bootloader
I (35) boot: compile time 11:22:46
I (35) boot: Enabling RNG early entropy source...
D (35) boot: magic e9
D (35) boot: segments 04
D (35) boot: spi_mode 02
D (36) boot: spi_speed 0f
D (36) boot: spi_size 02
I (36) boot: SPI Speed : 80MHz
I (36) boot: SPI Mode : DIO
I (36) boot: SPI Flash Size : 4MB
D (37) bootloader_flash: mmu set paddr=00000000 count=1
D (37) boot: mapped partition table 0x8000 at 0x3f408000
E (37) flash_parts: partition 0 invalid magic number 0x195
E (38) boot: Failed to verify partition table
E (38) boot: load partition table error!
user code done
---------------------------------------------------------------------------
and the following when I have enabled "No output" (Bootloader log verbosity)
---------------------------------------------------------------------------
Fatal exception (28): LoadProhibited
epc1=0x400813cc, epc2=0x00000000, epc3=0x00000000, excvaddr=0x0000002d, depc=0x00000000
0x400813cc: xPortGetCoreID at /data/esp/esp-idf/components/freertos/include/freertos/portable.h:208
(inlined by) ipc_task at /data/esp/esp-idf/components/esp32/ipc.c:47
---------------------------------------------------------------------------
and if I press the reset button I get
---------------------------------------------------------------------------
Fatal exception (0): IllegalInstruction
epc1=0x400813cc, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000
0x400813cc: xPortGetCoreID at /data/esp/esp-idf/components/freertos/include/freertos/portable.h:208
(inlined by) ipc_task at /data/esp/esp-idf/components/esp32/ipc.c:47
---------------------------------------------------------------------------
My partitions.csv looks like :
---------------------------------------------------------------------------
nvs,data,nvs,0x9000,16K
otadata,data,ota,0xd000,8K
phy_init,data,phy,0xf000,4K
factory,app,factory,0x10000,1M
ota_0,app,ota_0,0x110000,1M
ota_1,app,ota_1,0x210000,1M
storage,data,spiffs,,512K
---------------------------------------------------------------------------
I tried the same with different SPI speeds and always use make erase_flash at the beginning of the cycle.
Sorry for the long post
Regards
Chris
PS : If I disable the secure boot and flash encryption and then build, my firmware works as it should..