Avoiding writing plain text to encrypted partitions

[kuhatovuk]

Hello ! I did "secure-boot one time" + "flash encryption release mode" on ten devices today. I thought one had failed and I restarted the operation. But maybe it was fine already. So I think I overwrote the valid encrypted bootloader with a plain-text bootloader and bricked it. Is there a command option or simple check to avoid overwriting a secure/encrypted partition with plain text ? Thank you !

[ESP_Angus]

Hi kuhatovuk ,

Unfortunately the only precaution we have is that "make flash" & "idf.py flash" won't automatically write the bootloader if secure boot is enabled.

If you can check the output of "espefuse.py -p PORT summary" then you can see which feature(s) are already enabled.

I will see if we can add some additional checks to esptool.py to require a flag to write if security features are already enabled.


angus

[kuhatovuk]

Hello, thank you for the answer. I had a similar issue today. Did the usual :

burn eFuse SDIO 3.3V
burn eFuse BLK3, write protect it
make -j4 erase_flash
make -j4
make -j4 bootloader
command to flash bootloader
make -j4 flash monitor

And it started well. Then it said some byte at ota0's offset wasn't as expected. I don't have the log anymore.

Is it possible that when flashing for encryption, make does not report partitions not fitting ? And I'm overflowing factory into ota0 or similar.

Also, is it possible to do secure-boot one-time + release encryption but burn the FLASH_CNT/UART_DECRYPT/etc eFuses at the end myself ? So I can verify everything is working before locking myself out.

Thank you !