same secure bootloader written twice now getting secure boot check failed

hacksome
Posts: 8
Joined: Sat Apr 13, 2019 8:23 am

same secure bootloader written twice now getting secure boot check failed

Postby hacksome » Thu May 16, 2019 3:38 pm

Hi all
I am using the latest IDF. I had several board to program and I was programming them using the windows flash download tool.
Most of them are working however some of them were programmed twice with the bootloader checked. When programmed once they were working but when programmed the second time we are seeing secure boot check failed.


All have secure bootload enabled with one time key encryption as recommended.
Is there a way out of it or have we bricked our boards?

Thanks for your help

hacksome
Posts: 8
Joined: Sat Apr 13, 2019 8:23 am

Re: same secure bootloader written twice now getting secure boot check failed

Postby hacksome » Thu May 16, 2019 4:08 pm

Forgot to say I did an erase before the second programming. The erase was done by pressing the button in flash download tools

WiFive
Posts: 2314
Joined: Tue Dec 01, 2015 7:35 am

Re: same secure bootloader written twice now getting secure boot check failed

Postby WiFive » Thu May 16, 2019 5:53 pm

If encryption is enabled and secure boot is enabled then the chip expects an encrypted bootloader with an encrypted signature. If the encryption key was generated on the chip you can't provide that. If the efuses are write protected you can't turn off encryption. At least you demonstrated why it's secure. ;)

hacksome
Posts: 8
Joined: Sat Apr 13, 2019 8:23 am

Re: same secure bootloader written twice now getting secure boot check failed

Postby hacksome » Thu May 16, 2019 8:43 pm

Hi sorry encryption is not enabled only secure boot is enabled
Both time exactly the same bootloader, partition table and code were loaded.

ESP_Angus
Posts: 1587
Joined: Sun May 08, 2016 4:11 am

Re: same secure bootloader written twice now getting secure boot check failed

Postby ESP_Angus » Fri May 17, 2019 1:57 am

Hi hacksome,
hacksome wrote: Forgot to say I did an erase before the second programming. The erase was done by pressing the button in flash download tools
The first time you boot an ESP-IDF bootloader that is built with secure boot enabled in one-time flash mode, it generates a random secret boot key to be stored in efuse, calculates a digest based on the bootloader contents and the key, and then writes this digest to flash at offset 0x0. It's not possible to re-generate this digest because the efuse key is read and write protected now.

If you pressed the erase button in the Flash Download Tool then it erased the entire flash, including the digest at offset 0x0. Unless you saved a copy of the digest somewhere (and the matching bootloader) then it's no longer possible to boot any firmware on this ESP32. Sorry.

If you want to be able to erase the flash, or flash an updated bootloader a second time, or if you're messing around in the development stages of a project, then please use the "Reflashable Bootloader" mode instead of the "One-Time Flash" mode.

Full details here: https://docs.espressif.com/projects/esp ... -boot.html

hacksome
Posts: 8
Joined: Sat Apr 13, 2019 8:23 am

Re: same secure bootloader written twice now getting secure boot check failed

Postby hacksome » Fri May 17, 2019 3:11 am

Thanks Angus
This explains it so well. Many thanks

Who is online

Users browsing this forum: rraghur and 18 guests