Secure Bootloader

[xbladen]

Hello,
just finished building Hardware Rev 4 and starting with software under windows and vscode with platformio. Managed to set up the project, compile and download it to omote, but got stuck, because bootloader checks for secure boot.
It seems, that the ESP32 pico D4 now have a new bootloader that checks the second stage bootloader for fulfilling the secure boot chain. Since i am new to platformio it seems, that there is no way to get a signed bootloader under platformio.
Could anybody help to setup the project maybe for ESP_IDF in vscode ?
Or is there another way ?
disable secure boot ?
Sign bootloader manually ?
Buy older revision chips ?

COM_output from first stage bootloader :
rst:0x10 (RTCWDT_RTC_RESET),boot:0x16 (SPI_FAST_FLASH_BOOT)
configsip: 188777542, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:1
load:0x3fff0030,len:1184
load:0x40078000,len:13260
load:0x40080400,len:3028
secure boot check fail
ets_main.c 371

Stefan

[KlausMu]

"Discussions" is maybe not the best place for this issue. "Issues" would fit better.

Never came in contact with secure boot before. To my understanding, if secure boot is enabled on your ESP32, then you are out of luck. You cannot revert this state, and since you most likely don't have the private key, you cannot create a firmware that is accepted by the ESP32.

https://docs.espressif.com/projects/esp-idf/en/stable/esp32/security/secure-boot-v1.html
https://www.esp32.com/viewtopic.php?t=37177

You can check the state of the efuses with tool "espefuse", but it might be tricky to get it running.
What I had to do on linux

source ~/.platformio/penv/bin/activate
pip3 install cryptography
pip3 install ecdsa
pip3 install bitstring
pip3 install reedsolo
python ~/.platformio/packages/tool-esptoolpy/espefuse.py -p /dev/ttyUSB0 dump

replace /dev/ttyUSB0, if needed

On Windows CMD

c:\Users\<username>\.platformio\penv\Scripts\activate.bat
pip3 install cryptography
pip3 install ecdsa
pip3 install bitstring
pip3 install reedsolo
python c:\Users\<username>\.platformio\packages\tool-esptoolpy\espefuse.py -p COMXXX dump

replace <username> and COMXXX

The output is

espefuse.py v4.5.1
Connecting.....
Detecting chip type... Unsupported detection protocol, switching and trying again...
Connecting....
Detecting chip type... ESP32
BLOCK0          (                ) [0 ] read_regs: 00000000 0890cca4 000264b7 0000aab0 00000236 01082226 00000004
BLOCK1          (flash_encryption) [1 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK2          (secure_boot_v1 s) [2 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK3          (                ) [3 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

EFUSE_REG_DEC_STATUS        0x00000000

=== Run "dump" command ===

If in your case the efuse is set, I would open an issue at your dealer.

[xbladen]

Thanks for the reply, will check this.
ALso need to check chip version and revision.
The secure boot fuse should be disabled on new devices and will be set by a second stange bootloader that supports secure boot.
So this should not happen with omote and i should be fine with the second stage bootloader in the omote project.
Since dealer is an aliexpress dealer i will go for new devices by digikey or mouser. They were in tape and looked new, but pads didn't take solder good, maybe a little bit corroded - which means old or moist.