feat: enable compress and encryption together

Author: jedi7

ci/download_flasher_stubs.py

@@ -12,7 +12,7 @@
         "STUB_SET_VERSION": "1",
         "DOWNLOAD_URL": "https://github.com/espressif/esptool-legacy-flasher-stub/releases/download",
         "TAG_URL": "https://github.com/espressif/esptool-legacy-flasher-stub/releases/tag",
-        "VERSION": "v1.9.0",
+        "VERSION": "v1.10.0",
         "FILE_LIST": (
             "esp32",
             "esp32c2",

esptool/cmds.py

@@ -619,6 +619,18 @@ def write_flash(
     if encrypt or encrypt_files is not None:
         do_write = True
 
+        if esp.CHIP_NAME == "ESP8266":
+            raise FatalError("ESP8266 does not support encrypted flashing. ")
+
+        # ESP32 ROM bootloader does not support the encryption parameter
+        # in flash commands. Only the stub flasher supports encrypted writes.
+        if esp.CHIP_NAME == "ESP32" and not esp.IS_STUB:
+            raise FatalError(
+                f"{esp.CHIP_NAME} ROM bootloader does not support encrypted writes. "
+                "Encrypted writing is only supported by the flasher stub. "
+                "Do not use --no-stub when writing encrypted data."
+            )
+
         if not esp.secure_download_mode:
             if esp.get_encrypted_download_disabled():
                 raise FatalError(
@@ -773,16 +785,6 @@ def write_flash(
         all_files = sorted(all_files + encrypted_files_flag, key=lambda x: x[0])
 
     for address, data, name, encrypted in all_files:
-        compress = compress
-
-        # Check whether we can compress the current file before flashing
-        if compress and encrypted:
-            source = "input bytes" if name is None else f"'{name}'"
-            log.print("\n")
-            log.warning("Compress and encrypt options are mutually exclusive.")
-            log.print(f"Will flash {source} uncompressed.")
-            compress = False
-
         image = data
 
         if len(image) == 0:
@@ -826,9 +828,11 @@ def write_flash(
                     # Decompress the compressed binary a block at a time,
                     # to dynamically calculate the timeout based on the real write size
                     decompress = zlib.decompressobj()
-                    esp.flash_defl_begin(uncsize, compsize, address)
+                    esp.flash_defl_begin(
+                        uncsize, compsize, address, encrypted_write=encrypted
+                    )
                 else:
-                    esp.flash_begin(uncsize, address, begin_rom_encrypted=encrypted)
+                    esp.flash_begin(uncsize, address, encrypted_write=encrypted)
                 seq = 0
                 bytes_sent = 0  # bytes sent on wire
                 bytes_written = 0  # bytes written to flash
@@ -861,6 +865,8 @@ def write_flash(
                         if not esp.IS_STUB:
                             # ROM code writes block to flash before ACKing
                             timeout = block_timeout
+                        # For compressed data, encryption is handled
+                        # via encrypted_write flag
                         esp.flash_defl_block(block, seq, timeout=timeout)
                         if esp.IS_STUB:
                             # Stub ACKs when block is received,
@@ -869,10 +875,7 @@ def write_flash(
                     else:
                         # Pad the last block
                         block = block + b"\xff" * (esp.FLASH_WRITE_SIZE - len(block))
-                        if encrypted:
-                            esp.flash_encrypt_block(block, seq)
-                        else:
-                            esp.flash_block(block, seq)
+                        esp.flash_block(block, seq, encrypted=encrypted)
                         bytes_written += len(block)
                     bytes_sent += len(block)
                     image = image[esp.FLASH_WRITE_SIZE :]

esptool/loader.py

@@ -295,9 +295,6 @@ class ESPLoader:
     # Bootloader flashing offset
     BOOTLOADER_FLASH_OFFSET = 0x0
 
-    # ROM supports an encrypted flashing mode
-    SUPPORTS_ENCRYPTED_FLASH = False
-
     # Response to SYNC might indicate that flasher stub is running
     # instead of the ROM bootloader
     sync_stub_detected = False
@@ -988,7 +985,7 @@ def mem_finish(self, entrypoint=0):
                 raise
             pass
 
-    def flash_begin(self, size, offset, begin_rom_encrypted=False, logging=True):
+    def flash_begin(self, size, offset, encrypted_write=False, logging=True):
         """
         Start downloading to Flash (performs an erase)
 
@@ -1008,8 +1005,11 @@ def flash_begin(self, size, offset, begin_rom_encrypted=False, logging=True):
         params = struct.pack(
             "<IIII", erase_size, num_blocks, self.FLASH_WRITE_SIZE, offset
         )
-        if self.SUPPORTS_ENCRYPTED_FLASH and not self.IS_STUB:
-            params += struct.pack("<I", 1 if begin_rom_encrypted else 0)
+
+        # ESP32 and ESP8266 ROMs do not support extended parameter format
+        if self.IS_STUB or self.CHIP_NAME not in ("ESP32", "ESP8266"):
+            params += struct.pack("<I", 1 if encrypted_write else 0)
+
         self.check_command(
             "enter flash download mode",
             self.ESP_CMDS["FLASH_BEGIN"],
@@ -1020,39 +1020,15 @@ def flash_begin(self, size, offset, begin_rom_encrypted=False, logging=True):
             log.print(f"Took {time.time() - t:.2f}s to erase flash block.")
         return num_blocks
 
-    def flash_block(self, data, seq, timeout=DEFAULT_TIMEOUT):
+    def flash_block(self, data, seq, timeout=DEFAULT_TIMEOUT, encrypted=False):
         """Write block to flash, retry if fail"""
-        for attempts_left in range(WRITE_BLOCK_ATTEMPTS - 1, -1, -1):
-            try:
-                self.check_command(
-                    f"write to target flash after seq {seq}",
-                    self.ESP_CMDS["FLASH_DATA"],
-                    struct.pack("<IIII", len(data), seq, 0, 0) + data,
-                    self.checksum(data),
-                    timeout=timeout,
-                )
-                break
-            except FatalError:
-                if attempts_left:
-                    self.trace(
-                        "Block write failed, "
-                        f"retrying with {attempts_left} attempts left..."
-                    )
-                else:
-                    raise
-
-    def flash_encrypt_block(self, data, seq, timeout=DEFAULT_TIMEOUT):
-        """Encrypt, write block to flash, retry if fail"""
-        if self.SUPPORTS_ENCRYPTED_FLASH and not self.IS_STUB:
-            # ROM support performs the encrypted writes via the normal write command,
-            # triggered by flash_begin(begin_rom_encrypted=True)
-            return self.flash_block(data, seq, timeout)
 
+        operation = "encrypted " if encrypted else ""
         for attempts_left in range(WRITE_BLOCK_ATTEMPTS - 1, -1, -1):
             try:
                 self.check_command(
-                    f"Write encrypted to target flash after seq {seq}",
-                    self.ESP_CMDS["FLASH_ENCRYPT_DATA"],
+                    f"write {operation}to target flash after seq {seq}",
+                    self.ESP_CMDS["FLASH_DATA"],
                     struct.pack("<IIII", len(data), seq, 0, 0) + data,
                     self.checksum(data),
                     timeout=timeout,
@@ -1061,8 +1037,8 @@ def flash_encrypt_block(self, data, seq, timeout=DEFAULT_TIMEOUT):
             except FatalError:
                 if attempts_left:
                     self.trace(
-                        "Encrypted block write failed, "
-                        f"retrying with {attempts_left} attempts left"
+                        f"{operation}block write failed, "
+                        f"retrying with {attempts_left} attempts left...".capitalize()
                     )
                 else:
                     raise
@@ -1342,7 +1318,7 @@ def run_stub(self, stub: StubFlasher | None = None) -> "ESPLoader":
         return self.STUB_CLASS(self) if self.STUB_CLASS is not None else self
 
     @stub_and_esp32_function_only
-    def flash_defl_begin(self, size, compsize, offset):
+    def flash_defl_begin(self, size, compsize, offset, encrypted_write=False):
         """
         Start downloading compressed data to Flash (performs an erase)
 
@@ -1368,10 +1344,11 @@ def flash_defl_begin(self, size, compsize, offset):
         params = struct.pack(
             "<IIII", write_size, num_blocks, self.FLASH_WRITE_SIZE, offset
         )
-        if self.SUPPORTS_ENCRYPTED_FLASH and not self.IS_STUB:
-            # extra param is to enter encrypted flash mode via ROM
-            # (not supported currently)
-            params += struct.pack("<I", 0)
+
+        # ESP32 and ESP8266 ROMs do not support extended parameter format
+        if self.IS_STUB or self.CHIP_NAME not in ("ESP32", "ESP8266"):
+            params += struct.pack("<I", 1 if encrypted_write else 0)
+
         self.check_command(
             "enter compressed flash mode",
             self.ESP_CMDS["FLASH_DEFL_BEGIN"],

esptool/targets/esp32c3.py

@@ -69,8 +69,6 @@ class ESP32C3ROM(ESP32ROM):
 
     PURPOSE_VAL_XTS_AES128_KEY = 4
 
-    SUPPORTS_ENCRYPTED_FLASH = True
-
     FLASH_ENCRYPTED_WRITE_ALIGN = 16
 
     # Variable in ROM .bss which indicates the port in use

esptool/targets/esp32c6.py

@@ -62,8 +62,6 @@ class ESP32C6ROM(ESP32C3ROM):
 
     PURPOSE_VAL_XTS_AES128_KEY = 4
 
-    SUPPORTS_ENCRYPTED_FLASH = True
-
     FLASH_ENCRYPTED_WRITE_ALIGN = 16
 
     UARTDEV_BUF_NO = 0x4087F580  # Variable in ROM .bss which indicates the port in use

esptool/targets/esp32h4.py

@@ -65,8 +65,6 @@ class ESP32H4ROM(ESP32C3ROM):
 
     PURPOSE_VAL_XTS_AES128_KEY = 4
 
-    SUPPORTS_ENCRYPTED_FLASH = True
-
     FLASH_ENCRYPTED_WRITE_ALIGN = 16
 
     UARTDEV_BUF_NO = 0x4087F580  # Variable in ROM .bss which indicates the port in use

esptool/targets/esp32p4.py

@@ -80,8 +80,6 @@ class ESP32P4ROM(ESP32ROM):
     RTC_CNTL_OPTION1_REG = 0x50110008
     RTC_CNTL_FORCE_DOWNLOAD_BOOT_MASK = 0x4  # Is download mode forced over USB?
 
-    SUPPORTS_ENCRYPTED_FLASH = True
-
     FLASH_ENCRYPTED_WRITE_ALIGN = 16
 
     @property

esptool/targets/esp32s2.py

@@ -37,8 +37,6 @@ class ESP32S2ROM(ESP32ROM):
 
     UART_CLKDIV_REG = 0x3F400014
 
-    SUPPORTS_ENCRYPTED_FLASH = True
-
     FLASH_ENCRYPTED_WRITE_ALIGN = 16
 
     # todo: use espefuse APIs to get this info

esptool/targets/esp32s3.py

@@ -38,8 +38,6 @@ class ESP32S3ROM(ESP32ROM):
 
     BOOTLOADER_FLASH_OFFSET = 0x0
 
-    SUPPORTS_ENCRYPTED_FLASH = True
-
     FLASH_ENCRYPTED_WRITE_ALIGN = 16
 
     # todo: use espefuse APIs to get this info

esptool/targets/stub_flasher/1/README.md

@@ -1,3 +1,3 @@
 # Licensing
 
-The binaries in JSON format distributed in this directory are released as Free Software under GNU General Public License Version 2 or later. They were released at https://github.com/espressif/esptool-legacy-flasher-stub/releases/tag/v1.9.0 from where the sources can be obtained.
+The binaries in JSON format distributed in this directory are released as Free Software under GNU General Public License Version 2 or later. They were released at https://github.com/espressif/esptool-legacy-flasher-stub/releases/tag/v1.10.0 from where the sources can be obtained.