alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2025-09-30 19:19:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

secure boot: Pad to avoid data after the signature mapping into the address space

Browse Source 
Because address space is mapped in 64KB pages, it was possible for unauthenticated data after the
app .bin to become mapped into the flash cache address space.

This problem is solved by 2 changes:

* "esptool elf2image --secure-pad" will pad the image so that the signature block ends close to the
  64KB boundary. Due to alignment constraints it will be 12 bytes too short after signing (but
  with flash encryption, these 12 bytes are still encrypted as part of the last block and can't be
  arbitrarily changed).
* By default, secure boot now requires all app partitions to be a multiple of 64KB in size.
This commit is contained in:
Angus Gratton
2018-07-13 11:52:57 +10:00
committed by Angus Gratton
parent 7f382f461c
commit 57b601ab7f
6 changed files with 34 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
components/esptool_py/Makefile.projbuild
View File

@@ -31,6 +31,14 @@ endif
ESPTOOL_ELF2IMAGE_OPTIONS :=
ifdef CONFIG_SECURE_BOOT_ENABLED
ifndef CONFIG_SECURE_BOOT_ALLOW_SHORT_APP_PARTITION
ifndef IS_BOOTLOADER_BUILD
ESPTOOL_ELF2IMAGE_OPTIONS += --secure-pad
endif
endif
endif
ESPTOOLPY_WRITE_FLASH=$(ESPTOOLPY_SERIAL) write_flash $(if $(CONFIG_ESPTOOLPY_COMPRESSED),-z,-u) $(ESPTOOL_WRITE_FLASH_OPTIONS)
ESPTOOL_ALL_FLASH_ARGS += $(APP_OFFSET) $(APP_BIN)

2
components/esptool_py/esptool

Submodule components/esptool_py/esptool updated: da31d9d7a1...fd8c25d216