Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'feat/bootloader-mbedtls-split-final' into 'master'

Browse Source 
feat(esp_image_verify): split image verification out of bootloader_support

Closes IDF-8577 and IDFGH-17033

See merge request espressif/esp-idf!48383
This commit is contained in:
Mahavir Jain
2026-08-13 08:45:58 +05:30
parent 9997de4b57 542d2ffc4a
commit 8c007f0e03
72 changed files with 716 additions and 536 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
components/app_update/CMakeLists.txt
View File

@@ -6,12 +6,15 @@ endif()
idf_component_register(SRCS "esp_ota_ops.c"
INCLUDE_DIRS "include"
REQUIRES partition_table bootloader_support esp_app_format esp_bootloader_format esp_partition
PRIV_REQUIRES esptool_py efuse spi_flash)
REQUIRES partition_table bootloader_support
esp_app_format esp_bootloader_format esp_partition
PRIV_REQUIRES esptool_py efuse spi_flash esp_image_verify)
if(CONFIG_SECURE_SIGNED_DATA_PARTITION)
idf_component_optional_requires(PRIVATE mbedtls)
endif()
# mbedtls is an *optional* requirement: it is linked only when another component in
# the build pulls it in. esp_image_verify (a priv_require above) always brings
# mbedtls into app builds; this directive makes it available to esp_ota_ops at
# link time without app_update forcing mbedtls in by itself.
idf_component_optional_requires(PRIVATE mbedtls)
idf_define_esp_err_codes(HEADERS include/esp_ota_ops.h)

3
components/app_update/Kconfig.projbuild
View File

@@ -1,5 +1,6 @@
menu "App Update config"
config SECURE_SIGNED_DATA_PARTITION
config APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
default n
bool "Require signed Data partition images"
depends on SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT || SECURE_SIGNED_APPS

46
components/app_update/esp_ota_ops.c
View File

@@ -31,10 +31,11 @@
#include "esp_bootloader_desc.h"
#include "esp_flash.h"
#include "esp_private/esp_flash_internal.h" //For dangerous write protection
#include "esp_private/esp_partition_utils.h"
#include "esp_macros.h"
#if CONFIG_SECURE_SIGNED_DATA_PARTITION
#if CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
#include "psa/crypto.h"
#endif // CONFIG_SECURE_SIGNED_DATA_PARTITION
#endif // CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
#define OTA_SLOT(i) (i & 0x0F)
@@ -491,7 +492,7 @@ esp_err_t esp_ota_abort(esp_ota_handle_t handle)
return ESP_OK;
}
#if CONFIG_SECURE_SIGNED_DATA_PARTITION
#if CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
#define SHA_CHUNK 256
static esp_err_t ota_calc_partition_bin_sha(const esp_partition_t *partition, uint32_t length, uint8_t out_digest[ESP_SECURE_BOOT_DIGEST_LEN], psa_algorithm_t alg)
{
@@ -573,7 +574,7 @@ static esp_err_t ota_verify_data_partition_signature(const esp_partition_t *part
}
return err;
}
#endif // CONFIG_SECURE_SIGNED_DATA_PARTITION
#endif // CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
static esp_err_t ota_verify_partition(ota_ops_entry_t *ota_ops)
{
@@ -600,7 +601,7 @@ static esp_err_t ota_verify_partition(ota_ops_entry_t *ota_ops)
esp_partition_munmap(partition_table_map);
}
}
#if CONFIG_SECURE_SIGNED_DATA_PARTITION
#if CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
else if (ota_ops->partition.final->type == ESP_PARTITION_TYPE_DATA &&
ota_ops->partition.final->subtype == ESP_PARTITION_SUBTYPE_DATA_UNDEFINED) {
esp_err_t err = ota_verify_data_partition_signature(ota_ops->partition.staging, ota_ops->wrote_size);
@@ -610,7 +611,7 @@ static esp_err_t ota_verify_partition(ota_ops_entry_t *ota_ops)
}
return ESP_OK;
}
#endif // CONFIG_SECURE_SIGNED_DATA_PARTITION
#endif // CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
return ret;
}
@@ -928,38 +929,7 @@ const esp_partition_t *esp_ota_get_boot_partition(void)
const esp_partition_t* esp_ota_get_running_partition(void)
{
static const esp_partition_t *curr_partition = NULL;
/*
* Currently running partition is unlikely to change across reset cycle,
* so it can be cached here, and avoid lookup on every flash write operation.
*/
if (curr_partition != NULL) {
return curr_partition;
}
/* Find the flash address of this exact function. By definition that is part
of the currently running firmware. Then find the enclosing partition. */
size_t phys_offs = spi_flash_cache2phys(esp_ota_get_running_partition);
assert (phys_offs != SPI_FLASH_CACHE2PHYS_FAIL); /* indicates cache2phys lookup is buggy */
esp_partition_iterator_t it = esp_partition_find(ESP_PARTITION_TYPE_APP,
ESP_PARTITION_SUBTYPE_ANY,
NULL);
assert(it != NULL); /* has to be at least one app partition */
while (it != NULL) {
const esp_partition_t *p = esp_partition_get(it);
if (p->address <= phys_offs && p->address + p->size > phys_offs) {
esp_partition_iterator_release(it);
curr_partition = p;
return p;
}
it = esp_partition_next(it);
}
abort(); /* Partition table is invalid or corrupt */
return esp_partition_get_running_partition();
}

4
components/app_update/sdkconfig.rename Normal file
View File

@@ -0,0 +1,4 @@
# sdkconfig replacement configurations for deprecated options formatted as
# CONFIG_DEPRECATED_OPTION CONFIG_NEW_OPTION
CONFIG_SECURE_SIGNED_DATA_PARTITION CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION

10
components/app_update/test_apps/test_app_update/main/test_switch_ota.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2021-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -516,7 +516,7 @@ static void test_flow6(void)
// 3 Stage: run OTA0 -> check it -> erase OTA_DATA for next tests -> PASS
TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0 using esp_ota_write_with_offset", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow6, test_flow6);
TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is invalid", "[partitions]")
TEST_CASE("Test esp_partition_get_sha256 returns ESP_ERR_IMAGE_INVALID when image is invalid", "[partitions]")
{
const esp_partition_t *cur_app = esp_ota_get_running_partition();
ESP_LOGI(TAG, "copy current app to next part");
@@ -526,15 +526,15 @@ TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_
uint8_t sha_256_cur_app[32];
uint8_t sha_256_other_app[32];
TEST_ESP_OK(bootloader_common_get_sha256_of_partition(cur_app->address, cur_app->size, cur_app->type, sha_256_cur_app));
TEST_ESP_OK(bootloader_common_get_sha256_of_partition(other_app->address, other_app->size, other_app->type, sha_256_other_app));
TEST_ESP_OK(esp_partition_get_sha256(cur_app, sha_256_cur_app));
TEST_ESP_OK(esp_partition_get_sha256(other_app, sha_256_other_app));
TEST_ASSERT_EQUAL_MEMORY_MESSAGE(sha_256_cur_app, sha_256_other_app, sizeof(sha_256_cur_app), "must be the same");
uint32_t data = 0;
bootloader_flash_write(other_app->address + 0x50, &data, sizeof(data), false);
TEST_ESP_ERR(ESP_ERR_IMAGE_INVALID, bootloader_common_get_sha256_of_partition(other_app->address, other_app->size, other_app->type, sha_256_other_app));
TEST_ESP_ERR(ESP_ERR_IMAGE_INVALID, esp_partition_get_sha256(other_app, sha_256_other_app));
TEST_ASSERT_EQUAL_MEMORY_MESSAGE(sha_256_cur_app, sha_256_other_app, sizeof(sha_256_cur_app), "must be the same");
}

1
components/bootloader/subproject/CMakeLists.txt
View File

@@ -32,6 +32,7 @@ set(COMPONENTS
partition_table
soc
bootloader_support
esp_image_verify
log
spi_flash
micro-ecc

9
components/bootloader/subproject/main/ld/esp32/bootloader.sections.ld.in
View File

@@ -17,17 +17,18 @@
*libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32c2/bootloader.sections.ld.in
View File

@@ -16,17 +16,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32c3/bootloader.sections.ld.in
View File

@@ -15,17 +15,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32c5/bootloader.sections.ld.in
View File

@@ -17,17 +17,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32c6/bootloader.sections.ld.in
View File

@@ -18,17 +18,18 @@
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility_tee.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32c61/bootloader.sections.ld.in
View File

@@ -17,17 +17,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32h2/bootloader.sections.ld.in
View File

@@ -16,17 +16,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32h21/bootloader.sections.ld.in
View File

@@ -16,17 +16,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32h4/bootloader.sections.ld.in
View File

@@ -17,17 +17,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

18
components/bootloader/subproject/main/ld/esp32p4/bootloader.sections.ld.in
View File

@@ -16,17 +16,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \
@@ -57,17 +58,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32s2/bootloader.sections.ld.in
View File

@@ -17,17 +17,18 @@
*libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32s3/bootloader.sections.ld.in
View File

@@ -17,17 +17,18 @@
*libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

9
components/bootloader/subproject/main/ld/esp32s31/bootloader.sections.ld.in
View File

@@ -17,17 +17,18 @@
*libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable) \
*libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_encryption_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_secure_features.*(.literal .text .literal.* .text.*) \
*libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:esp_image_format.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:bootloader_sha_flash.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot.*(.literal .text .literal.* .text.*) \
*libesp_image_verify.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*) \
*libmicro-ecc.a:*.*(.literal .text .literal.* .text.*) \
*libspi_flash.a:*.*(.literal .text .literal.* .text.*) \
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*) \

62
components/bootloader_support/CMakeLists.txt
View File

@@ -11,24 +11,24 @@ if(esp_tee_build)
"bootloader_flash/include")
set(tee_srcs "src/flash_partitions.c"
"src/bootloader_sha.c"
"src/bootloader_common_loader.c"
"src/esp_image_format.c"
"src/bootloader_utility.c"
"src/bootloader_utility_tee.c"
"bootloader_flash/src/bootloader_flash.c")
if(CONFIG_SECURE_BOOT_V2_ENABLED)
if(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME OR CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
list(APPEND tee_srcs "src/secure_boot_v2/secure_boot_signatures_bootloader.c"
"src/secure_boot_v2/secure_boot.c"
"src/${IDF_TARGET}/secure_boot_secure_features.c")
list(APPEND tee_srcs "src/${IDF_TARGET}/secure_boot_secure_features.c")
endif()
endif()
# The dependency cycle with esp_image_verify is deliberate.
# Without this edge the TEE link cannot resolve esp_image_verify() called
# from bootloader_utility_tee.c.
idf_component_register(SRCS ${tee_srcs}
INCLUDE_DIRS ${tee_inc_dirs}
PRIV_REQUIRES efuse esp_app_format esptool_py esp_hal_security)
PRIV_REQUIRES efuse esp_app_format esptool_py esp_hal_security
esp_image_verify)
return()
endif()
@@ -60,11 +60,9 @@ if(CONFIG_APP_BUILD_TYPE_APP_2NDBOOT)
list(APPEND srcs
"src/bootloader_utility.c"
"src/flash_partitions.c"
"src/esp_image_format.c"
)
endif()
list(APPEND srcs "src/bootloader_sha.c")
if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
list(APPEND srcs "src/${IDF_TARGET}/bootloader_ecdsa.c")
endif()
@@ -78,7 +76,7 @@ if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
# and micro-ecc lives in the bootloader subproject so it isn't available in app builds.
set(priv_requires spi_flash efuse esp_bootloader_format esp_app_format esptool_py)
if(BOOTLOADER_BUILD)
list(APPEND priv_requires micro-ecc)
list(APPEND priv_requires micro-ecc esp_image_verify)
endif()
# `esp_hal_ana_conv` is required by bootloader_random_esp32xx.c
list(APPEND priv_requires esp_hal_wdt esp_hal_gpio esp_hal_uart esp_hal_ana_conv esp_hal_rtc_timer
@@ -98,8 +96,9 @@ if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
else()
set(include_dirs "include" "bootloader_flash/include")
set(priv_include_dirs "private_include")
# heap is required for `heap_memory_layout.h` header
set(priv_requires spi_flash mbedtls efuse heap esp_bootloader_format esp_app_format esptool_py)
# heap is required for `heap_memory_layout.h`.
set(priv_requires spi_flash efuse heap esp_bootloader_format esp_app_format
esptool_py)
# `esp_hal_ana_conv` is required by bootloader_random_esp32xx.c
list(APPEND priv_requires esp_hal_wdt esp_hal_gpio esp_hal_uart esp_hal_ana_conv esp_hal_rtc_timer
esp_hal_clock esp_hal_security esp_hal_debug_assist)
@@ -119,18 +118,12 @@ if(BOOTLOADER_BUILD)
endif()
if(CONFIG_SECURE_SIGNED_ON_BOOT)
if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
list(APPEND srcs "src/secure_boot_v1/secure_boot_signatures_bootloader.c")
endif()
if(CONFIG_SECURE_BOOT_V1_ENABLED)
list(APPEND srcs "src/secure_boot_v1/secure_boot.c"
"src/${IDF_TARGET}/secure_boot_secure_features.c")
list(APPEND srcs "src/${IDF_TARGET}/secure_boot_secure_features.c")
endif()
if(CONFIG_SECURE_BOOT_V2_ENABLED)
list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_bootloader.c"
"src/secure_boot_v2/secure_boot.c"
"src/${IDF_TARGET}/secure_boot_secure_features.c")
list(APPEND srcs "src/${IDF_TARGET}/secure_boot_secure_features.c")
endif()
endif()
else()
@@ -138,20 +131,6 @@ else()
list(APPEND srcs "src/${IDF_TARGET}/secure_boot_secure_features.c")
endif()
if(CONFIG_SECURE_SIGNED_ON_UPDATE)
if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
list(APPEND srcs "src/secure_boot_v1/secure_boot_signatures_app.c")
endif()
if(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_app.c")
list(APPEND srcs "src/secure_boot_v2/secure_boot_rsa_signature.c")
endif()
if(CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_app.c")
list(APPEND srcs "src/secure_boot_v2/secure_boot_ecdsa_signature.c")
endif()
endif()
endif()
set(requires soc) #unfortunately the header directly uses SOC registers
@@ -162,17 +141,12 @@ idf_component_register(SRCS "${srcs}"
REQUIRES "${requires}"
PRIV_REQUIRES "${priv_requires}")
idf_define_esp_err_codes(HEADERS include/esp_image_format.h)
if(NOT BOOTLOADER_BUILD)
if(CONFIG_SECURE_SIGNED_ON_UPDATE)
if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME OR CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME OR
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
target_link_libraries(${COMPONENT_LIB} PRIVATE idf::app_update)
endif()
endif()
if(NOT BOOTLOADER_BUILD AND NOT esp_tee_build)
idf_component_optional_requires(PRIVATE esp_image_verify)
endif()
idf_define_esp_err_codes(HEADERS include/esp_image_format.h)
if(CONFIG_SECURE_SIGNED_APPS AND (CONFIG_SECURE_BOOT_V1_ENABLED OR CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME))
idf_component_get_property(espsecure_py_cmd esptool_py ESPSECUREPY_CMD)
if(BOOTLOADER_BUILD)
@@ -243,3 +217,7 @@ endif()
# Disable LTO for bootloader_support: it relies on linker script placements that
# depend on object file names, which LTO does not preserve.
idf_component_set_property(${COMPONENT_NAME} NO_LTO 1)
if(NOT BOOTLOADER_BUILD AND NOT esp_tee_build AND CONFIG_BOOTLOADER_RESERVE_RTC_MEM)
target_link_libraries(${COMPONENT_LIB} INTERFACE "-u bootloader_common_get_rtc_retain_mem")
endif()

9
components/bootloader_support/include/bootloader_common.h
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2018-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2018-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -153,8 +153,13 @@ void bootloader_configure_spi_pins(int drv);
* - ESP_ERR_NO_MEM: Cannot allocate memory for sha256 operation.
* - ESP_ERR_IMAGE_INVALID: App partition doesn't contain a valid app image.
* - ESP_FAIL: An allocation error occurred.
*
* @deprecated Use esp_partition_get_sha256() from the esp_partition component instead.
* Requires the esp_image_verify component in the build; otherwise
* calls fail at link time with an undefined reference.
*/
esp_err_t bootloader_common_get_sha256_of_partition(uint32_t address, uint32_t size, int type, uint8_t *out_sha_256);
esp_err_t bootloader_common_get_sha256_of_partition(uint32_t address, uint32_t size, int type, uint8_t *out_sha_256)
__attribute__((deprecated("Use esp_partition_get_sha256() from the esp_partition component instead")));
/**
* @brief Returns the number of active otadata.

48
components/bootloader_support/include/bootloader_sha_flash.h Normal file
View File

@@ -0,0 +1,48 @@
/*
* SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#pragma once
#include "esp_err.h"
#include "soc/soc_caps.h"
#ifdef __cplusplus
extern "C" {
#endif
/** @brief Generates the SHA-256 digest of flash contents between offset and offset+length.
*
* Reads in MMU-sized chunks, so it handles images larger than the MMU window
* (3.2 MB / 50 pages of 64 KB).
*
* @param[in] flash_offset Byte offset in flash.
* @param[in] len Length of data in bytes.
* @param[out] digest 32-byte buffer for the resulting SHA-256 digest.
*
* @return ESP_OK on success; ESP_ERR_NO_MEM if allocation fails.
*
* @note Defined in the esp_image_verify component; calling it in builds without
* that component fails at link time with an undefined reference.
*/
esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
/** @brief Generates the SHA-384 digest of flash contents between offset and offset+length.
*
* @param[in] flash_offset Byte offset in flash.
* @param[in] len Length of data in bytes.
* @param[out] digest 48-byte buffer for the resulting SHA-384 digest.
*
* @return ESP_OK on success; ESP_ERR_NO_MEM if allocation fails.
*
* @note Defined in the esp_image_verify component; calling it in builds without
* that component fails at link time with an undefined reference.
*/
esp_err_t bootloader_sha384_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);
#endif
#ifdef __cplusplus
}
#endif

10
components/bootloader_support/include/esp_secure_boot.h
View File

@@ -312,6 +312,16 @@ typedef struct {
*/
void esp_secure_boot_init_checks(void);
/**
* @brief Run the on-update signature-block check for app-side secure boot.
*
* @important This function is invoked by esp_secure_boot_init_checks() during app
* startup when CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT is configured with
* V2 RSA or ECDSA schemes. It verifies that the running app's signature blocks
* are intact so future OTA updates can be verified.
*/
void esp_secure_boot_check_signature_on_update(void);
#if !BOOTLOADER_BUILD && (CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
/** @brief Scan the current running app for signature blocks

65
components/bootloader_support/private_include/bootloader_utility.h
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2018-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2018-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -89,69 +89,6 @@ __attribute__((__noreturn__)) void bootloader_reset(void);
*/
void bootloader_atexit(void);
/**
* @brief Converts an array to a printable string.
*
* This function is useful for printing SHA-256 digest.
* \code{c}
* // Example of using. image_hash will be printed
* #define HASH_LEN 32 // SHA-256 digest length
* ...
* char hash_print[HASH_LEN * 2 + 1];
* hash_print[HASH_LEN * 2] = 0;
* bootloader_sha256_hex_to_str(hash_print, image_hash, HASH_LEN);
* ESP_LOGI(TAG, %s", hash_print);
* \endcode
* @param[out] out_str Output string
* @param[in] in_array_hex Pointer to input array
* @param[in] len Length of input array
*
* @return ESP_OK: Successful
* ESP_ERR_INVALID_ARG: Error in the passed arguments
*/
esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_hex, size_t len);
/**
* @brief Debug log contents of a buffer as hexadecimal.
*
* @note - Only works if component log level is DEBUG or higher.
* - It will print at most 128 bytes from @c buffer.
*
* @param buffer Buffer to log
* @param length Length of buffer in bytes. Maximum length 128 bytes.
* @param label Label to print at beginning of log line.
*/
void bootloader_debug_buffer(const void *buffer, size_t length, const char *label);
/** @brief Generates the digest of the data between offset & offset+length.
*
* This function should be used when the size of the data is larger than 3.2MB.
* The MMU capacity is 3.2MB (50 pages - 64KB each). This function generates the SHA-256
* of the data in chunks of 3.2MB, considering the MMU capacity.
*
* @param[in] flash_offset Offset of the data in flash.
* @param[in] len Length of data in bytes.
* @param[out] digest Pointer to buffer where the digest is written, if ESP_OK is returned.
*
* @return ESP_OK if secure boot digest is generated successfully.
*/
esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);
/** @brief Generates the digest of the data between offset & offset+length.
*
* This function should be used when the size of the data is larger than 3.2MB.
* The MMU capacity is 3.2MB (50 pages - 64KB each). This function generates the SHA-384
* of the data in chunks of 3.2MB, considering the MMU capacity.
*
* @param[in] flash_offset Offset of the data in flash.
* @param[in] len Length of data in bytes.
* @param[out] digest Pointer to buffer where the digest is written, if ESP_OK is returned.
*
* @return ESP_OK if secure boot digest is generated successfully.
*/
esp_err_t bootloader_sha384_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);
#ifdef __cplusplus
}
#endif

37
components/bootloader_support/src/bootloader_common.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2018-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -14,15 +14,15 @@
#include "esp_rom_gpio.h"
#include "esp_rom_sys.h"
#include "esp_flash_partitions.h"
#include "esp_image_format.h"
#include "bootloader_flash_priv.h"
#include "bootloader_common.h"
#include "bootloader_utility.h"
#include "bootloader_sha_flash.h"
#include "soc/soc_caps.h"
#include "soc/rtc.h"
#include "soc/efuse_reg.h"
#include "hal/gpio_ll.h"
#include "esp_image_format.h"
#include "bootloader_sha.h"
#include "sys/param.h"
#define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
@@ -153,7 +153,8 @@ esp_err_t bootloader_common_get_sha256_of_partition(uint32_t address, uint32_t s
.size = size,
};
esp_image_metadata_t data;
if (esp_image_get_metadata(&partition_pos, &data) != ESP_OK) {
esp_err_t err = esp_image_get_metadata(&partition_pos, &data);
if (err != ESP_OK) {
return ESP_ERR_IMAGE_INVALID;
}
if (data.image.hash_appended) {
@@ -187,3 +188,31 @@ void bootloader_common_vddsdio_configure(void)
}
#endif // CONFIG_BOOTLOADER_VDDSDIO_BOOST
}
// Lives here rather than in esp_image_format.c (esp_image_verify) because
// esp_system calls it during early init and must be able to resolve it via
// its existing bootloader_support dep, without dragging esp_image_verify
// (and mbedTLS) into the build graph for every app.
int esp_image_get_flash_size(esp_image_flash_size_t app_flash_size)
{
switch (app_flash_size) {
case ESP_IMAGE_FLASH_SIZE_1MB:
return 1 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_2MB:
return 2 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_4MB:
return 4 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_8MB:
return 8 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_16MB:
return 16 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_32MB:
return 32 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_64MB:
return 64 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_128MB:
return 128 * 1024 * 1024;
default:
return 0;
}
}

1
components/bootloader_support/src/bootloader_common_loader.c
View File

@@ -20,7 +20,6 @@
#include "soc/chip_revision.h"
#include "hal/efuse_hal.h"
#include "esp_image_format.h"
#include "bootloader_sha.h"
#include "sys/param.h"
#include "bootloader_flash_priv.h"
#include "esp_rom_caps.h"

137
components/bootloader_support/src/bootloader_utility.c
View File

@@ -43,7 +43,7 @@
#include "bootloader_config.h"
#include "bootloader_common.h"
#include "bootloader_utility.h"
#include "bootloader_sha.h"
#include "bootloader_util.h"
#include "bootloader_console.h"
#include "bootloader_soc.h"
#include "bootloader_memory_utils.h"
@@ -1174,138 +1174,3 @@ void bootloader_atexit(void)
abort();
#endif
}
esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_hex, size_t len)
{
if (out_str == NULL || in_array_hex == NULL || len == 0) {
return ESP_ERR_INVALID_ARG;
}
for (size_t i = 0; i < len; i++) {
for (int shift = 0; shift < 2; shift++) {
uint8_t nibble = (in_array_hex[i] >> (shift ? 0 : 4)) & 0x0F;
if (nibble < 10) {
out_str[i * 2 + shift] = '0' + nibble;
} else {
out_str[i * 2 + shift] = 'a' + nibble - 10;
}
}
}
return ESP_OK;
}
void bootloader_debug_buffer(const void *buffer, size_t length, const char *label)
{
#if CONFIG_BOOTLOADER_LOG_LEVEL >= 4
const uint8_t *bytes = (const uint8_t *)buffer;
const size_t output_len = MIN(length, 128);
char hexbuf[128 * 2 + 1];
bootloader_sha256_hex_to_str(hexbuf, bytes, output_len);
hexbuf[output_len * 2] = '\0';
ESP_LOGD(TAG, "%s: %s", label, hexbuf);
#else
(void) buffer;
(void) length;
(void) label;
#endif
}
static esp_err_t bootloader_sha_flash_contents(esp_sha_type type, uint32_t flash_offset, uint32_t len, uint8_t *digest)
{
if (digest == NULL) {
return ESP_ERR_INVALID_ARG;
}
/* Handling firmware images larger than MMU capacity */
uint32_t mmu_free_pages_count = bootloader_mmap_get_free_pages();
bootloader_sha_handle_t sha_handle = NULL;
if (type == SHA2_256) {
sha_handle = bootloader_sha256_start();
} else
// Using SOC_ECDSA_SUPPORT_CURVE_P384 here so that there is no flash size impact in the case of existing targets like ESP32.
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
if (type == SHA2_384) {
sha_handle = bootloader_sha512_start(true);
} else
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
{
return ESP_ERR_INVALID_ARG;
}
if (sha_handle == NULL) {
return ESP_ERR_NO_MEM;
}
while (len > 0) {
uint32_t mmu_page_offset = ((flash_offset & MMAP_ALIGNED_MASK) != 0) ? 1 : 0; /* Skip 1st MMU Page if it is already populated */
uint32_t max_pages = (mmu_free_pages_count > mmu_page_offset) ? (mmu_free_pages_count - mmu_page_offset) : 0;
if (max_pages == 0) {
ESP_LOGE(TAG, "No free MMU pages are available");
if (type == SHA2_256) {
bootloader_sha256_finish(sha_handle, NULL);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
else if (type == SHA2_384) {
bootloader_sha512_finish(sha_handle, NULL);
}
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
return ESP_ERR_NO_MEM;
}
uint32_t max_image_len;
if (__builtin_mul_overflow(max_pages, SPI_FLASH_MMU_PAGE_SIZE, &max_image_len)) {
max_image_len = UINT32_MAX;
}
uint32_t partial_image_len = MIN(len, max_image_len); /* Read the image that fits in the free MMU pages */
const void * image = bootloader_mmap(flash_offset, partial_image_len);
if (image == NULL) {
if (type == SHA2_256) {
bootloader_sha256_finish(sha_handle, NULL);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
else if (type == SHA2_384) {
bootloader_sha512_finish(sha_handle, NULL);
}
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
return ESP_FAIL;
}
if (type == SHA2_256) {
bootloader_sha256_data(sha_handle, image, partial_image_len);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
else if (type == SHA2_384) {
bootloader_sha512_data(sha_handle, image, partial_image_len);
}
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
bootloader_munmap(image);
flash_offset += partial_image_len;
len -= partial_image_len;
}
if (type == SHA2_256) {
bootloader_sha256_finish(sha_handle, digest);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
else if (type == SHA2_384) {
bootloader_sha512_finish(sha_handle, digest);
}
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
return ESP_OK;
}
esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
{
return bootloader_sha_flash_contents(SHA2_256, flash_offset, len, digest);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
esp_err_t bootloader_sha384_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
{
return bootloader_sha_flash_contents(SHA2_384, flash_offset, len, digest);
}
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */

26
components/bootloader_support/src/secure_boot.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -148,28 +148,6 @@ static esp_err_t secure_boot_v2_check(bool *need_fix)
#endif
#endif // CONFIG_SECURE_BOOT
#if (CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME) && CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
static void check_signature_on_update_check(void)
{
// We rely on the keys used to sign this app to verify the next app on OTA, so make sure there is at
// least one to avoid a stuck firmware
esp_image_sig_public_key_digests_t digests = { 0 };
esp_err_t err = esp_secure_boot_get_signature_blocks_for_running_app(false, &digests);
if (err != ESP_OK || digests.num_digests == 0) {
ESP_LOGE(TAG, "This app is not signed, but check signature on update is enabled in config. It won't be possible to verify any update.");
abort();
}
#if CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT && SECURE_BOOT_NUM_BLOCKS > 1
if (digests.num_digests > 1) {
ESP_LOGW(TAG, "App has %d signatures. Only the first position of signature blocks is used to verify any update", digests.num_digests);
}
#endif
}
#endif // (CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME) && CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
void esp_secure_boot_init_checks(void)
{
#ifdef CONFIG_SECURE_BOOT
@@ -189,7 +167,7 @@ void esp_secure_boot_init_checks(void)
#if (CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME) && CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
check_signature_on_update_check();
esp_secure_boot_check_signature_on_update();
#endif // (CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME) && CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
}

80
components/esp_image_verify/CMakeLists.txt Normal file
View File

@@ -0,0 +1,80 @@
idf_build_get_property(target IDF_TARGET)
idf_build_get_property(esp_tee_build ESP_TEE_BUILD)
if(${target} STREQUAL "linux")
return()
endif()
set(srcs
"src/esp_image_format.c"
"src/bootloader_sha.c"
"src/bootloader_sha_flash.c"
)
# Secure Boot V1 + V2 sources. Bootloader build picks up the on-boot verifier; app
# build picks up the on-update verifier. ESP-TEE app builds compile V2 (RSA / ECDSA-V2)
# but skip V1 entirely (V1 hardware is ESP32 / ESP32-S2).
if(BOOTLOADER_BUILD)
if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
list(APPEND srcs "src/secure_boot_v1/secure_boot_signatures_bootloader.c")
endif()
if(CONFIG_SECURE_BOOT_V1_ENABLED)
list(APPEND srcs "src/secure_boot_v1/secure_boot.c")
endif()
if(CONFIG_SECURE_BOOT_V2_ENABLED)
list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_bootloader.c"
"src/secure_boot_v2/secure_boot.c")
endif()
elseif(esp_tee_build)
if(CONFIG_SECURE_BOOT_V2_ENABLED)
if(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME OR CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_bootloader.c"
"src/secure_boot_v2/secure_boot.c")
endif()
endif()
else()
if(CONFIG_SECURE_SIGNED_ON_UPDATE)
if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
list(APPEND srcs "src/secure_boot_v1/secure_boot_signatures_app.c")
endif()
if(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_app.c"
"src/secure_boot_v2/secure_boot_rsa_signature.c")
endif()
if(CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_app.c"
"src/secure_boot_v2/secure_boot_ecdsa_signature.c")
endif()
endif()
# secure_boot.c — app-side on-update signature-block sanity check
list(APPEND srcs "src/secure_boot.c")
endif()
# Public REQUIRES bootloader_support — esp_image_format.h includes esp_flash_partitions.h
# from bootloader_support's public include path.
set(requires bootloader_support esp_app_format esp_bootloader_format)
set(priv_requires spi_flash efuse esp_hal_security)
if(BOOTLOADER_BUILD)
list(APPEND priv_requires micro-ecc)
elseif(NOT esp_tee_build)
# heap is needed by the SHA primitive (PSA hash op allocations).
list(APPEND priv_requires heap mbedtls app_update)
endif()
idf_component_register(
SRCS "${srcs}"
PRIV_INCLUDE_DIRS "private_include"
REQUIRES "${requires}"
PRIV_REQUIRES "${priv_requires}"
)
if(NOT BOOTLOADER_BUILD AND NOT esp_tee_build)
if(CONFIG_SECURE_SIGNED_ON_UPDATE)
if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME OR CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME OR
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
target_link_libraries(${COMPONENT_LIB} PRIVATE idf::app_update)
endif()
endif()
endif()

4
components/bootloader_support/private_include/bootloader_sha.h → components/esp_image_verify/private_include/bootloader_sha.h
View File

@@ -5,10 +5,8 @@
*/
#pragma once
/* Provide a SHA256 API for bootloader_support code,
/* Provide a SHA256 API for image-verification code,
that can be used from bootloader or app code.
This header is available to source code in the bootloader & bootloader_support components only.
Use PSA APIs or include esp32/sha.h to calculate SHA256 in IDF apps.
*/

0
components/bootloader_support/private_include/bootloader_signature.h → components/esp_image_verify/private_include/bootloader_signature.h
View File

12
components/bootloader_support/src/bootloader_sha.c → components/esp_image_verify/src/bootloader_sha.c
View File

@@ -104,7 +104,7 @@ void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data,
for (size_t i = 0; i < copy_words; i++) {
sha_text_reg[block_count + i] = __builtin_bswap32(w[i]);
}
asm volatile ("memw");
asm volatile("memw");
// Update counters
words_hashed += copy_words;
@@ -152,7 +152,7 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
assert(words_hashed % BLOCK_WORDS == 60 / 4); // 32-bits left in block
// Calculate 32-bit length for final 32 bits of data
uint32_t bit_count = __builtin_bswap32( data_words * 32 );
uint32_t bit_count = __builtin_bswap32(data_words * 32);
bootloader_sha256_data(handle, &bit_count, sizeof(bit_count));
assert(words_hashed % BLOCK_WORDS == 0);
@@ -166,12 +166,12 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
for (size_t i = 0; i < DIGEST_WORDS; i++) {
digest_words[i] = __builtin_bswap32(sha_text_reg[i]);
}
asm volatile ("memw");
asm volatile("memw");
}
#endif /* CONFIG_IDF_TARGET_ESP32 */
#else /* NON_OS_BUILD || CONFIG_APP_BUILD_TYPE_RAM */
#include "bootloader_flash_priv.h"
/* App-side SHA implementation backed by PSA/mbedtls. */
#include "psa/crypto.h"
bootloader_sha256_handle_t bootloader_sha256_start(void)
@@ -218,14 +218,13 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
}
free(handle);
handle = NULL;
}
#if SOC_SHA_SUPPORT_SHA512
typedef struct {
psa_hash_operation_t *hash_op;
int psa_alg;
psa_algorithm_t psa_alg;
} bootloader_psa_sha_handle_t;
bootloader_sha_handle_t bootloader_sha512_start(bool is384)
@@ -283,7 +282,6 @@ void bootloader_sha512_finish(bootloader_sha_handle_t handle, uint8_t *digest)
free(op->hash_op);
free(op);
handle = NULL;
}
#endif /* SOC_SHA_SUPPORT_SHA512 */
#endif /* !(NON_OS_BUILD || CONFIG_APP_BUILD_TYPE_RAM) */

114
components/esp_image_verify/src/bootloader_sha_flash.c Normal file
View File

@@ -0,0 +1,114 @@
/*
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <sys/param.h>
#include "esp_log.h"
#include "bootloader_flash_priv.h"
#include "bootloader_sha.h"
#include "bootloader_sha_flash.h"
#include "spi_flash_mmap.h"
#include "soc/soc_caps.h"
#include "hal/sha_types.h"
#include "rom/sha.h"
ESP_LOG_ATTR_TAG(TAG, "boot_sha");
static esp_err_t bootloader_sha_flash_contents(esp_sha_type type, uint32_t flash_offset, uint32_t len, uint8_t *digest)
{
if (digest == NULL) {
return ESP_ERR_INVALID_ARG;
}
/* Handling firmware images larger than MMU capacity */
uint32_t mmu_free_pages_count = bootloader_mmap_get_free_pages();
bootloader_sha_handle_t sha_handle = NULL;
if (type == SHA2_256) {
sha_handle = bootloader_sha256_start();
} else
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
if (type == SHA2_384) {
sha_handle = bootloader_sha512_start(true);
} else
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
{
return ESP_ERR_INVALID_ARG;
}
if (sha_handle == NULL) {
return ESP_ERR_NO_MEM;
}
while (len > 0) {
uint32_t mmu_page_offset = ((flash_offset & MMAP_ALIGNED_MASK) != 0) ? 1 : 0; /* Skip 1st MMU Page if it is already populated */
uint32_t max_pages = (mmu_free_pages_count > mmu_page_offset) ? (mmu_free_pages_count - mmu_page_offset) : 0;
if (max_pages == 0) {
ESP_LOGE(TAG, "No free MMU pages are available");
if (type == SHA2_256) {
bootloader_sha256_finish(sha_handle, NULL);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
else if (type == SHA2_384) {
bootloader_sha512_finish(sha_handle, NULL);
}
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
return ESP_ERR_NO_MEM;
}
uint32_t max_image_len;
if (__builtin_mul_overflow(max_pages, SPI_FLASH_MMU_PAGE_SIZE, &max_image_len)) {
max_image_len = UINT32_MAX;
}
uint32_t partial_image_len = MIN(len, max_image_len); /* Read the image that fits in the free MMU pages */
const void * image = bootloader_mmap(flash_offset, partial_image_len);
if (image == NULL) {
if (type == SHA2_256) {
bootloader_sha256_finish(sha_handle, NULL);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
else if (type == SHA2_384) {
bootloader_sha512_finish(sha_handle, NULL);
}
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
return ESP_FAIL;
}
if (type == SHA2_256) {
bootloader_sha256_data(sha_handle, image, partial_image_len);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
else if (type == SHA2_384) {
bootloader_sha512_data(sha_handle, image, partial_image_len);
}
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
bootloader_munmap(image);
flash_offset += partial_image_len;
len -= partial_image_len;
}
if (type == SHA2_256) {
bootloader_sha256_finish(sha_handle, digest);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
else if (type == SHA2_384) {
bootloader_sha512_finish(sha_handle, digest);
}
#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
return ESP_OK;
}
esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
{
return bootloader_sha_flash_contents(SHA2_256, flash_offset, len, digest);
}
#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
esp_err_t bootloader_sha384_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
{
return bootloader_sha_flash_contents(SHA2_384, flash_offset, len, digest);
}
#endif

109
components/bootloader_support/src/esp_image_format.c → components/esp_image_verify/src/esp_image_format.c
View File

@@ -6,7 +6,6 @@
#include <string.h>
#include <sys/param.h>
#include <esp_cpu.h>
#include <bootloader_utility.h>
#include <esp_secure_boot.h>
#include <esp_fault.h>
#include <esp_log.h>
@@ -147,11 +146,11 @@ void esp_image_bootloader_offset_set(const uint32_t offset)
static bool is_bootloader(uint32_t offset)
{
return ((offset == ESP_PRIMARY_BOOTLOADER_OFFSET)
|| (offset == s_bootloader_partition_offset)
|| (offset == s_bootloader_partition_offset)
#if SOC_RECOVERY_BOOTLOADER_SUPPORTED
|| (efuse_hal_recovery_bootloader_enabled() ? offset == efuse_hal_get_recovery_bootloader_address() : false)
|| (efuse_hal_recovery_bootloader_enabled() ? offset == efuse_hal_get_recovery_bootloader_address() : false)
#endif
);
);
}
#if BOOTLOADER_BUILD && (SECURE_BOOT_CHECK_SIGNATURE == 1)
@@ -187,7 +186,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
bootloader_sha256_handle_t sha_handle = NULL;
bool verify_sha;
#if (SECURE_BOOT_CHECK_SIGNATURE == 1)
/* used for anti-FI checks */
/* used for anti-FI checks */
uint8_t image_digest[ESP_SECURE_BOOT_DIGEST_LEN] = { [ 0 ... ESP_SECURE_BOOT_DIGEST_LEN - 1 ] = 0xEE };
uint8_t verified_digest[ESP_SECURE_BOOT_DIGEST_LEN] = { [ 0 ... ESP_SECURE_BOOT_DIGEST_LEN - 1 ] = 0x01 };
#endif
@@ -336,15 +335,15 @@ esp_err_t bootloader_load_image(const esp_partition_pos_t *part, esp_image_metad
#elif CONFIG_BOOTLOADER_SKIP_VALIDATE_ON_POWER_ON
if (esp_rom_get_reset_reason(0) == RESET_REASON_CHIP_POWER_ON
#if SOC_EFUSE_HAS_EFUSE_RST_BUG
|| esp_rom_get_reset_reason(0) == RESET_REASON_CORE_EFUSE_CRC
|| esp_rom_get_reset_reason(0) == RESET_REASON_CORE_EFUSE_CRC
#endif
) {
) {
mode = ESP_IMAGE_LOAD_NO_VALIDATE;
}
#endif // CONFIG_BOOTLOADER_SKIP_...
#endif // CONFIG_SECURE_BOOT
return image_load(mode, part, data);
return image_load(mode, part, data);
#endif // BOOTLOADER_BUILD
}
@@ -387,11 +386,11 @@ static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t
esp_err_t err = ESP_OK;
ESP_LOGD(TAG, "image header: 0x%02x 0x%02x 0x%02x 0x%02x %08"PRIx32,
image->magic,
image->segment_count,
image->spi_mode,
image->spi_size,
image->entry_addr);
image->magic,
image->segment_count,
image->spi_mode,
image->spi_size,
image->entry_addr);
if (image->magic != ESP_IMAGE_HEADER_MAGIC) {
FAIL_LOAD("image at 0x%"PRIx32" has invalid magic byte (nothing flashed here?)", src_addr);
@@ -442,7 +441,7 @@ static bool verify_load_addresses(int segment_index, intptr_t load_addr, intptr_
/* Check if we're clobbering the stack */
intptr_t sp = (intptr_t)esp_cpu_get_sp();
if (bootloader_util_regions_overlap(sp - STACK_LOAD_HEADROOM, ROM_STACK_START,
load_addr, load_end)) {
load_addr, load_end)) {
reason = ESP_LOG_ATTR_STR("overlaps bootloader stack");
goto invalid;
}
@@ -485,8 +484,7 @@ static bool verify_load_addresses(int segment_index, intptr_t load_addr, intptr_
return verify_load_addresses(segment_index, iram_load_addr, iram_load_end, print_error, true);
}
}
}
else if (esp_ptr_in_iram(load_addr_p) && esp_ptr_in_iram(load_inclusive_end_p)) { /* Writing to IRAM */
} else if (esp_ptr_in_iram(load_addr_p) && esp_ptr_in_iram(load_inclusive_end_p)) { /* Writing to IRAM */
/* Check for overlap of 'loader' section of IRAM */
if (bootloader_util_regions_overlap((intptr_t)&_loader_text_start, (intptr_t)&_loader_text_end,
load_addr, load_end)) {
@@ -522,12 +520,12 @@ static bool verify_load_addresses(int segment_index, intptr_t load_addr, intptr_
return verify_load_addresses(segment_index, dram_load_addr, dram_load_end, print_error, true);
}
}
/* Sections entirely in RTC memory won't overlap with a vanilla bootloader but are valid load addresses, thus skipping them from the check */
/* Sections entirely in RTC memory won't overlap with a vanilla bootloader but are valid load addresses, thus skipping them from the check */
}
#if SOC_RTC_FAST_MEM_SUPPORTED
else if (esp_ptr_in_rtc_iram_fast(load_addr_p) && esp_ptr_in_rtc_iram_fast(load_inclusive_end_p)){
else if (esp_ptr_in_rtc_iram_fast(load_addr_p) && esp_ptr_in_rtc_iram_fast(load_inclusive_end_p)) {
return true;
} else if (esp_ptr_in_rtc_dram_fast(load_addr_p) && esp_ptr_in_rtc_dram_fast(load_inclusive_end_p)){
} else if (esp_ptr_in_rtc_dram_fast(load_addr_p) && esp_ptr_in_rtc_dram_fast(load_inclusive_end_p)) {
return true;
}
#endif
@@ -550,7 +548,7 @@ static bool verify_load_addresses(int segment_index, intptr_t load_addr, intptr_
}
return true;
invalid:
invalid:
if (print_error) {
ESP_LOGE(TAG, "Segment %d 0x%08x-0x%08x invalid: %s", segment_index, load_addr, load_end, reason);
}
@@ -653,7 +651,6 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
(do_load) ? ESP_LOG_ATTR_STR("load") : (is_mapping) ? ESP_LOG_ATTR_STR("map") : "");
}
#ifdef BOOTLOADER_BUILD
/* Before loading segment, check it doesn't clobber bootloader RAM. */
if (do_load && data_len > 0) {
@@ -681,7 +678,7 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
#if (SECURE_BOOT_CHECK_SIGNATURE == 1) && defined(BOOTLOADER_BUILD)
/* Double check the address verification done above */
ESP_FAULT_ASSERT(!do_load || verify_load_addresses(0, segment_data.load_addr,
segment_data.load_addr + data_len_remain, false, false));
segment_data.load_addr + data_len_remain, false, false));
#endif
uint32_t offset_page = ((segment_data.data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
/* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
@@ -799,11 +796,11 @@ static esp_err_t process_segment_data(const process_segment_data_t *segment_data
// Anti-rollback check and efuse block version check should handle only Case I from above.
if (segment_data->segment == 0 && segment_data->is_segment_start &&
!is_bootloader(segment_data->metadata->start_addr)) {
/* ESP32 doesn't have more memory and more efuse bits for block major version. */
/* ESP32 doesn't have more memory and more efuse bits for block major version. */
#if !CONFIG_IDF_TARGET_ESP32
const esp_app_desc_t *app_desc = (const esp_app_desc_t *)src;
esp_err_t ret = bootloader_common_check_efuse_blk_validity(app_desc->min_efuse_blk_rev_full,
app_desc->max_efuse_blk_rev_full);
app_desc->max_efuse_blk_rev_full);
if (ret != ESP_OK) {
bootloader_munmap(data);
return ret;
@@ -1042,7 +1039,7 @@ static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint3
sig_block_len += sizeof(ets_secure_boot_signature_t);
#endif
} else {
// Case II: Application part
// Case II: Application part
#if CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
sig_block_len = sizeof(esp_secure_boot_sig_block_t);
#else
@@ -1147,6 +1144,44 @@ static esp_err_t verify_signature_and_adjust_image_len(esp_image_metadata_t *dat
}
#endif /* SECURE_BOOT_CHECK_SIGNATURE */
#if CONFIG_BOOTLOADER_LOG_LEVEL >= 4
static esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_hex, size_t len)
{
if (out_str == NULL || in_array_hex == NULL || len == 0) {
return ESP_ERR_INVALID_ARG;
}
for (size_t i = 0; i < len; i++) {
for (int shift = 0; shift < 2; shift++) {
uint8_t nibble = (in_array_hex[i] >> (shift ? 0 : 4)) & 0x0F;
if (nibble < 10) {
out_str[i * 2 + shift] = '0' + nibble;
} else {
out_str[i * 2 + shift] = 'a' + nibble - 10;
}
}
}
return ESP_OK;
}
#endif
static void bootloader_debug_buffer(const void *buffer, size_t length, const char *label)
{
#if CONFIG_BOOTLOADER_LOG_LEVEL >= 4
const uint8_t *bytes = (const uint8_t *)buffer;
const size_t output_len = MIN(length, 128);
char hexbuf[128 * 2 + 1];
bootloader_sha256_hex_to_str(hexbuf, bytes, output_len);
hexbuf[output_len * 2] = '\0';
ESP_LOGD(TAG, "%s: %s", label, hexbuf);
#else
(void) buffer;
(void) length;
(void) label;
#endif
}
static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest)
{
#if (SECURE_BOOT_CHECK_SIGNATURE == 1)
@@ -1226,27 +1261,3 @@ static esp_err_t verify_simple_hash(bootloader_sha256_handle_t sha_handle, esp_i
return ESP_OK;
}
int esp_image_get_flash_size(esp_image_flash_size_t app_flash_size)
{
switch (app_flash_size) {
case ESP_IMAGE_FLASH_SIZE_1MB:
return 1 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_2MB:
return 2 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_4MB:
return 4 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_8MB:
return 8 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_16MB:
return 16 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_32MB:
return 32 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_64MB:
return 64 * 1024 * 1024;
case ESP_IMAGE_FLASH_SIZE_128MB:
return 128 * 1024 * 1024;
default:
return 0;
}
}

33
components/esp_image_verify/src/secure_boot.c Normal file
View File

@@ -0,0 +1,33 @@
/*
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include "sdkconfig.h"
#include "esp_log.h"
#include "esp_secure_boot.h"
ESP_LOG_ATTR_TAG(TAG, "secure_boot");
#if (CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME) && CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
void esp_secure_boot_check_signature_on_update(void)
{
/* We rely on the keys used to sign this app to verify the next app on OTA, so make sure
there is at least one to avoid a stuck firmware. */
esp_image_sig_public_key_digests_t digests = { 0 };
esp_err_t err = esp_secure_boot_get_signature_blocks_for_running_app(false, &digests);
if (err != ESP_OK || digests.num_digests == 0) {
ESP_LOGE(TAG, "This app is not signed, but check signature on update is enabled in config. It won't be possible to verify any update.");
abort();
}
#if SECURE_BOOT_NUM_BLOCKS > 1
if (digests.num_digests > 1) {
ESP_LOGW(TAG, "App has %d signatures. Only the first position of signature blocks is used to verify any update", digests.num_digests);
}
#endif
}
#endif /* (CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME) && CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT */

23
components/bootloader_support/src/secure_boot_v1/secure_boot.c → components/esp_image_verify/src/secure_boot_v1/secure_boot.c
View File

@@ -14,7 +14,6 @@
#include "esp32/rom/secure_boot.h"
#include "soc/rtc_periph.h"
#include "bootloader_utility.h"
#include "sdkconfig.h"
@@ -37,7 +36,8 @@ ESP_LOG_ATTR_TAG(TAG, "secure_boot_v1");
*
* @inputs: image_len - length of image to calculate digest for
*/
static bool secure_boot_generate(uint32_t image_len){
static bool secure_boot_generate(uint32_t image_len)
{
esp_err_t err;
esp_secure_boot_iv_digest_t digest;
const uint32_t *image;
@@ -53,8 +53,7 @@ static bool secure_boot_generate(uint32_t image_len){
ets_secure_boot_hash(NULL);
/* iv stored in sec 0 */
err = bootloader_flash_erase_sector(0);
if (err != ESP_OK)
{
if (err != ESP_OK) {
ESP_LOGE(TAG, "SPI erase failed: 0x%x", err);
return false;
}
@@ -65,8 +64,8 @@ static bool secure_boot_generate(uint32_t image_len){
ESP_LOGE(TAG, "bootloader_mmap(0x1000, 0x%" PRIx32 ") failed", image_len);
return false;
}
for (size_t i = 0; i < image_len; i+= sizeof(digest.iv)) {
ets_secure_boot_hash(&image[i/sizeof(uint32_t)]);
for (size_t i = 0; i < image_len; i += sizeof(digest.iv)) {
ets_secure_boot_hash(&image[i / sizeof(uint32_t)]);
}
bootloader_munmap(image);
@@ -76,7 +75,7 @@ static bool secure_boot_generate(uint32_t image_len){
ESP_LOGD(TAG, "write iv+digest to flash");
err = bootloader_flash_write(FLASH_OFFS_SECURE_BOOT_IV_DIGEST, &digest,
sizeof(digest), esp_efuse_is_flash_encryption_enabled());
sizeof(digest), esp_efuse_is_flash_encryption_enabled());
if (err != ESP_OK) {
ESP_LOGE(TAG, "SPI write failed: 0x%x", err);
return false;
@@ -90,7 +89,7 @@ esp_err_t esp_secure_boot_generate_digest(void)
esp_err_t err;
if (esp_secure_boot_enabled()) {
ESP_LOGI(TAG, "bootloader secure boot is already enabled."
" No need to generate digest. continuing..");
" No need to generate digest. continuing..");
return ESP_OK;
}
#if CONFIG_SECURE_BOOT_REQUIRE_ALREADY_ENABLED
@@ -135,11 +134,11 @@ esp_err_t esp_secure_boot_generate_digest(void)
/* Generate secure boot digest using programmed key in EFUSE */
ESP_LOGI(TAG, "Generating secure boot digest...");
uint32_t image_len = bootloader_data.image_len;
if(bootloader_data.image.hash_appended) {
if (bootloader_data.image.hash_appended) {
/* Secure boot digest doesn't cover the hash */
image_len -= ESP_IMAGE_HASH_LEN;
}
if (false == secure_boot_generate(image_len)){
if (false == secure_boot_generate(image_len)) {
ESP_LOGE(TAG, "secure boot generation failed");
return ESP_FAIL;
}
@@ -165,8 +164,8 @@ esp_err_t esp_secure_boot_permanently_enable(void)
bool dis_write = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_BLK2);
if (dis_read != dis_write) {
ESP_LOGE(TAG, "Pre-loaded key is not %s %s protected. Refusing to blow secure boot efuse.",
(!dis_read) ? "read,":" ",
(!dis_read) ? "write":" ");
(!dis_read) ? "read," : " ",
(!dis_read) ? "write" : " ");
return ESP_ERR_INVALID_STATE;
}
esp_efuse_batch_write_begin(); /* Batch all efuse writes at the end of this function */

3
components/bootloader_support/src/secure_boot_v1/secure_boot_signatures_app.c → components/esp_image_verify/src/secure_boot_v1/secure_boot_signatures_app.c
View File

@@ -7,7 +7,7 @@
#include "bootloader_flash_priv.h"
#include "bootloader_sha.h"
#include "bootloader_utility.h"
#include "bootloader_sha_flash.h"
#include "esp_log.h"
#include "esp_image_format.h"
#include "esp_secure_boot.h"
@@ -16,7 +16,6 @@
#include <sys/param.h>
#include "mbedtls/pk.h"
#ifdef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
ESP_LOG_ATTR_TAG(TAG, "secure_boot_v1");

15
components/bootloader_support/src/secure_boot_v1/secure_boot_signatures_bootloader.c → components/esp_image_verify/src/secure_boot_v1/secure_boot_signatures_bootloader.c
View File

@@ -7,7 +7,7 @@
#include "bootloader_flash_priv.h"
#include "bootloader_sha.h"
#include "bootloader_utility.h"
#include "bootloader_sha_flash.h"
#include "esp_log.h"
#include "esp_image_format.h"
#include "esp_secure_boot.h"
@@ -41,7 +41,7 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
// Map the signature block
sigblock = (const esp_secure_boot_sig_block_t *) bootloader_mmap(src_addr + length, sizeof(esp_secure_boot_sig_block_t));
if(!sigblock) {
if (!sigblock) {
ESP_LOGE(TAG, "bootloader_mmap(0x%" PRIx32 ", 0x%x) failed", src_addr + length, sizeof(esp_secure_boot_sig_block_t));
return ESP_FAIL;
}
@@ -53,7 +53,6 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
return err;
}
esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
{
ptrdiff_t keylen;
@@ -73,11 +72,11 @@ esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig
bool is_valid;
is_valid = uECC_verify_antifault(signature_verification_key_start,
image_digest,
ESP_SECURE_BOOT_DIGEST_LEN,
sig_block->signature,
uECC_secp256r1(),
verified_digest);
image_digest,
ESP_SECURE_BOOT_DIGEST_LEN,
sig_block->signature,
uECC_secp256r1(),
verified_digest);
ESP_LOGD(TAG, "Verification result %d", is_valid);
return is_valid ? ESP_OK : ESP_ERR_IMAGE_INVALID;

13
components/bootloader_support/src/secure_boot_v2/secure_boot.c → components/esp_image_verify/src/secure_boot_v2/secure_boot.c
View File

@@ -10,14 +10,13 @@
#include "esp_secure_boot.h"
#include "bootloader_flash_priv.h"
#include "bootloader_sha.h"
#include "bootloader_utility.h"
#include "bootloader_sha_flash.h"
#include "esp_image_format.h"
#include "esp_efuse.h"
#include "esp_efuse_table.h"
#include "secure_boot_signature_priv.h"
#include "esp_macros.h"
/* The following API implementations are used only when called
* from the bootloader code.
*/
@@ -177,7 +176,7 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
}
/* Initialize all efuse block entries to invalid (max) value */
esp_efuse_block_t blocks[SECURE_BOOT_NUM_BLOCKS] = {[0 ... SECURE_BOOT_NUM_BLOCKS-1] = EFUSE_BLK_KEY_MAX};
esp_efuse_block_t blocks[SECURE_BOOT_NUM_BLOCKS] = {[0 ... SECURE_BOOT_NUM_BLOCKS - 1] = EFUSE_BLK_KEY_MAX};
/* Check if secure boot digests are present */
bool has_secure_boot_digest = false;
for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
@@ -190,7 +189,7 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
esp_image_sig_public_key_digests_t boot_key_digests = {0};
esp_image_sig_public_key_digests_t app_key_digests = {0};
ESP_LOGI(TAG, "Secure boot digests %s", has_secure_boot_digest ? "already present":"absent, generating..");
ESP_LOGI(TAG, "Secure boot digests %s", has_secure_boot_digest ? "already present" : "absent, generating..");
if (!has_secure_boot_digest) {
/* Generate the bootloader public key digests */
@@ -245,8 +244,8 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
#else
size_t offset = 0;
#endif
ret = esp_efuse_read_block(blocks[i], boot_key_digests.key_digests[boot_key_digests.num_digests], offset,
ESP_SECURE_BOOT_KEY_DIGEST_LEN * 8);
ret = esp_efuse_read_block(blocks[i], boot_key_digests.key_digests[boot_key_digests.num_digests], offset,
ESP_SECURE_BOOT_KEY_DIGEST_LEN * 8);
if (ret) {
ESP_LOGE(TAG, "Error during reading %d eFuse block (err=0x%x)", blocks[i], ret);
return ret;
@@ -318,7 +317,7 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
}
#if CONFIG_SECURE_ENABLE_TEE
if (!match) {
continue;
continue;
}
for (unsigned j = 0; j < tee_key_digests.num_digests; j++) {

28
components/bootloader_support/src/secure_boot_v2/secure_boot_ecdsa_signature.c → components/esp_image_verify/src/secure_boot_v2/secure_boot_ecdsa_signature.c
View File

@@ -38,24 +38,24 @@ esp_err_t verify_ecdsa_signature_block(const ets_secure_boot_signature_t *sig_bl
uint8_t key_size = 0;
psa_ecc_family_t curve_family;
switch(trusted_block->ecdsa.key.curve_id) {
switch (trusted_block->ecdsa.key.curve_id) {
#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_256_BITS
case ECDSA_CURVE_P256:
key_size = 32;
curve_family = PSA_ECC_FAMILY_SECP_R1;
psa_set_key_bits(&key_attributes, PSA_BYTES_TO_BITS(key_size));
break;
case ECDSA_CURVE_P256:
key_size = 32;
curve_family = PSA_ECC_FAMILY_SECP_R1;
psa_set_key_bits(&key_attributes, PSA_BYTES_TO_BITS(key_size));
break;
#endif /* CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_256_BITS */
#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
case ECDSA_CURVE_P384:
key_size = 48;
curve_family = PSA_ECC_FAMILY_SECP_R1;
psa_set_key_bits(&key_attributes, PSA_BYTES_TO_BITS(key_size));
break;
case ECDSA_CURVE_P384:
key_size = 48;
curve_family = PSA_ECC_FAMILY_SECP_R1;
psa_set_key_bits(&key_attributes, PSA_BYTES_TO_BITS(key_size));
break;
#endif /* CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS */
default:
ESP_LOGE(TAG, "Invalid curve ID");
return ESP_ERR_INVALID_ARG;
default:
ESP_LOGE(TAG, "Invalid curve ID");
return ESP_ERR_INVALID_ARG;
}
#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS

22
components/bootloader_support/src/secure_boot_v2/secure_boot_rsa_signature.c → components/esp_image_verify/src/secure_boot_v2/secure_boot_rsa_signature.c
View File

@@ -24,9 +24,9 @@ ESP_LOG_ATTR_TAG(TAG, "secure_boot_v2_rsa");
* }
*/
static int encode_rsa_pubkey_der(const uint8_t *modulus, size_t modulus_len,
const uint8_t *exponent, size_t exponent_len,
uint8_t *der_buf, size_t der_buf_size,
uint8_t **der_start, size_t *der_len)
const uint8_t *exponent, size_t exponent_len,
uint8_t *der_buf, size_t der_buf_size,
uint8_t **der_start, size_t *der_len)
{
if (!der_buf || !der_start || !der_len || der_buf_size == 0) {
return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
@@ -77,7 +77,7 @@ static int encode_rsa_pubkey_der(const uint8_t *modulus, size_t modulus_len,
/* Write SEQUENCE header */
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&c, der_buf, len));
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(&c, der_buf,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE));
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE));
*der_start = c;
*der_len = len;
@@ -137,11 +137,11 @@ esp_err_t verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_bloc
e_bytes[3] = trusted_block->key.e & 0xFF;
ret = encode_rsa_pubkey_der(
n_be, rsa_key_size,
e_bytes, sizeof(e_bytes),
pubkey_der_buf, pubkey_der_buf_size,
&der_start, &der_len
);
n_be, rsa_key_size,
e_bytes, sizeof(e_bytes),
pubkey_der_buf, pubkey_der_buf_size,
&der_start, &der_len
);
free(n_be);
@@ -170,8 +170,8 @@ esp_err_t verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_bloc
/* Verify the signature using PSA APIs */
status = psa_verify_hash(key_id, PSA_ALG_RSA_PSS(PSA_ALG_SHA_256),
image_digest, ESP_SECURE_BOOT_DIGEST_LEN,
sig_be, rsa_key_size);
image_digest, ESP_SECURE_BOOT_DIGEST_LEN,
sig_be, rsa_key_size);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Signature verification failed, err: %d", status);

0
components/bootloader_support/src/secure_boot_v2/secure_boot_signature_priv.h → components/esp_image_verify/src/secure_boot_v2/secure_boot_signature_priv.h
View File

16
components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_app.c → components/esp_image_verify/src/secure_boot_v2/secure_boot_signatures_app.c
View File

@@ -7,7 +7,7 @@
#include "bootloader_flash_priv.h"
#include "bootloader_sha.h"
#include "bootloader_utility.h"
#include "bootloader_sha_flash.h"
#include "bootloader_signature.h"
#include "esp_log.h"
#include "esp_image_format.h"
@@ -35,7 +35,7 @@ ESP_LOG_ATTR_TAG(TAG, "secure_boot_v2");
static esp_err_t validate_signature_block(const ets_secure_boot_sig_block_t *block)
{
if (block->magic_byte != ETS_SECURE_BOOT_V2_SIGNATURE_MAGIC
|| block->block_crc != esp_rom_crc32_le(0, (uint8_t *)block, CRC_SIGN_BLOCK_LEN)) {
|| block->block_crc != esp_rom_crc32_le(0, (uint8_t *)block, CRC_SIGN_BLOCK_LEN)) {
return ESP_FAIL;
}
if (block->version != ESP_SECURE_BOOT_SCHEME) {
@@ -100,11 +100,11 @@ static esp_err_t calculate_image_public_key_digests(bool verify_image_digest, bo
if (verify_image_digest) {
// Check we can verify the image using this signature and this key
uint8_t temp_verified_digest[ESP_SECURE_BOOT_DIGEST_LEN];
#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
bool verified = ets_rsa_pss_verify(&block.key, block.signature, image_digest, temp_verified_digest);
#elif CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
#elif CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
bool verified = ets_ecdsa_verify(&block.ecdsa.key.point[0], block.ecdsa.signature, block.ecdsa.key.curve_id, image_digest, temp_verified_digest);
#endif
#endif
if (!verified) {
ESP_LOGE(TAG, "Secure boot key (%d) verification failed.", i);
continue;
@@ -157,7 +157,7 @@ static esp_err_t get_secure_boot_key_digests(esp_image_sig_public_key_digests_t
// Gets key digests from running app
ESP_LOGI(TAG, "Take trusted digest key(s) from running app");
return esp_secure_boot_get_signature_blocks_for_running_app(true, public_key_digests);
} else { // CONFIG_SECURE_BOOT_V2_ENABLED
} else { // CONFIG_SECURE_BOOT_V2_ENABLED
ESP_LOGI(TAG, "Take trusted digest key(s) from eFuse block(s)");
// Read key digests from efuse
esp_secure_boot_key_digests_t efuse_trusted;
@@ -172,7 +172,7 @@ static esp_err_t get_secure_boot_key_digests(esp_image_sig_public_key_digests_t
if (public_key_digests->num_digests > 0) {
return ESP_OK;
}
}
}
return ESP_ERR_NOT_FOUND;
}
@@ -282,7 +282,7 @@ esp_err_t esp_secure_boot_verify_sbv2_signature_block(const ets_secure_boot_sign
break;
}
}
return (ret != 0 || any_trusted_key == false) ? ESP_ERR_IMAGE_INVALID: ESP_OK;
return (ret != 0 || any_trusted_key == false) ? ESP_ERR_IMAGE_INVALID : ESP_OK;
}
#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME

4
components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c → components/esp_image_verify/src/secure_boot_v2/secure_boot_signatures_bootloader.c
View File

@@ -9,7 +9,7 @@
#include "esp_fault.h"
#include "bootloader_flash_priv.h"
#include "bootloader_sha.h"
#include "bootloader_utility.h"
#include "bootloader_sha_flash.h"
#include "bootloader_signature.h"
#include "esp_log.h"
#include "esp_image_format.h"
@@ -63,7 +63,7 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
static esp_err_t validate_signature_block(const ets_secure_boot_sig_block_t *block)
{
if (block->magic_byte != ETS_SECURE_BOOT_V2_SIGNATURE_MAGIC
|| block->block_crc != esp_rom_crc32_le(0, (uint8_t *)block, CRC_SIGN_BLOCK_LEN)) {
|| block->block_crc != esp_rom_crc32_le(0, (uint8_t *)block, CRC_SIGN_BLOCK_LEN)) {
return ESP_FAIL;
}
if (block->version != ESP_SECURE_BOOT_SCHEME) {

4
components/esp_partition/CMakeLists.txt
View File

@@ -29,7 +29,7 @@ else()
set(srcs "partition.c")
set(priv_reqs esp_system spi_flash partition_table efuse)
set(reqs esp_blockdev)
set(private_include_dirs)
set(private_include_dirs "")
idf_build_get_property(build_dir BUILD_DIR)
idf_build_get_property(target IDF_TARGET)
@@ -41,7 +41,7 @@ else()
idf_component_get_property(bootloader_support_dir bootloader_support COMPONENT_DIR)
set(private_include_dirs ${bootloader_support_dir}/include)
else()
list(APPEND priv_reqs bootloader_support app_update)
list(APPEND priv_reqs bootloader_support)
list(APPEND srcs "partition_target.c")
endif()

4
components/esp_partition/include/esp_partition.h
View File

@@ -535,6 +535,10 @@ void esp_partition_munmap(esp_partition_mmap_handle_t handle);
* - ESP_ERR_NO_MEM: Cannot allocate memory for sha256 operation.
* - ESP_ERR_IMAGE_INVALID: App partition doesn't contain a valid app image.
* - ESP_FAIL: An allocation error occurred.
*
* @note Requires the esp_image_verify component in the build (apps using OTA get
* it through app_update). Calling it without that component fails at link
* time with an undefined reference.
*/
esp_err_t esp_partition_get_sha256(const esp_partition_t* partition, uint8_t* sha_256);

27
components/esp_partition/include/esp_private/esp_partition_utils.h Normal file
View File

@@ -0,0 +1,27 @@
/*
* SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#pragma once
#include "esp_partition.h"
#ifdef __cplusplus
extern "C" {
#endif
/**
* @brief Find the APP partition containing the currently executing firmware.
*
* Private helper shared by esp_partition and app_update; application code
* should prefer esp_ota_get_running_partition() (app_update). The result is
* cached after the first lookup.
*
* @return Running APP partition
*/
const esp_partition_t *esp_partition_get_running_partition(void);
#ifdef __cplusplus
}
#endif

45
components/esp_partition/partition_target.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -19,7 +19,7 @@
#include "esp_rom_md5.h"
#include "spi_flash_mmap.h"
#include "bootloader_common.h"
#include "esp_ota_ops.h"
#include "esp_private/esp_partition_utils.h"
#define HASH_LEN 32 /* SHA-256 digest length */
@@ -189,7 +189,13 @@ void esp_partition_munmap(esp_partition_mmap_handle_t handle)
esp_err_t esp_partition_get_sha256(const esp_partition_t *partition, uint8_t *sha_256)
{
return bootloader_common_get_sha256_of_partition(partition->address, partition->size, partition->type, sha_256);
/* Single shared implementation lives in bootloader_common.
Inline its body here once that API is removed. */
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
return bootloader_common_get_sha256_of_partition(partition->address, partition->size,
partition->type, sha_256);
#pragma GCC diagnostic pop
}
bool esp_partition_check_identity(const esp_partition_t *partition_1, const esp_partition_t *partition_2)
@@ -224,12 +230,43 @@ bool esp_partition_is_flash_region_writable(size_t addr, size_t size)
return true;
}
const esp_partition_t *esp_partition_get_running_partition(void)
{
static const esp_partition_t *s_running_partition = NULL;
if (s_running_partition != NULL) {
return s_running_partition;
}
size_t phys_offs = spi_flash_cache2phys(esp_partition_get_running_partition);
assert(phys_offs != SPI_FLASH_CACHE2PHYS_FAIL); /* indicates cache2phys lookup is buggy */
if (phys_offs == SPI_FLASH_CACHE2PHYS_FAIL) {
abort(); /* stay fatal when asserts are compiled out */
}
esp_partition_iterator_t it = esp_partition_find(ESP_PARTITION_TYPE_APP,
ESP_PARTITION_SUBTYPE_ANY, NULL);
assert(it != NULL); /* has to be at least one app partition */
while (it != NULL) {
const esp_partition_t *p = esp_partition_get(it);
if (phys_offs >= p->address && phys_offs < p->address + p->size) {
esp_partition_iterator_release(it);
s_running_partition = p;
return p;
}
it = esp_partition_next(it);
}
abort(); /* Partition table is invalid or corrupt */
}
bool esp_partition_main_flash_region_safe(size_t addr, size_t size)
{
if (addr <= ESP_PARTITION_TABLE_OFFSET + ESP_PARTITION_TABLE_MAX_LEN) {
return false;
}
const esp_partition_t *p = esp_ota_get_running_partition();
const esp_partition_t *p = esp_partition_get_running_partition();
if (addr >= p->address && addr < p->address + p->size) {
return false;
}

2
components/esp_tee/subproject/CMakeLists.txt
View File

@@ -25,7 +25,7 @@ set(ESP_TEE_BUILD 1)
set(NON_OS_BUILD 1)
# Additional components
list(APPEND COMPONENTS bootloader_support efuse esp_hal_mspi esp_hal_wdt
list(APPEND COMPONENTS bootloader_support esp_image_verify efuse esp_hal_mspi esp_hal_wdt
esp_hal_security esp_security mbedtls esp_stdio)
# TEE-specific components

1
components/esp_tee/subproject/components/attestation/esp_att_utils_crypto.c
View File

@@ -11,7 +11,6 @@
#include "esp_err.h"
#if ESP_TEE_BUILD
#include "bootloader_sha.h"
#include "esp_tee_sec_storage.h"
#endif
#include "esp_random.h"

1
components/esp_tee/subproject/components/attestation/esp_att_utils_json.c
View File

@@ -11,7 +11,6 @@
#include "esp_err.h"
#if ESP_TEE_BUILD
#include "bootloader_sha.h"
#include "esp_tee_sec_storage.h"
#endif
#include "esp_random.h"

2
components/esp_tee/test_apps/tee_test_fw/main/CMakeLists.txt
View File

@@ -1,6 +1,6 @@
idf_build_get_property(idf_path IDF_PATH)
set(priv_requires bootloader_support esp_driver_gptimer esp_system esp_tee esp_timer mbedtls spi_flash)
set(priv_requires bootloader_support esp_driver_gptimer esp_system esp_tee esp_timer mbedtls spi_flash esp_image_verify)
# Test FW related
list(APPEND priv_requires console nvs_flash test_utils unity)
# TEE related

7
components/mbedtls/CMakeLists.txt
View File

@@ -543,6 +543,13 @@ else()
target_link_libraries(${COMPONENT_LIB} ${linkage_type} "-u mbedtls_psa_crypto_init_include_impl")
endif()
# Force-link esp_mem.c so esp_mbedtls_mem_calloc/free are present whenever
# mbedtls is in the link. Without this, link order breaks for apps that pull
# mbedtls but don't call any mbedtls function
if(NOT (CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin" AND ${IDF_TARGET} STREQUAL "linux"))
target_link_libraries(${COMPONENT_LIB} ${linkage_type} "-u esp_mbedtls_mem_calloc")
endif()
# Additional optional dependencies for the mbedcrypto library
function(builtin_optional_deps component_name)
idf_build_get_property(components BUILD_COMPONENTS)

7
components/nvs_flash/CMakeLists.txt
View File

@@ -63,7 +63,12 @@ else()
set(requires esp_partition esp_blockdev)
set(priv_requires spi_flash)
if(NOT ${target} STREQUAL "linux")
list(APPEND priv_requires esp_libc esptool_py nvs_sec_provider)
# mbedtls is needed for NVS encryption (nvs_encrypted_partition.cpp).
# It used to be pulled in transitively via bootloader_support, but
# that dep was removed in the bootloader_support / esp_image_verify
# split. Declare it explicitly so `idf::mbedtls` exists for the
# target_link_libraries() call below.
list(APPEND priv_requires esp_libc esptool_py nvs_sec_provider mbedtls)
endif()
idf_component_register(SRCS "${srcs}"

2
docs/en/api-reference/system/ota.rst
View File

@@ -235,7 +235,7 @@ The verification of signed OTA updates can be performed even without enabling ha
Signed Data Partition Updates
------------------------------
Data partition images can be verified using the same Secure Boot v2 signature mechanism as application images. Enable :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` during OTA updates.
Data partition images can be verified using the same Secure Boot v2 signature mechanism as application images. Enable :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` during OTA updates.
Sign data partition images using:

14
docs/en/migration-guides/release-6.x/6.2/security.rst
View File

@@ -13,3 +13,17 @@ A PMP entry locked by the bootloader cannot be reconfigured until the next CPU r
Applications built with ESP-IDF are not affected, as they program and lock the full PMP configuration themselves during startup, before any application code runs.
Custom (non-ESP-IDF) applications launched by the ESP-IDF second stage bootloader must not assume that any PMP entries are pre-configured or locked at handoff. Previously, the bootloader configured and locked entries covering, e.g., the ROM and the peripheral address spaces; such applications must now program their own PMP configuration.
Image verification split out of ``bootloader_support``
------------------------------------------------------
Image verification and secure-boot signature checking moved from
``bootloader_support`` into the new ``esp_image_verify`` component. ``bootloader_support`` no longer depends on ``mbedtls``.
- Components that relied on ``bootloader_support`` transitively providing ``mbedtls`` or ``app_update`` must now declare those dependencies explicitly in their ``PRIV_REQUIRES`` / ``REQUIRES``.
- :cpp:func:`bootloader_common_get_sha256_of_partition` is deprecated. Use :cpp:func:`esp_partition_get_sha256` instead.
- In builds that do not include the ``esp_image_verify`` component (no OTA or signed-image features), calling :cpp:func:`esp_partition_get_sha256` or the deprecated function above fails at link time with an undefined reference to ``esp_image_get_metadata`` / ``bootloader_sha256_flash_contents``. Add ``esp_image_verify`` (or ``app_update``, which includes it and provides the OTA APIs) to the calling component's ``PRIV_REQUIRES`` or to the project's ``COMPONENTS`` list.
- Builds enabling :ref:`CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT` must include the ``esp_image_verify`` component, which provides the startup check that verifies the running app's signature.
Apps using OTA get it automatically through ``app_update``; apps that trim the component graph (e.g. ``MINIMAL_BUILD``) must add ``esp_image_verify`` (or ``app_update``) to a ``PRIV_REQUIRES`` list or the project ``COMPONENTS``. Such builds fail with a ``#error`` instead of silently skipping the configured check.
- The Kconfig option ``CONFIG_SECURE_SIGNED_DATA_PARTITION`` was renamed to ``CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION`` (old name still accepted via ``sdkconfig.rename``).

2
docs/en/security/secure-boot-v2.rst
View File

@@ -420,7 +420,7 @@ An image is verified if the public key stored in any signature block is valid fo
Verifying Data Partitions
--------------------------
The Secure Boot v2 signature verification can also verify data partition images during OTA updates. Enable :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED``.
The Secure Boot v2 signature verification can also verify data partition images during OTA updates. Enable :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED``.
Data partition images must be signed using ``idf.py secure-sign-data`` with the same signing key and follow the same format as application images. The verification uses the public key digest(s) stored in eFuse and follows the process described in :ref:`verify_image`.

2
docs/zh_CN/api-reference/system/ota.rst
View File

@@ -235,7 +235,7 @@ Kconfig 中的 :menuitem:`CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE` 可以帮助用
签名数据分区的更新
------------------
数据分区镜像可以使用与应用镜像相同的 Secure Boot v2 签名机制进行验证。启用 :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION`，以便在 OTA 更新期间验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
数据分区镜像可以使用与应用镜像相同的 Secure Boot v2 签名机制进行验证。启用 :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION`，以便在 OTA 更新期间验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
使用以下命令对数据分区镜像进行签名：

14
docs/zh_CN/migration-guides/release-6.x/6.2/security.rst
View File

@@ -13,3 +13,17 @@
使用 ESP-IDF 构建的应用程序不受影响，因为应用程序会在启动阶段、任何应用代码运行之前，自行编程并锁定完整的 PMP 配置。
由 ESP-IDF 二级引导加载程序启动的自定义（非 ESP-IDF）应用程序不得假定交接时任何 PMP 表项已被预先配置或锁定。此前，引导加载程序会配置并锁定覆盖 ROM 和外设地址空间等区域的表项；此类应用程序现在必须自行完成 PMP 配置。
镜像校验功能从 ``bootloader_support`` 中拆分
--------------------------------------------
镜像校验与安全启动签名校验已从 ``bootloader_support`` 移至新的
``esp_image_verify`` 组件。``bootloader_support`` 不再依赖 ``mbedtls``。
- 此前通过 ``bootloader_support`` 间接获得 ``mbedtls`` 或 ``app_update`` 依赖的组件，现在必须在 ``PRIV_REQUIRES`` / ``REQUIRES`` 中显式声明。
- :cpp:func:`bootloader_common_get_sha256_of_partition` 已弃用，请改用 :cpp:func:`esp_partition_get_sha256`。
- 在未包含 ``esp_image_verify`` 组件的工程中（未启用 OTA 或签名镜像功能），调用 :cpp:func:`esp_partition_get_sha256` 或上述弃用函数会在链接时因 ``esp_image_get_metadata`` / ``bootloader_sha256_flash_contents`` 未定义引用而失败。请将 ``esp_image_verify`` （或 ``app_update``，它包含该组件并提供 OTA API）添加到调用组件的 ``PRIV_REQUIRES`` 或工程的 ``COMPONENTS`` 列表中。
- 启用 :ref:`CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT` 的工程必须包含 ``esp_image_verify`` 组件，该组件提供启动时校验当前应用签名的检查。
使用 OTA 的应用会通过 ``app_update`` 自动引入该组件；裁剪组件依赖图的应用（如启用 ``MINIMAL_BUILD``）必须将 ``esp_image_verify`` （或 ``app_update``）添加到 ``PRIV_REQUIRES`` 或工程的 ``COMPONENTS`` 中。否则构建将以 ``#error`` 失败，而不会静默跳过已配置的安全检查。
- Kconfig 选项 ``CONFIG_SECURE_SIGNED_DATA_PARTITION`` 已重命名为 ``CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION`` （通过 ``sdkconfig.rename`` 兼容旧名称）。

2
docs/zh_CN/security/secure-boot-v2.rst
View File

@@ -420,7 +420,7 @@
验证数据分区
------------
Secure Boot v2 签名验证也可以在 OTA 更新期间验证数据分区镜像。启用 :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION` 以验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
Secure Boot v2 签名验证也可以在 OTA 更新期间验证数据分区镜像。启用 :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION` 以验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
数据分区镜像必须使用相同的签名密钥，通过 ``idf.py secure-sign-data`` 进行签名，并采用与应用镜像相同的格式。验证使用存储在 eFuse 中的一个或多个公钥摘要，并遵循 :ref:`verify_image` 中所述的流程。

1
examples/build_system/cmake/import_prebuilt/main/CMakeLists.txt
View File

@@ -1,4 +1,5 @@
idf_component_register(SRCS "main.c"
PRIV_REQUIRES app_update
INCLUDE_DIRS ".")
# Import the library, specifying a target name and the library path.

1
examples/build_system/cmakev2/features/import_prebuilt/main/CMakeLists.txt
View File

@@ -1,4 +1,5 @@
idf_component_register(SRCS "main.c"
PRIV_REQUIRES app_update
INCLUDE_DIRS ".")
# Import the library, specifying a target name and the library path.

1
examples/system/ota/otatool/main/CMakeLists.txt
View File

@@ -1,2 +1,3 @@
idf_component_register(SRCS "otatool_main.c"
PRIV_REQUIRES app_update
INCLUDE_DIRS ".")

2
examples/system/ota/partitions_ota/CMakeLists.txt
View File

@@ -6,7 +6,7 @@ include($ENV{IDF_PATH}/tools/cmake/project.cmake)
project(partitions_ota)
# Copy storage.bin from test folder to build directory
if(CONFIG_SECURE_SIGNED_DATA_PARTITION)
if(CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION)
set(storage_file signed_storage.bin)
else()
set(storage_file storage.bin)

4
examples/system/ota/partitions_ota/main/app_main.c
View File

@@ -209,12 +209,12 @@ static esp_err_t ota_update_partitions(esp_https_ota_config_t *ota_config)
}
} else if (strstr(ota_config->http_config->url, "storage.bin") != NULL) {
#if CONFIG_SECURE_SIGNED_DATA_PARTITION
#if CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
ota_config->partition.staging = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, "staging");
assert(ota_config->partition.staging != NULL);
#else
ota_config->partition.staging = NULL; // free app ota partition will be selected and used for downloading a new image
#endif // SECURE_SIGNED_DATA_PARTITION
#endif // APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
ota_config->partition.final = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, "storage");
assert(ota_config->partition.final != NULL);
ota_config->partition.finalize_with_copy = true; // After the download is complete, copy the received image to the final partition automatically

2
examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification
View File

@@ -29,4 +29,4 @@ CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT=y
CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key.pem"
CONFIG_SECURE_BOOT_ALLOW_SHORT_APP_PARTITION=y
CONFIG_SECURE_SIGNED_DATA_PARTITION=y
CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION=y

9
tools/idf_py_actions/hints.yml
View File

@@ -592,3 +592,12 @@
-
re: "error: 'WIFI_BW_HT40' undeclared \\(first use in this function\\)"
hint: "The enum value 'WIFI_BW_HT40' has been removed. Use 'WIFI_BW40' instead."
-
re: "undefined reference to `(esp_image_get_metadata|bootloader_sha256_flash_contents|bootloader_sha384_flash_contents)'"
hint: "'{}' is provided by the esp_image_verify component, which is not in the build. APIs such as esp_partition_get_sha256() need it. Add esp_image_verify (or app_update, which includes it and provides the OTA APIs) to the calling component's PRIV_REQUIRES or to the project's COMPONENTS list."
match_to_output: True
-
re: "undefined reference to `esp_secure_boot_check_signature_on_update'"
hint: "CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT requires the startup signature check from the esp_image_verify component, which is not in the build. Add esp_image_verify (or app_update, which includes it) to the calling component's PRIV_REQUIRES or to the project's COMPONENTS list."

2
tools/test_apps/security/signed_app_no_secure_boot/main/CMakeLists.txt
View File

@@ -1,3 +1,3 @@
idf_component_register(SRCS "main.c"
INCLUDE_DIRS "."
PRIV_REQUIRES nvs_flash)
PRIV_REQUIRES nvs_flash esp_image_verify)

1
tools/test_apps/system/build_tests/client_only_mbedtls/main/CMakeLists.txt
View File

@@ -1,2 +1,3 @@
idf_component_register(SRCS "test_main.c"
REQUIRES mbedtls
INCLUDE_DIRS ".")

1
tools/test_apps/system/build_tests/no_esp_cert_bundle/main/CMakeLists.txt
View File

@@ -1,2 +1,3 @@
idf_component_register(SRCS "test_main.c"
REQUIRES mbedtls
INCLUDE_DIRS ".")

16
tools/test_apps/system/g1_components/CMakeLists.txt
View File

@@ -44,11 +44,6 @@ set(extra_allowed_components
# These components are currently included into "G1" build, but shouldn't.
# After removing the extra dependencies, remove the components from this list as well.
set(extra_components_which_shouldnt_be_included
# app_update gets added because of spi_flash and esp_partition.
# esp_partition will get removed from g1 and spi_flash does not actually seem to need app_update anymore.
# When esp-partition is removed from g1 build it should be easy for us to also remove app-update # TODO IDF-8577
app_update
# bootloader is only included from esptool_py, which should be removed from G1
bootloader
@@ -85,7 +80,7 @@ set(extra_components_which_shouldnt_be_included
# esp_pm is pulled in by esp_system due to pm_init and freertos idle hook
# both could be moved to pm component if esp-system idle hook provided a way to register hooks
# esp_hw_support dependency seems like it could be removed?
# It is also used by esp_driver_gpio, mbedtls all of which should be removed from G1-only build.
# It is also used by esp_driver_gpio, which should be removed from G1-only build.
# IDF-10415
esp_pm
@@ -101,10 +96,6 @@ set(extra_components_which_shouldnt_be_included
# should be removed from G1-only build.
esptool_py
# mbedtls is a dependency of bootloader_support (plus other easier-to-remove ones)
# it is hard to make it conditional, need to remove bootloader_support.
mbedtls
# partition_table is pulled in by app_update, esptool_py, bootloader, esp_partition; all to be removed
partition_table
@@ -118,12 +109,9 @@ set(extra_components_which_shouldnt_be_included
# pthread is required by cxx. See [refactor-todo] about cxx, can it work without pthread?
pthread
# esp_security is required by mbedtls and spi_flash
# esp_security is required by spi_flash
esp_security
# esp_driver_dma is required by mbedtls
esp_driver_dma
# esp_usb_cdc_rom_console is used by the panic handler, will be conditional on cdc console option when
# the new build-system is implemented
esp_usb_cdc_rom_console

2
tools/test_apps/system/mmu_page_size/main/CMakeLists.txt
View File

@@ -1,2 +1,2 @@
idf_component_register(SRCS "main.c"
PRIV_REQUIRES unity esp_partition bootloader_support)
PRIV_REQUIRES unity esp_partition bootloader_support esp_image_verify)