Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

refactor(app_update): rename SECURE_SIGNED_DATA_PARTITION Kconfig option

Browse Source
This commit is contained in:
Ashish Sharma
2026-07-08 15:53:25 +08:00
committed by Mahavir Jain
parent 8589d9df25
commit b912691fcd
10 changed files with 20 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
components/app_update/Kconfig.projbuild
View File

@@ -1,5 +1,6 @@
menu "App Update config"
config SECURE_SIGNED_DATA_PARTITION
config APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
default n
bool "Require signed Data partition images"
depends on SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT || SECURE_SIGNED_APPS

12
components/app_update/esp_ota_ops.c
View File

@@ -32,9 +32,9 @@
#include "esp_flash.h"
#include "esp_private/esp_flash_internal.h" //For dangerous write protection
#include "esp_macros.h"
#if CONFIG_SECURE_SIGNED_DATA_PARTITION
#if CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
#include "psa/crypto.h"
#endif // CONFIG_SECURE_SIGNED_DATA_PARTITION
#endif // CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
#define OTA_SLOT(i) (i & 0x0F)
@@ -491,7 +491,7 @@ esp_err_t esp_ota_abort(esp_ota_handle_t handle)
return ESP_OK;
}
#if CONFIG_SECURE_SIGNED_DATA_PARTITION
#if CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
#define SHA_CHUNK 256
static esp_err_t ota_calc_partition_bin_sha(const esp_partition_t *partition, uint32_t length, uint8_t out_digest[ESP_SECURE_BOOT_DIGEST_LEN], psa_algorithm_t alg)
{
@@ -573,7 +573,7 @@ static esp_err_t ota_verify_data_partition_signature(const esp_partition_t *part
}
return err;
}
#endif // CONFIG_SECURE_SIGNED_DATA_PARTITION
#endif // CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
static esp_err_t ota_verify_partition(ota_ops_entry_t *ota_ops)
{
@@ -600,7 +600,7 @@ static esp_err_t ota_verify_partition(ota_ops_entry_t *ota_ops)
esp_partition_munmap(partition_table_map);
}
}
#if CONFIG_SECURE_SIGNED_DATA_PARTITION
#if CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
else if (ota_ops->partition.final->type == ESP_PARTITION_TYPE_DATA &&
ota_ops->partition.final->subtype == ESP_PARTITION_SUBTYPE_DATA_UNDEFINED) {
esp_err_t err = ota_verify_data_partition_signature(ota_ops->partition.staging, ota_ops->wrote_size);
@@ -610,7 +610,7 @@ static esp_err_t ota_verify_partition(ota_ops_entry_t *ota_ops)
}
return ESP_OK;
}
#endif // CONFIG_SECURE_SIGNED_DATA_PARTITION
#endif // CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
return ret;
}

4
components/app_update/sdkconfig.rename Normal file
View File

@@ -0,0 +1,4 @@
# sdkconfig replacement configurations for deprecated options formatted as
# CONFIG_DEPRECATED_OPTION CONFIG_NEW_OPTION
CONFIG_SECURE_SIGNED_DATA_PARTITION CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION

2
docs/en/api-reference/system/ota.rst
View File

@@ -235,7 +235,7 @@ The verification of signed OTA updates can be performed even without enabling ha
Signed Data Partition Updates
------------------------------
Data partition images can be verified using the same Secure Boot v2 signature mechanism as application images. Enable :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` during OTA updates.
Data partition images can be verified using the same Secure Boot v2 signature mechanism as application images. Enable :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` during OTA updates.
Sign data partition images using:

2
docs/en/security/secure-boot-v2.rst
View File

@@ -420,7 +420,7 @@ An image is verified if the public key stored in any signature block is valid fo
Verifying Data Partitions
--------------------------
The Secure Boot v2 signature verification can also verify data partition images during OTA updates. Enable :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED``.
The Secure Boot v2 signature verification can also verify data partition images during OTA updates. Enable :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED``.
Data partition images must be signed using ``idf.py secure-sign-data`` with the same signing key and follow the same format as application images. The verification uses the public key digest(s) stored in eFuse and follows the process described in :ref:`verify_image`.

2
docs/zh_CN/api-reference/system/ota.rst
View File

@@ -235,7 +235,7 @@ Kconfig 中的 :menuitem:`CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE` 可以帮助用
签名数据分区的更新
------------------
数据分区镜像可以使用与应用镜像相同的 Secure Boot v2 签名机制进行验证。启用 :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION`，以便在 OTA 更新期间验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
数据分区镜像可以使用与应用镜像相同的 Secure Boot v2 签名机制进行验证。启用 :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION`，以便在 OTA 更新期间验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
使用以下命令对数据分区镜像进行签名：

2
docs/zh_CN/security/secure-boot-v2.rst
View File

@@ -420,7 +420,7 @@
验证数据分区
------------
Secure Boot v2 签名验证也可以在 OTA 更新期间验证数据分区镜像。启用 :menuitem:`CONFIG_SECURE_SIGNED_DATA_PARTITION` 以验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
Secure Boot v2 签名验证也可以在 OTA 更新期间验证数据分区镜像。启用 :menuitem:`CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION` 以验证子类型为 ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` 的数据分区。
数据分区镜像必须使用相同的签名密钥，通过 ``idf.py secure-sign-data`` 进行签名，并采用与应用镜像相同的格式。验证使用存储在 eFuse 中的一个或多个公钥摘要，并遵循 :ref:`verify_image` 中所述的流程。

2
examples/system/ota/partitions_ota/CMakeLists.txt
View File

@@ -6,7 +6,7 @@ include($ENV{IDF_PATH}/tools/cmake/project.cmake)
project(partitions_ota)
# Copy storage.bin from test folder to build directory
if(CONFIG_SECURE_SIGNED_DATA_PARTITION)
if(CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION)
set(storage_file signed_storage.bin)
else()
set(storage_file storage.bin)

4
examples/system/ota/partitions_ota/main/app_main.c
View File

@@ -209,12 +209,12 @@ static esp_err_t ota_update_partitions(esp_https_ota_config_t *ota_config)
}
} else if (strstr(ota_config->http_config->url, "storage.bin") != NULL) {
#if CONFIG_SECURE_SIGNED_DATA_PARTITION
#if CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
ota_config->partition.staging = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, "staging");
assert(ota_config->partition.staging != NULL);
#else
ota_config->partition.staging = NULL; // free app ota partition will be selected and used for downloading a new image
#endif // SECURE_SIGNED_DATA_PARTITION
#endif // APP_UPDATE_SECURE_SIGNED_DATA_PARTITION
ota_config->partition.final = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, "storage");
assert(ota_config->partition.final != NULL);
ota_config->partition.finalize_with_copy = true; // After the download is complete, copy the received image to the final partition automatically

2
examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2.data_partition_verification
View File

@@ -29,4 +29,4 @@ CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT=y
CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key.pem"
CONFIG_SECURE_BOOT_ALLOW_SHORT_APP_PARTITION=y
CONFIG_SECURE_SIGNED_DATA_PARTITION=y
CONFIG_APP_UPDATE_SECURE_SIGNED_DATA_PARTITION=y