Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(secure_boot): range-check ECDSA r,s in bootloader before ROM verify

Browse Source
This commit is contained in:
harshal.patil
2026-06-12 14:38:47 +05:30
parent a981af40ca
commit f68bc1ba9f
19 changed files with 133 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_rom/esp32s31/Kconfig.soc_caps.in
-4
View File
@@ -91,10 +91,6 @@ config ESP_ROM_PRINTS_LOCKUP_STATUS
bool
default y
config ESP_ROM_ECDSA_VERIFY_PATCH
bool
default y
config ESP_ROM_BOOTLOADER_OFFSET_FLASH
hex
default 0x2000
components/esp_rom/esp32s31/esp_rom_caps.h
-1
View File
@@ -29,6 +29,5 @@
#define ESP_ROM_HAS_VERSION (1) // ROM has version/eco information
#define ESP_ROM_HAS_OUTPUT_PUTC_FUNC (1) // ROM has esp_rom_output_putc (or ets_write_char_uart)
#define ESP_ROM_PRINTS_LOCKUP_STATUS (1) // ROM bootloader already prints CPU lockup diagnostic status
#define ESP_ROM_ECDSA_VERIFY_PATCH (1) // ROM ets_ecdsa_verify API requires a software patch
#define ESP_ROM_BOOTLOADER_OFFSET_FLASH (0x2000) // Bootloader offset in flash determined by the ROM bootloader
#define ESP_ROM_CACHE_WRITEBACK_NEEDS_SYNC_TWICE_MAP (1) // ROM cache writeback related needs patch to avoid sync loss, need map parameter
components/esp_rom/esp32s31/ld/esp32s31.rom.ld
+1 -1
View File
@@ -467,7 +467,7 @@ esp_rom_recover_key = 0x2f8008b8;
/* Functions */
ets_emsa_pss_verify = 0x2f8008bc;
ets_rsa_pss_verify = 0x2f8008c0;
_rom_ets_ecdsa_verify = 0x2f8008c4;
ets_ecdsa_verify = 0x2f8008c4;
ets_secure_boot_verify_bootloader_with_keys = 0x2f8008c8;
ets_secure_boot_verify_signature = 0x2f8008cc;
ets_secure_boot_read_key_digests = 0x2f8008d0;