alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

fix(bootloader_support): check the secure version only for app image

Browse Source 
Secure version in the image header is only available for the application
image. However, for certain security workflows, bootloader verifies
itself (own image) and hence the secure version check during that must be
avoided.

Regression introduced in recent commit-id: 3305cb4d

Tested that both secure boot and flash-enc workflows work correctly
with the anti-rollback scenario.
This commit is contained in:
Mahavir Jain 2024-02-19 12:26:08 +05:30
parent dbbe2cf173
commit b2cdc06789
No known key found for this signature in database
GPG Key ID: 99324EF4A00734E0
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
components/bootloader_support/src/esp_image_format.c
View File

@ -701,12 +701,16 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t
#endif
}
uint32_t *dest = (uint32_t *)load_addr;
#endif
#endif // BOOTLOADER_BUILD
const uint32_t *src = data;
#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
if (segment == 0) {
// Case I: Bootloader verifying application
// Case II: Bootloader verifying bootloader
// Anti-rollback check should handle only Case I from above.
if (segment == 0 && metadata->start_addr != ESP_BOOTLOADER_OFFSET) {
ESP_LOGD(TAG, "additional anti-rollback check 0x%"PRIx32, data_addr);
// The esp_app_desc_t structure is located in DROM and is always in segment #0.
size_t len = process_esp_app_desc_data(src, sha_handle, checksum, metadata);
data_len -= len;