eaw/esp-idf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/secure_boot_padding_v3_1' into 'release/v3.1'

Browse Source 
secure boot: Fix padding issue (backport v3.1)

See merge request idf/esp-idf!2833
This commit is contained in:
Angus Gratton
2018-07-25 08:59:31 +08:00
parent ef38eb0323 e1e4e08fa8
commit 3eaf8f1a84
7 changed files with 34 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
components/bootloader/Kconfig.projbuild
View File

@@ -275,6 +275,13 @@ config SECURE_BOOT_ALLOW_JTAG
Only set this option in testing environments.
config SECURE_BOOT_ALLOW_SHORT_APP_PARTITION
bool "Allow app partition length not 64KB aligned"
depends on SECURE_BOOT_INSECURE
help
If not set (default), app partition size must be a multiple of 64KB. App images are padded to 64KB length, and the bootloader checks any trailing bytes after the signature (before the next 64KB boundary) have not been written. This is because flash cache maps entire 64KB pages into the address space. This prevents an attacker from appending unverified data after the app image in the flash, causing it to be mapped into the address space.
Setting this option allows the app partition length to be unaligned, and disables padding of the app image to this length. It is generally not recommended to set this option, unless you have a legacy partitioning scheme which doesn't support 64KB aligned partition lengths.
config FLASH_ENCRYPTION_UART_BOOTLOADER_ALLOW_ENCRYPT
bool "Leave UART bootloader encryption enabled"