From 93a3beafb8db4b7963cabc05a71889b80a3433e1 Mon Sep 17 00:00:00 2001 From: Ivan Grokhotkov Date: Wed, 4 Mar 2020 15:46:03 +0100 Subject: [PATCH 1/2] bootloader_support: don't check signature when JTAG is attached If an insecure configuration is enabled (no hardware secure boot, just software signature check), skip the signature check in bootloader if JTAG debugger is attached. This allows the debugger to set breakpoints in Flash before the application runs. Closes https://github.com/espressif/esp-idf/issues/4734 Closes https://github.com/espressif/esp-idf/issues/4878 --- .../bootloader_support/src/esp_image_format.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/components/bootloader_support/src/esp_image_format.c b/components/bootloader_support/src/esp_image_format.c index 76af18ddf8..07e0599392 100644 --- a/components/bootloader_support/src/esp_image_format.c +++ b/components/bootloader_support/src/esp_image_format.c @@ -220,8 +220,17 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_ #ifdef SECURE_BOOT_CHECK_SIGNATURE // secure boot images have a signature appended - err = verify_secure_boot_signature(sha_handle, data, image_digest, verified_digest); -#else +#if defined(BOOTLOADER_BUILD) && !defined(CONFIG_SECURE_BOOT) + // If secure boot is not enabled in hardware, then + // skip the signature check in bootloader when the debugger is attached. + // This is done to allow for breakpoints in Flash. + if (!esp_cpu_in_ocd_debug_mode()) { +#else // CONFIG_SECURE_BOOT + if (true) { +#endif // end checking for JTAG + err = verify_secure_boot_signature(sha_handle, data, image_digest, verified_digest); + } +#else // SECURE_BOOT_CHECK_SIGNATURE // No secure boot, but SHA-256 can be appended for basic corruption detection if (sha_handle != NULL && !esp_cpu_in_ocd_debug_mode()) { err = verify_simple_hash(sha_handle, data); From 6f2e465ec9b948776ebb19663f2d07d6a8ddf4d0 Mon Sep 17 00:00:00 2001 From: Ivan Grokhotkov Date: Sun, 31 May 2020 18:39:30 +0200 Subject: [PATCH 2/2] partition_table: fix generation of signed partition table Fixes the issue that signed partition table was not generated when CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES was on, because partition_table_bin depended on unsigned_partition_bin twice. Regression from acb7a211. Also use final_partition_bin variable in esptool_py_flash_target_image arguments, to avoid issues in the future if final_partition_bin is changed. --- components/partition_table/CMakeLists.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/components/partition_table/CMakeLists.txt b/components/partition_table/CMakeLists.txt index 2b78a1f226..ec00f222a0 100644 --- a/components/partition_table/CMakeLists.txt +++ b/components/partition_table/CMakeLists.txt @@ -51,7 +51,7 @@ add_custom_command(OUTPUT "${build_dir}/partition_table/${unsigned_partition_bin VERBATIM) add_custom_target(partition_table_bin DEPENDS "${build_dir}/partition_table/${unsigned_partition_bin}" - "${build_dir}/partition_table/${unsigned_partition_bin}") + "${build_dir}/partition_table/${final_partition_bin}") if(EXISTS ${partition_csv}) add_custom_target(partition_table @@ -100,7 +100,7 @@ idf_component_get_property(sub_args esptool_py FLASH_SUB_ARGS) if(CONFIG_APP_BUILD_GENERATE_BINARIES) esptool_py_flash_target(partition_table-flash "${main_args}" "${sub_args}") esptool_py_flash_target_image(partition_table-flash partition_table "${PARTITION_TABLE_OFFSET}" - "${build_dir}/partition_table/partition-table.bin") + "${build_dir}/partition_table/${final_partition_bin}") esptool_py_flash_target_image(flash partition_table "${PARTITION_TABLE_OFFSET}" - "${build_dir}/partition_table/partition-table.bin") + "${build_dir}/partition_table/${final_partition_bin}") endif()