fix(esp32-s3): Allow stub flasher execution with active Secure Boot

Author: radimkarnis

esptool/loader.py

@@ -1213,6 +1213,10 @@ def run_stub(self, stub=None):
             print("Stub is already running. No upload is necessary.")
             return self.STUB_CLASS(self)
 
+        secure_boot_workflow = (
+            self.CHIP_NAME == "ESP32-S3" and self.get_secure_boot_enabled()
+        )
+
         # Upload
         print("Uploading stub...")
         for field in [stub.text, stub.data]:
@@ -1225,8 +1229,24 @@ def run_stub(self, stub=None):
                     from_offs = seq * self.ESP_RAM_BLOCK
                     to_offs = from_offs + self.ESP_RAM_BLOCK
                     self.mem_block(field[from_offs:to_offs], seq)
+
         print("Running stub...")
-        self.mem_finish(stub.entry)
+        if not secure_boot_workflow:
+            self.mem_finish(stub.entry)
+        else:
+            # Bug in ESP32-S3 ROM prevents stub execution if secure boot is enabled
+            # Hijack the `read` function in ROM to point to the stub entrypoint
+            # got with GDB - p &rom_spiflash_legacy_funcs.read
+            rom_spiflash_legacy_funcs_read_ptr = 0x3FCEF688
+            self.mem_finish(0)  # Finish uploading to RAM but don't run the stub yet
+            stored_read_pointer = self.read_reg(rom_spiflash_legacy_funcs_read_ptr)
+            self.write_reg(rom_spiflash_legacy_funcs_read_ptr, stub.entry)
+            self.command(  # Trigger the `read` in ROM to jump to the stub entrypoint
+                self.ESP_READ_FLASH_SLOW,
+                struct.pack("<II", 0, 0),
+                wait_response=False,
+            )
+
         try:
             p = self.read()
         except StopIteration:
@@ -1238,6 +1258,9 @@ def run_stub(self, stub=None):
 
         if p != b"OHAI":
             raise FatalError(f"Failed to start stub. Unexpected response: {p}")
+        if secure_boot_workflow:
+            # Restore the original `read` function pointer
+            self.write_reg(rom_spiflash_legacy_funcs_read_ptr, stored_read_pointer)
         print("Stub running...")
         return self.STUB_CLASS(self)