You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Sep 16, 2024. It is now read-only.
To use it, you will need to update your ``PATH`` environment variable in ``~/.bash_profile`` file. To make ``xtensa-esp32-elf`` available for all terminal sessions, add the following line to your ``~/.bash_profile`` file::
65
66
@@ -74,7 +75,7 @@ Then when you need the toolchain you can type ``get_esp32`` on the command line
74
75
You also need the ESP IDF along side this repository in order to build the ESP32 port.
The Secure Boot key `secure_boot_signing_key.pem` has to be transformed into `secure-bootloader-key.bin`, to be burnt into efuses. This can be done in 2 ways:
**_If the keys are not written in efuse, before flashing the bootloader, then random keys will be generated by the ESP32, they can never be read nor re-written, so bootloader can never be updated. Even more, the application can be re-flashed (by USB) just 3 more times._**
249
-
250
-
### Makefile options:
251
-
252
-
make BOARD=GPY SECURE=on SECURE_KEY=secure_boot_signing_key.pem ENCRYPT_KEY=flash_encryption_key.bin
253
-
254
-
-`SECURE=on` is the main flag; it's not optional
255
-
- if `SECURE=on` by default:
256
-
- encryption is enabled
257
-
- secure_boot_signing_key.pem is the secure boot key, located relatively to Makefile
258
-
- flash_encryption_key.bin is the flash encryption key, located relatively to Makefile
259
-
260
-
For flashing the bootloader digest and the encrypted versions of all binaries:
261
-
262
-
make BOARD=GPY SECURE=on flash
263
-
264
-
### Flashing
265
-
266
-
For flashing the bootloader-reflash-digest.bin has to be written at address 0x0, instead of the bootloader.bin (at address 0x1000).
267
-
268
-
Build is done using `SECURE=on` option; additionally, all the binaries are pre-encrypted.
The OTA should be done using the pre-encrypted application image.
281
-
282
-
Because the encryption is done based on the physical flash address, there are 2 application binaries generated:
283
-
- gpy.bin_enc_0x10000 which has to be written at default factory address: 0x10000
284
-
- gpy.bin_enc_0x1A0000 which has to be written at the ota_0 partition address (0x1A0000)
285
-
286
-
*__Hint:__ on micropython interface, the method `pycom.ota_slot()` responds with the address of the next OTA partition available (either 0x10000 or 0x1A0000).*
209
+
For Secure Boot and Flash Encryption please check: https://docs.pycom.io/advance/encryption/
0 commit comments