Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use official spelling for MCUboot #7

Merged
merged 1 commit into from
Nov 17, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile.zephyr_base
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ RUN useradd -g dialout -m esp && \
USER esp

#############################
# MCUBoot development
# MCUboot development
#############################

RUN git clone https://github.com/mcu-tools/mcuboot.git && \
Expand Down
42 changes: 21 additions & 21 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,13 @@ Both the IDF bootloader image and the application image are verified against

![Secure Boot Flow: ESP-IDF](./img/secure-boot-flow_esp-idf.png "Secure Boot Flow: ESP-IDF")

### Secure Boot Flow: Zephyr/MCUBoot
### Secure Boot Flow: Zephyr/MCUboot

The IDF bootloader image is verified against `PK_HASH` (public key hash) in
eFuse. The application image is verified against `MCUBOOT_PK` (MCUBoot public
key) in MCUBoot image.
eFuse. The application image is verified against `MCUBOOT_PK` (MCUboot public
key) in MCUboot image.

![Secure Boot Flow: Zephyr/MCUBoot](./img/secure-boot-flow_esp32-mcuboot.png "Secure Boot Flow: Zephyr/MCUBoot")
![Secure Boot Flow: Zephyr/MCUboot](./img/secure-boot-flow_esp32-mcuboot.png "Secure Boot Flow: Zephyr/MCUboot")

### Secure Boot Efuse Blowing

Expand Down Expand Up @@ -92,9 +92,9 @@ Use the fuseblower Docker image `esp32fb:dev` built with
idf.py flash
```

### Zephyr/MCUBoot Development (with Secure Boot Image Signing)
### Zephyr/MCUboot Development (with Secure Boot Image Signing)

- Build container image for Zephyr/MCUBoot development. Note that for
- Build container image for Zephyr/MCUboot development. Note that for
`--build-arg` values, private keys must be under the
[esp32/keys](./esp32/keys/) folder, and bootloader configs must be under
the [esp32/configs](./esp32/configs/) folder. If no build argument is
Expand All @@ -119,7 +119,7 @@ Use the fuseblower Docker image `esp32fb:dev` built with

Inside the container,

- For MCUBoot and secure boot development
- For MCUboot and secure boot development
- Use `/home/esp/mcuboot`.
- Remember to set up the ESP-IDF environment by sourcing `export.sh`

Expand All @@ -136,7 +136,7 @@ Use the fuseblower Docker image `esp32fb:dev` built with
source ${HOME}/zephyrproject/.venv/bin/activate
```

- Flash MCUBoot and Zephyr App Images
- Flash MCUboot and Zephyr App Images

On Linux host, we can interact with the development board from the container

Expand All @@ -150,7 +150,7 @@ Use the fuseblower Docker image `esp32fb:dev` built with
```bash
cd ${HOME}/mcuboot/boot/espressif
source ./hal/esp-idf/export.sh
# Flash MCUBoot image at offset 0x1000
# Flash MCUboot image at offset 0x1000
esptool.py -p /dev/ttyUSB0 \
-b 460800 \
--before default_reset \
Expand All @@ -162,7 +162,7 @@ Use the fuseblower Docker image `esp32fb:dev` built with
--flash_freq 40m \
0x1000 build/mcuboot_esp32_signed.bin
# Flash Zephyr application image at offset 0x10000. This is the slot0 offset
# configured in bootloader.conf of MCUBoot
# configured in bootloader.conf of MCUboot
esptool.py -p /dev/ttyUSB0 \
-b 460800 \
--before default_reset \
Expand Down Expand Up @@ -221,20 +221,20 @@ Use the fuseblower Docker image `esp32fb:dev` built with
<details>
<summary>ESP32-S2: Container Local Build Setup</summary>

## ESP32-S2 (MCUBoot and Zephyr)
## ESP32-S2 (MCUboot and Zephyr)

Dev board: ESP32-S2-DevKitM-1-N4R2 ([Mouser
link](https://www.mouser.com/ProductDetail/Espressif-Systems/ESP32-S2-DevKitM-1-N4R2?qs=vvQtp7zwQdNx66oTi6gqpw%3D%3D&countryCode=US&currencyCode=USD);
[Datasheet](https://www.mouser.com/new/espressif/espressif-esp32-s2-kits/))


### Secure Boot Flow: Zephyr/MCUBoot
### Secure Boot Flow: Zephyr/MCUboot

The IDF bootloader image is verified against `PK_HASH` (public key hash) in
eFuse. The application image is verified against `MCUBOOT_PK` (MCUBoot public
key) in MCUBoot image.
eFuse. The application image is verified against `MCUBOOT_PK` (MCUboot public
key) in MCUboot image.

![Secure Boot Flow: Zephyr/MCUBoot](./img/secure-boot-flow_esp32-mcuboot.png "Secure Boot Flow: Zephyr/MCUBoot")
![Secure Boot Flow: Zephyr/MCUboot](./img/secure-boot-flow_esp32-mcuboot.png "Secure Boot Flow: Zephyr/MCUboot")

### Secure Boot Efuse Blowing

Expand Down Expand Up @@ -262,9 +262,9 @@ an unfused board to blow fuses to enable secure boot. The `efuse_app` can be
flashed (cf. [flashing instructions](./esp32s2/apps/efuse_app/README.md)) on a
development-fused board to read out efuse values.

### Zephyr/MCUBoot Development (with Secure Boot Image Signing)
### Zephyr/MCUboot Development (with Secure Boot Image Signing)

- Build container image for Zephyr/MCUBoot development. Note that for
- Build container image for Zephyr/MCUboot development. Note that for
`--build-arg` values, private keys must be under the
[esp32s2/keys](./esp32s2/keys/) folder, and bootloader configs must be under
the [esp32s2/configs](./esp32s2/configs/) folder. If no build argument is
Expand All @@ -287,7 +287,7 @@ development-fused board to read out efuse values.

Inside the container,

- For MCUBoot and secure boot development
- For MCUboot and secure boot development
- Use `/home/esp/mcuboot`.
- Remember to set up the ESP-IDF environment by sourcing `export.sh`

Expand All @@ -304,7 +304,7 @@ development-fused board to read out efuse values.
source ${HOME}/zephyrproject/.venv/bin/activate
```

- Flash MCUBoot and Zephyr App Images
- Flash MCUboot and Zephyr App Images

On Linux host, we can interact with the development board from the container

Expand All @@ -318,7 +318,7 @@ development-fused board to read out efuse values.
```bash
cd ${HOME}/mcuboot/boot/espressif
source ./hal/esp-idf/export.sh
# Flash MCUBoot image at offset 0x1000
# Flash MCUboot image at offset 0x1000
esptool.py -p /dev/ttyUSB0 \
-b 460800 \
--before default_reset \
Expand All @@ -330,7 +330,7 @@ development-fused board to read out efuse values.
--flash_freq 40m \
0x1000 build/mcuboot_esp32s2_signed.bin
# Flash Zephyr application image at offset 0x10000. This is the slot0 offset
# configured in bootloader.conf of MCUBoot
# configured in bootloader.conf of MCUboot
esptool.py -p /dev/ttyUSB0 \
-b 460800 \
--before default_reset \
Expand Down
2 changes: 1 addition & 1 deletion esp32/Dockerfile.esp32_fuseblower
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
# - https://docs.espressif.com/projects/esp-idf/en/latest/esp32/get-started/linux-macos-setup.html
FROM ghcr.io/thistletech/devenv_idf_base:91717a88614327e2c1bd75452d9d0118a04a6400

# sdkconfig file used to build IDF apps (non-MCUBoot), for secure boot related
# sdkconfig file used to build IDF apps (non-MCUboot), for secure boot related
# stuff
ARG IDF_SDKCONFIG="sdkconfig.sbv2_nojtag"
# Private key used to sign SBV2 images during build. Key file must be under keys
Expand Down
12 changes: 6 additions & 6 deletions esp32/Dockerfile.esp32_mcuboot_zephyr
Original file line number Diff line number Diff line change
Expand Up @@ -16,18 +16,18 @@ ARG ZEPHYR_BOARD_NAME="esp32"
ARG PORT="/dev/ttyUSB0"
# Secure Boot V2 image signing private key name; file must be under keys/
ARG SBV2_PRIVATE_KEY="sbv2_private_dev.pem"
# MCUBoot image signing private key name; file must be under keys/
# MCUboot image signing private key name; file must be under keys/
ARG MCUBOOT_PRIVATE_KEY="mcuboot-ecdsa-p256_private_dev.pem"
# MCUBoot bootloader configuration file name; file must be under configs/
# MCUboot bootloader configuration file name; file must be under configs/
ARG BOOTLOADER_CONFIG="bootloader_mcuboot_dev.conf"

COPY --chown=esp:dialout keys ${HOME}/keys
COPY --chown=esp:dialout configs ${HOME}/configs

#############################
# MCUBoot
# MCUboot
#############################
# Build MCUBoot for ESP32
# Build MCUboot for ESP32
RUN cd ${HOME}/mcuboot/boot/espressif && \
source ./hal/esp-idf/export.sh && \
# Need to pip install again inside IDF env
Expand All @@ -36,13 +36,13 @@ RUN cd ${HOME}/mcuboot/boot/espressif && \
mv ${HOME}/keys/${MCUBOOT_PRIVATE_KEY} ${HOME}/mcuboot/mcuboot_private.pem && \
cmake -DCMAKE_TOOLCHAIN_FILE=tools/toolchain-${TARGET}.cmake -DMCUBOOT_TARGET=${TARGET} -DMCUBOOT_FLASH_PORT=${PORT} -B build -GNinja && \
ninja -C build/ && \
# Sign MCUBoot image
# Sign MCUboot image
espsecure.py sign_data --version 2 --keyfile ${HOME}/keys/${SBV2_PRIVATE_KEY} -o build/mcuboot_esp32_signed.bin build/mcuboot_esp32.bin

#############################
# Zephyr development
#############################
# Sanity check: Build and sign hello_world example for MCUBoot
# Sanity check: Build and sign hello_world example for MCUboot
RUN source ${HOME}/zephyrproject/.venv/bin/activate && \
cd ${HOME}/zephyrproject/zephyr && \
west build -p always -b ${ZEPHYR_BOARD_NAME} samples/hello_world -- -DCONFIG_BOOTLOADER_MCUBOOT=y && \
Expand Down
4 changes: 2 additions & 2 deletions esp32/keys/README.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# ESP32 Secure Boot V2 and MCUBoot Application Verificaiton Keys
# ESP32 Secure Boot V2 and MCUboot Application Verificaiton Keys

## Keygen: Development Keys

- MCUBoot image verification key pair (ECDSA-P256)
- MCUboot image verification key pair (ECDSA-P256)

```bash
export MCUBOOT_SK="mcuboot-ecdsa-p256_private_dev.pem"
Expand Down
2 changes: 1 addition & 1 deletion esp32s2/Dockerfile.esp32s2_fuseblower
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
# - https://docs.espressif.com/projects/esp-idf/en/latest/esp32s2/get-started/linux-macos-setup.html
FROM ghcr.io/thistletech/devenv_idf_base:91717a88614327e2c1bd75452d9d0118a04a6400

# sdkconfig file used to build IDF apps (non-MCUBoot), for secure boot related
# sdkconfig file used to build IDF apps (non-MCUboot), for secure boot related
# stuff
ARG IDF_SDKCONFIG="sdkconfig.sbv2_nojtag"
# Private key used to sign SBV2 images during build. Key file must be under keys
Expand Down
12 changes: 6 additions & 6 deletions esp32s2/Dockerfile.esp32s2_mcuboot_zephyr
Original file line number Diff line number Diff line change
Expand Up @@ -16,18 +16,18 @@ ARG ZEPHYR_BOARD_NAME="esp32s2_saola"
ARG PORT="/dev/ttyUSB0"
# Secure Boot V2 image signing private key name; file must be under keys/
ARG SBV2_PRIVATE_KEY="sbv2_private_dev.pem"
# MCUBoot image signing private key name; file must be under keys/
# MCUboot image signing private key name; file must be under keys/
ARG MCUBOOT_PRIVATE_KEY="mcuboot-ecdsa-p256_private_dev.pem"
# MCUBoot bootloader configuration file name; file must be under configs/
# MCUboot bootloader configuration file name; file must be under configs/
ARG BOOTLOADER_CONFIG="bootloader_mcuboot_dev.conf"

COPY --chown=esp:dialout keys ${HOME}/keys
COPY --chown=esp:dialout configs ${HOME}/configs

#############################
# MCUBoot
# MCUboot
#############################
# Build MCUBoot for ESP32-S2
# Build MCUboot for ESP32-S2
RUN cd ${HOME}/mcuboot/boot/espressif && \
source ./hal/esp-idf/export.sh && \
# Need to pip install again inside IDF env
Expand All @@ -36,13 +36,13 @@ RUN cd ${HOME}/mcuboot/boot/espressif && \
mv ${HOME}/keys/${MCUBOOT_PRIVATE_KEY} ${HOME}/mcuboot/mcuboot_private.pem && \
cmake -DCMAKE_TOOLCHAIN_FILE=tools/toolchain-${TARGET}.cmake -DMCUBOOT_TARGET=${TARGET} -DMCUBOOT_FLASH_PORT=${PORT} -B build -GNinja && \
ninja -C build/ && \
# Sign MCUBoot image
# Sign MCUboot image
espsecure.py sign_data --version 2 --keyfile ${HOME}/keys/${SBV2_PRIVATE_KEY} -o build/mcuboot_esp32s2_signed.bin build/mcuboot_esp32s2.bin

#############################
# Zephyr development
#############################
# Sanity check: Build and sign hello_world example for MCUBoot
# Sanity check: Build and sign hello_world example for MCUboot
RUN source ${HOME}/zephyrproject/.venv/bin/activate && \
cd ${HOME}/zephyrproject/zephyr && \
west build -p always -b ${ZEPHYR_BOARD_NAME} samples/hello_world -- -DCONFIG_BOOTLOADER_MCUBOOT=y && \
Expand Down
4 changes: 2 additions & 2 deletions esp32s2/keys/README.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# ESP32 Secure Boot V2 and MCUBoot Application Verificaiton Keys
# ESP32 Secure Boot V2 and MCUboot Application Verificaiton Keys

## Keygen: Development Keys

- MCUBoot image verification key pair (ECDSA-P256)
- MCUboot image verification key pair (ECDSA-P256)

```bash
export MCUBOOT_SK="mcuboot-ecdsa-p256_private_dev.pem"
Expand Down
2 changes: 1 addition & 1 deletion esp32s3/Dockerfile.esp32s3_fuseblower
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
# - https://docs.espressif.com/projects/esp-idf/en/latest/esp32s3/get-started/linux-macos-setup.html
FROM ghcr.io/thistletech/devenv_idf_base:91717a88614327e2c1bd75452d9d0118a04a6400

# sdkconfig file used to build IDF apps (non-MCUBoot), for secure boot related
# sdkconfig file used to build IDF apps (non-MCUboot), for secure boot related
# stuff. File must be under directory configs/
ARG IDF_SDKCONFIG="sdkconfig.dev-sbv2_nojtag"
# Secure Boot V2 image signing private key name; file must be under keys/
Expand Down