nRF5340 Audio DK Secure Boot won't build

RE: nRF5340 Audio DK Secure Boot won't build

MStreet — Tue, 18 Jul 2023 19:03:43 GMT

Just to be clear for anyone else reading this, I had to put the CONFIG_BOOT_SIGNATURE_KEY_FILE="" setting into the overlay-mcuboot_external_flash.conf file in the nrf5340_audo/dfu/conf folder for it to work. It won't work if placed in prj.conf or prj_release.conf.

RE: nRF5340 Audio DK Secure Boot won't build

dejans — Mon, 17 Jul 2023 09:24:47 GMT

Hi,

It is great to hear that you found a solution for your problem.

Best regards,
Dejan

RE: nRF5340 Audio DK Secure Boot won't build

MStreet — Fri, 14 Jul 2023 19:52:24 GMT

Major RTFM on my part! You only need to enable SECURE_BOOT if you want to use MCUboot as an upgradable second-stage bootloader as detailed in the Security section of the SDK documentation. I don't need to do this, so all I needed to do was set CONFIG__BOOT_SIGNATURE_KEY_FILE to point to my own key.

RE: nRF5340 Audio DK Secure Boot won't build

dejans — Thu, 13 Jul 2023 16:14:12 GMT

Hi,

You can find relevant information on how to add bootloader chain, and use custom project configurations in the documentation.

Best regards,
Dejan

RE: nRF5340 Audio DK Secure Boot won't build

MStreet — Wed, 12 Jul 2023 20:07:12 GMT

Hi,

The nrf5340_audio application uses MCUBOOT which is set in Kconfig.dfu so that is what I am using.

And, when building I get the following message:

So, does that mean I don't need CONFIG_SECURE_BOOT=y but instead need to rebuild MCUBOOT with my own private key?

Thanks.

RE: nRF5340 Audio DK Secure Boot won't build

dejans — Tue, 11 Jul 2023 11:22:19 GMT

Hi,

Could you please provide information about the type of bootloader that you want to use in your application? Is nRF Secure Immutable Bootloader (NSIB), adding NSIB as immutable bootloader and adding custom signature key file relevant to your problem?

Best regards,
Dejan

RE: nRF5340 Audio DK Secure Boot won't build

MStreet — Mon, 10 Jul 2023 21:48:54 GMT

Hi Dejan,

I don't have any problems until I set CONFIG_SECURE_BOOT=y in either debug or release. But I need to use our own private key rather than the debug one for security reasons. Don't I need to have this set for that? Neither the debug nor release versions work with this set.

Also, when I build the debug version with CONFIG_SECURE_BOOT=y the b0.conf in child_image is properly merged in by dts.cmake:

Merged configuration 'C:/ncs/v2.4.0/nrf/applications/nrf5340_audio/child_image/b0.conf'

This doesn't happen with the release build so the sys_clock_cycle_get_32 error reappears.

RE: nRF5340 Audio DK Secure Boot won't build

dejans — Mon, 10 Jul 2023 12:38:35 GMT

Hi,

I have reproduced your issues when CONFIG_SECURE_BOOT=y in prj.conf and no child_image exists in the project folder. However, when I commented out CONFIG_SECURE_BOOT=y in prj.conf and added CONFIG_NRF_RTC_TIMER=y to b0n.conf in the child_image folder, I could build the project successfully.

Please note that according to the documentation, the application should be built with prj_release.conf instead of prj_debug.conf which you tried to use. Here is the build command:

python buildprog.py -c both -b release -d gateway -m external --pristine

Best regards,
Dejan