Setup of external call to bl_validation_fw from my application

[Simon Third]

Hi All,

I'm in the process of implementing the bootloader (NSIB) to support FW upgrades.

This is working well until I added access to call the bootloaders bl_validation_firmware() from my app via the EXT_API feature.  To get the project to compile I had to add

CONFIG_SECURE_BOOT_VALIDATION=y

CONFIG_BL_VALIDATE_FW_EXT_API_ENABLED=y

CONFIG_SECURE_BOOT_CRYPTO=y

CONFIG_SECURE_BOOT_STORAGE=y

EXT_API_REQ(BL_VALIDATE_FW, 1, struct bl_validate_fw_ext_api, bl);

int main(void)
{

        printk("Starting up...\n");

        if (bl->ext_api.bl_validate_firmware(0x9000, 0x9000))
        {
                printk("FW at 0x9000 validated");
        }
        else
                printk("FW at 0x9000 Failed validated");

        printk("Waiting forever...\n");
        while (1)
        {
                ;
        }
        return 0;
}

But then it fails to Link my app, with undefined reference to get_hash().  So am I missing another CONFIG item?

I wouldn't have thought that my app would need to link in bl_crypto in the first place, as this functionality is implemented in the bootloader image? Isn't this the point of the external api to enable calls to the bootloader functions and not having to re-implement them in the user application?

I'm testing this on the nRF52840DK with SDK 2.2.0

Thanks

Simon

[Vidar Berg]

Hello Simon,

It should be possible to utilize the APIs exposed by NSIB (nRF Secure Immutable Bootloader) for image validation without duplicating the crypto dependencies in the application. However, NSIB isn't designed for performing DFU over SMP. For that, you'd need to integrate MCUBoot as your primary or secondary bootloader. If you're looking to get started with DFU, I recommend beginning with the SMP Server Sample. While this sample comes with MCUBoot as the first stage bootloader, you can add CONFIG_SECURE_BOOT=y to the prj.conf if you wish to include NSIB. In this sample, the image validation is taken care of by the bootloader, not the application. The application is only responsible for receiving and storing the image to the secondary slot through the MCUmgr subsystem.

Best regards,

Vidar

[Simon Third]

Hi Vidar,

I've found the solution.

I also need to add

CONFIG_BL_VALIDATE_FW_EXT_API_REQUIRED=y

 

Thanks 

S3