How to properly add the private key to the bootloader (without warnings)

RE: How to properly add the private key to the bootloader (without warnings)

AHaug — Wed, 24 Jan 2024 08:55:10 GMT

Hi,

I recommend you to have a look at https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/scripts/partition_manager/partition_manager.html#static-configuration to learn more about how to add and how to configure a static partition

[quote user="J0sh1101"]As in the ticket mentioned, this warning is that the partition file is always recreated. However, for the realease version, the memory layout should be fixed. Therefore I moved the partition.yaml from my buid directory to the root directory and renamed it to pm_static.yaml.[/quote]

This is the correct way to do it. In general all the partitions required will be generated at every build, but if you have defined the partitions in your pm_static.yml it will be skipped. Such as done in your case. If you wish to add more partitions such as for instance a settings_storage partition, you should follow the link I posted above for information about how to do so.

Kind regards,
Andreas

RE: How to properly add the private key to the bootloader (without warnings)

J0sh1101 — Tue, 23 Jan 2024 15:23:07 GMT

Hello,

sorry for my late reply. I have moved the code closer to the C drive, and it has now compiled correctly. I have two problems now. It doesn't complain about the key, but it gives me a warning that the pm_static.yaml file is not used.

Building mcuboot_manual_sign
west build --build-dir c:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk c:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign --pristine --board nrf9160dk_nrf9160 --no-sysbuild -- -DNCS_TOOLCHAIN_VERSION=NONE -DBOARD_ROOT=c:/ncs_workspace/mqtt_publisher;c:/ncs_workspace/mqtt;c:/ncs_workspace/blefund_less4_exer1_solution;c:/ncs_workspace/blefund_less4_exer3_solution;c:/ncs_workspace/nrf_dm;c:/ncs_workspace/asset_tracker_v2;c:/ncs_workspace/blinky_pwm;c:/ncs_workspace/lvgl-oled01;c:/ncs_workspace/dm_minimal;c:/ncs_workspace/nrf_cloud_rest_fota;c:/ncs_workspace/samples/littlefs_test;c:/ncs_workspace/fat_fs;c:/ncs_workspace/spi_flash_nrf9160;c:/ncs_workspace/mcuboot2;c:/ncs_workspace/aws_iot_mqtt;c:/ncs_workspace/mqtt_publisher_1;c:/ncs_workspace/blefund_less4_exer3;c:/ncs_workspace/nrf_cloud_rest_fota_ -DCONFIG_DEBUG_OPTIMIZATIONS=y -DCONFIG_DEBUG_THREAD_INFO=y -DCONF_FILE=c:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/prj.conf

-- west build: generating a build system
-- Application: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign
-- CMake version: 3.20.5
Loading Zephyr default modules (Zephyr base).
-- Found Python3: C:/ncs/toolchains/c57af46cb7/opt/bin/python.exe (found suitable version "3.8.2", minimum required is "3.8") found components: Interpreter 
-- Cache files will be written to: C:/ncs/v2.5.0/zephyr/.cache
-- Zephyr version: 3.4.99 (C:/ncs/v2.5.0/zephyr)
-- Found west (found suitable version "1.1.0", minimum required is "0.14.0")
-- Board: nrf9160dk_nrf9160, Revision: 0.14.0
-- Found host-tools: zephyr 0.16.1 (C:/ncs/toolchains/c57af46cb7/opt/zephyr-sdk)
-- Found toolchain: zephyr 0.16.1 (C:/ncs/toolchains/c57af46cb7/opt/zephyr-sdk)
-- Found Dtc: C:/ncs/toolchains/c57af46cb7/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6") 
-- Found BOARD.dts: C:/ncs/v2.5.0/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160.dts
-- Found devicetree overlay: C:/ncs/v2.5.0/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160_0_14_0.overlay
-- Generated zephyr.dts: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/zephyr/zephyr.dts
-- Generated devicetree_generated.h: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/zephyr/include/generated/devicetree_generated.h
-- Including generated dts.cmake file: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/zephyr/dts.cmake
Parsing C:/ncs/v2.5.0/zephyr/Kconfig
Loaded configuration 'C:/ncs/v2.5.0/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160_defconfig'
Merged configuration 'c:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/prj.conf'
Merged configuration 'C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/zephyr/misc/generated/extra_kconfig_options.conf'
Configuration saved to 'C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/zephyr/.config'
Kconfig header saved to 'C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/zephyr/include/generated/autoconf.h'
-- Found GnuLd: c:/ncs/toolchains/c57af46cb7/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd.exe (found version "2.38") 
-- The C compiler identification is GNU 12.2.0
-- The CXX compiler identification is GNU 12.2.0
-- The ASM compiler identification is GNU
-- Found assembler: C:/ncs/toolchains/c57af46cb7/opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc.exe
-- Found Python3: C:/ncs/toolchains/c57af46cb7/opt/bin/python.exe (found version "3.8.2") found components: Interpreter 

=== child image mcuboot -  begin ===
loading initial cache file C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/mcuboot/child_image_preload.cmake
Loading Zephyr default modules (Zephyr base).
-- Application: C:/ncs/v2.5.0/bootloader/mcuboot/boot/zephyr
-- CMake version: 3.20.5
-- Found Python3: C:/ncs/toolchains/c57af46cb7/opt/bin/python.exe (found suitable version "3.8.2", minimum required is "3.8") found components: Interpreter 
-- Cache files will be written to: C:/ncs/v2.5.0/zephyr/.cache
-- Zephyr version: 3.4.99 (C:/ncs/v2.5.0/zephyr)
-- Found west (found suitable version "1.1.0", minimum required is "0.14.0")
-- Board: nrf9160dk_nrf9160, Revision: 0.14.0
-- Found host-tools: zephyr 0.16.1 (C:/ncs/toolchains/c57af46cb7/opt/zephyr-sdk)
-- Found toolchain: zephyr 0.16.1 (C:/ncs/toolchains/c57af46cb7/opt/zephyr-sdk)
-- Found Dtc: C:/ncs/toolchains/c57af46cb7/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6") 
-- Found BOARD.dts: C:/ncs/v2.5.0/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160.dts
-- Found devicetree overlay: C:/ncs/v2.5.0/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160_0_14_0.overlay
-- Found devicetree overlay: C:/ncs/v2.5.0/bootloader/mcuboot/boot/zephyr/app.overlay
-- Generated zephyr.dts: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/mcuboot/zephyr/zephyr.dts
-- Generated devicetree_generated.h: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/mcuboot/zephyr/include/generated/devicetree_generated.h
-- Including generated dts.cmake file: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/mcuboot/zephyr/dts.cmake
Parsing C:/ncs/v2.5.0/bootloader/mcuboot/boot/zephyr/Kconfig
Loaded configuration 'C:/ncs/v2.5.0/zephyr/boards/arm/nrf9160dk_nrf9160/nrf9160dk_nrf9160_defconfig'
Merged configuration 'C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/child_image/mcuboot/prj.conf'
Merged configuration 'C:/ncs/v2.5.0/nrf/subsys/partition_manager/partition_manager_enabled.conf'
Merged configuration 'C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/mcuboot/zephyr/misc/generated/extra_kconfig_options.conf'
Configuration saved to 'C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/mcuboot/zephyr/.config'
Kconfig header saved to 'C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/mcuboot/zephyr/include/generated/autoconf.h'
-- Found GnuLd: c:/ncs/toolchains/c57af46cb7/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd.exe (found version "2.38") 
-- The C compiler identification is GNU 12.2.0
-- The CXX compiler identification is GNU 12.2.0
-- The ASM compiler identification is GNU
-- Found assembler: C:/ncs/toolchains/c57af46cb7/opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc.exe
MCUBoot bootloader key file: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/child_image/mcuboot/custom_priv.pem
-- Configuring done
-- Generating done
-- Build files have been written to: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk/mcuboot
=== child image mcuboot -  end ===

CMake Warning at C:/ncs/v2.5.0/nrf/cmake/partition_manager.cmake:79 (message):
  

          ---------------------------------------------------------------------
          --- WARNING: Using a bootloader without pm_static.yml.            ---
          --- There are cases where a deployed product can consist of       ---
          --- multiple images, and only a subset of these images can be     ---
          --- upgraded through a firmware update mechanism. In such cases,  ---
          --- the upgradable images must have partitions that are static    ---
          --- and are matching the partition map used by the bootloader     ---
          --- programmed onto the device.                                   ---
          ---------------------------------------------------------------------
          

Call Stack (most recent call first):
  C:/ncs/v2.5.0/zephyr/cmake/modules/kernel.cmake:247 (include)
  C:/ncs/v2.5.0/zephyr/cmake/modules/zephyr_default.cmake:138 (include)
  C:/ncs/v2.5.0/zephyr/share/zephyr-package/cmake/ZephyrConfig.cmake:66 (include)
  C:/ncs/v2.5.0/zephyr/share/zephyr-package/cmake/ZephyrConfig.cmake:92 (include_boilerplate)
  CMakeLists.txt:5 (find_package)


-- Configuring done
-- Generating done
-- Build files have been written to: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk
-- west build: building application
[4/200] Generating include/generated/version.h
-- Zephyr version: 3.4.99 (C:/ncs/v2.5.0/zephyr), build: v3.4.99-ncs1
[3/255] Generating include/generated/version.h
-- Zephyr version: 3.4.99 (C:/ncs/v2.5.0/zephyr), build: v3.4.99-ncs1
[255/255] Linking C executable zephyr\zephyr.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       38278 B        48 KB     77.88%
             RAM:       22564 B       256 KB      8.61%
        IDT_LIST:          0 GB         2 KB      0.00%
[192/200] Linking C executable zephyr\zephyr.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       46508 B     474624 B      9.80%
             RAM:       12580 B       256 KB      4.80%
        IDT_LIST:          0 GB         2 KB      0.00%
[195/200] Generating ../../zephyr/app_update.bin
image.py: sign the payload
[196/200] Generating ../../zephyr/app_signed.hex
image.py: sign the payload
[198/200] Generating ../../zephyr/app_test_update.hex
image.py: sign the payload
[200/200] Generating zephyr/merged.hex
 *  Das Terminal wird von Aufgaben wiederverwendet, drücken Sie zum Schließen eine beliebige Taste.

I have updated it according to this ticket, link. As in the ticket mentioned, this warning is that the partition file is always recreated. However, for the realease version, the memory layout should be fixed. Therefore I moved the partition.yaml from my buid directory to the root directory and renamed it to pm_static.yaml. After this change I get this message:

- Found partition manager static configuration: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/pm_static.yml
Partition 'mcuboot' is not included in the dynamic resolving since it is statically defined.
Partition 'mcuboot_pad' is not included in the dynamic resolving since it is statically defined.
Partition 'mcuboot_primary' is not included in the dynamic resolving since it is statically defined.
Partition 'mcuboot_primary_app' is not included in the dynamic resolving since it is statically defined.
Partition 'mcuboot_secondary' is not included in the dynamic resolving since it is statically defined.
-- Configuring done
-- Generating done
-- Build files have been written to: C:/samples_for_nrf_connect_sdk/bootloader_samples/keys_and_signatures/mcuboot_manual_sign/build_nrf9160_dk

How do I include the other partitions?

I managed to compile the application bootloader_samples\keys_and_signatures\mcuboot_manual_sign with the private keys. However, the example nrf_cloud_rest_fota is a mystery to me. Is there a way to solve this problem?

RE: How to properly add the private key to the bootloader (without warnings)

AHaug — Tue, 28 Nov 2023 13:17:06 GMT

Hi,

[quote user="J0sh1101"]I tried to compile the sample project wich you gave me above (https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures ). I cloned, compiled it and got errors:[/quote]

Regarding the error in the build output it looks like the path is too long. Try to copy the application and move it to somewhere with a shorter path. I know that if you clone the repo and add it to something like C/nordic/ncs/my_projects/the_git_repo/bootloader_samples/keys_and_signatures/the_app_you're_testing, the path will be too long.and you will see such errors.

Other than this the PM warnings are not something you need to worry about before you're ready to test for DFU so lets resolve the other issue first.

Kind regards,
Andreas

RE: How to properly add the private key to the bootloader (without warnings)

J0sh1101 — Sat, 25 Nov 2023 13:30:31 GMT

Hi,

I am using the nrf9160dk.

Thanks for the update.

RE: How to properly add the private key to the bootloader (without warnings)

AHaug — Fri, 24 Nov 2023 15:13:35 GMT

[quote user="J0sh1101"]I updated the SDK to 2.5.0 and update the modem, maybe this is the reason I got this extra error message. [/quote]

Ah, I didn't catch that you were using a 9160. I will check in with the author of the samples to see if there are anything different in this case.

Are you using a Thingy:91 or a nRF9160dk?

I will get back to you early next week

Kind regards,
Andreas

RE: How to properly add the private key to the bootloader (without warnings)

J0sh1101 — Tue, 21 Nov 2023 13:33:20 GMT

Hi,

[quote userid="107683" url="~/f/nordic-q-a/105609/how-to-properly-add-the-private-key-to-the-bootloader-without-warnings/455323"]In the two first warnings it looks like the location has not been parsed correctly by the build system. Are you certain that the path is "C:\\keys\\priv_ecdsa.pem"? Could you cross examine with the samples in https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures (which stores the keys within the project folder)[/quote]

Yes, the file exists. Below is the prof:

After looking at the example, I proceeded in exactly the same way. I added the keys to the project folder. Below you can see the resulting folder structure:

Add the flags in the CMakeLists.txt as follows:

#
# Copyright (c) 2021 Nordic Semiconductor
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

cmake_minimum_required(VERSION 3.20.0)

find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
project(nRF_Cloud_REST_FOTA_Sample)
zephyr_compile_definitions(PROJECT_NAME=${PROJECT_NAME})

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/keys/priv_ecdsa.pem\")
set(mcuboot_CONFIG_SB_SIGNING_KEY_FILE \"${CMAKE_CURRENT_SOURCE_DIR}/keys/priv_ecdsa.pem\")

# NORDIC SDK APP START
target_sources(app PRIVATE src/main.c)
# NORDIC SDK APP END

add_subdirectory(src/fota)

I am still getting the same errors in the compilation process and a bit more:

I updated the SDK to 2.5.0 and update the modem, maybe this is the reason I got this extra error message.

I tried to compile the sample project wich you gave me above (https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures ). I cloned, compiled it and got errors:

Are there additional examples that compile without warnings and are compatible with the latest SDK?

Thanks for the help.

RE: How to properly add the private key to the bootloader (without warnings)

AHaug — Mon, 13 Nov 2023 14:13:09 GMT

Hi,

[quote user=""]What steps can I take to eliminate these warnings?[/quote]

In the two first warnings it looks like the location has not been parsed correctly by the build system. Are you certain that the path is "C:\\keys\\priv_ecdsa.pem"? Could you cross examine with the samples in https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/bootloader_samples/keys_and_signatures (which stores the keys within the project folder)

The two lasts warnings are not related to the key issue

[quote user=""]How can I verify that the bootloader has successfully incorporated the private key into the bootloader image?[/quote]

I will have to check this item and come back to you

[quote user=""]Why does the bootloader always create 3 images (child-image b0, child-image mcuboot, child-image s1-image)?[/quote]

You've configured the device to build all three images in your prj.conf. You can check the configurations here https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/kconfig/index.html

The parent page https://developer.nordicsemi.com/nRF_Connect_SDK/doc/2.3.0/nrf/app_dev/bootloaders_and_dfu/index.html takes you through steps such as enabling secure boot, i.e to enable b0 by adding CONFIG_SECURE_BOOT=y and you have CONFIG_BOOTLOADER_MCUBOOT=y i.e mcuboot enabled.

Kind regards,
Andreas