Migration from NCS v2.1.3 to v2.6.0 with prebuilt B0 binaries

RE: Migration from NCS v2.1.3 to v2.6.0 with prebuilt B0 binaries

matharman — Thu, 11 Apr 2024 14:53:31 GMT

Hi Einar,

Thank you for the suggested workaround

I managed to implement it in CMake so that it will be automatic and replace the default merged.hex. Thought I would share it here for future readers.

list(APPEND TO_MERGE
    # Pre-built B0 bootloader
    ${CONFIG_B0_HEX_FILE}
    # Mcuboot built from source, signed for B0
    # You can also use CONFIG_MCUBOOT_HEX_FILE if using a pre-built mcuboot.
    ${CMAKE_BINARY_DIR}/zephyr/signed_by_b0_s0_image.hex
    # TFM+Application built from source, signed for mcuboot
    ${CMAKE_BINARY_DIR}/zephyr/app_signed.hex
)

set(MERGED_HEX ${CMAKE_BINARY_DIR}/zephyr/merged.hex)
set(MERGED_FIXED_HEX ${CMAKE_BINARY_DIR}/zephyr/merged-fixed.hex)

# Manually merge the components of the final binary, excluding provision.hex
add_custom_command(
    OUTPUT ${MERGED_FIXED_HEX}
    DEPENDS ${TO_MERGE}
    COMMAND
        ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/scripts/build/mergehex.py
        -o ${MERGED_FIXED_HEX}
        --overlap=replace
        ${TO_MERGE}
    )
add_custom_target(merged_fixed_hex
    ALL
    COMMENT "Creating patched merged.hex"
    DEPENDS ${TO_MERGE}
    )

# Unconditionally copy our merged binary over the default merged.hex
# so we can use west flash as normal.
# The DEPENDS clause ensures it always runs after the
# hex files of interest are generated.
add_custom_target(patch_merged_hex
    ALL
    COMMENT "Replacing NCS merged.hex with ours"
    COMMAND
        ${CMAKE_COMMAND} -E copy ${MERGED_FIXED_HEX} ${MERGED_HEX}
    DEPENDS ${MERGED_HEX} ${MERGED_FIXED_HEX}
    )

If like us your B0 binary is from NCS <=v2.1.3, then you cannot use the generated provision.hex in NCS v2.2.0+; however, if you disable the generation of provision.hex, then MCUBoot source builds will not be signed for B0. You can also use a prebuilt MCUBoot hex file to avoid that problem, but this demonstrates how you would merge with an update image for MCUBoot in S0/S1.

For our application we generate one binary with provision.hex, and one without. For the binary with provision.hex, I have the pre-generated provision.hex that paired with the B0 binary for NCS v2.1.3. We simply add that file to the list of hex files to merge.

RE: Migration from NCS v2.1.3 to v2.6.0 with prebuilt B0 binaries

Einar Thorsrud — Thu, 11 Apr 2024 13:30:20 GMT

Hi,

We do not have a solution for this at the moment. However, perhaps you can do something like this:

Get the merged output file that contain everything which you find here: <build folder>/zephyr/merged.hex.
Take the immutable bootloader from the old build (which you find under <build folder>/b0/zephyr/zephyr.hex

Then do like this:

python <NCS folder>/zephyr/scripts/build/mergehex.py -o merged_with_old_b0.hex --overlap=replace <path to new merged.hex file> <path to old b0 zephyr.hex file>

If you do this separately/in some custom build script you can replace the bootloader(s) wihtout needing updates in the build system. Of course building bootloader(s) you don't use and supsequently overwriting them in the merged .hex file is not very elegant, but it should function as a workaround.

RE: Migration from NCS v2.1.3 to v2.6.0 with prebuilt B0 binaries

matharman — Wed, 10 Apr 2024 18:16:51 GMT

Hmm, this seems to have the unfortunate side effect of preventing an MCUBoot built from source from being signed.

This backwards compatibility story is not great. IMO the signing of the MCUBoot image should not be coupled to the generation of provision.hex, especially when there is no way to generate a provision.hex that is compatible with versions that don't have knowledge of the PRoT lifecycle state and implementation ID.

RE: Migration from NCS v2.1.3 to v2.6.0 with prebuilt B0 binaries

matharman — Tue, 09 Apr 2024 19:39:15 GMT

Correction: I have stumbled on CONFIG_BOOTLOADER_PROVISION_HEX, but it has no prompt so is not user configurable:

error: BOOTLOADER_PROVISION_HEX (defined at /opt/ncs2/nrf/subsys/bootloader/Kconfig:34) is assigned
in a configuration file, but is not directly user-configurable (has no prompt). It gets its value
indirectly from other symbols. See

I was able to override the selected value with the following change to my app's Kconfig file and setting CONFIG_BOOTLOADER_PROVISION_HEX=n in prj.conf. It must appear before source $(ZEPHYR_BASE)/Kconfig.zephyr, or else the NCS default will be used first.

+config BOOTLOADER_PROVISION_HEX
+    bool "Generate provision.hex for B0"
+
 menu "Zephyr Kernel"
 source "$ZEPHYR_BASE/Kconfig.zephyr"
 endmenu

This can be resolved with a conditional prompt for this Kconfig option when B0's build strategy is USE_HEX_FILE. I will be opening a pull request suggesting this change shortly.