Adding the customized B0 bootloader in project which is already having MCUBOOT and app.

[vim_nordic]

Hi team, 

I'm using the NRF54L15DK board with NCS SDK v2.9.0. 

I'm trying to include the B0 bootloader along with the MCUBOOT and application. 

I'm wanted to customize the B0 bootloader using prj.conf file which I've added as B0.conf file in project. 

But not sure where my B0 main file is getting added. And I wanted to update the main.c file of B0 bootloader as part of my project.

1. Can I shift B0 bootloader main.c file as part of my project and B0 bootloader should include that file only while building the B0 bootloader?

2. Facing issue while adding the configuration for B0 bootloader as B0.conf file. Also wanted to enable the overlay configuration for B0 bootloader to access the external flash. 

I could see B0 bootloader is supporting OBERON_ECDSA_SECP256R1 and CC310_ECDSA_SECP256R1 and RSA-2048.

3. What is the difference between OBERON and CC310 ECDSA_SECP2561?

4. MCUBOOT is supporting ECDSA_P256R1 then what is the difference between ECDSA_SECP256R1(OBERON and CC310)?

5. How to make B0 bootloader as purely immutable? Can I add the B0 bootloader in OTP region and how?

My current directory

 

Please help me with the enabling both the B0 bootloader and MCUBOOT along with application as project. 

Thanks

[AHaug]

Hi,

In general I would say there are a few misunderstandings here from your perspective w.r.t how bootloaders work, so I would strongly recommend that you go through https://academy.nordicsemi.com/courses/nrf-connect-sdk-intermediate/lessons/lesson-9-bootloaders-and-dfu-fota/ and https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/bootloaders_dfu/mcuboot_nsib/bootloader_mcuboot_nsib.html thoroughly

Anyways, here's some answers to your questions!

1. Can I shift B0 bootloader main.c file as part of my project and B0 bootloader should include that file only while building the B0 bootloader?

NSIB (b0) is not supported for NCS v2.9.0

And is listed as experimental in NCS v3.0.0

2. Facing issue while adding the configuration for B0 bootloader as B0.conf file. Also wanted to enable the overlay configuration for B0 bootloader to access the external flash. 

We don't have support for B0 to access the external flash. B0 only knows about the second stage bootloader and/or the application and where to boot said components

3. What is the difference between OBERON and CC310 ECDSA_SECP2561?

Kapa lists the following from our documentation. Please review the linked documentation

ECDSA_SECP256R1 implementations using the NCS (Nordic Connect SDK) documentation provided in the knowledge sources.

Based on the NCS documentation, here are the key differences between Oberon and CC310 implementations of ECDSA with the secp256r1 curve:

1. Implementation Type:

   • CC310 (also referred to as nrf_cc3xx in NCS) is a hardware-accelerated cryptography implementation that uses the CryptoCell hardware
   • Oberon (nrf_oberon) is a software-based cryptography library
2. Curve Support:

   • Both support secp256r1, but CC310 supports a wider range of curves including secp192r1, secp224r1, secp256r1, secp384r1, secp521r1, and various Koblitz curves
   • Oberon has more limited curve support for ECDSA, primarily supporting secp256r1 and secp224r1 as noted in the asymmetric signature support documentation
3. Integration Differences:

   • According to the NCS documentation: "The nrf_cc3xx_mbedcrypto library does not integrate on ECP layer. Only the top-level APIs for ECDSA are replaced." ECDSA configurations
4. Configuration in NCS:

   • In NCS, ECDSA support is enabled with the CONFIG_MBEDTLS_ECDSA_C Kconfig option
   • Driver selection is done through options like CONFIG_PSA_USE_CC3XX_ASYMMETRIC_SIGNATURE_DRIVER for CC310 or automatically generated for Oberon based on enabled algorithms
5. Limitations:

   • The nrf_oberon driver is "currently limited to ECC curve types secp224r1, secp256r1, and secp384r1 for ECDSA" as stated in the asymmetric signature support documentation

4. MCUBOOT is supporting ECDSA_P256R1 then what is the difference between ECDSA_SECP256R1(OBERON and CC310)?

Same as above

5. How to make B0 bootloader as purely immutable?

https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/bootloaders_dfu/mcuboot_nsib/bootloader_adding_sysbuild.html 

Can I add the B0 bootloader in OTP region and how?

No, you can't do this. 

Kind regards,
Andreas

[vim_nordic]

Hi AHaug , 

Thanks for your input and I have got a lot of idea from mentioned page. 

I have tried to include the B0 bootloader using SB_CONFIG_SECURE_BOOT_APPCORE=y in susbuild.conf file. 
But I wanted to customize few things and settings in B0 bootloader. But facing build error, not sure why I'm not facing any issue when building with customized configurations. 

Is folder structure given in previous questions image correct to customize both B0 and mcuboot bootloaders? 

referred the document https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/bootloaders_dfu/mcuboot_nsib/bootloader_adding_sysbuild.html#adding_nrf_secure_immutable_bootloader_as_an_immutable_bootloader. 

But facing the SPI NOR error so once I'm enabling the SPI_NOR in B0, MCUBOOT and Application, still facing the same issue.  

Attached the error text we are facing. 

Fullscreen 6175.error.txt Download

error FAILED: zephyr/zephyr_pre0.elf zephyr/zephyr_pre0.map C:/MIC/POC/B0_Bootloader/fw-app/build/mcuboot/zephyr/zephyr_pre0.map 
cmd.exe /C "cd . && C:\ncs_sdk\toolchains\b620d30767\opt\zephyr-sdk\arm-zephyr-eabi\bin\arm-zephyr-eabi-gcc.exe -Os -DNDEBUG -gdwarf-4 -gdwarf-4 zephyr/CMakeFiles/zephyr_pre0.dir/misc/empty_file.c.obj -o zephyr\zephyr_pre0.elf  zephyr/CMakeFiles/offsets.dir/./arch/arm/core/offsets/offsets.c.obj  -T  zephyr/linker_zephyr_pre0.cmd  -Wl,-Map=C:/MIC/POC/B0_Bootloader/mic-fw-app/build/mcuboot/zephyr/zephyr_pre0.map  -Wl,--whole-archive  app/libapp.a  zephyr/libzephyr.a  zephyr/arch/common/libarch__common.a  zephyr/arch/arch/arm/core/libarch__arm__core.a  zephyr/arch/arch/arm/core/cortex_m/libarch__arm__core__cortex_m.a  zephyr/arch/arch/arm/core/cortex_m/cmse/libarch__arm__core__cortex_m__cmse.a  zephyr/arch/arch/arm/core/mpu/libarch__arm__core__mpu.a  zephyr/lib/libc/picolibc/liblib__libc__picolibc.a  zephyr/lib/libc/common/liblib__libc__common.a  zephyr/soc/soc/nrf54l15/libsoc__nordic.a  zephyr/drivers/cache/libdrivers__cache.a  zephyr/drivers/clock_control/libdrivers__clock_control.a  zephyr/drivers/console/libdrivers__console.a  zephyr/drivers/flash/libdrivers__flash.a  zephyr/drivers/gpio/libdrivers__gpio.a  zephyr/drivers/pinctrl/libdrivers__pinctrl.a  zephyr/drivers/serial/libdrivers__serial.a  zephyr/drivers/timer/libdrivers__timer.a  modules/nrf/subsys/bootloader/bl_crypto/lib..__nrf__subsys__bootloader__bl_crypto.a  modules/nrf/subsys/fw_info/lib..__nrf__subsys__fw_info.a  modules/mcuboot/boot/bootutil/zephyr/libmcuboot_util.a  modules/hal_nordic/nrfx/libmodules__hal_nordic__nrfx.a  modules/segger/libmodules__segger.a  -Wl,--no-whole-archive  zephyr/kernel/libkernel.a  -LC:/MIC/POC/B0_Bootloader/mic-fw-app/build/mcuboot/zephyr  zephyr/arch/common/libisr_tables.a  C:/ncs_sdk/v2.9.0/nrfxlib/crypto/nrf_oberon/lib/cortex-m33/soft-float/liboberon_3.0.15.a  -mcpu=cortex-m33  -mthumb  -mabi=aapcs  -mfp16-format=ieee  -mtp=soft  -fuse-ld=bfd  -Wl,--gc-sections  -Wl,--build-id=none  -Wl,--sort-common=descending  -Wl,--sort-section=alignment  -Wl,-u,_OffsetAbsSyms  -Wl,-u,_ConfigAbsSyms  -nostdlib  -static  -Wl,-X  -Wl,-N  -Wl,--orphan-handling=warn  -Wl,-no-pie  -specs=picolibc.specs  -DPICOLIBC_LONG_LONG_PRINTF_SCANF -L"c:/ncs_sdk/toolchains/b620d30767/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/thumb/v8-m.main/nofp" -lc -lgcc && cmd.exe /C "cd /D C:\MIC\POC\B0_Bootloader\mic-fw-app\build\mcuboot\zephyr && C:\ncs_sdk\toolchains\b620d30767\opt\bin\cmake.exe -E true""
c:/ncs_sdk/toolchains/b620d30767/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd.exe: zephyr/drivers/flash/libdrivers__flash.a(spi_nor.c.obj):(.rodata.spi_nor_0_config+0x0): undefined reference to `__device_dts_ord_114'

[AHaug]

Hi,

Are you still using NCS v2.9.0 or have you upgraded to 3.0.0?

vim_nordic said:

Is folder structure given in previous questions image correct to customize both B0 and mcuboot bootloaders? 

Almost, the build system is sensitive for capital letters, so you will have to rename then "b0" instead of "B0". Here's a sample that has a b0 overlay within the sysbuild folder: https://github.com/nrfconnect/sdk-nrf/tree/main/samples/keys/hw_unique_key/sysbuild.

vim_nordic said:

Attached the error text we are facing. 

Could you share the contents of the files within the sysbuild folder and I'll have a closer look? With spi-nor error, you refer to enabling an external spi nor flash device in b0, mcuboot and app, right?

Kind regards,
Andreas