Cannot retrieve hash using img_mgmt_client API

[[email protected]]

Hello,

After I upload a new signed image to my device using MCUboot serial recovery (single image), MCUmgr Img_mgmt_client API

img_mgmt_client_state_read() always fails because there's no hash. I added version number using VERSION file. Is there a similar way to add hash to my image?

Regards,
Chang

[SwRa]

Hi Chang,

You can use both a signature and a 32-byte (SHA-256) hash with MCUboot.  The hash length when you use  SHA256 hash is 32. So it should not be a problem and  matches what  img_mgmt_client_state_read() and image_state_res_fn() expect. Even with signatures enabled, the hash field in the MCUmgr response should be 32 bytes if using SHA256. Could you ensure that you are using the default hash settings.? https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/bootloaders_dfu/mcuboot_nsib/bootloader_main_config.html#mcuboot_image_hash_algorithms 

Regrds,

Swathy

[[email protected]]

Hi Swathy,

For nRF54, CONFIG_BOOT_IMG_HASH_ALG_SHA512=y is defined by other dependencies by default. The followings will make build errors because those configs can't be modified directly:

CONFIG_BOOT_IMG_HASH_ALG_SHA512=n
CONFIG_BOOT_IMG_HASH_ALG_SHA256=y

 

SB_CONFIG_BOOT_SIGNATURE_TYPE_NONE=y was the only way I could find to disable SHA512. If there are other ways to disable SHA512 and enable SHA256 on nRF54 MCUboot, please let me know. I'm using NCS v3.0.2.

Regards,
Chang