NCS 3.0.2 MCUboot link error: undefined reference to rsa_pub_key / rsa_pub_key_len (works on NCS 2.4.2)

[Haris Iqbal]

Environment

• NCS: v3.0.2 (Zephyr 4.0.99)

• Toolchain: Zephyr SDK 0.17.0 (arm-zephyr-eabi gcc 12.2)

• West: 1.2.0

• Building via nRF Connect / sysbuild

• Board: custom nRF52840 (project also builds fine on NCS 2.4.2)

Issue Summary:
I’m facing an issue with mcuboot in NCS 3.0.2. Initially, I started getting undefined reference to rsa_pub_key and rsa_pub_key_len during the build. To resolve this, I checked mcuboot_config.h and saw that only 2048 and 3072 bit RSA keys are supported. I then tried adding CONFIG_BOOT_SIGNATURE_TYPE_RSA_LEN=2048 in sysbuild.conf, but got this warning instead:

warning: attempt to assign the value '2048' to the undefined symbol BOOT_SIGNATURE_TYPE_RSA_LEN

sysbuild.conf:

SB_CONFIG_BOOTLOADER_MCUBOOT=y
SB_CONFIG_PARTITION_MANAGER=y
# SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y
# SB_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
SB_CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
# SB_CONFIG_BOOT_SIGNATURE_TYPE_RSA_LEN=2048
SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="D://Development//Repo//BLE_firmware_nRF//signature//infinity.pem"

prj.conf:

# Incresed stack due to settings API usage
# CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=8192

CONFIG_BT=y
# CONFIG_BT_LL_SOFTDEVICE=n

# Enable Bluetooth Controller
CONFIG_BT_CTLR=y
CONFIG_BT_CTLR_TX_PWR_DYNAMIC_CONTROL=y

CONFIG_CLOCK_CONTROL_NRF_K32SRC_RC=y

CONFIG_BT_CTLR_TX_PWR_PLUS_8=y

# Enable SMP Server
CONFIG_MCUMGR=y
CONFIG_MCUMGR_GRP_IMG=y

# CONFIG_MCUMGR_GRP_IMG dependencies
CONFIG_IMG_MANAGER=y

# CONFIG_IMG_MANAGER dependencies
CONFIG_STREAM_FLASH=y

# CONFIG_MCUMGR dependencies
CONFIG_NET_BUF=y
CONFIG_ZCBOR=y

# Ensure an MCUboot-compatible binary is generated.
CONFIG_BOOTLOADER_MCUBOOT=y

CONFIG_BT_PERIPHERAL=y
CONFIG_BT_CENTRAL=y
CONFIG_BT_SCAN=y
CONFIG_BT_SCAN_FILTER_ENABLE=y
CONFIG_BT_SCAN_UUID_CNT=1
CONFIG_BT_GATT_DM=y
CONFIG_BT_GATT_CLIENT=y
CONFIG_BT_GATT_DYNAMIC_DB=y

CONFIG_BT_DEVICE_NAME="SB PINPAD"
CONFIG_BT_DEVICE_APPEARANCE=833
CONFIG_BT_DEVICE_NAME_DYNAMIC=n

# check if we need this
CONFIG_BT_SETTINGS=y
CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y

# for LittleFS
CONFIG_FILE_SYSTEM=y
CONFIG_FILE_SYSTEM_LITTLEFS=y

#  Enable loging 
# IMPORTANT -> THIS MUST BE COMMENTED OUT DURING PRODUCTION
# CONFIG_LOG=y
CONFIG_SERIAL=y
CONFIG_CONSOLE=y
CONFIG_UART_CONSOLE=y
# CONFIG_LOG_DEFAULT_LEVEL=3
# CONFIG_LOG_MODE_IMMEDIATE=y

CONFIG_BT_CREATE_CONN_TIMEOUT=10
CONFIG_BT_CONN_PARAM_UPDATE_TIMEOUT=10000
CONFIG_BT_CONN_PARAM_RETRY_COUNT=6
CONFIG_BT_CONN_PARAM_RETRY_TIMEOUT=10000
CONFIG_BASE64=y

CONFIG_BT_L2CAP_TX_MTU=251
CONFIG_BT_BUF_ACL_RX_SIZE=256
CONFIG_BT_BUF_ACL_TX_SIZE=256
CONFIG_BT_PHY_UPDATE=n

CONFIG_BT_BUF_ACL_RX_COUNT=4
CONFIG_BT_BUF_ACL_TX_COUNT=4
CONFIG_BT_MAX_CONN=4

# Enable ADC for temp & Battery status
CONFIG_ADC=y

# Power Management
CONFIG_PM=y
CONFIG_PM_DEVICE=y


CONFIG_REBOOT=y
CONFIG_BT_DIS=y
# CONFIG_BT_DIS_MANUF="SwipBox International A/S"
# CONFIG_BT_DIS_MODEL="Infinity PINpad"
CONFIG_BT_DIS_PNP=n

CONFIG_BT_DIS_FW_REV=y
CONFIG_BT_DIS_FW_REV_STR="1.0.3"         

CONFIG_BT_DIS_HW_REV=y
CONFIG_BT_DIS_HW_REV_STR="1"

CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=n

CONFIG_MBEDTLS_PSA_CRYPTO_C=y

CONFIG_CRYPTO=y
CONFIG_MBEDTLS=y

# Enable nordic security backend and PSA APIs
CONFIG_NRF_SECURITY=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=y
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=y
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT=y

CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

# Algorithms
CONFIG_PSA_WANT_ALG_SHA_256=y

# Define key size
CONFIG_PSA_WANT_RSA_KEY_SIZE_1024=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y

CONFIG_MCUMGR_TRANSPORT_BT=y
CONFIG_MCUMGR_TRANSPORT_BT_PERM_RW=n
CONFIG_MCUMGR_TRANSPORT_BT_CONN_PARAM_CONTROL=y
# CONFIG_MCUMGR_TRANSPORT_UART=y
CONFIG_NCS_SAMPLE_MCUMGR_BT_OTA_DFU=y

# Enable the mcumgr Packet Reassembly feature over Bluetooth and its configuration dependencies.
# MCUmgr buffer size is optimized to fit one SMP packet divided into five Bluetooth Write Commands,
# transmitted with the maximum possible MTU value: 498 bytes.
CONFIG_MCUMGR_TRANSPORT_BT_REASSEMBLY=y
CONFIG_MCUMGR_GRP_OS_MCUMGR_PARAMS=y

CONFIG_THREAD_NAME=y

#32KB
CONFIG_MAIN_STACK_SIZE=27648

#18KB
CONFIG_HEAP_MEM_POOL_SIZE=18432 

#8KB
CONFIG_MBEDTLS_HEAP_SIZE=7168

#5KB
CONFIG_FS_LITTLEFS_FC_HEAP_SIZE=5120

#8KB
CONFIG_BT_RX_STACK_SIZE=9216

#4KB
CONFIG_BT_HCI_TX_STACK_SIZE=5120

CONFIG_DISABLE_FLASH_PATCH=y

# CONFIG_MCUMGR_SMP_BT=y
# CONFIG_BT_DFU_SMP=y

# SMP GATT service registration
CONFIG_MCUMGR_TRANSPORT_BT_DYNAMIC_SVC_REGISTRATION=y

For context, I was using this same RSA signature setup in NCS 2.4.2 without any issue. Can someone clarify what’s changed in NCS 3.0.2, and also confirm if it’s possible to still use a 1024-bit RSA key with mcuboot in this version?

Thanks.

[Haris Iqbal]

There's an update, I used the imgtool to get public key from the private key that my bootloader uses. I figured out that it's an ECDSA_P256 key, not RSA. Now the problem is that the OTA between firmwares based on different NCS versions, the OTA fails. Here are different cases:

1. When I perform OTA for NCS 3.0.2 based firmware to the same NCS based firmware, it's a success. The image is confirmed and it stays on the updated firmware even after hard reset.
2. When I OTA NCS 2.4.2 based firmware to NCS 3.0.2 based firmware, it's also a success but upon hard reset, it reverts back to the older firmware, that's based on NCS 2.4.2 (probably image not confirmed).
   
3. When I OTA NCS 3.0.2 based firmware to the one based on NCS 2.4.2, it doesn't even upgrade, and prints out the older version. The device manager app says "hash not found (8)".
   

Note: I'm using Device Manager from Nordic for OTA's.

[Einar Thorsrud]

Hi,

I see you made some progress. Regarding 2 it seems the image is not confirmed as you write, as it is reverted on the next boot. Do you try to confirm it in this case? Do you have logging to indicate why it does not happen? Note that the image can be confirmed both via SMP, or by the image itself by calling boot_write_img_confirmed().

There may also be a problem that is hinted to by your case 3, which makes me wonder if you are using static partitioning or if the partition layout has changed between your 2.4.2 based firmware and your 3.0.2? If so, that will cause problems. You need to use static partitioning when doing DFU between versions, as changes in partitions will cause problems. See Static and dynamic configuration.

[Haris Iqbal]

How do I get the partition report? do you want me to share the paritions.yml file from build folder?

[Einar Thorsrud]

Hi,

If you can generate the partition report in text format and share here that would probably be best. You can do that using "ninja partition_manager_report" in the build folder, as described in the Partition manager documentation.

[Haris Iqbal]

There are clear differences between partition sizes.

Partition manager report for NCS 3.0.2 based firmware:

  external_flash (0x400000 - 4096kB):
+-----------------------------------------+
| 0x0: external_flash (0x400000 - 4096kB) |
+-----------------------------------------+

  flash_primary (0x100000 - 1024kB):
+-------------------------------------------------+
| 0x0: mcuboot (0xc000 - 48kB)                    |
+---0xc000: mcuboot_primary (0x73000 - 460kB)-----+
| 0xc000: mcuboot_pad (0x200 - 512B)              |
+---0xc200: mcuboot_primary_app (0x72e00 - 459kB)-+
| 0xc200: app (0x72e00 - 459kB)                   |
+-------------------------------------------------+
| 0x7f000: mcuboot_secondary (0x73000 - 460kB)    |
| 0xf2000: nvs_storage (0x6000 - 24kB)            |
| 0xf8000: littlefs_storage (0x8000 - 32kB)       |
+-------------------------------------------------+

  sram_primary (0x40000 - 256kB):
+--------------------------------------------+
| 0x20000000: sram_primary (0x40000 - 256kB) |
+--------------------------------------------+

Partition manager report for NCS 2.4.2 based firmware:

  external_flash (0x400000 - 4096kB): 
+-----------------------------------------+
| 0x0: external_flash (0x400000 - 4096kB) |
+-----------------------------------------+

  flash_primary (0x100000 - 1024kB):
+-------------------------------------------------+
| 0x0: mcuboot (0xc000 - 48kB)                    |
+---0xc000: mcuboot_primary (0x76000 - 472kB)-----+
| 0xc000: mcuboot_pad (0x200 - 512B)              |
+---0xc200: mcuboot_primary_app (0x75e00 - 471kB)-+
| 0xc200: app (0x75e00 - 471kB)                   |
+-------------------------------------------------+
| 0x82000: mcuboot_secondary (0x76000 - 472kB)    |
| 0xf8000: littlefs_storage (0x8000 - 32kB)       |
+-------------------------------------------------+

  sram_primary (0x40000 - 256kB):
+--------------------------------------------+
| 0x20000000: sram_primary (0x40000 - 256kB) |
+--------------------------------------------+

[Haris Iqbal]

It worked for me after updating the pm_static.yml to have all of the partitions as static. I'll verify if the little fs is not getting corrupted as reported by my team that previously when they used static partitioning, it messed up the little fs.

[Haris Iqbal]

The File system is also working fine. Thanks a lot for the support.