NCS recommended MCUboot enabled apps build and flash methods

RE: NCS recommended MCUboot enabled apps build and flash methods

ayavilevich — Fri, 13 Aug 2021 09:38:09 GMT

Thanks for the pointers.

I am on v1.5.1 and ended up with another method of setting a custom key that I though is worth sharing. Not sure if v1.6 changes anything. At least I found not relevant info in the release notes.

This processes of setting up a custom mcuboot signing key is definitely not polished enough. Took a while to solve. I hope Nordic can improve on that.

A good implementation for this in the build system will allow to set a relative path to a file. Then it should take effect in the app and in the mcuboot build processes. It should support the file being located in the app folder or in some other out-of-tree folder.

All of the other solutions I have seen are based on putting the file in mcuboot project folder. That code is shared by several projects, so doesn't seem to be a proper solution.

Also, most of the solutions will not accept a relative file path...

The way I found that addresses these issues is adding the following line in CMakeLists.txt:

set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE "\"${CMAKE_CURRENT_LIST_DIR}/mcuboot_key_dev.pem\"")

This works. Makes a different autogen-pubkey.c file and signs the bin file correctly. Make sure you verify with "imgtool.py verify".

Specifying this line in cmake allows for variables to be used. This way I can convert a relative path to an absolute one that mcuboot script expects.

The quotes make sure the values goes correctly to "build_*\mcuboot\zephyr\misc\generated\extra_kconfig_options.conf" file. Otherwise it doesn't build.

RE: NCS recommended MCUboot enabled apps build and flash methods

n.sakamoto — Thu, 04 Feb 2021 00:46:56 GMT

thanks you.
I didn't notice.
Be careful.

RE: NCS recommended MCUboot enabled apps build and flash methods

Vitaliy69 — Wed, 03 Feb 2021 20:10:46 GMT

Thx, this is a working way.

But I found another one. It's need to create a directory child_image in directory with prj.conf with file mcuboot.conf with content:

CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=n
CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
CONFIG_BOOT_SIGNATURE_KEY_FILE="custom_key_rsa-2048.pem"

For exaple: nrf/samples/nrf9160/http_update/application_update/child_image/mcuboot.conf

But the scary message doesn't disappear anyway.

RE: NCS recommended MCUboot enabled apps build and flash methods

Cody — Wed, 03 Feb 2021 19:19:19 GMT

Is it expected that we still get this scary message even though it appears to be working properly?

---------------------------------------------------------
--- WARNING: Using default MCUBoot key, it should not ---
--- be used for production. ---
---------------------------------------------------------

RE: NCS recommended MCUboot enabled apps build and flash methods

Dominic — Sun, 24 Jan 2021 18:18:47 GMT

On NCS v1.4.0 you no longer need to specify the signature key file in the application, however the default key type has been changed to ECDSA. Thus, the lines you have to add to mcuboot/boot/zephyr/prj.conf to use an RSA key are:

CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=n
CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
CONFIG_BOOT_SIGNATURE_KEY_FILE="custom_key_rsa-2048.pem"

RE: NCS recommended MCUboot enabled apps build and flash methods

n.sakamoto — Wed, 04 Nov 2020 07:39:48 GMT

key pair file path is bootloader/mcuboot/root-rsa-2048-new.pem.
However, smp_srv builds with the default root-rsa-2048.pem.

ncs v1.4.0 seems to have solved this problem.
Use v1.4.0. Thank you for the correction.

I also understand that NCS does not need to extract the private key ("imgtool.py getpub").

[imgtool.py getpub]
./scripts/imgtool.py getpub -k root-rsa-2048-new.pem

RE: NCS recommended MCUboot enabled apps build and flash methods

Simon — Mon, 02 Nov 2020 08:58:27 GMT

I did some investigation into NCS v1.3.2 and it seems like you have to do the following to use your custom key:

Generate the key "root-rsa-2048-custom.pem" according to https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.3.2/mcuboot/imgtool.html
Put the generated key inside <ncs location>\bootloader\mcuboot
set CONFIG_BOOT_SIGNATURE_KEY_FILE="root-rsa-2048-custom.pem" in both <ncs location>\bootloader\mcuboot\boot\zephyr\prj.conf and <application to be signed>\prj.conf

The reason you have to put it both places is the following: Inside bootloader\mcuboot\boot\zephyr\CMakeLists.txt (where the public key autogen-pubkey.c is created), it uses the key from mcuboot\boot\zephyr\prj.conf. Inside nrf\cmake\mcuboot.cmake (where the signed image app_update.bin is created), the key from <application to be signed>\prj.conf is used.

Next you simply flash the merged.hex file from the applications build folder. It will contain both the mcuboot and app_update.bin hex. The mcuboot should be able to boot validate and boot the application.

I have not looked into NCS v1.4.0/master, and if this process is simplified to only set the key in one place. I can do some investigation if you would like to.

Best regards,

Simon

RE: NCS recommended MCUboot enabled apps build and flash methods

Simon — Wed, 28 Oct 2020 10:56:40 GMT

I'm sorry for the delay on this. I have not looked into this topic (singing, keys, etc..) very much and I put off some time yesterday and today to get an overview of how all this works. I'm gradually getting a better understanding of this and will try to provide you with an answer soon.

Best regards,

Simon

RE: NCS recommended MCUboot enabled apps build and flash methods

n.sakamoto — Wed, 28 Oct 2020 05:20:56 GMT

I decided to avoid the problem by using the generated private key without changing the original file name, hoping that the problem that CONFIG_BOOT_SIGNATURE_KEY_FILE is not reflected in MCU boot will be solved by version upgrade.

RE: NCS recommended MCUboot enabled apps build and flash methods

n.sakamoto — Wed, 28 Oct 2020 04:18:32 GMT

I found the following post about an issue where MCUboot's CONFIG_BOOT_SIGNATURE_KEY_FILE is not recognized.

[CONFIG_BOOT_SIGNATURE_KEY_FILE doesn't correctly get propagated to MCUBoot build]
devzone.nordicsemi.com/.../267627

RE: NCS recommended MCUboot enabled apps build and flash methods

n.sakamoto — Tue, 27 Oct 2020 04:54:41 GMT

Reverting CONFIG_BOOT_SIGNATURE_KEY_FILE in prj.conf of MCUboot to the original file name and executing "imgtool.py getpub" to rebuild it solved the problem.
1.edit mcuboot prj.conf
[bootloader/mcuboot/boot/zephyr/prj.conf]
#CONFIG_BOOT_SIGNATURE_KEY_FILE="root-rsa-2048-new.pem" <-comment
CONFIG_BOOT_SIGNATURE_KEY_FILE="root-rsa-2048.pem" <-Revert to old code
2.
./scripts/imgtool.py getpub -k root-rsa-2048.pem

When I built mcuboot when bootloader / mcuboot / root-rsa-2048.pem did not exist, the build failed.
An error will occur if root-rsa-2048.pem'is missing.
Could not build with the newly generated root-rsa-2048-new.pem.
Is the method of specifying the key pair wrong?

error:
FileNotFoundError: [Errno 2] No such file or directory: '/home/ncs/ncs/v1.3.2/zephyr/../bootloader/mcuboot/root-rsa-2048.pem'

1.edit mcuboot prj.conf
[bootloader/mcuboot/boot/zephyr/prj.conf]
CONFIG_BOOT_SIGNATURE_KEY_FILE="root-rsa-2048-new.pem" <-set new file
#CONFIG_BOOT_SIGNATURE_KEY_FILE="root-rsa-2048.pem" <-comment
2.
./scripts/imgtool.py getpub -k root-rsa-2048-new.pem

[smp_srv build log]

ncs@ubuntu:~/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr$ west build -b nrf52dk_nrf52832  -d build_nrf52dk_nrf52832 . -- -DOVERLAY=overlay-bt.conf
-- west build: generating a build system
Including boilerplate (Zephyr base): /home/ncs/ncs/v1.3.2/zephyr/cmake/app/boilerplate.cmake
-- Application: /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr
-- Zephyr version: 2.3.0-rc1 (/home/ncs/ncs/v1.3.2/zephyr)
-- Found Python3: /usr/bin/python3.8 (found suitable exact version "3.8.5") found components: Interpreter 
-- Board: nrf52dk_nrf52832
-- Found west: /home/ncs/.local/bin/west (found suitable version "0.7.2", minimum required is "0.7.1")

-- Found dtc: /usr/bin/dtc (found suitable version "1.5.0", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (/home/ncs/gnuarmemb)
-- Found BOARD.dts: /home/ncs/ncs/v1.3.2/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832.dts
-- Generated zephyr.dts: /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/include/generated/devicetree_unfixed.h
Parsing /home/ncs/ncs/v1.3.2/zephyr/Kconfig
Loaded configuration '/home/ncs/ncs/v1.3.2/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832_defconfig'
Merged configuration '/home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/prj.conf'
Merged configuration '/home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/boards/nrf52dk_nrf52832.conf'
Configuration saved to '/home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/.config'
Kconfig header saved to '/home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 9.3.1
-- The CXX compiler identification is GNU 9.3.1
-- The ASM compiler identification is GNU
-- Found assembler: /home/ncs/gnuarmemb/bin/arm-none-eabi-gcc
-- Cache files will be written to: /home/ncs/.cache/zephyr

=== child image mcuboot - nrf52dk_nrf52832 begin ===
Including boilerplate (Zephyr base): /home/ncs/ncs/v1.3.2/zephyr/cmake/app/boilerplate.cmake
-- Application: /home/ncs/ncs/v1.3.2/bootloader/mcuboot/boot/zephyr
-- Zephyr version: 2.3.0-rc1 (/home/ncs/ncs/v1.3.2/zephyr)
-- Found Python3: /usr/bin/python3.8 (found suitable exact version "3.8.5") found components: Interpreter 
-- Board: nrf52dk_nrf52832
-- Found west: /home/ncs/.local/bin/west (found suitable version "0.7.2", minimum required is "0.7.1")
-- Found dtc: /usr/bin/dtc (found suitable version "1.5.0", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (/home/ncs/gnuarmemb)
-- Found BOARD.dts: /home/ncs/ncs/v1.3.2/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832.dts
-- Found devicetree overlay: /home/ncs/ncs/v1.3.2/bootloader/mcuboot/boot/zephyr/dts.overlay
-- Generated zephyr.dts: /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/mcuboot/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/mcuboot/zephyr/include/generated/devicetree_unfixed.h
Parsing /home/ncs/ncs/v1.3.2/bootloader/mcuboot/boot/zephyr/Kconfig
Loaded configuration '/home/ncs/ncs/v1.3.2/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832_defconfig'
Merged configuration '/home/ncs/ncs/v1.3.2/bootloader/mcuboot/boot/zephyr/prj.conf'
Configuration saved to '/home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/mcuboot/zephyr/.config'
Kconfig header saved to '/home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/mcuboot/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 9.3.1
-- The CXX compiler identification is GNU 9.3.1
-- The ASM compiler identification is GNU
-- Found assembler: /home/ncs/gnuarmemb/bin/arm-none-eabi-gcc
-- Cache files will be written to: /home/ncs/.cache/zephyr
-- Configuring done
-- Generating done
-- Build files have been written to: /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/mcuboot
=== child image mcuboot - nrf52dk_nrf52832 end ===

-- Configuring done
-- Generating done
CMake Warning:
  Manually-specified variables were not used by the project:

    OVERLAY


-- Build files have been written to: /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832
-- west build: building application
[1/266] Preparing syscall dependency handling

[9/266] Performing build step for 'mcuboot_subimage'
[1/239] Preparing syscall dependency handling

[234/239] Linking C executable zephyr/zephyr_prebuilt.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       36060 B        48 KB     73.36%
            SRAM:       23608 B        64 KB     36.02%
        IDT_LIST:          72 B         2 KB      3.52%
[239/239] Linking C executable zephyr/zephyr.elf
[255/266] Linking C executable zephyr/zephyr_prebuilt.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:      177420 B     224768 B     78.93%
            SRAM:       32280 B        64 KB     49.26%
        IDT_LIST:         136 B         2 KB      6.64%
[263/266] Generating ../../zephyr/app_...../../zephyr/app_moved_test_update.hex
FAILED: zephyr/app_update.bin zephyr/app_signed.hex zephyr/app_test_update.hex zephyr/app_moved_test_update.hex 
cd /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/modules/mcuboot && /usr/bin/python3.8 /home/ncs/ncs/v1.3.2/zephyr/../bootloader/mcuboot/scripts/imgtool.py sign --key /home/ncs/ncs/v1.3.2/zephyr/../bootloader/mcuboot/root-rsa-2048.pem --header-size 0x200 --align 4 --version 0.0.0+0 --slot-size 0x37000 --pad-header /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/mcuboot_primary_app.hex /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/app_signed.hex && /home/ncs/gnuarmemb/bin/arm-none-eabi-objcopy --input-target=ihex --output-target=binary /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/mcuboot_primary_app.hex /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/app_to_sign.bin && /usr/bin/python3.8 /home/ncs/ncs/v1.3.2/zephyr/../bootloader/mcuboot/scripts/imgtool.py sign --key /home/ncs/ncs/v1.3.2/zephyr/../bootloader/mcuboot/root-rsa-2048.pem --header-size 0x200 --align 4 --version 0.0.0+0 --slot-size 0x37000 --pad-header /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/app_to_sign.bin /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/app_update.bin && /usr/bin/python3.8 /home/ncs/ncs/v1.3.2/zephyr/../bootloader/mcuboot/scripts/imgtool.py sign --key /home/ncs/ncs/v1.3.2/zephyr/../bootloader/mcuboot/root-rsa-2048.pem --header-size 0x200 --align 4 --version 0.0.0+0 --slot-size 0x37000 --pad-header --pad /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/mcuboot_primary_app.hex /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/app_test_update.hex && /home/ncs/gnuarmemb/bin/arm-none-eabi-objcopy --input-target=ihex --output-target=ihex --change-address 0x37000 /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/app_test_update.hex /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832/zephyr/app_moved_test_update.hex
Traceback (most recent call last):
  File "/home/ncs/ncs/v1.3.2/zephyr/../bootloader/mcuboot/scripts/imgtool.py", line 20, in <module>
    main.imgtool()
  File "/home/ncs/.local/lib/python3.8/site-packages/click/core.py", line 764, in __call__
    return self.main(*args, **kwargs)
  File "/home/ncs/.local/lib/python3.8/site-packages/click/core.py", line 717, in main
    rv = self.invoke(ctx)
  File "/home/ncs/.local/lib/python3.8/site-packages/click/core.py", line 1137, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/ncs/.local/lib/python3.8/site-packages/click/core.py", line 956, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/ncs/.local/lib/python3.8/site-packages/click/core.py", line 555, in invoke
    return callback(*args, **kwargs)
  File "/home/ncs/ncs/v1.3.2/bootloader/mcuboot/scripts/imgtool/main.py", line 294, in sign
    key = load_key(key) if key else None
  File "/home/ncs/ncs/v1.3.2/bootloader/mcuboot/scripts/imgtool/main.py", line 72, in load_key
    key = keys.load(keyfile)
  File "/home/ncs/ncs/v1.3.2/bootloader/mcuboot/scripts/imgtool/keys/__init__.py", line 44, in load
    with open(path, 'rb') as f:
FileNotFoundError: [Errno 2] No such file or directory: '/home/ncs/ncs/v1.3.2/zephyr/../bootloader/mcuboot/root-rsa-2048.pem'
ninja: build stopped: subcommand failed.
FATAL ERROR: command exited with status 1: /usr/bin/cmake --build /home/ncs/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr/build_nrf52dk_nrf52832

RE: NCS recommended MCUboot enabled apps build and flash methods

Simon — Fri, 23 Oct 2020 08:38:34 GMT

I'm sorry for the delay on this. I'll try to provide you with an answer within the next upcoming working days.

Best regards,

Simon