NCS recommended MCUboot enabled apps build and flash methods

[n.sakamoto]

I am testing smp_srv (bluetooth) with NCS 1.3.2.
I don't know how to build and flash related apps for MCU boot in NCS.
MCUboot is unable to boot smp_srv even after running as documented.
All sample code related to MCUboot will fail to start the application.

1. Is this smp_srv build correct in NCS? Or what is the recommended build method?
2. How do you do the flash method related to MCU boot recommended by NCS?
I don't use west sign -t imgtool because it doesn't seem to be recommended by NCS.
I'm flashing merged.hex with west flash.

[challenged command]
cd ~/ncs/v1.3.2/zephyr/samples/subsys/mgmt/mcumgr/smp_svr
west build -b nrf52dk_nrf52832 -d build_nrf52dk_nrf52832 . -- -DOVERLAY_CONFIG=overlay-bt.conf
west flash -d build_nrf52dk_nrf52832

nRF Connect SDK 1.3.2
Ubuntu 20.04.1 LTS

SEGGER J-Link V6.86e - Real time terminal output
J-Link OB-SAM3U128-V2-NordicSemi compiled Mar 17 2020 14:43:00 V1.0, SN=682102400
Process: JLinkExe
[00:00:00.003,753] <inf> mcuboot: Starting bootloader
[00:00:00.010,467] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[00:00:00.021,667] <inf> mcuboot: Boot source: none
[00:00:00.027,770] <inf> mcuboot: Swap type: none
[00:00:00.244,415] <err> mcuboot: Image in the primary slot is not valid!
[00:00:00.252,838] <err> mcuboot: Unable to find bootable image

[Simon]

I did some investigation into NCS v1.3.2 and it seems like you have to do the following to use your custom key:

• Generate the key "root-rsa-2048-custom.pem" according to https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.3.2/mcuboot/imgtool.html
• Put the generated key inside <ncs location>\bootloader\mcuboot
• set CONFIG_BOOT_SIGNATURE_KEY_FILE="root-rsa-2048-custom.pem" in both <ncs location>\bootloader\mcuboot\boot\zephyr\prj.conf and <application to be signed>\prj.conf

The reason you have to put it both places is the following: Inside bootloader\mcuboot\boot\zephyr\CMakeLists.txt (where the public key autogen-pubkey.c is created), it uses the key from mcuboot\boot\zephyr\prj.conf. Inside nrf\cmake\mcuboot.cmake (where the signed image app_update.bin is created), the key from <application to be signed>\prj.conf is used.

• Next you simply flash the merged.hex file from the applications build folder. It will contain both the mcuboot and app_update.bin hex. The mcuboot should be able to boot validate and boot the application.

I have not looked into NCS v1.4.0/master, and if this process is simplified to only set the key in one place. I can do some investigation if you would like to.

Best regards,

Simon

[n.sakamoto]

key pair file path is bootloader/mcuboot/root-rsa-2048-new.pem.
However, smp_srv builds with the default root-rsa-2048.pem.

ncs v1.4.0 seems to have solved this problem.
Use v1.4.0. Thank you for the correction.

I also understand that NCS does not need to extract the private key ("imgtool.py getpub").

[imgtool.py getpub]
./scripts/imgtool.py getpub -k root-rsa-2048-new.pem

[Dominic]

On NCS v1.4.0 you no longer need to specify the signature key file in the application, however the default key type has been changed to ECDSA. Thus, the lines you have to add to mcuboot/boot/zephyr/prj.conf to use an RSA key are:

CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=n
CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
CONFIG_BOOT_SIGNATURE_KEY_FILE="custom_key_rsa-2048.pem"

[Cody]

Is it expected that we still get this scary message even though it appears to be working properly?

---------------------------------------------------------
--- WARNING: Using default MCUBoot key, it should not ---
--- be used for production. ---
---------------------------------------------------------

[Vitaliy69]

Thx, this is a working way.

But I found another one. It's need to create a directory child_image in directory with prj.conf with file mcuboot.conf with content:

CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=n
CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
CONFIG_BOOT_SIGNATURE_KEY_FILE="custom_key_rsa-2048.pem"

For exaple: nrf/samples/nrf9160/http_update/application_update/child_image/mcuboot.conf

But the scary message doesn't disappear anyway.