How to update the MCUboot in nRF Connect on nRF52840DK

[RAS_ID]

Hi,

I press Button 1 and Reset to put the nRF52840 DK in to DFU mode that is programmed with a immutable bootloader (B0), mcuboot, and application. This works well to update the application (app_update.bin) using mcumgr over USB. However, during the mcuboot update (signed_by_mcuboot_and_b0_s1_image_update.bin), the application area is over-written and the application enters in a infinite loop after reset. I verified the over-write by reading the flash memory using the nRF programmer. 

Since mcumgr doesn't accept an address or slot parameter, I think the DFU mode is initialized with the application address. 

Are there different ways to enter the DFU mode to update the application and to update the mcuboot?

Thanks,

Ram

[Sigurd]

Hi Ram,

RAS_ID said:

What may be the reason the signature of the bootloaders (_b0_s0_ and _b0_s1_) is changed in a built with a small change?

Did you do a pristine build (e.g. west build with -p argument), or deleted the old build folder, when you build the project with the change(a modified printf statement)? If you are not setting your own CONFIG_SB_SIGNING_KEY_FILE, then the generated debug keys will be used. New debug keys are generated if you delete the build folder, or do a pristine build.

[RAS_ID]

Hi

Thanks your reply!

Yes, I always delete the build directory and do pristine build.

I am not using my own key file to sign the build, and this may be the reason as explained by you. I will use a predefined key file with CONFIG_SB_SIGNIG_KEY_FILE and repeat the test.

Would the sample key file provided with ncs work?

Thanks,

Ram

[RAS_ID]

Hi Sigurdon,

I made the second time build without pristine and without deleting the build directory and used _b0_s0_image_signed.hex to program the bootloader. It worked and printed the new message when put in the DFU mode.  Thank you very much for pointing me to the problem!

However, I am getting build error with  CONFIG_SB_SIGNIG_KEY_FILE.

This is what I put in the blinky's prj.conf file.

CONFIG_SB_SIGNING_KEY_FILE="c:/Users/singhr48/ncs/v1.4.0/bootloader/mcuboot/root-rsa-2048.pem"
CONFIG_SB_PUBLIC_KEY_FILES="c:/Users/singhr48/ncs/v1.4.0/bootloader/mcuboot/enc-rsa2048-pub.pem"

The two .pem files are provided as part of the ncs.

And the build error is

 [150/162] cmd.exe /C "cd /D C:\Users\singhr48\ncs\v1.4.0\zephyr\samples\basic\blinky\build\zephyr && C:\Users\singhr48\ncs\v1.4.0\toolchain\opt\bin\python.exe C:/Users/singhr48/ncs/v1.4.0/nrf/scripts/bootloader/keygen.py --public --in c:/Users/singhr48/ncs/v1.4.0/bootloader/mcuboot/root-rsa-2048.pem --out C:/Users/singhr48/ncs/v1.4.0/zephyr/samples/basic/blinky/build/zephyr/nrf/subsys/bootloader/generated/public.pem"
Traceback (most recent call last):
File "C:/Users/singhr48/ncs/v1.4.0/nrf/scripts/bootloader/keygen.py", line 33, in <module>
sk = SigningKey.from_pem(args.infile.read()) if args.infile else SigningKey.generate(curve=NIST256p)
File "C:\Users\singhr48\ncs\v1.4.0\toolchain\opt\bin\lib\site-packages\ecdsa\keys.py", line 828, in from_pem
privkey_pem = string[string.index(b("-----BEGIN EC PRIVATE KEY-----")):]
ValueError: subsection not found
FAILED: zephyr/nrf/subsys/bootloader/generated/public.pem
cmd.exe /C "cd /D C:\Users\singhr48\ncs\v1.4.0\zephyr\samples\basic\blinky\build\zephyr && C:\Users\singhr48\ncs\v1.4.0\toolchain\opt\bin\python.exe C:/Users/singhr48/ncs/v1.4.0/nrf/scripts/bootloader/keygen.py --public --in c:/Users/singhr48/ncs/v1.4.0/bootloader/mcuboot/root-rsa-2048.pem --out C:/Users/singhr48/ncs/v1.4.0/zephyr/samples/basic/blinky/build/zephyr/nrf/subsys/bootloader/generated/public.pem"
ninja: build stopped: subcommand failed.

Could you please guide what I am missing while defining the key files?

Thanks,

Ram

[Sigurd]

Hi Ram,

Try setting it to the EC key instead.

For me it's:

CONFIG_SB_SIGNING_KEY_FILE="C:/ncs/bootloader/mcuboot/root-ec-p256.pem"

 

I don't think you need to set CONFIG_SB_PUBLIC_KEY_FILES (I think it will be generated based on the private/signing key for you, but if you are setting it manually, it need to generated based on the private key).