How to create a MCUBoot image and an application image without modifying the SDK?

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Heidi — Wed, 11 Aug 2021 11:58:17 GMT

Of course. Just create a private ticket and reference this one.

RE: How to create a MCUBoot image and an application image without modifying the SDK?

SirBranch — Tue, 10 Aug 2021 14:11:37 GMT

Are we able to move the discussion to a private ticket so I can share those files? Apologies if this causes issues, it's production firmware

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Heidi — Tue, 10 Aug 2021 11:59:37 GMT

Hi!

Could you send me the following files:

build/mcuboot/zephyr/.config

build/spm/zephyr/.config

build/zephyr/.config

RE: How to create a MCUBoot image and an application image without modifying the SDK?

SirBranch — Fri, 06 Aug 2021 17:43:48 GMT

Hi Heidi,

Are you able to provide an update?

Thanks & Best Regards,

Ramiro

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Heidi — Thu, 29 Jul 2021 13:01:28 GMT

Hi Ramiro! Due to the summer holidays, we are quite understaffed in the support department at the moment. But I will get to your issue next week.

RE: How to create a MCUBoot image and an application image without modifying the SDK?

SirBranch — Thu, 22 Jul 2021 15:41:44 GMT

Hi Heidi,

I've setup the mcuboot bootloader with a private key. I've validated that this is consumed correctly by checking that the public key matches the generated one at build/mcuboot/zephyr/autogen-pubkey.c. Basic functionality of mcuboot works for me.

The issue I'm running into is when attempting to encrypt the hex generated by Zephyr, this can be done directly with mcuboot by enabling the following configuration:

CONFIG_BOOT_ENCRYPT_RSA=y

This requires a Crypto library, in my case I'm using mbedtls with all ciphers enabled for my networking stack. The issue I'm having is that during the build mcuboot is unable to locate the following mbedtls dependency.

In file included from C:/project/bootloader/mcuboot/boot/bootutil/include/bootutil/enc_key.h:33,
                 from C:/project/bootloader/mcuboot/boot/bootutil/src/bootutil_priv.h:43,
                 from C:/project/bootloader/mcuboot/boot/boot_serial/src/boot_serial.c:60:
C:/project/bootloader/mcuboot/boot/bootutil/include/bootutil/crypto/aes_ctr.h:23:14: fatal error: mbedtls/aes.h: No such file or directory
   23 |     #include <mbedtls/aes.h>
      |              ^~~~~~~~~~~~~~~
compilation terminated.

This is my configurations for the mcuboot_CONF_FILE:

CONFIG_SIZE_OPTIMIZATIONS=y
CONFIG_DEBUG=y
CONFIG_SYSTEM_CLOCK_DISABLE=y
CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"

# Do not erase all flash when flashing mcuboot
CONFIG_ZEPHYR_TRY_MASS_ERASE=n

# nrf52840 with QSPI
CONFIG_FLASH=y
CONFIG_MPU_ALLOW_FLASH_WRITE=y
CONFIG_MULTITHREADING=y
CONFIG_NORDIC_QSPI_NOR=y
CONFIG_NORDIC_QSPI_NOR_FLASH_LAYOUT_PAGE_SIZE=4096
CONFIG_NORDIC_QSPI_NOR_STACK_WRITE_BUFFER_SIZE=16
CONFIG_PM_EXTERNAL_FLASH=y
CONFIG_PM_EXTERNAL_FLASH_DEV_NAME="MX25R64"
CONFIG_PM_EXTERNAL_FLASH_SIZE=0x800000
CONFIG_PM_EXTERNAL_FLASH_BASE=0x0

CONFIG_UART_CONSOLE=n
CONFIG_CONSOLE_HANDLER=n
CONFIG_RTT_CONSOLE=y

# Updates over Serial
CONFIG_MCUBOOT_SERIAL=y
CONFIG_BOOT_SERIAL_UART=y
CONFIG_BOOT_SERIAL_DETECT_PIN=31
CONFIG_BOOT_SERIAL_DETECT_PIN_VAL=0
CONFIG_BOOT_WATCHDOG_FEED=y
CONFIG_BOOT_MAX_IMG_SECTORS=256

# Boot Security Configuration
CONFIG_BOOT_VALIDATE_SLOT0=y
CONFIG_BOOT_UPGRADE_ONLY=n 
# CONFIG_BOOT_SIGNATURE_TYPE_NONE=y
CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
# CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y
CONFIG_BOOT_ENCRYPT_RSA=y
# CONFIG_BOOT_ENCRYPT_X25519=y

CONFIG_BOOT_SIGNATURE_KEY_FILE="C:/test_key_rsa_2048.pem"
CONFIG_MCUBOOT_SIGNATURE_KEY_FILE="C:/test_key_rsa_2048.pem"

This is my configurations for the mcuboot_DTC_OVERLAY_FILE:

# Ensure an MCUboot-compatible binary is generated.
CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_FW_INFO=y

Any help is much appreciated.

Thanks & Best Regards,

Ramiro

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Heidi — Tue, 27 Apr 2021 12:59:32 GMT

Hi!

You can specify the public key file without modifying NCS in one of the following ways:

in a dedicated `mcuboot_prj.conf` and pass it to the build system as: `-Dmcuboot_CONF_FILE=mcuboot_prj.conf`
containing:
CONFIG_BOOT_SIGNATURE_KEY_FILE=<path>/public-key.pem
If using this method, CONFIG_BOOT_SIGNATURE_KEY_FILE <path> can be omitted and path will be taken relative to the location of the conf file.
In a Kconfig fragment, like: mcuboot_overlay-keys.conf , and pass it to the build system as: `-Dmcuboot_OVERLAY_CONFIG=mcuboot_overlay-keys.conf` containing:
Path must be absolute in this case.
CONFIG_BOOT_SIGNATURE_KEY_FILE=<path>/public-key.pem
using `-Dmcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE=<path>/public-key.pem`.
Path must be absolute in this case.

So try one of these methods and let me know if you still see the warnings.

Best regards,

Heidi

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Maaike — Fri, 23 Apr 2021 07:21:24 GMT

Hi Heidi,

I am a colleague of Giannis and took over the FOTA implementation.

I have created a mcuboot.conf file in the project folder, containing solely this line:
CONFIG_MCUBOOT_SIGNATURE_KEY_FILE="key.pem"

The same line I added to the prj.conf. There we also specified CONFIG_BOOTLOADER_MCUBOOT=y.

I also added the key.pem file to the project folder. I have created this key.pem with the instructions of this link.

As we do not want to make changes to the ncs (in this case to keys.c), I was not sure what to do with this instruction.
I skipped it for now, which is probably not the best idea.

During build I get the following warning:

=== child image mcuboot -  end ===

CMake Warning at C:/ncs/nrf/modules/mcuboot/CMakeLists.txt:151 (message):
  

        ---------------------------------------------------------
        --- WARNING: Using default MCUBoot key, it should not ---
        --- be used for production.                           ---
        ---------------------------------------------------------




CMake Warning at C:/ncs/nrf/modules/mcuboot/CMakeLists.txt:352 (message):
  CONFIG_MCUBOOT_SIGNATURE_KEY_FILE is set to "key.pem".

  You are using the NCS Mcuboot signing, which means this option will be
  ignored.

  Image signing in NCS is done via the MCUboot image's
  CONFIG_BOOT_SIGNATURE_KEY_FILE option.

  Consider setting CONFIG_MCUBOOT_SIGNATURE_KEY_FILE in your application
  image back to its default value, the empty string.

I am not sure what these warnings mean. Has the imaged been signed during build? How can I check that the image has been signed correctly? Or is there still something going wrong?

I tried using this

west sign -t imgtool -- --key key.pem --header-size 32 --pad

after building but that still gives the same error as Giannis had initially.

Also can you tell me how I should incorporate the public key in the code?

Thanks in advance.

Kind regards,
Maaike

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Heidi — Tue, 22 Dec 2020 14:08:56 GMT

Hi Giannis Anastasopoulos!

Yes, you should be able to set the configurations I mentioned below to point to the file containing the key you want to use and MCUboot will use that instead.

[quote user=""]Also, I am not sure what is the role of the SPM in this process.[/quote]

The SPM is for when you're running an application on the non-secure domain of the chip. This application set sup the device with trusted execution so that it can run your application on the non-secure domain.

Let me know if you have any more questions!

Best regards,

Heidi

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Heidi — Tue, 22 Dec 2020 13:57:47 GMT

Hi! It looks like there are a few ways to do it.

You could set CONFIG_MCUBOOT_SIGNATURE_KEY_FILE to the full path of the .pem file you want to use. I believe you will need to change CONFIG_BOOT_SIGNATURE_KEY_FILE in your MCUboot. config as well.

Or create an mcuboot.conf file in your application with these configurations and append them to the MCUboot configurations by adding the following in the CMakeLists.txt file in the application you are running. Make sure to place it right after the cmake_minimum_required line.

cmake_minimum_required(VERSION 3.13.1)
 
if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/mcuboot.conf")
    list(APPEND mcuboot_OVERLAY_CONFIG
      "${CMAKE_CURRENT_SOURCE_DIR}/mcuboot.conf"
      )
endif()

Let me know if there's anything else.

Best regards,

Heidi

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Vojislav — Tue, 22 Dec 2020 12:28:22 GMT

Heidi have you managed to find the solution to this issue?

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Vojislav — Thu, 17 Dec 2020 13:09:55 GMT

Hi,

I am also interested in this. So is it possible to add my .pem file into my application folder and configure the build system to use it for building the MCUboot and signing the application instead of the default one which is located in MCUboot repo.

Best regards,
Vojislav

RE: How to create a MCUBoot image and an application image without modifying the SDK?

Heidi — Fri, 11 Dec 2020 13:19:17 GMT

Hi!

I just wanted to let you know that I'm working on your case and I'll get back to you with an answer on Monday. Have a good weekend!

Best regards,

Heidi