• State Verified Answer
  • Replies 7 replies
  • Subscribers 65 subscribers
  • Views 2121 views
  • Users 0 members are here
Attachments (0)
Nordic Case Info
  • Case ID: 265816
Options
This post is older than 2 years and might not be relevant anymore
More Info: Consider searching for newer posts

Best process for signing firmware images when using mcuboot

d_c_h_w

I am developing an applicaiton to run on the app core of an nRF5340, and I have mcuboot enabled for the purposes of handling DFU.

I have recently implemented signing the app firmware with our own pem key instead of using the default key provided by mcuboot.

I am raising this support request as there does not seem to be a set ideal way to accomplish this automatically. If have tried two methods, and since upgrading to v1.5.0 have changed to using Method B.

Method A)

Specify in cmakelists.txt that we are in charge of the config of mcuboot e.g. via 

set(mcuboot_CONF_FILE
${CMAKE_CURRENT_SOURCE_DIR}/boards/mcuboot.conf
)

Advantages Disadvantages
Uses the immediate path of the conf file, so we can have the pem file inside our repository rather than the nRF Connect SDK source tree Have to maintain the full conf info for mcuboot, which generally changes in configuration between SDK revisions. Several changes observed going from v1.4.2 to v1.5.0
Goes against the idea of having the child_image directory to control small tweaks to the standard configuration of mcuboot that has been added in v1.5.0

Method B)

Use child_image mcuboot conf file to specifiy the pem file

Advantages Disadvantages
Don't have to maintain a full conf file for mcuboot Have to copy it into mcuboot area of SDK source code checkout. This is the only Path it looks in, and full paths are 1. a bit unworkable and 2. discouraged.
Having it stored at this path seems to trigger the cmake warning regarding using standard mcuboot key and that it should not be used in production, which is confusing to say the least. See warning below


Am I missing something here, or are these the simplest options.

  • 0 in reply to lcoudeville
    lcoudeville said:
    set(mcuboot_OVERLAY_CONFIG "${CMAKE_CURRENT_SOURCE_DIR}/mcuboot_prj.conf")

    I noticed you are using quotes here, could that be the problem?

  • 0 in reply to d_c_h_w

    That  doesn't make a difference. Even tried LIST(append.... but that doesn't make a difference.

    Added some debug messages in the "extensions.cmake" file in nrf-sdk learned that the variable mcuboot_OVERLAY_CONFIG is configured. In the macro/function `add_overlay` I added a message debug line:

    macro(add_overlay_config image overlay_file)
      add_overlay(${image} ${overlay_file} OVERLAY_CONFIG)
      message(${mcuboot_OVERLAY_CONFIG})
    endmacro()

    When I pass the variable as cli argument ( -Dmcuboot_OVERLAY_CONFIG=$(pwd)/mcuboot_prj.conf ), I get:

    /home/.../mcuboot_prj.conf;/home/.../ncs/nrf/subsys/partition_manager/partition_manager_enabled.conf

    Which is OK!

    When I set the variable from the CMakeLists.txt (as first line!) I get:

    /home/.../mcuboot_prj.conf

    Which is NOT OK! mcuboot is compiled without partition manager support, causing errors at boot time.

    I solved my issue with the "child_image" approach, however, I preferred to set the variable from the CMakeLists.txt file.

Related