MCUBOOT Hardware Key

RE: MCUBOOT Hardware Key

hyper — Thu, 06 Jan 2022 04:51:54 GMT

Yeah, sorry about wasting your time there - I was in a rush and I just looked at the code rather than trying to compile it, and I missed the additional mcuboot_config.h #include in bootutil_priv.h.

RE: MCUBOOT Hardware Key

Sigurd — Tue, 04 Jan 2022 10:28:10 GMT

[quote user="hyper"]AFAICT, there is still the same sort of bug in single_loader.c that hasn't been fixed upstream yet.[/quote][quote user="hyper"]I think that a similar #include order issue may also be present in single_loader.c, because, for example, bootutil_priv.h depends on MCUBOOT_ENC_IMAGES. But that appears to be set in mcuboot_config.h, which is included later.[/quote]

Are you able to trigger an issue here? I think this should be ok, since bootutil_priv.h includes mcuboot_config.h

RE: MCUBOOT Hardware Key

hyper — Tue, 21 Dec 2021 22:12:52 GMT

Thanks, that's good to see.

AFAICT, there is still the same sort of bug in single_loader.c that hasn't been fixed upstream yet.

RE: MCUBOOT Hardware Key

Sigurd — Tue, 21 Dec 2021 14:31:49 GMT

Hi,

[quote user="hyper"]This looks to me to be a bug in keys.c, because sign_key.h is being #include'd before mcuboot_config.h rather than after it.[/quote]

The issue is resolved upstream: https://github.com/mcu-tools/mcuboot/pull/1156

We have opened a PR to include the fix in our fork here: https://github.com/nrfconnect/sdk-mcuboot/pull/190

RE: MCUBOOT Hardware Key

hyper — Fri, 17 Dec 2021 07:04:00 GMT

BTW, I am referring to a recent version of sdk-nrf main branch in my posts here.

I think that a similar #include order issue may also be present in single_loader.c, because, for example, bootutil_priv.h depends on MCUBOOT_ENC_IMAGES. But that appears to be set in mcuboot_config.h, which is included later.

I'm thinking I must be wrong about this though, as surely these options have been tested by someone upstream?

RE: MCUBOOT Hardware Key

hyper — Fri, 17 Dec 2021 06:51:44 GMT

This looks to me to be a bug in keys.c, because sign_key.h is being #include'd before mcuboot_config.h rather than after it.

As a result, MCUBOOT_HW_KEY is not defined when sign_key.h is processed at the start of compiling keys.c.

If you swap those two #includes around, you should get further, and will then have to figure out the best way to incorporate an implementation of boot_retrieve_public_key_hash() into MCUBoot when it is built. I am not yet sure the best way to do that without having to maintain our own fork of the sdk-nrf repo (which we are trying hard to avoid).

RE: MCUBOOT Hardware Key

rtscts — Fri, 17 Dec 2021 04:55:04 GMT

Hello,

Is Mcuboot Hardware Key feature supported on NCS 1.8.0?

I'm getting exactly the same build error as was reported for 1.5.0.

Thanks

RE: MCUBOOT Hardware Key

Amanda Hsieh — Mon, 10 May 2021 09:08:48 GMT

Hi Jasonho,

Mcuboot Hardware Key feature is not supported on NCS 1.5.

-Amanda H.

RE: MCUBOOT Hardware Key

Jasonho — Fri, 07 May 2021 23:00:50 GMT

#ifndef MCUBOOT_HW_KEY
struct bootutil_key {
    const uint8_t *key;
    const unsigned int *len;
};

extern const struct bootutil_key bootutil_keys[];
#else
struct bootutil_key {
    uint8_t *key;
    unsigned int *len;
};

extern struct bootutil_key bootutil_keys[];

/**
 * Retrieve the hash of the corresponding public key for image authentication.
 *
 * @param[in]      image_index      Index of the image to be authenticated.
 * @param[out]     public_key_hash  Buffer to store the key-hash in.
 * @param[in,out]  key_hash_size    As input the size of the buffer. As output
 *                                  the actual key-hash length.
 *
 * @return                          0 on success; nonzero on failure.
 */
int boot_retrieve_public_key_hash(uint8_t image_index,
                                  uint8_t *public_key_hash,
                                  size_t *key_hash_size);
#endif /* !MCUBOOT_HW_KEY */

The above is from sign_key.h

You can see that if MCUBOOT_HW_KEY is defined

It will use

extern struct bootutil_key bootutil_keys[];

So the issue is why MCUBOOT_HW_KEY is not define if I enable BOOT_HW_KEY

But in keys.c, MCUBOOT_HW_KEY is defined.

I think this is the main issue.

modify the code in your way is not appropriated

RE: MCUBOOT Hardware Key

Amanda Hsieh — Fri, 07 May 2021 06:20:42 GMT

Hi,

This is a type conflict. One is const struct while the other is struct. Try defining the array as const

const struct bootutil_key bootutil_keys[1] = {...};

-Amanda H.