Secure bootloader chain + two-stage upgradable bootloader MCUBOOT

[Siddharth Kachhia]

I am working with nRF connect SDK with nRF5340DK. I am compiling code using nRF connect (ncs-1.8.0) for VS code with nrf5340dk_nrf5340_cpuapp board.

prj.conf as below,

CONFIG_BOOTLOADER_MCUBOOT=y

CONFIG_MCUMGR=y

CONFIG_SECURE_BOOT=y

Using this I can enabling two-stage bootloader, here are the log,

 

*** Booting Zephyr OS build v2.7.0-ncs1 ***

Attempting to boot slot 0.

Attempting to boot from address 0x8200.

Verifying signature against key 0.

Hash: 0x12...93

Firmware signature verified.

Firmware version 1

Booting (0x8200).

*** Booting Zephyr OS build v2.7.0-ncs1 ***

I: Starting bootloader
I: Primary image: magic=good, swap_type=0x3, copy_done=0x1, image_ok=0x1
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Swap type: none
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Bootloader chainload address offset: 0x28000
I: Jumping to the first image slot
*** Booting Zephyr OS build v2.7.0-ncs1 ***

I can firmware upgrade over-the-air (FOTA) for application using app_update.bin file.

Question:

1) How can I upgrade the second stage bootloader(MCUBoot bootloader)?

2) Which bin file to upload for upgrade the second stage bootloader?

[Hung Bui]

Hi Siddharth, 

I would suggest to have a look at this case to have an idea of how it should be handled: https://devzone.nordicsemi.com/f/nordic-q-a/67024/nrf9160-questions-related-to-immutable-mcuboot-application/274813#274813

Then you can have a look at this case , our coworker has created a working example: 

https://devzone.nordicsemi.com/f/nordic-q-a/85539/update-mcuboot-with-smp/358748

[Siddharth Kachhia]

Hi Hung,

I have tried your coworker example : https://devzone.nordicsemi.com/f/nordic-q-a/85539/update-mcuboot-with-smp/358748

but its not updating MCUBOOT!!

 For, testing I had follow below steps,

I make a change to MCUBoot, for example add a log in $NRF_CONNECT_SDK/bootloader/mcuboot/boot/zephyr/main.c.

Build again, and upload the new image using mcumgr:

mcumgr conn add acm0 type="serial" connstring="dev=/dev/ttyACM0,baud=115200,mtu=512"
mcumgr -c acm0 image list
mcumgr -c acm0 image upload build/zephyr/signed_by_mcuboot_and_b0_s1_image_update.bin
mcumgr -c acm0 image list

Copy the hash of the newly uploaded image, and use it to confirm it, making the new image run at next reboot, such as:

mcumgr -c acm0 image confirm 2348de4f84cb19c1c2721662ad1275da5c21eca749da9b32db20d2c9dffb47c0

Then reboot the Developement Kit. This will load the new MCUBoot image its slot. Reboot the Developement Kit again to load using the new version of MCUBoot.

If I miss any steps let me know please.

I did not Disable the Mass Storage feature on the device. is this required to do that?

Why required Disabling the Mass Storage feature on the device? 

Also I have one questions,

How we can use both stage bootloader as MCUBOOT? as shown in below ,I am talking about second options.

Bootloader	Can be first-stage	Can be second-stage	Key type support	Public key revocation	SMP updates	Downgrade protection	Versioning	Update methods (supported by nRF Connect SDK)
nRF Secure Immutable Bootloader	Yes	No	See list	Yes	No	Yes	Monotonic (HW)	Dual slot execute in place (XIP)
MCUboot	Yes	Yes	See imgtool	No	Yes	Yes	Semantic (SW)	Image swap - single primary

[Siddharth Kachhia]

Hi Sigurd,

Thanks for the detail explanation. I got your point. I will test it again as you explain and if I face any difficulty then let you know.

[Siddharth Kachhia]

Hi Sigurd,

Now, I am able to do upgrade the mcuboot.

I have questions regarding KEY.

1) how can I generate my own "custom_priv.pem" which is CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256?

2) how can I generate my own "nsib_priv.pem" which is CONFIG_SB_SIGNING_KEY_FILE? what is type of this key?

[Sigurd Hellesvik]

Hi Siddharth,

Siddharth Kachhia said:

1) how can I generate my own "custom_priv.pem" which is CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256?

As long as it is a standard ECDSA P256 key, you should be able to use any tool. For example OpenSSl. However, the MCUBoot tool imgtool.py has functionality for creating such keys, so I recommend it:

python3 <nrf_connect_sdk_dir>/bootloader/mcuboot/scripts/imgtool.py keygen -k filename.pem -t ecdsa-p256

Siddharth Kachhia said:

2) how can I generate my own "nsib_priv.pem" which is CONFIG_SB_SIGNING_KEY_FILE? what is type of this key?

From nRF Secure Immutable Bootloader documentation:
"This bootloader supports the ECDSA-p256 key type for validating the next image in the boot chain."

Regards,
Sigurd Hellesvik

[Siddharth Kachhia]

Hi Sigurd,

Thanks for the quick reply. got it point. I will try to create ECDS_P256 key using imgtool.py 

I have question on network core bootloader.

Is it possible to enable secure bootloader chain (two stage upgradable bootloader MCUBOOT) on network core?

So, at the end I want to achieve below things,
Upgrade MCUboot and application on application core,
Upgrade MCUboot and application on network core.

[Sigurd Hellesvik]

Hi

By default, the Network Core does not run MCUBoot, but a custom bootloader called b0n: nRF5340: Network core bootloader.
Therefore, if you need to update MCUBoot, this would be relevant mostly for the application core.

I do not think we have any sample for running MCUBoot on the Network Core.
I suspect that doing so will take up too much space to also run the Bluetooth Low Energy Host. But I have not verified this, so I recommend that you check this yourself if you want to be sure.

As with NSIB in the Application core, I do not think it is possible to update this bootloader. At least not easily.
If you have good reason for wanting to update either NSIB(b0) or b0n, I could ask our developers if this is possible?

Regards,
Sigurd Hellesvik

[Siddharth Kachhia]

Hi Sigurd,

I was asking for feasibility. right now there is no any good point for upgrading that.

 In my current implementation,

I have added secure bootloader chain in application core and after that I am able to do upgrade 2nd stage bootloader mcuboot(using signed_by_mcuboot_and_b0_s1_image_update.bin) and application core app (using app_update.bin). but not upgrading net-core app (using net_core_app_update.bin).

Is there any thing missing?

Because I have tested with single stage bootloader as mcuboot, I am able to upgrade application core app (using app_update.bin) and net-core app (using net_core_app_update.bin).

Facing issue with multistage bootloader to upgrade net-core app.

[Sigurd Hellesvik]

Hi

We do not support encrypted bootloader chain.

Regards,
Sigurd Hellesvik

[Siddharth Kachhia]

Hi

Yes. but in this case we are not using encrypted image.

Only enable the 2nd stage bootloader in application core. After that net-core is not upgrading.

[Sigurd Hellesvik]

Hi

I am sorry, mixed this up with your other cases.

I will continue looking into this.

Regards,
Sigurd Hellesvik

[Sigurd Hellesvik]

Hi

Are you able to upload the net_core_app_update.bin to the network core if you add "-n 3" to the "mcumgr upload" command for the network core.
Then wait 2 minutes after the upload is done before resetting the nRF5340.

Does this work?

Regards,
Sigurd Hellesvik