nRF Connect SDK DFU

RE: nRF Connect SDK DFU

Simon — Wed, 07 Sep 2022 14:27:18 GMT

I've asked internally about the progress of this. I will keep you updated.

Best regards,

Simon

RE: nRF Connect SDK DFU

CW — Tue, 06 Sep 2022 08:35:27 GMT

Hi Simon,
I am also encountering this symptom, may I know any progress of the question "Sending the request timed out." ?
Thank you
Jason

RE: nRF Connect SDK DFU

Simon — Wed, 31 Aug 2022 10:31:37 GMT

[quote user="lCannon"]Could this documentation be updated or expanded on and instruction given to use mcumgr in windows?[/quote]

I don't think the mcumgr commands are any different in Windows than in Linux. The only thing I could think of was the serial port name used with --connstring. However, in the tutorial I added the following note: "Get the development kit’s serial port name (for example, "/dev/ttyACM0"), by running nrfjprog --com" (see Serial DFU -->Testing), which should help you get the serial port name when using both Windows and Linux.

[quote user="lCannon"] Also could the instructions be updated to build with VS Code?[/quote]

To keep the tutorial concise, short and to the point I just used west. I added the following note in the start: "The west command is used to build and flash the samples, but if you're not familiar with the command line, you can build and flash the sample using nRF Connect for VS Code instead.". So I added some links that demonstrated how to build and flash usin VS Code.

Does this seem reasonable? Please let me know if not.

Best regards,

Simon

RE: nRF Connect SDK DFU

lCannon — Wed, 24 Aug 2022 19:47:47 GMT

Hello Simon

The DFU guide has a BLE OTA section but also a serial section:

Add DFU support to your application

Could this documentation be updated or expanded on and instruction given to use mcumgr in windows? Also could the instructions be updated to build with VS Code?

Thank you

RE: nRF Connect SDK DFU

Simon — Mon, 15 Aug 2022 10:03:58 GMT

Thanks for sharing your solution!

RE: nRF Connect SDK DFU

lCannon — Sat, 30 Jul 2022 04:32:32 GMT

For anyone else who wishes to use signatures to only load authorized software with a custom signature after DFU support has been added to their project:

These steps were performed in windows.

Inside the SDK, go to:

v2.0.0\bootloader\mcuboot\scripts\

And then generate a new private key and a public key from the private key. I have not tested with any other type then rsa-2048.

python imgtool.py keygen -k my_private_key.pem -t rsa-2048

python imgtool.py getpub -k my_private_key.pem > pub_key.c

Generating the c file is not required but useful for confirmation later. The placement of the key file seams unimportant but I placed mine in the project directory such as follows:

My_Project\Key\my_private_key.pem

Then create a directory called child_image if it does not already exist as follows:

My_Project\child_image\

Create a file called mcuboot.conf inside the directory as follows:

My_Project\child_image\mcuboot.conf

Add a single line to the file pointing to the absolute path of the key file. You must use forward slashes. The line may look such as follows:

CONFIG_BOOT_SIGNATURE_KEY_FILE="C:/Projects/My_Project/Key/my_private_key.pem"

Take care not to add any extra spaces or the build will fail. Go ahead and rebuild your project. It should succeed and build the bootloader using the private key and build your application with a public key automatically extracted from the private key. Because of this you are not required to generate a key pair but just a private key. However, you may verify the project is using your new private key by verifying the public key generated by the build system is the same as the pub_key.c you previously generated. The build generated public key file is located at:

My_Project\build\mcuboot\zephyr\autogen-pubkey.c

As far as I know, at the time of writing, encrypting your software images is not yet supported but you can prevent software not signed by you from being loaded.

I have read other methods to add the private key including changing the CMakeList.txt file and a method to manually sign but i wanted to use the build system to handle it.

I hope this helps anyone else struggling with this.

RE: nRF Connect SDK DFU

Simon — Wed, 27 Jul 2022 20:47:04 GMT

Check out this ticket: Signing and versioning an image for MCUboot

It explains two ways to use your own custom key instead of the default one, manually and through the build system using CONFIG_BOOT_SIGNATURE_KEY_FILE.

Best regards,

Simon

RE: nRF Connect SDK DFU

lCannon — Wed, 27 Jul 2022 17:25:36 GMT

Thank you for your help Simon.

Is there a step by step guide on how to generate and use keys for both the bootloader and application so only a signed app may work not using the development default MCUBoot key? I have seen many different posts on the issue but no guide on the complete process.

Thank you

RE: nRF Connect SDK DFU

Simon — Wed, 13 Jul 2022 19:56:16 GMT

[quote user="simoniversen"]Regarding 2, I don't have an iOS device at my home office, but I will ask some colleagues to reproduce this on Monday[/quote]

I got a colleague to test this with an iPhone, and he got the same error as you: "Sending the request timed out."

I have reported this internally. I will keep you updated.

Best regards,

Simon

RE: nRF Connect SDK DFU

Simon — Sun, 10 Jul 2022 12:47:11 GMT

So there are currently two issues:

Performing DFU using your firmware and the Android Device Manager 1.4.0 fails
Performing DFU using the peripheral_lbs from the DFU guide and the iOS Device Manager v1.2.5 fails

Regarding 1, would you be able to upload your firmware (or a minimal reproducible sample), so I can reproduce it on my side and investigate it

Regarding 2, I don't have an iOS device at my home office, but I will ask some colleagues to reproduce this on Monday

Best regards,

Simon

RE: nRF Connect SDK DFU

lCannon — Sat, 09 Jul 2022 17:57:14 GMT

Thank you for your answers. I think a large problem is that the nRF Connect Device Manager is not working correctly. Using the Nordic_LBS example and modifying for the DFU similar to the guide, the iOS version of the Device Manger struggles. First it validates for a while

Then it times out

and the commands to test or confirm do not work after the read is issued:

I did switch to the android Version and it worked as you showed. The upload would work along with the commands to read and then test or confirm the firmware. So there are issued with the iOS version. However, when switching to the DFU support on our program, the android version would fail to work.

I went back to the iOS version and it did work correctly. So the android version would fail on our firmware and the iOS would fail on the Nordic_LBS firmware. The version of the Device Manager i used are:

iOS device manager
V1.2.5
~2022-07-07

Android device manager
1.4.0
26.06.2022

Thank you

RE: nRF Connect SDK DFU

Simon — Fri, 08 Jul 2022 15:44:30 GMT

[quote user=""]1)What modifications are required for the nRF5340 with an app core and net core? This example shows using Device Manager to upload a .bin file but that is only one of the app core or net core, not both. Can Device Manager accept a the generated .zip with the manifest to update both at once? Could a similar guide be generated for updating both the app and net cores at the same time? When trying to upload the zip of both, Device Manager shows the hash of both bin files, but when started with confirm only, the state shows VALIDATING… for a while then “Sending the request timed out.” When using the advanced page, I can manually select the app core and download the bin for it – not the zip.[/quote]

I created a sample here that updates the netcore and appcore. The readme contains instructions how to perform the updates.

Btw, the patch I refer to in the readme is applied to NCS v2.0.0.

It is not possible to update both cores simultaneously using this sample, you have to do it one at the time.

If you want to update both cores simultaneously, you could take a look at the machine learning sample and copy the approach there. It supports multi-image update. Take a look at this page as well: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/2.0.0 /nrf/ug_nrf5340.html#simultaneous-multi-image-dfu

[quote user=""]2)In Device Manger, the read, test, confirm, and erase options do not work. How can they be activated?[/quote]

What do you mean by this?

Does this window not show up when clicking on "Start"?

Do you mean that these are greyed out (you can see this view by clicking on "ADVANCED" in the top right corner)?

You need to click on "READ" for "TEST", "CONFIRM" and "ERASE" to be clickable.

Or do you mean that these options are visible, but it fails/nothing happens when you click on them?

[quote user=""]3)The guide said that Device Manager will reset the device after the transfer but watching the debug output on the device, this is not the case. I need to manually press the advanced button to get the reset command to show then issue it. Is this correct?[/quote]

I was not able to reproduce this. I modified the peripheral_lbs sample and followed the steps in the guide using NCS v2.0.0 and the nrf5340dk_nrf5340_cpuapp, and the device reset after the transfer completed:

I noticed that I had to do a pristine build, in order for the build time print to be different. If this printk is the same, the image will be the same and the hash will be the same, and the update won't even start.

Here is the sample I used

devzone.nordicsemi.com/.../7271.peripheral_5F00_lbs_5F00_dfu.zip

[quote user=""]4)I have read about encryption and updating keys but in other places it appears it is not supported to encrypt an image:[/quote][quote user=""]Is it correct to say signing is supported but encryption is not? Is there a step by step guide to generate new encryption keys (or signing keys) and update the MCUboot and app for both the app core and net core?[/quote]

That is correct. It should be possible to encrypt the images, but we do not have any guides or sample that does this unfortunately. This is reported internally. I will keep you updated on the progress.

The resources I know of, are listed in the ticket you referred to: Please add/enable support for encrypted images with MCUBOOT

[quote user=""]5)If singing is working correctly, is it still possible for a user to upload an image that is not correctly signed, but that the MCUboot will just not swa[/quote]

Yes, that is my understanding. The image is validated by mcuboot, so it has to be transferred to the secondary slot first. MCUmgr does not do any checks, it just transfers the image + some more commands like resetting, confirming etc..

Best regards,

Simon

RE: nRF Connect SDK DFU

Simon — Thu, 07 Jul 2022 15:58:43 GMT

Hello,

I'll take a look at this tomorrow

Best regards,

Simon