Questions of DFU over BLE example

RE: Questions of DFU over BLE example

Vidar Berg — Fri, 16 Sep 2022 11:36:04 GMT

Hi Ping,

I'm glad you found my answers helpful. I would prefer if you could create a new ticket for questions not directly related to the original topic as it better fits the Q&A style of this forum. Long threads are generally hard to follow for others who may be looking for the same answers.

Regards,

Vidar

RE: Questions of DFU over BLE example

PingISTL — Fri, 16 Sep 2022 11:21:34 GMT

Thank you, Vidar

You solved my another puzzle.

I have a few more questions about the Device Management mobile app, shall I carry on asking here or start a new ticket? You already done a great job in this ticket.

Thanks!

Ping

RE: Questions of DFU over BLE example

Vidar Berg — Fri, 16 Sep 2022 11:04:13 GMT

Hi,

In vs code you now have to press this button to do a pristine build:

[quote user="PingISTL"]So the procedure for future production is like what I just did? and keep the key file safe? If anyone uploaded another file, it won't work.[/quote]

Yes, correct. If others get access to the private key, they will be able to create and distribute FW updates for your device.

RE: Questions of DFU over BLE example

PingISTL — Fri, 16 Sep 2022 10:39:55 GMT

Hi, Vidar

Thank you for your help - I tried to do a clean build and it shows which key file is used only with a clean build. BTW - I have to do a clean build by remove the build and add again as I don't see the pristine option in VS code ACTIONS window now since a upgrade.

Then I factory programmed the image.hex into the board, and also tried to load a update file with default key. It updated successfully, but it doesn't run and log says "E: Image in the secondary slot is not valid!"

I suppose this is expected. It works if I upload a new build file with same key file.

So the procedure for future production is like what I just did? and keep the key file safe? If anyone uploaded another file, it won't work.

Regards!

Ping

RE: Questions of DFU over BLE example

Vidar Berg — Fri, 16 Sep 2022 09:25:10 GMT

Hi Ping,

The build log will state which key file is used. You can always try do DFU with the default key again to verify that the update gets rejected to be absolutely sure.

Regards,

Vidar

RE: Questions of DFU over BLE example

PingISTL — Fri, 16 Sep 2022 09:17:54 GMT

Hi, Vidar

I did follow your steps and build successfully, I have not seen any warning message about the default keys are being used, does it mean I am using my own generated key now?

is there any other way to know this after build?

Ping

RE: Questions of DFU over BLE example

Vidar Berg — Fri, 16 Sep 2022 08:45:56 GMT

Hi Ping,

Assuming you have made the child image folder as I outlined in my initial reply, the next step would be to build the project. You can check the build log to confirm that your key is being used.

Regards,

Vidar

RE: Questions of DFU over BLE example

PingISTL — Thu, 15 Sep 2022 14:52:37 GMT

Hi, Vidar

Thanks for point out, imgtool is installed although I don't know where it is, but I generated a key file and put it into the keys folder created according to your instruction.

Now what is the next step please? I am not fully understand the final step you mentioned and the link, could you specify a bit more please?

Regards!

Ping

RE: Questions of DFU over BLE example

Vidar Berg — Thu, 15 Sep 2022 13:57:54 GMT

Hello Ping,

The imgtool is included in the SDK toolchain. Try to open the terminal from the Toolchain manager app, then run 'imgtool' from the terminal to verify that it is installed.

RE: Questions of DFU over BLE example

PingISTL — Thu, 15 Sep 2022 13:44:26 GMT

Hello, Vidar

Thanks for reply.

1. I tried and it works with confirm only. Also read a bit more on image uploading procedure and know a bit more now.

2. I am stuck in generating new key pair, it seems like I need to install the image tool first according to the link , I opened cmd window and tried following and got a error message below. Sorry, I am not familiar with python, and need more help here to install the tool. I am a windows user.

Could you help further please?

Ping

RE: Questions of DFU over BLE example

Vidar Berg — Thu, 15 Sep 2022 11:12:39 GMT

These options are relevant when working on the 53 series which as multiple upgradable images. On the nRF52 series you only have one, so you can select the "application core" option.

RE: Questions of DFU over BLE example

Vidar Berg — Thu, 15 Sep 2022 11:11:02 GMT

Hello,

1. The bootloader will only boot images from slot 0 unless you enable direct-xip (not enabled by default). Also, after DFU, you need to confirm the image in slot 0. Otherwise, the bootloader will end up restoring the old image from slot 1 on next boot.

Have you tried to select "Confirm Only" when initiating DFU from the basic menu? This should make the phone confirm the image right after the DFU is finished, rather than waiting for the new app to boot up and confirm it then.

2. For production builds, you should always use your own secret private key to sign the image. First step is to create a key pair, which you can do by following the instructions here: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/mcuboot/readme-zephyr.html#generating-a-new-keypair. The final step is to pass this private key to the build.

Steps to change the private key used by MCUboot (see the Image-specific variables section of the SDK documentation for details on how this works)

a. In your project directory, create a folder named "child_image" with a sub-directory named mcuboot

b. In 'mcuboot', create a file named "prj.conf" which will override the default mcuboot configuration. This file should include CONFIG_BOOT_SIGNATURE_KEY_FILE="keys/<filename>.pem" along with the other default mcuboot configurations. You may use the child_image.zip folder attached below as a reference.

c. adjacent to the the prj.conf file, make a new "key" folder where you will keep your key.

d. Now the folder structure should look like this:

├── child_image
│   └── mcuboot
│       ├── keys
│       │   └── mcuboot_private.pem
│       └── prj.conf

3. CONFIG_MCUMGR_SMP_BT_AUTHEN means the phone must be paired with MITM protection before it can initiate DFU (i.e. pairing with passkey, nummeric comparison, or OOB with NFC). It does not affect the DFU process itself. You can still use the same update images as when the authentication requirement is disabled.

Attachment

devzone.nordicsemi.com/.../2134.child_5F00_image.zip

Best regards,

Vidar

RE: Questions of DFU over BLE example

PingISTL — Wed, 14 Sep 2022 11:09:35 GMT

one more please, 4 . after choose SELECT FILE, and hit UPLOAD button, some time it pops up with a Select Image interface with options - Application Core(0), Network core(1), Image(2) and Image (3).

What does it mean and what option shall i choose if I just wan to upload the new image?

Thanks

Ping