Attachments (0)
Nordic Case Info
  • Case ID: 296391
Options

MCUBoot with serial UART and image encryption

rdolejs

I am working on a development with a nRF52840-DK development board and I am trying to enable image encryption with MCUboot. I followed the case advice given in "nRF52840 + NCS + MCUBoot, CC310-enabled image encryption?" since it appeared to be working. However I also have the UART serial port enabled and that appears to be generating a compile error as shown below.

C:\nordicsemi\v2.0.0\bootloader\mcuboot\boot\boot_serial\src\boot_serial.c:476: undefined reference to `boot_handle_enc_fw'
collect2.exe: error: ld returned 1 exit status

The .conf files are shown below.

prj.conf file:

Fullscreen
1
2
CONFIG_GPIO=y
CONFIG_BOOTLOADER_MCUBOOT=y
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

mcuboot.conf file:

Fullscreen
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
CONFIG_SIZE_OPTIMIZATIONS=y
CONFIG_PM_PARTITION_SIZE_MCUBOOT=0x10000
CONFIG_UART_CONSOLE=n
CONFIG_MCUBOOT_SERIAL=y
CONFIG_BOOT_SERIAL_UART=y
CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
CONFIG_BOOT_SIGNATURE_KEY_FILE="C:/Workspace/VScode/wren_blinky/child_image/keys/mcuboot_private_sign.pem"
CONFIG_BOOT_ENCRYPT_EC256=y
CONFIG_BOOT_ENCRYPTION_KEY_FILE="C:/Workspace/VScode/wren_blinky/child_image/keys/mcuboot_private_enc.pem"
CONFIG_BOOT_ECDSA_TINYCRYPT=y
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Bootloading with mcumger works with the signature enabled. However, adding the CONFIG_BOOT_ENCRYPT_EC256=y line causes the undefined reference to boot_handle_enc_fw error to be generated. Any ideas why I am getting this compile error?

Best regards,

Ray

Parents
  • 0

    Hi Amanda,

    I did get encrypted DFU to work following the links you provided with a few additions. To fix the 'boot_handle_enc_fw' issue I had to add CONFIG_SINGLE_APPLICATION_SLOT=y. This enables including 'boot_handle_enc_fw' in the build. I also had to change CONFIG_BOOT_ENCRYPT_EC256=y to CONFIG_BOOT_SERIAL_ENCRYPT_EC256=y to fix some compile errors. Finally I added the line --encrypt C:/Workspace/VScode/wren2_blinky/child_image/keys/mcuboot_private_enc.pem to the CMakeLists.txt file as shown in one of the links. The app_update.bin file is now encrypted and downloads with mcumgr.

    A new issue is there appears to be a size limit to app_update.bin where encrypted DFU fails. If the app_update.bin file is greater than about 238K, encrypted DFU appears to stop working. Is there something I need to add or change in the configuration to remove the app_update.bin file size limitation?

    Best regards,

    Ray

  • 0 in reply to rdolejs

    Hi, 

    rdolejs said:
    The app_update.bin file is now encrypted and downloads with mcumgr.

    Good to hear you make it work. 

    rdolejs said:
    Is there something I need to add or change in the configuration to remove the app_update.bin file size limitation?

    I think the size is depended on the available slot's space. 

    Could you update the prj.conf and mcuboot.conf? Please run "ninja partition_manager_report" under build folder and provide the report. Thanks. 

    -Amanda

  • 0 in reply to Amanda Hsieh

    Hi,

    An error on my part on generating an encrypted app_update.bin file. I am not able to generate an encrypted file. Let's set aside the file size limitation for now.

    My test setup is a nRF52840-DK, VS Code with SDK 2.0.0 and mcumgr CLI. The starting point is the blinky example. I added the following prj.conf file:

    Fullscreen
    1
    2
    3
    4
    CONFIG_GPIO=y
    CONFIG_BOOTLOADER_MCUBOOT=y
    CONFIG_CLOCK_CONTROL_NRF_K32SRC_RC=y
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    And mcuboot.conf file:

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    CONFIG_SIZE_OPTIMIZATIONS=y
    CONFIG_PM_PARTITION_SIZE_MCUBOOT=0x10000
    CONFIG_UART_CONSOLE=n
    CONFIG_MCUBOOT_SERIAL=y
    CONFIG_BOOT_SERIAL_UART=y
    # Signature configuration
    CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
    CONFIG_BOOT_SIGNATURE_KEY_FILE="C:/Workspace/VScode/blinky/child_image/keys/mcuboot_private_sign.pem"
    # Encryption configuration
    CONFIG_BOOT_SERIAL_ENCRYPT_EC256=y
    CONFIG_BOOT_ENCRYPTION_KEY_FILE="C:/Workspace/VScode/blinky/child_image/keys/mcuboot_private_enc.pem"
    CONFIG_BOOT_ECDSA_TINYCRYPT=y
    CONFIG_SINGLE_APPLICATION_SLOT=y
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    The project compiles :

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    Executing task: nRF Connect: Build: blinky/release_build (active)
    Building blinky
    west build --build-dir c:\Workspace\VScode\blinky\release_build c:\Workspace\VScode\blinky --pristine --board nrf52840dk_nrf52840 -- -DNCS_TOOLCHAIN_VERSION:STRING="NONE" -DCONF_FILE:STRING="c:/Workspace/VScode/blinky/prj.conf"
    -- west build: generating a build system
    Loading Zephyr default modules (Zephyr base).
    -- Application: C:/Workspace/VScode/blinky
    -- Found Python3: C:/nordicsemi/toolchains/v2.0.0/opt/bin/python.exe (found suitable exact version "3.8.2") found components: Interpreter
    -- Cache files will be written to: C:/nordicsemi/v2.0.0/zephyr/.cache
    -- Zephyr version: 3.0.99 (C:/nordicsemi/v2.0.0/zephyr)
    -- Found west (found suitable version "0.13.1", minimum required is "0.7.1")
    -- Board: nrf52840dk_nrf52840
    -- Found host-tools: zephyr 0.14.1 (C:/nordicsemi/toolchains/v2.0.0/opt/zephyr-sdk)
    -- Found dtc: C:/nordicsemi/toolchains/v2.0.0/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
    -- Found toolchain: zephyr 0.14.1 (C:/nordicsemi/toolchains/v2.0.0/opt/zephyr-sdk)
    -- Found BOARD.dts: C:/nordicsemi/v2.0.0/zephyr/boards/arm/nrf52840dk_nrf52840/nrf52840dk_nrf52840.dts
    -- Generated zephyr.dts: C:/Workspace/VScode/blinky/release_build/zephyr/zephyr.dts
    -- Generated devicetree_unfixed.h: C:/Workspace/VScode/blinky/release_build/zephyr/include/generated/devicetree_unfixed.h
    -- Generated device_extern.h: C:/Workspace/VScode/blinky/release_build/zephyr/include/generated/device_extern.h
    -- Including generated dts.cmake file: C:/Workspace/VScode/blinky/release_build/zephyr/dts.cmake
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Bootloads with mcumgr:

    But the data in the app_update.bin file is not encrypted. I can match all the data in the app_update.bin file with data in the merged.hex file.

    The ninja_partition_manager_report command gave me this result. Something is not working.

    It sounds like others have encryption working. Any ideas what I have missed? Once encryption is working on the Nordic DK board we will add the updates to our custom design.

    Thanks,

    Ray

  • 0 in reply to rdolejs

    Hi,

    We made an update to another project yesterday and removed the --encrypt <insert path or symbol here that points to your key file > update to the ncs/nrf/modules/mcuboot/CMakeLists.txt file. This caused encryption to stop working. When we restored this update encryption worked again. The encryption issue is resolved.

    Here is a method to duplicate the file size limitation issue.

    My test setup is a nRF52840-DK, VS Code with SDK 2.0.0 and mcumgr CLI. The starting point is the blinky example. I added the following prj.conf file:

    Fullscreen
    1
    2
    3
    4
    CONFIG_GPIO=y
    CONFIG_BOOTLOADER_MCUBOOT=y
    CONFIG_CLOCK_CONTROL_NRF_K32SRC_RC=y
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    And mcuboot.conf file:

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    CONFIG_SIZE_OPTIMIZATIONS=y
    CONFIG_PM_PARTITION_SIZE_MCUBOOT=0x10000
    CONFIG_UART_CONSOLE=n
    CONFIG_MCUBOOT_SERIAL=y
    CONFIG_BOOT_SERIAL_UART=y
    # Signature configuration
    CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
    CONFIG_BOOT_SIGNATURE_KEY_FILE="C:/Workspace/VScode/blinky/child_image/keys/mcuboot_private_sign.pem"
    # Encryption configuration
    CONFIG_BOOT_SERIAL_ENCRYPT_EC256=y
    CONFIG_BOOT_ENCRYPTION_KEY_FILE="C:/Workspace/VScode/blinky/child_image/keys/mcuboot_private_enc.pem"
    CONFIG_BOOT_ECDSA_TINYCRYPT=y
    CONFIG_SINGLE_APPLICATION_SLOT=y
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Additional line to the ncs/nrf/modules/mcuboot/CMakeLists.txt file. This was described in the link above.

    Fullscreen
    1
    --encrypt C:/Workspace/VScode/blinky/child_image/keys/mcuboot_private_enc.pem
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Update to blinky main.c code to include an array to vary the build size of app_update.bin.

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    /*
    * Copyright (c) 2016 Intel Corporation
    *
    * SPDX-License-Identifier: Apache-2.0
    */
    #include <zephyr.h>
    #include <drivers/gpio.h>
    /* 1000 msec = 1 sec */
    #define SLEEP_TIME_MS 1000
    /* The devicetree node identifier for the "led0" alias. */
    #define LED0_NODE DT_ALIAS(led0)
    // Added array code here
    volatile static const uint8_t largeArray[20480] = {0}; // app_update.bin = 46k works
    //volatile static const uint8_t largeArray[75776] = {0}; // app_update.bin = 100k fails
    /*
    * A build error on this line means your board is unsupported.
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    The project compiles :

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    Executing task: nRF Connect: Build: blinky/release_build (active)
    Building blinky
    west build --build-dir c:\Workspace\VScode\blinky\release_build c:\Workspace\VScode\blinky --pristine --board nrf52840dk_nrf52840 -- -DNCS_TOOLCHAIN_VERSION:STRING="NONE" -DCONF_FILE:STRING="c:/Workspace/VScode/blinky/prj.conf"
    -- west build: generating a build system
    Loading Zephyr default modules (Zephyr base).
    -- Application: C:/Workspace/VScode/blinky
    -- Found Python3: C:/nordicsemi/toolchains/v2.0.0/opt/bin/python.exe (found suitable exact version "3.8.2") found components: Interpreter
    -- Cache files will be written to: C:/nordicsemi/v2.0.0/zephyr/.cache
    -- Zephyr version: 3.0.99 (C:/nordicsemi/v2.0.0/zephyr)
    -- Found west (found suitable version "0.13.1", minimum required is "0.7.1")
    -- Board: nrf52840dk_nrf52840
    -- Found host-tools: zephyr 0.14.1 (C:/nordicsemi/toolchains/v2.0.0/opt/zephyr-sdk)
    -- Found dtc: C:/nordicsemi/toolchains/v2.0.0/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
    -- Found toolchain: zephyr 0.14.1 (C:/nordicsemi/toolchains/v2.0.0/opt/zephyr-sdk)
    -- Found BOARD.dts: C:/nordicsemi/v2.0.0/zephyr/boards/arm/nrf52840dk_nrf52840/nrf52840dk_nrf52840.dts
    -- Generated zephyr.dts: C:/Workspace/VScode/blinky/release_build/zephyr/zephyr.dts
    -- Generated devicetree_unfixed.h: C:/Workspace/VScode/blinky/release_build/zephyr/include/generated/devicetree_unfixed.h
    -- Generated device_extern.h: C:/Workspace/VScode/blinky/release_build/zephyr/include/generated/device_extern.h
    -- Including generated dts.cmake file: C:/Workspace/VScode/blinky/release_build/zephyr/dts.cmake
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Flash the board and LED1 will flash once a second.

    Press Button 1 and reset to put the board into bootload mode. Bootload the board with mcumgr.

    Press the reset button and the LED should flash again indicating a successful bootload.

    If the code is built with the smaller array uint8_t largeArray[20480] the bootload will be successful. If the code is built with the larger array uint8_t largeArray[75776] the bootload will be unsuccessful.

    Encrypted bootloads appear to work when the file size is small and fail when the file size is larger. Any ideas why this might occur? There may be something we have missed in the configuration setup.

    Thanks,

    Ray

  • 0 in reply to rdolejs

    Hi, 

    From the team:

    Since we don't support encryption out-of-the-box in the SDK, we have no experience with this I'm afraid. 

    --

    I would suggest you submit the issue to mcuboot github https://github.com/mcu-tools/mcuboot/issues

    -Amanda H.
Reply Children
  • 0 in reply to Amanda Hsieh

    Hi,

    We did eventually get MCUBoot with serial UART and image encryption to work on our custom board design. Our custom board does not have a 32KHz external crystal. We needed to add the line CONFIG_CLOCK_CONTROL_NRF_K32SRC_RC=y to the mcuboot.conf file. MCUBoot worked unpredictably until that change was made. After the serial UART bootload data is transferred it takes about 20 seconds for the data to be decrypted. If your system is not prepared for that amount of time it may cause some issues.

    Best Regards,

    Ray

  • 0 in reply to rdolejs

    Where you able to get encryption working with a build that had two slots (not a single application slot) ? Curious, since it is just as important to have image encryption for secondary partitions that are on external flash.

Terms of service