Using the nRF secure immutable bootloader to update the application core

[Ryisen]

Hi everyone,

I'm using an nRF 5340-DK and want to update the application core firmware by using the nRF secure immutable bootloader. The bootloader and the network core do not need to be updated.

I used the example project "central_bas" where I added the bootloader by adding "CONFIG_SECURE_BOOT=y" to the prj.conf file. The bootloader works as it gives the expected output to a e.g. Putty console.

Now what I don't unterstand is how to send application firmware images to the bootloader in order to update the application core. I couldn't find any examples in the official nRF Connect SDK documentation. For this I am using nRF Connect SDK v1.9.0.

For testing I tried to program the application core with nrfjprog, but it would give me an error saying that "readback protection" is enabled and I have to flash the complete application core.

What I try to achieve is to send new firmware images to the bootloader, which updates the current firmware on the application core.

Best regards,

Alex

[Ryisen]

I found the option of "CONFIG_BUILD_S1_VARIANT=y", but CMake throws an error if I add this to the prj.conf file.

How can I build for S1 as the target?

[Ryisen]

It says "BOARD is not being defined on the CMake command-line in the environment or by the app."

[Amanda Hsieh]

Hi, 

I'm using an nRF 5340-DK and want to update the application core firmware by using the nRF secure immutable bootloader. The bootloader and the network core do not need to be updated.

Please check out the nRF Secure Immutable Bootloader. 

Now what I don't unterstand is how to send application firmware images to the bootloader in order to update the application core. I couldn't find any examples in the official nRF Connect SDK documentation. For this I am using nRF Connect SDK v1.9.0.

How would you want to send the image to the bootloader to update the app core?

See the note:

Currently, this immutable bootloader does not support firmware updates over the SMP transport for either an upgradable bootloader or an application. If the application using this bootloader requires SMP-based firmware updates, such as Bluetooth LE DFU, include MCUboot as a second-stage bootloader.

For testing I tried to program the application core with nrfjprog, but it would give me an error saying that "readback protection" is enabled and I have to flash the complete application core.

See the Readback protection section. 

Ryisen said:

I found the option of "CONFIG_BUILD_S1_VARIANT=y", but CMake throws an error if I add this to the prj.conf file.

How can I build for S1 as the target?

Which sample are you using?

I build the hello_world with the following command and cannot reproduce the issue. 

west build -b nrf5340dk_nrf5340_cpuapp zephyr/samples/hello_world -- -DCONFIG_SECURE_BOOT=y -DCONFIG_BOOTLOADER_MCUBOOT=y -DCONFIG_BUILD_S1_VARIANT=y

Regards,
Amanda

[Ryisen]

Hi Amanda,

thanks for your insight.

I'm using the central_bas sample project.

For testing purposes, I was trying to reproduce this section: Revoking private keys

There the update process seems to work without MCUBoot as second stage bootloader.

Am I missing something there?

I tried the hello_world zephyr sample with both bootloaders, I added the following to the prj.conf file:

CONFIG_SECURE_BOOT=y
CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_BUILD_S1_VARIANT=y

However, I get the following error message:

Creating solution hello_world.emProject
-- Application: C:/ncs/v1.9.0/zephyr/samples/hello_world
-- Zephyr version: 2.7.99 (C:/ncs/v1.9.0/zephyr), build: v2.7.99-ncs1
-- Found west (found suitable version "0.12.0", minimum required is "0.7.1")
-- Board: nrf5340dk_nrf5340_cpuapp
-- Cache files will be written to: C:/ncs/v1.9.0/zephyr/.cache
-- Found dtc: C:/ncs/v1.9.0/toolchain/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (C:/ncs/v1.9.0/toolchain/opt)
-- Found BOARD.dts: C:/ncs/v1.9.0/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp.dts
-- Generated zephyr.dts: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/zephyr/dts.cmake
Parsing C:/ncs/v1.9.0/zephyr/Kconfig
Loaded configuration 'C:/ncs/v1.9.0/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp_defconfig'
Merged configuration 'C:/ncs/v1.9.0/zephyr/samples/hello_world/prj.conf'
Configuration saved to 'C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/zephyr/.config'
Kconfig header saved to 'C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/zephyr/include/generated/autoconf.h'
loading initial cache file C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/child_image_preload.cmake
-- Application: C:/ncs/v1.9.0/nrf/samples/bootloader
-- Zephyr version: 2.7.99 (C:/ncs/v1.9.0/zephyr), build: v2.7.99-ncs1
-- Found west (found suitable version "0.12.0", minimum required is "0.7.1")
-- Board: nrf5340dk_nrf5340_cpuapp
-- Cache files will be written to: C:/ncs/v1.9.0/zephyr/.cache
-- Found dtc: C:/ncs/v1.9.0/toolchain/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (C:/ncs/v1.9.0/toolchain/opt)
-- Found BOARD.dts: C:/ncs/v1.9.0/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp.dts
-- Generated zephyr.dts: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/zephyr/dts.cmake
Parsing C:/ncs/v1.9.0/zephyr/Kconfig
Loaded configuration 'C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/zephyr/.config'
No change to configuration in 'C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/zephyr/.config'
No change to Kconfig header in 'C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/zephyr/include/generated/autoconf.h'
-- Configuring done
-- Generating done
-- Build files have been written to: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0
loading initial cache file C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/child_image_preload.cmake
-- Application: C:/ncs/v1.9.0/bootloader/mcuboot/boot/zephyr
-- Zephyr version: 2.7.99 (C:/ncs/v1.9.0/zephyr), build: v2.7.99-ncs1
-- Found west (found suitable version "0.12.0", minimum required is "0.7.1")
-- Board: nrf5340dk_nrf5340_cpuapp
-- Cache files will be written to: C:/ncs/v1.9.0/zephyr/.cache
-- Found dtc: C:/ncs/v1.9.0/toolchain/opt/bin/dtc.exe (found suitable version "1.4.7", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (C:/ncs/v1.9.0/toolchain/opt)
-- Found BOARD.dts: C:/ncs/v1.9.0/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp.dts
-- Found devicetree overlay: C:/ncs/v1.9.0/nrf/modules/mcuboot/usb.overlay
-- Found devicetree overlay: C:/ncs/v1.9.0/bootloader/mcuboot/boot/zephyr/dts.overlay
-- Generated zephyr.dts: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/zephyr/dts.cmake
Parsing C:/ncs/v1.9.0/bootloader/mcuboot/boot/zephyr/Kconfig
Loaded configuration 'C:/ncs/v1.9.0/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp_defconfig'
Merged configuration 'C:/ncs/v1.9.0/bootloader/mcuboot/boot/zephyr/prj.conf'
Merged configuration 'C:/ncs/v1.9.0/nrf/subsys/bootloader/image/log_minimal.conf'
Merged configuration 'C:/ncs/v1.9.0/nrf/subsys/bootloader/image/multi_image_mcuboot.conf'
Merged configuration 'C:/ncs/v1.9.0/nrf/subsys/bootloader/image/fw_info.conf'
Merged configuration 'C:/ncs/v1.9.0/nrf/subsys/partition_manager/partition_manager_enabled.conf'
Merged configuration 'C:/ncs/v1.9.0/nrf/subsys/bootloader/image/build_s1.conf'
Merged configuration 'C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/zephyr/misc/generated/extra_kconfig_options.conf'
Configuration saved to 'C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/zephyr/.config'
Kconfig header saved to 'C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/zephyr/include/generated/autoconf.h'
-- Configuring done
-- Generating done
-- Build files have been written to: C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot
loading initial cache file C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/child_image_preload.cmake
-- Configuring incomplete, errors occurred!
See also "C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/CMakeFiles/CMakeOutput.log".
See also "C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/CMakeFiles/CMakeError.log".
Including boilerplate (Zephyr base (cached)): C:/ncs/v1.9.0/zephyr/cmake/app/boilerplate.cmake
-- Using NCS Toolchain 1.9.0 for building. (C:/ncs/v1.9.0/toolchain/cmake)
C:\ncs\v1.9.0\toolchain\opt\bin\arm-none-eabi-gdb.exe: warning: Couldn't determine a path for the index cache directory.

=== child image b0 -  begin ===
CMake Warning (dev) at C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/child_image_preload.cmake:9 (set):
  Syntax error in cmake code at

    C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/b0/child_image_preload.cmake:9

  when parsing string

    C:\ncs\v1.9.0\toolchain\segger_embedded_studio/html/configure_nordic_project_menuconfig.py

  Invalid escape sequence \v

  Policy CMP0010 is not set: Bad variable reference syntax is an error.  Run
  "cmake --help-policy CMP0010" for policy details.  Use the cmake_policy
  command to set the policy and suppress this warning.
This warning is for project developers.  Use -Wno-dev to suppress it.

Including boilerplate (Zephyr base (cached)): C:/ncs/v1.9.0/zephyr/cmake/app/boilerplate.cmake
-- Using NCS Toolchain 1.9.0 for building. (C:/ncs/v1.9.0/toolchain/cmake)
C:\ncs\v1.9.0\toolchain\opt\bin\arm-none-eabi-gdb.exe: warning: Couldn't determine a path for the index cache directory.
CMake Warning at ../../subsys/bootloader/CMakeLists.txt:21 (message):
  

        --------------------------------------------------------
        --- WARNING: When using the immutable bootloader on  ---
        --- this SoC, the UICR must be erased when flashing. ---
        --- E.g. by calling 'west flash --erase'             ---
        --------------------------------------------------------


=== child image b0 -  end ===


=== child image mcuboot -  begin ===
CMake Warning (dev) at C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/child_image_preload.cmake:9 (set):
  Syntax error in cmake code at

    C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/child_image_preload.cmake:9

  when parsing string

    C:\ncs\v1.9.0\toolchain\segger_embedded_studio/html/configure_nordic_project_menuconfig.py

  Invalid escape sequence \v

  Policy CMP0010 is not set: Bad variable reference syntax is an error.  Run
  "cmake --help-policy CMP0010" for policy details.  Use the cmake_policy
  command to set the policy and suppress this warning.
This warning is for project developers.  Use -Wno-dev to suppress it.

Including boilerplate (Zephyr base (cached)): C:/ncs/v1.9.0/zephyr/cmake/app/boilerplate.cmake
-- Using NCS Toolchain 1.9.0 for building. (C:/ncs/v1.9.0/toolchain/cmake)
C:\ncs\v1.9.0\toolchain\opt\bin\arm-none-eabi-gdb.exe: warning: Couldn't determine a path for the index cache directory.
MCUBoot bootloader key file: C:/ncs/v1.9.0/bootloader/mcuboot/root-rsa-2048.pem
=== child image mcuboot -  end ===


=== child image s1_image -  begin ===
CMake Warning (dev) at C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/child_image_preload.cmake:9 (set):
  Syntax error in cmake code at

    C:/ncs/v1.9.0/zephyr/samples/hello_world/build_nrf5340dk_nrf5340_cpuapp/mcuboot/child_image_preload.cmake:9

  when parsing string

    C:\ncs\v1.9.0\toolchain\segger_embedded_studio/html/configure_nordic_project_menuconfig.py

  Invalid escape sequence \v

  Policy CMP0010 is not set: Bad variable reference syntax is an error.  Run
  "cmake --help-policy CMP0010" for policy details.  Use the cmake_policy
  command to set the policy and suppress this warning.
This warning is for project developers.  Use -Wno-dev to suppress it.

CMake Error: The source "C:/ncs/v1.9.0/bootloader/mcuboot/boot/zephyr/CMakeLists.txt" does not match the source "C:/ncs/v1.9.0/zephyr/samples/hello_world/CMakeLists.txt" used to generate cache.  Re-run cmake with a different source directory.
CMake Error at C:/ncs/v1.9.0/nrf/cmake/multi_image.cmake:409 (message):
  CMake generation for s1_image failed, aborting.  Command: 1
Call Stack (most recent call first):
  C:/ncs/v1.9.0/nrf/cmake/multi_image.cmake:150 (add_child_image_from_source)
  C:/ncs/v1.9.0/nrf/modules/mcuboot/CMakeLists.txt:222 (add_child_image)



error: cmake failed
create_nordic_project.py failed (1)

Any idea how to fix this?

Best Regards,

Alex

[Amanda Hsieh]

Hi Alex,

Please try to delete the build folder and compile it again. 

-Amanda