Signing image and CONFIG_ROM_START_OFFSET parameter.

[JuanAlm]

Im working with nrf52840DK and nrf Connect SDK 2.2.0. 

My goal is running this sample. (SMP server sample). Let's check the described steps:

1º) I have installed the MCUMGR CLI

2º) I have built and flashed the MCUBoot

3º) I have built the sample application with the next command:

west build -b nrf52840dk_nrf52840 zephyr/samples/subsys/mgmt/mcumgr/smp_svr -- -DOVERLAY_CONFIG='overlay-serial.conf;overlay-fs.conf;overlay-shell-mgmt.conf'

4º) This step is where I got stucked... Trying to signing the image. When I run the next command:

west sign -t imgtool -- --key bootloader/mcuboot/root-rsa-2048.pem

I get the next prompt:

D:\ncs\v2.2.0>west sign -t imgtool -- --key bootloader/mcuboot/root-rsa-2048.pem
=== image configuration:
partition offset: 49152 (0xc000)
partition size: 421888 (0x67000)
rom start offset: 0 (0x0)
=== signing binaries
unsigned bin: D:\ncs\v2.2.0\build\zephyr\zephyr.bin
signed bin:   D:\ncs\v2.2.0\build\zephyr\zephyr.signed.bin
Usage: python -m imgtool sign [OPTIONS] INFILE OUTFILE
Try 'python -m imgtool sign -h' for help.

Error: Invalid value for '-H' / '--header-size': Minimum value for -H/--header-size is 32
FATAL ERROR: command exited with status 2: 'C:\Users\juan.martinez\AppData\Local\Programs\Python\Python38\Scripts\imgtool.EXE' sign --version 0.0.0+0 --align 4 --header-size 0 --slot-size 421888 --key bootloader/mcuboot/root-rsa-2048.pem 'D:\ncs\v2.2.0\build\zephyr\zephyr.bin' 'D:\ncs\v2.2.0\build\zephyr\zephyr.signed.bin'

I noticed the --header-size is 0 and it should be (the prompt says it) minimun 32... What is the exactly minimun value for it? How can I change it?

[Hung Bui]

Hi Juan, 

As the log suggested the minimum header size should be 32. 
Could you please try: 

west sign -t imgtool -- --key bootloader/mcuboot/root-rsa-2048.pem --header-size 32 --pad-header

Please note that by default if you build the image that has MCUBoot, the image is signed automatically and you can find the binary that signed and ready for DFU transferring. Please look for app_update.bin in the build folder. You don't have to call west sign to sign the image. You can also change the key if you want by modify the config option. 

Please see here: developer.nordicsemi.com/.../readme-ncs.html

[JuanAlm]

Nice! Now it can be signed correctly and zephyr.signed.bin has been generated and flashed!

But now appears a new problem, I cant echo nothing:

 

root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM0,baud=115200" echo hello
Error: NMP timeout

root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM1,baud=115200" echo hello
Error: NMP timeout

ACM0 and ACM1 are the ports that appears when I connect the nrf52840DK. I have disables Mass Storage Device.

[JuanAlm]

My last problem:

I can see my image list:

root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM0,baud=115200" image list
Images:
 image=0 slot=0
    version: 0.0.0
    bootable: true
    flags: active confirmed
    hash: 8893d1a1fccdb1719a0d937eb9fffdd98d809c3baa3c6dd2f946fab9ebf4dd84
Split status: N/A (0)

After rebuilding the sample, I have signed it and uploaded.

root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM0,baud=115200" image upload -e /zephyr.signed_
zephyr.signed_1.bin           zephyr.signed_2.bin           zephyr.signed_3.bin           zephyr.signed_serial_dfu.bin
root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM0,baud=115200" image upload -e /zephyr.signed_serial_dfu.bin
 42.30 KiB / 42.30 KiB [====================================================================================================================================================================] 100.00% 3.43 KiB/s 12s
Done


root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM0,baud=115200" image list
Images:
 image=0 slot=0
    version: 0.0.0
    bootable: true
    flags: active confirmed
    hash: 8893d1a1fccdb1719a0d937eb9fffdd98d809c3baa3c6dd2f946fab9ebf4dd84
 image=0 slot=1
    version: 0.0.0
    bootable: true
    flags:
    hash: 6628576c399e33d147b891fa055a82583d1fa112ba71841128d895c2a0df12e7
Split status: N/A (0)

I selected the new firmware to swap after reseting:

root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM0,baud=115200" image test 6628576c399e33d147b891fa055a82583d1fa112ba71841128d895c2a0df12e7
Images:
 image=0 slot=0
    version: 0.0.0
    bootable: true
    flags: active confirmed
    hash: 8893d1a1fccdb1719a0d937eb9fffdd98d809c3baa3c6dd2f946fab9ebf4dd84
 image=0 slot=1
    version: 0.0.0
    bootable: true
    flags: pending
    hash: 6628576c399e33d147b891fa055a82583d1fa112ba71841128d895c2a0df12e7
Split status: N/A (0)

But it doesn't work:

root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM0,baud=115200" reset
Done



root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM0,baud=115200" image list
Images:
 image=0 slot=0
    version: 0.0.0
    bootable: true
    flags: active confirmed
    hash: 8893d1a1fccdb1719a0d937eb9fffdd98d809c3baa3c6dd2f946fab9ebf4dd84
Split status: N/A (0)

[Hung Bui]

Hi Juan, 

It's very strange that UART doesn't work but shell work. They both use the same UART interface. 

I would suggest to try testing more with UART to see if there is anything wrong here. . 

[JuanAlm]

Ok, what test do you suggest?

PD: I think we wrote at the same time and maybe you didnt notice my previous message to your last reply. =)

[Hung Bui]

Have you tried to test with any UART example ? Please use the uart sample in the SDK. 

Regarding your last question, could you please try confirm instead of test ? 
Could you check the RTT log when you do confirm / test ? 

I would suggest to try putting some LED blink in the application so that you know when the new firmware is running you can detect it with the LED (you can change the blink rate for example, or change the LED pin on the new image that you update) 

[JuanAlm]

I have tried the sample echo_bot and it's working perfectly, connected via Visual Studio Code in windows.

I have noticed that there is problems when I echo something with the Serial_DFU_hello_world but SMP server sample works like a charm:

If I try to confirm, it works correctly:

root@gcu1:~# mcumgr --conntype serial --connstring "/dev/ttyACM0,baud=115200" image confirm 9c2a99413194f11d9a4e00ff7396854e5dae14220bac5f1786e6a2f73d8fa143
Images:
 image=0 slot=0
    version: 0.0.0
    bootable: true
    flags: active confirmed
    hash: 8893d1a1fccdb1719a0d937eb9fffdd98d809c3baa3c6dd2f946fab9ebf4dd84
 image=0 slot=1
    version: 0.0.0
    bootable: true
    flags: pending permanent
    hash: 9c2a99413194f11d9a4e00ff7396854e5dae14220bac5f1786e6a2f73d8fa143

But after the reset, the board doesnt work... I will put the led to blink for detecting the board is working...

Have I to check the key file to sign the file to update¿? Maybe its not the same than the MCUBoot has?