We have switched over to the new device tree based partition scheme, and developed custom board files with not-secure variant and mcuboot for ota.
OTA was tested using BLE DFU, and all is working, including KMU. However, when making use of CONFIG_MCUBOOT_SHELL, to get information about the image at runtime, we ran into an issue with the `mcuboot` shell command. This issue was only present when building for the 'ns' board variant.
When run, the command fails to read the header of image 0. However we know that image 0 has a valid header as the image was able to boot, and the command was run during runtime.
When building for the default (not ns) variant we got this (the secondary image failure is expected as there was no image present in the secondary slot at the time, however it does work when there is):
What we had determined on our end, was that the issue arose from the different in expected partition names between mcuboot and the ns application.
Mcuboot always inherited the base devicetree from the default variant. Within our dts partitions, we have slot0_partition and slot0_ns_partition, but because we are building for the ns variant, when mcuboot_priv.h evaluates this:
#ifndef ZEPHYR_DFU_BOOT_MCUBOOT_H_ #define ZEPHYR_DFU_BOOT_MCUBOOT_H_ #include <zephyr/storage/flash_map.h> #ifdef CONFIG_TRUSTED_EXECUTION_NONSECURE #define SLOT0_LABEL slot0_ns_partition #define SLOT1_LABEL slot1_ns_partition #else #define SLOT0_LABEL slot0_partition #define SLOT1_LABEL slot1_partition #endif /* CONFIG_TRUSTED_EXECUTION_NONSECURE */ /* PARTITION_ID() values used below are auto-generated by DT */ #define FLASH_AREA_IMAGE_PRIMARY PARTITION_ID(SLOT0_LABEL) #if PARTITION_EXISTS(SLOT1_LABEL) #define FLASH_AREA_IMAGE_SECONDARY PARTITION_ID(SLOT1_LABEL) #endif
It sees CONFIG_TRUSTED_EXECUTION_NONSECURE=y, and selects slot0_ns_partition as the label, but this does not contain the image header, the image header is at the start of the image, in the slot0_partition. I verified this by modifying `boot_read_v1_header()` in mcuboot.c to force it to read from partition id 8 which in our partition layout corresponds to slot0_partition, and the command executes without issue.
As for the partition layout, we have a single partition.dtsi file that is included in both the default and ns variant builds to avoid compile time errors due to redefining partitions with different starting addresses.
