Perform FOTA to application built with SPM with application built with TFM

Dear All,

We are want to transition from SDK v1.6.0 to 2.1.0.

At the moment we have several devices that are were programmed with the SPM and now we want to be able to do FOTA on them to version 2.1.0 with the application using TFM.

Preliminary tests are not showing promising results, as the device simply reverts back to the original firmware that was on the device.

Is there perhaps an intermediate step that would be advised?

Parents Reply Children
  •  

    Thank you for the response.

    From what I see the fix you are suggesting is to be applied on v1.6.0, correct?

    If yes, then the proposed fix is not helpful, as we have devices on the field that we cannot receive back and what we want to do is to be able to send them a FOTA file that will be compiled using SDK v2.1.0, preferably using TFM (as SPM is depracated).

    I am not sure how to get the logs for the reverting. This is what I have:

    11:19:12.758 -> *** Booting Zephyr OS build v2.6.0-rc1-ncs1  ***
    11:19:12.758 -> I: Starting bootloader
    11:19:12.758 -> I: Primary image: magic=good, swap_type=0x4, copy_done=0x1, image_ok=0x1
    11:19:12.758 -> I: Secondary image: magic=good, swap_type=0x2, copy_done=0x3, image_ok=0x3
    11:19:12.758 -> I: Boot source: none
    11:19:12.758 -> I: Swap type: test
    11:19:49.386 -> I: Bootloader chainload address offset: 0x10000
    11:19:49.386 -> I: Jumping to the first image slot
    *** Booting Zephyr OS build v2.6.0-rc1-ncs1  ***
    11:21:49.434 -> I: Starting bootloader
    11:21:49.434 -> I: Primary image: magic=good, swap_type=0x2, copy_done=0x1, image_ok=0x3
    11:21:49.434 -> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
    11:21:49.434 -> I: Boot source: none
    11:21:49.434 -> I: Swap type: revert
    11:21:49.812 -> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
    11:22:26.658 -> I: Bootloader chainload address offset: 0x10000
    11:22:26.658 -> I: Jumping to the first image slot
    *** Booting Zephyr OS build v2.6.0-rc1-ncs1  ***
    11:22:26.942 -> Flash regions		Domain		Permissions
    11:22:26.942 -> 00 03 0x00000 0x20000 	Secure		rwxl
    11:22:26.942 -> 04 31 0x20000 0x100000 	Non-Secure	rwxl
    11:22:26.942 -> 
    11:22:26.942 -> Non-secure callable region 0 placed in flash region 3 with size 32.
    11:22:26.942 -> 
    11:22:27.128 -> SRAM region		Domain		Permissions
    11:22:27.128 -> 00 07 0x00000 0x10000 	Secure		rwxl
    11:22:27.128 -> 08 31 0x10000 0x40000 	Non-Secure	rwxl


    The device resets due to the hardware watchdog that is set to expire in 2 minutes in the original application (I have tried it as well with 3 mins timeout, same results).

    I also tried to send a FOTA file using the wrong key and that was rejected immediately.

    So effectively what I think that I am looking at is that the MCuboot fails to start the application. Could it be that there is a difference in MCuboot versions used in the different nRF SDKs?

    Is there maybe a fix that you can propose for SDK 2.1.0 as we are not able to change anything on devices working with previous versions?

  • Could it be that we are missing some Kconfig?

    This is what I am using right now:

    CONFIG_BOOTLOADER_MCUBOOT=y
    CONFIG_IMG_MANAGER=y
    CONFIG_IMG_ERASE_PROGRESSIVELY=y
    CONFIG_MCUBOOT_IMG_MANAGER=y
    CONFIG_SECURE_BOOT=y
    CONFIG_DFU_TARGET_MCUBOOT=y
    
    CONFIG_DFU_TARGET=y
    CONFIG_MODEM_KEY_MGMT=y
    CONFIG_DOWNLOAD_CLIENT=y
    CONFIG_DOWNLOAD_CLIENT_STACK_SIZE=4096
    CONFIG_FOTA_DOWNLOAD=y
    
    CONFIG_REBOOT=y
    CONFIG_JSON_LIBRARY=y
    
    CONFIG_FLASH=y
    CONFIG_FLASH_PAGE_LAYOUT=y
    CONFIG_MPU_ALLOW_FLASH_WRITE=y
    CONFIG_NVS=y

  • And to add a little bit more information, when programming the device with the firmware that is to be FOTA-ed, the MCuboot prints out this information:

    11:52:56.408 -> 
    *** Booting Zephyr OS build v3.1.99-ncs1  ***
    11:56:14.056 -> Attempting to boot slot 0.
    
    11:56:14.056 -> Attempting to boot from address 0x8200.
    11:56:14.056 -> 
    Verifying signature against key 0.
    11:56:14.056 -> 
    Hash: 0x16...2e
    
    11:56:14.056 -> Firmware signature verified.
    11:56:14.056 -> 
    Firmware version 1
    
    11:56:14.102 -> Setting monotonic counter (version: 1, slot: 0)
    
    11:56:14.102 -> Booting (0x8200).
    
    *** Booting Zephyr OS build v3.1.99-ncs1  ***
    11:56:14.527 -> I: Starting bootloader
    11:56:14.527 -> I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
    11:56:14.527 -> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
    11:56:14.527 -> I: Boot source: none
    11:56:14.527 -> I: Swap type: none
    11:56:14.527 -> I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
    11:56:14.527 -> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
    11:56:14.527 -> I: Boot source: none
    11:56:14.527 -> I: Swap type: none
    11:56:14.856 -> I: Bootloader chainload address offset: 0x28000
    11:56:14.856 -> I: Jumping to the first image slot
    *** Booting Zephyr OS build v3.1.99-ncs1  ***
    


    And there it is obvious that the MCuboot is looking for an application start to a different address (0x8200) in SDK 2.1.0, instead of 0x10000 that is using on the SDK v1.6.0.

    I hope this information is a bit more helpful

  • Hi,

    the start address is interesting, lets look a bit more into that.

    Can you take your project before and after, and upload their build/partitions.yml?

    Regards,
    Sigurd Hellesvik

  •  

    The partions.yml of the orignal project is this:

    EMPTY_0:
      address: 0xc000
      end_address: 0x10000
      placement:
        before:
        - mcuboot_pad
      region: flash_primary
      size: 0x4000
    EMPTY_1:
      address: 0xf0000
      end_address: 0xfa000
      placement:
        after:
        - mcuboot_secondary
      region: flash_primary
      size: 0xa000
    app:
      address: 0x20200
      end_address: 0x80000
      region: flash_primary
      size: 0x5fe00
    mcuboot:
      address: 0x0
      end_address: 0xc000
      placement:
        before:
        - mcuboot_primary
      region: flash_primary
      size: 0xc000
    mcuboot_pad:
      address: 0x10000
      end_address: 0x10200
      placement:
        align:
          start: 0x8000
        before:
        - mcuboot_primary_app
      region: flash_primary
      size: 0x200
    mcuboot_primary:
      address: 0x10000
      end_address: 0x80000
      orig_span: &id001
      - spm
      - app
      - mcuboot_pad
      region: flash_primary
      sharers: 0x1
      size: 0x70000
      span: *id001
    mcuboot_primary_app:
      address: 0x10200
      end_address: 0x80000
      orig_span: &id002
      - app
      - spm
      region: flash_primary
      size: 0x6fe00
      span: *id002
    mcuboot_secondary:
      address: 0x80000
      end_address: 0xf0000
      placement:
        after:
        - mcuboot_primary
        align:
          start: 0x8000
      region: flash_primary
      share_size:
      - mcuboot_primary
      size: 0x70000
    nrf_modem_lib_ctrl:
      address: 0x20010000
      end_address: 0x200104e8
      inside:
      - sram_nonsecure
      placement:
        after:
        - spm_sram
        - start
      region: sram_primary
      size: 0x4e8
    nrf_modem_lib_rx:
      address: 0x200124e8
      end_address: 0x200144e8
      inside:
      - sram_nonsecure
      placement:
        after:
        - nrf_modem_lib_tx
      region: sram_primary
      size: 0x2000
    nrf_modem_lib_sram:
      address: 0x20010000
      end_address: 0x200144e8
      orig_span: &id003
      - nrf_modem_lib_ctrl
      - nrf_modem_lib_tx
      - nrf_modem_lib_rx
      region: sram_primary
      size: 0x44e8
      span: *id003
    nrf_modem_lib_tx:
      address: 0x200104e8
      end_address: 0x200124e8
      inside:
      - sram_nonsecure
      placement:
        after:
        - nrf_modem_lib_ctrl
      region: sram_primary
      size: 0x2000
    nvs_storage:
      address: 0xfa000
      end_address: 0x100000
      placement:
        before:
        - end
      region: flash_primary
      size: 0x6000
    otp:
      address: 0xff8108
      end_address: 0xff83fc
      region: otp
      size: 0x2f4
    spm:
      address: 0x10200
      end_address: 0x20200
      inside:
      - mcuboot_primary_app
      placement:
        before:
        - app
      region: flash_primary
      size: 0x10000
    spm_sram:
      address: 0x20000000
      end_address: 0x20010000
      inside:
      - sram_secure
      placement:
        after:
        - start
      region: sram_primary
      size: 0x10000
    sram_nonsecure:
      address: 0x20010000
      end_address: 0x20040000
      orig_span: &id004
      - sram_primary
      - nrf_modem_lib_ctrl
      - nrf_modem_lib_tx
      - nrf_modem_lib_rx
      region: sram_primary
      size: 0x30000
      span: *id004
    sram_primary:
      address: 0x200144e8
      end_address: 0x20040000
      region: sram_primary
      size: 0x2bb18
    sram_secure:
      address: 0x20000000
      end_address: 0x20010000
      orig_span: &id005
      - spm_sram
      region: sram_primary
      size: 0x10000
      span: *id005
    


    And from the new project is this:

    EMPTY_0:
      address: 0x14200
      end_address: 0x18000
      placement:
        before:
        - s1_pad
      region: flash_primary
      size: 0x3e00
    EMPTY_1:
      address: 0x24200
      end_address: 0x28000
      placement:
        before:
        - mcuboot_pad
      region: flash_primary
      size: 0x3e00
    EMPTY_2:
      address: 0xfe000
      end_address: 0x100000
      placement:
        after:
        - nvs_storage
      region: flash_primary
      size: 0x2000
    app:
      address: 0x30200
      end_address: 0x90000
      region: flash_primary
      size: 0x5fe00
    app_image:
      address: 0x28200
      end_address: 0x90000
      orig_span: &id001
      - tfm
      - app
      region: flash_primary
      size: 0x67e00
      span: *id001
    b0:
      address: 0x0
      end_address: 0x8000
      placement:
        after:
        - start
      region: flash_primary
      size: 0x8000
    b0_container:
      address: 0x0
      end_address: 0x8000
      orig_span: &id002
      - b0
      region: flash_primary
      size: 0x8000
      span: *id002
    mcuboot:
      address: 0x8200
      end_address: 0x14200
      placement:
        before:
        - mcuboot_primary
      region: flash_primary
      sharers: 0x1
      size: 0xc000
    mcuboot_pad:
      address: 0x28000
      end_address: 0x28200
      placement:
        align:
          start: 0x8000
        before:
        - mcuboot_primary_app
      region: flash_primary
      sharers: 0x2
      size: 0x200
    mcuboot_primary:
      address: 0x28000
      end_address: 0x90000
      orig_span: &id003
      - mcuboot_pad
      - app
      - tfm
      region: flash_primary
      sharers: 0x1
      size: 0x68000
      span: *id003
    mcuboot_primary_app:
      address: 0x28200
      end_address: 0x90000
      orig_span: &id004
      - app
      - tfm
      region: flash_primary
      size: 0x67e00
      span: *id004
    mcuboot_secondary:
      address: 0x90000
      end_address: 0xf8000
      placement:
        after:
        - mcuboot_primary
        align:
          start: 0x8000
      region: flash_primary
      share_size:
      - mcuboot_primary
      size: 0x68000
    nonsecure_storage:
      address: 0xf8000
      end_address: 0xfe000
      orig_span: &id005
      - nvs_storage
      region: flash_primary
      size: 0x6000
      span: *id005
    nrf_modem_lib_ctrl:
      address: 0x20008000
      end_address: 0x200084e8
      inside:
      - sram_nonsecure
      placement:
        after:
        - tfm_sram
        - start
      region: sram_primary
      size: 0x4e8
    nrf_modem_lib_rx:
      address: 0x2000a4e8
      end_address: 0x2000c4e8
      inside:
      - sram_nonsecure
      placement:
        after:
        - nrf_modem_lib_tx
      region: sram_primary
      size: 0x2000
    nrf_modem_lib_sram:
      address: 0x20008000
      end_address: 0x2000c4e8
      orig_span: &id006
      - nrf_modem_lib_ctrl
      - nrf_modem_lib_tx
      - nrf_modem_lib_rx
      region: sram_primary
      size: 0x44e8
      span: *id006
    nrf_modem_lib_tx:
      address: 0x200084e8
      end_address: 0x2000a4e8
      inside:
      - sram_nonsecure
      placement:
        after:
        - nrf_modem_lib_ctrl
      region: sram_primary
      size: 0x2000
    nvs_storage:
      address: 0xf8000
      align:
        start: 0x8000
      end_address: 0xfe000
      inside:
      - nonsecure_storage
      placement:
        align:
          start: 0x8000
        before:
        - end
      region: flash_primary
      size: 0x6000
    otp:
      address: 0xff8388
      end_address: 0xff83fc
      region: otp
      size: 0x74
    provision:
      address: 0xff8108
      end_address: 0xff8388
      region: otp
      size: 0x280
    s0:
      address: 0x8000
      end_address: 0x14200
      orig_span: &id007
      - mcuboot
      - s0_pad
      region: flash_primary
      size: 0xc200
      span: *id007
    s0_image:
      address: 0x8200
      end_address: 0x14200
      orig_span: &id008
      - mcuboot
      region: flash_primary
      size: 0xc000
      span: *id008
    s0_pad:
      address: 0x8000
      end_address: 0x8200
      placement:
        after:
        - b0_container
        align:
          start: 0x8000
      region: flash_primary
      share_size:
      - mcuboot_pad
      size: 0x200
    s1:
      address: 0x18000
      end_address: 0x24200
      orig_span: &id009
      - s1_pad
      - s1_image
      region: flash_primary
      size: 0xc200
      span: *id009
    s1_image:
      address: 0x18200
      end_address: 0x24200
      placement:
        after:
        - s1_pad
        - s0
      region: flash_primary
      share_size:
      - mcuboot
      size: 0xc000
    s1_pad:
      address: 0x18000
      end_address: 0x18200
      placement:
        after:
        - s0
        align:
          start: 0x8000
      region: flash_primary
      share_size:
      - mcuboot_pad
      size: 0x200
    sram_nonsecure:
      address: 0x20008000
      end_address: 0x20040000
      orig_span: &id010
      - sram_primary
      - nrf_modem_lib_ctrl
      - nrf_modem_lib_tx
      - nrf_modem_lib_rx
      region: sram_primary
      size: 0x38000
      span: *id010
    sram_primary:
      address: 0x2000c4e8
      end_address: 0x20040000
      region: sram_primary
      size: 0x33b18
    sram_secure:
      address: 0x20000000
      end_address: 0x20008000
      orig_span: &id011
      - tfm_sram
      region: sram_primary
      size: 0x8000
      span: *id011
    tfm:
      address: 0x28200
      end_address: 0x30200
      inside:
      - mcuboot_primary_app
      placement:
        before:
        - app
      region: flash_primary
      size: 0x8000
    tfm_nonsecure:
      address: 0x30200
      end_address: 0x90000
      orig_span: &id012
      - app
      region: flash_primary
      size: 0x5fe00
      span: *id012
    tfm_secure:
      address: 0x28000
      end_address: 0x30200
      orig_span: &id013
      - mcuboot_pad
      - tfm
      region: flash_primary
      size: 0x8200
      span: *id013
    tfm_sram:
      address: 0x20000000
      end_address: 0x20008000
      inside:
      - sram_secure
      placement:
        after:
        - start
      region: sram_primary
      size: 0x8000
    

Related