Secure mcuboot usage, dfu-util and OTA query

Official Hardware Mega GIGA R1 WiFi
1

Hi,

I am working through the documentation here which says that once I have flashed my encryption and signing key I can run this command to upload a signed and encrypted .bin file.

dfu-util --device 0x2341:0x035b -D update.ino.bin -a2 --dfuse-address=0xA0000000:leave

The docs say this is going to upload to QSPI but I guess I don’t understand the address because I’ve yet to workout the difference between these things.

const uint32_t QSPIFLASH_BASE_ADDRESS   =  0x90000000;
const uint32_t FILEBLOCK_BASE_ADDRESS   =  0xA0000000;

My other question is how this interacts with OTA. OTA setup (as described by Arduino) requires QSPI is partitioned to include a second partition which starts after the partition reserved for the WiFi firmware. In the OTA examples this second partition is FAT, it's not treated as a memory mapped blob. FAT has a bunch of metadata (e.g, file allocation table and directory table for root) before any files. When I'm uploading locally (as opposed to via OTA) is using the address 0xA0000000 going to trash my OTA setup, aka partitions and filesystem formats on QSPI?

2

Ok, I get this, 0xA… is essentially a virtual address indicating “upload to dfu_secondary_bd“. This in turn, depending on the storage type, will map to a raw view of the partition, a FAT view or an LFS view. At least this is how I am reading the code.

3

In order to make all relevant information available to any who are interested in this subject, I'll share a link to the related discussion here:

One of the Arduino developers gave an explanation there:

Does the above command trash any partitioning and formatting done?

The dfu-util command will preserve the FAT partition, the command will create a UPDATE.BIN file inside the 2nd partition of the QSPI flash.

I guess I want to know if I can upload directly to the device, deploy it and upload via OTA or whether I have to do some QSPI reformatting post-local deployment?

The 2nd partition is present on all the boards as per default factory partitioning; as long as you don't change the partition table of the QSPI flash you don't need any reformatting

Finally, can I upload signed and encrypted bin files via arduino-cli and skip the interim stem of loading to QSPI first?

Yes it should be possible using the -b switch

-b arduino:mbed_portenta:envie_m7:security=sien

4

Thanks. I found the code that does this in the boot loader .