I am working on the NXP MCXE31B and using the MCUboot mcuboot_opensource example as the bootloader.
My goal is to implement OTA firmware updates by flashing the secondary slot via SPI using LPSPI in slave mode.
OTA Flow
- The secondary firmware image is generated using the imgtool utility.
- The image is transmitted from the SPI master in 256-byte chunks.
- On the receiver side, the firmware receives the SPI data and writes it into the secondary slot using mflash_drv_page_program().
- After the transfer is completed, the bootloader API boot_set_pending() is called to mark the image for swap.
Bootloader Behavior
After resetting the board, the bootloader prints the following log:
Bootloader Version 2.2.0
Image index: 0, Swap type: test
Image is invalid, erasing...
Image in the secondary slot is not valid!
Bootloader chainload address offset: 0x500000
Reset_Handler address offset: 0x500400
Jumping to the image
Image Header Verification
To verify the received image, I printed the MCUboot image header on the receiver side:
--- MCUboot Image Header Check ---
Magic: 0x96F3B83D (Expected: 0x96F3B83D)
Size: 20436 bytes
Version: 1.0.5+0
SPI Transfer Log
During SPI transfer, the firmware receives and writes the image successfully. The progress log shows the entire secondary slot being written:
Progress: 16384 / 786432 bytes
...
Progress: 786432 / 786432 bytes
Data transfer finished (786432 bytes).
After writing the data, the trailer is written and the image is marked as pending:
writing magic; fa_id=1 off=0xbfff0 (0x6bfff0)
writing swap_info; fa_id=1 off=0xbffd8 (0x6bffd8), swap_type=0x2 image_num=0x0
Success! Image marked. Resetting to trigger swap...
Flash Layout
Primary slot : 0x500000
Secondary slot : 0x600000
SPI Transfer Configuration
#define TRANSFER_SIZE 256
Issue
Even though:
- The image header magic is correct
- The image is generated using imgtool
- The entire secondary slot is written successfully
- The image is marked pending
The bootloader still reports that the secondary image is invalid.
Possible Causes Considered
I am currently investigating the following possibilities:
- Incorrect image signing parameters
- Mismatch between image size and slot size
- Missing padding (--pad) during imgtool signing
- Alignment issues with flash writes
- Flash programming constraints when writing via mflash_drv_page_program()
- Corruption of the MCUboot trailer area
Request
I would appreciate any suggestions or guidance on why MCUboot might reject the secondary image in this scenario and what additional checks I should perform to debug this issue.
