mixed update strategies, in-place decryption - is it possible?

[tdjastrzebski]

I would like to implement what I thought would be a simple Cortex-M33 firmware update scenario for a device like a fancy office coffee machine (non-IoT) routinely serviced by a field engineer.

• MCUboot
• Custom USB Secure Loader using two slots for maximum reliability, must be updatable e.g. to support another filesystem or transfer protocol. Must be able to decrypt Mai App image in-place, preferably using parts of MCUboot configured with MCUBOOT_PRIMARY_ONLY/MCUBOOT_OVERWRITE_ONLY/MCUBOOT_ENC_IMAGES options.
• Third image containing the main app, using just one slot and the entire remaining flash, loaded by a loader app from USB stick, next verified and decrypted in-place by MCUBoot. For the third image automatic rollback is not required, I do not care about update interruption since firmware will be updated by a field engineer who can just try again in case of update failure as long as loader app is in place and functional. Instead, I prefer to have all the remaining flash space available for the main app to store nice graphics and fonts, rather than just half of this space after it is divided into two slots. Needless to say, encryption is a must.

Unless I am missing something, it seems that the above scenario cannot be easily implemented with current version of MCUboot.

I think the only way it could be done without too much code changes is by using two separate sets of configs which will allow MCUboot to believe that Secure Loader is the only image to load (two slots) while Secure Loader would be configured with MCUBOOT_PRIMARY_ONLY, MCUBOOT_OVERWRITE_ONLY, MCUBOOT_ENC_IMAGES options to load the Main App (just one large, initially encrypted slot). In any case, it probably still is a lot of rework.

Please advise