Hi,
I am working with the OEMiRoT reference project (STM32U385) and I need to configure a single Secure application image without TrustZone isolation (S-only application), while still keeping the Secure Data Image enabled.
From flash_layout.h, I see the following:
#define MCUBOOT_APP_IMAGE_NUMBER 1
#define FLASH_NS_PARTITION_SIZE (0x32000) /* default case */
and also this condition:
#if (MCUBOOT_APP_IMAGE_NUMBER == 1) && (FLASH_NS_PARTITION_SIZE == 0)
which seems to define the “FULL SECURE” case.
Question
To correctly implement an S-only application (no S/NS split) in OEMiRoT:
- Should I explicitly set both:
- MCUBOOT_APP_IMAGE_NUMBER = 1
- FLASH_NS_PARTITION_SIZE = 0
OR
- Is FLASH_NS_PARTITION_SIZE automatically set to 0 by the OEMiRoT provisioning/build system when selecting the S-only configuration, meaning it should NOT be manually modified in flash_layout.h?
Concern
The header comment suggests that some Flash layout values are automatically generated by the ROT provisioning scripts depending on the selected boot path, so it is unclear whether manual modification is supported or recommended.
Target configuration
- Single Secure application image (no NS image)
- No TrustZone isolation at application level
- Secure Data Image enabled
Any clarification on the correct and recommended configuration flow would be appreciated.
