Upgrade from secondary slot if primary slot is corrupted

[dillonj-sentient]

I am using MCUBOOT_OVERWRITE_ONLY. I would like MCUboot to copy the image from secondary slot to primary slot in the event that the primary slot cannot be verified (for example if the image in primary slot has been corrupted).
I understand that a call to boot_set_pending_multi() will fill in the end of the slot with the magic number which will trigger an update. However, an update only commences if boot_set_pending_multi() has been called AND I have loaded secondary slot with a new image.
How can I cause an upgrade to start without modifying the already-valid image in the secondary slot?
Tangentially, why doesn't an upgrade occur after a call to boot_set_pending_multi() when the primary and secondary slots hold the same image?

[dillonj-sentient]

I've discovered that on an upgrade, the first 8k of the secondary slot is erased (8k is the sector size of my flash).
I assume that this is not intended upgrade behavior for MCUboot, correct? I'll be looking to see if I have a bug in my flash porting layer. Obviously with this section of the image erased, the SHA256 will no longer validate, so MCUboot will not copy data from secondary slot to primary slot.

[dillonj-sentient]

I found in function boot_copy_image() the secondary slot's header and trailer are explicitly erased. I understand erasing the slot's trailer to prevent unrequested upgrades, but why erase the header? Doing so erases part of the image in the secondary slot and prevents an upgrade from the secondary slot's image occurring more than once.

[dillonj-sentient]

Defining MCUBOOT_OVERWRITE_ONLY_KEEP_BACKUP in mcuboot_config.h (or wherever you want I guess) prevents overwriting the first sector of the secondary slot on upgrade and thus allows for repeatedly upgrading from the secondary slot as needed.
It could be useful for this macro to be documented.