[nrf noup] boot/bootutil/loader: image discovery by ih_load_address by nvlsianpu · Pull Request #461 · nrfconnect/sdk-mcuboot

nvlsianpu · 2025-07-02T15:48:14Z

Introduce alternative procedure for detecting to which partition
image candidate belongs. This method uses ih_load_address field of the
image header instead of reset vector address. This allows to match
incoming image to the partition even when it is for instance encrypted,
as the image header is always plain-text.

This new procedure can be enabled using
CONFIG_MCUBOOT_USE_CHECK_LOAD_ADDR=y. Firmware need to be signed with
imgtool.py sign --rom-fixed <partition_address> parameter.

ref.: NCSIDB-1173

manifest-pr-skip

Copilot

Pull Request Overview

Adds a configuration option to use the image header’s load address for slot discovery instead of the reset handler address.

Introduce MCUBOOT_USE_CHECK_LOAD_ADDR Kconfig option and adjust dependencies for MCUBOOT_VERIFY_IMG_ADDRESS
Refactor boot_validate_slot and boot_validated_swap_type to read ih_load_addr when enabled
Define new IS_IN_RANGE_* macros for address range checks

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
boot/zephyr/Kconfig	Add new config `MCUBOOT_USE_CHECK_LOAD_ADDR` and update dependencies
boot/bootutil/src/loader.c	Conditional read of `ih_load_addr`, macro definitions, and slot validation updates

Comments suppressed due to low confidence (3)

boot/bootutil/src/loader.c:1264

Mismatched #ifdef/#else guards—this #else does not match the preceding #ifdef CONFIG_MCUBOOT_USE_CHECK_LOAD_ADDR correctly and will break compilation.

#else /* BOOT_USE_CHECK_LOAD_ADDR */

boot/bootutil/src/loader.c:1522

Extra closing parenthesis in macro definition leads to a syntax error; remove the surplus ) at the end.

#define IS_IN_RANGE_CPUNET_APP_ADDR(_addr) ((_addr) >= PM_CPUNET_APP_ADDRESS && (_addr) < PM_CPUNET_APP_END_ADDRESS))

boot/bootutil/src/loader.c:1595

The IS_IN_RANGE_S_VARIANT_ADDR macro expects two parameters but is invoked with one; use IS_IN_RANGE_S_ALTERNATE_ADDR or IS_IN_RANGE_S_CURRENT_ADDR instead.

            if (IS_IN_RANGE_S_VARIANT_ADDR(internal_img_addr)) {

Copilot · 2025-07-04T15:36:50Z

+	  If y, the bootloader will use the load address form image header
+	  for checking to which slot image belongs instead of usage of reset
+	  handler addres reading form the image.


[nitpick] Typo in help text: replace “form image header” with “from image header” and correct “addres” to “address”.

Suggested change

If y, the bootloader will use the load address form image header

for checking to which slot image belongs instead of usage of reset

handler addres reading form the image.

If y, the bootloader will use the load address from image header

for checking to which slot image belongs instead of usage of reset

handler address reading from the image.

sonarqubecloud · 2025-07-24T11:56:37Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

nordicjm

add nrf-squash! [nrf noup] treewide: Add support for sysbuild assigned images to commit message

nordicjm · 2025-07-24T12:10:52Z

        struct image_header *secondary_hdr = boot_img_hdr(state, slot);
-        uint32_t reset_value = 0;
-        uint32_t reset_addr = secondary_hdr->ih_hdr_size + sizeof(reset_value);
+        uint32_t internal_img_addr = 0; /* either the reset handler addres or the image beginning addres */


nordicjm · 2025-07-24T12:13:33Z

 	bool

+config MCUBOOT_USE_CHECK_LOAD_ADDR
+	bool "use check of load address"


Suggested change

bool "use check of load address"

bool "Use check of load address"

if we're adding to all new images, do we want to default y this? Or I guess not right away so other things e.g. qspi xip can be updated

nordicjm · 2025-07-24T12:14:24Z


+#define IS_IN_RANGE_CPUNET_APP_ADDR(_addr) ((_addr) >= PM_CPUNET_APP_ADDRESS && (_addr) < PM_CPUNET_APP_END_ADDRESS)
+#define _IS_IN_RANGE_S_VARIANT_ADDR(_addr, x) ((_addr) >= PM_S##x_ADDRESS && (_addr) <= (PM_S##x_ADDRESS + PM_S##x_SIZE))
+#if (CONFIG_NCS_IS_VARIANT_IMAGE)


Application need special support in the bootloader in order to resume for suspend to RAM. MCUboot is immediate actor which redirects execution to the application (application reset vector) when wake-up from S2RAM is detected. Detection is based on HW (NRF_RESETINFO) and hardened using additional check over independent source of truth (variable with magic value). Thanks to above the application is resuming using its routines - instead of mocking that by routines compiled in by the MCUboot. Implementation is able to support only MCUboot modes with a swap. Direct-XIP is not handled as it require a way to run-time recognization of active application slot. Signed-off-by: Karol Lasończyk <karol.lasonczyk@nordicsemi.no> Signed-off-by: Tomasz Chyrowicz <tomasz.chyrowicz@nordicsemi.no> Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

Added configuration which pre-configures MCUboot so It is able to support operation of resuming the App from S2RAM by the application itself. Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

Previously reopening of PR did not reopen manifest PR. This commit will enable reopening of manifest PR in such case. Signed-off-by: Kari Hamalainen <kari.hamalainen@nordicsemi.no>

This reverts commit d0796dc. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>

This reverts commit c390295. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>

This reverts commit b26db4d. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>

fixes missing array bug. Signed-off-by: Mateusz Michalek <mateusz.michalek@nordicsemi.no> (cherry picked from commit 5e1be19)

Fix uninitialized variable warning as well as compile time issue, when the slotted dependencies are enabled. Signed-off-by: Tomasz Chyrowicz <tomasz.chyrowicz@nordicsemi.no> (cherry picked from commit 9ca0881)

nrf-squash! [nrf noup] bootloader: Add bootloader requests Fix a warning for uninitialized variable. Ref: NCSDK-35733 Signed-off-by: Tomasz Chyrowicz <tomasz.chyrowicz@nordicsemi.no>

If a device uses RESETINFO, than there are some bits set in the resetinfo, even for reboots that should allow to interpret and enter the device recovery. That way it is possible to recover a device through serial recovery if the main application resets due to i.e. watchdog. Signed-off-by: Tomasz Chyrowicz <tomasz.chyrowicz@nordicsemi.no> (cherry picked from commit cc98529)

Added direct-xip support: * new API for marking active slot to be used by boot_go() routines. * jump vector assignment which is basing on above designation. Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

Added call which designate active slot so MCUBoot can jump to proper slot when CPU is resuming from S2RAM. Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

nrf-squash! [nrf noup] bootutil: Add support for KMU stored ED25519 signature key Will instead use the immutable bootloader key slot IDs if b0 is not enabled, adds a Kconfig which can be used to fall back to the previous slot IDs for previously deployed bootloaders Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>

nrf-squash! [nrf noup] boot/zephyr: nRF54h20 resume from S2RAM (hardened) CONFIG_ARM_SOC_START_HOOK=y allow to rework the resume from S2RAM code to work without PM_S2RAM mocking. It allows to implement only what really needed from the MCUboot perspective. Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

nrf-squash! [nrf noup] boot/zephyr/socs: nrf54h20 prj.conf for S2RAM Updated in order to use optimized configuration. Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

nrf-squash! [nrf noup] treewide: Add support for sysbuild assigned images Introduce alternative procedure for detecting to which partition image candidate belongs. This method uses ih_load_address field of the image header instead of reset vector address. This allows to match incoming image to the partition even when it is for instance encrypted, as the image header is always plain-text. This new procedure can be enabled using CONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRES =y. Firmware need to be signed with imgtool.py sign --rom-fixed <partition_address> parameter. ref.: NCSIDB-1173 Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

sonarqubecloud · 2025-10-10T19:28:30Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

nordicjm · 2025-10-13T07:51:52Z

         */
+#ifdef PM_CPUNET_APP_ADDRESS
        if (BOOT_CURR_IMG(state) == CONFIG_MCUBOOT_NETWORK_CORE_IMAGE_NUMBER) {
+


Suggested change

nordicjm · 2025-10-13T07:52:14Z

-            check_addresses = true;
-        } else
-#endif
+


Suggested change

nordicjm · 2025-10-13T07:52:49Z

+        }
+#endif /* CHECK_MCUBOOT_IMAGE */
+
+#if CONFIG_MCUBOOT_APPLICATION_IMAGE_NUMBER != -1


Suggested change

#if CONFIG_MCUBOOT_APPLICATION_IMAGE_NUMBER != -1

there is always an app update image

nordicjm · 2025-10-13T07:52:54Z

 #endif
-            check_addresses = true;
        }
+#endif


Suggested change

#endif

nordicjm · 2025-10-13T07:52:58Z

-#else
-            min_addr = pri_fa->fa_off;
-            max_addr = pri_fa->fa_off + pri_fa->fa_size;
+


Suggested change

nordicjm · 2025-10-13T07:54:41Z

+#if CHECK_MCUBOOT_IMAGE == 1
+            min_addr = MIN(min_addr, NCS_VARIANT_SLOT_MIN_ADDR);
+            max_addr = MAX(max_addr, NCS_VARIANT_SLOT_MAX_ADDR);


this seems to preset an unintended side effect, an image that spans across both the s0/s1 and the application partitions would pass this validation

nordicjm · 2025-10-13T07:56:27Z

                BOOT_LOG_ERR("Cleaned-up secondary slot of image %d", BOOT_CURR_IMG(state));
                return BOOT_SWAP_TYPE_FAIL;
-            } else if (reset_addr < primary_fa->fa_off || reset_addr > (primary_fa->fa_off + primary_fa->fa_size)) {
+            } else if (!IS_IN_RANGE_IMAGE_ADDR(internal_img_addr, primary_fa)) {


what happens if the primary and secondary slots are located in e.g. SPI or QSPI? This is how QSPI XIP split image support works and an upcoming extra DFU slot system will work

Naam · 2026-03-30T15:29:58Z

We hit this exact issue on nRF54L15 with NCS v3.2.4 — NSIB (b0) + MCUboot + ECIES-X25519 image encryption + OTA via BLE SMP.

With CONFIG_UPDATEABLE_IMAGE_NUMBER=2 and the shared secondary slot (PM_S1_ADDRESS defined), boot_validated_swap_type() reads the reset vector from raw flash to determine which image the secondary slot content is for. When the image is encrypted (IMAGE_F_ENCRYPTED_AES128), the payload is AES-CTR ciphertext, so the reset vector read returns garbage. MCUboot then classifies the image as "not intended for any slot" and returns BOOT_SWAP_TYPE_NONE — the swap never happens.

Our local workaround checks IS_ENCRYPTED(hdr) before the reset vector read in boot_validated_swap_type():

For the app image index (CONFIG_MCUBOOT_APPLICATION_IMAGE_NUMBER): skip the reset vector check, fall through to boot_swap_type_multi() which handles the trailer correctly
For other image indices (MCUboot/NSIB): return BOOT_SWAP_TYPE_NONE since encrypted images in the shared secondary are always app updates, not bootloader updates

This works but is a heuristic. The ih_load_address approach in this PR is cleaner since the header is always plaintext, and it doesn't hard-code assumptions about which image types use encryption. Looking forward to seeing this merged.

nvlsianpu · 2026-05-27T10:24:09Z

closed in favors to #679

nvlsianpu marked this pull request as draft July 2, 2025 15:49

nvlsianpu force-pushed the img_disc_by_load_addr branch 2 times, most recently from dda8a3b to db3fe90 Compare July 3, 2025 14:17

nvlsianpu requested a review from Copilot July 4, 2025 15:35

Copilot AI reviewed Jul 4, 2025

View reviewed changes

nvlsianpu force-pushed the img_disc_by_load_addr branch from db3fe90 to 2fb0029 Compare July 7, 2025 12:49

This was referenced Jul 8, 2025

manifest: update mcuboot nrfconnect/sdk-nrf#23187

Closed

cmake/sysbuild/image_signing: allow usage --rom-fixed for images target partition recognition nrfconnect/sdk-nrf#23242

Closed

nvlsianpu force-pushed the img_disc_by_load_addr branch from 2fb0029 to 5155061 Compare July 24, 2025 11:55

nvlsianpu marked this pull request as ready for review July 24, 2025 11:57

nvlsianpu requested review from de-nordic and nordicjm as code owners July 24, 2025 11:57

nordicjm requested changes Jul 24, 2025

View reviewed changes

rlubos force-pushed the main branch from 4e48cbd to d69621e Compare August 1, 2025 13:56

de-nordic force-pushed the img_disc_by_load_addr branch from 5155061 to aa627f8 Compare September 10, 2025 18:20

de-nordic changed the title ~~[nrf noup] boot/bootutil/loader: image discovery by ih_load_address~~ [wip] [nrf noup] boot/bootutil/loader: image discovery by ih_load_address Sep 10, 2025

de-nordic force-pushed the img_disc_by_load_addr branch from aa627f8 to 900c495 Compare September 11, 2025 08:17

NordicBuilder mentioned this pull request Sep 11, 2025

manifest: update mcuboot nrfconnect/sdk-nrf#24484

Closed

de-nordic force-pushed the img_disc_by_load_addr branch 5 times, most recently from 566d3f3 to e1d9d3f Compare September 12, 2025 14:53

nvlsianpu and others added 6 commits September 16, 2025 16:38

[nrf noup] boot/zephyr/socs: nrf54h20 prj.conf for S2RAM

c390295

Added configuration which pre-configures MCUboot so It is able to support operation of resuming the App from S2RAM by the application itself. Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

[nrf noup] ci: add reopen for manifest-pr action

d0796dc

Previously reopening of PR did not reopen manifest PR. This commit will enable reopening of manifest PR in such case. Signed-off-by: Kari Hamalainen <kari.hamalainen@nordicsemi.no>

Revert "[nrf noup] ci: add reopen for manifest-pr action"

0e6e9a3

This reverts commit d0796dc. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>

Revert "[nrf noup] boot/zephyr/socs: nrf54h20 prj.conf for S2RAM"

1c81b6a

This reverts commit c390295. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>

Revert "[nrf noup] boot/zephyr: nRF54h20 resume from S2RAM (hardened)"

fb65971

This reverts commit b26db4d. Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>

[nrf fromtree] boot: bootutil: write_sz fix

7c44ed0

fixes missing array bug. Signed-off-by: Mateusz Michalek <mateusz.michalek@nordicsemi.no> (cherry picked from commit 5e1be19)

de-nordic force-pushed the img_disc_by_load_addr branch 6 times, most recently from bd80231 to e4fd441 Compare October 3, 2025 18:08

tomchy added 3 commits October 6, 2025 08:55

[nrf fromtree] bootutil: Fix minor issues

049dc0b

Fix uninitialized variable warning as well as compile time issue, when the slotted dependencies are enabled. Signed-off-by: Tomasz Chyrowicz <tomasz.chyrowicz@nordicsemi.no> (cherry picked from commit 9ca0881)

[nrf noup] mcuboot: Fix warning

f34b20b

nrf-squash! [nrf noup] bootloader: Add bootloader requests Fix a warning for uninitialized variable. Ref: NCSDK-35733 Signed-off-by: Tomasz Chyrowicz <tomasz.chyrowicz@nordicsemi.no>

de-nordic force-pushed the img_disc_by_load_addr branch from e4fd441 to 3b21cec Compare October 7, 2025 07:29

nvlsianpu and others added 3 commits October 7, 2025 10:38

[nrf noup] bootutil/loader: integrate nRF54h S2RAM with diect-xip

1c8a595

Added call which designate active slot so MCUBoot can jump to proper slot when CPU is resuming from S2RAM. Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

de-nordic force-pushed the img_disc_by_load_addr branch 3 times, most recently from 6460f21 to 4752c56 Compare October 7, 2025 14:22

nvlsianpu added 2 commits October 9, 2025 09:55

[nrf noup] boot/zephyr/socs: update nrf54h20 prj.conf for S2RAM

6256d9f

nrf-squash! [nrf noup] boot/zephyr/socs: nrf54h20 prj.conf for S2RAM Updated in order to use optimized configuration. Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>

de-nordic force-pushed the img_disc_by_load_addr branch 2 times, most recently from 0f013f2 to d91e83e Compare October 10, 2025 19:20

de-nordic force-pushed the img_disc_by_load_addr branch from d91e83e to 6435279 Compare October 10, 2025 19:27

de-nordic changed the title ~~[wip] [nrf noup] boot/bootutil/loader: image discovery by ih_load_address~~ [nrf noup] boot/bootutil/loader: image discovery by ih_load_address Oct 10, 2025

nordicjm reviewed Oct 13, 2025

View reviewed changes

rlubos force-pushed the main branch from 9ba25b8 to 19c0a68 Compare November 24, 2025 14:52

nvlsianpu closed this May 27, 2026

	bool "use check of load address"
	bool "Use check of load address"

Conversation

nvlsianpu commented Jul 2, 2025 • edited by de-nordic Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 4, 2025

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Jul 24, 2025

Quality Gate passed

Uh oh!

nordicjm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Oct 10, 2025

Quality Gate passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Naam commented Mar 30, 2026

Uh oh!

nvlsianpu commented May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

nvlsianpu commented Jul 2, 2025 •

edited by de-nordic

Loading