boot: Adjustments to region protection code for all nRF54L platforms #25025

ahasztag · 2025-10-14T11:21:59Z

This commit fixes a couple of issues regarding B0 and MCUBoot region protection for nRF54L. It also adds some tests verifying that the issues are no longer present.

Also, support for region and BOOTCONF protection is added for nRF54LM20 and nRF54LV10 platforms.

Note: due nRF54LM20 and nRF54LV10 devices being shipped in the TEST mode, the BOOTCONF configuration is not copied to the appropriate REGION[n].CONFIG register and is not automatically applied at startup.
Thus, the BOOTCONF configuration does not work with the shipped devices. However, all the code needed for
that is present.

NordicBuilder · 2025-10-14T11:22:53Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
mcuboot	nrfconnect/sdk-mcuboot@`92b8fd3`	nrfconnect/sdk-mcuboot@`697ca33` (`main`)	nrfconnect/[email protected]

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2025-10-14T11:31:38Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 8

Inputs:

Sources:

sdk-nrf: PR head: 83929910bfe1e246ca5ac0cf5e48cb044954c928
mcuboot: PR head: 6fb2bab3b609b31910af897f36879f3aaaa54067

more details

sdk-nrf:

PR head: 83929910bfe1e246ca5ac0cf5e48cb044954c928
merge base: be08637aa6961388fbe8e80ec936356fb71c6dde
target head (main): fcef5e5a116c6df850a7c021239e3230e4ceb260
Diff

mcuboot:

PR head: 6fb2bab3b609b31910af897f36879f3aaaa54067
merge base: 92b8fd3308f968da0143cbee1d6bb2cfa440f73b
target head (main): 92b8fd3308f968da0143cbee1d6bb2cfa440f73b
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (16)

bootloader
│  ├── mcuboot
│  │  ├── boot
│  │  │  ├── zephyr
│  │  │  │  ├── Kconfig
│  │  │  │  │ main.c
cmake
│  ├── sysbuild
│  │  │ bootconf.cmake
scripts
│  │ reglock.py
subsys
│  ├── bootloader
│  │  ├── Kconfig
│  │  ├── bl_boot
│  │  │  │ bl_boot.c
sysbuild
│  │ Kconfig.secureboot
tests
│  ├── subsys
│  │  ├── bootloader
│  │  │  ├── b0_lock_rwx
│  │  │  │  ├── Kconfig
│  │  │  │  ├── modules
│  │  │  │  │  ├── run_from_s1
│  │  │  │  │  │  ├── zephyr
│  │  │  │  │  │  │  ├── CMakeLists.txt
│  │  │  │  │  │  │  ├── Kconfig
│  │  │  │  │  │  │  ├── module.yml
│  │  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  │  │ run_from_s1.c
│  │  │  │  ├── src
│  │  │  │  │  │ main.c
│  │  │  │  ├── sysbuild.cmake
│  │  │  │  │ testcase.yaml
west.yml

Outputs:

Toolchain

Version: 46667c6630
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:46667c6630_bba2ea5f2e

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
🟡 Integration tests
- ✅ test-sdk-audio
- ✅ desktop52_verification
- ❌ test-fw-nrfconnect-apps - Error: Error starting job: null
- ❌ test_ble_nrf_config - Error: Error starting job: null
- ❌ test-fw-nrfconnect-ble_mesh - Error: Error starting job: null
- ❌ test-fw-nrfconnect-ble_samples - Error: Error starting job: null
- ✅ test-fw-nrfconnect-chip
- ❌ test-fw-nrfconnect-nfc - Error: Error starting job: null
- ❌ test-fw-nrfconnect-nrf-iot_libmodem-nrf
- ✅ test-fw-nrfconnect-nrf-iot_serial_lte_modem
- ✅ test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- ✅ test-fw-nrfconnect-nrf-iot_samples
- ❌ test-fw-nrfconnect-nrf-iot_lwm2m - Error: Error starting job: null
- ❌ test-fw-nrfconnect-nrf-iot_thingy91 - Error: Error starting job: null
- ❌ test-fw-nrfconnect-nrf_crypto - Error: Error starting job: null
- ✅ test-fw-nrfconnect-proprietary_esb
- ✅ test-fw-nrfconnect-rpc
- ✅ test-fw-nrfconnect-rs
- ✅ test-fw-nrfconnect-fem
- ❌ test-fw-nrfconnect-tfm - Error: Error starting job: null
- ✅ test-fw-nrfconnect-thread-main
- ✅ test-sdk-find-my
- ❌ test-sdk-wifi
- ✅ test-low-level
- ✅ test-sdk-pmic-samples
- ❌ test-sdk-mcuboot - Error: Error starting job: null
- ❌ test-sdk-dfu - Error: Error starting job: null
- ✅ test-fw-nrfconnect-ps-main
- ✅ test-secdom-samples-public
- ⚠️ test-fw-nrfconnect-nrf-iot_cloud

Note: This message is automatically posted and updated by the CI

github-actions · 2025-10-14T12:01:52Z

You can find the documentation preview for this PR here.

NordicBuilder · 2025-10-14T12:51:57Z

Memory footprint analysis revealed the following potential issues

applications.hpf.gpio.icmsg[nrf54l15dk/nrf54l15/cpuflpr]: High RAM usage: 9102[B] - link (cc: @nrfconnect/ncs-ll-ursus)
applications.hpf.gpio.icmsg[nrf54l15dk/nrf54l15/cpuflpr]: High ROM usage: 5858[B] - link (cc: @nrfconnect/ncs-ll-ursus)
applications.hpf.gpio.icbmsg[nrf54l15dk/nrf54l15/cpuflpr]: High RAM usage: 12744[B] - link (cc: @nrfconnect/ncs-ll-ursus)
applications.hpf.gpio.icbmsg[nrf54l15dk/nrf54l15/cpuflpr]: High ROM usage: 9492[B] - link (cc: @nrfconnect/ncs-ll-ursus)

Note: This message is automatically posted and updated by the CI (latest/sdk-nrf/PR-25025/9)

nordicjm · 2025-10-14T13:45:20Z

when opening PRs in e.g. sdk-mcuboot and you are creating your own manifest PR, use the skip manifest PR tag so it doesn't create duplicate #25024 manifest updates which wastes CI resources

michalek-no · 2025-10-15T10:03:44Z

tests/subsys/bootloader/b0_lock_rwx/src/main.c

 {
 	printk("Region %d\n", RRAMC_REGION_FOR_TEST);
-	uint32_t protected_end_address = 1024 * config.size_kb;
+	uint32_t protected_end_address = config.address + (1024 * config.size_kb);
 	volatile uint32_t *unprotected_word = (volatile uint32_t *)protected_end_address;
 	volatile uint32_t *protected_word =
 		(volatile uint32_t *)protected_end_address - sizeof(uint32_t);


additional check? something like that:

uint32_t tmp = nrf_rramc_region_config_raw_get(NRF_RRAMC, RRAMC_REGION_FOR_TEST);
.
.
.
zassert_equal(nrf_rramc_region_config_raw_get(NRF_RRAMC, RRAMC_REGION_FOR_TEST) !=
tmp, "error, managed to change permissions")

Good idea, added

nordicjm · 2025-10-16T12:39:32Z

scripts/reglock.py

+    if soc not in ["nrf54ls05b"]:
+        value |= SECURE
+
+    size = size // 1024


was there before (Artur just moved that line).
Can we have a comment or better a constant dewfinition?

I've changed one of the variable names to size_kb - maybe this will clear things out. I do not see a point of defining a constant for 1024

nordicjm · 2025-10-16T12:43:03Z

subsys/bootloader/bl_boot/bl_boot.c

+	/* Note: the protection is only applied to the image itself, not the header (pad).
+	 * When building with MCUBoot, applying protection to the header is not needed, as the
+	 * header is only used during DFU and is only left for compatibility. Without MCUBoot, the
+	 * header is not present.
+	 */


so doesn't that theoretically mean there is a possible attacker entry point if there is some data they can put in this completely unprotected location that causes MCUboot to do something undefined?

So, looked into ./cmake/sysbuild/sign.cmake, I saw that material for signature is has over built binary(like set(slot_hex ${${slot}_image_dir}/zephyr/${${slot}_kernel_name}.hex), which doesn't contains this area.
For NSIB is waisted area. Active MCUboot instance doesn't parse it as well.

To be clear: this is NOT something introduced by this PR, it was already there, this PR only adds a comment which only explains why it is not a great concern and why we do not need to fix it immediately.
This will be solved soon, we plan to remove the s0_pad/s1_pad for the NSIB+MCUBoot configuration - the issue will be non-existent then.

nordicjm · 2025-10-16T12:43:35Z

tests/subsys/bootloader/b0_lock_rwx/modules/run_from_s1/zephyr/CMakeLists.txt

+cmake_minimum_required(VERSION 3.20.0)
+
+if (CONFIG_TEST_B0_LOCK_USE_S1)
+


Suggested change

nordicjm · 2025-10-16T12:44:23Z

tests/subsys/bootloader/b0_lock_rwx/modules/run_from_s1/zephyr/CMakeLists.txt

+
+zephyr_library()
+zephyr_library_sources(src/run_from_s1.c)
+


Suggested change

nordicjm · 2025-10-16T12:44:32Z

tests/subsys/bootloader/b0_lock_rwx/modules/run_from_s1/zephyr/CMakeLists.txt

+zephyr_library()
+zephyr_library_sources(src/run_from_s1.c)


cmake indent is 2 spaces

@carlescufi can you please enable some automatic check for it?

nordicjm · 2025-10-16T12:45:05Z

tests/subsys/bootloader/b0_lock_rwx/modules/run_from_s1/zephyr/CMakeLists.txt

+
+cmake_minimum_required(VERSION 3.20.0)
+
+if (CONFIG_TEST_B0_LOCK_USE_S1)


there's also no spaces between if and brackets in cmake... I have your name firmly in my mind because I'm pretty sure I've told you all of this many times now and I'm still seeing it in PRs

I'm not doing this on purpose, my brain keeps ignoring these spaces.
I've actually tried to ask AI locally to create a script to detect such mistakes, but it turned out to be no good. A script for detecting such changes would be useful. I'll try to be more careful next time and improve my personal script

@carlescufi can you please enable some automatic check for it?

@nordicjm can you please point out written rules describing it?

@maciejpietras yes, I think this is ongoing upstream, so I will follow-up.
Regarding the rules, they are here:
https://docs.zephyrproject.org/latest/contribute/style/cmake.html
or, more in general, you can find them all here:
https://docs.zephyrproject.org/latest/contribute/style/index.html

Good news, I am aware of this rule, however single spaces are easy to miss, especially due to the reflex out of C, where the space is present, an automatic check would be of great help

@carlescufi @nordicjm while contributors shall follow the contributor guideline I will appreciate following reviewers rules as well https://github.com/zephyrproject-rtos/zephyr/blob/main/CODE_OF_CONDUCT.md e.g.

_Demonstrating empathy and kindness toward other people

Being respectful of differing opinions, viewpoints, and experiences

Giving and gracefully accepting constructive feedback

Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience_

nvlsianpu · 2025-10-17T14:26:01Z

scripts/reglock.py

+    if soc not in ["nrf54ls05b"]:
+        value |= SECURE
+
+    size = size // 1024


was there before (Artur just moved that line).
Can we have a comment or better a constant dewfinition?

nvlsianpu · 2025-10-17T15:26:52Z

subsys/bootloader/bl_boot/bl_boot.c

+	/* Note: the protection is only applied to the image itself, not the header (pad).
+	 * When building with MCUBoot, applying protection to the header is not needed, as the
+	 * header is only used during DFU and is only left for compatibility. Without MCUBoot, the
+	 * header is not present.
+	 */


So, looked into ./cmake/sysbuild/sign.cmake, I saw that material for signature is has over built binary(like set(slot_hex ${${slot}_image_dir}/zephyr/${${slot}_kernel_name}.hex), which doesn't contains this area.
For NSIB is waisted area. Active MCUboot instance doesn't parse it as well.

This commit fixes a couple of issues regarding B0 and MCUBoot region protection for nRF54L. It also adds some tests verifying that the issues are no longer present. Also, support for region and BOOTCONF protection is added for nRF54LM20 and nRF54LV10 platforms. Note: due nRF54LM20 and nRF54LV10 devices being shipped in the TEST mode, the BOOTCONF configuration is not copied to the appropriate REGION[n].CONFIG register and is not automatically applied at startup. Thus, the BOOTCONF configuration does not work with the shipped devices. However, all the code needed for that is present. Signed-off-by: Artur Hadasz <[email protected]>

ahasztag requested review from michalek-no, nvlsianpu and tomchy October 14, 2025 11:21

ahasztag requested review from a team as code owners October 14, 2025 11:22

NordicBuilder added manifest changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Oct 14, 2025

NordicBuilder added manifest-mcuboot DNM labels Oct 14, 2025

michalek-no reviewed Oct 15, 2025

View reviewed changes

tomchy approved these changes Oct 15, 2025

View reviewed changes

ahasztag force-pushed the NCSDK-35695_bootconf_n54lm_lv_adjustments branch from f5f8868 to bff6074 Compare October 16, 2025 06:55

NordicBuilder requested review from a team October 16, 2025 06:55

michalek-no approved these changes Oct 16, 2025

View reviewed changes

ahasztag force-pushed the NCSDK-35695_bootconf_n54lm_lv_adjustments branch from bff6074 to 2545db6 Compare October 16, 2025 10:34

NordicBuilder requested a review from a team October 16, 2025 10:34

nordicjm requested changes Oct 16, 2025

View reviewed changes

nvlsianpu approved these changes Oct 17, 2025

View reviewed changes

ahasztag force-pushed the NCSDK-35695_bootconf_n54lm_lv_adjustments branch from 2545db6 to a860fda Compare October 20, 2025 07:36

NordicBuilder requested review from a team October 20, 2025 07:36

NordicBuilder requested a review from a team October 20, 2025 07:36

ahasztag force-pushed the NCSDK-35695_bootconf_n54lm_lv_adjustments branch from a860fda to ea429ae Compare October 20, 2025 07:39

ahasztag requested a review from nordicjm October 20, 2025 07:46

ahasztag force-pushed the NCSDK-35695_bootconf_n54lm_lv_adjustments branch from ea429ae to 8392991 Compare October 21, 2025 07:39

nordicjm approved these changes Oct 21, 2025

View reviewed changes

ahasztag force-pushed the NCSDK-35695_bootconf_n54lm_lv_adjustments branch from 8392991 to 3f5bf0f Compare October 21, 2025 09:46

NordicBuilder requested review from a team October 21, 2025 09:47

NordicBuilder removed the DNM label Oct 21, 2025

nvlsianpu approved these changes Oct 21, 2025

View reviewed changes

tomchy merged commit acf5d75 into nrfconnect:main Oct 21, 2025
23 of 24 checks passed

		cmake_minimum_required(VERSION 3.20.0)

		if (CONFIG_TEST_B0_LOCK_USE_S1)


		zephyr_library()
		zephyr_library_sources(src/run_from_s1.c)

		zephyr_library()
		zephyr_library_sources(src/run_from_s1.c)

boot: Adjustments to region protection code for all nRF54L platforms #25025

boot: Adjustments to region protection code for all nRF54L platforms #25025

Uh oh!

Conversation

ahasztag commented Oct 14, 2025

Uh oh!

NordicBuilder commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

github-actions bot commented Oct 14, 2025

Uh oh!

NordicBuilder commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Memory footprint analysis revealed the following potential issues

Uh oh!

nordicjm commented Oct 14, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nvlsianpu Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ahasztag Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ahasztag Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

maciejpietras Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

NordicBuilder commented Oct 14, 2025 •

edited

Loading

NordicBuilder commented Oct 14, 2025 •

edited

Loading

NordicBuilder commented Oct 14, 2025 •

edited

Loading

nvlsianpu Oct 17, 2025 •

edited

Loading

ahasztag Oct 20, 2025 •

edited

Loading

ahasztag Oct 20, 2025 •

edited

Loading

maciejpietras Oct 31, 2025 •

edited

Loading

nvlsianpu Oct 17, 2025 •

edited

Loading