Skip to content

samples: fast_pair: locator_tag: migrate nRF53 targets to DTS partitioning#28462

Open
kapi-no wants to merge 5 commits into
nrfconnect:mainfrom
kapi-no:fast_pair_locator_tag_without_pm_nrf5340
Open

samples: fast_pair: locator_tag: migrate nRF53 targets to DTS partitioning#28462
kapi-no wants to merge 5 commits into
nrfconnect:mainfrom
kapi-no:fast_pair_locator_tag_without_pm_nrf5340

Conversation

@kapi-no
Copy link
Copy Markdown
Contributor

@kapi-no kapi-no commented Apr 29, 2026

Summary

Migrate the Fast Pair Locator Tag sample on the nRF53 Series board targets (nrf5340dk/nrf5340/cpuapp and thingy53/nrf5340/cpuapp) from the deprecated Partition Manager (PM) static YAML configuration to a devicetree (DTS) partition layout, following the migration style established by NCSDK-37587 and NCSDK-37790. With this change, all board targets supported by the sample now define partitions through DTS, and the Partition Manager no longer carries any Fast Pair-specific exception.

The PR is split into four commits:

  • samples: bluetooth: fast_pair: locator_tag: migrate nRF53 to DTS partitioning

    • Replace the per-board PM pm_static.yml files with DTS overlays for both nRF5340 DK and Thingy:53.
    • Define the application core layout on flash0 (boot_partition, slot0_partition, bt_fast_pair_partition, storage_partition) and the secondary slots on the external mx25r64 (slot1_partition for the application core, slot3_partition aligned with the upstream flash_sim slot2_partition for the network core).
    • Define the network core layout on flash1 once in a sysbuild overlay shared by the IPC radio image (b0n_partition, provision_partition aliased as bl_storage, s0_partition).
    • Add a B0N sysbuild image overlay that includes the IPC radio cpunet overlay and selects b0n_partition as zephyr,code-partition. The MCUboot image overlay similarly reuses the application core overlay and selects boot_partition.
    • Use DT_SIZE_K() consistently for partition sizes.
    • In sysbuild, set SB_CONFIG_PARTITION_MANAGER=n, keep SB_CONFIG_SECURE_BOOT_NETCORE=y and SB_CONFIG_NETCORE_APP_UPDATE=y, and align with SB_CONFIG_MCUBOOT_NRF53_MULTI_IMAGE_UPDATE=y. In the MCUboot image, disable CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS (depends on PM-only macros for the network core slot) and drop the Direct XIP-only secondary_app_partition: &slot1_partition {} alias.
    • Remove the nrf5340dk/nrf5340/cpuapp/ns and thingy53/nrf5340/cpuapp/ns board targets per the updated NCSDK-38010 description (board configs, overlays, PM YAMLs, sysbuild folders, signature key files, and sample.yaml entries).
    • Move CONFIG_USE_DT_CODE_PARTITION=y from per-board *.conf files to configuration/prj.conf and configuration/prj_release.conf (matching the input_device sample style). The b0n image keeps its own CONFIG_USE_DT_CODE_PARTITION=y in sysbuild/b0n/prj.conf.
    • Update README.rst to drop the _ns rows from the DFU and signature algorithm tables and the build_and_run_ns.txt include.
  • doc: bt_fast_pair: drop nRF53 Partition Manager exception

    • In the Fast Pair integration guide and library documentation, replace the manually written PM deprecation note with the shared /includes/pm_deprecation.txt include and drop the nRF53-only carve-out paragraph.
    • Update the dependency note in the integration guide to mark Partition Manager as fully deprecated (no nRF53 caveat).
  • doc: migration guide: add Fast Pair nRF53 PM to DTS migration steps

    • Add a Fast Pair Locator Tag entry in migration_guide_3.4.rst that lists the unique nRF53 adjustments on top of the generic Fast Pair PM-to-DTS steps from migration_guide_3.3.rst: enabling SB_CONFIG_MCUBOOT_NRF53_MULTI_IMAGE_UPDATE, the external flash node override (with the flash0-only-slot0_partition note relative to nRF52/nRF54L), the network core (flash1) layout, the new B0N sysbuild image overlay (with CONFIG_USE_DT_CODE_PARTITION=y), and disabling CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS in the MCUboot image.
  • doc: release notes: add Fast Pair nRF53 PM deprecation changelog entries

    • Note the locator_tag nRF53 PM-to-DTS migration and _ns removal under Bluetooth Fast Pair samples.
    • Note the integration guide alignment under Google Fast Pair integration.

Verified on nrf5340dk/nrf5340/cpuapp

  • Pristine sysbuild succeeds with the expected memory regions:
    • locator_tag FLASH used 231584 / 978560 B (matches slot0_partition 956 KB).
    • b0n FLASH used 8524 / 34176 B.
    • ipc_radio FLASH used 136512 / 246 KB.
  • After west flash --recover, MCUboot validates slot 0 with BOOT_VALIDATE_SLOT0 enabled, B0N validates and chainloads ipc_radio, BT HCI IPC binds, and the sample reaches Sample has started with active Fast Pair advertising.

Ref: NCSDK-38010

Test plan

  • Documentation builds without warnings.
  • CI build for nrf5340dk/nrf5340/cpuapp (debug + release).
  • CI build for thingy53/nrf5340/cpuapp (debug + release).
  • CI builds for the remaining supported board targets (regression for the shared prj.conf / prj_release.conf move of CONFIG_USE_DT_CODE_PARTITION).
  • On hardware: west flash --recover on nrf5340dk/nrf5340/cpuapp, confirm MCUboot + B0N chainload, IPC radio start, and Fast Pair advertising / pairing.

@kapi-no kapi-no requested review from a team as code owners April 29, 2026 14:18
@NordicBuilder NordicBuilder added doc-required PR must not be merged without tech writer approval. changelog labels Apr 29, 2026
@NordicBuilder NordicBuilder requested review from a team April 29, 2026 14:18
@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from ef72204 to a0461ec Compare April 29, 2026 14:24
@NordicBuilder
Copy link
Copy Markdown
Contributor

NordicBuilder commented Apr 29, 2026

CI Information

To view the history of this post, click the 'edited' button above
Build number: 19

Inputs:

Sources:

sdk-nrf: PR head: 408d86203662302bb10d7e128b75e25d3aa64d06

more details

sdk-nrf:

PR head: 408d86203662302bb10d7e128b75e25d3aa64d06
merge base: d294950e7b6d59865fba3f6fd0d7646e010d4c6d
target head (main): 3e601fc940eb0d6a9d3cbe529e834282df50f01c
Diff

Github labels

Enabled Name Description
ci-disabled Disable the ci execution
ci-all-test Run all of ci, no test spec filtering will be done
ci-force-downstream Force execution of downstream even if twister fails
ci-run-twister Force run twister
ci-run-zephyr-twister Force run zephyr twister
List of changed files detected by CI (48)
doc
│  ├── nrf
│  │  ├── external_comp
│  │  │  ├── bt_fast_pair
│  │  │  │  │ core.rst
│  │  ├── libraries
│  │  │  ├── bluetooth
│  │  │  │  ├── fast_pair
│  │  │  │  │  │ core.rst
│  │  ├── releases_and_maturity
│  │  │  ├── migration
│  │  │  │  │ migration_guide_3.4.rst
│  │  │  ├── releases
│  │  │  │  │ release-notes-changelog.rst
samples
│  ├── bluetooth
│  │  ├── fast_pair
│  │  │  ├── locator_tag
│  │  │  │  ├── README.rst
│  │  │  │  ├── configuration
│  │  │  │  │  ├── boards
│  │  │  │  │  │  ├── nrf52833dk_nrf52833.conf
│  │  │  │  │  │  ├── nrf52840dk_nrf52840.conf
│  │  │  │  │  │  ├── nrf52dk_nrf52832.conf
│  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp.overlay
│  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp_common.dtsi
│  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp_ns.conf
│  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp_ns.overlay
│  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp_ns_release.conf
│  │  │  │  │  │  ├── nrf54l15dk_nrf54l05_cpuapp.conf
│  │  │  │  │  │  ├── nrf54l15dk_nrf54l10_cpuapp.conf
│  │  │  │  │  │  ├── nrf54l15dk_nrf54l15_cpuapp.conf
│  │  │  │  │  │  ├── nrf54l15tag_nrf54l15_cpuapp.conf
│  │  │  │  │  │  ├── nrf54l15tag_nrf54l15_cpuapp_release.conf
│  │  │  │  │  │  ├── nrf54lm20dk_nrf54lm20a_cpuapp.conf
│  │  │  │  │  │  ├── nrf54lm20dk_nrf54lm20b_cpuapp.conf
│  │  │  │  │  │  ├── nrf54ls05dk_nrf54ls05b_cpuapp.conf
│  │  │  │  │  │  ├── thingy53_nrf5340_cpuapp.overlay
│  │  │  │  │  │  ├── thingy53_nrf5340_cpuapp_common.dtsi
│  │  │  │  │  │  ├── thingy53_nrf5340_cpuapp_ns.conf
│  │  │  │  │  │  ├── thingy53_nrf5340_cpuapp_ns.overlay
│  │  │  │  │  │  │ thingy53_nrf5340_cpuapp_ns_release.conf
│  │  │  │  │  ├── pm_static_nrf5340dk_nrf5340_cpuapp.yml
│  │  │  │  │  ├── pm_static_nrf5340dk_nrf5340_cpuapp_ns.yml
│  │  │  │  │  ├── pm_static_thingy53_nrf5340_cpuapp.yml
│  │  │  │  │  ├── pm_static_thingy53_nrf5340_cpuapp_ns.yml
│  │  │  │  │  ├── prj.conf
│  │  │  │  │  │ prj_release.conf
│  │  │  │  ├── sample.yaml
│  │  │  │  ├── sysbuild
│  │  │  │  │  ├── b0n
│  │  │  │  │  │  ├── boards
│  │  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpunet.overlay
│  │  │  │  │  │  │  │ thingy53_nrf5340_cpunet.overlay
│  │  │  │  │  │  │ prj.conf
│  │  │  │  │  ├── configuration
│  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp
│  │  │  │  │  │  │  │ sysbuild.conf
│  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp_ns
│  │  │  │  │  │  │  ├── boot_signature_key_file_rsa2048.pem
│  │  │  │  │  │  │  │ sysbuild.conf
│  │  │  │  │  │  ├── thingy53_nrf5340_cpuapp
│  │  │  │  │  │  │  │ sysbuild.conf
│  │  │  │  │  │  ├── thingy53_nrf5340_cpuapp_ns
│  │  │  │  │  │  │  ├── boot_signature_key_file_rsa2048.pem
│  │  │  │  │  │  │  │ sysbuild.conf
│  │  │  │  │  ├── ipc_radio
│  │  │  │  │  │  ├── boards
│  │  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpunet.overlay
│  │  │  │  │  │  │  │ thingy53_nrf5340_cpunet.overlay
│  │  │  │  │  ├── mcuboot
│  │  │  │  │  │  ├── boards
│  │  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp.conf
│  │  │  │  │  │  │  ├── nrf5340dk_nrf5340_cpuapp.overlay
│  │  │  │  │  │  │  ├── thingy53_nrf5340_cpuapp.conf
│  │  │  │  │  │  │  │ thingy53_nrf5340_cpuapp.overlay

Outputs:

Toolchain

Version: f0aa129f09
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:f0aa129f09_5ea73affbf

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

  • ◻️ Toolchain - Skipped: existing toolchain is used
  • ✅ Build twister
    • sdk-nrf test count: 20
  • ✅ Integration tests
Disabled integration tests
    • test-fw-nrfconnect-nrf_lrcs_mosh
    • test-fw-nrfconnect-nrf_lrcs_positioning
    • desktop52_verification
    • test_ble_nrf_config
    • test-fw-nrfconnect-apps
    • test-fw-nrfconnect-apps_nrfdesktop
    • test-fw-nrfconnect-ble_mesh
    • test-fw-nrfconnect-ble_samples
    • test-fw-nrfconnect-chip
    • test-fw-nrfconnect-fem
    • test-fw-nrfconnect-nfc
    • test-fw-nrfconnect-nrf-iot_libmodem-nrf
    • test-fw-nrfconnect-nrf-iot_lwm2m
    • test-fw-nrfconnect-nrf-iot_samples
    • test-fw-nrfconnect-nrf-iot_thingy91
    • test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
    • test-fw-nrfconnect-nrf_crypto
    • test-fw-nrfconnect-ps-main
    • test-fw-nrfconnect-rpc
    • test-fw-nrfconnect-rs
    • test-fw-nrfconnect-tfm
    • test-fw-nrfconnect-thread-main
    • test-low-level
    • test-sdk-audio
    • test-sdk-dfu
    • test-sdk-find-my
    • test-sdk-mcuboot
    • test-sdk-wifi
    • test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

If your application is based on the nRF53 Series MCUboot DFU configuration of this sample, follow the generic Fast Pair PM-to-DTS migration steps described in the *Google Fast Pair* recommended changes of the :ref:`migration_3.3` guide.
In addition to the generic steps, the nRF53 Series DFU configuration with MCUboot in the overwrite mode requires the following unique adjustments:

1. Enable the multi-image update mode in your sysbuild configuration so that the application core and the network core images are updated together through MCUboot:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
1. Enable the multi-image update mode in your sysbuild configuration so that the application core and the network core images are updated together through MCUboot:
1. Enable the multi-image update mode in your sysbuild configuration so that the application core and network core images are updated together through MCUboot:


The size of ``slot3_partition`` must match the corresponding RAM-backed ``slot2_partition`` defined in :file:`nrf/modules/mcuboot/flash_sim.overlay`, which MCUboot uses to forward the network core image during DFU.

As a consequence of moving the secondary slots to external flash, the internal flash node (``flash0``) only needs to declare a single MCUboot slot partition (``slot0_partition``), in contrast to nRF52 and nRF54L Series board targets where ``slot1_partition`` is also placed on the internal flash.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
As a consequence of moving the secondary slots to external flash, the internal flash node (``flash0``) only needs to declare a single MCUboot slot partition (``slot0_partition``), in contrast to nRF52 and nRF54L Series board targets where ``slot1_partition`` is also placed on the internal flash.
As a consequence of moving the secondary slots to external flash, the internal flash node (``flash0``) only needs to declare a single MCUboot slot partition (``slot0_partition``).
In the nRF52 and nRF54L Series board targets, the ``slot1_partition`` is also placed on the internal flash.

Comment on lines +94 to +95
Place this overlay in :file:`sysbuild/ipc_radio/boards/<board_target>.overlay` so that it is applied to the IPC radio image.
Size ``s0_partition`` so that the network core image fits within the RAM-backed ``slot2_partition`` of :file:`nrf/modules/mcuboot/flash_sim.overlay`.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Place this overlay in :file:`sysbuild/ipc_radio/boards/<board_target>.overlay` so that it is applied to the IPC radio image.
Size ``s0_partition`` so that the network core image fits within the RAM-backed ``slot2_partition`` of :file:`nrf/modules/mcuboot/flash_sim.overlay`.
Place this overlay in :file:`sysbuild/ipc_radio/boards/<board_target>.overlay` file so that it is applied to the IPC radio image.
Size ``s0_partition`` so that the network core image fits within the RAM-backed ``slot2_partition`` of the :file:`nrf/modules/mcuboot/flash_sim.overlay` file.

----------------------------

|no_changes_yet_note|
* Updated the :ref:`Google Fast Pair integration <ug_bt_fast_pair_integration>` guide to reflect that all supported board targets use devicetree (DTS) for partition definitions.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Updated the :ref:`Google Fast Pair integration <ug_bt_fast_pair_integration>` guide to reflect that all supported board targets use devicetree (DTS) for partition definitions.
* Updated the :ref:`Google Fast Pair integration guide<ug_bt_fast_pair_integration>` to reflect that all supported board targets use devicetree (DTS) for partition definitions.

* ``slot1_partition`` (``image-1``) for the application core secondary slot.
* ``slot3_partition`` (``image-3``) for the network core secondary slot.

The size of ``slot3_partition`` must match the corresponding RAM-backed ``slot2_partition`` defined in :file:`nrf/modules/mcuboot/flash_sim.overlay`, which MCUboot uses to forward the network core image during DFU.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The size of ``slot3_partition`` must match the corresponding RAM-backed ``slot2_partition`` defined in :file:`nrf/modules/mcuboot/flash_sim.overlay`, which MCUboot uses to forward the network core image during DFU.
The size of ``slot3_partition`` must match the corresponding RAM-backed ``slot2_partition`` defined in the :file:`nrf/modules/mcuboot/flash_sim.overlay` file, which MCUboot uses to forward the network core image during DFU.

Copy link
Copy Markdown
Contributor

@dchat-nordic dchat-nordic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit, otherwise lgtm

@@ -1,18 +1,24 @@
#
# Copyright (c) 2024-2025 Nordic Semiconductor
# Copyright (c) 2024-2026 Nordic Semiconductor
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Copyright (c) 2024-2026 Nordic Semiconductor
# Copyright (c) 2024-2026 Nordic Semiconductor ASA

@@ -1,10 +1,24 @@
#
# Copyright (c) 2024-2025 Nordic Semiconductor
# Copyright (c) 2024-2026 Nordic Semiconductor
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Copyright (c) 2024-2026 Nordic Semiconductor
# Copyright (c) 2024-2026 Nordic Semiconductor ASA

@@ -1,11 +1,9 @@
#
# Copyright (c) 2024 Nordic Semiconductor
# Copyright (c) 2024-2026 Nordic Semiconductor
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Copyright (c) 2024-2026 Nordic Semiconductor
# Copyright (c) 2024-2026 Nordic Semiconductor ASA

@@ -1,11 +1,9 @@
#
# Copyright (c) 2024 Nordic Semiconductor
# Copyright (c) 2024-2026 Nordic Semiconductor
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Copyright (c) 2024-2026 Nordic Semiconductor
# Copyright (c) 2024-2026 Nordic Semiconductor ASA


.. |sample path| replace:: :file:`samples/bluetooth/fast_pair/locator_tag`

.. include:: /includes/build_and_run_ns.txt
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could replace this include with ".. include:: /includes/build_and_run.txt" as the PR is about removing _ns.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, good catch :)

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from a0461ec to 6d3297a Compare May 6, 2026 07:10
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 6, 2026

Pure rebase, no file diff has changed.

Comment on lines +15 to +17
# Disable image address verification as it relies on PM-specific macros for
# the network core image slot that are not available in the DTS build.
CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS=n
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please verify both CONFIG_FLASH_SIMULATOR (if it is enabled by default/what it enables now if it was needed previously) and CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS=n (if it is needed)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regarding the FLASH_SIMULATOR Kconfig option:

nrf/sysbuild/CMakeLists.txt:L598:

    if(SB_CONFIG_MCUBOOT_NRF53_MULTI_IMAGE_UPDATE)
      set_config_bool(mcuboot CONFIG_NRF53_MULTI_IMAGE_UPDATE y)
      set_config_bool(mcuboot CONFIG_BOOT_IMAGE_ACCESS_HOOKS y)
      set_config_bool(mcuboot CONFIG_FLASH_SIMULATOR y)
      set_config_bool(mcuboot CONFIG_FLASH_SIMULATOR_DOUBLE_WRITES y)
      set_config_bool(mcuboot CONFIG_FLASH_SIMULATOR_STATS n)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regarding the explicit setting of the MCUBOOT_VERIFY_IMG_ADDRESS Kconfig option:

   *****************************
   * Running CMake for mcuboot *
   *****************************

Loading Zephyr default modules (Zephyr base).
-- Application: /home/kapi/Repos/ncs/bootloader/mcuboot/boot/zephyr
-- CMake version: 3.21.0
-- Found Python3: /home/kapi/.pyenv/versions/3.12.4/bin/python3.12 (found suitable version "3.12.4", minimum required is "3.12") found components: Interpreter 
-- Cache files will be written to: /home/kapi/.cache/zephyr
-- Zephyr version: 4.4.0 (/home/kapi/Repos/ncs/zephyr)
-- Found west (found suitable version "1.4.0", minimum required is "0.14.0")
-- Board: nrf5340dk, qualifiers: nrf5340/cpuapp
-- Found host-tools: zephyr 1.0.1 (/opt/zephyr-sdk/zephyr-sdk-1.0.1)
-- Found toolchain: zephyr 1.0.1 (/opt/zephyr-sdk/zephyr-sdk-1.0.1)
-- Found Dtc: /opt/zephyr-sdk/zephyr-sdk-1.0.1/hosttools/sysroots/x86_64-pokysdk-linux/usr/bin/dtc (found suitable version "1.7.0", minimum required is "1.4.6") 
-- Found BOARD.dts: /home/kapi/Repos/ncs/zephyr/boards/nordic/nrf5340dk/nrf5340dk_nrf5340_cpuapp.dts
-- Found devicetree overlay: /home/kapi/Repos/ncs/nrf/samples/bluetooth/fast_pair/locator_tag/sysbuild/mcuboot/boards/nrf5340dk_nrf5340_cpuapp.overlay
-- Found devicetree overlay: /home/kapi/Repos/ncs/nrf/modules/mcuboot/flash_sim_mcuboot.overlay
-- Generated zephyr.dts: /home/kapi/Repos/ncs/nrf/samples/bluetooth/fast_pair/locator_tag/build/mcuboot/zephyr/zephyr.dts
-- Generated pickled edt: /home/kapi/Repos/ncs/nrf/samples/bluetooth/fast_pair/locator_tag/build/mcuboot/zephyr/edt.pickle
-- Generated devicetree_generated.h: /home/kapi/Repos/ncs/nrf/samples/bluetooth/fast_pair/locator_tag/build/mcuboot/zephyr/include/generated/zephyr/devicetree_generated.h

warning: Deprecated symbol MCUBOOT_VERIFY_IMG_ADDRESS is enabled.

The option is enabled by default and emits the deprecated warning. @nrfconnect/ncs-eris, you can consider improving this part.

/delete-node/ partitions;

partitions {
compatible = "fixed-partitions";
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rerun with latest script in main which will correctly generated mapped partitions

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure! However, in the first step, I need to correct the main branch state:

#28561

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done, the PR is now aligned with the mapped-partition compatible and ranges syntax

* against it: ih_img_size + ih_hdr_size must fit in slot2.
* Keep s0_partition at 222 KB to leave room for the header.
*/
s0_partition: partition@8800 {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure you want to start partition in the middle of the erase page? Seems that the update that would come to this would have to erase a part of provisioning too, assuming that the page boundaries will be rounded down to 0x8000.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

misconception there, page size of nrf5340 application core is is 4KiB, on nrf5340 network core it is 2KiB

Copy link
Copy Markdown
Contributor Author

@kapi-no kapi-no May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Either way, we need to keep it at 0x2800 start address to maintain backwards compatibility with the default PM configuration.

* against it: ih_img_size + ih_hdr_size must fit in slot2.
* Keep s0_partition at 222 KB to leave room for the header.
*/
s0_partition: partition@8800 {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same issue with partition start offset.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

Comment on lines +38 to +39
# Enable code partitioning with DTS
CONFIG_USE_DT_CODE_PARTITION=y
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure this is needed?

Copy link
Copy Markdown
Contributor Author

@kapi-no kapi-no May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Kconfig option is disabled by default and needs to be explicitly enabled.

Without it, the memory footprint information for the b0n image may confuse the users:

CONFIG_USE_DT_CODE_PARTITION=y
correct

Memory region         Used Size  Region Size  %age Used
           FLASH:        8480 B       9600 B     88.33%
             RAM:        3248 B        64 KB      4.96%
           SRAM1:           0 B        64 KB      0.00%
        IDT_LIST:           0 B        32 KB      0.00%

CONFIG_USE_DT_CODE_PARTITION=n
incorrect

Memory region         Used Size  Region Size  %age Used
           FLASH:        8480 B       256 KB      3.23%
             RAM:        3248 B        64 KB      4.96%
           SRAM1:           0 B        64 KB      0.00%
        IDT_LIST:           0 B        32 KB      0.00%

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally all sysbuild images that have a claim over any memory region of the target device should have the CONFIG_USE_DT_CODE_PARTITION Kconfig option enabled.

CONFIG_TIMEOUT_64BIT=n

# Enable code partitioning with DTS
CONFIG_USE_DT_CODE_PARTITION=y
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this needed, seems that defult conf for netboot already sets this.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from 6d3297a to 763211d Compare May 11, 2026 08:41
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 11, 2026

Pure rebase

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from 763211d to 18c9134 Compare May 11, 2026 09:51
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 11, 2026

Addressed comments from @dchat-nordic, @divipillai, @nordicjm and @peknis.

I also created a new commit with the migration guide description. The new documentation covers the migration from the fixed-partitions to the mapped-partition DTS property. It is relevant for all Fast Pair samples and their supported board targets.

* against it: ih_img_size + ih_hdr_size must fit in slot2.
* Keep s0_partition at 222 KB to leave room for the header.
*/
s0_partition: partition@8800 {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

misconception there, page size of nrf5340 application core is is 4KiB, on nrf5340 network core it is 2KiB

Comment thread doc/nrf/releases_and_maturity/migration/migration_guide_3.4.rst Outdated
Copy link
Copy Markdown
Contributor

@peknis peknis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved with a minor nit.

See the :file:`sysbuild/configuration/<board_target>/sysbuild.conf` file from the :ref:`fast_pair_locator_tag` sample as an example.

#. Override the external flash node in the application core overlay to define the MCUboot secondary slot partitions there.
In the nRF53 Series DFU configuration, the secondary slots reside in external QSPI flash (for example, ``mx25r64`` on the ``nrf5340dk/nrf5340/cpuapp`` board target) instead of the internal flash.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
In the nRF53 Series DFU configuration, the secondary slots reside in external QSPI flash (for example, ``mx25r64`` on the ``nrf5340dk/nrf5340/cpuapp`` board target) instead of the internal flash.
In the nRF53 Series DFU configuration, the secondary slots reside in the external QSPI flash (for example, ``mx25r64`` on the ``nrf5340dk/nrf5340/cpuapp`` board target) instead of the internal flash.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

addressed

@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 15, 2026

Potential fix available in the following draft PR:

#28802

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from 62e5076 to 8f5f02a Compare May 20, 2026 12:23
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 20, 2026

Rebased my PR to include a fix for the network core flashing procedure that had been introduced by the following PR:

#28802

@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 20, 2026

I am also waiting for a fix for the image verification solution that currently fails to build. The following PR seems to fix it:

nrfconnect/sdk-mcuboot#663

I would like to keep the same feature that was used with the deprecated PM solution.

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from 8f5f02a to 93a2c12 Compare May 20, 2026 14:31
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 20, 2026

Force-pushed an amendment to the samples: bluetooth: fast_pair: locator_tag: migrate nRF53 targets to DTS commit.

What changed: Both nRF53 MCUboot board configs (sysbuild/mcuboot/boards/nrf5340dk_nrf5340_cpuapp.conf and thingy53_nrf5340_cpuapp.conf) now set:

CONFIG_BOOT_MAX_IMG_SECTORS_AUTO=n
CONFIG_BOOT_MAX_IMG_SECTORS=239

Why: With the new DTS layout, MCUboot's auto-compute prints a CMake warning during the build (Unable to determine erase size of slot1 partition). The nordic,qspi-nor binding used by mx25r64 does not declare erase-block-size (the driver discovers it from SFDP at runtime), so MCUboot cannot derive the sector count for the QSPI-backed slot1_partition/slot3_partition and falls back without a value. Setting the value explicitly (956 KiB slot / 4 KiB sector = 239 sectors) silences the warning and gives MCUboot the correct MCUBOOT_MAX_IMG_SECTORS for both image slots.

Verified on nrf5340dk/nrf5340/cpuapp: clean build with no sector-count warning; locator_tag boots, IPC HCI comes up, and Fast Pair advertising starts.

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from 93a2c12 to 1185ef7 Compare May 22, 2026 07:16
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 22, 2026

Rebased my PR to include a fix for the image verification solution that had been introduced by the following PR:

nrfconnect/sdk-mcuboot#663

@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 22, 2026

Rebased my PR to include a fix for the image verification solution that had been introduced by the following PR:

nrfconnect/sdk-mcuboot#663

The build process is broken after the quoted PR got included. Attempted to fix it in the following PR:

nrfconnect/sdk-mcuboot#677

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from 1185ef7 to 845b5c1 Compare May 25, 2026 07:46
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 25, 2026

Rebase after mbedTLS upmerge (and to resolve conflicts).

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from 845b5c1 to daa1a7e Compare May 25, 2026 12:41
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 25, 2026

Another rebase to include a fix from the following PR:

nrfconnect/sdk-mcuboot#677

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from daa1a7e to f049a77 Compare May 25, 2026 13:09
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 25, 2026

Force-pushed another amendment.

What changed: Enabled the new address verification mechanism in the nRF53 MCUboot configs (sysbuild/mcuboot/boards/nrf5340dk_nrf5340_cpuapp.conf and thingy53_nrf5340_cpuapp.conf):

Why: Now that nrfconnect/sdk-mcuboot#677 has landed (manifest already bumped on main), MCUboot finally derives NETCPU_APP_SLOT_OFFSET / NETCPU_APP_SLOT_END from the b0n s0_partition DTS node (via the PCD_NET_CORE_APP_ADDRESS / PCD_NET_CORE_APP_SIZE compile defs). This means address verification of the secondary slot can be re-enabled on nRF53 DTS builds — previously we had to disable it because those symbols only existed in PM builds.

kapi-no added 3 commits May 25, 2026 15:22
Migrated the Fast Pair Locator Tag sample on the nRF53 board targets
away from the deprecated Partition Manager static YAML files to a
DTS-based partition layout, in line with the migration style
established for the remaining board targets. Documentation updates that
go beyond the sample-local README is done in an independent commit.

The new DTS partition layout is aligned with the legacy Partition
Manager static configuration from the |NCS| v3.3.0 release so that
field-deployed devices running v3.3.0 firmware can be updated to
v3.4.0 over DFU without re-flashing.

Affected board targets:

- nrf5340dk/nrf5340/cpuapp
- thingy53/nrf5340/cpuapp

Application core changes (configuration/boards/*_cpuapp.overlay):

- Defined the full flash0 partition layout (boot_partition,
  slot0_partition, bt_fast_pair_partition, storage_partition).
- Defined the mx25r64 partition layout for slot1_partition (956 KB,
  matching the original PM offsets) and slot3_partition. Set
  status = "okay" on the &mx25r64 node explicitly to follow the NCS
  convention used by other overlays that consume mx25r64 partitions
  (the node already defaults to okay through the board DTS).
- Set slot3_partition to DT_SIZE_K(256) so it matches both the
  upstream RAM-backed slot2_partition in
  nrf/modules/mcuboot/flash_sim.overlay that MCUboot uses to forward
  the network core image and the legacy PM mcuboot_secondary_1
  partition (0x40000 / 256 KB).
- Used DT_SIZE_K() consistently for partition sizes.
- Removed the per-board common dtsi files; both /ns variants and the
  related dtsi includes are gone with the /ns scope removal.

Sysbuild overlays (sysbuild/{ipc_radio,b0n,mcuboot}/boards/):

- Introduced a single ipc_radio cpunet overlay that defines
  b0n_partition (offset 0x0, size 0x2580), the bl_storage /
  provision_partition node (offset 0x2580, size 0x280), and
  s0_partition (offset 0x2800, size DT_SIZE_K(246)). The offsets
  and sizes match the legacy PM b0n, provision, and app/ipc_radio
  partitions, and s0_partition fits within the 256 KB RAM-backed
  slot2_partition of flash_sim.overlay with room for the MCUboot
  image header during DFU.
- The b0n overlay reuses the IPC radio cpunet layout via a relative
  include and only sets zephyr,code-partition to b0n_partition,
  avoiding any duplication of the cpunet partition map.
- The MCUboot overlays continue to include the cpuapp overlay and
  point zephyr,code-partition at boot_partition.
- Enabled CONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRESS=y for the secondary
  slot address verification against the NETCPU_APP_SLOT range derived
  from the b0n s0_partition DTS node. CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS,
  the deprecated predecessor of the option, is disabled explicitly to
  suppress its auto-y default in the overwrite-only mode.

Sysbuild configuration (sysbuild/configuration/*/sysbuild.conf):

- Disabled SB_CONFIG_PARTITION_MANAGER for the nRF53 board targets.
- Kept SB_CONFIG_SECURE_BOOT_NETCORE=y and
  SB_CONFIG_NETCORE_APP_UPDATE=y so that the upstream s0-partition
  and flash_sim overlays apply, and aligned the layout with
  SB_CONFIG_MCUBOOT_NRF53_MULTI_IMAGE_UPDATE.

Removed /ns scope (per updated NCSDK-38010 description):

- Deleted nrf5340dk/nrf5340/cpuapp/ns and
  thingy53/nrf5340/cpuapp/ns board configs, overlays, PM static
  YAMLs, sysbuild folders, and signature key files.
- Removed the matching entries from sample.yaml.

Project-wide configuration:

- Moved CONFIG_USE_DT_CODE_PARTITION=y from per-board *.conf files
  to configuration/prj.conf and configuration/prj_release.conf, and
  highlighted it with a leading blank line, mirroring the style of
  nrf/samples/bluetooth/fast_pair/input_device/prj.conf. Now that
  every supported target is on DTS partitioning, the option only
  needs to be set once at the sample level. The b0n image keeps its
  own CONFIG_USE_DT_CODE_PARTITION=y in sysbuild/b0n/prj.conf since
  it is a separate sysbuild image.

README.rst alignment:

- Removed nrf5340dk/nrf5340/cpuapp/ns and thingy53/nrf5340/cpuapp/ns
  from the DFU solution and signature algorithm tables.
- Replaced the /includes/build_and_run_ns.txt include with the
  /includes/build_and_run.txt one in the Building and running section,
  as no /ns variant is supported now.

Ref: NCSDK-38010

Signed-off-by: Kamil Piszczek <Kamil.Piszczek@nordicsemi.no>
Update the Fast Pair integration guide and the Fast Pair library
documentation to reflect that the nRF53 Series DFU configuration with
MCUboot is no longer the exception that requires the Partition Manager.
With the nRF53 migration to devicetree (DTS) for the Fast Pair Locator
Tag sample, all supported board targets now define the Fast Pair
partition through DTS.

Replace the manually written Partition Manager deprecation note in
both pages with the shared /includes/pm_deprecation.txt include, drop
the nRF53 carve-out paragraph, and align the dependency note in the
integration guide to mark the Partition Manager as fully deprecated
(without the nRF53-only caveat).

Ref: NCSDK-38010

Signed-off-by: Kamil Piszczek <Kamil.Piszczek@nordicsemi.no>
…ation

Added a Google Fast Pair section under "Libraries / Recommended
changes" of the v3.4 migration guide that documents the migration of
the Fast Pair sample partition overlays from the legacy
fixed-partitions compatible string to the new zephyr,mapped-partition
compatible string.

The new section is anchored as migration_3.4_google_fast_pair so that
other parts of the migration guide can reference it.

The migration is generic and applies to all Fast Pair samples and
board targets, but the section also highlights that it is mandatory on
nRF53 Series board targets: after the recent Zephyr SoC devicetree
updates that added a ranges translation to the cpunet flash node, the
legacy fixed-partitions style makes the linker double-count the flash
base address. Without the migration, the network core image is linked
outside the valid flash range and nrfutil rejects programming.

Ref: NCSDK-38010

Signed-off-by: Kamil Piszczek <Kamil.Piszczek@nordicsemi.no>
@kapi-no kapi-no added this to the 3.4.0 milestone May 25, 2026
@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from f049a77 to cbb3301 Compare May 25, 2026 13:26
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 25, 2026

Force-pushed: set status = "okay" explicitly on &mx25r64 in both nRF53 cpuapp overlays
(configuration/boards/nrf5340dk_nrf5340_cpuapp.overlay and
configuration/boards/thingy53_nrf5340_cpuapp.overlay).

The node already defaulted to "okay" through the board DTS (so the previous build worked too),
but other NCS overlays that consume mx25r64 partitions
(matter_weather_station, azure_iot_hub, aws_iot, the matter samples on nrf7002dk/nrf54l*dk,
tests/subsys/dfu/dfu_extra, tests/subsys/bootloader/upgrade/ref_smp_svr_ext_flash,
nrf/dts/samples/matter/nrf5340_cpuapp_partitions.dtsi, etc.) all set it explicitly.
Making it explicit here aligns the sample with that convention, is self-documenting,
and is defensive against any future overlay that might disable mx25r64.

@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from cbb3301 to 9d5de66 Compare May 25, 2026 13:47
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 25, 2026

Force-pushed to align the migration guide with the last code/configuration changes::

  • Step 2 (external flash overlay): added the status = "okay"
    instruction on the external flash node, matching the explicit-status
    addition on &mx25r64 in the sample overlays.
  • Step 5 (MCUboot Kconfig): replaced the old "disable
    CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS" paragraph with the full Kconfig
    block now used by the sample
    (CONFIG_BOOT_MAX_IMG_SECTORS_AUTO=n,
    CONFIG_BOOT_MAX_IMG_SECTORS=239,
    CONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRESS=y,
    CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS=n)
    and added two short bullets explaining why each pair is needed.
    Removed the now-inaccurate "PM-only macros" sentence, since
    CHECK_HEADER_LOAD_ADDRESS does work with the DTS-based layout
    (the expected primary-slot range is derived from the DTS
    s0_partition node).

kapi-no added 2 commits May 25, 2026 15:59
Add a Fast Pair Locator Tag sample entry to the v3.4 migration guide
that lists the unique adjustments required when migrating the nRF53
Series DFU configuration with MCUboot in the overwrite mode from the
Partition Manager to devicetree (DTS).

The new entry refers the reader to the generic Fast Pair PM-to-DTS
migration steps from the v3.3 migration guide and supplements them
with the nRF53-specific actions:

- Enable SB_CONFIG_MCUBOOT_NRF53_MULTI_IMAGE_UPDATE in sysbuild so
  that the application core and network core images are updated
  together through MCUboot.
- Override the external flash node (for example, mx25r64) in the
  application core overlay to host slot1_partition (image-1) and
  slot3_partition (image-3); align slot3_partition with the
  RAM-backed slot2_partition from the upstream flash_sim overlay.
  Note that, unlike on nRF52 and nRF54L Series targets, the internal
  flash (flash0) only needs slot0_partition for MCUboot. Set
  status = "okay" on the external flash node explicitly to follow
  the convention used by the other |NCS| samples that consume its
  partitions and to guard against any overlay that might disable the
  chip before this one.
- Define the network core (flash1) partition layout (b0n_partition,
  provision_partition aliased as bl_storage, and s0_partition) once
  in the IPC radio sysbuild overlay.
- Add a B0N sysbuild image overlay that includes the IPC radio
  cpunet overlay and chooses b0n_partition as zephyr,code-partition,
  and enable CONFIG_USE_DT_CODE_PARTITION in the B0N image
  configuration.
- Adjust the MCUboot sysbuild image Kconfig configuration to align
  MCUboot with the DTS partition layout:
  * Disable CONFIG_BOOT_MAX_IMG_SECTORS_AUTO and set
    CONFIG_BOOT_MAX_IMG_SECTORS explicitly, because the
    nordic,qspi-nor binding used by mx25r64 does not declare the
    erase-block-size property and the MCUboot auto-compute therefore
    cannot determine the slot sector count from DTS.
  * Enable CONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRESS and disable its
    deprecated predecessor CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS, which
    otherwise auto-defaults to y in the overwrite-only mode. The
    new option verifies the secondary-slot image against the load
    address embedded in the image header, which is compatible with
    the DTS partition layout (the expected primary-slot range is
    derived from the DTS s0_partition node).

In addition, append a backwards compatibility note at the end of the
section that lists the specific partition offsets and sizes (slot3,
b0n, provision, and s0 partitions) needed to keep the new DTS layout
aligned with the legacy Partition Manager layout from |NCS| v3.3.0,
so that field-deployed devices flashed with the v3.3.0 release can
still receive DFU updates after the migration.

Ref: NCSDK-38010

Signed-off-by: Kamil Piszczek <Kamil.Piszczek@nordicsemi.no>
Add changelog entries for the Fast Pair Locator Tag nRF53 PM-to-DTS
migration:

- Bluetooth Fast Pair samples: note the migration of the
  nrf5340dk/nrf5340/cpuapp and thingy53/nrf5340/cpuapp board targets
  from the deprecated Partition Manager to the devicetree (DTS)
  partition layout, and the removal of the corresponding /ns board
  target variants from the sample. Highlight that the new DTS
  partition layout preserves DFU backwards compatibility with the
  legacy Partition Manager layout from the |NCS| v3.3.0 release.
- Google Fast Pair integration: note that the integration guide no
  longer carries the nRF53-specific Partition Manager exception, so
  the Partition Manager is fully deprecated for the supported Fast
  Pair project configurations.

Ref: NCSDK-38010

Signed-off-by: Kamil Piszczek <Kamil.Piszczek@nordicsemi.no>
@kapi-no kapi-no force-pushed the fast_pair_locator_tag_without_pm_nrf5340 branch from 9d5de66 to 408d862 Compare May 25, 2026 13:59
@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 25, 2026

Force pushed to clarify the misleading content

@kapi-no
Copy link
Copy Markdown
Contributor Author

kapi-no commented May 26, 2026

Heads-up on a sysbuild signing gap that affects the image address verification enabled in this PR.

The verification works for the cpunet image but not for the application image

This PR sets CONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRESS=y (and explicitly CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS=n) in the MCUboot sysbuild image overlay. With those settings, MCUboot reads ih_load_addr from the secondary-slot image header and checks it against the primary slot's address range before swapping (bootloader/mcuboot/boot/bootutil/src/loader.c, boot_validate_slot(), lines ~810-890).

I tested the SMP/MCUmgr DFU flow on the nRF5340 DK with three v10.2.99 packages built from this branch:

Package App header ih_load_addr Cpunet header ih_load_addr Result
Correct addresses 0x00000000 0x01002800 App rejected, cpunet accepted and used
Wrong app address 0x00000000 0x01002800 App rejected, cpunet accepted and used
Wrong radio address 0x00000000 0x01008800 App rejected, cpunet accepted then bricked

imgtool dumpinfo on dfu_application.zip confirms the headers above. There are two distinct issues:

1. Application image is signed with ih_load_addr = 0x0.

Not specific to a single "bad" package - it is true for every legitimate build of this sample. The NCS sysbuild signing script (nrf/cmake/sysbuild/image_signing.cmake) does not pass --load-addr or --rom-fixed to imgtool in the CONFIG_MCUBOOT_IMGTOOL_OVERWRITE_ONLY=y branch or in the default swap branch. The upstream Zephyr zephyr/cmake/mcuboot.cmake fallback has the same gap, and non-PM nRF53 builds are currently routed through that upstream script. The signed application image therefore carries ih_load_addr = 0, which is outside the [0xC000, 0xFB000) slot0_partition range, and MCUboot rejects every legitimate application DFU update.

The cpunet image is unaffected because nrf/cmake/sysbuild/b0_mcuboot_signing.cmake already signs it with --rom-fixed ${slot_address} (using the ABSOLUTE form of dt_partition_addr), so its header carries the correct 0x01002800.

2. MCUboot's cpunet check is range membership, not equality to slot start.

The wrong-radio package was signed with ih_load_addr = 0x01008800, inside the s0_partition range [0x01002800, 0x01040800) but not at the slot start. MCUboot accepts it (min_addr <= ih_load_addr < max_addr in boot_validate_slot()), copies it to 0x01002800, and the cpunet faults on the first instruction because the image was linked for 0x01008800. This is a separate MCUboot improvement and is out of scope here.

Fix in flight

sdk-nrf#29021 - sysbuild: image_signing: set ih_load_addr from slot0 partition (draft) - closes the application-image gap at the build-system level:

  • Reads the absolute slot0_partition address with dt_partition_addr(... REQUIRED ABSOLUTE) and passes it to imgtool as --rom-fixed ${slot0_partition_address} for both the OVERWRITE_ONLY and default swap branches in nrf/cmake/sysbuild/image_signing.cmake. Mirrors the existing cpunet signing pattern in nrf/cmake/sysbuild/b0_mcuboot_signing.cmake.
  • Adds SB_CONFIG_SOC_SERIES_NRF53 to the list of platforms in nrf/sysbuild/CMakeLists.txt that route through the NCS sysbuild signing script, so non-PM nRF53 builds actually exercise the fix. Mirrors the existing treatment of SB_CONFIG_SOC_SERIES_NRF54L and SB_CONFIG_SOC_SERIES_NRF54H.

With #29021 applied, the signed application image now carries ih_load_addr = 0xc000 and flags = ROM_FIXED, derived from DT - no sample-side workaround needed. Confirmed end-to-end on the nRF5340 DK with the nRF Connect Device Manager mobile app: a legitimate v10.2.99 update is accepted by MCUboot and the device boots into the updated firmware on both cores.

A matching upstream Zephyr change in zephyr/cmake/mcuboot.cmake is noted as a follow-up in the description of #29021 for users that do not route through the NCS sysbuild signing script.

No changes needed in this PR; once #29021 lands the verification enabled here will work for both legitimate application updates and rejection of mis-targeted ones.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

changelog DNM doc-required PR must not be merged without tech writer approval.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants