sysbuild: image_signing: set ih_load_addr from slot0 partition#29021
Open
kapi-no wants to merge 1 commit into
Open
sysbuild: image_signing: set ih_load_addr from slot0 partition#29021kapi-no wants to merge 1 commit into
kapi-no wants to merge 1 commit into
Conversation
The MCUboot CHECK_HEADER_LOAD_ADDRESS feature (CONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRESS) verifies that an image in the secondary slot is intended for the primary slot by comparing the ih_load_addr field in the image header against the primary slot boundaries. The NCS sysbuild signing script did not pass --load-addr or --rom-fixed to imgtool for the OVERWRITE_ONLY and default swap branches, leaving ih_load_addr at zero in the signed application image. This caused MCUboot to reject every legitimate application update because zero falls outside the primary slot's address range. Updated nrf/cmake/sysbuild/image_signing.cmake to read the absolute slot0_partition address with dt_partition_addr ABSOLUTE and pass it as --rom-fixed to imgtool for both the OVERWRITE_ONLY and default swap branches. The ROM_FIXED flag follows the pattern already used by the cpunet image signing in nrf/cmake/sysbuild/b0_mcuboot_signing.cmake. Added SB_CONFIG_SOC_SERIES_NRF53 to the list of platforms in nrf/sysbuild/CMakeLists.txt that route through the NCS sysbuild signing script instead of the upstream zephyr/cmake/mcuboot.cmake. This makes non-PM nRF53 builds (such as the Fast Pair Locator Tag sample migrated to DTS) pick up the ih_load_addr fix. The change mirrors the existing treatment of SB_CONFIG_SOC_SERIES_NRF54L and SB_CONFIG_SOC_SERIES_NRF54H. Verified on the nRF5340 DK Fast Pair Locator Tag sample (nrf5340dk/nrf5340/cpuapp): the signed application image now reports ih_load_addr = 0xc000 and flags = ROM_FIXED, matching the slot0_partition definition in DTS. The cpunet image signing remains unchanged (ih_load_addr = 0x01002800, flags = ROM_FIXED). The equivalent fix is needed in upstream Zephyr (zephyr/cmake/mcuboot.cmake) for users that do not route through the NCS sysbuild signing script. Ref: NCSDK-38010 Signed-off-by: Kamil Piszczek <Kamil.Piszczek@nordicsemi.no>
Contributor
CI InformationTo view the history of this post, click the 'edited' button above Inputs:Sources:sdk-nrf: PR head: 7b4d2ba191123cf2490db0bfa630fcb3c7749299 more detailssdk-nrf:
Github labels
List of changed files detected by CI (2)Outputs:ToolchainVersion: f0aa129f09 Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped;
|
5 tasks
Contributor
Memory footprint analysis revealed the following potential issuesapplications.hpf.gpio.mbox[nrf54l15dk/nrf54l15/cpuflpr]: High RAM usage: 7202[B] - link (cc: @nrfconnect/ncs-ll-ursus) Note: This message is automatically posted and updated by the CI (latest/sdk-nrf/PR-29021/2) |
nvlsianpu
requested changes
May 27, 2026
| if(CONFIG_MCUBOOT_IMGTOOL_OVERWRITE_ONLY) | ||
| # Use overwrite-only instead of swap upgrades. | ||
| set(imgtool_rom_command --overwrite-only --align 1) | ||
| set(imgtool_rom_command --overwrite-only --align 1 --rom-fixed ${slot0_partition_address}) |
Contributor
There was a problem hiding this comment.
This should be done with zephyr,code-partition as few deozen line bellow.
nvlsianpu
reviewed
May 27, 2026
| set(imgtool_rom_command --rom-fixed ${code_partition_offset} --align ${write_block_size}) | ||
| else() | ||
| set(imgtool_rom_command --align ${write_block_size}) | ||
| set(imgtool_rom_command --align ${write_block_size} --rom-fixed ${slot0_partition_address}) |
Contributor
There was a problem hiding this comment.
Suggested change
| set(imgtool_rom_command --align ${write_block_size} --rom-fixed ${slot0_partition_address}) | |
| dt_chosen(code_partition PROPERTY "zephyr,code-partition") | |
| dt_partition_addr(code_partition_offset PATH "${code_partition}" REQUIRED) | |
| set(imgtool_rom_command --align ${write_block_size} --rom-fixed ${code_partition_offset) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the NCS sysbuild signing pipeline so that the application image header carries a non-zero
ih_load_addr, makingCONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRESS=ywork for legitimate DFU updates instead of rejecting every package.Background
MCUboot's
CONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRESSfeature verifies that an image in the secondary slot is intended for the primary slot by comparing theih_load_addrfield in the image header against the primary slot boundaries (bootloader/mcuboot/boot/bootutil/src/loader.c,boot_validate_slot(), lines ~810-890):The NCS sysbuild signing script (
nrf/cmake/sysbuild/image_signing.cmake) did not pass--load-addror--rom-fixedtoimgtoolfor theCONFIG_MCUBOOT_IMGTOOL_OVERWRITE_ONLY=ybranch and for the default swap branch. The signed application image therefore hadih_load_addr = 0x0, which is outside the primary slot range, so MCUboot would reject every legitimate update.The same gap exists in upstream
zephyr/cmake/mcuboot.cmake; a follow-up fix is needed there for users that do not route through the NCS sysbuild signing script.Changes
nrf/cmake/sysbuild/image_signing.cmake— read the absoluteslot0_partitionaddress withdt_partition_addr(... REQUIRED ABSOLUTE)and pass it toimgtoolas--rom-fixed ${slot0_partition_address}for both theOVERWRITE_ONLYand default swap branches.--rom-fixedmatches the pattern already used by the cpunet image signing innrf/cmake/sysbuild/b0_mcuboot_signing.cmakeand avoids the spuriousIMAGE_F_RAM_LOADflag that--load-addrwould set.nrf/sysbuild/CMakeLists.txt— addSB_CONFIG_SOC_SERIES_NRF53to the list of platforms that route through the NCS sysbuild signing script. This makes non-PM nRF53 builds (such as the Fast Pair Locator Tag sample being migrated to DTS in PR samples: fast_pair: locator_tag: migrate nRF53 targets to DTS partitioning #28462) pick up the fix. Mirrors the existing treatment ofSB_CONFIG_SOC_SERIES_NRF54LandSB_CONFIG_SOC_SERIES_NRF54H.Verification
Built the Fast Pair Locator Tag sample for
nrf5340dk/nrf5340/cpuappagainst this branch + the DTS-migrated sample (PR #28462). Usedimgtool dumpinfoto inspect the signed images and the resultingdfu_application.zip:locator_tag.signed.bin(app)load_addr = 0x0,flags = 0x0load_addr = 0xc000,flags = ROM_FIXEDsigned_by_mcuboot_and_b0_ipc_radio.bin(cpunet)load_addr = 0x01002800,flags = ROM_FIXED0xc000matches theslot0_partition@c000reg insamples/bluetooth/fast_pair/locator_tag/configuration/boards/nrf5340dk_nrf5340_cpuapp.overlay, derived from DT (no sample-level Kconfig workaround needed).Notes
IMAGE_F_ROM_FIXEDflag is only consulted by MCUboot inMCUBOOT_DIRECT_XIPmode (boot_rom_address_check()inloader.c), so it has no runtime side effect in OVERWRITE_ONLY/swap configurations beyond providing theih_load_addrvalue that the newCHECK_HEADER_LOAD_ADDRESScheck needs.zephyr/cmake/mcuboot.cmakefor users that build outside the NCS sysbuild signing path. I am happy to follow up with a PR to the Zephyr fork once this lands.min_addr <= ih_load_addr < max_addr), not equality to the slot start, so a deliberately mis-targeted cpunet image inside the slot still passes verification. Tightening that to requireih_load_addr == NETCPU_APP_SLOT_OFFSETis a separate MCUboot improvement.Ref: NCSDK-38010