[nrf noup] boot/bootutil/loader: image discovery by ih_load_address #461

nvlsianpu · 2025-07-02T15:48:14Z

Introduce alternative procedure for detecting to which partition
image candidate belongs. This method uses ih_load_address field of the
image header instead of reset vector address. This allows to match
incoming image to the partition even when it is for instance encrypted,
as the image header is always plain-text.

This new procedure can be enabled using
CONFIG_MCUBOOT_USE_CHECK_LOAD_ADDR=y. Firmware need to be signed with
imgtool.py sign --rom-fixed <partition_address> parameter.

ref.: NCSIDB-1173

manifest-pr-skip

Copilot

Pull Request Overview

Adds a configuration option to use the image header’s load address for slot discovery instead of the reset handler address.

Introduce MCUBOOT_USE_CHECK_LOAD_ADDR Kconfig option and adjust dependencies for MCUBOOT_VERIFY_IMG_ADDRESS
Refactor boot_validate_slot and boot_validated_swap_type to read ih_load_addr when enabled
Define new IS_IN_RANGE_* macros for address range checks

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
boot/zephyr/Kconfig	Add new config `MCUBOOT_USE_CHECK_LOAD_ADDR` and update dependencies
boot/bootutil/src/loader.c	Conditional read of `ih_load_addr`, macro definitions, and slot validation updates

Comments suppressed due to low confidence (3)

boot/bootutil/src/loader.c:1264

Mismatched #ifdef/#else guards—this #else does not match the preceding #ifdef CONFIG_MCUBOOT_USE_CHECK_LOAD_ADDR correctly and will break compilation.

#else /* BOOT_USE_CHECK_LOAD_ADDR */

boot/bootutil/src/loader.c:1522

Extra closing parenthesis in macro definition leads to a syntax error; remove the surplus ) at the end.

#define IS_IN_RANGE_CPUNET_APP_ADDR(_addr) ((_addr) >= PM_CPUNET_APP_ADDRESS && (_addr) < PM_CPUNET_APP_END_ADDRESS))

boot/bootutil/src/loader.c:1595

The IS_IN_RANGE_S_VARIANT_ADDR macro expects two parameters but is invoked with one; use IS_IN_RANGE_S_ALTERNATE_ADDR or IS_IN_RANGE_S_CURRENT_ADDR instead.

            if (IS_IN_RANGE_S_VARIANT_ADDR(internal_img_addr)) {

Copilot · 2025-07-04T15:36:50Z

boot/zephyr/Kconfig

+	  If y, the bootloader will use the load address form image header
+	  for checking to which slot image belongs instead of usage of reset
+	  handler addres reading form the image.


[nitpick] Typo in help text: replace “form image header” with “from image header” and correct “addres” to “address”.

Suggested change

If y, the bootloader will use the load address form image header

for checking to which slot image belongs instead of usage of reset

handler addres reading form the image.

If y, the bootloader will use the load address from image header

for checking to which slot image belongs instead of usage of reset

handler address reading from the image.

sonarqubecloud · 2025-07-24T11:56:37Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

nordicjm

add nrf-squash! [nrf noup] treewide: Add support for sysbuild assigned images to commit message

nordicjm · 2025-07-24T12:10:52Z

boot/bootutil/src/loader.c

        struct image_header *secondary_hdr = boot_img_hdr(state, slot);
-        uint32_t reset_value = 0;
-        uint32_t reset_addr = secondary_hdr->ih_hdr_size + sizeof(reset_value);
+        uint32_t internal_img_addr = 0; /* either the reset handler addres or the image beginning addres */


boot/bootutil/src/loader.c

nordicjm · 2025-07-24T12:13:33Z

boot/zephyr/Kconfig

 	bool

+config MCUBOOT_USE_CHECK_LOAD_ADDR
+	bool "use check of load address"


Suggested change

bool "use check of load address"

bool "Use check of load address"

if we're adding to all new images, do we want to default y this? Or I guess not right away so other things e.g. qspi xip can be updated

nordicjm · 2025-07-24T12:14:24Z

boot/bootutil/src/loader.c


+#define IS_IN_RANGE_CPUNET_APP_ADDR(_addr) ((_addr) >= PM_CPUNET_APP_ADDRESS && (_addr) < PM_CPUNET_APP_END_ADDRESS)
+#define _IS_IN_RANGE_S_VARIANT_ADDR(_addr, x) ((_addr) >= PM_S##x_ADDRESS && (_addr) <= (PM_S##x_ADDRESS + PM_S##x_SIZE))
+#if (CONFIG_NCS_IS_VARIANT_IMAGE)


nrf-squash! [nrf noup] treewide: Add support for sysbuild assigned images Introduce alternative procedure for detecting to which partition image candidate belongs. This method uses ih_load_address field of the image header instead of reset vector address. This allows to match incoming image to the partition even when it is for instance encrypted, as the image header is always plain-text. This new procedure can be enabled using CONFIG_MCUBOOT_CHECK_HEADER_LOAD_ADDRES =y. Firmware need to be signed with imgtool.py sign --rom-fixed <partition_address> parameter. ref.: NCSIDB-1173 Signed-off-by: Andrzej Puzdrowski <[email protected]>

sonarqubecloud · 2025-10-10T19:28:30Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

nordicjm · 2025-10-13T07:51:52Z

boot/bootutil/src/loader.c

         */
+#ifdef PM_CPUNET_APP_ADDRESS
        if (BOOT_CURR_IMG(state) == CONFIG_MCUBOOT_NETWORK_CORE_IMAGE_NUMBER) {
+


Suggested change

nordicjm · 2025-10-13T07:52:14Z

boot/bootutil/src/loader.c

-            check_addresses = true;
-        } else
-#endif
+


Suggested change

nordicjm · 2025-10-13T07:52:49Z

boot/bootutil/src/loader.c

+        }
+#endif /* CHECK_MCUBOOT_IMAGE */
+
+#if CONFIG_MCUBOOT_APPLICATION_IMAGE_NUMBER != -1


Suggested change

#if CONFIG_MCUBOOT_APPLICATION_IMAGE_NUMBER != -1

there is always an app update image

nordicjm · 2025-10-13T07:52:54Z

boot/bootutil/src/loader.c

 #endif
-            check_addresses = true;
        }
+#endif


Suggested change

#endif

nordicjm · 2025-10-13T07:52:58Z

boot/bootutil/src/loader.c

-#else
-            min_addr = pri_fa->fa_off;
-            max_addr = pri_fa->fa_off + pri_fa->fa_size;
+


Suggested change

nordicjm · 2025-10-13T07:54:41Z

boot/bootutil/src/loader.c

+#if CHECK_MCUBOOT_IMAGE == 1
+            min_addr = MIN(min_addr, NCS_VARIANT_SLOT_MIN_ADDR);
+            max_addr = MAX(max_addr, NCS_VARIANT_SLOT_MAX_ADDR);


this seems to preset an unintended side effect, an image that spans across both the s0/s1 and the application partitions would pass this validation

nordicjm · 2025-10-13T07:56:27Z

boot/bootutil/src/loader.c

                BOOT_LOG_ERR("Cleaned-up secondary slot of image %d", BOOT_CURR_IMG(state));
                return BOOT_SWAP_TYPE_FAIL;
-            } else if (reset_addr < primary_fa->fa_off || reset_addr > (primary_fa->fa_off + primary_fa->fa_size)) {
+            } else if (!IS_IN_RANGE_IMAGE_ADDR(internal_img_addr, primary_fa)) {


what happens if the primary and secondary slots are located in e.g. SPI or QSPI? This is how QSPI XIP split image support works and an upcoming extra DFU slot system will work

nvlsianpu marked this pull request as draft July 2, 2025 15:49

nvlsianpu force-pushed the img_disc_by_load_addr branch 2 times, most recently from dda8a3b to db3fe90 Compare July 3, 2025 14:17

nvlsianpu requested a review from Copilot July 4, 2025 15:35

Copilot AI reviewed Jul 4, 2025

View reviewed changes

nvlsianpu force-pushed the img_disc_by_load_addr branch from db3fe90 to 2fb0029 Compare July 7, 2025 12:49

This was referenced Jul 8, 2025

manifest: update mcuboot nrfconnect/sdk-nrf#23187

Closed

cmake/sysbuild/image_signing: allow usage --rom-fixed for images target partition recognition nrfconnect/sdk-nrf#23242

Open

nvlsianpu force-pushed the img_disc_by_load_addr branch from 2fb0029 to 5155061 Compare July 24, 2025 11:55

nvlsianpu marked this pull request as ready for review July 24, 2025 11:57

nvlsianpu requested review from de-nordic and nordicjm as code owners July 24, 2025 11:57

nordicjm requested changes Jul 24, 2025

View reviewed changes

rlubos force-pushed the main branch from 4e48cbd to d69621e Compare August 1, 2025 13:56

de-nordic force-pushed the img_disc_by_load_addr branch from 5155061 to aa627f8 Compare September 10, 2025 18:20

de-nordic changed the title ~~[nrf noup] boot/bootutil/loader: image discovery by ih_load_address~~ [wip] [nrf noup] boot/bootutil/loader: image discovery by ih_load_address Sep 10, 2025

de-nordic force-pushed the img_disc_by_load_addr branch from aa627f8 to 900c495 Compare September 11, 2025 08:17

NordicBuilder mentioned this pull request Sep 11, 2025

manifest: update mcuboot nrfconnect/sdk-nrf#24484

Closed

de-nordic force-pushed the img_disc_by_load_addr branch 5 times, most recently from 566d3f3 to e1d9d3f Compare September 12, 2025 14:53

de-nordic force-pushed the img_disc_by_load_addr branch 6 times, most recently from 9da4fd3 to 89a583a Compare October 1, 2025 08:03

de-nordic force-pushed the img_disc_by_load_addr branch 11 times, most recently from 6460f21 to 4752c56 Compare October 7, 2025 14:22

de-nordic force-pushed the img_disc_by_load_addr branch 2 times, most recently from 0f013f2 to d91e83e Compare October 10, 2025 19:20

de-nordic force-pushed the img_disc_by_load_addr branch from d91e83e to 6435279 Compare October 10, 2025 19:27

de-nordic changed the title ~~[wip] [nrf noup] boot/bootutil/loader: image discovery by ih_load_address~~ [nrf noup] boot/bootutil/loader: image discovery by ih_load_address Oct 10, 2025

nordicjm reviewed Oct 13, 2025

View reviewed changes

	bool "use check of load address"
	bool "Use check of load address"

[nrf noup] boot/bootutil/loader: image discovery by ih_load_address #461

Are you sure you want to change the base?

[nrf noup] boot/bootutil/loader: image discovery by ih_load_address #461

Uh oh!

Conversation

nvlsianpu commented Jul 2, 2025 • edited by de-nordic Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 4, 2025

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Jul 24, 2025

Quality Gate passed

Uh oh!

nordicjm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Oct 10, 2025

Quality Gate passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nvlsianpu commented Jul 2, 2025 •

edited by de-nordic

Loading