Skip to content

modules: mcuboot: enable support for RAMLOAD mode with revert #85254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Aug 5, 2025
Merged

modules: mcuboot: enable support for RAMLOAD mode with revert #85254

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
5ce884e
samples: subsys: mcumgr: rework ram load support for multiple boards
danieldegrasse Feb 3, 2025
a62c1e7
soc: nxp: common: disable FLASH_MCUX_FLEXSPI_XIP if using ramload
danieldegrasse Feb 3, 2025
c9f27d1
samples: subsys: mgmt: mcumgr: add support for ramload on mimxrt1050_evk
danieldegrasse Feb 3, 2025
cc38cf7
modules: mcuboot: add Kconfigs for RAMLOAD_WITH_REVERT mode
danieldegrasse Feb 5, 2025
28790dc
scripts: ci: exempt BOOT_RAM_LOAD_REVERT from checks
danieldegrasse Feb 5, 2025
29d4747
cmake: mcuboot: respect alignment size when signing for ramload mode
danieldegrasse Feb 5, 2025
157485b
cmake: mcuboot: prefer confirmed image when one is created
danieldegrasse Feb 5, 2025
8b90114
soc: nxp: flexspi_xip: Update FLASH_MCUX_FLEXSPI_XIP ramload dependen…
danieldegrasse Feb 5, 2025
8c46a99
dfu: mcuboot: update dependencies for RAMLOAD_WITH_REVERT
danieldegrasse Feb 5, 2025
c4f2cb7
dfu: boot: mcuboot: fix boot_fetch_active_slot
danieldegrasse Feb 5, 2025
16348e2
mgmt: update img_mgmt_slot_in_use for ramload with revert mode
danieldegrasse Jun 24, 2025
bb8c665
samples: mgmt: mcumgr: add testcase for ramload with revert
danieldegrasse Feb 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions cmake/mcuboot.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ function(zephyr_mcuboot_tasks)
if(CONFIG_MCUBOOT_IMGTOOL_OVERWRITE_ONLY)
# Use overwrite-only instead of swap upgrades.
set(imgtool_args --overwrite-only --align 1 ${imgtool_args})
elseif(CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD)
elseif(CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD OR CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD_WITH_REVERT)
# RAM load requires setting the location of where to load the image to
dt_chosen(chosen_ram PROPERTY "zephyr,sram")
dt_reg_addr(chosen_ram_address PATH ${chosen_ram})
Expand All @@ -130,7 +130,8 @@ function(zephyr_mcuboot_tasks)
dt_nodelabel(slot1_partition NODELABEL "slot1_partition" REQUIRED)
dt_reg_addr(slot1_partition_address PATH ${slot1_partition})

set(imgtool_args --align 1 --load-addr ${chosen_ram_address} ${imgtool_args})
dt_prop(write_block_size PATH "${flash_node}" PROPERTY "write-block-size")
set(imgtool_args --align ${write_block_size} --load-addr ${chosen_ram_address} ${imgtool_args})
Comment on lines +133 to +134
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fallback needed if write-block-size is not set. the generic spi-nor flash driver does not have this prop and also not allow this prop to be added. If it is not set imgtool will complain, that align is without argument

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd argue we need to allow the generic spi-nor-flash driver to add that property in this case- typically this is done by including the soc-nv-flash compatible, but you can also define the property directly

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added it here: #95152

Copy link
Member

@erwango erwango Sep 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@danieldegrasse This change indeed broke the RAMLOAD build on our side.
I see #95152 is supposed to fix it, but it seems blocked for the time being. Would it be possible to revert this specific change (if its absence doesn't break the whole goal of this PR) waiting to have a consensus on a way to avoid breaking existing users ?

Copy link
Contributor

@nordicjm nordicjm Sep 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would suggest putting this align part in an if() for the revert part, the normal RAM load part should never need a value here that is not 1

set(imgtool_args_alt_slot ${imgtool_args} --hex-addr ${slot1_partition_address})
set(imgtool_args ${imgtool_args} --hex-addr ${slot0_partition_address})
elseif(CONFIG_MCUBOOT_BOOTLOADER_MODE_SINGLE_APP_RAM_LOAD)
Expand Down Expand Up @@ -178,6 +179,7 @@ function(zephyr_mcuboot_tasks)
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands COMMAND
${imgtool_sign} ${imgtool_args} --pad --confirm ${output}.bin
${output}.signed.confirmed.bin)
zephyr_runner_file(bin ${output}.signed.confirmed.bin)
endif()

if(NOT "${keyfile_enc}" STREQUAL "")
Expand All @@ -190,7 +192,7 @@ function(zephyr_mcuboot_tasks)
${output}.signed.encrypted.bin)
endif()

if(CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD)
if(CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD OR CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD_WITH_REVERT)
list(APPEND byproducts ${output}.slot1.signed.encrypted.bin)
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands COMMAND
${imgtool_sign} ${imgtool_args_alt_slot} ${output}.bin
Expand Down Expand Up @@ -241,6 +243,7 @@ function(zephyr_mcuboot_tasks)
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands COMMAND
${imgtool_sign} ${imgtool_args} --pad --confirm ${output}.hex
${output}.signed.confirmed.hex)
zephyr_runner_file(hex ${output}.signed.confirmed.hex)
endif()

if(NOT "${keyfile_enc}" STREQUAL "")
Expand All @@ -253,7 +256,7 @@ function(zephyr_mcuboot_tasks)
${output}.signed.encrypted.hex)
endif()

if(CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD)
if(CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD OR CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD_WITH_REVERT)
list(APPEND byproducts ${output}.slot1.signed.hex)
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands COMMAND
${imgtool_sign} ${imgtool_args_alt_slot} ${output}.hex
Expand Down
22 changes: 22 additions & 0 deletions modules/Kconfig.mcuboot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,28 @@ config MCUBOOT_BOOTLOADER_MODE_RAM_LOAD
This option automatically selects MCUBOOT_BOOTLOADER_NO_DOWNGRADE as it is not possible
to swap back to older version of the application.

config MCUBOOT_BOOTLOADER_MODE_RAM_LOAD_WITH_REVERT
bool "MCUboot has been configured for RAM LOAD with revert"
select MCUBOOT_BOOTLOADER_MODE_HAS_NO_DOWNGRADE
select MCUBOOT_BOOTLOADER_NO_DOWNGRADE
help
MCUboot expects slot0_partition and slot1_partition to exist in DT. In this mode, MCUboot
will select the image with the higher version number, copy it to RAM and begin execution
from there. The image must be linked to execute from RAM, the address that it is copied
to is specified using the load-addr argument when running imgtool.
This option automatically selectes MCUBOOT_BOOTLOADER_NO_DOWNGRADE as
MCUBoot will automatically select the highest revision of the application
to boot. Note however that MCUBoot will select an older revision of
the application if the booted revision does not mark itself as confirmed.
In this mode MCUboot will boot the application with the higher
version from either slot, as long as it has been marked to be boot
next time for test or permanently. In case when application is marked
for test it needs to confirm itself, on the first boot, or it will be
removed and MCUboot will revert to booting previously approved
application. Note that in this mode MCUboot will not boot an
application if it does not have an image header, so if an application
is flashed manually it should be marked as confirmed

config MCUBOOT_BOOTLOADER_MODE_DIRECT_XIP
bool "MCUboot has been configured for DirectXIP operation"
select MCUBOOT_BOOTLOADER_MODE_HAS_NO_DOWNGRADE
Expand Down
1 change: 1 addition & 0 deletions samples/subsys/mgmt/mcumgr/smp_svr/boards/mimxrt1050_evk_hyperflash_ram_load.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
CONFIG_USE_DT_CODE_PARTITION=y
53 changes: 53 additions & 0 deletions samples/subsys/mgmt/mcumgr/smp_svr/boards/mimxrt1050_evk_hyperflash_ram_load.overlay
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
/*
* Copyright (c) 2025 Tenstorrent AI ULC
*
* SPDX-License-Identifier: Apache-2.0
*/

/*
* Layout must match the hyperflash_ram_load overlay file within mcuboot
* application configuration directory
*/

/delete-node/ &sdram0;

/ {
sram@80007F00 {
compatible = "zephyr,memory-region", "mmio-sram";
reg = <0x80007F00 0x100>;
zephyr,memory-region = "RetainedMem";
status = "okay";

retainedmem {
compatible = "zephyr,retained-ram";
status = "okay";
#address-cells = <1>;
#size-cells = <1>;

boot_info0: boot_info@0 {
compatible = "zephyr,retention";
status = "okay";
reg = <0x0 0x100>;
};
};
};

chosen {
zephyr,bootloader-info = &boot_info0;
zephyr,sram = &sdram_split;
};

/*
* Adjust sdram0 to reserve first 30KB for MCUBoot, and
* remaining 2KB for retained memory
*/
sdram_split: sdram_split@80008000 {
reg = <0x80008000 (0x2000000 - DT_SIZE_K(32))>;
};

};

/* Reduce size of slot 0 to match slot 1 */
&slot0_partition {
reg = <0x40000 0x300000>;
};
36 changes: 35 additions & 1 deletion samples/subsys/mgmt/mcumgr/smp_svr/boards/nrf52840dk_nrf52840_ram_load.overlay
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,40 @@
/delete-node/ &sram0;

#include "../sysbuild/nrf52840dk_nrf52840_mcuboot_ram_load.overlay"
/*
* Layout must match the nrf52840dk_nrf52840_ram_load overlay file within mcuboot
* application configuration directory
*/

&gpregret1 {
/delete-node/ boot_mode@0;
};

/ {
sram@2003FC00 {
compatible = "zephyr,memory-region", "mmio-sram";
reg = <0x2003FC00 DT_SIZE_K(1)>;
zephyr,memory-region = "RetainedMem";
status = "okay";

retainedmem {
compatible = "zephyr,retained-ram";
status = "okay";
#address-cells = <1>;
#size-cells = <1>;

boot_info0: boot_info@0 {
compatible = "zephyr,retention";
status = "okay";
reg = <0x0 0x100>;
};
};
};

chosen {
/delete-property/ zephyr,boot-mode;
zephyr,bootloader-info = &boot_info0;
};
};

/ {
chosen {
Expand Down
11 changes: 10 additions & 1 deletion samples/subsys/mgmt/mcumgr/smp_svr/sample.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,8 +182,17 @@ tests:
- EXTRA_CONF_FILE="overlay-serial.conf"
platform_allow:
- nrf52840dk/nrf52840
- mimxrt1050_evk/mimxrt1052/hyperflash
sample.mcumgr.smp_svr.ram_load_revert.serial:
extra_args:
- FILE_SUFFIX="ram_load"
- EXTRA_CONF_FILE="overlay-serial.conf"
- SB_CONFIG_MCUBOOT_MODE_RAM_LOAD_WITH_REVERT=y
- smp_svr_CONFIG_MCUBOOT_GENERATE_CONFIRMED_IMAGE=y
platform_allow:
- mimxrt1050_evk/mimxrt1052/hyperflash
integration_platforms:
- nrf52840dk/nrf52840
- mimxrt1050_evk/mimxrt1052/hyperflash
sample.mcumgr.smp_svr.ram_load.serial.fs.shell:
extra_args:
- FILE_SUFFIX="ram_load"
Expand Down
4 changes: 0 additions & 4 deletions samples/subsys/mgmt/mcumgr/smp_svr/sysbuild/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,5 @@
# SPDX-License-Identifier: Apache-2.0

if("${FILE_SUFFIX}" STREQUAL "ram_load")
set(mcuboot_EXTRA_DTC_OVERLAY_FILE "${CMAKE_CURRENT_LIST_DIR}/nrf52840dk_nrf52840_mcuboot_ram_load.overlay" CACHE INTERNAL "" FORCE)
endif()

find_package(Sysbuild REQUIRED HINTS $ENV{ZEPHYR_BASE})

project(sysbuild LANGUAGES)
33 changes: 0 additions & 33 deletions samples/subsys/mgmt/mcumgr/smp_svr/sysbuild/nrf52840dk_nrf52840_mcuboot_ram_load.overlay
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions scripts/ci/check_compliance.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1207,6 +1207,7 @@ def check_no_undef_outside_kconfig(self, kconf):
"BOOT_IMAGE_EXECUTABLE_RAM_START", # MCUboot setting
"BOOT_MAX_IMG_SECTORS_AUTO", # Used in sysbuild
"BOOT_RAM_LOAD", # Used in sysbuild for MCUboot configuration
"BOOT_RAM_LOAD_REVERT", # Used in sysbuild for MCUboot configuration
"BOOT_SERIAL_BOOT_MODE", # Used in (sysbuild-based) test/
# documentation
"BOOT_SERIAL_CDC_ACM", # Used in (sysbuild-based) test
Expand Down
8 changes: 7 additions & 1 deletion share/sysbuild/image_configurations/BOOTLOADER_image_default.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ elseif(SB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY)
set(bootmode CONFIG_BOOT_UPGRADE_ONLY)
elseif(SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP OR SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP_WITH_REVERT)
set(bootmode CONFIG_BOOT_DIRECT_XIP)
elseif(SB_CONFIG_MCUBOOT_MODE_RAM_LOAD)
elseif(SB_CONFIG_MCUBOOT_MODE_RAM_LOAD OR SB_CONFIG_MCUBOOT_MODE_RAM_LOAD_WITH_REVERT)
set(bootmode CONFIG_BOOT_RAM_LOAD)
elseif(SB_CONFIG_MCUBOOT_MODE_SINGLE_APP_RAM_LOAD)
set(bootmode CONFIG_SINGLE_APPLICATION_SLOT_RAM_LOAD)
Expand Down Expand Up @@ -56,6 +56,12 @@ else()
set_config_bool(${ZCMAKE_APPLICATION} CONFIG_BOOT_DIRECT_XIP_REVERT n)
endif()

if(SB_CONFIG_MCUBOOT_MODE_RAM_LOAD_WITH_REVERT)
set_config_bool(${ZCMAKE_APPLICATION} CONFIG_BOOT_RAM_LOAD_REVERT y)
else()
set_config_bool(${ZCMAKE_APPLICATION} CONFIG_BOOT_RAM_LOAD_REVERT n)
endif()

set(keytypes CONFIG_BOOT_SIGNATURE_TYPE_NONE
CONFIG_BOOT_SIGNATURE_TYPE_RSA
CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256
Expand Down
5 changes: 5 additions & 0 deletions share/sysbuild/image_configurations/MAIN_image_default.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,11 @@ if(SB_CONFIG_BOOTLOADER_MCUBOOT)
set_config_bool(${ZCMAKE_APPLICATION} CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD y)
set_config_bool(${ZCMAKE_APPLICATION} CONFIG_XIP n)
set_config_int(${ZCMAKE_APPLICATION} CONFIG_FLASH_SIZE 0)
elseif(SB_CONFIG_MCUBOOT_MODE_RAM_LOAD_WITH_REVERT)
# RAM load mode requires XIP be disabled and flash size be set to 0
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unrelated to the core of the PR, do you know why RAM_LOAD mode requires XIP=n, but SINGLE_APP_RAM_LOAD does not?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't, no- not familiar with SINGLE_APP_RAM_LOAD. @nordicjm do you know why this is the case?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

An oversight probably

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@edersondisouza

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

XIP is orthogonal to SINGLE_APP_RAM_LOAD - it simply loads the image to RAM. If the image was linked to run from the area in the RAM it is going to be loaded, it can use XIP.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

XIP is orthogonal to SINGLE_APP_RAM_LOAD - it simply loads the image to RAM. If the image was linked to run from the area in the RAM it is going to be loaded, it can use XIP.

Can you perhaps clarify this in the Kconfig help text, I think it's a very important point that will help many users.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

XIP is orthogonal to SINGLE_APP_RAM_LOAD - it simply loads the image to RAM. If the image was linked to run from the area in the RAM it is going to be loaded, it can use XIP.

that is not consistent with what the Kconfig does:

        help
          This option allows the kernel to operate with its text and read-only
          sections residing in ROM (or similar read-only memory). Not all boards
          support this option so it must be used with care; you must also
          supply a linker command file when building your image. Enabling this
          option increases both the code and data footprint of the image.

so XIP is execute from flash, non-XIP is execute from RAM

set_config_bool(${ZCMAKE_APPLICATION} CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD_WITH_REVERT y)
set_config_bool(${ZCMAKE_APPLICATION} CONFIG_XIP n)
set_config_int(${ZCMAKE_APPLICATION} CONFIG_FLASH_SIZE 0)
elseif(SB_CONFIG_MCUBOOT_MODE_SINGLE_APP_RAM_LOAD)
set_config_bool(${ZCMAKE_APPLICATION} CONFIG_MCUBOOT_BOOTLOADER_MODE_SINGLE_APP_RAM_LOAD y)
elseif(SB_CONFIG_MCUBOOT_MODE_FIRMWARE_UPDATER)
Expand Down
14 changes: 14 additions & 0 deletions share/sysbuild/images/bootloader/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,20 @@ config MCUBOOT_MODE_RAM_LOAD
Note: RAM must be assigned to the bootloader that is not used by the application in this
mode so that the bootloader is able to function until the application has booted.

config MCUBOOT_MODE_RAM_LOAD_WITH_REVERT
bool "RAM load with revert"
help
MCUboot expects slot0_partition and slot1_partition to exist in DT. In this mode, MCUboot
will select the image with the higher version number, copy it to RAM and begin execution
from there. MCUBoot will only boot an image if it has been marked to be boot next time
for test or permanently. In case when application is marked for test it needs to confirm
itself, on the first boot, or it will be removed and MCUboot will revert to booting
previously approved application. The image must be linked to execute from RAM, the address
that it is copied to is specified using the load-addr argument when running imgtool.

Note: RAM must be assigned to the bootloader that is not used by the application in this
mode so that the bootloader is able to function until the application has booted.

config MCUBOOT_MODE_FIRMWARE_UPDATER
bool "Firmware updater"
help
Expand Down
2 changes: 2 additions & 0 deletions soc/nxp/common/Kconfig.flexspi_xip
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ config FLASH_SIZE
config FLASH_MCUX_FLEXSPI_XIP
bool
default $(DT_FLASH_PARENT_IS_FLEXSPI)
depends on !(MCUBOOT_BOOTLOADER_MODE_RAM_LOAD || \
MCUBOOT_BOOTLOADER_MODE_RAM_LOAD_WITH_REVERT)
select XIP
help
Allows REfor the soc to safely initialize the clocks for the
Expand Down
Loading
Loading