NCSDK-35612: Fix offsets in merged slot builds

applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/app_common.dtsi

@@ -65,18 +65,6 @@
 	};
 };
 
-/* Define the necessary aliases for the MCUboot slots that will be used by the DFU transports.
- * Due to the build system limitation, the allowed size of the application image (configured by
- * the code partition DTS node) is incorrectly increased by the size allocated for the radio image.
- */
-slot0_partition: &cpuapp_slot0_partition {
-	label = "image-0";
-};
-
-slot1_partition: &cpuapp_slot1_partition {
-	label = "image-1";
-};
-
 secondary_app_partition: &cpuapp_slot1_partition {};
 
 /* Remove the undefined property value from the disabled VPR cores to prevent build errors. */

applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/images/mcuboot/app.overlay

@@ -15,17 +15,6 @@
 	};
 };
 
-/* Define the necessary aliases for the DTS partition nodes that contain the application and
- * radio images.
- */
-slot0_partition: &cpuapp_slot0_partition {
-	label = "image-0";
-};
-
-slot1_partition: &cpuapp_slot1_partition {
-	label = "image-1";
-};
-
 /* Remove the undefined property value from the disabled VPR cores to prevent build errors. */
 &cpuflpr_vpr {
 	/delete-property/ source-memory;

applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/memory_map.dtsi

@@ -21,28 +21,31 @@
 			reg = <0x30000 DT_SIZE_K(24)>;
 		};
 
-		/* Due to the build system limitation, the allowed size of the application image
-		 * (configured by the code partition DTS node) is incorrectly increased by the size
-		 * allocated for the radio image.
+		/* When using merged slots, the definition of MCUboot slots is common for all
+		 * images and points to the "merged" partition.
 		 */
-		cpuapp_slot0_partition: partition@36000 {
+		slot0_partition: partition@36000 {
 			reg = <0x36000 DT_SIZE_K(808)>;
 		};
 
+		cpuapp_slot0_partition: partition@36800 {
+			reg = <0x36800 DT_SIZE_K(586)>;
+		};
+
 		cpurad_slot0_partition: partition@c9000 {
 			reg = <0xc9000 DT_SIZE_K(220)>;
 		};
 
 		/* Partitions belonging to the MRAM_11 memory block. */
 
-		/* Due to the build system limitation, the allowed size of the application image
-		 * (configured by the code partition DTS node) is incorrectly increased by the size
-		 * allocated for the radio image.
-		 */
-		cpuapp_slot1_partition: partition@100000 {
+		slot1_partition: partition@100000 {
 			reg = <0x100000 DT_SIZE_K(808)>;
 		};
 
+		cpuapp_slot1_partition: partition@100800 {
+			reg = <0x100800 DT_SIZE_K(586)>;
+		};
+
 		cpurad_slot1_partition: partition@193000 {
 			reg = <0x193000 DT_SIZE_K(220)>;
 		};

applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/sysbuild.conf

@@ -13,3 +13,5 @@ SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP=y
 SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y
 SB_CONFIG_BOOT_SIGNATURE_TYPE_PURE=y
 SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APPLICATION_CONFIG_DIR}/images/mcuboot/mcuboot_private.pem"
+# Reserve space for MCUboot trailer only in the radio slots.
+SB_CONFIG_MCUBOOT_IMAGES_ROM_END_OFFSET_AUTO="ipc_radio;ipc_radio_secondary_app"

applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/sysbuild_dongle.conf

@@ -13,3 +13,5 @@ SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP=y
 SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y
 SB_CONFIG_BOOT_SIGNATURE_TYPE_PURE=y
 SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APPLICATION_CONFIG_DIR}/images/mcuboot/mcuboot_private.pem"
+# Reserve space for MCUboot trailer only in the radio slots.
+SB_CONFIG_MCUBOOT_IMAGES_ROM_END_OFFSET_AUTO="ipc_radio;ipc_radio_secondary_app"

applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/sysbuild_release.conf

@@ -13,3 +13,5 @@ SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP=y
 SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y
 SB_CONFIG_BOOT_SIGNATURE_TYPE_PURE=y
 SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APPLICATION_CONFIG_DIR}/images/mcuboot/mcuboot_private.pem"
+# Reserve space for MCUboot trailer only in the radio slots.
+SB_CONFIG_MCUBOOT_IMAGES_ROM_END_OFFSET_AUTO="ipc_radio;ipc_radio_secondary_app"

applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/sysbuild_release_dongle.conf

@@ -13,3 +13,5 @@ SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP=y
 SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y
 SB_CONFIG_BOOT_SIGNATURE_TYPE_PURE=y
 SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APPLICATION_CONFIG_DIR}/images/mcuboot/mcuboot_private.pem"
+# Reserve space for MCUboot trailer only in the radio slots.
+SB_CONFIG_MCUBOOT_IMAGES_ROM_END_OFFSET_AUTO="ipc_radio;ipc_radio_secondary_app"

applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpurad/images/ipc_radio/app.overlay

@@ -6,12 +6,4 @@
 
 #include "../../../nrf54h20dk_nrf54h20_cpuapp/memory_map.dtsi"
 
-slot0_partition: &cpurad_slot0_partition {
-	label = "image-0";
-};
-
-slot1_partition: &cpurad_slot1_partition {
-	label = "image-1";
-};
-
 secondary_app_partition: &cpurad_slot1_partition {};

applications/nrf_desktop/src/modules/dfu.c

@@ -107,9 +107,14 @@ LOG_MODULE_REGISTER(MODULE, CONFIG_DESKTOP_CONFIG_CHANNEL_DFU_LOG_LEVEL);
 		BUILD_ASSERT(DT_FIXED_PARTITION_EXISTS(MCUBOOT_SECONDARY_NODE),
 			     "Missing secondary partition definition in DTS.");
 
+
 		#define CODE_PARTITION_START_ADDR    DT_FIXED_PARTITION_ADDR(CODE_PARTITION_NODE)
 		#define MCUBOOT_PRIMARY_START_ADDR   DT_FIXED_PARTITION_ADDR(MCUBOOT_PRIMARY_NODE)
 		#define MCUBOOT_SECONDARY_START_ADDR DT_FIXED_PARTITION_ADDR(MCUBOOT_SECONDARY_NODE)
+		#define MCUBOOT_PRIMARY_END_ADDR     (MCUBOOT_PRIMARY_START_ADDR + \
+						      DT_REG_SIZE(MCUBOOT_PRIMARY_NODE))
+		#define MCUBOOT_SECONDARY_END_ADDR   (MCUBOOT_SECONDARY_START_ADDR + \
+						      DT_REG_SIZE(MCUBOOT_SECONDARY_NODE))
 
 		#if MCUBOOT_PRIMARY_START_ADDR == MCUBOOT_SECONDARY_START_ADDR
 			#error Primary and secondary partitions cannot have the same address.
@@ -118,9 +123,15 @@ LOG_MODULE_REGISTER(MODULE, CONFIG_DESKTOP_CONFIG_CHANNEL_DFU_LOG_LEVEL);
 		#define MCUBOOT_PRIMARY_SLOT_ID   DT_FIXED_PARTITION_ID(MCUBOOT_PRIMARY_NODE)
 		#define MCUBOOT_SECONDARY_SLOT_ID DT_FIXED_PARTITION_ID(MCUBOOT_SECONDARY_NODE)
 
-		#if CODE_PARTITION_START_ADDR == MCUBOOT_PRIMARY_START_ADDR
+		/* Use range check to allow for placing MCUboot header in a separate partition,
+		 * so the application code partition is not an alias for the MCUboot partition,
+		 * but a subpartition of the MCUboot partition.
+		 */
+		#if (CODE_PARTITION_START_ADDR >= MCUBOOT_PRIMARY_START_ADDR) && \
+		    (CODE_PARTITION_START_ADDR < MCUBOOT_PRIMARY_END_ADDR)
 			#define DFU_SLOT_ID MCUBOOT_SECONDARY_SLOT_ID
-		#elif CODE_PARTITION_START_ADDR == MCUBOOT_SECONDARY_START_ADDR
+		#elif (CODE_PARTITION_START_ADDR >= MCUBOOT_SECONDARY_START_ADDR) && \
+		      (CODE_PARTITION_START_ADDR < MCUBOOT_SECONDARY_END_ADDR)
 			#define DFU_SLOT_ID MCUBOOT_PRIMARY_SLOT_ID
 		#else
 			#error Missing partition definitions in DTS.

cmake/sysbuild/mcuboot_nrf54h20.cmake

@@ -9,6 +9,7 @@ if(SB_CONFIG_MCUBOOT_SIGN_MERGED_BINARY)
   set(MERGED_IMAGES_HEX "mcuboot_merged.hex")
   UpdateableImage_Get(images GROUP "DEFAULT")
 
+  check_merged_slot_boundaries("slot0_partition" "${images}")
   merge_images_nrf54h20(${MERGED_IMAGES_HEX} "${images}")
   # Since all bootloader-enabled images are merged, disable programming subimages.
   list(REMOVE_ITEM images "${DEFAULT_IMAGE}")
@@ -19,6 +20,7 @@ if(SB_CONFIG_MCUBOOT_SIGN_MERGED_BINARY)
   UpdateableImage_Get(variants GROUP "VARIANT")
 
   if(variants)
+    check_merged_slot_boundaries("slot1_partition" "${variants}")
     merge_images_nrf54h20(${MERGED_IMAGES_SECONDARY_HEX} "${variants}")
     list(REMOVE_ITEM variants "mcuboot_secondary_app")
     disable_programming_nrf54h20("${variants}")

cmake/sysbuild/sign_nrf54h20.cmake

@@ -4,6 +4,45 @@
 
 include(${ZEPHYR_NRF_MODULE_DIR}/cmake/sysbuild/bootloader_dts_utils.cmake)
 
+function(check_merged_slot_boundaries merged_partition images)
+  # Predefine the MCUboot header size.
+  set(MCUBOOT_HEADER_SIZE 0x800)
+
+  # Fetch merged slot details from the mcuboot image.
+  dt_chosen(flash_node TARGET mcuboot PROPERTY "zephyr,flash")
+  dt_nodelabel(slot_path TARGET mcuboot NODELABEL "${merged_partition}" REQUIRED)
+  dt_partition_addr(slot_addr PATH "${slot_path}" TARGET mcuboot REQUIRED ABSOLUTE)
+  dt_reg_size(slot_size TARGET mcuboot PATH ${slot_path})
+
+  # Calculate boundaries of the usable area.
+  sysbuild_get(mcuboot_image_footer_size IMAGE mcuboot CACHE)
+  math(EXPR slot_max_addr "${slot_addr} + ${slot_size} - ${mcuboot_image_footer_size}" OUTPUT_FORMAT HEXADECIMAL)
+  math(EXPR slot_min_addr "${slot_addr} + ${MCUBOOT_HEADER_SIZE}" OUTPUT_FORMAT HEXADECIMAL)
+
+  # Iterate over images and check that they fit in the merged slots.
+  foreach(image ${images})
+    set(start_offset)
+    set(end_offset)
+    sysbuild_get(start_offset IMAGE ${image} VAR CONFIG_ROM_START_OFFSET KCONFIG)
+    sysbuild_get(end_offset IMAGE ${image} VAR CONFIG_ROM_END_OFFSET KCONFIG)
+    dt_chosen(code_flash TARGET ${image} PROPERTY "zephyr,code-partition")
+    dt_partition_addr(code_addr PATH "${code_flash}" TARGET ${image} REQUIRED ABSOLUTE)
+    dt_reg_size(code_size TARGET ${image} PATH ${code_flash})
+
+    math(EXPR code_end_addr "${code_addr} + ${code_size} - ${end_offset}" OUTPUT_FORMAT HEXADECIMAL)
+    math(EXPR code_start_addr "${code_addr} + ${start_offset}" OUTPUT_FORMAT HEXADECIMAL)
+
+    if((${code_end_addr} GREATER ${slot_max_addr}) OR
+       (${code_start_addr} LESS ${slot_min_addr}))
+      message(FATAL_ERROR "Variant image ${image} "
+                          "(${code_start_addr}, ${code_end_addr}) "
+                          "does not fit in the merged ${merged_partition} "
+                          "(${slot_min_addr}, ${slot_max_addr})")
+      return()
+    endif()
+  endforeach()
+endfunction()
+
 function(merge_images_nrf54h20 output_artifact images)
   find_program(MERGEHEX mergehex.py HINTS ${ZEPHYR_BASE}/scripts/build/ NAMES
     mergehex NAMES_PER_DIR)
@@ -208,19 +247,23 @@ function(mcuboot_sign_merged_nrf54h20 merged_hex main_image)
      SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP)
     if(CONFIG_NCS_IS_VARIANT_IMAGE)
       set(slot_size ${slot1_size})
+      set(slot_addr ${slot1_addr})
     else()
       set(slot_size ${slot0_size})
+      set(slot_addr ${slot0_addr})
     endif()
-    set(imgtool_rom_command --rom-fixed ${code_addr})
+    # Adjust start offset, based on the active slot and code partition address.
+    math(EXPR start_offset "${start_offset} + ${code_addr} - ${slot_addr}")
+    set(imgtool_rom_command --rom-fixed ${slot_addr})
   else()
     message(FATAL_ERROR "Only Direct XIP MCUboot modes are supported.")
     return()
   endif()
 
   # Basic 'imgtool sign' command with known image information.
-  set(imgtool_sign ${PYTHON_EXECUTABLE} ${IMGTOOL} sign
-      --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --header-size
-      ${start_offset} --slot-size ${slot_size} ${imgtool_rom_command})
+  set(imgtool_sign ${PYTHON_EXECUTABLE} ${IMGTOOL} sign --version
+    ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --header-size ${start_offset} --slot-size ${slot_size}
+    --pad-header ${imgtool_rom_command})
   set(imgtool_args --align ${write_block_size} ${imgtool_args})
 
   # Extensionless prefix of any output file.
@@ -285,9 +328,8 @@ function(mcuboot_sign_merged_nrf54h20 merged_hex main_image)
       set(BYPRODUCT_KERNEL_SIGNED_CONFIRMED_HEX_NAME
         "${output}.signed.confirmed.hex" CACHE FILEPATH
         "Signed and confirmed kernel hex file" FORCE)
-      list(APPEND imgtool_cmd COMMAND
-        ${imgtool_sign} ${imgtool_args} --pad --confirm ${merged_hex}
-        ${output}.signed.confirmed.hex)
+      list(APPEND imgtool_cmd COMMAND ${imgtool_sign} ${imgtool_args} --pad --pad-header --confirm
+        ${merged_hex} ${output}.signed.confirmed.hex)
     endif()
 
     if(NOT "${keyfile_enc}" STREQUAL "")

samples/dfu/ab/boards/nrf54h20dk_nrf54h20_cpuapp.overlay

@@ -11,3 +11,5 @@
 		zephyr,boot-mode = &boot_request;
 	};
 };
+
+secondary_app_partition: &cpuapp_slot1_partition {};

samples/dfu/ab/src/ab_utils.c

@@ -39,12 +39,18 @@ LOG_MODULE_DECLARE(ab_sample);
 
 #define SLOT_A_OFFSET FIXED_PARTITION_OFFSET(SLOT_A_PARTITION)
 #define SLOT_B_OFFSET FIXED_PARTITION_OFFSET(SLOT_B_PARTITION)
+#define SLOT_A_SIZE   FIXED_PARTITION_SIZE(SLOT_A_PARTITION)
+#define SLOT_B_SIZE   FIXED_PARTITION_SIZE(SLOT_B_PARTITION)
 
 #define SLOT_A_FLASH_AREA_ID FIXED_PARTITION_ID(SLOT_A_PARTITION)
 #define SLOT_B_FLASH_AREA_ID FIXED_PARTITION_ID(SLOT_B_PARTITION)
 
-#define IS_SLOT_A (CODE_PARTITION_OFFSET == SLOT_A_OFFSET)
-#define IS_SLOT_B (CODE_PARTITION_OFFSET == SLOT_B_OFFSET)
+#define IS_SLOT_A                                                                                  \
+	(CODE_PARTITION_OFFSET >= SLOT_A_OFFSET &&                                                 \
+	 CODE_PARTITION_OFFSET < SLOT_A_OFFSET + SLOT_A_SIZE)
+#define IS_SLOT_B                                                                                  \
+	(CODE_PARTITION_OFFSET >= SLOT_B_OFFSET &&                                                 \
+	 CODE_PARTITION_OFFSET < SLOT_B_OFFSET + SLOT_B_SIZE)
 
 #endif /* CONFIG_PARTITION_MANAGER_ENABLED */
 

samples/dfu/ab/sysbuild.conf

@@ -7,3 +7,4 @@ SB_CONFIG_NETCORE_IPC_RADIO_BT_HCI_IPC=y
 
 # Enable direct XIP with revert support
 SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP_WITH_REVERT=y
+SB_CONFIG_MCUBOOT_IMAGES_ROM_END_OFFSET_AUTO="ipc_radio;ipc_radio_secondary_app"

samples/zephyr/smp_svr_mini_boot/boards/nrf54h20dk_nrf54h20_cpuapp.overlay → samples/dfu/ab/sysbuild/ipc_radio.overlay

@@ -4,4 +4,6 @@
  * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
  */
 
-#include "../sysbuild/nrf54h20dk_nrf54h20_memory_map_merged_slot.dtsi"
+#include "nrf54h20dk_nrf54h20_memory_map.dtsi"
+
+secondary_app_partition: &cpurad_slot1_partition {};

samples/dfu/ab/sysbuild/nrf54h20dk_nrf54h20_memory_map.dtsi

@@ -5,14 +5,55 @@
  */
 
 /* On nRF54H20 the Direct XIP mode is supported in the merged slot configuration
- * Merge application and radio slots by extending the application partition.
+ * Extend slot0_partition and slot1_partition to cover both application and
+ * radio images, as well as MCUboot image metadata (header and trailer).
+ * Those partitions will be used by MCUboot to verify the merged image to boot.
+ * Apart from that, they will be used by the MCUmgr subsystem to correctly
+ * handle flags, stored inside the MCUboot image trailer.
+ * Use cpu<app|rad>_slot<0|1>_partition as zephyr,code-partition, so the
+ * application and radio sizes are correctly reported.
  */
-&cpuapp_slot0_partition {
-	reg = <0x40000 DT_SIZE_K(656)>;
-};
+/delete-node/&cpuapp_slot0_partition;
+/delete-node/&cpuapp_slot1_partition;
+/delete-node/&cpurad_slot0_partition;
+/delete-node/&cpurad_slot1_partition;
+
+&mram1x {
+	partitions {
+		/* Merged partition used by the MCUboot (variant 0). */
+		slot0_partition: partition@40000 {
+			reg = <0x40000 DT_SIZE_K(656)>;
+		};
+
+		/* Application code partition (variant 0).
+		 * Offset by the MCUboot header size (2048 bytes).
+		 */
+		cpuapp_slot0_partition: partition@40800 {
+			reg = <0x40800 DT_SIZE_K(326)>;
+		};
+
+		/* Radio code partition (variant 0). */
+		cpurad_slot0_partition: partition@92000 {
+			reg = <0x92000 DT_SIZE_K(328)>;
+		};
 
-&cpuapp_slot1_partition {
-	reg = <0x100000 DT_SIZE_K(656)>;
+		/* Merged partition used by the MCUboot (variant 1). */
+		slot1_partition: partition@100000 {
+			reg = <0x100000 DT_SIZE_K(656)>;
+		};
+
+		/* Application code partition (variant 1).
+		 * Offset by the MCUboot header size (2048 bytes).
+		 */
+		cpuapp_slot1_partition: partition@100800 {
+			reg = <0x100800 DT_SIZE_K(326)>;
+		};
+
+		/* Radio code partition (variant 1). */
+		cpurad_slot1_partition: partition@152000 {
+			reg = <0x152000 DT_SIZE_K(328)>;
+		};
+	};
 };
 
 / {

samples/zephyr/smp_svr_mini_boot/Kconfig.sysbuild

@@ -16,4 +16,7 @@ config NRF_DEFAULT_IPC_RADIO
 config NETCORE_IPC_RADIO_BT_HCI_IPC
 	default y if SOC_SERIES_NRF54HX
 
+config MCUBOOT_IMAGES_ROM_END_OFFSET_AUTO
+	default "ipc_radio;ipc_radio_secondary_app" if MCUBOOT_SIGN_MERGED_BINARY
+
 source "share/sysbuild/Kconfig"

samples/zephyr/smp_svr_mini_boot/boards/nrf54h20dk_nrf54h20_cpuapp_direct_xip.overlay

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2025 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+ */
+
+#include "../sysbuild/nrf54h20dk_nrf54h20_memory_map_direct_xip.dtsi"
+
+secondary_app_partition: &cpuapp_slot1_partition {};

samples/zephyr/smp_svr_mini_boot/sample.yaml

@@ -13,6 +13,7 @@ common:
 tests:
   sample.smp_svr_mini_boot:
     extra_args:
+      - FILE_SUFFIX="direct_xip"
       - SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP=y
     platform_allow:
       - nrf54l15dk/nrf54l15/cpuapp

samples/zephyr/smp_svr_mini_boot/sysbuild/ipc_radio_direct_xip.overlay

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2025 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+ */
+
+#include "nrf54h20dk_nrf54h20_memory_map_direct_xip.dtsi"
+
+secondary_app_partition: &cpurad_slot1_partition {};

samples/zephyr/smp_svr_mini_boot/sysbuild/mcuboot/boards/nrf54h20dk_nrf54h20_cpuapp.overlay

@@ -4,8 +4,6 @@
  * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
  */
 
-#include "../../nrf54h20dk_nrf54h20_memory_map_merged_slot.dtsi"
-
 / {
 	chosen {
 		zephyr,code-partition = &boot_partition;