Skip to content

Conversation

@cdwilson
Copy link
Contributor

@cdwilson cdwilson commented Nov 20, 2025

Starting in v2.21.0, the STM32 signing tool (STM32_SigningTool_CLI) stopped automatically adding padding bytes at the beginning of the payload to align it to the 0x400 offset. To restore this behavior, the -align flag must be passed to the signing tool post-build command.

This commit checks for signing tool version v2.21.0 or higher and appends the -align flag to the post-build signing command.

Fixes #99456

@cdwilson
Copy link
Contributor Author

Set this to draft because I realized this prob needs some updates to the docs. If this looks like the right direction, LMK and I'll update this PR with the doc changes as well.

@erwango
Copy link
Member

erwango commented Nov 20, 2025

Thanks for pushing this.
I'm trying to find if there are alternate ways to do fix this problem. Kconfig indeed works, but it doesn't feel like the right way. I'm looking for CMake alternative, but otherwise, we'll go with this proposal.

@cdwilson
Copy link
Contributor Author

I'm trying to find if there are alternate ways to do fix this problem. Kconfig indeed works, but it doesn't feel like the right way. I'm looking for CMake alternative, but otherwise, we'll go with this proposal.

Agreed, hoping you can find a better solution!

@erwango
Copy link
Member

erwango commented Nov 20, 2025

So, you can look at nrf-regtool which performs a version check once, then store it for later usage.
We should probably do something similar. Are you interested to look at this ?

Copy link
Contributor

@etienne-lms etienne-lms left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worth to add a note in the migration guide to tell flash programming N6 boards require at least STM32_SigningTool_CLI v2.21.0 with a reference to #99456?

@erwango
Copy link
Member

erwango commented Nov 20, 2025

Worth to add a note in the migration guide to tell flash programming N6 boards require at least STM32_SigningTool_CLI v2.21.0 with a reference to #99456

Preventing use of earlier versions would be another way to handle it. Radical but efficient.
CMake part could be used to detect non supported versions and return error.
For this we need to confirm first that moving to v2.21.0 has no drawback.

@cdwilson
Copy link
Contributor Author

So, you can look at nrf-regtool which performs a version check once, then store it for later usage.
We should probably do something similar. Are you interested to look at this ?

@erwango thanks for the pointer, I'll check it out a bit later today and try to rework this PR to do something similar.

@erwango
Copy link
Member

erwango commented Nov 20, 2025

I'll check it out a bit later today and try to rework this PR to do something similar.

In case, you missed it: Complaining on versions earlier than 2.21 could be ok (at least in a first version).

@cdwilson cdwilson force-pushed the cdwilson/stm32-signing-tool-2.21.0 branch from e484e68 to 92bee62 Compare November 20, 2025 21:32
@cdwilson cdwilson changed the title soc: st: stm32: Add Kconfig option to control signing CLI '-align' flag soc: st: stm32: add '-align' flag for signing tool v2.21.0+ Nov 20, 2025
@cdwilson cdwilson force-pushed the cdwilson/stm32-signing-tool-2.21.0 branch from 92bee62 to 3a9147c Compare November 20, 2025 21:36
Comment on lines 68 to 73
else()
message(FATAL_ERROR
"Unable to determine ${SIGNING_TOOL} version (expected match to "
"${SIGNING_TOOL_VERSION_REGEX} regex)"
)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if we want to bomb out here or just throw a warning. I figured it's better to have an explicit error than to arbitrarily choose either appending or omitting the -align flag in the case where we can't determine the version.

@cdwilson
Copy link
Contributor Author

@erwango @etienne-lms I updated the PR to check the signing tool version as part of the build process. LMK if this looks OK and I'll remove the draft status.

@cdwilson cdwilson force-pushed the cdwilson/stm32-signing-tool-2.21.0 branch from 3a9147c to 1c0235b Compare November 21, 2025 03:38
RESULT_VARIABLE result
)

set(SIGNING_TOOL_ARGS
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor comment: CMake conventions recommend to use lower case names for varaibles local to a CMake file, and upper case names for variables exported to other CMake file.
That said, before your changes, this CMakeLists.txt file already defined SIGNING_TOOL and SIGNING_TOOL_ARGS that are local. Maybe worth to change them also, either as a follow-up P-R, or in your P-R if you will to.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@etienne-lms thanks for your feedback! I updated the PR to use lower case names for all the local variables (LMK if there is any I missed).

"${SIGNING_TOOL} version is v${SIGNING_TOOL_VERSION}, "
"appending \"-align\" flag to post-build signing command "
"(applicable only with header v2.3 for MCUs, starting from "
"version v${SIGNING_TOOL_MIN_VERSION})"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you indent with 2 more space chars, here at below (in the fatal message).

@etienne-lms
Copy link
Contributor

I think you can remove the draft status.

Copy link
Contributor

@zacck zacck left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I just tested this on both 2.20 and 2.21 and it works really smooth

Starting in v2.21.0, the STM32 signing tool ('STM32_SigningTool_CLI')
stopped automatically adding padding bytes at the beginning of the
payload to align it to the 0x400 offset. To restore this behavior, the
'-align' flag must be passed to the signing tool post-build command.

This commit checks for signing tool version v2.21.0 or higher and
appends the '-align' flag to the post-build signing command.

Fixes zephyrproject-rtos#99456

Signed-off-by: Chris Wilson <chris@binho.io>
@cdwilson cdwilson force-pushed the cdwilson/stm32-signing-tool-2.21.0 branch from 1c0235b to fb4c524 Compare November 21, 2025 18:53
@cdwilson cdwilson marked this pull request as ready for review November 21, 2025 19:03
@cdwilson cdwilson requested a review from etienne-lms November 21, 2025 19:03
@sonarqubecloud
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

STM32N6 images signed with STM32CubeProgrammer v2.21.0 fail to run

5 participants