STM32N6 images signed with STM32CubeProgrammer v2.21.0 fail to run

[cdwilson]

Describe the bug

When I follow the instructions at https://docs.zephyrproject.org/latest/boards/st/stm32n6570_dk/doc/index.html images signed using the latest STM32_SigningTool_CLI version 2.21.0 do not run on either of the STM32N6570-DK or the Nucleo N657X0-Q boards.

Reverting back to version 2.20.0 of the STM32CubeProgrammer release fixes the issue (images run correctly per the instructions in the Zephyr docs).

I'm not exactly sure yet if this is a bug in the latest STM32_SigningTool_CLI tool or an issue on the Zephyr side, but I wanted to report it in case this saves somebody else a couple hours of head scratching wondering what's going on.

Also, be aware that the 2.20.0 release has an issue that prevents west flash from working on Windows & Ubuntu for the Nucleo N657X0-Q board, so if you revert to that version just be aware that flashing the board might be broken (strangely the STM32N6570-DK board works fine with 2.20.0 on these OS). It looks like this flashing issue is fixed in 2.21.0.

Regression

• This is a regression.

Steps to reproduce

1. Install STM32CubeProgrammer 2.21.0
2. Follow the instructions at https://docs.zephyrproject.org/latest/boards/st/stm32n6570_dk/doc/index.html

Impact

Workaround by reverting to 2.20.0

Environment

Same issue on Windows, macOS, Ubuntu hosts

[cdwilson]

From this reply on the ST community:

With STM32CubeProgrammer v2.21, there has been a change where the tool doesn't align automatically the payload to 0x400 with padding bytes for N6.
...
To solve this, add the -align or --align to the signing CLI command and it should be fine.

After applying the following change, images built with 2.21.0 are able to run correctly:

diff --git a/soc/st/stm32/stm32n6x/CMakeLists.txt b/soc/st/stm32/stm32n6x/CMakeLists.txt
index 41547898696..53cb0f6b96e 100644
--- a/soc/st/stm32/stm32n6x/CMakeLists.txt
+++ b/soc/st/stm32/stm32n6x/CMakeLists.txt
@@ -39,7 +39,7 @@ if(NOT CONFIG_BOOTLOADER_MCUBOOT)
     set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
       COMMAND ${SIGNING_TOOL}
       -in ${PROJECT_BINARY_DIR}/${CONFIG_KERNEL_BIN_NAME}.bin
-      -nk -t fsbl -hv 2.3 --silent
+      -nk -t fsbl -hv 2.3 --silent --align
       -o ${PROJECT_BINARY_DIR}/${CONFIG_KERNEL_BIN_NAME}.signed.bin
       -dump ${PROJECT_BINARY_DIR}/${CONFIG_KERNEL_BIN_NAME}.signed.bin
       WORKING_DIRECTORY ${PROJECT_BINARY_DIR}

In terms of a PR to fix this, adding the --align flag as shown above will cause builds using 2.20.0 and earlier to start failing when they were working previously. Is there a recommended way to have this flag only be set conditionally based on STM32_SigningTool_CLI version >= 2.21.0?

[zacck]

Following.

[cdwilson]

Following.

@zacck FYI, I think you can just hit the "Subscribe" button (under "Notifications) in the right pane and it will notify you of any replies.

[erwango]

After applying the following change, images built with 2.21.0 are able to run correctly:

Thanks for sharing this.

In terms of a PR to fix this, adding the --align flag as shown above will cause builds using 2.20.0 and earlier to start failing when they were working previously. Is there a recommended way to have this flag only be set conditionally based on STM32_SigningTool_CLI version >= 2.21.0?

Unfortunately, we don't have such means atm. I don't think this can be set otherwise than with a Kconfig that would have to be set by the user.