Flash Management & MCUboot
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
Flash management and MCUboot integration are critical components of the Zephyr Project, providing the foundation for secure boot, Device Firmware Updates (DFU), and efficient non-volatile storage. The system is designed to handle resource-constrained environments while maintaining high security standards through monolithic system designs and execution protection.
The scope of flash management encompasses hardware abstraction via flash maps, which partition physical flash memory into logical areas for applications, bootloaders, and data. MCUboot serves as the primary secure bootloader, enabling features such as image validation and Secure Updates.
Sources: doc/security/security-overview.rst, README.rst
Flash Memory Architecture
The architecture relies on a structured partitioning of the on-chip and external flash memory units. Modern SoCs supported by the project, such as the MCXW7x family, feature up to 2 MB of on-chip flash memory and support external SPI flash via dedicated headers.
Flash Map and Partitioning
Flash management is abstracted through a flash map system that allows developers to interact with memory using logical IDs rather than physical addresses. This ensures portability across different hardware boards.
| Feature | Description |
|---|---|
| On-chip Flash | Internal memory ranging from 1 MB to 2 MB for system and NBU images. |
| External SPI Flash | Supported for additional storage or large data sets. |
| Logical Partitioning | Division of flash into areas for MCUboot, application, and storage. |
Sources: boards/nxp/frdm_mcxw70/doc/index.rst:27-31, boards/nxp/frdm_mcxw72/doc/index.rst:21-25
Hardware-Specific Implementations
Specific boards implement flash management according to their SoC capabilities:
- FRDM-MCXW70: Features 1.5 MB on-chip flash and external SPI flash.
- FRDM-MCXW71: Features 1 MB on-chip flash.
- FRDM-MCXW72: Features 2 MB on-chip flash.
Sources: boards/nxp/frdm_mcxw70/doc/index.rst:28, boards/nxp/frdm_mcxw71/doc/index.rst:28, boards/nxp/frdm_mcxw72/doc/index.rst:22
MCUboot & Secure Boot
MCUboot provides a secure boot environment by ensuring only authenticated and intact firmware images are executed. It manages the transition from the bootloader to the application code.
Image Validation and Execution
The security architecture is monolithic; the kernel and applications are compiled into a single static binary. This eliminates the need for dynamic loaders and reduces the attack surface. MCUboot leverages stack protection and thread separation to further secure the execution environment.
The diagram above illustrates the high-level logic flow when MCUboot initializes the system and validates the firmware image before jumping to the application entry point.
Sources: doc/security/security-overview.rst:55-65, subsys/dfu/boot/mcuboot.c
Secure Firmware Updates
The project supports various methods for updating flash memory, including Device Firmware Upgrade (DFU) and specialized In-System Programming (ISP) utilities.
ISP Mode and Tooling
For many NXP-based boards, the blhost utility is used to perform low-level flash operations, particularly for updating the Network Build Unit (NBU).
ISP Mode Activation Steps:
- Disconnect all power sources.
- Hold specific ISP buttons (e.g., SW2 or SW3 depending on the board).
- Connect to host via USB.
- Release buttons to enter ISP mode.
Sources: boards/nxp/frdm_mcxw70/doc/index.rst:133-145, boards/nxp/frdm_mcxw71/doc/index.rst:135-145
NBU and Application Flashing
Updating firmware often involves writing multiple images: one for the host processor (Cortex-M33) and one for the NBU (Cortex-M3).
| Update Type | Tool / Method | Typical Command |
|---|---|---|
| Application | West Runner | west flash |
| NBU (BLE) | blhost | blhost -p COMxx -- receive-sb-file mcxw71_nbu_ble.sb3 |
| Flash Erase | blhost | blhost -p COMxx flash-erase-all 0 |
Sources: boards/nxp/frdm_mcxw70/doc/index.rst:148-160, boards/nxp/frdm_mcxw72/doc/index.rst:144-150
Security and Protection Mechanisms
Flash management is integrated with Zephyr's security features to provide defense-in-depth.
Execution Protection Features
- Memory Separation: Partitioning regions into attributes based on ownership.
- Stack Protection: Stack guards to detect and trap overflows.
- Thread Separation: Ensuring threads only access authorized memory resources.
Sources: doc/security/security-overview.rst:111-125
Cryptographic Integration
Firmware verification within flash management relies on cryptographic features provided through PSA Crypto with mbedTLS. This ensures standardized and secure approaches to signature verification for images stored in flash.
Sources: doc/security/security-overview.rst:50-55
Historical Context & Evolution
The flash management system has evolved significantly since version 1.6.0.
- Version 1.6.0: Introduced USB mass storage support and initial access to the filesystem.
- Version 1.7.0: Added Device Tree support for flash base addresses and SRAM on ARM-based boards.
Sources: doc/releases/release-notes-1.6.rst:18, doc/releases/release-notes-1.7.rst:23-25
Conclusion
Flash Management and MCUboot together ensure that the Zephyr OS remains a secure and scalable platform for IoT devices. By abstracting physical flash into a manageable flash map and enforcing strict signature validation through MCUboot, the project provides a robust framework for firmware integrity and reliable updates across a wide range of hardware architectures.