Removes the `add_subdirectory`
of nrfxlib it will still check that the nrfxlib is located outside
the mcuboot directory.

Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Andrzej Puzdrowski <[email protected]>
Signed-off-by: Martí Bolívar <[email protected]>
Signed-off-by: Emil Obalski <[email protected]>
Signed-off-by: Andrzej Puzdrowski <[email protected]>
Signed-off-by: Håkon Øye Amundsen <[email protected]>
Signed-off-by: Ioannis Glaropoulos <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 6558dff)

Add prj_minimal.conf, a Kconfig fragment to be used for minimally
sized image production. The minimal fragment has been simplified for
only external crypto.

Move partition sizing into Kconfig to be consistent with the method
used by b0.

Using this fragment with prj_minimal.conf makes MCUboot < 16kB for
all nRF devices (9160 still needs 32kB partition).

Ref: NCSDK-6704
Signed-off-by: Stephen Stauts <[email protected]>
Signed-off-by: Martí Bolívar <[email protected]>
Signed-off-by: Sebastian Bøe <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 42fdada)

Adds project configurations for the two systems on the Thingy:91
(PCA-20035) board.

The bootloader that is factory-programmed on thing91 does not support
ECDSA signature type. Hence this commit also sets the signature type
to RSA for applications built for Thingy:91.

Signed-off-by: Bernt Johan Damslora <[email protected]>
Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Jon Helge Nistad <[email protected]>
Signed-off-by: Balaji Srinivasan <[email protected]>
Signed-off-by: Robert Lubos <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Marek Pieta <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit c4251c7)

The default value of CONFIG_NRF_RTC_TIMER_USER_CHAN_COUNT
for nRF52 SOCs has been changed from 0 to 3, but it makes
MCUBoot get stuck on erasing flash pages when swapping two
images. Restore the previous value until the RTC issue is
resolved (see NCSDK-14427)

Signed-off-by: Damian Krolik <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit c141b8b)

This patch adds board configuration for the Thingy:91 X.

Signed-off-by: Maximilian Deubel <[email protected]>
(cherry picked from commit ed8ed2e)

Partition Manager is an nRF Connect SDK component which uses yaml
files to resolve flash partition placement with a holistic view of the
device.

This component's MCUboot portions began life as upstream mcuboot
PR#430. This added support for being built as a sub image from the
downstream Nordic patch set for a zephyr multi image build
system (mcuboot 430 was combined with effor submitted to upstream
zephyr as PR#13672, which was ultimately reworked after being rejected
for mainline at the ELCE 2019 conference in Lyon).

It has since evolved over time. This is the version that will go into
NCS v1.3. It features:

- page size aligned partitions for all partitions used by mcuboot.
- image swaps without scratch partitions

Add support for configurations where there exists two primary slots
but only one secondary slot, which is shared. These two primary slots
are the regular application and B1. B1 can be either S0 or S1
depending on the state of the device.

Decide where an upgrade should be stored by looking at the vector
table.

Provide update candidates for both s0 and s1. These candidates must be
signed with mcuboot after being signed by b0.

Additional notes:

- we make update.hex without trailer data

  This is needed for serial recovery to work using hex files.
  Prior to this the update.hex got TLV data at the end of the
  partition, which caused many blank pages to be included,
  which made it hard to use in a serial recovery scheme.

  Instead, make update.hex without TLV data at the end,
  and provide a new file test_update.hex which contains
  the TLV data, and can be directly flashed to test the
  upgrade procedure.

- we use a function for signing the application as future-proofing
  for when other components must be signed as well

- this includes an update to single image applications that enables
  support for partition manager; when single image DFU is used, a
  scratch partition is not needed.

- In NCS, image 1 primary slot is the upgrade bank for mcuboot (IE S0 or
  S1 depending on the active slot). It is not required that this slot
  contains any valid data.

- The nRF boards all have a single flash page size, and partition
  manager deals with the size of the update partitions and so on, so we
  must skip a boot_slots_compatible() check to avoid getting an error.

- There is no need to verify the target when using partition manager.

- We lock mcuboot using fprotect before jumping, to enable the secure
  boot property of the system.

- Call fw_info_ext_api_provide() before booting if EXT_API_PROVIDE
  EXT_API is enabled. This is relevant only when the immutable
  bootloader has booted mcuboot.

Signed-off-by: Håkon Øye Amundsen <[email protected]>
Signed-off-by: Øyvind Rønningstad <[email protected]>
Signed-off-by: Sebastian Bøe <[email protected]>
Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Martí Bolívar <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Andrzej Głąbek <[email protected]>
Signed-off-by: Robert Lubos <[email protected]>
Signed-off-by: Andrzej Puzdrowski <[email protected]>
Signed-off-by: Emil Obalski <[email protected]>
Signed-off-by: Pawel Dunaj <[email protected]>
Signed-off-by: Ioannis Glaropoulos <[email protected]>
Signed-off-by: Johann Fischer <[email protected]>
Signed-off-by: Vidar Berg <[email protected]>
Signed-off-by: Draus, Sebastian <[email protected]>
Signed-off-by: Trond Einar Snekvik <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Joakim Andersson <[email protected]>
Signed-off-by: Georgios Vasilakis <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 7f66ef1)

- Add network core bootloader implementation

  Enables network core updates of nrf53 using MCUBoot by identifying
  images through their start addresses. Also implements the control and
  transfer using the PCD module.

- Add support for multi image DFU using partition manager.

- Add check for netcore addr if NSIB is enabled so netcore updates works

- boot: zephyr: move thingy53_nrf5340_cpuapp.conf downstream

  Moved the board configuration for Thingy:53 Application Core to the
  nRF Connect SDK MCUboot downstream repository. The configuration file
  contains references to the Kconfig modules that are only available in
  the nRF Connect SDK. The current configuration is set up to work in the
  nRF Connect SDK environment and cannot be used upstream.

- pm: enable ram flash partition using common flag

  This patch makes mcuboot_primary_1 ram-flash partition
  selectable using CONFIG_NRF53_MCUBOOT_PRIMARY_1_RAM_FLASH
  property. This is needed since CONFIG_NRF53_MULTI_IMAGE_UPDATE
  become not only configuration which requires that partition.

- MCUBoot configures USB CDC by its own. There is no need for
  BOARD_SERIAL_BACKEND_CDC_ACM option to configure anything which is
  later overwritten anyway.

  Jira: NCSDK-18596

Signed-off-by: Andrzej Puzdrowski <[email protected]>
Signed-off-by: Emil Obalski <[email protected]>
Signed-off-by: Håkon Øye Amundsen <[email protected]>
Signed-off-by: Ioannis Glaropoulos <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Johann Fischer <[email protected]>
Signed-off-by: Kamil Piszczek <[email protected]>
Signed-off-by: Ole Sæther <[email protected]>
Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Simon Iversen <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Trond Einar Snekvik <[email protected]>
Signed-off-by: Mateusz Kapala <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 9b50519)

Do some cleanup of nRF peripherals. This is necessary since Zephyr
doesn't have any driver deinitialization functionality, and we'd like
to leave peripherals in a more predictable state before booting the
Zephyr image. This should be re-worked when the zephyr driver model
allows us to deinitialize devices cleanly before jumping to the
chain-loaded image.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
Signed-off-by: Robert Lubos <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Øyvind Rønningstad <[email protected]>
Signed-off-by: Martí Bolívar <[email protected]>
Signed-off-by: Håkon Øye Amundsen <[email protected]>
Signed-off-by: Ioannis Glaropoulos <[email protected]>
Signed-off-by: Johann Fischer <[email protected]>
Signed-off-by: Trond Einar Snekvik <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 3226c3b)

To ensure that MCUBoot does not leak keys or other material through
memory to non-secure side we clear the memory before jumping to the next
image.

Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
Signed-off-by: Ole Sæther <[email protected]>
(cherry picked from commit 5dab1bf)

When mcuboot_secondary is on external flash, the image header cannot
dircetly be accessed via secondary_fa->fa_off. Instead the provided
function boot_img_hdr() is used now.
Additionally a similar issue is present when trying to read the address
of the reset handler. For this flash_area_read() is used now.

With this patch is possible to have the update partiton
mcuboot_secondary on external flash and update a updatable
bootloader (mcuboot) in s0 and/or s1.

Signed-off-by: Christian Taedcke <[email protected]>
Signed-off-by: Ole Sæther <[email protected]>
Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 6a56543)

The XIP image, 2, does not have reset vector.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 0bc7d0b)

Puts the flash simulation configurtion into cache variables that can
be used by other applications and CMake code to know specifics on
the simulated flash details

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit 0452d2e)

This removes the `return;` to ensure that the application is booted even
if EXT_ABI is not provided to the application because it does not
include `FW_INFO`.

Added a bit more description to the error messages when FW_INFO is not
found and EXT_ABI is not able to be provided to the next image.

Ref. NCSDK-24132

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit 62aa9fb)

For nRF53, the only existing version number metadata is stored in the
`firmware_info` structure in the network core. This utilizes PCD to read
out the version number and compares it against the version number found
in the secondary slot for the network core.

Ref. NCSDK-21379

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit 62468f9)

Change disables GPIO interrupt support in Zephyr GPIO driver,
which is not obligatory for MCUboot.
This is needed to reduce memory footprint.

Signed-off-by: Nikodem Kastelik <[email protected]>
(cherry picked from commit de6763b)

Added configuration which allows to build MCUboot for
nrf54l15pdk_nrf54l15_cpuapp with external flash used for
the secondary slot.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit ae86489)

Seems multi-image dependencies are not supported for multi-image in
NCS yet. This is a workaround which reverts some lines to restore
previous MCUboot behavior, so that Immutable bootloader + MCUBoot type
builds will work.

Ref. NCSDK-8681

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit b1f6a8c)

Fixes a missing PCD define check, an image might have the
network core partition layout set but if PCD support is not
enabled then it should not assume that PCD support is part
of mcuboot.

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit 3ed9b1e)

This adds support for using both NSIB and the multi-image configuration
in MCUboot. Before this was not possible due to upgradable bootloader
support through NSIB was using the `UPDATEABLE_IMAGE_NUMBER`
configuration to update the updateable bootloader.

In this commit we change from using `FLASH_AREA_IMAGE_PRIMARY` to get
the flash area ID to using the bootloader state where we set the flash
area ID of the free updatable bootloader slot if the image is intended
for this slot.

Ref. NCSDK-19223
Ref. NCSDK-23305

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit 05b8643)

Making sysflash.h and pm_sysflash.h more readable.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 93222ac)

The commit modifies pm_sysflash.h to add support for three
application images.

Ref. NCSDK-19223

Signed-off-by: Dominik Ermel <[email protected]>
Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit ee86874)

Added procedure which clean-up content of all the secondary slot
which contains valid header but couldn't be assigned to any of
supported primary images.
This behavior is needed when configuration allows to use one secondary
slot for collecting image for multiple primary slots.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit 02c770e)

FPROTECT is not suppored yet for nrf54l15.

Signed-off-by: Grzegorz Chwierut <[email protected]>
Signed-off-by: Gerard Marull-Paretas <[email protected]>
(cherry picked from commit 30df7db)

Move ifdefs just to not add code for cleanup unusable
slot when direct xip mode is enabled to avoid warnings.

Signed-off-by: Grzegorz Chwierut <[email protected]>
(cherry picked from commit 54afcb2)

Added DTS with partitioning which involves external flash
as place for slo1_partition.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit bfa61d8)

This patch supplements the configuration for external flash so
MCUboot can be build with FILE_SUFFIX="ext_flash" for the nrf54l15pdk
instead of explicitly configuration specification.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit b576e6f)

This patch disbales MCUBoot logging and enables
serial recovery for the Thingy:91.

Signed-off-by: Maximilian Deubel <[email protected]>
Signed-off-by: Bernt Johan Damslora <[email protected]>
(cherry picked from commit a920249)

Mcuboot's boot banner should not be used if NCS boot banner is enabled.

Signed-off-by: Robert Lubos <[email protected]>
(cherry picked from commit 01baf69)

By the upstream patch the vt get now the pointer to the copy
of the arm_vector instead of original.

This patch fixes address of the firmware which is to be taken by
the fw_info_find.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit 52cc9b4)

Adds additional conditions that lets the direct upload option to be
selected on nRF5340 to allow for uploading network core updates
directly to the network core with the flash simulator

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit 036ae01)

Configured CONFIG_NRF_RRAM_WRITE_BUFFER_SIZE=32
Which ensure the fastest bulk RRAM write operations.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit 9916ecd)

Removes stray child/parent references

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit d9a4196)

MCUboot uses SOC_FLASH_0_ID and SPI_FLASH_0_ID to distinguish
between internal and external boot device. These IDs are provided
by sysflash.h, but the pm_sysflash.h overrides entire file,
and was lacking that definitions.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 7f34a02)

Disabled NCS BOOT BANNER to save some flash, as Thingy:53 stopped
to fit in the mcuboot partition. The boot banner is not used
anyway, as logs are disabled.

Signed-off-by: Kamil Kasperczyk <[email protected]>
(cherry picked from commit 560cc01)

Adds check to region of mcuboot_secondary_1 to put it in external flash
only if CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY is set.

This should allow for DFU from internal flash on the nRF5340 with dynamic
partitioning.

Also fixing a typo.

Signed-off-by: Sigurd Hellesvik <[email protected]>
(cherry picked from commit 27e4783)

Select proper configuration and disable mbedTLS selection,
as we are using NRF Security enabled Oberon.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 4bcddc1)

Fixes path variables to use the proper Zephyr module variables

Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit b808352)

Adds support for LZMA-compressed firmware updates which also
supports encrypted images and supports more than 1 updateable image

Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit eb5056a)

The commit adds verification of image using keys stored in KMU.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 7d649aa)

Adds selecting the experimental Kconfig when compession is in use

Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 7aebe39)

Adds a new Kconfig CONFIG_BOOT_SIGNATURE_KMU_SLOTS which allows
specifying how many KMU key IDs are supported, the default is set
to 1 instead of 3 which was set before

NCSDK-30743

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit 1a2e7b5)

Use snprinf, alloc, calloc and free from mbedTLS rather than
from Zephyr.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit ec17f76)

Added basic support for nrf54h20dk_nrf54h20_cpuapp_iron board.
This commit turns off CONFIG_FPROTECT for this board build.

Signed-off-by: Michal Kozikowski <[email protected]>
(cherry picked from commit e5ef402)

This commit removes NRF_CLOCK cleanup for this board build - for Lillium, there is no clock peripheral access from the app domain.

Signed-off-by: Michal Kozikowski <[email protected]>
(cherry picked from commit 0b41fc9)

Disable previous generation key when update comes with
new valid key and application is confirmed.

Signed-off-by: Mateusz Michalek <[email protected]>
(cherry picked from commit 4546dc5)

Added procedure which does configure UARTE pins to
the default states. This allows to reduce power consumption
if pin is floating.

clean-up UARTE only if its driver was enabled

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit bc7bc71)

Zephyr provides "mcuboot-mbedtls-cfg.h" as glue interface for
configure mbedts. "config-tls-generic.h" default value was erroneously
introduced during a meta codebase synchronization.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit b09f774)

Compile out code which does cleanup on UARTE pins as this cause issues
on for some applications.

ref.: NCSDK-33039

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit 083cab6)

adding default configs.

Signed-off-by: Mateusz Michalek <[email protected]>
(cherry picked from commit b7633cc)

This commit adds cleanup for GRTC and UARTE peripherals.

ref: NCSDK-32966

Signed-off-by: Artur Hadasz <[email protected]>
(cherry picked from commit 5afc0aa)

This commit aligns to the changes in the nrfcompress API,
which now enables the caller to provide the expected size of the
decompressed image.

ref: NCSDK-32340

Signed-off-by: Michal Kozikowski <[email protected]>

pointer to the image ARM vector table should be placed out of
stack which is being reconfigured before vt is used for branch
to the application. This caused transient boot failure when
CONFIG_LTO=y.

Moved vt to static data scope.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
(cherry picked from commit 264f6ee)

Enable LTO to cut down the MCUboot size for nrf54l15

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 671513c)

Tests some fprotect thing

Signed-off-by: Jamie McCrae <[email protected]>