SB_CONFIG_BOOT_SIGNATURE_KEY_FILE now accepts a comma-separated list of
PEM paths in addition to a single path. When a list is given, the MCUboot
bootloader embeds the public half of every key and accepts an image
signed with any of them. The first entry is also the key the application
is signed with; every entry past the first must be a public-only PEM of
the same signature type (MCUboot enforces this at build time with
'imgtool keyinfo --require public'). A common use is a development
bootloader that boots both development- and production-signed images
while never holding the production private key.
The keys the bootloader embeds and the single key the application is
signed with are both derived from this one list through the sysbuild
helpers sysbuild_mcuboot_resolve_signature_key_files() and
sysbuild_mcuboot_application_signature_key_file(). Entries are forwarded
verbatim for each image to resolve, so a single-key value behaves exactly
as before and no previously working configuration breaks.
The feature is exercised at runtime by tests/boot/mcuboot_multiple_keys,
which builds a two-key bootloader on the mps2/an385 QEMU machine and
boots an application signed with either embedded key, asserting MCUboot
validates it against the matching key (key_id 0 and key_id 1). The two
keys are MCUboot's own ed25519 test keys: a development key (key_id 0)
and a production key embedded by its public half only (key_id 1). The
application is signed at build time with the development key; the second
scenario re-signs the built image with the production key afterwards,
the way a production custodian signs a release binary out-of-band, so
the production private key never enters the build configuration.
Signed-off-by: JP Hutchins <jp@intercreate.io>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
For some use cases (such as Harvard architectures with code and data
memory), it may be desirable to link an application to SRAM with
CONFIG_XIP=y so that the application will utilize a different SRAM
region for execution than it does for data.
To support this with MCUBoot, add CONFIG_MCUBOOT_RAMLOAD_ALLOW_XIP
Signed-off-by: Daniel DeGrasse <daniel.degrasse@analog.com>
Fixes some issues with merged hex output, parses images to get the
hex files that are flashed then uses that as the input for the
merged hex output. Also allows sysbuild modules to add custom
dependencies to the merged hex output if they generate the images
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
This replaces a workaround in `ExternalZephyrVariantProject_Add()` -
setting KCONFIG_TARGETS-NOTFOUND - which turned out to be incomplete.
For example, it had no way of accounting for EXTRA_KCONFIG_TARGETS
(which could be set on the command line or through something like
`ZephyrBuildConfig.cmake`).
Instead, the creation of `menuconfig` and friends can be gated on
KCONFIG_VARIANT_SOURCE, which is the variable sysbuild uses to forward
the source configuration to the variant image. This way, both lists of
Kconfig targets are excluded reliably.
Signed-off-by: Grzegorz Swiderski <grzegorz.swiderski@nordicsemi.no>
Adds variant image handling CMake code which re-uses parts of the
original dts CMake module code but applies variant-specific parts
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Fixes wrongly using the default image instead of the supplied
user image in the variant image function
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Zephyr `<type>_ROOT`s, such as `BOARD_ROOT`, `DTS_ROOT`, `SCA_ROOT`,
are initialed by ROOT settings provided through CMake variable
`<type>_ROOT`, Zephyr base, and root settings specified in Zephyr
module's `zephyr/module.yml` file.
`SNIPPET_ROOT` didn't follow the same pattern as it also included
application source dir.
This commit aligns `SNIPPET_ROOT` to follow same principle for
constructing other Zephyr `<type>_ROOT` lists.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
Remove the hard-coded target knowledge of menuconfig, hardenconfig, and
guiconfig and instead use the ZEPHYR_SHARED_TARGETS provided by the
Zephyr image.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
The value os board qualifiers in CMake and Kconfig differs.
CMake has a leading '/', as example:
CMake: BOARD_QUALIFIERS=/nrf52840
Kconfig: BOARD_QUALIFIERS=nrf52840
This was also discussed in
https://github.com/zephyrproject-rtos/zephyr/pull/69740
This commit aligns the value of the CMake variable BOARD_QUALIFIERS to
the value of BOARD_QUALIFIERS (CONFIG_BOARD_QUALIFIERS) in Kconfig.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
Links the output from the default MCUboot build with the estimated
size of the overhead with the main image. This also allowes used
to remove the linkage between them, if they so wish
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Adds a new experimental Kconfig option to sysbuild which allows
generating a variant image to use with MCUboot in direct-xip mode.
It also includes base sysbuild infrastructure for creating
additional variant images in future (including out-of-tree),
whereby they use the base configuration of an existing image but
modify it, without creating the default zephyr extra targets for
images (e.g. menuconfig) to prevent changing configuration that
should not be changed.
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Without this, the parent CMake and the sub-processes may use different
Python environment.
Co-authored-by: Torsten Tejlmand Rasmussen <torsten.rasmussen@nordicsemi.no>
Signed-off-by: Wilfried Chauveau <wilfried.chauveau@arm.com>
Adds support for generated merged hex file output, one hex file
per unique board target. This feature can be enabled with
SB_CONFIG_MERGED_HEX_FILES
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Update MCUboot configuration so that STM32 no longer defaults to
SWAP_USING_MOVE. Instead, SWAP_USING_OFFSET becomes the default mode
for STM32 boards.
Signed-off-by: Fabrice DJIATSA <fabrice.djiatsa-ext@st.com>
Prevents a random occurance whereby sysbuild reconfigures itself
after a reconfiguration for no known discernable reason
Signed-off-by: Jamie McCrae <spam@helper3000.net>
APPLICATION_SOURCE_DIR is image specific and the value inside sysbuild
points to sysbuild itself.
This gives wrong results when a sample uses
`zephyr_get(APPLICATION_SOURCE_DIR)` as it will fetch the sysbuild value
and not its own value.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
This commit provides a CMakePresets.json which includes the sample's
CMakePresets.json file.
`west build` is extended to set `APP_DIR` in environment when sysbuild
is used. This allows sysbuild's CMakePresets.json to include the
sample's presets file.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
Loads this file in a better way that means samples and modules
should not have to source the file before referencing Kconfig
module path variables
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Adds a output env file that lists the paths of zephyr modules
which can be used in Kconfig files and uses this in Kconfig. Also
updates Kconfig doc output to generate and use this
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
This commit adds changes which are necessary to support
the AES256 encryption algorithm in mcuboot.
Signed-off-by: Artur Hadasz <artur.hadasz@nordicsemi.no>
Add Kconfigs for RAMLOAD_WITH_REVERT mode in MCUBoot. This mode works in
a manner similar to DIRECT_XIP_WITH_REVERT- namely, mcuboot will only
boot an image that is either confirmed or marked as pending. If both
images are confirmed, mcuboot will still select the one with the higher
version, so downgrading is not possible using this mode.
Signed-off-by: Daniel DeGrasse <ddegrasse@tenstorrent.com>
This swapping method is more efficient than swap using move and
has been available for some time, remove experimental flag and
set it as the default except for stm32 devices which have
partition alignment for swap using move
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Add a new promptless Kconfig symbol (INSECURE). This symbols must
be selected by any setting which is used to enable an insecure
feature.
Signed-off-by: Flavio Ceolin <flavio@hubblenetwork.com>
Fixes an issue where external sysbuild Kconfig path variables
were not provided and meant they could not be overwritten
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Utilize a code spell-checking tool to scan for and correct spelling errors
in `Kconfig` files within the `arch`, `boards`, `kernel`, `modules`,
`samples`, and `share` directory.
Additionally, incorporates a fix recommended by the reviewer.
Signed-off-by: Pisit Sawangvonganan <pisit@ndrsolution.com>
Allow to add an image-specific DTS overlay, that is applied based on the
FILE_SUFFIX.
Up to this point, it was possible to specify such Kconfig files
(sysbuild/<image>_<file_suffix>.conf),
but it did not work with dts overlays
(sysbuild/<image>_<file_suffix>.overlay).
This commit aligns the logic of finding configuration files for both
scenarios mentioned above.
Ref: NCSDK-NONE
Signed-off-by: Tomasz Chyrowicz <tomasz.chyrowicz@nordicsemi.no>
Make the image devicetrees available to sysbuild for advanced use cases.
This is done by calling `zephyr_dt_import` on each image target. The DT
target properties are all expected to be prefixed with `DT_`, so there
should be no conflicts.
Thus, the DT contents of a given `<image>` can be retrieved using e.g.:
dt_nodelabel(<var> NODELABEL <label> TARGET <image>)
as noted in `extensions.cmake`.
Signed-off-by: Grzegorz Swiderski <grzegorz.swiderski@nordicsemi.no>
Adds a devicetree overlay file for the firmware loader image which
sets the code partition to slot 1, which is where the firmware loader
image resides
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Adds support for setting up a firmware loader image in a build,
which can also optionally automatically configure MCUboot and the
application image to be able to boot the firmware loader image
using the retention subsystem
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Deprecates the old Kconfig and adds a new one which lines up with
the name of the Kconfig used by MCUboot
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Populate the build_info.yml created by sysbuild CMake with list of
images and write the build info file afterwards.
This allows users and external tools to examine which images was
included in the build even if one or more of those images fails CMake
configure or generate stage.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
This reverts commit f67939bf7e.
as it's part of a series of commits causing issues on Windows
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Populate the build_info.yml created by sysbuild CMake with list of
images and write the build info file afterwards.
This allows users and external tools to examine which images was
included in the build even if one or more of those images fails CMake
configure or generate stage.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
Add missing quotes around string values, so that they won't be
interpreted as undefined symbol names.
Signed-off-by: Grzegorz Swiderski <grzegorz.swiderski@nordicsemi.no>
