sysbuild: Add support for sysbuild-assigned MCUboot image IDs

applications/asset_tracker_v2/sysbuild/mcuboot/boards/thingy91x_nrf9151.conf

@@ -17,3 +17,5 @@ CONFIG_BOOT_SERIAL_IMG_GRP_IMAGE_STATE=y
 
 CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=y
 CONFIG_PM_OVERRIDE_EXTERNAL_DRIVER_CHECK=y
+
+CONFIG_FW_INFO_FIRMWARE_VERSION=2

applications/asset_tracker_v2/sysbuild/mcuboot/boards/thingy91x_nrf9151.overlay

@@ -0,0 +1,4 @@
+&uart0 {
+	status = "okay";
+	current-speed = < 1000000 >;
+};

applications/connectivity_bridge/sysbuild/mcuboot/boards/thingy91x_nrf5340_cpuapp.conf

@@ -60,3 +60,5 @@ CONFIG_BOOT_SERIAL_IMG_GRP_IMAGE_STATE=y
 CONFIG_MCUBOOT_VERIFY_IMG_ADDRESS=n
 
 CONFIG_BOOT_SERIAL_NO_APPLICATION=y
+
+CONFIG_FW_INFO_FIRMWARE_VERSION=2

applications/serial_lte_modem/sysbuild/mcuboot/boards/thingy91x_nrf9151.conf

@@ -14,3 +14,8 @@ CONFIG_UART_CONSOLE=n
 CONFIG_MCUBOOT_SERIAL=y
 CONFIG_MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD=y
 CONFIG_BOOT_SERIAL_IMG_GRP_IMAGE_STATE=y
+
+CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=y
+CONFIG_PM_OVERRIDE_EXTERNAL_DRIVER_CHECK=y
+
+CONFIG_FW_INFO_FIRMWARE_VERSION=2

applications/serial_lte_modem/sysbuild/mcuboot/boards/thingy91x_nrf9151.overlay

@@ -0,0 +1,4 @@
+&uart0 {
+	status = "okay";
+	current-speed = < 1000000 >;
+};

modules/mcuboot/boot/zephyr/Kconfig

@@ -37,6 +37,8 @@ config PM_PARTITION_SIZE_MCUBOOT
 
 config PM_PARTITION_SIZE_MCUBOOT
 	hex "Flash space allocated for the MCUboot partition" if !BOOT_USE_MIN_PARTITION_SIZE
+	default 0xb800 if MCUBOOT_MCUBOOT_IMAGE_NUMBER != -1 && SOC_SERIES_NRF54LX
+	default 0xbe00 if MCUBOOT_MCUBOOT_IMAGE_NUMBER != -1 && !SOC_SERIES_NRF54LX
 	default 0xc000
 	help
 	  Flash space set aside for the MCUboot partition.
@@ -103,7 +105,10 @@ config BOOT_ERASE_PROGRESSIVELY
 
 config BOOT_IMAGE_ACCESS_HOOKS
 	bool
-	default y if UPDATEABLE_IMAGE_NUMBER > 1 && SOC_NRF5340_CPUAPP && PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY
+	# Child/parent check
+	default y if UPDATEABLE_IMAGE_NUMBER > 1 && SOC_NRF5340_CPUAPP && PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY && MCUBOOT_APPLICATION_IMAGE_NUMBER = -1
+	# Sysbuild check
+	default y if MCUBOOT_NETWORK_CORE_IMAGE_NUMBER != -1
 	depends on MCUBOOT
 
 config BOOT_IMAGE_ACCESS_HOOK_NRF5340

modules/mcuboot/hooks/nrf53_hooks.c

@@ -15,8 +15,17 @@
 #include "bootutil/fault_injection_hardening.h"
 #include "flash_map_backend/flash_map_backend.h"
 
-#define NET_CORE_SECONDARY_SLOT 1
+#if CONFIG_MCUBOOT_NETWORK_CORE_IMAGE_NUMBER != -1
+/* Sysbuild */
+/* MCUboot image update image number */
+#define NET_CORE_SECONDARY_IMAGE CONFIG_MCUBOOT_NETWORK_CORE_IMAGE_NUMBER
+/* MCUboot serial recovery slot number */
+#define NET_CORE_VIRTUAL_PRIMARY_SLOT (CONFIG_MCUBOOT_NETWORK_CORE_IMAGE_NUMBER * 2) + 1
+#else
+/* Legacy child/parent */
+#define NET_CORE_SECONDARY_IMAGE 1
 #define NET_CORE_VIRTUAL_PRIMARY_SLOT 3
+#endif
 
 #include <dfu/pcd.h>
 #if defined(CONFIG_PCD_APP) && defined(CONFIG_NRF53_MULTI_IMAGE_UPDATE) \
@@ -53,7 +62,6 @@ int pcd_version_cmp_net(const struct flash_area *fap, struct image_header *hdr)
 
 	firmware_info = fw_info_find((uint32_t)&read_buf);
 	if (firmware_info != NULL) {
-
 		if (firmware_info->version > version) {
 			return 1;
 		}
@@ -71,7 +79,7 @@ int pcd_version_cmp_net(const struct flash_area *fap, struct image_header *hdr)
 
 int boot_read_image_header_hook(int img_index, int slot, struct image_header *img_head)
 {
-	if (img_index == 1 && slot == 0) {
+	if (img_index == NET_CORE_SECONDARY_IMAGE && slot == 0) {
 		img_head->ih_magic = IMAGE_MAGIC;
 		img_head->ih_hdr_size = PM_MCUBOOT_PAD_SIZE;
 		img_head->ih_load_addr = PM_MCUBOOT_PRIMARY_1_ADDRESS;
@@ -90,7 +98,7 @@ int boot_read_image_header_hook(int img_index, int slot, struct image_header *im
 
 fih_ret boot_image_check_hook(int img_index, int slot)
 {
-	if (img_index == 1 && slot == 0) {
+	if (img_index == NET_CORE_SECONDARY_IMAGE && slot == 0) {
 		FIH_RET(FIH_SUCCESS);
 	}
 
@@ -106,7 +114,7 @@ int boot_perform_update_hook(int img_index, struct image_header *img_head,
 int boot_read_swap_state_primary_slot_hook(int image_index,
 		struct boot_swap_state *state)
 {
-	if (image_index == 1) {
+	if (image_index == NET_CORE_SECONDARY_IMAGE) {
 		/* Populate with fake data */
 		state->magic = BOOT_MAGIC_UNSET;
 		state->swap_type = BOOT_SWAP_TYPE_NONE;
@@ -160,7 +168,7 @@ int network_core_update(bool wait)
 int boot_copy_region_post_hook(int img_index, const struct flash_area *area,
 		size_t size)
 {
-	if (img_index == NET_CORE_SECONDARY_SLOT) {
+	if (img_index == NET_CORE_SECONDARY_IMAGE) {
 		return network_core_update(true);
 	}
 

samples/cellular/nrf_cloud_multi_service/sysbuild/mcuboot/boards/thingy91x_nrf9151.conf

@@ -14,3 +14,8 @@ CONFIG_UART_CONSOLE=n
 CONFIG_MCUBOOT_SERIAL=y
 CONFIG_MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD=y
 CONFIG_BOOT_SERIAL_IMG_GRP_IMAGE_STATE=y
+
+CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=y
+CONFIG_PM_OVERRIDE_EXTERNAL_DRIVER_CHECK=y
+
+CONFIG_FW_INFO_FIRMWARE_VERSION=2

samples/cellular/nrf_cloud_multi_service/sysbuild/mcuboot/boards/thingy91x_nrf9151.overlay

@@ -0,0 +1,4 @@
+&uart0 {
+	status = "okay";
+	current-speed = < 1000000 >;
+};

samples/net/aws_iot/sysbuild/mcuboot/boards/thingy91x_nrf9151.conf

@@ -14,3 +14,8 @@ CONFIG_UART_CONSOLE=n
 CONFIG_MCUBOOT_SERIAL=y
 CONFIG_MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD=y
 CONFIG_BOOT_SERIAL_IMG_GRP_IMAGE_STATE=y
+
+CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=y
+CONFIG_PM_OVERRIDE_EXTERNAL_DRIVER_CHECK=y
+
+CONFIG_FW_INFO_FIRMWARE_VERSION=2

samples/net/aws_iot/sysbuild/mcuboot/boards/thingy91x_nrf9151.overlay

@@ -0,0 +1,4 @@
+&uart0 {
+	status = "okay";
+	current-speed = < 1000000 >;
+};

samples/tfm/tfm_psa_template/sysbuild.conf

@@ -8,6 +8,5 @@ SB_CONFIG_BOOTLOADER_MCUBOOT=y
 SB_CONFIG_SECURE_BOOT_APPCORE=y
 SB_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
 SB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY=y
-SB_CONFIG_MCUBOOT_UPDATEABLE_IMAGES=2
 SB_CONFIG_APPROTECT_LOCK=y
 SB_CONFIG_SECURE_APPROTECT_LOCK=y

samples/wifi/shell/sysbuild/mcuboot/boards/thingy91x_nrf9151.conf

@@ -1,11 +1,3 @@
-#
-# Copyright (c) 2024 Nordic Semiconductor ASA
-#
-# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
-#
-
-# unmodified copy from mcuboot
-
 # MCUBoot settings
 CONFIG_BOOT_MAX_IMG_SECTORS=512
 
@@ -20,6 +12,10 @@ CONFIG_CONSOLE=n
 CONFIG_CONSOLE_HANDLER=n
 CONFIG_UART_CONSOLE=n
 CONFIG_MCUBOOT_SERIAL=y
-
 CONFIG_MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD=y
 CONFIG_BOOT_SERIAL_IMG_GRP_IMAGE_STATE=y
+
+CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=y
+CONFIG_PM_OVERRIDE_EXTERNAL_DRIVER_CHECK=y
+
+CONFIG_FW_INFO_FIRMWARE_VERSION=2

samples/wifi/shell/sysbuild/mcuboot/boards/thingy91x_nrf9151.overlay

@@ -0,0 +1,4 @@
+&uart0 {
+	status = "okay";
+	current-speed = < 1000000 >;
+};

subsys/Kconfig

@@ -42,4 +42,5 @@ rsource "sdfw_services/Kconfig"
 rsource "suit/Kconfig"
 rsource "dult/Kconfig"
 rsource "nrf_compress/Kconfig"
+rsource "mcuboot_ids/Kconfig"
 endmenu

subsys/mcuboot_ids/Kconfig

@@ -0,0 +1,49 @@
+#
+# Copyright (c) 2024 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+#
+
+menu "MCUboot IDs (informative only, do not change)"
+
+config MCUBOOT_APPLICATION_IMAGE_NUMBER
+	int "Application image number (informative only, do not change)"
+	default -1
+
+config MCUBOOT_NETWORK_CORE_IMAGE_NUMBER
+	int "Netcore core image number (informative only, do not change)"
+	default -1
+
+config MCUBOOT_WIFI_PATCHES_IMAGE_NUMBER
+	int "WiFi patches image number (informative only, do not change)"
+	default -1
+
+config MCUBOOT_QSPI_XIP_IMAGE_NUMBER
+	int "QSPI XIP image number (informative only, do not change)"
+	default -1
+
+config MCUBOOT_MCUBOOT_IMAGE_NUMBER
+	int "MCUboot (S0/S1) image number (informative only, do not change)"
+	default -1
+
+if MCUBOOT
+
+config MCUBOOT_MCUBOOT_S0_S1_VERSION_MAJOR
+	int "MCUboot (S0/S1) package major version number (informative only, do not change)"
+	default -1
+
+config MCUBOOT_MCUBOOT_S0_S1_VERSION_MINOR
+	int "MCUboot (S0/S1) package minor version number (informative only, do not change)"
+	default -1
+
+config MCUBOOT_MCUBOOT_S0_S1_VERSION_REVISION
+	int "MCUboot (S0/S1) package revision version number (informative only, do not change)"
+	default -1
+
+config MCUBOOT_MCUBOOT_S0_S1_VERSION_BUILD_NUMBER
+	int "MCUboot (S0/S1) package build number version number (informative only, do not change)"
+	default -1
+
+endif # MCUBOOT
+
+endmenu

subsys/nrf_compress/lzma/armthumb.c

@@ -1,4 +1,4 @@
 // SPDX-License-Identifier: 0BSD
 
 ///////////////////////////////////////////////////////////////////////////////
 //
@@ -7,17 +7,21 @@
 ///
 //  Authors:    Igor Pavlov
 //              Lasse Collin
+//  With changes by Nordic Semiconductor ASA
 //
 ///////////////////////////////////////////////////////////////////////////////
 
 #include <stdio.h>
 #include "armthumb.h"
 
-void arm_thumb_filter(uint8_t *buf, uint32_t buf_size, uint32_t pos, bool compress)
+void arm_thumb_filter(uint8_t *buf, uint32_t buf_size, uint32_t pos, bool compress,
+		      bool *end_part_match)
 {
 	uint32_t i = 0;
+	uint32_t last_update_address = 0;
 
 	while ((i + 4) <= buf_size) {
+
 		if ((buf[i + 1] & 0xF8) == 0xF0 && (buf[i + 3] & 0xF8) == 0xF8) {
 			uint32_t dest;
 			uint32_t src = (((uint32_t)(buf[i + 1]) & 7) << 19)
@@ -26,6 +30,7 @@
 			| (uint32_t)(buf[i + 2]);
 
 			src <<= 1;
+			last_update_address = i;
 
 			if (compress) {
 				dest = pos + (uint32_t)(i) + 4 + src;
@@ -38,9 +43,18 @@
 			buf[i + 0] = (dest >> 11);
 			buf[i + 3] = 0xF8 | ((dest >> 8) & 0x7);
 			buf[i + 2] = (dest);
+
 			i += 2;
 		}
 
 		i += 2;
 	}
+
+	if (i == (buf_size - 2)) {
+		if (i > last_update_address && (buf[i + 1] & 0xF8) == 0xF0) {
+			*end_part_match = true;
+		} else {
+			*end_part_match = false;
+		}
+	}
 }

subsys/nrf_compress/lzma/armthumb.h

@@ -1,4 +1,4 @@
 // SPDX-License-Identifier: 0BSD
 
 ///////////////////////////////////////////////////////////////////////////////
 //
@@ -16,6 +16,7 @@
 #include <stdint.h>
 #include <stdbool.h>
 
-void arm_thumb_filter(uint8_t *buf, uint32_t buf_size, uint32_t pos, bool compress);
+void arm_thumb_filter(uint8_t *buf, uint32_t buf_size, uint32_t pos, bool compress,
+		      bool *end_part_match);
 
 #endif

subsys/nrf_compress/src/arm_thumb.c

@@ -16,12 +16,18 @@ LOG_MODULE_REGISTER(nrf_compress_arm_thumb, CONFIG_NRF_COMPRESS_LOG_LEVEL);
 BUILD_ASSERT((CONFIG_NRF_COMPRESS_CHUNK_SIZE % 4) == 0,
 	     "CONFIG_NRF_COMPRESS_CHUNK_SIZE must be multiple of 4");
 
-static uint8_t output_buffer[CONFIG_NRF_COMPRESS_CHUNK_SIZE];
+/* Requires 2 extra bytes to allow checking cross-chunk 16-bit aligned ARM thumb instructions */
+#define EXTRA_BUFFER_SIZE 2
+
+static uint8_t output_buffer[CONFIG_NRF_COMPRESS_CHUNK_SIZE + EXTRA_BUFFER_SIZE];
+static uint8_t temp_extra_buffer[EXTRA_BUFFER_SIZE];
 static uint32_t data_position = 0;
+static bool has_extra_buffer_data;
 
 static int arm_thumb_init(void *inst)
 {
 	data_position = 0;
+	has_extra_buffer_data = false;
 
 	return 0;
 }
@@ -38,6 +44,7 @@ static int arm_thumb_deinit(void *inst)
 static int arm_thumb_reset(void *inst)
 {
 	data_position = 0;
+	has_extra_buffer_data = false;
 	memset(output_buffer, 0x00, sizeof(output_buffer));
 
 	return 0;
@@ -52,17 +59,47 @@ static int arm_thumb_decompress(void *inst, const uint8_t *input, size_t input_s
 				bool last_part, uint32_t *offset, uint8_t **output,
 				size_t *output_size)
 {
+	bool end_part_match = false;
+	bool extra_buffer_used = false;
+
 	if (input_size > CONFIG_NRF_COMPRESS_CHUNK_SIZE) {
 		return -EINVAL;
 	}
 
-	memcpy(output_buffer, input, input_size);
-	arm_thumb_filter(output_buffer, input_size, data_position, false);
+	if (has_extra_buffer_data == true) {
+		/* Copy bytes from temporary holding buffer */
+		memcpy(output_buffer, temp_extra_buffer, sizeof(temp_extra_buffer));
+		memcpy(&output_buffer[sizeof(temp_extra_buffer)], input, input_size);
+		end_part_match = true;
+		extra_buffer_used = true;
+		has_extra_buffer_data = false;
+		input_size += sizeof(temp_extra_buffer);
+	} else {
+		memcpy(output_buffer, input, input_size);
+	}
+
+	arm_thumb_filter(output_buffer, input_size, data_position, false, &end_part_match);
 	data_position += input_size;
 	*offset = input_size;
+
+	if (extra_buffer_used) {
+		*offset -= sizeof(temp_extra_buffer);
+	}
+
 	*output = output_buffer;
 	*output_size = input_size;
 
+	if (end_part_match == true && !last_part) {
+		/* Partial match at end of input, need to cut the final 2 bytes off and stash
+		 * them
+		 */
+		memcpy(temp_extra_buffer, &output_buffer[(input_size - sizeof(temp_extra_buffer))],
+		       sizeof(temp_extra_buffer));
+		has_extra_buffer_data = true;
+		*output_size -= sizeof(temp_extra_buffer);
+		data_position -= sizeof(temp_extra_buffer);
+	}
+
 	return 0;
 }
 

subsys/nrf_security/Kconfig

@@ -64,11 +64,7 @@ config MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
 	  Promptless option used to control if the PSA Crypto core should have support for builtin keys or not.
 
 config MBEDTLS_CFG_FILE
-	string "mbed TLS configuration file"
 	default "nrf-config.h"
-	help
-	  Name of the config file for mbed TLS. This configuration file is used
-	  in configurations with or without PSA APIs supported.
 
 config MBEDTLS_PSA_CRYPTO_CONFIG
 	bool