sysbuild: Allow building secondary MCUboot without header

The commit adds Kconfig sysbuild option
SECURE_BOOT_MCUBOOT_DISCARDS_MCUBOOT_IMAGE_HEADER
that allows to build NSIB and MCUboot to discard MCUboot image
header on MCUboot image, to s0/s1 slot, update.
Warning: Images built with the option will not be compatbile
with existing builds did not have the option or did not have
it selected.
Enabling the options allows to slightly increase space available
for MCUboot image in s0/s1 slot and reduce size of MCUboot
image in DFU.

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>

Author: de-nordic

cmake/sysbuild/b0_mcuboot_signing.cmake

@@ -69,7 +69,7 @@ function(ncs_secure_boot_mcuboot_sign application bin_files signed_targets prefi
     # image makes no sense, so the --header-size=auto will be used.
 
     # Do not bother picking header size from image that is for CPUNET
-    if("${prefix}" STREQUAL "CPUNET_")
+    if("${prefix}" STREQUAL "CPUNET_" OR SB_CONFIG_SECURE_BOOT_MCUBOOT_DISCARDS_MCUBOOT_IMAGE_HEADER)
       set(header_size auto)
     else()
       sysbuild_get(header_size IMAGE ${application} VAR CONFIG_ROM_START_OFFSET KCONFIG)
@@ -92,7 +92,7 @@ function(ncs_secure_boot_mcuboot_sign application bin_files signed_targets prefi
   # partition start address.
   if(SB_CONFIG_PARTITION_MANAGER)
     set(pad_header --pad-header)
-  elseif("${prefix}" STREQUAL "CPUNET_")
+  elseif("${prefix}" STREQUAL "CPUNET_" OR SB_CONFIG_SECURE_BOOT_MCUBOOT_DISCARDS_MCUBOOT_IMAGE_HEADER)
     set(pad_header --pad-header)
   else()
     set(pad_header)

cmake/sysbuild/sign.cmake

@@ -98,7 +98,7 @@ function(b0_sign_image slot cpunet_target)
     set(skip_size 0)
   elseif(NOT SB_CONFIG_BOOTLOADER_MCUBOOT)
     set(skip_size 0)
-  elseif(cpunet_target)
+  elseif(cpunet_target OR SB_CONFIG_SECURE_BOOT_MCUBOOT_DISCARDS_MCUBOOT_IMAGE_HEADER)
     set(skip_size 0)
   else()
     sysbuild_get(build_with_tfm IMAGE ${DEFAULT_IMAGE} VAR CONFIG_BUILD_WITH_TFM KCONFIG)

sysbuild/CMakeLists.txt

@@ -675,6 +675,28 @@ function(${SYSBUILD_CURRENT_MODULE_NAME}_pre_cmake)
       set_config_bool(mcuboot CONFIG_SECURE_BOOT y)
       set_config_bool(mcuboot CONFIG_FW_INFO y)
 
+      # Discardable header is glued in front of image, not part of firmware image,
+      # so there is no offset to jump to, as executable image starts at the partition
+      # starting address.
+      if(SB_CONFIG_SECURE_BOOT_MCUBOOT_DISCARDS_MCUBOOT_IMAGE_HEADER)
+        set_config_int(b0 CONFIG_SB_IMAGE_BOOT_OFFSET 0)
+        set_config_bool(mcuboot CONFIG_NCS_MCUBOOT_DISCARDS_HEADER_IN_SECONDARY_MCUBOOT y)
+        # No nice way to do this without changes to Zephyr ROM_START_OFFSET definitions.
+        # This is special case, as we have MCUboot as bootloader and at the same time
+        # we do not want the shifter binary, as we usually do with Zephyr builds for
+        # MCUboot, with space left for MCUboot image header.
+        set_config_int(mcuboot CONFIG_ROM_START_OFFSET 0)
+      else()
+        if(SB_CONFIG_SOC_SERIES_NRF53 OR SB_CONFIG_SOC_SERIES_NRF91 OR SB_CONFIG_SOC_SERIES_NRF52)
+          set_config_int(b0 CONFIG_SB_IMAGE_BOOT_OFFSET 0x200)
+        elseif(SB_CONFIG_SOC_SERIES_NRF54L)
+          set_config_int(b0 CONFIG_SB_IMAGE_BOOT_OFFSET 0x800)
+        else()
+          message(WARNING "Missing CONFIG_SB_IMAGE_BOOT_OFFSET setting for selected SoC")
+        endif()
+        set_config_bool(mcuboot CONFIG_NCS_MCUBOOT_DISCARDS_HEADER_IN_SECONDARY_MCUBOOT n)
+      endif()
+
       if(SB_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256)
         if(SB_CONFIG_BOOT_SHARED_CRYPTO_ECDSA_P256)
           add_overlay_config(

sysbuild/Kconfig.mcuboot

@@ -174,6 +174,29 @@ config SECURE_BOOT_MCUBOOT_VERSION
 	help
 	  The version of the MCUboot S0/S1 upgrade package
 
+config SECURE_BOOT_MCUBOOT_DISCARDS_MCUBOOT_IMAGE_HEADER
+	bool "Use enough space in front of image to just fit header there"
+	depends on SECURE_BOOT
+	depends on BOOTLOADER_MCUBOOT
+	help
+	  INCOMPATIBILITY WARNING: MCUboot as secondary bootloader that have been
+	  built without the option enabled will not be able to update itself
+	  with a binary built with the option enabled. NSIB will not be able to
+	  boot such MCUboot either. The entire bootchain has to be built with the
+	  option enabled. This will happen because pre-existing MCUboot, built
+	  without the option, will try to skip non-existing header while trying
+	  to verify the image with NSIB, failing the process of verification.
+	  When this option is enabled, the MCUboot for secondary bootloader is
+	  built with ROM_START_OFFSET set to 0 and NSIB has nothing to skip over.
+	  Instead the header is glued in front of the image during signing, post
+	  build,  and is left out when MCUboot does update.
+	  NSIB will now have to verify, and boot MCUBOOT image, exactly at
+	  the beginning of S0/S1 partition, which means
+	  that SB_IMAGE_BOOT_OFFSET, for Secure Bootloader, has to be set to 0 too;
+	  RWX protections no longer need to skip the leftover MCUboot image header,
+	  because it no longer occupies the beginning of partition, so
+	  SB_DISABLE_SELF_RWX_SKIP_SIZE should also be set to 0.
+
 if BOOTLOADER_MCUBOOT
 
 choice BOOT_SIGNATURE_TYPE