manifest: Add mcuboot

.github/actions/action-slt-setup/action.yml

@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2025 Silicon Laboratories Inc.
+
+name: Install tools with SLT
+description: Install required tools using SLT
+
+inputs:
+  package-file:
+    description: Path to package file to install from
+    required: true
+    default: pkg.slt
+  slt-url:
+    description: URL to download SLT from
+    required: true
+    default: https://www.silabs.com/documents/public/software/slt-cli-1.0.0-linux-x64.zip
+
+runs:
+  using: composite
+  steps:
+    - name: Download and extract SLT
+      shell: bash
+      run: |
+        wget -q ${{ inputs.slt-url }} -O slt.zip
+        unzip -q slt.zip -d $GITHUB_WORKSPACE/slt
+        chmod +x $GITHUB_WORKSPACE/slt/slt
+        rm slt.zip
+        echo "$GITHUB_WORKSPACE/slt" >> $GITHUB_PATH
+    - name: Install packages
+      shell: bash
+      run: |
+        slt install -f ${{ inputs.package-file }} --no-lock

.github/workflows/build.yml

@@ -25,6 +25,11 @@ jobs:
         with:
           python-version: 3.12
 
+      - name: Set up Silicon Labs tools
+        uses: ./zephyr-silabs/.github/actions/action-slt-setup
+        with:
+          package-file: zephyr-silabs/pkg.slt
+
       - name: Setup Zephyr project
         uses: zephyrproject-rtos/action-zephyr-setup@v1
         with:
@@ -74,6 +79,15 @@ jobs:
             -p xg24_rb4187c \
             -p bg29_rb4420a
 
+      - name: Build bootloader samples
+        shell: bash
+        run: |
+          west twister -v --inline-logs -K \
+            -s sample.sysbuild.with_mcuboot \
+            -p xg24_rb4187c \
+            -p xg27_rb4194a \
+            -p bg29_rb4420a
+
       - name: Build Bluetooth samples
         shell: bash
         run: |

CMakeLists.txt

@@ -5,3 +5,16 @@
 # as the module CMake entry point (see zephyr/module.yml).
 
 add_subdirectory(modules)
+
+if(DEFINED CONFIG_SOC_FAMILY_SILABS_S2)
+
+# If MCUboot is being built, use the Commander signing script to sign the bootloader
+# with Simplicity Commander. This enables the MCUboot image to be secure boot
+# verified by the SE.
+if(DEFINED CONFIG_MCUBOOT)
+  set_target_properties(zephyr_property_target PROPERTIES
+    SIGNING_SCRIPT ${CMAKE_CURRENT_LIST_DIR}/zephyr/cmake/commander_sign.cmake
+  )
+endif()
+
+endif()

pkg.slt

@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2025 Silicon Laboratories Inc.
+
+[dependency]
+commander = "~1"

soc/silabs/Kconfig.sysbuild

@@ -0,0 +1,4 @@
+# Copyright (c) 2025 Silicon Laboratories Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+rsource "*/Kconfig.sysbuild"

soc/silabs/silabs_s2/Kconfig.sysbuild

@@ -0,0 +1,10 @@
+# Copyright (c) 2025 Silicon Laboratories Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+if BOOTLOADER_MCUBOOT
+
+choice BOOT_SIGNATURE_TYPE
+	default BOOT_SIGNATURE_TYPE_ECDSA_P256
+endchoice
+
+endif

west.yml

@@ -13,6 +13,10 @@ manifest:
       remote: silabs
       revision: 43bb1e577e2accfaa135464bac181ed2a0cc0489
       path: modules/crypto/mbedtls
+    - name: zephyr-mcuboot
+      remote: silabs
+      revision: 30a3475547e6c557d019943ef652af2e249d7883
+      path: bootloader/mcuboot
     - name: zephyr
       remote: silabs
       revision: e438b57a8caded26e90bc227edcf3329ece5241d

zephyr/cmake/commander_sign.cmake

@@ -0,0 +1,39 @@
+# Copyright (c) 2025 Silicon Laboratories Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+list(PREPEND CMAKE_MODULE_PATH ${CMAKE_CURRENT_LIST_DIR}/modules)
+
+function(zephyr_runner_file type path)
+  # Property magic which makes west flash choose the signed build
+  # output of a given type.
+  set_target_properties(runners_yaml_props_target PROPERTIES "${type}_file" "${path}")
+endfunction()
+
+function(zephyr_commander_sign_tasks keyfile)
+  string(CONFIGURE "${keyfile}" keyfile)
+
+  # Extensionless prefix of any output file.
+  set(output ${ZEPHYR_BINARY_DIR}/${KERNEL_NAME})
+
+  # List of additional build byproducts.
+  set(byproducts)
+
+  find_package(SimplicityCommander REQUIRED)
+
+  if(CONFIG_BUILD_OUTPUT_HEX)
+    list(APPEND byproducts ${output}.signed.hex)
+    zephyr_runner_file(hex ${output}.signed.hex)
+    set(BYPRODUCT_KERNEL_SIGNED_HEX_NAME "${output}.signed.hex"
+      CACHE FILEPATH "Signed kernel hex file" FORCE
+    )
+    set_property(GLOBAL APPEND PROPERTY extra_post_build_commands COMMAND
+                  ${COMMANDER} convert ${output}.hex
+                  --secureboot --keyfile ${keyfile} -o ${output}.signed.hex)
+  endif()
+
+  set_property(GLOBAL APPEND PROPERTY extra_post_build_byproducts ${byproducts})
+endfunction()
+
+if(DEFINED CONFIG_MCUBOOT AND DEFINED CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256)
+  zephyr_commander_sign_tasks("${CONFIG_BOOT_SIGNATURE_KEY_FILE}")
+endif()

zephyr/cmake/modules/FindSimplicityCommander.cmake

@@ -0,0 +1,35 @@
+# Copyright (c) 2025 Silicon Laboratories Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+# Module for locating Simplicity Commander.
+#
+# The module defines the following variables:
+#
+# COMMANDER
+# Path to Simplicity Commander binary
+# Set to 'COMMANDER-NOTFOUND' if Commander was not found
+#
+# SimplicityCommander_FOUND
+# True if Simplicity Commander was found.
+
+find_program(SLT slt)
+if(SLT)
+  execute_process(
+    COMMAND ${SLT} where commander
+    OUTPUT_VARIABLE slt_output
+    RESULT_VARIABLE slt_status
+    OUTPUT_STRIP_TRAILING_WHITESPACE
+  )
+  if(${slt_status} EQUAL 0 AND NOT slt_output STREQUAL "")
+    set(slt_commander_path "${slt_output}")
+  endif()
+endif()
+
+find_program(COMMANDER
+  NAMES commander-cli commander NAMES_PER_DIR
+  HINTS ${slt_commander_path}
+  PATH_SUFFIXES Contents/MacOS
+)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(SimplicityCommander REQUIRED_VARS COMMANDER)