Added MCUboot support for RAK4631 module

.editorconfig-checker.json

@@ -11,6 +11,8 @@
     "firmwares/",
     "loader/blobs/",
     "llext-edk/",
-    "extra/build.sh"
+    "extra/build.sh",
+    "loader/CMakeLists.txt",
+    "^CMakeLists\\.txt$"
   ]
 }

.github/workflows/rak-build.yml

@@ -67,7 +67,7 @@ jobs:
         run: |
           mkdir -p venv/bin && touch venv/bin/activate
           ./extra/build.sh nrf52840dk
-          ./extra/build.sh rak4631
+          ./extra/build.sh rak4631 --mcuboot
 
       - name: Build samples
         # Standalone Zephyr build of the samples. The sample list comes
@@ -91,7 +91,7 @@ jobs:
         if: ${{ github.event_name != 'pull_request' ||
           !contains(github.event.pull_request.labels.*.name, 'upstream-sync') }}
         working-directory: ${{ env.MODULE_PATH }}
-        run: west rak-lint -v -b build/rak4631_nrf52840
+        run: west rak-lint -v -b build/rak4631_nrf52840/loader
 
       - name: Install arduino-cli
         # Pinned (script and binary) for reproducible sketch builds.
@@ -102,7 +102,7 @@ jobs:
           arduino-cli version
 
       - name: Install the Arduino Zephyr toolchain
-        run: arduino-cli core install arduino:zephyr_main@0.90.0
+        run: arduino-cli core install arduino:zephyr_main@1.0.0
 
       - name: Install the sketch libraries
         # Third-party libraries the sketches in sketch/ include, pinned

.gitignore

@@ -17,5 +17,3 @@ includes.txt
 syms-dynamic.ld
 syms-static.ld
 tls-syms.S
-
-__pycache__/

.vscode/flash_loader.jlink

@@ -1,3 +1,4 @@
+loadfile firmwares/mcuboot-rak4631_nrf52840.hex
 loadfile firmwares/zephyr-rak4631_nrf52840.hex
 r
 g

.vscode/flash_sketch.jlink

@@ -1,4 +1,4 @@
-loadbin sketch/wisblock_rak13800/build/rak.zephyr.rak4631/wisblock_rak13800.ino.elf-zsk.bin, 0x70000
+loadbin sketch/arduino_blinky/build/rak.zephyr.rak4631/arduino_blinky.ino.elf-zsk.bin, 0x80000
 r
 g
 exit

.vscode/tasks.json

@@ -9,9 +9,10 @@
             "BOARD_WEST": "rak4631/nrf52840",
             "VARIANT": "rak4631_nrf52840",
             "DEVICE": "NRF52840_XXAA",
-            "SKETCH": "sketch/wisblock_rak13800",
+            "SKETCH": "sketch/arduino_blinky",
             "SKETCH_DEBUG": "false",
             "SAMPLE": "samples/blinky_arduino",
+            "SERIAL_PORT": "/dev/cu.usbmodem1101"
         },
         "cwd": "${workspaceFolder}"
     },
@@ -32,7 +33,8 @@
             "command": "extra/build.sh",
             "args": [
                 "${BOARD_ARD}",
-                "--debug"
+                // "--debug",
+                "--mcuboot"
             ],
             "group": "build",
             "problemMatcher": ["$gcc"]
@@ -50,6 +52,19 @@
             ],
             "problemMatcher": []
         },
+        {
+            // Board in MCUboot serial recovery (double-tap reset); MCUboot itself needs J-Link.
+            "label": "Loader: Upload (mcumgr)",
+            "type": "shell",
+            "command": "arduino-cli",
+            "args": [
+                "burn-bootloader",
+                "-b", "rak:zephyr:${BOARD_ARD}",
+                "-P", "mcumgr",
+                "-p", "${SERIAL_PORT}"
+            ],
+            "problemMatcher": []
+        },
         {
             "label": "Loader: Clean",
             "type": "shell",
@@ -114,6 +129,19 @@
             ],
             "problemMatcher": []
         },
+        {
+            "label": "Sketch: Upload (mcumgr)",
+            "type": "shell",
+            "command": "arduino-cli",
+            "args": [
+                "upload",
+                "-b", "rak:zephyr:${BOARD_ARD}",
+                "-p", "${SERIAL_PORT}",
+                "--input-dir", "${SKETCH}/build/rak.zephyr.${BOARD_ARD}",
+                "${SKETCH}"
+            ],
+            "problemMatcher": []
+        },
         {
             "label": "Sketch: Clean",
             "type": "shell",

CMakeLists.txt

@@ -1,5 +1,9 @@
+# Copyright (c) Arduino s.r.l. and/or its affiliated companies
+# Copyright (c) 2026 RAKwireless Technology Limited
 # SPDX-License-Identifier: Apache-2.0
 
+add_subdirectory(modules)
+
 # Do nothing unless the Arduino API is enabled in the Zephyr project
 if(NOT CONFIG_ARDUINO_API)
   return()

Kconfig.rak

@@ -12,3 +12,5 @@ config RAK_RUI_API
 
 	  With this option disabled the core behaves like upstream
 	  ArduinoCore-zephyr and none of the RAK sources are compiled.
+
+rsource "modules/Kconfig"

README.rak.md

@@ -162,11 +162,11 @@ arduino-cli version   # verify the installation
 ### Install the Arduino Zephyr toolchain (one time)
 
 ```shell
-arduino-cli core install arduino:zephyr_main@0.90.0
+arduino-cli core install arduino:zephyr_main@1.0.0
 ```
 
 The official `arduino:zephyr_main` core supplies the cross compiler
-referenced by `boards.txt` (`arm-zephyr-eabi` 0.16.8) and the
+referenced by `boards.txt` (`arm-zephyr-eabi` 1.0.1) and the
 post-processing tools (`gen-rodata-ld`, `zephyr-sketch-tool`,
 `zephyr-check-size`) that the `{runtime.tools.*}` recipes in
 `platform.txt` resolve against.
@@ -181,6 +181,7 @@ cd ~/rak-arduino-zephyr/ArduinoCore-zephyr
 (cd tools/zephyr-sketch-tool && go build)
 (cd tools/gen-rodata-ld && go build)
 (cd tools/zephyr-check-size && go build)
+(cd tools/mcumgr && go build)
 ```
 
 Each binary is produced inside its own tool directory

boards.txt

@@ -734,8 +734,7 @@ ventunoq.bootloader.target=stm32h5f5xx
 nrf52840dk.name=Nordic nRF52840 DK
 nrf52840dk.build.core=arduino
 nrf52840dk.build.crossprefix=arm-zephyr-eabi-
-nrf52840dk.build.compiler_path={runtime.tools.arm-zephyr-eabi-0.16.8.path}/bin/
-
+nrf52840dk.build.compiler_path={runtime.tools.arm-zephyr-eabi-1.0.1.path}/bin/
 nrf52840dk.menu.debug.false=Standard
 nrf52840dk.menu.debug.true=Debug
 nrf52840dk.menu.debug.true.build.zsk_args.debug=-debug
@@ -764,7 +763,7 @@ nrf52840dk.upload.target=nrf52840
 rak4631.name=RAKwireless RAK4631
 rak4631.build.core=arduino
 rak4631.build.crossprefix=arm-zephyr-eabi-
-rak4631.build.compiler_path={runtime.tools.arm-zephyr-eabi-0.16.8.path}/bin/
+rak4631.build.compiler_path={runtime.tools.arm-zephyr-eabi-1.0.1.path}/bin/
 
 rak4631.menu.debug.false=Standard
 rak4631.menu.debug.true=Debug
@@ -783,6 +782,7 @@ rak4631.menu.baseboard.rak19007.build.extra_flags=-DWISBLOCK_BASE_19007
 rak4631.build.zephyr_target=rak4631/nrf52840
 rak4631.build.zephyr_args=
 rak4631.build.zephyr_hals=hal_nordic
+rak4631.build.zephyr_toolchain=arm-zephyr-eabi
 rak4631.build.variant=rak4631_nrf52840
 
 rak4631.build.extra_flags=
@@ -792,6 +792,20 @@ rak4631.vid.0=0x1915
 rak4631.pid.0=0x5300
 rak4631.upload_port.0.vid=0x1915
 rak4631.upload_port.0.pid=0x5300
+rak4631.upload_port.1.vid=0x1915
+rak4631.upload_port.1.pid=0x5301
 rak4631.upload.target=nrf52840
 
+rak4631.upload.tool=mcumgr
+rak4631.upload.tool.default=mcumgr
+rak4631.upload.protocol=
+rak4631.upload.transport=
+rak4631.upload.use_1200bps_touch=true
+rak4631.upload.wait_for_upload_port=true
+rak4631.upload.native_usb=true
+
+rak4631.bootloader.tool=mcumgr
+rak4631.bootloader.tool.default=mcumgr
+rak4631.bootloader.file=zephyr-{build.variant}.bin
+
 ##########################################################################################

extra/build.sh

@@ -21,7 +21,7 @@ fi
 if [ $# -eq 0 ] || [ x$1 == x"-h" ] || [ x$1 == x"--help" ]; then
 	cat << EOF
 Usage:
-	$0 <arduino_board>
+	$0 <arduino_board> [--debug] [--mcuboot]
 	$0 <zephyr_board> [<west_args>]
 Build the loader for the given target.
 
@@ -60,9 +60,25 @@ if ! [ -z "$chosen_board" ]; then
 	fi
 	upload_offset=$(jq -cr '.upload_offset' <<< "$chosen_board")
 
-	# Check for debug flag and append
-	if [ x$2 == x"--debug" ]; then
-		args+=(-- -DEXTRA_CONF_FILE=../extra/debug.conf)
+	# Check for debug and mcuboot flags and append
+	for opt in "${@:2}"; do
+		case "$opt" in
+		--debug) debug=1 ;;
+		--mcuboot) mcuboot=1 ;;
+		*) echo "Unknown option: $opt"; exit 1 ;;
+		esac
+	done
+
+	conf=""
+	if [ -n "$mcuboot" ]; then
+		args+=(--sysbuild)
+		conf="overlay_mcuboot.conf"
+	fi
+	if [ -n "$debug" ]; then
+		conf="${conf:+$conf;}../extra/debug.conf"
+	fi
+	if [ -n "$conf" ]; then
+		args+=(-- "-DEXTRA_CONF_FILE=$conf")
 	fi
 else
 	# expect Zephyr-compatible target and args
@@ -100,12 +116,17 @@ fi
 BUILD_DIR=build/${variant}
 VARIANT_DIR=variants/${variant}
 rm -rf ${BUILD_DIR}
-west build -d ${BUILD_DIR} -b ${target} loader -t llext-edk "${args[@]}"
+west build -d ${BUILD_DIR} -b ${target} loader "${args[@]}"
+
+# With sysbuild the loader is one image among several and has its own build
+# directory as loader; the EDK target only exists there.
+LOADER_DIR=${BUILD_DIR}${mcuboot:+/loader}
+west build -d ${LOADER_DIR} -t llext-edk
 
 # Extract the generated EDK tarball and copy it to the variant directory
 mkdir -p ${VARIANT_DIR} firmwares
-(set -e ; cd ${BUILD_DIR} && rm -rf llext-edk && tar xf zephyr/llext-edk.tar.Z)
-rsync -a --delete ${BUILD_DIR}/llext-edk ${VARIANT_DIR}/
+(set -e ; cd ${LOADER_DIR} && rm -rf llext-edk && tar xf zephyr/llext-edk.tar.Z)
+rsync -a --delete ${LOADER_DIR}/llext-edk ${VARIANT_DIR}/
 
 # remove all inline comments in macro definitions
 # (especially from devicetree_generated.h and sys/util_internal.h)
@@ -123,20 +144,39 @@ edk_funcs='int32_t k_sleep\(k_timeout_t timeout\)|void k_busy_wait\(uint32_t use
 perl -0pi -e "s/__pinned_func\nstatic inline ($edk_funcs)/$edk_qual \$1/g" "$syscalls_hdr"
 perl -0pi -e "s/__syscall ($edk_funcs);/$edk_qual \$1;/g" "$kernel_hdr"
 
+IMG=${LOADER_DIR}/zephyr/zephyr
+# a signed build that produced no signed bin/hex would brick the board, so bail
+# out before touching firmwares/
+if [ -n "$mcuboot" ]; then
+	for ext in bin hex; do
+		if [ ! -f $IMG.signed.$ext ]; then
+			echo "error: --mcuboot build produced no $IMG.signed.$ext" >&2
+			exit 1
+		fi
+	done
+fi
 for ext in elf bin hex uf2; do
-    rm -f firmwares/zephyr-$variant.$ext
-    if [ -f ${BUILD_DIR}/zephyr/zephyr.$ext ]; then
-        cp ${BUILD_DIR}/zephyr/zephyr.$ext firmwares/zephyr-$variant.$ext
-    fi
+	rm -f firmwares/zephyr-$variant.$ext
+	# under MCUboot only the signed image boots, so prefer it when it exists
+	for src in $IMG.signed.$ext $IMG.$ext; do
+		if [ -f $src ]; then
+			cp $src firmwares/zephyr-$variant.$ext
+			break
+		fi
+	done
 done
-cp ${BUILD_DIR}/zephyr/zephyr.dts firmwares/zephyr-$variant.dts
-cp ${BUILD_DIR}/zephyr/.config firmwares/zephyr-$variant.config
+rm -f firmwares/mcuboot-$variant.hex
+if [ -n "$mcuboot" ]; then
+	cp ${BUILD_DIR}/mcuboot/zephyr/zephyr.hex firmwares/mcuboot-$variant.hex
+fi
+cp ${LOADER_DIR}/zephyr/zephyr.dts firmwares/zephyr-$variant.dts
+cp ${LOADER_DIR}/zephyr/.config firmwares/zephyr-$variant.config
 
 # Generate the provides.ld file for linked builds
 echo "Generating exported symbol scripts"
-extra/gen_provides.py "${BUILD_DIR}/zephyr/zephyr.elf" -T > ${VARIANT_DIR}/tls-syms.S
-extra/gen_provides.py "${BUILD_DIR}/zephyr/zephyr.elf" -L > ${VARIANT_DIR}/syms-dynamic.ld
-extra/gen_provides.py "${BUILD_DIR}/zephyr/zephyr.elf" -LF \
+extra/gen_provides.py "${LOADER_DIR}/zephyr/zephyr.elf" -T > ${VARIANT_DIR}/tls-syms.S
+extra/gen_provides.py "${LOADER_DIR}/zephyr/zephyr.elf" -L > ${VARIANT_DIR}/syms-dynamic.ld
+extra/gen_provides.py "${LOADER_DIR}/zephyr/zephyr.elf" -LF \
 	"+kheap_llext_heap" \
 	"+kheap__system_heap" \
 	"*sketch_base_addr=_sketch_start" \

extra/rak/checkall.py

@@ -63,8 +63,11 @@ def _build_checks(board):
         log.die(f"Board '{board}' not found in boards.txt / boards.local.txt")
 
     return [
-        (f"loader build ({board})", ["./extra/build.sh", board]),
-        ("cppcheck static analysis", ["west", "rak-lint", "-b", f"build/{variant}"]),
+        (f"loader build ({board})", ["./extra/build.sh", board, "--mcuboot"]),
+        (
+            "cppcheck static analysis",
+            ["west", "rak-lint", "-b", f"build/{variant}/loader"],
+        ),
         (f"sketch compilation ({board})", ["west", "rak-sketch-check", "-b", board]),
         (f"sample build ({target})", ["west", "rak-sample-check", "-b", target]),
     ]

extra/rak/license_check.py

@@ -22,7 +22,18 @@
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import rak_utils as utils
 
-IGNORE_SUFFIXES = {".md", ".rst", ".txt", ".pde", ".json", ".svg"}
+IGNORE_SUFFIXES = {
+    ".md",
+    ".rst",
+    ".txt",
+    ".pde",
+    ".json",
+    ".svg",
+    ".pem",
+    ".sum",
+    ".mod",
+}
+
 # Never checked, matched by exact file name (dotfiles have no suffix).
 IGNORE_NAMES = {".gitignore", "VERSION"}
 # Checked even though their suffix is ignored.

key/arduino_key_ecdsa-p256.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgoDdEoVMhi3aY27HX
+cxBaM5+nqp9tNbm0Q4PHywRo3HuhRANCAATEGlLJf8OiiVl0DJcddiM2JuNPlraW
+AV6J6SbzclJna5YXFKSKPk8JwHhQ81d4nFFzRJKnoHQ8XcwTl3X0PAvC
+-----END PRIVATE KEY-----

loader/CMakeLists.txt

@@ -1,11 +1,16 @@
+# Copyright (c) Arduino s.r.l. and/or its affiliated companies
+# Copyright (c) 2026 RAKwireless Technology Limited
 # SPDX-License-Identifier: Apache-2.0
 
 #set(DTC_OVERLAY_FILE ${BOARD}.overlay)
 
 cmake_minimum_required(VERSION 3.20.0)
 
 # get value of NORMALIZED_BOARD_TARGET early
-find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE} COMPONENTS yaml boards)
+# 'basic_settings' must load before 'boards' so the board lookup works under
+# sysbuild: it creates the sysbuild_cache target that the boards module reads.
+# It is a no-op in a non-sysbuild build, so plain builds are unaffected.
+find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE} COMPONENTS basic_settings yaml boards)
 
 set(DTC_OVERLAY_FILE ${CMAKE_CURRENT_LIST_DIR}/../variants/${NORMALIZED_BOARD_TARGET}/${NORMALIZED_BOARD_TARGET}.overlay)
 set(EXTRA_CONF_FILE ${CMAKE_CURRENT_LIST_DIR}/../variants/${NORMALIZED_BOARD_TARGET}/${NORMALIZED_BOARD_TARGET}.conf)

loader/llext_exports.c

@@ -549,4 +549,12 @@ FORCE_EXPORT_SYM(lorawan_register_dr_changed_callback);
 FORCE_EXPORT_SYM(lorawan_register_link_check_ans_callback);
 #endif
 
+#if defined(CONFIG_RETENTION_BOOT_MODE)
+FORCE_EXPORT_SYM(bootmode_set);
+#endif
+
+#if defined(CONFIG_REBOOT)
+FORCE_EXPORT_SYM(sys_reboot);
+#endif
+
 EXPORT_SYMBOL(sketch_header_v1_verify);