sysbuild: Rollback protection in merged slots

Add a possibility to enable HW-based rollback protection when a project
uses the merged slots.

Ref: NCSDK-36295

Signed-off-by: Tomasz Chyrowicz <[email protected]>

Author: tomchy

cmake/sysbuild/sign_nrf54h20.cmake

@@ -183,6 +183,8 @@ function(mcuboot_sign_merged_nrf54h20 merged_hex main_image)
   set(CONFIG_MCUBOOT_IMGTOOL_UUID_CID)
   set(CONFIG_MCUBOOT_IMGTOOL_UUID_VID_NAME)
   set(CONFIG_MCUBOOT_IMGTOOL_UUID_CID_NAME)
+  set(CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION)
+  set(CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE)
   sysbuild_get(CONFIG_MCUBOOT_IMGTOOL_UUID_VID IMAGE ${main_image} VAR
     CONFIG_MCUBOOT_IMGTOOL_UUID_VID KCONFIG)
   sysbuild_get(CONFIG_MCUBOOT_IMGTOOL_UUID_CID IMAGE ${main_image} VAR
@@ -191,15 +193,22 @@ function(mcuboot_sign_merged_nrf54h20 merged_hex main_image)
     CONFIG_MCUBOOT_IMGTOOL_UUID_VID_NAME KCONFIG)
   sysbuild_get(CONFIG_MCUBOOT_IMGTOOL_UUID_CID_NAME IMAGE ${main_image} VAR
     CONFIG_MCUBOOT_IMGTOOL_UUID_CID_NAME KCONFIG)
+  sysbuild_get(CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION IMAGE ${main_image} VAR
+    CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION KCONFIG)
+  sysbuild_get(CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE IMAGE ${main_image} VAR
+    CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE KCONFIG)
+
+  if(CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION)
+    set(imgtool_args ${imgtool_args} --security-counter
+      ${CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE})
+  endif()
 
   if(CONFIG_MCUBOOT_IMGTOOL_UUID_VID)
-    set(imgtool_args ${imgtool_args} --vid
-      "${CONFIG_MCUBOOT_IMGTOOL_UUID_VID_NAME}")
+    set(imgtool_args ${imgtool_args} --vid "${CONFIG_MCUBOOT_IMGTOOL_UUID_VID_NAME}")
   endif()
 
   if(CONFIG_MCUBOOT_IMGTOOL_UUID_CID)
-    set(imgtool_args ${imgtool_args} --cid
-      "${CONFIG_MCUBOOT_IMGTOOL_UUID_CID_NAME}")
+    set(imgtool_args ${imgtool_args} --cid "${CONFIG_MCUBOOT_IMGTOOL_UUID_CID_NAME}")
   endif()
 
   # Fetch version and flags from the main image Kconfig.