Commit 310999da authored by Ioannis Glaropoulos's avatar Ioannis Glaropoulos
Browse files

boards: arm: update tfm post-build scripts after upmerge 



Update the TF-M post-build scripts in the relevant
ARM platforms in the wake of updating TF-M to the
latest upstream.

Signed-off-by: default avatarIoannis Glaropoulos <Ioannis.Glaropoulos@nordicsemi.no>
parent c9fd62a2

boards/arm/mps2_an521/CMakeLists.txt

+14 −14
Original line number Diff line number Diff line
@@ -18,8 +18,9 @@ if (CONFIG_BUILD_WITH_TFM) 
		set(TFM_IMAGE_VERSION_NS 0.0.0+0)

	endif()



	set(PREPROCESSED_FILE "${CMAKE_BINARY_DIR}/tfm/image_macros_preprocessed")

	set(TFM_MCUBOOT_DIR "${ZEPHYR_BASE}/../modules/tee/tfm/trusted-firmware-m/bl2/ext/mcuboot")

	set(PREPROCESSED_FILE_S "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_s.dir/signing_layout_s.o")

	set(PREPROCESSED_FILE_NS "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_ns.dir/signing_layout_ns.o")

	set(TFM_MCUBOOT_DIR "${ZEPHYR_TFM_MODULE_DIR}/trusted-firmware-m/bl2/ext/mcuboot")



	# Configure which format (full or hash) to include the public key in

	# the image manifest
@@ -35,43 +36,42 @@ if (CONFIG_BUILD_WITH_TFM) 
	set_property(GLOBAL APPEND PROPERTY extra_post_build_commands



		#Sign secure binary image with public key

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/imgtool.py

		ARGS sign

			 --layout ${PREPROCESSED_FILE}_s.c

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/wrapper/wrapper.py

			 --layout ${PREPROCESSED_FILE_S}

			 -k ${CONFIG_TFM_KEY_FILE_S}

			 --public-key-format ${TFM_PUBLIC_KEY_FORMAT}

			 --align 1

			 -v ${TFM_IMAGE_VERSION_S}

			 --pad

			 --pad-header

			 ${ADD_NS_IMAGE_MIN_VER}

			 ${ADD_SECURITY_COUNTER_S}

			 -s auto

			 -H 0x400

			 ${CMAKE_BINARY_DIR}/tfm/install/outputs/AN521/tfm_s.bin

			 ${CMAKE_BINARY_DIR}/tfm/install/outputs/MPS2/AN521/tfm_s.bin

			 ${CMAKE_BINARY_DIR}/tfm_s_signed.bin



		#Sign non-secure binary image with public key

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/imgtool.py

		ARGS sign

			 --layout ${PREPROCESSED_FILE}_ns.c

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/wrapper/wrapper.py

			 --layout ${PREPROCESSED_FILE_NS}

			 -k ${CONFIG_TFM_KEY_FILE_NS}

			 --public-key-format ${TFM_PUBLIC_KEY_FORMAT}

			 --align 1

			 -v ${TFM_IMAGE_VERSION_NS}

			 -s auto

			 ${ADD_S_IMAGE_MIN_VER}

			 ${ADD_SECURITY_COUNTER_NS}

			 -H 0x400

			 --included-header

			 ${CMAKE_BINARY_DIR}/zephyr/${KERNEL_BIN_NAME}

			 ${CMAKE_BINARY_DIR}/zephyr_ns_signed.bin



		#Create concatenated binary image from the two independently signed binary file

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/assemble.py

		ARGS --layout ${PREPROCESSED_FILE}_s.c

		     --layout ${PREPROCESSED_FILE_S}

			 -s ${CMAKE_BINARY_DIR}/tfm_s_signed.bin

			 -n ${CMAKE_BINARY_DIR}/zephyr_ns_signed.bin

			 -o ${CMAKE_BINARY_DIR}/tfm_sign.bin



		#Copy mcuboot.bin

		COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/mcuboot.bin ${CMAKE_BINARY_DIR}

		COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_BINARY_DIR}/tfm/bin/bl2.bin ${CMAKE_BINARY_DIR}/mcuboot.bin



		#Merge mcuboot.bin and tfm_sign.bin for QEMU

		COMMAND ${SREC_CAT}

boards/arm/nucleo_l552ze_q/CMakeLists.txt

+15 −15
Original line number Diff line number Diff line
@@ -16,49 +16,49 @@ if (CONFIG_BUILD_WITH_TFM) 
		set(TFM_IMAGE_VERSION_NS 0.0.0+0)

	endif()



	set(PREPROCESSED_FILE "${CMAKE_BINARY_DIR}/tfm/image_macros_preprocessed")

	set(TFM_MCUBOOT_DIR "${ZEPHYR_BASE}/../modules/tee/tfm/trusted-firmware-m/bl2/ext/mcuboot")

	set(PREPROCESSED_FILE_S "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_s.dir/signing_layout_s.o")

	set(PREPROCESSED_FILE_NS "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_ns.dir/signing_layout_ns.o")

	set(TFM_MCUBOOT_DIR "${ZEPHYR_TFM_MODULE_DIR}/trusted-firmware-m/bl2/ext/mcuboot")



	# Configure which format (full or hash) to include the public key in

	# the image manifest

	set(TFM_PUBLIC_KEY_FORMAT "hash")

	set(TFM_PUBLIC_KEY_FORMAT "full")



	#Create and sign for concatenated binary image, should align with the TF-M BL2

	set_property(GLOBAL APPEND PROPERTY extra_post_build_commands



		#Sign secure binary image with public key

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/imgtool.py

		ARGS sign

			 --layout ${PREPROCESSED_FILE}_s.c

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/wrapper/wrapper.py

			 --layout ${PREPROCESSED_FILE_S}

			 -k ${CONFIG_TFM_KEY_FILE_S}

			 --public-key-format ${TFM_PUBLIC_KEY_FORMAT}

			 --align 1

			 -v ${TFM_IMAGE_VERSION_S}

			 --pad

			 --pad-header

			 ${ADD_NS_IMAGE_MIN_VER}

			 ${ADD_SECURITY_COUNTER_S}

			 -s auto

			 -H 0x400

			 ${CMAKE_BINARY_DIR}/tfm/install/outputs/STM_NUCLEO_L552ZE_Q/tfm_s.bin

			 ${CMAKE_BINARY_DIR}/tfm/install/outputs/STM/NUCLEO_L552ZE_Q/tfm_s.bin

			 ${CMAKE_BINARY_DIR}/tfm_s_signed.bin



		#Sign non-secure binary image with public key

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/imgtool.py

		ARGS sign

			 --layout ${PREPROCESSED_FILE}_ns.c

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/wrapper/wrapper.py

			 --layout ${PREPROCESSED_FILE_NS}

			 -k ${CONFIG_TFM_KEY_FILE_NS}

			 --public-key-format ${TFM_PUBLIC_KEY_FORMAT}

			 --align 1

			 -v ${TFM_IMAGE_VERSION_NS}

			 -s auto

			 ${ADD_S_IMAGE_MIN_VER}

			 ${ADD_SECURITY_COUNTER_NS}

			 -H 0x400

			 --included-header

			 ${CMAKE_BINARY_DIR}/zephyr/${KERNEL_BIN_NAME}

			 ${CMAKE_BINARY_DIR}/zephyr_ns_signed.bin



		#Copy mcuboot.bin

		COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/mcuboot.bin ${CMAKE_BINARY_DIR}

		COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_BINARY_DIR}/tfm/bin/bl2.bin ${CMAKE_BINARY_DIR}/mcuboot.bin



		#Execute post build script postbuild.sh

		COMMAND ${CMAKE_BINARY_DIR}/tfm/install/postbuild.sh

		COMMAND ${CMAKE_BINARY_DIR}/tfm/postbuild.sh

      )

endif()

boards/arm/v2m_musca_b1/CMakeLists.txt

+20 −15
Original line number Diff line number Diff line
@@ -18,8 +18,9 @@ if (CONFIG_BUILD_WITH_TFM) 
		set(TFM_IMAGE_VERSION_NS 0.0.0+0)

	endif()



	set(PREPROCESSED_FILE "${CMAKE_BINARY_DIR}/tfm/image_macros_preprocessed")

	set(TFM_MCUBOOT_DIR "${ZEPHYR_BASE}/../modules/tee/tfm/trusted-firmware-m/bl2/ext/mcuboot")

	set(PREPROCESSED_FILE_S "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_s.dir/signing_layout_s.o")

	set(PREPROCESSED_FILE_NS "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_ns.dir/signing_layout_ns.o")

	set(TFM_MCUBOOT_DIR "${ZEPHYR_TFM_MODULE_DIR}/trusted-firmware-m/bl2/ext/mcuboot")



	# Configure which format (full or hash) to include the public key in

	# the image manifest
@@ -34,33 +35,37 @@ if (CONFIG_BUILD_WITH_TFM) 
	# Create and sign for concatenated binary image should align with the TF-M BL2

	set_property(GLOBAL APPEND PROPERTY extra_post_build_commands



		#Create concatenated binary image from the two binary file

		# Create concatenated binary image from the two binary files

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/assemble.py

		ARGS --layout ${PREPROCESSED_FILE}.c

		    --layout ${PREPROCESSED_FILE_NS}

			-s ${CMAKE_BINARY_DIR}/tfm/install/outputs/MUSCA_B1/tfm_s.bin

			-n ${CMAKE_BINARY_DIR}/zephyr/${KERNEL_BIN_NAME}

			-o ${CMAKE_BINARY_DIR}/tfm_full.bin



		#Sign concatenated binary image with default public key in mcuboot folder

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/imgtool.py

		ARGS sign

			--layout ${PREPROCESSED_FILE}.c

			-k ${CONFIG_TFM_KEY_FILE_S}

		COMMAND ${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/wrapper/wrapper.py

			--layout ${PREPROCESSED_FILE_NS}

			-k ${CONFIG_TFM_KEY_FILE_NS}

			--public-key-format ${TFM_PUBLIC_KEY_FORMAT}

			--align 1

			-v ${TFM_IMAGE_VERSION_S}

			${ADD_SECURITY_COUNTER}

			-v ${TFM_IMAGE_VERSION_NS}

			--pad

			--pad-header

			${ADD_NS_IMAGE_MIN_VER}

			-s auto

			-H 0x400

			--included-header

			${CMAKE_BINARY_DIR}/tfm_full.bin

			${CMAKE_BINARY_DIR}/tfm_sign.bin



		#Copy mcuboot.bin

		COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_BINARY_DIR}/tfm/bin/bl2.bin ${CMAKE_BINARY_DIR}/mcuboot.bin



		#srec_cat to combine images into hex for drag and drop

		COMMAND ${SREC_CAT}

		ARGS ${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/mcuboot.bin -binary

		ARGS ${CMAKE_BINARY_DIR}/mcuboot.bin -Binary

			-offset 0xA000000

			${CMAKE_BINARY_DIR}/tfm_sign.bin -binary

			${CMAKE_BINARY_DIR}/tfm_sign.bin -Binary

			-offset 0xA020000

			-o ${CMAKE_BINARY_DIR}/tfm_zephyr.hex -Intel --line-length=44

			-o ${CMAKE_BINARY_DIR}/tfm_zephyr.hex -intel --line-length=44

	)

endif()

CRA Git | Maintained and supported by SUSTech CRA and CCSE