| #------------------------------------------------------------------------------ |
| # Copyright (c) 2020-2022, Arm Limited. All rights reserved. |
| # |
| # SPDX-License-Identifier: BSD-3-Clause |
| # |
| #------------------------------------------------------------------------------ |
| |
| cmake_minimum_required(VERSION 3.15) |
| cmake_policy(SET CMP0079 NEW) |
| |
| add_library(mcuboot_config INTERFACE) |
| |
| set(MCUBOOT_KEY_ENC "${MCUBOOT_PATH}/enc-rsa2048-pub.pem" CACHE FILEPATH "Path to key with which to encrypt binary") |
| |
| # Add/process CBOR encoded measured boot data (MCUBOOT_MEASURED_BOOT) only if |
| # the store encoded measurements config is enabled. Otherwise, unencoded |
| # measurements are stored in the shared data area and must be processed at |
| # runtime. |
| if (CONFIG_TFM_BOOT_STORE_MEASUREMENTS AND CONFIG_TFM_BOOT_STORE_ENCODED_MEASUREMENTS) |
| set(MCUBOOT_MEASURED_BOOT ON) |
| endif() |
| |
| add_subdirectory("${MCUBOOT_PATH}/boot/bootutil" bootutil) |
| |
| target_include_directories(bootutil |
| PUBLIC |
| include |
| config |
| ) |
| |
| target_link_libraries(bootutil |
| PUBLIC |
| mcuboot_config |
| platform_bl2 |
| bl2_mbedcrypto |
| ) |
| |
| target_compile_options(bootutil |
| PRIVATE |
| ${BL2_COMPILER_CP_FLAG} |
| ) |
| |
| target_compile_definitions(bootutil |
| PRIVATE |
| $<$<BOOL:${DEFAULT_MCUBOOT_FLASH_MAP}>:DEFAULT_MCUBOOT_FLASH_MAP> |
| ) |
| |
| target_include_directories(mcuboot_config |
| INTERFACE |
| $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}> # for mcuboot_config.h only |
| ) |
| |
| target_include_directories(bl2 |
| PUBLIC |
| $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include> |
| ) |
| |
| target_sources(bl2 |
| PRIVATE |
| ${CMAKE_CURRENT_SOURCE_DIR}/bl2_main.c |
| ${CMAKE_CURRENT_SOURCE_DIR}/keys.c |
| ${CMAKE_CURRENT_SOURCE_DIR}/flash_map_extended.c |
| ${CMAKE_CURRENT_SOURCE_DIR}/flash_map_legacy.c |
| ) |
| |
| target_link_libraries(bl2 |
| PUBLIC |
| bootutil |
| ) |
| |
| set(MCUBOOT_ALLOWED_LOG_LEVELS OFF ERROR WARNING INFO DEBUG) |
| list(FIND MCUBOOT_ALLOWED_LOG_LEVELS ${MCUBOOT_LOG_LEVEL} LOG_LEVEL_ID) |
| |
| if (MCUBOOT_ALIGN_VAL GREATER 8) |
| set (MCUBOOT_BOOT_MAX_ALIGN ${MCUBOOT_ALIGN_VAL}) |
| else() |
| set (MCUBOOT_BOOT_MAX_ALIGN 8) |
| endif() |
| |
| configure_file(include/mcuboot_config/mcuboot_config.h.in |
| ${CMAKE_CURRENT_BINARY_DIR}/mcuboot_config/mcuboot_config.h |
| @ONLY) |
| |
| ############################### IMAGE SIGNING ################################## |
| |
| find_package(Python3) |
| |
| set(IMAGE_TYPE "S_IMAGE") |
| set(FLASH_AREA_NUM ${MCUBOOT_S_IMAGE_FLASH_AREA_NUM}) |
| if (MCUBOOT_IMAGE_NUMBER GREATER 1) |
| configure_file(signing_layout.c.in signing_layout_s.c @ONLY) |
| add_library(signing_layout_s OBJECT ${CMAKE_CURRENT_BINARY_DIR}/signing_layout_s.c) |
| else() |
| # Imgtool script requires the s_ns sufix. Since only one sigining layout is |
| # used in this mode the signing_layout_s target's source file is renamed. |
| configure_file(signing_layout.c.in signing_layout_s_ns.c @ONLY) |
| add_library(signing_layout_s OBJECT ${CMAKE_CURRENT_BINARY_DIR}/signing_layout_s_ns.c) |
| endif() |
| |
| target_compile_options(signing_layout_s |
| PRIVATE |
| $<$<C_COMPILER_ID:GNU>:-E\;-xc> |
| $<$<C_COMPILER_ID:ARMClang>:-E\;-xc> |
| $<$<C_COMPILER_ID:IAR>:--preprocess=ns\;$<TARGET_OBJECTS:signing_layout_s>> |
| ) |
| target_compile_definitions(signing_layout_s |
| PRIVATE |
| $<$<BOOL:${BL2}>:BL2> |
| $<$<BOOL:${MCUBOOT_IMAGE_NUMBER}>:MCUBOOT_IMAGE_NUMBER=${MCUBOOT_IMAGE_NUMBER}> |
| $<$<STREQUAL:${MCUBOOT_UPGRADE_STRATEGY},DIRECT_XIP>:IMAGE_ROM_FIXED> |
| ) |
| target_link_libraries(signing_layout_s |
| PRIVATE |
| platform_bl2 |
| ) |
| |
| if(NS) |
| add_custom_target(tfm_s_ns_bin |
| SOURCES tfm_s_ns.bin |
| ) |
| add_custom_command(OUTPUT tfm_s_ns.bin |
| DEPENDS $<TARGET_FILE_DIR:tfm_s>/tfm_s.bin |
| DEPENDS $<TARGET_FILE_DIR:tfm_ns>/tfm_ns.bin |
| DEPENDS tfm_s_bin tfm_ns_bin |
| DEPENDS signing_layout_s |
| |
| COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/assemble.py |
| --layout $<TARGET_OBJECTS:signing_layout_s> |
| -s $<TARGET_FILE_DIR:tfm_s>/tfm_s.bin |
| -n $<TARGET_FILE_DIR:tfm_ns>/tfm_ns.bin |
| -o tfm_s_ns.bin |
| COMMAND ${CMAKE_COMMAND} -E copy tfm_s_ns.bin $<TARGET_FILE_DIR:bl2> |
| ) |
| endif() |
| |
| add_custom_target(tfm_s_signed_bin |
| SOURCES tfm_s_signed.bin |
| ) |
| add_custom_command(OUTPUT tfm_s_signed.bin |
| DEPENDS $<TARGET_FILE_DIR:tfm_s>/tfm_s.bin |
| DEPENDS tfm_s_bin signing_layout_s |
| WORKING_DIRECTORY ${MCUBOOT_PATH}/scripts |
| |
| #Sign secure binary image with provided secret key |
| COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/wrapper/wrapper.py |
| -v ${MCUBOOT_IMAGE_VERSION_S} |
| --layout $<TARGET_OBJECTS:signing_layout_s> |
| -k ${MCUBOOT_KEY_S} |
| --public-key-format $<IF:$<BOOL:${MCUBOOT_HW_KEY}>,full,hash> |
| --align ${MCUBOOT_ALIGN_VAL} |
| --pad |
| --pad-header |
| -H ${BL2_HEADER_SIZE} |
| -s ${MCUBOOT_SECURITY_COUNTER_S} |
| -L ${MCUBOOT_ENC_KEY_LEN_S} |
| -d \"\(1,${MCUBOOT_NS_IMAGE_MIN_VER}\)\" |
| $<$<STREQUAL:${MCUBOOT_UPGRADE_STRATEGY},OVERWRITE_ONLY>:--overwrite-only> |
| $<$<BOOL:${MCUBOOT_ENC_IMAGES}>:-E${MCUBOOT_KEY_ENC}> |
| $<$<BOOL:${MCUBOOT_MEASURED_BOOT}>:--measured-boot-record> |
| $<TARGET_FILE_DIR:tfm_s>/tfm_s.bin |
| ${CMAKE_CURRENT_BINARY_DIR}/tfm_s_signed.bin |
| COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_BINARY_DIR}/tfm_s_signed.bin $<TARGET_FILE_DIR:bl2> |
| ) |
| |
| set(IMAGE_TYPE "NS_IMAGE") |
| set(FLASH_AREA_NUM ${MCUBOOT_NS_IMAGE_FLASH_AREA_NUM}) |
| configure_file(signing_layout.c.in signing_layout_ns.c @ONLY) |
| |
| add_library(signing_layout_ns OBJECT ${CMAKE_CURRENT_BINARY_DIR}/signing_layout_ns.c) |
| target_compile_options(signing_layout_ns |
| PRIVATE |
| $<$<C_COMPILER_ID:GNU>:-E\;-xc> |
| $<$<C_COMPILER_ID:ARMClang>:-E\;-xc> |
| $<$<C_COMPILER_ID:IAR>:--preprocess=ns\;$<TARGET_OBJECTS:signing_layout_ns>> |
| ) |
| target_compile_definitions(signing_layout_ns |
| PRIVATE |
| $<$<BOOL:${BL2}>:BL2> |
| $<$<BOOL:${MCUBOOT_IMAGE_NUMBER}>:MCUBOOT_IMAGE_NUMBER=${MCUBOOT_IMAGE_NUMBER}> |
| $<$<STREQUAL:${MCUBOOT_UPGRADE_STRATEGY},DIRECT_XIP>:IMAGE_ROM_FIXED> |
| ) |
| target_link_libraries(signing_layout_ns |
| PRIVATE |
| platform_bl2 |
| ) |
| |
| if(NS) |
| add_custom_target(tfm_ns_signed_bin |
| SOURCES tfm_ns_signed.bin |
| ) |
| add_custom_command(OUTPUT tfm_ns_signed.bin |
| DEPENDS $<TARGET_FILE_DIR:tfm_ns>/tfm_ns.bin |
| DEPENDS tfm_ns_bin signing_layout_ns |
| WORKING_DIRECTORY ${MCUBOOT_PATH}/scripts |
| |
| #Sign non-secure binary image with provided secret key |
| COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/wrapper/wrapper.py |
| -v ${MCUBOOT_IMAGE_VERSION_NS} |
| --layout $<TARGET_OBJECTS:signing_layout_ns> |
| -k ${MCUBOOT_KEY_NS} |
| --public-key-format $<IF:$<BOOL:${MCUBOOT_HW_KEY}>,full,hash> |
| --align ${MCUBOOT_ALIGN_VAL} |
| --pad |
| --pad-header |
| -H ${BL2_HEADER_SIZE} |
| -s ${MCUBOOT_SECURITY_COUNTER_NS} |
| -L ${MCUBOOT_ENC_KEY_LEN_NS} |
| -d \"\(0, ${MCUBOOT_S_IMAGE_MIN_VER}\)\" |
| $<TARGET_FILE_DIR:tfm_ns>/tfm_ns.bin |
| $<$<STREQUAL:${MCUBOOT_UPGRADE_STRATEGY},OVERWRITE_ONLY>:--overwrite-only> |
| $<$<BOOL:${MCUBOOT_ENC_IMAGES}>:-E${MCUBOOT_KEY_ENC}> |
| $<$<BOOL:${MCUBOOT_MEASURED_BOOT}>:--measured-boot-record> |
| ${CMAKE_CURRENT_BINARY_DIR}/tfm_ns_signed.bin |
| COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_BINARY_DIR}/tfm_ns_signed.bin $<TARGET_FILE_DIR:bl2> |
| ) |
| endif() |
| |
| if(NS) |
| add_custom_target(tfm_s_ns_signed_bin |
| SOURCES tfm_s_ns_signed.bin |
| ) |
| if (MCUBOOT_IMAGE_NUMBER GREATER 1) |
| add_custom_command(OUTPUT tfm_s_ns_signed.bin |
| DEPENDS tfm_s_signed_bin $<TARGET_FILE_DIR:tfm_s>/tfm_s.bin |
| DEPENDS tfm_ns_signed_bin $<TARGET_FILE_DIR:tfm_ns>/tfm_ns.bin |
| DEPENDS signing_layout_s |
| |
| # Create concatenated binary image from the two independently signed |
| # binary file. This only uses the local assemble.py script (not from |
| # upstream mcuboot) because that script is geared towards zephyr |
| # support |
| COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/assemble.py |
| --layout $<TARGET_OBJECTS:signing_layout_s> |
| -s $<TARGET_FILE_DIR:bl2>/tfm_s_signed.bin |
| -n $<TARGET_FILE_DIR:bl2>/tfm_ns_signed.bin |
| -o tfm_s_ns_signed.bin |
| COMMAND ${CMAKE_COMMAND} -E copy tfm_s_ns_signed.bin $<TARGET_FILE_DIR:bl2> |
| ) |
| else() |
| add_custom_command(OUTPUT tfm_s_ns_signed.bin |
| WORKING_DIRECTORY ${MCUBOOT_PATH}/scripts |
| DEPENDS tfm_s_ns_bin tfm_s_ns.bin |
| DEPENDS signing_layout_s |
| |
| # Use the non-secure key to sign the combined image if FORWARD_PROT_MSG is set. |
| # In such a configuration there is a subsystem with higher privileges controlling the |
| # the boot process and current implementation requires to use the non-secure key here. |
| COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/wrapper/wrapper.py |
| -v ${MCUBOOT_IMAGE_VERSION_S} |
| --layout $<TARGET_OBJECTS:signing_layout_s> |
| -k $<IF:$<BOOL:${FORWARD_PROT_MSG}>,${MCUBOOT_KEY_NS},${MCUBOOT_KEY_S}> |
| --public-key-format $<IF:$<BOOL:${MCUBOOT_HW_KEY}>,full,hash> |
| --align ${MCUBOOT_ALIGN_VAL} |
| --pad |
| --pad-header |
| -H ${BL2_HEADER_SIZE} |
| -s ${MCUBOOT_SECURITY_COUNTER_S} |
| -L ${MCUBOOT_ENC_KEY_LEN_S} |
| $<$<STREQUAL:${MCUBOOT_UPGRADE_STRATEGY},OVERWRITE_ONLY>:--overwrite-only> |
| $<$<BOOL:${MCUBOOT_ENC_IMAGES}>:-E${MCUBOOT_KEY_ENC}> |
| $<$<BOOL:${MCUBOOT_MEASURED_BOOT}>:--measured-boot-record> |
| ${CMAKE_CURRENT_BINARY_DIR}/tfm_s_ns.bin |
| ${CMAKE_CURRENT_BINARY_DIR}/tfm_s_ns_signed.bin |
| COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_BINARY_DIR}/tfm_s_ns_signed.bin $<TARGET_FILE_DIR:bl2> |
| ) |
| endif() |
| endif() |
| |
| add_custom_target(signed_images |
| ALL |
| DEPENDS $<IF:$<BOOL:${NS}>,tfm_s_ns_signed_bin,tfm_s_signed_bin> |
| ) |