Add platform and boards configurations to create signed and encrypted sketches

Author: pennam

boards.txt

@@ -13,6 +13,7 @@ edge_control.build.fpu=-mfpu=fpv4-sp-d16
 edge_control.build.float-abi=-mfloat-abi=softfp
 edge_control.build.board=EDGE_CONTROL
 edge_control.build.ldscript=linker_script.ld
+edge_control.build.postbuild.cmd=imgtool exit
 edge_control.compiler.mbed.arch.define=-DARDUINO_ARCH_NRF52840
 edge_control.compiler.mbed.defines={build.variant.path}/defines.txt
 edge_control.compiler.mbed.ldflags={build.variant.path}/ldflags.txt
@@ -50,6 +51,7 @@ edge_control.bootloader.file=EDGE_CONTROL/bootloader.hex
 ##############################################################
 
 menu.split=Flash split
+menu.security=Security setting
 
 envie_m7.name=Arduino Portenta H7 (M7 core)
 envie_m7.build.core=arduino
@@ -60,6 +62,9 @@ envie_m7.menu.split.50_50=1MB M7 + 1MB M4
 envie_m7.menu.split.75_25=1.5MB M7 + 0.5MB M4
 envie_m7.menu.split.100_0=2MB M7 + M4 in SDRAM
 
+envie_m7.menu.security.none=None
+envie_m7.menu.security.sien=Signature + Encryption
+
 envie_m7.build.variant=PORTENTA_H7_M7
 envie_m7.build.mcu=cortex-m7
 envie_m7.build.fpu=-mfpu=fpv5-d16
@@ -71,6 +76,12 @@ envie_m7.menu.split.100_0.build.extra_ldflags=-DCM4_BINARY_START=0x60000000
 envie_m7.build.architecture=cortex-m7
 envie_m7.build.board=PORTENTA_H7_M7
 envie_m7.build.ldscript=linker_script.ld
+envie_m7.build.slot_size=0x1E0000
+envie_m7.build.header_size=0x20000
+envie_m7.build.alignment=32
+envie_m7.build.version=1.2.3+4
+envie_m7.menu.security.sien.build.postbuild.cmd="{tools.imgtool.path}/{tools.imgtool.cmd}" {tools.imgtool.build.pattern}
+envie_m7.menu.security.none.build.postbuild.cmd="{tools.imgtool.path}/{tools.imgtool.cmd}" exit
 envie_m7.compiler.mbed.arch.define=
 envie_m7.compiler.mbed.defines={build.variant.path}/defines.txt
 envie_m7.compiler.mbed.ldflags={build.variant.path}/ldflags.txt
@@ -98,8 +109,10 @@ envie_m7.upload.protocol=
 envie_m7.upload.transport=
 envie_m7.upload.vid=0x2341
 envie_m7.upload.pid=0x035b
-envie_m7.upload.address=0x08040000
-envie_m7.upload.interface=0
+envie_m7.menu.security.none.upload.interface=0
+envie_m7.menu.security.sien.upload.interface=2
+envie_m7.menu.security.none.upload.address=0x08040000
+envie_m7.menu.security.sien.upload.address=0xA0000000
 envie_m7.upload.use_1200bps_touch=true
 envie_m7.upload.wait_for_upload_port=true
 envie_m7.upload.native_usb=true
@@ -147,6 +160,7 @@ envie_m4.menu.split.100_0.build.extra_ldflags=-DCM4_BINARY_START=0x60000000 -DCM
 envie_m4.build.architecture=cortex-m4
 envie_m4.build.board=PORTENTA_H7_M4
 envie_m4.build.ldscript=linker_script.ld
+envie_m4.build.postbuild.cmd="{tools.imgtool.path}/{tools.imgtool.cmd}" exit
 envie_m4.compiler.mbed.arch.define=
 envie_m4.compiler.mbed.defines={build.variant.path}/defines.txt
 envie_m4.compiler.mbed.ldflags={build.variant.path}/ldflags.txt
@@ -205,6 +219,7 @@ nano33ble.build.fpu=-mfpu=fpv4-sp-d16
 nano33ble.build.float-abi=-mfloat-abi=softfp
 nano33ble.build.board=ARDUINO_NANO33BLE
 nano33ble.build.ldscript=linker_script.ld
+nano33ble.build.postbuild.cmd="{tools.imgtool.path}/{tools.imgtool.cmd}" exit
 nano33ble.compiler.mbed.arch.define=-DARDUINO_ARCH_NRF52840
 nano33ble.compiler.mbed.defines={build.variant.path}/defines.txt
 nano33ble.compiler.mbed.ldflags={build.variant.path}/ldflags.txt
@@ -258,6 +273,7 @@ nanorp2040connect.build.float-abi=
 nanorp2040connect.build.architecture=cortex-m0plus
 nanorp2040connect.build.board=NANO_RP2040_CONNECT
 nanorp2040connect.build.ldscript=linker_script.ld
+nanorp2040connect.build.postbuild.cmd="{tools.imgtool.path}/{tools.imgtool.cmd}" exit
 nanorp2040connect.compiler.mbed.arch.define=-DARDUINO_ARCH_RP2040
 nanorp2040connect.compiler.mbed.defines={build.variant.path}/defines.txt
 nanorp2040connect.compiler.mbed.ldflags={build.variant.path}/ldflags.txt
@@ -309,6 +325,7 @@ pico.build.float-abi=
 pico.build.architecture=cortex-m0plus
 pico.build.board=RASPBERRY_PI_PICO
 pico.build.ldscript=linker_script.ld
+pico.build.postbuild.cmd="{tools.imgtool.path}/{tools.imgtool.cmd}" exit
 pico.compiler.mbed.arch.define=-DARDUINO_ARCH_RP2040
 pico.compiler.mbed.defines={build.variant.path}/defines.txt
 pico.compiler.mbed.ldflags={build.variant.path}/ldflags.txt
@@ -352,6 +369,7 @@ nicla_sense.build.fpu=-mfpu=fpv4-sp-d16
 nicla_sense.build.float-abi=-mfloat-abi=softfp
 nicla_sense.build.board=NICLA
 nicla_sense.build.ldscript=linker_script.ld
+nicla_sense.build.postbuild.cmd="{tools.imgtool.path}/{tools.imgtool.cmd}" exit
 nicla_sense.compiler.mbed.arch.define=-DARDUINO_ARCH_NRF52832
 nicla_sense.compiler.mbed.defines={build.variant.path}/defines.txt
 nicla_sense.compiler.mbed.ldflags={build.variant.path}/ldflags.txt
@@ -399,6 +417,7 @@ nicla_vision.build.extra_flags=
 nicla_vision.build.architecture=cortex-m7
 nicla_vision.build.board=NICLA_VISION
 nicla_vision.build.ldscript=linker_script.ld
+nicla_vision.build.postbuild.cmd="{tools.imgtool.path}/{tools.imgtool.cmd}" exit
 nicla_vision.compiler.mbed.arch.define=
 nicla_vision.compiler.mbed.defines={build.variant.path}/defines.txt
 nicla_vision.compiler.mbed.ldflags={build.variant.path}/ldflags.txt

platform.txt

@@ -96,6 +96,8 @@ recipe.objcopy.bin.pattern="{compiler.path}{compiler.elf2hex.cmd}" {compiler.elf
 ## Create output (hex file)
 recipe.objcopy.hex.pattern="{compiler.path}{compiler.elf2hex.cmd}" {compiler.elf2hex.hex.flags} {compiler.elf2hex.extra_flags} "{build.path}/{build.project_name}.elf" "{build.path}/{build.project_name}.hex"
 
+## Create output secure image (bin file)
+recipe.hooks.objcopy.postobjcopy.1.pattern={build.postbuild.cmd}
 ## Compute size
 recipe.size.pattern="{compiler.path}{compiler.size.cmd}" -A "{build.path}/{build.project_name}.elf"
 recipe.size.regex.data=^(?:\.data|\.bss)\s+([0-9]+).*
@@ -185,6 +187,18 @@ tools.picotool.upload.params.verbose=-v
 tools.picotool.upload.params.quiet=
 tools.picotool.upload.pattern="{path}/{cmd}" {upload.verbose} -D "{build.path}/{build.project_name}.elf"
 
+#
+# IMGTOOL
+#
+
+tools.imgtool.path={runtime.tools.imgtool.path}
+tools.imgtool.cmd=imgtool
+tools.imgtool.keys.path={runtime.hardware.path}/mbed/libraries/MCUboot/default_keys
+tools.imgtool.sign.name=ecdsa-p256-signing-key.pem
+tools.imgtool.encrypt.name=ecdsa-p256-encrypt-key.pem
+
+tools.imgtool.build.pattern=sign --key "{tools.imgtool.keys.path}/{tools.imgtool.sign.name}"  --encrypt "{tools.imgtool.keys.path}/{tools.imgtool.encrypt.name}" "{build.path}/{build.project_name}.bin" "{build.path}/{build.project_name}.bin" --align {build.alignment} --max-align {build.alignment} --version {build.version} --header-size {build.header_size} --pad-header --slot-size {build.slot_size}
+
 #
 # GDB (Debugger)
 #