Skip to content

Commit 2b97ff6

Browse files
jainvikas8jainvikas8
committed
Update ARM_MUSCA_S1.py post binary hook script
The script changes are required with respect to TF-M v1.2 integration for this target. The imgtool.py is been replaced with `wrapper.py` which uses click command to run the signing algorithm. The version `-v` and dependencies `-d` have been updated to resolve upgrade issues from TF-M v1.1 --> v1.2
1 parent e8cbfdf commit 2b97ff6

File tree

2 files changed

+93
-53
lines changed

2 files changed

+93
-53
lines changed

‎tools/targets/ARM_MUSCA_S1.py

Lines changed: 92 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/python
2-
# Copyright (c) 2017-2020 Arm Limited
2+
# Copyright (c) 2017-2021 Arm Limited
33
#
44
# SPDX-License-Identifier: Apache-2.0
55
#
@@ -19,16 +19,12 @@
1919
from os.path import abspath, basename, dirname, splitext, isdir
2020
from os.path import join as path_join
2121
import re
22-
from argparse import Namespace
23-
from tools.psa.tfm.bin_utils.assemble import Assembly
24-
from tools.psa.tfm.bin_utils.imgtool import do_sign
25-
from tools.psa.tfm.bin_utils.imgtool_lib import version
22+
import subprocess
2623

2724
SCRIPT_DIR = dirname(abspath(__file__))
2825
MBED_OS_ROOT = abspath(path_join(SCRIPT_DIR, os.pardir, os.pardir))
2926
MUSCA_S1_BASE = path_join(MBED_OS_ROOT, 'targets', 'TARGET_ARM_SSG', 'TARGET_MUSCA_S1')
3027

31-
3228
def musca_tfm_bin(t_self, non_secure_bin, secure_bin):
3329

3430
assert os.path.isfile(secure_bin)
@@ -39,58 +35,93 @@ def musca_tfm_bin(t_self, non_secure_bin, secure_bin):
3935
if not isdir(tempdir):
4036
os.makedirs(tempdir)
4137
flash_layout = path_join(MUSCA_S1_BASE, 'partition', 'flash_layout.h')
42-
mcuboot_bin = path_join(MUSCA_S1_BASE, 'mcuboot.bin')
43-
image_macros_s = path_join(MUSCA_S1_BASE, 'partition', 'image_macros_preprocessed_s.c')
44-
image_macros_ns = path_join(MUSCA_S1_BASE, 'partition', 'image_macros_preprocessed_ns.c')
38+
mcuboot_bin = path_join(MUSCA_S1_BASE, 'bl2.bin')
39+
image_macros_s = path_join(MUSCA_S1_BASE, 'partition', 'signing_layout_s.c')
40+
image_macros_ns = path_join(MUSCA_S1_BASE, 'partition', 'signing_layout_ns.c')
4541
s_bin_name, s_bin_ext = splitext(basename(secure_bin))
46-
s_signed_bin = path_join(tempdir, s_bin_name + '_signed' + s_bin_ext)
42+
s_signed_bin = abspath(path_join(tempdir, s_bin_name + '_signed' + s_bin_ext))
4743
ns_bin_name, ns_bin_ext = splitext(basename(non_secure_bin))
48-
ns_signed_bin = path_join(tempdir, 'tfm_' + ns_bin_name + '_signed' + ns_bin_ext)
49-
concatenated_bin = path_join(tempdir, s_bin_name + '_' + ns_bin_name + '_concat' + ns_bin_ext)
44+
ns_signed_bin = abspath(path_join(tempdir, 'tfm_' + ns_bin_name + '_signed' + ns_bin_ext))
45+
concatenated_bin = abspath(path_join(tempdir, s_bin_name + '_' + ns_bin_name + '_concat' + ns_bin_ext))
5046

5147
assert os.path.isfile(image_macros_s)
5248
assert os.path.isfile(image_macros_ns)
5349

54-
#1. Run imgtool to sign the secure binary
55-
sign_args = Namespace(
56-
layout=image_macros_s,
57-
key=path_join(SCRIPT_DIR, 'musca_s1-root-rsa-3072.pem'),
58-
public_key_format=None,
59-
align=1,
60-
dependencies=None,
61-
version=version.decode_version('1.0'),
62-
header_size=0x400,
63-
security_counter=None,
64-
rsa_pkcs1_15=False,
65-
included_header=False,
66-
infile=secure_bin,
67-
outfile=s_signed_bin
68-
)
69-
do_sign(sign_args)
70-
71-
#2. Run imgtool to sign the non-secure mbed binary
72-
sign_args = Namespace(
73-
layout=image_macros_ns,
74-
key=path_join(SCRIPT_DIR, 'musca_s1-root-rsa-3072_1.pem'),
75-
public_key_format=None,
76-
align=1,
77-
dependencies=None,
78-
version=version.decode_version('1.0'),
79-
header_size=0x400,
80-
security_counter=None,
81-
rsa_pkcs1_15=False,
82-
included_header=False,
83-
infile=non_secure_bin,
84-
outfile=ns_signed_bin
85-
)
86-
do_sign(sign_args)
87-
88-
#1. Concatenate signed secure TFM and non-secure mbed binaries
89-
output = Assembly(image_macros_s, concatenated_bin)
90-
output.add_image(s_signed_bin, "SECURE")
91-
output.add_image(ns_signed_bin, "NON_SECURE")
92-
93-
#3. Concatenate mcuboot and signed binary and overwrite mbed built binary file
50+
#1. Run wrapper to sign the TF-M secure binary
51+
cmd = [
52+
"python3",
53+
path_join(MBED_OS_ROOT, "tools", "psa","tfm", "bin_utils","wrapper.py"),
54+
"-v",
55+
'1.2.0',
56+
"-k",
57+
path_join(SCRIPT_DIR, 'musca_s1-root-rsa-3072.pem'),
58+
"--layout",
59+
image_macros_s,
60+
"--public-key-format",
61+
'full',
62+
"--align",
63+
'1',
64+
"--pad",
65+
"--pad-header",
66+
"-H",
67+
'0x400',
68+
"--overwrite-only",
69+
"-s",
70+
'auto',
71+
"-d",
72+
'(0,0.0.0+0)',
73+
abspath(secure_bin),
74+
s_signed_bin,
75+
]
76+
77+
run_cmd(cmd, MBED_OS_ROOT)
78+
79+
#2. Run wrapper to sign the non-secure mbed binary
80+
cmd = [
81+
"python3",
82+
path_join(MBED_OS_ROOT, "tools", "psa","tfm", "bin_utils","wrapper.py"),
83+
"-v",
84+
'1.2.0',
85+
"-k",
86+
path_join(SCRIPT_DIR, 'musca_s1-root-rsa-3072_1.pem'),
87+
"--layout",
88+
image_macros_ns,
89+
"--public-key-format",
90+
'full',
91+
"--align",
92+
'1',
93+
"--pad",
94+
"--pad-header",
95+
"-H",
96+
'0x400',
97+
"--overwrite-only",
98+
"-s",
99+
'auto',
100+
"-d",
101+
'(1,0.0.0+0)',
102+
abspath(non_secure_bin),
103+
ns_signed_bin,
104+
]
105+
106+
run_cmd(cmd, MBED_OS_ROOT)
107+
108+
#3. Concatenate signed secure TFM and non-secure mbed binaries
109+
cmd = [
110+
"python3",
111+
path_join(MBED_OS_ROOT, "tools", "psa","tfm", "bin_utils","assemble.py"),
112+
"--layout",
113+
image_macros_s,
114+
"-s",
115+
s_signed_bin,
116+
"-n",
117+
ns_signed_bin,
118+
"-o",
119+
concatenated_bin,
120+
]
121+
122+
run_cmd(cmd, MBED_OS_ROOT)
123+
124+
#4. Concatenate mcuboot and signed binary and overwrite mbed built binary file
94125
mcuboot_image_size = find_bl2_size(flash_layout)
95126
with open(mcuboot_bin, "rb") as mcuboot_fh, open(concatenated_bin, "rb") as concat_fh:
96127
with open(non_secure_bin, "w+b") as out_fh:
@@ -109,3 +140,12 @@ def find_bl2_size(configFile):
109140
bl2_size = int(m.group(1), 0)
110141
break
111142
return bl2_size
143+
144+
def run_cmd(cmd, directory):
145+
146+
POPEN_INSTANCE = subprocess.Popen(
147+
cmd,
148+
cwd=directory,
149+
)
150+
151+
POPEN_INSTANCE.communicate()

‎tools/targets/musca_s1-root-rsa-3072.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
A default RSA key pair is given to the Musca-S1 target.
44

5-
Public keys were pre-compiled to `targets/TARGET_ARM_SSG/TARGET_MUSCA_S1/prebuilt/mcuboot.bin` and private key is in `musca_s1-root-rsa-3072.pem` for Secure image and `musca_s1-root-rsa-3072_1.pem` for Non-Secure image.
5+
Public keys were pre-compiled to `targets/TARGET_ARM_SSG/TARGET_MUSCA_S1/bl2.bin` and private key is in `musca_s1-root-rsa-3072.pem` for Secure image and `musca_s1-root-rsa-3072_1.pem` for Non-Secure image.
66

77
DO NOT use them in production code, they are exclusively for testing!
88

0 commit comments

Comments
 (0)