Skip to content

Commit 278ff00

Browse files
0xc01700xc0170
authored
Merge pull request #14361 from LDong-Arm/musca_post_binary_hooks
CMake: support signing TF-M targets with post binary hooks
2 parents e37f7a6 + 3e19778 commit 278ff00

File tree

10 files changed

+421
-0
lines changed

10 files changed

+421
-0
lines changed

‎platform/FEATURE_EXPERIMENTAL_API/FEATURE_PSA/TARGET_TFM/TARGET_TFM_LATEST/scripts/generate_mbed_image.py

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
#!/usr/bin/python
2+
# Copyright (c) 2017-2021 Arm Limited
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
# Licensed under the Apache License, Version 2.0 (the "License");
7+
# you may not use this file except in compliance with the License.
8+
# You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing, software
13+
# distributed under the License is distributed on an "AS IS" BASIS,
14+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
# See the License for the specific language governing permissions and
16+
# limitations under the License.
17+
18+
import os
19+
from os.path import abspath, basename, dirname, splitext, isdir
20+
from os.path import join as path_join
21+
import re
22+
import subprocess
23+
import argparse
24+
25+
SCRIPT_DIR = dirname(abspath(__file__))
26+
MBED_OS_ROOT = abspath(path_join(SCRIPT_DIR, os.pardir, os.pardir, os.pardir, os.pardir, os.pardir, os.pardir))
27+
28+
def sign_and_merge_tfm_bin(target_name, target_path, non_secure_bin, secure_bin):
29+
30+
assert os.path.isdir(target_path)
31+
assert os.path.isfile(secure_bin)
32+
assert os.path.isfile(non_secure_bin)
33+
34+
build_dir = dirname(non_secure_bin)
35+
tempdir = path_join(build_dir, 'temp')
36+
if not isdir(tempdir):
37+
os.makedirs(tempdir)
38+
flash_layout = path_join(target_path, 'partition', 'flash_layout.h')
39+
mcuboot_bin = path_join(target_path, 'bl2.bin')
40+
image_macros_s = path_join(target_path, 'partition', 'signing_layout_s.c')
41+
image_macros_ns = path_join(target_path, 'partition', 'signing_layout_ns.c')
42+
s_bin_name, s_bin_ext = splitext(basename(secure_bin))
43+
s_signed_bin = abspath(path_join(tempdir, s_bin_name + '_signed' + s_bin_ext))
44+
ns_bin_name, ns_bin_ext = splitext(basename(non_secure_bin))
45+
ns_signed_bin = abspath(path_join(tempdir, 'tfm_' + ns_bin_name + '_signed' + ns_bin_ext))
46+
concatenated_bin = abspath(path_join(tempdir, s_bin_name + '_' + ns_bin_name + '_concat' + ns_bin_ext))
47+
48+
assert os.path.isfile(image_macros_s)
49+
assert os.path.isfile(image_macros_ns)
50+
51+
#1. Run wrapper to sign the TF-M secure binary
52+
cmd = [
53+
"python3",
54+
path_join(MBED_OS_ROOT, "tools", "psa","tfm", "bin_utils","wrapper.py"),
55+
"-v",
56+
'1.2.0',
57+
"-k",
58+
path_join(target_path, (target_name + '-root-rsa-3072.pem')),
59+
"--layout",
60+
image_macros_s,
61+
"--public-key-format",
62+
'full',
63+
"--align",
64+
'1',
65+
"--pad",
66+
"--pad-header",
67+
"-H",
68+
'0x400',
69+
"--overwrite-only",
70+
"-s",
71+
'auto',
72+
"-d",
73+
'(0,0.0.0+0)',
74+
abspath(secure_bin),
75+
s_signed_bin,
76+
]
77+
78+
retcode = run_cmd(cmd, MBED_OS_ROOT)
79+
if retcode:
80+
raise Exception("Unable to sign " + target_name +
81+
" secure binary, Error code: " + str(retcode))
82+
83+
#2. Run wrapper to sign the non-secure mbed binary
84+
cmd = [
85+
"python3",
86+
path_join(MBED_OS_ROOT, "tools", "psa","tfm", "bin_utils","wrapper.py"),
87+
"-v",
88+
'1.2.0',
89+
"-k",
90+
path_join(target_path, (target_name + '-root-rsa-3072_1.pem')),
91+
"--layout",
92+
image_macros_ns,
93+
"--public-key-format",
94+
'full',
95+
"--align",
96+
'1',
97+
"--pad",
98+
"--pad-header",
99+
"-H",
100+
'0x400',
101+
"--overwrite-only",
102+
"-s",
103+
'auto',
104+
"-d",
105+
'(1,0.0.0+0)',
106+
abspath(non_secure_bin),
107+
ns_signed_bin,
108+
]
109+
110+
retcode = run_cmd(cmd, MBED_OS_ROOT)
111+
if retcode:
112+
raise Exception("Unable to sign " + target_name +
113+
" non-secure binary, Error code: " + str(retcode))
114+
115+
#3. Concatenate signed secure TFM and non-secure mbed binaries
116+
cmd = [
117+
"python3",
118+
path_join(MBED_OS_ROOT, "tools", "psa","tfm", "bin_utils","assemble.py"),
119+
"--layout",
120+
image_macros_s,
121+
"-s",
122+
s_signed_bin,
123+
"-n",
124+
ns_signed_bin,
125+
"-o",
126+
concatenated_bin,
127+
]
128+
129+
retcode = run_cmd(cmd, MBED_OS_ROOT)
130+
if retcode:
131+
raise Exception("Unable to concatenate " + target_name +
132+
" binaries, Error code: " + str(retcode))
133+
134+
#4. Concatenate mcuboot and signed binary and overwrite mbed built binary file
135+
mcuboot_image_size = find_bl2_size(flash_layout)
136+
with open(mcuboot_bin, "rb") as mcuboot_fh, open(concatenated_bin, "rb") as concat_fh:
137+
with open(non_secure_bin, "w+b") as out_fh:
138+
out_fh.write(mcuboot_fh.read())
139+
out_fh.seek(mcuboot_image_size)
140+
out_fh.write(concat_fh.read())
141+
142+
143+
def find_bl2_size(configFile):
144+
bl2_size_re = re.compile(r"^#define\s+FLASH_AREA_BL2_SIZE\s+\({0,1}(0x[0-9a-fA-F]+)\){0,1}")
145+
bl2_size = None
146+
with open(configFile, 'r') as flash_layout_file:
147+
for line in flash_layout_file:
148+
m = bl2_size_re.match(line)
149+
if m is not None:
150+
bl2_size = int(m.group(1), 0)
151+
break
152+
return bl2_size
153+
154+
def run_cmd(cmd, directory):
155+
156+
popen_instance = subprocess.Popen(
157+
cmd,
158+
stdout=subprocess.PIPE,
159+
stderr=subprocess.STDOUT,
160+
cwd=directory,
161+
)
162+
163+
popen_instance.communicate()
164+
return popen_instance.returncode
165+
166+
def parse_args():
167+
parser = argparse.ArgumentParser()
168+
169+
parser.add_argument(
170+
"--tfm-target",
171+
help="Name of the TF-M target",
172+
required=True
173+
)
174+
175+
parser.add_argument(
176+
"--target-path",
177+
help="Path containing the target's bootloader, layouts and signing keys",
178+
required=True
179+
)
180+
181+
parser.add_argument(
182+
"--non-secure-bin",
183+
help="Path to the non-secure binary",
184+
required=True
185+
)
186+
187+
parser.add_argument(
188+
"--secure-bin",
189+
help="Path to the secure binary",
190+
required=True
191+
)
192+
193+
return parser.parse_args()
194+
195+
if __name__ == "__main__":
196+
args = parse_args()
197+
sign_and_merge_tfm_bin(args.tfm_target, args.target_path, args.non_secure_bin, args.secure_bin)

‎platform/FEATURE_EXPERIMENTAL_API/FEATURE_PSA/TARGET_TFM/TARGET_TFM_LATEST/scripts/mbed_set_post_build_tfm.cmake

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Copyright (c) 2021 ARM Limited. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
include(${MBED_PATH}/tools/cmake/mbed_set_post_build.cmake)
5+
6+
#
7+
# Sign TF-M secure and non-secure images and combine them with the bootloader
8+
#
9+
function(mbed_post_build_tfm_sign_image
10+
mbed_target
11+
tfm_target
12+
target_path
13+
secure_bin
14+
)
15+
find_package(Python3)
16+
17+
set(mbed_target_name ${mbed_target})
18+
set(post_build_command
19+
COMMAND ${Python3_EXECUTABLE}
20+
${MBED_PATH}/platform/FEATURE_EXPERIMENTAL_API/FEATURE_PSA/TARGET_TFM/TARGET_TFM_LATEST/scripts/generate_mbed_image.py
21+
--tfm-target ${tfm_target}
22+
--target-path ${target_path}
23+
--secure-bin ${secure_bin}
24+
--non-secure-bin ${CMAKE_BINARY_DIR}/$<TARGET_PROPERTY:mbed-post-build-bin-${mbed_target_name},application>.bin
25+
)
26+
27+
mbed_set_post_build_operation()
28+
endfunction()

‎targets/TARGET_ARM_SSG/TARGET_MUSCA_B1/CMakeLists.txt

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# Copyright (c) 2020-2021 ARM Limited. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33

4+
include(${MBED_PATH}/platform/FEATURE_EXPERIMENTAL_API/FEATURE_PSA/TARGET_TFM/TARGET_TFM_LATEST/scripts/mbed_set_post_build_tfm.cmake)
5+
46
add_library(mbed-arm-musca-b1 INTERFACE)
57

68
if(${MBED_TOOLCHAIN} STREQUAL "ARM")
@@ -52,3 +54,10 @@ target_link_libraries(mbed-arm-musca-b1
5254
${CMAKE_CURRENT_SOURCE_DIR}/s_veneers.o
5355
mbed-arm-ssg
5456
)
57+
58+
mbed_post_build_tfm_sign_image(
59+
ARM_MUSCA_B1
60+
musca_b1
61+
${CMAKE_CURRENT_SOURCE_DIR}
62+
${CMAKE_CURRENT_SOURCE_DIR}/tfm_s.bin
63+
)

‎targets/TARGET_ARM_SSG/TARGET_MUSCA_B1/musca_b1-root-rsa-3072.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Musca-B1 RSA keypair
2+
3+
A default RSA key pair is given to the Musca-B1 target.
4+
5+
Public keys were pre-compiled to `targets/TARGET_ARM_SSG/TARGET_MUSCA_B1/bl2.bin` and private key is in `musca_b1-root-rsa-3072.pem` for Secure image and `musca_b1-root-rsa-3072_1.pem` for Non-Secure image.
6+
7+
DO NOT use them in production code, they are exclusively for testing!
8+
9+
Private key must be stored in a safe place outside of the repository.
10+
11+
`tools/psa/tfm/bin_utils/imgtool.py` can be used to generate new key pairs.

‎targets/TARGET_ARM_SSG/TARGET_MUSCA_B1/musca_b1-root-rsa-3072.pem

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIG4gIBAAKCAYEAnLrCWr/MxU8gDE9vbFFPXAqrgLhrEMSbK8RSMglLOyeUah3V
3+
TKhcoMB2lXsmBLETfngn1gy06LAtklKK+2n/QhCqVgyDyGVuug1fjvcrKZL8Qi0t
4+
+YD1hSGH6qxAqMvQqDvi0uzwFEgOzyuKS6TNoQVbF2Yd3m5E/kajDdBpv4ytqRZo
5+
Uet5kSDmgQMHiUBVS+vPZ/gxxxxUTlILYOiiUAfRz84SJs2Ogo1OZKn3xyGZJQfd
6+
xdVf9GP6zCvaBlxZZ7AGNemqkkU15aAD/xwCtcdOlEturXOdzm8Js7GPYGyi+s13
7+
D8wn5jZYs1L3j75JmLfpYP2XV83q0wvfokL3RNOH3uAQA5Ta/LzdvpOzSitY3JYS
8+
8m8jujs3/vwYH3V9VAEOvj0YE7MouTQs1fvFM72HvTvkHdcCPRxyZXJDQzao+uZz
9+
LaRh6AKcOlZNHNF2nIyqXxvrHEr1ubhvQUsnh972lB/d5vGpwgLCT6P8pANa2W94
10+
/YTw5f09pU0brVtLAgMBAAECggGAG786mltbctEL0PIdPVV10cs3yq2bktfjys9S
11+
Z/ZaQcpDjbfjY9NotrLsK5GmTO1WkKzQDKaqPom2P7HqVhFRdg5CQcKscAV5IWot
12+
sT9T/mO90i9ydLoefWfOyr6dIeUXdzlG8mWtKUIKkSXZsYOnPesXUeCryA3InCXA
13+
RzlPB3Dt68ICTQJ9vrJO7KcvJd7kWvEQAo2frmr3B/iheBInbji8LeiDMShyIu3G
14+
Y67tpWzu0m3+lsAsYTV0GMJosniVulaZ3hYQQazHUk+zDzMSC7zryICrpjEbgzWU
15+
HZI9EGi1B890nwUtdhlCpkr8zoWDb0BjawpftiGz7fRm7q2TQkYAWGzNKm3DZlIS
16+
4LsRACvHnPZ17wUSze9tqP14Pb593WR3nOTiVjrJWm+4Z5hgV3QfoEqW5swOAYl4
17+
6QmKZsCXAfGkozJiHnYcyaULkGBVegn1LQ5rcb8JUMribQddrHZxCVHrbgwh2zm/
18+
v9CYfTtpWCnKHq+wF3mwjl6w7m4JAoHBALolVbgs919Dx0xjcPnW5MSxW3ctflI9
19+
2ZE1BOH/Rtg5gfBwR/aToUM3a/ZgIJHQYhVty2TzUVtthtmLNTRKu2FSqWN8//GJ
20+
wmj4bcNBshMgniHEfkutlBiP9exhdvCZX4bYpdTkJAyvOmUGjEM8QBFsod60u0z7
21+
Bd0EIXs7PIURP0fNAUXCgSHMPjdICLljhwHinr31VEIU2/xehw8DBIJwkR/rCsPq
22+
xBmlIwPWVjzCRTnYUxQuxCAYf+qvgNylKQKBwQDXi3UGI7t30rYNMdIjMn1GPkhW
23+
o62BOJNCusoXiGnbVOkj8qBayf7kPu10ONBzHcYL7+SQYeVVXQY+DH033ji8oa0J
24+
p1xMGIlx4JZEduQYlk0ke4hUNrcBQczTRA47DmMm2kIdWlaTHtB7aCJNx72IrwWn
25+
lVTY9TWm6+yOPcpV5JfyCMM6GqoRycikgNS5IQug5hl2pFVLw+UTfxo6msYaAOnp
26+
ICUjoeDUKS0Z8+FtzGhAkWTk8GXIiPbfu7RoN1MCgcAcah6Poq2QKTR/AJ76REdf
27+
jwM7SgKCY1aWx9Ua+nDCCOVA4qLZjOeM7yTX0wyltX2Db+MgYdQFdM6k3o8ckFvS
28+
G2AoA6i+Ih0/EM0QhTK9oLkCxo/Q1YpJxY/wqWASkhb26pNF0B2Aoi7zxPAcQ1I0
29+
VrTO3h/JPHhEqKDDwuMWHO/f8fdDwtEba6YDokdSpVKygvlgXdaiz7RU7ckIDZne
30+
n3hHuwVFqsyMbZzOtSUs2SrgDZmA9zKRA6xjEq9E/yECgcAnm7XecfSCGVNg61XN
31+
J/sDTHCokx1QEKBm88ItPuEM7/aDp5M1+8Z+FN43rDUJ4l/BU8zxhzvISvbZshvU
32+
h15vs1oD2yBHz356UaXrYNmbdwsn+BdeOku4zGmiLPBcg9FOk27wy+f60v/GnaUo
33+
G9tFYbwtRnC4CZ9ZVCM9JDepPv9494lAhSPZbvYS3KW6e0sSvxXQynPuH0paIdIl
34+
EMn0f1R8hW6ttJKHCiYCjeFP9u71ZoJe25oolpqfFHQbbocCgcAuBR4w3Qmnbscm
35+
3b7fyy8n3AXa1gIfYjjPpR35qyp1K9thiLyj66YZIl0ACC/dt08lmI9/lguRoNIQ
36+
AfjzZ8DByZa0caiSiFIMlgNZXdh7N3BUNNbIQk98Wd91gBlWDAiFEhrJKFPpRkmv
37+
FySATPYcq0lcrjJb3IW2GDK4uo/jb4Nb7Cfog95W6T76XcSKHS5O8k1aI4kFPRsr
38+
1wGZw64OkA8VXVaCaEBQ4brZ1YKB3mx4/tDqwn0I6bqkGRX3RJg=
39+
-----END RSA PRIVATE KEY-----

‎targets/TARGET_ARM_SSG/TARGET_MUSCA_B1/musca_b1-root-rsa-3072_1.pem

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIG5AIBAAKCAYEAv7ewn+jI0f4WHVOHl3kcFceZFmzKuC3Kwg1i+euP6ToYQ0fX
3+
u9VivOMzY6ejqFzzI3j9LQchH7lUcCipCNpQfp6OzGhOf0gN6ifoxu+tX51GSrxp
4+
mjBfO8FSkvi8ddQ8J3BAAKYuKH9Z5WBDEdwxCX3PL0E/tlIao0kW8rWznDz7Xiwf
5+
Ioa9rr42Ur3E8FhpNqeAPoGzVJjkXZXtIfC6riH7xBmHVdErTwDYQVjL26maU+ls
6+
Z8t8XfaRBnVS8sB+sWtdMEBAL9gelTwFl3/wBPBOLNU5DpQ9fAMIHQkI8o1EDc+z
7+
lj1aduj27pNk6FfR4vULGGlv6eE9+IlJKOavuKjGQlUtwduMXbJtf/4m6nXZ/R/c
8+
IjukG6et63HfvbQ30eu+CBAceIQcmnXEreXvcxesaXi81jeMDBQhBke9+AqsGQmd
9+
DR1y4T4adOqG2VxKzczGlKf+2guHEbtr8DrjT4JPseSkzbxwPJ2cSfnPKG242m99
10+
OFdVQypzjbYY/XCnAgMBAAECggGAWmcsjuMumzMEy5RhWlB+KVkC+7uWRg41z5aP
11+
ZwkoxdIiscs1U/nVwvsh9uqMdi5Kap45SFvVx0dVpUPPHYEQtvxems3Owh9AjHuA
12+
PRq09uLLTB+XbmFD7wIExZAsEiXfrbs1Ovkhx+/xfIONbOUXbIHaSk6q0/bYX8nt
13+
28pJpTFuWORWVCoUVMuWAyNANBOEnYSTqSXw4cHs4aJ6fOgup0EYHsro8dMd6HWe
14+
BAZyrqTFxK7L8w/Vl9tWXKTDVfvlj8DHRwWBQhvS1P4XWaEcVopv7Sy4XK7UUeXm
15+
tllsi5byGlNmr9ADK7Gd+eft/y/APyWo6SFPBLiyVLCSJ+6X4/7FwmLGYYt1WysH
16+
/86W55qTRgtHQmb+oPBn8NYDxnYhEYFzGbpoAPD83U4CyGbnoqp5tsmssw8SfvWH
17+
BTUdJiPjVLpHRuH1pwAyHMi+MvIVB6A8f5yWbtVwAho3Q+pIwd62aZqCpelUg9Vp
18+
F1ssr723gQxPJqS/mwm1SfIe0GfNAoHBAMVgHdTANplIZIadWDulggjYXH5qkU+b
19+
nB8bxv35s1Rl8iTQuD/UtxflIaLwciOl1mAfUUqG+6JH8c1OpVIaGmWKDeVThliH
20+
tN8/OGdCPkPOFKyY8MHl83tNpsNk7P3F/WJOxCqxWziK3YoDwSr+l96XokAg/SDu
21+
LoTax3DZPMAd2HSZuBPMGBlIbbfdkAaWzB0QJBSWv6ednt0kue+F1O/sdQ15SXoz
22+
jGzCrEf60HIOWdAnnCCq0iT+ZeZTX1gMhQKBwQD4qVxxlSJUv+w3pGC17IN3uC3K
23+
yq988GVqOND21RdwZ/YeYZrmORjnpXyrpJsbj9IGwYd/hpwkLe8qwOj67mZCXmND
24+
Eca4xE7s4gtAiHXOZKXRgISEs+9giWd/8U7pczVsUwiTS77j6C7nd1f5ZgKajxJd
25+
Tdy4bIWErCKijmpT/IEQVVYb+Ki8khTKxzbaDxWtrHv/iM+7+bgUfsKefDcO6MCb
26+
jmhj/aOSzcmcJNfx1bdqCyxuK6iw583awBtctjsCgcEArcdwvG74I4GPsM48b1fL
27+
48nLtipSAot5rBIi5F7Du91+k1eJwfmhs1I0iWe2txg+ZadtRXcPetRpW2CRQnZl
28+
I12n2m/t62igoabiHFhAxiZeIZEO+UljVP8LgyILX2zBKZs8MHKzZFcvs2KW4yoB
29+
wSQ04M2q0SGkp6iQzRUX3fbpK9BkOFoMJcaVg7t6IbMHx9b8TXxlBklLJF4/r1pg
30+
H1ZLwS82uHdGfkPwt/dnK+Tiwtj9J+3+1D+ArIhffACZAoHBANghRLOIv41QP73h
31+
Rxn5GA//6vVflIaQ4GUiOya/8p6GDhs8FQnUSPxXD3SVHygmqpOqtN44HxEnR8Eu
32+
aZJpkkJPjhFmqwY/wqYMl2Eg+txJCQN+pDA/wWl0JJzFHiS1OZMM3OBCLwoi7lnL
33+
lpC0hMDYaErm+VjnImo9v+DwziRvzbJnqe+oAuncQuw5mUiRYfNRf3mM7ZpiJAjU
34+
YM6mAqkXzwmmDsASXpGkAn+QWo3dh41JZvXfRsF0ya0/2siLrwKBwBBX7YegsNPJ
35+
skp5AAwYDvujDISc3aLxqEc1UHyM5SmKVt1U0/Dsyod0ZBMe27N8t9INFqy+G7hI
36+
Y1sthsk6DyM1hSiZsLBTossJgyu3Tf3e300NTmc6CpFSRqL1L4lcSzKAGNTWvS9H
37+
5q+MpRkZLzug83pmFw0qTWTw8p79cpELM4sklLg8L5cnLDLZyU+Gr5ZshkgpkXJI
38+
egyV0maL40d5fDsX2ZqCZQPrQ7+FhDHKg/jf3Z3lXHwTAKBNrQGN6g==
39+
-----END RSA PRIVATE KEY-----

‎targets/TARGET_ARM_SSG/TARGET_MUSCA_S1/CMakeLists.txt

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# Copyright (c) 2020-2021 ARM Limited. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33

4+
include(${MBED_PATH}/platform/FEATURE_EXPERIMENTAL_API/FEATURE_PSA/TARGET_TFM/TARGET_TFM_LATEST/scripts/mbed_set_post_build_tfm.cmake)
5+
46
add_library(mbed-arm-musca-s1 INTERFACE)
57

68
if(${MBED_TOOLCHAIN} STREQUAL "ARM")
@@ -58,3 +60,10 @@ target_link_libraries(mbed-arm-musca-s1
5860
${CMAKE_CURRENT_SOURCE_DIR}/s_veneers.o
5961
mbed-arm-ssg
6062
)
63+
64+
mbed_post_build_tfm_sign_image(
65+
ARM_MUSCA_S1
66+
musca_s1
67+
${CMAKE_CURRENT_SOURCE_DIR}
68+
${CMAKE_CURRENT_SOURCE_DIR}/tfm_s.bin
69+
)

‎targets/TARGET_ARM_SSG/TARGET_MUSCA_S1/musca_s1-root-rsa-3072.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Musca-S1 RSA keypair
2+
3+
A default RSA key pair is given to the Musca-S1 target.
4+
5+
Public keys were pre-compiled to `targets/TARGET_ARM_SSG/TARGET_MUSCA_S1/bl2.bin` and private key is in `musca_s1-root-rsa-3072.pem` for Secure image and `musca_s1-root-rsa-3072_1.pem` for Non-Secure image.
6+
7+
DO NOT use them in production code, they are exclusively for testing!
8+
9+
Private key must be stored in a safe place outside of the repository.
10+
11+
`tools/psa/tfm/bin_utils/imgtool.py` can be used to generate new key pairs.

0 commit comments

Comments
 (0)