Merge branch 'bugfix/cmake_secure_boot_v4.0' into 'release/v4.0'

secure boot: CMake bug fixes (v4.0)

See merge request espressif/esp-idf!6630

components/bootloader/subproject/CMakeLists.txt

@@ -76,6 +76,7 @@ if(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
         COMMAND ${CMAKE_COMMAND} -E echo "DIGEST ${bootloader_digest_bin}"
         COMMAND ${ESPSECUREPY} digest_secure_bootloader --keyfile "${secure_bootloader_key}"
         -o "${bootloader_digest_bin}" "${CMAKE_BINARY_DIR}/bootloader.bin"
+        MAIN_DEPENDENCY gen_project_binary
         DEPENDS gen_secure_bootloader_key gen_project_binary
         VERBATIM)
 

components/bootloader_support/CMakeLists.txt

@@ -36,7 +36,8 @@ idf_component_register(SRCS "${srcs}"
                     REQUIRES "${requires}"
                     PRIV_REQUIRES "${priv_requires}")
 
-if(BOOTLOADER_BUILD AND CONFIG_SECURE_SIGNED_APPS)
+if(CONFIG_SECURE_SIGNED_APPS)
+    if(BOOTLOADER_BUILD)
         # Whether CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES or not, we need verification key to embed
         # in the library.
         if(CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES)
@@ -51,6 +52,7 @@ if(BOOTLOADER_BUILD AND CONFIG_SECURE_SIGNED_APPS)
                 COMMAND ${ESPSECUREPY}
                 extract_public_key --keyfile "${secure_boot_signing_key}"
                 "${secure_boot_verification_key}"
+                DEPENDS ${secure_boot_signing_key}
                 VERBATIM)
         else()
             # We expect to 'inherit' the verification key passed from main project.
@@ -58,8 +60,36 @@ if(BOOTLOADER_BUILD AND CONFIG_SECURE_SIGNED_APPS)
                 ${SECURE_BOOT_VERIFICATION_KEY}
                 ABSOLUTE BASE_DIR "${project_dir}")
         endif()
+    else()  # normal app build
+        idf_build_get_property(project_dir PROJECT_DIR)
 
-    target_add_binary_data(${COMPONENT_LIB} "${secure_boot_verification_key}" "BINARY")
+        if(CONFIG_SECURE_BOOT_VERIFICATION_KEY)
+            # verification-only build supplies verification key
+            set(secure_boot_verification_key ${CONFIG_SECURE_BOOT_VERIFICATION_KEY})
+            get_filename_component(secure_boot_verification_key
+                ${secure_boot_verification_key}
+                ABSOLUTE BASE_DIR "${project_dir}")
+        else()
+            # sign at build time, extracts key from signing key
+            set(secure_boot_verification_key "${CMAKE_BINARY_DIR}/signature_verification_key.bin")
+            get_filename_component(secure_boot_signing_key
+                ${CONFIG_SECURE_BOOT_SIGNING_KEY}
+                ABSOLUTE BASE_DIR "${project_dir}")
+
+            add_custom_command(OUTPUT "${secure_boot_verification_key}"
+                COMMAND ${ESPSECUREPY}
+                extract_public_key --keyfile "${secure_boot_signing_key}"
+                "${secure_boot_verification_key}"
+                WORKING_DIRECTORY ${project_dir}
+                DEPENDS ${secure_boot_signing_key}
+                VERBATIM)
+        endif()
+    endif()
+
+    # Embed the verification key in the binary (app & bootloader)
+    #
+    target_add_binary_data(${COMPONENT_LIB} "${secure_boot_verification_key}" "BINARY"
+        RENAME_TO signature_verification_key_bin)
     set_property(DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
         APPEND PROPERTY ADDITIONAL_MAKE_CLEAN_FILES
         "${secure_boot_verification_key}")

tools/cmake/scripts/data_file_embed_asm.cmake

@@ -38,9 +38,14 @@ string(REGEX REPLACE "[^\n]+$" ".byte \\0\n" data "${data}")
 string(REGEX REPLACE "[0-9a-f][0-9a-f]" "0x\\0, " data "${data}")                      # hex formatted C bytes
 string(REGEX REPLACE ", \n" "\n" data "${data}")                                       # trim the last comma
 
-## Come up with C-friendly symbol name based on source file
+## Come up with C-friendly variable name based on source file
+# unless VARIABLE_BASENAME is set
+if(NOT VARIABLE_BASENAME)
     get_filename_component(source_filename "${DATA_FILE}" NAME)
     string(MAKE_C_IDENTIFIER "${source_filename}" varname)
+else()
+    string(MAKE_C_IDENTIFIER "${VARIABLE_BASENAME}" varname)
+endif()
 
 function(append str)
     file(APPEND "${SOURCE_FILE}" "${str}")

tools/cmake/utilities.cmake

@@ -77,6 +77,7 @@ endfunction()
 # by converting it to a generated source file which is then compiled
 # to a binary object as part of the build
 function(target_add_binary_data target embed_file embed_type)
+    cmake_parse_arguments(_ "" "RENAME_TO" "" ${ARGN})
     idf_build_get_property(build_dir BUILD_DIR)
     idf_build_get_property(idf_path IDF_PATH)
 
@@ -85,10 +86,16 @@ function(target_add_binary_data target embed_file embed_type)
     get_filename_component(name "${embed_file}" NAME)
     set(embed_srcfile "${build_dir}/${name}.S")
 
+    set(rename_to_arg)
+    if(__RENAME_TO)  # use a predefined variable name
+        set(rename_to_arg -D "VARIABLE_BASENAME=${__RENAME_TO}")
+    endif()
+
     add_custom_command(OUTPUT "${embed_srcfile}"
         COMMAND "${CMAKE_COMMAND}"
         -D "DATA_FILE=${embed_file}"
         -D "SOURCE_FILE=${embed_srcfile}"
+        ${rename_to_arg}
         -D "FILE_TYPE=${embed_type}"
         -P "${idf_path}/tools/cmake/scripts/data_file_embed_asm.cmake"
         MAIN_DEPENDENCY "${embed_file}"