diff --git a/cmake/sysbuild/b0_mcuboot_signing.cmake b/cmake/sysbuild/b0_mcuboot_signing.cmake index a404d3a2a335..7ff84dfe0f71 100644 --- a/cmake/sysbuild/b0_mcuboot_signing.cmake +++ b/cmake/sysbuild/b0_mcuboot_signing.cmake @@ -11,26 +11,12 @@ # function to avoid polluting the top-level scope. function(ncs_secure_boot_mcuboot_sign application bin_files signed_targets prefix) + find_program(IMGTOOL imgtool.py HINTS ${ZEPHYR_MCUBOOT_MODULE_DIR}/scripts/ NAMES imgtool NAMES_PER_DIR) set(keyfile "${SB_CONFIG_BOOT_SIGNATURE_KEY_FILE}") string(CONFIGURE "${keyfile}" keyfile) - # Find imgtool. Even though west is installed, imgtool might not be. - # The user may also have a custom manifest which doesn't include - # MCUboot. - # - # Therefore, go with an explicitly installed imgtool first, falling - # back on mcuboot/scripts/imgtool.py. - if(IMGTOOL) - set(imgtool_path "${IMGTOOL}") - elseif(DEFINED ZEPHYR_MCUBOOT_MODULE_DIR) - set(IMGTOOL_PY "${ZEPHYR_MCUBOOT_MODULE_DIR}/scripts/imgtool.py") - if(EXISTS "${IMGTOOL_PY}") - set(imgtool_path "${IMGTOOL_PY}") - endif() - endif() - # No imgtool, no signed binaries. - if(NOT DEFINED imgtool_path) + if(NOT DEFINED IMGTOOL) message(FATAL_ERROR "Can't sign images for MCUboot: can't find imgtool. To fix, install imgtool with pip3, or add the mcuboot repository to the west manifest and ensure it has a scripts/imgtool.py file.") return() endif() @@ -40,7 +26,7 @@ function(ncs_secure_boot_mcuboot_sign application bin_files signed_targets prefi sysbuild_get(CONFIG_BUILD_OUTPUT_HEX IMAGE ${application} VAR CONFIG_BUILD_OUTPUT_HEX KCONFIG) string(TOUPPER "${application}" application_uppercase) - set(imgtool_sign ${PYTHON_EXECUTABLE} ${imgtool_path} sign --version ${SB_CONFIG_SECURE_BOOT_MCUBOOT_VERSION} --align 4 --slot-size $ --pad-header --header-size ${SB_CONFIG_PM_MCUBOOT_PAD}) + set(imgtool_sign ${PYTHON_EXECUTABLE} ${IMGTOOL} sign --version ${SB_CONFIG_SECURE_BOOT_MCUBOOT_VERSION} --align 4 --slot-size $ --pad-header --header-size ${SB_CONFIG_PM_MCUBOOT_PAD}) if(SB_CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION) set(imgtool_extra --security-counter ${SB_CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE}) diff --git a/cmake/sysbuild/image_signing.cmake b/cmake/sysbuild/image_signing.cmake index 73f65e2f61b5..485a19b9167d 100644 --- a/cmake/sysbuild/image_signing.cmake +++ b/cmake/sysbuild/image_signing.cmake @@ -49,27 +49,8 @@ function(zephyr_mcuboot_tasks) endif() endforeach() - # Find imgtool. Even though west is installed, imgtool might not be. - # The user may also have a custom manifest which doesn't include - # MCUboot. - # - # Therefore, go with an explicitly installed imgtool first, falling - # back on mcuboot/scripts/imgtool.py. We exclude the system imgtool when - # compressed image support is enabled due to needing a version of imgtool - # that has features not in the most recent public release. - if(IMGTOOL AND - (NOT CONFIG_MCUBOOT_COMPRESSED_IMAGE_SUPPORT_ENABLED AND - NOT (CONFIG_SOC_SERIES_NRF54LX AND CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_ED25519))) - set(imgtool_path "${IMGTOOL}") - elseif(DEFINED ZEPHYR_MCUBOOT_MODULE_DIR) - set(IMGTOOL_PY "${ZEPHYR_MCUBOOT_MODULE_DIR}/scripts/imgtool.py") - if(EXISTS "${IMGTOOL_PY}") - set(imgtool_path "${IMGTOOL_PY}") - endif() - endif() - # No imgtool, no signed binaries. - if(NOT DEFINED imgtool_path) + if(NOT DEFINED IMGTOOL) message(FATAL_ERROR "Can't sign images for MCUboot: can't find imgtool. To fix, install imgtool with pip3, or add the mcuboot repository to the west manifest and ensure it has a scripts/imgtool.py file.") return() endif() @@ -106,7 +87,7 @@ function(zephyr_mcuboot_tasks) # TODO: NCSDK-28461 sysbuild PM fields cannot be updated without a pristine build, will become # invalid if a static PM file is updated without pristine build set(imgtool_sign_sysbuild --slot-size @PM_MCUBOOT_PRIMARY_SIZE@ --pad-header --header-size @PM_MCUBOOT_PAD_SIZE@ ${imgtool_rom_command} CACHE STRING "imgtool sign sysbuild replacement") - set(imgtool_sign ${PYTHON_EXECUTABLE} ${imgtool_path} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align ${write_block_size} ${imgtool_sign_sysbuild}) + set(imgtool_sign ${PYTHON_EXECUTABLE} ${IMGTOOL} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align ${write_block_size} ${imgtool_sign_sysbuild}) # Arguments to imgtool. if(NOT CONFIG_MCUBOOT_EXTRA_IMGTOOL_ARGS STREQUAL "") diff --git a/cmake/sysbuild/image_signing_firmware_loader.cmake b/cmake/sysbuild/image_signing_firmware_loader.cmake index 8b42bfa0d64f..a2a05b243ee0 100644 --- a/cmake/sysbuild/image_signing_firmware_loader.cmake +++ b/cmake/sysbuild/image_signing_firmware_loader.cmake @@ -47,23 +47,8 @@ function(zephyr_mcuboot_tasks) endif() endforeach() - # Find imgtool. Even though west is installed, imgtool might not be. - # The user may also have a custom manifest which doesn't include - # MCUboot. - # - # Therefore, go with an explicitly installed imgtool first, falling - # back on mcuboot/scripts/imgtool.py. - if(IMGTOOL) - set(imgtool_path "${IMGTOOL}") - elseif(DEFINED ZEPHYR_MCUBOOT_MODULE_DIR) - set(IMGTOOL_PY "${ZEPHYR_MCUBOOT_MODULE_DIR}/scripts/imgtool.py") - if(EXISTS "${IMGTOOL_PY}") - set(imgtool_path "${IMGTOOL_PY}") - endif() - endif() - # No imgtool, no signed binaries. - if(NOT DEFINED imgtool_path) + if(NOT DEFINED IMGTOOL) message(FATAL_ERROR "Can't sign images for MCUboot: can't find imgtool. To fix, install imgtool with pip3, or add the mcuboot repository to the west manifest and ensure it has a scripts/imgtool.py file.") return() endif() @@ -85,7 +70,7 @@ function(zephyr_mcuboot_tasks) # TODO: NCSDK-28461 sysbuild PM fields cannot be updated without a pristine build, will become # invalid if a static PM file is updated without pristine build set(imgtool_sign_sysbuild --slot-size @PM_MCUBOOT_SECONDARY_SIZE@ --pad-header --header-size @PM_MCUBOOT_PAD_SIZE@ ${imgtool_rom_command} CACHE STRING "imgtool sign sysbuild replacement") - set(imgtool_sign ${PYTHON_EXECUTABLE} ${imgtool_path} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align ${write_block_size} ${imgtool_sign_sysbuild}) + set(imgtool_sign ${PYTHON_EXECUTABLE} ${IMGTOOL} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align ${write_block_size} ${imgtool_sign_sysbuild}) # Arguments to imgtool. if(NOT CONFIG_MCUBOOT_EXTRA_IMGTOOL_ARGS STREQUAL "") diff --git a/cmake/sysbuild/image_signing_nrf700x.cmake b/cmake/sysbuild/image_signing_nrf700x.cmake index a0698383c959..e704877b0fba 100644 --- a/cmake/sysbuild/image_signing_nrf700x.cmake +++ b/cmake/sysbuild/image_signing_nrf700x.cmake @@ -19,23 +19,8 @@ function(nrf7x_signing_tasks input output_hex output_bin dependencies) endif() endif() - # Find imgtool. Even though west is installed, imgtool might not be. - # The user may also have a custom manifest which doesn't include - # MCUboot. - # - # Therefore, go with an explicitly installed imgtool first, falling - # back on mcuboot/scripts/imgtool.py. - if(IMGTOOL) - set(imgtool_path "${IMGTOOL}") - elseif(DEFINED ZEPHYR_MCUBOOT_MODULE_DIR) - set(IMGTOOL_PY "${ZEPHYR_MCUBOOT_MODULE_DIR}/scripts/imgtool.py") - if(EXISTS "${IMGTOOL_PY}") - set(imgtool_path "${IMGTOOL_PY}") - endif() - endif() - # No imgtool, no signed binaries. - if(NOT DEFINED imgtool_path) + if(NOT DEFINED IMGTOOL) message(FATAL_ERROR "Can't sign images for MCUboot: can't find imgtool. To fix, install imgtool with pip3, or add the mcuboot repository to the west manifest and ensure it has a scripts/imgtool.py file.") return() endif() @@ -52,7 +37,7 @@ function(nrf7x_signing_tasks input output_hex output_bin dependencies) endif() sysbuild_get(CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION IMAGE ${DEFAULT_IMAGE} VAR CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION KCONFIG) - set(imgtool_sign ${PYTHON_EXECUTABLE} ${imgtool_path} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align 4 --slot-size $ --pad-header --header-size ${SB_CONFIG_PM_MCUBOOT_PAD}) + set(imgtool_sign ${PYTHON_EXECUTABLE} ${IMGTOOL} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align 4 --slot-size $ --pad-header --header-size ${SB_CONFIG_PM_MCUBOOT_PAD}) sysbuild_get(CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION IMAGE ${DEFAULT_IMAGE} VAR CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION KCONFIG) if(CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION) diff --git a/cmake/sysbuild/image_signing_split.cmake b/cmake/sysbuild/image_signing_split.cmake index 784ff9b949b0..ebfa3ff507a9 100644 --- a/cmake/sysbuild/image_signing_split.cmake +++ b/cmake/sysbuild/image_signing_split.cmake @@ -74,23 +74,8 @@ function(zephyr_mcuboot_tasks) endif() endforeach() - # Find imgtool. Even though west is installed, imgtool might not be. - # The user may also have a custom manifest which doesn't include - # MCUboot. - # - # Therefore, go with an explicitly installed imgtool first, falling - # back on mcuboot/scripts/imgtool.py. - if(IMGTOOL) - set(imgtool_path "${IMGTOOL}") - elseif(DEFINED ZEPHYR_MCUBOOT_MODULE_DIR) - set(IMGTOOL_PY "${ZEPHYR_MCUBOOT_MODULE_DIR}/scripts/imgtool.py") - if(EXISTS "${IMGTOOL_PY}") - set(imgtool_path "${IMGTOOL_PY}") - endif() - endif() - # No imgtool, no signed binaries. - if(NOT DEFINED imgtool_path) + if(NOT DEFINED IMGTOOL) message(FATAL_ERROR "Can't sign images for MCUboot: can't find imgtool. To fix, install imgtool with pip3, or add the mcuboot repository to the west manifest and ensure it has a scripts/imgtool.py file.") return() endif() @@ -127,8 +112,8 @@ function(zephyr_mcuboot_tasks) # invalid if a static PM file is updated without pristine build set(imgtool_internal_sign_sysbuild --slot-size @PM_MCUBOOT_PRIMARY_SIZE@ --pad-header --header-size @PM_MCUBOOT_PAD_SIZE@ ${imgtool_internal_rom_command} CACHE STRING "imgtool sign (internal flash) sysbuild replacement") set(imgtool_external_sign_sysbuild --slot-size @PM_MCUBOOT_PRIMARY_${qspi_xip_image_number}_SIZE@ --pad-header --header-size @PM_MCUBOOT_PAD_SIZE@ ${imgtool_external_rom_command} CACHE STRING "imgtool sign (external flash) sysbuild replacement") - set(imgtool_internal_sign ${PYTHON_EXECUTABLE} ${imgtool_path} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align ${write_block_size} ${imgtool_internal_sign_sysbuild}) - set(imgtool_external_sign ${PYTHON_EXECUTABLE} ${imgtool_path} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align ${write_block_size} ${imgtool_external_sign_sysbuild}) + set(imgtool_internal_sign ${PYTHON_EXECUTABLE} ${IMGTOOL} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align ${write_block_size} ${imgtool_internal_sign_sysbuild}) + set(imgtool_external_sign ${PYTHON_EXECUTABLE} ${IMGTOOL} sign --version ${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION} --align ${write_block_size} ${imgtool_external_sign_sysbuild}) # Arguments to imgtool. if(NOT CONFIG_MCUBOOT_EXTRA_IMGTOOL_ARGS STREQUAL "")