suit: move envelope creation options to sysbuild Kconfig

Moved Kconfig options that are common or affect all images being built
to the sysbuild Kconfig. The new file in sysbuild/Kconfig.suit contains
those options.

Signed-off-by: Rafał Kuźnia <[email protected]>

Author: e-rk

cmake/sysbuild/suit.cmake

@@ -103,10 +103,9 @@ endfunction()
 #   'output_file' - path to output signed envelope
 function(suit_sign_envelope input_file output_file)
   cmake_path(GET ZEPHYR_NRF_MODULE_DIR PARENT_PATH NRF_DIR_PARENT)
-  sysbuild_get(CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT IMAGE ${DEFAULT_IMAGE} VAR CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT KCONFIG)
-  suit_set_absolute_or_relative_path(${CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT} ${NRF_DIR_PARENT} SIGN_SCRIPT)
+  suit_set_absolute_or_relative_path(${SB_CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT} ${NRF_DIR_PARENT} SIGN_SCRIPT)
   if(NOT EXISTS ${SIGN_SCRIPT})
-    message(SEND_ERROR "DFU: ${CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT} does not exist. Corrupted configuration?")
+    message(SEND_ERROR "DFU: ${SB_CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT} does not exist. Corrupted configuration?")
     return()
   endif()
   set_property(
@@ -164,14 +163,23 @@ function(suit_create_package)
   set(CORE_ARGS)
   set(STORAGE_BOOT_ARGS)
 
-  sysbuild_get(CONFIG_SUIT_ENVELOPE_EDITABLE_TEMPLATES_LOCATION IMAGE ${DEFAULT_IMAGE} VAR CONFIG_SUIT_ENVELOPE_EDITABLE_TEMPLATES_LOCATION KCONFIG)
-  suit_set_absolute_or_relative_path(${CONFIG_SUIT_ENVELOPE_EDITABLE_TEMPLATES_LOCATION} ${PROJECT_BINARY_DIR} INPUT_TEMPLATES_DIRECTORY)
-  sysbuild_get(ENVELOPE_SHALL_BE_SIGNED IMAGE ${DEFAULT_IMAGE} VAR CONFIG_SUIT_ENVELOPE_SIGN KCONFIG)
+  suit_set_absolute_or_relative_path(${SB_CONFIG_SUIT_ENVELOPE_EDITABLE_TEMPLATES_LOCATION} ${PROJECT_BINARY_DIR} INPUT_TEMPLATES_DIRECTORY)
+  set(ENVELOPE_SHALL_BE_SIGNED ${SB_CONFIG_SUIT_ENVELOPE_SIGN})
   if(NOT DEFINED ENVELOPE_SHALL_BE_SIGNED)
     set(ENVELOPE_SHALL_BE_SIGNED FALSE)
   endif()
 
+  list(APPEND CORE_ARGS
+    --core sysbuild,,,${CMAKE_BINARY_DIR}/zephyr/.config
+  )
+
   foreach(image ${IMAGES})
+    sysbuild_get(GENERATE_LOCAL_ENVELOPE IMAGE ${image} VAR CONFIG_SUIT_LOCAL_ENVELOPE_GENERATE KCONFIG)
+    if(NOT DEFINED GENERATE_LOCAL_ENVELOPE)
+      continue()
+    endif()
+    unset(GENERATE_LOCAL_ENVELOPE)
+
     sysbuild_get(INPUT_ENVELOPE_JINJA_FILE IMAGE ${image} VAR CONFIG_SUIT_ENVELOPE_TEMPLATE KCONFIG)
     sysbuild_get(target IMAGE ${image} VAR CONFIG_SUIT_ENVELOPE_TARGET KCONFIG)
     sysbuild_get(BINARY_DIR IMAGE ${image} VAR APPLICATION_BINARY_DIR CACHE)
@@ -185,10 +193,9 @@ function(suit_create_package)
     set(BINARY_FILE "${BINARY_FILE}.bin")
 
     list(APPEND CORE_ARGS
-      --core ${target},${SUIT_ROOT_DIRECTORY}${target}.bin,${BINARY_DIR}/zephyr/edt.pickle
+      --core ${target},${SUIT_ROOT_DIRECTORY}${target}.bin,${BINARY_DIR}/zephyr/edt.pickle,${BINARY_DIR}/zephyr/.config
     )
 
-    sysbuild_get(CONFIG_SUIT_ENVELOPE_ROOT_ARTIFACT_NAME IMAGE ${DEFAULT_IMAGE} VAR CONFIG_SUIT_ENVELOPE_ROOT_ARTIFACT_NAME KCONFIG)
     set(ENVELOPE_YAML_FILE ${SUIT_ROOT_DIRECTORY}${target}.yaml)
     set(ENVELOPE_SUIT_FILE ${SUIT_ROOT_DIRECTORY}${target}.suit)
 
@@ -200,14 +207,11 @@ function(suit_create_package)
     )
   endforeach()
 
-  sysbuild_get(INPUT_ROOT_ENVELOPE_JINJA_FILE IMAGE ${DEFAULT_IMAGE} VAR CONFIG_SUIT_ENVELOPE_ROOT_TEMPLATE KCONFIG)
+  set(INPUT_ROOT_ENVELOPE_JINJA_FILE ${SB_CONFIG_SUIT_ENVELOPE_ROOT_TEMPLATE})
 
   # create root envelope if defined
   if(DEFINED INPUT_ROOT_ENVELOPE_JINJA_FILE AND NOT INPUT_ROOT_ENVELOPE_JINJA_FILE STREQUAL "")
-    sysbuild_get(ROOT_NAME IMAGE ${DEFAULT_IMAGE} VAR CONFIG_SUIT_ENVELOPE_ROOT_ARTIFACT_NAME KCONFIG)
-    if(NOT DEFINED ROOT_NAME OR ROOT_NAME STREQUAL "")
-      set(ROOT_NAME "root")
-    endif()
+    set(ROOT_NAME ${SB_CONFIG_SUIT_ENVELOPE_ROOT_ARTIFACT_NAME})
     suit_copy_input_template(${INPUT_TEMPLATES_DIRECTORY} "${INPUT_ROOT_ENVELOPE_JINJA_FILE}" ROOT_ENVELOPE_JINJA_FILE)
     suit_check_template_digest(${INPUT_TEMPLATES_DIRECTORY} "${INPUT_ROOT_ENVELOPE_JINJA_FILE}")
     set(ROOT_ENVELOPE_YAML_FILE ${SUIT_ROOT_DIRECTORY}${ROOT_NAME}.yaml)
@@ -242,6 +246,13 @@ function(suit_setup_merge)
   sysbuild_get(BINARY_DIR IMAGE ${DEFAULT_IMAGE} VAR APPLICATION_BINARY_DIR CACHE)
   foreach(image ${IMAGES})
     set(ARTIFACTS_TO_MERGE)
+
+    sysbuild_get(GENERATE_LOCAL_ENVELOPE IMAGE ${image} VAR CONFIG_SUIT_LOCAL_ENVELOPE_GENERATE KCONFIG)
+    if(NOT DEFINED GENERATE_LOCAL_ENVELOPE)
+      continue()
+    endif()
+    unset(GENERATE_LOCAL_ENVELOPE)
+
     sysbuild_get(IMAGE_BINARY_DIR IMAGE ${image} VAR APPLICATION_BINARY_DIR CACHE)
     sysbuild_get(IMAGE_BINARY_FILE IMAGE ${image} VAR CONFIG_KERNEL_BIN_NAME KCONFIG)
     sysbuild_get(IMAGE_TARGET_NAME IMAGE ${image} VAR CONFIG_SUIT_ENVELOPE_TARGET KCONFIG)
@@ -275,8 +286,6 @@ function(suit_setup_merge)
   endforeach()
 endfunction()
 
-# Enable SUIT envelope generation only if DEFAULT_IMAGE has it enabled.
-sysbuild_get(CONFIG_SUIT_ENVELOPE IMAGE ${DEFAULT_IMAGE} VAR CONFIG_SUIT_ENVELOPE KCONFIG)
-if(CONFIG_SUIT_ENVELOPE)
+if(SB_CONFIG_SUIT_ENVELOPE)
   suit_create_package()
-endif()
+endif()

cmake/sysbuild/suit_utilities.cmake

@@ -75,7 +75,7 @@ function(suit_create_envelope input_file output_file create_signature)
     --input-file ${input_file}
     --output-file ${output_file}
   )
-  if (create_signature)
+  if (create_signature AND SB_CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT)
     suit_sign_envelope(${output_file} ${output_file})
   endif()
-endfunction()
+endfunction()

samples/suit/smp_transfer/prj.conf

@@ -26,8 +26,5 @@ CONFIG_SUIT=y
 CONFIG_MGMT_SUITFU=y
 CONFIG_FLASH=y
 
-# Enable SUIT envelope creation
-CONFIG_SUIT_ENVELOPE=y
-
 # Extended SUIT commands over USER group
 CONFIG_MGMT_SUITFU_GRP_SUIT=y

samples/suit/smp_transfer/sample.yaml

@@ -8,8 +8,6 @@ sample:
   name: SUIT update through SMP sample
   description: Sample application that updates firmware using SUIT and SMP protocol
 common:
-  extra_configs:
-    - CONFIG_SUIT_ENVELOPE_EDITABLE_TEMPLATES_LOCATION="./"
   platform_allow: nrf54h20dk/nrf54h20/cpuapp
   build_only: true
   sysbuild: true

samples/suit/smp_transfer/sysbuild.conf

@@ -0,0 +1,7 @@
+#
+# Copyright (c) 2024 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+#
+
+SB_CONFIG_SUIT_ENVELOPE=y

samples/suit/smp_transfer/sysbuild_bt.conf

@@ -4,4 +4,5 @@
 # SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
 #
 
+SB_CONFIG_SUIT_ENVELOPE=y
 SB_CONFIG_NETCORE_HCI_IPC=y

sysbuild/Kconfig.suit

@@ -0,0 +1,72 @@
+#
+# Copyright (c) 2024 Nordic Semiconductor
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+#
+
+menu "SUIT"
+
+# 'default y if SOC_SERIES_NRF54HX' to be added when SUIT is to be enabled globally.
+menuconfig SUIT_ENVELOPE
+	bool "Create SUIT envelope"
+	help
+	  Enable DFU SUIT envelope creation
+
+if SUIT_ENVELOPE
+
+config SUIT_ENVELOPE_SIGN
+	bool "Sign created SUIT envelope"
+	help
+	  Sign created SUIT envelope by external script
+
+config SUIT_ENVELOPE_SEQUENCE_NUM
+	int "Sequence number of the generated SUIT manifest"
+	range 0 2147483647
+	default 1
+
+config SUIT_ENVELOPE_ROOT_TEMPLATE
+	string "Path to the default root envelope template"
+	default "${ZEPHYR_SUIT_GENERATOR_MODULE_DIR}/ncs/root_with_binary_nordic_top.yaml.jinja2"
+	help
+	  Path to the default root envelope template, that is used if the application directory does not
+	  contain an input envelope template file.
+	  You can use either absolute or relative path.
+	  In case relative path is used, the build system uses CMAKE_SOURCE_DIR directory.
+
+config SUIT_ENVELOPE_EDITABLE_TEMPLATES_LOCATION
+	string "Path to the folder with envelope templates"
+	default "../"
+	help
+	  Path to the folder containing editable templates used to create binary envelopes.
+	  Input templates are created by the build system during first build from the SUIT_ENVELOPE_DEFAULT_TEMPLATE.
+	  You can use either absolute or relative path.
+	  In case relative path is used, the build system uses CMAKE_SOURCE_DIR directory.
+
+config SUIT_ENVELOPE_SIGN_SCRIPT
+	string "Location of SUIT sign script"
+	depends on SUIT_ENVELOPE_SIGN
+	help
+	  Python script called to sign SUIT envelope.
+	  You can use either absolute or relative path.
+	  In case relative path is used, the build system uses NRF parent directory.
+	  Script need to accept two arguments:
+	  - --input-file <STRING> - location of unsigned envelope in the build system
+	  - --output-file <STRING> - location of signed envelope to create by script
+	default "modules/lib/suit-generator/ncs/sign_script.py"
+
+config SUIT_ENVELOPE_ROOT_ARTIFACT_NAME
+	string "Name of the root SUIT artifact."
+	default "root"
+	help
+	  Name of the root SUIT artifact.
+
+config SUIT_ENVELOPE_NORDIC_TOP_DIRECTORY
+	string "Path to the folder with nordic top artifacts"
+	default ""
+	help
+	  Path to the folder containing nordic-top.suit envelope.
+	  nordic_top.suit won't be included in the root manifest if value is empty.
+
+endif # SUIT_ENVELOPE
+
+endmenu

sysbuild/Kconfig.sysbuild

@@ -74,3 +74,4 @@ rsource "Kconfig.mcuboot"
 rsource "Kconfig.dfu"
 rsource "Kconfig.xip"
 rsource "Kconfig.bt_fast_pair"
+rsource "Kconfig.suit"

west.yml

@@ -239,7 +239,7 @@ manifest:
           upstream-sha: c6eaeda5a1c1c5dbb24dce7e027340cb8893a77b
           compare-by-default: false
     - name: suit-generator
-      revision: c0165159dac566fafbf67be75d86ca64a34834f0
+      revision: 1dfb3fa1676c255c9d19a5c159249b5a7e53c476
       path: modules/lib/suit-generator
     - name: suit-processor
       revision: 5603911b75f037dc3822fd95542c3435c0bf812d