Add EMBED and OTP_KEY_PAGE arguments to pico_encrypt_binary function

Author: will-v-pi

tools/CMakeLists.txt

@@ -47,6 +47,12 @@ define_property(TARGET
     BRIEF_DOCS "Embed decryption stage into encrypted binary"
     FULL_DOCS "Embed decryption stage into encrypted binary"
 )
+define_property(TARGET
+    PROPERTY PICOTOOL_OTP_KEY_PAGE
+    INHERITED
+    BRIEF_DOCS "OTP page storing the AES key"
+    FULL_DOCS "OTP page storing the AES key"
+)
 define_property(TARGET
     PROPERTY PICOTOOL_ENC_SIGFILE
     INHERITED
@@ -364,50 +370,40 @@ function(pico_embed_pt_in_binary TARGET PTFILE)
     )
 endfunction()
 
-# pico_encrypt_binary(TARGET AESFILE [SIGFILE])
+# pico_encrypt_binary(TARGET AESFILE [SIGFILE <file>] [EMBED] [OTP_KEY_PAGE <page>])
 # Encrypt the target binary with the given AES key (should be a binary
 # file containing 128 bytes of a random key), and sign the encrypted binary.
 # This sets PICOTOOL_AESFILE to AESFILE, and PICOTOOL_ENC_SIGFILE to SIGFILE
 # if present, else PICOTOOL_SIGFILE.
+# Optionally, use EMBED to embed a decryption stage into the encrypted binary.
+# This sets PICOTOOL_EMBED_DECRYPTION to TRUE.
+# Optionally, use OTP_KEY_PAGE to specify the OTP page storing the AES key.
+# This sets PICOTOOL_OTP_KEY_PAGE to OTP_KEY_PAGE.
 function(pico_encrypt_binary TARGET AESFILE)
+    set(options EMBED)
+    set(oneValueArgs OTP_KEY_PAGE SIGFILE)
+    # set(multiValueArgs )
+    cmake_parse_arguments(PARSE_ARGV 2 ENC "${options}" "${oneValueArgs}" "${multiValueArgs}")
     picotool_check_configurable(${TARGET})
     set_target_properties(${TARGET} PROPERTIES
         PICOTOOL_AESFILE ${AESFILE}
     )
-    if (ARGC EQUAL 3)
+
+    if (ENC_EMBED)
         set_target_properties(${TARGET} PROPERTIES
-            PICOTOOL_ENC_SIGFILE ${ARGV2}
+            PICOTOOL_EMBED_DECRYPTION TRUE
         )
-    else()
-        get_target_property(enc_sig_file ${TARGET} PICOTOOL_ENC_SIGFILE)
-        if (NOT enc_sig_file)
-            get_target_property(sig_file ${TARGET} PICOTOOL_SIGFILE)
-            if (NOT sig_file)
-                message(FATAL_ERROR "Signature file not set for ${TARGET}")
-            else()
-                set_target_properties(${TARGET} PROPERTIES
-                    PICOTOOL_ENC_SIGFILE ${sig_file}
-                )
-            endif()
-        endif()
     endif()
-endfunction()
 
-# pico_create_decrypting_binary(TARGET AESFILE [SIGFILE])
-# Encrypt the target binary with the given AES key (should be a binary
-# file containing 128 bytes of a random key), add a decryption stage to
-# decrypt the binary at runtime, and then sign the encrypted binary.
-# This sets PICOTOOL_AESFILE to AESFILE, PICOTOOL_EMBED_DECRYPTION to TRUE,
-# and PICOTOOL_ENC_SIGFILE to SIGFILE if present, else PICOTOOL_SIGFILE.
-function(pico_create_decrypting_binary TARGET AESFILE)
-    picotool_check_configurable(${TARGET})
-    set_target_properties(${TARGET} PROPERTIES
-        PICOTOOL_AESFILE ${AESFILE}
-        PICOTOOL_EMBED_DECRYPTION TRUE
-    )
-    if (ARGC EQUAL 3)
+    if (ENC_OTP_KEY_PAGE)
         set_target_properties(${TARGET} PROPERTIES
-            PICOTOOL_ENC_SIGFILE ${ARGV2}
+            PICOTOOL_OTP_KEY_PAGE ${ENC_OTP_KEY_PAGE}
+        )
+    endif()
+
+    if (ENC_SIGFILE)
+        set_target_properties(${TARGET} PROPERTIES
+            PICOTOOL_ENC_SIGFILE ${ENC_SIGFILE}
         )
     else()
         get_target_property(enc_sig_file ${TARGET} PICOTOOL_ENC_SIGFILE)
@@ -561,6 +557,11 @@ function(picotool_postprocess_binary TARGET)
                 list(APPEND picotool_encrypt_args "--embed")
             endif()
 
+            get_target_property(otp_key_page ${TARGET} PICOTOOL_OTP_KEY_PAGE)
+            if (otp_key_page)
+                list(APPEND picotool_encrypt_args "--otp-key-page" ${otp_key_page})
+            endif()
+
             add_custom_command(TARGET ${TARGET} POST_BUILD
                 DEPENDS ${picotool_enc_sigfile} ${picotool_aesfile}
                 COMMAND picotool