trusted-firmware-m: Set --align when signing

The current version of TF-M script that sign MCUboot image uses a
default alignment of 1. This value varies between flash devices
and not all accept the default 1. This improve the script picking
the write-block-size property from the current flash controller
and pass as the --align parameter when signing an image.

Note: This solution works out-of-box for the vast majority of
devices in the Zephyr tree and an exception will throw when
a device is not supported.

Signed-off-by: BUDKE Gerson Fernando <[email protected]>

Author: nandojve

modules/trusted-firmware-m/CMakeLists.txt

@@ -450,6 +450,39 @@ if (CONFIG_BUILD_WITH_TFM)
     set(HEX_ADDR_ARGS_NS "--hex-addr=${TFM_HEX_BASE_ADDRESS_NS}")
   endif()
 
+  if(CONFIG_TFM_BL2)
+    set(image_alignment 1)
+    set(flash_write_block_size 1)
+
+    dt_chosen(chosen_flash PROPERTY "zephyr,flash")
+    if(DEFINED chosen_flash AND chosen_flash)
+      dt_prop(flash_write_block_size PATH ${chosen_flash} PROPERTY write-block-size)
+    else()
+      message(WARNING
+        "The 'zephyr,flash' chosen property is not defined!
+        Using flash_write_block_size default value possible differs from
+        TF-M board definitions resulting in improver sign."
+        )
+    endif()
+
+    # The alignment is determined by the minimal amount of bytes necessary to
+    # be written in the flash sector. Ex., assuming that the sector erase
+    # operation is 1KiB and, on that sector, the minimum amount of bytes that
+    # must be written is 8 bytes then the alignment is 8.
+    #
+    # Current MCUboot maximum alignment is 32 bytes.
+    if(flash_write_block_size GREATER 0)
+      if(flash_write_block_size GREATER 32)
+        message(WARNING
+          "imgtool max alignment is 32 and current value is ${flash_write_block_size}.
+          Keep default image alignment of 1."
+          )
+      else()
+        set(image_alignment ${flash_write_block_size})
+      endif()
+    endif()
+  endif()
+
   function(tfm_sign OUT_ARG SUFFIX PAD INPUT_FILE OUTPUT_FILE)
     if(PAD)
       set(pad_args --pad --pad-header)
@@ -469,7 +502,7 @@ if (CONFIG_BUILD_WITH_TFM)
       --layout ${layout_file}
       -k ${CONFIG_TFM_KEY_FILE_${SUFFIX}}
       --public-key-format ${TFM_PUBLIC_KEY_FORMAT}
-      --align 1
+      --align ${image_alignment}
       -v ${CONFIG_TFM_IMAGE_VERSION_${SUFFIX}}
       ${pad_args}
       ${HEX_ADDR_ARGS_${SUFFIX}}