trusted-firmware-m: Set --align when signing

The current version of TF-M script that sign MCUboot image uses a
default alignment of 1. This value varies between flash devices
and not all accept the default 1. This improve the script picking
the write-block-size property from the current flash controller
and pass as the --align parameter when signing an image.

Note: This solution works out-of-box for the vast majority of
devices in the Zephyr tree and an exception will throw when
a device is not supported.

Signed-off-by: BUDKE Gerson Fernando <[email protected]>

Author: nandojve

modules/trusted-firmware-m/CMakeLists.txt

@@ -444,6 +444,26 @@ if (CONFIG_BUILD_WITH_TFM)
     set(HEX_ADDR_ARGS_NS "--hex-addr=${TFM_HEX_BASE_ADDRESS_NS}")
   endif()
 
+  dt_chosen(chosen_flash PROPERTY "zephyr,flash")
+  dt_prop(flash_write_block_size PATH ${chosen_flash} PROPERTY write-block-size)
+  # The alignment is determined by the minimal amount of bytes necessary to
+  # be written in the flash sector. Ex., assuming that the sector erase
+  # operation is 1KiB and, on that sector, the minimal amount of bytes that
+  # must be writen is 8 bytes than the alignment is 8.
+  #
+  # Current MCUboot maximum alignment is 32 bytes.
+  if(flash_write_block_size GREATER 0)
+    if(flash_write_block_size GREATER 32)
+      message(FATAL_ERROR
+        "imgtool max alignment is 32 and current value is
+        {$flash_write_block_size}"
+        )
+    endif()
+    set(image_alignment ${flash_write_block_size})
+  else()
+    set(image_alignment 1)
+  endif()
+
   function(tfm_sign OUT_ARG SUFFIX PAD INPUT_FILE OUTPUT_FILE)
     if(PAD)
       set(pad_args --pad --pad-header)
@@ -463,7 +483,7 @@ if (CONFIG_BUILD_WITH_TFM)
       --layout ${layout_file}
       -k ${CONFIG_TFM_KEY_FILE_${SUFFIX}}
       --public-key-format ${TFM_PUBLIC_KEY_FORMAT}
-      --align 1
+      --align ${image_alignment}
       -v ${CONFIG_TFM_IMAGE_VERSION_${SUFFIX}}
       ${pad_args}
       ${HEX_ADDR_ARGS_${SUFFIX}}