trusted-firmware-m: Define header and trailer options

The current behavior when signing an image is to always set --pad and
--pad-header for all images unless TFM_USE_NS_APP is set. This does not
allow for easy creation of signed images for FOTA applications. Rewrite
the PAD parameter as HEADER and TRAILER to simplify the setup of more
signing options.

Another important reason for this change is that the NS image, when
signed without --pad, runs on the hardware but does not perform the
MCUboot test, and the FWU never upgrades the image. This fixes the NS
image signing process to correctly support TF-M FWU using the PSA API
functions.

Signed-off-by: BUDKE Gerson Fernando <[email protected]>

Author: nandojve

modules/trusted-firmware-m/CMakeLists.txt

@@ -502,9 +502,13 @@ if (CONFIG_BUILD_WITH_TFM)
     endif()
   endif()
 
-  function(tfm_sign OUT_ARG SUFFIX PAD MAX_SECTORS INPUT_FILE OUTPUT_FILE)
-    if(PAD)
+  function(tfm_sign OUT_ARG SUFFIX HEADER TRAILER MAX_SECTORS INPUT_FILE OUTPUT_FILE)
+    if(HEADER AND TRAILER)
       set(pad_args --pad --pad-header)
+    elseif(HEADER)
+      set(pad_args --pad-header)
+    elseif(TRAILER)
+      set(pad_args --pad)
     endif()
     # Secure + Non-secure images are signed the same way as a secure only
     # build, but with a different layout file.
@@ -563,7 +567,7 @@ if (CONFIG_BUILD_WITH_TFM)
     )
 
   elseif(CONFIG_TFM_MCUBOOT_IMAGE_NUMBER STREQUAL "1")
-    tfm_sign(sign_cmd S_NS TRUE ${S_NS_MAX_SECTORS} ${S_NS_FILE} ${S_NS_SIGNED_FILE})
+    tfm_sign(sign_cmd S_NS TRUE TRUE ${S_NS_MAX_SECTORS} ${S_NS_FILE} ${S_NS_SIGNED_FILE})
 
     set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
       COMMAND ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/scripts/build/mergehex.py
@@ -588,12 +592,12 @@ if (CONFIG_BUILD_WITH_TFM)
 
   else()
     if (CONFIG_TFM_USE_NS_APP)
-      tfm_sign(sign_cmd_ns NS TRUE ${S_NS_MAX_SECTORS} ${NS_APP_FILE} ${NS_SIGNED_FILE})
+      tfm_sign(sign_cmd_ns NS TRUE TRUE ${S_NS_MAX_SECTORS} ${NS_APP_FILE} ${NS_SIGNED_FILE})
     else()
-      tfm_sign(sign_cmd_ns NS FALSE ${S_NS_MAX_SECTORS} ${NS_APP_FILE} ${NS_SIGNED_FILE})
+      tfm_sign(sign_cmd_ns NS FALSE TRUE ${S_NS_MAX_SECTORS} ${NS_APP_FILE} ${NS_SIGNED_FILE})
     endif()
 
-    tfm_sign(sign_cmd_s S TRUE ${S_NS_MAX_SECTORS} $<TARGET_PROPERTY:tfm,TFM_S_HEX_FILE>
+    tfm_sign(sign_cmd_s S TRUE TRUE ${S_NS_MAX_SECTORS} $<TARGET_PROPERTY:tfm,TFM_S_HEX_FILE>
       ${S_SIGNED_FILE})
 
     #Create and sign for concatenated binary image, should align with the TF-M BL2