[FEATURE] pass vendor specific FW signing options to west sign

[kv2019i]

Is your feature request related to a problem? Please describe.
On Intel platforms, we need to sign production releases with west sign options "-i" and "-p". Currently SOF's xtensa-build-zephyr.py does not allow passing these options.

Describe the solution you'd like
Option to pass a list of options that suits multivendor usage with "west sign".

@marc-hb May 2022 EDIT: this almost complete. It has NOT been implemented by "passing a list of options to xtensa-build-zephyr.py". It's using west config for west sign instead.

cc:

• xtensa-build-zephyr.py: stop calling west sign, rely on west build #7684
• intel_adsp: move west sign from west flash to earlier west build zephyrproject-rtos/zephyr#54700
• Support 4th level west -c config.ini file(s) zephyrproject-rtos/west#429

[kv2019i]

FYI @abonislawski @marc-hb @lgirdwood @juimonen

[marc-hb]

I will try to address this (the small rest of) this week. I think the very first step is to actually review this PR in detail:

• intel_adsp: Add signed image target to cmake zephyrproject-rtos/zephyr#52942

[lgirdwood]

@nashif fyi

[marc-hb]

So as I suspected, zephyrproject-rtos/zephyr#52942 is trying to solve this problem (among others). I just finished a (detailed) review of it.

If upstream Zephyr solves this problem with some new configuration file or something and we add some hack in xtensa-build-zephyr.py at the same time then we're very likely to end-up in some forward/backward compatibility nightmare with upstream.

So temporarily for this 2.4 release would it be possible to (re-)run west sign manually with the modified rimage parameters? AFAIK production releases are NOT automated anyway. This will overwrite the .ri file in the build-tgl directory, then it only needs to be copied to build-sof-staging/.

After running xtensa-build-zephyr.py, scrolling up 1 or 2 screens shows the exact west sign command it has run.

[kv2019i]

@marc-hb Let's leave the 2.4 release aside and consider just the specific question of ability to pass signing options. I think a generic ability to pass FW signing options seems like a generic thing we will need now and future. I don't see Zephyr PR52942 changing this.

If I look up Zephyr docs on west sign:
https://docs.zephyrproject.org/latest/develop/west/sign.html

west sign -t your_tool -- ARGS_FOR_YOUR_TOOL

... so generic ability to pass extra options from xtensa-build-zephyr.py to "ARGS_FOR_YOUR_TOOL" seems like a good capability to have as it's something "west sign" tool has.

If signing is merged to build step on Zephyr side, then it would seem the extra options would need to be passed to build step, but otherwise still applicable.

Whether changing the signing options via the script parameters is a good approach or not, is another topic, but it's something SOF has in the past offered and at least the Intel binary release process has dependent upon. So moving to e.g. some in-tree configuration file to describe different signing targets, would be a very large change to the release model and something that should be discussed separately.

[marc-hb]

I think a generic ability to pass FW signing options seems like a generic thing we will need now and future.

Yes.

I don't see Zephyr PR52942 changing this.

It does - and more.

So moving to e.g. some in-tree configuration file

The configuration file I suggested in Zephyr 52942 does not have to be in git. It's just a suggestion, work in progress.

2.4 workaround In the meantime:

• [STABLE 2.4] xtensa-build-zephyr.py: add --extra-rimage-args option #6923