build: Introduce DEFAULT_APP with automatic builds

Introduce the Makefile variable DEFAULT_APP which should be the path
to the device app binary to include in the obliagory slot 0.

Build automatically: the default app, the new digest file
mgmt_app_digest.h for the firmware which contains the digest of
DEFAULT_APP, the default partition table, and all the tools necessary
to generate this.

LICENSES/spdx-ensure

@@ -79,7 +79,6 @@ hw/application_fpga/tools/README.md
 hw/application_fpga/tools/b2s/README.md
 hw/application_fpga/tools/b2s/go.mod
 hw/application_fpga/tools/b2s/go.sum
-hw/application_fpga/tools/default_partition.bin
 hw/application_fpga/tools/tkeyimage/README.md
 hw/application_fpga/tools/tkeyimage/go.mod
 hw/application_fpga/tools/tkeyimage/go.sum

README.md

@@ -118,7 +118,10 @@ This uses the make target `prog_flash` in
 `hw/application_fpga/Makefile` behind the scenes, but mounts your TP1
 device into the container.
 
-To see all targets:
+If you want to change the default app the TKey uses, change
+`DEFAULT_APP` in the `hw/application_fpga/Makefile`.
+
+To see all container targets:
 
 ```
 cd contrib

hw/application_fpga/Makefile

@@ -43,6 +43,10 @@ CC = clang
 
 LIBDIR ?= tkey-libs
 
+# The preloaded app in slot 0. Must be defined. Firmware depends on
+# it. Change this if you want another first preloaded app.
+DEFAULT_APP ?= $(P)/apps/defaultapp.bin
+
 CFLAGS = \
 	-target riscv32-unknown-none-elf \
 	-march=rv32iczmmul \
@@ -119,8 +123,11 @@ VERILOG_SRCS = \
 PICORV32_SRCS = \
 	$(P)/core/picorv32/rtl/picorv32.v
 
+
 FIRMWARE_DEPS = \
-	$(P)/fw/tk1/proto.h
+	$(P)/fw/tk1/proto.h \
+	$(P)/fw/tk1/mgmt_app_digest.h \
+	tools/default_partition.bin
 
 FIRMWARE_OBJS = \
 	$(P)/fw/tk1/main.o \
@@ -176,6 +183,19 @@ secret:
 	cd data;../tools/tpt/tpt.py
 .PHONY: secret
 
+# -------------------------------------------------------------------
+# Build tools
+# -------------------------------------------------------------------
+
+# .PHONY to let go build handle deps and rebuilds
+.PHONY: tools/tkeyimage/tkeyimage
+tools/tkeyimage/tkeyimage:
+	go build -C $(P)/tools/tkeyimage
+
+.PHONY: tools/b2s/b2s
+tools/b2s/b2s:
+	go build -C $(P)/tools/b2s
+
 #-------------------------------------------------------------------
 # Firmware generation.
 # Included in the bitstream.
@@ -196,6 +216,14 @@ QEMU_LDFLAGS = \
 tkey-libs:
 	make -C $(LIBDIR)
 
+# Device app used as preloaded app
+$(DEFAULT_APP):
+	make -C apps
+
+# Partititon table for the firmware's filesystem
+tools/default_partition.bin: tools/tkeyimage/tkeyimage $(DEFAULT_APP)
+	./tools/tkeyimage/tkeyimage -app0 $(DEFAULT_APP) -o $@
+
 $(FIRMWARE_OBJS): $(FIRMWARE_DEPS)
 $(TESTFW_OBJS): $(FIRMWARE_DEPS)
 
@@ -214,6 +242,11 @@ qemu_firmware.elf: ASFLAGS += -DQEMU_SYSCALL
 qemu_firmware.elf: tkey-libs $(FIRMWARE_OBJS) $(P)/fw/tk1/qemu_firmware.lds
 	$(CC) $(CFLAGS) $(FIRMWARE_OBJS) $(QEMU_LDFLAGS) -o $@ > $(basename $@).map
 
+# Generate the file containing the digest for the obligatory default
+# app in slot 0.
+$(P)/fw/tk1/mgmt_app_digest.h: $(DEFAULT_APP) tools/b2s/b2s
+	./tools/b2s/b2s -c -m $(DEFAULT_APP) > $@
+
 # Create compile_commands.json for clangd and LSP
 .PHONY: clangd
 clangd: compile_commands.json
@@ -471,10 +504,9 @@ tb_application_fpga: $(SIM_VERILOG_SRCS) \
 # FPGA device programming.
 #-------------------------------------------------------------------
 
-prog_flash: check-hardware application_fpga.bin
+prog_flash: check-hardware application_fpga.bin tools/default_partition.bin
 	tillitis-iceprog application_fpga.bin
-	make -C apps
-	(cd tools && ./load_preloaded_app.sh 0 ../apps/defaultapp.bin)
+	(cd tools && ./load_preloaded_app.sh 0 $(DEFAULT_APP))
 .PHONY: prog_flash
 
 prog_flash_bs: check-hardware application_fpga.bin
@@ -513,6 +545,9 @@ clean: clean_sim clean_fw clean_tb
 	rm -f tools/tpt/*.hex
 	rm -rf tools/tpt/__pycache__
 	make -C apps clean
+	rm -f fw/tk1/mgmt_app_digest.h
+	rm -f tools/default_partition.bin
+
 .PHONY: clean
 
 clean_fw:

hw/application_fpga/fw/tk1/mgmt_app.c

@@ -10,15 +10,9 @@
 
 // Lock down what app can start from flash slot 0.
 //
-// To update this, compute the BLAKE2s digest of the app.bin
-// clang-format off
-static const uint8_t allowed_app_digest[32] = {
-    0x40, 0x7f, 0x58, 0xbe, 0x39, 0xcf, 0xae, 0xaf,
-    0x43, 0xa0, 0x75, 0x90, 0x4d, 0x43, 0xa3, 0x2e,
-    0xa1, 0x5f, 0x4c, 0x1b, 0x6a, 0xf3, 0x69, 0x4d,
-    0x74, 0x05, 0x21, 0x63, 0xa0, 0xd3, 0x69, 0x34,
-};
-// clang-format on
+// To update this, compute the BLAKE2s digest of the device app
+// binare, see the b2s tool.
+#include "mgmt_app_digest.h"
 
 static uint8_t current_app_digest[32];