soc: st: stm32: Add Kconfig option to control signing CLI '-align' flag

Starting in v2.21.0, the STM32 signing tool ('STM32_SigningTool_CLI')
stopped automatically adding padding bytes at the beginning of the
payload to align it to the 0x400 offset. To restore this behavior, the
'-align' flag must be passed to the signing tool.

This commit introduces a new Kconfig option,
'CONFIG_STM32_SIGNING_TOOL_ALIGN_FLAG', that controls whether the
'-align' flag is passed to the signing tool when signing images. This
option is now enabled by default for STM32N6x series devices.

For compatibility with 'STM32_SigningTool_CLI' v2.20.0 and earlier, this
Kconfig option must be disabled. For example, the following config in
'app/sysbuild/mcuboot/boards/stm32n6570_dk_stm32n657xx_fsbl.conf' will
omit the '-align' flag from the signing tool arguments:

    CONFIG_STM32_SIGNING_TOOL_ALIGN_FLAG=n

Fixes #99456

Signed-off-by: Chris Wilson <chris@binho.io>

Author: cdwilson

soc/st/stm32/Kconfig

@@ -132,4 +132,11 @@ config STM32_APP_IN_EXT_FLASH
 	  in external Flash and is chainloaded with MCUboot.
 	  Whether the app is eXecuted in Place (XiP) depends on the MCUboot mode used.
 
+config STM32_SIGNING_TOOL_ALIGN_FLAG
+	bool "STM32 image signing tool '-align' flag"
+	default y
+	depends on SOC_SERIES_STM32N6X
+	help
+	  Adds the '-align' flag when invoking the STM32 image signing tool.
+
 endif # SOC_FAMILY_STM32

soc/st/stm32/stm32n6x/CMakeLists.txt

@@ -36,12 +36,22 @@ if(NOT CONFIG_BOOTLOADER_MCUBOOT)
     You won't be able to run application on the board.
     Refer to board documentation for more information")
   else()
-    set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
-      COMMAND ${SIGNING_TOOL}
+    set(SIGNING_TOOL_ARGS
       -in ${PROJECT_BINARY_DIR}/${CONFIG_KERNEL_BIN_NAME}.bin
       -nk -t fsbl -hv 2.3 --silent
+    )
+
+    if(CONFIG_STM32_SIGNING_TOOL_ALIGN_FLAG)
+      list(APPEND SIGNING_TOOL_ARGS -align)
+    endif()
+
+    list(APPEND SIGNING_TOOL_ARGS
       -o ${PROJECT_BINARY_DIR}/${CONFIG_KERNEL_BIN_NAME}.signed.bin
       -dump ${PROJECT_BINARY_DIR}/${CONFIG_KERNEL_BIN_NAME}.signed.bin
+    )
+
+    set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
+      COMMAND ${SIGNING_TOOL} ${SIGNING_TOOL_ARGS}
       WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
     )