feat(fiptool): add cca, core_swd, plat cert in FIP

Added support for cca CoT in the fiptool by adding the cca,
core_swd, and plat key certificates.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmei

feat(fiptool): add cca, core_swd, plat cert in FIP

Added support for cca CoT in the fiptool by adding the cca,
core_swd, and plat key certificates.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I1ba559e188ad8c33cb0e643d7a2fc6fb96736ab9

show more ...

refactor(security): upgrade tools to OpenSSL 3.0

Host tools cert_tool and encrypt_fw refactored to be fully
compatible with OpenSSL v3.0.

Changes were made following the OpenSSL 3.0 migration guide

refactor(security): upgrade tools to OpenSSL 3.0

Host tools cert_tool and encrypt_fw refactored to be fully
compatible with OpenSSL v3.0.

Changes were made following the OpenSSL 3.0 migration guide:
https://www.openssl.org/docs/man3.0/man7/migration_guide.html
In some cases, those changes are straightforward and only
a small modification on the types or API calls was needed
(e.g.: replacing BN_pseudo_rand() with BN_rand(). Both identical
since v1.1.0).
The use of low level APIs is now deprecated. In some cases,
the new API provides a simplified solution for our goals and
therefore the code was simplified accordingly (e.g.: generating
RSA keys through EVP_RSA_gen() without the need of handling the
exponent). However, in some cases, a more
sophisticated approach was necessary, as the use of a context
object was required (e.g.: when retrieving the digest value from
an SHA file).

Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: I978e8578fe7ab3e71307450ebe7e7812fbcaedb6

show more ...

Merge "fix(fiptool): respect OPENSSL_DIR" into integration

fix(fiptool): avoid packing the zero size images in the FIP

Updated the fiptool to avoid packing the zero size images in
the FIP.
Also, updated the commitlint-json file to cover the fiptool
changes

fix(fiptool): avoid packing the zero size images in the FIP

Updated the fiptool to avoid packing the zero size images in
the FIP.
Also, updated the commitlint-json file to cover the fiptool
changes under a separate scope.

Change-Id: Id7ac3dcff0c7318546e49308d0f17b6cbd5eb24b
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(fiptool): respect OPENSSL_DIR

fiptool links to libcrypto, so as with the other tools it should respect
OPENSSL_DIR for include/library paths.

Change-Id: Icd8c15fa5097db1da9a3a9222d9e267548c4c7e

fix(fiptool): respect OPENSSL_DIR

fiptool links to libcrypto, so as with the other tools it should respect
OPENSSL_DIR for include/library paths.

Change-Id: Icd8c15fa5097db1da9a3a9222d9e267548c4c7e2
Signed-off-by: Ross Burton <ross.burton@arm.com>

show more ...

feat(rme): add ENABLE_RME build option and support for RMM image

The changes include:

- A new build option (ENABLE_RME) to enable FEAT_RME

- New image called RMM. RMM is R-EL2 firmware that manage

feat(rme): add ENABLE_RME build option and support for RMM image

The changes include:

- A new build option (ENABLE_RME) to enable FEAT_RME

- New image called RMM. RMM is R-EL2 firmware that manages Realms.
When building TF-A, a path to RMM image can be specified using
the "RMM" build flag. If RMM image is not provided, TRP is built
by default and used as RMM image.

- Support for RMM image in fiptool

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I017c23ef02e465a5198baafd665a60858ecd1b25

show more ...

fiptool: Do not call 'make clean' in 'all' target

Calling 'make clean' in 'all' target is causing recompilation of binary
at every 'make' call, which is wrong.

Also building a new target via 'make

fiptool: Do not call 'make clean' in 'all' target

Calling 'make clean' in 'all' target is causing recompilation of binary
at every 'make' call, which is wrong.

Also building a new target via 'make TARGET' can cause infinite loop as
it is not defined as explicit make dependency. Dependent targets must be
specified after colon when defining target, which also prevents infinite
loops as make is able to detect these circular dependencies.

Moreover calling 'make clean' is supposed to be done by user when
configuration is changing.

So remove calling 'make clean' in 'all' target and define dependency for
'${PROJECT}' at correct place.

Signed-off-by: Pali Rohár <pali@kernel.org>
Change-Id: I70e7fd2b04b02f6a0650c82df91d58c9a4cb24d9

show more ...

tools: add mechanism to allow platform specific image UUID

Generic framework is added to include platform defined UUID.

This framework is added for the following:
- All NXP SoC based platforms need

tools: add mechanism to allow platform specific image UUID

Generic framework is added to include platform defined UUID.

This framework is added for the following:
- All NXP SoC based platforms needed additional fip-fuse.bin
- NXP SoC lx2160a based platforms requires additional fip-ddr.bin

Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Change-Id: Ibe05d9c596256e34077287a490dfcd5b731ef2cf

show more ...

Update makefile to build fiptool for Windows

Although support for building fiptool on a Windows host was present,
the binary was not built when the top level makefile was invoked.

This patch makes

Update makefile to build fiptool for Windows

Although support for building fiptool on a Windows host was present,
the binary was not built when the top level makefile was invoked.

This patch makes the necessary changes to the to support building of
fiptool on a Windows host PC from the main makefile.

Change-Id: I0c01ba237fa3010a027a1b324201131210cf4d7c
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>

show more ...

Fix fiptool packaging issue on windows

Windows does not have a standard getopt implementation. To address
this an equivalent implementation has been provided in win_posix.c
However, the implementati

Fix fiptool packaging issue on windows

Windows does not have a standard getopt implementation. To address
this an equivalent implementation has been provided in win_posix.c
However, the implementation has an issue with option processing as
described below.

Long option names may be abbreviated if the abbreviation is unique
or an exact match for some defined option.
Since some options can be substring of other options e.g. "scp-fw"
option is a substring of "scp-fwu-cfg", we need to identify if an
option is abbreviated and also check for uniqueness. Otherwise if
a user passes --scp-fw as an option, the "scp-fwu-cfg" option may
get selected, resulting in an incorrectly packaged FIP.

This issue has been be fixed by:
- First searching for an exact match.
- If exact match was not found search for a abbreviated match.
By doing this an incorrect option selection can be avoided.

Change-Id: I22f4e7a683f3df857f5b6f0783bf9b03a64a0bcc
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>

show more ...

tools: Set the tool's default binary name

This patch: fafd3ec9c assumes that tools must build from
the main makefile folder.
This assumption leads to the error when somebody wants to
build a tool fr

tools: Set the tool's default binary name

This patch: fafd3ec9c assumes that tools must build from
the main makefile folder.
This assumption leads to the error when somebody wants to
build a tool from the tool's folder.
Hence changes are done to provide the default binary name
in the tool's makefile.

Change-Id: Iae570a7f8d322151376b6feb19e739300eecc3fc
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

tools: Get the tool's binary name from the main makefile

Currently, the tool's makefile override the tool's binary name
which is already been defined in the main makefile.
Hence fix is provided so t

tools: Get the tool's binary name from the main makefile

Currently, the tool's makefile override the tool's binary name
which is already been defined in the main makefile.
Hence fix is provided so that the tool's makefile get the tool's
binary name from the main makefile instead of overriding it.

Change-Id: I8af2bd391a96bba2dbcddef711338a94ebf5f038
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...