tools: don't clean when building

Don't depend on clean when building, as the user is capable of cleaning
if required and this introduces a race where "all" depends on both the
compile and the clean

tools: don't clean when building

Don't depend on clean when building, as the user is capable of cleaning
if required and this introduces a race where "all" depends on both the
compile and the clean in parallel. It's quite possible for some of the
compile to happen in parallel with the clean, which results in the link
failing as objects just built are missing.

Change-Id: I710711eea7483cafa13251c5d94ec693148bd001
Signed-off-by: Ross Burton <ross.burton@arm.com>

show more ...

Use preallocated parts of the HASH struct

When OpenSSL's macro allocates the HASH struct, it allocates the fields
as well. After this allocation, the prior code would assign over the
pointers inside

Use preallocated parts of the HASH struct

When OpenSSL's macro allocates the HASH struct, it allocates the fields
as well. After this allocation, the prior code would assign over the
pointers inside the HASH struct, leaking these fields. This patch
avoids allocating extra copies of these members.

Change-Id: I50a38b0a04b52ec54d6388db0f694feb578d2818
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

Free arguments copied with strdup

Change-Id: I0ad9620145c2a9c4450b9bf20cd1f70c9db6593c
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

Free keys after use

Change-Id: I16ba4420ffeb9aa439e0a09a1b34d2aba2e1eb6e
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

Free X509_EXTENSIONs

Previously, we would leak these extensions as they are not freed by the
stack. An except from the `sk_TYPE_free` documentation:

sk_TYPE_free() frees up the sk structure. It

Free X509_EXTENSIONs

Previously, we would leak these extensions as they are not freed by the
stack. An except from the `sk_TYPE_free` documentation:

sk_TYPE_free() frees up the sk structure. It does not free up any
elements of sk. After this call sk is no longer valid.

The fix is to drain the stack and free its elements before freeing the
stack. sk_TYPE_pop_free does this, so we use that instead.

Change-Id: Ie70c302f9dda5af1a7243f163d36e99916ee639c
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

Update makefile to build fiptool for Windows

Although support for building fiptool on a Windows host was present,
the binary was not built when the top level makefile was invoked.

This patch makes

Update makefile to build fiptool for Windows

Although support for building fiptool on a Windows host was present,
the binary was not built when the top level makefile was invoked.

This patch makes the necessary changes to the to support building of
fiptool on a Windows host PC from the main makefile.

Change-Id: I0c01ba237fa3010a027a1b324201131210cf4d7c
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>

show more ...

Fix fiptool packaging issue on windows

Windows does not have a standard getopt implementation. To address
this an equivalent implementation has been provided in win_posix.c
However, the implementati

Fix fiptool packaging issue on windows

Windows does not have a standard getopt implementation. To address
this an equivalent implementation has been provided in win_posix.c
However, the implementation has an issue with option processing as
described below.

Long option names may be abbreviated if the abbreviation is unique
or an exact match for some defined option.
Since some options can be substring of other options e.g. "scp-fw"
option is a substring of "scp-fwu-cfg", we need to identify if an
option is abbreviated and also check for uniqueness. Otherwise if
a user passes --scp-fw as an option, the "scp-fwu-cfg" option may
get selected, resulting in an incorrectly packaged FIP.

This issue has been be fixed by:
- First searching for an exact match.
- If exact match was not found search for a abbreviated match.
By doing this an incorrect option selection can be avoided.

Change-Id: I22f4e7a683f3df857f5b6f0783bf9b03a64a0bcc
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>

show more ...

tools: Set the tool's default binary name

This patch: fafd3ec9c assumes that tools must build from
the main makefile folder.
This assumption leads to the error when somebody wants to
build a tool fr

tools: Set the tool's default binary name

This patch: fafd3ec9c assumes that tools must build from
the main makefile folder.
This assumption leads to the error when somebody wants to
build a tool from the tool's folder.
Hence changes are done to provide the default binary name
in the tool's makefile.

Change-Id: Iae570a7f8d322151376b6feb19e739300eecc3fc
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

tools: Get the tool's binary name from the main makefile

Currently, the tool's makefile override the tool's binary name
which is already been defined in the main makefile.
Hence fix is provided so t

tools: Get the tool's binary name from the main makefile

Currently, the tool's makefile override the tool's binary name
which is already been defined in the main makefile.
Hence fix is provided so that the tool's makefile get the tool's
binary name from the main makefile instead of overriding it.

Change-Id: I8af2bd391a96bba2dbcddef711338a94ebf5f038
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

SPM: Alter sp_gen.mk entry depending on owner of partition

With recently introduced dualroot CoT for SPs where they are owned
either by SiP or by Platform. SiP owned SPs index starts at SP_PKG1_ID
w

SPM: Alter sp_gen.mk entry depending on owner of partition

With recently introduced dualroot CoT for SPs where they are owned
either by SiP or by Platform. SiP owned SPs index starts at SP_PKG1_ID
while Plat owned SPs index starts at SP_PKG5_ID.

This patch modifies SP makefile generator script to take CoT as an
argument and if it is "dualroot" then generates SP_PKG in order
mentioned above, otherwise generates it sequentially.

Signed-off-by: Ruari Phipps <ruari.phipps@arm.com>
Change-Id: Iffad1131787be650a9462f6f8cc09b603cddb3b8

show more ...

cert_create: add Platform owned secure partitions support

Add support to generate a certificate named "plat-sp-cert" for Secure
Partitions(SP) owned by Platform.
Earlier a single certificate file "s

cert_create: add Platform owned secure partitions support

Add support to generate a certificate named "plat-sp-cert" for Secure
Partitions(SP) owned by Platform.
Earlier a single certificate file "sip-sp-cert" was generated which
contained hash of all 8 SPs, with this change SPs are divided into
two categories viz "SiP owned" and "Plat owned" containing 4 SPs each.

Platform RoT key pair is used for signing.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I5bd493cfce4cf3fc14b87c8ed1045f633d0c92b6

show more ...

Use abspath to dereference $BUILD_BASE

If the user tries to change BUILD_BASE to put the build products outside
the build tree the compile will fail due to hard coded assumptions that
$BUILD_BASE is

Use abspath to dereference $BUILD_BASE

If the user tries to change BUILD_BASE to put the build products outside
the build tree the compile will fail due to hard coded assumptions that
$BUILD_BASE is a relative path. Fix by using $(abspath $(BUILD_BASE))
to rationalize to an absolute path every time and remove the relative
path assumptions.

This patch also adds documentation that BUILD_BASE can be specified by
the user.

Signed-off-by: Grant Likely <grant.likely@arm.com>
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ib1af874de658484aaffc672f30029b852d2489c8

show more ...

Merge "fiptool: return zero status on help and help <command>" into integration

tools: doimage: change the binary image alignment to 16

Change the binary image alignment from 4 to 16.
The PKCS signature verification fails for unaligned images.

Change-Id: Ieb08dc3ea128790f542ad

tools: doimage: change the binary image alignment to 16

Change the binary image alignment from 4 to 16.
The PKCS signature verification fails for unaligned images.

Change-Id: Ieb08dc3ea128790f542ad93e3c948117567a65af
Signed-off-by: Konstantin Porotchkin <kostap@marvell.com>

show more ...

tools: doimage: migrate to mbedtls v2.8 APIs

Replace deprecated mbedtls_sha256 with mbedtls_sha256_ret
The mbedtls_pk_parse_key does not work correctly anymore
with the DER buffer embedded in the se

tools: doimage: migrate to mbedtls v2.8 APIs

Replace deprecated mbedtls_sha256 with mbedtls_sha256_ret
The mbedtls_pk_parse_key does not work correctly anymore
with the DER buffer embedded in the secure image extentson
using the buffer size as the the key length.
Move to mbedtls_pk_parse_subpubkey API that handles such
case correctly.
The DER format already contains the key length, so there
is no particular reason to supply it to the key parser.
Update the doimage version to 3.3

Change-Id: I0ec5ee84b7d1505b43138e0b7a6bdba44a6702b6
Signed-off-by: Konstantin Porotchkin <kostap@marvell.com>

show more ...

fiptool: return zero status on help and help <command>

Querying the 'fiptool' for help or help <command> should return 0
return status (success) and not 1 (failure). In the other hand, if tool is
ex

fiptool: return zero status on help and help <command>

Querying the 'fiptool' for help or help <command> should return 0
return status (success) and not 1 (failure). In the other hand, if tool is
executed with any other command (not help) where command's parameters are
either missing or wrong, then the tool should return non-zero (failure). Now,
the 'usage' function caller is the one that passes the return status.

Change-Id: Id5eea91037cd810fb1e34a42e8199ef504f5daa4
Signed-off-by: Leonardo Sandoval <leonardo.sandoval@linaro.org>

show more ...

cert_tool: Update cert_tool for fw_config image support

Updated cert_tool to add hash information of fw_config image into
the existing "trusted boot fw" certificate.

Signed-off-by: Manish V Badarkh

cert_tool: Update cert_tool for fw_config image support

Updated cert_tool to add hash information of fw_config image into
the existing "trusted boot fw" certificate.

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I720319225925806a2a9f50a1ac9c8a464be975f0

show more ...

fiptool: Add fw_config in FIP

Added support in fiptool to include fw_config image
in FIP.

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: Ibbd14723a4141598d9d7f6bfcf88a0ef92cf

fiptool: Add fw_config in FIP

Added support in fiptool to include fw_config image
in FIP.

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: Ibbd14723a4141598d9d7f6bfcf88a0ef92cf87bc

show more ...

cert_create: extend Secure partition support for tbbr CoT

with sha 0792dd7, support to generate certificate for Secure
Partitions was added for dualroot CoT only, this patch extends
this support for

cert_create: extend Secure partition support for tbbr CoT

with sha 0792dd7, support to generate certificate for Secure
Partitions was added for dualroot CoT only, this patch extends
this support for tbbr CoT.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I451c0333536dd1cbe17861d454bdb0dc7a17c63f

show more ...

sptool: append cert_tool arguments.

To support secure boot of SP's update cert tool arguments while
generating sp_gen.mk which in turn is consumed by build system.

Signed-off-by: Manish Pandey <man

sptool: append cert_tool arguments.

To support secure boot of SP's update cert tool arguments while
generating sp_gen.mk which in turn is consumed by build system.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I2293cee9b7c684c27d387aba18e0294c701fb1cc

show more ...

cert_create: add SiP owned secure partitions support

Add support to generate certificate "sip-sp-cert" for Secure
Partitions(SP) owned by Silicon provider(SiP).
To avoid deviation from TBBR specific

cert_create: add SiP owned secure partitions support

Add support to generate certificate "sip-sp-cert" for Secure
Partitions(SP) owned by Silicon provider(SiP).
To avoid deviation from TBBR specification the support is only added for
dualroot CoT and not for TBBR CoT.

A single certificate file is generated containing hash of individual
packages. Maximum 8 secure partitions are supported.

Following new options added to cert_tool:
--sip-sp-cert --> SiP owned Secure Partition Content Certificate
--sp-pkg1 --> Secure Partition Package1 file
--sp-pkg2
.....
--sp-pkg8

Trusted world key pair is used for signing.

Going forward, this feature can be extended for Platfrom owned
Partitions, if required.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ia6dfbc1447cfb41b1fcbd12cf2bf7b88f409bd8d

show more ...

Merge changes from topic "sb/dualroot" into integration

* changes:
Build system: Changes to drive cert_create for dualroot CoT
cert_create: Define the dualroot CoT
Introduce a new "dualroot" c

Merge changes from topic "sb/dualroot" into integration

* changes:
Build system: Changes to drive cert_create for dualroot CoT
cert_create: Define the dualroot CoT
Introduce a new "dualroot" chain of trust

show more ...

tools: Add firmware authenticated encryption tool

Add firmware authenticated encryption tool which utilizes OpenSSL
library to encrypt firmwares using a key provided via cmdline. Currently
this tool

tools: Add firmware authenticated encryption tool

Add firmware authenticated encryption tool which utilizes OpenSSL
library to encrypt firmwares using a key provided via cmdline. Currently
this tool supports AES-GCM as an authenticated encryption algorithm.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I60e296af1b98f1912a19d5f91066be7ea85836e4

show more ...

Merge "tools: Small improvement to print_memory_map script" into integration

cert_create: Define the dualroot CoT

Selection of the chain of trust is done through the COT build option:

> make COT=dualroot

Change-Id: Id87c7a5116bdd13bdb29645ecf31d111ad094c1e
Signed-off-by: S

cert_create: Define the dualroot CoT

Selection of the chain of trust is done through the COT build option:

> make COT=dualroot

Change-Id: Id87c7a5116bdd13bdb29645ecf31d111ad094c1e
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

show more ...