Update makefile to build fiptool for Windows ...

Although support for building fiptool on a Windows host was present,
the binary was not built when the top level makefile was invoked.

This patch makes the necessary changes to the to support building of
fiptool on a Windows host PC from the main makefile.

Change-Id: I0c01ba237fa3010a027a1b324201131210cf4d7c
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>

Fix fiptool packaging issue on windows ...

Windows does not have a standard getopt implementation. To address
this an equivalent implementation has been provided in win_posix.c
However, the implementation has an issue with option processing as
described below.

Long option names may be abbreviated if the abbreviation is unique
or an exact match for some defined option.
Since some options can be substring of other options e.g. "scp-fw"
option is a substring of "scp-fwu-cfg", we need to identify if an
option is abbreviated and also check for uniqueness. Otherwise if
a user passes --scp-fw as an option, the "scp-fwu-cfg" option may
get selected, resulting in an incorrectly packaged FIP.

This issue has been be fixed by:
  - First searching for an exact match.
  - If exact match was not found search for a abbreviated match.
By doing this an incorrect option selection can be avoided.

Change-Id: I22f4e7a683f3df857f5b6f0783bf9b03a64a0bcc
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>

tools: Set the tool's default binary name ...

This patch: fafd3ec9c assumes that tools must build from
the main makefile folder.
This assumption leads to the error when somebody wants to
build a tool from the tool's folder.
Hence changes are done to provide the default binary name
in the tool's makefile.

Change-Id: Iae570a7f8d322151376b6feb19e739300eecc3fc
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

tools: Get the tool's binary name from the main makefile ...

Currently, the tool's makefile override the tool's binary name
which is already been defined in the main makefile.
Hence fix is provided so that the tool's makefile get the tool's
binary name from the main makefile instead of overriding it.

Change-Id: I8af2bd391a96bba2dbcddef711338a94ebf5f038
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

SPM: Alter sp_gen.mk entry depending on owner of partition ...

With recently introduced dualroot CoT for SPs where they are owned
either by SiP or by Platform. SiP owned SPs index starts at SP_PKG1_ID
while Plat owned SPs index starts at SP_PKG5_ID.

This patch modifies SP makefile generator script to take CoT as an
argument and if it is "dualroot" then generates SP_PKG in order
mentioned above, otherwise generates it sequentially.

Signed-off-by: Ruari Phipps <ruari.phipps@arm.com>
Change-Id: Iffad1131787be650a9462f6f8cc09b603cddb3b8

cert_create: add Platform owned secure partitions support ...

Add support to generate a certificate named "plat-sp-cert" for Secure
Partitions(SP) owned by Platform.
Earlier a single certificate file "sip-sp-cert" was generated which
contained hash of all 8 SPs, with this change SPs are divided into
two categories viz "SiP owned" and "Plat owned" containing 4 SPs each.

Platform RoT key pair is used for signing.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I5bd493cfce4cf3fc14b87c8ed1045f633d0c92b6

Use abspath to dereference $BUILD_BASE ...

If the user tries to change BUILD_BASE to put the build products outside
the build tree the compile will fail due to hard coded assumptions that
$BUILD_BASE is a relative path. Fix by using $(abspath $(BUILD_BASE))
to rationalize to an absolute path every time and remove the relative
path assumptions.

This patch also adds documentation that BUILD_BASE can be specified by
the user.

Signed-off-by: Grant Likely <grant.likely@arm.com>
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ib1af874de658484aaffc672f30029b852d2489c8

Merge "fiptool: return zero status on help and help <command>" into integration

tools: doimage: change the binary image alignment to 16 ...

Change the binary image alignment from 4 to 16.
The PKCS signature verification fails for unaligned images.

Change-Id: Ieb08dc3ea128790f542ad93e3c948117567a65af
Signed-off-by: Konstantin Porotchkin <kostap@marvell.com>

tools: doimage: migrate to mbedtls v2.8 APIs ...

Replace deprecated mbedtls_sha256 with mbedtls_sha256_ret
The mbedtls_pk_parse_key does not work correctly anymore
with the DER buffer embedded in the secure image extentson
using the buffer size as the the key length.
Move to mbedtls_pk_parse_subpubkey API that handles such
case correctly.
The DER format already contains the key length, so there
is no particular reason to supply it to the key parser.
Update the doimage version to 3.3

Change-Id: I0ec5ee84b7d1505b43138e0b7a6bdba44a6702b6
Signed-off-by: Konstantin Porotchkin <kostap@marvell.com>

fiptool: return zero status on help and help <command> ...

Querying the 'fiptool' for help or help <command> should return 0
return status (success) and not 1 (failure). In the other hand, if tool is
executed with any other command (not help) where command's parameters are
either missing or wrong, then the tool should return non-zero (failure). Now,
the 'usage' function caller is the one that passes the return status.

Change-Id: Id5eea91037cd810fb1e34a42e8199ef504f5daa4
Signed-off-by: Leonardo Sandoval <leonardo.sandoval@linaro.org>

cert_tool: Update cert_tool for fw_config image support ...

Updated cert_tool to add hash information of fw_config image into
the existing "trusted boot fw" certificate.

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I720319225925806a2a9f50a1ac9c8a464be975f0

fiptool: Add fw_config in FIP ...

Added support in fiptool to include fw_config image
in FIP.

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: Ibbd14723a4141598d9d7f6bfcf88a0ef92cf87bc

cert_create: extend Secure partition support for tbbr CoT ...

with sha 0792dd7, support to generate certificate for Secure
Partitions was added for dualroot CoT only, this patch extends
this support for tbbr CoT.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I451c0333536dd1cbe17861d454bdb0dc7a17c63f

sptool: append cert_tool arguments. ...

To support secure boot of SP's update cert tool arguments while
generating sp_gen.mk which in turn is consumed by build system.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I2293cee9b7c684c27d387aba18e0294c701fb1cc

cert_create: add SiP owned secure partitions support ...

Add support to generate certificate "sip-sp-cert" for Secure
Partitions(SP) owned by Silicon provider(SiP).
To avoid deviation from TBBR specification the support is only added for
dualroot CoT and not for TBBR CoT.

A single certificate file is generated containing hash of individual
packages. Maximum 8 secure partitions are supported.

Following new options added to cert_tool:
 --sip-sp-cert --> SiP owned Secure Partition Content Certificate
 --sp-pkg1 --> Secure Partition Package1 file
 --sp-pkg2
 .....
 --sp-pkg8

Trusted world key pair is used for signing.

Going forward, this feature can be extended for Platfrom owned
Partitions, if required.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ia6dfbc1447cfb41b1fcbd12cf2bf7b88f409bd8d

Merge changes from topic "sb/dualroot" into integration ...

* changes:
  Build system: Changes to drive cert_create for dualroot CoT
  cert_create: Define the dualroot CoT
  Introduce a new "dualroot" chain of trust

tools: Add firmware authenticated encryption tool ...

Add firmware authenticated encryption tool which utilizes OpenSSL
library to encrypt firmwares using a key provided via cmdline. Currently
this tool supports AES-GCM as an authenticated encryption algorithm.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I60e296af1b98f1912a19d5f91066be7ea85836e4

Merge "tools: Small improvement to print_memory_map script" into integration

cert_create: Define the dualroot CoT ...

Selection of the chain of trust is done through the COT build option:

> make COT=dualroot

Change-Id: Id87c7a5116bdd13bdb29645ecf31d111ad094c1e
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

SPMD: generate and add Secure Partition blobs into FIP ...

Till now TF-A allows limited number of external images to be made part
of FIP. With SPM coming along, there may exist multiple SP packages
which need to be inserted into FIP. To achieve this we need a more
scalable approach to feed SP packages to FIP.

This patch introduces changes in build system to generate and add SP
packages into FIP based on information provided by platform.
Platform provides information in form of JSON which contains layout
description of available Secure Partitions.
JSON parser script is invoked by build system early on and generates
a makefile which updates FIP, SPTOOL and FDT arguments which will be
used by build system later on for final packaging.

"SP_LAYOUT_FILE" passed as a build argument and can be outside of TF-A
tree. This option will be used only when SPD=spmd.

For each SP, generated makefile will have following entries
     - FDT_SOURCES	+=	sp1.dts
     - SPTOOL_ARGS	+= 	-i sp1.img:sp1.dtb -o sp1.pkg
     - FIP_ARGS		+=	--blob uuid=XXXX-XXX...,file=SP1.pkg

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ib6a9c064400caa3cd825d9886008a3af67741af7

tools: Small improvement to print_memory_map script ...

This patch:
- Add the __COHERENT_RAM_START__ and __COHERENT_RAM_END__ symbols.
- Improve how the symbols are found with a regex.
- Add a build option to revert the memory layout output.

Change-Id: I54ec660261431bc98d78acb0f80e3d95bc5397ac
Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>

SPM: modify sptool to generate individual SP blobs ...

Currently sptool generates a single blob containing all the Secure
Partitions, with latest SPM implementation, it is desirable to have
individual blobs for each Secure Partition. It allows to leverage
packaging and parsing of SP on existing FIP framework. It also allows
SP packages coming from different sources.

This patch modifies sptool so that it takes number of SP payload pairs
as input and generates number of SP blobs instead of a single blob.

Each SP blob can optionally have its own header containing offsets and
sizes of different payloads along with a SP magic number and version.
It is also associated in FIP with a UUID, provided by SP owner.

Usage example:
sptool -i sp1.bin:sp1.dtb -o sp1.pkg -i sp2.bin:sp2.dtb -o sp2.pkg ...

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ie2db8e601fa1d4182d0a1d22e78e9533dce231bc

cert_create: Remove references to TBBR in common code ...

In preparation of supporting alternate chains of trust, reword comments
and error messages that explicitly mentioned TBBR.

Change-Id: I85a0b08e16d0cd82f3b767fcc092d1f20f45939f
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

cert_create: Introduce COT build option ...

It allows to select the desired chain of trust. Right now, only the TBBR
CoT is available.

At this stage, this build option only affects the tool itself. It is not
plugged into the rest of the build system yet. To use it:

 > make -C tools/cert_create COT=tbbr

Change-Id: I4484418f76d3c7b330d8653c978499a181534dcd
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

cert_create: Introduce TBBR CoT makefile ...

Move all TBBR-specific stuff out of the tool's makefile into a
sub-makefile. This will make it easier to define and select an alternate
chain of trust in the future.

Change-Id: I92e366a1999b74cf51127d1771b64b807cd94b29
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

cert_create: Remove some unused header files inclusions ...

The chain of trust definitions are only needed in the part of the code
dealing with the TBBR CoT (tbbr/* files).

Change-Id: I6f9a86bba4a2d16313b6842a3ec85b7c951074bc
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

tools: Add show_memory script ...

show_memory is a simple tools that parse the blx.map files and print a
representation of the memory layout for the latest build.
This representation is based on standard symbols present on the map
files as: __TEXT_START/END__, __RODATA_START/END__, __STACKS_START/END__
, etc..

Change-Id: Iba3e301a1a9fee9a35abf1afdb69093617d33929
Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>

Remove RSA PKCS#1 v1.5 support from cert_tool ...

Support for PKCS#1 v1.5 was deprecated in SHA 1001202 and fully removed
in SHA fe199e3, however, cert_tool is still able to generate
certificates in that form. This patch fully removes the ability for
cert_tool to generate these certificates.

Additionally, this patch also fixes a bug where the issuing certificate
was a RSA and the issued certificate was EcDSA. In this case, the issued
certificate would be signed using PKCS#1 v1.5 instead of RSAPSS per
PKCS#1 v2.1, preventing TF-A from verifying the image signatures. Now
that PKCS#1 v1.5 support is removed, all certificates that are signed
with RSA now use the more modern padding scheme.

Change-Id: Id87d7d915be594a1876a73080528d968e65c4e9a
Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>

Add cert_create tool support for RSA key sizes ...

cert_tool is now able to accept a command line option for specifying the
key size. It now supports the following options: 1024, 2048 (default),
3072 and 4096. This is also modifiable by TFA using the build flag
KEY_SIZE.

Change-Id: Ifadecf84ade3763249ee8cc7123a8178f606f0e5
Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>