fix: make TF-A use provided OpenSSL binary

Currently Tf-A uses whatever openssl binary is on the system to sign
images. However if OPENSSL_DIR is specified in the build flags this can
lead to linking issues as the system binary can end up being linked
against shared libraries provided in OPENSSL_DIR/lib if both binaries
(the system's and the on in OPENSSL_DIR/bin) are the same version.
This patch ensures that the binary used is always the one given by
OPENSSL_DIR to avoid those link issues.

Signed-off-by: Salome Thirot <salome.thirot@arm.com>
Change-Id: Ib534e06ebc8482e4391e376d3791a87968de4a99

diff --git a/make_helpers/defaults.mk b/make_helpers/defaults.mk
index fab6bf6dae42a3819581b7bb7d4eb4ec543bd324..a3ab6c205706766fcf3524c8662cd2a0c1cb8d0d 100644 (file)
--- a/make_helpers/defaults.mk
+++ b/make_helpers/defaults.mk
@@ -415,6 +415,13 @@ COT_DESC_IN_DTB                    := 0
 # Build option to provide openssl directory path
 OPENSSL_DIR                    := /usr
 
+# Select the openssl binary provided in OPENSSL_DIR variable
+ifeq ("$(wildcard ${OPENSSL_DIR}/bin)", "")
+    OPENSSL_BIN_PATH = ${OPENSSL_DIR}/apps
+else
+    OPENSSL_BIN_PATH = ${OPENSSL_DIR}/bin
+endif
+
 # Build option to use the SP804 timer instead of the generic one
 USE_SP804_TIMER                        := 0
 

diff --git a/plat/arm/board/common/board_common.mk b/plat/arm/board/common/board_common.mk
index b11811cd5ac3b5623c8df614a5db0cbd8bf7b0a1..1d0eb136ea5d9587d57e26c3bf8be0ee25b6b241 100644 (file)
--- a/plat/arm/board/common/board_common.mk
+++ b/plat/arm/board/common/board_common.mk
@@ -53,8 +53,8 @@ $(ARM_ROTPK_HASH) : $(HASH_PREREQUISITES)
 ifndef ROT_KEY
        $(error Cannot generate hash: no ROT_KEY defined)
 endif
-       openssl ${CRYPTO_ALG} -in $< -pubout -outform DER | openssl dgst \
-               -sha256 -binary > $@
+       ${OPENSSL_BIN_PATH}/openssl ${CRYPTO_ALG} -in $< -pubout -outform DER | \
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@
 
 # Certificate NV-Counters. Use values corresponding to tied off values in
 # ARM development platforms

diff --git a/plat/hisilicon/hikey/platform.mk b/plat/hisilicon/hikey/platform.mk
index 3e1771c66ab28114bf1fd90bca1ae4ecad6c3562..2bfc58281735aaab1e4c5e1750a21f599248da52 100644 (file)
--- a/plat/hisilicon/hikey/platform.mk
+++ b/plat/hisilicon/hikey/platform.mk
@@ -154,12 +154,12 @@ $(BUILD_PLAT)/bl2/hikey_rotpk.o: $(ROTPK_HASH)
 certificates: $(ROT_KEY)
 $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
-       $(Q)openssl genrsa 2048 > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null
 
 $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 endif
 
 # Enable workarounds for selected Cortex-A53 errata.

diff --git a/plat/hisilicon/hikey960/platform.mk b/plat/hisilicon/hikey960/platform.mk
index 608fe0937ab0ca650fd644191f97eef7e8e345da..c8ad66c6554bd004a6fbf02c065acd6598d561f7 100644 (file)
--- a/plat/hisilicon/hikey960/platform.mk
+++ b/plat/hisilicon/hikey960/platform.mk
@@ -146,12 +146,12 @@ $(BUILD_PLAT)/bl2/hikey960_rotpk.o: $(ROTPK_HASH)
 certificates: $(ROT_KEY)
 $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
-       $(Q)openssl genrsa 2048 > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null
 
 $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 endif
 
 # Enable workarounds for selected Cortex-A53 errata.

diff --git a/plat/imx/imx7/common/imx7.mk b/plat/imx/imx7/common/imx7.mk
index fdde9a9da2d73aca502faff2190f5eeabbd7f011..f4f5bfc0c3d50551a5327c379ff9c975a06588fb 100644 (file)
--- a/plat/imx/imx7/common/imx7.mk
+++ b/plat/imx/imx7/common/imx7.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2018-2020, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2018-2022, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -80,13 +80,13 @@ certificates: $(ROT_KEY)
 $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
        @if [ ! -f $(ROT_KEY) ]; then \
-               openssl genrsa 2048 > $@ 2>/dev/null; \
+               ${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null; \
        fi
 
 $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 endif
 
 # Add the build options to pack BLx images and kernel device tree

diff --git a/plat/imx/imx8m/imx8mm/platform.mk b/plat/imx/imx8m/imx8mm/platform.mk
index 1c6c9f806fe5519eca5636ec99dcf5ab64cb213f..e3e5c0c5a53479b896e711631148356fe2ff8899 100644 (file)
--- a/plat/imx/imx8m/imx8mm/platform.mk
+++ b/plat/imx/imx8m/imx8mm/platform.mk
@@ -132,13 +132,13 @@ certificates: $(ROT_KEY)
 $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
        @if [ ! -f $(ROT_KEY) ]; then \
-               openssl genrsa 2048 > $@ 2>/dev/null; \
+               ${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null; \
        fi
 
 $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 endif
 
 USE_COHERENT_MEM       :=      1

diff --git a/plat/imx/imx8m/imx8mp/platform.mk b/plat/imx/imx8m/imx8mp/platform.mk
index 45f29728b798f256ef34b8a78e04aae4a540758b..e8669e5f844754468855a1c69605413e0f342856 100644 (file)
--- a/plat/imx/imx8m/imx8mp/platform.mk
+++ b/plat/imx/imx8m/imx8mp/platform.mk
@@ -129,13 +129,13 @@ certificates: $(ROT_KEY)
 $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
        @if [ ! -f $(ROT_KEY) ]; then \
-               openssl genrsa 2048 > $@ 2>/dev/null; \
+               ${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null; \
        fi
 
 $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 endif
 
 USE_COHERENT_MEM       :=      1

diff --git a/plat/marvell/armada/a3k/common/a3700_common.mk b/plat/marvell/armada/a3k/common/a3700_common.mk
index d0e86886aea3075750032f7793a8b8fb31477059..55472016ed01ef4a95f86e8fa5bdf5359ead9284 100644 (file)
--- a/plat/marvell/armada/a3k/common/a3700_common.mk
+++ b/plat/marvell/armada/a3k/common/a3700_common.mk
@@ -205,12 +205,12 @@ ifeq ($(MARVELL_SECURE_BOOT),1)
        @$(ECHO_BLANK_LINE)
        $(Q)cp $(BUILD_PLAT)/wtmi.bin $(BUILD_PLAT)/wtmi-align.bin
        $(Q)truncate -s %16 $(BUILD_PLAT)/wtmi-align.bin
-       $(Q)openssl enc -aes-256-cbc -e -in $(BUILD_PLAT)/wtmi-align.bin \
+       $(Q)${OPENSSL_BIN_PATH}/openssl enc -aes-256-cbc -e -in $(BUILD_PLAT)/wtmi-align.bin \
        -out $(BUILD_PLAT)/$(WTMI_ENC_IMG) \
        -K `cat $(IMAGESPATH)/aes-256.txt` -nosalt \
        -iv `cat $(IMAGESPATH)/iv.txt` -p
        $(Q)truncate -s %16 $(BUILD_PLAT)/$(BOOT_IMAGE);
-       $(Q)openssl enc -aes-256-cbc -e -in $(BUILD_PLAT)/$(BOOT_IMAGE) \
+       $(Q)${OPENSSL_BIN_PATH}/openssl enc -aes-256-cbc -e -in $(BUILD_PLAT)/$(BOOT_IMAGE) \
        -out $(BUILD_PLAT)/$(BOOT_ENC_IMAGE) \
        -K `cat $(IMAGESPATH)/aes-256.txt` -nosalt \
        -iv `cat $(IMAGESPATH)/iv.txt` -p

diff --git a/plat/nxp/common/tbbr/tbbr.mk b/plat/nxp/common/tbbr/tbbr.mk
index 7edcfbc8ce609ed3e8826e1206cf3037e804a17a..4aac9d6343217ca1393c75d18c1b6dd2e404aaa0 100644 (file)
--- a/plat/nxp/common/tbbr/tbbr.mk
+++ b/plat/nxp/common/tbbr/tbbr.mk
@@ -133,13 +133,13 @@ else
     $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
        @if [ ! -f $(ROT_KEY) ]; then \
-               openssl genrsa 2048 > $@ 2>/dev/null; \
+               ${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null; \
        fi
 
     $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 
 endif #MBEDTLS_DIR
 

diff --git a/plat/qemu/qemu/platform.mk b/plat/qemu/qemu/platform.mk
index 8e7f7c82532c4d306810aef8ee3cda30ba127605..e0b52710e453b9503f15f8af674fb3eb1b70e1fc 100644 (file)
--- a/plat/qemu/qemu/platform.mk
+++ b/plat/qemu/qemu/platform.mk
@@ -88,12 +88,12 @@ ifneq (${TRUSTED_BOARD_BOOT},0)
 
     $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
-       $(Q)openssl genrsa 2048 > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null
 
     $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 endif
 
 # Include Measured Boot makefile before any Crypto library makefile.

diff --git a/plat/rpi/rpi3/platform.mk b/plat/rpi/rpi3/platform.mk
index 6c239230d9fd111ebf4cb4ecd73f0d068f9ba888..53c97e225d3578fdcc509bd901763b39547c881c 100644 (file)
--- a/plat/rpi/rpi3/platform.mk
+++ b/plat/rpi/rpi3/platform.mk
@@ -212,10 +212,10 @@ ifneq (${TRUSTED_BOARD_BOOT},0)
 
     $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
-       $(Q)openssl genrsa 2048 > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null
 
     $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 endif

diff --git a/plat/socionext/synquacer/platform.mk b/plat/socionext/synquacer/platform.mk
index 3eab3d6e3afcfaa39b43d76f9dea978465ed6b55..b76ae8841860359703ac72f8096d732339ecb866 100644 (file)
--- a/plat/socionext/synquacer/platform.mk
+++ b/plat/socionext/synquacer/platform.mk
@@ -73,12 +73,12 @@ $(BUILD_PLAT)/bl2/sq_rotpk.o: $(ROTPK_HASH)
 certificates: $(ROT_KEY)
 $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
-       $(Q)openssl genrsa 2048 > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null
 
 $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 
 endif  # TRUSTED_BOARD_BOOT
 endif

diff --git a/plat/socionext/uniphier/platform.mk b/plat/socionext/uniphier/platform.mk
index 6edd181f4080489b0cd56ddfeddffe93d61fc436..378497aefcbda0d4f1eb16d0cf4b7d1c892a4945 100644 (file)
--- a/plat/socionext/uniphier/platform.mk
+++ b/plat/socionext/uniphier/platform.mk
@@ -107,12 +107,12 @@ $(BUILD_PLAT)/bl2/uniphier_rotpk.o: $(ROTPK_HASH)
 certificates: $(ROT_KEY)
 $(ROT_KEY): | $(BUILD_PLAT)
        @echo "  OPENSSL $@"
-       $(Q)openssl genrsa 2048 > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl genrsa 2048 > $@ 2>/dev/null
 
 $(ROTPK_HASH): $(ROT_KEY)
        @echo "  OPENSSL $@"
-       $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
-       openssl dgst -sha256 -binary > $@ 2>/dev/null
+       $(Q)${OPENSSL_BIN_PATH}/openssl rsa -in $< -pubout -outform DER 2>/dev/null |\
+       ${OPENSSL_BIN_PATH}/openssl dgst -sha256 -binary > $@ 2>/dev/null
 
 endif