LM
/
u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[iot] Return full zero hash if fuse not initialized 

Part of permanent attributes hash was stored in
fuse for security reason, however, the write
operation of fuse was disabled by default because
it was an irreversible operation. Returning
AVB_IO_RESULT_ERROR_IO will stop following
AVB process and won't pass dm-verity related
commandlines to kernel, in such case, board
will fail to boot even in unlock state.

Returning AVB_IO_RESULT_OK and full zero
permanent attributes hash when the fuse
haven't been initialized, let the lock/unlock
policy in libavb to handle the mismatch errors.

Test: imx7d_pico boot successfully with dm-verity feature.

Change-Id: I6bcf58ff8ce71859fa2d85c86572ea6de1c3a0df
Signed-off-by: Luo Ji <ji.luo@nxp.com>
This commit is contained in:
Luo Ji 2018-05-23 14:34:33 +08:00 committed by Ji Luo
parent aceb62dbfb
commit d2275a5926
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/avb/fsl/fsl_avbkey.c
View File

@ -1162,13 +1162,16 @@ AvbIOResult fsl_read_permanent_attributes_hash(
if (permanent_attributes_sha256_hash(sha256_hash_buf) != RESULT_OK) { if (permanent_attributes_sha256_hash(sha256_hash_buf) != RESULT_OK) {
return AVB_IO_RESULT_ERROR_IO; return AVB_IO_RESULT_ERROR_IO;
} }
/* check if the sha256(permanent attributes) hash match */ /* check if the sha256(permanent attributes) hash match the calculated one,
* if not match, just return all zeros hash.
*/
if (memcmp(sha256_hash_fuse, sha256_hash_buf, ATX_HASH_LENGTH)) { if (memcmp(sha256_hash_fuse, sha256_hash_buf, ATX_HASH_LENGTH)) {
printf("ERROR - sha256(permanent attributes) does not match\n"); printf("ERROR - sha256(permanent attributes) does not match\n");
return AVB_IO_RESULT_ERROR_IO; memset(hash, 0, AVB_SHA256_DIGEST_SIZE);
} else {
memcpy(hash, sha256_hash_buf, AVB_SHA256_DIGEST_SIZE);
} }
memcpy(hash, sha256_hash_buf, AVB_SHA256_DIGEST_SIZE);
return AVB_IO_RESULT_OK; return AVB_IO_RESULT_OK;
} }