diff options
| author | Luo Ji <ji.luo@nxp.com> | 2018-05-23 14:34:33 +0800 |
|---|---|---|
| committer | Ji Luo <ji.luo@nxp.com> | 2018-08-20 21:25:44 +0800 |
| commit | d2275a5926ac2ff7e9f656ac7803de010b51e870 (patch) | |
| tree | b42c880201e3ff7d573c825b59c7a87a113252f1 /lib | |
| parent | aceb62dbfb1c5ecd17a46ca11e39db77ce1ba680 (diff) | |
[iot] Return full zero hash if fuse not initialized
Part of permanent attributes hash was stored in
fuse for security reason, however, the write
operation of fuse was disabled by default because
it was an irreversible operation. Returning
AVB_IO_RESULT_ERROR_IO will stop following
AVB process and won't pass dm-verity related
commandlines to kernel, in such case, board
will fail to boot even in unlock state.
Returning AVB_IO_RESULT_OK and full zero
permanent attributes hash when the fuse
haven't been initialized, let the lock/unlock
policy in libavb to handle the mismatch errors.
Test: imx7d_pico boot successfully with dm-verity feature.
Change-Id: I6bcf58ff8ce71859fa2d85c86572ea6de1c3a0df
Signed-off-by: Luo Ji <ji.luo@nxp.com>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/avb/fsl/fsl_avbkey.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/lib/avb/fsl/fsl_avbkey.c b/lib/avb/fsl/fsl_avbkey.c index 81e6549c5c..b12ed5cdcf 100644 --- a/lib/avb/fsl/fsl_avbkey.c +++ b/lib/avb/fsl/fsl_avbkey.c @@ -1162,13 +1162,16 @@ AvbIOResult fsl_read_permanent_attributes_hash( if (permanent_attributes_sha256_hash(sha256_hash_buf) != RESULT_OK) { return AVB_IO_RESULT_ERROR_IO; } - /* check if the sha256(permanent attributes) hash match */ + /* check if the sha256(permanent attributes) hash match the calculated one, + * if not match, just return all zeros hash. + */ if (memcmp(sha256_hash_fuse, sha256_hash_buf, ATX_HASH_LENGTH)) { printf("ERROR - sha256(permanent attributes) does not match\n"); - return AVB_IO_RESULT_ERROR_IO; + memset(hash, 0, AVB_SHA256_DIGEST_SIZE); + } else { + memcpy(hash, sha256_hash_buf, AVB_SHA256_DIGEST_SIZE); } - memcpy(hash, sha256_hash_buf, AVB_SHA256_DIGEST_SIZE); return AVB_IO_RESULT_OK; } |