diff options
| author | Mary Ruthven <mruthven@chromium.org> | 2021-08-06 19:21:01 -0500 |
|---|---|---|
| committer | Commit Bot <commit-bot@chromium.org> | 2021-09-07 17:52:51 +0000 |
| commit | 1c3b00c3f7c0c819c330ddd98812d9085c578230 (patch) | |
| tree | 8fe3a82953dffe2b178a738e3e123be7d02071b5 /include | |
| parent | 519a3cf7cdef12437ae27a58d0dd70e12ca07278 (diff) | |
| download | chrome-ec-1c3b00c3f7c0c819c330ddd98812d9085c578230.tar.gz | |
add script to inject the fips fingerprint
Inject the fips fingerprint into the cr50 image, so it can verify the
fips module before starting to execute it. This change adds a script to
calculate the checksum and inject it into a elf file before signing.
If CONFIG_FIPS_CHECKSUM is defined, generate an elf file with the fips
checksum and use that to create signed images and hex files.
The build process doesn't change for RO artifacts. Nothing changes if
CONFIG_FIPS_CHECKSUM isn't defined.
The new chain for RW is
ec.RW.elf -> ec.RW.elf.fips -> ec.RW.flat
ec.RW.elf.fips is generated with util/inject_fips_fingerprint.sh.
util/inject_fips_fingerprint.sh calculates the fips module fingerprint,
copies ec.RW.elf to ec.RW.elf.fips, and then injects the fingerprint
into ec.RW.elf.fips.
util/signer/bs will be modified to use ec.RW.elf.fips if it exists in a
followup CL.
BUG=none
TEST=manual
# Verify cr50 is the only board that creates the fips artifacts
make buildall -j
objdump the text.fips_checksum section of ec.RW.elf and
ec.RW_B.elf. Make sure they match ec.RW.fips.checksum and
ec.RW_B.fips.checksum
# Verify cr50 can update to image signed with devid and that
# image shows Stored hash that matches the computed one.
H1_DEVIDS="${DEVID}" make -j BOARD=cr50 CR50_DEV=1
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Change-Id: Iab857ec1b7e3ae0d23681a25467e26286bd68210
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/3078053
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/config.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/config.h b/include/config.h index 8914c92725..475c56f13f 100644 --- a/include/config.h +++ b/include/config.h @@ -1360,6 +1360,8 @@ #undef CONFIG_DCRYPTO_BOARD /* Build FIPS utils in the module */ #undef CONFIG_FIPS_UTIL +/* Inject the fips checksum into the image. */ +#undef CONFIG_FIPS_CHECKSUM /* * This provides struct definitions and function declarations that can be * implemented by unit tests for testing code that depends on dcrypto. |