[PATCH 3/4] avb: add board-specific root key provider

[Igor Opaniuk <igor.opaniuk@gmail.com>]

The strongest anchor for the root of trust is a key hash burned into
hardware (OTP/eFuse), which is inherently SoC-specific and cannot live in
common code. Give boards a hook to supply it from wherever their hardware
keeps it.

The default is deliberately fail-closed: a board that has not wired up a
provider refuses verification rather than silently trusting whatever key it
is handed. A misconfiguration should stop the boot, not quietly weaken it.

Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
---
 common/Kconfig      |  9 +++++++++
 common/avb_verify.c | 13 +++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/common/Kconfig b/common/Kconfig
index 094635bfe57..110eaa0d004 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -929,6 +929,15 @@ config AVB_ROOT_KEY_TEE
 	  The digest must be provisioned into the TEE beforehand. Integrity is
 	  provided by the TEE's (RPMB-backed) storage.
 
+config AVB_ROOT_KEY_BOARD
+	bool "SoC/board specific provider (weak function)"
+	help
+	  Obtain the trusted root key digest from a board/SoC specific strong
+	  definition of avb_read_root_key_digest() (for example reading a hash
+	  fused into OTP/eFuse). The default weak implementation fails closed,
+	  so a board that forgets to override it will refuse verification
+	  rather than silently trust a wrong key.
+
 endchoice
 
 config AVB_ROOT_KEY_TEE_NAME
diff --git a/common/avb_verify.c b/common/avb_verify.c
index b8b99628180..b96cd1ebd7b 100644
--- a/common/avb_verify.c
+++ b/common/avb_verify.c
@@ -1091,6 +1091,19 @@ AvbIOResult avb_read_root_key_digest(AvbOps *ops, uint8_t *digest)
 
 	return AVB_IO_RESULT_OK;
 }
+#else /* CONFIG_AVB_ROOT_KEY_BOARD */
+/*
+ * Weak, fail-closed default. A board/SoC selecting CONFIG_AVB_ROOT_KEY_BOARD
+ * must provide a strong avb_read_root_key_digest() (e.g. reading a hash fused
+ * into OTP/eFuse). If it does not, verification fails rather than silently
+ * trusting a wrong key.
+ */
+__weak AvbIOResult avb_read_root_key_digest(AvbOps *ops, uint8_t *digest)
+{
+	printf("%s: board root key provider not implemented\n", __func__);
+
+	return AVB_IO_RESULT_ERROR_NO_SUCH_VALUE;
+}
 #endif
 
 /**

-- 
2.53.0