1 // SPDX-License-Identifier: GPL-2.0+
3 * (C) Copyright 2018, Linaro Limited
6 #include <avb_verify.h>
13 #define AVB_BOOTARGS "avb_bootargs"
15 static struct AvbOps
*avb_ops
;
17 int do_avb_init(struct cmd_tbl
*cmdtp
, int flag
, int argc
, char *const argv
[])
19 unsigned long mmc_dev
;
24 mmc_dev
= hextoul(argv
[1], NULL
);
27 avb_ops_free(avb_ops
);
29 avb_ops
= avb_ops_alloc(mmc_dev
);
31 return CMD_RET_SUCCESS
;
33 printf("Can't allocate AvbOps");
35 printf("Failed to initialize AVB\n");
37 return CMD_RET_FAILURE
;
40 int do_avb_read_part(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
45 size_t bytes
, bytes_read
= 0;
50 printf("AVB is not initialized, please run 'avb init <id>'\n");
51 return CMD_RET_FAILURE
;
58 offset
= hextoul(argv
[2], NULL
);
59 bytes
= hextoul(argv
[3], NULL
);
60 buffer
= (void *)hextoul(argv
[4], NULL
);
62 ret
= avb_ops
->read_from_partition(avb_ops
, part
, offset
,
63 bytes
, buffer
, &bytes_read
);
64 if (ret
== AVB_IO_RESULT_OK
) {
65 printf("Read %zu bytes\n", bytes_read
);
66 return CMD_RET_SUCCESS
;
69 printf("Failed to read from partition '%s', err = %d\n",
72 return CMD_RET_FAILURE
;
75 int do_avb_read_part_hex(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
80 size_t bytes
, bytes_read
= 0;
85 printf("AVB is not initialized, please run 'avb init <id>'\n");
86 return CMD_RET_FAILURE
;
93 offset
= hextoul(argv
[2], NULL
);
94 bytes
= hextoul(argv
[3], NULL
);
96 buffer
= malloc(bytes
);
98 printf("Failed to tlb_allocate buffer for data\n");
99 return CMD_RET_FAILURE
;
101 memset(buffer
, 0, bytes
);
103 ret
= avb_ops
->read_from_partition(avb_ops
, part
, offset
,
104 bytes
, buffer
, &bytes_read
);
105 if (ret
== AVB_IO_RESULT_OK
) {
106 printf("Requested %zu, read %zu bytes\n", bytes
, bytes_read
);
108 for (int i
= 0; i
< bytes_read
; i
++)
109 printf("%02X", buffer
[i
]);
114 return CMD_RET_SUCCESS
;
117 printf("Failed to read from partition '%s', err = %d\n",
121 return CMD_RET_FAILURE
;
124 int do_avb_write_part(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
134 printf("AVB is not initialized, please run 'avb init <id>'\n");
135 return CMD_RET_FAILURE
;
139 return CMD_RET_USAGE
;
142 offset
= hextoul(argv
[2], NULL
);
143 bytes
= hextoul(argv
[3], NULL
);
144 buffer
= (void *)hextoul(argv
[4], NULL
);
146 ret
= avb_ops
->write_to_partition(avb_ops
, part
, offset
,
148 if (ret
== AVB_IO_RESULT_OK
) {
149 printf("Wrote %zu bytes\n", bytes
);
150 return CMD_RET_SUCCESS
;
153 printf("Failed to write in partition '%s', err = %d\n",
156 return CMD_RET_FAILURE
;
159 int do_avb_read_rb(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
167 printf("AVB is not initialized, please run 'avb init <id>'\n");
168 return CMD_RET_FAILURE
;
172 return CMD_RET_USAGE
;
174 index
= (size_t)hextoul(argv
[1], NULL
);
176 ret
= avb_ops
->read_rollback_index(avb_ops
, index
, &rb_idx
);
177 if (ret
== AVB_IO_RESULT_OK
) {
178 printf("Rollback index: %llx\n", rb_idx
);
179 return CMD_RET_SUCCESS
;
182 printf("Failed to read rollback index id = %zu, err = %d\n",
185 return CMD_RET_FAILURE
;
188 int do_avb_write_rb(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
196 printf("AVB is not initialized, please run 'avb init <id>'\n");
197 return CMD_RET_FAILURE
;
201 return CMD_RET_USAGE
;
203 index
= (size_t)hextoul(argv
[1], NULL
);
204 rb_idx
= hextoul(argv
[2], NULL
);
206 ret
= avb_ops
->write_rollback_index(avb_ops
, index
, rb_idx
);
207 if (ret
== AVB_IO_RESULT_OK
)
208 return CMD_RET_SUCCESS
;
210 printf("Failed to write rollback index id = %zu, err = %d\n",
213 return CMD_RET_FAILURE
;
216 int do_avb_get_uuid(struct cmd_tbl
*cmdtp
, int flag
,
217 int argc
, char *const argv
[])
220 char buffer
[UUID_STR_LEN
+ 1];
224 printf("AVB is not initialized, please run 'avb init <id>'\n");
225 return CMD_RET_FAILURE
;
229 return CMD_RET_USAGE
;
233 ret
= avb_ops
->get_unique_guid_for_partition(avb_ops
, part
,
236 if (ret
== AVB_IO_RESULT_OK
) {
237 printf("'%s' UUID: %s\n", part
, buffer
);
238 return CMD_RET_SUCCESS
;
241 printf("Failed to read partition '%s' UUID, err = %d\n",
244 return CMD_RET_FAILURE
;
247 int do_avb_verify_part(struct cmd_tbl
*cmdtp
, int flag
,
248 int argc
, char *const argv
[])
250 const char * const requested_partitions
[] = {"boot", NULL
};
251 AvbSlotVerifyResult slot_result
;
252 AvbSlotVerifyData
*out_data
;
253 enum avb_boot_state boot_state
;
256 char *slot_suffix
= "";
259 bool unlocked
= false;
260 int res
= CMD_RET_FAILURE
;
263 printf("AVB is not initialized, please run 'avb init <id>'\n");
264 return CMD_RET_FAILURE
;
267 if (argc
< 1 || argc
> 2)
268 return CMD_RET_USAGE
;
271 slot_suffix
= argv
[1];
273 printf("## Android Verified Boot 2.0 version %s\n",
274 avb_version_string());
276 ret
= avb_ops
->read_is_device_unlocked(avb_ops
, &unlocked
);
277 if (ret
!= AVB_IO_RESULT_OK
) {
278 printf("Can't determine device lock state, err = %d\n",
280 return CMD_RET_FAILURE
;
284 avb_slot_verify(avb_ops
,
285 requested_partitions
,
288 AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE
,
292 * LOCKED devices with custom root of trust setup is not supported (YELLOW)
294 if (slot_result
== AVB_SLOT_VERIFY_RESULT_OK
) {
295 printf("Verification passed successfully\n");
298 * ORANGE state indicates that device may be freely modified.
299 * Device integrity is left to the user to verify out-of-band.
302 boot_state
= AVB_ORANGE
;
304 boot_state
= AVB_GREEN
;
306 /* export boot state to AVB_BOOTARGS env var */
307 extra_args
= avb_set_state(avb_ops
, boot_state
);
309 cmdline
= append_cmd_line(out_data
->cmdline
,
312 cmdline
= out_data
->cmdline
;
314 env_set(AVB_BOOTARGS
, cmdline
);
316 res
= CMD_RET_SUCCESS
;
318 printf("Verification failed, reason: %s\n", str_avb_slot_error(slot_result
));
322 avb_slot_verify_data_free(out_data
);
327 int do_avb_is_unlocked(struct cmd_tbl
*cmdtp
, int flag
,
328 int argc
, char *const argv
[])
334 printf("AVB is not initialized, please run 'avb init <id>'\n");
335 return CMD_RET_FAILURE
;
339 printf("--%s(-1)\n", __func__
);
340 return CMD_RET_USAGE
;
343 ret
= avb_ops
->read_is_device_unlocked(avb_ops
, &unlock
);
344 if (ret
== AVB_IO_RESULT_OK
) {
345 printf("Unlocked = %d\n", unlock
);
346 return CMD_RET_SUCCESS
;
349 printf("Can't determine device lock state, err = %d\n",
352 return CMD_RET_FAILURE
;
355 int do_avb_read_pvalue(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
366 printf("AVB is not initialized, please run 'avb init <id>'\n");
367 return CMD_RET_FAILURE
;
371 return CMD_RET_USAGE
;
374 bytes
= dectoul(argv
[2], &endp
);
375 if (*endp
&& *endp
!= '\n')
376 return CMD_RET_USAGE
;
378 buffer
= malloc(bytes
);
380 return CMD_RET_FAILURE
;
382 ret
= avb_ops
->read_persistent_value(avb_ops
, name
, bytes
,
383 buffer
, &bytes_read
);
384 if (ret
== AVB_IO_RESULT_OK
) {
385 printf("Read %zu bytes, value = %s\n", bytes_read
,
388 return CMD_RET_SUCCESS
;
391 printf("Failed to read persistent value, err = %d\n", ret
);
395 return CMD_RET_FAILURE
;
398 int do_avb_write_pvalue(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
406 printf("AVB is not initialized, please run 'avb init <id>'\n");
407 return CMD_RET_FAILURE
;
411 return CMD_RET_USAGE
;
416 ret
= avb_ops
->write_persistent_value(avb_ops
, name
,
418 (const uint8_t *)value
);
419 if (ret
== AVB_IO_RESULT_OK
) {
420 printf("Wrote %zu bytes\n", strlen(value
) + 1);
421 return CMD_RET_SUCCESS
;
424 printf("Failed to write persistent value `%s` = `%s`, err = %d\n",
427 return CMD_RET_FAILURE
;
430 static struct cmd_tbl cmd_avb
[] = {
431 U_BOOT_CMD_MKENT(init
, 2, 0, do_avb_init
, "", ""),
432 U_BOOT_CMD_MKENT(read_rb
, 2, 0, do_avb_read_rb
, "", ""),
433 U_BOOT_CMD_MKENT(write_rb
, 3, 0, do_avb_write_rb
, "", ""),
434 U_BOOT_CMD_MKENT(is_unlocked
, 1, 0, do_avb_is_unlocked
, "", ""),
435 U_BOOT_CMD_MKENT(get_uuid
, 2, 0, do_avb_get_uuid
, "", ""),
436 U_BOOT_CMD_MKENT(read_part
, 5, 0, do_avb_read_part
, "", ""),
437 U_BOOT_CMD_MKENT(read_part_hex
, 4, 0, do_avb_read_part_hex
, "", ""),
438 U_BOOT_CMD_MKENT(write_part
, 5, 0, do_avb_write_part
, "", ""),
439 U_BOOT_CMD_MKENT(verify
, 2, 0, do_avb_verify_part
, "", ""),
440 #ifdef CONFIG_OPTEE_TA_AVB
441 U_BOOT_CMD_MKENT(read_pvalue
, 3, 0, do_avb_read_pvalue
, "", ""),
442 U_BOOT_CMD_MKENT(write_pvalue
, 3, 0, do_avb_write_pvalue
, "", ""),
446 static int do_avb(struct cmd_tbl
*cmdtp
, int flag
, int argc
, char *const argv
[])
450 cp
= find_cmd_tbl(argv
[1], cmd_avb
, ARRAY_SIZE(cmd_avb
));
455 if (!cp
|| argc
> cp
->maxargs
)
456 return CMD_RET_USAGE
;
458 if (flag
== CMD_FLAG_REPEAT
)
459 return CMD_RET_FAILURE
;
461 return cp
->cmd(cmdtp
, flag
, argc
, argv
);
466 "Provides commands for testing Android Verified Boot 2.0 functionality",
467 "init <dev> - initialize avb2 for <dev>\n"
468 "avb read_rb <num> - read rollback index at location <num>\n"
469 "avb write_rb <num> <rb> - write rollback index <rb> to <num>\n"
470 "avb is_unlocked - returns unlock status of the device\n"
471 "avb get_uuid <partname> - read and print uuid of partition <part>\n"
472 "avb read_part <partname> <offset> <num> <addr> - read <num> bytes from\n"
473 " partition <partname> to buffer <addr>\n"
474 "avb read_part_hex <partname> <offset> <num> - read <num> bytes from\n"
475 " partition <partname> and print to stdout\n"
476 "avb write_part <partname> <offset> <num> <addr> - write <num> bytes to\n"
477 " <partname> by <offset> using data from <addr>\n"
478 #ifdef CONFIG_OPTEE_TA_AVB
479 "avb read_pvalue <name> <bytes> - read a persistent value <name>\n"
480 "avb write_pvalue <name> <value> - write a persistent value <name>\n"
482 "avb verify [slot_suffix] - run verification process using hash data\n"
483 " from vbmeta structure\n"
484 " [slot_suffix] - _a, _b, etc (if vbmeta partition is slotted)\n"