3 * (C) Copyright 2018, Linaro Limited
5 * SPDX-License-Identifier: GPL-2.0+
8 #include <avb_verify.h>
15 #define AVB_BOOTARGS "avb_bootargs"
16 static struct AvbOps
*avb_ops
;
18 int do_avb_init(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
20 unsigned long mmc_dev
;
25 mmc_dev
= simple_strtoul(argv
[1], NULL
, 16);
28 avb_ops_free(avb_ops
);
30 avb_ops
= avb_ops_alloc(mmc_dev
);
32 return CMD_RET_SUCCESS
;
34 printf("Failed to initialize avb2\n");
36 return CMD_RET_FAILURE
;
39 int do_avb_read_part(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
43 size_t bytes
, bytes_read
= 0;
47 printf("AVB 2.0 is not initialized, please run 'avb init'\n");
55 offset
= simple_strtoul(argv
[2], NULL
, 16);
56 bytes
= simple_strtoul(argv
[3], NULL
, 16);
57 buffer
= (void *)simple_strtoul(argv
[4], NULL
, 16);
59 if (avb_ops
->read_from_partition(avb_ops
, part
, offset
, bytes
,
60 buffer
, &bytes_read
) ==
62 printf("Read %zu bytes\n", bytes_read
);
63 return CMD_RET_SUCCESS
;
66 printf("Failed to read from partition\n");
68 return CMD_RET_FAILURE
;
71 int do_avb_read_part_hex(cmd_tbl_t
*cmdtp
, int flag
, int argc
,
76 size_t bytes
, bytes_read
= 0;
80 printf("AVB 2.0 is not initialized, please run 'avb init'\n");
88 offset
= simple_strtoul(argv
[2], NULL
, 16);
89 bytes
= simple_strtoul(argv
[3], NULL
, 16);
91 buffer
= malloc(bytes
);
93 printf("Failed to tlb_allocate buffer for data\n");
94 return CMD_RET_FAILURE
;
96 memset(buffer
, 0, bytes
);
98 if (avb_ops
->read_from_partition(avb_ops
, part
, offset
, bytes
, buffer
,
99 &bytes_read
) == AVB_IO_RESULT_OK
) {
100 printf("Requested %zu, read %zu bytes\n", bytes
, bytes_read
);
102 for (int i
= 0; i
< bytes_read
; i
++)
103 printf("%02X", buffer
[i
]);
108 return CMD_RET_SUCCESS
;
111 printf("Failed to read from partition\n");
114 return CMD_RET_FAILURE
;
117 int do_avb_write_part(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
125 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
126 return CMD_RET_FAILURE
;
130 return CMD_RET_USAGE
;
133 offset
= simple_strtoul(argv
[2], NULL
, 16);
134 bytes
= simple_strtoul(argv
[3], NULL
, 16);
135 buffer
= (void *)simple_strtoul(argv
[4], NULL
, 16);
137 if (avb_ops
->write_to_partition(avb_ops
, part
, offset
, bytes
, buffer
) ==
139 printf("Wrote %zu bytes\n", bytes
);
140 return CMD_RET_SUCCESS
;
143 printf("Failed to write in partition\n");
145 return CMD_RET_FAILURE
;
148 int do_avb_read_rb(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
154 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
155 return CMD_RET_FAILURE
;
159 return CMD_RET_USAGE
;
161 index
= (size_t)simple_strtoul(argv
[1], NULL
, 16);
163 if (avb_ops
->read_rollback_index(avb_ops
, index
, &rb_idx
) ==
165 printf("Rollback index: %llx\n", rb_idx
);
166 return CMD_RET_SUCCESS
;
169 printf("Failed to read rollback index\n");
171 return CMD_RET_FAILURE
;
174 int do_avb_write_rb(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
180 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
181 return CMD_RET_FAILURE
;
185 return CMD_RET_USAGE
;
187 index
= (size_t)simple_strtoul(argv
[1], NULL
, 16);
188 rb_idx
= simple_strtoul(argv
[2], NULL
, 16);
190 if (avb_ops
->write_rollback_index(avb_ops
, index
, rb_idx
) ==
192 return CMD_RET_SUCCESS
;
194 printf("Failed to write rollback index\n");
196 return CMD_RET_FAILURE
;
199 int do_avb_get_uuid(cmd_tbl_t
*cmdtp
, int flag
,
200 int argc
, char * const argv
[])
203 char buffer
[UUID_STR_LEN
+ 1];
206 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
207 return CMD_RET_FAILURE
;
211 return CMD_RET_USAGE
;
215 if (avb_ops
->get_unique_guid_for_partition(avb_ops
, part
, buffer
,
218 printf("'%s' UUID: %s\n", part
, buffer
);
219 return CMD_RET_SUCCESS
;
222 printf("Failed to read UUID\n");
224 return CMD_RET_FAILURE
;
227 int do_avb_verify_part(cmd_tbl_t
*cmdtp
, int flag
,
228 int argc
, char *const argv
[])
230 const char * const requested_partitions
[] = {"boot", NULL
};
231 AvbSlotVerifyResult slot_result
;
232 AvbSlotVerifyData
*out_data
;
235 char *slot_suffix
= "";
237 bool unlocked
= false;
238 int res
= CMD_RET_FAILURE
;
241 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
242 return CMD_RET_FAILURE
;
245 if (argc
< 1 || argc
> 2)
246 return CMD_RET_USAGE
;
249 slot_suffix
= argv
[1];
251 printf("## Android Verified Boot 2.0 version %s\n",
252 avb_version_string());
254 if (avb_ops
->read_is_device_unlocked(avb_ops
, &unlocked
) !=
256 printf("Can't determine device lock state.\n");
257 return CMD_RET_FAILURE
;
261 avb_slot_verify(avb_ops
,
262 requested_partitions
,
265 AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE
,
268 switch (slot_result
) {
269 case AVB_SLOT_VERIFY_RESULT_OK
:
270 /* Until we don't have support of changing unlock states, we
271 * assume that we are by default in locked state.
272 * So in this case we can boot only when verification is
273 * successful; we also supply in cmdline GREEN boot state
275 printf("Verification passed successfully\n");
277 /* export additional bootargs to AVB_BOOTARGS env var */
279 extra_args
= avb_set_state(avb_ops
, AVB_GREEN
);
281 cmdline
= append_cmd_line(out_data
->cmdline
,
284 cmdline
= out_data
->cmdline
;
286 env_set(AVB_BOOTARGS
, cmdline
);
288 res
= CMD_RET_SUCCESS
;
290 case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION
:
291 printf("Verification failed\n");
293 case AVB_SLOT_VERIFY_RESULT_ERROR_IO
:
294 printf("I/O error occurred during verification\n");
296 case AVB_SLOT_VERIFY_RESULT_ERROR_OOM
:
297 printf("OOM error occurred during verification\n");
299 case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA
:
300 printf("Corrupted dm-verity metadata detected\n");
302 case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION
:
303 printf("Unsupported version avbtool was used\n");
305 case AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX
:
306 printf("Checking rollback index failed\n");
308 case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED
:
309 printf("Public key was rejected\n");
312 printf("Unknown error occurred\n");
318 int do_avb_is_unlocked(cmd_tbl_t
*cmdtp
, int flag
,
319 int argc
, char * const argv
[])
324 printf("AVB not initialized, run 'avb init' first\n");
325 return CMD_RET_FAILURE
;
329 printf("--%s(-1)\n", __func__
);
330 return CMD_RET_USAGE
;
333 if (avb_ops
->read_is_device_unlocked(avb_ops
, &unlock
) ==
335 printf("Unlocked = %d\n", unlock
);
336 return CMD_RET_SUCCESS
;
339 printf("Can't determine device lock state.\n");
341 return CMD_RET_FAILURE
;
344 int do_avb_read_pvalue(cmd_tbl_t
*cmdtp
, int flag
, int argc
,
354 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
355 return CMD_RET_FAILURE
;
359 return CMD_RET_USAGE
;
362 bytes
= simple_strtoul(argv
[2], &endp
, 10);
363 if (*endp
&& *endp
!= '\n')
364 return CMD_RET_USAGE
;
366 buffer
= malloc(bytes
);
368 return CMD_RET_FAILURE
;
370 if (avb_ops
->read_persistent_value(avb_ops
, name
, bytes
, buffer
,
371 &bytes_read
) == AVB_IO_RESULT_OK
) {
372 printf("Read %zu bytes, value = %s\n", bytes_read
,
375 return CMD_RET_SUCCESS
;
378 printf("Failed to read persistent value\n");
382 return CMD_RET_FAILURE
;
385 int do_avb_write_pvalue(cmd_tbl_t
*cmdtp
, int flag
, int argc
,
392 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
393 return CMD_RET_FAILURE
;
397 return CMD_RET_USAGE
;
402 if (avb_ops
->write_persistent_value(avb_ops
, name
, strlen(value
) + 1,
403 (const uint8_t *)value
) ==
405 printf("Wrote %zu bytes\n", strlen(value
) + 1);
406 return CMD_RET_SUCCESS
;
409 printf("Failed to write persistent value\n");
411 return CMD_RET_FAILURE
;
414 static cmd_tbl_t cmd_avb
[] = {
415 U_BOOT_CMD_MKENT(init
, 2, 0, do_avb_init
, "", ""),
416 U_BOOT_CMD_MKENT(read_rb
, 2, 0, do_avb_read_rb
, "", ""),
417 U_BOOT_CMD_MKENT(write_rb
, 3, 0, do_avb_write_rb
, "", ""),
418 U_BOOT_CMD_MKENT(is_unlocked
, 1, 0, do_avb_is_unlocked
, "", ""),
419 U_BOOT_CMD_MKENT(get_uuid
, 2, 0, do_avb_get_uuid
, "", ""),
420 U_BOOT_CMD_MKENT(read_part
, 5, 0, do_avb_read_part
, "", ""),
421 U_BOOT_CMD_MKENT(read_part_hex
, 4, 0, do_avb_read_part_hex
, "", ""),
422 U_BOOT_CMD_MKENT(write_part
, 5, 0, do_avb_write_part
, "", ""),
423 U_BOOT_CMD_MKENT(verify
, 2, 0, do_avb_verify_part
, "", ""),
424 #ifdef CONFIG_OPTEE_TA_AVB
425 U_BOOT_CMD_MKENT(read_pvalue
, 3, 0, do_avb_read_pvalue
, "", ""),
426 U_BOOT_CMD_MKENT(write_pvalue
, 3, 0, do_avb_write_pvalue
, "", ""),
430 static int do_avb(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
434 cp
= find_cmd_tbl(argv
[1], cmd_avb
, ARRAY_SIZE(cmd_avb
));
439 if (!cp
|| argc
> cp
->maxargs
)
440 return CMD_RET_USAGE
;
442 if (flag
== CMD_FLAG_REPEAT
)
443 return CMD_RET_FAILURE
;
445 return cp
->cmd(cmdtp
, flag
, argc
, argv
);
450 "Provides commands for testing Android Verified Boot 2.0 functionality",
451 "init <dev> - initialize avb2 for <dev>\n"
452 "avb read_rb <num> - read rollback index at location <num>\n"
453 "avb write_rb <num> <rb> - write rollback index <rb> to <num>\n"
454 "avb is_unlocked - returns unlock status of the device\n"
455 "avb get_uuid <partname> - read and print uuid of partition <part>\n"
456 "avb read_part <partname> <offset> <num> <addr> - read <num> bytes from\n"
457 " partition <partname> to buffer <addr>\n"
458 "avb read_part_hex <partname> <offset> <num> - read <num> bytes from\n"
459 " partition <partname> and print to stdout\n"
460 "avb write_part <partname> <offset> <num> <addr> - write <num> bytes to\n"
461 " <partname> by <offset> using data from <addr>\n"
462 #ifdef CONFIG_OPTEE_TA_AVB
463 "avb read_pvalue <name> <bytes> - read a persistent value <name>\n"
464 "avb write_pvalue <name> <value> - write a persistent value <name>\n"
466 "avb verify [slot_suffix] - run verification process using hash data\n"
467 " from vbmeta structure\n"
468 " [slot_suffix] - _a, _b, etc (if vbmeta partition is slotted)\n"