]>
git.ipfire.org Git - thirdparty/u-boot.git/blob - cmd/tpm-v2.c
1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (c) 2018 Bootlin
4 * Author: Miquel Raynal <miquel.raynal@bootlin.com>
12 #include <tpm-common.h>
14 #include "tpm-user-utils.h"
16 static int do_tpm2_startup(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
19 enum tpm2_startup_types mode
;
29 if (!strcasecmp("TPM2_SU_CLEAR", argv
[1])) {
31 } else if (!strcasecmp("TPM2_SU_STATE", argv
[1])) {
34 printf("Couldn't recognize mode string: %s\n", argv
[1]);
35 return CMD_RET_FAILURE
;
38 return report_return_code(tpm2_startup(dev
, mode
));
41 static int do_tpm2_self_test(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
44 enum tpm2_yes_no full_test
;
54 if (!strcasecmp("full", argv
[1])) {
56 } else if (!strcasecmp("continue", argv
[1])) {
59 printf("Couldn't recognize test mode: %s\n", argv
[1]);
60 return CMD_RET_FAILURE
;
63 return report_return_code(tpm2_self_test(dev
, full_test
));
66 static int do_tpm2_clear(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
70 const char *pw
= (argc
< 3) ? NULL
: argv
[2];
71 const ssize_t pw_sz
= pw
? strlen(pw
) : 0;
79 if (argc
< 2 || argc
> 3)
82 if (pw_sz
> TPM2_DIGEST_LEN
)
85 if (!strcasecmp("TPM2_RH_LOCKOUT", argv
[1]))
86 handle
= TPM2_RH_LOCKOUT
;
87 else if (!strcasecmp("TPM2_RH_PLATFORM", argv
[1]))
88 handle
= TPM2_RH_PLATFORM
;
92 return report_return_code(tpm2_clear(dev
, handle
, pw
, pw_sz
));
95 static int do_tpm2_pcr_extend(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
99 struct tpm_chip_priv
*priv
;
100 u32 index
= simple_strtoul(argv
[1], NULL
, 0);
101 void *digest
= map_sysmem(simple_strtoul(argv
[2], NULL
, 0), 0);
106 return CMD_RET_USAGE
;
112 priv
= dev_get_uclass_priv(dev
);
116 if (index
>= priv
->pcr_count
)
119 rc
= tpm2_pcr_extend(dev
, index
, digest
);
121 unmap_sysmem(digest
);
123 return report_return_code(rc
);
126 static int do_tpm_pcr_read(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
130 struct tpm_chip_priv
*priv
;
132 unsigned int updates
;
137 return CMD_RET_USAGE
;
143 priv
= dev_get_uclass_priv(dev
);
147 index
= simple_strtoul(argv
[1], NULL
, 0);
148 if (index
>= priv
->pcr_count
)
151 data
= map_sysmem(simple_strtoul(argv
[2], NULL
, 0), 0);
153 rc
= tpm2_pcr_read(dev
, index
, priv
->pcr_select_min
, data
, &updates
);
155 printf("PCR #%u content (%u known updates):\n", index
, updates
);
156 print_byte_string(data
, TPM2_DIGEST_LEN
);
161 return report_return_code(rc
);
164 static int do_tpm_get_capability(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
167 u32 capability
, property
, rc
;
179 return CMD_RET_USAGE
;
181 capability
= simple_strtoul(argv
[1], NULL
, 0);
182 property
= simple_strtoul(argv
[2], NULL
, 0);
183 data
= map_sysmem(simple_strtoul(argv
[3], NULL
, 0), 0);
184 count
= simple_strtoul(argv
[4], NULL
, 0);
186 rc
= tpm2_get_capability(dev
, capability
, property
, data
, count
);
190 printf("Capabilities read from TPM:\n");
191 for (i
= 0; i
< count
; i
++) {
192 printf("Property 0x");
193 for (j
= 0; j
< 4; j
++)
194 printf("%02x", data
[(i
* 8) + j
]);
196 for (j
= 4; j
< 8; j
++)
197 printf("%02x", data
[(i
* 8) + j
]);
204 return report_return_code(rc
);
207 static int do_tpm_dam_reset(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
210 const char *pw
= (argc
< 2) ? NULL
: argv
[1];
211 const ssize_t pw_sz
= pw
? strlen(pw
) : 0;
220 return CMD_RET_USAGE
;
222 if (pw_sz
> TPM2_DIGEST_LEN
)
225 return report_return_code(tpm2_dam_reset(dev
, pw
, pw_sz
));
228 static int do_tpm_dam_parameters(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
231 const char *pw
= (argc
< 5) ? NULL
: argv
[4];
232 const ssize_t pw_sz
= pw
? strlen(pw
) : 0;
234 * No Dictionary Attack Mitigation (DAM) means:
235 * maxtries = 0xFFFFFFFF, recovery_time = 1, lockout_recovery = 0
237 unsigned long int max_tries
;
238 unsigned long int recovery_time
;
239 unsigned long int lockout_recovery
;
247 if (argc
< 4 || argc
> 5)
248 return CMD_RET_USAGE
;
250 if (pw_sz
> TPM2_DIGEST_LEN
)
253 if (strict_strtoul(argv
[1], 0, &max_tries
))
254 return CMD_RET_USAGE
;
256 if (strict_strtoul(argv
[2], 0, &recovery_time
))
257 return CMD_RET_USAGE
;
259 if (strict_strtoul(argv
[3], 0, &lockout_recovery
))
260 return CMD_RET_USAGE
;
262 log(LOGC_NONE
, LOGL_INFO
, "Changing dictionary attack parameters:\n");
263 log(LOGC_NONE
, LOGL_INFO
, "- maxTries: %lu", max_tries
);
264 log(LOGC_NONE
, LOGL_INFO
, "- recoveryTime: %lu\n", recovery_time
);
265 log(LOGC_NONE
, LOGL_INFO
, "- lockoutRecovery: %lu\n", lockout_recovery
);
267 return report_return_code(tpm2_dam_parameters(dev
, pw
, pw_sz
, max_tries
,
272 static int do_tpm_change_auth(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
276 const char *newpw
= argv
[2];
277 const char *oldpw
= (argc
== 3) ? NULL
: argv
[3];
278 const ssize_t newpw_sz
= strlen(newpw
);
279 const ssize_t oldpw_sz
= oldpw
? strlen(oldpw
) : 0;
287 if (argc
< 3 || argc
> 4)
288 return CMD_RET_USAGE
;
290 if (newpw_sz
> TPM2_DIGEST_LEN
|| oldpw_sz
> TPM2_DIGEST_LEN
)
293 if (!strcasecmp("TPM2_RH_LOCKOUT", argv
[1]))
294 handle
= TPM2_RH_LOCKOUT
;
295 else if (!strcasecmp("TPM2_RH_ENDORSEMENT", argv
[1]))
296 handle
= TPM2_RH_ENDORSEMENT
;
297 else if (!strcasecmp("TPM2_RH_OWNER", argv
[1]))
298 handle
= TPM2_RH_OWNER
;
299 else if (!strcasecmp("TPM2_RH_PLATFORM", argv
[1]))
300 handle
= TPM2_RH_PLATFORM
;
302 return CMD_RET_USAGE
;
304 return report_return_code(tpm2_change_auth(dev
, handle
, newpw
, newpw_sz
,
308 static int do_tpm_pcr_setauthpolicy(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
311 u32 index
= simple_strtoul(argv
[1], NULL
, 0);
313 const char *pw
= (argc
< 4) ? NULL
: argv
[3];
314 const ssize_t pw_sz
= pw
? strlen(pw
) : 0;
322 if (strlen(key
) != TPM2_DIGEST_LEN
)
325 if (argc
< 3 || argc
> 4)
326 return CMD_RET_USAGE
;
328 return report_return_code(tpm2_pcr_setauthpolicy(dev
, pw
, pw_sz
, index
,
332 static int do_tpm_pcr_setauthvalue(struct cmd_tbl
*cmdtp
, int flag
,
333 int argc
, char *const argv
[])
335 u32 index
= simple_strtoul(argv
[1], NULL
, 0);
337 const ssize_t key_sz
= strlen(key
);
338 const char *pw
= (argc
< 4) ? NULL
: argv
[3];
339 const ssize_t pw_sz
= pw
? strlen(pw
) : 0;
347 if (strlen(key
) != TPM2_DIGEST_LEN
)
350 if (argc
< 3 || argc
> 4)
351 return CMD_RET_USAGE
;
353 return report_return_code(tpm2_pcr_setauthvalue(dev
, pw
, pw_sz
, index
,
357 static struct cmd_tbl tpm2_commands
[] = {
358 U_BOOT_CMD_MKENT(device
, 0, 1, do_tpm_device
, "", ""),
359 U_BOOT_CMD_MKENT(info
, 0, 1, do_tpm_info
, "", ""),
360 U_BOOT_CMD_MKENT(init
, 0, 1, do_tpm_init
, "", ""),
361 U_BOOT_CMD_MKENT(startup
, 0, 1, do_tpm2_startup
, "", ""),
362 U_BOOT_CMD_MKENT(self_test
, 0, 1, do_tpm2_self_test
, "", ""),
363 U_BOOT_CMD_MKENT(clear
, 0, 1, do_tpm2_clear
, "", ""),
364 U_BOOT_CMD_MKENT(pcr_extend
, 0, 1, do_tpm2_pcr_extend
, "", ""),
365 U_BOOT_CMD_MKENT(pcr_read
, 0, 1, do_tpm_pcr_read
, "", ""),
366 U_BOOT_CMD_MKENT(get_capability
, 0, 1, do_tpm_get_capability
, "", ""),
367 U_BOOT_CMD_MKENT(dam_reset
, 0, 1, do_tpm_dam_reset
, "", ""),
368 U_BOOT_CMD_MKENT(dam_parameters
, 0, 1, do_tpm_dam_parameters
, "", ""),
369 U_BOOT_CMD_MKENT(change_auth
, 0, 1, do_tpm_change_auth
, "", ""),
370 U_BOOT_CMD_MKENT(pcr_setauthpolicy
, 0, 1,
371 do_tpm_pcr_setauthpolicy
, "", ""),
372 U_BOOT_CMD_MKENT(pcr_setauthvalue
, 0, 1,
373 do_tpm_pcr_setauthvalue
, "", ""),
376 struct cmd_tbl
*get_tpm2_commands(unsigned int *size
)
378 *size
= ARRAY_SIZE(tpm2_commands
);
380 return tpm2_commands
;
383 U_BOOT_CMD(tpm2
, CONFIG_SYS_MAXARGS
, 1, do_tpm
, "Issue a TPMv2.x command",
384 "<command> [<arguments>]\n"
386 "device [num device]\n"
387 " Show all devices or set the specified device\n"
389 " Show information about the TPM.\n"
391 " Initialize the software stack. Always the first command to issue.\n"
393 " Issue a TPM2_Startup command.\n"
394 " <mode> is one of:\n"
395 " * TPM2_SU_CLEAR (reset state)\n"
396 " * TPM2_SU_STATE (preserved state)\n"
398 " Test the TPM capabilities.\n"
399 " <type> is one of:\n"
400 " * full (perform all tests)\n"
401 " * continue (only check untested tests)\n"
402 "clear <hierarchy>\n"
403 " Issue a TPM2_Clear command.\n"
404 " <hierarchy> is one of:\n"
405 " * TPM2_RH_LOCKOUT\n"
406 " * TPM2_RH_PLATFORM\n"
407 "pcr_extend <pcr> <digest_addr>\n"
408 " Extend PCR #<pcr> with digest at <digest_addr>.\n"
409 " <pcr>: index of the PCR\n"
410 " <digest_addr>: address of a 32-byte SHA256 digest\n"
411 "pcr_read <pcr> <digest_addr>\n"
412 " Read PCR #<pcr> to memory address <digest_addr>.\n"
413 " <pcr>: index of the PCR\n"
414 " <digest_addr>: address to store the a 32-byte SHA256 digest\n"
415 "get_capability <capability> <property> <addr> <count>\n"
416 " Read and display <count> entries indexed by <capability>/<property>.\n"
417 " Values are 4 bytes long and are written at <addr>.\n"
418 " <capability>: capability\n"
419 " <property>: property\n"
420 " <addr>: address to store <count> entries of 4 bytes\n"
421 " <count>: number of entries to retrieve\n"
422 "dam_reset [<password>]\n"
423 " If the TPM is not in a LOCKOUT state, reset the internal error counter.\n"
424 " <password>: optional password\n"
425 "dam_parameters <max_tries> <recovery_time> <lockout_recovery> [<password>]\n"
426 " If the TPM is not in a LOCKOUT state, set the DAM parameters\n"
427 " <maxTries>: maximum number of failures before lockout,\n"
428 " 0 means always locking\n"
429 " <recoveryTime>: time before decrement of the error counter,\n"
430 " 0 means no lockout\n"
431 " <lockoutRecovery>: time of a lockout (before the next try),\n"
432 " 0 means a reboot is needed\n"
433 " <password>: optional password of the LOCKOUT hierarchy\n"
434 "change_auth <hierarchy> <new_pw> [<old_pw>]\n"
435 " <hierarchy>: the hierarchy\n"
436 " <new_pw>: new password for <hierarchy>\n"
437 " <old_pw>: optional previous password of <hierarchy>\n"
438 "pcr_setauthpolicy|pcr_setauthvalue <pcr> <key> [<password>]\n"
439 " Change the <key> to access PCR #<pcr>.\n"
440 " hierarchy and may be empty.\n"
441 " /!\\WARNING: untested function, use at your own risks !\n"
442 " <pcr>: index of the PCR\n"
443 " <key>: secret to protect the access of PCR #<pcr>\n"
444 " <password>: optional password of the PLATFORM hierarchy\n"