2 * Copyright (c) 2013 The Chromium OS Authors.
4 * SPDX-License-Identifier: GPL-2.0+
12 #include <asm/unaligned.h>
13 #include <linux/string.h>
15 /* Useful constants */
18 /* max lengths, valid for RSA keys <= 2048 bits */
19 TPM_PUBKEY_MAX_LENGTH
= 288,
23 * Print a byte string in hexdecimal format, 16-bytes per line.
25 * @param data byte string to be printed
26 * @param count number of bytes to be printed
28 static void print_byte_string(uint8_t *data
, size_t count
)
30 int i
, print_newline
= 0;
32 for (i
= 0; i
< count
; i
++) {
33 printf(" %02x", data
[i
]);
34 print_newline
= (i
% 16 == 15);
38 /* Avoid duplicated newline at the end */
44 * Convert a text string of hexdecimal values into a byte string.
46 * @param bytes text string of hexdecimal values with no space
48 * @param data output buffer for byte string. The caller has to make
49 * sure it is large enough for storing the output. If
50 * NULL is passed, a large enough buffer will be allocated,
51 * and the caller must free it.
52 * @param count_ptr output variable for the length of byte string
53 * @return pointer to output buffer
55 static void *parse_byte_string(char *bytes
, uint8_t *data
, size_t *count_ptr
)
63 length
= strlen(bytes
);
72 for (i
= 0; i
< length
; i
+= 2) {
74 byte
[1] = bytes
[i
+ 1];
75 data
[i
/ 2] = (uint8_t)simple_strtoul(byte
, NULL
, 16);
85 * report_return_code() - Report any error and return failure or success
87 * @param return_code TPM command return code
88 * @return value of enum command_ret_t
90 static int report_return_code(int return_code
)
93 printf("Error: %d\n", return_code
);
94 return CMD_RET_FAILURE
;
96 return CMD_RET_SUCCESS
;
101 * Return number of values defined by a type string.
103 * @param type_str type string
104 * @return number of values of type string
106 static int type_string_get_num_values(const char *type_str
)
108 return strlen(type_str
);
112 * Return total size of values defined by a type string.
114 * @param type_str type string
115 * @return total size of values of type string, or 0 if type string
116 * contains illegal type character.
118 static size_t type_string_get_space_size(const char *type_str
)
122 for (size
= 0; *type_str
; type_str
++) {
142 * Allocate a buffer large enough to hold values defined by a type
143 * string. The caller has to free the buffer.
145 * @param type_str type string
146 * @param count pointer for storing size of buffer
147 * @return pointer to buffer or NULL on error
149 static void *type_string_alloc(const char *type_str
, uint32_t *count
)
154 size
= type_string_get_space_size(type_str
);
165 * Pack values defined by a type string into a buffer. The buffer must have
166 * large enough space.
168 * @param type_str type string
169 * @param values text strings of values to be packed
170 * @param data output buffer of values
171 * @return 0 on success, non-0 on error
173 static int type_string_pack(const char *type_str
, char * const values
[],
179 for (offset
= 0; *type_str
; type_str
++, values
++) {
180 value
= simple_strtoul(values
[0], NULL
, 0);
183 data
[offset
] = value
;
187 put_unaligned_be16(value
, data
+ offset
);
191 put_unaligned_be32(value
, data
+ offset
);
203 * Read values defined by a type string from a buffer, and write these values
204 * to environment variables.
206 * @param type_str type string
207 * @param data input buffer of values
208 * @param vars names of environment variables
209 * @return 0 on success, non-0 on error
211 static int type_string_write_vars(const char *type_str
, uint8_t *data
,
217 for (offset
= 0; *type_str
; type_str
++, vars
++) {
220 value
= data
[offset
];
224 value
= get_unaligned_be16(data
+ offset
);
228 value
= get_unaligned_be32(data
+ offset
);
234 if (setenv_ulong(*vars
, value
))
241 static int do_tpm_startup(cmd_tbl_t
*cmdtp
, int flag
,
242 int argc
, char * const argv
[])
244 enum tpm_startup_type mode
;
247 return CMD_RET_USAGE
;
248 if (!strcasecmp("TPM_ST_CLEAR", argv
[1])) {
250 } else if (!strcasecmp("TPM_ST_STATE", argv
[1])) {
252 } else if (!strcasecmp("TPM_ST_DEACTIVATED", argv
[1])) {
253 mode
= TPM_ST_DEACTIVATED
;
255 printf("Couldn't recognize mode string: %s\n", argv
[1]);
256 return CMD_RET_FAILURE
;
259 return report_return_code(tpm_startup(mode
));
262 static int do_tpm_nv_define_space(cmd_tbl_t
*cmdtp
, int flag
,
263 int argc
, char * const argv
[])
265 uint32_t index
, perm
, size
;
268 return CMD_RET_USAGE
;
269 index
= simple_strtoul(argv
[1], NULL
, 0);
270 perm
= simple_strtoul(argv
[2], NULL
, 0);
271 size
= simple_strtoul(argv
[3], NULL
, 0);
273 return report_return_code(tpm_nv_define_space(index
, perm
, size
));
276 static int do_tpm_nv_read_value(cmd_tbl_t
*cmdtp
, int flag
,
277 int argc
, char * const argv
[])
279 uint32_t index
, count
, rc
;
283 return CMD_RET_USAGE
;
284 index
= simple_strtoul(argv
[1], NULL
, 0);
285 data
= (void *)simple_strtoul(argv
[2], NULL
, 0);
286 count
= simple_strtoul(argv
[3], NULL
, 0);
288 rc
= tpm_nv_read_value(index
, data
, count
);
290 puts("area content:\n");
291 print_byte_string(data
, count
);
294 return report_return_code(rc
);
297 static int do_tpm_nv_write_value(cmd_tbl_t
*cmdtp
, int flag
,
298 int argc
, char * const argv
[])
305 return CMD_RET_USAGE
;
306 index
= simple_strtoul(argv
[1], NULL
, 0);
307 data
= parse_byte_string(argv
[2], NULL
, &count
);
309 printf("Couldn't parse byte string %s\n", argv
[2]);
310 return CMD_RET_FAILURE
;
313 rc
= tpm_nv_write_value(index
, data
, count
);
316 return report_return_code(rc
);
319 static int do_tpm_extend(cmd_tbl_t
*cmdtp
, int flag
,
320 int argc
, char * const argv
[])
323 uint8_t in_digest
[20], out_digest
[20];
326 return CMD_RET_USAGE
;
327 index
= simple_strtoul(argv
[1], NULL
, 0);
328 if (!parse_byte_string(argv
[2], in_digest
, NULL
)) {
329 printf("Couldn't parse byte string %s\n", argv
[2]);
330 return CMD_RET_FAILURE
;
333 rc
= tpm_extend(index
, in_digest
, out_digest
);
335 puts("PCR value after execution of the command:\n");
336 print_byte_string(out_digest
, sizeof(out_digest
));
339 return report_return_code(rc
);
342 static int do_tpm_pcr_read(cmd_tbl_t
*cmdtp
, int flag
,
343 int argc
, char * const argv
[])
345 uint32_t index
, count
, rc
;
349 return CMD_RET_USAGE
;
350 index
= simple_strtoul(argv
[1], NULL
, 0);
351 data
= (void *)simple_strtoul(argv
[2], NULL
, 0);
352 count
= simple_strtoul(argv
[3], NULL
, 0);
354 rc
= tpm_pcr_read(index
, data
, count
);
356 puts("Named PCR content:\n");
357 print_byte_string(data
, count
);
360 return report_return_code(rc
);
363 static int do_tpm_tsc_physical_presence(cmd_tbl_t
*cmdtp
, int flag
,
364 int argc
, char * const argv
[])
369 return CMD_RET_USAGE
;
370 presence
= (uint16_t)simple_strtoul(argv
[1], NULL
, 0);
372 return report_return_code(tpm_tsc_physical_presence(presence
));
375 static int do_tpm_read_pubek(cmd_tbl_t
*cmdtp
, int flag
,
376 int argc
, char * const argv
[])
382 return CMD_RET_USAGE
;
383 data
= (void *)simple_strtoul(argv
[1], NULL
, 0);
384 count
= simple_strtoul(argv
[2], NULL
, 0);
386 rc
= tpm_read_pubek(data
, count
);
388 puts("pubek value:\n");
389 print_byte_string(data
, count
);
392 return report_return_code(rc
);
395 static int do_tpm_physical_set_deactivated(cmd_tbl_t
*cmdtp
, int flag
,
396 int argc
, char * const argv
[])
401 return CMD_RET_USAGE
;
402 state
= (uint8_t)simple_strtoul(argv
[1], NULL
, 0);
404 return report_return_code(tpm_physical_set_deactivated(state
));
407 static int do_tpm_get_capability(cmd_tbl_t
*cmdtp
, int flag
,
408 int argc
, char * const argv
[])
410 uint32_t cap_area
, sub_cap
, rc
;
415 return CMD_RET_USAGE
;
416 cap_area
= simple_strtoul(argv
[1], NULL
, 0);
417 sub_cap
= simple_strtoul(argv
[2], NULL
, 0);
418 cap
= (void *)simple_strtoul(argv
[3], NULL
, 0);
419 count
= simple_strtoul(argv
[4], NULL
, 0);
421 rc
= tpm_get_capability(cap_area
, sub_cap
, cap
, count
);
423 puts("capability information:\n");
424 print_byte_string(cap
, count
);
427 return report_return_code(rc
);
430 #define TPM_COMMAND_NO_ARG(cmd) \
431 static int do_##cmd(cmd_tbl_t *cmdtp, int flag, \
432 int argc, char * const argv[]) \
435 return CMD_RET_USAGE; \
436 return report_return_code(cmd()); \
439 TPM_COMMAND_NO_ARG(tpm_init
)
440 TPM_COMMAND_NO_ARG(tpm_self_test_full
)
441 TPM_COMMAND_NO_ARG(tpm_continue_self_test
)
442 TPM_COMMAND_NO_ARG(tpm_force_clear
)
443 TPM_COMMAND_NO_ARG(tpm_physical_enable
)
444 TPM_COMMAND_NO_ARG(tpm_physical_disable
)
446 static int get_tpm(struct udevice
**devp
)
450 rc
= uclass_first_device_err(UCLASS_TPM
, devp
);
452 printf("Could not find TPM (ret=%d)\n", rc
);
453 return CMD_RET_FAILURE
;
459 static int do_tpm_info(cmd_tbl_t
*cmdtp
, int flag
, int argc
,
469 rc
= tpm_get_desc(dev
, buf
, sizeof(buf
));
471 printf("Couldn't get TPM info (%d)\n", rc
);
472 return CMD_RET_FAILURE
;
479 static int do_tpm_raw_transfer(cmd_tbl_t
*cmdtp
, int flag
,
480 int argc
, char * const argv
[])
484 uint8_t response
[1024];
485 size_t count
, response_length
= sizeof(response
);
488 command
= parse_byte_string(argv
[1], NULL
, &count
);
490 printf("Couldn't parse byte string %s\n", argv
[1]);
491 return CMD_RET_FAILURE
;
498 rc
= tpm_xfer(dev
, command
, count
, response
, &response_length
);
501 puts("tpm response:\n");
502 print_byte_string(response
, response_length
);
505 return report_return_code(rc
);
508 static int do_tpm_nv_define(cmd_tbl_t
*cmdtp
, int flag
,
509 int argc
, char * const argv
[])
511 uint32_t index
, perm
, size
;
514 return CMD_RET_USAGE
;
515 size
= type_string_get_space_size(argv
[1]);
517 printf("Couldn't parse arguments\n");
518 return CMD_RET_USAGE
;
520 index
= simple_strtoul(argv
[2], NULL
, 0);
521 perm
= simple_strtoul(argv
[3], NULL
, 0);
523 return report_return_code(tpm_nv_define_space(index
, perm
, size
));
526 static int do_tpm_nv_read(cmd_tbl_t
*cmdtp
, int flag
,
527 int argc
, char * const argv
[])
529 uint32_t index
, count
, err
;
533 return CMD_RET_USAGE
;
534 if (argc
!= 3 + type_string_get_num_values(argv
[1]))
535 return CMD_RET_USAGE
;
536 index
= simple_strtoul(argv
[2], NULL
, 0);
537 data
= type_string_alloc(argv
[1], &count
);
539 printf("Couldn't parse arguments\n");
540 return CMD_RET_USAGE
;
543 err
= tpm_nv_read_value(index
, data
, count
);
545 if (type_string_write_vars(argv
[1], data
, argv
+ 3)) {
546 printf("Couldn't write to variables\n");
552 return report_return_code(err
);
555 static int do_tpm_nv_write(cmd_tbl_t
*cmdtp
, int flag
,
556 int argc
, char * const argv
[])
558 uint32_t index
, count
, err
;
562 return CMD_RET_USAGE
;
563 if (argc
!= 3 + type_string_get_num_values(argv
[1]))
564 return CMD_RET_USAGE
;
565 index
= simple_strtoul(argv
[2], NULL
, 0);
566 data
= type_string_alloc(argv
[1], &count
);
568 printf("Couldn't parse arguments\n");
569 return CMD_RET_USAGE
;
571 if (type_string_pack(argv
[1], argv
+ 3, data
)) {
572 printf("Couldn't parse arguments\n");
574 return CMD_RET_USAGE
;
577 err
= tpm_nv_write_value(index
, data
, count
);
580 return report_return_code(err
);
583 #ifdef CONFIG_TPM_AUTH_SESSIONS
585 static int do_tpm_oiap(cmd_tbl_t
*cmdtp
, int flag
,
586 int argc
, char * const argv
[])
588 uint32_t auth_handle
, err
;
590 err
= tpm_oiap(&auth_handle
);
592 return report_return_code(err
);
595 static int do_tpm_load_key2_oiap(cmd_tbl_t
*cmdtp
, int flag
,
596 int argc
, char * const argv
[])
598 uint32_t parent_handle
, key_len
, key_handle
, err
;
599 uint8_t usage_auth
[DIGEST_LENGTH
];
603 return CMD_RET_USAGE
;
605 parent_handle
= simple_strtoul(argv
[1], NULL
, 0);
606 key
= (void *)simple_strtoul(argv
[2], NULL
, 0);
607 key_len
= simple_strtoul(argv
[3], NULL
, 0);
608 if (strlen(argv
[4]) != 2 * DIGEST_LENGTH
)
609 return CMD_RET_FAILURE
;
610 parse_byte_string(argv
[4], usage_auth
, NULL
);
612 err
= tpm_load_key2_oiap(parent_handle
, key
, key_len
, usage_auth
,
615 printf("Key handle is 0x%x\n", key_handle
);
617 return report_return_code(err
);
620 static int do_tpm_get_pub_key_oiap(cmd_tbl_t
*cmdtp
, int flag
,
621 int argc
, char * const argv
[])
623 uint32_t key_handle
, err
;
624 uint8_t usage_auth
[DIGEST_LENGTH
];
625 uint8_t pub_key_buffer
[TPM_PUBKEY_MAX_LENGTH
];
626 size_t pub_key_len
= sizeof(pub_key_buffer
);
629 return CMD_RET_USAGE
;
631 key_handle
= simple_strtoul(argv
[1], NULL
, 0);
632 if (strlen(argv
[2]) != 2 * DIGEST_LENGTH
)
633 return CMD_RET_FAILURE
;
634 parse_byte_string(argv
[2], usage_auth
, NULL
);
636 err
= tpm_get_pub_key_oiap(key_handle
, usage_auth
,
637 pub_key_buffer
, &pub_key_len
);
639 printf("dump of received pub key structure:\n");
640 print_byte_string(pub_key_buffer
, pub_key_len
);
642 return report_return_code(err
);
645 TPM_COMMAND_NO_ARG(tpm_end_oiap
)
647 #endif /* CONFIG_TPM_AUTH_SESSIONS */
649 #define MAKE_TPM_CMD_ENTRY(cmd) \
650 U_BOOT_CMD_MKENT(cmd, 0, 1, do_tpm_ ## cmd, "", "")
652 static cmd_tbl_t tpm_commands
[] = {
653 U_BOOT_CMD_MKENT(info
, 0, 1, do_tpm_info
, "", ""),
654 U_BOOT_CMD_MKENT(init
, 0, 1,
655 do_tpm_init
, "", ""),
656 U_BOOT_CMD_MKENT(startup
, 0, 1,
657 do_tpm_startup
, "", ""),
658 U_BOOT_CMD_MKENT(self_test_full
, 0, 1,
659 do_tpm_self_test_full
, "", ""),
660 U_BOOT_CMD_MKENT(continue_self_test
, 0, 1,
661 do_tpm_continue_self_test
, "", ""),
662 U_BOOT_CMD_MKENT(force_clear
, 0, 1,
663 do_tpm_force_clear
, "", ""),
664 U_BOOT_CMD_MKENT(physical_enable
, 0, 1,
665 do_tpm_physical_enable
, "", ""),
666 U_BOOT_CMD_MKENT(physical_disable
, 0, 1,
667 do_tpm_physical_disable
, "", ""),
668 U_BOOT_CMD_MKENT(nv_define_space
, 0, 1,
669 do_tpm_nv_define_space
, "", ""),
670 U_BOOT_CMD_MKENT(nv_read_value
, 0, 1,
671 do_tpm_nv_read_value
, "", ""),
672 U_BOOT_CMD_MKENT(nv_write_value
, 0, 1,
673 do_tpm_nv_write_value
, "", ""),
674 U_BOOT_CMD_MKENT(extend
, 0, 1,
675 do_tpm_extend
, "", ""),
676 U_BOOT_CMD_MKENT(pcr_read
, 0, 1,
677 do_tpm_pcr_read
, "", ""),
678 U_BOOT_CMD_MKENT(tsc_physical_presence
, 0, 1,
679 do_tpm_tsc_physical_presence
, "", ""),
680 U_BOOT_CMD_MKENT(read_pubek
, 0, 1,
681 do_tpm_read_pubek
, "", ""),
682 U_BOOT_CMD_MKENT(physical_set_deactivated
, 0, 1,
683 do_tpm_physical_set_deactivated
, "", ""),
684 U_BOOT_CMD_MKENT(get_capability
, 0, 1,
685 do_tpm_get_capability
, "", ""),
686 U_BOOT_CMD_MKENT(raw_transfer
, 0, 1,
687 do_tpm_raw_transfer
, "", ""),
688 U_BOOT_CMD_MKENT(nv_define
, 0, 1,
689 do_tpm_nv_define
, "", ""),
690 U_BOOT_CMD_MKENT(nv_read
, 0, 1,
691 do_tpm_nv_read
, "", ""),
692 U_BOOT_CMD_MKENT(nv_write
, 0, 1,
693 do_tpm_nv_write
, "", ""),
694 #ifdef CONFIG_TPM_AUTH_SESSIONS
695 U_BOOT_CMD_MKENT(oiap
, 0, 1,
696 do_tpm_oiap
, "", ""),
697 U_BOOT_CMD_MKENT(end_oiap
, 0, 1,
698 do_tpm_end_oiap
, "", ""),
699 U_BOOT_CMD_MKENT(load_key2_oiap
, 0, 1,
700 do_tpm_load_key2_oiap
, "", ""),
701 U_BOOT_CMD_MKENT(get_pub_key_oiap
, 0, 1,
702 do_tpm_get_pub_key_oiap
, "", ""),
703 #endif /* CONFIG_TPM_AUTH_SESSIONS */
706 static int do_tpm(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
711 return CMD_RET_USAGE
;
712 tpm_cmd
= find_cmd_tbl(argv
[1], tpm_commands
, ARRAY_SIZE(tpm_commands
));
714 return CMD_RET_USAGE
;
716 return tpm_cmd
->cmd(cmdtp
, flag
, argc
- 1, argv
+ 1);
719 U_BOOT_CMD(tpm
, CONFIG_SYS_MAXARGS
, 1, do_tpm
,
720 "Issue a TPM command",
722 " - Issue TPM command <cmd> with arguments <args...>.\n"
723 "Admin Startup and State Commands:\n"
724 " info - Show information about the TPM\n"
726 " - Put TPM into a state where it waits for 'startup' command.\n"
728 " - Issue TPM_Starup command. <mode> is one of TPM_ST_CLEAR,\n"
729 " TPM_ST_STATE, and TPM_ST_DEACTIVATED.\n"
730 "Admin Testing Commands:\n"
732 " - Test all of the TPM capabilities.\n"
733 " continue_self_test\n"
734 " - Inform TPM that it should complete the self-test.\n"
735 "Admin Opt-in Commands:\n"
737 " - Set the PERMANENT disable flag to FALSE using physical presence as\n"
739 " physical_disable\n"
740 " - Set the PERMANENT disable flag to TRUE using physical presence as\n"
742 " physical_set_deactivated 0|1\n"
743 " - Set deactivated flag.\n"
744 "Admin Ownership Commands:\n"
746 " - Issue TPM_ForceClear command.\n"
747 " tsc_physical_presence flags\n"
748 " - Set TPM device's Physical Presence flags to <flags>.\n"
749 "The Capability Commands:\n"
750 " get_capability cap_area sub_cap addr count\n"
751 " - Read <count> bytes of TPM capability indexed by <cap_area> and\n"
752 " <sub_cap> to memory address <addr>.\n"
753 #ifdef CONFIG_TPM_AUTH_SESSIONS
754 "Storage functions\n"
755 " loadkey2_oiap parent_handle key_addr key_len usage_auth\n"
756 " - loads a key data from memory address <key_addr>, <key_len> bytes\n"
757 " into TPM using the parent key <parent_handle> with authorization\n"
758 " <usage_auth> (20 bytes hex string).\n"
759 " get_pub_key_oiap key_handle usage_auth\n"
760 " - get the public key portion of a loaded key <key_handle> using\n"
761 " authorization <usage auth> (20 bytes hex string)\n"
762 #endif /* CONFIG_TPM_AUTH_SESSIONS */
763 "Endorsement Key Handling Commands:\n"
764 " read_pubek addr count\n"
765 " - Read <count> bytes of the public endorsement key to memory\n"
767 "Integrity Collection and Reporting Commands:\n"
768 " extend index digest_hex_string\n"
769 " - Add a new measurement to a PCR. Update PCR <index> with the 20-bytes\n"
770 " <digest_hex_string>\n"
771 " pcr_read index addr count\n"
772 " - Read <count> bytes from PCR <index> to memory address <addr>.\n"
773 #ifdef CONFIG_TPM_AUTH_SESSIONS
774 "Authorization Sessions\n"
776 " - setup an OIAP session\n"
778 " - terminates an active OIAP session\n"
779 #endif /* CONFIG_TPM_AUTH_SESSIONS */
780 "Non-volatile Storage Commands:\n"
781 " nv_define_space index permission size\n"
782 " - Establish a space at index <index> with <permission> of <size> bytes.\n"
783 " nv_read_value index addr count\n"
784 " - Read <count> bytes from space <index> to memory address <addr>.\n"
785 " nv_write_value index addr count\n"
786 " - Write <count> bytes from memory address <addr> to space <index>.\n"
787 "Miscellaneous helper functions:\n"
788 " raw_transfer byte_string\n"
789 " - Send a byte string <byte_string> to TPM and print the response.\n"
790 " Non-volatile storage helper functions:\n"
791 " These helper functions treat a non-volatile space as a non-padded\n"
792 " sequence of integer values. These integer values are defined by a type\n"
793 " string, which is a text string of 'bwd' characters: 'b' means a 8-bit\n"
794 " value, 'w' 16-bit value, 'd' 32-bit value. All helper functions take\n"
795 " a type string as their first argument.\n"
796 " nv_define type_string index perm\n"
797 " - Define a space <index> with permission <perm>.\n"
798 " nv_read types_string index vars...\n"
799 " - Read from space <index> to environment variables <vars...>.\n"
800 " nv_write types_string index values...\n"
801 " - Write to space <index> from values <values...>.\n"