2 * Copyright (c) 2013 The Chromium OS Authors.
4 * SPDX-License-Identifier: GPL-2.0+
11 #include <asm/unaligned.h>
12 #include <linux/string.h>
14 /* Useful constants */
17 /* max lengths, valid for RSA keys <= 2048 bits */
18 TPM_PUBKEY_MAX_LENGTH
= 288,
22 * Print a byte string in hexdecimal format, 16-bytes per line.
24 * @param data byte string to be printed
25 * @param count number of bytes to be printed
27 static void print_byte_string(uint8_t *data
, size_t count
)
29 int i
, print_newline
= 0;
31 for (i
= 0; i
< count
; i
++) {
32 printf(" %02x", data
[i
]);
33 print_newline
= (i
% 16 == 15);
37 /* Avoid duplicated newline at the end */
43 * Convert a text string of hexdecimal values into a byte string.
45 * @param bytes text string of hexdecimal values with no space
47 * @param data output buffer for byte string. The caller has to make
48 * sure it is large enough for storing the output. If
49 * NULL is passed, a large enough buffer will be allocated,
50 * and the caller must free it.
51 * @param count_ptr output variable for the length of byte string
52 * @return pointer to output buffer
54 static void *parse_byte_string(char *bytes
, uint8_t *data
, size_t *count_ptr
)
60 length
= strlen(bytes
);
69 for (i
= 0; i
< length
; i
+= 2) {
71 byte
[1] = bytes
[i
+ 1];
72 data
[i
/ 2] = (uint8_t)simple_strtoul(byte
, NULL
, 16);
82 * Convert TPM command return code to U-Boot command error codes.
84 * @param return_code TPM command return code
85 * @return value of enum command_ret_t
87 static int convert_return_code(uint32_t return_code
)
90 return CMD_RET_FAILURE
;
92 return CMD_RET_SUCCESS
;
96 * Return number of values defined by a type string.
98 * @param type_str type string
99 * @return number of values of type string
101 static int type_string_get_num_values(const char *type_str
)
103 return strlen(type_str
);
107 * Return total size of values defined by a type string.
109 * @param type_str type string
110 * @return total size of values of type string, or 0 if type string
111 * contains illegal type character.
113 static size_t type_string_get_space_size(const char *type_str
)
117 for (size
= 0; *type_str
; type_str
++) {
137 * Allocate a buffer large enough to hold values defined by a type
138 * string. The caller has to free the buffer.
140 * @param type_str type string
141 * @param count pointer for storing size of buffer
142 * @return pointer to buffer or NULL on error
144 static void *type_string_alloc(const char *type_str
, uint32_t *count
)
149 size
= type_string_get_space_size(type_str
);
160 * Pack values defined by a type string into a buffer. The buffer must have
161 * large enough space.
163 * @param type_str type string
164 * @param values text strings of values to be packed
165 * @param data output buffer of values
166 * @return 0 on success, non-0 on error
168 static int type_string_pack(const char *type_str
, char * const values
[],
174 for (offset
= 0; *type_str
; type_str
++, values
++) {
175 value
= simple_strtoul(values
[0], NULL
, 0);
178 data
[offset
] = value
;
182 put_unaligned_be16(value
, data
+ offset
);
186 put_unaligned_be32(value
, data
+ offset
);
198 * Read values defined by a type string from a buffer, and write these values
199 * to environment variables.
201 * @param type_str type string
202 * @param data input buffer of values
203 * @param vars names of environment variables
204 * @return 0 on success, non-0 on error
206 static int type_string_write_vars(const char *type_str
, uint8_t *data
,
212 for (offset
= 0; *type_str
; type_str
++, vars
++) {
215 value
= data
[offset
];
219 value
= get_unaligned_be16(data
+ offset
);
223 value
= get_unaligned_be32(data
+ offset
);
229 if (setenv_ulong(*vars
, value
))
236 static int do_tpm_startup(cmd_tbl_t
*cmdtp
, int flag
,
237 int argc
, char * const argv
[])
239 enum tpm_startup_type mode
;
242 return CMD_RET_USAGE
;
243 if (!strcasecmp("TPM_ST_CLEAR", argv
[1])) {
245 } else if (!strcasecmp("TPM_ST_STATE", argv
[1])) {
247 } else if (!strcasecmp("TPM_ST_DEACTIVATED", argv
[1])) {
248 mode
= TPM_ST_DEACTIVATED
;
250 printf("Couldn't recognize mode string: %s\n", argv
[1]);
251 return CMD_RET_FAILURE
;
254 return convert_return_code(tpm_startup(mode
));
257 static int do_tpm_nv_define_space(cmd_tbl_t
*cmdtp
, int flag
,
258 int argc
, char * const argv
[])
260 uint32_t index
, perm
, size
;
263 return CMD_RET_USAGE
;
264 index
= simple_strtoul(argv
[1], NULL
, 0);
265 perm
= simple_strtoul(argv
[2], NULL
, 0);
266 size
= simple_strtoul(argv
[3], NULL
, 0);
268 return convert_return_code(tpm_nv_define_space(index
, perm
, size
));
271 static int do_tpm_nv_read_value(cmd_tbl_t
*cmdtp
, int flag
,
272 int argc
, char * const argv
[])
274 uint32_t index
, count
, rc
;
278 return CMD_RET_USAGE
;
279 index
= simple_strtoul(argv
[1], NULL
, 0);
280 data
= (void *)simple_strtoul(argv
[2], NULL
, 0);
281 count
= simple_strtoul(argv
[3], NULL
, 0);
283 rc
= tpm_nv_read_value(index
, data
, count
);
285 puts("area content:\n");
286 print_byte_string(data
, count
);
289 return convert_return_code(rc
);
292 static int do_tpm_nv_write_value(cmd_tbl_t
*cmdtp
, int flag
,
293 int argc
, char * const argv
[])
300 return CMD_RET_USAGE
;
301 index
= simple_strtoul(argv
[1], NULL
, 0);
302 data
= parse_byte_string(argv
[2], NULL
, &count
);
304 printf("Couldn't parse byte string %s\n", argv
[2]);
305 return CMD_RET_FAILURE
;
308 rc
= tpm_nv_write_value(index
, data
, count
);
311 return convert_return_code(rc
);
314 static int do_tpm_extend(cmd_tbl_t
*cmdtp
, int flag
,
315 int argc
, char * const argv
[])
318 uint8_t in_digest
[20], out_digest
[20];
321 return CMD_RET_USAGE
;
322 index
= simple_strtoul(argv
[1], NULL
, 0);
323 if (!parse_byte_string(argv
[2], in_digest
, NULL
)) {
324 printf("Couldn't parse byte string %s\n", argv
[2]);
325 return CMD_RET_FAILURE
;
328 rc
= tpm_extend(index
, in_digest
, out_digest
);
330 puts("PCR value after execution of the command:\n");
331 print_byte_string(out_digest
, sizeof(out_digest
));
334 return convert_return_code(rc
);
337 static int do_tpm_pcr_read(cmd_tbl_t
*cmdtp
, int flag
,
338 int argc
, char * const argv
[])
340 uint32_t index
, count
, rc
;
344 return CMD_RET_USAGE
;
345 index
= simple_strtoul(argv
[1], NULL
, 0);
346 data
= (void *)simple_strtoul(argv
[2], NULL
, 0);
347 count
= simple_strtoul(argv
[3], NULL
, 0);
349 rc
= tpm_pcr_read(index
, data
, count
);
351 puts("Named PCR content:\n");
352 print_byte_string(data
, count
);
355 return convert_return_code(rc
);
358 static int do_tpm_tsc_physical_presence(cmd_tbl_t
*cmdtp
, int flag
,
359 int argc
, char * const argv
[])
364 return CMD_RET_USAGE
;
365 presence
= (uint16_t)simple_strtoul(argv
[1], NULL
, 0);
367 return convert_return_code(tpm_tsc_physical_presence(presence
));
370 static int do_tpm_read_pubek(cmd_tbl_t
*cmdtp
, int flag
,
371 int argc
, char * const argv
[])
377 return CMD_RET_USAGE
;
378 data
= (void *)simple_strtoul(argv
[1], NULL
, 0);
379 count
= simple_strtoul(argv
[2], NULL
, 0);
381 rc
= tpm_read_pubek(data
, count
);
383 puts("pubek value:\n");
384 print_byte_string(data
, count
);
387 return convert_return_code(rc
);
390 static int do_tpm_physical_set_deactivated(cmd_tbl_t
*cmdtp
, int flag
,
391 int argc
, char * const argv
[])
396 return CMD_RET_USAGE
;
397 state
= (uint8_t)simple_strtoul(argv
[1], NULL
, 0);
399 return convert_return_code(tpm_physical_set_deactivated(state
));
402 static int do_tpm_get_capability(cmd_tbl_t
*cmdtp
, int flag
,
403 int argc
, char * const argv
[])
405 uint32_t cap_area
, sub_cap
, rc
;
410 return CMD_RET_USAGE
;
411 cap_area
= simple_strtoul(argv
[1], NULL
, 0);
412 sub_cap
= simple_strtoul(argv
[2], NULL
, 0);
413 cap
= (void *)simple_strtoul(argv
[3], NULL
, 0);
414 count
= simple_strtoul(argv
[4], NULL
, 0);
416 rc
= tpm_get_capability(cap_area
, sub_cap
, cap
, count
);
418 puts("capability information:\n");
419 print_byte_string(cap
, count
);
422 return convert_return_code(rc
);
425 #define TPM_COMMAND_NO_ARG(cmd) \
426 static int do_##cmd(cmd_tbl_t *cmdtp, int flag, \
427 int argc, char * const argv[]) \
430 return CMD_RET_USAGE; \
431 return convert_return_code(cmd()); \
434 TPM_COMMAND_NO_ARG(tpm_init
)
435 TPM_COMMAND_NO_ARG(tpm_self_test_full
)
436 TPM_COMMAND_NO_ARG(tpm_continue_self_test
)
437 TPM_COMMAND_NO_ARG(tpm_force_clear
)
438 TPM_COMMAND_NO_ARG(tpm_physical_enable
)
439 TPM_COMMAND_NO_ARG(tpm_physical_disable
)
441 static int do_tpm_raw_transfer(cmd_tbl_t
*cmdtp
, int flag
,
442 int argc
, char * const argv
[])
445 uint8_t response
[1024];
446 size_t count
, response_length
= sizeof(response
);
449 command
= parse_byte_string(argv
[1], NULL
, &count
);
451 printf("Couldn't parse byte string %s\n", argv
[1]);
452 return CMD_RET_FAILURE
;
455 rc
= tis_sendrecv(command
, count
, response
, &response_length
);
458 puts("tpm response:\n");
459 print_byte_string(response
, response_length
);
462 return convert_return_code(rc
);
465 static int do_tpm_nv_define(cmd_tbl_t
*cmdtp
, int flag
,
466 int argc
, char * const argv
[])
468 uint32_t index
, perm
, size
;
471 return CMD_RET_USAGE
;
472 size
= type_string_get_space_size(argv
[1]);
474 printf("Couldn't parse arguments\n");
475 return CMD_RET_USAGE
;
477 index
= simple_strtoul(argv
[2], NULL
, 0);
478 perm
= simple_strtoul(argv
[3], NULL
, 0);
480 return convert_return_code(tpm_nv_define_space(index
, perm
, size
));
483 static int do_tpm_nv_read(cmd_tbl_t
*cmdtp
, int flag
,
484 int argc
, char * const argv
[])
486 uint32_t index
, count
, err
;
490 return CMD_RET_USAGE
;
491 if (argc
!= 3 + type_string_get_num_values(argv
[1]))
492 return CMD_RET_USAGE
;
493 index
= simple_strtoul(argv
[2], NULL
, 0);
494 data
= type_string_alloc(argv
[1], &count
);
496 printf("Couldn't parse arguments\n");
497 return CMD_RET_USAGE
;
500 err
= tpm_nv_read_value(index
, data
, count
);
502 if (type_string_write_vars(argv
[1], data
, argv
+ 3)) {
503 printf("Couldn't write to variables\n");
509 return convert_return_code(err
);
512 static int do_tpm_nv_write(cmd_tbl_t
*cmdtp
, int flag
,
513 int argc
, char * const argv
[])
515 uint32_t index
, count
, err
;
519 return CMD_RET_USAGE
;
520 if (argc
!= 3 + type_string_get_num_values(argv
[1]))
521 return CMD_RET_USAGE
;
522 index
= simple_strtoul(argv
[2], NULL
, 0);
523 data
= type_string_alloc(argv
[1], &count
);
525 printf("Couldn't parse arguments\n");
526 return CMD_RET_USAGE
;
528 if (type_string_pack(argv
[1], argv
+ 3, data
)) {
529 printf("Couldn't parse arguments\n");
531 return CMD_RET_USAGE
;
534 err
= tpm_nv_write_value(index
, data
, count
);
537 return convert_return_code(err
);
540 #ifdef CONFIG_TPM_AUTH_SESSIONS
542 static int do_tpm_oiap(cmd_tbl_t
*cmdtp
, int flag
,
543 int argc
, char * const argv
[])
545 uint32_t auth_handle
, err
;
547 err
= tpm_oiap(&auth_handle
);
549 return convert_return_code(err
);
552 static int do_tpm_load_key2_oiap(cmd_tbl_t
*cmdtp
, int flag
,
553 int argc
, char * const argv
[])
555 uint32_t parent_handle
, key_len
, key_handle
, err
;
556 uint8_t usage_auth
[DIGEST_LENGTH
];
560 return CMD_RET_USAGE
;
562 parent_handle
= simple_strtoul(argv
[1], NULL
, 0);
563 key
= (void *)simple_strtoul(argv
[2], NULL
, 0);
564 key_len
= simple_strtoul(argv
[3], NULL
, 0);
565 if (strlen(argv
[4]) != 2 * DIGEST_LENGTH
)
566 return CMD_RET_FAILURE
;
567 parse_byte_string(argv
[4], usage_auth
, NULL
);
569 err
= tpm_load_key2_oiap(parent_handle
, key
, key_len
, usage_auth
,
572 printf("Key handle is 0x%x\n", key_handle
);
574 return convert_return_code(err
);
577 static int do_tpm_get_pub_key_oiap(cmd_tbl_t
*cmdtp
, int flag
,
578 int argc
, char * const argv
[])
580 uint32_t key_handle
, err
;
581 uint8_t usage_auth
[DIGEST_LENGTH
];
582 uint8_t pub_key_buffer
[TPM_PUBKEY_MAX_LENGTH
];
583 size_t pub_key_len
= sizeof(pub_key_buffer
);
586 return CMD_RET_USAGE
;
588 key_handle
= simple_strtoul(argv
[1], NULL
, 0);
589 if (strlen(argv
[2]) != 2 * DIGEST_LENGTH
)
590 return CMD_RET_FAILURE
;
591 parse_byte_string(argv
[2], usage_auth
, NULL
);
593 err
= tpm_get_pub_key_oiap(key_handle
, usage_auth
,
594 pub_key_buffer
, &pub_key_len
);
596 printf("dump of received pub key structure:\n");
597 print_byte_string(pub_key_buffer
, pub_key_len
);
599 return convert_return_code(err
);
602 TPM_COMMAND_NO_ARG(tpm_end_oiap
)
604 #endif /* CONFIG_TPM_AUTH_SESSIONS */
606 #define MAKE_TPM_CMD_ENTRY(cmd) \
607 U_BOOT_CMD_MKENT(cmd, 0, 1, do_tpm_ ## cmd, "", "")
609 static cmd_tbl_t tpm_commands
[] = {
610 U_BOOT_CMD_MKENT(init
, 0, 1,
611 do_tpm_init
, "", ""),
612 U_BOOT_CMD_MKENT(startup
, 0, 1,
613 do_tpm_startup
, "", ""),
614 U_BOOT_CMD_MKENT(self_test_full
, 0, 1,
615 do_tpm_self_test_full
, "", ""),
616 U_BOOT_CMD_MKENT(continue_self_test
, 0, 1,
617 do_tpm_continue_self_test
, "", ""),
618 U_BOOT_CMD_MKENT(force_clear
, 0, 1,
619 do_tpm_force_clear
, "", ""),
620 U_BOOT_CMD_MKENT(physical_enable
, 0, 1,
621 do_tpm_physical_enable
, "", ""),
622 U_BOOT_CMD_MKENT(physical_disable
, 0, 1,
623 do_tpm_physical_disable
, "", ""),
624 U_BOOT_CMD_MKENT(nv_define_space
, 0, 1,
625 do_tpm_nv_define_space
, "", ""),
626 U_BOOT_CMD_MKENT(nv_read_value
, 0, 1,
627 do_tpm_nv_read_value
, "", ""),
628 U_BOOT_CMD_MKENT(nv_write_value
, 0, 1,
629 do_tpm_nv_write_value
, "", ""),
630 U_BOOT_CMD_MKENT(extend
, 0, 1,
631 do_tpm_extend
, "", ""),
632 U_BOOT_CMD_MKENT(pcr_read
, 0, 1,
633 do_tpm_pcr_read
, "", ""),
634 U_BOOT_CMD_MKENT(tsc_physical_presence
, 0, 1,
635 do_tpm_tsc_physical_presence
, "", ""),
636 U_BOOT_CMD_MKENT(read_pubek
, 0, 1,
637 do_tpm_read_pubek
, "", ""),
638 U_BOOT_CMD_MKENT(physical_set_deactivated
, 0, 1,
639 do_tpm_physical_set_deactivated
, "", ""),
640 U_BOOT_CMD_MKENT(get_capability
, 0, 1,
641 do_tpm_get_capability
, "", ""),
642 U_BOOT_CMD_MKENT(raw_transfer
, 0, 1,
643 do_tpm_raw_transfer
, "", ""),
644 U_BOOT_CMD_MKENT(nv_define
, 0, 1,
645 do_tpm_nv_define
, "", ""),
646 U_BOOT_CMD_MKENT(nv_read
, 0, 1,
647 do_tpm_nv_read
, "", ""),
648 U_BOOT_CMD_MKENT(nv_write
, 0, 1,
649 do_tpm_nv_write
, "", ""),
650 #ifdef CONFIG_TPM_AUTH_SESSIONS
651 U_BOOT_CMD_MKENT(oiap
, 0, 1,
652 do_tpm_oiap
, "", ""),
653 U_BOOT_CMD_MKENT(end_oiap
, 0, 1,
654 do_tpm_end_oiap
, "", ""),
655 U_BOOT_CMD_MKENT(load_key2_oiap
, 0, 1,
656 do_tpm_load_key2_oiap
, "", ""),
657 U_BOOT_CMD_MKENT(get_pub_key_oiap
, 0, 1,
658 do_tpm_get_pub_key_oiap
, "", ""),
659 #endif /* CONFIG_TPM_AUTH_SESSIONS */
662 static int do_tpm(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
667 return CMD_RET_USAGE
;
668 tpm_cmd
= find_cmd_tbl(argv
[1], tpm_commands
, ARRAY_SIZE(tpm_commands
));
670 return CMD_RET_USAGE
;
672 return tpm_cmd
->cmd(cmdtp
, flag
, argc
- 1, argv
+ 1);
675 U_BOOT_CMD(tpm
, CONFIG_SYS_MAXARGS
, 1, do_tpm
,
676 "Issue a TPM command",
678 " - Issue TPM command <cmd> with arguments <args...>.\n"
679 "Admin Startup and State Commands:\n"
681 " - Put TPM into a state where it waits for 'startup' command.\n"
683 " - Issue TPM_Starup command. <mode> is one of TPM_ST_CLEAR,\n"
684 " TPM_ST_STATE, and TPM_ST_DEACTIVATED.\n"
685 "Admin Testing Commands:\n"
687 " - Test all of the TPM capabilities.\n"
688 " continue_self_test\n"
689 " - Inform TPM that it should complete the self-test.\n"
690 "Admin Opt-in Commands:\n"
692 " - Set the PERMANENT disable flag to FALSE using physical presence as\n"
694 " physical_disable\n"
695 " - Set the PERMANENT disable flag to TRUE using physical presence as\n"
697 " physical_set_deactivated 0|1\n"
698 " - Set deactivated flag.\n"
699 "Admin Ownership Commands:\n"
701 " - Issue TPM_ForceClear command.\n"
702 " tsc_physical_presence flags\n"
703 " - Set TPM device's Physical Presence flags to <flags>.\n"
704 "The Capability Commands:\n"
705 " get_capability cap_area sub_cap addr count\n"
706 " - Read <count> bytes of TPM capability indexed by <cap_area> and\n"
707 " <sub_cap> to memory address <addr>.\n"
708 #ifdef CONFIG_TPM_AUTH_SESSIONS
709 "Storage functions\n"
710 " loadkey2_oiap parent_handle key_addr key_len usage_auth\n"
711 " - loads a key data from memory address <key_addr>, <key_len> bytes\n"
712 " into TPM using the parent key <parent_handle> with authorization\n"
713 " <usage_auth> (20 bytes hex string).\n"
714 " get_pub_key_oiap key_handle usage_auth\n"
715 " - get the public key portion of a loaded key <key_handle> using\n"
716 " authorization <usage auth> (20 bytes hex string)\n"
717 #endif /* CONFIG_TPM_AUTH_SESSIONS */
718 "Endorsement Key Handling Commands:\n"
719 " read_pubek addr count\n"
720 " - Read <count> bytes of the public endorsement key to memory\n"
722 "Integrity Collection and Reporting Commands:\n"
723 " extend index digest_hex_string\n"
724 " - Add a new measurement to a PCR. Update PCR <index> with the 20-bytes\n"
725 " <digest_hex_string>\n"
726 " pcr_read index addr count\n"
727 " - Read <count> bytes from PCR <index> to memory address <addr>.\n"
728 #ifdef CONFIG_TPM_AUTH_SESSIONS
729 "Authorization Sessions\n"
731 " - setup an OIAP session\n"
733 " - terminates an active OIAP session\n"
734 #endif /* CONFIG_TPM_AUTH_SESSIONS */
735 "Non-volatile Storage Commands:\n"
736 " nv_define_space index permission size\n"
737 " - Establish a space at index <index> with <permission> of <size> bytes.\n"
738 " nv_read_value index addr count\n"
739 " - Read <count> bytes from space <index> to memory address <addr>.\n"
740 " nv_write_value index addr count\n"
741 " - Write <count> bytes from memory address <addr> to space <index>.\n"
742 "Miscellaneous helper functions:\n"
743 " raw_transfer byte_string\n"
744 " - Send a byte string <byte_string> to TPM and print the response.\n"
745 " Non-volatile storage helper functions:\n"
746 " These helper functions treat a non-volatile space as a non-padded\n"
747 " sequence of integer values. These integer values are defined by a type\n"
748 " string, which is a text string of 'bwd' characters: 'b' means a 8-bit\n"
749 " value, 'w' 16-bit value, 'd' 32-bit value. All helper functions take\n"
750 " a type string as their first argument.\n"
751 " nv_define type_string index perm\n"
752 " - Define a space <index> with permission <perm>.\n"
753 " nv_read types_string index vars...\n"
754 " - Read from space <index> to environment variables <vars...>.\n"
755 " nv_write types_string index values...\n"
756 " - Write to space <index> from values <values...>.\n"