2 * Copyright (c) 2013 The Chromium OS Authors.
4 * See file CREDITS for list of people who contributed to this
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 of
10 * the License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
27 #include <asm/unaligned.h>
28 #include <linux/string.h>
30 /* Useful constants */
33 /* max lengths, valid for RSA keys <= 2048 bits */
34 TPM_PUBKEY_MAX_LENGTH
= 288,
38 * Print a byte string in hexdecimal format, 16-bytes per line.
40 * @param data byte string to be printed
41 * @param count number of bytes to be printed
43 static void print_byte_string(uint8_t *data
, size_t count
)
45 int i
, print_newline
= 0;
47 for (i
= 0; i
< count
; i
++) {
48 printf(" %02x", data
[i
]);
49 print_newline
= (i
% 16 == 15);
53 /* Avoid duplicated newline at the end */
59 * Convert a text string of hexdecimal values into a byte string.
61 * @param bytes text string of hexdecimal values with no space
63 * @param data output buffer for byte string. The caller has to make
64 * sure it is large enough for storing the output. If
65 * NULL is passed, a large enough buffer will be allocated,
66 * and the caller must free it.
67 * @param count_ptr output variable for the length of byte string
68 * @return pointer to output buffer
70 static void *parse_byte_string(char *bytes
, uint8_t *data
, size_t *count_ptr
)
76 length
= strlen(bytes
);
85 for (i
= 0; i
< length
; i
+= 2) {
87 byte
[1] = bytes
[i
+ 1];
88 data
[i
/ 2] = (uint8_t)simple_strtoul(byte
, NULL
, 16);
98 * Convert TPM command return code to U-Boot command error codes.
100 * @param return_code TPM command return code
101 * @return value of enum command_ret_t
103 static int convert_return_code(uint32_t return_code
)
106 return CMD_RET_FAILURE
;
108 return CMD_RET_SUCCESS
;
112 * Return number of values defined by a type string.
114 * @param type_str type string
115 * @return number of values of type string
117 static int type_string_get_num_values(const char *type_str
)
119 return strlen(type_str
);
123 * Return total size of values defined by a type string.
125 * @param type_str type string
126 * @return total size of values of type string, or 0 if type string
127 * contains illegal type character.
129 static size_t type_string_get_space_size(const char *type_str
)
133 for (size
= 0; *type_str
; type_str
++) {
153 * Allocate a buffer large enough to hold values defined by a type
154 * string. The caller has to free the buffer.
156 * @param type_str type string
157 * @param count pointer for storing size of buffer
158 * @return pointer to buffer or NULL on error
160 static void *type_string_alloc(const char *type_str
, uint32_t *count
)
165 size
= type_string_get_space_size(type_str
);
176 * Pack values defined by a type string into a buffer. The buffer must have
177 * large enough space.
179 * @param type_str type string
180 * @param values text strings of values to be packed
181 * @param data output buffer of values
182 * @return 0 on success, non-0 on error
184 static int type_string_pack(const char *type_str
, char * const values
[],
190 for (offset
= 0; *type_str
; type_str
++, values
++) {
191 value
= simple_strtoul(values
[0], NULL
, 0);
194 data
[offset
] = value
;
198 put_unaligned_be16(value
, data
+ offset
);
202 put_unaligned_be32(value
, data
+ offset
);
214 * Read values defined by a type string from a buffer, and write these values
215 * to environment variables.
217 * @param type_str type string
218 * @param data input buffer of values
219 * @param vars names of environment variables
220 * @return 0 on success, non-0 on error
222 static int type_string_write_vars(const char *type_str
, uint8_t *data
,
228 for (offset
= 0; *type_str
; type_str
++, vars
++) {
231 value
= data
[offset
];
235 value
= get_unaligned_be16(data
+ offset
);
239 value
= get_unaligned_be32(data
+ offset
);
245 if (setenv_ulong(*vars
, value
))
252 static int do_tpm_startup(cmd_tbl_t
*cmdtp
, int flag
,
253 int argc
, char * const argv
[])
255 enum tpm_startup_type mode
;
258 return CMD_RET_USAGE
;
259 if (!strcasecmp("TPM_ST_CLEAR", argv
[1])) {
261 } else if (!strcasecmp("TPM_ST_STATE", argv
[1])) {
263 } else if (!strcasecmp("TPM_ST_DEACTIVATED", argv
[1])) {
264 mode
= TPM_ST_DEACTIVATED
;
266 printf("Couldn't recognize mode string: %s\n", argv
[1]);
267 return CMD_RET_FAILURE
;
270 return convert_return_code(tpm_startup(mode
));
273 static int do_tpm_nv_define_space(cmd_tbl_t
*cmdtp
, int flag
,
274 int argc
, char * const argv
[])
276 uint32_t index
, perm
, size
;
279 return CMD_RET_USAGE
;
280 index
= simple_strtoul(argv
[1], NULL
, 0);
281 perm
= simple_strtoul(argv
[2], NULL
, 0);
282 size
= simple_strtoul(argv
[3], NULL
, 0);
284 return convert_return_code(tpm_nv_define_space(index
, perm
, size
));
287 static int do_tpm_nv_read_value(cmd_tbl_t
*cmdtp
, int flag
,
288 int argc
, char * const argv
[])
290 uint32_t index
, count
, rc
;
294 return CMD_RET_USAGE
;
295 index
= simple_strtoul(argv
[1], NULL
, 0);
296 data
= (void *)simple_strtoul(argv
[2], NULL
, 0);
297 count
= simple_strtoul(argv
[3], NULL
, 0);
299 rc
= tpm_nv_read_value(index
, data
, count
);
301 puts("area content:\n");
302 print_byte_string(data
, count
);
305 return convert_return_code(rc
);
308 static int do_tpm_nv_write_value(cmd_tbl_t
*cmdtp
, int flag
,
309 int argc
, char * const argv
[])
316 return CMD_RET_USAGE
;
317 index
= simple_strtoul(argv
[1], NULL
, 0);
318 data
= parse_byte_string(argv
[2], NULL
, &count
);
320 printf("Couldn't parse byte string %s\n", argv
[2]);
321 return CMD_RET_FAILURE
;
324 rc
= tpm_nv_write_value(index
, data
, count
);
327 return convert_return_code(rc
);
330 static int do_tpm_extend(cmd_tbl_t
*cmdtp
, int flag
,
331 int argc
, char * const argv
[])
334 uint8_t in_digest
[20], out_digest
[20];
337 return CMD_RET_USAGE
;
338 index
= simple_strtoul(argv
[1], NULL
, 0);
339 if (!parse_byte_string(argv
[2], in_digest
, NULL
)) {
340 printf("Couldn't parse byte string %s\n", argv
[2]);
341 return CMD_RET_FAILURE
;
344 rc
= tpm_extend(index
, in_digest
, out_digest
);
346 puts("PCR value after execution of the command:\n");
347 print_byte_string(out_digest
, sizeof(out_digest
));
350 return convert_return_code(rc
);
353 static int do_tpm_pcr_read(cmd_tbl_t
*cmdtp
, int flag
,
354 int argc
, char * const argv
[])
356 uint32_t index
, count
, rc
;
360 return CMD_RET_USAGE
;
361 index
= simple_strtoul(argv
[1], NULL
, 0);
362 data
= (void *)simple_strtoul(argv
[2], NULL
, 0);
363 count
= simple_strtoul(argv
[3], NULL
, 0);
365 rc
= tpm_pcr_read(index
, data
, count
);
367 puts("Named PCR content:\n");
368 print_byte_string(data
, count
);
371 return convert_return_code(rc
);
374 static int do_tpm_tsc_physical_presence(cmd_tbl_t
*cmdtp
, int flag
,
375 int argc
, char * const argv
[])
380 return CMD_RET_USAGE
;
381 presence
= (uint16_t)simple_strtoul(argv
[1], NULL
, 0);
383 return convert_return_code(tpm_tsc_physical_presence(presence
));
386 static int do_tpm_read_pubek(cmd_tbl_t
*cmdtp
, int flag
,
387 int argc
, char * const argv
[])
393 return CMD_RET_USAGE
;
394 data
= (void *)simple_strtoul(argv
[1], NULL
, 0);
395 count
= simple_strtoul(argv
[2], NULL
, 0);
397 rc
= tpm_read_pubek(data
, count
);
399 puts("pubek value:\n");
400 print_byte_string(data
, count
);
403 return convert_return_code(rc
);
406 static int do_tpm_physical_set_deactivated(cmd_tbl_t
*cmdtp
, int flag
,
407 int argc
, char * const argv
[])
412 return CMD_RET_USAGE
;
413 state
= (uint8_t)simple_strtoul(argv
[1], NULL
, 0);
415 return convert_return_code(tpm_physical_set_deactivated(state
));
418 static int do_tpm_get_capability(cmd_tbl_t
*cmdtp
, int flag
,
419 int argc
, char * const argv
[])
421 uint32_t cap_area
, sub_cap
, rc
;
426 return CMD_RET_USAGE
;
427 cap_area
= simple_strtoul(argv
[1], NULL
, 0);
428 sub_cap
= simple_strtoul(argv
[2], NULL
, 0);
429 cap
= (void *)simple_strtoul(argv
[3], NULL
, 0);
430 count
= simple_strtoul(argv
[4], NULL
, 0);
432 rc
= tpm_get_capability(cap_area
, sub_cap
, cap
, count
);
434 puts("capability information:\n");
435 print_byte_string(cap
, count
);
438 return convert_return_code(rc
);
441 #define TPM_COMMAND_NO_ARG(cmd) \
442 static int do_##cmd(cmd_tbl_t *cmdtp, int flag, \
443 int argc, char * const argv[]) \
446 return CMD_RET_USAGE; \
447 return convert_return_code(cmd()); \
450 TPM_COMMAND_NO_ARG(tpm_init
)
451 TPM_COMMAND_NO_ARG(tpm_self_test_full
)
452 TPM_COMMAND_NO_ARG(tpm_continue_self_test
)
453 TPM_COMMAND_NO_ARG(tpm_force_clear
)
454 TPM_COMMAND_NO_ARG(tpm_physical_enable
)
455 TPM_COMMAND_NO_ARG(tpm_physical_disable
)
457 static int do_tpm_raw_transfer(cmd_tbl_t
*cmdtp
, int flag
,
458 int argc
, char * const argv
[])
461 uint8_t response
[1024];
462 size_t count
, response_length
= sizeof(response
);
465 command
= parse_byte_string(argv
[1], NULL
, &count
);
467 printf("Couldn't parse byte string %s\n", argv
[1]);
468 return CMD_RET_FAILURE
;
471 rc
= tis_sendrecv(command
, count
, response
, &response_length
);
474 puts("tpm response:\n");
475 print_byte_string(response
, response_length
);
478 return convert_return_code(rc
);
481 static int do_tpm_nv_define(cmd_tbl_t
*cmdtp
, int flag
,
482 int argc
, char * const argv
[])
484 uint32_t index
, perm
, size
;
487 return CMD_RET_USAGE
;
488 size
= type_string_get_space_size(argv
[1]);
490 printf("Couldn't parse arguments\n");
491 return CMD_RET_USAGE
;
493 index
= simple_strtoul(argv
[2], NULL
, 0);
494 perm
= simple_strtoul(argv
[3], NULL
, 0);
496 return convert_return_code(tpm_nv_define_space(index
, perm
, size
));
499 static int do_tpm_nv_read(cmd_tbl_t
*cmdtp
, int flag
,
500 int argc
, char * const argv
[])
502 uint32_t index
, count
, err
;
506 return CMD_RET_USAGE
;
507 if (argc
!= 3 + type_string_get_num_values(argv
[1]))
508 return CMD_RET_USAGE
;
509 index
= simple_strtoul(argv
[2], NULL
, 0);
510 data
= type_string_alloc(argv
[1], &count
);
512 printf("Couldn't parse arguments\n");
513 return CMD_RET_USAGE
;
516 err
= tpm_nv_read_value(index
, data
, count
);
518 if (type_string_write_vars(argv
[1], data
, argv
+ 3)) {
519 printf("Couldn't write to variables\n");
525 return convert_return_code(err
);
528 static int do_tpm_nv_write(cmd_tbl_t
*cmdtp
, int flag
,
529 int argc
, char * const argv
[])
531 uint32_t index
, count
, err
;
535 return CMD_RET_USAGE
;
536 if (argc
!= 3 + type_string_get_num_values(argv
[1]))
537 return CMD_RET_USAGE
;
538 index
= simple_strtoul(argv
[2], NULL
, 0);
539 data
= type_string_alloc(argv
[1], &count
);
541 printf("Couldn't parse arguments\n");
542 return CMD_RET_USAGE
;
544 if (type_string_pack(argv
[1], argv
+ 3, data
)) {
545 printf("Couldn't parse arguments\n");
547 return CMD_RET_USAGE
;
550 err
= tpm_nv_write_value(index
, data
, count
);
553 return convert_return_code(err
);
556 #ifdef CONFIG_TPM_AUTH_SESSIONS
558 static int do_tpm_oiap(cmd_tbl_t
*cmdtp
, int flag
,
559 int argc
, char * const argv
[])
561 uint32_t auth_handle
, err
;
563 err
= tpm_oiap(&auth_handle
);
565 return convert_return_code(err
);
568 static int do_tpm_load_key2_oiap(cmd_tbl_t
*cmdtp
, int flag
,
569 int argc
, char * const argv
[])
571 uint32_t parent_handle
, key_len
, key_handle
, err
;
572 uint8_t usage_auth
[DIGEST_LENGTH
];
576 return CMD_RET_USAGE
;
578 parent_handle
= simple_strtoul(argv
[1], NULL
, 0);
579 key
= (void *)simple_strtoul(argv
[2], NULL
, 0);
580 key_len
= simple_strtoul(argv
[3], NULL
, 0);
581 if (strlen(argv
[4]) != 2 * DIGEST_LENGTH
)
582 return CMD_RET_FAILURE
;
583 parse_byte_string(argv
[4], usage_auth
, NULL
);
585 err
= tpm_load_key2_oiap(parent_handle
, key
, key_len
, usage_auth
,
588 printf("Key handle is 0x%x\n", key_handle
);
590 return convert_return_code(err
);
593 static int do_tpm_get_pub_key_oiap(cmd_tbl_t
*cmdtp
, int flag
,
594 int argc
, char * const argv
[])
596 uint32_t key_handle
, err
;
597 uint8_t usage_auth
[DIGEST_LENGTH
];
598 uint8_t pub_key_buffer
[TPM_PUBKEY_MAX_LENGTH
];
599 size_t pub_key_len
= sizeof(pub_key_buffer
);
602 return CMD_RET_USAGE
;
604 key_handle
= simple_strtoul(argv
[1], NULL
, 0);
605 if (strlen(argv
[2]) != 2 * DIGEST_LENGTH
)
606 return CMD_RET_FAILURE
;
607 parse_byte_string(argv
[2], usage_auth
, NULL
);
609 err
= tpm_get_pub_key_oiap(key_handle
, usage_auth
,
610 pub_key_buffer
, &pub_key_len
);
612 printf("dump of received pub key structure:\n");
613 print_byte_string(pub_key_buffer
, pub_key_len
);
615 return convert_return_code(err
);
618 TPM_COMMAND_NO_ARG(tpm_end_oiap
)
620 #endif /* CONFIG_TPM_AUTH_SESSIONS */
622 #define MAKE_TPM_CMD_ENTRY(cmd) \
623 U_BOOT_CMD_MKENT(cmd, 0, 1, do_tpm_ ## cmd, "", "")
625 static cmd_tbl_t tpm_commands
[] = {
626 U_BOOT_CMD_MKENT(init
, 0, 1,
627 do_tpm_init
, "", ""),
628 U_BOOT_CMD_MKENT(startup
, 0, 1,
629 do_tpm_startup
, "", ""),
630 U_BOOT_CMD_MKENT(self_test_full
, 0, 1,
631 do_tpm_self_test_full
, "", ""),
632 U_BOOT_CMD_MKENT(continue_self_test
, 0, 1,
633 do_tpm_continue_self_test
, "", ""),
634 U_BOOT_CMD_MKENT(force_clear
, 0, 1,
635 do_tpm_force_clear
, "", ""),
636 U_BOOT_CMD_MKENT(physical_enable
, 0, 1,
637 do_tpm_physical_enable
, "", ""),
638 U_BOOT_CMD_MKENT(physical_disable
, 0, 1,
639 do_tpm_physical_disable
, "", ""),
640 U_BOOT_CMD_MKENT(nv_define_space
, 0, 1,
641 do_tpm_nv_define_space
, "", ""),
642 U_BOOT_CMD_MKENT(nv_read_value
, 0, 1,
643 do_tpm_nv_read_value
, "", ""),
644 U_BOOT_CMD_MKENT(nv_write_value
, 0, 1,
645 do_tpm_nv_write_value
, "", ""),
646 U_BOOT_CMD_MKENT(extend
, 0, 1,
647 do_tpm_extend
, "", ""),
648 U_BOOT_CMD_MKENT(pcr_read
, 0, 1,
649 do_tpm_pcr_read
, "", ""),
650 U_BOOT_CMD_MKENT(tsc_physical_presence
, 0, 1,
651 do_tpm_tsc_physical_presence
, "", ""),
652 U_BOOT_CMD_MKENT(read_pubek
, 0, 1,
653 do_tpm_read_pubek
, "", ""),
654 U_BOOT_CMD_MKENT(physical_set_deactivated
, 0, 1,
655 do_tpm_physical_set_deactivated
, "", ""),
656 U_BOOT_CMD_MKENT(get_capability
, 0, 1,
657 do_tpm_get_capability
, "", ""),
658 U_BOOT_CMD_MKENT(raw_transfer
, 0, 1,
659 do_tpm_raw_transfer
, "", ""),
660 U_BOOT_CMD_MKENT(nv_define
, 0, 1,
661 do_tpm_nv_define
, "", ""),
662 U_BOOT_CMD_MKENT(nv_read
, 0, 1,
663 do_tpm_nv_read
, "", ""),
664 U_BOOT_CMD_MKENT(nv_write
, 0, 1,
665 do_tpm_nv_write
, "", ""),
666 #ifdef CONFIG_TPM_AUTH_SESSIONS
667 U_BOOT_CMD_MKENT(oiap
, 0, 1,
668 do_tpm_oiap
, "", ""),
669 U_BOOT_CMD_MKENT(end_oiap
, 0, 1,
670 do_tpm_end_oiap
, "", ""),
671 U_BOOT_CMD_MKENT(load_key2_oiap
, 0, 1,
672 do_tpm_load_key2_oiap
, "", ""),
673 U_BOOT_CMD_MKENT(get_pub_key_oiap
, 0, 1,
674 do_tpm_get_pub_key_oiap
, "", ""),
675 #endif /* CONFIG_TPM_AUTH_SESSIONS */
678 static int do_tpm(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
683 return CMD_RET_USAGE
;
684 tpm_cmd
= find_cmd_tbl(argv
[1], tpm_commands
, ARRAY_SIZE(tpm_commands
));
686 return CMD_RET_USAGE
;
688 return tpm_cmd
->cmd(cmdtp
, flag
, argc
- 1, argv
+ 1);
691 U_BOOT_CMD(tpm
, CONFIG_SYS_MAXARGS
, 1, do_tpm
,
692 "Issue a TPM command",
694 " - Issue TPM command <cmd> with arguments <args...>.\n"
695 "Admin Startup and State Commands:\n"
697 " - Put TPM into a state where it waits for 'startup' command.\n"
699 " - Issue TPM_Starup command. <mode> is one of TPM_ST_CLEAR,\n"
700 " TPM_ST_STATE, and TPM_ST_DEACTIVATED.\n"
701 "Admin Testing Commands:\n"
703 " - Test all of the TPM capabilities.\n"
704 " continue_self_test\n"
705 " - Inform TPM that it should complete the self-test.\n"
706 "Admin Opt-in Commands:\n"
708 " - Set the PERMANENT disable flag to FALSE using physical presence as\n"
710 " physical_disable\n"
711 " - Set the PERMANENT disable flag to TRUE using physical presence as\n"
713 " physical_set_deactivated 0|1\n"
714 " - Set deactivated flag.\n"
715 "Admin Ownership Commands:\n"
717 " - Issue TPM_ForceClear command.\n"
718 " tsc_physical_presence flags\n"
719 " - Set TPM device's Physical Presence flags to <flags>.\n"
720 "The Capability Commands:\n"
721 " get_capability cap_area sub_cap addr count\n"
722 " - Read <count> bytes of TPM capability indexed by <cap_area> and\n"
723 " <sub_cap> to memory address <addr>.\n"
724 #ifdef CONFIG_TPM_AUTH_SESSIONS
725 "Storage functions\n"
726 " loadkey2_oiap parent_handle key_addr key_len usage_auth\n"
727 " - loads a key data from memory address <key_addr>, <key_len> bytes\n"
728 " into TPM using the parent key <parent_handle> with authorization\n"
729 " <usage_auth> (20 bytes hex string).\n"
730 " get_pub_key_oiap key_handle usage_auth\n"
731 " - get the public key portion of a loaded key <key_handle> using\n"
732 " authorization <usage auth> (20 bytes hex string)\n"
733 #endif /* CONFIG_TPM_AUTH_SESSIONS */
734 "Endorsement Key Handling Commands:\n"
735 " read_pubek addr count\n"
736 " - Read <count> bytes of the public endorsement key to memory\n"
738 "Integrity Collection and Reporting Commands:\n"
739 " extend index digest_hex_string\n"
740 " - Add a new measurement to a PCR. Update PCR <index> with the 20-bytes\n"
741 " <digest_hex_string>\n"
742 " pcr_read index addr count\n"
743 " - Read <count> bytes from PCR <index> to memory address <addr>.\n"
744 #ifdef CONFIG_TPM_AUTH_SESSIONS
745 "Authorization Sessions\n"
747 " - setup an OIAP session\n"
749 " - terminates an active OIAP session\n"
750 #endif /* CONFIG_TPM_AUTH_SESSIONS */
751 "Non-volatile Storage Commands:\n"
752 " nv_define_space index permission size\n"
753 " - Establish a space at index <index> with <permission> of <size> bytes.\n"
754 " nv_read_value index addr count\n"
755 " - Read <count> bytes from space <index> to memory address <addr>.\n"
756 " nv_write_value index addr count\n"
757 " - Write <count> bytes from memory address <addr> to space <index>.\n"
758 "Miscellaneous helper functions:\n"
759 " raw_transfer byte_string\n"
760 " - Send a byte string <byte_string> to TPM and print the response.\n"
761 " Non-volatile storage helper functions:\n"
762 " These helper functions treat a non-volatile space as a non-padded\n"
763 " sequence of integer values. These integer values are defined by a type\n"
764 " string, which is a text string of 'bwd' characters: 'b' means a 8-bit\n"
765 " value, 'w' 16-bit value, 'd' 32-bit value. All helper functions take\n"
766 " a type string as their first argument.\n"
767 " nv_define type_string index perm\n"
768 " - Define a space <index> with permission <perm>.\n"
769 " nv_read types_string index vars...\n"
770 " - Read from space <index> to environment variables <vars...>.\n"
771 " nv_write types_string index values...\n"
772 " - Write to space <index> from values <values...>.\n"