3 * (C) Copyright 2018, Linaro Limited
5 * SPDX-License-Identifier: GPL-2.0+
8 #include <avb_verify.h>
14 #define AVB_BOOTARGS "avb_bootargs"
15 static struct AvbOps
*avb_ops
;
17 static const char * const requested_partitions
[] = {"boot",
22 int do_avb_init(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
24 unsigned long mmc_dev
;
29 mmc_dev
= simple_strtoul(argv
[1], NULL
, 16);
32 avb_ops_free(avb_ops
);
34 avb_ops
= avb_ops_alloc(mmc_dev
);
36 return CMD_RET_SUCCESS
;
38 printf("Failed to initialize avb2\n");
40 return CMD_RET_FAILURE
;
43 int do_avb_read_part(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
47 size_t bytes
, bytes_read
= 0;
51 printf("AVB 2.0 is not initialized, please run 'avb init'\n");
59 offset
= simple_strtoul(argv
[2], NULL
, 16);
60 bytes
= simple_strtoul(argv
[3], NULL
, 16);
61 buffer
= (void *)simple_strtoul(argv
[4], NULL
, 16);
63 if (avb_ops
->read_from_partition(avb_ops
, part
, offset
, bytes
,
64 buffer
, &bytes_read
) ==
66 printf("Read %zu bytes\n", bytes_read
);
67 return CMD_RET_SUCCESS
;
70 printf("Failed to read from partition\n");
72 return CMD_RET_FAILURE
;
75 int do_avb_read_part_hex(cmd_tbl_t
*cmdtp
, int flag
, int argc
,
80 size_t bytes
, bytes_read
= 0;
84 printf("AVB 2.0 is not initialized, please run 'avb init'\n");
92 offset
= simple_strtoul(argv
[2], NULL
, 16);
93 bytes
= simple_strtoul(argv
[3], NULL
, 16);
95 buffer
= malloc(bytes
);
97 printf("Failed to tlb_allocate buffer for data\n");
98 return CMD_RET_FAILURE
;
100 memset(buffer
, 0, bytes
);
102 if (avb_ops
->read_from_partition(avb_ops
, part
, offset
, bytes
, buffer
,
103 &bytes_read
) == AVB_IO_RESULT_OK
) {
104 printf("Requested %zu, read %zu bytes\n", bytes
, bytes_read
);
106 for (int i
= 0; i
< bytes_read
; i
++)
107 printf("%02X", buffer
[i
]);
112 return CMD_RET_SUCCESS
;
115 printf("Failed to read from partition\n");
118 return CMD_RET_FAILURE
;
121 int do_avb_write_part(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
129 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
130 return CMD_RET_FAILURE
;
134 return CMD_RET_USAGE
;
137 offset
= simple_strtoul(argv
[2], NULL
, 16);
138 bytes
= simple_strtoul(argv
[3], NULL
, 16);
139 buffer
= (void *)simple_strtoul(argv
[4], NULL
, 16);
141 if (avb_ops
->write_to_partition(avb_ops
, part
, offset
, bytes
, buffer
) ==
143 printf("Wrote %zu bytes\n", bytes
);
144 return CMD_RET_SUCCESS
;
147 printf("Failed to write in partition\n");
149 return CMD_RET_FAILURE
;
152 int do_avb_read_rb(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
158 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
159 return CMD_RET_FAILURE
;
163 return CMD_RET_USAGE
;
165 index
= (size_t)simple_strtoul(argv
[1], NULL
, 16);
167 if (avb_ops
->read_rollback_index(avb_ops
, index
, &rb_idx
) ==
169 printf("Rollback index: %llx\n", rb_idx
);
170 return CMD_RET_SUCCESS
;
173 printf("Failed to read rollback index\n");
175 return CMD_RET_FAILURE
;
178 int do_avb_write_rb(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
184 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
185 return CMD_RET_FAILURE
;
189 return CMD_RET_USAGE
;
191 index
= (size_t)simple_strtoul(argv
[1], NULL
, 16);
192 rb_idx
= simple_strtoul(argv
[2], NULL
, 16);
194 if (avb_ops
->write_rollback_index(avb_ops
, index
, rb_idx
) ==
196 return CMD_RET_SUCCESS
;
198 printf("Failed to write rollback index\n");
200 return CMD_RET_FAILURE
;
203 int do_avb_get_uuid(cmd_tbl_t
*cmdtp
, int flag
,
204 int argc
, char * const argv
[])
207 char buffer
[UUID_STR_LEN
+ 1];
210 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
211 return CMD_RET_FAILURE
;
215 return CMD_RET_USAGE
;
219 if (avb_ops
->get_unique_guid_for_partition(avb_ops
, part
, buffer
,
222 printf("'%s' UUID: %s\n", part
, buffer
);
223 return CMD_RET_SUCCESS
;
226 printf("Failed to read UUID\n");
228 return CMD_RET_FAILURE
;
231 int do_avb_verify_part(cmd_tbl_t
*cmdtp
, int flag
,
232 int argc
, char *const argv
[])
234 AvbSlotVerifyResult slot_result
;
235 AvbSlotVerifyData
*out_data
;
239 bool unlocked
= false;
240 int res
= CMD_RET_FAILURE
;
243 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
244 return CMD_RET_FAILURE
;
248 return CMD_RET_USAGE
;
250 printf("## Android Verified Boot 2.0 version %s\n",
251 avb_version_string());
253 if (avb_ops
->read_is_device_unlocked(avb_ops
, &unlocked
) !=
255 printf("Can't determine device lock state.\n");
256 return CMD_RET_FAILURE
;
260 avb_slot_verify(avb_ops
,
261 requested_partitions
,
264 AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE
,
267 switch (slot_result
) {
268 case AVB_SLOT_VERIFY_RESULT_OK
:
269 /* Until we don't have support of changing unlock states, we
270 * assume that we are by default in locked state.
271 * So in this case we can boot only when verification is
272 * successful; we also supply in cmdline GREEN boot state
274 printf("Verification passed successfully\n");
276 /* export additional bootargs to AVB_BOOTARGS env var */
278 extra_args
= avb_set_state(avb_ops
, AVB_GREEN
);
280 cmdline
= append_cmd_line(out_data
->cmdline
,
283 cmdline
= out_data
->cmdline
;
285 env_set(AVB_BOOTARGS
, cmdline
);
287 res
= CMD_RET_SUCCESS
;
289 case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION
:
290 printf("Verification failed\n");
292 case AVB_SLOT_VERIFY_RESULT_ERROR_IO
:
293 printf("I/O error occurred during verification\n");
295 case AVB_SLOT_VERIFY_RESULT_ERROR_OOM
:
296 printf("OOM error occurred during verification\n");
298 case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA
:
299 printf("Corrupted dm-verity metadata detected\n");
301 case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION
:
302 printf("Unsupported version avbtool was used\n");
304 case AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX
:
305 printf("Checking rollback index failed\n");
307 case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED
:
308 printf("Public key was rejected\n");
311 printf("Unknown error occurred\n");
317 int do_avb_is_unlocked(cmd_tbl_t
*cmdtp
, int flag
,
318 int argc
, char * const argv
[])
323 printf("AVB not initialized, run 'avb init' first\n");
324 return CMD_RET_FAILURE
;
328 printf("--%s(-1)\n", __func__
);
329 return CMD_RET_USAGE
;
332 if (avb_ops
->read_is_device_unlocked(avb_ops
, &unlock
) ==
334 printf("Unlocked = %d\n", unlock
);
335 return CMD_RET_SUCCESS
;
338 printf("Can't determine device lock state.\n");
340 return CMD_RET_FAILURE
;
343 static cmd_tbl_t cmd_avb
[] = {
344 U_BOOT_CMD_MKENT(init
, 2, 0, do_avb_init
, "", ""),
345 U_BOOT_CMD_MKENT(read_rb
, 2, 0, do_avb_read_rb
, "", ""),
346 U_BOOT_CMD_MKENT(write_rb
, 3, 0, do_avb_write_rb
, "", ""),
347 U_BOOT_CMD_MKENT(is_unlocked
, 1, 0, do_avb_is_unlocked
, "", ""),
348 U_BOOT_CMD_MKENT(get_uuid
, 2, 0, do_avb_get_uuid
, "", ""),
349 U_BOOT_CMD_MKENT(read_part
, 5, 0, do_avb_read_part
, "", ""),
350 U_BOOT_CMD_MKENT(read_part_hex
, 4, 0, do_avb_read_part_hex
, "", ""),
351 U_BOOT_CMD_MKENT(write_part
, 5, 0, do_avb_write_part
, "", ""),
352 U_BOOT_CMD_MKENT(verify
, 1, 0, do_avb_verify_part
, "", ""),
355 static int do_avb(cmd_tbl_t
*cmdtp
, int flag
, int argc
, char * const argv
[])
359 cp
= find_cmd_tbl(argv
[1], cmd_avb
, ARRAY_SIZE(cmd_avb
));
364 if (!cp
|| argc
> cp
->maxargs
)
365 return CMD_RET_USAGE
;
367 if (flag
== CMD_FLAG_REPEAT
)
368 return CMD_RET_FAILURE
;
370 return cp
->cmd(cmdtp
, flag
, argc
, argv
);
375 "Provides commands for testing Android Verified Boot 2.0 functionality",
376 "init <dev> - initialize avb2 for <dev>\n"
377 "avb read_rb <num> - read rollback index at location <num>\n"
378 "avb write_rb <num> <rb> - write rollback index <rb> to <num>\n"
379 "avb is_unlocked - returns unlock status of the device\n"
380 "avb get_uuid <partname> - read and print uuid of partition <part>\n"
381 "avb read_part <partname> <offset> <num> <addr> - read <num> bytes from\n"
382 " partition <partname> to buffer <addr>\n"
383 "avb read_part_hex <partname> <offset> <num> - read <num> bytes from\n"
384 " partition <partname> and print to stdout\n"
385 "avb write_part <partname> <offset> <num> <addr> - write <num> bytes to\n"
386 " <partname> by <offset> using data from <addr>\n"
387 "avb verify - run verification process using hash data\n"
388 " from vbmeta structure\n"