blob: c5af4a2e461d4ac224ab2410b846aec8ab5f6a4b [file] [log] [blame]
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +03001
2/*
3 * (C) Copyright 2018, Linaro Limited
4 *
5 * SPDX-License-Identifier: GPL-2.0+
6 */
7
8#include <avb_verify.h>
9#include <command.h>
10#include <image.h>
11#include <malloc.h>
12#include <mmc.h>
13
14#define AVB_BOOTARGS "avb_bootargs"
15static struct AvbOps *avb_ops;
16
17static const char * const requested_partitions[] = {"boot",
18 "system",
19 "vendor",
20 NULL};
21
22int do_avb_init(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
23{
24 unsigned long mmc_dev;
25
26 if (argc != 2)
27 return CMD_RET_USAGE;
28
29 mmc_dev = simple_strtoul(argv[1], NULL, 16);
30
31 if (avb_ops)
32 avb_ops_free(avb_ops);
33
34 avb_ops = avb_ops_alloc(mmc_dev);
35 if (avb_ops)
36 return CMD_RET_SUCCESS;
37
Jens Wiklander6d899022018-09-25 16:40:07 +020038 printf("Failed to initialize avb2\n");
39
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +030040 return CMD_RET_FAILURE;
41}
42
43int do_avb_read_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
44{
45 const char *part;
46 s64 offset;
47 size_t bytes, bytes_read = 0;
48 void *buffer;
49
50 if (!avb_ops) {
51 printf("AVB 2.0 is not initialized, please run 'avb init'\n");
52 return CMD_RET_USAGE;
53 }
54
55 if (argc != 5)
56 return CMD_RET_USAGE;
57
58 part = argv[1];
59 offset = simple_strtoul(argv[2], NULL, 16);
60 bytes = simple_strtoul(argv[3], NULL, 16);
61 buffer = (void *)simple_strtoul(argv[4], NULL, 16);
62
63 if (avb_ops->read_from_partition(avb_ops, part, offset, bytes,
64 buffer, &bytes_read) ==
65 AVB_IO_RESULT_OK) {
66 printf("Read %zu bytes\n", bytes_read);
67 return CMD_RET_SUCCESS;
68 }
69
Jens Wiklander6d899022018-09-25 16:40:07 +020070 printf("Failed to read from partition\n");
71
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +030072 return CMD_RET_FAILURE;
73}
74
75int do_avb_read_part_hex(cmd_tbl_t *cmdtp, int flag, int argc,
76 char *const argv[])
77{
78 const char *part;
79 s64 offset;
80 size_t bytes, bytes_read = 0;
81 char *buffer;
82
83 if (!avb_ops) {
84 printf("AVB 2.0 is not initialized, please run 'avb init'\n");
85 return CMD_RET_USAGE;
86 }
87
88 if (argc != 4)
89 return CMD_RET_USAGE;
90
91 part = argv[1];
92 offset = simple_strtoul(argv[2], NULL, 16);
93 bytes = simple_strtoul(argv[3], NULL, 16);
94
95 buffer = malloc(bytes);
96 if (!buffer) {
97 printf("Failed to tlb_allocate buffer for data\n");
98 return CMD_RET_FAILURE;
99 }
100 memset(buffer, 0, bytes);
101
102 if (avb_ops->read_from_partition(avb_ops, part, offset, bytes, buffer,
103 &bytes_read) == AVB_IO_RESULT_OK) {
104 printf("Requested %zu, read %zu bytes\n", bytes, bytes_read);
105 printf("Data: ");
106 for (int i = 0; i < bytes_read; i++)
107 printf("%02X", buffer[i]);
108
109 printf("\n");
110
111 free(buffer);
112 return CMD_RET_SUCCESS;
113 }
114
Jens Wiklander6d899022018-09-25 16:40:07 +0200115 printf("Failed to read from partition\n");
116
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300117 free(buffer);
118 return CMD_RET_FAILURE;
119}
120
121int do_avb_write_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
122{
123 const char *part;
124 s64 offset;
125 size_t bytes;
126 void *buffer;
127
128 if (!avb_ops) {
129 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
130 return CMD_RET_FAILURE;
131 }
132
133 if (argc != 5)
134 return CMD_RET_USAGE;
135
136 part = argv[1];
137 offset = simple_strtoul(argv[2], NULL, 16);
138 bytes = simple_strtoul(argv[3], NULL, 16);
139 buffer = (void *)simple_strtoul(argv[4], NULL, 16);
140
141 if (avb_ops->write_to_partition(avb_ops, part, offset, bytes, buffer) ==
142 AVB_IO_RESULT_OK) {
143 printf("Wrote %zu bytes\n", bytes);
144 return CMD_RET_SUCCESS;
145 }
146
Jens Wiklander6d899022018-09-25 16:40:07 +0200147 printf("Failed to write in partition\n");
148
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300149 return CMD_RET_FAILURE;
150}
151
152int do_avb_read_rb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
153{
154 size_t index;
155 u64 rb_idx;
156
157 if (!avb_ops) {
158 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
159 return CMD_RET_FAILURE;
160 }
161
162 if (argc != 2)
163 return CMD_RET_USAGE;
164
165 index = (size_t)simple_strtoul(argv[1], NULL, 16);
166
167 if (avb_ops->read_rollback_index(avb_ops, index, &rb_idx) ==
168 AVB_IO_RESULT_OK) {
Jens Wiklanderab2d7382018-09-25 16:40:06 +0200169 printf("Rollback index: %llx\n", rb_idx);
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300170 return CMD_RET_SUCCESS;
171 }
Jens Wiklander6d899022018-09-25 16:40:07 +0200172
173 printf("Failed to read rollback index\n");
174
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300175 return CMD_RET_FAILURE;
176}
177
178int do_avb_write_rb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
179{
180 size_t index;
181 u64 rb_idx;
182
183 if (!avb_ops) {
184 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
185 return CMD_RET_FAILURE;
186 }
187
188 if (argc != 3)
189 return CMD_RET_USAGE;
190
191 index = (size_t)simple_strtoul(argv[1], NULL, 16);
192 rb_idx = simple_strtoul(argv[2], NULL, 16);
193
194 if (avb_ops->write_rollback_index(avb_ops, index, rb_idx) ==
195 AVB_IO_RESULT_OK)
196 return CMD_RET_SUCCESS;
197
Jens Wiklander6d899022018-09-25 16:40:07 +0200198 printf("Failed to write rollback index\n");
199
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300200 return CMD_RET_FAILURE;
201}
202
203int do_avb_get_uuid(cmd_tbl_t *cmdtp, int flag,
204 int argc, char * const argv[])
205{
206 const char *part;
207 char buffer[UUID_STR_LEN + 1];
208
209 if (!avb_ops) {
210 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
211 return CMD_RET_FAILURE;
212 }
213
214 if (argc != 2)
215 return CMD_RET_USAGE;
216
217 part = argv[1];
218
219 if (avb_ops->get_unique_guid_for_partition(avb_ops, part, buffer,
220 UUID_STR_LEN + 1) ==
221 AVB_IO_RESULT_OK) {
222 printf("'%s' UUID: %s\n", part, buffer);
223 return CMD_RET_SUCCESS;
224 }
225
Jens Wiklander6d899022018-09-25 16:40:07 +0200226 printf("Failed to read UUID\n");
227
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300228 return CMD_RET_FAILURE;
229}
230
231int do_avb_verify_part(cmd_tbl_t *cmdtp, int flag,
232 int argc, char *const argv[])
233{
234 AvbSlotVerifyResult slot_result;
235 AvbSlotVerifyData *out_data;
Igor Opaniuk5d4fd872018-06-03 21:56:40 +0300236 char *cmdline;
237 char *extra_args;
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300238
239 bool unlocked = false;
240 int res = CMD_RET_FAILURE;
241
242 if (!avb_ops) {
243 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
244 return CMD_RET_FAILURE;
245 }
246
247 if (argc != 1)
248 return CMD_RET_USAGE;
249
250 printf("## Android Verified Boot 2.0 version %s\n",
251 avb_version_string());
252
253 if (avb_ops->read_is_device_unlocked(avb_ops, &unlocked) !=
254 AVB_IO_RESULT_OK) {
255 printf("Can't determine device lock state.\n");
256 return CMD_RET_FAILURE;
257 }
258
259 slot_result =
260 avb_slot_verify(avb_ops,
261 requested_partitions,
262 "",
263 unlocked,
264 AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE,
265 &out_data);
266
267 switch (slot_result) {
268 case AVB_SLOT_VERIFY_RESULT_OK:
Igor Opaniuk5d4fd872018-06-03 21:56:40 +0300269 /* Until we don't have support of changing unlock states, we
270 * assume that we are by default in locked state.
271 * So in this case we can boot only when verification is
272 * successful; we also supply in cmdline GREEN boot state
273 */
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300274 printf("Verification passed successfully\n");
275
276 /* export additional bootargs to AVB_BOOTARGS env var */
Igor Opaniuk5d4fd872018-06-03 21:56:40 +0300277
278 extra_args = avb_set_state(avb_ops, AVB_GREEN);
279 if (extra_args)
280 cmdline = append_cmd_line(out_data->cmdline,
281 extra_args);
282 else
283 cmdline = out_data->cmdline;
284
285 env_set(AVB_BOOTARGS, cmdline);
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300286
287 res = CMD_RET_SUCCESS;
288 break;
289 case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION:
290 printf("Verification failed\n");
291 break;
292 case AVB_SLOT_VERIFY_RESULT_ERROR_IO:
293 printf("I/O error occurred during verification\n");
294 break;
295 case AVB_SLOT_VERIFY_RESULT_ERROR_OOM:
296 printf("OOM error occurred during verification\n");
297 break;
298 case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA:
299 printf("Corrupted dm-verity metadata detected\n");
300 break;
301 case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION:
302 printf("Unsupported version avbtool was used\n");
303 break;
304 case AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX:
305 printf("Checking rollback index failed\n");
306 break;
307 case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED:
308 printf("Public key was rejected\n");
309 break;
310 default:
311 printf("Unknown error occurred\n");
312 }
313
314 return res;
315}
316
317int do_avb_is_unlocked(cmd_tbl_t *cmdtp, int flag,
318 int argc, char * const argv[])
319{
320 bool unlock;
321
322 if (!avb_ops) {
323 printf("AVB not initialized, run 'avb init' first\n");
324 return CMD_RET_FAILURE;
325 }
326
327 if (argc != 1) {
328 printf("--%s(-1)\n", __func__);
329 return CMD_RET_USAGE;
330 }
331
332 if (avb_ops->read_is_device_unlocked(avb_ops, &unlock) ==
333 AVB_IO_RESULT_OK) {
334 printf("Unlocked = %d\n", unlock);
335 return CMD_RET_SUCCESS;
336 }
337
Jens Wiklander6d899022018-09-25 16:40:07 +0200338 printf("Can't determine device lock state.\n");
339
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300340 return CMD_RET_FAILURE;
341}
342
Igor Opaniukfc1fe012019-04-09 15:38:14 +0200343int do_avb_read_pvalue(cmd_tbl_t *cmdtp, int flag, int argc,
344 char * const argv[])
345{
346 const char *name;
347 size_t bytes;
348 size_t bytes_read;
349 void *buffer;
350 char *endp;
351
352 if (!avb_ops) {
353 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
354 return CMD_RET_FAILURE;
355 }
356
357 if (argc != 3)
358 return CMD_RET_USAGE;
359
360 name = argv[1];
361 bytes = simple_strtoul(argv[2], &endp, 10);
362 if (*endp && *endp != '\n')
363 return CMD_RET_USAGE;
364
365 buffer = malloc(bytes);
366 if (!buffer)
367 return CMD_RET_FAILURE;
368
369 if (avb_ops->read_persistent_value(avb_ops, name, bytes, buffer,
370 &bytes_read) == AVB_IO_RESULT_OK) {
371 printf("Read %ld bytes, value = %s\n", bytes_read,
372 (char *)buffer);
373 free(buffer);
374 return CMD_RET_SUCCESS;
375 }
376
377 printf("Failed to read persistent value\n");
378
379 free(buffer);
380
381 return CMD_RET_FAILURE;
382}
383
384int do_avb_write_pvalue(cmd_tbl_t *cmdtp, int flag, int argc,
385 char * const argv[])
386{
387 const char *name;
388 const char *value;
389
390 if (!avb_ops) {
391 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
392 return CMD_RET_FAILURE;
393 }
394
395 if (argc != 3)
396 return CMD_RET_USAGE;
397
398 name = argv[1];
399 value = argv[2];
400
401 if (avb_ops->write_persistent_value(avb_ops, name, strlen(value) + 1,
402 (const uint8_t *)value) ==
403 AVB_IO_RESULT_OK) {
404 printf("Wrote %ld bytes\n", strlen(value) + 1);
405 return CMD_RET_SUCCESS;
406 }
407
408 printf("Failed to write persistent value\n");
409
410 return CMD_RET_FAILURE;
411}
412
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300413static cmd_tbl_t cmd_avb[] = {
414 U_BOOT_CMD_MKENT(init, 2, 0, do_avb_init, "", ""),
415 U_BOOT_CMD_MKENT(read_rb, 2, 0, do_avb_read_rb, "", ""),
416 U_BOOT_CMD_MKENT(write_rb, 3, 0, do_avb_write_rb, "", ""),
417 U_BOOT_CMD_MKENT(is_unlocked, 1, 0, do_avb_is_unlocked, "", ""),
418 U_BOOT_CMD_MKENT(get_uuid, 2, 0, do_avb_get_uuid, "", ""),
419 U_BOOT_CMD_MKENT(read_part, 5, 0, do_avb_read_part, "", ""),
420 U_BOOT_CMD_MKENT(read_part_hex, 4, 0, do_avb_read_part_hex, "", ""),
421 U_BOOT_CMD_MKENT(write_part, 5, 0, do_avb_write_part, "", ""),
422 U_BOOT_CMD_MKENT(verify, 1, 0, do_avb_verify_part, "", ""),
Igor Opaniukfc1fe012019-04-09 15:38:14 +0200423#ifdef CONFIG_OPTEE_TA_AVB
424 U_BOOT_CMD_MKENT(read_pvalue, 3, 0, do_avb_read_pvalue, "", ""),
425 U_BOOT_CMD_MKENT(write_pvalue, 3, 0, do_avb_write_pvalue, "", ""),
426#endif
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300427};
428
429static int do_avb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
430{
431 cmd_tbl_t *cp;
432
433 cp = find_cmd_tbl(argv[1], cmd_avb, ARRAY_SIZE(cmd_avb));
434
435 argc--;
436 argv++;
437
438 if (!cp || argc > cp->maxargs)
439 return CMD_RET_USAGE;
440
441 if (flag == CMD_FLAG_REPEAT)
442 return CMD_RET_FAILURE;
443
444 return cp->cmd(cmdtp, flag, argc, argv);
445}
446
447U_BOOT_CMD(
448 avb, 29, 0, do_avb,
449 "Provides commands for testing Android Verified Boot 2.0 functionality",
450 "init <dev> - initialize avb2 for <dev>\n"
451 "avb read_rb <num> - read rollback index at location <num>\n"
452 "avb write_rb <num> <rb> - write rollback index <rb> to <num>\n"
453 "avb is_unlocked - returns unlock status of the device\n"
454 "avb get_uuid <partname> - read and print uuid of partition <part>\n"
455 "avb read_part <partname> <offset> <num> <addr> - read <num> bytes from\n"
456 " partition <partname> to buffer <addr>\n"
457 "avb read_part_hex <partname> <offset> <num> - read <num> bytes from\n"
458 " partition <partname> and print to stdout\n"
459 "avb write_part <partname> <offset> <num> <addr> - write <num> bytes to\n"
460 " <partname> by <offset> using data from <addr>\n"
Igor Opaniukfc1fe012019-04-09 15:38:14 +0200461#ifdef CONFIG_OPTEE_TA_AVB
462 "avb read_pvalue <name> <bytes> - read a persistent value <name>\n"
463 "avb write_pvalue <name> <value> - write a persistent value <name>\n"
464#endif
Igor Opaniuk60b2f9e2018-06-03 21:56:39 +0300465 "avb verify - run verification process using hash data\n"
466 " from vbmeta structure\n"
467 );