3 * (C) Copyright 2018, Linaro Limited
5 * SPDX-License-Identifier: GPL-2.0+
8 #include <avb_verify.h>
15 #define AVB_BOOTARGS "avb_bootargs"
16 static struct AvbOps *avb_ops;
18 int do_avb_init(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
20 unsigned long mmc_dev;
25 mmc_dev = simple_strtoul(argv[1], NULL, 16);
28 avb_ops_free(avb_ops);
30 avb_ops = avb_ops_alloc(mmc_dev);
32 return CMD_RET_SUCCESS;
34 printf("Failed to initialize avb2\n");
36 return CMD_RET_FAILURE;
39 int do_avb_read_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
43 size_t bytes, bytes_read = 0;
47 printf("AVB 2.0 is not initialized, please run 'avb init'\n");
55 offset = simple_strtoul(argv[2], NULL, 16);
56 bytes = simple_strtoul(argv[3], NULL, 16);
57 buffer = (void *)simple_strtoul(argv[4], NULL, 16);
59 if (avb_ops->read_from_partition(avb_ops, part, offset, bytes,
60 buffer, &bytes_read) ==
62 printf("Read %zu bytes\n", bytes_read);
63 return CMD_RET_SUCCESS;
66 printf("Failed to read from partition\n");
68 return CMD_RET_FAILURE;
71 int do_avb_read_part_hex(cmd_tbl_t *cmdtp, int flag, int argc,
76 size_t bytes, bytes_read = 0;
80 printf("AVB 2.0 is not initialized, please run 'avb init'\n");
88 offset = simple_strtoul(argv[2], NULL, 16);
89 bytes = simple_strtoul(argv[3], NULL, 16);
91 buffer = malloc(bytes);
93 printf("Failed to tlb_allocate buffer for data\n");
94 return CMD_RET_FAILURE;
96 memset(buffer, 0, bytes);
98 if (avb_ops->read_from_partition(avb_ops, part, offset, bytes, buffer,
99 &bytes_read) == AVB_IO_RESULT_OK) {
100 printf("Requested %zu, read %zu bytes\n", bytes, bytes_read);
102 for (int i = 0; i < bytes_read; i++)
103 printf("%02X", buffer[i]);
108 return CMD_RET_SUCCESS;
111 printf("Failed to read from partition\n");
114 return CMD_RET_FAILURE;
117 int do_avb_write_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
125 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
126 return CMD_RET_FAILURE;
130 return CMD_RET_USAGE;
133 offset = simple_strtoul(argv[2], NULL, 16);
134 bytes = simple_strtoul(argv[3], NULL, 16);
135 buffer = (void *)simple_strtoul(argv[4], NULL, 16);
137 if (avb_ops->write_to_partition(avb_ops, part, offset, bytes, buffer) ==
139 printf("Wrote %zu bytes\n", bytes);
140 return CMD_RET_SUCCESS;
143 printf("Failed to write in partition\n");
145 return CMD_RET_FAILURE;
148 int do_avb_read_rb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
154 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
155 return CMD_RET_FAILURE;
159 return CMD_RET_USAGE;
161 index = (size_t)simple_strtoul(argv[1], NULL, 16);
163 if (avb_ops->read_rollback_index(avb_ops, index, &rb_idx) ==
165 printf("Rollback index: %llx\n", rb_idx);
166 return CMD_RET_SUCCESS;
169 printf("Failed to read rollback index\n");
171 return CMD_RET_FAILURE;
174 int do_avb_write_rb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
180 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
181 return CMD_RET_FAILURE;
185 return CMD_RET_USAGE;
187 index = (size_t)simple_strtoul(argv[1], NULL, 16);
188 rb_idx = simple_strtoul(argv[2], NULL, 16);
190 if (avb_ops->write_rollback_index(avb_ops, index, rb_idx) ==
192 return CMD_RET_SUCCESS;
194 printf("Failed to write rollback index\n");
196 return CMD_RET_FAILURE;
199 int do_avb_get_uuid(cmd_tbl_t *cmdtp, int flag,
200 int argc, char * const argv[])
203 char buffer[UUID_STR_LEN + 1];
206 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
207 return CMD_RET_FAILURE;
211 return CMD_RET_USAGE;
215 if (avb_ops->get_unique_guid_for_partition(avb_ops, part, buffer,
218 printf("'%s' UUID: %s\n", part, buffer);
219 return CMD_RET_SUCCESS;
222 printf("Failed to read UUID\n");
224 return CMD_RET_FAILURE;
227 int do_avb_verify_part(cmd_tbl_t *cmdtp, int flag,
228 int argc, char *const argv[])
230 const char * const requested_partitions[] = {"boot", NULL};
231 AvbSlotVerifyResult slot_result;
232 AvbSlotVerifyData *out_data;
236 bool unlocked = false;
237 int res = CMD_RET_FAILURE;
240 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
241 return CMD_RET_FAILURE;
245 return CMD_RET_USAGE;
247 printf("## Android Verified Boot 2.0 version %s\n",
248 avb_version_string());
250 if (avb_ops->read_is_device_unlocked(avb_ops, &unlocked) !=
252 printf("Can't determine device lock state.\n");
253 return CMD_RET_FAILURE;
257 avb_slot_verify(avb_ops,
258 requested_partitions,
261 AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE,
264 switch (slot_result) {
265 case AVB_SLOT_VERIFY_RESULT_OK:
266 /* Until we don't have support of changing unlock states, we
267 * assume that we are by default in locked state.
268 * So in this case we can boot only when verification is
269 * successful; we also supply in cmdline GREEN boot state
271 printf("Verification passed successfully\n");
273 /* export additional bootargs to AVB_BOOTARGS env var */
275 extra_args = avb_set_state(avb_ops, AVB_GREEN);
277 cmdline = append_cmd_line(out_data->cmdline,
280 cmdline = out_data->cmdline;
282 env_set(AVB_BOOTARGS, cmdline);
284 res = CMD_RET_SUCCESS;
286 case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION:
287 printf("Verification failed\n");
289 case AVB_SLOT_VERIFY_RESULT_ERROR_IO:
290 printf("I/O error occurred during verification\n");
292 case AVB_SLOT_VERIFY_RESULT_ERROR_OOM:
293 printf("OOM error occurred during verification\n");
295 case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA:
296 printf("Corrupted dm-verity metadata detected\n");
298 case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION:
299 printf("Unsupported version avbtool was used\n");
301 case AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX:
302 printf("Checking rollback index failed\n");
304 case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED:
305 printf("Public key was rejected\n");
308 printf("Unknown error occurred\n");
314 int do_avb_is_unlocked(cmd_tbl_t *cmdtp, int flag,
315 int argc, char * const argv[])
320 printf("AVB not initialized, run 'avb init' first\n");
321 return CMD_RET_FAILURE;
325 printf("--%s(-1)\n", __func__);
326 return CMD_RET_USAGE;
329 if (avb_ops->read_is_device_unlocked(avb_ops, &unlock) ==
331 printf("Unlocked = %d\n", unlock);
332 return CMD_RET_SUCCESS;
335 printf("Can't determine device lock state.\n");
337 return CMD_RET_FAILURE;
340 int do_avb_read_pvalue(cmd_tbl_t *cmdtp, int flag, int argc,
350 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
351 return CMD_RET_FAILURE;
355 return CMD_RET_USAGE;
358 bytes = simple_strtoul(argv[2], &endp, 10);
359 if (*endp && *endp != '\n')
360 return CMD_RET_USAGE;
362 buffer = malloc(bytes);
364 return CMD_RET_FAILURE;
366 if (avb_ops->read_persistent_value(avb_ops, name, bytes, buffer,
367 &bytes_read) == AVB_IO_RESULT_OK) {
368 printf("Read %zu bytes, value = %s\n", bytes_read,
371 return CMD_RET_SUCCESS;
374 printf("Failed to read persistent value\n");
378 return CMD_RET_FAILURE;
381 int do_avb_write_pvalue(cmd_tbl_t *cmdtp, int flag, int argc,
388 printf("AVB 2.0 is not initialized, run 'avb init' first\n");
389 return CMD_RET_FAILURE;
393 return CMD_RET_USAGE;
398 if (avb_ops->write_persistent_value(avb_ops, name, strlen(value) + 1,
399 (const uint8_t *)value) ==
401 printf("Wrote %zu bytes\n", strlen(value) + 1);
402 return CMD_RET_SUCCESS;
405 printf("Failed to write persistent value\n");
407 return CMD_RET_FAILURE;
410 static cmd_tbl_t cmd_avb[] = {
411 U_BOOT_CMD_MKENT(init, 2, 0, do_avb_init, "", ""),
412 U_BOOT_CMD_MKENT(read_rb, 2, 0, do_avb_read_rb, "", ""),
413 U_BOOT_CMD_MKENT(write_rb, 3, 0, do_avb_write_rb, "", ""),
414 U_BOOT_CMD_MKENT(is_unlocked, 1, 0, do_avb_is_unlocked, "", ""),
415 U_BOOT_CMD_MKENT(get_uuid, 2, 0, do_avb_get_uuid, "", ""),
416 U_BOOT_CMD_MKENT(read_part, 5, 0, do_avb_read_part, "", ""),
417 U_BOOT_CMD_MKENT(read_part_hex, 4, 0, do_avb_read_part_hex, "", ""),
418 U_BOOT_CMD_MKENT(write_part, 5, 0, do_avb_write_part, "", ""),
419 U_BOOT_CMD_MKENT(verify, 1, 0, do_avb_verify_part, "", ""),
420 #ifdef CONFIG_OPTEE_TA_AVB
421 U_BOOT_CMD_MKENT(read_pvalue, 3, 0, do_avb_read_pvalue, "", ""),
422 U_BOOT_CMD_MKENT(write_pvalue, 3, 0, do_avb_write_pvalue, "", ""),
426 static int do_avb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
430 cp = find_cmd_tbl(argv[1], cmd_avb, ARRAY_SIZE(cmd_avb));
435 if (!cp || argc > cp->maxargs)
436 return CMD_RET_USAGE;
438 if (flag == CMD_FLAG_REPEAT)
439 return CMD_RET_FAILURE;
441 return cp->cmd(cmdtp, flag, argc, argv);
446 "Provides commands for testing Android Verified Boot 2.0 functionality",
447 "init <dev> - initialize avb2 for <dev>\n"
448 "avb read_rb <num> - read rollback index at location <num>\n"
449 "avb write_rb <num> <rb> - write rollback index <rb> to <num>\n"
450 "avb is_unlocked - returns unlock status of the device\n"
451 "avb get_uuid <partname> - read and print uuid of partition <part>\n"
452 "avb read_part <partname> <offset> <num> <addr> - read <num> bytes from\n"
453 " partition <partname> to buffer <addr>\n"
454 "avb read_part_hex <partname> <offset> <num> - read <num> bytes from\n"
455 " partition <partname> and print to stdout\n"
456 "avb write_part <partname> <offset> <num> <addr> - write <num> bytes to\n"
457 " <partname> by <offset> using data from <addr>\n"
458 #ifdef CONFIG_OPTEE_TA_AVB
459 "avb read_pvalue <name> <bytes> - read a persistent value <name>\n"
460 "avb write_pvalue <name> <value> - write a persistent value <name>\n"
462 "avb verify - run verification process using hash data\n"
463 " from vbmeta structure\n"