cmd/tpm-v2.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * Copyright (c) 2018 Bootlin
   4  * Author: Miquel Raynal <[email protected]>
   5  */
   6
   7 #include <command.h>
   8 #include <dm.h>
   9 #include <log.h>
  10 #include <mapmem.h>
  11 #include <tpm-common.h>
  12 #include <tpm-v2.h>
  13 #include "tpm-user-utils.h"
  14
  15 static int do_tpm2_startup(struct cmd_tbl *cmdtp, int flag, int argc,
  16                            char *const argv[])
  17 {
  18         enum tpm2_startup_types mode;
  19         struct udevice *dev;
  20         int ret;
  21
  22         ret = get_tpm(&dev);
  23         if (ret)
  24                 return ret;
  25         if (argc != 2)
  26                 return CMD_RET_USAGE;
  27
  28         if (!strcasecmp("TPM2_SU_CLEAR", argv[1])) {
  29                 mode = TPM2_SU_CLEAR;
  30         } else if (!strcasecmp("TPM2_SU_STATE", argv[1])) {
  31                 mode = TPM2_SU_STATE;
  32         } else {
  33                 printf("Couldn't recognize mode string: %s\n", argv[1]);
  34                 return CMD_RET_FAILURE;
  35         }
  36
  37         return report_return_code(tpm2_startup(dev, mode));
  38 }
  39
  40 static int do_tpm2_self_test(struct cmd_tbl *cmdtp, int flag, int argc,
  41                              char *const argv[])
  42 {
  43         enum tpm2_yes_no full_test;
  44         struct udevice *dev;
  45         int ret;
  46
  47         ret = get_tpm(&dev);
  48         if (ret)
  49                 return ret;
  50         if (argc != 2)
  51                 return CMD_RET_USAGE;
  52
  53         if (!strcasecmp("full", argv[1])) {
  54                 full_test = TPMI_YES;
  55         } else if (!strcasecmp("continue", argv[1])) {
  56                 full_test = TPMI_NO;
  57         } else {
  58                 printf("Couldn't recognize test mode: %s\n", argv[1]);
  59                 return CMD_RET_FAILURE;
  60         }
  61
  62         return report_return_code(tpm2_self_test(dev, full_test));
  63 }
  64
  65 static int do_tpm2_clear(struct cmd_tbl *cmdtp, int flag, int argc,
  66                          char *const argv[])
  67 {
  68         u32 handle = 0;
  69         const char *pw = (argc < 3) ? NULL : argv[2];
  70         const ssize_t pw_sz = pw ? strlen(pw) : 0;
  71         struct udevice *dev;
  72         int ret;
  73
  74         ret = get_tpm(&dev);
  75         if (ret)
  76                 return ret;
  77
  78         if (argc < 2 || argc > 3)
  79                 return CMD_RET_USAGE;
  80
  81         if (pw_sz > TPM2_DIGEST_LEN)
  82                 return -EINVAL;
  83
  84         if (!strcasecmp("TPM2_RH_LOCKOUT", argv[1]))
  85                 handle = TPM2_RH_LOCKOUT;
  86         else if (!strcasecmp("TPM2_RH_PLATFORM", argv[1]))
  87                 handle = TPM2_RH_PLATFORM;
  88         else
  89                 return CMD_RET_USAGE;
  90
  91         return report_return_code(tpm2_clear(dev, handle, pw, pw_sz));
  92 }
  93
  94 static int do_tpm2_pcr_extend(struct cmd_tbl *cmdtp, int flag, int argc,
  95                               char *const argv[])
  96 {
  97         struct udevice *dev;
  98         struct tpm_chip_priv *priv;
  99         u32 index = simple_strtoul(argv[1], NULL, 0);
 100         void *digest = map_sysmem(simple_strtoul(argv[2], NULL, 0), 0);
 101         int algo = TPM2_ALG_SHA256;
 102         int algo_len;
 103         int ret;
 104         u32 rc;
 105
 106         if (argc < 3 || argc > 4)
 107                 return CMD_RET_USAGE;
 108         if (argc == 4) {
 109                 algo = tpm2_name_to_algorithm(argv[3]);
 110                 if (algo < 0)
 111                         return CMD_RET_FAILURE;
 112         }
 113         algo_len = tpm2_algorithm_to_len(algo);
 114
 115         ret = get_tpm(&dev);
 116         if (ret)
 117                 return ret;
 118
 119         priv = dev_get_uclass_priv(dev);
 120         if (!priv)
 121                 return -EINVAL;
 122
 123         if (index >= priv->pcr_count)
 124                 return -EINVAL;
 125
 126         rc = tpm2_pcr_extend(dev, index, algo, digest, algo_len);
 127         if (!rc) {
 128                 printf("PCR #%u extended with %d byte %s digest\n", index,
 129                        algo_len, tpm2_algorithm_name(algo));
 130                 print_byte_string(digest, algo_len);
 131         }
 132
 133         unmap_sysmem(digest);
 134
 135         return report_return_code(rc);
 136 }
 137
 138 static int do_tpm_pcr_read(struct cmd_tbl *cmdtp, int flag, int argc,
 139                            char *const argv[])
 140 {
 141         enum tpm2_algorithms algo = TPM2_ALG_SHA256;
 142         struct udevice *dev;
 143         struct tpm_chip_priv *priv;
 144         u32 index, rc;
 145         int algo_len;
 146         unsigned int updates;
 147         void *data;
 148         int ret;
 149
 150         if (argc < 3 || argc > 4)
 151                 return CMD_RET_USAGE;
 152         if (argc == 4) {
 153                 algo = tpm2_name_to_algorithm(argv[3]);
 154                 if (algo < 0)
 155                         return CMD_RET_FAILURE;
 156         }
 157         algo_len = tpm2_algorithm_to_len(algo);
 158
 159         ret = get_tpm(&dev);
 160         if (ret)
 161                 return ret;
 162
 163         priv = dev_get_uclass_priv(dev);
 164         if (!priv)
 165                 return -EINVAL;
 166
 167         index = simple_strtoul(argv[1], NULL, 0);
 168         if (index >= priv->pcr_count)
 169                 return -EINVAL;
 170
 171         data = map_sysmem(simple_strtoul(argv[2], NULL, 0), 0);
 172
 173         rc = tpm2_pcr_read(dev, index, priv->pcr_select_min, algo,
 174                            data, algo_len, &updates);
 175         if (!rc) {
 176                 printf("PCR #%u %s %d byte content (%u known updates):\n", index,
 177                        tpm2_algorithm_name(algo), algo_len, updates);
 178                 print_byte_string(data, algo_len);
 179         }
 180
 181         unmap_sysmem(data);
 182
 183         return report_return_code(rc);
 184 }
 185
 186 static int do_tpm_get_capability(struct cmd_tbl *cmdtp, int flag, int argc,
 187                                  char *const argv[])
 188 {
 189         u32 capability, property, rc;
 190         u8 *data;
 191         size_t count;
 192         int i, j;
 193         struct udevice *dev;
 194         int ret;
 195
 196         ret = get_tpm(&dev);
 197         if (ret)
 198                 return ret;
 199
 200         if (argc != 5)
 201                 return CMD_RET_USAGE;
 202
 203         capability = simple_strtoul(argv[1], NULL, 0);
 204         property = simple_strtoul(argv[2], NULL, 0);
 205         data = map_sysmem(simple_strtoul(argv[3], NULL, 0), 0);
 206         count = simple_strtoul(argv[4], NULL, 0);
 207
 208         rc = tpm2_get_capability(dev, capability, property, data, count);
 209         if (rc)
 210                 goto unmap_data;
 211
 212         printf("Capabilities read from TPM:\n");
 213         for (i = 0; i < count; i++) {
 214                 printf("Property 0x");
 215                 for (j = 0; j < 4; j++)
 216                         printf("%02x", data[(i * 8) + j + sizeof(u32)]);
 217                 printf(": 0x");
 218                 for (j = 4; j < 8; j++)
 219                         printf("%02x", data[(i * 8) + j + sizeof(u32)]);
 220                 printf("\n");
 221         }
 222
 223 unmap_data:
 224         unmap_sysmem(data);
 225
 226         return report_return_code(rc);
 227 }
 228
 229 static int do_tpm_dam_reset(struct cmd_tbl *cmdtp, int flag, int argc,
 230                             char *const argv[])
 231 {
 232         const char *pw = (argc < 2) ? NULL : argv[1];
 233         const ssize_t pw_sz = pw ? strlen(pw) : 0;
 234         struct udevice *dev;
 235         int ret;
 236
 237         ret = get_tpm(&dev);
 238         if (ret)
 239                 return ret;
 240
 241         if (argc > 2)
 242                 return CMD_RET_USAGE;
 243
 244         if (pw_sz > TPM2_DIGEST_LEN)
 245                 return -EINVAL;
 246
 247         return report_return_code(tpm2_dam_reset(dev, pw, pw_sz));
 248 }
 249
 250 static int do_tpm_dam_parameters(struct cmd_tbl *cmdtp, int flag, int argc,
 251                                  char *const argv[])
 252 {
 253         const char *pw = (argc < 5) ? NULL : argv[4];
 254         const ssize_t pw_sz = pw ? strlen(pw) : 0;
 255         /*
 256          * No Dictionary Attack Mitigation (DAM) means:
 257          * maxtries = 0xFFFFFFFF, recovery_time = 1, lockout_recovery = 0
 258          */
 259         unsigned long int max_tries;
 260         unsigned long int recovery_time;
 261         unsigned long int lockout_recovery;
 262         struct udevice *dev;
 263         int ret;
 264
 265         ret = get_tpm(&dev);
 266         if (ret)
 267                 return ret;
 268
 269         if (argc < 4 || argc > 5)
 270                 return CMD_RET_USAGE;
 271
 272         if (pw_sz > TPM2_DIGEST_LEN)
 273                 return -EINVAL;
 274
 275         if (strict_strtoul(argv[1], 0, &max_tries))
 276                 return CMD_RET_USAGE;
 277
 278         if (strict_strtoul(argv[2], 0, &recovery_time))
 279                 return CMD_RET_USAGE;
 280
 281         if (strict_strtoul(argv[3], 0, &lockout_recovery))
 282                 return CMD_RET_USAGE;
 283
 284         log(LOGC_NONE, LOGL_INFO, "Changing dictionary attack parameters:\n");
 285         log(LOGC_NONE, LOGL_INFO, "- maxTries: %lu", max_tries);
 286         log(LOGC_NONE, LOGL_INFO, "- recoveryTime: %lu\n", recovery_time);
 287         log(LOGC_NONE, LOGL_INFO, "- lockoutRecovery: %lu\n", lockout_recovery);
 288
 289         return report_return_code(tpm2_dam_parameters(dev, pw, pw_sz, max_tries,
 290                                                       recovery_time,
 291                                                       lockout_recovery));
 292 }
 293
 294 static int do_tpm_change_auth(struct cmd_tbl *cmdtp, int flag, int argc,
 295                               char *const argv[])
 296 {
 297         u32 handle;
 298         const char *newpw = argv[2];
 299         const char *oldpw = (argc == 3) ? NULL : argv[3];
 300         const ssize_t newpw_sz = strlen(newpw);
 301         const ssize_t oldpw_sz = oldpw ? strlen(oldpw) : 0;
 302         struct udevice *dev;
 303         int ret;
 304
 305         ret = get_tpm(&dev);
 306         if (ret)
 307                 return ret;
 308
 309         if (argc < 3 || argc > 4)
 310                 return CMD_RET_USAGE;
 311
 312         if (newpw_sz > TPM2_DIGEST_LEN || oldpw_sz > TPM2_DIGEST_LEN)
 313                 return -EINVAL;
 314
 315         if (!strcasecmp("TPM2_RH_LOCKOUT", argv[1]))
 316                 handle = TPM2_RH_LOCKOUT;
 317         else if (!strcasecmp("TPM2_RH_ENDORSEMENT", argv[1]))
 318                 handle = TPM2_RH_ENDORSEMENT;
 319         else if (!strcasecmp("TPM2_RH_OWNER", argv[1]))
 320                 handle = TPM2_RH_OWNER;
 321         else if (!strcasecmp("TPM2_RH_PLATFORM", argv[1]))
 322                 handle = TPM2_RH_PLATFORM;
 323         else
 324                 return CMD_RET_USAGE;
 325
 326         return report_return_code(tpm2_change_auth(dev, handle, newpw, newpw_sz,
 327                                                    oldpw, oldpw_sz));
 328 }
 329
 330 static int do_tpm_pcr_setauthpolicy(struct cmd_tbl *cmdtp, int flag, int argc,
 331                                     char *const argv[])
 332 {
 333         u32 index = simple_strtoul(argv[1], NULL, 0);
 334         char *key = argv[2];
 335         const char *pw = (argc < 4) ? NULL : argv[3];
 336         const ssize_t pw_sz = pw ? strlen(pw) : 0;
 337         struct udevice *dev;
 338         int ret;
 339
 340         ret = get_tpm(&dev);
 341         if (ret)
 342                 return ret;
 343
 344         if (strlen(key) != TPM2_DIGEST_LEN)
 345                 return -EINVAL;
 346
 347         if (argc < 3 || argc > 4)
 348                 return CMD_RET_USAGE;
 349
 350         return report_return_code(tpm2_pcr_setauthpolicy(dev, pw, pw_sz, index,
 351                                                          key));
 352 }
 353
 354 static int do_tpm_pcr_setauthvalue(struct cmd_tbl *cmdtp, int flag,
 355                                    int argc, char *const argv[])
 356 {
 357         u32 index = simple_strtoul(argv[1], NULL, 0);
 358         char *key = argv[2];
 359         const ssize_t key_sz = strlen(key);
 360         const char *pw = (argc < 4) ? NULL : argv[3];
 361         const ssize_t pw_sz = pw ? strlen(pw) : 0;
 362         struct udevice *dev;
 363         int ret;
 364
 365         ret = get_tpm(&dev);
 366         if (ret)
 367                 return ret;
 368
 369         if (strlen(key) != TPM2_DIGEST_LEN)
 370                 return -EINVAL;
 371
 372         if (argc < 3 || argc > 4)
 373                 return CMD_RET_USAGE;
 374
 375         return report_return_code(tpm2_pcr_setauthvalue(dev, pw, pw_sz, index,
 376                                                         key, key_sz));
 377 }
 378
 379 static struct cmd_tbl tpm2_commands[] = {
 380         U_BOOT_CMD_MKENT(device, 0, 1, do_tpm_device, "", ""),
 381         U_BOOT_CMD_MKENT(info, 0, 1, do_tpm_info, "", ""),
 382         U_BOOT_CMD_MKENT(state, 0, 1, do_tpm_report_state, "", ""),
 383         U_BOOT_CMD_MKENT(init, 0, 1, do_tpm_init, "", ""),
 384         U_BOOT_CMD_MKENT(startup, 0, 1, do_tpm2_startup, "", ""),
 385         U_BOOT_CMD_MKENT(self_test, 0, 1, do_tpm2_self_test, "", ""),
 386         U_BOOT_CMD_MKENT(clear, 0, 1, do_tpm2_clear, "", ""),
 387         U_BOOT_CMD_MKENT(pcr_extend, 0, 1, do_tpm2_pcr_extend, "", ""),
 388         U_BOOT_CMD_MKENT(pcr_read, 0, 1, do_tpm_pcr_read, "", ""),
 389         U_BOOT_CMD_MKENT(get_capability, 0, 1, do_tpm_get_capability, "", ""),
 390         U_BOOT_CMD_MKENT(dam_reset, 0, 1, do_tpm_dam_reset, "", ""),
 391         U_BOOT_CMD_MKENT(dam_parameters, 0, 1, do_tpm_dam_parameters, "", ""),
 392         U_BOOT_CMD_MKENT(change_auth, 0, 1, do_tpm_change_auth, "", ""),
 393         U_BOOT_CMD_MKENT(autostart, 0, 1, do_tpm_autostart, "", ""),
 394         U_BOOT_CMD_MKENT(pcr_setauthpolicy, 0, 1,
 395                          do_tpm_pcr_setauthpolicy, "", ""),
 396         U_BOOT_CMD_MKENT(pcr_setauthvalue, 0, 1,
 397                          do_tpm_pcr_setauthvalue, "", ""),
 398 };
 399
 400 struct cmd_tbl *get_tpm2_commands(unsigned int *size)
 401 {
 402         *size = ARRAY_SIZE(tpm2_commands);
 403
 404         return tpm2_commands;
 405 }
 406
 407 U_BOOT_CMD(tpm2, CONFIG_SYS_MAXARGS, 1, do_tpm, "Issue a TPMv2.x command",
 408 "<command> [<arguments>]\n"
 409 "\n"
 410 "device [num device]\n"
 411 "    Show all devices or set the specified device\n"
 412 "info\n"
 413 "    Show information about the TPM.\n"
 414 "state\n"
 415 "    Show internal state from the TPM (if available)\n"
 416 "autostart\n"
 417 "    Initalize the tpm, perform a Startup(clear) and run a full selftest\n"
 418 "    sequence\n"
 419 "init\n"
 420 "    Initialize the software stack. Always the first command to issue.\n"
 421 "    'tpm startup' is the only acceptable command after a 'tpm init' has been\n"
 422 "    issued\n"
 423 "startup <mode>\n"
 424 "    Issue a TPM2_Startup command.\n"
 425 "    <mode> is one of:\n"
 426 "        * TPM2_SU_CLEAR (reset state)\n"
 427 "        * TPM2_SU_STATE (preserved state)\n"
 428 "self_test <type>\n"
 429 "    Test the TPM capabilities.\n"
 430 "    <type> is one of:\n"
 431 "        * full (perform all tests)\n"
 432 "        * continue (only check untested tests)\n"
 433 "clear <hierarchy>\n"
 434 "    Issue a TPM2_Clear command.\n"
 435 "    <hierarchy> is one of:\n"
 436 "        * TPM2_RH_LOCKOUT\n"
 437 "        * TPM2_RH_PLATFORM\n"
 438 "pcr_extend <pcr> <digest_addr> [<digest_algo>]\n"
 439 "    Extend PCR #<pcr> with digest at <digest_addr> with digest_algo.\n"
 440 "    <pcr>: index of the PCR\n"
 441 "    <digest_addr>: address of digest of digest_algo type (defaults to SHA256)\n"
 442 "pcr_read <pcr> <digest_addr> [<digest_algo>]\n"
 443 "    Read PCR #<pcr> to memory address <digest_addr> with <digest_algo>.\n"
 444 "    <pcr>: index of the PCR\n"
 445 "    <digest_addr>: address of digest of digest_algo type (defaults to SHA256)\n"
 446 "get_capability <capability> <property> <addr> <count>\n"
 447 "    Read and display <count> entries indexed by <capability>/<property>.\n"
 448 "    Values are 4 bytes long and are written at <addr>.\n"
 449 "    <capability>: capability\n"
 450 "    <property>: property\n"
 451 "    <addr>: address to store <count> entries of 4 bytes\n"
 452 "    <count>: number of entries to retrieve\n"
 453 "dam_reset [<password>]\n"
 454 "    If the TPM is not in a LOCKOUT state, reset the internal error counter.\n"
 455 "    <password>: optional password\n"
 456 "dam_parameters <max_tries> <recovery_time> <lockout_recovery> [<password>]\n"
 457 "    If the TPM is not in a LOCKOUT state, set the DAM parameters\n"
 458 "    <maxTries>: maximum number of failures before lockout,\n"
 459 "                0 means always locking\n"
 460 "    <recoveryTime>: time before decrement of the error counter,\n"
 461 "                    0 means no lockout\n"
 462 "    <lockoutRecovery>: time of a lockout (before the next try),\n"
 463 "                       0 means a reboot is needed\n"
 464 "    <password>: optional password of the LOCKOUT hierarchy\n"
 465 "change_auth <hierarchy> <new_pw> [<old_pw>]\n"
 466 "    <hierarchy>: the hierarchy\n"
 467 "    <new_pw>: new password for <hierarchy>\n"
 468 "    <old_pw>: optional previous password of <hierarchy>\n"
 469 "pcr_setauthpolicy|pcr_setauthvalue <pcr> <key> [<password>]\n"
 470 "    Change the <key> to access PCR #<pcr>.\n"
 471 "    hierarchy and may be empty.\n"
 472 "    /!\\WARNING: untested function, use at your own risks !\n"
 473 "    <pcr>: index of the PCR\n"
 474 "    <key>: secret to protect the access of PCR #<pcr>\n"
 475 "    <password>: optional password of the PLATFORM hierarchy\n"
 476 );