From 401650636c3a9c082bdc5f69fef3091215ee6150 Mon Sep 17 00:00:00 2001 From: Collin Wright Date: Wed, 8 Jul 2026 18:45:10 +0000 Subject: [PATCH 1/3] Add tpm startup subcommand to htool --- examples/htool.c | 6 ++++++ examples/htool_tpm.c | 28 ++++++++++++++++++++++++++++ examples/htool_tpm.h | 2 ++ 3 files changed, 36 insertions(+) diff --git a/examples/htool.c b/examples/htool.c index 0a3c758..04dcbbc 100644 --- a/examples/htool.c +++ b/examples/htool.c @@ -2067,6 +2067,12 @@ static const struct htool_cmd CMDS[] = { .params = (const struct htool_param[]){{}}, .func = htool_get_tpm_mode, }, + { + .verbs = (const char*[]){"tpm", "startup", NULL}, + .desc = "Send TPM2_Startup(CLEAR) command to initialize the TPM.", + .params = (const struct htool_param[]){{}}, + .func = htool_tpm_startup, + }, { .verbs = (const char*[]){"tpm", "set_mode", "disabled", NULL}, .desc = "Set the TPM mode to DISABLED.", diff --git a/examples/htool_tpm.c b/examples/htool_tpm.c index ca7f0fa..4d67d87 100644 --- a/examples/htool_tpm.c +++ b/examples/htool_tpm.c @@ -86,3 +86,31 @@ int htool_get_tpm_mode(const struct htool_invocation* inv) { return 0; } + +int htool_tpm_startup(const struct htool_invocation* inv) { + struct libhoth_device* dev = htool_libhoth_device(); + if (!dev) { + return -1; + } + + // Standard 12-byte TPM2_Startup(CLEAR) command packet + static const uint8_t req[12] = { + 0x80, 0x01, // TPM_ST_NO_SESSIONS + 0x00, 0x00, 0x00, 0x0c, // paramSize = 12 + 0x00, 0x00, 0x01, 0x44, // TPM_CC_Startup + 0x00, 0x00 // TPM_SU_CLEAR + }; + + uint8_t resp[32]; + size_t resp_size = 0; + int ret = libhoth_hostcmd_exec( + dev, HOTH_CMD_BOARD_SPECIFIC_BASE + HOTH_PRV_CMD_HAVEN_TPM, 0, req, + sizeof(req), resp, sizeof(resp), &resp_size); + if (ret) { + htool_report_error("tpm startup", ret); + return ret; + } + + printf("TPM2_Startup(CLEAR) sent successfully.\n"); + return 0; +} diff --git a/examples/htool_tpm.h b/examples/htool_tpm.h index 6fe0129..ddd00b8 100644 --- a/examples/htool_tpm.h +++ b/examples/htool_tpm.h @@ -23,6 +23,7 @@ extern "C" { #define HOTH_PRV_CMD_SET_TPM_MODE 0x0051 #define HOTH_PRV_CMD_GET_TPM_MODE 0x0052 +#define HOTH_PRV_CMD_HAVEN_TPM 0x0033 enum ec_tpm_mode { TPM_MODE_DISABLED = 0, // Turn the TPM off: typically used to turn off one @@ -38,6 +39,7 @@ struct tpm_mode { int htool_set_tpm_mode(const struct htool_invocation* inv); int htool_get_tpm_mode(const struct htool_invocation* inv); +int htool_tpm_startup(const struct htool_invocation* inv); #ifdef __cplusplus } From af357ab3370aa90e1b04d904bcc9913703a70994 Mon Sep 17 00:00:00 2001 From: Collin Wright Date: Thu, 9 Jul 2026 14:53:13 +0000 Subject: [PATCH 2/3] Change subcommand from tpm startup to security startup --- examples/htool.c | 12 ++++++------ examples/htool_tpm.c | 4 ++-- examples/htool_tpm.h | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/examples/htool.c b/examples/htool.c index 04dcbbc..3e1b02f 100644 --- a/examples/htool.c +++ b/examples/htool.c @@ -2038,6 +2038,12 @@ static const struct htool_cmd CMDS[] = { "other output files are not required."}, {}}, }, + { + .verbs = (const char*[]){"security", "startup", NULL}, + .desc = "Send TPM2_Startup(CLEAR) command to initialize the TPM.", + .params = (const struct htool_param[]){{}}, + .func = htool_security_startup, + }, { .verbs = (const char*[]){"mauv", "compiled", NULL}, .desc = "Get compiled MAUV", @@ -2067,12 +2073,6 @@ static const struct htool_cmd CMDS[] = { .params = (const struct htool_param[]){{}}, .func = htool_get_tpm_mode, }, - { - .verbs = (const char*[]){"tpm", "startup", NULL}, - .desc = "Send TPM2_Startup(CLEAR) command to initialize the TPM.", - .params = (const struct htool_param[]){{}}, - .func = htool_tpm_startup, - }, { .verbs = (const char*[]){"tpm", "set_mode", "disabled", NULL}, .desc = "Set the TPM mode to DISABLED.", diff --git a/examples/htool_tpm.c b/examples/htool_tpm.c index 4d67d87..03002dc 100644 --- a/examples/htool_tpm.c +++ b/examples/htool_tpm.c @@ -87,7 +87,7 @@ int htool_get_tpm_mode(const struct htool_invocation* inv) { return 0; } -int htool_tpm_startup(const struct htool_invocation* inv) { +int htool_security_startup(const struct htool_invocation* inv) { struct libhoth_device* dev = htool_libhoth_device(); if (!dev) { return -1; @@ -107,7 +107,7 @@ int htool_tpm_startup(const struct htool_invocation* inv) { dev, HOTH_CMD_BOARD_SPECIFIC_BASE + HOTH_PRV_CMD_HAVEN_TPM, 0, req, sizeof(req), resp, sizeof(resp), &resp_size); if (ret) { - htool_report_error("tpm startup", ret); + htool_report_error("security startup", ret); return ret; } diff --git a/examples/htool_tpm.h b/examples/htool_tpm.h index ddd00b8..a54cb9b 100644 --- a/examples/htool_tpm.h +++ b/examples/htool_tpm.h @@ -39,7 +39,7 @@ struct tpm_mode { int htool_set_tpm_mode(const struct htool_invocation* inv); int htool_get_tpm_mode(const struct htool_invocation* inv); -int htool_tpm_startup(const struct htool_invocation* inv); +int htool_security_startup(const struct htool_invocation* inv); #ifdef __cplusplus } From 59306a6717fb5e89825be382013d1842a40af48d Mon Sep 17 00:00:00 2001 From: Collin Wright Date: Thu, 9 Jul 2026 15:03:14 +0000 Subject: [PATCH 3/3] Make security startup return 0 as no-op on Security V2 --- examples/htool_tpm.c | 51 +++++++++++++++++++++++++++----------------- 1 file changed, 32 insertions(+), 19 deletions(-) diff --git a/examples/htool_tpm.c b/examples/htool_tpm.c index 03002dc..f4e3a2d 100644 --- a/examples/htool_tpm.c +++ b/examples/htool_tpm.c @@ -21,6 +21,7 @@ #include "host_commands.h" #include "htool.h" #include "htool_cmd.h" +#include "htool_security_version.h" #include "transports/libhoth_device.h" int htool_set_tpm_mode(const struct htool_invocation* inv) { @@ -93,24 +94,36 @@ int htool_security_startup(const struct htool_invocation* inv) { return -1; } - // Standard 12-byte TPM2_Startup(CLEAR) command packet - static const uint8_t req[12] = { - 0x80, 0x01, // TPM_ST_NO_SESSIONS - 0x00, 0x00, 0x00, 0x0c, // paramSize = 12 - 0x00, 0x00, 0x01, 0x44, // TPM_CC_Startup - 0x00, 0x00 // TPM_SU_CLEAR - }; - - uint8_t resp[32]; - size_t resp_size = 0; - int ret = libhoth_hostcmd_exec( - dev, HOTH_CMD_BOARD_SPECIFIC_BASE + HOTH_PRV_CMD_HAVEN_TPM, 0, req, - sizeof(req), resp, sizeof(resp), &resp_size); - if (ret) { - htool_report_error("security startup", ret); - return ret; + libhoth_security_version sv = htool_get_security_version(dev); + switch (sv) { + case LIBHOTH_SECURITY_V2: { + fprintf(stderr, "security startup is not supported on Security V2\n"); + return 0; + } + case LIBHOTH_SECURITY_V3: { + // Standard 12-byte TPM2_Startup(CLEAR) command packet + static const uint8_t req[12] = { + 0x80, 0x01, // TPM_ST_NO_SESSIONS + 0x00, 0x00, 0x00, 0x0c, // paramSize = 12 + 0x00, 0x00, 0x01, 0x44, // TPM_CC_Startup + 0x00, 0x00 // TPM_SU_CLEAR + }; + + uint8_t resp[32]; + size_t resp_size = 0; + int ret = libhoth_hostcmd_exec( + dev, HOTH_CMD_BOARD_SPECIFIC_BASE + HOTH_PRV_CMD_HAVEN_TPM, 0, req, + sizeof(req), resp, sizeof(resp), &resp_size); + if (ret) { + htool_report_error("security startup", ret); + return ret; + } + + printf("TPM2_Startup(CLEAR) sent successfully.\n"); + return 0; + } + default: { + return -1; + } } - - printf("TPM2_Startup(CLEAR) sent successfully.\n"); - return 0; }