Cr50: Add TPM-compliant commands for console lock

This allows custom TPM commands to be declared using the a
DECLARE_VENDOR_COMMAND macro instead of the original (and still
unchanged) DECLARE_EXTENSION_COMMAND macro.

The new commands are nearly identical, but they are encapsulated
using the vendor-specific protocols described in the TPMv2 spec.
Our original extensions use a non-standard command code, and
return a non-standard struct on completion, which can be
confusing to standard TPM drivers and tools.

Demonstrating the use of the new macros, this adds commands to
obtain the state of the Cr50 restricted console lock, or to set
the lock. There is intentionally no command to unlock the
console.

Note that this CL just adds the commands to the Cr50. We still
need to provide a nice userspace utility for the AP to use.

BUG=chrome-os-partner:58230
BUG=chrome-os-partner:57940
BRANCH=none
TEST=make buildall; load, boot, test, and update again on Reef

On Reef, I can use the trunks_send tool to send the raw TPM bytes
to invoke these commands:

Get the lock state:

  # trunks_send 80 01 00 00 00 0C 20 00 00 00 00 10
  80010000000D00000000001000

The last byte 00 indicates that the lock is NOT set, so set it:

  # trunks_send 80 01 00 00 00 0C 20 00 00 00 00 10
  80010000000C000000000011

Success. On the Cr50 console, I see it take effect:

  [480.080444 The console is locked]

Query the state again:

  # trunks_send 80 01 00 00 00 0C 20 00 00 00 00 10
  80010000000D00000000001001

and now the last byte 01 indicates that the console is locked.

And of course the existing extension commands still work as
before. In addition to uploading firmware, I can use the
usb_updater from my build machine to query the running firmware
version:

  $ ./extra/usb_updater/usb_updater -f
  open_device 18d1:5014
  found interface 4 endpoint 5, chunk_len 64
  READY
  -------
  start
  Target running protocol version 5
  Offsets: backup RO at 0x40000, backup RW at 0x4000
  Keyids: RO 0x3716ee6b, RW 0xb93d6539
  Current versions:
  RO 0.0.10
  RW 0.0.9
  $

Change-Id: I7fb1d888bf808c2ef0b2b07c782e926063cc2cc4
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/409692
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>

1 files changed, 89 insertions, 34 deletions

diff --git a/include/extension.h b/include/extension.h
index d3001934da..225ca87239 100644
--- a/include/extension.h
+++ b/include/extension.h
@@ -11,6 +11,43 @@
 
 #include "common.h"
 
+/* Extension and vendor commands. */
+enum vendor_cmd_cc {
+	/* Original extension commands */
+	EXTENSION_AES = 0,
+	EXTENSION_HASH = 1,
+	EXTENSION_RSA = 2,
+	EXTENSION_ECC = 3,
+	EXTENSION_FW_UPGRADE = 4,
+	EXTENSION_HKDF = 5,
+	EXTENSION_ECIES = 6,
+	EXTENSION_POST_RESET = 7,
+
+	LAST_EXTENSION_COMMAND = 15,
+
+	/* Our TPMv2 vendor-specific command codes. 16 bits available. */
+	VENDOR_CC_GET_LOCK = 16,
+	VENDOR_CC_SET_LOCK = 17,
+
+	LAST_VENDOR_COMMAND = 65535,
+};
+
+/* Error codes reported by extension and vendor commands. */
+enum vendor_cmd_rc {
+	/* EXTENSION_HASH error codes */
+	/* Attempt to start a session on an active handle. */
+	EXC_HASH_DUPLICATED_HANDLE = 1,
+	EXC_HASH_TOO_MANY_HANDLES = 2,  /* No room to allocate a new context. */
+	/* Continuation/finish on unknown context. */
+	EXC_HASH_UNKNOWN_CONTEXT = 3,
+
+	/* Our TPMv2 vendor-specific response codes. */
+	VENDOR_RC_SUCCESS = 0,
+	VENDOR_RC_BOGUS_ARGS = 1,
+	/* Only 7 bits available; max is 127 */
+	VENDOR_RC_NO_SUCH_COMMAND = 127,
+};
+
 /*
  * Type of function handling extension commands.
  *
@@ -20,12 +57,13 @@
  * @param response_size On input - max size of the buffer, on output - actual
  *                      number of data returned by the handler.
  */
-typedef void (*extension_handler)(void *buffer,
-				 size_t command_size,
-				 size_t *response_size);
+typedef enum vendor_cmd_rc (*extension_handler)(enum vendor_cmd_cc code,
+						void *buffer,
+						size_t command_size,
+						size_t *response_size);
+
 /*
  * Find handler for an extension command.
- *
  * @param command_code Code associated with a extension command handler.
  * @param buffer       Data to be processd by the handler, the same space
  *                     is used for data returned by the handler.
@@ -34,42 +72,59 @@ typedef void (*extension_handler)(void *buffer,
  *                     data returned by the handler. A single byte return
  *                     usually indicates an error and contains the error code.
  */
-void extension_route_command(uint16_t command_code,
-			    void *buffer,
-			    size_t command_size,
-			    size_t *size);
+uint32_t extension_route_command(uint16_t command_code,
+				 void *buffer,
+				 size_t command_size,
+				 size_t *size);
+
+/*
+ * The TPMv2 Spec mandates that vendor-specific command codes have bit 29 set,
+ * while bits 15-0 indicate the command. All other bits should be zero.
+ * We will define one of those 16-bit command values for Cr50 purposes, and use
+ * the subcommand_code in struct tpm_cmd_header to further distinguish the
+ * desired operation.
+ */
+#define TPM_CC_VENDOR_BIT_MASK 0x20000000
+#define VENDOR_CC_MASK         0x0000ffff
+/* Our vendor-specific command codes go here */
+#define TPM_CC_VENDOR_CR50         0x0000
 
+/*
+ * The TPM response code is all zero for success.
+ * Errors are a little complicated:
+ *
+ *   Bits 31:12 must be zero.
+ *
+ *   Bit 11     S=0   Error
+ *   Bit 10     T=1   Vendor defined response code
+ *   Bit  9     r=0   reserved
+ *   Bit  8     V=1   Conforms to TPMv2 spec
+ *   Bit  7     F=0   Confirms to Table 14, Format-Zero Response Codes
+ *   Bits 6:0   num   128 possible failure reasons
+ */
+#define VENDOR_RC_ERR 0x00000500
+
+/* Pointer table */
 struct extension_command {
 	uint16_t command_code;
 	extension_handler handler;
 } __packed;
 
-/* Values for different extension subcommands. */
-enum {
-	EXTENSION_AES = 0,
-	EXTENSION_HASH = 1,
-	EXTENSION_RSA = 2,
-	EXTENSION_ECC = 3,
-	EXTENSION_FW_UPGRADE = 4,
-	EXTENSION_HKDF = 5,
-	EXTENSION_ECIES = 6,
-	EXTENSION_POST_RESET = 7,
-};
-
-
-/* Error codes reported by extension commands. */
-enum {
-	/* EXTENSION_HASH error codes */
-	/* Attempt to start a session on an active handle. */
-	EXC_HASH_DUPLICATED_HANDLE = 1,
-	EXC_HASH_TOO_MANY_HANDLES = 2,  /* No room to allocate a new context. */
-	/* Continuation/finish on unknown context. */
-	EXC_HASH_UNKNOWN_CONTEXT = 3
-};
+#define DECLARE_EXTENSION_COMMAND(code, func)				\
+	static enum vendor_cmd_rc func##_wrap(enum vendor_cmd_cc code,	\
+				       void *cmd_body,			\
+				       size_t cmd_size,			\
+				       size_t *response_size) {		\
+		func(cmd_body, cmd_size, response_size);		\
+		return 0;						\
+	}								\
+	const struct extension_command __keep __extension_cmd_##code	\
+	__attribute__((section(".rodata.extensioncmds")))		\
+		= {.command_code = code, .handler = func##_wrap }
 
-#define DECLARE_EXTENSION_COMMAND(code, handler) \
-	const struct extension_command __keep __extension_cmd_##code \
-	__attribute__((section(".rodata.extensioncmds")))	   \
-	= {code, handler}
+#define DECLARE_VENDOR_COMMAND(code, func)				\
+	const struct extension_command __keep __vendor_cmd_##code	\
+	__attribute__((section(".rodata.extensioncmds")))		\
+		= {.command_code = code, .handler = func}
 
 #endif  /* __EC_INCLUDE_EXTENSION_H */