coreboot: check Cr50 PM mode on normal boot

Under some scenarios the key ladder on the Cr50 can get disabled.  If
this state is detected, trigger a reboot of the Cr50 to restore full
TPM functionality.

BUG=b:121463033
BRANCH=none
TEST=Built coreboot on sarien and grunt platforms.
TEST=Ran 'gsctool -a -m disable' and reboot. Verified coreboot sends
VENDOR_CC_IMMEDIATE_RESET command to Cr50 and that the Cr50 resets and
then the platform boots normally.
TEST=Performed Cr50 rollback to 0.0.22 which does not support the
VENDOR_CC_TPM_MODE command, confirmed that platform boots normally and
the coreboot log captures the unsupported command.
Tested-by: Keith Short <keithshort@chromium.org>

Change-Id: I70e012efaf1079d43890e909bc6b5015bef6835a
Signed-off-by: Keith Short <keithshort@chromium.org>
Reviewed-on: https://review.coreboot.org/c/31260
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>

2 files changed, 25 insertions, 0 deletions

diff --git a/src/security/tpm/tss/tcg-2.0/tss_marshaling.c b/src/security/tpm/tss/tcg-2.0/tss_marshaling.c
index f1c5a375e2..62bc6a9a35 100644
--- a/src/security/tpm/tss/tcg-2.0/tss_marshaling.c
+++ b/src/security/tpm/tss/tcg-2.0/tss_marshaling.c
@@ -266,6 +266,14 @@ static int marshal_cr50_vendor_command(struct obuf *ob, void *command_body)
 	uint16_t *sub_command = command_body;
 
 	switch (*sub_command) {
+	case TPM2_CR50_SUB_CMD_IMMEDIATE_RESET:
+		/* The 16-bit timeout parameter is optional for the
+		 * IMMEDIATE_RESET command.  However in coreboot, the timeout
+		 * parameter must be specified.
+		 */
+		rc |= obuf_write_be16(ob, sub_command[0]);
+		rc |= obuf_write_be16(ob, sub_command[1]);
+		break;
 	case TPM2_CR50_SUB_CMD_NVMEM_ENABLE_COMMITS:
 		rc |= obuf_write_be16(ob, *sub_command);
 		break;
@@ -276,6 +284,18 @@ static int marshal_cr50_vendor_command(struct obuf *ob, void *command_body)
 	case TPM2_CR50_SUB_CMD_GET_REC_BTN:
 		rc |= obuf_write_be16(ob, *sub_command);
 		break;
+	case TPM2_CR50_SUB_CMD_TPM_MODE:
+		/* The Cr50 TPM_MODE command supports an optional parameter.
+		 * When the parameter is present the Cr50 will attempt to change
+		 * the TPM state (enable or disable) and returns the new state
+		 * in the response.  When the parameter is absent, the Cr50
+		 * returns the current TPM state.
+		 *
+		 * coreboot currently only uses the TPM get capability and does
+		 * not set a new TPM state with the Cr50.
+		 */
+		rc |= obuf_write_be16(ob, *sub_command);
+		break;
 	default:
 		/* Unsupported subcommand. */
 		printk(BIOS_WARNING, "Unsupported cr50 subcommand: 0x%04x\n",
@@ -471,12 +491,16 @@ static int unmarshal_vendor_command(struct ibuf *ib,
 		return -1;
 
 	switch (vcr->vc_subcommand) {
+	case TPM2_CR50_SUB_CMD_IMMEDIATE_RESET:
+		break;
 	case TPM2_CR50_SUB_CMD_NVMEM_ENABLE_COMMITS:
 		break;
 	case TPM2_CR50_SUB_CMD_TURN_UPDATE_ON:
 		return ibuf_read_be8(ib, &vcr->num_restored_headers);
 	case TPM2_CR50_SUB_CMD_GET_REC_BTN:
 		return ibuf_read_be8(ib, &vcr->recovery_button_state);
+	case TPM2_CR50_SUB_CMD_TPM_MODE:
+		return ibuf_read_be8(ib, &vcr->tpm_mode);
 	default:
 		printk(BIOS_ERR,
 		       "%s:%d - unsupported vendor command %#04x!\n",
diff --git a/src/security/tpm/tss/tcg-2.0/tss_structures.h b/src/security/tpm/tss/tcg-2.0/tss_structures.h
index 6952169108..991cbcf502 100644
--- a/src/security/tpm/tss/tcg-2.0/tss_structures.h
+++ b/src/security/tpm/tss/tcg-2.0/tss_structures.h
@@ -298,6 +298,7 @@ struct vendor_command_response {
 	union {
 		uint8_t num_restored_headers;
 		uint8_t recovery_button_state;
+		uint8_t tpm_mode;
 	};
 };