cr50: Add case closed debugging V1 configuration

This adds the CCD configuration module, and the console commands to
control it.  It is not wired up to any of the CCD capabilities; that's
coming in the next CL.

Briefly:
* CCD configuration is persistently stored in nvmem_vars.  Use ccdinfo to
  print it.
* CCD can be Locked, Unlocked (some capabilities), or Opened
  (all capabilities), using the ccdlock / ccdunlock / ccdopen commands.
* CCD config can be restricted by setting a password via ccdpass.
* Individual config capabilities can be set via ccdset.  Some of those will
  be used to gate access to things like write protect and UARTs.  Others
  affect the requirements for ccdunlock / ccdopen (for example, is physical
  presenc required).
* The entire config can be reset via ccdreset.  If only unlocked, config
  that is restricted to Opened is not reset.
* If CR50_DEV=1, ccdoops will force-reset and open the config.

See go/cr50-ccd-wp for more information.

BUG=b:62537474
BRANCH=none
TEST=manual with CR50_DEV=1 build
	gpioget # make sure GPIO_BATT_PRES_L=0

	ccdlock # lock, because CR50_DEV=1 builds start unlocked

	ccdinfo # locked, flags=0, all capabilities default
	ccdpass # access denied (we're locked)
	ccdreset # access denied
	ccdset flashap always # access denied

	ccdunlock
	ccdinfo # unlocked
	ccdpass foo
	ccdinfo # flags=2 (password set when unlocked)
	ccdset flashap always # access denied
	ccdset uartectx unlesslocked
	ccdinfo # yes, uartectx permission changed
	ccdlock

	ccdunlock # fails without password
	ccdunlock bar # wrong password
	ccdunlock foo # busy
	(wait 3 sec)
	ccdunlock foo
	ccdreset
	ccdinfo # no password, flags 0, capabilities all default

	ccdopen # requires physical presence; tap power or use 'pp'
	ccdset uartectx unlesslocked
	ccdset batterybypasspp ifopened
	ccdpass baz
	ccdinfo # password set, flag 0, ccdset changes worked

	ccdunlock
	ccdreset
	ccdinfo # uartectx back to ifopened, password still set

	ccdopen baz # still requires physical presence
	ccdset opennolongpp always
	ccdlock
	ccdopen baz # no pp required
	ccdset unlocknoshortpp unlesslocked
	ccdlock
	ccdopen baz # short pp sequence required (3 taps)
	ccdlock
	ccdunlock baz # short pp sequence required
	ccdopen baz # pp not required
	ccdset unlocknoshortpp always
	ccdlock

	testlab open # access denied
	testlab enable # access denied
	ccdunlock baz
	testlab open # access denied
	testlab enable # access denied
	ccdopen baz
	testlab enable # requires short pp
	ccdinfo # flags 1

	ccdreset
	ccdinfo # no password, flags=1, caps all default
	ccdlock
	testlab open
	ccdinfo # opened
	testlab disable # requires short pp; let it time out
	ccdinfo # still opened, flags=1

	ccdlock
	ccdoops # backdoor in CR50_DEV images to force-reset CCD
	ccdinfo # opened, flags=0, all defaults (yes, oops wipes out testlab)

	ccdreset rma
	ccdinfo # flags = 0x400000, everything but Cr50FullConsole always
	ccdreset # back to flags=0, all default

Change-Id: I24e8d8f361874671e6e94f27492ae00db919bea9
Reviewed-on: https://chromium-review.googlesource.com/569439
Commit-Ready: Randall Spangler <rspangler@chromium.org>
Tested-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>

3 files changed, 1011 insertions, 0 deletions

diff --git a/common/build.mk b/common/build.mk
index 5f6a8954bd..792fcd8138 100644
--- a/common/build.mk
+++ b/common/build.mk
@@ -33,6 +33,7 @@ common-$(CONFIG_BLUETOOTH_LE_STACK)+=btle_hci_controller.o btle_ll.o
 common-$(CONFIG_BUTTON_COUNT)+=button.o
 common-$(CONFIG_CAPSENSE)+=capsense.o
 common-$(CONFIG_CASE_CLOSED_DEBUG)+=case_closed_debug.o
+common-$(CONFIG_CASE_CLOSED_DEBUG_V1)+=ccd_config.o
 common-$(CONFIG_CHARGE_MANAGER)+=charge_manager.o
 common-$(CONFIG_CHARGE_RAMP)+=charge_ramp.o
 common-$(CONFIG_CHARGER)+=charger.o
diff --git a/common/ccd_config.c b/common/ccd_config.c
new file mode 100644
index 0000000000..2c465c6d68
--- /dev/null
+++ b/common/ccd_config.c
@@ -0,0 +1,1007 @@
+/* Copyright 2017 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * Case Closed Debug configuration
+ */
+
+#include "case_closed_debug.h"
+#include "common.h"
+#include "console.h"
+#include "cryptoc/sha256.h"
+#include "dcrypto.h"
+#include "hooks.h"
+#include "nvmem_vars.h"
+#include "physical_presence.h"
+#include "system.h"
+#include "task.h"
+#include "timer.h"
+#include "trng.h"
+
+#define CPRINTS(format, args...) cprints(CC_CCD, format, ## args)
+#define CPRINTF(format, args...) cprintf(CC_CCD, format, ## args)
+
+enum ccd_state {
+	CCD_STATE_LOCKED = 0,
+	CCD_STATE_UNLOCKED,
+	CCD_STATE_OPENED,
+
+	/* Number of CCD states */
+	CCD_STATE_COUNT
+};
+
+/* Restriction state for ccdunlock when no password is set */
+enum ccd_unlock_restrict {
+	/* Unrestricted */
+	CCD_UNLOCK_UNRESTRICTED = 0,
+
+	/* Physical presence required for unlock unless disabled by config */
+	CCD_UNLOCK_NEED_PP,
+
+	/* Unlock not allowed */
+	CCD_UNLOCK_DISABLED
+};
+
+/* Minimum time between password attempts */
+#define PASSWORD_RATE_LIMIT_US (3 * SECOND)
+
+/* Current version of case-closed debugging configuration struct */
+#define CCD_CONFIG_VERSION 0x10
+
+/* Capability states */
+enum ccd_capability_state {
+	/* Default value */
+	CCD_CAP_STATE_DEFAULT = 0,
+
+	/* Always available (state >= CCD_STATE_LOCKED) */
+	CCD_CAP_STATE_ALWAYS = 1,
+
+	/* Unless locked (state >= CCD_STATE_UNLOCKED) */
+	CCD_CAP_STATE_UNLESS_LOCKED = 2,
+
+	/* Only if opened (state >= CCD_STATE_OPENED) */
+	CCD_CAP_STATE_IF_OPENED = 3,
+
+	/* Number of capability states */
+	CCD_CAP_STATE_COUNT
+};
+
+/* Size of password salt and digest in bytes */
+#define CCD_PASSWORD_SALT_SIZE 4
+#define CCD_PASSWORD_DIGEST_SIZE 16
+
+struct ccd_config {
+	/* Version (CCD_CONFIG_VERSION) */
+	uint8_t version;
+
+	/*
+	 * Flags.  These MUST immediately follow version, so that the test
+	 * lab flag is always the LSBit of the first flags byte.
+	 */
+	uint8_t flags[3];
+
+	/* Capabilities */
+	uint8_t capabilities[8];
+
+	/* Password salt (random) */
+	uint8_t password_salt[CCD_PASSWORD_SALT_SIZE];
+
+	/*
+	 * Password digest = truncated
+	 * SHA256_digest(password_salt+device_id+password)
+	 */
+	uint8_t password_digest[CCD_PASSWORD_DIGEST_SIZE];
+};
+
+struct ccd_capability_info {
+	/* Capability name */
+	const char *name;
+
+	/* Default state, if config set to CCD_CAP_STATE_DEFAULT */
+	enum ccd_capability_state default_state;
+};
+
+/* Flags for ccd_reset_config() */
+enum ccd_reset_config_flags {
+	/* Also reset test lab flag */
+	CCD_RESET_TEST_LAB = (1 << 0),
+
+	/* Only reset Always/UnlessLocked settings */
+	CCD_RESET_UNLOCKED_ONLY = (1 << 1),
+
+	/* Use RMA/factory defaults */
+	CCD_RESET_RMA = (1 << 2)
+};
+
+/* Forward declarations of static functions */
+static int ccd_reset_config(unsigned flags);
+
+/* Nvmem variable name for CCD config */
+static const uint8_t k_ccd_config = NVMEM_VAR_CCD_CONFIG;
+
+/* Flags which can be set via ccd_set_flag() */
+static const uint32_t k_public_flags =
+		CCD_FLAG_OVERRIDE_WP_AT_BOOT |
+		CCD_FLAG_OVERRIDE_WP_STATE_ENABLED;
+
+/* List of CCD capability info; must be in same order as enum ccd_capability */
+static const struct ccd_capability_info cap_info[CCD_CAP_COUNT] = {
+	{"UartAPTX",		CCD_CAP_STATE_ALWAYS},
+	{"UartAPRX",		CCD_CAP_STATE_ALWAYS},
+	{"UartECTX",		CCD_CAP_STATE_ALWAYS},
+	{"UartECRX",		CCD_CAP_STATE_IF_OPENED},
+
+	{"FlashAP",		CCD_CAP_STATE_IF_OPENED},
+	{"FlashEC",		CCD_CAP_STATE_IF_OPENED},
+	{"WPOverride",		CCD_CAP_STATE_IF_OPENED},
+	{"RebootECAP",		CCD_CAP_STATE_IF_OPENED},
+
+	{"Cr50FullConsole",	CCD_CAP_STATE_IF_OPENED},
+	{"UnlockNoReboot",	CCD_CAP_STATE_ALWAYS},
+	{"UnlockNoShortPP",	CCD_CAP_STATE_ALWAYS},
+	{"OpenNoTPMWipe",	CCD_CAP_STATE_IF_OPENED},
+
+	{"OpenNoLongPP",	CCD_CAP_STATE_IF_OPENED},
+	{"BatteryBypassPP",	CCD_CAP_STATE_ALWAYS},
+	{"UpdateNoTPMWipe",	CCD_CAP_STATE_ALWAYS},
+};
+
+static const char *ccd_state_names[CCD_STATE_COUNT] = {
+	"Locked", "Unlocked", "Opened"};
+static const char *ccd_cap_state_names[CCD_CAP_STATE_COUNT] = {
+	"Default", "Always", "UnlessLocked", "IfOpened"};
+
+#ifdef CONFIG_CASE_CLOSED_DEBUG_V1_UNSAFE
+static enum ccd_state ccd_state = CCD_STATE_OPENED;
+#else
+static enum ccd_state ccd_state = CCD_STATE_LOCKED;
+#endif
+
+static struct ccd_config config;
+static uint8_t ccd_config_loaded;
+static struct mutex ccd_config_mutex;
+
+/******************************************************************************/
+/* Raw config accessors */
+
+/**
+ * Get CCD flags.
+ *
+ * @return the current flags mask.
+ */
+static uint32_t raw_get_flags(void)
+{
+	return (uint32_t)(config.flags[0] << 0)
+			| ((uint32_t)config.flags[1] << 8)
+			| ((uint32_t)config.flags[2] << 16);
+}
+
+/**
+ * Set a single CCD flag.
+ *
+ * This does NOT call ccd_save_config() or lock the mutex.  Caller must do
+ * those.
+ *
+ * @param flag		Flag to set
+ * @param value		New value for flag (0=clear, non-zero=set)
+ */
+static void raw_set_flag(enum ccd_flag flag, int value)
+{
+	uint32_t f;
+
+	f = raw_get_flags();
+	if (value)
+		f |= flag;
+	else
+		f &= ~flag;
+
+	config.flags[0] = (uint8_t)(f >> 0);
+	config.flags[1] = (uint8_t)(f >> 8);
+	config.flags[2] = (uint8_t)(f >> 16);
+}
+
+/**
+ * Get a raw capability state from the config
+ *
+ * @param cap			Capability to check
+ * @param translate_default	If non-zero, translate CCD_CAP_STATE_DEFAULT
+ *				to the actual default for that config
+ * @return The capability state.
+ */
+static enum ccd_capability_state raw_get_cap(enum ccd_capability cap,
+					     int translate_default)
+{
+	int c =	(config.capabilities[cap / 4] >> (2 * (cap % 4))) & 3;
+
+	if (c == CCD_CAP_STATE_DEFAULT && translate_default)
+		c = cap_info[cap].default_state;
+
+	return c;
+}
+
+/**
+ * Set a raw capability to the config.
+ *
+ * This does NOT call ccd_save_config() or lock the mutex.  Caller must do
+ * those.
+ *
+ * @param cap		Capability to set
+ * @param state		New state for capability
+ */
+static void raw_set_cap(enum ccd_capability cap,
+			    enum ccd_capability_state state)
+{
+	config.capabilities[cap / 4] &= ~(3 << (2 * (cap % 4)));
+	config.capabilities[cap / 4] |= (state & 3) << (2 * (cap % 4));
+}
+
+/**
+ * Check if a password is set.
+ * @return 1 if password is set, 0 if it's not
+ */
+static int raw_has_password(void)
+{
+	uint8_t set = 0;
+	int i;
+
+	/* Password is set unless salt and digest are all zero */
+	for (i = 0; i < sizeof(config.password_salt); i++)
+		set |= config.password_salt[i];
+	for (i = 0; i < sizeof(config.password_digest); i++)
+		set |= config.password_digest[i];
+
+	return !!set;
+}
+
+/**
+ * Calculate the expected digest for a password.
+ *
+ * Uses the unique device ID and the salt from the config.
+ *
+ * @param digest	Pointer to a CCD_PASSWORD_DIGEST_SIZE buffer
+ * @param password	The password to digest
+ */
+static void ccd_password_digest(uint8_t *digest, const char *password)
+{
+	HASH_CTX sha;
+	uint8_t *unique_id;
+	int unique_id_len;
+
+	unique_id_len = system_get_chip_unique_id(&unique_id);
+
+	DCRYPTO_SHA256_init(&sha, 0);
+	HASH_update(&sha, config.password_salt, sizeof(config.password_salt));
+	HASH_update(&sha, unique_id, unique_id_len);
+	HASH_update(&sha, password, strlen(password));
+	memcpy(digest, HASH_final(&sha), CCD_PASSWORD_DIGEST_SIZE);
+}
+
+/**
+ * Check the password.
+ *
+ * @param password	The password to check
+ * @return EC_SUCCESS, EC_ERROR_BUSY if too soon since last attempt, or
+ *	   EC_ERROR_ACCESS_DENIED if mismatch.
+ */
+static int raw_check_password(const char *password)
+{
+	/*
+	 * Time of last password attempt; initialized to 0 at boot.  Yes, we're
+	 * only keeping the bottom 32 bits of the timer here, so on a
+	 * wraparound (every ~4000 seconds) it's possible for an attacker to
+	 * get one extra attempt.  But it still behaves properly at boot,
+	 * requiring the system to be up PASSWORD_RATE_LIMIT_US before allowing
+	 * the first attempt.
+	 */
+	static uint32_t last_password_time;
+
+	uint8_t digest[CCD_PASSWORD_DIGEST_SIZE];
+	uint32_t t;
+
+	/* If no password is set, match only an empty password */
+	if (!raw_has_password())
+		return *password ? EC_ERROR_ACCESS_DENIED : EC_SUCCESS;
+
+	/* Rate limit password attempts */
+	t = get_time().le.lo;
+	if (t - last_password_time < PASSWORD_RATE_LIMIT_US)
+		return EC_ERROR_BUSY;
+	last_password_time = t;
+
+	/* Calculate the digest of the password */
+	ccd_password_digest(digest, password);
+
+	if (safe_memcmp(digest, config.password_digest,
+			sizeof(config.password_digest)))
+		return EC_ERROR_ACCESS_DENIED;
+
+	return EC_SUCCESS;
+}
+
+/**
+ * Clear the password.
+ *
+ * This does NOT call ccd_save_config() or lock the mutex.  Caller must do
+ * those.
+ */
+static void raw_reset_password(void)
+{
+	memset(config.password_salt, 0, sizeof(config.password_salt));
+	memset(config.password_digest, 0, sizeof(config.password_digest));
+	raw_set_flag(CCD_FLAG_PASSWORD_SET_WHEN_UNLOCKED, 0);
+}
+
+/**
+ * Set the password.
+ *
+ * @param password	New password; must be non-empty
+ */
+static void raw_set_password(const char *password)
+{
+	/* Get a new salt */
+	rand_bytes(config.password_salt, sizeof(config.password_salt));
+
+	/* Update the password digest */
+	ccd_password_digest(config.password_digest, password);
+
+	/* Track whether we were opened when we set the password */
+	raw_set_flag(CCD_FLAG_PASSWORD_SET_WHEN_UNLOCKED,
+				     ccd_state == CCD_STATE_UNLOCKED);
+}
+
+/******************************************************************************/
+/* Internal methods */
+
+#ifdef CONFIG_CASE_CLOSED_DEBUG_V1_UNSAFE
+/* TODO(rspangler): remove when we wire this up to real capabilities */
+void test_ccd_change_hook(void)
+{
+	CPRINTS("CCD change hook called");
+}
+DECLARE_HOOK(HOOK_CCD_CHANGE, test_ccd_change_hook, HOOK_PRIO_DEFAULT);
+#endif
+
+/**
+ * Set the CCD state.
+ *
+ * @param state		New CCD state
+ */
+static void ccd_set_state(enum ccd_state state)
+{
+	if (state == ccd_state)
+		return;
+
+	ccd_state = state;
+
+	/* Notify CCD users of configuration change */
+	hook_notify(HOOK_CCD_CHANGE);
+}
+
+/**
+ * Load CCD config from nvmem_vars
+ *
+ * @return EC_SUCCESS or non-zero error code.
+ */
+static void ccd_load_config(void)
+{
+	const struct tuple *t;
+
+	/* Don't reload if we're already loaded */
+	if (ccd_config_loaded)
+		return;
+
+	/* Load config data from nvmem */
+	t = getvar(&k_ccd_config, sizeof(k_ccd_config));
+
+	/* Use defaults if config data is not present */
+	if (!t) {
+		if (board_is_first_factory_boot()) {
+			/* Give factory RMA access */
+			CPRINTS("CCD using factory config");
+			ccd_reset_config(CCD_RESET_TEST_LAB | CCD_RESET_RMA);
+		} else {
+			/* Somehow we lost our config; normal defaults */
+			CPRINTS("CCD using default config");
+			ccd_reset_config(CCD_RESET_TEST_LAB);
+		}
+
+		ccd_config_loaded = 1;
+		return;
+	}
+
+	/* Copy the tuple data */
+	memcpy(&config, tuple_val(t), MIN(sizeof(config), t->val_len));
+
+	/* If version or size is wrong, reset to defaults */
+	if (config.version != CCD_CONFIG_VERSION ||
+	    t->val_len != sizeof(config)) {
+		CPRINTS("CCD config mismatch; using defaults");
+		/*
+		 * If the config data was big enough to hold the test lab bit,
+		 * preserve it.  That's guaranteed to be in the same place for
+		 * all data versions.
+		 */
+		ccd_reset_config(t->val_len < 2 ? CCD_RESET_TEST_LAB : 0);
+	}
+
+	ccd_config_loaded = 1;
+
+	/* Notify CCD users of configuration change */
+	hook_notify(HOOK_CCD_CHANGE);
+}
+
+/**
+ * Save CCD config to nvmem_vars
+ *
+ * @return EC_SUCCESS or non-zero error code.
+ */
+static int ccd_save_config(void)
+{
+	int rv;
+
+	rv = setvar(&k_ccd_config, sizeof(k_ccd_config),
+		      (const uint8_t *)&config, sizeof(config));
+	if (rv)
+		return rv;
+
+	rv = writevars();
+
+	/* Notify CCD users of configuration change */
+	hook_notify(HOOK_CCD_CHANGE);
+
+	return rv;
+}
+
+/**
+ * Set a CCD capability to a new state.
+ *
+ * @param cap		Capability to set
+ * @param state		New state for capability
+ * @return EC_SUCCESS or non-zero error code.
+ */
+static int ccd_set_cap(enum ccd_capability cap, enum ccd_capability_state state)
+{
+	if (!ccd_config_loaded)
+		return EC_ERROR_BUSY;
+
+	if (state == raw_get_cap(cap, 0))
+		return EC_SUCCESS;	/* Capability not changed */
+
+	mutex_lock(&ccd_config_mutex);
+	raw_set_cap(cap, state);
+	mutex_unlock(&ccd_config_mutex);
+
+	return ccd_save_config();
+}
+
+/**
+ * Reset CCD config to defaults.
+ *
+ * @param flags		Reset flags (see enum ccd_reset_config_flags)
+ * @return EC_SUCCESS, or non-zero if error.
+ */
+static int ccd_reset_config(unsigned flags)
+{
+	int old_lab = ccd_get_flag(CCD_FLAG_TEST_LAB);
+
+	mutex_lock(&ccd_config_mutex);
+
+	if (flags & CCD_RESET_UNLOCKED_ONLY) {
+		/* Only set config options that are mutable when unlocked */
+		int i;
+
+		/* Reset the password if it was set when unlocked */
+		if (ccd_get_flag(CCD_FLAG_PASSWORD_SET_WHEN_UNLOCKED))
+			raw_reset_password();
+
+		/* Reset all capabilities that aren't IfOpened */
+		for (i = 0; i < CCD_CAP_COUNT; i++) {
+			if (raw_get_cap(i, 1) == CCD_CAP_STATE_IF_OPENED)
+				continue;
+			raw_set_cap(i, CCD_CAP_STATE_DEFAULT);
+		}
+
+		/* Flags all require IfOpened, so don't touch those */
+	} else {
+		/* Reset the entire config */
+		memset(&config, 0, sizeof(config));
+		config.version = CCD_CONFIG_VERSION;
+	}
+
+	if (flags & CCD_RESET_RMA) {
+		/* Force RMA settings */
+		int i;
+
+		/* Allow all capabilities all the time */
+		for (i = 0; i < CCD_CAP_COUNT; i++) {
+			/*
+			 * Restricted console commands are still IfOpened, but
+			 * that's kinda meaningless because we set a
+			 * well-defined password below.
+			 */
+			if (i == CCD_CAP_CR50_RESTRICTED_CONSOLE)
+				continue;
+
+			raw_set_cap(i, CCD_CAP_STATE_ALWAYS);
+		}
+
+		/* Force WP disabled at boot */
+		raw_set_flag(CCD_FLAG_OVERRIDE_WP_AT_BOOT, 1);
+		raw_set_flag(CCD_FLAG_OVERRIDE_WP_STATE_ENABLED, 0);
+	}
+
+	/* Restore test lab flag unless explicitly resetting it */
+	if (!(flags & CCD_RESET_TEST_LAB))
+		raw_set_flag(CCD_FLAG_TEST_LAB, old_lab);
+
+	mutex_unlock(&ccd_config_mutex);
+
+	return ccd_save_config();
+}
+
+/**
+ * Convert a string to a capability index.
+ *
+ * @param name		Capability name to find
+ * @return The capability index, or CCD_CAP_COUNT if error
+ */
+static enum ccd_capability ccd_cap_from_name(const char *name)
+{
+	int i;
+
+	for (i = 0; i < CCD_CAP_COUNT; i++) {
+		if (!strcasecmp(name, cap_info[i].name))
+			return i;
+	}
+
+	return CCD_CAP_COUNT;
+}
+
+/**
+ * Reset the password.
+ *
+ * @return EC_SUCCESS or non-zero error code.
+ */
+static int ccd_reset_password(void)
+{
+	mutex_lock(&ccd_config_mutex);
+	raw_reset_password();
+	mutex_unlock(&ccd_config_mutex);
+
+	return ccd_save_config();
+}
+
+/**
+ * Set the password.
+ *
+ * @param password	New password; must be non-empty
+ * @return EC_SUCCESS or non-zero error code.
+ */
+static int ccd_set_password(const char *password)
+{
+	mutex_lock(&ccd_config_mutex);
+	raw_set_password(password);
+	mutex_unlock(&ccd_config_mutex);
+
+	return ccd_save_config();
+}
+
+/******************************************************************************/
+/* Handlers for state changes requiring physical presence */
+
+static void ccd_open_done(void)
+{
+	if (!ccd_is_cap_enabled(CCD_CAP_OPEN_WITHOUT_TPM_WIPE)) {
+		/* Can't open unless wipe succeeds */
+		if (board_wipe_tpm() != EC_SUCCESS) {
+			CPRINTS("CCD open TPM wipe failed");
+			return;
+		}
+	}
+
+	if (!ccd_is_cap_enabled(CCD_CAP_UNLOCK_WITHOUT_AP_REBOOT))
+		board_reboot_ap();
+
+	CPRINTS("CCD opened");
+	ccd_set_state(CCD_STATE_OPENED);
+}
+
+static void ccd_unlock_done(void)
+{
+	if (!ccd_is_cap_enabled(CCD_CAP_UNLOCK_WITHOUT_AP_REBOOT))
+		board_reboot_ap();
+
+	CPRINTS("CCD unlocked");
+	ccd_set_state(CCD_STATE_UNLOCKED);
+}
+
+static void ccd_testlab_toggle(void)
+{
+	int v = !ccd_get_flag(CCD_FLAG_TEST_LAB);
+
+	CPRINTS("Test lab mode %sbled", v ? "ena" : "dis");
+
+	/* Use raw_set_flag() because the test lab flag is internal */
+	mutex_lock(&ccd_config_mutex);
+	raw_set_flag(CCD_FLAG_TEST_LAB, v);
+	mutex_unlock(&ccd_config_mutex);
+}
+
+/******************************************************************************/
+/* External interface */
+
+void ccd_config_init(void)
+{
+	ccd_load_config();
+}
+
+int ccd_get_flag(enum ccd_flag flag)
+{
+	uint32_t f = raw_get_flags();
+
+	if (!ccd_config_loaded)
+		return 0;
+
+	return !!(f & flag);
+}
+
+int ccd_set_flag(enum ccd_flag flag, int value)
+{
+	/* Fail if trying to set a private flag */
+	if (flag & ~k_public_flags)
+		return EC_ERROR_ACCESS_DENIED;
+
+	if (!ccd_config_loaded)
+		return EC_ERROR_BUSY;
+
+	if (ccd_get_flag(flag) == !!value)
+		return EC_SUCCESS;
+
+	mutex_lock(&ccd_config_mutex);
+	raw_set_flag(flag, value);
+	mutex_unlock(&ccd_config_mutex);
+	return ccd_save_config();
+}
+
+int ccd_is_cap_enabled(enum ccd_capability cap)
+{
+	/* Don't enable any capabilities before we've loaded the config */
+	if (!ccd_config_loaded) {
+		CPRINTS("CCD cap %s checked before load\n",
+			cap_info[cap].name);
+		return 0;
+	}
+
+	switch (raw_get_cap(cap, 1)) {
+	case CCD_CAP_STATE_ALWAYS:
+		return 1;
+	case CCD_CAP_STATE_UNLESS_LOCKED:
+		return ccd_state != CCD_STATE_LOCKED;
+	case CCD_CAP_STATE_IF_OPENED:
+	default:
+		return ccd_state == CCD_STATE_OPENED;
+	}
+}
+
+/******************************************************************************/
+/* Console commands */
+
+static int command_ccdinfo(int argc, char **argv)
+{
+	int i;
+
+	ccprintf("State: %s\n", ccd_state_names[ccd_state]);
+	ccprintf("Password: %s\n", raw_has_password() ? "set" : "none");
+	ccprintf("Flags: 0x%06x\n", raw_get_flags());
+
+	ccprintf("Capabilities: %.8h\n", config.capabilities);
+	for (i = 0; i < CCD_CAP_COUNT; i++) {
+		int c = raw_get_cap(i, 0);
+
+		ccprintf("%-15s %c %d=%s",
+			 cap_info[i].name,
+			 ccd_is_cap_enabled(i) ? 'Y' : '-',
+			 c, ccd_cap_state_names[c]);
+		if (c == CCD_CAP_STATE_DEFAULT)
+			ccprintf(" (%s)",
+				ccd_cap_state_names[cap_info[i].default_state]);
+		ccprintf("\n");
+		cflush();
+	}
+
+	return EC_SUCCESS;
+}
+DECLARE_SAFE_CONSOLE_COMMAND(ccdinfo, command_ccdinfo,
+			     "",
+			     "Print CCD state");
+
+static int command_ccdreset(int argc, char **argv)
+{
+	int flags = 0;
+
+	if (argc > 1) {
+		if (!strcasecmp(argv[1], "rma"))
+			flags = CCD_RESET_RMA;
+		else
+			return EC_ERROR_PARAM1;
+	}
+
+	switch (ccd_state) {
+	case CCD_STATE_OPENED:
+		ccprintf("%sResetting all settings.\n",
+			 flags & CCD_RESET_RMA ? "RMA " : "");
+		/* Note that this does not reset the testlab flag */
+		return ccd_reset_config(flags);
+
+	case CCD_STATE_UNLOCKED:
+		ccprintf("Resetting unlocked settings.\n");
+		return ccd_reset_config(CCD_RESET_UNLOCKED_ONLY);
+
+	default:
+		return EC_ERROR_ACCESS_DENIED;
+	}
+}
+DECLARE_SAFE_CONSOLE_COMMAND(ccdreset, command_ccdreset,
+			     "[rma]",
+			     "Reset CCD config");
+
+static int command_ccdset(int argc, char **argv)
+{
+	enum ccd_capability cap;
+	enum ccd_capability_state old;
+	enum ccd_capability_state new;
+
+	/* Only works if unlocked or opened */
+	if (ccd_state == CCD_STATE_LOCKED)
+		return EC_ERROR_ACCESS_DENIED;
+
+	if (argc < 3)
+		return EC_ERROR_PARAM_COUNT;
+
+	/* Get capability to set */
+	cap = ccd_cap_from_name(argv[1]);
+	if (cap == CCD_CAP_COUNT)
+		return EC_ERROR_PARAM1;
+
+	/* Get new state */
+	for (new = CCD_CAP_STATE_DEFAULT; new < CCD_CAP_STATE_COUNT; new++) {
+		if (!strcasecmp(argv[2], ccd_cap_state_names[new]))
+			break;
+	}
+	if (new == CCD_CAP_STATE_COUNT)
+		return EC_ERROR_PARAM2;
+
+	/* Get current state */
+	old = raw_get_cap(cap, 1);
+
+	/* If we're only unlocked, can't change to/from IfOpened */
+	if (ccd_state == CCD_STATE_UNLOCKED &&
+	    (new == CCD_CAP_STATE_IF_OPENED || old == CCD_CAP_STATE_IF_OPENED))
+		return EC_ERROR_ACCESS_DENIED;
+
+	/* Set new state */
+	return ccd_set_cap(cap, new);
+}
+DECLARE_SAFE_CONSOLE_COMMAND(ccdset, command_ccdset,
+			     "<cap> <state>",
+			     "Set CCD capability state");
+
+static int command_ccdpassword(int argc, char **argv)
+{
+	/* Only works if unlocked or opened */
+	if (ccd_state == CCD_STATE_LOCKED)
+		return EC_ERROR_ACCESS_DENIED;
+
+	if (argc < 2)
+		return EC_ERROR_PARAM_COUNT;
+
+	/* If password was set from Opened, can't change if just Unlocked */
+	if (raw_has_password() && ccd_state == CCD_STATE_UNLOCKED &&
+	    !ccd_get_flag(CCD_FLAG_PASSWORD_SET_WHEN_UNLOCKED))
+		return EC_ERROR_ACCESS_DENIED;
+
+	if (!strcasecmp(argv[1], "clear"))
+		return ccd_reset_password();
+
+	/* Set new password */
+	return ccd_set_password(argv[1]);
+}
+DECLARE_SAFE_CONSOLE_COMMAND(ccdpassword, command_ccdpassword,
+			     "[<new password> | clear]",
+			     "Set or clear CCD password");
+
+static int command_ccdopen(int argc, char **argv)
+{
+	int is_long = 1;
+	int need_pp = 1;
+	int rv;
+
+	if (ccd_state == CCD_STATE_OPENED)
+		return EC_SUCCESS;
+
+	if (raw_has_password()) {
+		if (argc < 2)
+			return EC_ERROR_PARAM_COUNT;
+
+		rv = raw_check_password(argv[1]);
+		if (rv)
+			return rv;
+	} else if (!board_fwmp_allows_unlock()) {
+		return EC_ERROR_ACCESS_DENIED;
+	}
+
+	/* Fail and abort if already checking physical presence */
+	if (physical_detect_busy()) {
+		physical_detect_abort();
+		return EC_ERROR_BUSY;
+	}
+
+	/* Reduce physical presence if enabled via config */
+	if (ccd_is_cap_enabled(CCD_CAP_OPEN_WITHOUT_LONG_PP))
+		is_long = 0;
+	if (!is_long && ccd_is_cap_enabled(CCD_CAP_UNLOCK_WITHOUT_SHORT_PP))
+		need_pp = 0;
+
+	/* Bypass physical presence check entirely if battery is removed */
+	if (ccd_is_cap_enabled(CCD_CAP_REMOVE_BATTERY_BYPASSES_PP) &&
+	    !board_battery_is_present()) {
+		need_pp = 0;
+	}
+
+	if (need_pp) {
+		/* Start physical presence detect */
+		ccprintf("Starting CCD open...\n");
+		return physical_detect_start(is_long, ccd_open_done);
+	} else {
+		/* No physical presence required; go straight to done */
+		ccd_open_done();
+		return EC_SUCCESS;
+	}
+}
+DECLARE_SAFE_CONSOLE_COMMAND(ccdopen, command_ccdopen,
+			     "[password]",
+			     "Change CCD state to Opened");
+
+static int command_ccdunlock(int argc, char **argv)
+{
+	int need_pp = 1;
+	int rv;
+
+	if (ccd_state == CCD_STATE_UNLOCKED)
+		return EC_SUCCESS;
+
+	/* Can go from opened to unlocked with no delay or password */
+	if (ccd_state == CCD_STATE_OPENED) {
+		ccd_unlock_done();
+		return EC_SUCCESS;
+	}
+
+	if (raw_has_password()) {
+		if (argc < 2)
+			return EC_ERROR_PARAM_COUNT;
+
+		rv = raw_check_password(argv[1]);
+		if (rv)
+			return rv;
+	} else if (!board_fwmp_allows_unlock()) {
+		/* Unlock disabled by FWMP */
+		return EC_ERROR_ACCESS_DENIED;
+	} else {
+		/*
+		 * When unlock is requested via the console, physical presence
+		 * is required unless disabled by config.  This prevents a
+		 * malicious peripheral from setitng a password.
+		 *
+		 * If this were a TPM vendor command from the AP, we would
+		 * instead check unlock restrictions based on the user login
+		 * state stored in ccd_unlock_restrict:
+		 *
+		 * 1) Unlock from the AP is unrestricted before any users
+		 * login, so enrollment policy scripts can update CCD config.
+		 *
+		 * 2) Owner accounts can unlock, but require physical presence
+		 * to prevent OS-level compromises from setting a password.
+		 *
+		 * 3) A non-owner account logging in blocks CCD config until
+		 * the next AP reboot, as implied by TPM reboot.
+		 */
+	}
+
+	/* Fail and abort if already checking physical presence */
+	if (physical_detect_busy()) {
+		physical_detect_abort();
+		return EC_ERROR_BUSY;
+	}
+
+	/* Bypass physical presence check if configured to do so */
+	if (ccd_is_cap_enabled(CCD_CAP_UNLOCK_WITHOUT_SHORT_PP))
+		need_pp = 0;
+
+	/* Bypass physical presence check entirely if battery is removed */
+	if (ccd_is_cap_enabled(CCD_CAP_REMOVE_BATTERY_BYPASSES_PP) &&
+	    !board_battery_is_present()) {
+		need_pp = 0;
+	}
+
+	if (need_pp) {
+		/* Start physical presence detect */
+		ccprintf("Starting CCD unlock...\n");
+		return physical_detect_start(0, ccd_unlock_done);
+	} else {
+		/* Unlock immediately */
+		ccd_unlock_done();
+		return EC_SUCCESS;
+	}
+}
+DECLARE_SAFE_CONSOLE_COMMAND(ccdunlock, command_ccdunlock,
+			     "[password]",
+			     "Change CCD state to Unlocked");
+
+static int command_ccdlock(int argc, char **argv)
+{
+	/* Lock always works */
+	ccprintf("CCD locked.\n");
+	ccd_set_state(CCD_STATE_LOCKED);
+	return EC_SUCCESS;
+}
+DECLARE_SAFE_CONSOLE_COMMAND(ccdlock, command_ccdlock,
+			     "",
+			     "Change CCD state to Locked");
+
+/* NOTE: Testlab command is console-only; no TPM vendor command for this */
+static int command_testlab(int argc, char **argv)
+{
+	int newflag = 0;
+
+	if (argc < 2)
+		return EC_ERROR_PARAM_COUNT;
+
+	if (!strcasecmp(argv[1], "open")) {
+		if (!ccd_get_flag(CCD_FLAG_TEST_LAB))
+			return EC_ERROR_ACCESS_DENIED;
+
+		/* Go directly to open state without wiping TPM or rebooting */
+		ccd_set_state(CCD_STATE_OPENED);
+		return EC_SUCCESS;
+	}
+
+	/* All other commands require CCD opened */
+	if (ccd_state != CCD_STATE_OPENED)
+		return EC_ERROR_ACCESS_DENIED;
+
+	if (!parse_bool(argv[1], &newflag))
+		return EC_ERROR_PARAM1;
+
+	if (newflag == ccd_get_flag(CCD_FLAG_TEST_LAB))
+		return EC_SUCCESS;  /* No change */
+
+	/* If we're still here, need to toggle test lab flag */
+	ccprintf("Requesting change of test lab flag.\n");
+	if (newflag)
+		ccprintf("NOTE: THIS WILL MAKE THIS DEVICE INSECURE!!!\n");
+	return physical_detect_start(0, ccd_testlab_toggle);
+}
+DECLARE_SAFE_CONSOLE_COMMAND(testlab, command_testlab,
+			     "<enable | disable | open>",
+			     "Toggle testlab mode or open CCD");
+
+
+#ifdef CONFIG_CASE_CLOSED_DEBUG_V1_UNSAFE
+/**
+ * Test command to forcibly reset CCD config
+ */
+static int command_ccdoops(int argc, char **argv)
+{
+	/* Completely reset CCD config and go to opened state */
+	ccprintf("Aborting physical detect...\n");
+	physical_detect_abort();
+	ccprintf("Resetting CCD config...\n");
+	ccd_reset_config(CCD_RESET_TEST_LAB);
+	ccprintf("Opening CCD...\n");
+	ccd_set_state(CCD_STATE_OPENED);
+	return EC_SUCCESS;
+}
+DECLARE_SAFE_CONSOLE_COMMAND(ccdoops, command_ccdoops,
+			     "",
+			     "Force-reset CCD config");
+#endif  /* CONFIG_CASE_CLOSED_DEBUG_V1_UNSAFE */
diff --git a/common/hooks.c b/common/hooks.c
index e406c2a637..b8725a2467 100644
--- a/common/hooks.c
+++ b/common/hooks.c
@@ -47,6 +47,9 @@ static const struct hook_ptrs hook_list[] = {
 	{__hooks_tablet_mode_change, __hooks_tablet_mode_change_end},
 	{__hooks_pwrbtn_change, __hooks_pwrbtn_change_end},
 	{__hooks_battery_soc_change, __hooks_battery_soc_change_end},
+#ifdef CONFIG_CASE_CLOSED_DEBUG
+	{__hooks_ccd_change, __hooks_ccd_change_end},
+#endif
 	{__hooks_tick, __hooks_tick_end},
 	{__hooks_second, __hooks_second_end},
 };