cr50: usb_upgrade: allow responses lager than requests

When invoking vendor command handlers in try_vendor_command(), the
buffer containing the command is passed to the handler to communicate
the command contents and to hold the command execution return data. It
was fine when invoking vendor command handlers from the TPM stack, as
the receive buffer is 4K in size and is large enough for any expected
vendor command response.

It is different in case of USB: the command is in the receive buffer
of the USB queue, and the response data could easily exceed the
command size, which would cause corruption of the USB receive queue
contents when the response data is placed into the same buffer where
the command is.

Let's introduce a local storage to pass the command and receive the
response data from the handler. 32 bytes is enough for the foreseeable
future, should a need arise for a larger buffer, testing would result
in an error (a new error type is added to indicate insufficient buffer
space for command processing).

BRANCH=none
BUG=b:35587387,b:35587053
TEST=with the rest of the patches applied verified proper processing
     of the 'Get Board ID' command for which response size exceeds the
     request size.

Change-Id: I2131496f3a99c7f3a1869905120a453d75efbdce
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/525092
Reviewed-by: Aseda Aboagye <aaboagye@chromium.org>

1 files changed, 2 insertions, 0 deletions

diff --git a/include/tpm_vendor_cmds.h b/include/tpm_vendor_cmds.h
index 4861457d36..1f9e552aaa 100644
--- a/include/tpm_vendor_cmds.h
+++ b/include/tpm_vendor_cmds.h
@@ -58,6 +58,8 @@ enum vendor_cmd_rc {
 	VENDOR_RC_BOGUS_ARGS = 1,
 	VENDOR_RC_READ_FLASH_FAIL = 2,
 	VENDOR_RC_WRITE_FLASH_FAIL = 3,
+	VENDOR_RC_REQUEST_TOO_BIG = 4,
+	VENDOR_RC_RESPONSE_TOO_BIG = 5,
 	/* Only 7 bits available; max is 127 */
 	VENDOR_RC_NO_SUCH_COMMAND = 127,
 };