pinweaver: Separate error codes in PK generation

In tests it will be more convenient if the client can distinguish
different reasons of failing to generate the pairing secret. Especially
we want to distinguish the case where the PK can't be established
because a user has logged in, and the case that the PK has been
established already. Other than that, switch the sequence of checking
those constraints because "whether Pk generation is blocked by user
login" is a piece of information inferior to "whether Pk has already
been established".

These 2 changes don't affect production logic and don't introduce
compatibility problems because production code doesn't act differently
on different Pk generation error codes now. The main effect is that this
can save many unnecessary reboots in tests (to ensure that Pk
establishment isn't blocked by user login) after landing.

BUG=b:294473939
TEST=build ok

Change-Id: I0ef4a2f908f10dca27076c5ba46c7ec01df6fa98
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/pinweaver/+/5261342
Reviewed-by: Yi Chou <yich@google.com>
Tested-by: Howard Yang <hcyang@google.com>

pinweaver.c

diff --git a/pinweaver.c b/pinweaver.c
index 8f0e13a..55d21ca 100644
--- a/pinweaver.c
+++ b/pinweaver.c
@@ -1598,10 +1598,6 @@
 		return PW_ERR_LENGTH_INVALID;
 	auth_channel = request->auth_channel;
 
-	if (generate_ba_pk_blocked) {
-		return PW_ERR_BIO_AUTH_ACCESS_DENIED;
-	}
-
 	/* Currently we only support v0 public key format. */
 	if (request->client_pbk.version != 0) {
 		return PW_ERR_BIO_AUTH_PUBLIC_KEY_VERSION_MISMATCH;
@@ -1615,8 +1611,14 @@
 	 * if no Pk is established yet and it's not blocked.
 	 */
 	ret = pinweaver_eal_storage_get_ba_pk(auth_channel, &pk);
-	if (ret != PW_ERR_BIO_AUTH_PK_NOT_ESTABLISHED)
+	if (ret == EC_SUCCESS)
+		return PW_ERR_BIO_AUTH_PK_ALREADY_ESTABLISHED;
+	else if (ret != PW_ERR_BIO_AUTH_PK_NOT_ESTABLISHED)
+		return PW_ERR_INTERNAL_FAILURE;
+
+	if (generate_ba_pk_blocked) {
 		return PW_ERR_BIO_AUTH_ACCESS_DENIED;
+	}
 
 	/* Perform ECDH to derive the shared secret. */
 	ret = pinweaver_eal_ecdh_derive(&request->client_pbk.pt,

pinweaver_types.h

diff --git a/pinweaver_types.h b/pinweaver_types.h
index 303d6bf..7f1f72f 100644
--- a/pinweaver_types.h
+++ b/pinweaver_types.h
@@ -75,6 +75,7 @@
 	 * when logging a try_auth event like this.
 	 */
 	PW_ERR_SUCCESS_WITH_INCREMENT,
+	PW_ERR_BIO_AUTH_PK_ALREADY_ESTABLISHED,
 };
 
 /* Represents the log2(fan out) of a tree. */