common/vboot: Add rwsig info command

The rwsig info command provides additional details on the verified boot
key used to sign the RW firmware. The information about the key can be
used by factory tests to validate that the factory is flashing firmware
that is signed by the expected key.

In addition, we refactor the "rwsig"-related commands into a generic
"rwsig" command that takes additional subcommands. This allows adding an
"rwsig dump" command that allows displaying individual fields, which is
useful in scripts and tests.

"rwsigstatus" becomes "rwsig status"
"rwsigaction" becomes "rwsig action"

The old commands are preserved for backward compatibility.

BRANCH=none
BUG=b:144958737
TEST=(kohaku) $ ectool --name=cros_fp rwsig info
TEST=(kohaku) $ ectool --name=cros_fp rwsig dump key_id
TEST=(kohaku) $ ectool --name=cros_fp reboot_ec; sleep 0.5;
	        ectool --name=cros_fp rwsig action abort; sleep 2;
		ectool --name=cros_fp version | grep "Firmware copy"
		=> Firmware copy: RO
TEST=On dragonclaw v0.2 console: rwsiginfo

Change-Id: Ib0ee4be33e6636ff702eeaef941cc3abed0594cb
Signed-off-by: Tom Hughes <tomhughes@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1999607
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-by: Denis Brockus <dbrockus@chromium.org>

2 files changed, 50 insertions, 0 deletions

diff --git a/include/ec_commands.h b/include/ec_commands.h
index d172d8cf7e..b9b8d95847 100644
--- a/include/ec_commands.h
+++ b/include/ec_commands.h
@@ -1785,6 +1785,48 @@ struct ec_response_rand_num {
 
 BUILD_ASSERT(sizeof(struct ec_response_rand_num) == 0);
 
+/**
+ * Get information about the key used to sign the RW firmware.
+ * For more details on the fields, see "struct vb21_packed_key".
+ */
+#define EC_CMD_RWSIG_INFO 0x001B
+#define EC_VER_RWSIG_INFO 0
+
+#define VBOOT2_KEY_ID_BYTES 20
+
+#ifdef CHROMIUM_EC
+/* Don't force external projects to depend on the vboot headers. */
+#include "vb21_struct.h"
+BUILD_ASSERT(sizeof(struct vb2_id) == VBOOT2_KEY_ID_BYTES);
+#endif
+
+struct ec_response_rwsig_info {
+	/**
+	 * Signature algorithm used by the key
+	 * (enum vb2_signature_algorithm).
+	 */
+	uint16_t sig_alg;
+
+	/**
+	 * Hash digest algorithm used with the key
+	 * (enum vb2_hash_algorithm).
+	 */
+	uint16_t hash_alg;
+
+	/** Key version. */
+	uint32_t key_version;
+
+	/** Key ID (struct vb2_id). */
+	uint8_t key_id[VBOOT2_KEY_ID_BYTES];
+
+	uint8_t key_is_valid;
+
+	/** Alignment padding. */
+	uint8_t reserved[3];
+} __ec_align4;
+
+BUILD_ASSERT(sizeof(struct ec_response_rwsig_info) == 32);
+
 /*****************************************************************************/
 /* PWM commands */
 
diff --git a/include/vboot.h b/include/vboot.h
index d757d0a3e7..776cc16441 100644
--- a/include/vboot.h
+++ b/include/vboot.h
@@ -25,6 +25,14 @@ int vb21_is_packed_key_valid(const struct vb21_packed_key *key);
 int vb21_is_signature_valid(const struct vb21_signature *sig,
 			    const struct vb21_packed_key *key);
 
+
+/**
+ * Returns the public key in RO that was used to sign RW.
+ *
+ * @return pointer to key, never NULL
+ */
+const struct vb21_packed_key *vb21_get_packed_key(void);
+
 /**
  * Check data region is filled with ones
  *