Skip to content

Commit 3ac32c2

Browse files
siemen11siemen11
committed
[FiSim] Unsigned owner upgrade test
Perform an instruction skip GDB test on getting an unsigned owner configuration block accepted in ROM_EXT. Signed-off-by: Siemen Dhooghe <[email protected]>
1 parent aee87ad commit 3ac32c2

File tree

7 files changed

+699
-2
lines changed

7 files changed

+699
-2
lines changed

‎sw/device/silicon_creator/lib/ownership/test_owner.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@
3737
#define TEST_OWNER_CONFIG_VERSION 1
3838

3939
#ifndef TEST_OWNER_UPDATE_MODE
40-
#define TEST_OWNER_UPDATE_MODE kOwnershipUpdateModeOpen
40+
// #define TEST_OWNER_UPDATE_MODE kOwnershipUpdateModeOpen
41+
// #define TEST_OWNER_UPDATE_MODE kOwnershipUpdateModeNewVersion
42+
#define TEST_OWNER_UPDATE_MODE kOwnershipUpdateModeSelfVersion
4143
#endif
4244

4345
#if defined(TEST_OWNER_KEY_ALG_HYBRID_SPX_PURE) || \

‎sw/device/tests/penetrationtests/BUILD‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the Apache License, Version 2.0, see LICENSE for details.
33
# SPDX-License-Identifier: Apache-2.0
44

5-
load(":pentest.bzl", "pentest_cryptolib_fi_asym", "pentest_cryptolib_fi_gdb_asym", "pentest_cryptolib_fi_gdb_sym", "pentest_cryptolib_fi_sym", "pentest_cryptolib_sca_asym", "pentest_cryptolib_sca_sym", "pentest_fi", "pentest_fi_ibex", "pentest_fi_otbn", "pentest_sca")
5+
load(":pentest.bzl", "pentest_cryptolib_fi_asym", "pentest_cryptolib_fi_gdb_asym", "pentest_cryptolib_fi_gdb_sym", "pentest_cryptolib_fi_sym", "pentest_cryptolib_sca_asym", "pentest_cryptolib_sca_sym", "pentest_fi", "pentest_fi_ibex", "pentest_fi_otbn", "pentest_owner_upgrade_fi_gdb", "pentest_sca")
66
load("@ot_python_deps//:requirements.bzl", "requirement")
77

88
package(default_visibility = ["//visibility:public"])
@@ -473,3 +473,14 @@ pentest_fi(
473473
test_harness = "//sw/host/penetrationtests/python/fi:fi_rng_python_test",
474474
test_vectors = [],
475475
)
476+
477+
pentest_owner_upgrade_fi_gdb(
478+
name = "fi_owner_upgrade_python_gdb_test",
479+
tags = [
480+
"manual",
481+
"skip_in_ci",
482+
],
483+
test_args = "",
484+
test_harness = "//sw/host/penetrationtests/python/fi:fi_owner_upgrade_python_gdb_test",
485+
test_vectors = [],
486+
)

‎sw/device/tests/penetrationtests/firmware/testdata/BUILD‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
# Copyright lowRISC contributors (OpenTitan project).
2+
# Licensed under the Apache License, Version 2.0, see LICENSE for details.
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
package(default_visibility = ["//visibility:public"])
6+
7+
load("@//rules:signing.bzl", "offline_presigning_artifacts", "offline_signature_attach")
8+
load("//rules:const.bzl", "CONST", "hex")
9+
load("//rules:manifest.bzl", "manifest")
10+
load(
11+
"//rules/opentitan:defs.bzl",
12+
"opentitan_binary",
13+
"opentitan_test",
14+
"silicon_params",
15+
)
16+
load(
17+
"//rules:otp.bzl",
18+
"STD_OTP_OVERLAYS",
19+
"otp_hex",
20+
"otp_image",
21+
"otp_json",
22+
"otp_partition",
23+
)
24+
25+
# Building a wrongly signed BL0 binary for testing the secure boot
26+
opentitan_binary(
27+
name = "bl0_firmware",
28+
testonly = True,
29+
# This can be any other source of the pentest framework
30+
srcs = ["//sw/device/tests/penetrationtests/firmware:firmware_cryptolib_fi_sym.c"],
31+
exec_env = {
32+
"//hw/top_earlgrey:fpga_cw340_rom_ext": None,
33+
},
34+
deps = [
35+
"//sw/device/tests/penetrationtests/firmware/sca:trigger_sca",
36+
"//sw/device/tests/penetrationtests/firmware/fi:cryptolib_fi_sym",
37+
"//sw/device/tests/penetrationtests/firmware/lib:extclk_sca_fi",
38+
"//sw/device/tests/penetrationtests/firmware/lib:pentest_lib",
39+
"//sw/device/lib/base:csr",
40+
"//sw/device/lib/base:status",
41+
"//sw/device/lib/crypto/drivers:entropy",
42+
"//sw/device/lib/testing/test_framework:check",
43+
"//sw/device/lib/testing/test_framework:ottf_main",
44+
"//sw/device/lib/testing/test_framework:ujson_ottf",
45+
"//sw/device/lib/ujson",
46+
47+
# Include all JSON commands.
48+
"//sw/device/tests/penetrationtests/json:commands",
49+
],
50+
)
51+
52+
offline_presigning_artifacts(
53+
name = "non_signed_firmware",
54+
testonly = True,
55+
srcs = [":bl0_firmware"],
56+
ecdsa_key = {"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_ecdsa": "prod_key_0"},
57+
manifest = "//sw/device/silicon_owner:manifest",
58+
spx_key = {},
59+
tags = ["manual"],
60+
)
61+
62+
offline_signature_attach(
63+
name = "wrong_signed_firmware",
64+
testonly = True,
65+
srcs = [":non_signed_firmware"],
66+
# We provide a wrong signature
67+
ecdsa_signatures = ["bl0_firmware_fpga_cw340_rom_ext.ecdsa_sig"],
68+
spx_signatures = [],
69+
tags = ["manual"],
70+
)
71+
72+
# For when building specialized manifests for security testing.
73+
manifest(d = {
74+
"name": "rom_ext_rollback_manifest",
75+
"identifier": hex(CONST.OWNER),
76+
"security_version": "0",
77+
"visibility": ["//visibility:public"],
78+
})
79+
80+
otp_json(
81+
name = "otp_json_rom_ext_fi",
82+
partitions = [
83+
otp_partition(
84+
name = "CREATOR_SW_CFG",
85+
items = {
86+
"CREATOR_SW_CFG_RMA_SPIN_EN": otp_hex(CONST.HARDENED_TRUE),
87+
# Number of Ibex cycles to spin: we set this to the highest value
88+
"CREATOR_SW_CFG_RMA_SPIN_CYCLES": "0xffffffff",
89+
# Enable SPX+ signature verification.
90+
# TODO: ROM_EXT is not signed with this yet
91+
# "CREATOR_SW_CFG_SIGVERIFY_SPX_EN": otp_hex(0x0),
92+
# Turn off the ROM_EXT_IMM
93+
"CREATOR_SW_CFG_IMMUTABLE_ROM_EXT_EN": otp_hex(0x0),
94+
# We disable randomness since that messes with GDB
95+
"CREATOR_SW_CFG_RNG_EN": otp_hex(0x0),
96+
},
97+
),
98+
otp_partition(
99+
name = "SECRET2",
100+
items = {
101+
# We set reproducible bitstreams for the tests
102+
"RMA_TOKEN": "0000000000000005",
103+
"CREATOR_ROOT_KEY_SHARE0": "1111111111111111111111111111111111111111111111111111111111111111",
104+
"CREATOR_ROOT_KEY_SHARE1": "2222222222222222222222222222222222222222222222222222222222222222",
105+
},
106+
lock = True,
107+
),
108+
],
109+
visibility = ["//visibility:private"],
110+
)
111+
112+
otp_image(
113+
name = "otp_img_rom_ext_fi",
114+
src = "//hw/ip/otp_ctrl/data:otp_json_rma",
115+
overlays = STD_OTP_OVERLAYS + [
116+
":otp_json_rom_ext_fi",
117+
],
118+
)
119+
120+
otp_json(
121+
name = "otp_json_rom_rollback_fi",
122+
partitions = [
123+
otp_partition(
124+
name = "CREATOR_SW_CFG",
125+
items = {
126+
"CREATOR_SW_CFG_RMA_SPIN_EN": otp_hex(CONST.HARDENED_TRUE),
127+
# Number of Ibex cycles to spin: we set this to the highest value
128+
"CREATOR_SW_CFG_RMA_SPIN_CYCLES": "0xffffffff",
129+
# We set the version to a higher number to check rollback protection
130+
"CREATOR_SW_CFG_MIN_SEC_VER_ROM_EXT": "0x1",
131+
# Enable SPX+ signature verification.
132+
# TODO: ROM_EXT is not signed with this yet
133+
# "CREATOR_SW_CFG_SIGVERIFY_SPX_EN": otp_hex(0x0),
134+
},
135+
),
136+
otp_partition(
137+
name = "SECRET2",
138+
items = {
139+
# We set reproducible bitstreams for the tests
140+
"RMA_TOKEN": "0000000000000005",
141+
"CREATOR_ROOT_KEY_SHARE0": "1111111111111111111111111111111111111111111111111111111111111111",
142+
"CREATOR_ROOT_KEY_SHARE1": "2222222222222222222222222222222222222222222222222222222222222222",
143+
},
144+
lock = True,
145+
),
146+
],
147+
visibility = ["//visibility:private"],
148+
)
149+
150+
otp_image(
151+
name = "otp_img_rom_rollback_fi",
152+
src = "//hw/ip/otp_ctrl/data:otp_json_rma",
153+
overlays = STD_OTP_OVERLAYS + [
154+
":otp_json_rom_rollback_fi",
155+
],
156+
)
157+
158+
otp_json(
159+
name = "otp_json_rom_ext_rollback_fi",
160+
partitions = [
161+
otp_partition(
162+
name = "CREATOR_SW_CFG",
163+
items = {
164+
"CREATOR_SW_CFG_RMA_SPIN_EN": otp_hex(CONST.HARDENED_TRUE),
165+
# Number of Ibex cycles to spin: we set this to the highest value
166+
"CREATOR_SW_CFG_RMA_SPIN_CYCLES": "0xffffffff",
167+
# We set the version to a higher number to check rollback protection
168+
"CREATOR_SW_CFG_MIN_SEC_VER_BL0": "0x2",
169+
# Enable SPX+ signature verification.
170+
# TODO: ROM_EXT is not signed with this yet
171+
# "CREATOR_SW_CFG_SIGVERIFY_SPX_EN": otp_hex(0x0),
172+
},
173+
),
174+
otp_partition(
175+
name = "SECRET2",
176+
items = {
177+
# We set reproducible bitstreams for the tests
178+
"RMA_TOKEN": "0000000000000005",
179+
"CREATOR_ROOT_KEY_SHARE0": "1111111111111111111111111111111111111111111111111111111111111111",
180+
"CREATOR_ROOT_KEY_SHARE1": "2222222222222222222222222222222222222222222222222222222222222222",
181+
},
182+
lock = True,
183+
),
184+
],
185+
visibility = ["//visibility:private"],
186+
)
187+
188+
otp_image(
189+
name = "otp_img_rom_ext_rollback_fi",
190+
src = "//hw/ip/otp_ctrl/data:otp_json_rma",
191+
overlays = STD_OTP_OVERLAYS + [
192+
":otp_json_rom_ext_rollback_fi",
193+
],
194+
)
195+
196+
exports_files(["bl0_owner_upgrade.c"])

‎sw/device/tests/penetrationtests/firmware/testdata/bl0_owner_upgrade.c‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
// Copyright lowRISC contributors (OpenTitan project).
2+
// Licensed under the Apache License, Version 2.0, see LICENSE for details.
3+
// SPDX-License-Identifier: Apache-2.0
4+
5+
#include "sw/device/lib/base/bitfield.h"
6+
#include "sw/device/lib/base/status.h"
7+
#include "sw/device/lib/runtime/log.h"
8+
#include "sw/device/lib/testing/test_framework/check.h"
9+
#include "sw/device/lib/testing/test_framework/ottf_main.h"
10+
#include "sw/device/silicon_creator/lib/drivers/flash_ctrl.h"
11+
#include "sw/device/silicon_creator/lib/drivers/retention_sram.h"
12+
#include "sw/device/silicon_creator/lib/drivers/rstmgr.h"
13+
#include "sw/device/silicon_creator/lib/ownership/owner_block.h"
14+
15+
OTTF_DEFINE_TEST_CONFIG();
16+
17+
bool test_main(void) {
18+
// read the active owner block page 0 from flash
19+
owner_block_t block;
20+
CHECK(flash_ctrl_info_read(&kFlashCtrlInfoPageOwnerSlot0, 0,
21+
sizeof(block) / sizeof(uint32_t),
22+
&block) == kErrorOk);
23+
LOG_INFO("owner_page_0: %d", block.config_version);
24+
25+
// modify it (unsigned)
26+
block.config_version = 5;
27+
28+
// write the upgrade request to page 1
29+
CHECK(flash_ctrl_info_erase(&kFlashCtrlInfoPageOwnerSlot1,
30+
kFlashCtrlEraseTypePage) == kErrorOk);
31+
CHECK(flash_ctrl_info_write(&kFlashCtrlInfoPageOwnerSlot1, 0,
32+
sizeof(block) / sizeof(uint32_t),
33+
&block) == kErrorOk);
34+
LOG_INFO("owner_page_1 erased and written");
35+
while (1) {
36+
}
37+
return true;
38+
}

‎sw/device/tests/penetrationtests/pentest.bzl‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -704,3 +704,44 @@ def pentest_cryptolib_sca_asym(name, test_vectors, test_args, test_harness, tags
704704
),
705705
deps = FIRMWARE_DEPS_CRYPTOLIB_SCA_ASYM,
706706
)
707+
708+
def pentest_owner_upgrade_fi_gdb(name, test_vectors, test_args, test_harness, tags):
709+
"""A macro for defining a CryptoTest test case.
710+
711+
Args:
712+
name: the name of the test.
713+
test_vectors: the test vectors to use.
714+
test_args: additional arguments to pass to the test.
715+
test_harness: the test harness to use.
716+
tags: indicate the tags for CI.
717+
"""
718+
opentitan_test(
719+
name = name,
720+
exec_env = {
721+
"//hw/top_earlgrey:fpga_cw340_rom_ext": None,
722+
},
723+
srcs = ["//sw/device/tests/penetrationtests/firmware/testdata:bl0_owner_upgrade.c"],
724+
fpga = fpga_params(
725+
timeout = "eternal",
726+
# We set an OTP with the RMA lifecycle, ensure ROM_EXT can still boot
727+
otp = "//sw/device/tests/penetrationtests/firmware/testdata:otp_img_rom_ext_fi",
728+
changes_otp = True, # i.e. changes owner
729+
data = test_vectors,
730+
tags = tags,
731+
test_cmd = """
732+
--bootstrap={firmware} --rom_ext={rom_ext} --rom={rom}
733+
""" + test_args,
734+
test_harness = test_harness,
735+
),
736+
deps = [
737+
"//sw/device/lib/base:bitfield",
738+
"//sw/device/lib/base:status",
739+
"//sw/device/lib/runtime:log",
740+
"//sw/device/lib/testing/test_framework:check",
741+
"//sw/device/lib/testing/test_framework:ottf_main",
742+
"//sw/device/silicon_creator/lib/drivers:flash_ctrl",
743+
"//sw/device/silicon_creator/lib/drivers:retention_sram",
744+
"//sw/device/silicon_creator/lib/drivers:rstmgr",
745+
"//sw/device/silicon_creator/lib/ownership:owner_block",
746+
],
747+
)

‎sw/host/penetrationtests/python/fi/BUILD‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,25 @@ py_binary(
212212
],
213213
)
214214

215+
py_binary(
216+
name = "fi_owner_upgrade_python_gdb_test",
217+
testonly = True,
218+
srcs = ["gdb_testing/fi_owner_upgrade_python_gdb_test.py"],
219+
data = [
220+
"//sw/host/opentitantool",
221+
"//third_party/openocd:jtag_cmsis_dap_adapter_cfg",
222+
"//third_party/openocd:openocd_bin",
223+
"//util/openocd/target:lowrisc-earlgrey.cfg",
224+
"@lowrisc_rv32imcb_toolchain//:bin/riscv32-unknown-elf-gdb",
225+
],
226+
deps = [
227+
"//sw/host/penetrationtests/python/util:dis_parser",
228+
"//sw/host/penetrationtests/python/util:gdb_controller",
229+
"//sw/host/penetrationtests/python/util:targets",
230+
"@rules_python//python/runfiles",
231+
],
232+
)
233+
215234
py_library(
216235
name = "fi_ibex_functions",
217236
srcs = ["host_scripts/fi_ibex_functions.py"],

0 commit comments

Comments
 (0)