Skip to content

Commit 54dcdfd

Browse files
cfrantzcfrantz
committed
[rom_ext_e2e] More ownership transfer tests
The tests added by this change are all simple variations on the ownership transfer test added in #24419. They involve verifying the different modes and error conditions (e.g. using the wrong key). Adds the following tests: - `bad_unlock_test`; Fixes #24466 - `bad_activate_test`; Fixes #24467 - `bad_owner_block_test`; Fixes #24468 - `bad_app_key_test`; Fixes #24469 - `transfer_endorsed_test`; Fixes #24470 - `bad_endorsee_test`; Fixes #24471 - `locked_update_test`; Fixes #24472 - `bad_locked_update_test` & `bad_locked_update_no_exec_test`; Fixes #24473 Signed-off-by: Chris Frantz <[email protected]> (cherry picked from commit 4d520bd)
1 parent 9ca4030 commit 54dcdfd

File tree

8 files changed

+411
-43
lines changed

8 files changed

+411
-43
lines changed

‎sw/device/silicon_creator/lib/ownership/keys/dummy/BUILD‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,11 @@ filegroup(
99
srcs = ["owner_ecdsa_p256.der"],
1010
)
1111

12+
filegroup(
13+
name = "owner_key_pub",
14+
srcs = ["owner_ecdsa_p256.pub.der"],
15+
)
16+
1217
filegroup(
1318
name = "activate_key",
1419
srcs = ["activate_ecdsa_p256.der"],

‎sw/device/silicon_creator/lib/ownership/keys/fake/BUILD‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,11 @@ filegroup(
4141
srcs = ["owner_ecdsa_p256.der"],
4242
)
4343

44+
filegroup(
45+
name = "owner_key_pub",
46+
srcs = ["owner_ecdsa_p256.pub.der"],
47+
)
48+
4449
filegroup(
4550
name = "activate_key",
4651
srcs = ["activate_ecdsa_p256.der"],
@@ -50,3 +55,13 @@ filegroup(
5055
name = "unlock_key",
5156
srcs = ["unlock_ecdsa_p256.der"],
5257
)
58+
59+
filegroup(
60+
name = "app_prod",
61+
srcs = ["app_prod_key_rsa_3072_exp_f4.der"],
62+
)
63+
64+
filegroup(
65+
name = "app_prod_pub",
66+
srcs = ["app_prod_key_rsa_3072_exp_f4.pub.der"],
67+
)

‎sw/device/silicon_creator/rom_ext/e2e/ownership/BUILD‎

Lines changed: 215 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -7,30 +7,27 @@ load(
77
"fpga_params",
88
"opentitan_test",
99
)
10+
load(
11+
"//sw/device/silicon_creator/rom_ext/e2e/ownership:defs.bzl",
12+
"ownership_transfer_test",
13+
)
1014

1115
package(default_visibility = ["//visibility:public"])
1216

13-
opentitan_test(
14-
name = "ownership_transfer_test",
15-
srcs = ["//sw/device/silicon_creator/rom_ext/e2e/verified_boot:boot_test"],
16-
exec_env = {
17-
"//hw/top_earlgrey:fpga_hyper310_rom_ext": None,
18-
},
17+
# TODO(#24462): The tests in this file are marked `changes_otp = True`,
18+
# but they don't change OTP. They modify the ownership INFO pages,
19+
# so we need to clear the bitstream after the test, which is what the
20+
# `changes_otp` parameter actually does.
21+
22+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_transfer_any_test
23+
ownership_transfer_test(
24+
name = "transfer_any_test",
1925
fpga = fpga_params(
20-
# This test doesn't change OTP, but it modifies the ownership INFO
21-
# pages, so we need to clear the bitstream after the test, which is
22-
# what the `changes_otp` parameter actually does.
2326
changes_otp = True,
24-
data = [
25-
"//sw/device/silicon_creator/lib/ownership/keys/dummy:activate_key",
26-
"//sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod_pub",
27-
"//sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key",
28-
"//sw/device/silicon_creator/lib/ownership/keys/dummy:unlock_key",
29-
"//sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key",
30-
],
3127
test_cmd = """
3228
--clear-bitstream
3329
--bootstrap={firmware}
30+
--unlock-mode=Any
3431
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
3532
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key)
3633
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:unlock_key)
@@ -49,3 +46,205 @@ opentitan_test(
4946
"//sw/device/silicon_creator/lib/drivers:retention_sram",
5047
],
5148
)
49+
50+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_bad_unlock_test
51+
ownership_transfer_test(
52+
name = "bad_unlock_test",
53+
fpga = fpga_params(
54+
changes_otp = True,
55+
test_cmd = """
56+
--clear-bitstream
57+
--bootstrap={firmware}
58+
--unlock-mode=Any
59+
# NOTE: We use the wrong unlock key to test that the unlock operation fails.
60+
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:activate_key)
61+
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key)
62+
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:unlock_key)
63+
--next-activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:activate_key)
64+
--next-application-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod_pub)
65+
--expected-error=OwnershipInvalidSignature
66+
""",
67+
test_harness = "//sw/host/tests/ownership:transfer_test",
68+
),
69+
)
70+
71+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_bad_activate_test
72+
ownership_transfer_test(
73+
name = "bad_activate_test",
74+
fpga = fpga_params(
75+
changes_otp = True,
76+
test_cmd = """
77+
--clear-bitstream
78+
--bootstrap={firmware}
79+
--unlock-mode=Any
80+
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
81+
# NOTE: We use the wrong activate key to test that the activate operation fails.
82+
--activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
83+
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key)
84+
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:unlock_key)
85+
--next-activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:activate_key)
86+
--next-application-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod_pub)
87+
--expected-error=OwnershipInvalidSignature
88+
""",
89+
test_harness = "//sw/host/tests/ownership:transfer_test",
90+
),
91+
)
92+
93+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_bad_owner_block_test
94+
ownership_transfer_test(
95+
name = "bad_owner_block_test",
96+
fpga = fpga_params(
97+
changes_otp = True,
98+
test_cmd = """
99+
--clear-bitstream
100+
--bootstrap={firmware}
101+
--unlock-mode=Any
102+
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
103+
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key)
104+
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:unlock_key)
105+
--next-activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:activate_key)
106+
--next-application-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod_pub)
107+
--corrupt-owner-block-signature=true
108+
--dual-owner-boot-check=false
109+
--expected-error=OwnershipInvalidInfoPage
110+
""",
111+
test_harness = "//sw/host/tests/ownership:transfer_test",
112+
),
113+
)
114+
115+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_bad_app_key_test
116+
ownership_transfer_test(
117+
name = "bad_app_key_test",
118+
fpga = fpga_params(
119+
changes_otp = True,
120+
test_cmd = """
121+
--clear-bitstream
122+
--bootstrap={firmware}
123+
--unlock-mode=Any
124+
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
125+
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key)
126+
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:unlock_key)
127+
--next-activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:activate_key)
128+
# NOTE: We use the wrong app key (fake instead of dummy) to test that we cannot boot
129+
# the test program after completing the transfer.
130+
--next-application-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_pub)
131+
--expected-error=OwnershipKeyNotFound
132+
""",
133+
test_harness = "//sw/host/tests/ownership:transfer_test",
134+
),
135+
)
136+
137+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_transfer_endorsed_test
138+
ownership_transfer_test(
139+
name = "transfer_endorsed_test",
140+
fpga = fpga_params(
141+
changes_otp = True,
142+
test_cmd = """
143+
--clear-bitstream
144+
--bootstrap={firmware}
145+
--unlock-mode=Endorsed
146+
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
147+
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key)
148+
--next-owner-key-pub=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key_pub)
149+
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:unlock_key)
150+
--next-activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:activate_key)
151+
--next-application-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod_pub)
152+
""",
153+
test_harness = "//sw/host/tests/ownership:transfer_test",
154+
),
155+
)
156+
157+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_bad_endorsee_test
158+
ownership_transfer_test(
159+
name = "bad_endorsee_test",
160+
fpga = fpga_params(
161+
changes_otp = True,
162+
test_cmd = """
163+
--clear-bitstream
164+
--bootstrap={firmware}
165+
--unlock-mode=Endorsed
166+
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
167+
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key)
168+
# NOTE: We use the wrong next-owner-public-key to test that endorsee is rejected and the activate operation fails.
169+
--next-owner-key-pub=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:owner_key_pub)
170+
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:unlock_key)
171+
--next-activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:activate_key)
172+
--next-application-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod_pub)
173+
--dual-owner-boot-check=false
174+
--expected-error=OwnershipInvalidInfoPage
175+
""",
176+
test_harness = "//sw/host/tests/ownership:transfer_test",
177+
),
178+
)
179+
180+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_locked_update_test
181+
ownership_transfer_test(
182+
name = "locked_update_test",
183+
fpga = fpga_params(
184+
changes_otp = True,
185+
test_cmd = """
186+
--clear-bitstream
187+
--bootstrap={firmware}
188+
--unlock-mode=Update
189+
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
190+
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:owner_key)
191+
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
192+
--next-activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:activate_key)
193+
# NOTE: We rotate the `fake` test owner's application key to the dummy key to test that
194+
# we can execute code with the new key.
195+
--next-application-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod_pub)
196+
""",
197+
test_harness = "//sw/host/tests/ownership:transfer_test",
198+
),
199+
)
200+
201+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_bad_locked_update_test
202+
# Part 1: Ensure a LockedUpdate with a new owner key is rejected.
203+
ownership_transfer_test(
204+
name = "bad_locked_update_test",
205+
fpga = fpga_params(
206+
changes_otp = True,
207+
test_cmd = """
208+
--clear-bitstream
209+
--bootstrap={firmware}
210+
--unlock-mode=Update
211+
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
212+
# NOTE: We use the wrong owner key to test that the activate operation fails.
213+
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key)
214+
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
215+
--next-activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:activate_key)
216+
--next-application-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_pub)
217+
--dual-owner-boot-check=false
218+
--expected-error=OwnershipInvalidInfoPage
219+
""",
220+
test_harness = "//sw/host/tests/ownership:transfer_test",
221+
),
222+
rsa_key = {
223+
"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod": "app_prod",
224+
},
225+
)
226+
227+
# rom_ext_e2e_testplan.hjson%rom_ext_e2e_bad_locked_update_test
228+
# Part 2: Ensure a LockedUpdate denies execution to anything signed with new app keys.
229+
ownership_transfer_test(
230+
name = "bad_locked_update_no_exec_test",
231+
fpga = fpga_params(
232+
changes_otp = True,
233+
test_cmd = """
234+
--clear-bitstream
235+
--bootstrap={firmware}
236+
--unlock-mode=Update
237+
--unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
238+
--next-unlock-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key)
239+
--next-activate-key=$(location //sw/device/silicon_creator/lib/ownership/keys/fake:activate_key)
240+
241+
# NOTE: We use the wrong owner key and the dummy app key (which the ownership_transfer_test rule
242+
# uses for signing) to check that owner code execution is denied in the intermediate
243+
# dual-owner state.
244+
--next-owner-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key)
245+
--next-application-key=$(location //sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod_pub)
246+
--expected-error=OwnershipKeyNotFound
247+
""",
248+
test_harness = "//sw/host/tests/ownership:transfer_test",
249+
),
250+
)

‎sw/device/silicon_creator/rom_ext/e2e/ownership/defs.bzl‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Copyright lowRISC contributors (OpenTitan project).
2+
# Licensed under the Apache License, Version 2.0, see LICENSE for details.
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
load(
6+
"//rules/opentitan:defs.bzl",
7+
"opentitan_test",
8+
)
9+
10+
def ownership_transfer_test(
11+
name,
12+
srcs = ["//sw/device/silicon_creator/rom_ext/e2e/verified_boot:boot_test"],
13+
exec_env = {
14+
"//hw/top_earlgrey:fpga_hyper310_rom_ext": None,
15+
},
16+
rsa_key = {
17+
"//sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod": "app_prod",
18+
},
19+
data = [
20+
"//sw/device/silicon_creator/lib/ownership/keys/dummy:activate_key",
21+
"//sw/device/silicon_creator/lib/ownership/keys/dummy:app_prod_pub",
22+
"//sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key",
23+
"//sw/device/silicon_creator/lib/ownership/keys/dummy:owner_key_pub",
24+
"//sw/device/silicon_creator/lib/ownership/keys/dummy:unlock_key",
25+
"//sw/device/silicon_creator/lib/ownership/keys/fake:unlock_key",
26+
"//sw/device/silicon_creator/lib/ownership/keys/fake:activate_key",
27+
"//sw/device/silicon_creator/lib/ownership/keys/fake:owner_key",
28+
"//sw/device/silicon_creator/lib/ownership/keys/fake:owner_key_pub",
29+
"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_pub",
30+
],
31+
deps = [
32+
"//sw/device/lib/base:status",
33+
"//sw/device/lib/testing/test_framework:ottf_main",
34+
"//sw/device/silicon_creator/lib:boot_log",
35+
"//sw/device/silicon_creator/lib/drivers:retention_sram",
36+
],
37+
**kwargs):
38+
opentitan_test(
39+
name = name,
40+
srcs = srcs,
41+
exec_env = exec_env,
42+
rsa_key = rsa_key,
43+
data = data,
44+
deps = deps,
45+
**kwargs
46+
)

‎sw/host/opentitanlib/src/chip/rom_error.rs‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,28 @@
33
// SPDX-License-Identifier: Apache-2.0
44

55
use crate::with_unknown;
6+
use std::error::Error;
67

78
include!(env!("rom_error_enum"));
9+
10+
impl Error for RomError {}
11+
12+
impl From<RomError> for Result<(), RomError> {
13+
fn from(error: RomError) -> Self {
14+
if error == RomError::Ok {
15+
Ok(())
16+
} else {
17+
Err(error)
18+
}
19+
}
20+
}
21+
22+
impl From<RomError> for Result<(), anyhow::Error> {
23+
fn from(error: RomError) -> Self {
24+
if error == RomError::Ok {
25+
Ok(())
26+
} else {
27+
Err(error.into())
28+
}
29+
}
30+
}

‎sw/host/tests/ownership/BUILD‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,6 @@ rust_binary(
2929
"@crate_index//:clap",
3030
"@crate_index//:humantime",
3131
"@crate_index//:log",
32+
"@crate_index//:regex",
3233
],
3334
)

0 commit comments

Comments
 (0)