[bazel] bump OT repo version

This bumps the lowrisc_opentitan bazel repo version, and subsequently
the OpenTitan provisioning firmware and bitstream dependencies.

Additionally, this adds a CRC computation to the RMA unlock token
message as the latest version of the personalization firmware now
requires the host to send a valid CRC with the RMA unlock token JSON
message.

Signed-off-by: Tim Trippel <ttrippel@google.com>

Author: timothytrippel

src/ate/ate_api.h

@@ -630,9 +630,11 @@ DLLEXPORT int DeviceIdFromJson(const dut_spi_frame_t* frame,
  *
  * @param rma_token The RMA token.
  * @param[out] result The generated JSON command.
+ * @param skip_crc Whether or not to skip attaching of the CRC.
  * @return The result of the operation.
  */
-DLLEXPORT int RmaTokenToJson(const token_t* rma_token, dut_spi_frame_t* result);
+DLLEXPORT int RmaTokenToJson(const token_t* rma_token, dut_spi_frame_t* result,
+                             bool skip_crc);
 
 /**
  * Parse JSON command to extract the RMA token from the SPI frame.

src/ate/ate_api_json_commands.cc

@@ -7,6 +7,7 @@
 #include <algorithm>
 
 #include "absl/log/log.h"
+#include "absl/strings/str_format.h"
 #include "src/ate/ate_api.h"
 #include "src/ate/proto/dut_commands.pb.h"
 
@@ -48,6 +49,51 @@ inline uint64_t ByteSwap64(uint64_t value) {
          ((value & 0x00000000000000FFULL) << 56);
 }
 
+/**
+ * Table to store the pre-computed CRC values for each possible 8-bit byte.
+ */
+static uint32_t crc32_table[256];
+
+/**
+ * Flag to ensure the table is initialized only once.
+ */
+static bool crc32_table_initialized = false;
+
+// Function to initialize the CRC32 lookup table
+void InitCrc32Table(void) {
+  if (crc32_table_initialized) {
+    // Table already initialized.
+    return;
+  }
+  constexpr uint32_t kCrc32Polynomial =
+      0xEDB88320;  // CRC-32 reversed polynomial.
+
+  for (size_t i = 0; i < 256; ++i) {
+    uint32_t c = (uint32_t)i;
+    for (size_t j = 0; j < 8; ++j) {
+      if (c & 1) {
+        c = kCrc32Polynomial ^ (c >> 1);
+      } else {
+        c = c >> 1;
+      }
+    }
+    crc32_table[i] = c;
+  }
+  crc32_table_initialized = true;
+}
+
+uint32_t CalculateCrc32(const char *data, size_t length) {
+  // Ensure the CRC32 table is initialized before calculation.
+  if (!crc32_table_initialized) {
+    InitCrc32Table();
+  }
+  uint32_t crc = 0xFFFFFFFF;
+  for (size_t i = 0; i < length; i++) {
+    crc = crc32_table[(crc ^ data[i]) & 0xFF] ^ (crc >> 8);
+  }
+  return crc ^ 0xFFFFFFFF;
+}
+
 }  // namespace
 
 DLLEXPORT int TokensToJson(const token_t *wafer_auth_secret,
@@ -138,8 +184,8 @@ DLLEXPORT int DeviceIdFromJson(const dut_spi_frame_t *frame,
   return 0;
 }
 
-DLLEXPORT int RmaTokenToJson(const token_t *rma_token,
-                             dut_spi_frame_t *result) {
+DLLEXPORT int RmaTokenToJson(const token_t *rma_token, dut_spi_frame_t *result,
+                             bool skip_crc) {
   if (result == nullptr) {
     LOG(ERROR) << "Invalid result buffer";
     return -1;
@@ -164,6 +210,11 @@ DLLEXPORT int RmaTokenToJson(const token_t *rma_token,
   google::protobuf::util::Status status =
       google::protobuf::util::MessageToJsonString(rma_hash_cmd, &command,
                                                   options);
+  if (!skip_crc) {
+    // The personalization firmware expects a CRC on this JSON payload.
+    uint32_t crc = CalculateCrc32(command.data(), command.length());
+    command += absl::StrFormat("{\"crc\": %d}", crc);
+  }
   if (!status.ok()) {
     LOG(ERROR) << "Failed to convert token hash command to JSON: "
                << status.ToString();

src/ate/ate_api_json_commands_test.cc

@@ -104,7 +104,7 @@ TEST_F(AteJsonTest, RmaToken) {
   rma_token.data[1] = 0x22;
 
   dut_spi_frame_t frame;
-  EXPECT_EQ(RmaTokenToJson(&rma_token, &frame), 0);
+  EXPECT_EQ(RmaTokenToJson(&rma_token, &frame, /*skip_crc=*/true), 0);
 
   std::string json_string =
       std::string(reinterpret_cast<char*>(frame.payload), frame.cursor);

src/ate/test_programs/ft.cc

@@ -233,7 +233,8 @@ int main(int argc, char **argv) {
     return -1;
   }
   dut_spi_frame_t rma_token_spi_frame;
-  if (RmaTokenToJson(&rma_token, &rma_token_spi_frame) != 0) {
+  if (RmaTokenToJson(&rma_token, &rma_token_spi_frame, /*skip_crc=*/false) !=
+      0) {
     LOG(ERROR) << "RmaTokenToJson failed.";
     return -1;
   }

third_party/lowrisc/ot_bitstreams/build-ot-bitstreams.sh

@@ -19,7 +19,7 @@ fi
 
 OT_REPO_TOP=$1
 
-_OT_REPO_BRANCH="Earlgrey-A2-Orchestrator-RC1"
+_OT_REPO_BRANCH="Earlgrey-A2-Orchestrator-RC2"
 _PROVISIONING_REPO_TOP=$(pwd)
 _FPGAS=("hyper310" "cw340")
 _CP_SKUS=("emulation")

third_party/lowrisc/ot_bitstreams/cp_hyper310.bit

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:744cf7e2562ac5a430cdb1f4b96d9cfb4b133a8b590f5b5981bc94b808f15157
+oid sha256:28d334cd26a2db68ba5187545b208e3a578534303dba54a7f343572288b69da0
 size 15878032

third_party/lowrisc/ot_bitstreams/cp_hyper340.bit

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:7fc14b448d75f893935cefa8b0cab5648806cf9b282792fafc8ea775304ead15
+oid sha256:cf919e400708298d4e895bc6dc1cdc12ebde1a9ac986446097135010a8400e2a
 size 35843488

third_party/lowrisc/ot_fw/orchestrator.zip

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f5420d905311b189449f00b6a14fdc787aa72a8dfd08186a22451a91f19e4aa2
-size 112425426
+oid sha256:5098ee556ecd5067cc03dd8a2da84d51caa1e460edf49bce63212040d2da6774
+size 112565360

third_party/lowrisc/repos.bzl

@@ -12,7 +12,7 @@ _BAZEL_SKYLIB_VERSION = "1.7.1"
 # When updating the lowrisc_opentitan repo, be sure to rebuild the builtstream
 # files too by following the instructions in
 # `third_party/lowrisc/README.md`.
-_OPENTITAN_VERSION = "Earlgrey-A2-Orchestrator-RC1"
+_OPENTITAN_VERSION = "Earlgrey-A2-Orchestrator-RC2"
 
 def lowrisc_repos(misc_linters = None, bazel_release = None, bazel_skylib = None, opentitan = None):
     maybe(
@@ -45,7 +45,7 @@ def lowrisc_repos(misc_linters = None, bazel_release = None, bazel_skylib = None
         http_archive_or_local,
         local = opentitan,
         name = "lowrisc_opentitan",
-        sha256 = "7ea956946e7898cd85baadcf6ebb7263fb2ac82b65b3b6555a0bc3a1fdc311f4",
+        sha256 = "f5d67e2c057ebdc5f42fab286076f8b69fba7e21d1ff105a2ddb3a61f415e11e",
         strip_prefix = "opentitan-{}".format(_OPENTITAN_VERSION),
         url = "https://github.com/lowRISC/opentitan/archive/refs/tags/{}.tar.gz".format(_OPENTITAN_VERSION),
     )