Skip to content

Commit ef1fa80

Browse files
jwnrtjwnrt
committed
[bazel] Move key consts and utils to opentitan rules
Signed-off-by: James Wainwright <[email protected]> (cherry picked from commit fe148bb)
1 parent 49f4b01 commit ef1fa80

File tree

24 files changed

+171
-308
lines changed

24 files changed

+171
-308
lines changed

‎hw/top_earlgrey/dv/env/chip_env_cfg.sv‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -459,7 +459,7 @@ class chip_env_cfg #(type RAL_T = chip_ral_pkg::chip_reg_block) extends cip_base
459459
// A flash image could be signed, and if it is, Bazel will attach a
460460
// suffix to the image name.
461461
if ("signed" inside {sw_image_flags[i]}) begin
462-
// Options match DEFAULT_SIGNING_KEYS in `rules/opentitan.bzl`.
462+
// Options match DEFAULT_SIGNING_KEYS in `rules/opentitan/keyutils.bzl`.
463463
if ("fake_ecdsa_dev_key_0" inside {sw_image_flags[i]}) begin
464464
sw_images[i] = $sformatf("%0s.fake_ecdsa_dev_key_0.signed", sw_images[i]);
465465
end else if ("fake_ecdsa_prod_key_0" inside {sw_image_flags[i]}) begin

‎rules/opentitan.bzl‎

Lines changed: 1 addition & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ load("@crt//rules:transition.bzl", "platform_target")
1717
load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
1818
load("@bazel_skylib//lib:structs.bzl", "structs")
1919
load("//rules/opentitan:toolchain.bzl", "LOCALTOOLS_TOOLCHAIN")
20+
load("//rules/opentitan:keyutils.bzl", "ECDSA_ONLY_KEY_STRUCTS")
2021

2122
"""Rules to build OpenTitan for the RISC-V target"""
2223

@@ -42,126 +43,9 @@ PER_DEVICE_DEPS = {
4243
"fpga_cw340": ["@//sw/device/lib/arch:fpga_cw340"],
4344
}
4445

45-
def create_key_(name, label, hw_lc_states):
46-
return struct(
47-
name = name,
48-
label = label,
49-
hw_lc_states = hw_lc_states,
50-
)
51-
52-
def create_test_key(name, label):
53-
return create_key_(name, label, [
54-
CONST.LCV.TEST_UNLOCKED0,
55-
CONST.LCV.TEST_UNLOCKED1,
56-
CONST.LCV.TEST_UNLOCKED2,
57-
CONST.LCV.TEST_UNLOCKED3,
58-
CONST.LCV.TEST_UNLOCKED4,
59-
CONST.LCV.TEST_UNLOCKED5,
60-
CONST.LCV.TEST_UNLOCKED6,
61-
CONST.LCV.TEST_UNLOCKED7,
62-
CONST.LCV.RMA,
63-
])
64-
65-
def create_dev_key(name, label):
66-
return create_key_(name, label, [
67-
CONST.LCV.TEST_UNLOCKED0,
68-
CONST.LCV.TEST_UNLOCKED1,
69-
CONST.LCV.TEST_UNLOCKED2,
70-
CONST.LCV.TEST_UNLOCKED3,
71-
CONST.LCV.TEST_UNLOCKED4,
72-
CONST.LCV.TEST_UNLOCKED5,
73-
CONST.LCV.TEST_UNLOCKED6,
74-
CONST.LCV.TEST_UNLOCKED7,
75-
CONST.LCV.RMA,
76-
CONST.LCV.DEV,
77-
])
78-
79-
def create_prod_key(name, label):
80-
return create_key_(name, label, [
81-
CONST.LCV.TEST_UNLOCKED0,
82-
CONST.LCV.TEST_UNLOCKED1,
83-
CONST.LCV.TEST_UNLOCKED2,
84-
CONST.LCV.TEST_UNLOCKED3,
85-
CONST.LCV.TEST_UNLOCKED4,
86-
CONST.LCV.TEST_UNLOCKED5,
87-
CONST.LCV.TEST_UNLOCKED6,
88-
CONST.LCV.TEST_UNLOCKED7,
89-
CONST.LCV.DEV,
90-
CONST.LCV.PROD,
91-
CONST.LCV.PROD_END,
92-
CONST.LCV.RMA,
93-
])
94-
95-
def create_key_struct(ecdsa_key, rsa_key, spx_key):
96-
return struct(
97-
ecdsa = ecdsa_key,
98-
rsa = rsa_key,
99-
spx = spx_key,
100-
)
101-
102-
# Keys available in the repo
103-
SILICON_CREATOR_KEYS = struct(
104-
FAKE = struct(
105-
ECDSA = struct(
106-
TEST = [
107-
create_test_key("fake_ecdsa_test_key_0", "@//sw/device/silicon_creator/rom/keys/fake/ecdsa:test_key_0_ecdsa_p256"),
108-
],
109-
DEV = [
110-
create_dev_key("fake_ecdsa_dev_key_0", "@//sw/device/silicon_creator/rom/keys/fake/ecdsa:dev_key_0_ecdsa_p256"),
111-
],
112-
PROD = [
113-
create_prod_key("fake_ecdsa_prod_key_0", "@//sw/device/silicon_creator/rom/keys/fake/ecdsa:prod_key_0_ecdsa_p256"),
114-
],
115-
),
116-
SPX = struct(
117-
TEST = [
118-
create_test_key("fake_spx_test_key_0", "@//sw/device/silicon_creator/rom/keys/fake/spx:test_key_0_spx"),
119-
],
120-
DEV = [
121-
create_dev_key("fake_spx_dev_key_0", "@//sw/device/silicon_creator/rom/keys/fake/spx:dev_key_0_spx"),
122-
],
123-
PROD = [
124-
create_prod_key("fake_spx_prod_key_0", "@//sw/device/silicon_creator/rom/keys/fake/spx:prod_key_0_spx"),
125-
],
126-
),
127-
),
128-
# We can't expose real private keys publicly.
129-
REAL = None,
130-
UNAUTHORIZED = struct(
131-
SPX = [
132-
create_key_("spx_unauthorized_0", "@//sw/device/silicon_creator/rom/keys/unauthorized/spx:unauthorized_0_spx", []),
133-
],
134-
),
135-
)
136-
13746
def flatten(l):
13847
return [item for ll in l for item in ll]
13948

140-
def key_allowed_in_lc_state(key, hw_lc_state_val):
141-
all_hw_lc_state_vals = structs.to_dict(CONST.LCV).values()
142-
if not hw_lc_state_val in all_hw_lc_state_vals:
143-
fail("Wrong life cycle state value: '{}', must be one of {}. Did you pass a string instead of the integer value?".format(hw_lc_state_val, all_hw_lc_state_vals))
144-
return hw_lc_state_val in key.hw_lc_states
145-
146-
def filter_key_structs_for_lc_state(key_structs, hw_lc_state):
147-
return [k for k in key_structs if (
148-
(not k.rsa or key_allowed_in_lc_state(k.rsa, hw_lc_state)) and
149-
(not k.ecdsa or key_allowed_in_lc_state(k.ecdsa, hw_lc_state)) and
150-
(not k.spx or key_allowed_in_lc_state(k.spx, hw_lc_state))
151-
)]
152-
153-
ECDSA_ONLY_KEY_STRUCTS = [
154-
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.TEST[0], None, None),
155-
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.DEV[0], None, None),
156-
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.PROD[0], None, None),
157-
]
158-
159-
ECDSA_SPX_KEY_STRUCTS = [
160-
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.TEST[0], None, SILICON_CREATOR_KEYS.FAKE.SPX.TEST[0]),
161-
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.DEV[0], None, SILICON_CREATOR_KEYS.FAKE.SPX.DEV[0]),
162-
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.PROD[0], None, SILICON_CREATOR_KEYS.FAKE.SPX.PROD[0]),
163-
]
164-
16549
def _obj_transform_impl(ctx):
16650
cc_toolchain = find_cc_toolchain(ctx)
16751
outputs = []

‎rules/opentitan/keyutils.bzl‎

Lines changed: 119 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@
22
# Licensed under the Apache License, Version 2.0, see LICENSE for details.
33
# SPDX-License-Identifier: Apache-2.0
44

5-
load("//rules:opentitan.bzl", "key_allowed_in_lc_state")
65
load("//rules:signing.bzl", "KeyInfo")
6+
load("//rules:const.bzl", "CONST")
7+
load("@bazel_skylib//lib:structs.bzl", "structs")
78

89
def _build_key_info_handler(id):
910
"""Return a handler that creates a KeyInfo provider.
@@ -157,3 +158,120 @@ def spx_key_by_name(key_structs, nickname):
157158
return {
158159
keys[0].spx.label: keys[0].spx.name,
159160
}
161+
162+
def key_allowed_in_lc_state(key, hw_lc_state_val):
163+
all_hw_lc_state_vals = structs.to_dict(CONST.LCV).values()
164+
if not hw_lc_state_val in all_hw_lc_state_vals:
165+
fail("Wrong life cycle state value: '{}', must be one of {}. Did you pass a string instead of the integer value?".format(hw_lc_state_val, all_hw_lc_state_vals))
166+
return hw_lc_state_val in key.hw_lc_states
167+
168+
def filter_key_structs_for_lc_state(key_structs, hw_lc_state):
169+
return [k for k in key_structs if (
170+
(not k.rsa or key_allowed_in_lc_state(k.rsa, hw_lc_state)) and
171+
(not k.ecdsa or key_allowed_in_lc_state(k.ecdsa, hw_lc_state)) and
172+
(not k.spx or key_allowed_in_lc_state(k.spx, hw_lc_state))
173+
)]
174+
175+
def create_key_(name, label, hw_lc_states):
176+
return struct(
177+
name = name,
178+
label = label,
179+
hw_lc_states = hw_lc_states,
180+
)
181+
182+
def create_test_key(name, label):
183+
return create_key_(name, label, [
184+
CONST.LCV.TEST_UNLOCKED0,
185+
CONST.LCV.TEST_UNLOCKED1,
186+
CONST.LCV.TEST_UNLOCKED2,
187+
CONST.LCV.TEST_UNLOCKED3,
188+
CONST.LCV.TEST_UNLOCKED4,
189+
CONST.LCV.TEST_UNLOCKED5,
190+
CONST.LCV.TEST_UNLOCKED6,
191+
CONST.LCV.TEST_UNLOCKED7,
192+
CONST.LCV.RMA,
193+
])
194+
195+
def create_dev_key(name, label):
196+
return create_key_(name, label, [
197+
CONST.LCV.TEST_UNLOCKED0,
198+
CONST.LCV.TEST_UNLOCKED1,
199+
CONST.LCV.TEST_UNLOCKED2,
200+
CONST.LCV.TEST_UNLOCKED3,
201+
CONST.LCV.TEST_UNLOCKED4,
202+
CONST.LCV.TEST_UNLOCKED5,
203+
CONST.LCV.TEST_UNLOCKED6,
204+
CONST.LCV.TEST_UNLOCKED7,
205+
CONST.LCV.RMA,
206+
CONST.LCV.DEV,
207+
])
208+
209+
def create_prod_key(name, label):
210+
return create_key_(name, label, [
211+
CONST.LCV.TEST_UNLOCKED0,
212+
CONST.LCV.TEST_UNLOCKED1,
213+
CONST.LCV.TEST_UNLOCKED2,
214+
CONST.LCV.TEST_UNLOCKED3,
215+
CONST.LCV.TEST_UNLOCKED4,
216+
CONST.LCV.TEST_UNLOCKED5,
217+
CONST.LCV.TEST_UNLOCKED6,
218+
CONST.LCV.TEST_UNLOCKED7,
219+
CONST.LCV.DEV,
220+
CONST.LCV.PROD,
221+
CONST.LCV.PROD_END,
222+
CONST.LCV.RMA,
223+
])
224+
225+
def create_key_struct(ecdsa_key, rsa_key, spx_key):
226+
return struct(
227+
ecdsa = ecdsa_key,
228+
rsa = rsa_key,
229+
spx = spx_key,
230+
)
231+
232+
# Keys available in the repo
233+
SILICON_CREATOR_KEYS = struct(
234+
FAKE = struct(
235+
ECDSA = struct(
236+
TEST = [
237+
create_test_key("fake_ecdsa_test_key_0", "@//sw/device/silicon_creator/rom/keys/fake/ecdsa:test_key_0_ecdsa_p256"),
238+
],
239+
DEV = [
240+
create_dev_key("fake_ecdsa_dev_key_0", "@//sw/device/silicon_creator/rom/keys/fake/ecdsa:dev_key_0_ecdsa_p256"),
241+
],
242+
PROD = [
243+
create_prod_key("fake_ecdsa_prod_key_0", "@//sw/device/silicon_creator/rom/keys/fake/ecdsa:prod_key_0_ecdsa_p256"),
244+
],
245+
),
246+
SPX = struct(
247+
TEST = [
248+
create_test_key("fake_spx_test_key_0", "@//sw/device/silicon_creator/rom/keys/fake/spx:test_key_0_spx"),
249+
],
250+
DEV = [
251+
create_dev_key("fake_spx_dev_key_0", "@//sw/device/silicon_creator/rom/keys/fake/spx:dev_key_0_spx"),
252+
],
253+
PROD = [
254+
create_prod_key("fake_spx_prod_key_0", "@//sw/device/silicon_creator/rom/keys/fake/spx:prod_key_0_spx"),
255+
],
256+
),
257+
),
258+
# We can't expose real private keys publicly.
259+
REAL = None,
260+
UNAUTHORIZED = struct(
261+
SPX = [
262+
create_key_("spx_unauthorized_0", "@//sw/device/silicon_creator/rom/keys/unauthorized/spx:unauthorized_0_spx", []),
263+
],
264+
),
265+
)
266+
267+
ECDSA_ONLY_KEY_STRUCTS = [
268+
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.TEST[0], None, None),
269+
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.DEV[0], None, None),
270+
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.PROD[0], None, None),
271+
]
272+
273+
ECDSA_SPX_KEY_STRUCTS = [
274+
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.TEST[0], None, SILICON_CREATOR_KEYS.FAKE.SPX.TEST[0]),
275+
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.DEV[0], None, SILICON_CREATOR_KEYS.FAKE.SPX.DEV[0]),
276+
create_key_struct(SILICON_CREATOR_KEYS.FAKE.ECDSA.PROD[0], None, SILICON_CREATOR_KEYS.FAKE.SPX.PROD[0]),
277+
]

‎rules/opentitan_test.bzl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44

55
load(
66
"@//rules:opentitan.bzl",
7-
"ECDSA_ONLY_KEY_STRUCTS",
87
"opentitan_flash_binary",
98
"opentitan_rom_binary",
109
)
10+
load("//rules/opentitan:keyutils.bzl", "ECDSA_ONLY_KEY_STRUCTS")
1111
load("@bazel_skylib//lib:shell.bzl", "shell")
1212
load("@bazel_skylib//lib:collections.bzl", "collections")
1313

‎sw/device/silicon_creator/manuf/tests/BUILD‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,7 @@
44

55
load("//rules:const.bzl", "CONST", "get_lc_items")
66
load("//rules:lc.bzl", "lc_raw_unlock_token")
7-
load(
8-
"//rules:opentitan.bzl",
9-
"ECDSA_SPX_KEY_STRUCTS",
10-
)
7+
load("//rules/opentitan:keyutils.bzl", "ECDSA_SPX_KEY_STRUCTS")
118
load(
129
"//rules:otp.bzl",
1310
"OTP_SIGVERIFY_FAKE_KEYS",

‎sw/device/silicon_creator/rom/e2e/BUILD‎

Lines changed: 5 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,36 +2,23 @@
22
# Licensed under the Apache License, Version 2.0, see LICENSE for details.
33
# SPDX-License-Identifier: Apache-2.0
44

5-
load(
6-
"@bazel_skylib//lib:dicts.bzl",
7-
"dicts",
8-
)
9-
load(
10-
"//rules:const.bzl",
11-
"CONST",
12-
"hex_digits",
13-
)
5+
load("@bazel_skylib//lib:dicts.bzl", "dicts")
6+
load("//rules:const.bzl", "CONST", "hex_digits")
147
load(
158
"//rules:opentitan.bzl",
16-
"ECDSA_ONLY_KEY_STRUCTS",
179
"bin_to_vmem",
1810
"scramble_flash_vmem",
1911
)
12+
load("//rules/opentitan:keyutils.bzl", "ECDSA_ONLY_KEY_STRUCTS")
2013
load(
2114
"//rules:otp.bzl",
2215
"OTP_SIGVERIFY_FAKE_KEYS",
2316
"otp_image",
2417
"otp_json",
2518
"otp_partition",
2619
)
27-
load(
28-
"//rules:rom_e2e.bzl",
29-
"maybe_skip_in_ci",
30-
)
31-
load(
32-
"//rules:splice.bzl",
33-
"bitstream_splice",
34-
)
20+
load("//rules:rom_e2e.bzl", "maybe_skip_in_ci")
21+
load("//rules:splice.bzl", "bitstream_splice")
3522
load(
3623
"//sw/device/silicon_creator/rom/e2e:defs.bzl",
3724
"MSG_PASS",

‎sw/device/silicon_creator/rom/e2e/boot_data_recovery/BUILD‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,20 +10,14 @@ load(
1010
"fpga_params",
1111
"opentitan_test",
1212
)
13-
load(
14-
"//rules:opentitan.bzl",
15-
"ECDSA_ONLY_KEY_STRUCTS",
16-
)
13+
load("//rules/opentitan:keyutils.bzl", "ECDSA_ONLY_KEY_STRUCTS")
1714
load(
1815
"//rules:const.bzl",
1916
"CONST",
2017
"hex",
2118
"hex_digits",
2219
)
23-
load(
24-
"//rules:manifest.bzl",
25-
"manifest",
26-
)
20+
load("//rules:manifest.bzl", "manifest")
2721
load(
2822
"//rules:otp.bzl",
2923
"STD_OTP_OVERLAYS",
@@ -32,10 +26,7 @@ load(
3226
"otp_json",
3327
"otp_partition",
3428
)
35-
load(
36-
"//rules:rom_e2e.bzl",
37-
"maybe_skip_in_ci",
38-
)
29+
load("//rules:rom_e2e.bzl", "maybe_skip_in_ci")
3930
load(
4031
"//sw/device/silicon_creator/rom/e2e:defs.bzl",
4132
"MSG_PASS",

‎sw/device/silicon_creator/rom/e2e/bootstrap/BUILD‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,8 @@ load(
99
"fpga_params",
1010
"opentitan_test",
1111
)
12-
load(
13-
"//rules:opentitan.bzl",
14-
"ECDSA_ONLY_KEY_STRUCTS",
15-
)
16-
load(
17-
"//rules:const.bzl",
18-
"CONST",
19-
)
12+
load("//rules/opentitan:keyutils.bzl", "ECDSA_ONLY_KEY_STRUCTS")
13+
load("//rules:const.bzl", "CONST")
2014
load(
2115
"//rules:otp.bzl",
2216
"STD_OTP_OVERLAYS",

0 commit comments

Comments
 (0)