[manuf] Bind perso firmware with INITIAL MANUF_STATE

This binds the personalization firmware with the `PERSO_INITIAL` manufacturing state. This ensures the personalization firmware's signature is invalidated once the device is fully personalized and prevents the personalization firmware from being executed again. A new manifest, `manifest_perso` is created with the `PERSO_INITIAL` creator manufacturing state to facilitate this binding. Signed-off-by: Anthony Chen <[email protected]> (cherry picked from commit 70d0cff)
lowRISC · Oct 29, 2024 · 321c23b · 321c23b
1 parent c9e6dba
commit 321c23b
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/rules/const.bzl b/rules/const.bzl
@@ -141,6 +141,7 @@ CONST = struct(
         ESC_PHASE_3 = 0x76,
     ),
     MANUF_STATE = struct(
+        PERSO_INITIAL = 0x00000000,
         SIVAL = 0x30305653,  # ASCII `SV00`.
         PRODC = 0x30304350,  # ASCII `PC00`.
     ),

diff --git a/sw/device/silicon_creator/manuf/base/BUILD b/sw/device/silicon_creator/manuf/base/BUILD
@@ -3,6 +3,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 load("@bazel_skylib//rules:common_settings.bzl", "bool_flag")
+load("//rules:const.bzl", "CONST", "hex")
+load("//rules:manifest.bzl", "manifest")
 load(
     "//rules/opentitan:defs.bzl",
     "fpga_params",
@@ -19,6 +21,10 @@ load(
     "FT_PROVISIONING_INPUTS",
     "LOCAL_CERT_ENDORSEMENT_PARAMS",
 )
+load(
+    "//sw/device/silicon_creator/rom_ext:defs.bzl",
+    "ROM_EXT_VERSION",
+)
 
 package(default_visibility = ["//visibility:public"])
 
@@ -323,6 +329,16 @@ _FT_PERSO_EXTS = [
     },
 ]
 
+manifest(d = {
+    "name": "manifest_perso",
+    "identifier": hex(CONST.ROM_EXT),
+    "manuf_state_creator": hex(CONST.MANUF_STATE.PERSO_INITIAL),
+    "visibility": ["//visibility:private"],
+    "version_major": ROM_EXT_VERSION.MAJOR,
+    "version_minor": ROM_EXT_VERSION.MINOR,
+    "security_version": ROM_EXT_VERSION.SECURITY,
+})
+
 [
     opentitan_binary(
         name = "ft_personalize{}".format(ext["suffix"] + dice["suffix"]),
@@ -335,6 +351,7 @@ _FT_PERSO_EXTS = [
             "//hw/top_earlgrey:silicon_creator": None,
         },
         linker_script = "//sw/device/lib/testing/test_framework:ottf_ld_silicon_creator_slot_a",
+        manifest = ":manifest_perso",
         spx_key = {"//sw/device/silicon_creator/rom/keys/fake/spx:prod_key_0_spx": "prod_key_0"},
         deps = [":ft_personalize_base{}".format(dice["suffix"])] + ext["ext_libs"],
     )