Cherry-pick to master: [rom_ext] Enable ECDSA verify of owner code

hw/top_earlgrey/BUILD

@@ -102,7 +102,7 @@ fpga_cw310(
     name = "fpga_cw310_rom_ext",
     testonly = True,
     base = ":fpga_cw310_test_rom",
-    ecdsa_key = CLEAR_KEY_SET,
+    ecdsa_key = {"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_ecdsa": "prod_key_0"},
     exec_env = "fpga_cw310_rom_ext",
     libs = [
         "//sw/device/lib/arch:boot_stage_owner",
@@ -119,7 +119,6 @@ fpga_cw310(
     },
     rom = "//sw/device/silicon_creator/rom:mask_rom",
     rom_ext = "//sw/device/silicon_creator/rom_ext:rom_ext_slot_a",
-    rsa_key = {"//sw/device/silicon_creator/rom_ext/keys/fake:rom_ext_test_private_key_0": "test_key_0"},
 )
 
 fpga_cw310(
@@ -156,7 +155,7 @@ fpga_cw310(
     name = "fpga_hyper310_rom_ext",
     testonly = True,
     base = ":fpga_hyper310_rom_with_fake_keys",
-    ecdsa_key = CLEAR_KEY_SET,
+    ecdsa_key = {"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_ecdsa": "prod_key_0"},
     exec_env = "fpga_hyper310_rom_ext",
     libs = [
         "//sw/device/lib/arch:boot_stage_owner",
@@ -172,7 +171,6 @@ fpga_cw310(
         "assemble": "{rom_ext}@0 {firmware}@0x10000",
     },
     rom_ext = "//sw/device/silicon_creator/rom_ext:rom_ext_slot_a",
-    rsa_key = {"//sw/device/silicon_creator/rom_ext/keys/fake:rom_ext_test_private_key_0": "test_key_0"},
 )
 
 # FPGA configuration used to emulate silicon targets. This rule can be used by
@@ -203,15 +201,14 @@ fpga_cw310(
     name = "fpga_cw310_sival_rom_ext",
     testonly = True,
     base = ":fpga_hyper310_rom_ext",
-    ecdsa_key = CLEAR_KEY_SET,
+    ecdsa_key = {"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_ecdsa": "prod_key_0"},
     exec_env = "fpga_cw310_sival_rom_ext",
     libs = [
         "//sw/device/lib/arch:boot_stage_owner",
         "//sw/device/lib/arch:fpga_cw310",
     ],
     otp = "//hw/top_earlgrey/data/otp/sival_skus:otp_img_prod_manuf_personalized",
     rom_ext = "//sw/device/silicon_creator/rom_ext:rom_ext_slot_a",
-    rsa_key = {"//sw/device/silicon_creator/rom_ext/keys/fake:rom_ext_prod_private_key_0": "prod_key_0"},
     tags = ["cw310_sival_rom_ext"],
 )
 
@@ -311,7 +308,7 @@ fpga_cw340(
     name = "fpga_cw340_rom_ext",
     testonly = True,
     base = ":fpga_cw340_rom_with_fake_keys",
-    ecdsa_key = CLEAR_KEY_SET,
+    ecdsa_key = {"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_ecdsa": "prod_key_0"},
     exec_env = "fpga_cw340_rom_ext",
     libs = [
         "//sw/device/lib/arch:boot_stage_owner",
@@ -327,7 +324,6 @@ fpga_cw340(
         "assemble": "{rom_ext}@0 {firmware}@0x10000",
     },
     rom_ext = "//sw/device/silicon_creator/rom_ext:rom_ext_slot_a",
-    rsa_key = {"//sw/device/silicon_creator/rom_ext/keys/fake:rom_ext_test_private_key_0": "test_key_0"},
 )
 
 # FPGA configuration used to emulate silicon targets. This rule can be used by
@@ -358,15 +354,14 @@ fpga_cw340(
     name = "fpga_cw340_sival_rom_ext",
     testonly = True,
     base = ":fpga_cw340_rom_ext",
-    ecdsa_key = CLEAR_KEY_SET,
+    ecdsa_key = {"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_ecdsa": "prod_key_0"},
     exec_env = "fpga_cw340_sival_rom_ext",
     libs = [
         "//sw/device/lib/arch:boot_stage_owner",
         "//sw/device/lib/arch:fpga_cw340",
     ],
     otp = "//hw/top_earlgrey/data/otp/sival_skus:otp_img_prod_manuf_personalized",
     rom_ext = "//sw/device/silicon_creator/rom_ext:rom_ext_slot_a",
-    rsa_key = {"//sw/device/silicon_creator/rom_ext/keys/fake:rom_ext_prod_private_key_0": "prod_key_0"},
     tags = ["cw340_sival_rom_ext"],
 )
 
@@ -417,7 +412,8 @@ silicon(
         "--interface={interface}",
     ],
     design = "earlgrey",
-    ecdsa_key = CLEAR_KEY_SET,
+    # TODO(moidx): Switch to real keys once these have been generated.
+    ecdsa_key = {"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_ecdsa": "prod_key_0"},
     exec_env = "silicon_owner_sival_rom_ext",
     extract_sw_logs = "//util/device_sw_utils:extract_sw_logs_db",
     flash_scramble_tool = "//util/design:gen-flash-img",
@@ -440,10 +436,6 @@ silicon(
         "//signing:test_keys": "//sw/device/silicon_creator/rom_ext/sival:rom_ext_fake_prod_signed_slot_a",
         "//conditions:default": "//sw/device/silicon_creator/rom_ext/sival:rom_ext_fake_prod_signed_slot_a",
     }),
-    rsa_key = select({
-        "//signing:test_keys": {"//sw/device/silicon_creator/rom_ext/keys/fake:rom_ext_test_private_key_0": "test_key_0"},
-        "//conditions:default": {"//sw/device/silicon_creator/rom_ext/sival/keys:keyset": "earlgrey_z0_sival_1"},
-    }),
     test_cmd = """
         --exec="transport init"
         --exec="bootstrap --clear-uart=true {firmware}"

sw/device/silicon_creator/lib/ownership/datatypes.h

@@ -182,6 +182,15 @@ OT_ASSERT_MEMBER_OFFSET(owner_application_key_t, usage_constraint, 44);
 OT_ASSERT_MEMBER_OFFSET(owner_application_key_t, data, 48);
 OT_ASSERT_SIZE(owner_application_key_t, 464);
 
+enum {
+  kTlvLenApplicationKeyRsa =
+      offsetof(owner_application_key_t, data) + sizeof(sigverify_rsa_key_t),
+  kTlvLenApplicationKeySpx =
+      offsetof(owner_application_key_t, data) + sizeof(sigverify_spx_key_t),
+  kTlvLenApplicationKeyEcdsa =
+      offsetof(owner_application_key_t, data) + sizeof(ecdsa_p256_public_key_t),
+};
+
 // clang-format off
 /**
  * Bitfields for the `access` word of flash region configs.

sw/device/silicon_creator/lib/ownership/keys/dummy/BUILD

@@ -1,6 +1,7 @@
 # Copyright lowRISC contributors (OpenTitan project).
 # Licensed under the Apache License, Version 2.0, see LICENSE for details.
 # SPDX-License-Identifier: Apache-2.0
+load("//rules/opentitan:keyutils.bzl", "key_ecdsa")
 
 package(default_visibility = ["//visibility:public"])
 
@@ -25,11 +26,15 @@ filegroup(
 )
 
 filegroup(
-    name = "app_prod",
-    srcs = ["app_prod_rsa_3072_exp_f4.der"],
+    name = "app_prod_ecdsa_pub",
+    srcs = ["app_prod_ecdsa_p256.pub.der"],
 )
 
-filegroup(
-    name = "app_prod_pub",
-    srcs = ["app_prod_rsa_3072_exp_f4.pub.der"],
+key_ecdsa(
+    name = "app_prod_ecdsa",
+    config = "EcdsaP256",
+    method = "local",
+    private_key = "app_prod_ecdsa_p256.der",
+    pub_key = "app_prod_ecdsa_p256.pub.der",
+    type = "ProdKey",
 )

sw/device/silicon_creator/lib/ownership/keys/fake/BUILD

@@ -2,16 +2,18 @@
 # Licensed under the Apache License, Version 2.0, see LICENSE for details.
 # SPDX-License-Identifier: Apache-2.0
 
+load("//rules/opentitan:keyutils.bzl", "key_ecdsa")
+
 package(default_visibility = ["//visibility:public"])
 
 cc_library(
     name = "includes",
     testonly = True,
     hdrs = [
         "activate_ecdsa_p256.h",
-        "app_dev_key_rsa_3072_exp_f4.h",
-        "app_prod_key_rsa_3072_exp_f4.h",
-        "app_test_key_rsa_3072_exp_f4.h",
+        "app_dev_ecdsa_p256.h",
+        "app_prod_ecdsa_p256.h",
+        "app_test_ecdsa_p256.h",
         "owner_ecdsa_p256.h",
         "unlock_ecdsa_p256.h",
     ],
@@ -57,11 +59,57 @@ filegroup(
 )
 
 filegroup(
-    name = "app_prod",
-    srcs = ["app_prod_key_rsa_3072_exp_f4.der"],
+    name = "app_ecdsa_prod",
+    srcs = ["app_prod_ecdsa_p256.der"],
+)
+
+filegroup(
+    name = "app_prod_ecdsa_pub",
+    srcs = ["app_prod_ecdsa_p256.pub.der"],
 )
 
 filegroup(
-    name = "app_prod_pub",
-    srcs = ["app_prod_key_rsa_3072_exp_f4.pub.der"],
+    name = "app_dev",
+    srcs = ["app_dev_ecdsa_p256.der"],
+)
+
+filegroup(
+    name = "app_dev_pub",
+    srcs = ["app_dev_ecdsa_p256.pub.der"],
+)
+
+key_ecdsa(
+    name = "app_prod_ecdsa",
+    config = "EcdsaP256",
+    method = "local",
+    private_key = "app_prod_ecdsa_p256.der",
+    pub_key = "app_prod_ecdsa_p256.pub.der",
+    type = "ProdKey",
+)
+
+key_ecdsa(
+    name = "app_dev_ecdsa",
+    config = "EcdsaP256",
+    method = "local",
+    private_key = "app_dev_ecdsa_p256.der",
+    pub_key = "app_dev_ecdsa_p256.pub.der",
+    type = "DevKey",
+)
+
+key_ecdsa(
+    name = "app_test_ecdsa",
+    config = "EcdsaP256",
+    method = "local",
+    private_key = "app_test_ecdsa_p256.der",
+    pub_key = "app_test_ecdsa_p256.pub.der",
+    type = "TestKey",
+)
+
+key_ecdsa(
+    name = "app_unauthorized_ecdsa",
+    config = "EcdsaP256",
+    method = "local",
+    private_key = "app_unauthorized_ecdsa_p256.der",
+    pub_key = "app_unauthorized_ecdsa_p256.pub.der",
+    type = "TestKey",
 )

sw/device/silicon_creator/lib/ownership/keys/fake/app_dev_ecdsa_p256.h

@@ -0,0 +1,16 @@
+// Copyright lowRISC contributors (OpenTitan project).
+// Licensed under the Apache License, Version 2.0, see LICENSE for details.
+// SPDX-License-Identifier: Apache-2.0
+
+#ifndef OPENTITAN_SW_DEVICE_SILICON_CREATOR_LIB_OWNERSHIP_KEYS_FAKE_APP_DEV_ECDSA_P256_H_
+#define OPENTITAN_SW_DEVICE_SILICON_CREATOR_LIB_OWNERSHIP_KEYS_FAKE_APP_DEV_ECDSA_P256_H_
+
+#define APP_DEV_ECDSA_P256                                 \
+  {                                                        \
+    .x = {0xddd43a0c, 0x622265ee, 0xae5b66d4, 0x94c06bca,  \
+          0x310493ae, 0x4ef6f61e, 0x7581813f, 0xac7b2ff9}, \
+    .y = {0xc5aa3b52, 0x07db1c51, 0x905148dc, 0xe5c458de,  \
+          0xebccfe4b, 0x317e5744, 0x863e76fd, 0xa08f1a90}, \
+  }
+
+#endif  // OPENTITAN_SW_DEVICE_SILICON_CREATOR_LIB_OWNERSHIP_KEYS_FAKE_APP_DEV_ECDSA_P256_H_

sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_ecdsa_p256.h

@@ -0,0 +1,16 @@
+// Copyright lowRISC contributors (OpenTitan project).
+// Licensed under the Apache License, Version 2.0, see LICENSE for details.
+// SPDX-License-Identifier: Apache-2.0
+
+#ifndef OPENTITAN_SW_DEVICE_SILICON_CREATOR_LIB_OWNERSHIP_KEYS_FAKE_APP_PROD_ECDSA_P256_H_
+#define OPENTITAN_SW_DEVICE_SILICON_CREATOR_LIB_OWNERSHIP_KEYS_FAKE_APP_PROD_ECDSA_P256_H_
+
+#define APP_PROD_ECDSA_P256                                \
+  {                                                        \
+    .x = {0x265b676b, 0x656df11f, 0xe7268c24, 0xf7682b71,  \
+          0x1a5407bc, 0x60d64f8b, 0x0df3f0ea, 0x32de82c0}, \
+    .y = {0x248107b0, 0xdddf1364, 0xa99b1d58, 0x35897333,  \
+          0x661324da, 0x4ad9cfd4, 0xac55ca48, 0x47d456f4}, \
+  }
+
+#endif  // OPENTITAN_SW_DEVICE_SILICON_CREATOR_LIB_OWNERSHIP_KEYS_FAKE_APP_PROD_ECDSA_P256_H_

sw/device/silicon_creator/lib/ownership/keys/fake/app_test_ecdsa_p256.h

@@ -0,0 +1,16 @@
+// Copyright lowRISC contributors (OpenTitan project).
+// Licensed under the Apache License, Version 2.0, see LICENSE for details.
+// SPDX-License-Identifier: Apache-2.0
+
+#ifndef OPENTITAN_SW_DEVICE_SILICON_CREATOR_LIB_OWNERSHIP_KEYS_FAKE_APP_TEST_ECDSA_P256_H_
+#define OPENTITAN_SW_DEVICE_SILICON_CREATOR_LIB_OWNERSHIP_KEYS_FAKE_APP_TEST_ECDSA_P256_H_
+
+#define APP_TEST_ECDSA_P256                                \
+  {                                                        \
+    .x = {0xced1f3c1, 0x8f31432e, 0x3bd9cc77, 0xb53f37f1,  \
+          0xd2eb4cdd, 0xeb3e0bf4, 0xed753db5, 0xdfcbc369}, \
+    .y = {0x230c28c5, 0xfd36977b, 0xe0a93eb8, 0x1c80d1b9,  \
+          0xbf7782d9, 0x0d3d6d7c, 0xaf133a0e, 0xefd36de6}, \
+  }
+
+#endif  // OPENTITAN_SW_DEVICE_SILICON_CREATOR_LIB_OWNERSHIP_KEYS_FAKE_APP_TEST_ECDSA_P256_H_

sw/device/silicon_creator/lib/ownership/test_owner.c

@@ -8,9 +8,9 @@
 #include "sw/device/silicon_creator/lib/drivers/flash_ctrl.h"
 #include "sw/device/silicon_creator/lib/error.h"
 #include "sw/device/silicon_creator/lib/ownership/keys/fake/activate_ecdsa_p256.h"
-#include "sw/device/silicon_creator/lib/ownership/keys/fake/app_dev_key_rsa_3072_exp_f4.h"
-#include "sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_key_rsa_3072_exp_f4.h"
-#include "sw/device/silicon_creator/lib/ownership/keys/fake/app_test_key_rsa_3072_exp_f4.h"
+#include "sw/device/silicon_creator/lib/ownership/keys/fake/app_dev_ecdsa_p256.h"
+#include "sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_ecdsa_p256.h"
+#include "sw/device/silicon_creator/lib/ownership/keys/fake/app_test_ecdsa_p256.h"
 #include "sw/device/silicon_creator/lib/ownership/keys/fake/owner_ecdsa_p256.h"
 #include "sw/device/silicon_creator/lib/ownership/keys/fake/unlock_ecdsa_p256.h"
 #include "sw/device/silicon_creator/lib/ownership/owner_block.h"
@@ -36,59 +36,63 @@ rom_error_t test_owner_init(boot_data_t *bootdata, owner_config_t *config,
   owner_page[0].activate_key = (owner_key_t){ACTIVATE_ECDSA_P256};
   owner_page[0].unlock_key = (owner_key_t){UNLOCK_ECDSA_P256};
 
-  // Fill the data segment with the end tag (0x5a5a5a5a).
-  memset(owner_page[0].data, 0x5a, sizeof(owner_page[0].data));
-
-  // TODO: we're temporarily using RSA keys.
-  // We'll change these to ECDSA keys after the ECDSA changes from
-  // master are merged.
   owner_application_key_t *app = (owner_application_key_t *)owner_page[0].data;
-  app[0] = (owner_application_key_t){
+  *app = (owner_application_key_t){
       .header =
           {
               .tag = kTlvTagApplicationKey,
-              .length = sizeof(owner_application_key_t),
+              .length = kTlvLenApplicationKeyEcdsa,
           },
-      .key_alg = kOwnershipKeyAlgRsa,
+      .key_alg = kOwnershipKeyAlgEcdsaP256,
       .key_domain = kOwnerAppDomainTest,
       .key_diversifier = {0},
       .usage_constraint = 0,
       .data =
           {
-              .rsa = APP_TEST_KEY_RSA_3072_EXP_F4,
+              .ecdsa = APP_TEST_ECDSA_P256,
           },
   };
-  app[1] = (owner_application_key_t){
+
+  app = (owner_application_key_t *)((uintptr_t)app + app->header.length);
+  *app = (owner_application_key_t){
       .header =
           {
               .tag = kTlvTagApplicationKey,
-              .length = sizeof(owner_application_key_t),
+              .length = kTlvLenApplicationKeyEcdsa,
           },
-      .key_alg = kOwnershipKeyAlgRsa,
+      .key_alg = kOwnershipKeyAlgEcdsaP256,
       .key_domain = kOwnerAppDomainDev,
       .key_diversifier = {0},
       .usage_constraint = 0,
       .data =
           {
-              .rsa = APP_DEV_KEY_RSA_3072_EXP_F4,
+              .ecdsa = APP_DEV_ECDSA_P256,
           },
   };
-  app[2] = (owner_application_key_t){
+
+  app = (owner_application_key_t *)((uintptr_t)app + app->header.length);
+  *app = (owner_application_key_t){
       .header =
           {
               .tag = kTlvTagApplicationKey,
-              .length = sizeof(owner_application_key_t),
+              .length = kTlvLenApplicationKeyEcdsa,
           },
-      .key_alg = kOwnershipKeyAlgRsa,
+      .key_alg = kOwnershipKeyAlgEcdsaP256,
       .key_domain = kOwnerAppDomainProd,
       .key_diversifier = {0},
       .usage_constraint = 0,
       .data =
           {
-              .rsa = APP_PROD_KEY_RSA_3072_EXP_F4,
+              .ecdsa = APP_PROD_ECDSA_P256,
           },
   };
 
+  // Fill the remainder of the data segment with the end tag (0x5a5a5a5a).
+  app = (owner_application_key_t *)((uintptr_t)app + app->header.length);
+  size_t len = (uintptr_t)(owner_page[0].data + sizeof(owner_page[0].data)) -
+               (uintptr_t)app;
+  memset(app, 0x5a, len);
+
   ownership_page_seal(/*page=*/0);
 
   RETURN_IF_ERROR(owner_block_parse(&owner_page[0], config, keyring));