Skip to content

Sync with upstream for week ending 2025-12-05 #164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
qmn wants to merge 95 commits into
base: master
Choose a base branch
from
Open

Sync with upstream for week ending 2025-12-05 #164

qmn wants to merge 95 commits into from

Conversation

@qmn
Copy link
Contributor

@qmn qmn commented Dec 5, 2025

No description provided.

nbdd0121 and others added 15 commits December 5, 2025 20:12
@nbdd0121 @qmn
[opentitanlib] move set_break from ConsoleDevice to Uart
bc1867f 
Previously `set_break` needs to be on `ConsoleDevice` because `UartConsole`
expects it to be there, so it can turn stdin breaks into console breaks.
This feature is now moved to `opentitantool console` (which was the only place
this feature was used), so the `set_break` doesn't need to be on `ConsoleDevice`
anymore (and also this capability is only available on `Uart` impls anyway).

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] add a console broadcasting utility
7d5434a 
This can allow multiple concurrent readers to all receive all data.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] implement Uart for &impl Uart and Rc<impl Uart>
bb16e6d 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] small code style improvement
ae5de8b 
Reduce nesting level by 1.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] remove logfile feature of UartConsole
e5aac31 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] change parameter on UartConsole to boolean quiet flag
70ac48f 
We always use `stdout` if it's not `None`, so just use a boolean quiet flag
instead.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@engdoreis @qmn
[tests, spi_device] Enable the tpm test on ci
c4f9ee4 
Signed-off-by: Douglas Reis <doreis@lowrisc.org>
(cherry picked from commit 268c62267e28d7ee1210952f66e03522f8153513)
@engdoreis @qmn
[test, spi_device] Update the tpm test to verify hw registers
a354b19 
Signed-off-by: Douglas Reis <doreis@lowrisc.org>
(cherry picked from commit 6e1731e075f418f93b3cf9bee3cf24f042130852)
@cfrantz @qmn
[opentitantool] Correct the SHA256 hash ordering
2008755 
Opentitanlib was computing the SHA256 hash and storing it in a fixed-sized
bigint.  This led to various problems dealing with the endianness of the
resulting digest, including emitting digest in "little-endian" order.
A SHA256 digest _is not_ an integer; it is a sequence of bytes.

1. Eliminate the bigint representation of the SHA256 digest.  Give the
   digest struct serialization, display and parsing traits to eliminate
   the need for dealing with conversions for those ues cases.  Add
   `to_vec` and `to_vec_rev` to produce the raw bytes when needed.
2. Add a `--spx-hash-reversal-bug` switch to opentitantool spx commands
   for cases where firmware erroneously uses a reversed digest.
3. Eliminate the copious digest reversals present in hsmtool.  Add a
   `Sha256HashReversed` input format for cases where
   firmware erroneously uses a reversed digest.
4. Fix the signing rules to use the reversed format only for keys
   tied to a firmware implementation with the reversal bug.

Signed-off-by: Chris Frantz <cfrantz@google.com>
(cherry picked from commit 51e6a41)
@cfrantz @qmn
[hsmtool] Add tests
f121ac5 
1. Add tests that check that signatures generated with opentitantool can
   be verified by hsmtool.
2. Add tests that check that signatures generated with hsmtool can
   be verified by opentitantool.
3. Verify the correctness of the manifest digest calculcated by
   opentitantool.

Signed-off-by: Chris Frantz <cfrantz@google.com>
(cherry picked from commit 12467bb)
@cfrantz @qmn
[rom] Make the DEV key valid in TEST and RMA
9ba2aa8 
Make the DEV key valid in TEST and RMA. Because of the limited number of
key slots in OTP, we allow the DEV key to be valid in DEV, TEST and RMA.
This will allow a single set of keys (e.g. 3xPROD + 1xDEV) to be viable
for devices provisioned to PROD and DEV mission mode states while still
allowing the use of the DEV key for TEST and RMA states.

Signed-off-by: Chris Frantz <cfrantz@google.com>
(cherry picked from commit 35ec68c)
@cfrantz @qmn
[rom] Correct the hash order for SPX verify
55e7024 
The hmac peripheral produces the SHA256 hash in reversed byte order.
We need to byte-reverse the hash to put it into natural byte order
before passing it to the `spx_verify` function.

Signed-off-by: Chris Frantz <cfrantz@google.com>
(cherry picked from commit 4184d0f)
@nbdd0121 @qmn
[opentitanlib] remove public timestamp field from UartConsole.
fa8f417 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] add dedicated time out error for console
5d27e67 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] add console logging middleware to log to output while …
511b5bd 
…reading

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@github-actions
Copy link

github-actions bot commented Dec 5, 2025

Welcome! Before accepting your contribution, the expo project requires you to sign the Contributor License Agreement. To indicate your agreement, please post a comment on this Pull Request with the message below.

If you are contributing on behalf of a company, please inform your supervisor to contact zeroRISC to sign a Corporate CLA instead.

I certify that I have read and agree that my contributions will be bound by the expo CLA.

0 out of 12 committers have signed the CLA.
❌ @nbdd0121
❌ @engdoreis
❌ @cfrantz
❌ @glaserf
❌ @rswarbrick
❌ @timothytrippel
❌ @etterli
❌ @moidx
❌ @jwnrt
❌ @sameo
❌ @pamaury
❌ @vogelpi
You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

nbdd0121 added 14 commits December 5, 2025 20:36
@nbdd0121 @qmn
[opentitanlib] add a wait_for_line method to ConsoleExt
85287b4 
This allows an user to bypass `UartConsole` and call it directly on any console.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanproxy] change uart to be polling
909f8d7 
This temporarily removes the nonblocking mechanism, which allows significant
code cleanup. The mechanism is going to be added later in a different form.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanproxy] use a tokio task for receiving messages
e68942b 
With the `AsyncData` removed, we can now covert ot_transport_proxy to
receive using a tokio task.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanproxy] use proper async in Connection handling in proxy s…
1984ab9 
…erver

The previous code is a direct translation from mio to tokio. This is now
refactored to proper async.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanproxy] ensure Connection only stays on the main thread
e8ba2b6 
With the previous commit, we have detangled `Connection` with the actual socket
handling. This allows us to keep `Connection` staying on the main thread, so
we can store structures to it that is not `Send`.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanproxy] add back the ability to broadcast UART
22d470a 
This uses the broadcaster to implement the same feature previously implemented
using the "nonblocking_uart` registry mechanism.

A "WeakBroadcaster" is added as the proxy's copy of `Broadcaster` is never read from.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanproxy] use waker mechanism to achieve true async
ced14d3 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitantool] add console::Buffered to have user-side buffering
d9ef400 
This is used for proxy transport as `wait_for_line` is doing 1-byte
read and this can be detrimental for a longer-latency transport like
proxy.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] add a regex utility macro for regex literals
fbfb461 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] move capture handling to ConsoleExt
1279b0a 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] allow matching of two regexes with wait_for_line
ad8651c 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] add logged method to the console extension trait
f650c80 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[opentitanlib] make use of the new console APIs
547c51b 
Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
@nbdd0121 @qmn
[ot_transport] add fpga_ops and make bitstream methods part of it
e914b03 
This eliminates the special `dispatch` mechanism for FPGA programming.

Signed-off-by: Gary Guo <gary.guo@lowrisc.org>
timothytrippel and others added 29 commits December 5, 2025 20:36
@timothytrippel @qmn
[orchestrator] enable overriding package ID via CLI
a77fe35 
Previously the package ID was defined in the HJSON SKU configuration
file. This updates the orchestrator.py script to enable overriding this
field via a command line arg.

Signed-off-by: Tim Trippel <ttrippel@google.com>
(cherry picked from commit c564ac4)
@timothytrippel @qmn
[tests] remove duplicate test behavior
c58c583 
The "enable-alerts" and "use-ext-clk" flags of the orchestrator.py
script are already tested in a separate test.

Signed-off-by: Tim Trippel <ttrippel@google.com>
(cherry picked from commit eaf6c7e)
@timothytrippel @qmn
[orchestrator] re-enable the multistage test
f708b59 
This test was temporarily disabled to deal with CI issues that have now
been resolved.

Signed-off-by: Tim Trippel <ttrippel@google.com>
(cherry picked from commit 922fc1b)
@timothytrippel @qmn
[testutils] increase OTP programming timeout to 10ms
9a3c65d 
Signed-off-by: Tim Trippel <ttrippel@google.com>
(cherry picked from commit ae75936)
@moidx @qmn
[rom] Update clkmgr jitter enable to match ROM specification.
8fa1511 
The ROM e2e plan captures the expected behavior of the clock jitter
enable flow:

> `CREATOR_SW_CFG_JITTER_EN`: `kMultiBitBool4False` disables, all other values
>  enables. `CREATOR_SW_CFG_AST_INIT_EN` must also be `kMultiBitBool4True` to enable.

This change refactors the code in `rom_start.S` and `test_rom_start.S`
to explicitly reduce any value different than MubiFalse to MubiTrue.
The implementation relies on the register to be reset to MubiFalse by
default.

Signed-off-by: Miguel Osorio <miguelosorio@google.com>
(cherry picked from commit 288b998)
@timothytrippel @qmn
[manuf] add weak OTP operations hooks
0492812 
This adds weak hook functions to OTP sub operations to enable tests, and
provisioning firmware, to insert debug functionality before and after
functions.

Signed-off-by: Tim Trippel <ttrippel@google.com>
(cherry picked from commit 58b9e53)
@timothytrippel @qmn
[manuf] remove printing of flash data in FT individualize
ca601c3 
This will optimize test time and code size.

Signed-off-by: Tim Trippel <ttrippel@google.com>
(cherry picked from commit 57f56b0)
@timothytrippel @qmn
[manuf] use GPIO indicators during OTP operations
b185ff2 
This updates the FT individualization firmware to use GPIO toggles
during OTP operations to aid in debugging during silicon bringup.

Signed-off-by: Tim Trippel <ttrippel@google.com>
(cherry picked from commit dc33214)
@rswarbrick @qmn
[dv] Move en_scb_tl_err_chk to cip_base_env_cfg
01d3ba8 
This is a TL-specific item, which means it only really applies to
comportable IP, and belongs in the CIP layer, rather than the DV base
layer.

Signed-off-by: Rupert Swarbrick <rswarbrick@lowrisc.org>
@rswarbrick @qmn
[dv] Move en_scb_ping_chk to cip_base_env_cfg
2d67f3f 
This is specific to alert handling, so belongs in the CIP layer,
rather than the DV base layer.

Signed-off-by: Rupert Swarbrick <rswarbrick@lowrisc.org>
@rswarbrick @qmn
[dv] Move will_reset functionality to cip_base_env_cfg
b1c9b8a 
This (somewhat dubious) functionality is only used in the CIP layer,
so probably belongs there.

Signed-off-by: Rupert Swarbrick <rswarbrick@lowrisc.org>
@rswarbrick @qmn
[dv] Move use_jtag_dmi to chip_env_cfg
2bb1721 
This is a chip-level item, so doesn't really belong in
dv_base_env_cfg.

Signed-off-by: Rupert Swarbrick <rswarbrick@lowrisc.org>
@rswarbrick @qmn
[dv] Reorder dv_base_env_cfg and add documentation comments
57f3b11 
The function that was called create_ral_models can be dramatically
simplified by defining a create_ral_model function to do the body and
looping with that. Unfortunately, the name is a bit close to
create_ral_by_name, so I've renamed the two local functions to
make_ral_model(s).

Also note that some of the documented items currently only apply to
CIP-related objects. For example, en_scb_mem_chk is only used for TL
transactions. But the general config option might make sense more
generally, so it probably still belongs in this config object.

Signed-off-by: Rupert Swarbrick <rswarbrick@lowrisc.org>
@jwnrt @qmn
[otlib] Use transport reset function in legacy bootstrap
2285c94 
The RX clearing mechanism is implemented (in a slightly different
improved way) in `target_reset` so it's okay to defer that to
`reset_target(true)`.

Signed-off-by: James Wainwright <james.wainwright@lowrisc.org>
(cherry picked from commit 839803e6a05f986c3d77f32b3056f1c3ba9beb78)
@jwnrt @qmn
[otlib] Split reset function in two
ad52613 
This allows us to have one function using a default configured reset and
another one that allows specifying the reset.

Signed-off-by: James Wainwright <james.wainwright@lowrisc.org>
(cherry picked from commit 4fcf7454b2f95c488b9c47f2387ea15b535e929c)
@jwnrt @qmn
[otlib] Allow reset delay to be configured in files
5215eda 
Signed-off-by: James Wainwright <james.wainwright@lowrisc.org>
(cherry picked from commit f8ba7c7b4fd82a3a10c01fabe8d1ef374d0a54c7)
@jwnrt @qmn
[otlib] Deprecate CLI flag for setting reset delay
c05b771 
Reset delays are now configured once in configuration files and cannot
be changed per-test on the command line.

This commit switches all uses of the `reset_target` function to use
either `reset` or `reset_with_delay` where appropriate. All delays
should be exactly the same after this commit.

Signed-off-by: James Wainwright <james.wainwright@lowrisc.org>
(cherry picked from commit 472c31f491d24a0492f97cd877310176aa7e18af)
@sameo @qmn
[sw,silicon_creator] Move key seed retrieval function to top specific…
67828ff 
… folders

Not all tops require or provide an additional attestation key seed, make
the function a top specific implementation.

This removes the flash controller dependency from the OTBN boot services
library.

Partly fixes #28438

Signed-off-by: Samuel Ortiz <sameo@rivosinc.com>
@pamaury @qmn
[dt,otp] Rename misleadingly name field and its documentation
ffc9382 
The documentation was probably copy-paste: the digest is not
actually an OTP address but a CSR. Rename the field to make it
clearer.

Signed-off-by: Amaury Pouly <amaury.pouly@lowrisc.org>
@pamaury @qmn
[silicon_creator,rom,e2e] Enable test on CW340
e8e1941 
Signed-off-by: Amaury Pouly <amaury.pouly@lowrisc.org>
@timothytrippel @qmn
[silicon_creator] remove duplicate function prototype
9273e3e 
This removes a duplicate function prototype for the
`otbn_boot_attestation_keygen()` that is unneeded.

Signed-off-by: Tim Trippel <ttrippel@google.com>
(cherry picked from commit 69e7d4a)
@moidx @qmn
[sram-exec] Avoid using compressed instructions when loading sp.
c011de4 
This changes solves an issue that caused larger programs to return the
following linker error:

```
relocation truncated to fit: R_RISCV_GPREL_I against symbol `_stack_end' defined in .sram_start
```

Using the `norelax` option avoids the use of compressed instructions
which was causing the `_stack_end` address calculation error.

Patch submitted by cfrantz@google.com.

Signed-off-by: Miguel Osorio <miguelosorio@google.com>
(cherry picked from commit 5b072fc)
@pamaury @qmn
[bazel,bitstream] Add support for non-master branch
70d167d 
Signed-off-by: Tim Trippel <ttrippel@google.com>
(cherry picked from commit 05e45b2)
Signed-off-by: Amaury Pouly <amaury.pouly@lowrisc.org>
@cfrantz @qmn
[rom_ext] Make the ROM_EXT protect itself in flash
4c84db2 
Ownership flash lockdown was protecting and locking all regions in the
same slot that booted the owner code.  However, the ROM_EXT and owner
code don't have to boot from the same side of the flash.

1. Disallow ownership configurations that have flash regions that
   overlap with the ROM_EXT region.  It is an error to upload such a
   configuration, but if one already exists in the chip, the
   owner-specified ROM_EXT regions are ignored in favor of the
   self-protection.
2. Always protect the ROM_EXT by using flash regions 0 and 1.
3. Update ownership tests.
4. Update SiVAL tests that used flash MP regions 0 & 1, as the ROM_EXT
   now uses them.

Fixes #25435.

Signed-off-by: Chris Frantz <cfrantz@google.com>
(cherry picked from commit d28f9e4)
@pamaury @qmn
[silicon_creator,owner] Replace hardcoded value by flash_ctrl parameter
2adbb8c 
Signed-off-by: Amaury Pouly <amaury.pouly@lowrisc.org>
@vogelpi @qmn
[top, dv] Parameterize number of EDN endpoints for EDN1, add DV configs
8776d53 
Previously, both EDN instances were instantiated with 8 endpoints and
7 of the endpoints for EDN1 were tied off. This allowed reducing the
number of DV configs but led to an area increase as the tied off
endpoint ports could not be optimized away entirely due to prim_buf
cells and the like.

Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>
@vogelpi @qmn
[prim/lint] Fix lint for prim_arbiter_ppc with N=1
2118b11 
Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>
@vogelpi @qmn
[top, csrng, entropy_src] Remove CS AES halt request interface
6926a03 
This interface adds considerable design and verification complexity
without substantial gain: The two crypto primitives serialized by this
interface (unmasked AES core inside CSRNG, unmasked SHA3 inside
ENTROPY_SRC) amount to less than 40 kGE together. Much more logic than
this got removed through the CSRNG restructuring effort.

At the same time, the interface is the main source of back pressure
inside the ENTROPY_SRC thereby introducing the need for additional logic
to aborb this back pressure. For this reason, the interface was anyway
disabled for Darjeeling which uses a high-rate noise source.

This commit removes the interface completely from the top levels and the
two involved hardware block IPs CSRNG and ENTROPY_SRC in order to reduce
complexity.

This resolves lowRISC/opentitan#28819.

Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>
@vogelpi @qmn
[entropy_src/doc] Document that the Distr FIFO depth needs to be odd
ae198c4 
This is a follow-up of 357d41aec26dbea832e7dafd29d56365be0d8015 .

Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>
@qmn qmn force-pushed the auto/qmn/2025-12-05-upstream-sync branch from c130880 to ae198c4 Compare December 5, 2025 20:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.