[keymgr_dpe] Replace keymgr in EG - PR9 top level integration

[rroth-lowrisc]

PR9 - Top level integration

This PR is the ninth in a series which will replace the keymgr with the kemgr_dpe in earlgrey. The replacement was approved by this RFC.

Merge-Dependencies

• [keymgr_dpe] Replace keymgr in EG - PR1 otp_ctrl #30615
• [keymgr_dpe] Replace keymgr in EG - PR3 blocklevel dv #30617
• [keymgr_dpe] Replace keymgr in EG - PR4 BootStageOwnerInt / Top dep. parameter #30618
• [keymgr_dpe] Replace keymgr in EG - PR5 dif functions #30619
• [keymgr_dpe] Replace keymgr in EG - PR6 silicon creator driver #30668
• [keymgr_dpe] Replace keymgr in EG - PR8 crypto driver #30677

Description

Replaces keymgr with keymgr_dpe in top_earlgrey and migrates the software stack to match.
A new top-level parameter keymgr_dpe_seed_selector chooses whether the creator/owner seed comes from flash_ctrl (used by Earl Grey) or otp_ctrl.

The CreatorRootKey derivation moves from the immutable ROM_EXT into the ROM per this RFC, and sealing/attestation keys now live in two parallel DPE slots instead of a single key chain, so sc_keymgr_key_type_t is dropped.

On the software side this ports rom, imm_section, dice_chain, ownership_key, otbn_boot_services, tpm and shutdown, and adds a keymgr_dpe_slot_idx field to otcrypto_key_config_t to select the parent DPE context for sideloaded keys.

Affected SW tests, DV sequences and testplans are updated here rather than in a follow-up, because the top-level swap breaks them as soon as it lands.

The keymgr_dpe requires to have a locked secret2 OTP partition to derive any DPE context and because rom already uses the keymgr_dpe a lot of tests would fail. This PR locks the secret2 partition in the default OTP image in the following lifecycle states: dev, prod, prod_end, rma. With an otp_partition in bazel its possible to get an unlocked secret2 partition:

otp_partition(
    name = "SECRET2",
    lock = False,
),

Open points

This list encompass open points which either needs to be fixed before this PR is merged or a Issue is created.

• Currently the ft_personalize.c is not yet updated and breaks when building
• Currently the cmac.c is not yet updated and breaks when building
• Fix all pentests (otbn_fi.c, otbn_sca.c, ibex_fi.c)
• rename sel_src_slot in the silicon driver (and all dependent files) to slot_src_sel for consistency with the register description.
• Find a suitable way to propagate the (fixed) slot number for the attestation and the sealing DPE context throughout the OT repo, replacing the current hardcoded solution (related issue [keymgr_dpe, dice] Remove duplicate definition for the keymgr_dpe slot number #30777)

Follow-ups issues: #30777, #30759, #30811, #30830, #30878, #30690, #30907.

Sidenote

The first commit encompasses all changes on the top-layer to replace the keymgr with keymgr_dpe. I split all autogenerated code into a separate commit to allow for a faster review process.

[andreaskurth]

Many thanks @rroth-lowrisc for this work!

I agree with the RTL changes:

• keymgr_dpe is instantiated in place of keymgr in top_earlgrey with every port correctly wired.
• The seed source selector for keymgr_dpe is set so that it's behaviorally equivalent to the prior keymgr instance.

The DV changes seem consistent as well (sequences and testplan renamed/added correctly).

I've added a couple small comments on RTL/generation and DV/testplan.

The main unresolved area in this PR I see in SW (I appreciate this PR depends on other PRs where SW changes are work in progress, but I don't expect those PRs to resolve top-level SW issues). Shall we take some time today to discuss this?

[rroth-lowrisc]

@gautschimi @engdoreis Thanks for your reviews, I implemented your suggestion or lakes a question in return.

@gautschimi I directly changed the references from u_keymgr to u_keymgr_dpe and remove the waivers in hw/top_earlgrey/cdc/cdc_waivers.w_recon.tcl (If necessary they can be reintroduced later on). The test error you have seen is unrelated to the keymgr_dpe integration and will be fixed in a separate PR.

[gautschimi]

@gautschimi I directly changed the references from u_keymgr to u_keymgr_dpe and remove the waivers in hw/top_earlgrey/cdc/cdc_waivers.w_recon.tcl (If necessary they can be reintroduced later on). The test error you have seen is unrelated to the keymgr_dpe integration and will be fixed in a separate PR.

Thanks. Please reference an issue that is explaining the problem with this test. It might already exist

[rroth-lowrisc]

@gautschimi I directly changed the references from u_keymgr to u_keymgr_dpe and remove the waivers in hw/top_earlgrey/cdc/cdc_waivers.w_recon.tcl (If necessary they can be reintroduced later on). The test error you have seen is unrelated to the keymgr_dpe integration and will be fixed in a separate PR.

Thanks. Please reference an issue that is explaining the problem with this test. It might already exist

I didn't find a issue, I opened #31000. I don't want to add the issue number somewhere in the code because its clearly related to the logger and not the keymgr_dpe integration.