Skip to content

Backport 27119 ([rescue,opentitanlib,test] Rescue command disability test)#29319

Merged
pamaury merged 4 commits intolowRISC:masterfrom
pamaury:backport_27119
Feb 19, 2026
Merged

Backport 27119 ([rescue,opentitanlib,test] Rescue command disability test)#29319
pamaury merged 4 commits intolowRISC:masterfrom
pamaury:backport_27119

Conversation

@pamaury
Copy link
Contributor

@pamaury pamaury commented Feb 16, 2026

Backport #27119 and add another commit to revert a subtle behaviour change introduced in #28783

pamaury and others added 4 commits February 19, 2026 19:29
When UartConsole::wait_for was changed in 275806e, a subtle behaviour
change was introduced in the set_mode function which previously returned
the full context on error:
  mode: {mode}
  error: {error}
but after the change, only returns the error:
  error: {error}

Unfortunately, some rescue tests expect to have the full context so this
commit restores the old behavour.

Signed-off-by: Amaury Pouly <amaury.pouly@opentitan.org>
The rescue mode validation logic was updated to immediately return bad
mode if a prior error occurred and the selected service exclusively
supports either upload or download operations in the DFU implementation.

This change ensures that `opentitantool` receives an error when
sending a disallowed command for uni-directional services. However,
for services supporting both upload and download, the `opentitantool`
might not receive an error for a disallowed command depending on the
owner configuration (e.g., when only upload or download is permitted).

Signed-off-by: Anthony Chen <antchen@google.com>
(cherry picked from commit a140bc0)
This adds the `empty` function in BootSvc for creating the Empty boot
service request and updates the Rescue trait.

Signed-off-by: Anthony Chen <antchen@google.com>
(cherry picked from commit 54ff8f5)
This introduces a new test to verify rescue command disabilities. It
uses the owner block binary if provided; otherwise, it captures the
owner page 0 Base64 data from the UART console.

The test analyzes the owner block to identify disallowed rescue commands
and then attempts to execute each of them. This ensures that the device
correctly enforces the configured restrictions.

The testing approach differs slightly between rescue protocols:

- XMODEM: The test directly examines the result of the rescue operation
 to confirm if a command was disallowed by the device.
- DFU: Due to the potential for the rescue operation result to be
 inconclusive, the test primarily relies on analyzing device logs to
 determine if a command was rejected. Only when informative device logs
 are absent will the test fall back to checking the rescue operation
 result.

Signed-off-by: Anthony Chen <antchen@google.com>
(cherry picked from commit 0fe7506)
@pamaury
Copy link
Contributor Author

pamaury commented Feb 19, 2026

CI failures are unrelated

@pamaury pamaury added this pull request to the merge queue Feb 19, 2026
Merged via the queue into lowRISC:master with commit 3e05c56 Feb 19, 2026
44 of 46 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

Comments