cr50_ap_ro_verification

Source code: cr50_ap_ro_verification.py

A test to ensure the AP RO verification works.

Description

The test is to verify the functionality of AP RO verification in early phase (The hash is usually written in PVT), but not the correctness of the hash.

If the verification failed, then the device won’t be bootable. Reinsert the battery or cr50 reboot to recover. To avoid the risk of bricking the DUT, we should try to clear RO hash after verifying. And it’s recommended to set RO hash by ap_ro_hash.py to make sure RO hash is set correctly, .

We decided to skip this test when Board ID has already been set. This might happen when re-flowing or RMA. Details are in ap_ro_hash.py.

Test Procedure

First round (rebooted flag should be None)

1. ccd open.

2. Trigger the AP RO verification, and the device will reboot.

Second round (rebooted flag should be true)

3. Deal with the verification result.

Dependency

• The verification needs AP RO hash set, or it won’t do anything.

• OS version >= 14704.0.0 (gsctool -aB and gsctool -aB start)

• cr50 version >= 0.5.111 (vendor commands to trigger RO verification)

• In cr50 factory mode to ccd open without physical presence.

Examples

To test AP RO verification, add this to test list:

{
  "inherit": "TestGroup",
  "label": "Cr50 AP RO Verification Group",
  "subtests": [
    {
      "pytest_name": "cr50_ap_ro_hash",
      "label": "Set Cr50 AP RO Hash",
      "related_components": [
        "test_tags.TestCategory.SECURE_ELEMENT"
      ],
      "args": {
        "action": "set"
      }
    },
    {
      "pytest_name": "cr50_ap_ro_verification",
      "label": "Cr50 AP RO Verification",
      "allow_reboot": true,
      "related_components": [
        "test_tags.TestCategory.SECURE_ELEMENT"
      ]
    },
    {
      "pytest_name": "cr50_ap_ro_hash",
      "label": "Clear Cr50 AP RO Hash",
      "related_components": [
        "test_tags.TestCategory.SECURE_ELEMENT"
      ],
      "args": {
        "action": "clear"
      }
    }
  ]
}

To use manual test of AP RO verification, add this to test list:

{
  "pytest_name": "cr50_ap_ro_verification",
  "label": "Cr50 AP RO Verification Manual",
  "allow_reboot": true,
  "related_components": [
    "test_tags.TestCategory.SECURE_ELEMENT"
  ],
  "args": {
    "timeout_secs": 5,
    "manual_test": true
  }
}

Test Arguments

Name	Type	Description
timeout_secs	int	(optional; default: 5) How many seconds to wait for the RO verification key combo.
manual_test	bool	(optional; default: False) True to trigger the verification by key combo.