Closed korran closed 1 year ago
Is anyone looking into this issue yet? If not, I can start
@nquarton No I don't think anyone has started on this one. Thanks!
Actually, let's split this up into multiple issues so that we can parallelize the work.
I opened https://github.com/chipsalliance/caliptra-sw/issues/882 and assigned to Zach to handle the stuff related to DPE. @nquarton would you want to take the other tests?
Actually, let's split this up into multiple issues so that we can parallelize the work.
I opened #882 and assigned to Zach to handle the stuff related to DPE. @nquarton would you want to take the other tests?
- test_keyvault
- test_fw_info
- test_fips_cmd_api
I may not be able to get to these other issues for a week or two due to some other priorities. If no one else can get to them earlier, I could take a look at that point.
For the stash measurement issue (and possibly some others) the problem is verilator (and it looks like the FPGA) use a hardcoded PAUSER of 0xFFFF_FFFF. DPE expects a PAUSER of 0x1 from what's provided in the image header. This causes the DPE code to report a failure.
However PAUSER values other than 0xFFFF_FFFF are blocked by the RTL. Only 0xFFFF_FFFF is valid by default (which I'm guessing is an invalid PAUSER? or is this a HW vulnerability?). To allow others, we need to set MBOX_VALID_PAUSER and MBOX_PAUSER_LOCK. I am adding this flow to the hw-model initialization.
We also need to add support to configure the PAUSER used on the bus in all 3 models (it's not configurable in the emulator either).
Ideally, the emulator should be covering this RTL behavior of VALID_PAUSER and PAUSER lock at some point as well.
Sorry Jordan, I misunderstood what you were asking at first. I started looking at the stash measurement failure since that was the one that was in the log. I missed the top part that listed all the other failures at first. If any other DPE failures are for locality/pauser, then the fix I can make should correct those as well.
But still the same answer for the others. Exactly when I can get to them will depend on some other tasks. But I'll put it on my list and I can get to it if no one else gets a chance to.
Thanks Nick! No problem, we can look into the other failures and open separate issues.
To allow others, we need to set MBOX_VALID_PAUSER and MBOX_PAUSER_LOCK. I am adding this flow to the hw-model initialization.
We also need to add support to configure the PAUSER used on the bus in all 3 models (it's not configurable in the emulator either).
So once you've updated the hw model to set those registers, would you expect this to work for Verilator/FPGA, and then the next step would be to implement use of those registers in the emulator?
cc @zhalvorsen as FYI for why some of the tests are failing.
I think some of the other failures are because the FPGA only supports 8 KeyVaultSlots. I think we use 10 today. We should look into
So once you've updated the hw model to set those registers, would you expect this to work for Verilator/FPGA, and then the next step would be to implement use of those registers in the emulator?
Yep, I pushed a "partial" fix (https://github.com/chipsalliance/caliptra-sw/pull/893) that will change the hardcoded value for PAUSER for verilator and FPGA to 0x1. It also adds a configuration option for the HW-model to init the necessary MBOX_VALID_PAUSER reg with a default of 1 and set LOCK as well. This for sure fixes the stash measurement test on verilator. I haven't had a chance to try the other broken tests or try on FPGA.
The full solution would just add the ability to configure the PAUSER value the 3 models use. Though this could be a separate PR technically since that's really a new feature anyway.
Just an update that fix should be complete now. The emulator still doesn't support the VALID_PAUSER check but it also doesn't actually seem to emulate pauser on the bus itself so I think that's an enhancement for a later time. Both VALID_PAUSER and the pauser value we want "soc" to use are configurable now though (and apply to both verilator and FPGA).
With #970 added we can now all the caliptra-runtime::integration_tests more easily on the FPGA. caliptra-runtime::runtime_integration_tests integration_tests::test_update
is now the only test failing.
ubuntu@zynqmp:~/caliptra-sw$ CPTRA_UIO_NUM=4 cargo nextest run --no-fail-fast --features=fpga_realtime --release -E 'package(caliptra-runtime)'
Finished release [optimized] target(s) in 1.57s
Starting 23 tests across 68 binaries
PASS [ 40.528s] caliptra-runtime::runtime_integration_tests error_handling::test_wdt_timeout
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests ecdsa::ecdsa_cmd_run_wycheproof
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests hmac::hmac_cmd_run_wycheproof
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_boot
PASS [ 64.583s] caliptra-runtime::runtime_integration_tests ecdsa::ecdsa_cmd_run_wycheproof
PASS [ 73.007s] caliptra-runtime::runtime_integration_tests hmac::hmac_cmd_run_wycheproof
PASS [ 81.143s] caliptra-runtime::runtime_integration_tests integration_tests::test_boot
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_certs
PASS [ 71.445s] caliptra-runtime::runtime_integration_tests integration_tests::test_certs
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_disable_attestation_cmd
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_ecdsa_verify_cmd
PASS [ 69.842s] caliptra-runtime::runtime_integration_tests integration_tests::test_disable_attestation_cmd
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_error_cleared
PASS [ 78.127s] caliptra-runtime::runtime_integration_tests integration_tests::test_ecdsa_verify_cmd
PASS [ 87.493s] caliptra-runtime::runtime_integration_tests integration_tests::test_error_cleared
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_fips_cmd_api
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_fw_info
PASS [ 87.533s] caliptra-runtime::runtime_integration_tests integration_tests::test_fips_cmd_api
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_fw_version
PASS [ 90.422s] caliptra-runtime::runtime_integration_tests integration_tests::test_fw_info
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_idev_id_cert
PASS [ 94.166s] caliptra-runtime::runtime_integration_tests integration_tests::test_fw_version
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_idev_id_info
PASS [ 94.228s] caliptra-runtime::runtime_integration_tests integration_tests::test_idev_id_cert
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_invoke_dpe_get_certificate_chain_cmd
PASS [ 93.339s] caliptra-runtime::runtime_integration_tests integration_tests::test_idev_id_info
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_invoke_dpe_get_profile_cmd
PASS [ 84.675s] caliptra-runtime::runtime_integration_tests integration_tests::test_invoke_dpe_get_certificate_chain_cmd
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_invoke_dpe_sign_and_certify_key_cmds
PASS [ 94.239s] caliptra-runtime::runtime_integration_tests integration_tests::test_invoke_dpe_get_profile_cmd
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_pauser_privilege_level_dpe_context_thresholds
PASS [ 93.917s] caliptra-runtime::runtime_integration_tests integration_tests::test_invoke_dpe_sign_and_certify_key_cmds
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_rt_cert_with_custom_dates
PASS [ 93.420s] caliptra-runtime::runtime_integration_tests integration_tests::test_pauser_privilege_level_dpe_context_thresholds
PASS [ 86.615s] caliptra-runtime::runtime_integration_tests integration_tests::test_rt_cert_with_custom_dates
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_standard
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_stash_measurement
PASS [ 86.659s] caliptra-runtime::runtime_integration_tests integration_tests::test_standard
PASS [ 86.096s] caliptra-runtime::runtime_integration_tests integration_tests::test_stash_measurement
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_unimplemented_cmds
SLOW [> 60.000s] caliptra-runtime::runtime_integration_tests integration_tests::test_update
PASS [ 43.064s] caliptra-runtime::runtime_integration_tests test_panic_missing::test_panic_missing
PASS [ 101.508s] caliptra-runtime::runtime_integration_tests integration_tests::test_unimplemented_cmds
FAIL [ 107.993s] caliptra-runtime::runtime_integration_tests integration_tests::test_update
--- STDOUT: caliptra-runtime::runtime_integration_tests integration_tests::test_update ---
running 1 test
test integration_tests::test_update has been running for over 60 seconds
0 new_unbooted
1 ready_for_fuses is high
1 writing to cptra_bootfsm_go
10 UART:
10 UART: Running Caliptra ROM ...
11 UART:
11 UART: [state] CFI Enabled
11 UART: [state] LifecycleState = Unprovisioned
11 UART: [state] DebugLocked = No
11 UART: [state] Watchdog Timer is not started because the device is not locked for debugging
18 UART: ROM Digest: 1BB96CC8A1EAC40029BE7A2605928E2AD11ECF884FA882CE70AA59B0EE9417C1
19 UART: [kat] ++
19 UART: [kat] sha1
19 UART: [kat] SHA2-256
19 UART: [kat] SHA2-384
19 UART: [kat] SHA2-384-ACC
20 UART: [kat] ECC-384
134 UART: [kat] HMAC-384
134 UART: [kat] LMS
185 UART: [kat] --
186 UART: [cold-reset] ++
186 UART: [fht] Storing FHT @ 0x50003400
186 UART: [idev] ++
186 UART: [idev] CDI.KEYID = 6
186 UART: [idev] SUBJECT.KEYID = 7
186 UART: [idev] UDS.KEYID = 0
187 ready_for_fw is high
187 <<< Executing mbox cmd 0x46574c44 (74004 bytes) from SoC
192 UART: [idev] Erasing UDS.KEYID = 0
355 UART: [idev] Using Sha1 for KeyId Algorithm
356 UART: [idev] --
356 UART: [ldev] ++
356 UART: [ldev] CDI.KEYID = 6
356 UART: [ldev] SUBJECT.KEYID = 5
357 UART: [ldev] AUTHORITY.KEYID = 7
357 UART: [ldev] FE.KEYID = 1
357 UART: [ldev] Erasing FE.KEYID = 1
521 UART: [ldev] Signing Cert with AUTHORITY.KEYID = 7
636 UART: [ldev] PUB.X = 504D38CA45D997901F48BA333A149A2FB2668B973AAC64D3B79ECC09A663F02ED2FABA133F5FA499677AEB7687C99B25
637 UART: [ldev] PUB.Y = A5CD31125698B3322C086E4398A591946BF20A3ECEA8EB7D7C23410D49FA877E7ECFBE47BD883BD53D7DA865AC217F1D
638 UART: [ldev] SIG.R = F6A916F77E5B3B771E6C4E82926720B3E88C379D5634F7B02603253A3BFD2E5409A81AE94634387494009E5718A79FCA
639 UART: [ldev] SIG.S = 605C11001E0624CA454FF5EF88D19D2919BB78E7B52A39E37573251E0212953D0327441F638BD2F2FAE80828B4FF4544
640 UART: [ldev] --
640 UART: [fwproc] Waiting for Commands...
640 UART: [fwproc] Received command 0x46574c44
640 UART: [fwproc] Received Image of size 74004 bytes
816 UART: [fwproc] Image verified using Vendor ECC Key Index 0
820 UART: [fwproc] Loading FMC at address 0x40000000 len 13020
823 UART: [fwproc] Loading Runtime at address 0x40004000 len 55100
833 >>> mbox cmd response: success
1,172 <<< Executing mbox cmd 0x46574c44 (74004 bytes) from SoC
1,177 UART: [afmc] ++
1,177 UART: [afmc] CDI.KEYID = 6
1,177 UART: [afmc] SUBJECT.KEYID = 7
1,177 UART: [afmc] AUTHORITY.KEYID = 5
1,177 UART: ROM Fatal Error: 0x00100001
1,177 >>> mbox cmd response: failed
test integration_tests::test_update ... FAILED
failures:
failures:
integration_tests::test_update
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 22 filtered out; finished in 107.98s
--- STDERR: caliptra-runtime::runtime_integration_tests integration_tests::test_update ---
warning: unknown feature specified for `-Ctarget-feature`: `unaligned-scalar-mem`
|
= note: it is still passed through to the codegen backend
= help: consider filing a feature request
warning: unknown feature specified for `-Ctarget-feature`: `unaligned-scalar-mem`
|
= note: it is still passed through to the codegen backend
= help: consider filing a feature request
warning: unknown feature specified for `-Ctarget-feature`: `unaligned-scalar-mem`
|
= note: it is still passed through to the codegen backend
= help: consider filing a feature request
thread 'integration_tests::test_update' panicked at 'called `Result::unwrap()` on an `Err` value: MailboxCmdFailed(1048577)', runtime/tests/runtime_integration_tests/integration_tests.rs:78:10
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
------------
Summary [ 504.465s] 23 tests run: 22 passed (20 slow), 1 failed, 0 skipped
FAIL [ 107.993s] caliptra-runtime::runtime_integration_tests integration_tests::test_update
error: test run failed
test_update
fixed with #972
Closing this issue since there are no failures on the latest FPGA run on Nightly Release: https://github.com/chipsalliance/caliptra-sw/actions/runs/6596754708/job/17923180848