Isolate no cpu int

.cargo/config.toml

@@ -1,4 +1,6 @@
 # Licensed under the Apache-2.0 license
+[env]
+RUST_MIN_STACK="16777216" # 16MB
 
 [target.riscv32imc-unknown-none-elf]
 rustflags = [

.config/nextest.toml

@@ -1,17 +1,107 @@
 # Licensed under the Apache-2.0 license
 
+# TODO(#2369): Remove the extra filters after fixing the broken tests
+[profile.fpga-subsystem]
+default-filter = """package(caliptra-api) +
+package(caliptra-api-types) +
+package(caliptra-auth-man-types) +
+package(caliptra-cfi-lib) +
+package(caliptra-coverage) +
+(package(caliptra-drivers) - test(test_doe_when_debug_locked) - test(test_ecc384_sign_validation_failure) - test(test_csrng_runtime_health_failure)) +
+package(caliptra-error) +
+(package(caliptra-hw-model) - test(tests::test_axi) - test(tests::test_mbox) - test(tests::test_mbox_negative) - binary_id(caliptra-hw-model::model_tests) - test(tests::test_negative_soc_mgr_mbox_users)) +
+package(caliptra-hw-model-types) +
+package(caliptra-image-crypto) +
+package(caliptra-image-elf) +
+package(caliptra-image-types) +
+package(caliptra-lms-types) +
+package(caliptra-size-history) +
+package(caliptra-systemrdl) +
+package(caliptra-verilated) +
+package(caliptra-x509) +
+package(caliptra-ureg) +
+package(caliptra-ureg-codegen) +
+package(caliptra-ureg-schema) +
+package(caliptra-ureg-systemrdl)
+"""
+failure-output = "immediate-final"
+fail-fast = false
+slow-timeout = { period = "30s", terminate-after = 6 }
+retries = 3 # the fpga subsystem is a bit flaky with typically 1 test randomly failing out of 100-200
+
+[[profile.fpga-subsystem.overrides]]
+filter = 'test(test_rt_journey_pcr_validation)'
+slow-timeout = { period = "30s", terminate-after = 10 }
+
+[profile.fpga-subsystem.junit]
+path = "/tmp/junit.xml"
+store-success-output = true
+store-failure-output = true
+
+# TODO(#2369): Remove the extra filters after fixing the broken tests
+# test(test_csrng_runtime_health_failure): entropy on FPGA seems to be behaving a bit differently and does not fail the test immediately, as expected
+[profile.fpga-core]
+default-filter = """
+not (package(/caliptra-emu-.*/) |
+    package(caliptra-builder) |
+    package(caliptra-cfi-derive) |
+    package(caliptra-file-header-fix) |
+    package(compliance-test) |
+    test(test_sign_validation_failure) |
+    test(test_activate_firmware::test_activate_fw_id_not_in_manifest) |
+    test(test_activate_firmware::test_activate_invalid_fw_id) |
+    test(test_activate_firmware::test_activate_mcu_fw_success) |
+    test(test_activate_firmware::test_activate_mcu_soc_fw_success) |
+    test(test_activate_firmware::test_activate_soc_fw_success) |
+    test(test_activate_firmware::test_invalid_exec_bit_in_manifest) |
+    test(test_authorize_and_stash::test_authorize_from_load_address) |
+    test(test_authorize_and_stash::test_authorize_from_load_address_incorrect_digest) |
+    test(test_authorize_and_stash::test_authorize_from_staging_address) |
+    test(test_authorize_and_stash::test_authorize_from_staging_address_incorrect_digest) |
+    test(test_csrng_runtime_health_failure) |
+    test(test_debug_unlock::test_dbg_unlock_prod_wrong_public_keys) |
+    test(test_fe_programming::test_fe_programming_cmd) |
+    test(test_fips::test_fips_shutdown) |
+    test(test_lms::test_lms_verify_cmd) |
+    test(test_lms::test_lms_verify_failure) |
+    test(test_lms::test_lms_verify_invalid_key_lms_type) |
+    test(test_lms::test_lms_verify_invalid_lmots_type) |
+    test(test_lms::test_lms_verify_invalid_sig_lms_type) |
+    test(test_rtalias::test_boot_status_reporting) |
+    binary_id(caliptra-test::fips_test_suite) |
+    test(test_update_reset::test_update_reset_verify_image_failure) |
+    test(test_debug_unlock::test_dbg_unlock_prod_unlock_levels_success) |
+    test(test_debug_unlock::test_dbg_unlock_prod_unlock_levels_failure))
+"""
+failure-output = "immediate-final"
+fail-fast = false
+slow-timeout = { period = "30s", terminate-after = 6 }
+
+[profile.fpga-core.junit]
+path = "/tmp/junit.xml"
+store-success-output = true
+store-failure-output = true
+
 [profile.nightly]
 failure-output = "immediate-final"
 fail-fast = false
 slow-timeout = { period = "30s", terminate-after = 6 }
 
 [[profile.nightly.overrides]]
 filter = 'test(test_generate_csr_envelop_stress)'
-slow-timeout = { period = "30s", terminate-after = 140 }
+slow-timeout = { period = "30s", terminate-after = 180 }
+
+[[profile.nightly.overrides]]
+filter = 'test(test_binaries_are_identical)'
+slow-timeout = { period = "30s", terminate-after = 30 }
 
 [[profile.nightly.overrides]]
 filter = 'test(test_stress_update)'
-slow-timeout = { period = "30s", terminate-after = 17 }
+slow-timeout = { period = "30s", terminate-after = 100 }
+
+[[profile.nightly.overrides]]
+filter = 'test(test_pl0_pl1_reallocation_range)'
+slow-timeout = { period = "30s", terminate-after = 24 }
 
 [profile.nightly.junit]
 path = "/tmp/junit.xml"

.github/workflows/build-test-verilator.yml

@@ -6,6 +6,7 @@ on:
   push:
     branches: ["main"]
   pull_request:
+  merge_group:
 
   workflow_call:
   workflow_dispatch:

.github/workflows/build-test.yml

@@ -6,6 +6,7 @@ on:
   push:
     branches: ["main"]
   pull_request:
+  merge_group:
 
   workflow_call:
   workflow_dispatch:
@@ -33,10 +34,6 @@ jobs:
         run: |
           echo "Build-Test: release_ref=$(git rev-parse HEAD)"
 
-      - name: Pull dpe submodule
-        run: |
-          git submodule update --init dpe
-
       - name: Install required packages
         run: |
           sudo apt-get update -qy && sudo apt-get install libftdi1-dev libusb-1.0-0-dev golang-1.21-go

.github/workflows/code-coverage.yml

@@ -0,0 +1,46 @@
+name: Code Coverage
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    runs-on: ubuntu-24.04
+
+    env:
+      CARGO_INCREMENTAL: 0
+      CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
+      PR_TITLE: ${{github.event.pull_request.title}}
+      PR_BASE_COMMIT: ${{github.event.pull_request.base.sha}}
+      GIT_AUTHOR_NAME: ${{github.event.pull_request.user.login}}
+      GIT_AUTHOR_EMAIL: ${{github.event.pull_request.user.id}}+${{github.event.pull_request.user.login}}@users.noreply.github.com
+      GIT_COMMITTER_NAME: ${{github.event.pull_request.user.login}}
+      GIT_COMMITTER_EMAIL: ${{github.event.pull_request.user.id}}+${{github.event.pull_request.user.login}}@users.noreply.github.com
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Configure actions-cache environment variables
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
+            core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
+
+      - name: Run code coverage analysis (look at workflow "Summary" tab for results)
+        run: |
+          cargo install rustfilt
+          ./ci.sh build_fw test > coverage.txt || true
+          sed -i -n '/coverage files found$/,$p' coverage.txt
+
+          echo '# Code Coverage' >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          cat coverage.txt | rustfilt >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY

.github/workflows/fpga-image.yml

@@ -19,57 +19,66 @@ on:
     - cron: '13 13 * * 2,4'
 
   workflow_call:
+    inputs:
+      branch:
+        default: ${{ github.sha }}
+        type: string
   workflow_dispatch:
-
 jobs:
   build_kernel:
     runs-on: [e2-standard-32, vck190-tools]
     strategy:
       matrix:
-        image_variant: [core-2.0, core-2.1, subsystem-2.0, subsystem-2.1]
+        image_variant: [core, subsystem]
         include:
-          - bitstream_hash: cb66e3117cab78bf503cfb15a5e1c4c6fc895dc810ad49b78a9de18180837f47
-            image_variant: core-2.0
-          - bitstream_name: xsa_core2p0_865bf243.xsa
-            image_variant: core-2.0
-          - bitstream_hash: e9b08c20a75e5294b660bddecdd2897677c4c63d2d9806180123b229f78631d4
-            image_variant: core-2.1
-          - bitstream_name: xsa_core2p1_85dadbc6.xsa
-            image_variant: core-2.1
-          - bitstream_hash: 71b0ffd91dab7344a110d03b98b95c314a31f5763e5f56819c3d657de908c5cf
-            image_variant: subsystem-2.0
-          - bitstream_name: xsa_ss2p0_24c0ea0b.xsa
-            image_variant: subsystem-2.0
-          - bitstream_hash: 4f27c7d21898cb6df2145d03eae07be86b98e925173eb5b7df280e813db9c179
-            image_variant: subsystem-2.1
-          - bitstream_name: xsa_ss2p1_e845cd0e.xsa
-            image_variant: subsystem-2.1
+          - bitstream_hash: e5cf1d375502dc9105becaa16c1c996a65ed1dcf153a688c7f098d51e66ba6ae
+            image_variant: core
+          - bitstream_name: xsa_core2p0_5d069408.xsa
+            image_variant: core
+          - bitstream_hash: 8fade301b2d2d4864a8586b5fea2cf8a80a76102afc711a940f66d7df79e30b3
+            image_variant: subsystem
+          - bitstream_name: xsa_ss2p0_b9f8a767.xsa
+            image_variant: subsystem
     env:
       IMAGE_VARIANT: ${{ matrix.image_variant }}
       BITSTREAM_NAME: ${{ matrix.bitstream_name }}
       BITSTREAM_SHA256: ${{ matrix.bitstream_hash }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.branch }}
+
+      - name: Cache Kernel output
+        id: cache-kernel
+        uses: actions/cache@v4
+        with:
+          path: |
+            /tmp/vck190-kernel-${{ matrix.image_variant }}.tar.gz
+            /tmp/io-module-${{ matrix.image_variant }}.ko
+          key: kernel-${{ matrix.image_variant }}-${{ matrix.bitstream_hash }}
 
       - name: Install pre-requisites
+        if: steps.cache-kernel.outputs.cache-hit != 'true'
         run: |
           sudo dpkg --add-architecture i386
           sudo apt-get update
           sudo apt install gcc libncurses-dev zlib1g:i386 zlib1g-dev net-tools xterm autoconf libtool texinfo gcc-multilib build-essential device-tree-compiler xvfb apt-transport-https ca-certificates gnupg curl -y
 
       - name: Mount FPGA tools
+        if: steps.cache-kernel.outputs.cache-hit != 'true'
         run: |
           echo "Starting work"
           sudo mkdir /vck190-tools
           sudo mount UUID=249f0fea-68c1-4e14-af09-5294e50e20b1 /vck190-tools/
 
       - name: Build Kernel
+        if: steps.cache-kernel.outputs.cache-hit != 'true'
         run: |
           echo "Building kernel for bitstream variant ${IMAGE_VARIANT}"
           source /vck190-tools/petalinux-tool/settings.sh
 
-          sudo scp /vck190-tools/caliptra-bitstreams/20250826/${BITSTREAM_NAME} /tmp/system.xsa
+          curl "https://storage.googleapis.com/caliptra-github-ci-bitstreams/v0/20251201/${BITSTREAM_NAME}" -o /tmp/system.xsa
 
           if ! (echo "${BITSTREAM_SHA256} /tmp/system.xsa" | sudo sha256sum -c); then
             echo "Bitstream does not match expected hash."
@@ -80,7 +89,7 @@ jobs:
 
           pushd hw/fpga
 
-          if [[ "$IMAGE_VARIANT" == "subsystem-2.0" || "$IMAGE_VARIANT" == "subsystem-2.1" ]]; then
+          if [[ "$IMAGE_VARIANT" == "subsystem" ]]; then
             export BUILD_SS=true
           fi
 
@@ -110,16 +119,18 @@ jobs:
           retention-days: 1
 
   build_sd_image:
-    runs-on: ubuntu-22.04
+    runs-on: [e2-standard-4, big-disk]
     needs: [build_kernel]
     strategy:
       matrix:
-        image_variant: [core-2.0, core-2.1, subsystem-2.0, subsystem-2.1]
+        image_variant: [core, subsystem]
     env:
       IMAGE_VARIANT: ${{ matrix.image_variant }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.branch }}
 
       - name: 'Download kernel artifact'
         uses: actions/download-artifact@v4
@@ -138,11 +149,25 @@ jobs:
           sudo apt-get update
           sudo apt-get -y install debootstrap binfmt-support qemu-user-static u-boot-tools gcc-aarch64-linux-gnu
           rustup target add aarch64-unknown-linux-gnu
+          cargo +1.88 install cross --git https://github.com/cross-rs/cross --root /tmp/cross
 
-      - name: Build SD image
+      - name: Build SD images
         run: |
+          # Build Dev image
           cd ci-tools/fpga-image
-          sudo KERNEL_ARCHIVE=/tmp/vck190-kernel/vck190-kernel-${IMAGE_VARIANT}.tar.gz KERNEL_MODULE_ARCHIVE=/tmp/vck190-kmod/io-module-${IMAGE_VARIANT}.ko bash build.sh
+          sudo PATH="$PATH:/tmp/cross/bin" BUILD_DEV_IMAGE=true KERNEL_ARCHIVE=/tmp/vck190-kernel/vck190-kernel-${IMAGE_VARIANT}.tar.gz KERNEL_MODULE_ARCHIVE=/tmp/vck190-kmod/io-module-${IMAGE_VARIANT}.ko bash build.sh
+          # Save Dev image for upload
+          sudo mv out/image.img dev-image.img
+          sudo rm -rf out/
+          # Now build CI image
+          sudo PATH="$PATH:/tmp/cross/bin" BUILD_DEV_IMAGE=false KERNEL_ARCHIVE=/tmp/vck190-kernel/vck190-kernel-${IMAGE_VARIANT}.tar.gz KERNEL_MODULE_ARCHIVE=/tmp/vck190-kmod/io-module-${IMAGE_VARIANT}.ko bash build.sh
+
+      - name: 'Upload dev-image as artifact'
+        uses: actions/upload-artifact@v4
+        with:
+          name: caliptra-fpga-image-${{ matrix.image_variant }}-dev
+          path: ci-tools/fpga-image/dev-image.img
+          retention-days: 90
 
       - name: 'Upload image as artifact'
         uses: actions/upload-artifact@v4