Skip to content

[TB] Add smoke_test_fc_filter_rule_write_zer_id for fuse_ctrl_filter …#1061

Open
ekarabu wants to merge 2 commits intopatch_ss_v2.1from
user/ekarabulut/fc-filter-write-zeroize-id-coverage_2.1_patch
Open

[TB] Add smoke_test_fc_filter_rule_write_zer_id for fuse_ctrl_filter …#1061
ekarabu wants to merge 2 commits intopatch_ss_v2.1from
user/ekarabulut/fc-filter-write-zeroize-id-coverage_2.1_patch

Conversation

@ekarabu
Copy link
Collaborator

@ekarabu ekarabu commented Feb 27, 2026

…coverage (#1056)

  • Add smoke_test_fc_filter_rule_write_zer_id for fuse_ctrl_filter coverage

    Add a new integration test targeting four uncovered paths in the
    fuse_ctrl_filter FSM (FUSE_ADDR_AXI_WR_ST and FUSE_CMD_AXI_ADDR_ST states):

    Scenario 1 - trigger_table_check in FUSE_ADDR_AXI_WR_ST:
    Writing DIRECT_ACCESS_ADDRESS twice in succession causes the FSM to
    see trigger_table_check while already in FUSE_ADDR_AXI_WR_ST, exercising
    the re-latch-and-loop-back path to FUSE_ADDR_AXI_ADDR_ST.

    Issuing a DaiWrite from the MCU user to a secret partition address
    (SECRET_MANUF_PARTITION). The MCU user is not in the access_control_table
    for the secret range [0x48,0xF0], so wr_req_allowed evaluates to false
    and the filter asserts discard_fuse_write.

    Writing WDATA_0 and WDATA_1 with MCU user, then switching to Caliptra
    core user for ADDRESS and CMD. The command is authorized (Caliptra core
    matches entry[0]), but the latched data IDs (MCU) differ from the
    address/command IDs (Caliptra core), making all_same_id false. The
    filter discards the write.

    Writing DIRECT_ACCESS_ADDRESS with MCU user, then switching to Caliptra
    core user for the DaiZeroize CMD. A non-secret partition (SW_MANUF_PARTITION
    at 0xF8) is targeted so the FIPS zeroization check passes, and the command
    is authorized, but addr_and_cmd_same_id is false because the address writer
    differs from the command writer. The filter discards the zeroize.

  • removed hard-coded line numbers

  • added new fc cov test to the regression list

  • Cover the false-branch of line 172 in mci_lcc_st_trans.sv where │ │
    │ │ lcc_volatile_raw_unlock_success_i is HIGH but state_error is also HIGH, │ │
    │ │ keeping the FSM in TRANSLATOR_NON_DEBUG instead of transitioning to │ │
    │ │ TRANSLATOR_UNPROV_DEBUG. This is a security-critical guard that prevents │ │
    │ │ debug unlock when a fatal state error is active. │ │
    │ │ │ │
    │ │ Changes: │ │
    │ │ - Add CMD_MCI_FORCE_STATE_ERROR/CMD_MCI_RELEASE_STATE_ERROR BFM commands │ │
    │ │ to caliptra_ss_tb_cmd_list.svh, caliptra_ss_lib.h, and │ │
    │ │ fc_lcc_tb_services.sv (force/release state_error on │ │
    │ │ MCI_PATH.LCC_state_translator) │ │
    │ │ - Add caliptra_ss_lcc_volatile_unlock_with_state_error test that boots │ │
    │ │ to RAW, forces state_error, performs volatile raw unlock, and verifies │ │
    │ │ the MCI translator stays locked │ │
    │ │ - Fix UnProvSIGNAL_with_Volatile_Decoding_A assertion to disable when │ │
    │ │ state_error is active (the assertion incorrectly fired when state_error │ │
    │ │ legitimately blocks the volatile unlock promotion) │ │
    │ │ - Register test in master test list and regenerate regression YAMLs │ │

  • removed the hard-coded line number

  • removed assertion change on RTL

  • MICROSOFT AUTOMATED PIPELINE: Stamp 'user/ekarabulut/fc-filter-write-zeroize-id-coverage' with updated timestamp and hash after successful run

  • updated assertion label

…coverage (#1056)

* Add smoke_test_fc_filter_rule_write_zer_id for fuse_ctrl_filter coverage

   Add a new integration test targeting four uncovered paths in the
   fuse_ctrl_filter FSM (FUSE_ADDR_AXI_WR_ST and FUSE_CMD_AXI_ADDR_ST states):

   Scenario 1 - trigger_table_check in FUSE_ADDR_AXI_WR_ST:
     Writing DIRECT_ACCESS_ADDRESS twice in succession causes the FSM to
     see trigger_table_check while already in FUSE_ADDR_AXI_WR_ST, exercising
     the re-latch-and-loop-back path to FUSE_ADDR_AXI_ADDR_ST.

     Issuing a DaiWrite from the MCU user to a secret partition address
     (SECRET_MANUF_PARTITION). The MCU user is not in the access_control_table
     for the secret range [0x48,0xF0], so wr_req_allowed evaluates to false
     and the filter asserts discard_fuse_write.

     Writing WDATA_0 and WDATA_1 with MCU user, then switching to Caliptra
     core user for ADDRESS and CMD. The command is authorized (Caliptra core
     matches entry[0]), but the latched data IDs (MCU) differ from the
     address/command IDs (Caliptra core), making all_same_id false. The
     filter discards the write.

     Writing DIRECT_ACCESS_ADDRESS with MCU user, then switching to Caliptra
     core user for the DaiZeroize CMD. A non-secret partition (SW_MANUF_PARTITION
     at 0xF8) is targeted so the FIPS zeroization check passes, and the command
     is authorized, but addr_and_cmd_same_id is false because the address writer
     differs from the command writer. The filter discards the zeroize.

* removed hard-coded line numbers

* added new fc cov test to the regression list

* Cover the false-branch of line 172 in mci_lcc_st_trans.sv where                                                                                                                                                                                                                                                                              │ │
│ │ lcc_volatile_raw_unlock_success_i is HIGH but state_error is also HIGH,                                                                                                                                                                                                                                                                      │ │
│ │ keeping the FSM in TRANSLATOR_NON_DEBUG instead of transitioning to                                                                                                                                                                                                                                                                          │ │
│ │ TRANSLATOR_UNPROV_DEBUG. This is a security-critical guard that prevents                                                                                                                                                                                                                                                                     │ │
│ │ debug unlock when a fatal state error is active.                                                                                                                                                                                                                                                                                             │ │
│ │                                                                                                                                                                                                                                                                                                                                              │ │
│ │ Changes:                                                                                                                                                                                                                                                                                                                                     │ │
│ │ - Add CMD_MCI_FORCE_STATE_ERROR/CMD_MCI_RELEASE_STATE_ERROR BFM commands                                                                                                                                                                                                                                                                     │ │
│ │   to caliptra_ss_tb_cmd_list.svh, caliptra_ss_lib.h, and                                                                                                                                                                                                                                                                                     │ │
│ │   fc_lcc_tb_services.sv (force/release state_error on                                                                                                                                                                                                                                                                                        │ │
│ │   MCI_PATH.LCC_state_translator)                                                                                                                                                                                                                                                                                                             │ │
│ │ - Add caliptra_ss_lcc_volatile_unlock_with_state_error test that boots                                                                                                                                                                                                                                                                       │ │
│ │   to RAW, forces state_error, performs volatile raw unlock, and verifies                                                                                                                                                                                                                                                                     │ │
│ │   the MCI translator stays locked                                                                                                                                                                                                                                                                                                            │ │
│ │ - Fix UnProvSIGNAL_with_Volatile_Decoding_A assertion to disable when                                                                                                                                                                                                                                                                        │ │
│ │   state_error is active (the assertion incorrectly fired when state_error                                                                                                                                                                                                                                                                    │ │
│ │   legitimately blocks the volatile unlock promotion)                                                                                                                                                                                                                                                                                         │ │
│ │ - Register test in master test list and regenerate regression YAMLs                                                                                                                                                                                                                                                                               │ │

* removed the hard-coded line number

* removed assertion change on RTL

* MICROSOFT AUTOMATED PIPELINE: Stamp 'user/ekarabulut/fc-filter-write-zeroize-id-coverage' with updated timestamp and hash after successful run

* updated assertion label

* MICROSOFT AUTOMATED PIPELINE: Stamp 'user/ekarabulut/fc-filter-write-zeroize-id-coverage' with updated timestamp and hash after successful run
# Conflicts:
#	.github/workflow_metadata/pr_hash
#	.github/workflow_metadata/pr_timestamp
@ekarabu ekarabu requested a review from calebofearth February 27, 2026 21:56
…zeroize-id-coverage_2.1_patch' with updated timestamp and hash after successful run
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants