[pentest] Add CharSramWriteReadAlt IbexFi test

This commit adds the CharSramWriteReadAlt test to the
IbexFi test framework.

Signed-off-by: Pascal Nasahl <[email protected]>
Co-authored-by: Siemen Dhooghe <[email protected]>

Author: 2 people

sw/device/tests/penetrationtests/firmware/fi/ibex_fi.c

@@ -38,6 +38,10 @@ enum {
    * Number of reference values that are available in the ref_values array.
    */
   kNumRefValues = 32,
+  /**
+   * Number of values used for the sram_write_read_alt test.
+   */
+  kSramWriteReadAltNumValues = 16,
 };
 
 // A function which takes an uint32_t as its only argument.
@@ -3318,6 +3322,96 @@ status_t handle_ibex_fi_char_sram_write_read(ujson_t *uj)
   return OK_STATUS();
 }
 
+status_t handle_ibex_fi_char_sram_write_read_alt(ujson_t *uj)
+    __attribute__((optnone)) {
+  // Clear registered alerts in alert handler.
+  pentest_registered_alerts_t reg_alerts = pentest_get_triggered_alerts();
+  // Clear the AST recoverable alerts.
+  pentest_clear_sensor_recov_alerts();
+
+  // Initialize the SRAM with a counter
+  for (size_t i = 0; i < kSramWriteReadAltNumValues; i++) {
+    sram_main_buffer[i] = i;
+  }
+
+  // Initialize the register file before the FI trigger window.
+  INIT_REGISTER_FILE
+
+  // FI code target.
+  PENTEST_ASM_TRIGGER_HIGH
+  asm volatile("sw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[0]));
+  asm volatile("lw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[0]));
+  asm volatile("sw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[1]));
+  asm volatile("lw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[1]));
+  asm volatile("sw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[2]));
+  asm volatile("lw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[2]));
+  asm volatile("sw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[3]));
+  asm volatile("lw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[3]));
+  asm volatile("sw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[4]));
+  asm volatile("lw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[4]));
+  asm volatile("sw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[5]));
+  asm volatile("lw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[5]));
+  asm volatile("sw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[6]));
+  asm volatile("lw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[6]));
+  asm volatile("sw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[7]));
+  asm volatile("lw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[7]));
+  asm volatile("sw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[8]));
+  asm volatile("lw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[8]));
+  asm volatile("sw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[9]));
+  asm volatile("lw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[9]));
+  asm volatile("sw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[10]));
+  asm volatile("lw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[10]));
+  asm volatile("sw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[11]));
+  asm volatile("lw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[11]));
+  asm volatile("sw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[12]));
+  asm volatile("lw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[12]));
+  asm volatile("sw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[13]));
+  asm volatile("lw x6, (%0)" : : "r"((uint32_t *)&sram_main_buffer[13]));
+  asm volatile("sw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[14]));
+  asm volatile("lw x7, (%0)" : : "r"((uint32_t *)&sram_main_buffer[14]));
+  asm volatile("sw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[15]));
+  asm volatile("lw x5, (%0)" : : "r"((uint32_t *)&sram_main_buffer[15]));
+  PENTEST_ASM_TRIGGER_LOW
+
+  // Dump the register file after the FI trigger window.
+  DUMP_REGISTER_FILE
+
+  // Load the values stored in the sram buffer.
+  uint32_t sram_values[kSramWriteReadAltNumValues] = {0};
+  for (size_t i = 0; i < kSramWriteReadAltNumValues; i++) {
+    sram_values[i] = sram_main_buffer[i];
+  }
+
+  // Get registered alerts from alert handler.
+  reg_alerts = pentest_get_triggered_alerts();
+  // Get fatal and recoverable AST alerts from sensor controller.
+  pentest_sensor_alerts_t sensor_alerts = pentest_get_sensor_alerts();
+
+  // Read ERR_STATUS register.
+  dif_rv_core_ibex_error_status_t codes;
+  TRY(dif_rv_core_ibex_get_error_status(&rv_core_ibex, &codes));
+
+  ibex_fi_test_result_sram_t uj_output;
+  // Preset buffers to 0.
+  memset(uj_output.memory, 0, sizeof(uj_output.memory));
+  memset(uj_output.registers, 0, sizeof(uj_output.registers));
+
+  // Return the 16 values from SRAM.
+  for (size_t it = 0; it < kSramWriteReadAltNumValues; it++) {
+    uj_output.memory[it] = sram_values[it];
+  }
+
+  // Return register file dump back to host.
+  memcpy(uj_output.registers, registers_dumped, sizeof(registers_dumped));
+  // Send result & ERR_STATUS to host.
+  uj_output.err_status = codes;
+  memcpy(uj_output.alerts, reg_alerts.alerts, sizeof(reg_alerts.alerts));
+  memcpy(uj_output.ast_alerts, sensor_alerts.alerts,
+         sizeof(sensor_alerts.alerts));
+  RESP_OK(ujson_serialize_ibex_fi_test_result_sram_t, uj, &uj_output);
+  return OK_STATUS();
+}
+
 status_t handle_ibex_fi_char_sram_write_static_unrolled(ujson_t *uj)
     __attribute__((optnone)) {
   // Clear registered alerts in alert handler.
@@ -4029,6 +4123,8 @@ status_t handle_ibex_fi(ujson_t *uj) {
       return handle_ibex_fi_char_sram_write(uj);
     case kIbexFiSubcommandCharSramWriteRead:
       return handle_ibex_fi_char_sram_write_read(uj);
+    case kIbexFiSubcommandCharSramWriteReadAlt:
+      return handle_ibex_fi_char_sram_write_read_alt(uj);
     case kIbexFiSubcommandCharSramWriteStaticUnrolled:
       return handle_ibex_fi_char_sram_write_static_unrolled(uj);
     case kIbexFiSubcommandCharUncondBranch:

sw/device/tests/penetrationtests/firmware/fi/ibex_fi.h

@@ -667,6 +667,26 @@ status_t handle_ibex_fi_char_sram_write(ujson_t *uj);
  */
 status_t handle_ibex_fi_char_sram_write_read(ujson_t *uj);
 
+/**
+ * ibex.fi.char.sram_write_read_alt command handler.
+ *
+ * This FI penetration tests executes the following instructions:
+ * - Set the trigger.
+ * - Add 10 NOPs to delay the trigger
+ * - Store a reference value in SRAM, load the value back in a different
+ * register and repeat for a different SRAM address repeated 16 times.
+ * - Unset the trigger.
+ * - Read back values from the registers and the SRAM and compare.
+ * - Return the values over UART.
+ *
+ * Faults are injected during the trigger_high & trigger_low.
+ * It needs to be ensured that the compiler does not optimize this code.
+ *
+ * @param uj An initialized uJSON context.
+ * @return OK or error.
+ */
+status_t handle_ibex_fi_char_sram_write_read_alt(ujson_t *uj);
+
 /**
  * ibex.fi.char.sram_write_static_unrolled command handler.
  *

sw/device/tests/penetrationtests/json/ibex_fi_commands.h

@@ -52,6 +52,7 @@ extern "C" {
     value(_, CharSramStatic) \
     value(_, CharSramWrite) \
     value(_, CharSramWriteRead) \
+    value(_, CharSramWriteReadAlt) \
     value(_, CharSramWriteStaticUnrolled) \
     value(_, CharUncondBranch) \
     value(_, CharUncondBranchNop) \

sw/host/penetrationtests/testvectors/data/fi_ibex.json

@@ -172,5 +172,10 @@
       "{\"result\":13,\"err_status\":0,\"alerts\":[0,0,0],\"ast_alerts\":[0,0]}",
       "{\"result\":15,\"err_status\":0,\"alerts\":[0,0,0],\"ast_alerts\":[0,0]}"
     ]
+  },
+  {
+    "test_case_id": 33,
+    "command": "CharSramWriteReadAlt",
+    "expected_output": ["{\"memory\":[2880293630,3131746989,3134333474,2880293630,3131746989,3134333474,2880293630,3131746989,3134333474,2880293630,3131746989,3134333474,2880293630,3131746989,3134333474,2880293630,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"err_status\":0,\"alerts\":[0,0,0],\"ast_alerts\":[0,0]}"]
   }
 ]