Skip to content

Attempt a basic PC range check as part of hubris.validate #711

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
evan-oxide merged 15 commits into from
Jul 20, 2026
Merged

Attempt a basic PC range check as part of hubris.validate #711

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
a83aee2
Attempt a basic PC range check as part of `hubris.validate`
labbott Jul 7, 2026
dc1913a
restart core after checking PC
evan-oxide Jul 8, 2026
bed7f1d
add read_image_id_from_flash()
evan-oxide Jul 8, 2026
e2bd6e0
don't call validate() before flashing, just check ID
evan-oxide Jul 8, 2026
aaf059c
warn before flashing if the PC suggests this is the wrong A/B image
evan-oxide Jul 8, 2026
fb74643
document is_pc_within_archive
evan-oxide Jul 9, 2026
09c14c0
use separate error variants for actual mismatch vs failure to check
evan-oxide Jul 9, 2026
7bf64fc
mention bootloader and ROM in error message
evan-oxide Jul 13, 2026
a850276
remove redundant PC check
evan-oxide Jul 13, 2026
ef94971
add comment about single-task dumps
evan-oxide Jul 13, 2026
4c24704
overwrite tests that just have a different error message now
evan-oxide Jul 13, 2026
c27ff89
overwrite flash-ram-mismatch tests that started erroring
evan-oxide Jul 13, 2026
d8bb485
overwrite in_bootloader tests that started erroring
evan-oxide Jul 13, 2026
681ac5b
don't leave core halted if PC check fails
evan-oxide Jul 13, 2026
970d18e
refactor is_pc_within_archive using PcResult
evan-oxide Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...ity-bin/tests/cmd/counters-ipc-filtered/counters-ipc-filtered.flash-ram-mismatch.0.stderr
View file
Open in desktop

@evan-oxide evan-oxide Jul 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I split up the test-case fixes into 3 commits. The first is straightforward changes like this file, where just the error message changed. But the other two are tests where the command used to succeed (or appear to succeed?) but now fails the PC check. Does anyone disagree with any of these changes and think that we should allow someone to, for example, run humility readvar while in the bootloader? If so, that might be a reason to add a --skip-pc-check flag.

@labbott labbott Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm inclined to say that the change is fine and that it's okay to give failures if we're in the bootloader. For the SP in particular we should never expect to end up in the bootloader so any attempt to read things from hubris RAM is likely to be questionable.

The RoT may be a more interesting case because we do expect to briefly go through a non-hubris bootloader but that code is designed to be so minimal I think rejecting it is okay. Really I think if future us actually finds a situation where something like --skip-pc-check is valuable/solves a real problem I think we can add it then.

Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
humility: attached to dump
humility counters failed: no IPC counters found
humility counters failed: image ID matches but PC at 0x1ff0a6e0 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/counters-ipc-filtered/counters-ipc-filtered.in_bootloader.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
humility: attached to dump
humility counters failed: no IPC counters found
humility counters failed: image ID matches but PC at 0x1ff0a612 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/counters-ipc-full/counters-ipc-full.flash-ram-mismatch.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
humility: attached to dump
humility counters failed: no IPC counters found
humility counters failed: image ID matches but PC at 0x1ff0a6e0 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/counters-ipc-full/counters-ipc-full.in_bootloader.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
humility: attached to dump
humility counters failed: no IPC counters found
humility counters failed: image ID matches but PC at 0x1ff0a612 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/counters-ipc/counters-ipc.flash-ram-mismatch.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
humility: attached to dump
humility counters failed: no IPC counters found
humility counters failed: image ID matches but PC at 0x1ff0a6e0 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/counters-ipc/counters-ipc.in_bootloader.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
humility: attached to dump
humility counters failed: no IPC counters found
humility counters failed: image ID matches but PC at 0x1ff0a612 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/host-panic/host-panic.flash-ram-mismatch.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
humility: attached to dump
humility host failed: Could not find host boot variables under any known name; is this a Gimlet image?
humility host failed: image ID matches but PC at 0x1ff0a6e0 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/host-panic/host-panic.in_bootloader.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
humility: attached to dump
humility host failed: Could not find host boot variables under any known name; is this a Gimlet image?
humility host failed: image ID matches but PC at 0x1ff0a612 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
1 change: 1 addition & 0 deletions humility-bin/tests/cmd/readvar-ticks/readvar-ticks.flash-ram-mismatch.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
humility: attached to dump
humility readvar failed: image ID matches but PC at 0x1ff0a6e0 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
12 changes: 0 additions & 12 deletions humility-bin/tests/cmd/readvar-ticks/readvar-ticks.flash-ram-mismatch.0.stdout
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +0,0 @@
kern::arch::arm_m::TICKS (0x200012b8) = [
AtomicU32 {
v: UnsafeCell<u32> {
value: 0x20000fc0
}
},
AtomicU32 {
v: UnsafeCell<u32> {
value: 0x7861f
}
}
]
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/readvar-ticks/readvar-ticks.flash-ram-mismatch.0.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@
fs.base = "../cores"
bin.name = "humility"
args = "-d hubris.core.flash-ram-mismatch.0 readvar TICKS"

status.code = 1
1 change: 1 addition & 0 deletions humility-bin/tests/cmd/readvar-ticks/readvar-ticks.in_bootloader.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
humility: attached to dump
humility readvar failed: image ID matches but PC at 0x1ff0a612 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
12 changes: 0 additions & 12 deletions humility-bin/tests/cmd/readvar-ticks/readvar-ticks.in_bootloader.0.stdout
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +0,0 @@
kern::arch::arm_m::TICKS (0x200012b8) = [
AtomicU32 {
v: UnsafeCell<u32> {
value: 0xed8bc
}
},
AtomicU32 {
v: UnsafeCell<u32> {
value: 0x0
}
}
]
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/readvar-ticks/readvar-ticks.in_bootloader.0.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@
fs.base = "../cores"
bin.name = "humility"
args = "-d hubris.core.in_bootloader.0 readvar TICKS"

status.code = 1
1 change: 1 addition & 0 deletions humility-bin/tests/cmd/ringbuf-arg/ringbuf-arg.flash-ram-mismatch.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
humility: attached to dump
humility ringbuf failed: image ID matches but PC at 0x1ff0a6e0 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
106 changes: 0 additions & 106 deletions humility-bin/tests/cmd/ringbuf-arg/ringbuf-arg.flash-ram-mismatch.0.stdout
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,106 +0,0 @@
humility: ring buffer drv_i2c_devices::adm1272::__RINGBUF in power:
NDX LINE GEN COUNT PAYLOAD
0 104 61 1 WriteConfig(CommandData(0x3f3d))
1 104 61 1 WriteConfig(CommandData(0x3f37))
2 104 61 1 WriteConfig(CommandData(0x3f3d))
3 104 61 1 WriteConfig(CommandData(0x3f37))
4 104 61 1 WriteConfig(CommandData(0x3f3d))
5 104 61 1 WriteConfig(CommandData(0x3f37))
6 104 61 1 WriteConfig(CommandData(0x3f3d))
7 104 61 1 WriteConfig(CommandData(0x3f37))
8 104 61 1 WriteConfig(CommandData(0x3f3d))
9 104 61 1 WriteConfig(CommandData(0x3f37))
10 104 61 1 WriteConfig(CommandData(0x3f3d))
11 104 61 1 WriteConfig(CommandData(0x3f37))
12 104 61 1 WriteConfig(CommandData(0x3f3d))
13 104 61 1 WriteConfig(CommandData(0x3f37))
14 104 61 1 WriteConfig(CommandData(0x3f3d))
15 104 61 1 WriteConfig(CommandData(0x3f37))
16 104 61 1 WriteConfig(CommandData(0x3f3d))
17 104 61 1 WriteConfig(CommandData(0x3f37))
18 104 61 1 WriteConfig(CommandData(0x3f3d))
19 104 61 1 WriteConfig(CommandData(0x3f37))
20 104 61 1 WriteConfig(CommandData(0x3f3d))
21 104 61 1 WriteConfig(CommandData(0x3f37))
22 104 61 1 WriteConfig(CommandData(0x3f3d))
23 104 61 1 WriteConfig(CommandData(0x3f37))
24 104 61 1 WriteConfig(CommandData(0x3f3d))
25 104 61 1 WriteConfig(CommandData(0x3f37))
26 104 61 1 WriteConfig(CommandData(0x3f3d))
27 104 61 1 WriteConfig(CommandData(0x3f37))
28 104 61 1 WriteConfig(CommandData(0x3f3d))
29 104 61 1 WriteConfig(CommandData(0x3f37))
30 104 61 1 WriteConfig(CommandData(0x3f3d))
31 104 61 1 WriteConfig(CommandData(0x3f37))
humility: ring buffer drv_stm32h7_i2c::__RINGBUF in i2c_driver:
NDX LINE GEN COUNT PAYLOAD
35 514 7114 1 WriteWaitISR(0x8020)
36 514 7114 2 WriteWaitISR(0x8021)
37 514 7114 1 WriteWaitISR(0x8061)
38 576 7114 2 ReadISR(0x8021)
39 576 7114 1 ReadISR(0x8025)
40 576 7114 2 ReadISR(0x8021)
41 576 7114 1 ReadISR(0x8025)
42 611 7114 3 ReadWaitISR(0x8021)
43 611 7114 1 ReadWaitISR(0x8061)
44 394 7114 1 WaitISR(0x21)
45 484 7114 1 WriteISR(0x21)
46 484 7114 2 WriteISR(0x8021)
47 484 7114 1 WriteISR(0x8023)
0 514 7115 1 WriteWaitISR(0x8020)
1 514 7115 2 WriteWaitISR(0x8021)
2 514 7115 1 WriteWaitISR(0x8061)
3 576 7115 2 ReadISR(0x8021)
4 576 7115 1 ReadISR(0x8025)
5 576 7115 2 ReadISR(0x8021)
6 576 7115 1 ReadISR(0x8025)
7 611 7115 3 ReadWaitISR(0x8021)
8 611 7115 1 ReadWaitISR(0x8061)
9 394 7115 1 WaitISR(0x21)
10 484 7115 1 WriteISR(0x21)
11 484 7115 2 WriteISR(0x8021)
12 484 7115 1 WriteISR(0x8023)
13 514 7115 1 WriteWaitISR(0x8020)
14 514 7115 2 WriteWaitISR(0x8021)
15 514 7115 1 WriteWaitISR(0x8061)
16 576 7115 2 ReadISR(0x8021)
17 576 7115 1 ReadISR(0x8025)
18 576 7115 2 ReadISR(0x8021)
19 576 7115 1 ReadISR(0x8025)
20 611 7115 3 ReadWaitISR(0x8021)
21 611 7115 1 ReadWaitISR(0x8061)
22 394 7115 1 WaitISR(0x21)
23 484 7115 1 WriteISR(0x21)
24 484 7115 2 WriteISR(0x8021)
25 484 7115 1 WriteISR(0x8023)
26 514 7115 1 WriteWaitISR(0x8020)
27 514 7115 2 WriteWaitISR(0x8021)
28 514 7115 1 WriteWaitISR(0x8061)
29 576 7115 2 ReadISR(0x8021)
30 576 7115 1 ReadISR(0x8025)
31 576 7115 2 ReadISR(0x8021)
32 576 7115 1 ReadISR(0x8025)
33 611 7115 3 ReadWaitISR(0x8021)
34 611 7115 1 ReadWaitISR(0x8061)
humility: ring buffer drv_stm32h7_i2c::__RINGBUF in spd:
NDX LINE GEN COUNT PAYLOAD
0 764 1 1 AddrISR(0x1)
1 787 1 1 WaitAddr
humility: ring buffer drv_stm32h7_i2c_server::__RINGBUF in i2c_driver:
NDX LINE GEN COUNT PAYLOAD
10 134 92 1 None
11 112 92 1 Some(NoDevice)
12 112 92 1 Some(BusLocked)
13 134 92 1 None
14 112 92 1 Some(NoDevice)
15 112 92 1 Some(BusLocked)
0 134 93 1 None
1 112 93 1 Some(NoDevice)
2 112 93 1 Some(BusLocked)
3 134 93 1 None
4 112 93 1 Some(NoDevice)
5 112 93 1 Some(BusLocked)
6 134 93 1 None
7 112 93 1 Some(NoDevice)
8 112 93 1 Some(BusLocked)
9 134 93 1 None
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/ringbuf-arg/ringbuf-arg.flash-ram-mismatch.0.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@
fs.base = "../cores"
bin.name = "humility"
args = "-d hubris.core.flash-ram-mismatch.0 ringbuf i2c"

status.code = 1
1 change: 1 addition & 0 deletions humility-bin/tests/cmd/ringbuf-arg/ringbuf-arg.in_bootloader.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
humility: attached to dump
humility ringbuf failed: image ID matches but PC at 0x1ff0a612 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
82 changes: 0 additions & 82 deletions humility-bin/tests/cmd/ringbuf-arg/ringbuf-arg.in_bootloader.0.stdout
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,82 +0,0 @@
humility: ring buffer drv_i2c_devices::adm1272::__RINGBUF in power:
NDX LINE GEN COUNT PAYLOAD
0 94 1 1 Config(CommandData(0x3f3f))
1 147 1 1 Coefficients(Coefficients { m: 0xfde, b: 0x0, R: 0xfe })
2 165 1 1 Coefficients(Coefficients { m: 0x297, b: 0x5000, R: 0xff })
3 193 1 1 Coefficients(Coefficients { m: 0x2927, b: 0x0, R: 0xfd })
4 94 1 1 Config(CommandData(0x3f3f))
5 147 1 1 Coefficients(Coefficients { m: 0xfde, b: 0x0, R: 0xfe })
6 165 1 1 Coefficients(Coefficients { m: 0x52e, b: 0x5000, R: 0xff })
7 193 1 1 Coefficients(Coefficients { m: 0x524e, b: 0x0, R: 0xfd })
humility: ring buffer drv_stm32h7_i2c::__RINGBUF in i2c_driver:
NDX LINE GEN COUNT PAYLOAD
39 514 12815 1 WriteWaitISR(0x8020)
40 514 12815 2 WriteWaitISR(0x8021)
41 514 12815 1 WriteWaitISR(0x8061)
42 576 12815 2 ReadISR(0x8021)
43 576 12815 1 ReadISR(0x8025)
44 576 12815 2 ReadISR(0x8021)
45 576 12815 1 ReadISR(0x8025)
46 611 12815 3 ReadWaitISR(0x8021)
47 611 12815 1 ReadWaitISR(0x8061)
0 394 12816 1 WaitISR(0x21)
1 484 12816 1 WriteISR(0x21)
2 484 12816 2 WriteISR(0x8021)
3 484 12816 1 WriteISR(0x8023)
4 514 12816 1 WriteWaitISR(0x8020)
5 514 12816 2 WriteWaitISR(0x8021)
6 514 12816 1 WriteWaitISR(0x8061)
7 576 12816 2 ReadISR(0x8021)
8 576 12816 1 ReadISR(0x8025)
9 576 12816 2 ReadISR(0x8021)
10 576 12816 1 ReadISR(0x8025)
11 611 12816 3 ReadWaitISR(0x8021)
12 611 12816 1 ReadWaitISR(0x8061)
13 394 12816 1 WaitISR(0x21)
14 484 12816 1 WriteISR(0x21)
15 484 12816 2 WriteISR(0x8021)
16 484 12816 1 WriteISR(0x8023)
17 514 12816 1 WriteWaitISR(0x8020)
18 514 12816 2 WriteWaitISR(0x8021)
19 514 12816 1 WriteWaitISR(0x8061)
20 576 12816 2 ReadISR(0x8021)
21 576 12816 1 ReadISR(0x8025)
22 576 12816 2 ReadISR(0x8021)
23 576 12816 1 ReadISR(0x8025)
24 611 12816 3 ReadWaitISR(0x8021)
25 611 12816 1 ReadWaitISR(0x8061)
26 394 12816 1 WaitISR(0x21)
27 484 12816 1 WriteISR(0x21)
28 484 12816 2 WriteISR(0x8021)
29 484 12816 1 WriteISR(0x8023)
30 514 12816 1 WriteWaitISR(0x8020)
31 514 12816 2 WriteWaitISR(0x8021)
32 514 12816 1 WriteWaitISR(0x8061)
33 576 12816 2 ReadISR(0x8021)
34 576 12816 1 ReadISR(0x8025)
35 576 12816 2 ReadISR(0x8021)
36 576 12816 1 ReadISR(0x8025)
37 611 12816 3 ReadWaitISR(0x8021)
38 611 12816 1 ReadWaitISR(0x8061)
humility: ring buffer drv_stm32h7_i2c::__RINGBUF in spd:
NDX LINE GEN COUNT PAYLOAD
0 764 1 1 AddrISR(0x1)
1 787 1 1 WaitAddr
humility: ring buffer drv_stm32h7_i2c_server::__RINGBUF in i2c_driver:
NDX LINE GEN COUNT PAYLOAD
7 134 182 1 None
8 112 182 1 Some(NoDevice)
9 112 182 1 Some(BusLockedMux)
10 134 182 1 None
11 112 182 1 Some(NoDevice)
12 112 182 1 Some(BusLockedMux)
13 134 182 1 None
14 112 182 1 Some(NoDevice)
15 112 182 1 Some(BusLockedMux)
0 134 183 1 None
1 112 183 1 Some(NoDevice)
2 112 183 1 Some(BusLockedMux)
3 134 183 1 None
4 112 183 1 Some(NoDevice)
5 112 183 1 Some(BusLockedMux)
6 134 183 1 None
2 changes: 1 addition & 1 deletion humility-bin/tests/cmd/ringbuf-arg/ringbuf-arg.in_bootloader.0.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@
fs.base = "../cores"
bin.name = "humility"
args = "-d hubris.core.in_bootloader.0 ringbuf i2c"

status.code = 1
5 changes: 1 addition & 4 deletions humility-bin/tests/cmd/ringbuf-full-totals/ringbuf-full-totals.flash-ram-mismatch.0.stderr
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,2 @@
humility: attached to dump
humility: ringbuf dump failed: loading value of type struct UnsafeCell<ringbuf::Ringbuf<drv_gimlet_seq_server::Trace, 64>> at address 0x0
humility: ringbuf dump failed: loading value of type struct UnsafeCell<ringbuf::Ringbuf<ksz8463::Trace, 16>> at address 0x0
humility: ringbuf dump failed: loading value of type struct UnsafeCell<ringbuf::Ringbuf<task_hiffy::stm32h7::Trace, 64>> at address 0x0
humility: ringbuf dump failed: loading value of type struct UnsafeCell<ringbuf::Ringbuf<vsc85xx::Trace, 16>> at address 0x0
humility ringbuf failed: image ID matches but PC at 0x1ff0a6e0 is not part of any module. Maybe this is an incorrect A/B archive, or bootloader or ROM code is running?
Loading
Loading