SPDM Req-Resp Test — Crypto Integration Summary

What was done

1. Add crypto server to the virt system image (1ca5fd6)

  • target/virt-ast1060-evb/spdm-req-resp-test/system.json5 — added crypto_server app (64KB flash at 0x28000, 64KB RAM); reduced spdm_requester RAM 96KB→32KB to stay within the 640KB limit
  • services/crypto/server/BUILD.bazel — added exports_files(["src/main.rs"])
  • target/virt-ast1060-evb/spdm-req-resp-test/BUILD.bazel — added crypto_server_app target wiring directly to services/crypto/server/src/main.rs
  • Test passes: crypto server starts, blocks on object_wait, SPDM exchange completes, QEMU exits cleanly

2. Wire SPDM requester/responder to the crypto server (c50a38a)

  • mock_platform.rs extracted into a rust_library Bazel target (//target/ast1060-evb/spdm-req-resp-test:mock_platform) — no duplication, shared by all four binaries (ast1060 + virt, requester + responder)
  • target/virt-ast1060-evb/spdm-req-resp-test/spdm_requester.rs created — uses SpdmCryptoHash and SpdmCryptoRng (IPC-backed) instead of mocks
  • target/virt-ast1060-evb/spdm-req-resp-test/spdm_responder.rs created — same
  • system.json5 updated — CRYPTO channel_initiator added to both requester and responder processes
  • VCA exchange (GET_VERSION, GET_CAPABILITIES, NEGOTIATE_ALGORITHMS) passes

3. Add GET_DIGESTS + fix crypto session isolation (7fe9bc6)

Problem discovered: The M1 transcript hash (m1_hash) opens a streaming SHA-384 session during ALGORITHMS and keeps it open across message boundaries. When GET_DIGESTS runs, hash tries to open another session on the same crypto server → SessionBusy → responder fails.

Fix: Give each SpdmCryptoHash instance its own dedicated IPC channel handle:

HandleUsed by
CRYPTO_REQrequester hash + rng
CRYPTO_REQ_M1requester m1_hash
CRYPTO_REQ_L1requester l1_hash
CRYPTO_RESPresponder hash + rng
CRYPTO_RESP_M1responder m1_hash
CRYPTO_RESP_L1responder l1_hash

The crypto server now has 6 channel_handler objects and a wait_group, serving each with its own independent HashSession state.

GET_DIGESTS added to the requester flow — first step that actually exercises the crypto server (SHA-384 hash over the responder's certificate chain via IPC).

Final test result

//target/virt-ast1060-evb/spdm-req-resp-test:spdm_req_resp_test_test  PASSED

SPDM exchange flow: GET_VERSION → GET_CAPABILITIES → NEGOTIATE_ALGORITHMS → GET_DIGESTS All hash and RNG operations served by the crypto server over IPC using RustCrypto backend.

Memory layout (virt-ast1060-evb)

0x00000500 - 0x00010000  Kernel flash         (~62KB)
0x00010000 - 0x00018000  mctp_loopback_server  (32KB)
0x00018000 - 0x00020000  spdm_requester        (32KB)
0x00020000 - 0x00028000  spdm_responder        (32KB)
0x00028000 - 0x00038000  crypto_server         (64KB)
0x00058000 - 0x00070000  Kernel RAM            (96KB)
0x00070000 - 0x00078000  mctp_loopback_server  (32KB)
0x00078000 - 0x00080000  spdm_requester        (32KB)
0x00080000 - 0x00090000  spdm_responder        (64KB)
0x00090000 - 0x000A0000  crypto_server         (64KB)
Total: 640KB