Capsule Update using CapsuleApp.efi fails *sometimes*

[philipanda]

Component

Dasharo firmware

Device

NovaCustom V56 14th Gen

Dasharo version

v1.0.0-rc10

Dasharo Tools Suite version

n/a

Test case ID

CUP150

Brief summary

CapsuleUpdate of v1.0.0-rc10 to the same version using CapsuleApp.efi and valid_capsule.cap generated using scripts/capsules/capsule_update_tests.sh in OSFV fails sometimes due to "Security Violation".

How reproducible

3/7 tries failed: F, F, S, F, S, S, S

How to reproduce

Create the capsules using scripts/capsules/capsule_update_tests.sh, run the update using CapsuleApp.efi.
Doing multiple consecutive updates does not result in a fail. Some unknown for now steps (running a couple other tests) need to be performed before the update will fail

Expected behavior

Succeeds every time

Actual behavior

sometimes fails due to "Security Violation" according to CapsuleApp.efi

Screenshots

No response

Additional context

No response

Solutions you've tried

No response

[SergiiDmytruk]

I think it's something specific to these laptops (not necessarily to their hardware). These unexpected failures were occurring before, if I'm not mistaken. There is also that unusual SMI/SMMSTORE failure rate which doesn't happen on other hardware (except maybe for NUC). cbmem log is being somehow damaged also on the laptops.

For debugging purposes, would be nice to determine what goes wrong during signature verification. Maybe by hashing capsule's data, so it can be compared. I also seem to remember that cbmem log becomes damaged right after the verification, but I couldn't determine why. Maybe there is some issue with MbedTLS/OpenSSL and memory.

[philipanda]

Similar thing happens on one of our V540TNDs.
Capsule update v1.0.0-rc10 -> v1.0.0-rc10 (reinstall) fails due to Not Ready.
Capsule update v1.0.0-rc4 -> v1.0.0-rc10 worked.
After that the reinstall rc10 -> rc10 started working back again with the exact same files.
This also causes this issue #1749