DOCA App Shield
This page is intended for DOCA AppShield users and customers. It is recommended that you read the DOCA AppShield Programming Guide .
Firmware Configuration
Ensure that you reboot the machine after configuring the firmware.
General
Configuring BAR2
dpu> mlxconfig -d /dev/mst/mt41686_pciconf0 s PF_BAR2_SIZE=2 PF_BAR2_ENABLE=1
If the Target is a VM
Enabling NVME-emulation and SRIOV (for working with VFs)
dpu> mlxconfig -d /dev/mst/mt41686_pciconf0 s NVME_EMULATION_ENABLE=1 SRIOV_EN=1
Configuring the number of VFs
dpu> mlxconfig -d /dev/mst/mt41686_pciconf0 s NUM_OF_VFS=<wanted number>
Best practice for logging and tracing is documented in Debuggability.
This section addresses common issues that developers and users might face, along with step-by-step solutions.
doca_apsh_system_start fails with DOCA_ERROR_INITIALIZATION
This error occurs when AppShield is unable to locate the main kernel module in host memory.
Possible Causes and Solutions
DMA Device Lacks DMA Capability
Solution: Verify that the DMA device you configured has DMA capabilities. For detailed information, refer to the DOCA Core Documentation.
Device Representor Not Connected to Target
Solution: Ensure that the VF associated with the device representor is correctly attached to the VM or host.
Memory Regions/Symbols File Mismatch
Solution: Regenerate the input files to match the target machine.
OS Type Mismatch
Solution: Confirm that the VF is connected to the target machine and that the OS type configuration is correct.
doca_apsh_attestation_get Fails
Corrupted Hash Zip File
Solution: Ensure that the provided file is a valid .zip file.
doca_apsh_attestation_get Succeeds but Attestation Immediately Fails (PAGES_PRESENT != MATCHING_HASHES))
Outdated Hash Zip File
This issue can occur if there has been an update to the executable file or one of the loaded libraries.
Solution: Regenerate the hash zip file to reflect the latest updates.
Process Loads Libraries "On the Fly"
In some cases, the configuration tool may miss libraries that were not loaded at the time of the zip file creation.
Solution: If the process loads libraries dynamically, manually add these libraries to the zip file.