⚙ Caliptra Emulator

RISC-V emulator running in WebAssembly

Configuration

Loading default ROM...
Loading default FW...
(optional — default loaded for subsystem mode)
(optional — default loaded for subsystem mode)
(loading default MCU ROM...)
Enable SoC/subsystem boot flow
Enable OCP lock
Signal debug unlock intent (sets debug_locked & debug_intent)

Leave PK hashes empty for all-zeros (unprovisioned mode). Use the PK Hash Calculator to compute vendor and owner PK hashes from public keys. Default ROM is the frozen 2.1 release with UART logging. Default FW bundle is built with test keys (vendor PK hash pre-filled). Enable subsystem mode to boot through the subsystem flow; SoC manifest is only needed in that mode. Manufacturing lifecycle validates PK hashes; Unprovisioned skips validation.

Advanced Fuse Configuration

Override individual fuse values. Defaults shown below. Hex inputs are big-endian byte strings. In core mode, values populate the Caliptra Fuses struct. In subsystem (MCU) mode, values populate the corresponding OTP partition bytes. Note: fuse_pqc_key_type uses 0=LMS, 1=MLDSA (Caliptra convention); the OTP byte encoding is inverted automatically.

4-bit mask (decimal/hex, prefix 0x)
u32 bitmask
u32 bitmask
Disable rollback protection
u16
u8 (default 128)
4 u32 words, comma-separated
4 u32 words, comma-separated
96 bytes hex (192 chars)
16 bytes hex (32 chars)

Production Debug Unlock PK Hashes (subsystem mode only)

8 SHA-384 hashes (48 bytes / 96 hex chars each) for unlock levels 1-8. Stored in SW_MANUF OTP partition.

Controls

Initializing WASM...
Step:

UART Output

Mailbox Commands

Timestamped Log Output
Caliptra Fuse Registers
(Start the emulator to see fuse values)
Caliptra Key Vault

24 keys × 64 bytes plus per-key control register, then 32 PCRs × 48 bytes plus per-PCR control register. Updated automatically while running and after each step.

(Start the emulator to see Key Vault contents)