[FPGA]: Wait for cold boot complete in model harness

This reduces race conditions for the mailbox lock.

Author: clundin25

hw-model/src/lib.rs

@@ -90,6 +90,8 @@ pub use model_fpga_subsystem::ModelFpgaSubsystem;
 #[cfg(feature = "fpga_subsystem")]
 pub use model_fpga_subsystem::XI3CWrapper;
 
+pub use mcu_boot_status::{McuBootMilestones, McuRomBootStatus};
+
 /// Ideally, general-purpose functions would return `impl HwModel` instead of
 /// `DefaultHwModel` to prevent users from calling functions that aren't
 /// available on all HwModel implementations.  Unfortunately, rust-analyzer
@@ -1285,6 +1287,10 @@ pub trait HwModel: SocManager {
         self.soc_ifc().cptra_hw_config().read().subsystem_mode_en()
     }
 
+    fn mci_boot_milestones(&mut self) -> McuBootMilestones {
+        McuBootMilestones::empty()
+    }
+
     fn supports_ocp_lock(&mut self) -> bool {
         self.soc_ifc().cptra_hw_config().read().ocp_lock_mode_en()
     }

hw-model/src/model_fpga_subsystem.rs

@@ -1758,10 +1758,6 @@ impl ModelFpgaSubsystem {
         (self.mci_flow_status() & 0x0000_ffff) as u16
     }
 
-    pub fn mci_boot_milestones(&mut self) -> McuBootMilestones {
-        McuBootMilestones::from((self.mci_flow_status() >> 16) as u16)
-    }
-
     fn caliptra_axi_bus(&mut self) -> Option<FpgaRealtimeBus<'_>> {
         self.mmio.caliptra_axi_bus()
     }
@@ -1817,6 +1813,10 @@ impl HwModel for ModelFpgaSubsystem {
         self.mmio.mci().unwrap().regs()
     }
 
+    fn mci_boot_milestones(&mut self) -> McuBootMilestones {
+        McuBootMilestones::from((self.mci_flow_status() >> 16) as u16)
+    }
+
     fn step(&mut self) {
         self.handle_log();
         self.handle_flash();
@@ -2339,7 +2339,13 @@ impl HwModel for ModelFpgaSubsystem {
         // MCU ROM will wait after reaching the mailbox for this bit before booting RT
         gpio.set(current | 1 << 31);
 
-        // ironically, we don't need to support this
+        // Wait for MCU to finish cold boot (including ROM integrity check)
+        // to avoid mailbox contention with the host.
+        self.step_until(|m| {
+            m.mci_boot_milestones()
+                .contains(McuBootMilestones::COLD_BOOT_FLOW_COMPLETE)
+        });
+
         Ok(())
     }