runtime: Anchor MCU RT in Caliptra-managed DPE chain (#3729)

- Carry the SoC manifest SVN into the MCU RT DPE context created during recovery boot.

- Keep MCU RT hitless update measurement changes on the internal backdoor-update path.

- Generalize Caliptra-managed DPE context lookup and backdoor measurement updates for CCIV, MCFW, and future managed contexts.

- Refactor AUTHORIZE_AND_STASH image verification so ACTIVATE_FIRMWARE can authorize MCU RT when the MCU image is activated, before updating MCFW internally.

- Preserve public AUTHORIZE_AND_STASH semantics: SKIP_STASH only controls whether authorized measurements are stashed into DPE and PCR31.

Author: parvathib

drivers/src/persistent.rs

@@ -57,6 +57,8 @@ pub const CMB_AES_KEY_SHARE_SIZE: u32 = 32;
 pub const DOT_OWNER_PK_HASH_SIZE: u32 = 13 * 4;
 pub const CLEARED_NON_FATAL_FW_ERROR_SIZE: u32 = 4;
 pub const MCU_FIRMWARE_LOADED_SIZE: u32 = 4;
+#[cfg(feature = "runtime")]
+pub const SOC_MANIFEST_SVN_SIZE: u32 = 4;
 pub const _DPE_PL_CONTEXT_LIMITS_WITH_PAD_SIZE: u32 = 4; // u8 + u8 + 2 bytes padding
 
 #[cfg(feature = "runtime")]
@@ -95,6 +97,15 @@ pub type StashMeasurementArray = [MeasurementLogEntry; MEASUREMENT_MAX_COUNT];
 pub type AuthManifestImageMetadataList =
     [AuthManifestImageMetadata; AUTH_MANIFEST_IMAGE_METADATA_MAX_COUNT];
 
+#[cfg(feature = "runtime")]
+#[derive(Clone, Copy, FromBytes, Immutable, IntoBytes, KnownLayout, Zeroize, Default)]
+#[repr(C)]
+pub struct CaliptraManagedDpeContextIndices {
+    pub cciv: u8,
+    pub mcu_rt: u8,
+    pub reserved: [u8; 2],
+}
+
 #[derive(Clone, Immutable, IntoBytes, KnownLayout, TryFromBytes, Zeroize)]
 #[repr(C)]
 pub struct Ecc384IdevIdCsr {
@@ -381,6 +392,14 @@ pub struct PersistentData {
     /// changing the frozen ROM binary. FMC writes this during handoff,
     /// runtime reads it for MLDSA signing operations.
     pub rt_mldsa_keypair_seed_kv_hdl: HandOffDataHandle,
+
+    /// SoC manifest SVN, stored after auth manifest validation.
+    /// Used as the MCU RT current_svn when creating the MCU RT DPE context.
+    #[cfg(feature = "runtime")]
+    pub soc_manifest_svn: u32,
+
+    #[cfg(feature = "runtime")]
+    pub caliptra_managed_dpe_context_indices: CaliptraManagedDpeContextIndices,
 }
 
 impl PersistentData {
@@ -548,7 +567,30 @@ impl PersistentData {
                 addr_of!((*P).dpe_pl0_context_limit) as u32,
                 memory_layout::PERSISTENT_DATA_ORG + persistent_data_offset
             );
+            persistent_data_offset += _DPE_PL_CONTEXT_LIMITS_WITH_PAD_SIZE;
+            assert_eq!(
+                addr_of!((*P).rt_mldsa_keypair_seed_kv_hdl) as u32,
+                memory_layout::PERSISTENT_DATA_ORG + persistent_data_offset
+            );
+            persistent_data_offset += size_of::<HandOffDataHandle>() as u32;
+            #[cfg(feature = "runtime")]
+            {
+                assert_eq!(
+                    addr_of!((*P).soc_manifest_svn) as u32,
+                    memory_layout::PERSISTENT_DATA_ORG + persistent_data_offset
+                );
+                persistent_data_offset += SOC_MANIFEST_SVN_SIZE;
+                assert_eq!(
+                    addr_of!((*P).caliptra_managed_dpe_context_indices) as u32,
+                    memory_layout::PERSISTENT_DATA_ORG + persistent_data_offset
+                );
+                persistent_data_offset += size_of::<CaliptraManagedDpeContextIndices>() as u32;
+            }
 
+            assert_eq!(
+                memory_layout::PERSISTENT_DATA_ORG + persistent_data_offset,
+                memory_layout::DATA_ORG
+            );
             assert_eq!(P.add(1) as u32, memory_layout::DATA_ORG);
         }
     }

error/src/lib.rs

@@ -1589,14 +1589,14 @@ impl CaliptraError {
             "Runtime Error: Attested CSR COSE Sign1 encoding error"
         ),
         (
-            RUNTIME_CCIV_CONTEXT_NOT_FOUND,
+            RUNTIME_DPE_CONTEXT_NOT_FOUND,
             0x000E0093,
-            "Runtime Error: CCIV context not found"
+            "Runtime Error: DPE context not found"
         ),
         (
-            RUNTIME_MULTIPLE_CCIV_CONTEXTS_FOUND,
+            RUNTIME_MULTIPLE_DPE_CONTEXTS_FOUND,
             0x000E0094,
-            "Runtime Error: Multiple CCIV contexts found"
+            "Runtime Error: Multiple DPE contexts found"
         ),
         (
             RUNTIME_INVOKE_DPE_RESPONSE_TOO_LARGE,

runtime/src/activate_firmware.rs

@@ -18,7 +18,7 @@ use crate::authorize_and_stash::{self, AuthorizeAndStashCmd};
 use crate::drivers::{McuFwStatus, McuResetReason};
 use crate::Drivers;
 use crate::{manifest::find_metadata_entry, mutrefbytes};
-use caliptra_api::mailbox::{AuthAndStashFlags, AuthorizeAndStashReq, ImageHashSource};
+use caliptra_api::mailbox::{AuthorizeAndStashReq, ImageHashSource};
 use caliptra_auth_man_types::ImageMetadataFlags;
 use caliptra_common::mailbox_api::{ActivateFirmwareReq, ActivateFirmwareResp, MailboxRespHeader};
 use caliptra_drivers::dma::MCU_SRAM_OFFSET;
@@ -202,28 +202,32 @@ impl ActivateFirmwareCmd {
                 )
                 .map_err(|_| ())?;
 
-            // Verify MCU after loading
+            // Update MCU RT DPE context with new measurement.
+            // SVN stays the same as the recovery boot value.
             let auth_and_stash_req = AuthorizeAndStashReq {
                 fw_id: ActivateFirmwareReq::MCU_IMAGE_ID.to_le_bytes(),
                 measurement: [0; 48],
                 source: ImageHashSource::LoadAddress.into(),
-                flags: AuthAndStashFlags::SKIP_STASH.bits(),
                 image_size: mcu_image_size,
                 ..Default::default()
             };
 
             let pl0_pauser_locality = drivers.persistent_data.get().manifest1.header.pl0_pauser;
-            let authorization_result = AuthorizeAndStashCmd::authorize_and_stash(
-                drivers,
-                &auth_and_stash_req,
-                pl0_pauser_locality,
-            )
-            .map_err(|_| ())?;
+            let (authorization_result, measurement) =
+                AuthorizeAndStashCmd::authorize_image(drivers, &auth_and_stash_req)
+                    .map_err(|_| ())?;
 
             // Make sure the image was properly authorized.
             if authorization_result != authorize_and_stash::IMAGE_AUTHORIZED {
                 return Err(());
             }
+            drivers
+                .update_caliptra_managed_measurement(
+                    Drivers::MCU_RT_TCI_TYPE,
+                    &measurement,
+                    Some(pl0_pauser_locality),
+                )
+                .map_err(|_| ())?;
 
             drivers.persistent_data.get_mut().mcu_firmware_loaded = McuFwStatus::Loaded.into();
         }

runtime/src/authorize_and_stash.rs

@@ -67,6 +67,39 @@ impl AuthorizeAndStashCmd {
         cmd: &AuthorizeAndStashReq,
         locality: u32,
     ) -> CaliptraResult<u32> {
+        let (auth_result, stash_measurement) = Self::authorize_image(drivers, cmd)?;
+
+        // Stash the measurement if the image is authorized.
+        if auth_result == IMAGE_AUTHORIZED {
+            let flags: AuthAndStashFlags = cmd.flags.into();
+            if !flags.contains(AuthAndStashFlags::SKIP_STASH) {
+                let dpe_result = StashMeasurementCmd::stash_measurement(
+                    drivers,
+                    &cmd.fw_id,
+                    &stash_measurement,
+                    cmd.svn,
+                    drivers.caller_privilege_level(),
+                    locality,
+                )?;
+                if dpe_result != DpeErrorCode::NoError {
+                    drivers
+                        .soc_ifc
+                        .set_fw_extended_error(dpe_result.get_error_code());
+
+                    Err(CaliptraError::RUNTIME_AUTH_AND_STASH_MEASUREMENT_DPE_ERROR)?;
+                }
+            }
+        }
+
+        Ok(auth_result)
+    }
+
+    #[cfg_attr(feature = "cfi", cfi_impl_fn)]
+    #[inline(never)]
+    pub(crate) fn authorize_image(
+        drivers: &mut Drivers,
+        cmd: &AuthorizeAndStashReq,
+    ) -> CaliptraResult<(u32, [u8; 48])> {
         let source = ImageHashSource::from(cmd.source);
         if source == ImageHashSource::Invalid {
             Err(CaliptraError::RUNTIME_AUTH_AND_STASH_UNSUPPORTED_IMAGE_SOURCE)?;
@@ -82,7 +115,11 @@ impl AuthorizeAndStashCmd {
         let auth_manifest_image_metadata_col = &persistent_data.auth_manifest_image_metadata_col;
 
         let cmd_fw_id = u32::from_le_bytes(cmd.fw_id);
+        // The measurement used for both authorization and stashing/updating DPE.
+        // For InRequest source, this is cmd.measurement.
+        // For LoadAddress/StagingAddress, this is computed from the image in memory.
         let mut stash_measurement = cmd.measurement;
+
         let auth_result = if let Some(metadata_entry) =
             find_metadata_entry(auth_manifest_image_metadata_col, cmd_fw_id)
         {
@@ -137,28 +174,7 @@ impl AuthorizeAndStashCmd {
         } else {
             IMAGE_NOT_AUTHORIZED
         };
-        // Stash the measurement if the image is authorized.
-        if auth_result == IMAGE_AUTHORIZED {
-            let flags: AuthAndStashFlags = cmd.flags.into();
-            if !flags.contains(AuthAndStashFlags::SKIP_STASH) {
-                let dpe_result = StashMeasurementCmd::stash_measurement(
-                    drivers,
-                    &cmd.fw_id,
-                    &stash_measurement,
-                    cmd.svn,
-                    drivers.caller_privilege_level(),
-                    locality,
-                )?;
-                if dpe_result != DpeErrorCode::NoError {
-                    drivers
-                        .soc_ifc
-                        .set_fw_extended_error(dpe_result.get_error_code());
 
-                    Err(CaliptraError::RUNTIME_AUTH_AND_STASH_MEASUREMENT_DPE_ERROR)?;
-                }
-            }
-        }
-
-        Ok(auth_result)
+        Ok((auth_result, stash_measurement))
     }
 }