Merge branch 'caliptra-2.0' into cherry-pick-certify-key-chunks-3765-v2

Author: parvathib

FROZEN_IMAGES.sha384sum

@@ -1,3 +1,3 @@
 # WARNING: Do not update this file without the approval of the Caliptra TAC
-d9859df1c8456bc56e97c4f54aa524bb4e3e4c6006a7b6afcd1f0cb1fdf472ba918ca9b314c519f72adae3dd0256a173  caliptra-rom-no-log.bin
-53142b923c92a22f33a5468bb65f8fda194eaf73d906a669051aac85147f727ccb615bb5f5ae1df14c1f1d27174bebf7  caliptra-rom-with-log.bin
+4cb14746c57cfd81e1c816d1bf662b3d314d31d499ccbf8ba6b741d658a4a3069ef5ae7619171bfb8b22546129354506  caliptra-rom-no-log.bin
+715cb76928d869a393d0fc506d52047df03908ffaadb55dd3cbf82c9be53a882029830a6cdefd2289d05d468ed32f33d  caliptra-rom-with-log.bin

common/src/uds_fe_programming.rs

@@ -149,6 +149,13 @@ impl UdsFeProgrammingFlow {
             let otp_ctrl = DmaOtpCtrl::new(AxiAddr::from(fuse_controller_base_addr), dma);
             let seed_dest_address = self.get_dest_address(soc_ifc);
             let dai_idle_bit_num = soc_ifc.otp_dai_idle_bit_num();
+            let status_reg_offset = soc_ifc.otp_status_reg_offset();
+            let status_reg_addr = if status_reg_offset != 0 {
+                Some(fuse_controller_base_addr + status_reg_offset as u64)
+            } else {
+                // TODO: Remove this fallback once MCU programs the OTP status register offset.
+                None
+            };
             let direct_access_cmd_reg_addr =
                 fuse_controller_base_addr + soc_ifc.otp_direct_access_cmd_reg_offset() as u64;
             let direct_access_address_reg_addr =
@@ -159,11 +166,15 @@ impl UdsFeProgrammingFlow {
                 direct_access_cmd_reg_addr + DIRECT_ACCESS_WDATA_1_OFFSET;
 
             let _ = otp_ctrl.with_regs_mut(|regs| {
-            // Helper function to check if DAI is idle using the configurable bit number
-            let is_dai_idle = || -> bool {
-                let status: u32 = regs.status().read().into();
-                (status & (1 << dai_idle_bit_num)) != 0
-            };
+                // Helper function to check if DAI is idle using the configurable bit number
+                let is_dai_idle = || -> bool {
+                    let status = if let Some(status_reg_addr) = status_reg_addr {
+                        dma.read_dword(AxiAddr::from(status_reg_addr))
+                    } else {
+                        regs.status().read().into()
+                    };
+                    (status & (1 << dai_idle_bit_num)) != 0
+                };
 
                 let seed = &seed[..self.seed_length_words()]; // Get random bytes of desired size
                 let chunk_size = if uds_fuse_row_granularity_64 { 2 } else { 1 };

drivers/src/mailbox.rs

@@ -111,6 +111,12 @@ impl Mailbox {
         }
     }
 
+    /// Wait until the mailbox FSM returns to idle.
+    pub fn wait_until_idle(&self) {
+        let mbox = self.mbox.regs();
+        while !mbox.status().read().mbox_fsm_ps().mbox_idle() {}
+    }
+
     /// Aborts with failure any pending SoC->Uc transactions.
     ///
     /// This is useful to call from a fatal-error-handling routine.

drivers/src/soc_ifc.rs

@@ -115,16 +115,24 @@ impl SocIfc {
         let lifecycle = self.lifecycle();
         let soc_ifc_regs = self.soc_ifc.regs_mut();
         match lifecycle {
-            Lifecycle::Manufacturing => soc_ifc_regs.ss_dbg_manuf_service_reg_rsp().modify(|w| {
-                w.tap_mailbox_available(in_progress)
-                    .manuf_dbg_unlock_in_progress(in_progress)
-            }),
-            DeviceLifecycleE::Production => {
-                soc_ifc_regs.ss_dbg_manuf_service_reg_rsp().modify(|w| {
-                    w.tap_mailbox_available(in_progress)
-                        .prod_dbg_unlock_in_progress(in_progress)
-                })
-            }
+            Lifecycle::Manufacturing => soc_ifc_regs
+                .ss_dbg_manuf_service_reg_rsp()
+                .modify(|w| w.manuf_dbg_unlock_in_progress(in_progress)),
+            DeviceLifecycleE::Production => soc_ifc_regs
+                .ss_dbg_manuf_service_reg_rsp()
+                .modify(|w| w.prod_dbg_unlock_in_progress(in_progress)),
+            _ => (),
+        }
+    }
+
+    /// Enable or disable TAP access to the mailbox for debug unlock.
+    pub fn set_ss_dbg_unlock_tap_mailbox_available(&mut self, available: bool) {
+        let lifecycle = self.lifecycle();
+        let soc_ifc_regs = self.soc_ifc.regs_mut();
+        match lifecycle {
+            Lifecycle::Manufacturing | DeviceLifecycleE::Production => soc_ifc_regs
+                .ss_dbg_manuf_service_reg_rsp()
+                .modify(|w| w.tap_mailbox_available(available)),
             _ => (),
         }
     }
@@ -639,6 +647,10 @@ impl SocIfc {
         (self.soc_ifc.regs().ss_strap_generic().at(0).read() >> 16) & 0xFFFF
     }
 
+    pub fn otp_status_reg_offset(&self) -> u32 {
+        self.soc_ifc.regs().ss_strap_generic().at(0).read() & 0xFFFF
+    }
+
     pub fn otp_direct_access_cmd_reg_offset(&self) -> u32 {
         self.soc_ifc.regs().ss_strap_generic().at(1).read() & 0xFFFF
     }

rom/dev/README.md

@@ -277,11 +277,12 @@ The following flows are conducted when the ROM is operating in the manufacturing
 3. ROM then retrieves the UDS granularity from the `CPTRA_GENERIC_INPUT_WIRES` register0 Bit31 to learn if the fuse row is accessible with 32-bit or 64-bit granularity.  If the bit is reset, it indicates 64-bit granularity; otherwise, it indicates 32-bit granularity.
 
 4. ROM computes the following values:
-    - DAI_IDLE bit offset: (`SS_STRAP_GENERIC` register0 >> 16) & 0xFFFF
-    - `DIRECT_ACCESS_CMD` offset: (`SS_STRAP_GENERIC` register1) & 0xFFFF + Fuse Controller's base address.
+    - `STATUS` register address: Fuse Controller's base address + ((`SS_STRAP_GENERIC` register0) & 0xFFFF).
+    - DAI_IDLE bit index within the `STATUS` register: (`SS_STRAP_GENERIC` register0 >> 16) & 0xFFFF.
+    - `DIRECT_ACCESS_CMD` register address: Fuse Controller's base address + ((`SS_STRAP_GENERIC` register1) & 0xFFFF).
 
 4. ROM then performs the following steps until all the 512 bits of the UDS seed are programmed:
-    1. The ROM verifies the idle state of the DAI by reading the `STATUS` register `DAI_IDLE` bit (offset retrieved above) of the Fuse Controller, located at offset 0x10 from the Fuse Controller's base address.
+    1. The ROM verifies the idle state of the DAI by reading the `STATUS` register `DAI_IDLE` bit using the offset retrieved above.
     2. If the granularity is 32-bit, the ROM writes the next word from the UDS seed to the `DIRECT_ACCESS_WDATA_0` register. If the granularity is 64-bit, the ROM writes the next two words to `the DIRECT_ACCESS_WDATA_0` and `DIRECT_ACCESS_WDATA_1` registers, located at offsets 0x8 and 0xC respectively from the `DIRECT_ACCESS_CMD` register.
     3. The ROM writes the lower 32 bits of the UDS Seed programming base address to the `DIRECT_ACCESS_ADDRESS` register, located at offset 0x4 from the `DIRECT_ACCESS_CMD` register.
     4. The ROM triggers the UDS seed write command by writing 0x2 to the `DIRECT_ACCESS_CMD` register..

rom/dev/src/flow/debug_unlock.rs

@@ -12,8 +12,6 @@ Abstract:
 
 --*/
 
-use core::mem::ManuallyDrop;
-
 use crate::flow::cold_reset::fw_processor::FirmwareProcessor;
 use crate::CaliptraResult;
 use caliptra_api::mailbox::{
@@ -58,11 +56,24 @@ pub fn debug_unlock(env: &mut RomEnv) -> CaliptraResult<()> {
     }
 }
 
+fn start_debug_unlock(env: &mut RomEnv) {
+    env.soc_ifc.set_ss_dbg_unlock_tap_mailbox_available(true);
+    env.soc_ifc.set_ss_dbg_unlock_in_progress(true);
+}
+
+fn finish_debug_unlock(env: &mut RomEnv, response_sent: bool) {
+    env.soc_ifc.set_ss_dbg_unlock_in_progress(false);
+    if response_sent {
+        env.mbox.wait_until_idle();
+        env.soc_ifc.set_ss_dbg_unlock_tap_mailbox_available(false);
+    }
+}
+
 fn handle_manufacturing(env: &mut RomEnv) -> CaliptraResult<()> {
     cprintln!("[dbg_manuf] ++");
 
     // Set debug unlock in progress and unlock the mailbox for tap access.
-    env.soc_ifc.set_ss_dbg_unlock_in_progress(true);
+    start_debug_unlock(env);
 
     let mbox = &mut env.mbox;
     let txn = loop {
@@ -81,7 +92,7 @@ fn handle_manufacturing(env: &mut RomEnv) -> CaliptraResult<()> {
         Err(CaliptraError::SS_DBG_UNLOCK_MANUF_INVALID_MBOX_CMD)?;
     }
 
-    let mut txn = ManuallyDrop::new(txn.start_txn());
+    let mut txn = txn.start_txn();
 
     let result = (|| {
         let mut request = ManufDebugUnlockTokenReq::default();
@@ -115,124 +126,139 @@ fn handle_manufacturing(env: &mut RomEnv) -> CaliptraResult<()> {
         }
     }
 
-    env.soc_ifc.set_ss_dbg_unlock_in_progress(false);
+    drop(txn);
+    finish_debug_unlock(env, true);
 
     cprintln!("[dbg_manuf] --");
     result
 }
 
 fn handle_auth_debug_unlock_request(
     env: &mut RomEnv,
-) -> CaliptraResult<(
-    ProductionAuthDebugUnlockReq,
-    ProductionAuthDebugUnlockChallenge,
-)> {
-    let mbox = &mut env.mbox;
-    let txn = loop {
-        // Random delay for CFI glitch protection.
-        CfiCounter::delay();
-
-        match mbox.peek_recv() {
-            Some(txn) => break txn,
-            None => continue,
+) -> (
+    CaliptraResult<(
+        ProductionAuthDebugUnlockReq,
+        ProductionAuthDebugUnlockChallenge,
+    )>,
+    bool,
+) {
+    let mut response_sent = false;
+    let result = (|| {
+        let mbox = &mut env.mbox;
+        let txn = loop {
+            // Random delay for CFI glitch protection.
+            CfiCounter::delay();
+
+            match mbox.peek_recv() {
+                Some(txn) => break txn,
+                None => continue,
+            }
+        };
+
+        if CommandId::from(txn.cmd()) != CommandId::PRODUCTION_AUTH_DEBUG_UNLOCK_REQ {
+            Err(CaliptraError::SS_DBG_UNLOCK_PROD_INVALID_REQ_MBOX_CMD)?
         }
-    };
 
-    if CommandId::from(txn.cmd()) != CommandId::PRODUCTION_AUTH_DEBUG_UNLOCK_REQ {
-        cprintln!(
-            "Invalid command: {:?}, was expecting PRODUCTION_AUTH_DEBUG_UNLOCK_REQ",
-            txn.cmd()
+        let mut txn = txn.start_txn();
+
+        // Copy request data since it needs to persist
+        let mut request = ProductionAuthDebugUnlockReq::default();
+        FirmwareProcessor::copy_req_verify_chksum(&mut txn, request.as_mut_bytes(), false)?;
+
+        // Use common function to create challenge
+        let challenge = debug_unlock::create_debug_unlock_challenge(
+            &mut env.trng,
+            &env.soc_ifc,
+            &mut env.dma,
+            &request,
         );
-        Err(CaliptraError::SS_DBG_UNLOCK_PROD_INVALID_REQ_MBOX_CMD)?
-    }
 
-    let mut txn = ManuallyDrop::new(txn.start_txn());
-
-    // Process request and create challenge
-    let mut request = ProductionAuthDebugUnlockReq::default();
-    FirmwareProcessor::copy_req_verify_chksum(&mut txn, request.as_mut_bytes(), false)?;
-
-    // Use common function to create challenge
-    let challenge = debug_unlock::create_debug_unlock_challenge(
-        &mut env.trng,
-        &env.soc_ifc,
-        &mut env.dma,
-        &request,
-    );
-
-    // Send response
-    match challenge {
-        Err(err) => {
-            txn.send_response(MailboxRespHeader::default().as_bytes())?;
-            Err(err)
-        }
-        Ok(challenge_resp) => {
-            txn.send_response(challenge_resp.as_bytes())?;
-            Ok((request, challenge_resp))
+        // Send response
+        match challenge {
+            Err(err) => {
+                txn.send_response(MailboxRespHeader::default().as_bytes())?;
+                response_sent = true;
+                Err(err)
+            }
+            Ok(challenge_resp) => {
+                txn.send_response(challenge_resp.as_bytes())?;
+                response_sent = true;
+                Ok((request, challenge_resp))
+            }
         }
-    }
+    })();
+    (result, response_sent)
 }
 
 fn handle_auth_debug_unlock_token(
     env: &mut RomEnv,
     request: &ProductionAuthDebugUnlockReq,
     challenge: &ProductionAuthDebugUnlockChallenge,
-) -> CaliptraResult<()> {
-    let mbox = &mut env.mbox;
-    let txn = loop {
-        // Random delay for CFI glitch protection.
-        CfiCounter::delay();
-
-        match mbox.peek_recv() {
-            Some(txn) => break txn,
-            None => continue,
+) -> (CaliptraResult<()>, bool) {
+    let mut response_sent = false;
+    let result = (|| {
+        let mbox = &mut env.mbox;
+        let txn = loop {
+            // Random delay for CFI glitch protection.
+            CfiCounter::delay();
+
+            match mbox.peek_recv() {
+                Some(txn) => break txn,
+                None => continue,
+            }
+        };
+
+        if CommandId::from(txn.cmd()) != CommandId::PRODUCTION_AUTH_DEBUG_UNLOCK_TOKEN {
+            Err(CaliptraError::SS_DBG_UNLOCK_PROD_INVALID_TOKEN_MBOX_CMD)?;
         }
-    };
 
-    if CommandId::from(txn.cmd()) != CommandId::PRODUCTION_AUTH_DEBUG_UNLOCK_TOKEN {
-        cprintln!(
-            "Invalid command: {:?}, was expecting PRODUCTION_AUTH_DEBUG_UNLOCK_TOKEN",
-            txn.cmd()
+        let mut txn = txn.start_txn();
+
+        // Copy token data
+        let mut token = ProductionAuthDebugUnlockToken::default();
+        FirmwareProcessor::copy_req_verify_chksum(&mut txn, token.as_mut_bytes(), false)?;
+
+        // Use common validation function
+        let result = debug_unlock::validate_debug_unlock_token(
+            &env.soc_ifc,
+            &mut env.sha2_512_384,
+            &mut env.sha2_512_384_acc,
+            &mut env.ecc384,
+            &mut env.mldsa87,
+            &mut env.dma,
+            request,
+            challenge,
+            &token,
         );
-        Err(CaliptraError::SS_DBG_UNLOCK_PROD_INVALID_TOKEN_MBOX_CMD)?;
-    }
 
-    let mut txn = ManuallyDrop::new(txn.start_txn());
-
-    // Copy token from mailbox
-    let mut token = ProductionAuthDebugUnlockToken::default();
-    FirmwareProcessor::copy_req_verify_chksum(&mut txn, token.as_mut_bytes(), false)?;
-
-    // Use common validation function
-    let result = debug_unlock::validate_debug_unlock_token(
-        &env.soc_ifc,
-        &mut env.sha2_512_384,
-        &mut env.sha2_512_384_acc,
-        &mut env.ecc384,
-        &mut env.mldsa87,
-        &mut env.dma,
-        request,
-        challenge,
-        &token,
-    );
-
-    // Send response
-    let _ = txn.send_response(MailboxRespHeader::default().as_bytes());
-    result
+        // Send response
+        if txn
+            .send_response(MailboxRespHeader::default().as_bytes())
+            .is_ok()
+        {
+            response_sent = true;
+        }
+        result
+    })();
+    (result, response_sent)
 }
 
 fn handle_production(env: &mut RomEnv) -> CaliptraResult<()> {
     cprintln!("[dbg_prod] ++");
 
-    env.soc_ifc.set_ss_dbg_unlock_in_progress(true);
+    start_debug_unlock(env);
 
-    let mut debug_unlock_op = || -> CaliptraResult<u8> {
-        let (request, challenge) = handle_auth_debug_unlock_request(env)?;
-        handle_auth_debug_unlock_token(env, &request, &challenge)?;
-        Ok(request.unlock_level)
+    let (result, response_sent) = match handle_auth_debug_unlock_request(env) {
+        (Ok((request, challenge)), request_response_sent) => {
+            let (token_result, token_response_sent) =
+                handle_auth_debug_unlock_token(env, &request, &challenge);
+            (
+                token_result.map(|_| request.unlock_level),
+                request_response_sent || token_response_sent,
+            )
+        }
+        (Err(err), response_sent) => (Err(err), response_sent),
     };
-
-    let result = debug_unlock_op();
     match result {
         Ok(unlock_level) => {
             env.soc_ifc.set_ss_dbg_unlock_level(unlock_level);
@@ -245,7 +271,7 @@ fn handle_production(env: &mut RomEnv) -> CaliptraResult<()> {
             env.soc_ifc.set_ss_dbg_unlock_result(false);
         }
     }
-    env.soc_ifc.set_ss_dbg_unlock_in_progress(false);
+    finish_debug_unlock(env, response_sent);
 
     cprintln!("[dbg_prod] --");
     result.map(|_| ())