Record subsystem mode in ROM DeviceStatus measurement

[mhatrevi]

Summary

ROM currently uses CPTRA_HW_CONFIG.subsystem_mode_en for flow control, but the mode is not cryptographically recorded in the ROM DeviceStatus PCR entry or the matching FMC Alias TCB/device-info material. A verifier therefore cannot directly distinguish passive vs subsystem mode from signed/measured evidence.

Current behavior

SocIfc::subsystem_mode() reads CPTRA_HW_CONFIG.subsystem_mode_en:

• drivers/src/soc_ifc.rs

ROM uses this value for control flow, for example debug unlock and update/reset paths, but ROM PCR extension in rom/dev/src/pcr.rs builds the DeviceStatus measured data from these fields only:

• owner public key hash present in fuses
• anti-rollback disable fuse
• vendor ECC/LMS/MLDSA revocation fuses
• firmware fuse SVN
• SoC manifest min/max SVN fuses
• PQC key type fuse
• lifecycle
• debug locked
• cold boot firmware SVN
• vendor ECC/PQC public key indices

The measured data does not include subsystem_mode_en or a stable digest/encoding of CPTRA_HW_CONFIG.

The FMC Alias TCB/device-info hashes in common/src/dice.rs are documented to stay in sync with the ROM PCR contents, and they also do not include subsystem mode today.

Why this matters

A verifier that validates the signed DICE/attestation chain and PCR log cannot directly tell whether Caliptra was operating in passive mode or subsystem mode. That mode can affect available commands, mailbox behavior, DMA/recovery flows, external response support, and other subsystem-only behavior.

Requested change

Add subsystem mode to the cryptographically measured device status/evidence. Possible implementation:

1. Extend the ROM DeviceStatus PCR entry in rom/dev/src/pcr.rs with soc_ifc.subsystem_mode() as u8.
2. Update PcrLogEntry::measured_data() sizing for PcrLogEntryId::DeviceStatus in drivers/src/pcr_log.rs.
3. Update FMC Alias TCB/device-info hash construction in common/src/dice.rs so certificate TCB info remains in sync with PCR contents.
4. Update ROM integration tests that assert the DeviceStatus PCR log entry contents.
5. Consider whether additional stable CPTRA_HW_CONFIG bits should be measured together, rather than only subsystem_mode_en.

Acceptance criteria

• ROM PCR log DeviceStatus contains an explicit passive/subsystem mode value.
• FMC Alias TCB/device-info hash remains consistent with the PCR contents.
• Tests verify both passive and subsystem-mode expected values where practical.
• Documentation/comments identify the measured field and its source (CPTRA_HW_CONFIG.subsystem_mode_en).

[RaunakGu]

Hi @mhatrevi,

Which ROM release milestone are we targeting this?

[mhatrevi]

Hi @mhatrevi,

Which ROM release milestone are we targeting this?

@RaunakGu This is for 2.2.