Use measurement token in auxflash reset as well

cmd/auxflash/src/lib.rs

@@ -353,7 +353,7 @@ impl<'a> AuxFlashHandler<'a> {
     }
 
     pub fn reset(&mut self) -> Result<()> {
-        self.core.reset()
+        self.core.reset_with_handoff(self.hubris)
     }
 
     pub fn auxflash_write_from_archive(

cmd/flash/Cargo.toml

@@ -13,7 +13,6 @@ humility-probes-core = { workspace = true }
 cmd-auxflash = { workspace = true }
 clap = { workspace = true }
 anyhow = { workspace = true }
-measurement-token = { workspace = true }
 parse_int = { workspace = true }
 num-traits = { workspace = true }
 tempfile = { workspace = true }

cmd/flash/src/lib.rs

@@ -407,23 +407,8 @@ fn flashcmd(context: &mut ExecutionContext) -> Result<()> {
         std::thread::sleep(std::time::Duration::from_millis(delay));
     }
 
-    // If this image uses handoff to send a measurement token between the RoT
-    // and SP, this won't work with a debugger physically attached.  To prevent
-    // the SP from resetting itself, we write a different token which skips this
-    // reboot loop.  The memory address and token values are pulled from the
-    // `measurement-token` crate in `lpc55_support`, which is also used in the
-    // SP firmware.
-    if hubris.manifest.features.iter().any(|s| s == "measurement-handoff") {
-        core.reset_and_halt(std::time::Duration::from_millis(25))?;
-        humility::msg!("skipping measurement token handoff");
-        core.write_word_32(
-            measurement_token::SP_ADDR as u32,
-            measurement_token::SKIP,
-        )?;
-        core.run()?;
-    } else {
-        core.reset()?;
-    }
+    // Reset, using the handoff token if present in the archive
+    core.reset_with_handoff(hubris)?;
 
     // At this point, we can attempt to program the auxiliary flash.  This has
     // to happen *after* the image is flashed and the core is reset, because it

cmd/tofino-eeprom/src/lib.rs

@@ -140,10 +140,6 @@ impl<'a> EepromHandler<'a> {
         humility::msg!("done");
         Ok(())
     }
-
-    pub fn reset(&mut self) -> Result<()> {
-        self.core.reset()
-    }
 }
 
 ////////////////////////////////////////////////////////////////////////////////

humility-core/Cargo.toml

@@ -21,6 +21,7 @@ idol.workspace = true
 indexmap.workspace = true
 indicatif.workspace = true
 log.workspace = true
+measurement-token.workspace = true
 multimap.workspace = true
 num-derive.workspace = true
 num-traits.workspace = true

humility-core/src/core.rs

@@ -69,6 +69,28 @@ pub trait Core {
     /// halt
     fn reset_and_halt(&mut self, dur: std::time::Duration) -> Result<()>;
 
+    /// Reset the chip, with special handling for measurement handoff
+    ///
+    /// If this image uses handoff to send a measurement token between the RoT
+    /// and SP, this won't work with a debugger physically attached.  To prevent
+    /// the SP from resetting itself, we write a different token which skips
+    /// this reboot loop.  The memory address and token values are pulled from
+    /// the `measurement-token` crate in `lpc55_support`, which is also used in
+    /// the SP firmware.
+    fn reset_with_handoff(&mut self, hubris: &HubrisArchive) -> Result<()> {
+        if hubris.manifest.features.iter().any(|s| s == "measurement-handoff") {
+            self.reset_and_halt(std::time::Duration::from_millis(25))?;
+            crate::msg!("skipping measurement token handoff");
+            self.write_word_32(
+                measurement_token::SP_ADDR as u32,
+                measurement_token::SKIP,
+            )?;
+            self.run()
+        } else {
+            self.reset()
+        }
+    }
+
     /// Called before starting a series of operations.  May halt the target if
     /// the target does not allow operations while not halted.  Should not be
     /// intermixed with [`halt`]/[`run`].