[runtime] Start recovery flow in the runtime #1904

swenson · 2025-01-23T00:49:27Z

This stubs out the recovery flow in the runtime.

We also update the DMA peripheral so that it can be used as a
ureg::Mmio, which will allow us to use the autogenerated I3C recovery
register interface instead of hardcoding offsets.

We also had to modify ureg slightly to add Default, TryFrom<u32>,
and TryInto<u32> constraints to Uint to make it simpler to use with the
DMA interface.

This builds on #1867 and rewrites it to use the updated DMA interface.

swenson · 2025-01-23T00:52:25Z

drivers/src/dma.rs

@@ -62,7 +106,7 @@ pub struct DmaWriteTransaction {

 /// Dma Widget
 pub struct Dma {
-    dma: AxiDmaReg,
+    dma: Cell<Option<AxiDmaReg>>,


We have to switch to a Cell because the Mmio and MmioMut interfaces require that the methods use &self instead of &mut self, so we need interior mutability.

For safety, I used a with_dma() to ensure that the AxiDmaReg is only used by one function at a time, though this is probably overkill since Caliptra is single-threaded.

Suggest simplifying the code (if possible) with the single-threaded execution assumption.

mhatrevi · 2025-01-28T00:55:33Z

drivers/src/dma.rs

+            self.dma.set(Some(dma));
+            Ok(result)
+        } else {
+            Err(CaliptraError::RUNTIME_INTERNAL) // should never happen


Suggest renaming this to something like 'DRIVERS_INTERNAL' to disambiguate from a Runtime app error.

mhatrevi · 2025-01-28T01:16:50Z

runtime/src/recovery_flow.rs

+            .auth_manifest_image_metadata_col = image_metadata_collection;
+        // [TODO][CAP2]: capture measurement of Soc manifest?
+        // [TODO][CAP2]: this should be writing to MCU SRAM directly via AXI
+        let _mcu_size_bytes = dma_recovery.download_image_to_mbox(SOC_MANIFEST_INDEX)?;


This should use the MCU_FIRMWARE_INDEX.

mhatrevi

Please see the feedback.

jhand2 · 2025-01-28T19:23:19Z

runtime/src/drivers.rs

@@ -171,6 +176,9 @@ impl Drivers {
            ResetReason::ColdReset => {
                cfi_assert_eq(self.soc_ifc.reset_reason(), ResetReason::ColdReset);
                Self::initialize_dpe(self)?;
+                if self.soc_ifc.active_mode() {


I wonder if this should be a build-time flag since for a given integration it's either active or not. Otoh, it's probably easier to have a less complicated test matrix for RT.

Would we plan on building a separate active mode ROM then?

jhand2 · 2025-01-28T19:27:01Z

runtime/src/recovery_flow.rs

+        let _soc_size_bytes = dma_recovery.download_image_to_mbox(SOC_MANIFEST_INDEX)?;
+        let Some(preamble) = AuthManifestPreamble::read_from_prefix(drivers.mbox.raw_mailbox_contents()) else {
+            return Err(CaliptraError::IMAGE_VERIFIER_ERR_MANIFEST_SIZE_MISMATCH);
+        };
+        let Some(image_metadata_collection) = AuthManifestImageMetadataCollection::read_from_prefix(&drivers.mbox.raw_mailbox_contents()[AUTH_MANIFEST_PREAMBLE_SIZE..]) else {
+            return Err(CaliptraError::IMAGE_VERIFIER_ERR_MANIFEST_SIZE_MISMATCH);
+        };


nit: can probably simplify this by making a single stuct that contains AuthManifestPreamble and AuthManifestImageMetadataCollection and then doing a single read.

ureg/src/lib.rs

jhand2 · 2025-01-28T19:29:18Z

ureg/src/lib.rs

+    fn from_u32(val: u32) -> Self {
+        (val & 0xff) as u8
+    }


Is this needed for multiple types? I think I would prefer to the the truncation closer to the specific register that needs it so that we can review specific usages as not dropping any meaningful bytes.

It's not truly needed except on paper, as we don't have any 8- or 16-bit registers.

I think we can drop this and replace it with TryFrom<u32>.

mhatrevi · 2025-01-29T01:30:13Z

runtime/src/recovery_flow.rs

+
+        // // download SoC manifest
+        let _soc_size_bytes = dma_recovery.download_image_to_mbox(SOC_MANIFEST_INDEX)?;
+        let Some(manifest) = AuthorizationManifest::read_from_prefix(drivers.mbox.raw_mailbox_contents()) else {


This is not efficient. AuthorizationManifest is of 14284 bytes; most of the time there will only be a handful of image digests in it. I would simply add a TODO here to call the existing set_manifest_code.

swenson · 2025-01-30T18:52:10Z

PR updated and rebased. PTAL

This stubs out the recovery flow in the runtime. We also update the DMA peripheral so that it can be used as a `ureg::Mmio`, which will allow us to use the autogenerated I3C recovery register interface instead of hardcoding offsets. We also had to modify `ureg` slightly to remove the unused `impl Uint` for `u64` (because we don't don't support 64-bit AXI transfers) and add a `from_u32()` method for the (unused) `u8` and `u16` implementations. This builds on #1867 and rewrites it to use the updated DMA interface.

… macro

swenson added the Caliptra v2.0 Items to be considered for v2.0 Release label Jan 23, 2025

swenson requested review from jhand2, fdamato, rusty1968, bluegate010, mhatrevi, vsonims, ajisaxena, korran and JohnTraverAmd as code owners January 23, 2025 00:49

swenson commented Jan 23, 2025

View reviewed changes

swenson force-pushed the download-manifest-mcu-fw branch 2 times, most recently from 9152e52 to c9b226d Compare January 23, 2025 22:00

swenson requested review from jlmahowa-amd, wmaroneAMD and nquarton as code owners January 23, 2025 22:57

mhatrevi reviewed Jan 28, 2025

View reviewed changes

mhatrevi previously approved these changes Jan 28, 2025

View reviewed changes

swenson dismissed mhatrevi’s stale review via e54babc January 28, 2025 17:52

jhand2 reviewed Jan 28, 2025

View reviewed changes

mhatrevi reviewed Jan 29, 2025

View reviewed changes

swenson force-pushed the download-manifest-mcu-fw branch from 0eade71 to c56a00d Compare January 30, 2025 18:51

swenson force-pushed the download-manifest-mcu-fw branch from c56a00d to 029bf2a Compare January 31, 2025 17:24

swenson added 5 commits January 31, 2025 09:29

Address feedback

76758de

Read the whole manifest in at once

919ca05

Add back U64; ensure that we only support 32-bit DMA with unreachable…

de27ca7

… macro

Eliminate from_u32 with TryFrom<u32>; add todo about set_manifest

020f2a3

swenson force-pushed the download-manifest-mcu-fw branch from 029bf2a to 020f2a3 Compare January 31, 2025 17:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[runtime] Start recovery flow in the runtime #1904

[runtime] Start recovery flow in the runtime #1904

swenson commented Jan 23, 2025 •

edited

Loading

swenson Jan 23, 2025

mhatrevi Jan 28, 2025

mhatrevi Jan 28, 2025

mhatrevi Jan 28, 2025

mhatrevi left a comment

jhand2 Jan 28, 2025

swenson Jan 28, 2025

jhand2 Jan 28, 2025

jhand2 Jan 28, 2025

swenson Jan 28, 2025

swenson Jan 30, 2025

mhatrevi Jan 29, 2025

swenson commented Jan 30, 2025

[runtime] Start recovery flow in the runtime #1904

Are you sure you want to change the base?

[runtime] Start recovery flow in the runtime #1904

Conversation

swenson commented Jan 23, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhatrevi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

swenson commented Jan 30, 2025

swenson commented Jan 23, 2025 •

edited

Loading