Start recovery flow between Caliptra Core, MCU, and fake BMC

[swenson]

We start implementing a simulated recovery flow engine in a fake BMC, and having it work with Caliptra Core and MCU bootup.

This depends on an event bus being hooked up between Caliptra Core, the MCU, and our fake BMC, which is processed on each end to translate events. For example, recovery block reads and writes from the BMC are translated to recovery registers available through AXI in Caliptra Core.

This flow is a bit complex, and is not 100% finished yet. Currently it is working well enough that:

• Emulators start and enable active mode
• MCU ROM boots and sets up Caliptra Core's fuse registers
• MCU ROM starts the recovery flow
• Calipta Core ROM boots and requests the first recovery image (Caliptra's own firmware)
• Caliptra Core downloads the firmware successfully

The next step will be to get through validation and handle the SoC manifest and MCU firmware in Caliptra's runtime code.

But, I wanted to do a check in so that these PRs don't become too overwhelming.

Assuming you have caliptra-sw in ../caliptra-sw, have built the ROM (cd rom/dev && make build-rom) and the signed Caliptra firmware (cd rom/dev && make build-fw-image), and have a file (doesn't yet matter the contents) soc-manifest.bin, you can test this whole flow with:

$ cargo xtask runtime --caliptra-rom ../caliptra-sw/target/riscv32imc-unknown-none-elf/firmware/caliptra-rom.bin --caliptra-firmware ../caliptra-sw/target/riscv32imc-unknown-none-elf/firmware/caliptra-rom-test-fw --soc-manifest soc-manifest.bin --active-mode

...
[ldev] Signing Cert with MLDSA AUTHORITY.KEYID = 8
[ldev] --
[fwproc] Wait for Commands...
[fwproc] Recv command 0x52494644
[emulator bmc recovery] Recovery state transition: ReadDeviceStatus -> WaitForRecoveryStatus
[emulator bmc recovery] Sending recovery image 0
[emulator bmc recovery] Recovery state transition: WaitForRecoveryStatus -> WaitForRecoveryPending
[fwproc] Waiting for payload available signal...
[fwproc] Recovery payload of 131072 bytes available
[fwproc] Received Image from Recovery Interface of size 131072 bytes
ROM Fatal Error: 0x000B0003

(The fatal error is signature validation failure, which is to be expected.)

Depends on chipsalliance/caliptra-sw#1938

Copilot reviewed 7 out of 17 changed files in this pull request and generated no comments.

Files not reviewed (10)

• emulator/bmc/src/recovery.rs: Evaluated as low risk
• emulator/periph/src/lib.rs: Evaluated as low risk
• emulator/app/src/main.rs: Evaluated as low risk
• emulator/bmc/Cargo.toml: Evaluated as low risk
• emulator/bmc/src/bmc.rs: Evaluated as low risk
• emulator/bmc/src/lib.rs: Evaluated as low risk
• emulator/app/Cargo.toml: Evaluated as low risk
• emulator/caliptra/src/caliptra.rs: Evaluated as low risk
• xtask/src/runtime.rs: Evaluated as low risk
• xtask/src/main.rs: Evaluated as low risk

Comments suppressed due to low confidence (4)

emulator/periph/src/mci.rs:4

• [nitpick] The Mci struct is currently empty and doesn't provide any functionality. Is this intentional? If so, consider adding a comment or documentation to clarify its purpose.

pub struct Mci {}

rom/src/riscv.rs:207

• The value 123 should be defined as a constant with a meaningful name.

while mci.flow_status() != 123 {

rom/src/riscv.rs:171

• [nitpick] The error message could be more descriptive, e.g., 'Firmware validation failed: detected invalid firmware; halting'.

romtime::println!("Invalid firmware detected; halting");

rom/src/riscv.rs:180

• Add a comment explaining why writing to the address 0x1000_2000 exits the emulator.

unsafe { core::ptr::write_volatile(0x1000_2000 as *mut u32, exit_code); }