Add special-case handling for measurement token handoff

Author: mkeeter

Cargo.lock

@@ -87,9 +87,10 @@ hif = { git = "https://github.com/oxidecomputer/hif" }
 humpty = { git = "https://github.com/oxidecomputer/humpty", version = "0.1.3" }
 idol = {git = "https://github.com/oxidecomputer/idolatry.git"}
 idt8a3xxxx = { git = "https://github.com/oxidecomputer/idt8a3xxxx" }
+measurement-token = { git = "https://github.com/oxidecomputer/lpc55_support", default-features = false }
 pmbus = { git = "https://github.com/oxidecomputer/pmbus" }
-spd = { git = "https://github.com/oxidecomputer/spd" }
 serialport = { git = "https://github.com/jgallagher/serialport-rs", branch = "illumos-support" }
+spd = { git = "https://github.com/oxidecomputer/spd" }
 tlvc = { git = "https://github.com/oxidecomputer/tlvc" }
 tlvc-text = {git = "https://github.com/oxidecomputer/tlvc"}
 vsc7448-info = { git = "https://github.com/oxidecomputer/vsc7448.git" }

Cargo.toml

@@ -13,6 +13,7 @@ humility-probes-core = { workspace = true }
 cmd-auxflash = { workspace = true }
 clap = { workspace = true }
 anyhow = { workspace = true }
+measurement-token = { workspace = true }
 parse_int = { workspace = true }
 num-traits = { workspace = true }
 tempfile = { workspace = true }

cmd/flash/Cargo.toml

@@ -403,7 +403,23 @@ fn flashcmd(context: &mut ExecutionContext) -> Result<()> {
         std::thread::sleep(std::time::Duration::from_millis(delay));
     }
 
-    core.reset()?;
+    // If this image uses handoff to send a measurement token between the RoT
+    // and SP, this won't work with a debugger physically attached.  To prevent
+    // the SP from resetting itself, we write a different token which skips this
+    // reboot loop.  The memory address and token values are pulled from the
+    // `measurement-token` crate in `lpc55_support`, which is also used in the
+    // SP firmware.
+    if hubris.manifest.features.iter().any(|s| s == "measurement-handoff") {
+        core.reset_and_halt(std::time::Duration::from_millis(25))?;
+        humility::msg!("skipping measurement token handoff");
+        core.write_word_32(
+            measurement_token::SP_ADDR as u32,
+            measurement_token::SKIP,
+        )?;
+        core.run()?;
+    } else {
+        core.reset()?;
+    }
 
     // At this point, we can attempt to program the auxiliary flash.  This has
     // to happen *after* the image is flashed and the core is reset, because it

cmd/flash/src/lib.rs

@@ -40,7 +40,7 @@ const OXIDE_NT_HUBRIS_ARCHIVE: u32 = OXIDE_NT_BASE + 1;
 const OXIDE_NT_HUBRIS_REGISTERS: u32 = OXIDE_NT_BASE + 2;
 const OXIDE_NT_HUBRIS_TASK: u32 = OXIDE_NT_BASE + 3;
 
-const MAX_HUBRIS_VERSION: u32 = 9;
+const MAX_HUBRIS_VERSION: u32 = 10;
 
 #[derive(Default, Debug, Serialize)]
 pub struct HubrisManifest {