Add special-case handling for measurement token handoff (#552)

Without this change, the SP's "multiple seconds of resets" in
oxidecomputer/hubris#2138 cause Humility to time out. We could increase
Humility's timeout, but having an explicit SKIP token seems like a cleaner
solution; with the SWD dongle attached, the SP is definitely not getting
measured!

Author: mkeeter

Cargo.lock

@@ -87,9 +87,10 @@ hif = { git = "https://github.com/oxidecomputer/hif" }
 humpty = { git = "https://github.com/oxidecomputer/humpty", version = "0.1.3" }
 idol = {git = "https://github.com/oxidecomputer/idolatry.git"}
 idt8a3xxxx = { git = "https://github.com/oxidecomputer/idt8a3xxxx" }
+measurement-token = { git = "https://github.com/oxidecomputer/lpc55_support", default-features = false }
 pmbus = { git = "https://github.com/oxidecomputer/pmbus" }
-spd = { git = "https://github.com/oxidecomputer/spd" }
 serialport = { git = "https://github.com/jgallagher/serialport-rs", branch = "illumos-support" }
+spd = { git = "https://github.com/oxidecomputer/spd" }
 tlvc = { git = "https://github.com/oxidecomputer/tlvc" }
 tlvc-text = {git = "https://github.com/oxidecomputer/tlvc"}
 vsc7448-info = { git = "https://github.com/oxidecomputer/vsc7448.git" }

Cargo.toml

@@ -13,6 +13,7 @@ humility-probes-core = { workspace = true }
 cmd-auxflash = { workspace = true }
 clap = { workspace = true }
 anyhow = { workspace = true }
+measurement-token = { workspace = true }
 parse_int = { workspace = true }
 num-traits = { workspace = true }
 tempfile = { workspace = true }

cmd/flash/Cargo.toml

@@ -403,7 +403,23 @@ fn flashcmd(context: &mut ExecutionContext) -> Result<()> {
         std::thread::sleep(std::time::Duration::from_millis(delay));
     }
 
-    core.reset()?;
+    // If this image uses handoff to send a measurement token between the RoT
+    // and SP, this won't work with a debugger physically attached.  To prevent
+    // the SP from resetting itself, we write a different token which skips this
+    // reboot loop.  The memory address and token values are pulled from the
+    // `measurement-token` crate in `lpc55_support`, which is also used in the
+    // SP firmware.
+    if hubris.manifest.features.iter().any(|s| s == "measurement-handoff") {
+        core.reset_and_halt(std::time::Duration::from_millis(25))?;
+        humility::msg!("skipping measurement token handoff");
+        core.write_word_32(
+            measurement_token::SP_ADDR as u32,
+            measurement_token::SKIP,
+        )?;
+        core.run()?;
+    } else {
+        core.reset()?;
+    }
 
     // At this point, we can attempt to program the auxiliary flash.  This has
     // to happen *after* the image is flashed and the core is reset, because it

cmd/flash/src/lib.rs

@@ -17,7 +17,7 @@
 
 [package]
 name = "humility-bin"
-version = "0.12.6"
+version = "0.12.7"
 edition = "2021"
 license = "MPL-2.0"
 rust-version = "1.68"

humility-bin/Cargo.toml

@@ -13,7 +13,7 @@ For more information try --help
 
 ```
 $ humility --chip this-can-be-anything -V
-humility 0.12.6 
+humility 0.12.7 
 
 ```
 
@@ -28,7 +28,7 @@ For more information try --help
 
 ```
 $ humility -c apx432 -V
-humility 0.12.6 
+humility 0.12.7 
 
 ```
 

humility-bin/tests/cmd/chip.trycmd

@@ -2,14 +2,14 @@ Long version flag:
 
 ```
 $ humility --version
-humility 0.12.6 
+humility 0.12.7 
 
 ```
 
 Short version flag:
 
 ```
 $ humility -V
-humility 0.12.6 
+humility 0.12.7 
 
 ```

humility-bin/tests/cmd/version.trycmd

@@ -40,7 +40,7 @@ const OXIDE_NT_HUBRIS_ARCHIVE: u32 = OXIDE_NT_BASE + 1;
 const OXIDE_NT_HUBRIS_REGISTERS: u32 = OXIDE_NT_BASE + 2;
 const OXIDE_NT_HUBRIS_TASK: u32 = OXIDE_NT_BASE + 3;
 
-const MAX_HUBRIS_VERSION: u32 = 9;
+const MAX_HUBRIS_VERSION: u32 = 10;
 
 #[derive(Default, Debug, Serialize)]
 pub struct HubrisManifest {