Changes to Runtime Specification

Comparing version 2.1 to 2.0
+925 additions -166 deletions
@@ -1,10 +1,10 @@
11 <div style="font-size: 0.85em; color: #656d76; margin-bottom: 1em; padding: 0.5em; background: #f6f8fa; border-radius: 4px;">
2-📄 Source: <a href="https://github.com/chipsalliance/caliptra-sw/blob/c43041a0e8e8cf14a742f87117cbc02fb917a499/runtime/README.md" target="_blank">chipsalliance/caliptra-sw/runtime/README.md</a> @ <code>c43041a</code>
2+📄 Source: <a href="https://github.com/chipsalliance/caliptra-sw/blob/af5f9cf200595ef01b3c00569625b59a9e915da7/runtime/README.md" target="_blank">chipsalliance/caliptra-sw/runtime/README.md</a> @ <code>af5f9cf</code>
33 </div>
44
5-# Caliptra Runtime Firmware v2.0.1
6-
7-*Spec version: 0.3*
5+# Caliptra Runtime Firmware v2.1
6+
7+*Spec version: 1.0*
88
99 This specification describes the Caliptra Runtime Firmware.
1010
@@ -23,11 +23,17 @@
2323 * Add support for passive mode (same as 1.x) and subsystem (or active) mode
2424 * [MCU Runtime loading](#boot-and-initialization) (subsystem mode)
2525 * [Cryptographic mailbox commands](#cryptographic-mailbox-commands-new-in-20)
26-* `ECDSA384_SIGNATURE_VERIFY` and `LMS_SIGNATURE_VERIFY` require the hash to be included in the message, as the SHA accelerator registers are no longer accessible outside Caliptra. These commands return a non-approved FIPS status because the caller supplies the digest.
26+* `ECDSA384_SIGNATURE_VERIFY` and `LMS_SIGNATURE_VERIFY`require the hash to be included in the message, as the SHA accelerator registers are no longer accessible outside Caliptra.
27+
28+v2.1:
29+
30+* [External mailbox commands](#external-mailbox-cmd)
31+* [Encrypted firmware support](#encrypted-firmware-support-21-subsystem-mode-only)
32+* [OCP LOCK v1.0 commands](#mailbox-commands-ocp-lock-v10)
33+* `ECDSA384_SIGNATURE_VERIFY` and `LMS_SIGNATURE_VERIFY` return a non-approved FIPS status because the caller supplies the digest.
34+
2735
2836 ## Spec Opens
29-
30-* Cryptographic Mailbox: ML-KEM support
3137
3238 ## Runtime Firmware environment
3339
@@ -40,6 +46,20 @@
4046 * Initialize the [DICE Protection Environment (DPE)](#dice-protection-environment-dpe)
4147 * Initialize any SRAM structures used by Runtime Firmware
4248 * Upload the firmware to the Manufacturer Control Unit (2.0, subsystem mode only)
49+
50+#### Encrypted Firmware Support (2.1, subsystem mode only)
51+
52+When ROM receives the `RI_DOWNLOAD_ENCRYPTED_FIRMWARE` command instead of `RI_DOWNLOAD_FIRMWARE`, it sets the boot mode to `EncryptedFirmware`. In this mode:
53+
54+1. Runtime downloads the encrypted MCU firmware to MCU SRAM via the recovery interface
55+2. Runtime does **not** activate the MCU firmware immediately
56+3. The MCU ROM can then:
57+ - Import an AES key using `CM_IMPORT`
58+ - Decrypt the firmware in-place using `CM_AES_GCM_DECRYPT_DMA`
59+ - Send `ACTIVATE_FIRMWARE` with the `INITIAL_ACTIVATE` flag set, so Runtime publishes `FW_EXEC_CTRL[MCU]` without performing the hitless-update reload/verify dance (the firmware was already integrity-checked end-to-end by `RI_DOWNLOAD_ENCRYPTED_FIRMWARE` and `CM_AES_GCM_DECRYPT_DMA`). See [`ACTIVATE_FIRMWARE`](#activate_firmware) for the gating rules.
60+ - Trigger a warm reset; MCI releases MCU once `FW_EXEC_CTRL[MCU]` is asserted, and MCU FwBoot jumps into the decrypted firmware.
61+
62+The `CM_AES_GCM_DECRYPT_DMA` command is intended to be used for the `EncryptedFirmware` boot mode and performs a SHA384 integrity check of the ciphertext before decryption, but can be used to decrypt other images as well in any boot mode.
4363
4464 For behavior during other types of reset, see [Runtime firmware updates](#runtime-firmware-updates).
4565
@@ -59,6 +79,20 @@
5979
6080 Callers must wait until Caliptra is no longer busy to call a mailbox command.
6181
82+### Command watchdog
83+
84+On debug-locked devices, Runtime starts WDT1 before processing each mailbox
85+command with a timeout of `max(20_000_000, CPTRA_WDT_CFG)` cycles. Runtime reads
86+the full 64-bit configuration value; zero or a value below 20 million cycles
87+retains the existing 20-million-cycle minimum. Larger values extend the timeout.
88+
89+The timeout covers the entire command, including DMA image hashing and any
90+measurement stashing. Platforms using single-DWORD DMA hashing must configure
91+enough time for their supported image sizes and worst-case AXI latency, plus the
92+remaining command processing. Runtime stops the watchdog after command
93+processing and while idle. The watchdog is not started on debug-unlocked devices.
94+This Runtime minimum does not change ROM's watchdog configuration policy.
95+
6296 ### Fault handling
6397
6498 A mailbox command can fail to complete in the following ways:
@@ -94,7 +128,7 @@
94128
95129 CM itself does not provide any storage for the keys: when generated, they are returned to the caller in encrypted form, and must be passed back to be used.
96130
97-These mailbox commands provide SHA, HMAC, HKDF, AES, RNG, MLDSA, and ECDSA services.
131+These mailbox commands provide SHA, HMAC, HKDF, AES, RNG, MLDSA, ECDSA, and ML-KEM services.
98132
99133 Note that while MLDSA and ECDSA keys can be imported, generated, and used in the cryptographic mailbox commands (i.e., `CM_*` commands) through CMKs, these keys are *NOT* tied DICE or DPE, so their use may be restricted for certain purposes.
100134
@@ -126,8 +160,7 @@
126160
127161 | **Name** | **Bits** | **Description** |
128162 | ------------- | -------- | -------------------------------------- |
129-| version | 8 | CMK version. Currently always 1. |
130-| flags | 8 | Bit 0 = FIPS valid |
163+| version | 16 | CMK version. Currently always 1. |
131164 | length | 16 | how many bits of key material are used |
132165 | key usage | 8 | represents which kind of key this is |
133166 | id | 24 | ID number |
@@ -162,8 +195,10 @@
162195 | --------- | --------- |
163196 | 0 | Reserved |
164197 | 1 | HMAC |
165-| 2 | HKDF |
166-| 3 | AES |
198+| 2 | AES |
199+| 3 | ECDSA |
200+| 4 | MLDSA |
201+| 5 | ML-KEM |
167202
168203
169204 #### Replay Prevention and Deletion
@@ -187,7 +222,7 @@
187222
188223 Each of these abilities are tied to Caliptra Vendor and Owner FW signing keys and should be independent of any SoC RoT FW signing keys.
189224
190-Manifest-based image authorization is implemented via three mailbox commands: [`SET_AUTH_MANIFEST`](#set-auth-manifest), [`SET_OWNER_AUTH_MANIFEST`](#set-owner-auth-manifest), and [`AUTHORIZE_AND_STASH`](#authorize-and-stash). A firmware ID identifies one platform firmware image and must be unique across the active vendor + owner and owner-only Image Metadata Collections. Both set commands reject a manifest containing an ID in the other active collection. `AUTHORIZE_AND_STASH` searches the vendor + owner collection first and then the owner-only collection; the provenance of the matching entry is reflected in its `auth_req_result` field.
225+Manifest-based image authorization is implemented via three mailbox commands: [`SET_AUTH_MANIFEST`](#set_auth_manifest), [`SET_OWNER_AUTH_MANIFEST`](#set_owner_auth_manifest), and [`AUTHORIZE_AND_STASH`](#authorize_and_stash). A firmware ID identifies one platform firmware image and must be unique across the active vendor + owner and owner-only Image Metadata Collections. Both set commands reject a manifest containing an ID in the other active collection. Mailbox commands that look up a firmware ID select exactly one collection through bits `[2:1]` of their `flags` argument.
191226
192227 ### Caliptra-Endorsed Aggregated Measured Boot
193228
@@ -305,7 +340,69 @@
305340 Mailbox user 0xFFFF_FFFF is reserved for Caliptra internal use. All mailbox
306341 commands from that user will fail.
307342
308-### FW\_LOAD
343+### Byte order of cryptographic fields
344+
345+Several mailbox commands include ECC P-384 and ML-DSA-87 public keys,
346+signatures, and SHA digest values stored as `[u32]` arrays.
347+The "big endian" / "little endian" labels in individual command tables describe
348+how the **standard byte representation** produced by cryptographic
349+tools maps to those `u32` words.
350+
351+Generally, any fields specified as **little-endian** byte representation will match the standard byte representation of the cryptographic protocols, since the RISC-V processor is a little-endian processor.
352+
353+#### ECC P-384 fields (big-endian words)
354+
355+Each 4-byte group from the standard representation is byte-reversed on the
356+wire.
357+
358+Example — suppose OpenSSL produces a 48-byte X coordinate starting with:
359+
360+```
361+OpenSSL raw bytes: AB CD EF 01 23 45 67 89 ...
362+ ~~~~~~~~~~~ ~~~~~~~~~~~
363+Mailbox bytes: 01 EF CD AB 89 67 45 23 ...
364+```
365+
366+In other words: split the tool output into 4-byte groups, then reverse each
367+group.
368+
369+#### ML-DSA-87 fields (little-endian words)
370+
371+No conversion is needed. Copy the raw bytes produced by an ML-DSA-87
372+implementation (e.g., OpenSSL 3.5+, the `fips204` crate, or the NIST reference
373+implementation) directly into the mailbox buffer.
374+
375+```
376+openssl pkey output: AB CD EF 01 23 45 67 89 ...
377+Mailbox bytes: AB CD EF 01 23 45 67 89 ... (identical)
378+```
379+
380+#### SHA digest fields (big-endian words)
381+
382+Hash digests stored as `u32[N]` arrays use the same big-endian word convention
383+as ECC fields. Each 4-byte group of the standard hash output is byte-reversed
384+on the wire.
385+
386+Example — suppose `openssl dgst -sha384` produces a digest starting with:
387+
388+```
389+openssl output: A1 B2 C3 D4 E5 F6 07 18 ...
390+ ~~~~~~~~~~~ ~~~~~~~~~~~
391+Mailbox u32[12]: D4 C3 B2 A1 18 07 F6 E5 ...
392+```
393+
394+#### u8 byte-array fields (no conversion needed)
395+
396+When ECC P-384 keys, signatures, or SHA digests are declared as `u8[48]` (rather
397+than `u32[12]`), they use standard big-endian byte order — the same format
398+produced by OpenSSL and other cryptographic tools. No byte-swapping is required.
399+
400+For example, the `ECDSA384_SIGNATURE_VERIFY` input fields (`pub_key_x`,
401+`pub_key_y`, `signature_r`, `signature_s`, `hash`) and the `QUOTE_PCRS_ECC384`
402+output fields (`digest`, `signature_r`, `signature_s`) can be used directly with
403+`openssl` or OpenSSL's `BN_bin2bn()` without any conversion.
404+
405+### FIRMWARE\_LOAD
309406
310407 The `FIRMWARE_LOAD` command is handled by both ROM and Runtime Firmware.
311408
@@ -369,7 +466,14 @@
369466 | -------- | -------- | ---------------
370467 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian.
371468 | fips\_status | u32 | Indicates if the command is FIPS approved or an error.
372-| capabilities | u8[16] | Firmware capabilities
469+| capabilities | u8[16] | Firmware capabilities. See table below for details.
470+
471+*Table: Firmware Capabilities Flags*
472+
473+| **Name** | **Bit** | **Description**
474+| --------------- | ------- | ---------------
475+| `RT_BASE` | 64 | Base capabilities for Caliptra Runtime v2.1.
476+| `RT_OCP_LOCK` | 65 | Runtime firmware and hardware supports OCP LOCK.
373477
374478 ### GET\_IDEV\_ECC384\_CERT
375479
@@ -658,7 +762,7 @@
658762 | **Name** | **Type** | **Description**
659763 | -------- | -------- | ---------------
660764 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian.
661-| fips\_status | u32 | Indicates if the command is FIPS approved or an error.
765+| fips\_status | u32 | `FIPS_NOT_APPROVED_USER_SUPPLIED_DIGEST`, because the caller supplies the digest.
662766
663767 ### LMS\_SIGNATURE\_VERIFY
664768
@@ -699,7 +803,7 @@
699803 | **Name** | **Type** | **Description**
700804 | -------- | -------- | ---------------
701805 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian.
702-| fips\_status | u32 | Indicates if the command is FIPS approved or an error.
806+| fips\_status | u32 | `FIPS_NOT_APPROVED_USER_SUPPLIED_DIGEST`, because the caller supplies the digest.
703807
704808 ### MLDSA87_SIGNATURE_VERIFY
705809
@@ -742,7 +846,7 @@
742846 | **Name** | **Type** | **Description**
743847 | -------- | -------- | ---------------
744848 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian.
745-| digest | u32[12] | Owner public key hash.
849+| digest | u32[12] | Owner public key hash. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields).
746850
747851 *Table: `INSTALL_OWNER_PK_HASH` output arguments*
748852
@@ -813,13 +917,13 @@
813917 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian.
814918 | fips\_status | u32 | Indicates if the command is FIPS approved or an error.
815919
816-### INVOKE\_DPE\_COMMAND
817-
818-Invokes a serialized DPE command.
920+### INVOKE\_DPE\_ECC384
921+
922+Invokes a serialized EC-P384 DPE profile command.
819923
820924 Command Code: `0x4450_4543` ("DPEC")
821925
822-*Table: `INVOKE_DPE_COMMAND` input arguments*
926+*Table: `INVOKE_DPE_ECC384` input arguments*
823927
824928 | **Name** | **Type** | **Description**
825929 | -------- | -------- | ---------------
@@ -827,7 +931,53 @@
827931 | data\_size | u32 | Length in bytes of the valid data in the data field.
828932 | data | u8[...] | DPE command structure as defined in the DPE iRoT profile.
829933
830-*Table: `INVOKE_DPE_COMMAND` output arguments*
934+*Table: `INVOKE_DPE_ECC384` output arguments*
935+
936+| **Name** | **Type** | **Description**
937+| -------- | -------- | ---------------
938+| chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian.
939+| fips\_status | u32 | Indicates if the command is FIPS approved or an error.
940+| data\_size | u32 | Length in bytes of the valid data in the data field.
941+| data | u8[...] | DPE response structure as defined in the DPE iRoT profile.
942+
943+### INVOKE\_DPE\_MLDSA87
944+
945+Invokes a serialized ML-DSA-87 DPE profile command. In subsystem mode a response
946+can be DMA'ed to an external address. This is especially useful for large
947+commands like `CertifyKey` or `DeriveContext` when exporting a CDI. Both of
948+these responses contain a potentially large certificate/CSR. To use this
949+feature, set the `EXTERNAL_AXI_RESPONSE` in `flags` and set the corresponding
950+AXI address and size fields. The response over the mailbox will only contain a
951+mailbox header (`chksum` and `fips_status`). The full response including the
952+mailbox header will be found at the given address.
953+
954+**Important restrictions for `EXTERNAL_AXI_RESPONSE` flag use:**
955+- This command is only available in subsystem mode, as DMA is only available in subsystem.
956+- This command is only available for MCU.
957+
958+Command Code: `0x4450_454D` ("DPEM")
959+
960+*Table: `INVOKE_DPE_MLDSA87` input arguments*
961+
962+| **Name** | **Type** | **Description** |
963+| -------------- | -------- | --------------------------------------------------------------------------- |
964+| chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
965+| flags | u32 | Flags to give configurations of the command. |
966+| axi\_addr\_lo | u32 | Lower word of the destination physical address. |
967+| axi\_addr\_hi | u32 | Upper word of the destination physical address. |
968+| axi\_max\_size | u32 | Maximum DMA response size. |
969+| data\_size | u32 | Length in bytes of the valid data in the data field. |
970+| data | u8[...] | DPE command structure as defined in the DPE iRoT profile. |
971+
972+
973+*Table: `INVOKE_DPE_MLDSA87` input flags*
974+
975+| **Name** | **Value** |
976+| ----------------------- | --------- |
977+| EXTERNAL\_AXI\_RESPONSE | 1 << 31 |
978+
979+
980+*Table: `INVOKE_DPE_MLDSA87` output arguments*
831981
832982 | **Name** | **Type** | **Description**
833983 | -------- | -------- | ---------------
@@ -890,8 +1040,36 @@
8901040 | PCRs | PcrValue[32] | Values of all PCRs.
8911041 | nonce | u8[32] | Return the nonce used as input for convenience.
8921042 | reset\_ctrs | u32[32] | Reset counters for all PCRs.
893-| digest | u8[64] | Return the SHA2-512 digest over the PCR values and the nonce, in byte reversed order.
1043+| digest | u8[64] | SHA2-512 digest over the PCR values and the nonce, in DWORD-reversed order with per-word byte swap. See note below.
8941044 | signature | u8[4628] | MLDSA-87 signature over the `digest` (4627 bytes + 1 Reserved byte). </br> The FMC Alias MLDSA seed stored in Key Vault slot 8 is utilized to generate the private key, which is subsequently used for the signing operation.
1045+
1046+**Digest byte order:** The `digest` field has two transformations applied relative
1047+to the standard `openssl dgst -sha512` output: (1) the 16 u32 words are in
1048+reversed order, and (2) the bytes within each word are reversed. For example, if
1049+`openssl dgst -sha512` produces `A1 B2 C3 D4 E5 F6 07 18 ... P1 P2 P3 P4`,
1050+the mailbox response contains `P4 P3 P2 P1 ... 18 07 F6 E5 D4 C3 B2 A1`.
1051+
1052+To **independently recompute** this digest from PCR values and nonce, compute the
1053+SHA2-512 hash, then apply two steps:
1054+
1055+```
1056+openssl dgst -sha512 output (64 bytes, shown as 16 four-byte groups):
1057+ A1 B2 C3 D4 | E5 F6 07 18 | ... | M1 M2 M3 M4 | P1 P2 P3 P4
1058+
1059+Step 1 — reverse the bytes within each 4-byte group:
1060+ D4 C3 B2 A1 | 18 07 F6 E5 | ... | M4 M3 M2 M1 | P4 P3 P2 P1
1061+
1062+Step 2 — reverse the order of all 16 groups:
1063+ P4 P3 P2 P1 | M4 M3 M2 M1 | ... | 18 07 F6 E5 | D4 C3 B2 A1
1064+ ^^^^^^^^^^^^ ^^^^^^^^^^^^
1065+ (last group from Step 1 is now first) (first group is now last)
1066+
1067+Mailbox digest = result of Step 2
1068+```
1069+
1070+To **verify the signature** with an external tool such as OpenSSL, pass the `digest`
1071+bytes as-is as the pre-hashed message to ML-DSA-87 verification — no conversion
1072+is needed because the signature was computed over these exact bytes.
8951073
8961074 ### EXTEND\_PCR
8971075
@@ -1163,35 +1341,69 @@
11631341 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian.
11641342 | fips\_status | u32 | Indicates if the command is FIPS approved or an error.
11651343
1166-### CERTIFY\_KEY\_EXTENDED
1167-
1168-Produces a DPE leaf certificate or CSR containing custom extensions provided by the SoC.
1344+### CERTIFY\_KEY\_EXTENDED\_ECC384
1345+
1346+Produces an ECC-P384 DPE leaf certificate or CSR containing custom extensions provided by the SoC.
11691347
11701348 Command Code: `0x434B_4558` ("CKEX")
11711349
1172-*Table: `CERTIFY_KEY_EXTENDED` input arguments*
1350+*Table: `CERTIFY_KEY_EXTENDED_ECC384` input arguments*
11731351
11741352 | **Name** | **Type** | **Description** |
11751353 | ----------------- | -------- | --------------------------------------------------------------------------- |
11761354 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
1355+| flags | u32 | Flags determining which custom extensions to include in the certificate. |
11771356 | certify\_key\_req | u8[72] | Certify Key Request. |
1178-| flags | u32 | Flags determining which custom extensions to include in the certificate. |
1179-
1180-
1181-*Table: `CERTIFY_KEY_EXTENDED` input flags*
1357+
1358+
1359+*Table: `CERTIFY_KEY_EXTENDED_ECC384` input flags*
11821360
11831361 | **Name** | **Offset** |
1184-| --------------- | ---------- |
1185-| DMTF_OTHER_NAME | 1 << 31 |
1186-
1187-
1188-*Table: `CERTIFY_KEY_EXTENDED` output arguments*
1189-
1190-| **Name** | **Type** | **Description** |
1191-| ------------------ | -------- | -------------------------------------------------------------------------- |
1362+| ----------------- | ---------- |
1363+| DMTF\_OTHER\_NAME | 1 << 31 |
1364+
1365+
1366+*Table: `CERTIFY_KEY_EXTENDED_ECC384` output arguments*
1367+
1368+| **Name** | **Type** | **Description** |
1369+| ------------------ | --------- | -------------------------------------------------------------------------- |
11921370 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
11931371 | fips\_status | u32 | Indicates if the command is FIPS approved or an error. |
1194-| certify\_key\_resp | u8[2176] | Certify Key Response. |
1372+| size | u32 | The size of the response in the certify\_key\_resp field. |
1373+| certify\_key\_resp | u8[25152] | Certify Key Response. |
1374+
1375+
1376+### CERTIFY\_KEY\_EXTENDED\_MLDSA87
1377+
1378+Produces an ML-DSA-87 DPE leaf certificate or CSR containing custom extensions provided by the SoC.
1379+
1380+Command Code: `0x434B_584D` ("CKXM")
1381+
1382+*Table: `CERTIFY_KEY_EXTENDED_MLDSA87` input arguments*
1383+
1384+| **Name** | **Type** | **Description** |
1385+| ----------------- | -------- | --------------------------------------------------------------------------- |
1386+| chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
1387+| flags | u32 | Flags determining which custom extensions to include in the certificate. |
1388+| certify\_key\_req | u8[72] | Certify Key Request. |
1389+
1390+
1391+*Table: `CERTIFY_KEY_EXTENDED_MLDSA87` input flags*
1392+
1393+| **Name** | **Offset** |
1394+| ----------------------- | ---------- |
1395+| DMTF\_OTHER\_NAME | 1 << 31 |
1396+| EXTERNAL\_AXI\_RESPONSE | 1 << 30 |
1397+
1398+
1399+*Table: `CERTIFY_KEY_EXTENDED_MLDSA87` output arguments*
1400+
1401+| **Name** | **Type** | **Description** |
1402+| ------------------ | --------- | -------------------------------------------------------------------------- |
1403+| chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
1404+| fips\_status | u32 | Indicates if the command is FIPS approved or an error. |
1405+| size | u32 | The size of the response in the certify\_key\_resp field. |
1406+| certify\_key\_resp | u8[25152] | Certify Key Response. |
11951407
11961408
11971409 ### CERTIFY\_KEY\_CHUNKS
@@ -1239,30 +1451,42 @@
12391451
12401452 The SoC uses this command and `SET_IMAGE_METADTA` to program an image manifest for Manifest-Based Image Authorization to Caliptra. In response to these commands, the Caliptra Runtime will verify the manifest by authenticating the public keys and in turn using them to authenticate the IMC. On successful verification, the Runtime will store the IMEs into DCCM for future use. Every active `fw_id` must be unique within this manifest and must not appear in the installed owner-only manifest. A collision rejects the command without replacing either active collection.
12411453
1454+The original SoC manifest may include an optional device UEID IME with the
1455+reserved `fw_id` `0x0000_0FFF`, immediately below the vendor-defined SoC image
1456+ID range beginning at `0x0000_1000`. Its 48-byte digest contains the 17-byte
1457+device UEID followed by 31 zero bytes.
1458+After authenticating the IMC, Runtime compares the complete value with the UEID
1459+assembled from the IDevID certificate-attribute fuses. A mismatch, including
1460+nonzero padding, rejects the command with
1461+`RUNTIME_AUTH_MANIFEST_UEID_MISMATCH` without replacing the active manifest.
1462+The UEID entry is excluded from normal image lookup, authorization, and
1463+activation. This interpretation does not apply to the owner-only manifest
1464+loaded by `SET_OWNER_AUTH_MANIFEST`.
1465+
12421466 Command Code: `0x4154_4D4E` ("ATMN")
12431467
12441468 *Table: `SET_AUTH_MANIFEST` input arguments*
12451469
1246-| **Name** | **Type** | **Description**
1247-| -------- | -------- | ---------------
1470+| **Name** | **Type** | **Description** |
1471+| -------- | -------- | --------------- |
12481472 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
12491473 | manifest size | u32 | The size of the full Authentication Manifest |
12501474 | preamble\_marker | u32 | Marker needs to be 0x4154_4D4E for the preamble to be valid |
12511475 | preamble\_size | u32 | Size of the preamble |
12521476 | preamble\_version | u32 | Version of the preamble |
12531477 | preamble\_flags | u32 | Manifest flags. See AUTH_MANIFEST_FLAGS below |
1254-| preamble\_vendor\_ecc384\_key | u32[24] | Vendor ECC384 key with X and Y coordinates in that order |
1255-| preamble\_vendor\_pqc\_key | u32[648] | Vendor MLDSA-87 or LMS-SHA192-H15 key |
1256-| preamble\_vendor\_ecc384\_sig | u32[24] | Vendor ECC384 signature |
1257-| preamble\_vendor\_PQC\_sig | u32[1157] | Vendor MLDSA-87 or LMOTS-SHA192-W4 signature |
1258-| preamble\_owner\_ecc384\_key | u32[24] | Owner ECC384 key with X and Y coordinates in that order |
1259-| preamble\_owner\_pqc\_key | u32[648] | Owner MLDSA-87 or LMS-SHA192-H15 key |
1260-| preamble\_owner\_ecc384\_sig | u32[24] | Owner ECC384 signature |
1261-| preamble\_owner\_PQC\_sig | u32[1157] | Owner MLDSA-87 or LMOTS-SHA192-W4 signature |
1262-| metadata\_vendor\_ecc384\_sig | u32[24] | Metadata Vendor ECC384 signature |
1263-| metadata\_vendor\_PQC\_sig | u32[1157] | Metadata Vendor MLDSA-87 or LMOTS-SHA192-W4 signature |
1264-| metadata\_owner\_ecc384\_sig | u32[24] | Metadata Owner ECC384 signature |
1265-| metadata\_owner\_PQC\_sig | u32[1157] | Metadata Owner MLDSA-87 or LMOTS-SHA192-W4 signature |
1478+| preamble\_vendor\_ecc384\_key | u32[24] | Vendor ECC384 key with X and Y coordinates in that order. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1479+| preamble\_vendor\_pqc\_key | u32[648] | Vendor MLDSA-87 or LMS-SHA192-H15 key. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1480+| preamble\_vendor\_ecc384\_sig | u32[24] | Vendor ECC384 signature. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1481+| preamble\_vendor\_PQC\_sig | u32[1157] | Vendor MLDSA-87 or LMOTS-SHA192-W4 signature. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1482+| preamble\_owner\_ecc384\_key | u32[24] | Owner ECC384 key with X and Y coordinates in that order. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1483+| preamble\_owner\_pqc\_key | u32[648] | Owner MLDSA-87 or LMS-SHA192-H15 key. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1484+| preamble\_owner\_ecc384\_sig | u32[24] | Owner ECC384 signature. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1485+| preamble\_owner\_PQC\_sig | u32[1157] | Owner MLDSA-87 or LMOTS-SHA192-W4 signature. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1486+| metadata\_vendor\_ecc384\_sig | u32[24] | Metadata Vendor ECC384 signature. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1487+| metadata\_vendor\_PQC\_sig | u32[1157] | Metadata Vendor MLDSA-87 or LMOTS-SHA192-W4 signature. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1488+| metadata\_owner\_ecc384\_sig | u32[24] | Metadata Owner ECC384 signature. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
1489+| metadata\_owner\_PQC\_sig | u32[1157] | Metadata Owner MLDSA-87 or LMOTS-SHA192-W4 signature. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields). |
12661490 | metadata\_entry\_entry\_count | u32 | number of metadata entries |
12671491 | metadata\_entries | Metadata[80] | The max number of metadata entries is 80 but less can be used |
12681492
@@ -1285,21 +1509,21 @@
12851509 | **Name** | **Type** | **Description** |
12861510 | ------------------------ | --------- | ---------------- |
12871511 | Image Hash | u8[48] | SHA2-384 hash of a SOC image. |
1288-
1289-| Image_id | u32 | This corresponds to the `Image Identifier` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1290-| Component_id | u32 | This corresponds to the `Component Id` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1291-| flags | u32 | This corresponds to the `flags` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1292-| Image Load Address High | u32 | This corresponds to the `Image Load Address High` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1293-| Image Load Address Low | u32 | This corresponds to the `Image Load Address Low` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1294-| Staging Address High | u32 | This corresponds to the `Staging Address High` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1295-| Staging Address Low | u32 | This corresponds to the `Staging Address Low` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1296-| Classification | u32 | This corresponds to the `Classification` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1297-| Version Number | u32 | This corresponds to the `Version Number` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1298-| Version String | u8[32] | This corresponds to the `Version String` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/auth-manifest/README.md)
1512+| Image_id | u32 | This corresponds to the `Image Identifier` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1513+| Component_id | u32 | This corresponds to the `Component Id` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1514+| flags | u32 | This corresponds to the `flags` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md). Bit 3 requests single-DWORD DMA reads when Runtime hashes the image from its load or staging address. If clear, Runtime uses burst DMA reads. |
1515+| Image Load Address High | u32 | This corresponds to the `Image Load Address High` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1516+| Image Load Address Low | u32 | This corresponds to the `Image Load Address Low` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1517+| Staging Address High | u32 | This corresponds to the `Staging Address High` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1518+| Staging Address Low | u32 | This corresponds to the `Staging Address Low` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1519+| Classification | u32 | This corresponds to the `Classification` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1520+| Version Number | u32 | This corresponds to the `Version Number` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1521+| Version String | u8[32] | This corresponds to the `Version String` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1522+
12991523
13001524 ### VERIFY_AUTH_MANIFEST
13011525
1302-This command verifies the integrity and authenticity of the provided image manifest, including the `DEBUG_IMAGE` policy described above. Unlike `SET_AUTH_MANIFEST`, it performs validation only and does not persist the manifest in DCCM or modify `FW_INFO.debug_policy`. It also rejects a `fw_id` collision with the currently installed owner-only manifest.
1526+This command verifies the integrity and authenticity of the provided image manifest, including the `DEBUG_IMAGE` policy described above and the optional device UEID. Unlike `SET_AUTH_MANIFEST`, it performs validation only and does not persist the manifest in DCCM or modify `FW_INFO.debug_policy`. It also rejects a `fw_id` collision with the currently installed owner-only manifest.
13031527
13041528 Command Code: `0x4154_564D` ("ATVM")
13051529
@@ -1316,11 +1540,11 @@
13161540
13171541 1. The manifest's `owner_pub_keys` are signed by the firmware-image owner key (latched from FMC at boot via `manifest1.preamble.owner_pub_keys`). This signature also covers the policy fields `version`, `svn`, `flags`, and `owner_pub_keys`.
13181542 2. The manifest's IMC is signed by the manifest's own `owner_pub_keys`, which were just verified to chain to the firmware-image owner key.
1319-3. The manifest's `svn` is checked against the floor encoded in `SS_STRAP_GENERIC[3][15:8]` (subsystem mode only). The check is skipped when the lifecycle is `Unprovisioned` or anti-rollback is disabled.
1543+3. The manifest's `svn` is checked against the floor encoded in `SS_STRAP_GENERIC[3][15:8]`. The check is skipped when the lifecycle is `Unprovisioned` or anti-rollback is disabled.
13201544
13211545 #### Owner Authorization Manifest Minimum SVN
13221546
1323-`SS_STRAP_GENERIC[3][15:8]` carries a binary value in the range `0..255`; it does not carry a fuse bitmap. Before Caliptra starts, MCU firmware is responsible for deriving the owner-manifest minimum SVN from the platform's monotonic storage and programming the resulting integer into this strap. The strap is then locked by `CPTRA_FUSE_WR_DONE`.
1547+`SS_STRAP_GENERIC[3][15:8]` carries a binary value in the range `0..255`; it does not carry a fuse bitmap. Before Caliptra starts, platform firmware is responsible for deriving the owner-manifest minimum SVN from the platform's monotonic storage and programming the resulting integer into this strap. The strap is then locked by `CPTRA_FUSE_WR_DONE`.
13241548
13251549 This software interface does not define a new Caliptra fuse field. If a platform uses the same thermometer encoding as the existing SVN fuses, a 256-bit-aligned platform field can use bits 0 through 254 to encode SVN values 1 through 255, with all zeros encoding SVN 0 and bit 255 reserved. The authoritative physical fuse allocation belongs to the SoC/platform fuse-controller specification.
13261550
@@ -1349,6 +1573,14 @@
13491573
13501574 The response is a `MailboxRespHeader` (no payload).
13511575
1576+### VERIFY_OWNER_AUTH_MANIFEST
1577+
1578+This command verifies the integrity, authenticity, policy fields, SVN, and firmware-ID collisions of an Owner Authorization Manifest. Unlike `SET_OWNER_AUTH_MANIFEST`, it does not replace the active owner-only metadata collection or update the owner manifest digest or current SVN.
1579+
1580+Command Code: `0x4F41_564D` ("OAVM")
1581+
1582+The input arguments and response are the same as the `SET_OWNER_AUTH_MANIFEST` command.
1583+
13521584
13531585 ### AUTHORIZE_AND_STASH
13541586
@@ -1361,22 +1593,23 @@
13611593
13621594 *Table: `AUTHORIZE_AND_STASH` input arguments*
13631595
1364-| **Name** | **Type** | **Description**
1365-| ------------| -------- | ---------------
1596+| **Name** | **Type** | **Description** |
1597+| ------------ | -------- | --------------- |
13661598 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
13671599 | fw_id | u8[4] | Firmware id of the image, in little-endian format |
13681600 | measurement | u8[48] | Digest of the image requested for authorization. The `source` field needs to be set to '1` for InRequest, otherwise<br />this field is ignored. |
13691601 | context | u8[48] | Context field for `svn`; e.g., a hash of the public key that authenticated the SVN. |
13701602 | svn | u32 | The version of the image |
1371-| flags | u32 | See AUTHORIZE_AND_STASH_FLAGS below |
1603+| flags | u32 | See `AUTHORIZE_AND_STASH_FLAGS` below. |
13721604 | source | u32 | This field identifies the source of the digest to be used to compare with the SoC's<br />SHA digest in the SoC Manifest<br /><br />Values<br />1 - InRequest - Use the hash in the 'measurement' field of this command<br /><br />2 - LoadAddress - The image located in the `ImageLoadAddress` will be streamed to the SHA Accelerator to <br /> retrieve the digest that will be used for authorization.<br />3 - ImageStagingAddress - The image located in the `StagingAddress` will be streamed to the SHA Accelerator to<br /> retrieve the digest that will be used for authorization |
13731605 | image_size | u32 | The size of the image to hash. Only valid if source is `ImageLoadAddress` or `StagingAddress` |
13741606
13751607
13761608 *Table: `AUTHORIZE_AND_STASH_FLAGS` input flags*
1377-| **Name** | **Value** |
1378-| ----------- | --------- |
1379-| SKIP\_STASH | 1 << 0 |
1609+| **Bits** | **Name** | **Description** |
1610+| -------- | ------------------ | --------------- |
1611+| 0 | SKIP\_STASH | Skip stashing the authorized measurement. |
1612+| [2:1] | MANIFEST\_SOURCE | `00`: vendor + owner manifest; `01`: owner-only manifest. `10` and `11` are invalid. |
13801613
13811614
13821615 *Table: `AUTHORIZE_AND_STASH` output arguments*
@@ -1384,16 +1617,13 @@
13841617 | --------------- | -------- | -------------------------------------------------------------------------- |
13851618 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
13861619 | fips_status | u32 | Indicates if the command is FIPS approved or an error. |
1387-| auth_req_result | u32 | IMAGE_AUTHORIZED_VENDOR_OWNER (0xDEADC0DE, alias of legacy `AUTHORIZE_IMAGE`/`IMAGE_AUTHORIZED`), IMAGE_AUTHORIZED_OWNER_ONLY (0xC0DEDEAD), IMAGE_NOT_AUTHORIZED (0x21523F21) or IMAGE_HASH_MISMATCH (0x8BFB95CB). Lookup order: vendor + owner collection first, then owner-only collection populated by `SET_OWNER_AUTH_MANIFEST`. Active firmware IDs are unique across the collections, and the success value indicates which collection produced the match. |
1620+| auth_req_result | u32 | IMAGE_AUTHORIZED_VENDOR_OWNER (0xDEADC0DE, alias of legacy `AUTHORIZE_IMAGE`/`IMAGE_AUTHORIZED`), IMAGE_AUTHORIZED_OWNER_ONLY (0xC0DEDEAD), IMAGE_NOT_AUTHORIZED (0x21523F21) or IMAGE_HASH_MISMATCH (0x8BFB95CB). The success value identifies the selected collection that produced the match. |
13881621
13891622
13901623 ### GET_IMAGE_INFO
13911624
13921625 The MCU uses this command to retrieve the active Image Metadata Entry for a
1393-firmware ID. The Runtime searches the vendor + owner Image Metadata Collection
1394-first, then the owner-only collection installed by
1395-[`SET_OWNER_AUTH_MANIFEST`](#set_owner_auth_manifest). Active firmware IDs are
1396-unique across the collections, so the response is unambiguous.
1626+firmware ID from the collection selected by bits `[2:1]` of `flags`.
13971627
13981628 Command Code: `0x494D_4530` ("IME0")
13991629
@@ -1402,8 +1632,9 @@
14021632 | **Name** | **Type** | **Description** |
14031633 | -------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
14041634 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
1405-
1406-| fw_id | u32 | Firmware id of the image, in little-endian format
1635+| fw_id | u32 | Firmware id of the image, in little-endian format |
1636+| flags | u32 | Bits `[2:1]` select the Image Metadata Collection: `00` selects the vendor + owner manifest; `01` selects the owner-only manifest. `10` and `11` are invalid. All other bits are reserved and must be zero. |
1637+
14071638
14081639 *Table: `GET_IMAGE_INFO` output arguments*
14091640
@@ -1411,13 +1642,36 @@
14111642 | -------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
14121643 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
14131644 | fips_status | u32 | Indicates if the command is FIPS approved or an error. |
1414-| Component_id | u32 | This corresponds to the `Component Id` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/caliptra-2.0/auth-manifest/README.md) |
1415-| flags | u32 | This corresponds to the `flags` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/caliptra-2.0/auth-manifest/README.md) |
1416-| Image Load Address High | u32 | This corresponds to the `Image Load Address High` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/caliptra-2.0/auth-manifest/README.md) |
1417-| Image Load Address Low | u32 | This corresponds to the `Image Load Address Low` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/caliptra-2.0/auth-manifest/README.md) |
1418-| Staging Address High | u32 | This corresponds to the `Staging Address High` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/caliptra-2.0/auth-manifest/README.md) |
1419-| Staging Address Low | u32 | This corresponds to the `Staging Address Low` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/caliptra-2.0/auth-manifest/README.md) |
1645+| Component_id | u32 | This corresponds to the `Component Id` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1646+| flags | u32 | This corresponds to the `flags` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1647+| Image Load Address High | u32 | This corresponds to the `Image Load Address High` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1648+| Image Load Address Low | u32 | This corresponds to the `Image Load Address Low` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1649+| Staging Address High | u32 | This corresponds to the `Staging Address High` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
1650+| Staging Address Low | u32 | This corresponds to the `Staging Address Low` field in the [SoC Manifest](https://github.com/chipsalliance/caliptra-sw/blob/main/auth-manifest/README.md) |
14201651 | digest | u8[48] | SHA-384 digest of the image. **Only present in FW 2.0.2+ and 2.1.1+.** |
1652+
1653+
1654+### GET\_MCU\_FW\_SIZE
1655+
1656+Returns the size and SHA-384 digest of the MCU firmware image that was downloaded during the recovery flow. This command is used by MCU ROM during encrypted boot so it can issue `CM_AES_GCM_DECRYPT_DMA` with the correct size and without recomputing the digest.
1657+
1658+Command Code: `0x474D_4653` ("GMFS")
1659+
1660+*Table: `GET_MCU_FW_SIZE` input arguments*
1661+
1662+| **Name** | **Type** | **Description** |
1663+| -------------- | -------------- | --------------------------------------------------------------------------- |
1664+| chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
1665+
1666+
1667+*Table: `GET_MCU_FW_SIZE` output arguments*
1668+
1669+| **Name** | **Type** | **Description** |
1670+| -------------- | -------------- | -------------------------------------------------------------------------- |
1671+| chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
1672+| fips_status | u32 | Indicates if the command is FIPS approved or an error. |
1673+| size | u32 | Size of the MCU firmware image in bytes. |
1674+| sha384 | u8[48] | SHA-384 digest of the encrypted MCU firmware image. |
14211675
14221676
14231677 ### ACTIVATE_FIRMWARE
@@ -1433,9 +1687,69 @@
14331687 | -------------- | -------------- | --------------------------------------------------------------------------- |
14341688 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
14351689 | count | u32 | Number of image_ids to activate. Item count of image_ids array parameter |
1436-| mcu_image_size | u32 | Size of MCU image, if included in the activation |
1690+| mcu_image_size | u32 | Size of MCU image in bytes, if included in the activation. Must not exceed MCU SRAM capacity for hitless updates. |
14371691 | image_ids | Array of u8[4] | Array of Image ids in little-endian format |
1438-
1692+| flags | u32 | Optional flags (see below). Caliptra runtime 2.1.1+ only. |
1693+
1694+
1695+*Flags*
1696+
1697+| **Bits** | **Name** | **Description** |
1698+| -------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------ |
1699+| 0 | `INITIAL_ACTIVATE` | First-time MCU activation after the encrypted-boot flow. Caliptra runtime 2.1.1+ only. See below. |
1700+| [2:1] | `MANIFEST_SOURCE` | `00`: vendor + owner manifest; `01`: owner-only manifest. `10` and `11` are invalid. |
1701+
1702+
1703+Unknown flag bits are rejected with `RUNTIME_MAILBOX_INVALID_PARAMS`.
1704+
1705+For MCU hitless updates (`INITIAL_ACTIVATE` clear), the MCU entry in the
1706+selected authorization manifest must set `image_load_address` to the full
1707+64-bit MCU SRAM address, `MCI_BASE + 0x00c00000`. The entire source and
1708+destination byte ranges must fit in the 64-bit AXI address space without
1709+wrapping. `mcu_image_size` must not exceed the MCU SRAM capacity reported by
1710+MCI `HW_CONFIG1.MCU_SRAM_SIZE` (in KB, multiplied by 1024 to obtain bytes).
1711+An image exactly equal to that capacity is permitted.
1712+
1713+Runtime rejects a load-address mismatch, address-range overflow, or oversized
1714+image with `IMAGE_VERIFIER_ACTIVATION_FAILED` before changing the MCU reset
1715+reason, execution-control bits, SRAM contents, or MCU firmware DPE measurement.
1716+These requirements apply to both vendor + owner and owner-only manifests.
1717+The address-range checks prevent arithmetic overflow; they do not establish
1718+that the staging memory is mapped or accessible.
1719+
1720+Runtime copies `mcu_image_size` bytes from `image_staging_address` to that
1721+MCU SRAM destination, then authorizes the image at `image_load_address`.
1722+Requiring these destination addresses to match binds the post-copy digest
1723+check to the installed firmware. After successful authorization, Runtime
1724+updates the MCU firmware DPE measurement and enables execution. SoC-only
1725+activation does not impose these MCU address and size requirements.
1726+
1727+`INITIAL_ACTIVATE` is used exclusively by MCU ROM at the tail of the
1728+`EncryptedFirmware` boot flow. MCU ROM has already loaded firmware into MCU
1729+SRAM via `RI_DOWNLOAD_ENCRYPTED_FIRMWARE` and decrypted it in place via
1730+`CM_AES_GCM_DECRYPT_DMA`. When this flag is set, Caliptra Runtime:
1731+
1732+- Skips the hitless-update steps (set `RESET_REASON.FwHitlessUpd`, clear
1733+ `FW_EXEC_CTRL`, wait for MCU reset request and reset assertion, DMA-reload
1734+ from staging, re-`AuthorizeAndStash`), including the hitless load-address
1735+ and range/size requirements above.
1736+- Just publishes `FW_EXEC_CTRL[MCU]` (and any other requested bits) so that
1737+ MCI's `BOOT_RST_MCU` state releases MCU from reset on the next warm reset
1738+ that MCU ROM triggers.
1739+
1740+Caliptra Runtime only honors `INITIAL_ACTIVATE` when **all** of the following
1741+are true; otherwise the command fails with `IMAGE_VERIFIER_ACTIVATION_FAILED`:
1742+
1743+1. The MCU image bit is included in the activation request.
1744+2. The boot mode set by ROM is `EncryptedFirmware` (i.e., ROM received
1745+ `RI_DOWNLOAD_ENCRYPTED_FIRMWARE`).
1746+3. `FW_EXEC_CTRL[MCU]` is currently `0` — this is an initial activation,
1747+ not a hitless update masquerading as one.
1748+
1749+Together, these checks ensure that the MCU SRAM contents are
1750+integrity-protected end-to-end (ciphertext digest verified during recovery;
1751+GCM tag verified during `CM_AES_GCM_DECRYPT_DMA`) before Caliptra releases
1752+MCU to execute them.
14391753
14401754 *Table: `ACTIVATE_FIRMWARE` output arguments*
14411755
@@ -1444,6 +1758,28 @@
14441758 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
14451759 | fips_status | u32 | Indicates if the command is FIPS approved or an error. |
14461760
1761+
1762+## Mailbox commands: OCP LOCK v1.0
1763+
1764+These commands are defined in the OCP LOCK v1.0 [specification](https://github.com/chipsalliance/Caliptra/blob/main/doc/ocp_lock/releases/OCP_LOCK_Specification_v1.0_RC2.pdf).
1765+
1766+### ENUMERATE_HPKE_HANDLES
1767+### REPORT_HEK_METADATA
1768+### GET_ALGORITHMS
1769+### INITIALIZE_MEK_SECRET
1770+### ROTATE_HPKE_KEY
1771+### GENERATE_MEK
1772+### GENERATE_MPK
1773+### REWRAP_MPK
1774+### ENABLE_MPK
1775+### MIX_MPK
1776+### GET_HPKE_PUB_KEY
1777+### TEST_ACCESS_KEY
1778+### GET_STATUS
1779+### CLEAR_KEY_CACHE
1780+### UNLOAD_MEK
1781+### LOAD_MEK
1782+### DERIVE_MEK
14471783
14481784 ## Mailbox commands: Cryptographic Mailbox (2.0)
14491785
@@ -1547,6 +1883,99 @@
15471883 | fips_status | u32 | FIPS approved or an error |
15481884 | hash size | u32 ||
15491885 | hash | u8[hash size] ||
1886+
1887+
1888+### CM\_SHAKE256\_INIT
1889+
1890+This starts the computation of a SHAKE256 extendable-output hash, which may be larger than a single mailbox command allows.
1891+
1892+**Note:** Unlike the CM\_SHA commands, SHAKE256 cannot save and restore hardware state between calls. Instead, the SHA3 hardware state is kept live, and the context returned to the caller is an encrypted random session token. If any other SHA3 operation occurs between INIT and FINAL, the session is invalidated and UPDATE/FINAL will return an error.
1893+
1894+The sequence to use these are:
1895+* 1 `CM_SHAKE256_INIT` command
1896+* 0 or more `CM_SHAKE256_UPDATE` commands
1897+* 1 `CM_SHAKE256_FINAL` command
1898+
1899+For each command, the context from the previous command's output must be passed as an input.
1900+
1901+The `SHAKE256_CONTEXT_SIZE` is always exactly 44 bytes long (encrypted session token).
1902+
1903+The maximum supported input data size per command is 4096 bytes.
1904+
1905+Command Code: `0x434D_5849` ("CMXI")
1906+
1907+*Table: `CM_SHAKE256_INIT` input arguments*
1908+
1909+| **Name** | **Type** | **Description** |
1910+| --------- | ------------- | --------------- |
1911+| chksum | u32 ||
1912+| data size | u32 ||
1913+| data | u8[data size] | Data to hash |
1914+
1915+
1916+*Table: `CM_SHAKE256_INIT` output arguments*
1917+
1918+| **Name** | **Type** | **Description** |
1919+| ----------- | ------------------------- | -------------------------------------------------- |
1920+| chksum | u32 ||
1921+| fips_status | u32 | FIPS approved or an error |
1922+| context | u8[SHAKE256_CONTEXT_SIZE] | Passed to `CM_SHAKE256_UPDATE` / `CM_SHAKE256_FINAL` |
1923+
1924+
1925+### CM\_SHAKE256\_UPDATE
1926+
1927+This continues a SHAKE256 computation started by `CM_SHAKE256_INIT` or from another `CM_SHAKE256_UPDATE`.
1928+
1929+The context MUST be passed in from `CM_SHAKE256_INIT` or `CM_SHAKE256_UPDATE`.
1930+
1931+Command Code: `0x434D_5855` ("CMXU")
1932+
1933+*Table: `CM_SHAKE256_UPDATE` input arguments*
1934+
1935+| **Name** | **Type** | **Description** |
1936+| --------- | ------------------------- | ---------------------------------------------------- |
1937+| chksum | u32 ||
1938+| context | u8[SHAKE256_CONTEXT_SIZE] | From `CM_SHAKE256_INIT` / `CM_SHAKE256_UPDATE` |
1939+| data size | u32 ||
1940+| data | u8[data size] | Data to hash |
1941+
1942+
1943+*Table: `CM_SHAKE256_UPDATE` output arguments*
1944+
1945+| **Name** | **Type** | **Description** |
1946+| ----------- | ------------------------- | -------------------------------------------------- |
1947+| chksum | u32 ||
1948+| fips_status | u32 | FIPS approved or an error |
1949+| context | u8[SHAKE256_CONTEXT_SIZE] | Passed to `CM_SHAKE256_UPDATE` / `CM_SHAKE256_FINAL` |
1950+
1951+
1952+### CM\_SHAKE256\_FINAL
1953+
1954+This finalizes the SHAKE256 computation and produces the hash of all of the data.
1955+
1956+The context MUST be passed in from `CM_SHAKE256_INIT` or `CM_SHAKE256_UPDATE`.
1957+
1958+The output is always a 64-byte SHAKE256 digest.
1959+
1960+Command Code: `0x434D_5846` ("CMXF")
1961+
1962+*Table: `CM_SHAKE256_FINAL` input arguments*
1963+
1964+| **Name** | **Type** | **Description** |
1965+| ----------- | ------------------------- | ---------------------------------------------- |
1966+| chksum | u32 ||
1967+| context | u8[SHAKE256_CONTEXT_SIZE] | From `CM_SHAKE256_INIT` / `CM_SHAKE256_UPDATE` |
1968+| data size | u32 | May be 0 |
1969+| data | u8[data size] | Data to hash |
1970+
1971+
1972+*Table: `CM_SHAKE256_FINAL` output arguments*
1973+
1974+| **Name** | **Type** | **Description** |
1975+| ----------- | -------- | ------------------------- |
1976+| chksum | u32 ||
1977+| fips_status | u32 | FIPS approved or an error |
1978+| hash | u8[64] | SHAKE256 digest |
15501979
15511980
15521981 ### CM\_HMAC
@@ -1789,7 +2218,7 @@
17892218
17902219 The signature consists of its `r` and `s` values described in [FIPS 186-5](https://csrc.nist.gov/pubs/fips/186-5/final) encoded in big-endian byte order.
17912220
1792-Command Code: `0x434D_5D53` ("CMES")
2221+Command Code: `0x434D_4553` ("CMES")
17932222
17942223 *Table: `CM_ECDSA_SIGN` input arguments*
17952224 | **Name** | **Type** | **Description** |
@@ -1837,6 +2266,79 @@
18372266 | fips_status | u32 | FIPS approved or an error |
18382267
18392268
2269+### CM_MLKEM_KEY_GEN
2270+
2271+Generates an ML-KEM-1024 encapsulation key from the seed (seed\_d || seed\_z, 64 bytes) stored in a CMK with key usage `Mlkem`.
2272+
2273+The key generation algorithm is described in [FIPS 203](https://csrc.nist.gov/pubs/fips/203/final).
2274+
2275+Command Code: `0x434D_4C4B` ("CMLK")
2276+
2277+*Table: `CM_MLKEM_KEY_GEN` input arguments*
2278+| **Name** | **Type** | **Description** |
2279+| -------- | -------- | ---------------------------------------- |
2280+| chksum | u32 ||
2281+| CMK | CMK | ML-KEM seed (seed\_d &#124;&#124; seed\_z) |
2282+
2283+
2284+*Table: `CM_MLKEM_KEY_GEN` output arguments*
2285+| **Name** | **Type** | **Description** |
2286+| ----------- | -------- | ---------------------------------------- |
2287+| chksum | u32 ||
2288+| fips_status | u32 | FIPS approved or an error |
2289+| encaps_key | u8[1568] | ML-KEM-1024 encapsulation key |
2290+
2291+
2292+### CM_MLKEM_ENCAPSULATE
2293+
2294+Performs ML-KEM-1024 encapsulation against the provided encapsulation key, producing a ciphertext and a shared key wrapped as a CMK.
2295+
2296+The encapsulation algorithm is described in [FIPS 203](https://csrc.nist.gov/pubs/fips/203/final).
2297+
2298+Command Code: `0x434D_4C45` ("CMLE")
2299+
2300+*Table: `CM_MLKEM_ENCAPSULATE` input arguments*
2301+| **Name** | **Type** | **Description** |
2302+| ----------- | -------- | ---------------------------------------- |
2303+| chksum | u32 ||
2304+| key_usage | u32 | Key usage for the output CMK |
2305+| encaps_key | u8[1568] | ML-KEM-1024 encapsulation key |
2306+
2307+
2308+*Table: `CM_MLKEM_ENCAPSULATE` output arguments*
2309+| **Name** | **Type** | **Description** |
2310+| ----------- | -------- | ---------------------------------------- |
2311+| chksum | u32 ||
2312+| fips_status | u32 | FIPS approved or an error |
2313+| ciphertext | u8[1568] | ML-KEM-1024 ciphertext |
2314+| shared_key | CMK | CMK of the shared secret key |
2315+
2316+
2317+### CM_MLKEM_DECAPSULATE
2318+
2319+Performs ML-KEM-1024 decapsulation using the seed in the provided CMK and the given ciphertext, recovering the shared key wrapped as a CMK. This uses the hardware's combined keygen\_decapsulate operation to avoid materializing the full 3168-byte decapsulation key in memory.
2320+
2321+The decapsulation algorithm is described in [FIPS 203](https://csrc.nist.gov/pubs/fips/203/final).
2322+
2323+Command Code: `0x434D_4C44` ("CMLD")
2324+
2325+*Table: `CM_MLKEM_DECAPSULATE` input arguments*
2326+| **Name** | **Type** | **Description** |
2327+| ----------- | -------- | ---------------------------------------- |
2328+| chksum | u32 ||
2329+| key_usage | u32 | Key usage for the output CMK |
2330+| CMK | CMK | ML-KEM seed (seed\_d &#124;&#124; seed\_z) |
2331+| ciphertext | u8[1568] | ML-KEM-1024 ciphertext to decapsulate |
2332+
2333+
2334+*Table: `CM_MLKEM_DECAPSULATE` output arguments*
2335+| **Name** | **Type** | **Description** |
2336+| ----------- | -------- | ---------------------------------------- |
2337+| chksum | u32 ||
2338+| fips_status | u32 | FIPS approved or an error |
2339+| shared_key | CMK | CMK of the shared secret key |
2340+
2341+
18402342 ### CM_AES_ENCRYPT_INIT
18412343
18422344 Generic AES operation for unauthenticated AES operations.
@@ -1849,7 +2351,7 @@
18492351
18502352 The CMK must have been created for AES usage.
18512353
1852-Command Code: `0x434D_4349` ("CMCI")
2354+Command Code: `0x434D_4149` ("CMAI")
18532355
18542356 *Table: `CM_AES_ENCRYPT_INIT` input arguments*
18552357 | **Name** | **Type** | **Description** |
@@ -1883,8 +2385,7 @@
18832385 | mode | u32 ||
18842386 | key | u8[32] ||
18852387 | iv | u8[16] ||
1886-| fips_status | u8 | 1 = FIPS valid |
1887-| reserved | u8[75] | Reserved for additional fields |
2388+| reserved | u8[76] | Reserved for additional fields |
18882389
18892390
18902391 The size of the (encrypted) context is always exactly 156 bytes,
@@ -1901,7 +2402,7 @@
19012402 For CBC, the size must be a multiple of 16 bytes.
19022403 CTR mode supports input of any size up to the maximum cryptographic mailbox size.
19032404
1904-Command Code: `0x434D_4355` ("CMCU")
2405+Command Code: `0x434D_4155` ("CMAU")
19052406
19062407 *Table: `CM_AES_ENCRYPT_UPDATE` input arguments*
19072408 | **Name** | **Type** | **Description** |
@@ -1972,7 +2473,7 @@
19722473 For CBC, the size must be a multiple of 16 bytes.
19732474 CTR mode supports input of any size up to the maximum cryptographic mailbox size.
19742475
1975-Command Code: `0x434D_4155` ("CMAU")
2476+Command Code: `0x434D_4156` ("CMAV")
19762477
19772478 *Table: `CM_AES_DECRYPT_UPDATE` input arguments*
19782479 | **Name** | **Type** | **Description** |
@@ -2033,8 +2534,7 @@
20332534 | GHASH state | u8[16] ||
20342535 | current length | u32 | value mod 16 is buffer size |
20352536 | buffer | u8[16] ||
2036-| fips_status | u8 | 1 = FIPS valid |
2037-| reserved | u8[15] ||
2537+| reserved | u8[16] ||
20382538
20392539
20402540 The size of the (encrypted) context is always exactly 128 bytes,
@@ -2190,7 +2690,7 @@
21902690
21912691 The encrypted and authenticated context's internal structure will be the same as for encryption.
21922692
2193-### CM_AES_SPDM_GCM_DECRYPT_INIT
2693+### CM_AES_GCM_SPDM_DECRYPT_INIT
21942694
21952695 Starts an AES-256-GCM decryption computation in SPDM mode.
21962696
@@ -2306,6 +2806,45 @@
23062806 | plaintext | u8[plaintext size] ||
23072807
23082808
2809+### CM_AES_GCM_DECRYPT_DMA
2810+
2811+Performs in-place AES-256-GCM decryption of data at an AXI address using DMA. This command is specifically designed for decrypting MCU firmware that was downloaded via the `RI_DOWNLOAD_ENCRYPTED_FIRMWARE` command.
2812+
2813+**Important restrictions:**
2814+- This command is only available in subsystem mode, as DMA is only available in subsystem.
2815+- This command is only available for MCU.
2816+- This command is only available when the boot mode is `EncryptedFirmware`, which is set by ROM when it receives the `RI_DOWNLOAD_ENCRYPTED_FIRMWARE` command.
2817+- The command performs a two-pass operation:
2818+ 1. First pass: Verifies the SHA384 hash of the encrypted data at the AXI address
2819+ 2. Second pass: Performs in-place AES-GCM decryption via DMA
2820+
2821+The CMK must be an AES key (key usage = 3) that was previously imported using `CM_IMPORT`.
2822+
2823+Command Code: `0x434D_4444` ("CMDD")
2824+
2825+*Table: `CM_AES_GCM_DECRYPT_DMA` input arguments*
2826+| **Name** | **Type** | **Description** |
2827+| --------------------- | --------- | ---------------------------------------------------- |
2828+| chksum | u32 | Checksum over other input arguments |
2829+| cmk | CMK | Encrypted CMK containing the AES-256 key |
2830+| iv | u32[3] | AES-GCM initialization vector (12 bytes) |
2831+| tag | u32[4] | AES-GCM authentication tag (16 bytes) |
2832+| encrypted_data_sha384 | u8[48] | SHA384 hash of the encrypted data for verification |
2833+| axi_addr_lo | u32 | Lower 32 bits of the AXI address |
2834+| axi_addr_hi | u32 | Upper 32 bits of the AXI address |
2835+| length | u32 | Length of data to decrypt in bytes |
2836+| aad_length | u32 | Length of AAD in bytes (0-4095) |
2837+| aad | u8[...] | Additional authenticated data |
2838+
2839+
2840+*Table: `CM_AES_GCM_DECRYPT_DMA` output arguments*
2841+| **Name** | **Type** | **Description** |
2842+| ------------ | -------- | ----------------------------------------------------- |
2843+| chksum | u32 | Checksum over other output arguments |
2844+| fips_status | u32 | FIPS approved or an error |
2845+| tag_verified | u32 | 1 if GCM tag verification succeeded, 0 if it failed |
2846+
2847+
23092848 ### CM_ECDH_GENERATE
23102849
23112850 This computes the first half of an Elliptic Curve Diffie-Hellman exchange to compute an ephemeral shared key pair with another party.
@@ -2424,9 +2963,9 @@
24242963 ### CM\_DERIVE\_STABLE\_KEY
24252964
24262965 Derives an HMAC key that has a stable value across resets from either
2427-IDevId or LDevId.
2428-
2429-The (interior) value of the returned CMK will be the stable across resets as it is derived indirectly from the IDevId or LDevId CDIs.
2966+IDevId, LDevId, or the Owner Root Key (derived from HEK seed).
2967+
2968+The (interior) value of the returned CMK will be the stable across resets as it is derived indirectly from the IDevId or LDevId CDIs, or from the HEK-seed-derived Owner Root Key.
24302969 The actual encrypted bytes of the CMK will *not* be the same, and
24312970 the encrypted CMK itself cannot be used across resets. So, the key
24322971 will always need to be re-derived after every *cold* reset.
@@ -2434,26 +2973,39 @@
24342973 If a key usage other than HMAC is desired, then the KDF or HKDF
24352974 mailbox functions can be used to derive a key from the returned CMK.
24362975
2437-Note that in Caliptra 2.0 in subsystem mode, derived stable keys, their derivatives, and commands using them will be marked with a FIPS status of invalid since the UDS and FE cannot be completely zeroized.
2976+`key_type = OwnerKey` is only available in subsystem mode when the Stable Owner
2977+Key strap is enabled (`SS_STRAP_GENERIC[3]` bit 0 set to 1) and OCP LOCK is not
2978+enabled. If these requirements are not met, the command fails with
2979+`CMB_STABLE_OWNER_KEY_NOT_AVAILABLE`.
2980+
2981+In Runtime, this command is restricted to the PL0 PAUSER authenticated by the
2982+firmware manifest for all key types.
2983+
2984+For `OwnerKey`, this command derives from the ROM-populated Stable Owner Root
2985+Key. It first runs AES-256-CMAC KDF with `info` as the input data to produce an
2986+intermediate key, then runs HMAC-SHA512 KDF with `b"Stable Owner Key" || info`
2987+as the domain-separation input to produce the returned 64-byte HMAC key
2988+material. Caliptra wraps that key material as an encrypted CMK before returning
2989+it to the caller.
24382990
24392991 The command derivation is summarized below:
24402992
24412993 ![CM_DERIVE_STABLE_KEY Derivation](../images/caliptra-sw/runtime/../rom/dev/doc/svg/cm-derive-stable-key.svg)
24422994
2443-Command Code: `0x434D_4453` ("CMDS")
2995+Command Code: `0x494D_4453` ("IMDS")
24442996
24452997 *Table: `CM_DERIVE_STABLE_KEY` input arguments*
24462998
2447-| **Name** | **Type** | **Description**
2448-| -------- | -------- | ---------------
2999+| **Name** | **Type** | **Description** |
3000+| -------- | -------- | --------------- |
24493001 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
2450-| key_type | u32 | Source key to derive the stable key from. **0x0000_0001:** IDevId <br> **0x0000_0002:** LDevId |
3002+| key_type | u32 | Source key to derive the stable key from. **0x0000_0001:** IDevId <br> **0x0000_0002:** LDevId <br> **0x0000_0003:** OwnerKey (derived from HEK seed) |
24513003 | info | u8[32] | Data to use in the key derivation. |
24523004
24533005
24543006 *Table: `CM_DERIVE_STABLE_KEY` output arguments*
2455-| **Name** | **Type** | **Description**
2456-| -------- | -------- | ---------------
3007+| **Name** | **Type** | **Description** |
3008+| -------- | -------- | --------------- |
24573009 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
24583010 | cmk | CMK | CMK that stores the stable key material |
24593011
@@ -2463,9 +3015,6 @@
24633015 Imports the specified key and returns a CMK for it.
24643016
24653017 Usage information is required so that the key can be verified and used appropriately.
2466-
2467-Note that it is the caller's responsibility to ensure that the source
2468-key material meets FIPS requirements, such as zeroization.
24693018
24703019 Command Code: `0x434D_494D` ("CMIM")
24713020
@@ -2550,14 +3099,14 @@
25503099
25513100 *Table: `GET_IDEV_ECC384_CSR` input arguments*
25523101
2553-| **Name** | **Type** | **Description**
2554-| -------- | -------- | ---------------
3102+| **Name** | **Type** | **Description** |
3103+| -------- | -------- | --------------- |
25553104 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
25563105
25573106
25583107 *Table: `GET_IDEV_ECC384_CSR` output arguments*
2559-| **Name** | **Type** | **Description**
2560-| -------- | -------- | ---------------
3108+| **Name** | **Type** | **Description** |
3109+| -------- | -------- | --------------- |
25613110 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
25623111 | data\_size | u32 | Length in bytes of the valid data in the data field. |
25633112 | data | u8[...] | DER-encoded ECC384 IDevID certificate signing request. |
@@ -2569,14 +3118,14 @@
25693118
25703119 *Table: `GET_IDEV_MLDSA87_CSR` input arguments*
25713120
2572-| **Name** | **Type** | **Description**
2573-| -------- | -------- | ---------------
3121+| **Name** | **Type** | **Description** |
3122+| -------- | -------- | --------------- |
25743123 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
25753124
25763125
25773126 *Table: `GET_IDEV_MLDSA87_CSR` output arguments*
2578-| **Name** | **Type** | **Description**
2579-| -------- | -------- | ---------------
3127+| **Name** | **Type** | **Description** |
3128+| -------- | -------- | --------------- |
25803129 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
25813130 | data\_size | u32 | Length in bytes of the valid data in the data field. |
25823131 | data | u8[...] | DER-encoded MLDSA87 IDevID certificate signing request. |
@@ -2596,14 +3145,14 @@
25963145
25973146 *Table: `GET_FMC_ALIAS_ECC384_CSR` input arguments*
25983147
2599-| **Name** | **Type** | **Description**
2600-| -------- | -------- | ---------------
3148+| **Name** | **Type** | **Description** |
3149+| -------- | -------- | --------------- |
26013150 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
26023151
26033152
26043153 *Table: `GET_FMC_ALIAS_ECC384_CSR` output arguments*
2605-| **Name** | **Type** | **Description**
2606-| -------- | -------- | ---------------
3154+| **Name** | **Type** | **Description** |
3155+| -------- | -------- | --------------- |
26073156 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
26083157 | data\_size | u32 | Length in bytes of the valid data in the data field. |
26093158 | data | u8[...] | DER-encoded ECC384 FMC Alias certificate signing request. |
@@ -2615,14 +3164,14 @@
26153164
26163165 *Table: `GET_FMC_ALIAS_MLDSA87_CSR` input arguments*
26173166
2618-| **Name** | **Type** | **Description**
2619-| -------- | -------- | ---------------
3167+| **Name** | **Type** | **Description** |
3168+| -------- | -------- | --------------- |
26203169 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
26213170
26223171
26233172 *Table: `GET_FMC_ALIAS_MLDSA87_CSR` output arguments*
2624-| **Name** | **Type** | **Description**
2625-| -------- | -------- | ---------------
3173+| **Name** | **Type** | **Description** |
3174+| -------- | -------- | --------------- |
26263175 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
26273176 | data\_size | u32 | Length in bytes of the valid data in the data field. |
26283177 | data | u8[...] | DER-encoded MLDSA87 FMC Alias certificate signing request. |
@@ -2636,8 +3185,8 @@
26363185
26373186 *Table: `GET_ATTESTED_ECC384_CSR` input arguments*
26383187
2639-| **Name** | **Type** | **Description**
2640-| -------- | -------- | ---------------
3188+| **Name** | **Type** | **Description** |
3189+| -------- | -------- | --------------- |
26413190 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
26423191 | key_id | u32 | Key ID for which CSR is requested.<br> **0x0000_0000:** Keypair inventory discovery <br> **0x0000_0001:** LDevId <br> **0x0000_0002:** FMC Alias <br> **0x0000_0003:** RT Alias |
26433192 | nonce | u8[32] | Nonce to be included in the CSR EAT. |
@@ -2645,8 +3194,8 @@
26453194
26463195 *Table: `GET_ATTESTED_ECC384_CSR` output arguments*
26473196
2648-| **Name** | **Type** | **Description**
2649-| -------- | -------- | ---------------
3197+| **Name** | **Type** | **Description** |
3198+| -------- | -------- | --------------- |
26503199 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
26513200 | data\_size | u32 | Length in bytes of the valid data in the data field. |
26523201 | data | u8[...] | COSE Sign1 signed EAT token containing attested CSR (or keypair inventory when key_id = 0). |
@@ -2660,8 +3209,8 @@
26603209
26613210 *Table: `GET_ATTESTED_MLDSA87_CSR` input arguments*
26623211
2663-| **Name** | **Type** | **Description**
2664-| -------- | -------- | ---------------
3212+| **Name** | **Type** | **Description** |
3213+| -------- | -------- | --------------- |
26653214 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
26663215 | key_id | u32 | Key ID for which CSR is requested.<br> **0x0000_0000:** Keypair inventory discovery <br> **0x0000_0001:** LDevId <br> **0x0000_0002:** FMC Alias <br> **0x0000_0003:** RT Alias |
26673216 | nonce | u8[32] | Nonce to be included in the CSR EAT. |
@@ -2669,8 +3218,8 @@
26693218
26703219 *Table: `GET_ATTESTED_MLDSA87_CSR` output arguments*
26713220
2672-| **Name** | **Type** | **Description**
2673-| -------- | -------- | ---------------
3221+| **Name** | **Type** | **Description** |
3222+| -------- | -------- | --------------- |
26743223 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
26753224 | data\_size | u32 | Length in bytes of the valid data in the data field. |
26763225 | data | u8[...] | COSE Sign1 signed EAT token containing attested CSR (or keypair inventory when key_id = 0). |
@@ -2684,23 +3233,57 @@
26843233
26853234 *Table: `SIGN_WITH_EXPORTED_ECDSA` input arguments*
26863235
2687-| **Name** | **Type** | **Description**
2688-| -------- | -------- | ---------------
3236+| **Name** | **Type** | **Description** |
3237+| -------- | -------- | --------------- |
26893238 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
2690-| exported_cdi_handle | u8[32] | The Exported CDI handle returned by the DPE `DeriveContext` command. Little endian. |
2691-| tbs | u8[48] | The bytes to be signed. Little endian. |
3239+| exported_cdi_handle | u8[32] | The exported CDI handle returned by the DPE `DeriveContext` command. Opaque byte array; copy the bytes exactly as returned. |
3240+| tbs | u8[48] | The 48-byte SHA-384 digest to be signed. Raw byte array; no byte swapping is required. |
26923241
26933242
26943243 *Table: `SIGN_WITH_EXPORTED_ECDSA` output arguments*
2695-| **Name** | **Type** | **Description**
2696-| -------- | -------- | ---------------
3244+| **Name** | **Type** | **Description** |
3245+| -------- | -------- | --------------- |
26973246 | derived_pubkey_x | u8[48] | The X BigNum of the ECDSA public key associated with the signing key. |
26983247 | derived_pubkey_y | u8[48] | The Y BigNum of the ECDSA public key associated with the signing key. |
26993248 | signature_r | u8[48] | The R BigNum of an ECDSA signature. |
27003249 | signature_s | u8[48] | The S BigNum of an ECDSA signature. |
27013250
27023251
2703-The `exported_cdi` can be created by calling `DeriveContext` with the `export-cdi` and `create-certificate` flags.
3252+The `exported_cdi_handle` can be created by calling `DeriveContext` with the `export-cdi` and `create-certificate` flags.
3253+
3254+### SIGN\_WITH\_EXPORTED\_MLDSA
3255+
3256+Command Code: `0x5357_4D4C` ("SWML")
3257+
3258+**Note**: This command is only available in the locality of the PL0 PAUSER.
3259+
3260+*Table: `SIGN_WITH_EXPORTED_MLDSA` input arguments*
3261+
3262+| **Name** | **Type** | **Description** |
3263+| -------- | -------- | --------------- |
3264+| chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
3265+| exported_cdi_handle | u8[32] | The exported CDI handle returned by the DPE `DeriveContext` command. Opaque byte array; copy the bytes exactly as returned. |
3266+| sign_type | u32 | Signing mode selector. `0` = `Mu` (64-byte pre-hash input), `1` = `Raw` (arbitrary byte array input). |
3267+| tbs_size | u32 | Length of the message to be signed. For `Mu`, this must be exactly 64 bytes. For `Raw`, this may be up to 1024 bytes. |
3268+| tbs | u8[1024] | The message bytes to be signed. For `Mu`, this field contains a 64-byte message digest. For `Raw`, it contains the raw input bytes to sign. |
3269+
3270+
3271+*Table: `SIGN_WITH_EXPORTED_MLDSA` output arguments*
3272+
3273+| **Name** | **Type** | **Description** |
3274+| -------- | -------- | --------------- |
3275+| derived_pubkey | u8[2592] | The ML-DSA public key derived from the exported CDI handle and the DPE environment. |
3276+| signature | u8[4627] | The ML-DSA signature produced by the derived key. |
3277+
3278+
3279+The `exported_cdi_handle` can be created by calling `DeriveContext` with the `export-cdi` and `create-certificate` flags.
3280+
3281+This command derives an ML-DSA key pair from the provided exported CDI handle and signs either:
3282+
3283+- a 64-byte `Mu` message digest, or
3284+- a `Raw` message payload of up to 1024 bytes.
3285+
3286+The command performs the signing under PL0-only access control and returns the derived public key together with the signature.
27043287
27053288 ### REVOKE\_EXPORTED\_CDI\_HANDLE
27063289
@@ -2710,16 +3293,47 @@
27103293
27113294 *Table: `REVOKE_EXPORTED_CDI_HANDLE` input arguments*
27123295
2713-| **Name** | **Type** | **Description**
2714-| -------- | -------- | ---------------
3296+| **Name** | **Type** | **Description** |
3297+| -------- | -------- | --------------- |
27153298 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
2716-| exported_cdi_handle | u8[32] | The Exported CDI handle returned by the DPE `DeriveContext` command. Little endian. |
2717-
2718-
2719-The `exported_cdi` can be created by calling `DeriveContext` with the `export-cdi` and `create-certificate` flags.
3299+| exported_cdi_handle | u8[32] | The exported CDI handle returned by the DPE `DeriveContext` command. Opaque byte array; copy the bytes exactly as returned. |
3300+
3301+
3302+The `exported_cdi_handle` can be created by calling `DeriveContext` with the `export-cdi` and `create-certificate` flags.
27203303
27213304 The `exported_cdi_handle` is no longer usable after calling `REVOKE_EXPORTED_CDI_HANDLE` with it. After the `exported_cdi_handle`
2722-has been revoked, a new exported CDI can be created by calling `DeriveContext` with the `export-cdi` and `create-certificate` flags.
3305+has been revoked, a new exported CDI handle can be created by calling `DeriveContext` with the `export-cdi` and `create-certificate` flags.
3306+
3307+### EXTERNAL_MAILBOX_CMD
3308+
3309+Command Code: `0x4558_544D` ("EXTM")
3310+
3311+**Important restrictions:**
3312+- This command is only available in subsystem mode in 2.1+.
3313+- This command is only available for MCU.
3314+
3315+Executes a mailbox command located at an AXI address.
3316+This allows for executing mailbox commands that are larger than the mailbox allows.
3317+
3318+This is currently mostly useful for FIRMWARE_LOAD (as part of an update) or SET_AUTH_MANIFEST.
3319+
3320+The response is still written to the mailbox.
3321+
3322+The checksum is over the EXTM command, *not* the command that is loaded over AXI.
3323+That external command will still need its own checksum, if applicable.
3324+
3325+*Table: `EXTERNAL_MAILBOX_CMD` input arguments*
3326+
3327+| **Name** | **Type** | **Description** |
3328+| -------- | -------- | --------------- |
3329+| chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
3330+| command_id | u32 | Command ID for the mailbox command to be executed. Little endian. |
3331+| command_size | u32 | Size of the mailbox command to be executed. Little endian. |
3332+| axi_address_low | u32 | Lower 32 bits of the AXI address that contains the mailbox command. Little endian. |
3333+| axi_address_high | u32 | High 32 bits of the AXI address that contains the mailbox command. Little endian. |
3334+
3335+
3336+The response will be the response of the executed external command.
27233337
27243338 ### REALLOCATE\_DPE\_CONTEXT\_LIMITS
27253339
@@ -2729,24 +3343,168 @@
27293343
27303344 *Table: `REALLOCATE_DPE_CONTEXT_LIMITS` input arguments*
27313345
2732-| **Name** | **Type** | **Description**
2733-| -------- | -------- | ---------------
3346+| **Name** | **Type** | **Description** |
3347+| -------- | -------- | --------------- |
27343348 | chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian. |
27353349 | pl0_context_limit | u32 | Number of contexts to allocate to PL0. PL1 will receive remaining contexts. |
27363350
27373351
27383352 *Table: `REALLOCATE_DPE_CONTEXT_LIMITS` output arguments*
2739-| **Name** | **Type** | **Description**
2740-| -------- | -------- | ---------------
3353+| **Name** | **Type** | **Description** |
3354+| -------- | -------- | --------------- |
27413355 | chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian. |
27423356 | fips_status | u32 | Indicates if the command is FIPS approved or an error. |
27433357 | new_pl0_context_limit | u32 | Number of contexts assigned to PL0 after the reallocation |
27443358 | new_pl1_context_limit | u32 | Number of contexts assigned to PL1 after the reallocation |
27453359
27463360
2747-This allows the user to reallocate the 32 DPE contexts between PL0 and PL1. By default, each gets 16 contexts.
3361+This allows the user to reallocate the 64 DPE contexts between PL0 and PL1. By default, each gets 32 contexts.
27483362
27493363 **Note**: 2 PL0 contexts are used by Caliptra itself during initialization.
3364+
3365+### FE\_PROG
3366+
3367+Programs Field Entropy (FE) into one of 4 FE partitions in the OTP fuse controller. This command
3368+is typically used during device provisioning flows.
3369+
3370+**Note**: This command is only available when the device is in the **Production** lifecycle state.
3371+
3372+Command Code: `0x4645_5052` ("FEPR")
3373+
3374+*Table: `FE_PROG` input arguments*
3375+
3376+| **Name** | **Type** | **Description**
3377+| -------- | -------- | ---------------
3378+| chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian.
3379+| partition | u32 | FE partition number (valid values: 0–3).
3380+
3381+`FE_PROG` returns no output arguments other than the mailbox response header.
3382+
3383+### ZEROIZE\_UDS\_FE
3384+
3385+Permanently zeroizes the selected UDS and Field Entropy (FE) OTP partitions, including
3386+their seeds, digests, and zeroization markers. Runtime uses the same OTP programming
3387+flow and read-back verification as ROM.
3388+
3389+This command is restricted to **PL0** and **subsystem mode**, where Caliptra can
3390+access the OTP fuse controller through DMA. The caller must authorize the destructive
3391+operation before submitting it; this command does not implement the MCU's external
3392+challenge/signature authorization protocol.
3393+
3394+Command Code: `0x5A45_5546` ("ZEUF")
3395+
3396+*Table: `ZEROIZE_UDS_FE` input arguments*
3397+
3398+| **Name** | **Type** | **Description**
3399+| -------- | -------- | ---------------
3400+| chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian.
3401+| flags | u32 | Partition-selection bitmask: bit 0 selects UDS; bits 1 through 4 select FE0 through FE3.
3402+
3403+At least one partition must be selected. Reserved flag bits must be zero. Invalid
3404+lengths or flags are rejected before OTP changes or shutdown. Requests from PL1 or
3405+outside subsystem mode are also rejected without changing OTP or shutting down.
3406+
3407+*Table: `ZEROIZE_UDS_FE` output arguments*
3408+
3409+| **Name** | **Type** | **Description**
3410+| ----------- | -------- | ---------------
3411+| chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian.
3412+| fips_status | u32 | Standard mailbox response status.
3413+| dpe_result | u32 | `0` if every selected partition passed zeroization read-back verification; `1` if zeroization failed.
3414+
3415+The response is the existing 12-byte `ZeroizeUdsFeResp` used by ROM. Callers must
3416+read and check `dpe_result`; successful mailbox transport or an 8-byte response
3417+header alone is not proof of zeroization. A failure may follow partial, irreversible
3418+zeroization, and unattempted or unselected partitions are not reported as zeroized.
3419+The specific OTP error is reported in `CPTRA_FW_ERROR_NON_FATAL`.
3420+
3421+After any valid zeroization attempt, Runtime clears its cryptographic engines,
3422+key vault, and persistent state using the existing shutdown cleanup path. It returns
3423+the result and enters the terminal `RUNTIME_SHUTDOWN` state even if OTP zeroization
3424+failed. A cleanup failure causes mailbox command failure and still enters terminal
3425+shutdown. Caliptra cannot service further Runtime requests without reset.
3426+
3427+This command does not transition the lifecycle controller to RMA or update the
3428+MCU's field-entropy state markers. The MCU remains responsible for those operations,
3429+and must not request RMA unless zeroization has succeeded and the required OTP state
3430+has been verified.
3431+
3432+### PRODUCTION\_AUTH\_DEBUG\_UNLOCK\_REQ
3433+
3434+Initiates the production debug unlock flow by generating a cryptographic challenge. The caller
3435+must solve the challenge by signing it with the appropriate ECC and MLDSA keys and returning
3436+the result via the [`PRODUCTION_AUTH_DEBUG_UNLOCK_TOKEN`](#production_auth_debug_unlock_token)
3437+command.
3438+
3439+This command performs the same function as the ROM's `AUTH_DEBUG_UNLOCK_REQ` command
3440+(documented in the [ROM README](../rom/dev/README.md#debug-unlock)), but is available at
3441+runtime.
3442+
3443+**Note**: This command requires the device to be in the **Production** lifecycle state and the
3444+`PROD_DEBUG_UNLOCK_REQ` bit in the `SS_DBG_MANUF_SERVICE_REG_REQ` register to be set.
3445+
3446+Command Code: `0x5044_5552` ("PDUR")
3447+
3448+*Table: `PRODUCTION_AUTH_DEBUG_UNLOCK_REQ` input arguments*
3449+
3450+| **Name** | **Type** | **Description**
3451+| -------- | -------- | ---------------
3452+| chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian.
3453+| length | u32 | Length of the payload in DWORDs.
3454+| unlock\_level | u8 | Debug unlock level (1–8).
3455+| reserved | u8[3] | Reserved.
3456+
3457+*Table: `PRODUCTION_AUTH_DEBUG_UNLOCK_REQ` output arguments*
3458+
3459+| **Name** | **Type** | **Description**
3460+| -------- | -------- | ---------------
3461+| chksum | u32 | Checksum over other output arguments, computed by Caliptra. Little endian.
3462+| fips\_status | u32 | Indicates if the command is FIPS approved or an error.
3463+| length | u32 | Length of the response payload in DWORDs.
3464+| unique\_device\_identifier | u8[32] | Device identifier of the Caliptra device. Byte array; pass through as-is to the token command.
3465+| challenge | u8[48] | Random challenge number generated by Caliptra. Byte array; pass through as-is to the token command.
3466+
3467+### PRODUCTION\_AUTH\_DEBUG\_UNLOCK\_TOKEN
3468+
3469+Completes the production debug unlock handshake by validating the caller's solution to the
3470+challenge generated by
3471+[`PRODUCTION_AUTH_DEBUG_UNLOCK_REQ`](#production_auth_debug_unlock_req). The caller must
3472+provide the device identifier and challenge from the previous request along with ECC-384 and
3473+ML-DSA-87 signatures proving possession of the authorized debug unlock key.
3474+
3475+Upon successful validation, Caliptra authorizes the debug unlock by setting the unlock level
3476+in the `SS_SOC_DBG_UNLOCK_LEVEL` register.
3477+
3478+This command performs the same function as the ROM's `AUTH_DEBUG_UNLOCK_TOKEN` command
3479+(documented in the [ROM README](../rom/dev/README.md#debug-unlock)), but is available at
3480+runtime.
3481+
3482+**Note**: This command requires a preceding successful `PRODUCTION_AUTH_DEBUG_UNLOCK_REQ` in
3483+the same boot session. The challenge is consumed on use and cannot be replayed.
3484+
3485+Command Code: `0x5044_5554` ("PDUT")
3486+
3487+*Table: `PRODUCTION_AUTH_DEBUG_UNLOCK_TOKEN` input arguments*
3488+
3489+| **Name** | **Type** | **Description**
3490+| -------- | -------- | ---------------
3491+| chksum | u32 | Checksum over other input arguments, computed by the caller. Little endian.
3492+| length | u32 | Length of the payload in DWORDs.
3493+| unique\_device\_identifier | u8[32] | Device identifier (must match value from challenge response). Byte array; copied verbatim from the challenge response.
3494+| unlock\_level | u8 | Debug unlock level (1–8, must match the original request).
3495+| reserved | u8[3] | Reserved.
3496+| challenge | u8[48] | Challenge (must match value from challenge response). Byte array; copied verbatim from the challenge response.
3497+| ecc\_public\_key | u8[96] | ECC P-384 public key (X &#124;&#124; Y, 48 bytes each). See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields).
3498+| mldsa\_public\_key | u8[2592] | ML-DSA-87 public key. See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields).
3499+| ecc\_signature | u8[96] | ECC P-384 signature over the SHA2-384 message digest. R (48 bytes) &#124; S (48 bytes). See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields).
3500+| mldsa\_signature | u8[4628] | ML-DSA-87 signature over the SHA2-512 message digest (4627 bytes + 1 reserved byte). See [Byte order of cryptographic fields](#byte-order-of-cryptographic-fields).
3501+
3502+The signed message for both ECC and ML-DSA signatures is the hash of the concatenation:
3503+`unique_device_identifier || unlock_level || reserved || challenge` (all as raw bytes).
3504+ECC uses SHA2-384; ML-DSA uses SHA2-512.
3505+
3506+`PRODUCTION_AUTH_DEBUG_UNLOCK_TOKEN` returns no output arguments other than the mailbox
3507+response header.
27503508
27513509 ## Checksum
27523510
@@ -2770,15 +3528,15 @@
27703528
27713529 ## FIPS status
27723530
2773-For every command, the firmware responds with a FIPS status of FIPS approved. There is
2774-currently no use case for any other responses or error values.
3531+For successful commands, the firmware responds with a FIPS status indicating whether the service is FIPS approved. A non-approved status is not a command error.
27753532
27763533 *Table: FIPS status codes*
27773534
27783535 | **Name** | **Value** | Description |
27793536 | --------------- | --------------------------- | --------------------------------------------------- |
27803537 | `FIPS_APPROVED` | `0x0000_0000` | Status of command is FIPS approved |
2781-| `RESERVED` | `0x0000_0001 - 0xFFFF_FFFF` | Other values reserved, will not be sent by Caliptra |
3538+| `FIPS_NOT_APPROVED_USER_SUPPLIED_DIGEST` | `0x5553_5244` | Command is not FIPS approved because the caller supplied the digest instead of the raw message |
3539+| `RESERVED` | `0x0000_0002 - 0xFFFF_FFFF` | Other values reserved, will not be sent by Caliptra |
27823540
27833541
27843542 ## Runtime Firmware updates
@@ -2857,14 +3615,14 @@
28573615 To prevent this, we establish active context limits for each PAUSER
28583616 privilege level:
28593617
2860-* PL0 - 16 active contexts
2861-* PL1 - 16 active contexts
3618+* PL0 - 32 active contexts
3619+* PL1 - 32 active contexts
28623620
28633621 If a DPE command were to activate a new context such that the total number of
28643622 active contexts in a privilege level is above its active context limit, the
28653623 InvokeDpe command should fail.
28663624
2867-At boot Caliptra Runtime FW consumes part of the PL0 active contexts (initially 16) to DeriveContext for:
3625+At boot Caliptra Runtime FW consumes part of the PL0 active contexts (initially 32) to DeriveContext for:
28683626 - RTFW Journey (RTFJ) Measurement (1)
28693627 - Caliptra Configured Initialization Values digest (CCIV) (1)
28703628 - ROM Stashed Measurements (max 8)
@@ -2872,20 +3630,20 @@
28723630 Further, it is not allowed for PL1 to call DeriveContext with the intent to change locality to PL0's locality; this would increase the number
28733631 of active contexts in PL0's locality, and hence allow PL1 to DOS PL0.
28743632
2875-### DPE profile implementation
2876-
2877-The DPE iRoT profile leaves some choices up to implementers. This section
2878-describes specific requirements for the Caliptra DPE implementation.
3633+### Caliptra DPE Profile
3634+
3635+Caliptra defines the **Caliptra DPE Profile**, which inherits from the [OCP DPE iRoT Profile](https://github.com/opencomputeproject/Security/tree/main/specifications/dpe-irot-profile) (`DPE_PROFILE_IROT_P384_SHA384`) with some modifications. This section describes the profile attributes and specific requirements for the Caliptra DPE implementation.
28793636
28803637 | Name | Value | Description |
28813638 | -------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------------------ |
2882-| Profile Variant | `DPE_PROFILE_IROT_P384_SHA384` | The profile variant that Caliptra implements. |
3639+| Profile Variant | `Caliptra DPE Profile` | Derived from `DPE_PROFILE_IROT_P384_SHA384`. |
28833640 | KDF | SP800-108 HMAC-CTR | KDF to use for CDI (tcg.derive.kdf-sha384) and asymmetric key (tcg.derive.kdf-sha384-p384) derivation. |
28843641 | Simulation Context Support | Yes | Whether Caliptra implements the optional Simulation Contexts feature. |
28853642 | Supports ExtendTci | Yes | Whether Caliptra implements the optional ExtendTci command. |
28863643 | Supports Auto Init | Yes | Whether Caliptra will automatically initialize the default DPE context. |
28873644 | Supports Rotate Context | Yes | Whether Caliptra supports the optional RotateContextHandle command. |
28883645 | CertifyKey Alias Key | Caliptra Runtime Alias Key | The key that will be used to sign certificates that are produced by the DPE CertifyKey command. |
3646+| `export-cdi-format` | KeyVault Slot Handle | Overrides the iRoT profile default (which returns the actual CDI) to return a 32-byte handle to a KeyVault slot instead. |
28893647
28903648
28913649 ### Supported DPE commands
@@ -2896,6 +3654,7 @@
28963654 * InitializeContext
28973655 * DeriveContext
28983656 * **Note**: The "export-cdi" flag is only available in the locality of the PL0 PAUSER.
3657+ * **Note**: The value returned when `export-cdi` is requested is a 32-byte handle to a KeyVault slot containing the CDI, not the actual CDI. This overrides the default iRoT profile behavior.
28993658 * CertifyKey
29003659 * Caliptra DPE supports two formats for CertifyKey: X.509 and PKCS#10 CSR.
29013660 X.509 is only available to PL0 PAUSERs.