rt-sdk-2.1.0

This is the initial release of the MCU Runtime SDK for Caliptra 2.1. It provides
a Rust-based reference Root of Trust runtime built on Tock, including reusable
capsules, hardware-abstraction interfaces, reference drivers, userspace APIs,
protocol stacks, reference applications, and host tooling.

The SDK includes emulator and FPGA reference platforms that integrators can adapt
to their SoC-specific hardware and security policies.

Features

Tock-based runtime architecture

• Separates privileged machine-mode boards and hardware drivers from reusable
  capsules and isolated userspace applications.
• Provides hardware-abstraction interfaces and reference platform drivers for
  I3C, DOE, DMA, flash, external OTP, and mailbox-backed transports.
• Provides reusable capsules for MCTP, DOE, mailbox access, OTP, external OTP,
  logging, and flash partitions and storage. Integrators can bind these capsules
  to vendor-specific drivers.
• Provides synchronous and asynchronous Rust APIs for Caliptra services.

Caliptra command services

• Provides common Caliptra command handling over the MCI mailbox and SPDM VDM,
  with SPDM transported over MCTP or DOE.
• Provides direct MCTP VDM services for supported vendor-defined commands.
• Supports firmware version, device capabilities, attestation, debug logging,
  production debug unlock, Caliptra CSR retrieval, IDevID certificate
  population, and cryptographic operations.
• Supports chunked and streaming requests for commands larger than the
  transport buffer.

Authenticated provisioning and ownership

• Provides challenge-response authorization using ECDSA P-384/SHA-384 and
  ML-DSA-87/SHA-512.
• Supports Field Entropy provisioning, minimum SVN updates, fuse locking,
  owner and vendor public-key hash provisioning, rotation, and revocation.
• Exposes Device Ownership Transfer commands through the MCI mailbox and
  SPDM VDM.
• Supports external OTP storage for ECDSA and ML-DSA IDevID certificates.
• Zeroizes sensitive key material after use.

Attestation and measurements

• Supports integrator-owned attestation manifests describing platform identity
  and SoC firmware measurements.
• Provides DPE-backed TCB measurements and software-PCR-backed non-TCB
  measurements.
• Provides production OCP EAT evidence through first-class SPDM measurements
  and the Caliptra GET_ATTESTATION command over the MCI mailbox and SPDM VDM.
• Supports optional PCR Quote evidence through the same evidence framework.
• Preserves and validates measurement state across cold boot and hitless
  firmware updates.

SPDM, MCTP, DOE, and certificates

• Provides a feature-gated SPDM runtime stack with certificate-slot management,
  algorithm negotiation, secured sessions, large-message handling, and MCTP
  and DOE transports.
• Reuses the Caliptra VDM command implementation in the SPDM stack and supports
  streaming production debug unlock.
• Supports read-only vendor and managed flash-backed owner and tenant
  endorsement certificate slots.
• Includes feature-gated SET_CERTIFICATE support. The tagged reference
  applications enable it only for testing; production integrations must provide
  authorization and key-binding policy.
• Adds MCTP endpoint UUID and vendor-defined message support discovery,
  advertises the MCTP DCR on I3C targets, and validates MCTP operation after
  warm reset.
• Provides a platform-neutral DOE transport HIL and capsule plus an emulator
  DOE-mailbox reference driver. Integrators supply their platform-specific
  PCIe DOE hardware integration.

Firmware update and image loading

• Provides PLDM Type 5 firmware update for Caliptra FMC/runtime, MCU runtime,
  and SoC firmware components.
• Supports flash boot, streaming boot, update restart, and hitless activation.
• Authenticates SoC images through Caliptra Core against the SoC manifest.
• Provides platform hooks for authorization, component loading, activation,
  and flash-wear protection.

Logging and diagnostics

• Provides defmt-based userspace logging with release-build support.
• Supports persistent flash and volatile RAM backends with multiple log
  instances.
• Supports log retrieval and clearing through the MCI mailbox and MCTP VDM.
• Tracks image, stack, and SRAM sizes for runtime configurations.

Build and signing tools

• Supports offline authorization-manifest generation, signing, and signature
  attachment.
• Supports ECDSA P-384, LMS, and ML-DSA-87 signing with optional OpenSSL
  provider and HSM integration.
• Provides firmware-bundle vendor and owner public-key hash inspection and
  verification.
• Provides development and release build profiles with feature-selected
  runtime images.

Caliptra 2.1 additions

OCP LOCK and epoch-key services

• Uses the HEK slot state discovered by ROM and handed off to Runtime.
• Generates X.509 HPKE endorsement certificates for ECDH P-384, ML-KEM-1024,
  and hybrid ML-KEM-1024/ECDH P-384 keys.
• Provides commands for retrieving HPKE endorsement certificates, DPE signer
  context certificates, and nonce-bound epoch-key attestation reports.
• Uses an exported CDI context for DPE-backed signing and retains its opaque
  handle in reserved SRAM.
• Supports authorized HEK rotation and permanent-HEK state operations.

Runtime APIs and platform support

• Adds the consolidated caliptra-libapi for certificate, cryptographic,
  evidence, signing, and OCP LOCK operations.
• Adds a reusable DMA capsule HIL for integration with platform-specific DMA
  engines.
• Adds a manufacturing fuse-provisioning firmware image.
• Adds production feature gating and reduces all-features FPGA SRAM usage.
• Expands sensitive-material zeroization and scratch-backed Runtime APIs.

Notes for integrators

This is a source-oriented SDK release. Integrators select the required production
features and provide platform-specific boards, drivers, storage layouts,
authorization policies, and security configuration.

OCP LOCK requires the corresponding Caliptra 2.1 hardware and firmware support,
platform KMB policy, certificates, OTP layout, and key-release integration.

Full Changelog:
rom-sdk-2.1.0...rt-sdk-2.1.0