feat: turn send_cmio_response failures into no-ops in log and verify

The core send_cmio_response can no longer fail. If verification could
fail for a reachable machine state and response, there would be states
for which the honest party cannot produce a log that proves the
resulting state transition. The iflags.Y and response-length checks now
return without touching the state, like the advance-state yield check
already did. The length check also moves ahead of the revert root hash
write, where it can still prevent all state changes. iflags.Y remains
the first access, so a no-op log is never empty, which replay requires.

The host-facing machine::send_cmio_response still refuses misuse
upfront. check_pending_cmio_request takes over the dropped checks,
requiring a manual yield for every response reason and a response that
fits in the rx buffer, with the same error messages as before.
machine::log_send_cmio_response no longer fails for any machine state
or response argument and logs a no-op instead.

Author: diegonehab

Makefile

@@ -4,7 +4,7 @@ DOWNLOADDIR := downloads
 SRC_DIR := src
 
 EMULATOR_VERSION ?= v0.21.0
-EMULATOR_TAG ?= -test1
+EMULATOR_TAG ?= -test2
 
 SOLIDITY_VERSION ?= 0.8.30
 

helper_scripts/generate_EmulatorConstants.lua

@@ -39,7 +39,7 @@ out:write('    uint64 constant HTIF_FROMHOST_ADDRESS = 0x' ..
     hex(cartesi.machine:get_reg_address("htif_fromhost")) .. ';\n')
 out:write('    uint64 constant HTIF_TOHOST_ADDRESS = 0x' ..
     hex(cartesi.machine:get_reg_address("htif_tohost")) .. ';\n')
-out:write('    uint8 constant CMIO_YIELD_REASON_ADVANCE_STATE = 0x' ..
+out:write('    uint8 constant HTIF_YIELD_REASON_ADVANCE_STATE = 0x' ..
     hex(cartesi.HTIF_YIELD_REASON_ADVANCE_STATE) .. ';\n')
 out:write('    uint32 constant HASH_TREE_LOG2_WORD_SIZE = 0x' .. hex(cartesi.HASH_TREE_LOG2_WORD_SIZE) .. ';\n')
 out:write('    uint32 constant HASH_TREE_WORD_SIZE = uint32(1) << HASH_TREE_LOG2_WORD_SIZE;\n')

shasum-download

@@ -1,2 +1,2 @@
-b52a2b54cf18b1215108281ed5c6df93ed4ba3922a09f4155d9f945e703f9fd7  downloads/machine-emulator-tests-data.deb
-5bfb82f7a6665fe264d7d849d8b90f7b476de5f17d01a2743c15952bf8de0069  downloads/uarch-riscv-tests-json-logs.tar.gz
+7ae0df341e8d14b08461748a9f2f639d1cc23bf6c7f1a1aa31185503fef56230  downloads/machine-emulator-tests-data.deb
+b828dc0be96c3f46d61fd973e730a13e44afaca0a95670f7c56371cfc784d705  downloads/uarch-riscv-tests-json-logs.tar.gz

src/EmulatorCompat.sol

@@ -187,6 +187,16 @@ library EmulatorCompat {
         );
     }
 
+    function readHtifTohost(AccessLogs.Context memory a)
+        internal
+        pure
+        returns (uint64)
+    {
+        return a.readWord(
+            EmulatorConstants.HTIF_TOHOST_ADDRESS.toPhysicalAddress()
+        );
+    }
+
     // Conversions and arithmetic functions
 
     function int8ToUint64(int8 val) internal pure returns (uint64) {
@@ -380,4 +390,26 @@ library EmulatorCompat {
 
         return n;
     }
+
+    function isYieldedManualWith(uint64 tohost, uint64 yieldReason)
+        internal
+        pure
+        returns (bool)
+    {
+        uint64 dev = uint64ShiftRight(
+            tohost & EmulatorConstants.HTIF_DEV_MASK,
+            EmulatorConstants.HTIF_DEV_SHIFT
+        );
+        uint64 cmd = uint64ShiftRight(
+            tohost & EmulatorConstants.HTIF_CMD_MASK,
+            EmulatorConstants.HTIF_CMD_SHIFT
+        );
+        uint64 reason = uint64ShiftRight(
+            tohost & EmulatorConstants.HTIF_REASON_MASK,
+            EmulatorConstants.HTIF_REASON_SHIFT
+        );
+        return dev == EmulatorConstants.HTIF_DEV_YIELD
+            && cmd == EmulatorConstants.HTIF_YIELD_CMD_MANUAL
+            && reason == yieldReason;
+    }
 }

src/EmulatorConstants.sol

@@ -46,7 +46,7 @@ library EmulatorConstants {
     uint64 constant IFLAGS_Y_ADDRESS = 0x300;
     uint64 constant HTIF_FROMHOST_ADDRESS = 0x330;
     uint64 constant HTIF_TOHOST_ADDRESS = 0x328;
-    uint8 constant CMIO_YIELD_REASON_ADVANCE_STATE = 0x0;
+    uint8 constant HTIF_YIELD_REASON_ADVANCE_STATE = 0x0;
     uint32 constant HASH_TREE_LOG2_WORD_SIZE = 0x5;
     uint32 constant HASH_TREE_WORD_SIZE = uint32(1) << HASH_TREE_LOG2_WORD_SIZE;
     uint32 constant HTIF_DEV_SHIFT = 0x38;

src/SendCmioResponse.sol

@@ -36,15 +36,29 @@ library SendCmioResponse {
         bytes32 dataHash,
         uint32 dataLength
     ) internal pure {
+        // This function cannot fail. When a failure is detected, the operation is a no-op instead,
+        // so the honest party can always log and prove the resulting state transition.
+        // A response to a machine that is not waiting on a manual yield is a no-op.
         if (!EmulatorCompat.readIflagsY(a)) {
-            EmulatorCompat.throwRuntimeError(a, "iflags.Y is not set");
+            return;
+        }
+        if (reason == EmulatorConstants.HTIF_YIELD_REASON_ADVANCE_STATE) {
+            // Advance-state responses are the input boundary of the rollups flow. They only apply to a
+            // machine waiting for an input on an rx-accepted manual yield. Sending one to a machine that
+            // yielded manual with any other reason (e.g., rejected an input or threw an exception) is a no-op.
+            uint64 tohost = EmulatorCompat.readHtifTohost(a);
+            if (!EmulatorCompat.isYieldedManualWith(
+                    tohost,
+                    EmulatorConstants.HTIF_YIELD_MANUAL_REASON_RX_ACCEPTED
+                )) {
+                return;
+            }
         }
-        // Record the machine root hash to revert to in case the response is eventually rejected
-        EmulatorCompat.writeRevertRootHash(a, revertRootHash);
         // A zero length data is a valid response. We just skip writing to the rx buffer.
+        uint32 writeLengthLog2Size = 0;
         if (dataLength > 0) {
             // Find the write length: the smallest power of 2 that is >= dataLength and >= tree leaf size
-            uint32 writeLengthLog2Size = EmulatorCompat.uint32Log2(dataLength);
+            writeLengthLog2Size = EmulatorCompat.uint32Log2(dataLength);
             if (
                 writeLengthLog2Size < EmulatorConstants.HASH_TREE_LOG2_WORD_SIZE
             ) {
@@ -56,14 +70,17 @@ library SendCmioResponse {
             ) {
                 writeLengthLog2Size += 1;
             }
+            // A response with data that does not fit in the rx buffer is a no-op
             if (
                 writeLengthLog2Size
                     > EmulatorConstants.AR_CMIO_RX_BUFFER_LOG2_SIZE
             ) {
-                EmulatorCompat.throwRuntimeError(
-                    a, "CMIO response data is too large"
-                );
+                return;
             }
+        }
+        // Record the machine root hash to revert to in case the response is eventually rejected
+        EmulatorCompat.writeRevertRootHash(a, revertRootHash);
+        if (dataLength > 0) {
             a.writeRegion(
                 Memory.regionFromPhysicalAddress(
                     EmulatorConstants.AR_CMIO_RX_BUFFER_START

src/UArchReset.sol

@@ -36,24 +36,10 @@ library UArchReset {
             uint64 tohost = EmulatorCompat.readWord(
                 a, EmulatorConstants.HTIF_TOHOST_ADDRESS
             );
-            uint64 dev = EmulatorCompat.uint64ShiftRight(
-                tohost & EmulatorConstants.HTIF_DEV_MASK,
-                EmulatorConstants.HTIF_DEV_SHIFT
-            );
-            uint64 cmd = EmulatorCompat.uint64ShiftRight(
-                tohost & EmulatorConstants.HTIF_CMD_MASK,
-                EmulatorConstants.HTIF_CMD_SHIFT
-            );
-            uint64 reason = EmulatorCompat.uint64ShiftRight(
-                tohost & EmulatorConstants.HTIF_REASON_MASK,
-                EmulatorConstants.HTIF_REASON_SHIFT
-            );
-            if (
-                dev == EmulatorConstants.HTIF_DEV_YIELD
-                    && cmd == EmulatorConstants.HTIF_YIELD_CMD_MANUAL
-                    && reason
-                        == EmulatorConstants.HTIF_YIELD_MANUAL_REASON_RX_REJECTED
-            ) {
+            if (EmulatorCompat.isYieldedManualWith(
+                    tohost,
+                    EmulatorConstants.HTIF_YIELD_MANUAL_REASON_RX_REJECTED
+                )) {
                 EmulatorCompat.revertState(a);
             }
         }

test/SendCmioResponse.t.sol

@@ -34,6 +34,8 @@ contract SendCmioResponse_Test is AccessLogJsonParse {
     string constant JSON_PATH = "./test/uarch-log/";
     string constant CATALOG_PATH = "catalog.json";
     string constant SEND_CMIO_RESPONSE_PATH = "send-cmio-response-steps.json";
+    string constant SEND_CMIO_RESPONSE_NOOP_PATH =
+        "send-cmio-response-noop-steps.json";
 
     uint256 constant siblingsLength = 59;
 
@@ -115,6 +117,81 @@ contract SendCmioResponse_Test is AccessLogJsonParse {
         }
     }
 
+    function testSendCmioResponseNoop() public {
+        Entry[] memory catalog =
+            loadCatalog(string.concat(JSON_PATH, CATALOG_PATH));
+        string memory noopLog =
+            string.concat(JSON_PATH, SEND_CMIO_RESPONSE_NOOP_PATH);
+
+        // all tests combined can easily run out of gas, stop metering
+        // also raise memory_limit in foundry.toml per https://github.com/foundry-rs/foundry/issues/3971
+        vm.pauseGasMetering();
+        // create a large buffer and reuse it
+        bytes memory buffer = new bytes(100 * (siblingsLength + 1) * 32);
+        bool found = false;
+
+        for (uint256 i = 0; i < catalog.length; i++) {
+            if (
+                keccak256(abi.encodePacked(catalog[i].logFilename))
+                    != keccak256(
+                        abi.encodePacked("send-cmio-response-noop-steps.json")
+                    )
+            ) {
+                continue;
+            }
+            found = true;
+            console.log("Replaying log file %s ...", catalog[i].logFilename);
+
+            string memory rj = loadJsonLog(noopLog);
+
+            bytes32 initialRootHash = vm.parseBytes32(
+                string.concat("0x", catalog[i].initialRootHash)
+            );
+            bytes32 finalRootHash =
+                vm.parseBytes32(string.concat("0x", catalog[i].finalRootHash));
+            // the log was taken from a machine that yielded manual with reason
+            // rx-rejected, so the advance-state response must be a no-op
+            assertEq(
+                initialRootHash,
+                finalRootHash,
+                "initial and final root hashes must match"
+            );
+
+            loadBufferFromRawJson(buffer, rj);
+
+            AccessLogs.Context memory accessLogs =
+                AccessLogs.Context(initialRootHash, Buffer.Context(buffer, 0));
+
+            // Prepare arguments for sendCmioResponse
+            // These values are hard-coded in order to match the values used when generating the test log file
+            uint16 reason = EmulatorConstants.HTIF_YIELD_REASON_ADVANCE_STATE;
+            bytes memory response = bytes("This is a test cmio response");
+            bytes memory paddedResponse = new bytes(32);
+            for (uint256 j = 0; j < response.length; j++) {
+                paddedResponse[j] = response[j];
+            }
+            bytes32 paddedResponseHash = keccak256(paddedResponse);
+            // call sendCmioResponse
+            // the test log file was generated passing the initial root hash as the revert root hash
+            SendCmioResponse.sendCmioResponse(
+                accessLogs,
+                initialRootHash,
+                reason,
+                paddedResponseHash,
+                uint32(response.length)
+            );
+            // ensure that the final root hash matches the expected value
+            assertEq(
+                accessLogs.currentRootHash,
+                finalRootHash,
+                "final root hash must match"
+            );
+        }
+        assertTrue(
+            found, "catalog has no send-cmio-response-noop-steps.json entry"
+        );
+    }
+
     function loadCatalog(string memory path)
         private
         view