| commit | 1ba1559432478375276817a76f283db48df03004 | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun Feb 23 16:48:32 2025 -0800 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun Feb 23 16:48:32 2025 -0800 |
| tree | 8c2c5e6fc37e40f35d2b4763642637afc1aa6534 | |
| parent | 8fe67067d9f62c06076eee0481735c3eb8a47e7e [diff] |
roll: third_party/pigweed/src 2c9dee1..c12c17d (72 commits) c12c17d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/270592 roll: luci a4ddc9b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/270417 roll: ninja 7eb28ce:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/234717 pw_allocator: Add dlmalloc-style allocator b1a5820:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269753 pw_ide: Implement file status indicators for GN ea00e2a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269757 pw_ide: Run clean before testing 1ec3c50:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/270172 pw_span: Add IWYU private pragma to internal span impl 9a927ac:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/270152 pw_assert: Add IWYU export/private pragmas for check* 61138fd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264646 pw_allocator: Add multiple block implementations f432240:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269794 pw_build: Introduce runfiles manager 14595a2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/270292 pigweed.json: Remove combined sanitizer Bazel program 9687a0c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269992 pw_async2: Size optimizations for PendFuncAwaitable 1bc28ab:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268933 pw_build: Remove deprecated CMake function 62d8518:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269993 pigweed.json: Add separate sanitizer Bazel programs 2788c69:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264012 pw_crypto: Use pw::span_cast 0101b0e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269194 pw_allocator: Enable size reports in Bazel 4fe911e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/261152 pw_build_mcuxpresso: Add flag to clean old files a4549e5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269758 pw_bluetooth_sapphire: Fix misc. clang-tidy errors 6216648:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269515 pw_async2: Add IWYU export for dispatcher_base.h in dispatcher.h cbf1a74:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263535 SEED-0133: pw_wakelock 33072a9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268932 pw_build: Warn about use of deprecated CMake function f364df6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269732 pw_async2: Make PendFuncAwaitable constructor constexpr e199770:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269633 bazel: Update some bazel dep versions 4ff6944:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/267692 pw_bluetooth_sapphire: Implement Central2::Connect 86ff4cd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269632 pw_presubmit: Run format on all JS/TS file types c2cc6b7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269756 pw_presubmit: Add VS Code extension test suite 05d1f44:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269294 pw_kernel: Wire up panic handler 280634d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269214 pw_kernel: Flatten //pw_kernel/kernel aec9c4a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269232 pw_kernel: Move spinlocks into kernel crate b3864ad:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269793 pw_protobuf_compiler: Tidy up nanopb_proto_library 659b94b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269138 pw_function: Guidance for using pw::Function; rework aliases 4641cef:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269754 pw_protobuf_compiler: rm deps nanopb_proto_library 85ab4d3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269792 pw_protobuf_compiler: Narrow pw_assert dep de83b5b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/261452 pw_assert: Mark :backend deprecated 2695a7e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269752 pw_bluetooth_proxy: Unregister channel before sending close event 1872404:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269332 pw_span: Restrict span_cast<T> to one-byte types 0c58d27:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268732 pw_multibuf: Add support for alignment to SimpleAllocator 71f9739:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264514 pw_env_setup: Remove bazel.json e114a96:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269393 pw_presubmit: Update .clang-format to add newlines at the end of files 0012099:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268952 pw_bluetooth_proxy: Support two word event callback functions 4cbbd18:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269592 pw_ide: Unify testing d41e457:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269052 pw_kernel: Dump exception frame on every exception 73977b9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/267992 pw_kernel: Add NVIC register accessors 73c1156:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/267935 pw_kernel: Add systick register definitions 36e8e0a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/267934 pw_kernel: Add thumbv8m MPU register definitions 94391ef:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268875 pw_build: Support executables with pw_py_importable_runfile 2ac8a3a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268055 pw_kernel: Add timer based preemption 70d2e87:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269295 pw_presubmit: Disregard file order in PyPI upload 78a55c8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269212 pw_assert: Narrow some dependencies 813fe27:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268877 pw_async2: Add new PendFuncAwaitable utility class 72591b2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264645 pw_allocator: Refactor block tests to be generic b4e66e6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269292 bluetooth: Fix AVDTP dynamic size 15b0072:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269293 pw_env_setup: PyPI version bump to 0.0.21 b563e5b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/267612 pw_bloat: Build Bazel size reports with a specified platform c0e69a9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268974 pw_ide: Better orphaned file feedback fcd6de2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269213 pw_protobuf: Fix examples in docs dfd05cc:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269112 pw_rpc: Replace not_called with assert_not_called d6e9afb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268773 pw_thread_freertos: Remove includes attribute 8cf4e80:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264652 pw_log_basic: Remove includes, fix layering 55ce4e9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268812 pw_unit_test: Retire googletest platform 3dde8a0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269053 pw_sensor: Enable YAML to Python sensor attribute changes c330d21:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264644 pw_allocator: Facilitate additional block implementations febc8c2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/265832 pw_bluetooth: Remove scratch buffer from snoop log stack cf933ea:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268973 pw_ide: Fix compDB file read regression a89a725:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268053 pw_bluetooth_sapphire: Expose bt-hci-virtual for manual launching bdf6839:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268953 pw_interrupt: Add pw_interrupt_freertos to the backend_multiplexer 60a1d0c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264641 pw_allocator: Make assertions more tunable dcd8f58:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268032 CMake: Set policy to silence warnings in pw_parse_arguments_strict 434a4ff:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/255772 pw_build_mcuxpresso: Add readme generation support 6be7bf4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/261412 pw_unit_test: rm explicit deps on //pw_unit_test c05977a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/239734 pw_{clock_tree, stream_uart, uart}_mcuxpresso: Fix bazel dependencies 8a39426:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/267013 bazel: Don't disable layering check for googletest a551daa:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/267847 roll: go Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: 2c9dee1dd3a940..c12c17d8a25f0b Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8722096561116184545 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: Idc789cb2c2299008e2fb701da3a3af032b9c72fe Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/270615 Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init --recursive $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.