roll: third_party/pigweed/src d5c4abd..0a9a5b6 (71 commits) 0a9a5b6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357092 async2: Removes && from Waker's Wake() member function dd2751d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357192 pw_async2: Update the C/C++ API reference 7147b3c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357912 pw_build: Search for configs from --directory 2ccc2c8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357773 pw_build: Fix CMake DEBUG log d2caa1b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/354594 docs: Intro to Bazel projects 330b484:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/354255 pw_bluetooth_proxy: Finish TxEngine/RxEngine refactor 857cd4f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357772 pw_build: Add info to error 1701c4f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357673 pw_async2: Add accessor to NotifiedDispatcher 5be3be3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357453 pw_build: Support file absolute paths with CMake sandboxing 53371ae:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/349132 docs: Refactor the changelog automation 63e8811:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357693 pw_ide: Release v1.10.1 4e984ca:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357692 pw_ide: Pass `BAZEL_REAL` to generator triggered from UI 58a89e7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/351032 pw_thread_zephyr: Cleanup sleep timeouts for Zephyr 50dd03e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357452 docs: Refactor analytics 7d509af:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/353972 pw_containers: Add pw::EqualTo functor b766c31:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357313 pw_ide: Fix broken `source_is_in_gn_build` 333e246:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357314 docs: Update search analytics 9618175:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357312 pw_ide: Release v1.10.0 c22e3b3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357195 pw_bluetooth_proxy: Fix async sources 695d944:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357194 pw_ide: Replace list with dropdown in sidebar in first-run mode 9607ad1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/348929 pw_build: Use rules_cc empty_lib 59a42dd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357193 pw_ide: Remove python-based generator and related code 2b81c96:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356752 pw_presubmit: Remove gn_python_checks from lintformat dd4a7f1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356592 pw_async2: Rename //pw_async2:dispatcher to //pw_async2 ee242aa:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357093 pw_change: Add more error handling to push b9eb0c0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/357094 roll: cipd 495cbd6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356813 pw_bluetooth: Add sniff subrating command definition 72d63d7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/350694 pw_ide: Store last generation time and show banner if outdated 8db1046:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356695 pw_sync_stl: Use std::this_thread::yield() a5c1c07:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356912 docs: Set up navigation analytics aab8d9f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356753 pw_stream_uart_mcuxpresso: Remove deprecated constructor ceb48f9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356632 pw_bluetooth_sapphire: Fix -Wshadow-all warnings ed887b5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356693 pw_bluetooth_proxy: Fix async compilation issues ccb4577:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/353195 pw_async2: Update quickstart 5e2427b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356552 pw_bluetooth_proxy: Fix GATT Android.bp deps 10062de:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/354232 pw_bluetooth: Add Write Simple Pairing Debug Mode command 16b722b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/350692 pw_ide: Display predefined compile commands in sidebar UI 6d0da19:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/341132 pw_bluetooth_sapphire: Add CIG state baa604f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356452 pw_bluetooth_proxy: Fix memory ownership for L2capSignalingChannel c275a05:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356193 pw_async2: Use std::atomic for flag shared between threads in example 1a861c3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/331072 cortex_m55: Add M55 toolchain and target 144006c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/354112 bazel: Use Pigweed compile commands for Fuchsia SDK 63bda2e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355859 pw_toolchain: Add cpp20 check a8bef4c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/351372 pw_kernel: Allow app constants to be defined in system manifest 46a9e97:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355857 docs: Fix Pigweed Live 2027 dates cf58d46:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/351552 docs: Update C/C++ module metadata ddbcc1e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355258 pw_kernel: Consistently format targets d87d6de:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/346852 pw_build: Workflows cli build selection and help 4207a70:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/354593 pw_toolchain/rust: Introduce support for alloc 47f7a2b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/356032 pw_bluetooth_proxy: Fix HCI soong 3b69e42:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355692 docs: Add image hosting link for Googlers 8befd14:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355856 pw_stream_uart_mcuxpresso: Add flow control setting to isr safe writer 8ab4c6c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/347238 pw_bluetooth_proxy: Create GATT submodule 87a0204:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355813 pw_sys_io_baremetal_lm3s6965evb: Avoid volatile in for loop e735f08:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/353652 OWNERS: Remove abrachet@ from //depot/OWNERS c3a9165:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355252 pw_bluetooth_sapphire: Rename variable for offloaded filters in use 7d40d0b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/354595 pw_console: Improve UI theme handling 7ae6996:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355373 pw_build: Remove blooper 1c06a79:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/344835 pw_bluetooth_proxy: Add async support e5d78e5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/354256 pw_multibuf: Add ShrinkToFit to multibuf_v2 6389a1f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/351758 pw_kernel: Add ability to pass extra qemu args 7c05e35:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/349272 pw_bluetooth_proxy: Add async test utilities bd27191:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/353352 pw_async2: Generic multi producer/consumer handles 5cad923:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/340698 pw_bluetooth_proxy: Make sync portions replaceable 6e96ee9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/351757 pw_kernel: Add k utility with image_info command 13fc1fb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/354133 pw_async2: Remove module log config 4bf3c75:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/348072 sphinx: Add Doxygen class data to search index 777768c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/354753 pw_*: Fix C++20 compatibility issues 74bba12:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/351756 pw_kernel: Add out of band kernel stack annotations 005c2b2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355259 pw_kernel: Upgrade bitfield-struct crate a92920a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/355261 pw_bluetooth_proxy: Fix Android.bp for HCI Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: d5c4abd445a413..0a9a5b62d90ae0 Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8694826873314468113 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I55cc66bc92a9c858242c685d3ab15415ae6264d0 Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/358235 Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init --recursive $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.