| commit | 9a77fa0d5537260fc1cfbf3dc7edab8cdeb8949e | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun Jan 12 16:47:35 2025 -0800 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun Jan 12 16:47:35 2025 -0800 |
| tree | 1fe35678a0d106d12c6d8bbef84789e87e6baa02 | |
| parent | c800589dd97476da8408172630f7b737ad7ad320 [diff] |
roll: third_party/pigweed/src 7940ef2..ebd6ec4 (91 commits) ebd6ec4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/255555 pw_ide: Port compDB processing to TS 4b35845:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259753 docs: Update changelog 7e574a5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259512 docs: Prepend module name in HTML title node 68cebbd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259660 pw_watch: Alias //pw_watch/py:bazel to //pw_watch:bazel for convenience 6465286:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259693 pw_watch: Remove deps to enable running watch in other environments dfc7184:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259454 pw_bluetooth_sapphire: Register PairingToken during LE pairing 3c65121:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259356 pw_bluetooth_sapphire: Construct SecurityManager with Peer::WeakPtr cf38dfa:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259355 pw_bluetooth_sapphire: Refactor gap::Peer into separate build rule 3173ab3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259433 pw_toolchain: Register rustfmt toolchain 6148e5f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259112 pw_bluetooth_sapphire: Add PairingTokens to Peer 3cb02e2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259692 Revert "pw_presubmit: Use CQ cache instance" a9e3ab0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259335 Revert "pw_presubmit: Add remote_download_outputs kwarg" fc439e5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/193051 targets/emcraft_sf2_som: Fix runtime stats 03630c8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/257692 pw_protobuf: Correct nested scratch buffer size order of operations 18ba033:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259415 pw_bluetooth_sapphire: Fix header not found error in mock_server.cc ec95722:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259432 pw_protobuf_compiler: Add GN argument for generate protos 664160e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258353 pw_bluetooth_sapphire: Add helper for checking key validation support 72d815e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253833 pw_bluetooth_sapphire: Separate gtest deps from test libs ce6f2c3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259253 docs: Fix commit message style guidance a8c17c9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253892 pw_bluetooth_sapphire: Audit Bazel and GN files for host/ subdirectories 224e2e3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259312 pw_digital_io_mcuxpresso: Return Ok if a line is enabled twice 5976c3a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258775 pw_watch: Generic watcher and bazel integration f94267a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259413 docs: Fix figcaption color 09e1696:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259453 pw_bluetooth_proxy: Fix parameter name mismatch clang-tidy error 7cb88b2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259452 pw_bluetooth: Add AVDTP_SUSPEND_CMD 46ce327:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259354 pw_bluetooth: Add AVDTP_START_CMD 7a788dc:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259052 pw_bluetooth_proxy: Print hex value of the channel ids b687a64:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258973 pw_bluetooth: Add avdtp set stream command 818f8c1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259032 pw_bluetooth: Emboss util fn for copying from a container 8adc4c3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259412 pw_toolchain: Update m33 float-abi 6a6b22b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259174 pw_bluetooth_sapphire: Use emboss OpCode in RespondWithCommandComplete 203c6c8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259055 pw_unit_test: Expectation buffer cleanup 7f196d0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259173 pw_bluetooth: Normalize two OpCode command names 5c4455c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256432 pw_allocator: Use std::lock_guard in sync_alloc a7f27b5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259172 pw_bluetooth: Add more OpCode definitions 17c1509:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/257114 pw_bluetooth_proxy: Update round robin approach df36f07:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254433 pw_toolchain: Cleanup transition flag 78a218f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259252 pw_build: Remove old flag requirement d3a0a19:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259153 pw_bluetooth_sapphire: Use emboss OpCode in RespondWithCommandStatus 049545e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259152 pw_bluetooth: Add more OpCode definitions 7cc8be0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259113 pw_bluetooth_proxy: Change HandleFragmentedPdu name back 4a2fd44:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259132 pw_digital_io_mcuxpresso: Remove McuxpressoInterruptController 15d4ae5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258792 pw_rpc: Increment call_ids for java client 8a5fc59:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/247972 pw_digital_io_mcuxpresso: Add McuxpressoDigitalInOutInterrupt support 34521ea:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258994 pw_digital_io_mcuxpresso: Introduce McuxpressoPintInterrupt 3085c62:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256593 pw_perf_test: Remove multiplexer d93f986:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259013 pw_chrono: Don't import individual types in py aef6fca:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/251712 pw_tokenizer: CSV parser 483a24a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/229672 pw_crypto: Remove micro_ecc support b03ff49:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258772 pw_bluetooth_proxy: Allow Write(MultiBuf) for gatt notify 56d9d44:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258712 pw_bluetooth_proxy: Allow Write(MultiBuf) for rfcomm and basic b129282:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258533 pw_bluetooth_proxy: Move Write(MultiBuf) to L2capChannel 88e93b8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258422 pw_bluetooth_proxy: Rename L2capChannel incoming functions to use Handle 9925b31:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258456 pw_bluetooth_proxy: Move functions to protected 0f95b66:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258454 pw_bluetooth_proxy: Remove deprecated L2apCoc::Write(span) 413a815:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252472 pw_toolchain_bazel: Remove contents 3e0b832:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258833 docs: Remove admonition about Bazel version pin 736d6a3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/239049 pw_fuzzer: Make FuzzTest usable be external CMake projects 0a9be2a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256116 pw_bluetooth_proxy: Remove old cid fields a16e8fa:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258812 pw_bluetooth_sapphire: Simplify LESupportedFeatures 22b2528:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258774 pw_watch: Move path filtering code to separate module b13f7bf:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/242033 bazel: Update to Bazel 8.0.0 f51ac28:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258832 pw_bluetooth_proxy: Retain 'source_cid' name for pending connections 7a1c27a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258398 pw_tokenizer: Fix papaparse module import lint error b977a3a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254652 docs: Refresh Sense tutorial ca147e1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258478 pw_bluetooth_sapphire: Do not downgrade BR/EDR link keys d2ef5fd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254156 bazel: Update rules_cc 1c1dd85:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258673 pw_presubmit: Add remote_download_outputs kwarg a533c76:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258619 pw_bluetooth: Add AVDTP_CLOSE_CMD 710f34f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258672 pw_presubmit: Use CQ cache instance 71c2d0d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/255732 pw_uart: Restrict UartNonBlocking::DoRead() callback 9059212:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256838 pw_async_basic: Introduce ExecuteTask 44f63e7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253854 pw_fuzzer: Mark pw_cc_fuzz_tests as test-only f1611e0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/257632 pw_allocator: Fix Android.bp: Add bucket/public a542e41:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258174 pw_log_basic: Adjust field widths 57ff21b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253853 pw_async: Add test dep and mark as test-only 902b953:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256395 [owners] Remove luluwang@google.com from pw_bluetooth/OWNERS f245559:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258455 pw_thread: Update docs for ThreadCore 462b37b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/231914 pw_crypto: Add BoringSSL backend for AES 3ccae47:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256655 pw_spi_mcuxpresso: Use module constraint 628fefa:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/257312 pw_toolchain: Clang can specify path to gcc toolchain 48c5ba9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253773 pw_system: Handle client disconnection for socket based I/O e88f3c4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253753 pw_chrono/snapshot: Add support for clock names e7380e5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253772 pw_stream: Add ready method to socket stream 9cb5a89:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/257113 pw_build_android: Tweak docs with more detail on dep target types c3fd517:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258173 pw_bluetooth_proxy: Use switch statement with H4PacketType 8706efb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258392 pw_protobuf: Allow unset callback fields in message structs bfe2c77:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256693 docs: Move bug directive dbf07bb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258393 pw_toolchain: Add manual tag to supports_pic_old 924b629:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256835 fuchsia_sdk: Use toolchain defined in rules_fuchsia e5e913d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256373 [owners] Remove luluwang@google.com from pw_bluetooth_proxy/OWNERS Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: 7940ef25e097da..ebd6ec45381c3e Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8725901631395021249 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I94edf071ecf2bfcb0bb24232eb4fa4c3391a1e32 Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/259992 Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.