| commit | a2feeb7a1f6aa4bf6c790c527388463ca443332e | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun Mar 16 17:46:55 2025 -0700 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun Mar 16 17:46:55 2025 -0700 |
| tree | 2705c366b2cabc80ca96dfb39d6f9af1541a5562 | |
| parent | c2706a0111b26c8118def349047603e77206cb93 [diff] |
roll: third_party/pigweed/src 8b7efb0..a02d053 (68 commits) a02d053:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/276216 roll: gn 6fd6d56:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/276235 roll: luci 2221585:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/276234 roll: python-wheel 67b56c9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/276214 roll: ninja 8165b25:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263913 third_party/freertos: Allow empty glob a63dba9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275972 pw_async2: Move classes to their own headers 7fd8ce1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264519 pw_log_tokenized: Remove includes, fix layering 42f3db7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/256594 pw_rpc: Remove system_server multiplexer ff0dac0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/276074 pw_toolchain: Fixup compiler helpers for use outside pigweed 0ae3933:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/276134 pw_presubmit: Check includes on .bazelrc changes f1b817c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/276073 pw_build: Add -Wthread-safety-beta for upstream gn clang builds 29508f7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275352 pw_bluetooth: Add MTU field into L2capOption structure 8cb56bd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275892 pw_console: Remove unused ipython dependency 44575e1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275914 pw_i2c_mcuxpresso: Fix thread annotation issues 615cb03:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275912 MODULE.bazel: Use mirror of googletest a63afba:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274572 pw_env_setup: Upgrade pylint 236c292:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275692 bazel: Add Bazel shortcut for pw format 43bcf7e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274912 pw_log: Allow trailing commas in Rust API a05a8d6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273872 pw_kernel: Add sleep() and remove TICK_WAIT_QUEUE 137c217:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272814 pw_kernel: Add timeouts to WaitQueue and Mutex 609c60b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273552 pw_kernel: Add name field to Thread 7eb2376:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275612 pw_flatbuffers: Add PREFIX and STRIP_PREFIX to build options 5c1e4ea:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274895 pw_bluetooth_proxy: Adjust AclFragTest variable names and ordering 23115bf:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274833 pw_bluetooth_proxy: Handle channel being dropped during recombination 7504dc5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274554 pw_bluetooth_proxy: Tweak nested if and comment cee9c4c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273455 pw_kernel: Fix bug with is_linked() in lists e37e3da:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273113 pw_kernel: Add remove_element method to ForeignList 3e1c9bd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274996 pw_bluetooth_proxy: Fix msan issue in CanRepeatedlyReuseOneBuffer 8dcf388:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275716 pw_presubmit: Split out docs for pigweed.json options da0db9b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274995 pw_bluetooth_proxy: Fix msan issue in CanOccupyAllThenReuseEachBuffer 39dfa95:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274994 pw_bluetooth_proxy: Fix msan issue in H4BufferReleaseTriggersQueueDrain f64b951:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275713 pw_build: Allow overriding pw_python_zip_with_setup scripts 13bbf6b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258773 pw_tokenizer: Add support for nested tokenization in C++ 6a635aa:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275452 pw_env_setup: Upgrade pip, pip-tools, setuptools 953aec9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274573 pw_toolchain: Add riscv32 bazel toolchains 0866c5a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275712 pw_env_setup: Remove toml Python package checks 54b9b02:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274272 pw_container: Backport constexpr functions to <algorithm> a0b5dfd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260227 pw_bluetooth_sapphire: Add BidirectionalMultimap f1b4e9d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274792 clang-tidy: Enable bugprone-forwarding-reference-overload f9979ae:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275412 pw_config_loader: Remove toml loader fd015fe:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275052 pw_trace_tokenized: Add trace_time label flag 3016e5f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274963 pw_trace_tokenized: Update OWNERS 992ca19:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275012 pw_build: Add PW_MUST_NOT_PLACE 4bb2686:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273092 pw_presubmit: Add formatting check rule 18cbbfe:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275033 bazel: Roll Pico SDK to 2.1.1 8bd066c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274693 pw_allocator: Add PW_ALLOCATOR_HAS_ATOMICS 5ec4ad9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/275172 roll: clang 9b44d6e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260223 pw_bluetooth_sapphire: Add packet filtering support to FakeController f87e713:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260226 pw_bluetooth_sapphire: Update AdvertisingHandleMap to use UnorderedBiMap 29ac60d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/265635 pw_bluetooth_sapphire: AdvertisingPacketFilter handles all filtering 689ae6d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274832 pw_rpc: Add python pw_rpc.callback_client.Call object to the docs 55af15a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260231 pw_bluetooth_sapphire: LowEnergyScanner is now responsible for filtering 122b96e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274013 pw_bluetooth: Add L2cap Configure Req/Rsp 5fdadeb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274752 pw_config_loader: Move find_config.py 8b12608:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274815 bazel: --incompatible_bazel_test_exec_run_under 0cb16d1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274814 pw_build: boolean_constraint_value negative value shouldbn't be private 17bbff3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274813 pw_rpc: Remove unused test code 8610963:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268734 pw_rpc: Support open call ids f6007e2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/268733 Revert "pw_rpc: Revert Java client call ID changes" 2e15e17:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274552 pw_rpc: Fix link to call object destruction help bf2e156:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274012 pw_bluetooth_proxy: Avoid nesting acl credit lock inside channels lock 808ac9e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272872 pw_kernel: Add sorted_insert to lists eaa4770:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272812 pw_kernel: Add time library b3e7f59:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274512 pw_toolchain: Add msan toolchain feature 15e7d20:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273972 roll: Clang 124b7de:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274392 pw_env_setup: Update CIPD path in docstring 29e85fe:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274213 pw_container: Have FlatMap ctor support move-only values 690cacd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274333 roll: go Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: 8b7efb07d47ebb..a02d053a6f7326 Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8720194023388285713 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: Ic552d0252c2765b1cc2ab2898d32db4771a2747c Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/276299 Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init --recursive $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.