| commit | c2706a0111b26c8118def349047603e77206cb93 | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun Mar 09 17:47:56 2025 -0700 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun Mar 09 17:47:56 2025 -0700 |
| tree | d1c8b82c0630f1158540b9816807be4432aa8d9c | |
| parent | 9f741f729403c8f60e742bd8737ceaa03794d221 [diff] |
roll: third_party/pigweed/src 8ffdd15..8b7efb0 (70 commits) 8b7efb0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274332 roll: gn 3c0823b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274232 roll: luci c4d8c09:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274215 roll: fuchsia-infra-bazel-rules c87230d..1a9eeb1 (46 commits) 3fa32a8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/255134 pw_i2c_mcuxpresso: Convert to new i2c initiator message interface bce90ae:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260974 pw_i2c_mcuxpresso: Use non-blocking i3c operations 7d88fb9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259973 pw_i2c: Split Message::GetData() into const and non-const version 2dc5872:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259972 pw_i2c: Add feature support to Initiator class 8c78d5f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/255133 pw_i2c: Change initiator to take a list of messages for one transaction 287133e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260059 pw_i2c: Improve TenBit support in Address class 28fdb0a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271743 pw_bluetooth_sapphire: Clean up adapter logs 870f8f8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260225 pw_bluetooth_sapphire: Add BidirectionalMap 39b8e48:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/265638 pw_bluetooth_sapphire: Add operator== to DiscoveryFilter 19b092e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/265637 pw_bluetooth_sapphire: Add ToString to DiscoveryFilter cdf2d7e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260230 pw_bluetooth_sapphire: Rename DiscoveryFilter::MatchLowEnergyResult 324e513:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272572 pw_kernel: Add tokenized logging backend 749889c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/274033 pw_allocator: Fix sign conversion warning 432f5c2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273612 pw_bluetooth_sapphire: Ensure identity is known for LEPublic addresses 8c51086:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260229 pw_bluetooth_sapphire: Wrap LowEnergyScanner delegate calls 553d60f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/265634 pw_bluetooth_sapphire: Constify some methods that should have been b7b7110:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260228 pw_bluetooth_sapphire: PacketFilterConfig to AdvertisingPacketFilter be05ee5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272896 pw_bluetooth_sapphire: Handle L2CAP config req retry failure correctly 693a34d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271712 pw_bluetooth: Add Enable() and Disable() APIs to Snoop Log b3bfda8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273812 pw_allocator: Fix pw_assert deps 6d2af30:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273852 pw_bluetooth: Add drees to OWNERS e7e47e7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273413 pw_presubmit: Fix format fix command 7b6e43b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/270735 pw_allocator: Add SharedPtr and WeakPtr 07b722d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272874 pw_format/rust: Declare additional formatter types 700d01e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272873 pw_tokenizer/rust: Support additonal argument types bd14c15:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271793 pw_assert: Delete :pw_assert 7480855:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273054 pw_bluetooth_proxy: Split AclDataChannel synchronized fields up b6f2033:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271072 bazel: Clean up maven usage b2ed425:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272934 third_party/freertos: Change stack size type in support hooks 0cd6831:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/266273 pw_flatbuffers: Flatbuffers cmake support 7d1b8cd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273453 Revert "pw_malloc: Synchronize access to the system metrics" a131637:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273454 Revert "pw_malloc: Rename GetSystemAllocator to CreateSystemAllocator" 8af514d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273333 pw_bluetooth_sapphire: Fix uninitialized variable in bt::Random() 4a2ab50:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273332 third_party/freertos: Silence new warning 351d6c1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264642 pw_allocator: Restrict BlockAllocator's public interface 4a365f6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252053 pw_malloc: Rename GetSystemAllocator to CreateSystemAllocator 358d2b6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272752 pw_clock_tree: Add note in ClockTree::AcquireWith() doc comment 43cf8d7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/249914 pw_malloc: Synchronize access to the system metrics 986272f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273194 pw_bluetooth_sapphire: Remove nbsp 8838270:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272532 pw_allocator: Re-enable code-size reports c4fca6b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273093 pw_protobuf: Add decoder fuzz test c783ff2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273052 pw_tokenizer: Improve documentation for database merges 6ce6699:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/273053 pw_protobuf: Fix memory decoder out-of-bounds bug ca90f27:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272998 third_party/llvm_builtins: Fix copy/paste in docs 0449995:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/269674 pw_bluetooth_sapphire: Replace BoringSSL uses in sm/util.cc 1124698:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271744 pw_bluetooth: Fix version extraction of vendor major and minor version 386297a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/265636 pw_bluetooth_sapphire: Publicize the type and 32 bit version of the UUID 36d8028:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271745 pw_bluetooth: Fix Android vendor extensions APCF ApcfFeatureFilterLogic 77ad850:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272796 pw_presubmit: Enable buildifier formatting in Bazel d7bdeda:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272794 pw_kernel: Move scheduler locks into a sub-module b979d61:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272773 pw_toolchain: ARM Cortex-M4f configs 323d1bf:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272793 pw_kernel: Use mod_name.rs instead of mod_name/mod.rs e319db3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/232351 pw_metric: Use atomic operations 8d5512e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272575 pw_presubmit: Load formatting path exclusions 04dc1da:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272692 pw_kernel: Support dyn types with ForeignBox 4249230:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271736 pw_ide: Add a clangd dashboard UI to help user find issues 018a807:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264633 pw_ide: Add a button to dump logs and settings.json bc5c177:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264612 pw_ide: Add webview in sidebar to see extension report d7be437:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272512 pw_kernel: Remove unused WaitQueue::wake_thread method 52f1e7f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272593 pw_env_setup: Restrict visibility of py libraries 1a42475:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272672 pw_allocator: Add source files to Android.bp targets 57db167:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271685 pw_kernel: Optimize SpinLocks 9f43335:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271812 pw_kernel: Add Mutex eeed50e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/271753 pw_kernel: Make some scheduler variable names more descriptive b6da978:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272592 pw_env_setup: Fix docs headings d058875:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272073 third_party/smartfusion_mss: rm BUILD for-loops dcaf004:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/272093 pw_containers: Mark :pw_containers deprecated Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: 8ffdd1514e11f6..8b7efb07d47ebb Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8720828201373156993 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I19f6cccbf283ed629a6240bd1f220af802b87d62 Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/274315 Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com> Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init --recursive $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.