Refactoring spdm responder
diff --git a/target/ast1060-evb/spdm-responder/BUILD.bazel b/target/ast1060-evb/spdm-responder/BUILD.bazel deleted file mode 100644 index 2421435..0000000 --- a/target/ast1060-evb/spdm-responder/BUILD.bazel +++ /dev/null
@@ -1,111 +0,0 @@ -# Licensed under the Apache-2.0 license - -load("@rules_rust//rust:defs.bzl", "rust_binary") -load("//target/ast1060-evb:defs.bzl", "TARGET_COMPATIBLE_WITH") -load("@pigweed//pw_kernel/tooling:system_image.bzl", "system_image", "system_image_test") -load("@pigweed//pw_kernel/tooling:target_codegen.bzl", "target_codegen") -load("@pigweed//pw_kernel/tooling:target_linker_script.bzl", "target_linker_script") -load("@pigweed//pw_kernel/tooling/panic_detector:rust_binary_no_panics_test.bzl", "rust_binary_no_panics_test") -load("@pigweed//pw_kernel/tooling:app_package.bzl", "app_package") - -system_image( - name = "spdm_responder", - apps = [ - "//services/i2c/server:i2c_server", - "//services/mctp/server:mctp_server", - ":spdm_responder_app", - "//services/crypto/server:crypto_server", - ], - kernel = ":target", - platform = "//target/ast1060-evb", - system_config = ":system_config", - tags = ["kernel"], - visibility = ["//visibility:public"], -) - -system_image_test( - name = "spdm_responder_test", - image = ":spdm_responder", - target_compatible_with = TARGET_COMPATIBLE_WITH, -) - -rust_binary_no_panics_test( - name = "no_panics_test", - binary = ":spdm_responder", - tags = ["kernel"], -) - -filegroup( - name = "system_config", - srcs = ["system.json5"], - visibility = ["//visibility:public"], -) - -target_codegen( - name = "codegen", - arch = "@pigweed//pw_kernel/arch/arm_cortex_m:arch_arm_cortex_m", - system_config = ":system_config", - target_compatible_with = TARGET_COMPATIBLE_WITH, -) - -target_linker_script( - name = "linker_script", - system_config = ":system_config", - tags = ["kernel"], - target_compatible_with = TARGET_COMPATIBLE_WITH, - template = "//target/ast1060-evb:linker_script_template", -) - -rust_binary( - name = "target", - srcs = [ - "target.rs", - ], - edition = "2024", - tags = ["kernel"], - target_compatible_with = TARGET_COMPATIBLE_WITH, - deps = [ - ":codegen", - ":linker_script", - "@pigweed//pw_kernel/arch/arm_cortex_m:arch_arm_cortex_m", - "@pigweed//pw_kernel/kernel", - "//target/ast1060-evb:console_backend_uart", - "@pigweed//pw_kernel/target:target_common", - "//target/ast1060-evb:entry", - "@pigweed//pw_kernel/userspace", - "@pigweed//pw_log/rust:pw_log", - "@oot_crates_no_std//:cortex-m-semihosting", - ], -) - -app_package( - name = "app_spdm_responder", - app_name = "spdm_responder", - edition = "2024", - system_config = ":system_config", - tags = ["kernel"], -) - -rust_binary( - name = "spdm_responder_app", - srcs = [ - "spdm_responder_app.rs", - ], - edition = "2024", - tags = ["kernel"], - target_compatible_with = TARGET_COMPATIBLE_WITH, - deps = [ - ":app_spdm_responder", - "//target/ast1060-evb/cert-store:cert_store", - "//target/ast1060-evb/evidence:evidence", - "//services/spdm/hash:spdm_hash_lib", - "//services/spdm/rng:spdm_rng_lib", - "//services/mctp/client:mctp_client", - "//services/spdm/transport-mctp:spdm_transport_mctp", - "@pigweed//pw_kernel/syscall:syscall_user", - "@pigweed//pw_kernel/userspace", - "@pigweed//pw_log/rust:pw_log", - "@pigweed//pw_status/rust:pw_status", - "@oot_crates_no_std//:spdm-lib", - ], -)
diff --git a/target/ast1060-evb/spdm-responder/README.md b/target/ast1060-evb/spdm-responder/README.md deleted file mode 100644 index af6744d..0000000 --- a/target/ast1060-evb/spdm-responder/README.md +++ /dev/null
@@ -1,219 +0,0 @@ -# SPDM Responder Application for AST1060-EVB - -This is a complete SPDM (Security Protocol and Data Model) responder application for the AST1060-EVB platform. It integrates all platform-specific implementations to provide device attestation and secure communication capabilities. - -## Overview - -The SPDM responder application demonstrates the complete SPDM platform abstraction layer: - -- **Certificate Management**: Uses `Ast1060CertStore` for device certificates -- **Evidence Collection**: Uses `Ast1060Evidence` for device measurements -- **Cryptographic Operations**: Uses `SpdmCryptoHash` and `SpdmCryptoRng` via crypto service -- **Transport Layer**: Ready for MCTP transport integration -- **Protocol Handling**: Uses `SpdmResponder` service for message processing - -## Architecture - -```text -┌────────────────────────────────────────────────┐ -│ SPDM Requester (External Device) │ -└────────────────┬───────────────────────────────┘ - │ SPDM Protocol - │ (over MCTP - TODO) - ▼ -┌────────────────────────────────────────────────┐ -│ SPDM Responder Application │ -│ ┌──────────────────────────────────────────┐ │ -│ │ SpdmResponder Service │ │ -│ │ - Message processing │ │ -│ │ - Protocol state machine │ │ -│ └──────────────┬───────────────────────────┘ │ -│ │ │ -│ ┌──────────────┴───────────────────────────┐ │ -│ │ Platform Implementations │ │ -│ │ - Ast1060CertStore (certificates) │ │ -│ │ - Ast1060Evidence (measurements) │ │ -│ │ - SpdmCryptoHash (SHA-384 via IPC) │ │ -│ │ - SpdmCryptoRng (RNG via IPC) │ │ -│ │ - [MCTP Transport - TODO] │ │ -│ └──────────────────────────────────────────┘ │ -└────────────────┬───────────────────────────────┘ - │ IPC - ▼ -┌────────────────────────────────────────────────┐ -│ Crypto Service │ -│ - ECDSA P-384 signing │ -│ - SHA-384 hashing │ -│ - Random number generation │ -└────────────────────────────────────────────────┘ -``` - -## System Configuration - -The application is configured in `system.json5`: - -- **SPDM Responder App**: - - Flash: 192KB (SPDM library is large) - - RAM: 64KB (for SPDM contexts and buffers) - - Stack: 16KB per thread - - Objects: CRYPTO (channel to crypto service) - -- **Crypto Server**: - - Flash: 128KB - - RAM: 64KB - - Stack: 8KB per thread - - Objects: CRYPTO (channel handler) - -Total memory usage: ~704KB (fits in AST1060's 768KB SRAM) - -## Building - -Build the SPDM responder system image: - -```bash -bazel build --platforms=//target/ast1060-evb:ast1060-evb \ - //target/ast1060-evb/spdm-responder:spdm_responder -``` - -This produces a complete system image with: -- Kernel -- SPDM responder application -- Crypto service -- All platform implementations - -## Running - -### In QEMU - -```bash -bazel run --platforms=//target/ast1060-evb:ast1060-evb \ - //target/ast1060-evb/spdm-responder:spdm_responder_test -``` - -### On Hardware - -Flash the system image to AST1060-EVB and connect via UART to see logs. - -## SPDM Protocol Support - -The responder supports the following SPDM commands: - -1. **GET_VERSION** - Returns supported SPDM versions (1.2, 1.1) -2. **GET_CAPABILITIES** - Returns device capabilities -3. **NEGOTIATE_ALGORITHMS** - Negotiates cryptographic algorithms -4. **GET_DIGESTS** - Returns certificate chain digests -5. **GET_CERTIFICATE** - Returns certificate chains (with chunking support) -6. **CHALLENGE** - Challenge-response authentication -7. **GET_MEASUREMENTS** - Returns device measurements - -## Capabilities - -The responder advertises: - -- **CERT_CAP**: Certificate provisioning -- **CHAL_CAP**: Challenge-response authentication -- **MEAS_CAP**: Measurements with signatures -- **MEAS_FRESH_CAP**: Fresh measurements -- **CHUNK_CAP**: Large message chunking - -## Algorithms - -Supported cryptographic algorithms: - -- **Hash**: SHA-384 (TPM_ALG_SHA_384) -- **Asymmetric**: ECDSA with NIST P-384 (TPM_ALG_ECDSA_ECC_NIST_P384) -- **Measurement**: DMTF Measurement Specification - -## Current Status - -✅ **Implemented:** -- Complete platform abstraction layer -- All SPDM traits implemented -- Integration with crypto service -- Application structure and build configuration - -⚠️ **TODO:** -- MCTP transport integration (currently commented out) -- End-to-end testing with SPDM requester -- Real certificate provisioning (currently using placeholder data) - -## Testing - -Run the system image test: - -```bash -bazel test --platforms=//target/ast1060-evb:ast1060-evb \ - //target/ast1060-evb/spdm-responder:spdm_responder_test -``` - -Check for panics: - -```bash -bazel test --platforms=//target/ast1060-evb:ast1060-evb \ - //target/ast1060-evb/spdm-responder:no_panics_test -``` - -## Logs - -The application uses pw_log for logging: - -``` -[INFO] SPDM Responder App starting -[INFO] SPDM Responder starting... -[INFO] Platform implementations initialized -[INFO] SPDM responder configuration: ResponderConfig { ... } -[INFO] SPDM Responder initialized (waiting for MCTP transport) -[INFO] SPDM Responder thread spawned -``` - -## Next Steps - -To make this fully functional: - -1. **Add MCTP Transport**: - - Implement MCTP service - - Create `MctpSpdmTransport` wrapper - - Add MCTP object to system.json5 - - Uncomment transport code in spdm_responder_app.rs - -2. **Provision Real Certificates**: - - Replace placeholder data in cert-store - - Generate device-specific keys - - Include real X.509 certificate chain - -3. **Add Real Measurements**: - - Integrate with boot measurements - - Add measurement event log - - Include platform-specific measurements - -4. **End-to-End Testing**: - - Set up SPDM requester - - Test full protocol flow - - Verify attestation and authentication - -## Integration with Other Components - -The SPDM responder integrates with: - -- **Crypto Service** (`services/crypto/server`): Provides cryptographic operations -- **Cert Store** (`target/ast1060-evb/cert-store`): Device certificates and signing -- **Evidence** (`target/ast1060-evb/evidence`): Device measurements -- **Hash Service** (`services/spdm/hash`): SHA-384 operations -- **RNG Service** (`services/spdm/rng`): Random number generation - -## Memory Map - -``` -0x00000000 - 0x000004A0: Vector table (1184 bytes) -0x000004A0 - 0x00020000: Kernel (~126KB) -0x00020000 - 0x00050000: SPDM responder app (192KB) -0x00050000 - 0x00070000: Crypto server (128KB) -0x00070000 - 0x00090000: Kernel RAM (128KB) -0x00090000 - 0x000B0000: App RAM (128KB) - -Total: ~704KB / 768KB SRAM available -``` - -## License - -Licensed under the Apache-2.0 license.
diff --git a/target/ast1060-evb/spdm-responder/spdm_responder_app.rs b/target/ast1060-evb/spdm-responder/spdm_responder_app.rs deleted file mode 100644 index f09634e..0000000 --- a/target/ast1060-evb/spdm-responder/spdm_responder_app.rs +++ /dev/null
@@ -1,170 +0,0 @@ -// Licensed under the Apache-2.0 license - -//! SPDM Responder Application for AST1060-EVB -//! -//! This application provides SPDM (Security Protocol and Data Model) responder -//! functionality for device attestation and secure communication. - -#![no_std] -#![no_main] - -use ast1060_cert_store::Ast1060CertStore; -use ast1060_evidence::Ast1060Evidence; -use openprot_mctp_client::IpcMctpClient; -use openprot_spdm_hash::SpdmCryptoHash; -use openprot_spdm_rng::SpdmCryptoRng; -use openprot_spdm_transport_mctp::MctpSpdmTransport; -use pw_log::info; -use pw_status::Result; -use spdm_lib::codec::MessageBuf; -use spdm_lib::context::SpdmContext; -use spdm_lib::protocol::{ - AeadCipherSuite, AlgorithmPriorityTable, BaseAsymAlgo, BaseHashAlgo, CapabilityFlags, - DeviceAlgorithms, DeviceCapabilities, DheNamedGroup, KeySchedule, LocalDeviceAlgorithms, - MeasurementHashAlgo, MeasurementSpecification, MelSpecification, OtherParamSupport, - ReqBaseAsymAlg, SpdmVersion, -}; -use userspace::entry; -use userspace::syscall; - -use app_spdm_responder::handle; - -/// Create local device algorithms configuration for SPDM -fn create_local_algorithms<'a>() -> LocalDeviceAlgorithms<'a> { - // Measurement specification (DMTF) - let mut measurement_spec = MeasurementSpecification::default(); - measurement_spec.set_dmtf_measurement_spec(1); - - // Measurement hash algorithm (SHA-384) - let mut measurement_hash_algo = MeasurementHashAlgo::default(); - measurement_hash_algo.set_tpm_alg_sha_384(1); - - // Base asymmetric algorithm (ECDSA P-384) - let mut base_asym_algo = BaseAsymAlgo::default(); - base_asym_algo.set_tpm_alg_ecdsa_ecc_nist_p384(1); - - // Base hash algorithm (SHA-384) - let mut base_hash_algo = BaseHashAlgo::default(); - base_hash_algo.set_tpm_alg_sha_384(1); - - let device_algorithms = DeviceAlgorithms { - measurement_spec, - other_param_support: OtherParamSupport::default(), - measurement_hash_algo, - base_asym_algo, - base_hash_algo, - mel_specification: MelSpecification::default(), - dhe_group: DheNamedGroup::default(), - aead_cipher_suite: AeadCipherSuite::default(), - req_base_asym_algo: ReqBaseAsymAlg::default(), - key_schedule: KeySchedule::default(), - }; - - let algorithm_priority_table = AlgorithmPriorityTable { - measurement_specification: None, - opaque_data_format: None, - base_asym_algo: None, - base_hash_algo: None, - mel_specification: None, - dhe_group: None, - aead_cipher_suite: None, - req_base_asym_algo: None, - key_schedule: None, - }; - - LocalDeviceAlgorithms { - device_algorithms, - algorithm_priority_table, - } -} - -/// SPDM responder main loop -fn spdm_responder_loop() -> Result<()> { - info!("SPDM Responder starting..."); - - // Initialize platform implementations - let mut cert_store = Ast1060CertStore::new(handle::CRYPTO); - let mut hash = SpdmCryptoHash::new(handle::CRYPTO); - let mut m1_hash = SpdmCryptoHash::new(handle::CRYPTO); - let mut l1_hash = SpdmCryptoHash::new(handle::CRYPTO); - let mut rng = SpdmCryptoRng::new(handle::CRYPTO); - let evidence = Ast1060Evidence::new(); - - info!("Platform implementations initialized"); - - // Initialize MCTP transport - let mctp_client = IpcMctpClient::new(handle::MCTP); - let mut transport = MctpSpdmTransport::new_responder(mctp_client); - - // Configure device capabilities - let mut flags = CapabilityFlags::default(); - flags.set_cert_cap(1); // Certificate capability - flags.set_chal_cap(1); // Challenge capability - flags.set_meas_cap(2); // Measurements with signature (2 = with signature) - flags.set_meas_fresh_cap(1); // Measurements freshness capability - flags.set_chunk_cap(1); // Chunk capability - - let capabilities = DeviceCapabilities { - ct_exponent: 0, - flags, - data_transfer_size: 1024, - max_spdm_msg_size: 4096, - include_supported_algorithms: true, - }; - - // Configure supported algorithms - let algorithms = create_local_algorithms(); - - // Supported SPDM versions - static SUPPORTED_VERSIONS: [SpdmVersion; 2] = [SpdmVersion::V12, SpdmVersion::V11]; - - // Create SPDM context directly (no wrapper) - let mut context = match SpdmContext::new( - &SUPPORTED_VERSIONS, - &mut transport, - capabilities, - algorithms, - &mut cert_store, - None, // No peer cert store needed for responder - &mut hash, - &mut m1_hash, - &mut l1_hash, - &mut rng, - &evidence, - ) { - Ok(ctx) => ctx, - Err(_e) => { - pw_log::error!("Failed to create SPDM context"); - return Err(pw_status::Error::Unknown); - } - }; - - info!("SPDM context created, entering message loop"); - - // Process SPDM messages - // Buffer and MessageBuf must live as long as context due to lifetime constraint - let mut buffer = [0u8; 4096]; - let mut message_buf = MessageBuf::new(&mut buffer); - - loop { - if let Err(_e) = context.responder_process_message(&mut message_buf) { - // Continue processing - don't exit on errors - // Errors are expected during normal operation (e.g., malformed requests) - } - } -} - -#[entry] -fn entry() -> ! { - if let Err(e) = spdm_responder_loop() { - pw_log::error!("SPDM responder error: {:04x}", e as u32); - let _ = syscall::debug_shutdown(Err(e)); - } - - loop {} -} - -#[panic_handler] -fn panic(_info: &core::panic::PanicInfo) -> ! { - loop {} -}
diff --git a/target/ast1060-evb/spdm-responder/system.json5 b/target/ast1060-evb/spdm-responder/system.json5 deleted file mode 100644 index df1dcdf..0000000 --- a/target/ast1060-evb/spdm-responder/system.json5 +++ /dev/null
@@ -1,150 +0,0 @@ -// Licensed under the Apache-2.0 license - -// ASPEED AST1060-EVB SPDM Responder Configuration -// ARM Cortex-M4F with UART console -// -// Memory Layout (PMSAv7-aligned for AST1060 MPU): -// 0x00000000 - 0x00000500: Vector table + kernel annotations (1280 bytes) -// 0x00000500 - 0x00020000: Kernel code (~127KB) -// 0x00020000 - 0x00030000: I2C server (64KB flash) -// 0x00030000 - 0x00040000: MCTP server (64KB flash) -// 0x00040000 - 0x00060000: SPDM responder (128KB flash) -// 0x00060000 - 0x00080000: Crypto server (128KB flash, aligned to 128KB boundary) -// 0x00080000 - 0x00084000: I2C server RAM (16KB) -// 0x00084000 - 0x00088000: MCTP server RAM (16KB) -// 0x00088000 - 0x00090000: SPDM responder RAM (32KB) -// 0x00090000 - 0x00098000: Crypto server RAM (32KB) -// 0x00098000 - 0x000A8000: Kernel RAM (64KB) -// -// Total: 672KB (fits within 768KB SRAM) -{ - arch: { - type: "armv7m", - vector_table_start_address: 0x00000000, - vector_table_size_bytes: 1280, // 0x500 (272 vectors + thread/stack annotations) - }, - kernel: { - flash_start_address: 0x00000500, // After vector table + annotations - flash_size_bytes: 129792, // ~127KB (ends at 0x00020000) - ram_start_address: 0x00098000, // After all app RAM - ram_size_bytes: 65536, // 64KB - }, - apps: [ - // ──── I2C Server ──── - { - name: "i2c_server", - flash_size_bytes: 65536, // 64KB for I2C server - ram_size_bytes: 16384, // 16KB RAM - process: { - name: "i2c_server_process", - objects: [ - { - name: "I2C", - type: "channel_handler", - }, - ], - threads: [ - { - name: "i2c_server_thread", - stack_size_bytes: 4096, - }, - ], - memory_mappings: [ - { - name: "i2c_regs", - type: "device", - start_address: 0x7e7b0000, - size_bytes: 0x4000, - }, - { - name: "scu", - type: "device", - start_address: 0x7e6e2000, - size_bytes: 0x1000, - }, - ], - }, - }, - // ──── MCTP Server ──── - { - name: "mctp_server", - flash_size_bytes: 65536, // 64KB for MCTP server - ram_size_bytes: 16384, // 16KB RAM - process: { - name: "mctp_server_process", - objects: [ - { - name: "MCTP", - type: "channel_handler", - }, - { - name: "I2C", - type: "channel_initiator", - handler_app: "i2c_server", - handler_object_name: "I2C", - }, - { - name: "WG", - type: "wait_group", - }, - ], - threads: [ - { - name: "mctp_server_thread", - stack_size_bytes: 4096, - }, - ], - }, - }, - // ──── SPDM Responder ──── - { - name: "spdm_responder", - flash_size_bytes: 131072, // 128KB for SPDM responder (aligned) - ram_size_bytes: 32768, // 32KB RAM for SPDM contexts and buffers - process: { - name: "spdm_responder_process", - objects: [ - { - name: "CRYPTO", - type: "channel_initiator", - handler_app: "crypto_server", - handler_object_name: "CRYPTO", - }, - { - name: "MCTP", - type: "channel_initiator", - handler_app: "mctp_server", - handler_object_name: "MCTP", - }, - ], - threads: [ - { - name: "spdm_responder_thread", - stack_size_bytes: 16384, // 16KB stack for SPDM operations - }, - ], - }, - }, - // ──── Crypto Server ──── - { - name: "crypto_server", - flash_size_bytes: 131072, // 128KB for crypto server - ram_size_bytes: 32768, // 32KB RAM for crypto contexts - process: { - name: "crypto_server_process", - objects: [ - { - name: "CRYPTO", - type: "channel_handler", - }, - ], - threads: [ - { - name: "crypto_server_thread", - stack_size_bytes: 8192, // 8KB stack for crypto ops - }, - ], - }, - }, - ], -}
diff --git a/target/ast1060-evb/spdm-responder/target.rs b/target/ast1060-evb/spdm-responder/target.rs deleted file mode 100644 index 1f43f1f..0000000 --- a/target/ast1060-evb/spdm-responder/target.rs +++ /dev/null
@@ -1,37 +0,0 @@ -// Licensed under the Apache-2.0 license - -//! AST1060-EVB SPDM Responder Target -//! -//! Target entry point and initialization for the SPDM responder system. - -#![no_std] -#![no_main] - -use cortex_m_semihosting::debug::{EXIT_FAILURE, EXIT_SUCCESS, exit}; -use target_common::{TargetInterface, declare_target}; -use {console_backend as _, entry as _}; - -pub struct Target {} - -impl TargetInterface for Target { - const NAME: &'static str = "AST1060-EVB SPDM Responder"; - - fn main() -> ! { - codegen::start(); - #[expect(clippy::empty_loop)] - loop {} - } - - fn shutdown(code: u32) -> ! { - pw_log::info!("Shutting down with code {:04x}", code as u32); - let status = match code { - 0 => EXIT_SUCCESS, - _ => EXIT_FAILURE, - }; - exit(status); - #[expect(clippy::empty_loop)] - loop {} - } -} - -declare_target!(Target);