[cherry-pick] manually cherry-pick of #24992 to earlgrey_1.0.0 branch
#25038
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Currently, during ft_perso, the host writes the raw endorsed X.509 certificates (in ASN.1 DER format) to flash_info pages. When it needs to access them later on, the certificate length is calculated by parsing the ASN.1 header (1 or 2 bytes). This design works for X509 but not CWT-CBOR since there's no such information in some CBOR types (map, array specifically). Fixes lowRISC#24942. Co-authored-by: Tommy Chiu <[email protected]> Signed-off-by: Tim Trippel <[email protected]> (cherry picked from commit fc628e6)
This switches the `perso_tlv_get_cert_obj()` return type to a `rom_error_t` as this function will be used in the ROM_EXT to parse DICE certificates in a following commit. Signed-off-by: Tim Trippel <[email protected]> (cherry picked from commit dd6b29f)
This refactors the `perso_tlv_data` cert object building functions so they can be reused by the ROM_EXT. A prior commit updated the perso code to store all certificates in flash info pages in the perso LTV object format. Since the ROM_EXT needs to be able to regenerate CDI_0/1 DICE certificates, the ROM_EXT must also be able to regenerate this same perso LTV object format. Signed-off-by: Tim Trippel <[email protected]> (cherry picked from commit 89bf535)
The format by which DICE certs have been to provisioned into flash recently changed such that the certs were written in the perso LTV structure. This updates the ROM_EXT to use the same structure when reading and writing DICE certs from/to flash. Signed-off-by: Tim Trippel <[email protected]> (cherry picked from commit 5eb7370)
moidx
approved these changes
Nov 7, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This cherry-picks #24992 to
earlgrey_1.0.0branch to change how certs are written to flash info pages.