Skip to content

[perso] Send back CWT UDS certificate from host to device during provisioning - #31036

Merged
timothytrippel merged 2 commits into
lowRISC:earlgrey_1.0.0from
xorptr:perso_ft_provisioning_reduce_sram_usage_send_back_cwt_uds
Aug 27, 2026
Merged

timothytrippel merged 2 commits into
lowRISC:earlgrey_1.0.0from
xorptr:perso_ft_provisioning_reduce_sram_usage_send_back_cwt_uds

Conversation

@xorptr

@xorptr xorptr commented Aug 17, 2026

Copy link
Copy Markdown

Currently, during provisioning the device firmware generates CWT UDS certificate during pre-endorsement stage. The host does not send it back with other endorsed certificates, so during the post-endorsement stage the device uses data from the blob it sent to the host. This necessitates keeping both the blob sent to the host and blob received from the host live during the post-endorsement stage.

This PR changes the provisioning flow so that the host sends CWT UDS certificate back to the device (without doing any endorsement, which is similar to existing behavior). This allows splitting the perso blob to host and perso blob from host into stage specific union variables. This saves ~5KiB space in .bss section in SRAM. NOTE: This assumes that the pre-endorsement SKU extension logic will not keep any references to the blob sent to the host for use during post-endorsement SKU extension logic.

Changes are on top on PR #31033

Output from bloaty for .bss section in ft_personalize_emulation_dice_mldsa_sim_qemu_rom_with_fake_keys.elf before this change:

   0.0%       0  17.7%  27.4Ki    .bss
     NAN%       0  75.5%  20.7Ki    provision.perso_data
     NAN%       0  14.6%  4.00Ki    owner_page
     NAN%       0   7.2%  1.97Ki    main_spi_buf
     NAN%       0   1.0%     272    ottf_console_spi_getc.info
     NAN%       0   0.4%     100    pxReadyTasksLists
     NAN%       0   0.2%      52    main_console
     NAN%       0   0.1%      40    status_report_list
     NAN%       0   0.1%      24    rand_testutils_rng_ctx
     NAN%       0   0.1%      20    xDelayedTaskList1
     NAN%       0   0.1%      20    xDelayedTaskList2
     NAN%       0   0.1%      20    xPendingReadyList
     NAN%       0   0.1%      20    xSuspendedTaskList
     NAN%       0   0.1%      20    xTasksWaitingTermination

Output from bloaty for .bss section in ft_personalize_emulation_dice_mldsa_sim_qemu_rom_with_fake_keys.elf after this change:

   0.0%       0  14.9%  22.4Ki    .bss
     NAN%       0  70.0%  15.7Ki    provision.perso_data
     NAN%       0  17.8%  4.00Ki    owner_page
     NAN%       0   8.8%  1.97Ki    main_spi_buf
     NAN%       0   1.2%     272    ottf_console_spi_getc.info
     NAN%       0   0.4%     100    pxReadyTasksLists
     NAN%       0   0.2%      52    main_console
     NAN%       0   0.2%      40    status_report_list
     NAN%       0   0.1%      24    rand_testutils_rng_ctx
     NAN%       0   0.1%      20    xDelayedTaskList1

@xorptr
xorptr requested review from a team and cfrantz as code owners August 17, 2026 22:17
@xorptr
xorptr requested review from engdoreis and removed request for a team August 17, 2026 22:17
@xorptr
xorptr force-pushed the perso_ft_provisioning_reduce_sram_usage_send_back_cwt_uds branch 2 times, most recently from d642caf to 9f12b4c Compare August 17, 2026 23:20
stages_shared_data->blob_from_host.num_objs = num_objs_in_blob_from_host;
post_endorse_stages_shared_data->blob_from_host.num_objs =
num_objs_in_blob_from_host;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Q: should we also reset the next_free here?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I did that in a later commit (b613f53) in PR #31038

@cfrantz cfrantz left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to determine if this change has any impact on the ot-provisioning infrastructure.

@xorptr
xorptr force-pushed the perso_ft_provisioning_reduce_sram_usage_send_back_cwt_uds branch from 9f12b4c to c29a70a Compare August 21, 2026 00:05
@timothytrippel

Copy link
Copy Markdown
Contributor

please rebase to fix CI

@xorptr
xorptr force-pushed the perso_ft_provisioning_reduce_sram_usage_send_back_cwt_uds branch from c29a70a to f9caf9e Compare August 25, 2026 18:14
@xorptr

xorptr commented Aug 25, 2026

Copy link
Copy Markdown
Author

Rebased on top of last commit in PR #31033 (a3aef4ea32ce0bb3562155c50aa46c4cb748593a)

@xorptr
xorptr force-pushed the perso_ft_provisioning_reduce_sram_usage_send_back_cwt_uds branch from f9caf9e to 2ecf1ce Compare August 26, 2026 11:01
… it is

This commit changes the behavior of the provisioning flow so that the
firmware sends generated UDS CWT DICE certificate to the host, and then
expects the host to send it back. This allows for saving space in SRAM by
using only one perso blob variable (done in a later commit as a
mechanical refactor of code).

Tested by running
`//sw/host/provisioning/orchestrator/tests:e2e_emulation_dice_cwt_cw340_test`,
`//sw/host/provisioning/orchestrator/tests:e2e_emulation_dice_mldsa_cw340_test`,
`//sw/host/provisioning/orchestrator/tests:e2e_emulation_cw340_test`,
and `//sw/host/provisioning/orchestrator/tests:e2e_multistage_emulation_tpm_cw340_test`
targets locally

Signed-off-by: Lovepreet Singh <lpsingh@google.com>
@xorptr
xorptr force-pushed the perso_ft_provisioning_reduce_sram_usage_send_back_cwt_uds branch from 2ecf1ce to d340988 Compare August 26, 2026 23:49
…ve at time

The device no longer needs to use the perso blob it sent to the host
after changes in previous commit where the host sends back UDS CWT
certificate. Therefore, only one of those variables need to be live at a
given time: `blob_to_host` during pre-endorsement stage and
`blob_from_host` during post-endorsement stage.

This commit does a mechanical refactor to split the perso blob variables
into appropriate union fields so that device SRAM usage can be reduced.
`blob_from_host` is moved to shared post-endorsement since it is used in
stage 1 and after stage 2.

I also deleted variable to keep track of UDS CWT certificate offset in
blob_to_host since it is not needed anymore.

Tested by running
`//sw/host/provisioning/orchestrator/tests:e2e_emulation_dice_cwt_cw340_test`,
`//sw/host/provisioning/orchestrator/tests:e2e_emulation_dice_mldsa_cw340_test`,
`//sw/host/provisioning/orchestrator/tests:e2e_emulation_cw340_test`,
and `//sw/host/provisioning/orchestrator/tests:e2e_multistage_emulation_tpm_cw340_test`
targets locally

Output from `bloaty` for `.bss` section in
`ft_personalize_emulation_dice_mldsa_sim_qemu_rom_with_fake_keys.elf`
before this change:

```
   0.0%       0  17.7%  27.4Ki    .bss
     NAN%       0  75.5%  20.7Ki    provision.perso_data
     NAN%       0  14.6%  4.00Ki    owner_page
     NAN%       0   7.2%  1.97Ki    main_spi_buf
     NAN%       0   1.0%     272    ottf_console_spi_getc.info
     NAN%       0   0.4%     100    pxReadyTasksLists
     NAN%       0   0.2%      52    main_console
     NAN%       0   0.1%      40    status_report_list
     NAN%       0   0.1%      24    rand_testutils_rng_ctx
     NAN%       0   0.1%      20    xDelayedTaskList1
```

Output from `bloaty` for `.bss` section in
`ft_personalize_emulation_dice_mldsa_sim_qemu_rom_with_fake_keys.elf`
after this change:

```
0.0%       0  14.9%  22.4Ki    .bss
  NAN%       0  70.0%  15.7Ki    provision.perso_data
  NAN%       0  17.8%  4.00Ki    owner_page
  NAN%       0   8.8%  1.97Ki    main_spi_buf
  NAN%       0   1.2%     272    ottf_console_spi_getc.info
  NAN%       0   0.4%     100    pxReadyTasksLists
  NAN%       0   0.2%      52    main_console
  NAN%       0   0.2%      40    status_report_list
```

Signed-off-by: Lovepreet Singh <lpsingh@google.com>
@xorptr
xorptr force-pushed the perso_ft_provisioning_reduce_sram_usage_send_back_cwt_uds branch from d340988 to e1837fd Compare August 27, 2026 00:49
@timothytrippel
timothytrippel merged commit 7e20f45 into lowRISC:earlgrey_1.0.0 Aug 27, 2026
35 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants