Skip to content

Commit f6459ad

Browse files
nroggeman-ledgernroggeman-ledger
committed
Support new ENDORSEMENT syscalls and clean-up syscall ids and parsing
1 parent 7907202 commit f6459ad

File tree

7 files changed

+536
-459
lines changed

7 files changed

+536
-459
lines changed

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
66
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
77

8+
## [0.26.0] 2026-02-13
9+
10+
### Added
11+
- Support API_LEVEL_26
12+
- Support new ENDORSEMENT syscalls
13+
814
## [0.25.13] 2025-12-09
915

1016
### Fix

‎sdk/bolos_syscalls.h‎

Lines changed: 197 additions & 108 deletions
Large diffs are not rendered by default.

‎src/bolos/endorsement.c‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@
2121

2222
#define cx_ecdsa_init_public_key sys_cx_ecfp_init_public_key
2323

24+
#define ENDORSEMENT_HASH_LENGTH CX_SHA256_SIZE
25+
2426
/**********************
2527
* TYPEDEFS
2628
**********************/
@@ -43,7 +45,9 @@ static char CODE_HASH[] = "12345678abcdef0000fedcba8765432";
4345
* GLOBAL FUNCTIONS
4446
**********************/
4547

46-
// Pre API_LEVEL_23 syscalls
48+
///////////////////////////////////////
49+
// API_LEVEL_22
50+
///////////////////////////////////////
4751

4852
unsigned int sys_os_endorsement_get_code_hash(uint8_t *buffer)
4953
{
@@ -161,7 +165,9 @@ unsigned long sys_os_endorsement_key1_sign_without_code_hash(uint8_t *data,
161165
return signature[1] + 2;
162166
}
163167

164-
// API_LEVEL_23 and above
168+
///////////////////////////////////////
169+
// API_LEVEL_23 to API_LEVEL_25
170+
///////////////////////////////////////
165171

166172
bolos_err_t sys_ENDORSEMENT_get_public_key(ENDORSEMENT_slot_t slot,
167173
uint8_t *out_public_key,
@@ -272,3 +278,46 @@ bolos_err_t sys_ENDORSEMENT_get_public_key_certificate(ENDORSEMENT_slot_t slot,
272278

273279
return 0;
274280
}
281+
282+
///////////////////////////////////////
283+
// API_LEVEL_26 and above
284+
///////////////////////////////////////
285+
286+
bolos_err_t sys_ENDORSEMENT_GET_PUB_KEY(ENDORSEMENT_slot_t slot,
287+
uint8_t *out_public_key,
288+
size_t *out_public_key_length)
289+
{
290+
uint8_t key_len;
291+
bolos_err_t ret =
292+
sys_ENDORSEMENT_get_public_key(slot, out_public_key, &key_len);
293+
*out_public_key_length = key_len;
294+
return ret;
295+
}
296+
297+
bolos_err_t sys_ENDORSEMENT_KEY1_SIGN_DATA(uint8_t *data, size_t data_length,
298+
uint8_t *out_signature,
299+
size_t *out_signature_length)
300+
{
301+
return sys_ENDORSEMENT_key1_sign_data(data, data_length, out_signature,
302+
out_signature_length);
303+
}
304+
305+
bolos_err_t sys_ENDORSEMENT_GET_CODE_HASH(uint8_t *out_hash, size_t hash_length)
306+
{
307+
if (!out_hash || (hash_length < ENDORSEMENT_HASH_LENGTH)) {
308+
return 1;
309+
}
310+
311+
return sys_ENDORSEMENT_get_code_hash(out_hash);
312+
}
313+
314+
bolos_err_t sys_ENDORSEMENT_GET_PUB_KEY_SIG(ENDORSEMENT_slot_t slot,
315+
uint8_t *out_buffer,
316+
size_t *out_length)
317+
{
318+
uint8_t len;
319+
bolos_err_t ret =
320+
sys_ENDORSEMENT_get_public_key_certificate(slot, out_buffer, &len);
321+
*out_length = len;
322+
return ret;
323+
}

‎src/bolos/endorsement.h‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,9 @@ typedef enum {
3333
* GLOBAL PROTOTYPES
3434
**********************/
3535

36-
/// Legacy syscalls (before API_LEVEL_23)
36+
///////////////////////////////////////
37+
// API_LEVEL_22
38+
///////////////////////////////////////
3739

3840
unsigned long sys_os_endorsement_get_public_key(uint8_t index, uint8_t *buffer);
3941

@@ -57,7 +59,9 @@ sys_os_endorsement_get_public_key_certificate(unsigned char index,
5759
unsigned int sys_os_endorsement_get_public_key_certificate_new(
5860
unsigned char index, unsigned char *buffer, unsigned char *length);
5961

60-
/// Refactored syscalls (API_LEVEL_23 and above)
62+
///////////////////////////////////////
63+
// API_LEVEL_23 to API_LEVEL_25
64+
///////////////////////////////////////
6165

6266
bolos_err_t sys_ENDORSEMENT_get_public_key(ENDORSEMENT_slot_t slot,
6367
uint8_t *out_public_key,
@@ -68,7 +72,7 @@ bolos_err_t sys_ENDORSEMENT_key1_sign_data(uint8_t *data, uint32_t data_length,
6872
uint32_t *out_signature_length);
6973

7074
bolos_err_t
71-
sys_ENDORSEMENT_key1_sign_without_code_hash(uint8_t *data, size_t dataLength,
75+
sys_ENDORSEMENT_key1_sign_without_code_hash(uint8_t *data, uint32_t dataLength,
7276
uint8_t *signature,
7377
uint32_t *out_signature_length);
7478

@@ -78,6 +82,25 @@ bolos_err_t sys_ENDORSEMENT_get_public_key_certificate(ENDORSEMENT_slot_t slot,
7882
uint8_t *out_buffer,
7983
uint8_t *out_length);
8084

85+
///////////////////////////////////////
86+
// API_LEVEL_26 and above
87+
///////////////////////////////////////
88+
89+
bolos_err_t sys_ENDORSEMENT_GET_PUB_KEY(ENDORSEMENT_slot_t slot,
90+
uint8_t *out_public_key,
91+
size_t *out_public_key_length);
92+
93+
bolos_err_t sys_ENDORSEMENT_KEY1_SIGN_DATA(uint8_t *data, size_t data_length,
94+
uint8_t *out_signature,
95+
size_t *out_signature_length);
96+
97+
bolos_err_t sys_ENDORSEMENT_GET_CODE_HASH(uint8_t *out_hash,
98+
size_t hash_length);
99+
100+
bolos_err_t sys_ENDORSEMENT_GET_PUB_KEY_SIG(ENDORSEMENT_slot_t slot,
101+
uint8_t *out_buffer,
102+
size_t *out_length);
103+
81104
/**********************
82105
* MACROS
83106
**********************/

‎src/bolos/io/sdk/io/src/os_io_default_apdu.c‎

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,6 @@ static bolos_err_t get_version(uint8_t *buffer_out, size_t *buffer_out_length);
3232
static bolos_err_t get_seed_cookie(uint8_t *buffer_out,
3333
size_t *buffer_out_length);
3434
#endif // HAVE_SEED_COOKIE
35-
#if defined(DEBUG_OS_STACK_CONSUMPTION)
36-
static bolos_err_t get_stack_consumption(uint8_t mode, uint8_t *buffer_out,
37-
size_t *buffer_out_length);
38-
#endif // DEBUG_OS_STACK_CONSUMPTION
39-
#if defined(HAVE_LEDGER_PKI)
40-
static bolos_err_t pki_load_certificate(uint8_t *buffer, size_t buffer_len,
41-
uint8_t key_usage);
42-
#endif // HAVE_LEDGER_PKI
4335

4436
/* Exported variables --------------------------------------------------------*/
4537

@@ -115,42 +107,6 @@ static bolos_err_t get_seed_cookie(uint8_t *buffer_out,
115107
}
116108
#endif // HAVE_SEED_COOKIE
117109

118-
#if defined(DEBUG_OS_STACK_CONSUMPTION)
119-
static bolos_err_t get_stack_consumption(uint8_t mode, uint8_t *buffer_out,
120-
size_t *buffer_out_length)
121-
{
122-
bolos_err_t err = 0x6985;
123-
int status = os_stack_operations(mode);
124-
125-
*buffer_out_length = 0;
126-
if (status != -1) {
127-
U4BE_ENCODE(buffer_out, 0x00, status);
128-
*buffer_out_length += 4;
129-
err = SWO_SUCCESS;
130-
}
131-
132-
return err;
133-
}
134-
#endif // DEBUG_OS_STACK_CONSUMPTION
135-
136-
#if defined(HAVE_LEDGER_PKI)
137-
static bolos_err_t pki_load_certificate(uint8_t *buffer, size_t buffer_len,
138-
uint8_t key_usage)
139-
{
140-
bolos_err_t err = 0x6985;
141-
cx_ecfp_384_public_key_t public_key;
142-
143-
err = os_pki_load_certificate(key_usage, buffer, buffer_len, NULL, NULL,
144-
&public_key);
145-
if (err == 0) {
146-
err = SWO_SUCCESS;
147-
}
148-
explicit_bzero(&public_key, sizeof(cx_ecfp_384_public_key_t));
149-
150-
return err;
151-
}
152-
#endif // HAVE_LEDGER_PKI
153-
154110
/* Exported functions --------------------------------------------------------*/
155111
bolos_err_t os_io_handle_default_apdu(uint8_t *buffer_in,
156112
size_t buffer_in_length,
@@ -216,15 +172,6 @@ bolos_err_t os_io_handle_default_apdu(uint8_t *buffer_in,
216172
}
217173
break;
218174

219-
#if defined(HAVE_LEDGER_PKI)
220-
case DEFAULT_APDU_INS_LOAD_CERTIFICATE:
221-
*buffer_out_length = 0;
222-
err =
223-
pki_load_certificate(&buffer_in[APDU_OFF_LC + 1],
224-
buffer_in[APDU_OFF_LC], buffer_in[APDU_OFF_P1]);
225-
break;
226-
#endif // HAVE_LEDGER_PKI
227-
228175
default:
229176
err = 0x6e01;
230177
goto end;

0 commit comments

Comments
 (0)