Backport SPDM/DPE certificate retrieval and AES-GCM fixes to caliptra-2.0#3851
Merged
swenson merged 5 commits intoJun 12, 2026
Conversation
zhalvorsen
previously approved these changes
Jun 11, 2026
parvathib
force-pushed
the
cherry-pick-certify-key-chunks-3765-v2
branch
from
June 11, 2026 21:05
8c0e15f to
fe1609f
Compare
parvathib
changed the title
caliptra-2.0
parvathib
marked this pull request as ready for review
June 11, 2026 21:10
parvathib
requested review from
JohnTraverAmd,
ajisaxena,
bluegate010,
fdamato,
jhand2,
korran,
mhatrevi,
rusty1968,
swenson,
timothytrippel and
vsonims
as code owners
June 11, 2026 21:10
zhalvorsen
approved these changes
Jun 11, 2026
swenson
enabled auto-merge (rebase)
June 11, 2026 23:00
The old CertifyKey flow returns the complete DPE leaf certificate in a single response, requiring the MCU SPDM responder to allocate a relatively large buffer to hold it. This adds a chunked retrieval mechanism which reduces memory pressure while enabling more scalable certificate handling (e.g., for MLDSA and number of contexts) and improving overall efficiency. (cherry picked from commit 6430137)
…#3365) There was some duplicate code in the AES GCM and SPDM cryptographic mailbox commands that this consolidates a little to save space. This also fixes a bug I noticed where the "reserved" space in the AES GCM (non-SPDM) flags were being interpreted as the SPDM flags (i.e., version), which would trigger us to try to derived a key using HMAC. I think this was left over from the initial implementation of AES SPDM commands, but was never documented as being supported, so I just removed that behavior. (cherry picked from commit e2ef42a)
…3790) The GHASH accumulator was incorrectly discarded on the first streaming update call when no AAD had been provided, causing the final tag to omit the authentication contribution of the first batch of data. Always save the GHASH state after processing blocks in aes_256_gcm_update. A second, complementary bug existed on the restore side: when no AAD was provided and no full block of plaintext had been buffered yet, the driver still issued a GcmPhase::Restore writing a zero GHASH state into the hardware. This corrupts subsequent tag computation. Skip the restore in that case: there is nothing to restore until the driver has either ingested AAD or processed a full hardware block. Update the sw-emulator AES peripheral to model the same hardware behaviour: invoking GcmPhase::Restore with an all-zero GHASH state poisons the accumulator with a deterministic non-zero value, so drivers which improperly issue Restore in this state fail tag verification in emulator-based tests. Adds integration tests covering streaming AES-GCM with empty AAD across a range of plaintext sizes and chunk splits. (cherry picked from commit e5ced90)
…eq` (chipsalliance#3841) This is blocked by `InvokeDpe`, but was missed while creating this command. This adds the check here as well. It also adds a test to make sure it is blocked from PL1 correctly. (cherry picked from commit 0bc3c81)
parvathib
force-pushed
the
cherry-pick-certify-key-chunks-3765-v2
branch
from
June 12, 2026 02:22
8ffb8fa to
11488f9
Compare
swenson
approved these changes
Jun 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport SPDM/DPE certificate retrieval and AES-GCM fixes to
caliptra-2.0.This includes:
CERTIFY_KEY_CHUNKSfor chunked DPE certificate retrieval.CERTIFY_KEY_CHUNKS.