SET_CERT: ResetRequired handling

[rw8896]

It seems that the following behaviors haven't been implemented in libspdm yet.
If that's the case, is there any existing issue or plan to fix it?

"If the device temporarily cannot write to a slot, including in a case when it receives overlapping SET_CERTIFICATE requests from different Requesters, then the device shall respond with anErrorCode=Busy response.

When a reset is required for a pending previous SET_CERTIFICATE request and the device receives a GET_CERTIFICATE request for a pending slot or a GET_DIGESTS request, the device shall respond with an ErrorCode=ResetRequired response."

[steven-bellock]

is there any existing issue

Not that I know of.

or plan to fix it?

There can be, if it is needed. I think in a pull request I commented that libspdm needs to check with the Integrator before sending ResetRequired. In particular libspdm_gen_csr has

libspdm/include/hal/library/responder/csrlib.h

Lines 23 to 26 in 5149b56

	* @param[in, out] need_reset For input, it gives the value of CERT_INSTALL_RESET_CAP:
	* If true, then device needs to be reset to complete the CSR.
	* If false, the device doesn`t need to be reset to complete the CSR.
	* For output, it specifies whether the device needs to be reset to complete the CSR or not.

whereas there's no such check for SET_CERTIFICATE. In particular libspdm blindly sends ResetRequired if the Responder's CERT_INSTALL_RESET_CAP is set :

libspdm/library/spdm_responder_lib/libspdm_rsp_set_certificate.c

Lines 302 to 309 in 5149b56

	/*requires a reset to complete the SET_CERTIFICATE request*/
	if (libspdm_is_capabilities_flag_supported(
	spdm_context, false, 0,
	SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_CERT_INSTALL_RESET_CAP)) {
	/*the device will reset to set cert*/
	return libspdm_generate_error_response(spdm_context,
	SPDM_ERROR_CODE_RESET_REQUIRED, 0,
	response_size, response);

which is not entirely correct. Ie whether the reset is required may be conditional on other things besides the capability. So maybe libspdm_write_certificate_to_nvm can return whether errors are required to libspdm. For the Busy response to GET_CERTIFICATE we just need a per-slot way for the Integrator to communicate the state of the certificate slot in the spdm_context.