Merge pull request #912 from bigbrett/tc3-toolchain-support #1515
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: trustzone-emulator-tests | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| trustzone-emulator-tests: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/wolfssl/wolfboot-ci-m33mu:latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Init submodules | |
| run: | | |
| git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| git submodule update --init --single-branch | |
| - name: Configure stm32h5 (TZ) and build wolfboot | |
| run: | | |
| cp config/examples/stm32h5-tz.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (stm32h5) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| ./test.sh | |
| - name: Clean build tree for PKCS11 test (stm32h5) | |
| run: | | |
| make clean distclean | |
| - name: Configure PKCS11 test (stm32h5) | |
| run: | | |
| cp config/examples/stm32h5-tz.config .config | |
| - name: Build persistent PKCS11 test app (stm32h5) | |
| run: | | |
| make PKCS11_TESTAPP=1 | |
| - name: Prepare PKCS11 persistence directory | |
| run: | | |
| rm -rf /tmp/m33mu-pkcs11-persist | |
| mkdir -p /tmp/m33mu-pkcs11-persist | |
| rm -f /tmp/m33mu-pkcs11-first.log /tmp/m33mu-pkcs11-second.log | |
| - name: Run PKCS11 first boot (stm32h5) | |
| run: | | |
| cd /tmp/m33mu-pkcs11-persist | |
| m33mu "$GITHUB_WORKSPACE/wolfboot.bin" \ | |
| "$GITHUB_WORKSPACE/test-app/image_v1_signed.bin:0x60000" \ | |
| --persist --uart-stdout --timeout 120 --expect-bkpt 0x7d \ | |
| | tee /tmp/m33mu-pkcs11-first.log | |
| - name: Verify PKCS11 first boot (stm32h5) | |
| run: | | |
| grep -q "pkcs11: first boot path, creating persistent objects" /tmp/m33mu-pkcs11-first.log | |
| grep -q "pkcs11: created persistent PKCS11 objects" /tmp/m33mu-pkcs11-first.log | |
| grep -q "pkcs11: success" /tmp/m33mu-pkcs11-first.log | |
| grep -q "\\[BKPT\\] imm=0x7d" /tmp/m33mu-pkcs11-first.log | |
| grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-pkcs11-first.log | |
| - name: Run PKCS11 second boot (stm32h5) | |
| run: | | |
| cd /tmp/m33mu-pkcs11-persist | |
| m33mu "$GITHUB_WORKSPACE/wolfboot.bin" \ | |
| "$GITHUB_WORKSPACE/test-app/image_v1_signed.bin:0x60000" \ | |
| --persist --uart-stdout --timeout 120 --expect-bkpt 0x7f \ | |
| | tee /tmp/m33mu-pkcs11-second.log | |
| - name: Verify PKCS11 second boot (stm32h5) | |
| run: | | |
| grep -q "pkcs11: second boot path, restoring persistent objects" /tmp/m33mu-pkcs11-second.log | |
| grep -q "pkcs11: restored persistent PKCS11 objects" /tmp/m33mu-pkcs11-second.log | |
| grep -q "pkcs11: success" /tmp/m33mu-pkcs11-second.log | |
| grep -q "\\[BKPT\\] imm=0x7f" /tmp/m33mu-pkcs11-second.log | |
| grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-pkcs11-second.log | |
| - name: Clean and build stm32u5 (TZ + wolfcrypt) | |
| run: | | |
| make clean distclean | |
| cp config/examples/stm32u5-wolfcrypt-tz.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (stm32u5) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| ./test.sh | |
| # NuMaker-M2354 (Cortex-M23). This is the only ARMv8-M Baseline target, | |
| # and the only one whose secure view is the base address with the | |
| # non-secure world aliased at +0x10000000. Both worlds are covered: | |
| # TZEN=0 runs wolfBoot and the app entirely in the secure world, TZEN=1 | |
| # runs a non-secure app that reaches wolfBoot through the secure gateway | |
| # veneers. Requires an m33mu with m2354 support (wolfboot-ci >= 1.19). | |
| - name: Clean and build m2354 (Cortex-M23, secure world only) | |
| run: | | |
| make clean distclean | |
| cp config/examples/m2354.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (m2354, S mode) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| ./test.sh | |
| - name: Clean and build m2354 (Cortex-M23, TrustZone) | |
| run: | | |
| make clean distclean | |
| cp config/examples/m2354-tz.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (m2354, NS mode) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| ./test.sh | |
| - name: Clean and build stm32l5 (TZ + wolfcrypt) | |
| run: | | |
| make clean distclean | |
| cp config/examples/stm32l5-wolfcrypt-tz.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (stm32l5) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| ./test.sh | |
| - name: Clean and build test with DICE attestation (stm32h5) | |
| run: | | |
| set -o pipefail | |
| make clean distclean | |
| cp config/examples/stm32h5-tz-psa.config .config | |
| make | |
| m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 \ | |
| | tee /tmp/m33mu-dice.log | |
| grep -q "IAT size match: challenge=64 token=" /tmp/m33mu-dice.log | |
| grep -q "PSA boot attestation: success" /tmp/m33mu-dice.log | |
| grep -q "\\[BKPT\\] imm=0x7f" /tmp/m33mu-dice.log | |
| grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-dice.log | |
| - name: Clean and build test with fwTPM (stm32h5) | |
| run: | | |
| make clean distclean | |
| cp config/examples/stm32h5-tz-fwtpm.config .config | |
| make | |
| m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 \ | |
| | tee /tmp/m33mu-fwtpm.log | |
| grep -q "fwTPM PCR0 extended:" /tmp/m33mu-fwtpm.log | |
| grep -q "fwTPM unsealed secret: wolfBoot fwTPM PCR secret" /tmp/m33mu-fwtpm.log | |
| grep -q "fwTPM NSC tests passed" /tmp/m33mu-fwtpm.log | |
| grep -q "\\[BKPT\\] imm=0x7f" /tmp/m33mu-fwtpm.log | |
| grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-fwtpm.log | |
| # The wolfHSM STM32H5 TrustZone integration is exercised by the | |
| # nightly cross-repo job in wolfHSM | |
| # (.github/workflows/wolfboot-tz-integration.yml), which builds | |
| # this demo against the latest wolfHSM main and runs it under | |
| # m33mu. It is intentionally not gated on every wolfBoot PR. | |
| - name: Clean and build test with DICE attestation + OTP (stm32h5) | |
| run: | | |
| make clean distclean | |
| cp config/examples/stm32h5-tz-psa-otp.config .config | |
| make | |
| make -C tools/keytools/otp otp-keystore-primer.bin otp-keystore-gen | |
| ./tools/keytools/otp/otp-keystore-gen | |
| m33mu tools/keytools/otp/otp-keystore-primer.bin --persist --timeout 10 || true | |
| m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 --persist |