From 394865d912f7279554b2ccc2b0cfeddc1c8e6649 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Fri, 20 Mar 2026 19:14:41 +0100 Subject: [PATCH 1/4] Added wolfboot integration test to intercept regressions --- .github/workflows/wolfboot-integration.yml | 89 ++++++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 .github/workflows/wolfboot-integration.yml diff --git a/.github/workflows/wolfboot-integration.yml b/.github/workflows/wolfboot-integration.yml new file mode 100644 index 00000000..f5e713a3 --- /dev/null +++ b/.github/workflows/wolfboot-integration.yml @@ -0,0 +1,89 @@ +name: WolfPKCS11 wolfBoot emulator tests + +on: + push: + branches: [ 'master', 'main', 'release/**' ] + pull_request: + branches: [ '*' ] + +env: + WOLFBOOT_REPO: https://github.com/wolfSSL/wolfBoot.git + WOLFBOOT_BRANCH: master + +jobs: + stm32h5_pkcs11_persist: + name: stm32h5-pkcs11-persist + runs-on: ubuntu-latest + container: + image: ghcr.io/danielinux/m33mu-ci:1.8 + timeout-minutes: 25 + + steps: + - name: Checkout wolfPKCS11 + uses: actions/checkout@v4 + + - name: Clone wolfBoot and link tested wolfPKCS11 + run: | + set -euxo pipefail + + git config --global --add safe.directory "${GITHUB_WORKSPACE}" + git clone --depth 1 --branch "${WOLFBOOT_BRANCH}" "${WOLFBOOT_REPO}" wolfboot + git -C wolfboot config --global --add safe.directory "${GITHUB_WORKSPACE}/wolfboot" + git -C wolfboot submodule update --init --recursive + rm -rf wolfboot/lib/wolfPKCS11 + ln -s "${GITHUB_WORKSPACE}" wolfboot/lib/wolfPKCS11 + test -L wolfboot/lib/wolfPKCS11 + test "$(realpath wolfboot/lib/wolfPKCS11)" = "${GITHUB_WORKSPACE}" + + - name: Clean build tree for PKCS11 test (stm32h5) + working-directory: wolfboot + run: | + make clean distclean + + - name: Configure PKCS11 test (stm32h5) + working-directory: wolfboot + run: | + cp config/examples/stm32h5-tz.config .config + + - name: Build persistent PKCS11 test app (stm32h5) + working-directory: wolfboot + run: | + make PKCS11_TESTAPP=1 + + - name: Prepare PKCS11 persistence directory + run: | + rm -rf /tmp/m33mu-pkcs11-persist + mkdir -p /tmp/m33mu-pkcs11-persist + rm -f /tmp/m33mu-pkcs11-first.log /tmp/m33mu-pkcs11-second.log + + - name: Run PKCS11 first boot (stm32h5) + run: | + cd /tmp/m33mu-pkcs11-persist + m33mu "${GITHUB_WORKSPACE}/wolfboot/wolfboot.bin" \ + "${GITHUB_WORKSPACE}/wolfboot/test-app/image_v1_signed.bin:0x60000" \ + --persist --uart-stdout --timeout 120 --expect-bkpt 0x7d \ + | tee /tmp/m33mu-pkcs11-first.log + + - name: Verify PKCS11 first boot (stm32h5) + run: | + grep -q "pkcs11: first boot path, creating persistent objects" /tmp/m33mu-pkcs11-first.log + grep -q "pkcs11: created persistent PKCS11 objects" /tmp/m33mu-pkcs11-first.log + grep -q "pkcs11: success" /tmp/m33mu-pkcs11-first.log + grep -q "\\[BKPT\\] imm=0x7d" /tmp/m33mu-pkcs11-first.log + grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-pkcs11-first.log + + - name: Run PKCS11 second boot (stm32h5) + run: | + cd /tmp/m33mu-pkcs11-persist + m33mu "${GITHUB_WORKSPACE}/wolfboot/wolfboot.bin" \ + "${GITHUB_WORKSPACE}/wolfboot/test-app/image_v1_signed.bin:0x60000" \ + --persist --uart-stdout --timeout 120 --expect-bkpt 0x7f \ + | tee /tmp/m33mu-pkcs11-second.log + + - name: Verify PKCS11 second boot (stm32h5) + run: | + grep -q "pkcs11: second boot path, restoring persistent objects" /tmp/m33mu-pkcs11-second.log + grep -q "pkcs11: restored persistent PKCS11 objects" /tmp/m33mu-pkcs11-second.log + grep -q "pkcs11: success" /tmp/m33mu-pkcs11-second.log + grep -q "\\[BKPT\\] imm=0x7f" /tmp/m33mu-pkcs11-second.log + grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-pkcs11-second.log From 7f33cb3dbe0eb74619fd3d70da06b7d6d6b0ff45 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Tue, 24 Mar 2026 17:48:06 +0100 Subject: [PATCH 2/4] Update m33mu-ci to wolfboot-ci-m33mu --- .github/workflows/wolfboot-integration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/wolfboot-integration.yml b/.github/workflows/wolfboot-integration.yml index f5e713a3..3e3714eb 100644 --- a/.github/workflows/wolfboot-integration.yml +++ b/.github/workflows/wolfboot-integration.yml @@ -15,8 +15,8 @@ jobs: name: stm32h5-pkcs11-persist runs-on: ubuntu-latest container: - image: ghcr.io/danielinux/m33mu-ci:1.8 - timeout-minutes: 25 + image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.0 + timeout-minutes: 15 steps: - name: Checkout wolfPKCS11 From 26e06828bce4bce5a9db9c7dfaab6fa3a6eec33a Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Wed, 25 Mar 2026 12:11:47 +0100 Subject: [PATCH 3/4] Update wolfboot-ci-m33mu to v.1.1 (fixes in TZ) --- .github/workflows/wolfboot-integration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/wolfboot-integration.yml b/.github/workflows/wolfboot-integration.yml index 3e3714eb..1b20fe93 100644 --- a/.github/workflows/wolfboot-integration.yml +++ b/.github/workflows/wolfboot-integration.yml @@ -15,7 +15,7 @@ jobs: name: stm32h5-pkcs11-persist runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.0 + image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.1 timeout-minutes: 15 steps: From 8d55fd3fad1b25669c9dba7d25504816536fbfa7 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Wed, 25 Mar 2026 12:41:30 +0100 Subject: [PATCH 4/4] Update to wolfboot-ci-m33mu:v.1.2 (forced m33mu rebuild) --- .github/workflows/wolfboot-integration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/wolfboot-integration.yml b/.github/workflows/wolfboot-integration.yml index 1b20fe93..a08172c3 100644 --- a/.github/workflows/wolfboot-integration.yml +++ b/.github/workflows/wolfboot-integration.yml @@ -15,7 +15,7 @@ jobs: name: stm32h5-pkcs11-persist runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.1 + image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.2 timeout-minutes: 15 steps: