Skip to content

Commit a4b754a

Browse files
LinuxJediLinuxJedi
committed
Add STSAFE A120 CI support
Adds our STSAFE A120 simulator to the CI, adds STSAFE to configure.ac and fix missing required header.
1 parent d8797f5 commit a4b754a

4 files changed

Lines changed: 122 additions & 1 deletion

File tree

‎.github/workflows/stsafe-a120-sim.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: STSAFE-A120 simulator test
2+
3+
# START OF COMMON SECTION
4+
on:
5+
push:
6+
branches: [ 'master', 'main', 'release/**' ]
7+
pull_request:
8+
branches: [ '*' ]
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
# END OF COMMON SECTION
14+
15+
# Build the STSAFE-A120 software simulator (https://github.com/wolfSSL/simulators,
16+
# STSAFEA120Sim/ subdirectory), build wolfSSL against STMicro's STSELib +
17+
# simulator bridge, and run the wolfCrypt STSAFE-A120 test binary against the
18+
# simulator TCP server.
19+
#
20+
# The simulator's own Dockerfile (Dockerfile.wolfcrypt) clones wolfSSL master
21+
# and applies two sed patches to it. Both patches are now upstreamed in
22+
# wolfSSL itself (the include.am stsafe.c entry, and the
23+
# stse_platform_generic.h include order in stsafe.c), so we:
24+
# 1. COPY the PR checkout instead of cloning master.
25+
# 2. Strip the now-redundant sed RUN block.
26+
# 3. Switch the configure invocation from a raw -DWOLFSSL_STSAFEA120
27+
# CFLAG to the new --enable-stsafe=a120 option.
28+
29+
env:
30+
SIMULATORS_REF: 7e4a50ac3316680c523ec2f66711ea8403c94468
31+
32+
jobs:
33+
stsafe_a120_sim:
34+
name: wolfCrypt against STSAFE-A120 simulator
35+
if: github.repository_owner == 'wolfssl'
36+
runs-on: ubuntu-24.04
37+
timeout-minutes: 30
38+
steps:
39+
- name: Checkout wolfSSL (PR source)
40+
uses: actions/checkout@v4
41+
with:
42+
path: wolfssl-src
43+
44+
- name: Clone STSAFE-A120 simulator
45+
run: |
46+
git clone https://github.com/wolfSSL/simulators simulators
47+
cd simulators && git checkout "$SIMULATORS_REF"
48+
49+
- name: Stage PR wolfSSL into simulator build context
50+
run: mv wolfssl-src simulators/STSAFEA120Sim/wolfssl
51+
52+
- name: Patch Dockerfile to use PR wolfSSL and the upstreamed STSAFE build flags
53+
working-directory: simulators/STSAFEA120Sim
54+
run: |
55+
# 1. Replace the upstream master clone with a COPY of the PR source.
56+
sed -i 's|^RUN git clone --branch \${WOLFSSL_REF} --depth 1 \\$|COPY wolfssl /app/wolfssl|' Dockerfile.wolfcrypt
57+
# The COPY directive above is one line, so drop the now-stranded
58+
# `https://github.com/wolfSSL/wolfssl.git /app/wolfssl` continuation
59+
# line that followed the original `git clone --depth 1 \` line.
60+
sed -i '\|^ https://github.com/wolfSSL/wolfssl.git /app/wolfssl$|d' Dockerfile.wolfcrypt
61+
# Fail fast if the pattern drifted upstream -- better a clear error
62+
# than a CI run that silently tests master.
63+
grep -q '^COPY wolfssl /app/wolfssl$' Dockerfile.wolfcrypt
64+
! grep -q 'git clone .*wolfssl\.git' Dockerfile.wolfcrypt
65+
66+
# 2. Neutralise the sed-patch RUN block: the patches it applies
67+
# (adding stsafe.c to include.am, prepending
68+
# stse_platform_generic.h to stsafe.c) are now upstream and
69+
# rerunning them would produce duplicate entries.
70+
sed -i '/^RUN sed -i \\$/,/^ head -2 \/app\/wolfssl\/wolfcrypt\/src\/port\/st\/stsafe\.c$/c\RUN true' Dockerfile.wolfcrypt
71+
! grep -q 'sed -i .*include.am' Dockerfile.wolfcrypt
72+
! grep -q 'sed -i .*port/st/stsafe.c' Dockerfile.wolfcrypt
73+
74+
# 3. Switch the wolfSSL configure invocation to the new
75+
# --enable-stsafe=a120 option, and drop the now-redundant raw
76+
# -DWOLFSSL_STSAFEA120 from CFLAGS.
77+
sed -i 's|^ --disable-examples \\$| --disable-examples \\\n --enable-stsafe=a120 \\|' Dockerfile.wolfcrypt
78+
sed -i 's|-DWOLFSSL_STSAFEA120 ||' Dockerfile.wolfcrypt
79+
grep -q -- '--enable-stsafe=a120' Dockerfile.wolfcrypt
80+
! grep -q -- '-DWOLFSSL_STSAFEA120' Dockerfile.wolfcrypt
81+
82+
- uses: docker/setup-buildx-action@v3
83+
84+
- name: Build wolfCrypt-STSAFE-A120 test image
85+
uses: docker/build-push-action@v5
86+
with:
87+
context: simulators/STSAFEA120Sim
88+
file: simulators/STSAFEA120Sim/Dockerfile.wolfcrypt
89+
push: false
90+
load: true
91+
tags: wolfssl-stsafe-a120-sim:ci
92+
cache-from: type=gha
93+
cache-to: type=gha,mode=max
94+
95+
- name: Run wolfCrypt tests against simulator
96+
run: docker run --rm wolfssl-stsafe-a120-sim:ci

‎configure.ac‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3050,6 +3050,25 @@ AC_ARG_WITH([tropic01],
30503050
)
30513051

30523052

3053+
# STMicro STSAFE-A100 / STSAFE-A120
3054+
# Example: "./configure --enable-stsafe=a120"
3055+
ENABLED_STSAFE="no"
3056+
AC_ARG_ENABLE([stsafe],
3057+
[AS_HELP_STRING([--enable-stsafe@<:@=a100|a120@:>@],
3058+
[Enable STMicro STSAFE secure-element support. Variant selects the SDK:
3059+
a100 (legacy STSAFE-A1xx SDK, default) or a120 (STSELib).])],
3060+
[ ENABLED_STSAFE=$enableval ],
3061+
[ ENABLED_STSAFE=no ])
3062+
3063+
case "$ENABLED_STSAFE" in
3064+
no) ;;
3065+
yes|a100) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STSAFE -DWOLFSSL_STSAFEA100"
3066+
ENABLED_STSAFE="a100" ;;
3067+
a120) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STSAFE -DWOLFSSL_STSAFEA120" ;;
3068+
*) AC_MSG_ERROR([Invalid --enable-stsafe value '$ENABLED_STSAFE'; use a100 or a120]) ;;
3069+
esac
3070+
3071+
30533072
# NXP SE050
30543073
# Example: "./configure --with-se050=/home/pi/simw_top"
30553074
ENABLED_SE050="no"
@@ -12112,6 +12131,7 @@ AM_CONDITIONAL([BUILD_QNXCAAM],[test "x$ENABLED_CAAM_QNX" = "xyes"])
1211212131
AM_CONDITIONAL([BUILD_IOTSAFE],[test "x$ENABLED_IOTSAFE" = "xyes"])
1211312132
AM_CONDITIONAL([BUILD_IOTSAFE_HWRNG],[test "x$ENABLED_IOTSAFE_HWRNG" = "xyes"])
1211412133
AM_CONDITIONAL([BUILD_SE050],[test "x$ENABLED_SE050" = "xyes"])
12134+
AM_CONDITIONAL([BUILD_STSAFE],[test "x$ENABLED_STSAFE" != "xno"])
1211512135
AM_CONDITIONAL([BUILD_TROPIC01],[test "x$ENABLED_TROPIC01" = "xyes"])
1211612136
AM_CONDITIONAL([BUILD_KDF],[test "x$ENABLED_KDF" = "xyes"])
1211712137
AM_CONDITIONAL([BUILD_HMAC],[test "x$ENABLED_HMAC" = "xyes"])
@@ -12681,6 +12701,7 @@ echo " * i.MX CAAM: $ENABLED_CAAM"
1268112701
echo " * IoT-Safe: $ENABLED_IOTSAFE"
1268212702
echo " * IoT-Safe HWRNG: $ENABLED_IOTSAFE_HWRNG"
1268312703
echo " * NXP SE050: $ENABLED_SE050"
12704+
echo " * STMicro STSAFE: $ENABLED_STSAFE"
1268412705
echo " * TROPIC01: $ENABLED_TROPIC01"
1268512706
echo " * Maxim Integrated MAXQ10XX: $ENABLED_MAXQ10XX"
1268612707
echo " * PSA: $ENABLED_PSA"

‎wolfcrypt/src/include.am‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,6 @@ EXTRA_DIST += wolfcrypt/src/port/ti/ti-aes.c \
100100
wolfcrypt/src/port/silabs/silabs_random.c \
101101
wolfcrypt/src/port/silabs/README.md \
102102
wolfcrypt/src/port/st/stm32.c \
103-
wolfcrypt/src/port/st/stsafe.c \
104103
wolfcrypt/src/port/st/README.md \
105104
wolfcrypt/src/port/st/STM32MP13.md \
106105
wolfcrypt/src/port/st/STM32MP25.md \
@@ -235,6 +234,10 @@ if BUILD_SE050
235234
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/nxp/se050_port.c
236235
endif
237236

237+
if BUILD_STSAFE
238+
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/st/stsafe.c
239+
endif
240+
238241
if BUILD_TROPIC01
239242
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/tropicsquare/tropic01.c
240243
endif

‎wolfcrypt/src/port/st/stsafe.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353

5454
#ifdef WOLFSSL_STSAFEA120
5555
/* STSELib includes for A120 */
56+
#include "stse_platform_generic.h"
5657
#include "stselib.h"
5758
#else /* WOLFSSL_STSAFEA100 */
5859
/* Legacy STSAFE-A1xx SDK includes */

0 commit comments

Comments
 (0)