Skip to content

Commit 2b23590

Browse files
danielinuxdanielinux
committed
Fix USART3 NS-permissions, for STM32L5 test, renamed mislabeled test
1 parent 32446f3 commit 2b23590

3 files changed

Lines changed: 69 additions & 73 deletions

File tree

‎.github/workflows/trustzone-emulator-tests.yml‎

Lines changed: 50 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -27,78 +27,55 @@ jobs:
2727
run: |
2828
./test.sh
2929
30-
- name: Build and run persistent PKCS11 test app (stm32h5)
31-
run: |
32-
set -euo pipefail
33-
34-
build_log=/tmp/m33mu-pkcs11-build.log
35-
first_log=/tmp/m33mu-pkcs11-first.log
36-
second_log=/tmp/m33mu-pkcs11-second.log
37-
persist_dir=/tmp/m33mu-pkcs11-persist
38-
rm -f "$build_log" "$first_log" "$second_log"
39-
rm -rf "$persist_dir"
40-
mkdir -p "$persist_dir"
41-
42-
dump_log() {
43-
local log_file="$1"
44-
if [ -f "$log_file" ]; then
45-
echo "--- $log_file ---"
46-
cat "$log_file"
47-
fi
48-
}
49-
50-
make clean distclean >"$build_log" 2>&1 || {
51-
dump_log "$build_log"
52-
exit 1
53-
}
54-
cp config/examples/stm32h5-tz.config .config >>"$build_log" 2>&1 || {
55-
dump_log "$build_log"
56-
exit 1
57-
}
58-
make PKCS11_TESTAPP=1 >>"$build_log" 2>&1 || {
59-
dump_log "$build_log"
60-
exit 1
61-
}
62-
63-
(
64-
cd "$persist_dir"
65-
m33mu "$GITHUB_WORKSPACE/wolfboot.bin" \
66-
"$GITHUB_WORKSPACE/test-app/image_v1_signed.bin:0x60000" \
67-
--persist --uart-stdout --timeout 120 --expect-bkpt 0x7d \
68-
>"$first_log" 2>&1
69-
) || {
70-
dump_log "$first_log"
71-
exit 1
72-
}
73-
74-
grep -q "pkcs11: first boot path, creating persistent objects" "$first_log" && \
75-
grep -q "pkcs11: created persistent PKCS11 objects" "$first_log" && \
76-
grep -q "pkcs11: success" "$first_log" && \
77-
grep -q "\\[BKPT\\] imm=0x7d" "$first_log" && \
78-
grep -q "\\[EXPECT BKPT\\] Success" "$first_log" || {
79-
dump_log "$first_log"
80-
exit 1
81-
}
82-
83-
(
84-
cd "$persist_dir"
85-
m33mu "$GITHUB_WORKSPACE/wolfboot.bin" \
86-
"$GITHUB_WORKSPACE/test-app/image_v1_signed.bin:0x60000" \
87-
--persist --uart-stdout --timeout 120 --expect-bkpt 0x7f \
88-
>"$second_log" 2>&1
89-
) || {
90-
dump_log "$second_log"
91-
exit 1
92-
}
93-
94-
grep -q "pkcs11: second boot path, restoring persistent objects" "$second_log" && \
95-
grep -q "pkcs11: restored persistent PKCS11 objects" "$second_log" && \
96-
grep -q "pkcs11: success" "$second_log" && \
97-
grep -q "\\[BKPT\\] imm=0x7f" "$second_log" && \
98-
grep -q "\\[EXPECT BKPT\\] Success" "$second_log" || {
99-
dump_log "$second_log"
100-
exit 1
101-
}
30+
- name: Clean build tree for PKCS11 test (stm32h5)
31+
run: |
32+
make clean distclean
33+
34+
- name: Configure PKCS11 test (stm32h5)
35+
run: |
36+
cp config/examples/stm32h5-tz.config .config
37+
38+
- name: Build persistent PKCS11 test app (stm32h5)
39+
run: |
40+
make PKCS11_TESTAPP=1
41+
42+
- name: Prepare PKCS11 persistence directory
43+
run: |
44+
rm -rf /tmp/m33mu-pkcs11-persist
45+
mkdir -p /tmp/m33mu-pkcs11-persist
46+
rm -f /tmp/m33mu-pkcs11-first.log /tmp/m33mu-pkcs11-second.log
47+
48+
- name: Run PKCS11 first boot (stm32h5)
49+
run: |
50+
cd /tmp/m33mu-pkcs11-persist
51+
m33mu "$GITHUB_WORKSPACE/wolfboot.bin" \
52+
"$GITHUB_WORKSPACE/test-app/image_v1_signed.bin:0x60000" \
53+
--persist --uart-stdout --timeout 120 --expect-bkpt 0x7d \
54+
| tee /tmp/m33mu-pkcs11-first.log
55+
56+
- name: Verify PKCS11 first boot (stm32h5)
57+
run: |
58+
grep -q "pkcs11: first boot path, creating persistent objects" /tmp/m33mu-pkcs11-first.log
59+
grep -q "pkcs11: created persistent PKCS11 objects" /tmp/m33mu-pkcs11-first.log
60+
grep -q "pkcs11: success" /tmp/m33mu-pkcs11-first.log
61+
grep -q "\\[BKPT\\] imm=0x7d" /tmp/m33mu-pkcs11-first.log
62+
grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-pkcs11-first.log
63+
64+
- name: Run PKCS11 second boot (stm32h5)
65+
run: |
66+
cd /tmp/m33mu-pkcs11-persist
67+
m33mu "$GITHUB_WORKSPACE/wolfboot.bin" \
68+
"$GITHUB_WORKSPACE/test-app/image_v1_signed.bin:0x60000" \
69+
--persist --uart-stdout --timeout 120 --expect-bkpt 0x7f \
70+
| tee /tmp/m33mu-pkcs11-second.log
71+
72+
- name: Verify PKCS11 second boot (stm32h5)
73+
run: |
74+
grep -q "pkcs11: second boot path, restoring persistent objects" /tmp/m33mu-pkcs11-second.log
75+
grep -q "pkcs11: restored persistent PKCS11 objects" /tmp/m33mu-pkcs11-second.log
76+
grep -q "pkcs11: success" /tmp/m33mu-pkcs11-second.log
77+
grep -q "\\[BKPT\\] imm=0x7f" /tmp/m33mu-pkcs11-second.log
78+
grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-pkcs11-second.log
10279
10380
- name: Clean and build stm32u5 (TZ + wolfcrypt)
10481
run: |
@@ -117,7 +94,7 @@ jobs:
11794
cp config/examples/stm32l5-wolfcrypt-tz.config .config
11895
make wolfboot.bin
11996
120-
- name: Run emu test (stm32u5)
97+
- name: Run emu test (stm32l5)
12198
working-directory: test-app/emu-test-apps
12299
run: |
123100
TARGET=stm32l5 ./test.sh

‎hal/stm32l5.c‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,11 +400,17 @@ static void clock_pll_on(int powersave)
400400
#if TZ_SECURE()
401401
static void periph_unsecure()
402402
{
403+
volatile uint32_t reg;
404+
403405
/*Enable clock for User LED GPIOs */
404406
RCC_AHB2_CLOCK_ER|= LED_AHB2_ENABLE;
405407

406408
/* Enable clock for LPUART1 */
407409
RCC_APB1_CLOCK_ER |= UART1_APB1_CLOCK_ER_VAL;
410+
/* Enable clock for USART3 used by emu-test-apps on PD8/PD9 */
411+
RCC_APB1_CLOCK_ER |= UART3_APB1_CLOCK_ER_VAL;
412+
/* Enable clock for GPIO D (USART3 pins) */
413+
RCC_AHB2_CLOCK_ER |= GPIOD_AHB2_CLOCK_ER;
408414

409415

410416
PWR_CR2 |= PWR_CR2_IOSV;
@@ -423,6 +429,16 @@ static void periph_unsecure()
423429
GPIO_SECCFGR(GPIOG_BASE) &= ~(1<<UART1_TX_PIN);
424430
GPIO_SECCFGR(GPIOG_BASE) &= ~(1<<UART1_RX_PIN);
425431

432+
/* Unsecure USART3 and its pins for the STM32L5 emulator app path. */
433+
reg = TZSC_SECCFGR1;
434+
if (reg & TZSC_SECCFGR1_USART3SEC) {
435+
reg &= ~TZSC_SECCFGR1_USART3SEC;
436+
DMB();
437+
TZSC_SECCFGR1 = reg;
438+
}
439+
GPIO_SECCFGR(GPIOD_BASE) &= ~(1u << 8);
440+
GPIO_SECCFGR(GPIOD_BASE) &= ~(1u << 9);
441+
426442
}
427443
#endif
428444

‎hal/stm32l5.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,8 @@
183183

184184
#define TZSC_PRIVCFGR1 *((uint32_t *)(0x50032420))
185185
#define TZSC_PRIVCFG1_LPUARTPRIV (1 << 21)
186+
#define TZSC_SECCFGR1 *((uint32_t *)(0x50032410))
187+
#define TZSC_SECCFGR1_USART3SEC (1 << 11)
186188

187189

188190
#else
@@ -257,6 +259,7 @@
257259

258260
#define RCC_APB1_CLOCK_ER (*(volatile uint32_t *)(RCC_BASE + 0x5C ))
259261
#define UART1_APB1_CLOCK_ER_VAL (1 << 0)
262+
#define UART3_APB1_CLOCK_ER_VAL (1 << 18)
260263

261264
#define UART1_PIN_AF 8
262265
#define UART1_RX_PIN 8

0 commit comments

Comments
 (0)