@@ -169,10 +169,10 @@ jobs:
169169 m33mu tools/keytools/otp/otp-keystore-primer.bin --persist --timeout 10 || true
170170 m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 --persist
171171
172- # LPC55S69 DICE attestation + HW PUF. The PUF root key is provisioned
173- # at first boot (WOLFBOOT_HWPUF_PROVISION=1) and used for DICE key
174- # derivation on subsequent boots. Requires m33mu with lpc55s69 PUF/RNG
175- # models ( wolfboot-ci >= 1.22 ).
172+ # LPC55S69 DICE attestation + HW PUF. The first boot enrolls the PUF
173+ # and stores the record (WOLFBOOT_HWPUF_PROVISION=1); the second boot
174+ # must reuse it and report the same UEID. Needs the m33mu lpc55s69
175+ # PUF/RNG models and --persist (m33mu c2d903e, wolfboot-ci >= 1.28 ).
176176 # The lpc55s69 HAL needs MCUXpresso SDK headers (fsl_common.h); same
177177 # west-based setup as the lpc55s69 jobs in test-configs.yml.
178178 - name : Checkout CMSIS (lpc55s69)
@@ -192,8 +192,9 @@ jobs:
192192 sed -i '/se_hostlib\|emwin\|executorch/d' manifests/boards/lpcxpresso55s69.yml
193193 west update_board --set board lpcxpresso55s69
194194
195- - name : Clean and build test with DICE attestation + HW PUF (lpc55s69)
195+ - name : Build and run DICE attestation + HW PUF across two boots (lpc55s69)
196196 run : |
197+ set -o pipefail
197198 make clean distclean
198199 cp config/examples/lpc55s69-tz-psa.config .config
199200 sed -i 's/^HWPUF?=0/HWPUF?=1/' .config
@@ -203,19 +204,42 @@ jobs:
203204 grep -q '^WOLFBOOT_HWPUF_PROVISION?=1' .config
204205 grep -q '^WOLFBOOT_UDS_UID_FALLBACK_FORTEST?=0' .config
205206 make MCUXSDK=1 MCUXPRESSO="$GITHUB_WORKSPACE/mcuxpresso-sdk/mcuxsdk" MCUXPRESSO_CMSIS="$GITHUB_WORKSPACE/CMSIS_5/CMSIS"
206-
207- # Single boot: enroll the PUF, store the record, attest.
208- # TODO: add a second --persist boot checking the stored record is reused
209- # (same UEID) once the CI image ships an m33mu with lpc55s69 --persist
210- # support (m33mu c2d903e, after v1.23).
211- - name : Run DICE attestation + HW PUF (lpc55s69)
207+ BOOT_ADDR=$(sed -n 's/^WOLFBOOT_PARTITION_BOOT_ADDRESS?*=//p' .config)
208+ rm -rf /tmp/m33mu-lpc55s69-hwpuf-persist
209+ mkdir -p /tmp/m33mu-lpc55s69-hwpuf-persist
210+ cp wolfboot.bin test-app/image_v1_signed.bin /tmp/m33mu-lpc55s69-hwpuf-persist/
211+ cd /tmp/m33mu-lpc55s69-hwpuf-persist
212+ for boot in first second; do
213+ m33mu wolfboot.bin image_v1_signed.bin:$BOOT_ADDR --cpu lpc55s69 --persist --uart-stdout --expect-bkpt 0x7f --timeout 300 \
214+ | tee /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
215+ grep -q "Booting version:" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
216+ grep -q "Checking integrity...done" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
217+ grep -q "Verifying signature...done" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
218+ grep -q "attest: token size" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
219+ grep -q "state=0x00" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
220+ grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
221+ done
222+ # The second boot starts confirmed, so it attested from the stored record
223+ grep -q "boot: ver=0x1 state=0x00" /tmp/m33mu-lpc55s69-dice-hwpuf-second.log
224+ first=$(python3 $GITHUB_WORKSPACE/tools/scripts/eat_ueid.py /tmp/m33mu-lpc55s69-dice-hwpuf-first.log)
225+ second=$(python3 $GITHUB_WORKSPACE/tools/scripts/eat_ueid.py /tmp/m33mu-lpc55s69-dice-hwpuf-second.log)
226+ echo "UEID first boot: $first"
227+ echo "UEID second boot: $second"
228+ test -n "$first"
229+ test "$first" = "$second"
230+
231+ - name : Build and run persistent PKCS11 test (lpc55s69)
212232 run : |
213233 set -o pipefail
214- m33mu wolfboot.bin test-app/image_v1_signed.bin:0x48000 --cpu lpc55s69 --uart-stdout --expect-bkpt 0x7f --timeout 300 \
215- | tee /tmp/m33mu-lpc55s69-dice-hwpuf.log
216- grep -q "Booting version:" /tmp/m33mu-lpc55s69-dice-hwpuf.log
217- grep -q "Checking integrity...done" /tmp/m33mu-lpc55s69-dice-hwpuf.log
218- grep -q "Verifying signature...done" /tmp/m33mu-lpc55s69-dice-hwpuf.log
219- grep -q "attest: token size" /tmp/m33mu-lpc55s69-dice-hwpuf.log
220- grep -q "state=0x00" /tmp/m33mu-lpc55s69-dice-hwpuf.log
221- grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-lpc55s69-dice-hwpuf.log
234+ make clean distclean
235+ cp config/examples/lpc55s69-tz.config .config
236+ make MCUXSDK=1 MCUXPRESSO="$GITHUB_WORKSPACE/mcuxpresso-sdk/mcuxsdk" MCUXPRESSO_CMSIS="$GITHUB_WORKSPACE/CMSIS_5/CMSIS" PKCS11_TESTAPP=1
237+ BOOT_ADDR=$(sed -n 's/^WOLFBOOT_PARTITION_BOOT_ADDRESS?*=//p' .config)
238+ m33mu wolfboot.bin test-app/image_v1_signed.bin:$BOOT_ADDR --cpu lpc55s69 --persist --uart-stdout --timeout 300 --expect-bkpt 0x7d \
239+ | tee /tmp/m33mu-lpc55s69-pkcs11-first.log
240+ grep -q "pkcs11: created persistent PKCS11 objects" /tmp/m33mu-lpc55s69-pkcs11-first.log
241+ grep -q "pkcs11: success" /tmp/m33mu-lpc55s69-pkcs11-first.log
242+ m33mu wolfboot.bin test-app/image_v1_signed.bin:$BOOT_ADDR --cpu lpc55s69 --persist --uart-stdout --timeout 300 --expect-bkpt 0x7f \
243+ | tee /tmp/m33mu-lpc55s69-pkcs11-second.log
244+ grep -q "pkcs11: restored persistent PKCS11 objects" /tmp/m33mu-lpc55s69-pkcs11-second.log
245+ grep -q "pkcs11: success" /tmp/m33mu-lpc55s69-pkcs11-second.log
0 commit comments