Repository navigation
cherry-pick: bare-metal CI gate (#455) and lwIP HTTPS (#457) to main - #458
Merged
Merged
Conversation
) - .github/workflows/baremetal.yml (ubuntu-24.04: gcc-arm-none-eabi 13.2, newlib 4.4, qemu-user 8.2) runs `make baremetal-size-gate` on every PR and push: the three smoke firmware (in-memory dispatch with and without an RTC, and the lwIP adapter over loopback) under qemu-arm, then the budget check. ELFs, maps and logs are uploaded as an artifact. - baremetal-smoke keeps each run's output in .baremetal-build/<fw>.log and still fails on the first failing firmware. - scripts/ci/baremetal_size_gate.py measures flash (code, rodata, exidx, init arrays, .data load image), static RAM (.data + .bss, not the linker heap region) and the heap/stack high-water marks the firmware report, against scripts/ci/baremetal-budget.txt. A budgeted value the run did not report fails rather than passing. - Budgets sit about 10% above values measured with both gcc 13.2 (the CI toolchain) and 14.2, which agree within 0.6%. (cherry picked from commit 35ed9a0)
…4) (#457) lwIP's altcp_tls_mbedtls only supports mbedTLS 2.x (in 2.2.1 and on master), so the adapter drives mbedTLS 3.6 itself. - cwist_lwip_tls_create()/destroy() build a server context (certificate chain, key, CTR_DRBG, ssl config); cwist_lwip_config.tls turns HTTPS on for a listener. TLS code compiles with -DCWIST_LWIP_TLS; without it, create returns NULL and a listener asked for TLS fails instead of serving plaintext. - The DRBG is seeded only from cwist_port_entropy(): a failing hook makes create fail, and a failing reseed fails the handshake. - Per connection: an mbedtls_ssl_context with BIOs over the pcb. Received ciphertext queues (bounded, refused back to lwIP when full) and is decrypted into the same rx/framing path as plaintext; responses go through mbedtls_ssl_write and are copied into lwIP, so tx is freed as soon as mbedTLS has taken it. The next pipelined request is picked up from tcp_sent, as on the plaintext path. 100 Continue goes through the record layer. Connection: close sends close_notify. A failed handshake aborts the connection. - tests/lwip/cwist_test_mbedtls_config.h: TLS 1.2 server profile (ECDHE-ECDSA P-256, AES-128-GCM, SHA-256; 16 KB in / 4 KB out records). tests/lwip/tls_client.{c,h}: mbedTLS client over a loopback pcb. tests/lwip/test_tls_cert.h: test-only self-signed P-256 credentials. - tests/test_lwip_tls.c (make test): verified handshake, keep-alive and pipelining in one session, 100-continue with a split body, 40 KB response, 413, close_notify, plaintext client on the TLS port, and context creation failures. Under CWIST_TLS=mbedtls it links the vendored mbedTLS libcwist already uses. - tests/baremetal/hello_tls.c joins baremetal-smoke and the size gate: Cortex-M7 flash 137 KB, heap high-water 106.6 KB with both sessions, ~50 KB held by server + client sessions after the handshake. (cherry picked from commit eb537f9)
Contributor
|
This PR targets A maintainer needs to recreate this PR's commits against |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cherry-picks the dev merges since #454 that belong on main, in dev order (
git cherry-pick -x):35ed9a0daci(baremetal): Cortex-M7 smoke and size budget gate (epic: bare-metal STM32 (Cortex-M) port via the dispatch_memory core + lwIP #447 Phase 5) (ci(baremetal): Cortex-M7 smoke and size budget gate (#447 Phase 5) #455)eb537f9d5feat(port): HTTPS over the lwIP adapter with mbedTLS 3.6 (epic: bare-metal STM32 (Cortex-M) port via the dispatch_memory core + lwIP #447 Phase 4) (feat(port): HTTPS over the lwIP adapter with mbedTLS 3.6 (#447 Phase 4) #457)#456 is not picked. It brought main's
ae198886c("Potential fix for pull request finding 'Empty except'", merged with #454) to dev, so main already has the change. Doxygen and benchmark-report auto-commits stay divergent, as before.Conflict resolution
docs/api/v4.0-api-baseline.txt. Regenerated withmake api-baselinefrom main's headers. The diff adds only feat(port): HTTPS over the lwIP adapter with mbedTLS 3.6 (#447 Phase 4) #457's entries: 2 functions (cwist_lwip_tls_create,cwist_lwip_tls_destroy) and 1 type/typedef (cwist_lwip_tls).#455 applied cleanly. Submodule gitlinks are unchanged, and main keeps its own lsquic pin (
2b30189).How it was verified
On the picked tree, with main's submodule pins (lsquic
2b30189):make -j16 allandmake -k test: all targets pass, exit 0, includingtest_lwip_adapterandtest_lwip_tls.make baremetal-size-gate: hello, hello-rtc, hello-lwip and hello-tls PASS under qemu-arm, all within budget.check_test_wiring,check_api_baseline(incl. the v4 guarantee),check_env_knobs,check_api_test_coverage,check_inline_exports,malloc_lint.sh,scripts/ciunit tests: OK.scripts/ci/cppcheck.shwith cppcheck 2.13: no findings.