Repository navigation
Update wolfBoot emulator CI image to m33mu v1.25 - #249
Merged
Merged
Conversation
The stm32h5-pkcs11-single-boot job fails intermittently (about 3% of attempts since August) during first-boot token provisioning, with CKR_PIN_INCORRECT from C_Login(SO) or C_Login(USER), or CKR_FUNCTION_FAILED from C_InitToken or C_CreateObject. A re-run passes. The failures happen with and without recent wolfPKCS11 changes, and the run is cycle-identical up to the failing call, so this is not a wolfPKCS11 bug. The v1.2 image was built on 2026-03-25. m33mu has since fixed many exception-handling, IT-block and FPU emulation bugs, including the handling of Non-secure interrupts that preempt Secure code. That is the path this test exercises: the test app runs a 1 kHz SysTick during the Secure PKCS11 calls. wolfBoot's own CI runs the same first-boot test on the latest image (v1.25) and has had no PKCS11 failures in its last 400 runs.
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Successful completion of the integration test with the updated image remains unconfirmed.
0 open findings
What changed in this PR
Updates the wolfBoot emulator image to address intermittent first-boot PKCS11 provisioning failures.
Changes:
- Pins the CI image to
v1.25instead ofv1.2. - Leaves test steps and application source unchanged.
| File | Description |
|---|---|
.github/workflows/wolfboot-integration.yml |
Updates the m33mu container image tag to v1.25. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Frauschi
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the wolfBoot emulator test (
wolfboot-integration.yml) fromghcr.io/wolfssl/wolfboot-ci-m33mu:v1.2to:v1.25.stm32h5-pkcs11-single-boothas been failing intermittently during first-boot token provisioning, and a re-run always passes. Since August, 7 of 214 attempts failed.gh run listhides most of these, because it only shows the final, passing attempt. The errors vary:C_Login(SO) rv=0xa0(CKR_PIN_INCORRECT): Prefer the build-time default token path over HOME #247 and Compute CKA_CHECK_VALUE by secret key type #248 (2 out of 2 on Compute CKA_CHECK_VALUE by secret key type #248), plus a Fenrir fixes branch on 2026-10-14C_Login(USER) rv=0xa0: the same branch on 2026-10-14C_InitToken rv=0x6andC_CreateObject rv=0x6(CKR_FUNCTION_FAILED): Release session operation state on replace, error and cancel #230 and the issue208 branch in AugustThese are not caused by wolfPKCS11:
C_Login(SO)failure happened on code that contains neither 89b9e8e nor 15b24f9, the recent PIN-handling changes.C_Login(SO)failure stops at exactly 17906800 emulator cycles with the same PC and LR, even across commits and builds with different signing keys and TRNG data. The run is identical up to the failing call.0xa0there means the recomputed scrypt PIN hash did not match the stored one, and that code path cannot return the error codes that also map to CKR_PIN_INCORRECT.WOLFSSL_SMALL_STACK, and ASAN+UBSAN found no failures and no sanitizer reports.v1.2image (digest a40a465), 860 boots passed, including 60 across 6 fresh builds of the Compute CKA_CHECK_VALUE by secret key type #248 merge that failed 2 out of 2 in CI. Another 640 passed on locally built m33mu (March source and current HEAD).v1.2was built on 2026-03-25. This workflow was already cut back to a single boot that day because of an "unstable emulator" (0ad9762). Since then m33mu has fixed a long list of CPU and exception bugs. These include IT-block state, lazy FP save and FP frame layout, Secure/Non-secure additional-state unwinding, NVIC preemption and EXC_RETURN.ES, SysTick banking by security state, and cross-domain EXC_RETURN/CONTROL.SPSEL handling. This test exercises those paths: the stm32h5 test app starts a 1 kHz Non-secure SysTick and the USART3 IRQ before it calls into the Secure PKCS11 API.wolfBoot's own
trustzone-emulator-tests.ymlruns the same first-boot and second-boot PKCS11 test on:latest, which is the same image asv1.25(built 2026-09-23). In its last 400 runs it had no PKCS11 failures.v1.25is pinned here rather thanlatestso that image updates stay explicit.Testing: the CI run on this PR. No source changes.