Merge branch 'master' into make_dash_bootstrap_work

.github/.wordlist.txt

@@ -1071,7 +1071,6 @@ ProxyDiscovery
 ProxyValid
 ProxyView
 PRs
-PSA
 PSCAN
 PSECT
 PSK

.github/workflows/cirque.yaml

@@ -65,15 +65,18 @@ jobs:
             - name: Checkout submodules
               run: scripts/checkout_submodules.py --allow-changing-global-git-config --shallow --platform linux
 
-            - name: Bootstrap cache
-              uses: buildjet/cache@v3
-              timeout-minutes: 10
-              if: ${{ !env.ACT }}
+            - uses: Wandalen/[email protected]
+              name: Bootstrap cache
+              timeout-minutes: 20
               with:
-                  key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}
-                  path: |
-                      .environment
-                      build_overrides/pigweed_environment.gni
+                action: buildjet/cache@v3
+                attempt_limit: 3
+                attempt_delay: 2000
+                with: |
+                    key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}
+                    path: |
+                        .environment
+                        build_overrides/pigweed_environment.gni
             - name: Bootstrap
               timeout-minutes: 15
               run: |
@@ -87,11 +90,15 @@ jobs:
             - name: Get Cirque Bootstrap cache key
               id: cirque-bootstrap-cache-key
               run: echo "val=$(scripts/tests/cirque_tests.sh cachekeyhash)" >> $GITHUB_OUTPUT
-            - name: Cirque Bootstrap cache
-              uses: buildjet/cache@v3
-              timeout-minutes: 10
+            - uses: Wandalen/[email protected]
+              name: Cirque Bootstrap cache
               if: ${{ !env.ACT }}
+              timeout-minutes: 20
               with:
+                action: buildjet/cache@v3
+                attempt_limit: 3
+                attempt_delay: 2000
+                with: |
                   key: ${{ runner.os }}-cirque-${{ steps.cirque-bootstrap-cache-key.outputs.val }}
                   restore-keys: ${{ runner.os }}-cirque-
                   path: ${{ env.GITHUB_CACHE_PATH }}

.github/workflows/examples-bouffalolab.yaml

@@ -59,14 +59,18 @@ jobs:
           GH_CONTEXT: ${{ toJson(github) }}
         run: scripts/tools/memory/gh_sizes_environment.py "${GH_CONTEXT}"
 
-      - name: Bootstrap cache
-        uses: buildjet/cache@v3
-        timeout-minutes: 10
+      - uses: Wandalen/[email protected]
+        name: Bootstrap cache
+        timeout-minutes: 20
         with:
-          key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}
-          path: |
-            .environment
-            build_overrides/pigweed_environment.gni
+          action: buildjet/cache@v3
+          attempt_limit: 3
+          attempt_delay: 2000
+          with: |
+              key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}
+              path: |
+                  .environment
+                  build_overrides/pigweed_environment.gni
       - name: Bootstrap
         timeout-minutes: 25
         run: bash scripts/bootstrap.sh

.github/workflows/examples-efr32.yaml

@@ -65,14 +65,18 @@ jobs:
           GH_CONTEXT: ${{ toJson(github) }}
         run: scripts/tools/memory/gh_sizes_environment.py "${GH_CONTEXT}"
 
-      - name: Bootstrap cache
-        uses: buildjet/cache@v3
-        timeout-minutes: 10
+      - uses: Wandalen/[email protected]
+        name: Bootstrap cache
+        timeout-minutes: 20
         with:
-          key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}
-          path: |
-            .environment
-            build_overrides/pigweed_environment.gni
+          action: buildjet/cache@v3
+          attempt_limit: 3
+          attempt_delay: 2000
+          with: |
+              key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}
+              path: |
+                  .environment
+                  build_overrides/pigweed_environment.gni
       - name: Bootstrap
         timeout-minutes: 25
         run: bash scripts/bootstrap.sh

.github/workflows/examples-openiotsdk.yaml

@@ -31,11 +31,6 @@ env:
 
 jobs:
     openiotsdk:
-        strategy:
-            fail-fast: false
-            matrix:
-                cryptoBackend: ["psa", "mbedtls"]
-
         name: Open IoT SDK examples building
         timeout-minutes: 90
 
@@ -94,7 +89,7 @@ jobs:
               id: build_shell
               timeout-minutes: 10
               run: |
-                  scripts/examples/openiotsdk_example.sh -b ${{ matrix.cryptoBackend }} shell
+                  scripts/examples/openiotsdk_example.sh shell
                   .environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
                     openiotsdk release shell \
                     examples/shell/openiotsdk/build/chip-openiotsdk-shell-example.elf \
@@ -104,7 +99,7 @@ jobs:
               id: build_lock_app
               timeout-minutes: 10
               run: |
-                  scripts/examples/openiotsdk_example.sh -b ${{ matrix.cryptoBackend }} lock-app
+                  scripts/examples/openiotsdk_example.sh lock-app
                   .environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
                     openiotsdk release lock-app \
                     examples/lock-app/openiotsdk/build/chip-openiotsdk-lock-app-example.elf \
@@ -114,7 +109,7 @@ jobs:
               id: build_unit_tests
               timeout-minutes: 10
               run: |
-                  scripts/examples/openiotsdk_example.sh -b ${{ matrix.cryptoBackend }} unit-tests
+                  scripts/examples/openiotsdk_example.sh unit-tests
 
             - name: "Test: shell example"
               if: steps.build_shell.outcome == 'success'

.github/workflows/java-tests.yaml

@@ -200,18 +200,19 @@ jobs:
                      --tool-args "already-discovered --nodeid 1 --setup-pin-code 20202021 --address ::1 --port 5540 -t 1000" \
                      --factoryreset \
                   '
-            - name: Run Pairing Address-PaseOnly Test
-              timeout-minutes: 25
-              run: |
-                  scripts/run_in_build_env.sh \
-                  './scripts/tests/run_java_test.py \
-                     --app out/linux-x64-all-clusters-ipv6only-no-ble-no-wifi-tsan-clang-test/chip-all-clusters-app \
-                     --app-args "--discriminator 3840 --interface-id -1" \
-                     --tool-path out/linux-x64-java-matter-controller \
-                     --tool-cluster "pairing" \
-                     --tool-args "address-paseonly --nodeid 1 --setup-pin-code 20202021 --address ::1 --port 5540 -t 1000" \
-                     --factoryreset \
-                  '
+            # Disabled due to failure: https://github.com/project-chip/connectedhomeip/issues/27361
+            # - name: Run Pairing Address-PaseOnly Test
+            #   timeout-minutes: 25
+            #   run: |
+            #       scripts/run_in_build_env.sh \
+            #       './scripts/tests/run_java_test.py \
+            #          --app out/linux-x64-all-clusters-ipv6only-no-ble-no-wifi-tsan-clang-test/chip-all-clusters-app \
+            #          --app-args "--discriminator 3840 --interface-id -1" \
+            #          --tool-path out/linux-x64-java-matter-controller \
+            #          --tool-cluster "pairing" \
+            #          --tool-args "address-paseonly --nodeid 1 --setup-pin-code 20202021 --address ::1 --port 5540 -t 1000" \
+            #          --factoryreset \
+            #       '
             - name: Run Pairing SetupQRCode Test
               timeout-minutes: 25
               run: |

.mergify.yml

@@ -4,6 +4,10 @@ pull_request_rules:
       - "#approved-reviews-by>=1"
       - "#review-threads-unresolved=0"
       - "-draft"
+      - "label!=docker"            # Don't auto merge docker images
+      - "#check-failure=0"         # Don't auto merge with a failure
+      - "#check-pending=0"         # Don't auto merge with anything pending
+      - "check-success~=Build"     # Don't auto merge unless a build has succeeded, needed because above is true on a fresh PR before builds
       - or:
         - "check-success=pullapprove"
         - "check-skipped=pullapprove"

.vscode/tasks.json

@@ -251,7 +251,6 @@
                 "-Cbuild",
                 "-d${input:openiotsdkDebugMode}",
                 "-l${input:openiotsdkLwipDebug}",
-                "-b${input:openiotsdkCryptoBackend}",
                 "${input:openiotsdkExample}"
             ],
             "group": "build",
@@ -272,7 +271,6 @@
                 "-Cbuild",
                 "-d${input:openiotsdkDebugMode}",
                 "-l${input:openiotsdkLwipDebug}",
-                "-b${input:openiotsdkCryptoBackend}",
                 "unit-tests"
             ],
             "group": "build",
@@ -482,13 +480,6 @@
             "options": ["false", "true"],
             "default": "false"
         },
-        {
-            "type": "pickString",
-            "id": "openiotsdkCryptoBackend",
-            "description": "Which Crypto algorithm do you wish to use?",
-            "options": ["mbedtls", "psa"],
-            "default": "mbedtls"
-        },
         {
             "type": "command",
             "id": "openiotsdkExample",

config/openiotsdk/CMakeLists.txt

@@ -62,7 +62,6 @@ matter_add_gn_arg_bool  ("chip_automation_logging"              CONFIG_CHIP_AUTO
 matter_add_gn_arg_bool  ("chip_error_logging"                   CONFIG_CHIP_ERROR_LOGGING)
 matter_add_gn_arg_bool  ("chip_openiotsdk_use_tfm"              TFM_SUPPORT)
 matter_add_gn_arg_bool  ("chip_openiotsdk_use_psa_ps"           CONFIG_CHIP_OPEN_IOT_SDK_USE_PSA_PS)
-matter_add_gn_arg_string("chip_crypto"                          "${CONFIG_CHIP_CRYPTO}")
 if (TARGET cmsis-rtos-api)
     matter_add_gn_arg_string("target_os"                        "cmsis-rtos")
 endif()

config/openiotsdk/chip-gn/args.gni

@@ -31,6 +31,7 @@ chip_system_config_use_lwip = true
 lwip_platform = "external"
 chip_system_config_use_sockets = false
 
+chip_crypto = "mbedtls"
 chip_external_mbedtls = true
 
 custom_toolchain = "${chip_root}/config/openiotsdk/chip-gn/toolchain:openiotsdk"

config/openiotsdk/cmake/chip.cmake

@@ -21,7 +21,7 @@
 
 get_filename_component(GEN_DIR ${CHIP_ROOT}/zzz_generated/ REALPATH)
 
-# Default CHIP build configuration
+# Default CHIP build configuration 
 set(CONFIG_CHIP_PROJECT_CONFIG "main/include/CHIPProjectConfig.h" CACHE STRING "")
 set(CONFIG_CHIP_LIB_TESTS NO CACHE BOOL "")
 set(CONFIG_CHIP_LIB_SHELL NO CACHE BOOL "")
@@ -32,7 +32,6 @@ set(CONFIG_CHIP_AUTOMATION_LOGGING YES CACHE BOOL "Enable logging at automation
 set(CONFIG_CHIP_ERROR_LOGGING YES CACHE BOOL "Enable logging at error level")
 
 set(CONFIG_CHIP_OPEN_IOT_SDK_USE_PSA_PS NO CACHE BOOL "Enable using PSA Protected Storage")
-set(CONFIG_CHIP_CRYPTO "mbedtls" CACHE STRING "Matter crypto backend. Mbedtls as default")
 
 if(CONFIG_CHIP_OPEN_IOT_SDK_USE_PSA_PS AND NOT TFM_SUPPORT)
     message( FATAL_ERROR "You can not use PSA Protected Storage without TF-M support" )
@@ -54,14 +53,8 @@ if(TFM_SUPPORT)
     add_dependencies(chip-gn tfm-ns-interface)
 endif()
 
-if ("${CONFIG_CHIP_CRYPTO}" STREQUAL "psa")
-    target_compile_definitions(chip
-        INTERFACE
-            CONFIG_CHIP_CRYPTO_PSA)
-endif()
-
 function(chip_add_data_model target scope model_name)
-    target_include_directories(${target}
+    target_include_directories(${target} 
         PUBLIC
             ${GEN_DIR}/app-common
             ${GEN_DIR}/${model_name}-app

config/openiotsdk/cmake/sdk.cmake

@@ -27,7 +27,7 @@ get_filename_component(OPEN_IOT_SDK_STORAGE_SOURCE ${CHIP_ROOT}/third_party/open
 # Open IoT SDK targets passed to CHIP build
 list(APPEND CONFIG_CHIP_EXTERNAL_TARGETS)
 
-# Additional Open IoT SDK build configuration
+# Additional Open IoT SDK build configuration 
 set(TFM_SUPPORT NO CACHE BOOL "Add Trusted Firmware-M (TF-M) support to application")
 set(TFM_NS_APP_VERSION "0.0.0" CACHE STRING "TF-M non-secure application version (in the x.x.x format)")
 set(CONFIG_CHIP_OPEN_IOT_SDK_LWIP_DEBUG NO CACHE BOOL "Enable LwIP debug logs")
@@ -82,7 +82,7 @@ if(TFM_SUPPORT)
     set(TFM_PLATFORM ${OPEN_IOT_SDK_EXAMPLE_COMMON}/tf-m/targets/an552)
     set(TFM_PSA_FIRMWARE_UPDATE ON)
     set(MCUBOOT_IMAGE_VERSION_NS ${TFM_NS_APP_VERSION})
-    set(TFM_CMAKE_ARGS "-DCONFIG_TFM_ENABLE_FP=ON;-DTFM_PROFILE=profile_medium;-DTFM_EXCEPTION_INFO_DUMP=ON;-DCONFIG_TFM_HALT_ON_CORE_PANIC=ON;-DTFM_ISOLATION_LEVEL=1;-DTFM_MBEDCRYPTO_PLATFORM_EXTRA_CONFIG_PATH=${OPEN_IOT_SDK_CONFIG}/mbedtls/mbedtls_config_psa.h;-DMBEDCRYPTO_BUILD_TYPE=${CMAKE_BUILD_TYPE};-DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}")
+    set(TFM_CMAKE_ARGS "-DCONFIG_TFM_ENABLE_FP=ON;-DTFM_PROFILE=profile_medium;-DTFM_EXCEPTION_INFO_DUMP=ON;-DCONFIG_TFM_HALT_ON_CORE_PANIC=ON;-DTFM_ISOLATION_LEVEL=1")
     if ("${CMAKE_BUILD_TYPE}" STREQUAL "Debug")
         set(TFM_CMAKE_ARGS "${TFM_CMAKE_ARGS};-DMCUBOOT_LOG_LEVEL=INFO;-DTFM_SPM_LOG_LEVEL=TFM_SPM_LOG_LEVEL_DEBUG;-DTFM_PARTITION_LOG_LEVEL=TFM_PARTITION_LOG_LEVEL_INFO")
     else()
@@ -117,24 +117,24 @@ endif()
 # Add RTOS configuration headers
 # Link cmsis-rtos-api against a concrete implementation
 if(TARGET cmsis-rtos-api)
-    target_include_directories(cmsis-core
-        INTERFACE
+    target_include_directories(cmsis-core 
+        INTERFACE 
             cmsis-config
     )
-
+    
     target_compile_definitions(cmsis-rtos-api
         PUBLIC
             DOMAIN_NS=$<IF:$<BOOL:${TFM_SUPPORT}>,1,0>
     )
 
     if(TARGET freertos-kernel)
-        target_include_directories(freertos-kernel
-            PUBLIC
+        target_include_directories(freertos-kernel 
+            PUBLIC 
                 freertos-config
         )
 
-        target_link_libraries(freertos-kernel
-            PUBLIC
+        target_link_libraries(freertos-kernel 
+            PUBLIC 
                 cmsis-core
         )
 
@@ -250,6 +250,14 @@ if("cmsis-freertos" IN_LIST IOTSDK_FETCH_LIST)
     )
 endif()
 
+if("mbedtls" IN_LIST IOTSDK_FETCH_LIST)
+    list(APPEND CONFIG_CHIP_EXTERNAL_TARGETS
+        mbedtls
+        mbedtls-config
+        mbedtls-threading-cmsis-rtos 
+    )
+endif()
+
 if("lwip" IN_LIST IOTSDK_FETCH_LIST)
     list(APPEND CONFIG_CHIP_EXTERNAL_TARGETS
         lwipcore
@@ -274,15 +282,6 @@ if("trusted-firmware-m" IN_LIST IOTSDK_FETCH_LIST)
     )
 endif()
 
-# Note: Mbed TLS must appear after TF-M otherwise psa from mbed TLS is used
-if("mbedtls" IN_LIST IOTSDK_FETCH_LIST)
-    list(APPEND CONFIG_CHIP_EXTERNAL_TARGETS
-        mbedtls
-        mbedtls-config
-        mbedtls-threading-cmsis-rtos
-    )
-endif()
-
 # Additional Open IoT SDK port components
 
 # Add Open IoT SDK storage source

config/openiotsdk/lwip/user_lwipopts.h

@@ -49,11 +49,6 @@
  */
 #define LWIP_RAW (1)
 
-/**
- * Disable DHCP as the IP6 link local address can be used.
- */
-#define LWIP_DHCP 0
-
 #ifdef LWIP_DEBUG
 
 // Debug Options

config/openiotsdk/mbedtls/mbedtls_config.h

@@ -2692,7 +2692,7 @@
  *           or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
  *
  */
-//#define MBEDTLS_PSA_CRYPTO_C
+#define MBEDTLS_PSA_CRYPTO_C
 
 /**
  * \def MBEDTLS_PSA_CRYPTO_SE_C
@@ -3313,8 +3313,8 @@
 //#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT      384 /**< Maximum size of (re)seed buffer */
 
 /* ECP options */
-#define MBEDTLS_ECP_WINDOW_SIZE 6       /**< Maximum window size used */
-#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
+//#define MBEDTLS_ECP_WINDOW_SIZE            4 /**< Maximum window size used */
+//#define MBEDTLS_ECP_FIXED_POINT_OPTIM      1 /**< Enable fixed-point speed-up */
 
 /* Entropy options */
 //#define MBEDTLS_ENTROPY_MAX_SOURCES                20 /**< Maximum number of sources supported */