Large Refactoring (#95)

* wip: Share parsed `mbedtls_x509_crt` and `mbedtls_pk_context` between sessions

* feat: Add no-copy support for X509 parsing. Expose auth_mode parameter

- Session now exposes an optional `auth_mode` parameter to select the
certificate verification mode.
- Update Certificates to handle no-copy variants of certificates
parsing.
- Add DER certificates for testing no-copy variants

* refactor: Use struct to pass configuration to a session

* feat: Expose parsed X509 certificates and add extra impls to generated bindings

* fix: Improve lifetime management for Session certificates

- Remove duplicate justfile step for faster building

* refactor: Use `mbedtls_calloc()` and `mbedtls_free()` alias for memory management

* feat: Make `Certificates` Send

* chore: auto-push built libraries

* refactor: Make `Certificates` take references

* Unify everything into SessionConfig

* Option to split the async session into a read and write halves

* External rng; support for defmt

* defmt

* Make the async code non-optional

* Split into modules

* Move examples into their own crates; remove esp-hal dependencies from the examples; STD examples; testing and bugfixing

* Streamline the error story; apply Clippy

* New HAL-neutral HW-accel framework

* Restore the workspace Cargo.toml and the xtask alias

* esp - expmod

* Re-export the sys crate

* Make the build of esp-mbedtls-sys cpu-arch-specific but NOT mcu-specific

* Move all hooking and HW accel to esp-mbedtls-sys

* Move the self-tests to esp-mbedtls-sys

* Update READMEs

* Fix merr to return the non-negative result

* Restore the crypto self tests on the esp32 chips (with HW accel)

* Enlarge sha work area sizes for esp32

* Bugfixing

* Reduce the accel installation noise

* Fix software fallbacks for xtensa and riscv32

* Fix the exp_mod return type

* esp server example

* Unify the embassy_net bootstrapping code for all esp examples

* Working esp server examples

* Update certs and examples READMEs

* Replace all mentions of OpenThread with MbedTLS

* Install and run espup manually so that we enable the Espressif RISCV toolchain

* Fix CI

* Clippy

* fmt; fix CI

* Fix CI

* Address code review comments

* Rename a forgotten openthread mentioning

* Fix a typo

* Address review feedback

* Do not allocate larger space for sha, because sha HW accel is not enabled for the esp32 anyway

* Always build esp-hal with opt-level 3 as this affects HW accel

---------

Co-authored-by: Anthony Grondin <[email protected]>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: 3 people

.cargo/config.toml

@@ -1,89 +1,2 @@
-[build]
-# Build on host
-#target = "x86_64-unknown-linux-gnu"
-# Build on target firmware with baremetal
-#target = "xtensa-esp32-none-elf"
-#target = "xtensa-esp32s2-none-elf"
-#target = "xtensa-esp32s3-none-elf"
-#target = "riscv32imc-unknown-none-elf"
-# Build on target firmware with ESP IDF
-#target = "xtensa-esp32-espidf"
-#target = "xtensa-esp32s2-espidf"
-#target = "xtensa-esp32s3-espidf"
-#target = "riscv32imc-esp-espidf"
-
-[target.xtensa-esp32-none-elf]
-runner = "espflash flash --monitor --baud 921600"
-
-rustflags = [
-  "-C", "link-arg=-Tlinkall.x",
-  "-C", "link-arg=-nostartfiles",
-]
-
-[target.riscv32imc-unknown-none-elf]
-runner = "espflash flash --monitor --baud 921600"
-
-rustflags = [
-  "-C", "link-arg=-Tlinkall.x",
-
-  # Required to obtain backtraces (e.g. when using the "esp-backtrace" crate.)
-  # NOTE: May negatively impact performance of produced code
-  "-C", "force-frame-pointers",
-]
-
-[target.riscv32imac-unknown-none-elf]
-runner = "espflash flash --monitor --baud 921600"
-
-rustflags = [
-  "-C", "link-arg=-Tlinkall.x",
-
-  # Required to obtain backtraces (e.g. when using the "esp-backtrace" crate.)
-  # NOTE: May negatively impact performance of produced code
-  "-C", "force-frame-pointers",
-]
-
-[target.xtensa-esp32s2-none-elf]
-runner = "espflash flash --monitor --baud 921600"
-
-rustflags = [
-    #"-C", "linker=rust-lld",    
-    "-C", "link-arg=-Tlinkall.x",
-]
-
-[target.xtensa-esp32s3-none-elf]
-runner = "espflash flash --monitor --baud 921600"
-
-rustflags = [
-  "-C", "link-arg=-Tlinkall.x",
-  "-C", "link-arg=-nostartfiles",
-]
-
-[target.'cfg(target_os = "espidf")']
-linker = "ldproxy"
-runner = "espflash flash --monitor"
-rustflags = [ "--cfg",  "espidf_time64"]
-
-[unstable]
-# Enable this when building for baremetal
-build-std = ["core", "alloc"]
-# Enable this when building on the host machine or for ESP-IDF
-#build-std = ["std", "panic_abort"]
-
 [alias]
 xtask = "run --manifest-path ./xtask/Cargo.toml --"
-
-
-# Alias' for quickly building for different chips or running examples
-# By default we enable
-#   - `default` HAL features to set up basic chip specific settings
-esp32 =   "run --release --features   esp32 --target xtensa-esp32-none-elf        --features esp-hal/default"
-esp32s2 = "run --release --features esp32s2 --target xtensa-esp32s2-none-elf      --features esp-hal/default"
-esp32s3 = "run --release --features esp32s3 --target xtensa-esp32s3-none-elf      --features esp-hal/default"
-esp32c3 = "run --release --features esp32c3 --target riscv32imc-unknown-none-elf  --features esp-hal/default"
-esp32c6 = "run --release --features esp32c6 --target riscv32imac-unknown-none-elf  --features esp-hal/default"
-
-besp32 =   "build --release --features   esp32 --target xtensa-esp32-none-elf        --features esp-hal/default"
-besp32s2 = "build --release --features esp32s2 --target xtensa-esp32s2-none-elf      --features esp-hal/default"
-besp32s3 = "build --release --features esp32s3 --target xtensa-esp32s3-none-elf      --features esp-hal/default"
-besp32c3 = "build --release --features esp32c3 --target riscv32imc-unknown-none-elf  --features esp-hal/default"
-besp32c6 = "build --release --features esp32c6 --target riscv32imac-unknown-none-elf  --features esp-hal/default"

.github/workflows/ci.yml

@@ -1,9 +1,9 @@
-# This CI optionally builds libraries and then builds examples against them.
+# This CI builds the `esp-mbedtls*` crates and their examples.
 #
 # If a change is detected within `esp-mbedtls-sys/`, a rebuild is triggered and this CI will automatically
 # rebuild the libraries using the xtask. Then the tests are executed against the rebuilt libraries.
 #
-# If no rebuild occurs, the tests are executed against the current libraries.
+# If no rebuild occurs, the examples are built against the latest libraries present in the main branch.
 #
 # The libraries are pushed on either of these conditions:
 # 1. The PR is labelled with `rebuild-libs`.
@@ -12,7 +12,7 @@
 #    When pushing a PR that would trigger a rebuild, the libraries get automatically
 #    pushed to the main branch after successful testing.
 
-name: Build (optional) and test examples
+name: CI
 
 on:
   pull_request:
@@ -41,14 +41,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
 
 jobs:
-  build-test:
+  build:
+    name: Build
     runs-on: ubuntu-latest
     permissions: read-all
-    outputs:
-      upload-libs: ${{ steps.detect-changes.outputs.libs == 'true' }}
 
     steps:
-      # ==== Setup ====
       - uses: actions/checkout@v4
 
       - name: mbedtls init
@@ -60,11 +58,57 @@ jobs:
           toolchain: stable
           components: rust-src,rustfmt
 
-      - uses: Swatinem/rust-cache@v2
+      # TODO: Double-check and uncomment
+      # - uses: Swatinem/rust-cache@v2
+      #   with:
+      #     workspaces: |
+      #       ./
+      #       xtask
+
+      - name: Fmt Check
+        run: cargo fmt -- --check
+
+      - name: Clippy
+        run: cargo clippy -- -D warnings
+
+      - name: Build
+        run: cargo build
+
+      - name: Fmt Check - STD Examples
+        run: cd examples/std; cargo fmt -- --check
+
+      - name: Clippy - STD Examples
+        run: cd examples/std; cargo clippy -- -D warnings
+
+      - name: Build - STD Examples
+        run: cd examples/std; cargo build
+
+  build-mbedtls:
+    name: Build MbedTLS
+    runs-on: ubuntu-latest
+    permissions: read-all
+    needs: build
+    outputs:
+      upload-libs: ${{ steps.detect-changes.outputs.libs == 'true' }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: mbedtls init
+        run: git submodule update --init --recursive
+
+      - uses: dtolnay/rust-toolchain@v1
         with:
-          workspaces: |
-            ./
-            xtask
+          target: x86_64-unknown-linux-gnu
+          toolchain: nightly
+          components: rust-src,rustfmt
+
+      # TODO: Double-check and uncomment
+      # - uses: Swatinem/rust-cache@v2
+      #   with:
+      #     workspaces: |
+      #       ./
+      #       xtask
 
       - name: Detect esp-mbedtls-sys/ changes
         uses: dorny/paths-filter@v3
@@ -74,41 +118,51 @@ jobs:
             libs:
               - 'esp-mbedtls-sys/**'
 
-      - name: Install Rust for Xtensa and Espressif LLVM installation (optional)
-        uses: esp-rs/[email protected]
-        with:
-          ldproxy: true
-          override: false
-          extended-llvm: ${{
-            steps.detect-changes.outputs.libs == 'true' ||
-            contains(github.event.pull_request.labels.*.name, 'rebuild-libs')
-            }}
-
-      # ==== Build libs ====
-      - name: Build libraries and bindings
+      - name: Detect host target triple
+        run: |
+          export HOST_TARGET=$(rustup show | grep "Default host" | sed -e 's/.* //')
+          echo "HOST_TARGET=$HOST_TARGET" >> $GITHUB_ENV
+
+      - name: Install espup
+        run: |
+          curl -LO https://github.com/esp-rs/espup/releases/latest/download/espup-${{ env.HOST_TARGET }}.zip
+          unzip -o espup-${{ env.HOST_TARGET }}.zip -d "$HOME/.cargo/bin"
+          chmod +x "$HOME/.cargo/bin/espup"*
+          echo "ESPUP_EXPORT_FILE=$HOME/exports" >> $GITHUB_ENV
+
+      - name: Install espup toolchains (xtensa and riscv)
+        run: |
+          source "$HOME/.cargo/env"
+          "$HOME/.cargo/bin/espup" install -e -r
+          source "$HOME/exports"
+          echo "$PATH" >> "$GITHUB_PATH"
+          echo "LIBCLANG_PATH=${LIBCLANG_PATH}" >> "$GITHUB_ENV"
+          echo "CLANG_PATH=${CLANG_PATH}" >> "$GITHUB_ENV"
+  
+# TODO: Remove the manual espup installation and run once the action below
+# supports the `-r` flag to install the Espressif RISCV GCC toolchain
+# See https://github.com/esp-rs/xtensa-toolchain/issues/45 for more info
+#      - name: Install Rust for Xtensa and Espressif LLVM installation (optional)
+#        uses: esp-rs/[email protected]
+#        with:
+#          ldproxy: true
+#          override: false
+#          extended-llvm: ${{
+#            steps.detect-changes.outputs.libs == 'true' ||
+#            contains(github.event.pull_request.labels.*.name, 'rebuild-libs')
+#            }}
+
+      - name: Build MbedTLS libraries and bindings
         if: |
           steps.detect-changes.outputs.libs == 'true' ||
           contains(github.event.pull_request.labels.*.name, 'rebuild-libs')
         run: |
           rm -rf esp-mbedtls-sys/libs/*
-          cargo +stable xtask gen
-
-      # ==== Test ====
-      # If the libs are rebuilt, the tests are executed against the new libraries,
-      # else they get executed against the latest version in HEAD
-
-      # Tests requires nightly riscv32imc-unknown-none-elf to be installed
-      - uses: dtolnay/rust-toolchain@v1
-        with:
-          target: riscv32imc-unknown-none-elf
-          toolchain: nightly
-          components: rust-src,rustfmt
-      - uses: extractions/setup-just@v1
-        with:
-          just-version: 1.13.0
-
-      - name: check
-        run: just
+          cargo +stable xtask gen xtensa-esp32-none-elf
+          cargo +stable xtask gen xtensa-esp32s2-none-elf
+          cargo +stable xtask gen xtensa-esp32s3-none-elf
+          cargo +stable xtask gen -e riscv32imc-unknown-none-elf
+          cargo +stable xtask gen -e riscv32imac-unknown-none-elf
 
       - name: Upload libraries artifacts for commit
         if: |
@@ -123,17 +177,77 @@ jobs:
             esp-mbedtls-sys/libs
             esp-mbedtls-sys/src
 
+  build-mcu:
+    name: Build-MCU
+    runs-on: ubuntu-latest
+    permissions: read-all
+    needs: build-mbedtls
+    strategy:
+      fail-fast: false
+      matrix:
+        mcu:
+          - [esp, esp32, xtensa-esp32-none-elf]
+          - [esp, esp32s2, xtensa-esp32s2-none-elf]
+          - [esp, esp32s3, xtensa-esp32s3-none-elf]
+          - [esp, esp32c2, riscv32imc-unknown-none-elf]
+          - [esp, esp32c3, riscv32imc-unknown-none-elf]
+          - [esp, esp32c6, riscv32imac-unknown-none-elf]
+# No Wifi support on esp32h2
+#          - [esp, esp32h2, riscv32imac-unknown-none-elf]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@v1
+        with:
+          target: x86_64-unknown-linux-gnu
+          toolchain: nightly
+          components: rust-src,rustfmt,clippy
+
+      - name: Install MCU target
+        if: startsWith(matrix.mcu[2], 'riscv32')
+        run: rustup target add ${{ matrix.mcu[2] }}
+
+      - name: Install Rust for Xtensa
+        if: startsWith(matrix.mcu[2], 'xtensa-')
+        uses: esp-rs/[email protected]
+        with:
+          default: true
+          ldproxy: false
+
+      # TODO: Double-check and uncomment
+      # - uses: Swatinem/rust-cache@v2
+      #   with:
+      #     workspaces: |
+      #       ./
+      #       xtask
+
+      - name: Clippy
+        run: cargo clippy --features accel-${{ matrix.mcu[1] }} --target ${{ matrix.mcu[2] }} -Zbuild-std=core,alloc,panic_abort -- -D warnings
+
+      - name: Build
+        run: cargo build --features accel-${{ matrix.mcu[1] }} --target ${{ matrix.mcu[2] }} -Zbuild-std=core,alloc,panic_abort
+
+      - name: Fmt Check - Examples
+        run: cd examples/${{ matrix.mcu[0] }}; cargo fmt -- --check
+
+      - name: Clippy - Examples
+        run: export WIFI_SSID=ssid; export WIFI_PASS=pass; cd examples/${{ matrix.mcu[0] }}; cargo clippy --no-default-features --features ${{ matrix.mcu[1] }} --target ${{ matrix.mcu[2] }} -Zbuild-std=core,alloc,panic_abort -- -D warnings
+
+      - name: Build - Examples
+        run: export WIFI_SSID=ssid; export WIFI_PASS=pass; cd examples/${{ matrix.mcu[0] }}; cargo build --no-default-features --features ${{ matrix.mcu[1] }} --target ${{ matrix.mcu[2] }} -Zbuild-std=core,alloc,panic_abort
+
   # If libraries are rebuilt and tests are successful, we upload them in a specific job
   # that has write access to prevent security breaches, and unwanted use of the token
   commit-libs:
+    name: Commit MbedTLS libs
     runs-on: ubuntu-latest
     permissions:
       contents: write
-    needs: build-test
+    needs: build-mcu
     # TODO: Currently GitHub doesn't allow pushing to a forked repo's branch when running an action on a PR to upstream.
     if: |
       github.event.pull_request.head.repo.full_name == github.repository &&
-      ((needs.build-test.outputs.upload-libs &&
+      ((needs.build-mbedtls.outputs.upload-libs &&
       github.ref == 'refs/heads/main') ||
       contains(github.event.pull_request.labels.*.name, 'rebuild-libs'))
     steps: