CI for Build/Testing on PPC64BE (#1318)

Add CI for build and testing of ppc64 (big-endian).

.github/workflows/cross-ppc64.yml

@@ -0,0 +1,18 @@
+name: PPC64BE Build & Test
+on:
+  push:
+    branches: [ '*' ]
+  pull_request:
+    branches: [ '*' ]
+concurrency:
+  group: ppc64be-${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+jobs:
+  ppc64-build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install qemu
+        run: sudo apt-get -y install qemu-user qemu-user-binfmt
+      - uses: actions/checkout@v4
+      - name: Build/Test
+        run: tests/ci/run_cross_ppc64_tests.sh

.gitignore

@@ -39,3 +39,4 @@ symbols.txt
 .idea/
 .fleet/
 .cache/
+/CMakePresets.json

crypto/fipsmodule/bn/bytes.c

@@ -212,6 +212,9 @@ void bn_assert_fits_in_bytes(const BIGNUM *bn, size_t num) {
   size_t tot_bytes = bn->width * sizeof(BN_ULONG);
   if (tot_bytes > num) {
     CONSTTIME_DECLASSIFY(bytes + num, tot_bytes - num);
+// Avoids compiler error: unused variable 'byte' or 'word'
+// The assert statements below are only effective in DEBUG builds
+#ifndef NDEBUG
 #ifdef OPENSSL_BIG_ENDIAN
     for (int i = num / BN_BYTES; i < bn->width; i++) {
       BN_ULONG word = bn->d[i];
@@ -229,6 +232,7 @@ void bn_assert_fits_in_bytes(const BIGNUM *bn, size_t num) {
     for (size_t i = num; i < tot_bytes; i++) {
       assert(bytes[i] == 0);
     }
+#endif
 #endif
     (void)bytes;
   }

tests/ci/common_posix_setup.sh

@@ -1,19 +1,23 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0 OR ISC
 
+SRC_ROOT="$(pwd)"
 if [ -v CODEBUILD_SRC_DIR ]; then
   SRC_ROOT="$CODEBUILD_SRC_DIR"
-else
-  SRC_ROOT=$(pwd)
+elif [ "$(basename "${SRC_ROOT}")" != 'aws-lc' ]; then
+  SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+  SRC_ROOT="${SCRIPT_DIR}/../.."
 fi
-echo "$SRC_ROOT"
+SRC_ROOT="$(readlink -f "${SRC_ROOT}")"
+echo SRC_ROOT="$SRC_ROOT"
+
+SYS_ROOT="$(readlink -f "${SRC_ROOT}/..")"
+echo SYS_ROOT="$SYS_ROOT"
 
-cd ../
-SYS_ROOT=$(pwd)
 cd $SRC_ROOT
 
 BUILD_ROOT="${SRC_ROOT}/test_build_dir"
-echo "$BUILD_ROOT"
+echo BUILD_ROOT="$BUILD_ROOT"
 
 PLATFORM=$(uname -m)
 

tests/ci/gtest_util.sh

@@ -0,0 +1,31 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
+function shard_gtest() {
+    export GTEST_TOTAL_SHARDS=$(nproc --all)
+    if [ -n "${2}" ]; then
+        GTEST_TOTAL_SHARDS="${2}"
+    fi
+    if [ -z ${GTEST_TOTAL_SHARDS} -o ${GTEST_TOTAL_SHARDS} -lt 1 ]; then
+        GTEST_TOTAL_SHARDS=4
+    fi
+
+    echo shard_gtest-Command: ${1}
+    PIDS=()
+    COUNTER=0
+    while [ $COUNTER -lt $GTEST_TOTAL_SHARDS ]; do
+        export GTEST_SHARD_INDEX=$COUNTER
+        ${1} &
+        PIDS[${COUNTER}]=$!
+        COUNTER=$(( COUNTER+1 ))
+    done
+
+    RESULT=0
+    for PID in ${PIDS[*]}; do
+        wait -f $PID
+        if "${?}" -ne "0"; then
+          RESULT=${?}
+        fi
+    done
+    return $RESULT
+}

tests/ci/run_cross_ppc64_tests.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
+set -ex
+
+SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+SCRIPT_DIR="$(readlink -f "${SCRIPT_DIR}")"
+
+source "${SCRIPT_DIR}/common_posix_setup.sh"
+source "${SCRIPT_DIR}/gtest_util.sh"
+
+# Assumes script is executed from the root of aws-lc directory
+SCRATCH_FOLDER="${SYS_ROOT}/SCRATCH_PPC64"
+
+if [ -e "${SCRATCH_FOLDER}" ]; then
+    # Some directories in the archive lack write permission, preventing deletion of files
+    chmod +w -R "${SCRATCH_FOLDER}"
+    rm -rf "${SCRATCH_FOLDER}"
+fi
+mkdir -p "${SCRATCH_FOLDER}"
+
+pushd "${SCRATCH_FOLDER}"
+
+wget -q https://aws-libcrypto.s3.us-west-2.amazonaws.com/cross-compile-toolchains/host-x86_64-pc-linux-gnu/ppc64-x-tools.tar.xz
+tar Jxf ppc64-x-tools.tar.xz --no-same-owner --no-same-permissions
+
+cat <<EOF > ppc64.cmake
+# Specify the target system
+set(CMAKE_SYSTEM_NAME Linux)
+set(CMAKE_SYSTEM_PROCESSOR ppc64)
+
+# Specify the cross-compiler
+set(CMAKE_C_COMPILER ${SCRATCH_FOLDER}/powerpc64-unknown-linux-gnu/bin/powerpc64-unknown-linux-gnu-gcc)
+set(CMAKE_CXX_COMPILER ${SCRATCH_FOLDER}/powerpc64-unknown-linux-gnu/bin/powerpc64-unknown-linux-gnu-g++)
+
+# Specify the sysroot for the target system
+set(CMAKE_SYSROOT ${SCRATCH_FOLDER}/powerpc64-unknown-linux-gnu/powerpc64-unknown-linux-gnu/sysroot)
+set(CMAKE_SYSTEM_INCLUDE_PATH ${SCRATCH_FOLDER}/powerpc64-unknown-linux-gnu/powerpc64-unknown-linux-gnu/sysroot/usr/include)
+
+set(ENABLE_EXPERIMENTAL_BIG_ENDIAN_SUPPORT true)
+set(CMAKE_GENERATOR Ninja)
+EOF
+
+export QEMU_LD_PREFIX="${SCRATCH_FOLDER}/powerpc64-unknown-linux-gnu/powerpc64-unknown-linux-gnu/sysroot"
+export LD_LIBRARY_PATH="${SCRATCH_FOLDER}/powerpc64-unknown-linux-gnu/powerpc64-unknown-linux-gnu/sysroot/lib"
+
+echo "Testing AWS-LC shared library for PPC64 big-endian."
+
+BUILD_OPTIONS=()
+BUILD_OPTIONS+=("-DCMAKE_BUILD_TYPE=Release")
+# TODO: Investigate issues with the FIPS build for ppc64be
+#BUILD_OPTIONS+=("-DCMAKE_BUILD_TYPE=Release -DFIPS=1 -DBUILD_SHARED_LIBS=1")
+
+for BO in "${BUILD_OPTIONS[@]}"; do
+  run_build -DCMAKE_TOOLCHAIN_FILE="${SCRATCH_FOLDER}/ppc64.cmake" ${BO}
+
+  shard_gtest "${BUILD_ROOT}/crypto/crypto_test --gtest_also_run_disabled_tests"
+  shard_gtest ${BUILD_ROOT}/crypto/urandom_test
+  shard_gtest ${BUILD_ROOT}/crypto/mem_test
+  shard_gtest ${BUILD_ROOT}/crypto/mem_set_test
+
+  shard_gtest ${BUILD_ROOT}/ssl/ssl_test
+  shard_gtest ${BUILD_ROOT}/ssl/integration_test
+
+  # Due to its special linkage, this is now a Google Test
+  ${BUILD_ROOT}/crypto/dynamic_loading_test
+done
+popd