Commit Graph

439 Commits (aecf9049782835fc28dff1341cc0910a7305816e)

Author SHA1 Message Date
aidan garske b9bd6dae17 Add WOLFCRYPT_TZ_WOLFHSM TrustZone engine for STM32H5 2026-06-24 15:49:43 -07:00
David Garske dd4fc26df8
Merge pull request #803 from rizlik/tpm_mfg_auth_value
IDevID: allow using pre-computed auth values
2026-06-22 08:49:25 -07:00
Marco Oliverio 0438c54c9b tpm: rename masterPassword param to authOverride 2026-06-18 11:06:18 +02:00
Marco Oliverio cb56e866b6 tpm: remove trailing whitespace in MFG identity docs 2026-06-18 10:45:13 +02:00
Marco Oliverio 801ae8f1ca tpm: DevId identity allow to use precomputed auth values
Allow to either use a master different that the sample one or to
directly use the pre-computed per-device auth values for EH and AIK.
Using the per-device value is preferred as it doesn't expose the auth
value of the sibling devices in the same fleet.
2026-06-17 15:46:34 +02:00
Brett Nicholas b52dd5a1d0 make wolfHSM client ID parameterizable and settable via Makefiles 2026-06-16 22:03:28 -06:00
Brett Nicholas 7195bd8008 remove unnecessary wolfHSM PUBKEY_ID macro 2026-06-16 22:03:28 -06:00
David Garske 7cdfb4266a NXP T2080 / CW VPX3-152: VxWorks 7 64-bit boot support
Add wolfBoot support for booting VxWorks 7 SMP 64-bit (and signed ELF
images) on the NXP T2080 (e6500) / Curtiss-Wright VPX3-152.

Key fix: bring up the e6500 cluster L2 cache in the correct order -- set
L2PE (ECC) in its own polled write BEFORE enabling L2E, with L2FI|L2LFC --
matching CW U-Boot (SDK2.0). The previous bare-L2E init left the L2 ECC
array uninitialized for the kernel's 0x1E0000 set, machine-checking VxWorks
(MCSR[IF], L2ERRDET MBECC).

Also: ePAPR spin-table SMP bring-up of all four cores, ELF in-place loader
staging-overlap fix, DPAA/LIODN + QMan/BMan init, 64-bit OS handoff
(LAW/TLB/IVOR), and NAII 68PPC2 + CW VPX3-152 board configs.
2026-06-15 06:13:28 +02:00
Alex Lanzano 01c52d87e8 remove wolfhal TARGET. Add WOLFHAL option 2026-06-10 17:12:25 +02:00
Alex Lanzano 125872c571 Create STM32WB wolfHAL example. GC sections on all test apps 2026-06-10 17:12:25 +02:00
David Garske 14f6e4a298 Add wolfBoot FIT support for loading bitstream 2026-06-09 15:30:27 +02:00
David Garske c075549ea2 Add wolfBoot support for STM32G4 2026-05-29 13:10:15 +02:00
David Garske 9786f5608b Add wolfBoot port for STM32N6 (NUCLEO-N657X0-Q)
Co-authored-by: Aidan Garske <aidan@wolfssl.com>
2026-05-28 16:49:57 +02:00
Brett Nicholas a1f86fa1c2 expose root CA list as makefile var 2026-05-26 17:37:50 +02:00
Brett Nicholas b8bc0a75e5 Add support for wolfHSM multi-root certificate verification 2026-05-26 17:37:50 +02:00
Yosuke Shimizu f4d5340641 Add hardware-based DICE on mcxn 2026-05-21 20:49:20 +02:00
Tobias Frauenschläger 6e60abd034 Continue the ML-DSA renaming 2026-05-19 11:21:20 -07:00
David Garske b94954eab4 Add Xilinx Zynq-7000 (ZC702) wolfBoot port 2026-05-12 12:06:05 +02:00
Mattia Moffa 8a70a83039 Change ECC partitioning 2026-05-07 21:39:34 +02:00
Mattia Moffa dc6cfaaf83 Kinetis KL26 port 2026-05-07 21:39:34 +02:00
David Garske af40ae1471 Add STM32C5 target (NUCLEO-C5A3ZG) 2026-05-06 19:02:58 +02:00
David Garske d92053037c Fixes from peer review (Thank you Daniele and Marco) 2026-05-05 10:16:16 +02:00
David Garske 85fb32b1dd Fixes from peer review. Thank you Alex 2026-05-05 10:16:16 +02:00
David Garske afb9389c1d Peer review fixes 2026-05-05 10:16:16 +02:00
David Garske 5c29938ba3 docs: document FIT compressed and ramdisk paths for ZynqMP/Versal/PolarFire
PolarFire MPFS250, Versal VMK180, and ZynqMP "Booting PetaLinux"
walkthroughs now describe both options for handing PetaLinux off through
the FIT image:

  * Option A (default GZIP=1): set compression="gzip" in the .its,
    point data at Image.gz / linux.bin.gz, and let mkimage build the
    FIT directly. wolfBoot decompresses straight to the kernel load
    address at boot and verifies hash-1.
  * Option B (GZIP=0): keep the existing host-side gzip -cdvk /
    gunzip step and compression="none" in the .its.

ZynqMP also gains a "FIT ramdisk (initramfs)" subsection covering
RAMDISK=1, WOLFBOOT_LOAD_RAMDISK_ADDRESS, the commented-out opt-in
block in zynqmp_sdcard.config, gzip ramdisk support, and a sample ITS
layout with kernel + DTB + ramdisk subimages.
2026-05-05 10:16:16 +02:00
David Garske cbaecdd5d8 Peer review fixes + ZynqMP robustness improvements
hal/zynq.c:
  - Route IOU_TAPDLY_BYPASS writes through pmu_request at EL<=2 in the
    <=40 MHz and <=100 MHz branches (previously only done at <=150 MHz);
    the register is equally unwritable from EL2/EL1 at lower clocks.
  - Add qspi_flash_reset() (RESET_ENABLE 0x66 + RESET_MEMORY 0x99),
    called per chip in qspi_init so the flash starts from a known state
    regardless of what FSBL/BootROM left behind (XIP, 4-byte addr,
    auto-boot).
  - Drop unused 'reg' in csu_aes and 'ms' in csu_init so
    -Werror=unused-variable builds (OPTIMIZATION_LEVEL=0 / DEBUG=1) pass.

hal/zynq.ld:
  - Move wolfBoot ORIGIN from 0x08000000 to 0x10000000. Large FIT images
    (kernel load=0x00200000, payload >~126 MB) would sweep across
    0x08000000 at handoff and overwrite wolfBoot's own code.

tools/scripts/zcu102/zcu102-ca53-qspi.cmm:
  - Rewrite against the Lauterbach TRACE32 ZCU102 QSPI demo: PREPAREONLY
    entry mode, single/dual toggle, READ_ID_TEST, separate flash dialogs
    for BOOT.BIN (offset 0) and test-app/image_v1_signed.bin.
  - Document the ~128 MB TRACE32 temp-memory ceiling on FLASHFILE.Create:
    larger files must be split externally and loaded in chunks.
2026-04-28 14:55:06 +02:00
David Garske f2fe1f42fa ZynqMP ZCU102 SD-card boot fixes 2026-04-28 14:55:06 +02:00
David Garske c2f187dadd ZynqMP ZCU102 SD-card Linux boot: EL2 cleanup, DTS bootargs, SDHCI init
Add the pieces needed to boot Linux end-to-end from the ZCU102 SD card
with wolfBoot at EL2:

* src/boot_aarch64_start.S: new el2_flush_and_disable_mmu helper that
  cleans D-cache to PoC, invalidates I-cache to PoU, and clears
  SCTLR_EL2.{M,C,I}, then returns. Satisfies the ARM64 Linux boot
  protocol and is also correct for any other payload that sets up its
  own translation (hypervisor, RTOS, later bootloader stage).
* src/boot_aarch64.c: call el2_flush_and_disable_mmu from do_boot() on
  the EL2 direct-jump path before falling through to the br x4 block.
  Also pull in hal/zynq.h and hal/nxp_ls1028a.h so the EL_HYPERVISOR /
  BOOT_EL1 guards compile for those targets.
* hal/zynq.c: implement hal_dts_fixup() — set /chosen/bootargs from
  LINUX_BOOTARGS (with a LINUX_BOOTARGS_ROOT default of /dev/mmcblk0p4)
  and grow DTB totalsize by 512 bytes to give fdt_setprop() headroom
  (matches hal/versal.c). Add hal_get_timer_us() via CNTPCT_EL0.
* src/sdhci.c: add a 1 ms settling delay after sdhci_platform_init()
  and a CMD0 retry loop (up to 10 x 10 ms) so the ZCU102 Arasan
  controller reliably detects the card after the slot-type change +
  soft reset.
* config/examples/zynqmp_sdcard.config: stay at EL2 by default (comment
  out BOOT_EL1), default rootfs to /dev/mmcblk0p4, turn DEBUG off.
* hal/versal.c: correct the default LINUX_BOOTARGS_ROOT to
  /dev/mmcblk0p4 to match the shipped MBR layout.
* docs/Targets.md: note the unconditional EL2 cleanup in the ZynqMP
  and Versal SD-card sections.

Behavior change: non-Linux AArch64 EL2 payloads now enter with MMU
off and caches clean instead of inheriting wolfBoot's tables. No
in-tree payload relies on the old state leakage.
2026-04-28 14:55:06 +02:00
Thomas Cook 65be872436 Some doc updates. 2026-04-27 17:30:42 +02:00
Thomas Cook 994fe009de Update target doc 2026-04-27 17:30:42 +02:00
David Garske 284a1d5eb9 Peer review fixes 2026-04-27 17:00:41 +02:00
David Garske 980022de13 Add wolfBoot port for STM32U3 (NUCLEO-U385RG-Q)
New HAL port for the STM32U3 family (Cortex-M33, no TrustZone,
1MB dual-bank flash with 4KB pages, 64-bit double-word writes).

Features:
- hal/stm32u3.c, hal/stm32u3.h, hal/stm32u3.ld: flash driver,
  clock init (96 MHz MSIRC0 via EPOD booster), inline UART, ICACHE
- config/examples/stm32u3.config: ECC384/SHA384, DEBUG_UART=1,
  NVM_FLASH_WRITEONCE=1, RAM_CODE=1, dual-bank layout
- test-app/app_stm32u3.c: LED blink + UART output + version check
- tools/scripts/prepare_update_u3.sh: v2 pBOOT update image builder
- docs/Targets.md: STM32U3 section with build/flash/update instructions
- CI: stm32u3_test job + Clang rebuild coverage

Tested on NUCLEO-U385RG-Q:
- Verified boot with ECC384/SHA384 signature
- 96 MHz clock (MSIRC0 + SMPS + EPOD booster + VOS1)
- UART output on USART1 PA9/PA10 (ST-LINK VCP)
- TEST_FLASH erase/write/readback on both flash banks
- A/B firmware update (v1 -> v2 swap with pBOOT trigger)
2026-04-27 17:00:41 +02:00
David Garske 8b7ce4e4dd
Merge pull request #756 from danielinux/fTPM-TZ
Added support for fwTPM in TrustZone + STM32H5 test app
2026-04-22 14:10:19 -07:00
David Garske 3c11bf3f55 Peer review fixes 2026-04-22 19:08:00 +02:00
David Garske 5d71feb4ef PolarFire SoC M-Mode: Fix L2 scratchpad init, QSPI programmer, and add WDT support 2026-04-22 19:08:00 +02:00
Daniele Lacamera cffa75d4a4 Proper interface renaming + documentation 2026-04-22 14:14:28 +02:00
David Garske 00313b3e43 Rename LPC54S018M to LPC54S0XX 2026-04-22 14:10:55 +02:00
David Garske eee953f823 Add tests and improve docs 2026-04-22 14:10:55 +02:00
David Garske 2831b6dadd Expand documentation for the enhaced boot block 2026-04-22 14:10:55 +02:00
Aidan Garske 9673509c04 Clean up NXP LPC54S018M port and align with LPC55S69 patterns
- HAL: Remove debug spifi_test_mode_switch(), use wolfBoot_printf
    instead of raw uart_write, add printf.h include
  - Test app: Use check_parts() (was defined but unused), replace
    custom print_str/print_hex32 with wolfBoot_printf, fix LED logic
    to show LED1 for v1 and LED2 for v2+ (was always LED1)
  - Docs: Remove incorrect MCUXpresso SDK section (port is bare-metal),
    fix typo, add swap timing note, add flash script references
  - Build: Add --no-warn-rwx-segments to arch.mk, improve Makefile
    comments
  - Add tools/scripts/nxp-lpc54s018m-flash.sh following the
    nxp-s32k142-flash.sh pattern (build, sign, flash via pyocd)

  Tested: full boot + firmware update cycle (v1 -> v2 swap) verified
  on LPC54S018M-EVK hardware.
2026-04-22 14:10:55 +02:00
David Garske 91145d53bb Add wolfBoot support for NXP LPC54S018M-EVK 2026-04-22 14:10:55 +02:00
Brett Nicholas f7ea40f7cc Add oneshot hash build option 2026-04-17 08:25:51 +02:00
Daniele Lacamera 776378ca78 Preparing release v2.8.0 + update copyright 2026-04-16 13:11:56 +02:00
Daniele Lacamera b705ca74ae Warn when DISABLE_BACKUP is enabled
F/2257
2026-04-08 19:53:50 +02:00
David Garske a56c70e90a Support for NXP T1040 RDB 2026-03-20 14:51:15 +01:00
Mattia Moffa 175d2b3026 Update documentation 2026-03-18 22:38:17 +01:00
Mattia Moffa b5fab30310 Enable NSC veneers when TZEN=1, even without WOLFCRYPT_TZ 2026-03-18 22:26:32 +01:00
Thomas Cook 3b1ef9d6bc Address copilot pr comments. 2026-03-18 11:53:26 +01:00
Thomas Cook 0926705487 Add lpc55s69 to targets.md 2026-03-18 11:53:26 +01:00
Thomas Cook 2af2e795cb Initial support for lpc55s69 2026-03-18 11:53:26 +01:00