Skip to content

Commit 4db5cf7

Browse files
dgarskedgarske
authored
Merge pull request #846 from aidangarske/agilex5-tfa-port
Add Agilex 5 FCS and wolfBoot integration
2 parents 9bdc6cb + 1b425ab commit 4db5cf7

25 files changed

Lines changed: 995 additions & 58 deletions

‎.github/workflows/test-configs.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@ on:
88

99
jobs:
1010

11+
agilex5_test:
12+
uses: ./.github/workflows/test-build-aarch64.yml
13+
with:
14+
arch: aarch64
15+
config-file: ./config/examples/agilex5_013b_sdcard.config
16+
1117
cypsoc6_test:
1218
uses: ./.github/workflows/test-build-psoc6.yml
1319
with:

‎arch.mk‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,22 @@ ifeq ($(ARCH),AARCH64)
167167
CFLAGS_EXTRA+=-DSDHCI_SDMA_DISABLED
168168
endif
169169

170+
ifeq ($(TARGET),agilex5)
171+
# Altera Agilex 5: Cortex-A55, entered as non-secure BL33 at EL2 by
172+
# the GSRD TF-A BL31 image. SPL owns DDR, clocks, pinmux and resets.
173+
ARCH_FLAGS=-mcpu=cortex-a55+crypto -march=armv8.2-a+crypto \
174+
-mtune=cortex-a55
175+
CFLAGS+=$(ARCH_FLAGS) -DCORTEX_A55
176+
CFLAGS+=-DWOLFBOOT_DUALBOOT -DWOLFBOOT_UBOOT_LEGACY
177+
# BL31 owns GICv3 and secondary-core/PSCI setup. Do not touch RVBAR.
178+
CFLAGS+=-DSKIP_RVBAR=1 -DSKIP_GIC_INIT=1
179+
ifeq ($(DEBUG_UART),1)
180+
OBJS+=hal/uart/ns16550.o
181+
endif
182+
# Full SDHCI host reset: SPL leaves the Cadence host in UHS-I 1.8V/SDR104,
183+
# which mutes CMD8 against the 3.3V re-powered card (hardware-verified).
184+
endif
185+
170186
ifeq ($(TARGET),nxp_ls1028a)
171187
# DUART console on the generic driver (plain MMIO on AArch64).
172188
ifeq ($(DEBUG_UART),1)
@@ -335,7 +351,7 @@ ifeq ($(ARCH),AARCH64)
335351
# asm (sp_arm64.c / WOLFSSL_SP_ARM64_ASM); that is enabled independently on
336352
# __aarch64__ in include/user_settings.h, so a non-FIPS cm4 build still links
337353
# sp_arm64 asm.
338-
ifeq ($(filter zynq versal nxp_ls1028a,$(TARGET)),)
354+
ifeq ($(filter zynq versal agilex5 nxp_ls1028a,$(TARGET)),)
339355
NO_ARM_ASM?=1
340356
endif
341357

‎config/examples/agilex5_013b_sdcard.config‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# wolfBoot configuration for Altera Agilex 5 DK-A5E013BM16AEA (013B)
2+
#
3+
# SDM -> U-Boot SPL -> TF-A BL31 -> wolfBoot BL33/EL2 -> signed Linux FIT
4+
5+
ARCH?=AARCH64
6+
TARGET?=agilex5
7+
WOLFBOOT_VERSION?=1
8+
9+
SIGN?=RSA4096
10+
HASH?=SHA3
11+
IMAGE_HEADER_SIZE?=1024
12+
13+
DEBUG?=1
14+
DEBUG_SYMBOLS=1
15+
DEBUG_UART=1
16+
17+
DISK_SDCARD?=1
18+
DISK_EMMC?=0
19+
EXT_FLASH?=0
20+
NO_XIP=1
21+
ELF?=1
22+
GZIP?=1
23+
24+
VTOR?=1
25+
NO_ASM?=0
26+
ALLOW_DOWNGRADE?=0
27+
NVM_FLASH_WRITEONCE?=0
28+
SPMATH?=1
29+
RAM_CODE?=0
30+
DUALBANK_SWAP?=0
31+
PKA?=0
32+
WOLFTPM?=0
33+
34+
USE_GCC=1
35+
CROSS_COMPILE?=aarch64-none-elf-
36+
37+
# SPL/BL31 load this binary in place of U-Boot proper. These values must match
38+
# the u-boot.itb BL33 load and entry properties.
39+
WOLFBOOT_ORIGIN=0x80200000
40+
41+
# Signed payload staging, extracted Linux Image, and DTB do not overlap.
42+
WOLFBOOT_LOAD_ADDRESS?=0x90000000
43+
WOLFBOOT_LOAD_DTS_ADDRESS?=0x8f000000
44+
WOLFBOOT_RAMBOOT_MAX_SIZE?=0x10000000
45+
46+
# MBR: p1 FAT boot, p2 signed A, p3 signed B, p4 Linux rootfs.
47+
WOLFBOOT_NO_PARTITIONS=1
48+
CFLAGS_EXTRA+=-DBOOT_PART_A=1 -DBOOT_PART_B=2
49+
CFLAGS_EXTRA+=-DDISK_BLOCK_SIZE=0x80000
50+
CFLAGS_EXTRA+=-DLINUX_BOOTARGS_ROOT=\"/dev/mmcblk0p4\"
51+
52+
# Board settings, see docs/Agilex5.md. Defaults match the 013B dev kit.
53+
#CFLAGS_EXTRA+=-DDEBUG_UART_NUM=1
54+
#CFLAGS_EXTRA+=-DAGILEX5_DDR_SIZE=0x70000000
55+
CFLAGS_EXTRA+=-DWOLFBOOT_FDT_DISABLE_PATHS=\"/leds\"
56+
57+
# SD6HC uses SDMA for cache-coherent multi-block transfers.
58+
CFLAGS_EXTRA+=-DSDHCI_FORCE_CARD_DETECT
59+
60+
# Required by generic config checks even though disk partitions select A/B.
61+
WOLFBOOT_PARTITION_BOOT_ADDRESS=0x90000000
62+
WOLFBOOT_PARTITION_SIZE=0x0c800000
63+
WOLFBOOT_SECTOR_SIZE=0x1000
64+
65+
# Uncomment during storage bring-up.
66+
#CFLAGS_EXTRA+=-DDEBUG_SDHCI -DDEBUG_DISK

‎docs/Agilex5.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# Altera Agilex 5
2+
3+
The Agilex 5 port follows wolfBoot's established Cortex-A TF-A model. It does
4+
not replace the platform first stage or TF-A:
5+
6+
```text
7+
SDM -> U-Boot SPL -> TF-A BL31/EL3 -> wolfBoot BL33/EL2 -> signed Linux FIT
8+
```
9+
10+
SPL remains responsible for DDR, clocks, resets, pinmux, the SDHCI PHY and
11+
loading the signed U-Boot FIT. BL31 remains responsible for EL3, GICv3, PSCI,
12+
secondary CPUs and security-controller setup. The U-Boot-proper payload in the
13+
FIT is replaced with `wolfboot.bin` at load/entry address `0x80200000`.
14+
15+
## Build
16+
17+
Use an isolated wolfBoot checkout with initialized wolfSSL submodules:
18+
19+
```sh
20+
cp config/examples/agilex5_013b_sdcard.config .config
21+
make clean
22+
make -j"$(nproc)"
23+
```
24+
25+
The hosted build is covered by the Agilex 5 job in the `Test Example Configs`
26+
GitHub Actions workflow. It installs the same freestanding AArch64 toolchain
27+
used by the other Cortex-A ports and builds this configuration on every pull
28+
request; hardware is required only for the SD-card and Linux handoff steps
29+
below.
30+
31+
The default RSA-4096/SHA3-384 key is for development only. Production builds
32+
must supply controlled signing keys and keep them separate from both the SDM
33+
owner key and the SPL FIT-signing key.
34+
35+
Create the Linux FIT from the GSRD `Image` and the exact board DTB, then sign
36+
that FIT with wolfBoot's normal image-signing flow. Initialize both raw A/B
37+
partitions with a valid signed image for the first boot.
38+
39+
### Board settings
40+
41+
The example config targets the DK-A5E013BM16AEA. Other boards set these in
42+
their config:
43+
44+
| Setting | Default | Purpose |
45+
|---|---|---|
46+
| `CFLAGS_EXTRA+=-DDEBUG_UART_NUM=<0\|1>` | UART0 (`0x10C02000`) | select UART0 or UART1 (`0x10C02100`) for wolfBoot and Linux `earlycon` |
47+
| `CFLAGS_EXTRA+=-DDEBUG_UART_BASE=<addr>` | unset | any other console UART; write the address without a `UL` suffix |
48+
| `CFLAGS_EXTRA+=-DAGILEX5_DDR_SIZE=<bytes>` | `0x70000000` (1792 MiB) | DDR size written to the DTB memory node |
49+
| `CFLAGS_EXTRA+=-DWOLFBOOT_FDT_DISABLE_PATHS=\"/leds\"` | unset | comma-separated DTB node paths to mark `disabled`, for hardware behind the unprogrammed FPGA |
50+
51+
wolfBoot does not read the DDR size from the DTB, because without U-Boot the
52+
memory node holds whatever the DTB author wrote rather than the fitted size.
53+
54+
The checked-in `hal/agilex5.its` is a minimal FIT example. A GSRD production
55+
image must use the GSRD-generated kernel load address and board DTB, then be
56+
signed with the deployment key. Do not place private keys in the source tree
57+
or the WIC.
58+
59+
## GSRD integration
60+
61+
Keep the GSRD `u-boot.itb` structure and signature intact:
62+
63+
- retain the existing BL31 firmware node;
64+
- replace only the U-Boot-proper/BL33 data with `wolfboot.bin`;
65+
- retain load and entry `0x80200000`;
66+
- rebuild and sign the ITB using the same GSRD/SPL trust configuration.
67+
68+
Use a four-partition WIC:
69+
70+
1. 128 MiB FAT boot partition containing the signed boot artifacts;
71+
2. 200 MiB raw wolfBoot A partition;
72+
3. 200 MiB raw wolfBoot B partition;
73+
4. ext4 Linux root filesystem.
74+
75+
The wolfSSL FCS packages belong in partition 4. libfcs is Linux userspace
76+
software and is deliberately not linked into bare-metal wolfBoot.
77+
78+
## Test order
79+
80+
1. Cross-build the existing ZynqMP and Versal SD-card configurations to catch
81+
shared AArch64 regressions, then build Agilex 5.
82+
2. First boot a minimal signed payload that prints its exception level and
83+
proves the generic timer and PSCI reset path.
84+
3. Exercise SD reads in PIO mode, then valid, corrupt-signature, truncated and
85+
oversized images.
86+
4. Boot Linux and require the DTB in x0, x1-x3 zero, four online CPUs, working
87+
PSCI reboot, and rootfs `/dev/mmcblk0p4`.
88+
5. Build the complete WIC, inspect all four partitions, flash the whole card,
89+
compare the complete image span, cold boot, and test A-to-B fallback by
90+
corrupting only a disposable copy of A. Both slots must hold the same
91+
version: with `ALLOW_DOWNGRADE=0` wolfBoot refuses to fall back to a lower
92+
version (`Rollback to lower version not allowed`) and panics instead.
93+
6. From the booted WIC run `/usr/bin/wolfcrypttest`. Require exit zero and
94+
`ALTERA-FCS test passed!` to prove the Linux image still provides hardware
95+
FCS offload.
96+
97+
For the reproducible meta-wolfSSL customer flow, use
98+
`recipes-wolfssl/wolfboot/agilex5/README.md` in the meta-wolfSSL checkout. It
99+
covers the Kas fragment, the four-partition WIC inspection, whole-device flash
100+
and byte comparison, virtual SDM owner-key reprovisioning after power loss,
101+
and the target-side loader/FCS checks. wolfBoot itself does not link libfcs;
102+
the FCS test belongs to the Linux image in WIC partition 4.
103+
104+
Do not patch TF-A or take over GICv3, SMMU/firewall, mailbox, or PSCI ownership
105+
without a reproduced hardware failure showing the stock GSRD contract is
106+
insufficient.
107+
108+
## CI and hardware boundary
109+
110+
CI proves that the Agilex 5 configuration, linker script, startup assembly,
111+
SDHCI changes, and test application remain buildable without Agilex hardware.
112+
It cannot prove SPL DDR training, TF-A handoff, SDM services, signed FIT
113+
verification, or FCS offload. Those require the GSRD image and the
114+
DK-A5E013BM16AEA. Record the WIC hash, complete-card comparison, UART boot
115+
log, target `uname`, loader output, and `wolfcrypttest` exit status and FCS
116+
marker for a hardware release sign-off.

‎docs/Targets.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ This README describes configuration of supported targets.
44

55
## Supported Targets
66

7+
* [Altera Agilex 5](#altera-agilex-5-013b)
78
* [Simulated](#simulated)
89
* [Analog Devices MAX32666](#analog-devices-max32666)
910
* [Cortex-A53 / Raspberry PI 3](#cortex-a53--raspberry-pi-3-experimental)
@@ -10750,3 +10751,23 @@ The C28x boot ROM selects its boot source before any application code runs, so t
1075010751
| `DEBUG` | Enables verbose boot progress and a JTAG-readable survive-log mirror (`g_log`) for bring-up. |
1075110752

1075210753
A/B update / rollback is a follow-on: the partitions are declared, but the update path (flash erase/write, swap, trailer) is not yet wide-byte-hardened.
10754+
10755+
## Altera Agilex 5 (013B)
10756+
10757+
The Agilex 5 DK-A5E013BM16AEA port runs as the signed BL33 payload in the
10758+
GSRD handoff: SDM -> U-Boot SPL -> TF-A BL31 -> wolfBoot -> Linux FIT. SPL
10759+
owns DDR and controller initialization; TF-A owns EL3, GICv3 and PSCI. The
10760+
port keeps those responsibilities unchanged and loads signed A/B Linux FITs
10761+
from raw MBR partitions on the SD card.
10762+
10763+
Build the hosted configuration with:
10764+
10765+
```sh
10766+
cp config/examples/agilex5_013b_sdcard.config .config
10767+
make clean
10768+
make -j"$(nproc)"
10769+
```
10770+
10771+
See [docs/Agilex5.md](Agilex5.md) for the GSRD FIT/WIC layout, DT handoff,
10772+
hardware test order, and the boundary between the bare-metal bootloader and
10773+
the Linux libfcs/wolfSSL integration.

0 commit comments

Comments
 (0)