Add wolfBoot target for NXP i.MX95 Cortex-A55 as BL33 booting a Linux FIT from SD

Author: dgarske

Makefile

@@ -396,6 +396,12 @@ ifeq ($(TARGET),tegra234)
     MAIN_TARGET:=wolfboot.bin test-app/image_v1_signed.bin
 endif
 
+# i.MX95 A55 is a RAM-resident BL33 loaded by SPL inside an AHAB container, so
+# there is no contiguous flash image to assemble into a factory.bin.
+ifeq ($(TARGET),imx95_a55)
+    MAIN_TARGET:=wolfboot.bin
+endif
+
 ifeq ($(TARGET),cm4)
     MAIN_TARGET:=wolfboot.bin
 endif

arch.mk

@@ -219,6 +219,32 @@ ifeq ($(ARCH),AARCH64)
     # BOOT_EL1 itself is emitted by options.mk; nothing to add here.
   endif
 
+  ifeq ($(TARGET),imx95_a55)
+    # NXP i.MX95 Cortex-A55 cluster, running as BL33 in AHAB container 2.
+    # -mstrict-align because this stage runs with the MMU off, so every access
+    # is Device-nGnRnE and unaligned ones fault.
+    ARCH_FLAGS=-mcpu=cortex-a55+crypto -march=armv8.2-a+crypto -mstrict-align
+    CFLAGS+=$(ARCH_FLAGS) -DCORTEX_A55
+    LDFLAGS+=$(ARCH_FLAGS)
+    # BL31 loads and enters this image here; must match ORIGIN in
+    # hal/imx95_a55.ld and IMX95_BL33_BASE in hal/imx95_a55.h.
+    WOLFBOOT_ORIGIN=0x90200000
+    # Bring-up aid: print the entry EL, SCTLR and handoff x0 that BL31 passed.
+    ifeq ($(IMX95_HANDOFF_DUMP),1)
+      CFLAGS+=-DIMX95_HANDOFF_DUMP
+    endif
+    # i.MX95 is GICv3 and BL31 already configured it. EL2_HYPERVISOR is not a
+    # generic options.mk variable, so it is emitted here as tegra234 does.
+    ifeq ($(EL2_HYPERVISOR),1)
+      CFLAGS+=-DEL2_HYPERVISOR=1
+    endif
+    # i.MX uSDHC is not SDHCI-compatible: skip src/sdhci.c, use our driver.
+    ifneq ($(filter 1,$(DISK_SDCARD) $(DISK_EMMC)),)
+      DISK_DRIVER=usdhc
+      OBJS+=hal/imx95_usdhc.o
+    endif
+  endif
+
   ifeq ($(TARGET),cm4)
     # Raspberry Pi Compute Module 4 - Broadcom BCM2711, Cortex-A72
     ARCH_FLAGS=-mcpu=cortex-a72+crypto -march=armv8-a+crypto -mtune=cortex-a72

config/examples/imx95-a55.config

@@ -0,0 +1,78 @@
+# NXP i.MX95 Cortex-A55 - wolfBoot as BL33 (replaces U-Boot proper):
+#   ROM -> ELE -> SM -> OEI -> SPL [c1] -> BL31 -> OP-TEE -> wolfBoot -> Linux
+# wolfBoot takes U-Boot's slot in AHAB container 2 at 0x90200000; the other
+# container images are the vendor's, reused verbatim.
+
+ARCH?=AARCH64
+TARGET?=imx95_a55
+
+# ML-DSA-87, matching the imx95_m7 port. Header fits sig (4627) + pubkey.
+SIGN?=ML_DSA
+ML_DSA_LEVEL?=5
+HASH?=SHA256
+# Required: unset, ML_DSA_IMAGE_SIGNATURE_SIZE expands empty -> image.c errors.
+IMAGE_SIGNATURE_SIZE?=4627
+IMAGE_HEADER_SIZE?=12288
+
+DEBUG?=0
+DEBUG_SYMBOLS=1
+DEBUG_UART?=1
+# Print entry EL, SCTLR, MPIDR, CNTFRQ and the handoff x0 pointer.
+IMX95_HANDOFF_DUMP?=1
+
+V?=0
+SPMATH?=1
+NO_ASM?=0
+
+# RAM-resident: BL31 loads and enters this image, so there is nothing to copy
+# from a stored .data and no XIP flash behind it.
+NO_XIP?=1
+
+# GICv3, configured by BL31; gicv2_init_secure() would abort on an unmapped
+# ZynqMP address.
+SKIP_GIC_INIT?=1
+
+# Stay at EL2 (Linux wants it for KVM). Do NOT set BOOT_EL1: el2_to_el1_boot
+# skips cache/MMU cleanup and would hand Linux stale DRAM.
+EL2_HYPERVISOR=1
+
+# No flash: boot/update addresses come from the HAL.
+WOLFBOOT_NO_PARTITIONS=1
+
+# Must match ORIGIN in hal/imx95_a55.ld and IMX95_BL33_BASE in hal/imx95_a55.h.
+WOLFBOOT_ORIGIN=0x90200000
+
+# RAM staging at 0xA1000000: clear of the M7/BL31/OP-TEE/ELE/vpu carveouts;
+# hal_init() asserts this via imx95_check_load_ranges().
+WOLFBOOT_LOAD_ADDRESS?=0xA1000000
+WOLFBOOT_LOAD_DTS_ADDRESS?=0xA0800000
+
+# Bounds the image before authentication; required without fixed partitions.
+WOLFBOOT_RAMBOOT_MAX_SIZE=0x10000000
+
+# Required for the test-app link even with WOLFBOOT_NO_PARTITIONS=1.
+WOLFBOOT_SECTOR_SIZE?=0x4000
+WOLFBOOT_PARTITION_SIZE?=0x4000000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0xA1000000
+
+# Toolchain
+USE_GCC=1
+CROSS_COMPILE?=aarch64-none-elf-
+
+# Storage: carrier SD on uSDHC2 (hal/imx95_usdhc.c; i.MX uSDHC, not SDHCI).
+# Boot containers stay on eMMC.
+DISK_SDCARD?=1
+# A/B slots by 0-based index into the parsed partition table.
+CFLAGS_EXTRA+=-DBOOT_PART_A=1 -DBOOT_PART_B=2
+CFLAGS_EXTRA+=-DDISK_BLOCK_SIZE=0x10000
+
+# Linux FIT boot: kernel at 0xB2000000, ramdisk at 0xBA000000 - both above
+# the staging window so the copies cannot overlap the staged FIT.
+FIT_RAMDISK?=1
+WOLFBOOT_LOAD_RAMDISK_ADDRESS?=0xBA000000
+# OS cmdline plus serial console; the ostree= path pins the deployment.
+CFLAGS_EXTRA+=-DLINUX_BOOTARGS='"earlycon console=ttyLP1,115200 root=LABEL=otaroot rootfstype=ext4 logo.nologo ostree=/ostree/boot.1/torizon/d976a72bdc954405cfbe989bae393ad9da0b14b5dc0c1328c9b19e88201745a6/0"'
+
+# --- Later phases (not yet implemented) -------------------------------------
+#ELF?=1
+#GZIP?=1

docs/Targets.md

@@ -21,6 +21,7 @@ This README describes configuration of supported targets.
 * [Nordic nRF5340](#nordic-nrf5340)
 * [Nordic nRF54L15](#nordic-nrf54l15)
 * [NXP i.MX95 Cortex-M7](#nxp-imx95-cortex-m7)
+* [NXP i.MX95 Cortex-A55 (BL33)](#nxp-imx95-cortex-a55-bl33)
 * [NXP iMX-RT](#nxp-imx-rt)
 * [NXP Kinetis](#nxp-kinetis)
 * [NXP Kinetis KL26Z](#nxp-kinetis-kl26z)
@@ -9276,6 +9277,18 @@ The difference between the two timestamps is the cost of everything wolfBoot doe
 
 Both caches are enabled by `hal_init()`, which matters because verifying an image means hashing megabytes resident in DDR. The ARMv7-M default memory map marks `0x80000000-0x9FFFFFFF` as Normal write-through, so no MPU region is needed and M7 stores to the shared window still reach DDR; the HAL nevertheless cleans the affected lines explicitly so that behaviour is not left depending on an inherited attribute.
 
+## NXP i.MX95 Cortex-A55 (BL33)
+
+wolfBoot replaces U-Boot proper on the i.MX95's Cortex-A55 cluster: it is the third image in AHAB container 2 (after BL31 and OP-TEE), entered by BL31 at `0x90200000` in NS-EL2, where it verifies a Linux FIT (kernel + DTB + initramfs) with ML-DSA-87 and boots it at EL2. SPL/ELE authenticate the container itself (AHAB), so the chain is ROM -> ELE -> SPL -> BL31 -> wolfBoot -> Linux once SRK fuses are programmed. NXP also documents an OEM PQC SRK hybrid (ML-DSA) AHAB flow, so the container half of the chain can be post-quantum as well.
+
+Validated on a Toradex SMARC iMX95 with `TARGET=imx95_a55` (`config/examples/imx95-a55.config`): full boot to Linux userspace with the FIT on the carrier SD (uSDHC2, `hal/imx95_usdhc.c` - i.MX uSDHC, not SDHCI-compatible).
+
+Notes:
+- The FIT DTB gets `/chosen` bootargs, initrd properties and a `/memory` node from `hal_dts_fixup()`; deployment DTBs commonly ship without `/memory` (the bootloader is expected to add it) and the kernel hangs silently without one.
+- The EL2 exit is a fused asm routine (flush, DAIF mask, TLB invalidate, jump) that touches no memory after the D-cache goes off; set/way cleaning does not reach the A55 cluster's DSU system cache, so payload ranges are also cleaned by VA.
+- Use plain `earlycon` (DTB-derived); an explicit `earlycon=lpuart32,mmio32,<addr>` uses the wrong register layout on i.MX and silences all console output.
+- Storage requires the prior stage to have brought up uSDHC2 (clock/pinmux/card power are System Manager-owned via SCMI); a cold-boot SCMI client is follow-on work.
+
 ## TI C2000 C28x (LAUNCHXL-F28P55X)
 
 wolfBoot runs on the Texas Instruments C2000 C28x DSP (TMS320F28P550SJ, 150 MHz) as a secure execute-in-place (XIP) bootloader. The C28x is word-addressed with `CHAR_BIT == 16` (no 8-bit type -- each octet occupies one 16-bit cell), built with the TI `cl2000` toolchain against wolfSSL's wide-byte (`CHAR_BIT != 8`) support.