Support ARM Compiler for Embedded on STM32U5

.gitignore

@@ -133,6 +133,7 @@ tools/tpm/pcr_extend
 tools/tpm/policy_create
 tools/tpm/policy_sign
 config/*.ld
+config/*.sct
 test-lib
 lib-fs
 

Makefile

@@ -27,7 +27,8 @@ SIGN_ALG=
 OBJCOPY_FLAGS=
 BIG_ENDIAN?=0
 USE_CLANG?=0
-ifeq ($(USE_CLANG),1)
+USE_ARMCLANG?=0
+ifneq ($(filter 1,$(USE_CLANG) $(USE_ARMCLANG)),)
 USE_GCC?=0
 else
 USE_GCC?=1
@@ -251,6 +252,39 @@ ifeq ($(ARCH),AURIX_TC3)
   endif
 endif
 
+## ARM Compiler for Embedded (USE_ARMCLANG=1): rebuild the link options from
+## scratch and switch the linker script to a scatter file, to support armlink.
+ifeq ($(USE_ARMCLANG),1)
+  CFLAGS+=-D'END_STACK=Image$$$$ARM_LIB_STACK$$$$ZI$$$$Limit'
+  ifeq ($(WOLFCRYPT_TZ),1)
+    # Trap stubs for symbols referenced from wolfSSL code paths that are
+    # dead in this configuration: GNU ld garbage-collects the referencing
+    # sections, but armlink resolves all symbols before unused section
+    # elimination
+    OBJS+=tools/armclang/armclang_stubs.o
+    CFLAGS+=-DARMCLANG_STUBS_DEAD_REFS
+    ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
+      CFLAGS+=-D'_flash_keyvault=Image$$$$KEYVAULT$$$$Base'
+      CFLAGS+=-D'_flash_keyvault_size=Image$$$$KEYVAULT$$$$ZI$$$$Length'
+      CFLAGS+=-D'_start_heap=Image$$$$RAM_HEAP$$$$Base'
+      CFLAGS+=-D'_heap_size=Image$$$$RAM_HEAP$$$$ZI$$$$Length'
+      # ARM libc malloc needs the C-library init that never runs (entry is
+      # isr_reset): provide a heap allocator instead
+      CFLAGS+=-DARMCLANG_STUBS_MALLOC
+    endif
+  endif
+  LDFLAGS:=$(ARMCLANG_LDFLAGS) --map --list=wolfboot.map
+  LSCRIPT:=config/target.sct
+  LSCRIPT_IN:=hal/$(TARGET).sct
+  LSCRIPT_FLAGS:=--scatter=$(LSCRIPT)
+  LD_START_GROUP:=
+  LD_END_GROUP:=
+  SECURE_LDFLAGS:=
+  ifeq ($(TZEN),1)
+    SECURE_LDFLAGS:=--import_cmse_lib_out=./src/wolfboot_tz_nsc.o
+  endif
+endif
+
 # Environment variables for sign tool
 SIGN_ENV=IMAGE_HEADER_SIZE=$(IMAGE_HEADER_SIZE) \
 		 WOLFBOOT_PARTITION_SIZE=$(WOLFBOOT_PARTITION_SIZE) \
@@ -644,7 +678,7 @@ src/flash_otp_keystore.o: $(PRIVATE_KEY) src/flash_otp_keystore.c
 keys: $(PRIVATE_KEY)
 
 clean:
-	$(Q)rm -f src/*.o hal/*.o hal/spi/*.o test-app/*.o src/x86/*.o
+	$(Q)rm -f src/*.o hal/*.o hal/spi/*.o hal/uart/*.o test-app/*.o src/x86/*.o
 	$(Q)rm -f src/wolfboot_tz_nsc.o
 	$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/fwtpm/*.o $(WOLFBOOT_LIB_WOLFTPM)/hal/*.o $(WOLFBOOT_LIB_WOLFTPM)/examples/pcr/*.o
 	$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/Renesas/*.o

arch.mk

@@ -1510,6 +1510,45 @@ ifeq ($(USE_CLANG),1)
   LDFLAGS+=-nostdlib
 endif
 
+ifeq ($(USE_ARMCLANG),1)
+  ifneq ($(ARCH),ARM)
+    $(error USE_ARMCLANG=1 is currently supported only for ARCH=ARM)
+  endif
+  ARMCLANG_PATH?=
+  CC=$(ARMCLANG_PATH)armclang --target=arm-arm-none-eabi
+  AS=$(CC)
+  LD=$(ARMCLANG_PATH)armlink
+  AR=$(ARMCLANG_PATH)armar
+  FROMELF?=$(ARMCLANG_PATH)fromelf
+  SIZE=$(FROMELF) -z
+  OBJCOPY=FROMELF="$(FROMELF)" $(WOLFBOOT_ROOT)/tools/armclang/objcopy.sh
+
+  CFLAGS+=-mfloat-abi=soft
+  CFLAGS+=-fno-unwind-tables -fno-asynchronous-unwind-tables
+  CFLAGS+=-Wno-unknown-attributes -Wno-error=unknown-attributes
+
+  # Map scatter files region names to GNU ld symbols used by wolfBoot code
+  CFLAGS+=-D'_start_text=Image$$$$ER_VECTORS$$$$Base'
+  CFLAGS+=-D'_stored_data=Load$$$$RW_RAM$$$$Base'
+  CFLAGS+=-D'_start_data=Image$$$$RW_RAM$$$$Base'
+  CFLAGS+=-D'_end_data=Image$$$$RW_RAM$$$$Limit'
+  CFLAGS+=-D'_start_bss=Image$$$$RW_RAM$$$$ZI$$$$Base'
+  CFLAGS+=-D'_end_bss=Image$$$$RW_RAM$$$$ZI$$$$Limit'
+
+  # Base armlink options shared by both images:
+  # - the unreferenced vector table needs an explicit --keep or unused
+  #   section elimination removes it
+  # - RW data compression must be off: wolfBoot copies .data to RAM itself,
+  #   word by word, and would copy the compressed image
+  # - Suppress L6314W (no section matches pattern) is suppressed: the scatter
+  #   files list sections that are only present in some configurations (e.g.
+  #   .ramcode)
+  # - --no_startup: wolfBoot has its own reset handler.
+  ARMCLANG_LDFLAGS=--cpu=Cortex-M33 --fpu=SoftVFP --entry=isr_reset \
+                   --keep="*(.isr_vector)" --datacompressor=off --remove \
+                   --no_startup --info=sizes,totals,unused --diag_suppress=6314
+endif
+
 ifeq ($(USE_GCC),1)
   ## Toolchain setup
   CC=$(CROSS_COMPILE)gcc

config/examples/stm32u5-wolfcrypt-tz.config

@@ -20,13 +20,13 @@ RAM_CODE?=0
 DUALBANK_SWAP?=0
 WOLFBOOT_PARTITION_SIZE?=0x20000
 WOLFBOOT_SECTOR_SIZE?=0x2000
-WOLFBOOT_KEYVAULT_ADDRESS?=0x0C020000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
 WOLFBOOT_KEYVAULT_SIZE?=0x18000
-WOLFBOOT_NSC_ADDRESS?=0x0C038000
+WOLFBOOT_NSC_ADDRESS?=0x0C058000
 WOLFBOOT_NSC_SIZE?=0x8000
-WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08040000
-WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x08060000
-WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x08080000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x08080000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x080A0000
 FLAGS_HOME=0
 DISABLE_BACKUP=0
 WOLFCRYPT_TZ=1

docs/compile.md

@@ -341,6 +341,25 @@ iterating over a range of flash sectors and erasing them one at a time. Setting
 single HAL flash erase invocation with a larger erase length versus the iterative approach. On targets where multi-sector erases are more performant, this option can be used to dramatically speed up the
 image swap procedure.
 
+### Building with the ARM Compiler for Embedded (armclang)
+
+wolfBoot can be built with the [ARM Compiler for Embedded](https://developer.arm.com/Tools%20and%20Software/Arm%20Compiler%20for%20Embedded)
+(AC6: `armclang`, `armlink`, `armar`, `fromelf`), the toolchain used by Keil
+MDK. No tool from the GNU or LLVM toolchains is required.
+
+At the moment, the only supported and tested target is the STM32U5
+(`config/examples/{stm32u5.config,stm32u5-wolfcrypt-tz.config}`).
+
+To use this, either have the AC6 tools in your `PATH` or set `ARMCLANG_PATH` to
+their location (including a trailing slash). Then build with USE_ARMCLANG=1:
+
+```
+cp config/examples/stm32u5.config .config
+make USE_ARMCLANG=1
+```
+
+Alternatively, append `USE_ARMCLANG=1` and/or `ARMCLANG_PATH` to your `.config`.
+
 ### Using Mac OS/X
 
 If you see 0xC3 0xBF (C3BF) repeated in your factory.bin then your OS is using Unicode characters.

hal/stm32u5.c

@@ -24,6 +24,7 @@
 #include <string.h>
 #include "hal/stm32u5.h"
 #include "hal.h"
+#include "uart_drv.h"
 
 
 static void RAMFUNCTION flash_set_waitstates(unsigned int waitstates)
@@ -33,7 +34,7 @@ static void RAMFUNCTION flash_set_waitstates(unsigned int waitstates)
         FLASH_ACR =  (reg & ~FLASH_ACR_LATENCY_MASK) | waitstates;
 }
 
-static RAMFUNCTION void flash_wait_complete(uint8_t bank)
+void RAMFUNCTION hal_flash_wait_complete(uint8_t bank)
 {
     while ((FLASH_NS_SR & (FLASH_SR_BSY | FLASH_SR_WDW)) != 0)
         ;
@@ -44,7 +45,7 @@ static RAMFUNCTION void flash_wait_complete(uint8_t bank)
 
 }
 
-static void RAMFUNCTION flash_clear_errors(uint8_t bank)
+void RAMFUNCTION hal_flash_clear_errors(uint8_t bank)
 {
 
     FLASH_NS_SR |= (FLASH_SR_OPERR | FLASH_SR_PROGERR | FLASH_SR_WRPERR |
@@ -68,7 +69,7 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
     uint32_t qword[4];
     volatile uint32_t *sr, *cr;
 
-    flash_clear_errors(0);
+    hal_flash_clear_errors(0);
     src = (uint32_t*)data;
     dst = (uint32_t*)address;
 
@@ -105,7 +106,7 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
         ISB();
         dst[(i >> 2) + 3] = qword[3];
         ISB();
-        flash_wait_complete(0);
+        hal_flash_wait_complete(0);
         if ((*sr & FLASH_SR_EOP) != 0)
             *sr |= FLASH_SR_EOP;
         *cr &= ~FLASH_CR_PG;
@@ -117,7 +118,7 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
 
 void RAMFUNCTION hal_flash_unlock(void)
 {
-    flash_wait_complete(0);
+    hal_flash_wait_complete(0);
 #if (TZ_SECURE())
     if ((FLASH_CR & FLASH_CR_LOCK) != 0) {
         FLASH_KEYR = FLASH_KEY1;
@@ -140,7 +141,7 @@ void RAMFUNCTION hal_flash_unlock(void)
 
 void RAMFUNCTION hal_flash_lock(void)
 {
-    flash_wait_complete(0);
+    hal_flash_wait_complete(0);
 #if (TZ_SECURE())
     if ((FLASH_CR & FLASH_CR_LOCK) == 0)
         FLASH_CR |= FLASH_CR_LOCK;
@@ -151,7 +152,7 @@ void RAMFUNCTION hal_flash_lock(void)
 
 void RAMFUNCTION hal_flash_opt_unlock(void)
 {
-    flash_wait_complete(0);
+    hal_flash_wait_complete(0);
 
     if ((FLASH_NS_CR & FLASH_CR_OPTLOCK) != 0) {
         FLASH_NS_OPTKEYR = FLASH_OPTKEY1;
@@ -167,7 +168,7 @@ void RAMFUNCTION hal_flash_opt_lock(void)
 {
 
     FLASH_NS_CR |= FLASH_CR_OPTSTRT;
-    flash_wait_complete(0);
+    hal_flash_wait_complete(0);
     FLASH_NS_CR |= FLASH_CR_OBL_LAUNCH;
     if ((FLASH_NS_CR & FLASH_CR_OPTLOCK) == 0)
         FLASH_NS_CR |= FLASH_CR_OPTLOCK;
@@ -179,7 +180,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     uint32_t p;
     volatile uint32_t *cr = &FLASH_NS_CR;
 
-    flash_clear_errors(0);
+    hal_flash_clear_errors(0);
     if (len == 0)
         return -1;
 
@@ -212,7 +213,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
         *cr = reg;
         DMB();
         *cr |= FLASH_CR_STRT;
-        flash_wait_complete(0);
+        hal_flash_wait_complete(0);
     }
     /* If the erase operation is completed, disable the associated bits */
     *cr &= ~FLASH_CR_PER ;
@@ -493,6 +494,8 @@ static void led_unsecure()
 #define TZSC1_BASE 0x50032400u
 #define TZSC_SECCFGR1 (*(volatile uint32_t *)(TZSC1_BASE + 0x10u))
 #define TZSC_SECCFGR1_USART3SEC (1u << 10)
+#define TZSC_SECCFGR2 (*(volatile uint32_t *)(TZSC1_BASE + 0x14u))
+#define TZSC_SECCFGR2_USART1SEC (1u << 3)
 
 static void periph_unsecure(void)
 {
@@ -515,6 +518,24 @@ static void periph_unsecure(void)
         DMB();
         TZSC_SECCFGR1 = reg;
     }
+
+    /* Enable clock for GPIO A (USART1 pins PA9/PA10) */
+    RCC_AHB2ENR1_CLOCK_ER |= GPIOA_AHB2ENR1_CLOCK_ER;
+
+    /* Enable clock for USART1 */
+    RCC_APB2ENR |= UART1_APB2_CLOCK_ER_VAL;
+
+    /* Unsecure USART1 pins (PA9 TX, PA10 RX) */
+    GPIOA_SECCFGR &= ~(1u << UART1_TX_PIN);
+    GPIOA_SECCFGR &= ~(1u << UART1_RX_PIN);
+
+    /* Unsecure USART1 peripheral in GTZC TZSC */
+    reg = TZSC_SECCFGR2;
+    if (reg & TZSC_SECCFGR2_USART1SEC) {
+        reg &= ~TZSC_SECCFGR2_USART1SEC;
+        DMB();
+        TZSC_SECCFGR2 = reg;
+    }
 }
 #endif
 
@@ -547,6 +568,12 @@ void hal_init(void)
         fork_bootloader();
 #endif
     clock_pll_on(0);
+
+#ifdef DEBUG_UART
+    uart_init(115200, 8, 'N', 1);
+    uart_write("wolfBoot Init\n", 14);
+#endif
+
 #if TZ_SECURE()
     hal_tz_sau_init();
     hal_gtzc_init();

hal/stm32u5.h

@@ -277,6 +277,68 @@
 
 #define RCC_AHB2_CLOCK_ER RCC_AHB2ENR1_CLOCK_ER
 
+/* UART */
+#if (TZ_SECURE())
+#define UART1 (0x50013800) /* USART1 - RM0456 - Table 4 */
+#define GPIOA_BASE (0x52020000)
+#else
+#define UART1 (0x40013800) /* USART1 - RM0456 - Table 4 */
+#define GPIOA_BASE (0x42020000)
+#endif
+
+#define UART_CR1(base) (*(volatile uint32_t *)((base) + 0x00))
+#define UART_CR2(base) (*(volatile uint32_t *)((base) + 0x04))
+#define UART_CR3(base) (*(volatile uint32_t *)((base) + 0x08))
+#define UART_BRR(base) (*(volatile uint32_t *)((base) + 0x0c))
+#define UART_ISR(base) (*(volatile uint32_t *)((base) + 0x1c))
+#define UART_ICR(base) (*(volatile uint32_t *)((base) + 0x20))
+#define UART_RDR(base) (*(volatile uint32_t *)((base) + 0x24))
+#define UART_TDR(base) (*(volatile uint32_t *)((base) + 0x28))
+#define UART_PRE(base) (*(volatile uint32_t *)((base) + 0x2C))
+
+#define UART_CR1_UART_ENABLE    (1 << 0)
+#define UART_CR1_OVER8          (1 << 15)
+#define UART_CR1_SYMBOL_LEN     (1 << 12)
+#define UART_CR1_PARITY_ENABLED (1 << 10)
+#define UART_CR1_PARITY_ODD     (1 << 9)
+#define UART_CR1_TX_ENABLE      (1 << 3)
+#define UART_CR1_RX_ENABLE      (1 << 2)
+#define UART_CR2_STOPBITS       (3 << 12)
+#define UART_CR2_LINEN          (1 << 14)
+#define UART_CR2_CLKEN          (1 << 11)
+#define UART_CR3_HDSEL          (1 << 3)
+#define UART_CR3_SCEN           (1 << 5)
+#define UART_CR3_IREN           (1 << 1)
+#define UART_ISR_TX_EMPTY       (1 << 7)
+#define UART_ISR_TX_COMPLETE    (1 << 6)
+#define UART_ISR_RX_NOTEMPTY    (1 << 5)
+#define UART_EPE                (1 << 0)    /* Parity error */
+#define UART_EFE                (1 << 1)    /* Framing error */
+#define UART_ENE                (1 << 2)    /* Noise error */
+#define UART_ORE                (1 << 3)    /* Overrun error */
+
+#define UART1_APB2_CLOCK_ER_VAL (1 << 14) /* RM0456 - RCC_APB2ENR - USART1EN */
+#define RCC_APB2ENR             (*(volatile uint32_t *)(RCC_BASE + 0xA4)) /* RM0456 - Table 108 */
+
+#define RCC_CCIPR1              (*(volatile uint32_t *)(RCC_BASE + 0xE0)) /* RM0456 - 11.8.46 */
+#define RCC_CCIPR1_USART1SEL_SHIFT (0)
+#define RCC_CCIPR1_USART1SEL_MASK  (0x3)
+#define RCC_CCIPR1_USART1SEL_HSI16 (0x2)
+
+#define HSI16_FREQ (16000000)
+
+/* USART1 pin configuration: PA9 (TX) / PA10 (RX), AF7.
+ * Connected to the ST-LINK VCP on Nucleo-U575ZI-Q. */
+#define UART1_PIN_AF 7
+#define UART1_TX_PIN 9
+#define UART1_RX_PIN 10
+
+#define GPIOA_AHB2ENR1_CLOCK_ER (1 << 0)
+#define GPIOA_MODE    (*(volatile uint32_t *)(GPIOA_BASE + 0x00))
+#define GPIOA_AFL     (*(volatile uint32_t *)(GPIOA_BASE + 0x20))
+#define GPIOA_AFH     (*(volatile uint32_t *)(GPIOA_BASE + 0x24))
+#define GPIOA_SECCFGR (*(volatile uint32_t *)(GPIOA_BASE + 0x30))
+
 /* Reset */
 #define OPTR_SWAP_BANK (1 << 20)
 

hal/stm32u5.ld

@@ -1,6 +1,6 @@
 MEMORY
 {
-    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @WOLFBOOT_KEYVAULT_ADDRESS@ - @ARCH_FLASH_OFFSET@
+    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @WOLFBOOT_KEYVAULT_ADDRESS@ - @WOLFBOOT_ORIGIN@
     RAM (rwx) :     ORIGIN = 0x30000000, LENGTH = 0x00012000
     RAM_HEAP (rw):  ORIGIN = 0x30012000, LENGTH = 0xe000 /* 56KB Heap for wolfcrypt/PKCS11 */
     FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_KEYVAULT_ADDRESS@, LENGTH = @WOLFBOOT_KEYVAULT_SIZE@