Add AArch64 UEFI support (NVIDIA Jetson Orin) by dgarske · Pull Request #818 · wolfSSL/wolfBoot

dgarske · 2026-07-07T17:05:56Z

Summary

Adds a generic AArch64 UEFI-application target to wolfBoot -- the direct sibling of the existing x86_64_efi target. wolfBoot builds as wolfboot.efi (a PE/COFF EFI application), is launched by platform UEFI firmware, cryptographically verifies the next-stage image, and boots it through UEFI LoadImage/StartImage. Validated end-to-end on the NVIDIA Jetson Orin Nano, booting all the way to an Ubuntu 22.04 login prompt.

Features

New aarch64_efi target -- the AArch64 counterpart of x86_64_efi. It uses only UEFI Boot Services (no SoC-specific registers), so a single wolfboot.efi runs on any AArch64 UEFI platform rather than being tied to one board.
Verified boot after UEFI -- reads the kernel image from the EFI Simple File System, verifies it with wolfCrypt (validated with ED25519/SHA256; the standard wolfBoot SIGN/HASH options apply), and hands control to it via LoadImage/StartImage. A/B image selection uses the RAM updater.
gnu-efi build integration -- pei-aarch64-little PE output, gnu-efi CRT0 entry, and EFI console Print for log output. A helper script builds the AArch64 gnu-efi runtime from source (tools/scripts/build-gnu-efi-aarch64.sh), pinned to a released gnu-efi tag (4.0.4) so the runtime CRT0/linker-script/libs are reproducible and auditable.
Hardware-free iteration -- tools/scripts/aarch64-efi-qemu.sh runs wolfboot.efi under QEMU + AAVMF, including a --gdb mode for source-level debugging.
Continuous integration -- a compile-only aarch64_efi_test job builds the AArch64 gnu-efi runtime and then wolfboot.efi on every push, mirroring the existing x86_64_efi job.
Validated on real hardware -- NVIDIA Jetson Orin Nano (Tegra234): boots from the SD via UEFI removable-media auto-boot (\EFI\BOOT\BOOTAA64.EFI), verifies the ED25519 signature, and boots the payload through to Linux userspace.

Notable fix

For a UEFI-application target the keystore must not be placed in the dedicated .keystore linker section: the gnu-efi PE does not load that section, so PubKeys reads back as zeros and key lookup fails (and faults on stricter firmware). keygen.c now emits the keystore as plain const data for aarch64_efi, matching how x86_64_efi already handles it.

Files

New: hal/aarch64_efi.c, hal/aarch64_efi.ld, src/boot_aarch64_efi.c, config/examples/aarch64_efi.config, tools/scripts/build-gnu-efi-aarch64.sh, tools/scripts/aarch64-efi-qemu.sh. Edits: arch.mk, Makefile, tools/keytools/keygen.c, docs/Targets.md, .gitignore, .github/workflows/test-configs.yml, .github/workflows/test-build.yml.

Build and run

./tools/scripts/build-gnu-efi-aarch64.sh          # one-time: AArch64 gnu-efi
cp config/examples/aarch64_efi.config .config
make                                              # -> wolfboot.efi
# sign a payload, place wolfboot.efi + kernel.img on a FAT ESP, launch from UEFI
./tools/scripts/aarch64-efi-qemu.sh               # optional: run in QEMU

See docs/Targets.md (NVIDIA Jetson Orin section) for the full validated L4T recipe.

Validation

QEMU (qemu-system-aarch64 + AAVMF): launch -> read kernel.img -> ED25519 verify PASS -> LoadImage/StartImage -> the real L4T kernel EFI stub runs.
Jetson Orin Nano: Verifying signature...done -> boots the signed L4T kernel -> mounts the SD rootfs -> Ubuntu 22.04.5 login prompt, auto-launched from the SD.

Copilot

Pull request overview

This pull request adds a new aarch64_efi target so wolfBoot can run as an AArch64 UEFI application (validated on NVIDIA Jetson Orin), loading/verifying kernel.img/update.img from the ESP and booting via UEFI LoadImage/StartImage.

Changes:

Add a new AArch64 UEFI HAL (hal/aarch64_efi.c) plus boot glue (src/boot_aarch64_efi.c) and linker-script stub.
Extend the build system to support an AArch64 PE/COFF wolfboot.efi output and a new example config.
Add helper scripts and documentation for building gnu-efi for AArch64 and running under QEMU/Jetson deployment.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tools/scripts/build-gnu-efi-aarch64.sh	Helper to clone/build/install gnu-efi (AArch64) into the repo tree
tools/scripts/aarch64-efi-qemu.sh	Convenience runner for `wolfboot.efi` under QEMU + AAVMF
tools/keytools/keygen.c	Extends keystore section handling for the new UEFI target macro
src/boot_aarch64_efi.c	Adds UEFI-target `do_boot()` glue for AArch64
Makefile	Makes the `wolfboot.efi` objcopy output format configurable per target
hal/aarch64_efi.ld	Empty placeholder linker script (gnu-efi script used instead)
hal/aarch64_efi.c	New AArch64 UEFI HAL: ESP file loading, verification, LoadImage/StartImage handoff
docs/Targets.md	Adds `aarch64_efi` target documentation (Jetson Orin + QEMU workflow)
config/examples/aarch64_efi.config	Example configuration for `aarch64_efi`
arch.mk	Adds `aarch64_efi` target build flags, gnu-efi paths, and linking rules
.gitignore	Ignores gnu-efi build artifacts and staging dirs for the new target

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 11 comments.

+    uint32_t *size;
+    uint8_t* manifest = ((uint8_t*)boot_addr) - IMAGE_HEADER_SIZE;


+    size = (uint32_t *)(manifest + 4);
+
+    mem_path_device->Header.Type = EFI_DEVICE_PATH_PROTOCOL_HW_TYPE;
+    mem_path_device->Header.SubType = EFI_DEVICE_PATH_PROTOCOL_MEM_SUBTYPE;
+    mem_path_device->MemoryType = EfiLoaderData;
+    mem_path_device->StartingAddress = (EFI_PHYSICAL_ADDRESS)boot_addr;
+    mem_path_device->EndingAddress = (EFI_PHYSICAL_ADDRESS)((uint8_t*)boot_addr+*size);


+    *sz =  FileSize(file);
+    wolfBoot_printf("Opening file: %s, size: %u\n", filename, *sz);


+int RAMFUNCTION hal_flash_write(uintptr_t address, const uint8_t *data, int len)
+{
+    return 0;
+}


+int RAMFUNCTION hal_flash_erase(uintptr_t address, int len)
+{
+    return 0;
+}


+    *sz =  FileSize(file);
+    wolfBoot_printf("Opening file: %s, size: %u\n", filename, *sz);
+    status = uefi_call_wrapper(BS->AllocatePages,
+                          4,
+                          AllocateAnyPages,
+                          EfiLoaderData,
+                          (*sz/PAGE_SIZE) + 1, _addr);


+    if (status != EFI_SUCCESS) {
+        wolfBoot_printf("can't get memory at specified address %d\n", status);
+        uefi_call_wrapper(file->Close, 1, file);
+        return status;


+    if (status != EFI_SUCCESS) {
+        wolfBoot_printf("can't load kernel image from memory\n");
+        panic();
+    }


+    status = uefi_call_wrapper(gSystemTable->BootServices->StartImage,
+                               3,
+                               kernelImageHandle, 0, NULL);
+    if (status != EFI_SUCCESS) {
+        wolfBoot_printf("can't load kernel image from memory\n");
+        panic();
+    }


+extern void RAMFUNCTION aarch64_efi_do_boot(uint32_t *boot_addr);
+
+void RAMFUNCTION do_boot(const uint32_t *app_offset)
+{
+    aarch64_efi_do_boot((uint32_t *)app_offset);
+}


dgarske self-assigned this Jul 7, 2026

Copilot AI review requested due to automatic review settings July 7, 2026 17:05

Copilot started reviewing on behalf of dgarske July 7, 2026 17:07 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

Comment thread hal/aarch64_efi.c

Comment thread src/boot_aarch64_efi.c Outdated

Comment thread hal/aarch64_efi.c Outdated

Comment thread hal/aarch64_efi.c

Comment thread tools/scripts/build-gnu-efi-aarch64.sh Outdated

Comment thread arch.mk

Add aarch64_efi target: wolfBoot as an AArch64 UEFI application

f13a354

dgarske force-pushed the aarch64_efi branch from 4843214 to f13a354 Compare July 8, 2026 00:01

dgarske requested a review from Copilot July 8, 2026 00:05

Copilot AI reviewed Jul 8, 2026

View reviewed changes

Copilot started reviewing on behalf of dgarske July 8, 2026 00:29 View session

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add AArch64 UEFI support (NVIDIA Jetson Orin)#818

Add AArch64 UEFI support (NVIDIA Jetson Orin)#818
dgarske wants to merge 1 commit into
wolfSSL:masterfrom
dgarske:aarch64_efi

dgarske commented Jul 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		uint32_t *size;
		uint8_t* manifest = ((uint8_t*)boot_addr) - IMAGE_HEADER_SIZE;

		*sz = FileSize(file);
		wolfBoot_printf("Opening file: %s, size: %u\n", filename, *sz);

Uh oh!

Conversation

dgarske commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Features

Notable fix

Files

Build and run

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dgarske commented Jul 7, 2026 •

edited

Loading