Add NXP i.MX 8QuadMax MEK port including BL33 support

.github/workflows/test-configs.yml

@@ -461,6 +461,69 @@ jobs:
       config-file: ./config/examples/tegra234-sdcard.config
       make-args: wolfboot.bin test-app/image_v1_signed.bin CROSS_COMPILE=aarch64-linux-gnu-
 
+  imx8qm_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      # Bundled payload in DRAM, no storage driver. The target's full
+      # MAIN_TARGET and what the packaging script builds.
+      config-file: ./config/examples/imx8qm-mek.config
+      make-args: wolfboot.bin test-app/image_v1_signed.bin
+
+  imx8qm_linux_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      # Linux FIT off the SD card: MMU, EL2->EL1 and the DTB code path.
+      config-file: ./config/examples/imx8qm-mek.config
+      make-args: DISK_SDCARD=1 IMX8QM_MMU=1 EL2_HYPERVISOR=1 BOOT_EL1=1 wolfboot.bin test-app/image_v1_signed.bin
+
+  imx8qm_sdcard_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      # SD card (uSDHC2): keeps the uSDHC-to-SDHCI register shim compiled.
+      config-file: ./config/examples/imx8qm-mek.config
+      make-args: DISK_SDCARD=1 wolfboot.bin test-app/image_v1_signed.bin
+
+  imx8qm_emmc_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      # eMMC (uSDHC1): the only imx8qm build that compiles the DISK_EMMC
+      # branches of src/sdhci.c.
+      config-file: ./config/examples/imx8qm-mek.config
+      make-args: DISK_EMMC=1 wolfboot.bin test-app/image_v1_signed.bin
+
+  imx8qm_sdcard_fs_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      # Keeps the read-only filesystem layer (src/disk_fs.c, src/fat32.c,
+      # src/ext4.c) compiled against this target.
+      config-file: ./config/examples/imx8qm-mek.config
+      make-args: DISK_SDCARD=1 DISK_FS=both wolfboot.bin test-app/image_v1_signed.bin
+
+  imx8qm_qspi_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      # FlexSPI0 serial NOR: the only imx8qm build that compiles the
+      # ext_flash_* FlexSPI driver and the partition-based update flow. Its
+      # memory map differs enough to warrant its own config.
+      config-file: ./config/examples/imx8qm-mek-qspi.config
+      make-args: wolfboot.bin test-app/image_v1_signed.bin
+
+  imx8qm_no_scu_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      # arch.mk sets IMX8QM_SCU ?= 1, so every other imx8qm job already compiles
+      # the SCU (MU1_A) client. This is the one job that builds it OUT, which is
+      # the chainload path and is otherwise never compiled in CI.
+      config-file: ./config/examples/imx8qm-mek.config
+      make-args: DISK_SDCARD=1 IMX8QM_SCU=0 wolfboot.bin test-app/image_v1_signed.bin
+
   cm4_test:
     uses: ./.github/workflows/test-build-aarch64.yml
     with:

.gitignore

@@ -481,11 +481,15 @@ tools/unit-tests/unit-dice-token-size
 tools/unit-tests/unit-efi-x86-open-image
 tools/unit-tests/unit-flash-write-cc26x2
 tools/unit-tests/unit-ls1028a-xspi-write
+tools/unit-tests/unit-imx8qm-usdhc-shim
+tools/unit-tests/unit-imx8qm-flexspi-write
 tools/unit-tests/unit-nvm-cache-scrub
 tools/unit-tests/unit-p1021-fcm-bytes
 tools/unit-tests/unit-p1021-qe-firmware
 tools/unit-tests/unit-pic32-pfswap
 tools/unit-tests/unit-pkcs11-nsc-zeroize
+tools/unit-tests/unit-sdhci-cmd-inhibit
+tools/unit-tests/unit-sdhci-cmd-inhibit-uhs
 tools/unit-tests/unit-sdhci-uhs-recover
 tools/unit-tests/unit-sdhci-wait-busy
 tools/unit-tests/unit-stm32l5-write
@@ -555,3 +559,6 @@ tools/fs-test/fixtures/
 # x86 FSP QEMU filesystem test images (make_hd.sh FS=1)
 fs_a.img
 fs_b.img
+tools/unit-tests/aarch64_arch_host.h
+tools/unit-tests/imx8qm_usdhc_extract.h
+tools/unit-tests/imx8qm_flexspi_extract.h

Makefile

@@ -412,6 +412,13 @@ ifeq ($(TARGET),cm4)
     MAIN_TARGET:=wolfboot.bin
 endif
 
+# i.MX 8QuadMax runs as the bare-metal BL33 loaded into DRAM by ATF, so there
+# is no contiguous flash factory.bin. Build the bootloader plus the signed
+# payload, which the packaging script assembles into the BL33 image.
+ifeq ($(TARGET),imx8qm)
+    MAIN_TARGET:=wolfboot.bin test-app/image_v1_signed.bin
+endif
+
 # i.MX95 M7 runs from ITCM (loaded by the Linux remoteproc driver); the payload
 # lives in DDR at 0x80100000, so there is no contiguous flash image to assemble.
 ifeq ($(TARGET),imx95_m7)

arch.mk

@@ -231,6 +231,79 @@ ifeq ($(ARCH),AARCH64)
     # BOOT_EL1 itself is emitted by options.mk; nothing to add here.
   endif
 
+  ifeq ($(TARGET),imx8qm)
+    # Bare-metal wolfBoot as BL33, replacing U-Boot in the NXP boot container.
+    # SCFW trains DDR before any A-core runs. A53 is the lowest common
+    # denominator across the cluster pair; -mstrict-align because the MMU is off.
+    ARCH_FLAGS=-mcpu=cortex-a53+crypto -march=armv8-a+crypto -mstrict-align
+    CFLAGS+=$(ARCH_FLAGS) -DCORTEX_A53
+    # BL33 entry address. Must agree with ORIGIN in hal/imx8qm.ld.
+    WOLFBOOT_ORIGIN=0x80020000
+    # The RVBAR write in the full startup path is a ZynqMP register.
+    CFLAGS+=-DSKIP_RVBAR=1
+    # On by default: the SCU owns the console's power, clock and pads, so this
+    # is not optional at real BL33 entry.
+    IMX8QM_SCU ?= 1
+    ifeq ($(IMX8QM_SCU),1)
+      CFLAGS+=-DIMX8QM_SCU=1
+    endif
+    # Cacheable DRAM for load-and-verify, torn down before handoff.
+    ifeq ($(IMX8QM_MMU),1)
+      # The teardown needs the stack-free assembly routine in
+      # src/boot_aarch64_start.S, which this selects.
+      CFLAGS+=-DIMX8QM_MMU -DWOLFBOOT_AARCH64_MMU_TEARDOWN
+      # With the MMU on, DRAM is Normal cacheable and the wolfcrypt ARMv8
+      # assembly is safe: its NEON multi-register loads are only a problem
+      # while memory is Device-typed, which is why the shared AArch64 block
+      # defaults NO_ARM_ASM=1. Worth having, because SHA-384 dominates this
+      # target's boot: 4011 ms to 557 ms over a 32 MB image, hardware
+      # measured, with the signature still verifying. Set NO_ARM_ASM=1 to
+      # opt back out. This is first, so it wins the later ?= default.
+      NO_ARM_ASM ?= 0
+    endif
+    # Opt-in: pin the SD node to 3.3V high-speed and cap its clock. Off by
+    # default, since the board runs DDR50 at 50 MHz. Set it to keep Linux out
+    # of UHS, which is what makes a warm reboot work: once the card is at
+    # 1.8V, a reboot does no VDD cycle and wolfBoot's 3.3V CMD8 times out.
+    ifeq ($(IMX8QM_SD_NO_UHS),1)
+      CFLAGS+=-DIMX8QM_SD_NO_UHS
+    endif
+    # uSDHC board facts. Here rather than in the config because a command-line
+    # CFLAGS_EXTRA= would replace the config's, whereas CFLAGS is additive.
+    ifneq ($(filter 1,$(DISK_SDCARD) $(DISK_EMMC)),)
+      # Card detect is lsio_gpio5[22], so PRES_STATE bit 16 never sets.
+      # SDMA is on: the read is the dominant boot cost and PIO caps it near
+      # 1.6 MB/s regardless of bus clock. IMX8QM_SDHCI_PIO=1 falls back.
+      CFLAGS+=-DSDHCI_FORCE_CARD_DETECT
+      ifeq ($(IMX8QM_SDHCI_PIO),1)
+        CFLAGS+=-DSDHCI_SDMA_DISABLED
+      endif
+      # Read the payload in 64 KB chunks rather than the 512-byte default.
+      # A 32 MB image is 63083 separate commands at 512 bytes, and every one
+      # of them is below SDHCI_DMA_THRESHOLD (4 KB), so the transfer never
+      # reaches the SDMA path and pays full per-command overhead instead.
+      DISK_BLOCK_SIZE ?= 65536
+      CFLAGS+=-DDISK_BLOCK_SIZE=$(DISK_BLOCK_SIZE)
+      # Clock ceiling per medium: the SD is a removable slot whose sustained
+      # reads fail CRC above 25 MHz here; the soldered 8-bit eMMC has no such
+      # limit and takes the 3.3V high-speed rate. DISK_EMMC wins if both are
+      # set, matching the base-address selection in hal/imx8qm.c.
+      ifeq ($(DISK_EMMC),1)
+        IMX8QM_USDHC_MAX_CLK_KHZ ?= 52000
+      else ifeq ($(IMX8QM_SD_NO_UHS),1)
+        IMX8QM_USDHC_MAX_CLK_KHZ ?= 25000
+      else
+        IMX8QM_USDHC_MAX_CLK_KHZ ?= 50000
+      endif
+      CFLAGS+=-DIMX8QM_USDHC_MAX_CLK_KHZ=$(IMX8QM_USDHC_MAX_CLK_KHZ)
+    endif
+    # MMU/WOLFBOOT_FDT/DUALBOOT come from the shared AARCH64 block and only pull
+    # in the FDT codepath; imx8qm still runs MMU-off, 1:1.
+    ifeq ($(EL2_HYPERVISOR),1)
+      CFLAGS+=-DEL2_HYPERVISOR=1
+    endif
+  endif
+
   ifeq ($(TARGET),cm4)
     # Raspberry Pi Compute Module 4 - Broadcom BCM2711, Cortex-A72
     ARCH_FLAGS=-mcpu=cortex-a72+crypto -march=armv8-a+crypto -mtune=cortex-a72

config/examples/imx8qm-mek-qspi.config

@@ -0,0 +1,37 @@
+# NXP i.MX 8QuadMax MEK - bare-metal BL33, FlexSPI0 serial NOR boot. Separate
+# from imx8qm-mek.config because this is a different memory map, not a toggle.
+# Set SW2 to Octal SPI (POS-4 and POS-5 ON).
+#
+# Read, erase and program are hardware-validated against the on-board NOR.
+# See the FlexSPI notes in docs/Targets.md.
+ARCH=AARCH64
+TARGET=imx8qm
+SIGN?=ECC384
+HASH?=SHA384
+DEBUG?=1
+DEBUG_UART?=1
+SPMATH?=1
+SKIP_GIC_INIT?=1
+
+# wolfBoot runs from DRAM as BL33; the image is copied out of NOR before verify.
+EXT_FLASH=1
+SPI_FLASH=0
+NO_XIP=1
+# FlexSPI0 AHB (memory-mapped read) window.
+ARCH_FLASH_OFFSET?=0x08000000
+# MT35XU512ABA: 128 KiB sectors per "sf probe". Partitions are aligned to it,
+# and the first 1 MB is left free for the boot container at offset 0.
+WOLFBOOT_SECTOR_SIZE=0x20000
+WOLFBOOT_PARTITION_SIZE?=0x400000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08100000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x08500000
+# Unused: arch.mk selects update_ram.o for non-disk aarch64 targets.
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x08900000
+# Needed only because this config uses real partitions.
+WOLFBOOT_DTS_BOOT_ADDRESS?=0x08A00000
+WOLFBOOT_DTS_UPDATE_ADDRESS?=0x08B00000
+
+# Staging must clear the DTB's carveouts and the CMA pool at 0xc0000000.
+WOLFBOOT_RAMBOOT_MAX_SIZE=0x4000000
+WOLFBOOT_LOAD_ADDRESS?=0xA0000000
+WOLFBOOT_LOAD_DTS_ADDRESS?=0xA8000000

config/examples/imx8qm-mek.config

@@ -0,0 +1,41 @@
+# NXP i.MX 8QuadMax MEK - bare-metal BL33, replacing U-Boot in the NXP boot
+# container. As shipped: payload bundled in BL33, verified in DRAM, booted at
+# EL2. NOR has its own memory map: imx8qm-mek-qspi.config.
+#
+# Variants are make options, not separate configs, and are documented with their
+# effects in docs/Targets.md. Do not uncomment them here:
+#   DISK_SDCARD=1  DISK_EMMC=1  DISK_FS=fat32|ext4|both  IMX8QM_MMU=1
+#   EL2_HYPERVISOR=1  BOOT_EL1=1  IMX8QM_SCU=0  NO_ARM_ASM=1
+#   IMX8QM_USDHC_MAX_CLK_KHZ=<n>  IMX8QM_SD_NO_UHS=1  DISK_BLOCK_SIZE=<n>
+#   IMX8QM_SDHCI_PIO=1  BOOT_BENCHMARK=1
+# e.g. make DISK_SDCARD=1 IMX8QM_MMU=1 EL2_HYPERVISOR=1 BOOT_EL1=1  # Linux FIT
+#
+# Never pass CFLAGS_EXTRA= on the command line - it replaces, not appends.
+ARCH=AARCH64
+TARGET=imx8qm
+SIGN?=ECC384
+HASH?=SHA384
+DEBUG?=1
+DEBUG_UART?=1
+SPMATH?=1
+NO_XIP?=1
+SKIP_GIC_INIT?=1
+WOLFBOOT_SECTOR_SIZE?=0x1000
+WOLFBOOT_NO_PARTITIONS=1
+# Bounds the test-app link; a disk build reads its payload off the medium.
+WOLFBOOT_PARTITION_SIZE?=0x100000
+
+# A/B slots by GPT label, so they survive repartitioning. Disk builds only.
+CFLAGS_EXTRA+=-DBOOT_LABEL_A='"boot_a"'
+CFLAGS_EXTRA+=-DBOOT_LABEL_B='"boot_b"'
+#CFLAGS_EXTRA+=-DBOOT_PART_A=0
+#CFLAGS_EXTRA+=-DBOOT_PART_B=1
+#CFLAGS_EXTRA+=-DBOOT_FILE_A='"/boot/fitImage_A.itb"'   # with DISK_FS
+#CFLAGS_EXTRA+=-DBOOT_FILE_B='"/boot/fitImage_B.itb"'
+#WOLFBOOT_FS_CACHE_SIZE=512
+
+# Staging must clear the DTB's carveouts (~0x90000000-0x9c000000) and the CMA
+# pool at 0xc0000000. Keep LOAD_DTS_ADDRESS above LOAD_ADDRESS + RAMBOOT_MAX.
+WOLFBOOT_RAMBOOT_MAX_SIZE=0x4000000
+WOLFBOOT_LOAD_ADDRESS?=0xA0000000
+WOLFBOOT_LOAD_DTS_ADDRESS?=0xA8000000