Add Raspberry Pi Compute Module 4 (BCM2711) target + wolfCrypt FIPS 140-3

[dgarske]

Summary

Adds a wolfBoot target for the Raspberry Pi Compute Module 4 (CM4) - Broadcom BCM2711, quad-core Cortex-A72 (AArch64). wolfBoot replaces the second-stage OS loader (e.g. U-Boot): the VideoCore firmware loads wolfBoot as kernel8.img, and wolfBoot verifies the signed application image before booting it, extending the platform root of trust into the OS. wolfBoot can boot from a RAM-appended image or read A/B images from the onboard eMMC / microSD, and can optionally perform the verification inside the wolfCrypt FIPS 140-3 module.

CM4 target and authenticated boot

• New cm4 HAL (hal/cm4.c/.h/.ld) for BCM2711, with EL2 RAM-boot image handoff.
• wolfBoot is built as an AArch64 Linux kernel image: src/boot_aarch64_start.S prepends the 64-byte ARM64 image header ("ARM\x64" magic) and hal/cm4.ld links at 0x200000. The VideoCore firmware only transfers control to a 64-bit kernel that carries this header, and runs it in place at the 2 MB-aligned 0x200000 (it does not relocate a header image to 0x80000).
• Console is the BCM2711 mini-UART (0xFE215040, Linux ttyS0) on GPIO14/15, inherited from the firmware; build with -DCM4_UART_PL011 to use the PL011 instead on boards that route it to the header.
• Cortex-A72 build support in arch.mk (-mcpu=cortex-a72+crypto, -mstrict-align for MMU-off operation).
• Example config config/examples/cm4.config (RAM boot, SIGN=ECC384 HASH=SHA384).

Root of trust:

BCM2711 boot ROM -> SPI EEPROM -> VideoCore firmware -> wolfBoot (kernel8.img)
   -> verify (ECDSA P-384 / SHA-384) -> application

eMMC / SD A/B disk boot

• config/examples/cm4_emmc.config (onboard eMMC) and config/examples/cm4_sdcard.config (microSD) drive the BCM2711 EMMC2 controller (0xFE340000) through the generic SDHCI driver (src/sdhci.c + hal/cm4.c register glue) to read A/B signed images from GPT partitions. wolfBoot parses the GPT, selects the higher-version image, verifies it, ELF-loads it (ELF=1) to WOLFBOOT_LOAD_ADDRESS, and boots.
• The eMMC path is hardware-validated (below). The microSD path shares the same driver but needs a CM4 Lite - an eMMC module disables the carrier's microSD slot.

wolfCrypt FIPS 140-3

• FIPS=1 build option (options.mk) rebuilds the wolfcrypt object list as the validated module boundary in link order (wolfcrypt_first ... fips/fips_test ... wolfcrypt_last), pointing WOLFBOOT_LIB_WOLFSSL at a FIPS wolfSSL tree. The block guards impossible builds early (FIPS=1 requires NO_ARM_ASM=1 and a FIPS-approved SIGN).
• include/user_settings.h FIPS gate: enables the module's algorithm set, keeps the RNG/DRBG enabled, and provides a DRBG entropy seed (/dev/urandom on sim, BCM2711 RNG200 hardware TRNG on CM4).
• src/loader.c runs the power-on self-test at boot (fipsEntry, since bare-metal has no .init_array) and refuses to boot unless the module is operational; on a self-test failure it prints the runtime in-core hash to seal into verifyCore[].
• Configs: config/examples/sim-fips.config, plus an off-by-default FIPS=1 block in config/examples/cm4.config / config/examples/cm4_emmc.config.

Documentation

• docs/Targets.md: CM4 section covering the ARM64 header + 0x200000 load, mini-UART console, build, signing, config.txt, flashing (microSD / eMMC via rpiboot), eMMC A/B disk boot, and boot output.
• docs/FIPS.md: building with FIPS, DRBG entropy, in-core hash sealing (including the one-pass reseal of fips_test.o only), and bare-metal notes.

Testing

• Builds clean with both aarch64-none-elf- and aarch64-linux-gnu-.
• CI (test-configs.yml): cm4_test, cm4_sdcard_test, cm4_fips_test (build-only FIPS on aarch64), and sim_fips_test (host FIPS build); host SDHCI-glue unit test (tools/unit-tests/unit-cm4-sdhci.c).
• Signing + verify/update state machine validated on the native sim target with SIGN=ECC384 HASH=SHA384.
• FIPS 140-3 on the simulator: fully validated - sim-fips.config builds, the module reaches operational state (in-core integrity + POST/CASTs pass), and wolfBoot performs FIPS-backed integrity + signature verification and A/B updates.
• eMMC A/B disk boot validated end-to-end on real CM4 hardware (BCM2711, eMMC, CM4-IO-BASE-B): SDHCI/eMMC card init -> GPT parse -> A/B version select -> SHA-384 integrity -> ECDSA-P384 signature verify -> ELF load -> boot of a signed payload. A/B behavior confirmed on hardware: higher-version select, same-version failover (corrupt A -> boot B), and anti-rollback (higher fails -> refuse lower).
• FIPS 140-3 on CM4 hardware: fully validated - after sealing the in-core hash, wolfBoot reports FIPS 140-3 module operational and the module gates the eMMC disk boot with SHA-384 integrity and ECDSA-P384 signature verification (entropy from the BCM2711 RNG200 TRNG).

wolfBoot CM4 (BCM2711 Cortex-A72) hal_init, EL2
FIPS 140-3 module operational
...
Versions, A:1 B:2
Attempting boot from P:B
Checking image integrity...done
Verifying image signature...done
Firmware Valid.
...
>>> CM4 DISK APP OK: wolfBoot read + verified + booted from eMMC <<<

Notes

• FIPS requires a licensed/validated (or FIPS-ready) wolfSSL tree; see docs/FIPS.md. A production, CMVP-validated deployment additionally requires the licensed validated bundle at the validated revision.

[Copilot]

Pull request overview

Adds a new wolfBoot target for the Raspberry Pi Compute Module 4 (BCM2711 / Cortex-A72), including a dedicated HAL, linker script, build flags, example configs, and target documentation to support firmware-loading wolfBoot as kernel8.img and verifying a signed RAM-boot payload.

Changes:

• Introduces a CM4 HAL (hal/cm4.c/.h/.ld) with PL011 UART console support, RAM-boot partition addresses, and optional SDHCI (eMMC/SD) glue.
• Extends AArch64 build configuration for TARGET=cm4 with Cortex-A72+crypto flags and ensures the startup path includes the CM4 HAL header.
• Adds CM4 example configs and a new documentation section describing build/sign/flash/boot flow.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test-app/app_cm4.c	Adds a CM4-specific minimal bare-metal test application entry point.
src/boot_aarch64_start.S	Includes the CM4 HAL header when building for TARGET_cm4.
Makefile	Declares wolfboot.bin as the primary build artifact for TARGET=cm4.
hal/cm4.ld	Adds a CM4 linker script aligned to the firmware load address and fixed partition map.
hal/cm4.h	Defines CM4 target startup macros and BCM2711 MMIO base.
hal/cm4.c	Implements the CM4 HAL (UART + RAM boot addresses + optional SDHCI platform glue).
docs/Targets.md	Documents CM4 build/sign/flash steps and expected boot output.
config/examples/cm4.config	Provides a RAM-boot CM4 example configuration (ECC384/SHA384).
config/examples/cm4_sdcard.config	Provides an (unvalidated) disk-updater CM4 configuration scaffold for eMMC/SD A/B.
arch.mk	Adds Cortex-A72+crypto compiler flags for TARGET=cm4 and enables ARMv8 crypto ASM path.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

[danielinux]

A couple of minor things. Also the PR description seems outdated (says CM4 FIPS validation is work in progress but it seems complete here)

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

tools/scripts/cm4/prepare_emmc.sh:12

• The script header says the prove-out banner is printed over the PL011 UART, but the referenced payload (disk_app.S) writes to the BCM2711 mini-UART (AUX / ttyS0). This is misleading for anyone wiring up the serial console.

# version. Prove-out prints ">>> CM4 DISK APP OK <<<" over the PL011 UART.

tools/scripts/cm4/prepare_emmc.sh:32

• FWBASE points at raspberrypi/firmware master, so the script can silently start producing different boot artifacts over time (and it downloads them even when later run under sudo). Allow callers to pin the firmware revision (commit/tag/branch) for reproducibility.

FWBASE="https://raw.githubusercontent.com/raspberrypi/firmware/master/boot"
DEV="${1:-}"