Add support for PQC secure boot with MCXA 5xx family of MCUs

.github/workflows/check.yml

@@ -41,12 +41,18 @@ jobs:
       - name: cargo fmt --check (libs)
         run: cargo fmt --check
         working-directory: "./libs"
-      - name: cargo fmt --check (examples)
+      - name: cargo fmt --check (examples/rt685s)
         run: cargo fmt --check
         working-directory: "./examples/rt685s"
+      - name: cargo fmt --check (examples/mcxa-577app)
+        run: cargo fmt --check
+        working-directory: "./examples/mcxa-577app"
       - name: cargo fmt --check (bootloader-tool)
         run: cargo fmt --check
         working-directory: "./bootloader-tool"
+      - name: cargo fmt --check (mcxa-security-provisioning)
+        run: cargo fmt --check
+        working-directory: "./mcxa-security-provisioning"
 
   clippy:
     runs-on: ubuntu-latest
@@ -78,20 +84,35 @@ jobs:
           clippy_flags: -- -F clippy::suspicious -D clippy::correctness -F clippy::perf -F clippy::style
           github_token: ${{ secrets.GITHUB_TOKEN }}
           workdir: "./libs"
-      - name: cargo clippy (examples)
+          extra_args: --features mimxrt685s
+      - name: cargo clippy (examples/rt685s)
         uses: giraffate/clippy-action@v1
         with:
           reporter: "github-pr-check"
           clippy_flags: -- -F clippy::suspicious -D clippy::correctness -F clippy::perf -F clippy::style
           github_token: ${{ secrets.GITHUB_TOKEN }}
           workdir: "./examples/rt685s"
+      - name: cargo clippy (examples/mcxa-577app)
+        uses: giraffate/clippy-action@v1
+        with:
+          reporter: "github-pr-check"
+          clippy_flags: -- -F clippy::suspicious -D clippy::correctness -F clippy::perf -F clippy::style
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          workdir: "./examples/mcxa-577app"
       - name: cargo clippy (bootloader-tool)
         uses: giraffate/clippy-action@v1
         with:
           reporter: "github-pr-check"
           clippy_flags: -- -D clippy::suspicious -D clippy::correctness -D clippy::perf -D clippy::style
           github_token: ${{ secrets.GITHUB_TOKEN }}
           workdir: "./bootloader-tool"
+      - name: cargo clippy (mcxa-security-provisioning)
+        uses: giraffate/clippy-action@v1
+        with:
+          reporter: "github-pr-check"
+          clippy_flags: -- -F clippy::suspicious -D clippy::correctness -F clippy::perf -F clippy::style
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          workdir: "./mcxa-security-provisioning"
 
   # Enable once we have a released crate
   # semver:
@@ -135,7 +156,7 @@ jobs:
         working-directory: "./libs"
         env:
           RUSTDOCFLAGS: --cfg docsrs
-      - name: cargo doc (examples)
+      - name: cargo doc (examples/rt685s)
         run: cargo doc --no-deps
         working-directory: "./examples/rt685s"
         env:
@@ -197,12 +218,24 @@ jobs:
           log-level: warn
           manifest-path: ./libs/Cargo.toml
           command: check
-      - name: Cargo deny (examples)
+      - name: Cargo deny (examples/rt685s)
         uses: EmbarkStudios/cargo-deny-action@v2
         with:
           log-level: warn
           manifest-path: ./examples/rt685s/Cargo.toml
           command: check
+      - name: Cargo deny (examples/mcxa-577app)
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          log-level: warn
+          manifest-path: ./examples/mcxa-577app/Cargo.toml
+          command: check
+      - name: Cargo deny (mcxa-security-provisioning)
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          log-level: warn
+          manifest-path: ./mcxa-security-provisioning/Cargo.toml
+          command: check
 
   msrv:
     # check that we can build using the minimal rust version that is specified by this crate
@@ -233,12 +266,18 @@ jobs:
       - name: cargo +${{ matrix.msrv }} check (libs)
         run: cargo check --features mimxrt685s
         working-directory: "./libs"
-      - name: cargo +${{ matrix.msrv }} check (examples)
+      - name: cargo +${{ matrix.msrv }} check (examples/rt685s)
         run: cargo check
         working-directory: "./examples/rt685s"
+      - name: cargo +${{ matrix.msrv }} check (examples/mcxa-577app)
+        run: cargo check
+        working-directory: "./examples/mcxa-577app"
       - name: cargo +${{ matrix.msrv }} check (bootloader-tool)
         run: cargo check
         working-directory: "./bootloader-tool"
+      - name: cargo +${{ matrix.msrv }} check (mcxa-security-provisioning)
+        run: cargo check
+        working-directory: "./mcxa-security-provisioning"
 
   fuzz:
     runs-on: ubuntu-latest

.gitignore

@@ -0,0 +1,2 @@
+# Rust build artifacts
+target/

deny.toml

@@ -94,6 +94,7 @@ allow = [
     "MIT",
     "Apache-2.0",
     "Unicode-3.0",
+    "BSD-3-Clause",
     #"Apache-2.0 WITH LLVM-exception",
 ]
 # The confidence threshold for detecting a license from license text.

examples/mcxa-577app/.cargo/config.toml

@@ -0,0 +1,21 @@
+[build]
+target = "thumbv8m.main-none-eabihf"
+
+# Runner for app and bootloader. Provisioner overrides this in its own config.
+[target.thumbv8m.main-none-eabihf]
+runner = "probe-rs run --chip MCXA577 --speed 10000"
+
+# Flags for all workspace members (app, bootloader).
+# The provisioner sub-workspace uses RUSTFLAGS in its [env] to override this
+# set and exclude -Tdefmt.x, since it uses log/rtt-target instead of defmt.
+[target.'cfg(all(target_arch = "arm", target_os = "none"))']
+rustflags = [
+    "-C", "linker=flip-link",
+    "-C", "link-arg=-Tlink.x",
+    "-C", "link-arg=-Tdefmt.x",
+    "-C", "link-arg=--nmagic",
+    "-C", "force-frame-pointers=yes",
+]
+
+[env]
+DEFMT_LOG = "trace"

examples/mcxa-577app/Cargo.toml

@@ -0,0 +1,42 @@
+[workspace]
+resolver = "2"
+members = [
+    "app",
+    "bootloader",
+]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/OpenDevicePartnership/ec-slimloader"
+
+[workspace.dependencies]
+heapless = "0.8"
+partition-manager = { git = "https://github.com/OpenDevicePartnership/embedded-services.git", tag = "v0.1.0", default-features = false }
+partition-manager-macros = { git = "https://github.com/OpenDevicePartnership/embedded-services.git", tag = "v0.1.0" }
+static_cell = "2.1"
+embassy-sync = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+embassy-mcxa = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0", default-features = false }
+embassy-executor = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0", default-features = false }
+embassy-time = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+
+[patch.crates-io]
+embassy-embedded-hal = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+embassy-executor = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+embassy-executor-macros = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+embassy-futures = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+embassy-hal-internal = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+embassy-sync = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+embassy-time = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+embassy-time-driver = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+embassy-time-queue-utils = { git = "https://github.com/embassy-rs/embassy", rev = "f21d63db2d104a3b4c070408e529c109a64e65b0" }
+
+[profile.dev]
+panic = "abort"
+
+[profile.release]
+debug = 2
+lto = false
+opt-level = 2
+panic = "abort"

examples/mcxa-577app/app/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "mcxa-577app"
+version = "0.1.0"
+edition = "2021"
+license.workspace = true
+
+[dependencies]
+cortex-m = { version = "0.7", features = ["critical-section-single-core"] }
+cortex-m-rt = { version = "0.7", features = ["set-sp", "set-vtor"] }
+defmt = "1.0"
+defmt-rtt = "1.0"
+embassy-mcxa = { workspace = true, features = ["rt", "defmt", "mcxa5xx"] }
+embassy-executor = { workspace = true, features = ["platform-cortex-m", "executor-thread"] }
+embassy-time = { workspace = true, features = ["defmt", "defmt-timestamp-uptime"] }
+panic-probe = { version = "1.0", features = ["print-defmt"] }
+
+[[bin]]
+name = "app"
+path = "src/main.rs"
+
+

examples/mcxa-577app/app/build.rs

@@ -0,0 +1,17 @@
+use std::env;
+use std::fs::File;
+use std::io::Write;
+use std::path::PathBuf;
+
+fn main() {
+    // Put `memory.x` in our output directory and ensure it's
+    // on the linker search path.
+    let out = &PathBuf::from(env::var_os("OUT_DIR").unwrap());
+    File::create(out.join("memory.x"))
+        .unwrap()
+        .write_all(include_bytes!("memory.x"))
+        .unwrap();
+    println!("cargo:rustc-link-search={}", out.display());
+
+    println!("cargo:rerun-if-changed=memory.x");
+}

examples/mcxa-577app/app/memory.x

@@ -0,0 +1,21 @@
+MEMORY
+{
+  /* MCXA577 app memory map */
+  /* NOTE 1 K = 1 KiBi = 1024 bytes */
+  /* Bootloader uses 0x0000_0000..0x0000_FFFF (64KiB). App starts at slot_a = 0x0001_0000. */
+  FLASH  (rx) : ORIGIN = 0x00010000, LENGTH = 0x00019000  /* section 1: 100KB */
+  FLASH1 (rx) : ORIGIN = 0x00180000, LENGTH = 0x00019000  /* section 2: ~1.5MB offset, 100KB */
+  RAM (rwx) : ORIGIN = 0x20000000, LENGTH = 64K
+}
+
+/* Stack grows down from end of RAM */
+_stack_start = ORIGIN(RAM) + LENGTH(RAM);
+
+/* Extra linker section for code placed in FLASH1 (~1.5MB offset).
+ * Functions annotated with #[link_section = ".text_flash1"] will land here.
+ */
+SECTIONS {
+    .text_flash1 : ALIGN(4) {
+        *(.text_flash1 .text_flash1.*)
+    } > FLASH1
+} INSERT AFTER .text;

examples/mcxa-577app/app/src/main.rs

@@ -0,0 +1,91 @@
+#![no_std]
+#![no_main]
+
+use defmt_rtt as _;
+use embassy_executor::Spawner;
+use embassy_mcxa as hal;
+use embassy_time::Timer;
+use hal::bind_interrupts;
+use hal::dma::DmaChannel;
+use hal::gpio::{DriveStrength, Level, Output, SlewRate};
+use hal::peripherals::SGI0;
+use hal::sgi::hash::HashSize;
+use hal::sgi::{InterruptHandler, Sgi};
+use panic_probe as _;
+
+bind_interrupts!(struct Irqs {
+    SGI => InterruptHandler<SGI0>;
+});
+
+#[embassy_executor::main]
+async fn main(_spawner: Spawner) {
+    let mut p = hal::init(hal::config::Config::default());
+
+    defmt::info!("Blinky example with a sprinkle of SGI hashing");
+
+    let mut dma_ch0 = DmaChannel::new(p.DMA0_CH0.reborrow());
+    let mut hash_result = [0u8; 48];
+    let input_data: [u8; 256] = core::array::from_fn(|i| i as u8);
+
+    let mut sgi = Sgi::new(p.SGI0.reborrow(), Irqs).unwrap();
+    match sgi
+        .sha2_start_and_finalize(&mut dma_ch0, HashSize::Sha384, &input_data, &mut hash_result)
+        .await
+    {
+        Ok(()) => defmt::info!("DMA hash: {=[u8]:x}", &hash_result[..]),
+        Err(e) => defmt::error!("DMA hash failed: {:?}", defmt::Debug2Format(&e)),
+    }
+
+    let mut red = Output::new(p.P2_14, Level::High, DriveStrength::Normal, SlewRate::Fast);
+    let mut green = Output::new(p.P2_22, Level::High, DriveStrength::Normal, SlewRate::Fast);
+    let mut blue = Output::new(p.P2_23, Level::High, DriveStrength::Normal, SlewRate::Fast);
+
+    let mut rate = 250;
+
+    defmt::info!("It's showtime...");
+
+    for _ in 0..10 {
+        if rate > 1000 {
+            rate = 250;
+        }
+        red.toggle();
+        Timer::after_millis(rate).await;
+
+        red.toggle();
+        green.toggle();
+        Timer::after_millis(rate).await;
+
+        green.toggle();
+        blue.toggle();
+        Timer::after_millis(rate).await;
+        blue.toggle();
+
+        Timer::after_millis(rate).await;
+        rate = rate.wrapping_add(100);
+    }
+
+    defmt::info!("10 blink cycles done - jumping to FLASH1");
+    flash1_pattern(&mut red, &mut green, &mut blue).await;
+}
+
+/// Runs from FLASH1 (~1.5MB offset). All three LEDs pulse together, white,
+/// distinct from section 1's sequential RGB pattern.
+#[link_section = ".text_flash1"]
+#[inline(never)]
+async fn flash1_pattern(
+    red: &mut hal::gpio::Output<'_>,
+    green: &mut hal::gpio::Output<'_>,
+    blue: &mut hal::gpio::Output<'_>,
+) {
+    defmt::info!("Running from FLASH1");
+    loop {
+        red.set_low();
+        green.set_low();
+        blue.set_low();
+        Timer::after_millis(1000).await;
+        red.set_high();
+        green.set_high();
+        blue.set_high();
+        Timer::after_millis(1000).await;
+    }
+}

examples/mcxa-577app/bootloader/Cargo.toml

@@ -0,0 +1,39 @@
+[package]
+name = "mcxa-577app-bootloader"
+version = "0.1.0"
+edition = "2021"
+license.workspace = true
+
+[features]
+default = ["defmt", "certificate-logging", "verification-logging", "mcxa"]
+defmt = ["dep:defmt", "dep:defmt-or-log", "dep:defmt-rtt", "defmt-or-log/defmt"]
+log = ["dep:defmt-or-log", "defmt-or-log/log"]
+mcxa = ["ec-slimloader-mcxa/mcxa5xx"]
+mcxa5xxevk = ["ec-slimloader-mcxa/mcxa5xxevk"]
+certificate-logging = ["ec-slimloader-mcxa/certificate-logging"]
+verification-logging = ["ec-slimloader-mcxa/verification-logging"]
+
+[[bin]]
+name = "bootloader"
+path = "src/main.rs"
+
+[dependencies]
+cortex-m = { version = "0.7", features = ["critical-section-single-core"], default-features = false }
+cortex-m-rt = "0.7"
+defmt = { version = "1.0", optional = true }
+defmt-or-log = { version = "0.2.3", optional = true }
+defmt-rtt = { version = "1.0", optional = true }
+panic-probe = { version = "1.0", features = ["print-defmt"] }
+
+heapless = { version = "0.8", default-features = false }
+partition-manager = { workspace = true, features = ["macros"] }
+partition-manager-macros = { workspace = true }
+embassy-sync = { workspace = true }
+
+ec-slimloader-mcxa = { path = "../../../libs/ec-slimloader-mcxa", default-features = false, features = ["mcxa5xx", "defmt"] }
+ec-slimloader = { path = "../../../libs/ec-slimloader", default-features = false }
+ec-slimloader-state = { path = "../../../libs/ec-slimloader-state", default-features = false }
+mcxa-security-provisioning = { path = "../../../mcxa-security-provisioning", default-features = false, features = ["defmt"] }
+
+embassy-mcxa = { workspace = true, features = ["rt", "mcxa5xx"] }
+embassy-executor = { workspace = true, features = ["platform-cortex-m", "executor-thread"] }