[dgarske]

Description

Adds TARGET=s32g2 for the NXP S32G274A on the S32G-VNP-GLDBOX (RDB2). wolfBoot is the Boot ROM's application image: it runs from SRAM at EL3 in place of U-Boot, brings the SoC up, verifies a signed FIT and enters Linux at EL2.

What it adds

• hal/s32g2.c, hal/s32g2.h, hal/s32g2.ld - HAL: LINFlexD console, VR5510 watchdog over I2C, clock tree, Ncore, EL3 identity MMU, GICv3, secondary cores on a spin table, QuadSPI NOR driver behind the ext_flash API, device tree fixups
• hal/s32g2_ddr.c - LPDDR4 controller and PHY bring-up. The board's register tables and the Synopsys PHY training firmware are not in the tree: tools/scripts/s32g2/s32g2-ddr-blob.py packs them from an NXP BSP U-Boot checkout into a blob the build links in
• config/examples/s32g2-goldbox.config - boot from SD or eMMC with two FIT file slots and boot confirmation; s32g2-goldbox-qspi.config - boot from QuadSPI NOR with BOOT/UPDATE partitions in the NOR and the partition state kept as a journal (NVM_FLASH_JOURNAL), because the flash allows each 16-byte ECC unit to be programmed once per erase
• tools/scripts/s32g2/ - Boot ROM image writer (IVT, DCD, QuadSPI parameter block) and FIT build script
• docs/Targets.md, CI build jobs for each variant

Touches shared code

• src/boot_aarch64_start.S, src/boot_aarch64.c - S32G2 blocks only: SRAM ECC initialisation before the first store, EL3 fault vectors, secondary core entry, EL3 to EL2 handoff; invalidate_dcache_range moves next to flush_dcache_range so it is built for every AArch64 target
• hal/imx_usdhc_sdhci.c, include/aarch64_arch.h - the shared uSDHC shim now also serves S32G2, and its SDMA cache maintenance is available to any target that defines WOLFBOOT_AARCH64_DCACHE_RANGE
• src/update_disk.c - ALLOW_DOWNGRADE=1 no longer fails to build on an unused variable
• src/update_disk.c, src/disk_fs.c, src/fat32.c, src/ext4.c - DISK_BOOT_CONFIRM now also covers FAT32 and ext4 file slots: the state trailer is the last 8 bytes of the image file, located through the read path (fs_map()) and rewritten in place, with no filesystem structure changed. The booted file is published as /chosen/wolfboot,boot-file
• hal/imx8qm.c - the device tree fixup now publishes /chosen/wolfboot,boot-part, which its hal_dts_fixup() override had dropped
• src/fdt.c - fit_ramdisk_loaded() reports whether the FIT ramdisk loader wrote the initrd range, so a device tree fixup can clear a range the tree already carried
• arch.mk - -U_FORTIFY_SOURCE for AArch64, so distribution aarch64-linux-gnu- compilers do not emit __memcpy_chk into a bare-metal image

Testing

Validated on a GoldBox (S32G274A rev 2.1, RDB2 rev D): Boot ROM boot from SD and from QuadSPI NOR (plain SPI and octal DTR parameter blocks), the signed FIT read from SD (both file slots), eMMC and the NOR BOOT partition, Linux 5.4 (BSP29) to a login prompt with four cores. Boot confirmation on file slots was run on the SD card (FAT32): a staged slot boots on probation, is skipped when not confirmed, and stays selected once Linux confirms it. A NOR update was run with the programmer build: a newer FIT staged in UPDATE with the update marker is selected, recorded as testing and booted, and keeps booting across cold boots. Also run on the board from SD: a build without the wolfBoot console (DEBUG_UART=0), a FIT_RAMDISK=1 build with a FIT that carries no ramdisk, the ALLOW_DOWNGRADE=1 fallback to the older slot when the newer one fails to verify, and the NOR programmer refusing an oversized file and an out-of-range offset. ext4 file slots are covered by host unit tests only. The i.MX 8QuadMax and _FORTIFY_SOURCE changes are build-tested only.

[Copilot]

🟡 Changes recommended

Unresolved critical flash-programming and build-reuse defects can erase unrelated NOR partitions or overwrite the bootloader, while programming can proceed despite failed QuadSPI initialization.

9 open issues

• Persist S32G2 options in config.mk · New
• Rebuild programmer objects when build options change · New
• Reject RAW volumes and oversized input before programming · New
• Stop programming when QuadSPI initialization fails · New
• Track DDR blob changes as build dependencies · New
• Return zero after successful ext_flash_write · New
• Preserve authenticated ramdisk ranges during DTB fixup · New
• Resolve key paths before changing directories · New
• Skip staging copies when source and destination match · New

What changed in this PR

Adds TARGET=s32g2 for the NXP S32G274A GoldBox, allowing wolfBoot to replace U-Boot as the Boot ROM application, verify a signed FIT, and enter Linux at EL2.

Changes:

• Adds SoC and DDR initialization, storage drivers, device-tree fixups, and multicore startup.
• Provides SD/eMMC and QuadSPI configurations, image-generation tools, documentation, and CI build coverage.
• Extends shared AArch64 cache maintenance and uSDHC support, and fixes the ALLOW_DOWNGRADE unused-variable warning.

File	Description
tools/​scripts/​s32g2/​s32g2-mkfit.sh	Builds and signs kernel-plus-DTB FIT images.
tools/​scripts/​s32g2/​s32g2-ddr-blob.py	Packages external DDR tables and training firmware.
tools/​scripts/​s32g2/​s32g2_mkimage.py	Creates SD/eMMC and QuadSPI Boot ROM images.
src/​update_disk.c	Suppresses an unused-variable warning with downgrade support.
src/​boot_aarch64.c	Adds the S32G2 EL3-to-EL2 handoff.
src/​boot_aarch64_start.S	Adds SRAM initialization, fault vectors, and secondary-core startup.
Makefile	Selects wolfboot.bin as the target output.
include/​aarch64_arch.h	Exposes cache-range maintenance independently of EL2 mapping.
hal/​s32g2.ld	Defines SRAM placement, alignment, and stack space.
hal/​s32g2.its	Defines the kernel and device-tree FIT layout.
hal/​s32g2.h	Defines platform registers, memory layout, and interfaces.
hal/​s32g2.c	Implements SoC initialization, storage, and Linux preparation.
hal/​s32g2_ddr.c	Implements LPDDR4 training and controller setup.
hal/​imx_usdhc_sdhci.c	Extends shared uSDHC and DMA cache support to S32G2.
docs/​Targets.md	Documents building, programming, hardware setup, and limitations.
config/​examples/​s32g2-goldbox.config	Configures SD/eMMC boot with two FIT file slots.
config/​examples/​s32g2-goldbox-qspi.config	Configures NOR boot and image partitions.
arch.mk	Adds architecture flags, objects, and platform options.
.gitignore	Ignores generated platform artifacts.
.github/​workflows/​test-configs.yml	Adds SD, eMMC, NOR, and programmer build jobs.

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #984

Scan targets checked: wolfboot-src, wolfboot-bugs
Not reviewed (no scan target covers them): .github/workflows/test-configs.yml, .gitignore, Makefile, arch.mk, config/examples/s32g2-goldbox-qspi.config, config/examples/s32g2-goldbox.config, docs/Targets.md, hal/s32g2.h, hal/s32g2.its, hal/s32g2.ld, src/boot_aarch64_start.S, tools/scripts/s32g2/s32g2-ddr-blob.py, tools/scripts/s32g2/s32g2-mkfit.sh, tools/scripts/s32g2/s32g2_mkimage.py
Coverage: 6 of 6 in-scope changed file(s) opened by the reviewer

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Max

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #984

Scan targets checked: wolfboot-src, wolfboot-bugs
Not reviewed (no scan target covers them): .github/workflows/test-configs.yml, .gitignore, Makefile, arch.mk, config/examples/s32g2-goldbox-qspi.config, config/examples/s32g2-goldbox.config, docs/Targets.md, docs/compile.md, hal/s32g2.h, hal/s32g2.its, hal/s32g2.ld, src/boot_aarch64_start.S, tools/config.mk, tools/scripts/s32g2/s32g2-ddr-blob.py, tools/scripts/s32g2/s32g2-mkfit.sh, tools/scripts/s32g2/s32g2_mkimage.py, tools/unit-tests/Makefile
Coverage: 7 of 13 in-scope changed file(s) opened by the reviewer; not opened: hal/library_fs.c, hal/s32g2.c, include/disk_fs.h, include/ext4.h, include/fat32.h, tools/unit-tests/unit-fat32.c

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[Copilot]

🟡 Changes recommended

Unchecked QSPI lengths and offsets can cause EL3 faults or out-of-device writes, while writable ext4 mappings can corrupt other files on shared-block volumes.

6 open issues

• Reject QSPI reads that exceed the NOR device bounds · New
• Validate program offset before calculating remaining capacity · New
• Block writable mappings on shared-block ext4 volumes · New
• Enable DDR polling in the device tree when required · New
• Clear stale initrd properties when no ramdisk was loaded · New
• Reject image-overlapping trailers before decoding slot state · New

9 resolved since last review

• Stop programming when QuadSPI initialization fails
• Reject RAW volumes and oversized input before programming
• Rebuild programmer objects when build options change
• Persist S32G2 options in config.mk
• Skip staging copies when source and destination match
• Resolve key paths before changing directories
• Preserve authenticated ramdisk ranges during DTB fixup
• Return zero after successful ext_flash_write
• Track DDR blob changes as build dependencies

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #984

Scan targets checked: wolfboot-src, wolfboot-bugs
Not reviewed (no scan target covers them): .github/workflows/test-configs.yml, .gitignore, Makefile, arch.mk, config/examples/s32g2-goldbox-qspi.config, config/examples/s32g2-goldbox.config, docs/Targets.md, docs/compile.md, hal/s32g2.h, hal/s32g2.its, hal/s32g2.ld, src/boot_aarch64_start.S, tools/config.mk, tools/scripts/s32g2/s32g2-ddr-blob.py, tools/scripts/s32g2/s32g2-mkfit.sh, tools/scripts/s32g2/s32g2_mkimage.py, tools/unit-tests/Makefile
Coverage: 3 of 7 in-scope changed file(s) opened by the reviewer; not opened: hal/s32g2.c, include/ext4.h, include/fdt.h, tools/unit-tests/unit-update-disk-fs.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[Copilot]

🟡 Changes recommended

Unresolved critical defects allow conflicting memory translation attributes and let startup use SRAM after ECC initialization times out, risking faults before the console is available.

6 open issues

• Use break-before-make when replacing S32G2 memory attributes · New
• Stop startup when SRAM ECC initialization times out · New
• Pad QSPI FIFO fills to 16-byte units for short writes · New
• Halt NOR boot when S32G2 DTB fixups fail · New
• Reject writable mappings for fs-verity files · New
• Remove stale boot-file property when selecting a raw slot · New

6 resolved since last review

• Block writable mappings on shared-block ext4 volumes
• Validate program offset before calculating remaining capacity
• Reject QSPI reads that exceed the NOR device bounds
• Reject image-overlapping trailers before decoding slot state
• Clear stale initrd properties when no ramdisk was loaded
• Enable DDR polling in the device tree when required

_{Review effort: Balanced}