Add Agilex 5 FCS and wolfBoot integration

.github/workflows/test-build-agilex5.yml

@@ -0,0 +1,28 @@
+name: Agilex 5 wolfBoot build
+
+on:
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  workflow_dispatch:
+  pull_request:
+    branches: [ '*' ]
+    paths:
+      - 'arch.mk'
+      - 'config/examples/agilex5_013b_sdcard.config'
+      - 'hal/agilex5.*'
+      - 'hal/board/agilex5/**'
+      - 'include/sdhci.h'
+      - 'src/boot_aarch64*'
+      - 'src/sdhci.c'
+      - 'src/update_disk.c'
+      - 'test-app/app_agilex5.c'
+      - 'tools/bin-assemble/**'
+      - 'tools/keytools/**'
+      - '.github/workflows/test-build-agilex5.yml'
+
+jobs:
+  build:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/agilex5_013b_sdcard.config

.github/workflows/test-configs.yml

@@ -8,6 +8,12 @@ on:
 
 jobs:
 
+  agilex5_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/agilex5_013b_sdcard.config
+
   cypsoc6_test:
     uses: ./.github/workflows/test-build-psoc6.yml
     with:

arch.mk

@@ -155,6 +155,17 @@ ifeq ($(ARCH),AARCH64)
     CFLAGS_EXTRA+=-DSDHCI_SDMA_DISABLED
   endif
 
+  ifeq ($(TARGET),agilex5)
+    # Altera Agilex 5: Cortex-A55, entered as non-secure BL33 at EL2 by
+    # the GSRD TF-A BL31 image. SPL owns DDR, clocks, pinmux and resets.
+    ARCH_FLAGS=-mcpu=cortex-a55+crypto -march=armv8.2-a+crypto \
+               -mtune=cortex-a55
+    CFLAGS+=$(ARCH_FLAGS) -DCORTEX_A55
+    CFLAGS+=-DWOLFBOOT_DUALBOOT -DWOLFBOOT_UBOOT_LEGACY
+    # BL31 owns GICv3 and secondary-core/PSCI setup. Do not touch RVBAR.
+    CFLAGS+=-DSKIP_RVBAR=1 -DSKIP_GIC_INIT=1
+  endif
+
   ifeq ($(TARGET),nxp_ls1028a)
     ARCH_FLAGS=-mcpu=cortex-a72+crypto -march=armv8-a+crypto -mtune=cortex-a72
     CFLAGS+=$(ARCH_FLAGS) -DCORTEX_A72
@@ -174,7 +185,7 @@ ifeq ($(ARCH),AARCH64)
   endif
 
   # Default ARM ASM setting for unrecognized AARCH64 targets
-  ifeq ($(filter zynq versal nxp_ls1028a,$(TARGET)),)
+  ifeq ($(filter zynq versal agilex5 nxp_ls1028a,$(TARGET)),)
     NO_ARM_ASM?=1
   endif
 

config/examples/agilex5_013b_sdcard.config

@@ -0,0 +1,61 @@
+# wolfBoot configuration for Altera Agilex 5 DK-A5E013BM16AEA (013B)
+#
+# SDM -> U-Boot SPL -> TF-A BL31 -> wolfBoot BL33/EL2 -> signed Linux FIT
+
+ARCH?=AARCH64
+TARGET?=agilex5
+WOLFBOOT_VERSION?=1
+
+SIGN?=RSA4096
+HASH?=SHA3
+IMAGE_HEADER_SIZE?=1024
+
+DEBUG?=1
+DEBUG_SYMBOLS=1
+DEBUG_UART=1
+
+DISK_SDCARD?=1
+DISK_EMMC?=0
+EXT_FLASH?=0
+NO_XIP=1
+ELF?=1
+GZIP?=1
+
+VTOR?=1
+NO_ASM?=0
+ALLOW_DOWNGRADE?=0
+NVM_FLASH_WRITEONCE?=0
+SPMATH?=1
+RAM_CODE?=0
+DUALBANK_SWAP?=0
+PKA?=0
+WOLFTPM?=0
+
+USE_GCC=1
+CROSS_COMPILE?=aarch64-none-elf-
+
+# SPL/BL31 load this binary in place of U-Boot proper. These values must match
+# the u-boot.itb BL33 load and entry properties.
+WOLFBOOT_ORIGIN=0x80200000
+
+# Signed payload staging, extracted Linux Image, and DTB do not overlap.
+WOLFBOOT_LOAD_ADDRESS?=0x90000000
+WOLFBOOT_LOAD_DTS_ADDRESS?=0x8f000000
+WOLFBOOT_RAMBOOT_MAX_SIZE?=0x10000000
+
+# MBR: p1 FAT boot, p2 signed A, p3 signed B, p4 Linux rootfs.
+WOLFBOOT_NO_PARTITIONS=1
+CFLAGS_EXTRA+=-DBOOT_PART_A=1 -DBOOT_PART_B=2
+CFLAGS_EXTRA+=-DDISK_BLOCK_SIZE=0x80000
+CFLAGS_EXTRA+=-DLINUX_BOOTARGS_ROOT=\"/dev/mmcblk0p4\"
+
+# SD6HC uses SDMA for cache-coherent multi-block transfers.
+CFLAGS_EXTRA+=-DSDHCI_FORCE_CARD_DETECT
+
+# Required by generic config checks even though disk partitions select A/B.
+WOLFBOOT_PARTITION_BOOT_ADDRESS=0x90000000
+WOLFBOOT_PARTITION_SIZE=0x0c800000
+WOLFBOOT_SECTOR_SIZE=0x1000
+
+# Uncomment during storage bring-up.
+#CFLAGS_EXTRA+=-DDEBUG_SDHCI -DDEBUG_DISK

docs/Agilex5.md

@@ -0,0 +1,99 @@
+# Altera Agilex 5
+
+The Agilex 5 port follows wolfBoot's established Cortex-A TF-A model. It does
+not replace the platform first stage or TF-A:
+
+```text
+SDM -> U-Boot SPL -> TF-A BL31/EL3 -> wolfBoot BL33/EL2 -> signed Linux FIT
+```
+
+SPL remains responsible for DDR, clocks, resets, pinmux, the SD6HC PHY and
+loading the signed U-Boot FIT. BL31 remains responsible for EL3, GICv3, PSCI,
+secondary CPUs and security-controller setup. The U-Boot-proper payload in the
+FIT is replaced with `wolfboot.bin` at load/entry address `0x80200000`.
+
+## Build
+
+Use an isolated wolfBoot checkout with initialized wolfSSL submodules:
+
+```sh
+cp config/examples/agilex5_013b_sdcard.config .config
+make clean
+make -j"$(nproc)"
+```
+
+The hosted build is also covered by the `Agilex 5 wolfBoot build` GitHub
+Actions workflow. It installs the same freestanding AArch64 toolchain used by
+the other Cortex-A ports and builds this configuration on every relevant
+pull request; hardware is required only for the SD-card and Linux handoff
+steps below.
+
+The default RSA-4096/SHA3-384 key is for development only. Production builds
+must supply controlled signing keys and keep them separate from both the SDM
+owner key and the SPL FIT-signing key.
+
+Create the Linux FIT from the GSRD `Image` and the exact board DTB, then sign
+that FIT with wolfBoot's normal image-signing flow. Initialize both raw A/B
+partitions with a valid signed image for the first boot.
+
+The checked-in `hal/agilex5.its` is a minimal FIT example. A GSRD production
+image must use the GSRD-generated kernel load address and board DTB, then be
+signed with the deployment key. Do not place private keys in the source tree
+or the WIC.
+
+## GSRD integration
+
+Keep the GSRD `u-boot.itb` structure and signature intact:
+
+- retain the existing BL31 firmware node;
+- replace only the U-Boot-proper/BL33 data with `wolfboot.bin`;
+- retain load and entry `0x80200000`;
+- rebuild and sign the ITB using the same GSRD/SPL trust configuration.
+
+Use a four-partition WIC:
+
+1. 128 MiB FAT boot partition containing the signed boot artifacts;
+2. 200 MiB raw wolfBoot A partition;
+3. 200 MiB raw wolfBoot B partition;
+4. ext4 Linux root filesystem.
+
+The wolfSSL FCS packages belong in partition 4. libfcs is Linux userspace
+software and is deliberately not linked into bare-metal wolfBoot.
+
+## Test order
+
+1. Cross-build the existing ZynqMP and Versal SD-card configurations to catch
+   shared AArch64 regressions, then build Agilex 5.
+2. First boot a minimal signed payload that prints its exception level and
+   proves the generic timer and PSCI reset path.
+3. Exercise SD reads in PIO mode, then valid, corrupt-signature, truncated and
+   oversized images.
+4. Boot Linux and require the DTB in x0, x1-x3 zero, four online CPUs, working
+   PSCI reboot, and rootfs `/dev/mmcblk0p4`.
+5. Build the complete WIC, inspect all four partitions, flash the whole card,
+   compare the complete image span, cold boot, and test A-to-B fallback by
+   corrupting only a disposable copy of A.
+6. From the booted WIC run `/usr/bin/wolfcrypttest`. Require exit zero and
+   `ALTERA-FCS test passed!` to prove the Linux image still provides hardware
+   FCS offload.
+
+For the reproducible meta-wolfSSL customer flow, use
+`recipes-wolfssl/wolfboot/agilex5/README.md` in the meta-wolfSSL checkout. It
+covers the Kas fragment, the four-partition WIC inspection, whole-device flash
+and byte comparison, virtual SDM owner-key reprovisioning after power loss,
+and the target-side loader/FCS checks. wolfBoot itself does not link libfcs;
+the FCS test belongs to the Linux image in WIC partition 4.
+
+Do not patch TF-A or take over GICv3, SMMU/firewall, mailbox, or PSCI ownership
+without a reproduced hardware failure showing the stock GSRD contract is
+insufficient.
+
+## CI and hardware boundary
+
+CI proves that the Agilex 5 configuration, linker script, startup assembly,
+SDHCI changes, and test application remain buildable without Agilex hardware.
+It cannot prove SPL DDR training, TF-A handoff, SDM services, signed FIT
+verification, or FCS offload. Those require the GSRD image and the
+DK-A5E013BM16AEA. Record the WIC hash, complete-card comparison, UART boot
+log, target `uname`, loader output, and `wolfcrypttest` exit status and FCS
+marker for a hardware release sign-off.

docs/Targets.md

@@ -4,6 +4,7 @@ This README describes configuration of supported targets.
 
 ## Supported Targets
 
+* [Altera Agilex 5](#altera-agilex-5-013b)
 * [Simulated](#simulated)
 * [Analog Devices MAX32666](#analog-devices-max32666)
 * [Cortex-A53 / Raspberry PI 3](#cortex-a53--raspberry-pi-3-experimental)
@@ -8707,3 +8708,22 @@ Boot success marked. Version: 1
 | `FLAGS_HOME` | Keep boot flags in internal flash (required when `EXT_FLASH=1`). |
 | `MAX3266X_TPU` | Enable TPU hardware SHA256 acceleration (requires `MSDK_DIR`). |
 | `MAX3266X_OLD` | Build TPU acceleration against the older, deprecated Maxim SDK tree instead of the modern MSDK. |
+## Altera Agilex 5 (013B)
+
+The Agilex 5 DK-A5E013BM16AEA port runs as the signed BL33 payload in the
+GSRD handoff: SDM -> U-Boot SPL -> TF-A BL31 -> wolfBoot -> Linux FIT. SPL
+owns DDR and controller initialization; TF-A owns EL3, GICv3 and PSCI. The
+port keeps those responsibilities unchanged and loads signed A/B Linux FITs
+from raw MBR partitions on the SD card.
+
+Build the hosted configuration with:
+
+```sh
+cp config/examples/agilex5_013b_sdcard.config .config
+make clean
+make -j"$(nproc)"
+```
+
+See [docs/Agilex5.md](Agilex5.md) for the GSRD FIT/WIC layout, DT handoff,
+hardware test order, and the boundary between the bare-metal bootloader and
+the Linux libfcs/wolfSSL integration.