Fixes for Xilinx Zynq UltraScale+ MPSoC:

* Fixes to support wolfBoot native make and gcc-arm cross compiler. ZD 18159
* Adjust wolfBoot linker script to not use 0 base, instead use end of DDR - 1MB.
* Fixed QSPI bare-metal driver for multi-sector and read return code.
* Fixed issue with Xilinx XMSS IMAGE_HEADER_SIZE in documentation. It should be 5000 bytes.
* Performance optimizations for QSPI to allow configuration of SPI clock.
* Added support for SHA3 with ARMASM.
* Added Flattened uImage Tree (FIT) image (FDT format).
* Added Aarch64 support for FDT fixups.
* Added Aarch64 startup to support EL2.
* Added MMU and Cache support for Exception level 2.
* Added documentation about exception levels
* Updated fdt-parser to support saving off larger data images.

IDE/XilinxSDK/.cproject

@@ -131,7 +131,7 @@
                         </toolChain>
                     </folderInfo>
                     <sourceEntries>
-                        <entry excluding="src/qspi_flash.c|IDE/AURIX|IDE/CCS|IDE/MPLAB|IDE/Renesas|.git|IDE/IAR|test-app|tools|lib/wolfPKCS11|lib/wolfTPM|lib/wolfssl/linuxkm|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-aes-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha256-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-aes-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha256-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/autosar|lib/wolfssl/wrapper|lib/wolfssl/zephyr|src/boot_x86_fsp.c|src/boot_x86_fsp_start.S|src/boot_x86_fsp_payload.c|src/boot_x86_64.c|src/boot_renesas.c|src/boot_renesas_start.S|src/boot_ppc_start.S|src/boot_ppc_mp.S|src/boot_ppc.c|src/x86|lib/wolfTPM/examples|lib/wolfTPM/tests|lib/wolfTPM/IDE|lib/wolfssl/tests|lib/wolfssl/tirtos|lib/wolfssl/swig|lib/wolfssl/mqx|lib/wolfssl/mplabx|lib/wolfssl/IPP|lib/wolfssl/mcapi|lib/wolfssl/testsuite|lib/wolfssl/examples|lib/wolfssl/IDE|lib/wolfssl/wolfcrypt/user-crypto|lib/wolfssl/wolfcrypt/src/aes_asm.S|lib/wolfssl/wolfcrypt/src/aes_gcm_asm.S|lib/wolfssl/wolfcrypt/src/aes_gcm_x86_asm.S|lib/wolfssl/wolfcrypt/src/aes_xts_asm.S|lib/wolfssl/wolfcrypt/src/chacha_asm.S|lib/wolfssl/wolfcrypt/src/fe_x25519_asm.S|lib/wolfssl/wolfcrypt/src/poly1305_asm.S|lib/wolfssl/wolfcrypt/src/sha256_asm.S|lib/wolfssl/wolfcrypt/src/sha3_asm.S|lib/wolfssl/wolfcrypt/src/sha512_asm.S|lib/wolfssl/wolfcrypt/src/sm3_asm.S|lib/wolfssl/wolfcrypt/src/sp_sm2_x86_64_asm.S|lib/wolfssl/wolfcrypt/src/sp_x86_64_asm.S|lib/wolfssl/wolfcrypt/src/wc_kyber_asm.S|src/vector_riscv.S|src/update_flash_hwswap.c|src/update_flash.c|src/boot_riscv.c|src/boot_arm.c|hal/aurix_tc3xx.c|hal/cc26x2.c|hal/hifive1.c|hal/imx_rt.c|hal/kinetis.c|hal/kontron_vx3060_s2.c|hal/kontron_vx3060_s2_loader.c|hal/library.c|hal/lpc.c|hal/mcxa.c|hal/nrf52.c|hal/nxp_p1021.c|hal/nxp_ppc.c|hal/nxp_t1024.c|hal/nxp_t2080.c|hal/psoc6.c|hal/raspi3.c|hal/renesas-ra.c|hal/renesas-rx.c|hal/renesas-rz.c|hal/rx65n.c|hal/rx72n.c|hal/same51.c|hal/samr21.c|hal/sim.c|hal/skeleton.c|hal/stm32c0.c|hal/stm32f4.c|hal/stm32f7.c|hal/stm32g0.c|hal/stm32h5.c|hal/stm32h7.c|hal/stm32l0.c|hal/stm32l4.c|hal/stm32l5.c|hal/stm32_tz.c|hal/stm32u5.c|hal/stm32wb.c|hal/ti_hercules.c|hal/x86_64_efi.c|hal/x86_fsp_qemu.c|hal/x86_fsp_qemu_loader.c|hal/x86_fsp_tgl.c|hal/x86_uart.c" flags="VALUE_WORKSPACE_PATH|RESOLVED" kind="sourcePath" name=""/>
+                        <entry excluding="lib/wolfssl/wolfcrypt/src/port/arm/thumb2-poly1305-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-kyber-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-chacha-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-kyber-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-poly1305-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-kyber-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-chacha-asm.S|src/qspi_flash.c|IDE/AURIX|IDE/CCS|IDE/MPLAB|IDE/Renesas|.git|IDE/IAR|test-app|tools|lib/wolfPKCS11|lib/wolfTPM|lib/wolfssl/linuxkm|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-aes-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha256-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-aes-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha256-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/autosar|lib/wolfssl/wrapper|lib/wolfssl/zephyr|src/boot_x86_fsp.c|src/boot_x86_fsp_start.S|src/boot_x86_fsp_payload.c|src/boot_x86_64.c|src/boot_renesas.c|src/boot_renesas_start.S|src/boot_ppc_start.S|src/boot_ppc_mp.S|src/boot_ppc.c|src/x86|lib/wolfTPM/examples|lib/wolfTPM/tests|lib/wolfTPM/IDE|lib/wolfssl/tests|lib/wolfssl/tirtos|lib/wolfssl/swig|lib/wolfssl/mqx|lib/wolfssl/mplabx|lib/wolfssl/IPP|lib/wolfssl/mcapi|lib/wolfssl/testsuite|lib/wolfssl/examples|lib/wolfssl/IDE|lib/wolfssl/wolfcrypt/user-crypto|lib/wolfssl/wolfcrypt/src/aes_asm.S|lib/wolfssl/wolfcrypt/src/aes_gcm_asm.S|lib/wolfssl/wolfcrypt/src/aes_gcm_x86_asm.S|lib/wolfssl/wolfcrypt/src/aes_xts_asm.S|lib/wolfssl/wolfcrypt/src/chacha_asm.S|lib/wolfssl/wolfcrypt/src/fe_x25519_asm.S|lib/wolfssl/wolfcrypt/src/poly1305_asm.S|lib/wolfssl/wolfcrypt/src/sha256_asm.S|lib/wolfssl/wolfcrypt/src/sha3_asm.S|lib/wolfssl/wolfcrypt/src/sha512_asm.S|lib/wolfssl/wolfcrypt/src/sm3_asm.S|lib/wolfssl/wolfcrypt/src/sp_sm2_x86_64_asm.S|lib/wolfssl/wolfcrypt/src/sp_x86_64_asm.S|lib/wolfssl/wolfcrypt/src/wc_kyber_asm.S|src/vector_riscv.S|src/update_flash_hwswap.c|src/update_flash.c|src/boot_riscv.c|src/boot_arm.c|src/boot_arm32_start.S|src/boot_arm32.c|hal/aurix_tc3xx.c|hal/cc26x2.c|hal/hifive1.c|hal/imx_rt.c|hal/kinetis.c|hal/kontron_vx3060_s2.c|hal/kontron_vx3060_s2_loader.c|hal/library.c|hal/lpc.c|hal/mcxa.c|hal/nrf52.c|hal/nxp_p1021.c|hal/nxp_ppc.c|hal/nxp_t1024.c|hal/nxp_t2080.c|hal/psoc6.c|hal/raspi3.c|hal/renesas-ra.c|hal/renesas-rx.c|hal/renesas-rz.c|hal/rx65n.c|hal/rx72n.c|hal/same51.c|hal/sama5d3.c|hal/samr21.c|hal/sim.c|hal/skeleton.c|hal/stm32c0.c|hal/stm32f4.c|hal/stm32f7.c|hal/stm32g0.c|hal/stm32h5.c|hal/stm32h7.c|hal/stm32l0.c|hal/stm32l4.c|hal/stm32l5.c|hal/stm32_tz.c|hal/stm32u5.c|hal/stm32wb.c|hal/ti_hercules.c|hal/x86_64_efi.c|hal/x86_fsp_qemu.c|hal/x86_fsp_qemu_loader.c|hal/x86_fsp_tgl.c|hal/x86_uart.c" flags="VALUE_WORKSPACE_PATH|RESOLVED" kind="sourcePath" name=""/>
                     </sourceEntries>
                 </configuration>
             </storageModule>
@@ -267,7 +267,7 @@
                         </toolChain>
                     </folderInfo>
                     <sourceEntries>
-                        <entry excluding="src/qspi_flash.c|IDE/AURIX|IDE/CCS|IDE/MPLAB|IDE/Renesas|.git|IDE/IAR|test-app|tools|lib/wolfPKCS11|lib/wolfTPM|lib/wolfssl/linuxkm|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-aes-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha256-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-aes-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha256-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/autosar|lib/wolfssl/wrapper|lib/wolfssl/zephyr|src/boot_x86_fsp.c|src/boot_x86_fsp_start.S|src/boot_x86_fsp_payload.c|src/boot_x86_64.c|src/boot_renesas.c|src/boot_renesas_start.S|src/boot_ppc_start.S|src/boot_ppc_mp.S|src/boot_ppc.c|src/x86|lib/wolfTPM/examples|lib/wolfTPM/tests|lib/wolfTPM/IDE|lib/wolfssl/tests|lib/wolfssl/tirtos|lib/wolfssl/swig|lib/wolfssl/mqx|lib/wolfssl/mplabx|lib/wolfssl/IPP|lib/wolfssl/mcapi|lib/wolfssl/testsuite|lib/wolfssl/examples|lib/wolfssl/IDE|lib/wolfssl/wolfcrypt/user-crypto|lib/wolfssl/wolfcrypt/src/aes_asm.S|lib/wolfssl/wolfcrypt/src/aes_gcm_asm.S|lib/wolfssl/wolfcrypt/src/aes_gcm_x86_asm.S|lib/wolfssl/wolfcrypt/src/aes_xts_asm.S|lib/wolfssl/wolfcrypt/src/chacha_asm.S|lib/wolfssl/wolfcrypt/src/fe_x25519_asm.S|lib/wolfssl/wolfcrypt/src/poly1305_asm.S|lib/wolfssl/wolfcrypt/src/sha256_asm.S|lib/wolfssl/wolfcrypt/src/sha3_asm.S|lib/wolfssl/wolfcrypt/src/sha512_asm.S|lib/wolfssl/wolfcrypt/src/sm3_asm.S|lib/wolfssl/wolfcrypt/src/sp_sm2_x86_64_asm.S|lib/wolfssl/wolfcrypt/src/sp_x86_64_asm.S|lib/wolfssl/wolfcrypt/src/wc_kyber_asm.S|src/vector_riscv.S|src/update_flash_hwswap.c|src/update_flash.c|src/boot_riscv.c|src/boot_arm.c|hal/aurix_tc3xx.c|hal/cc26x2.c|hal/hifive1.c|hal/imx_rt.c|hal/kinetis.c|hal/kontron_vx3060_s2.c|hal/kontron_vx3060_s2_loader.c|hal/library.c|hal/lpc.c|hal/mcxa.c|hal/nrf52.c|hal/nxp_p1021.c|hal/nxp_ppc.c|hal/nxp_t1024.c|hal/nxp_t2080.c|hal/psoc6.c|hal/raspi3.c|hal/renesas-ra.c|hal/renesas-rx.c|hal/renesas-rz.c|hal/rx65n.c|hal/rx72n.c|hal/same51.c|hal/samr21.c|hal/sim.c|hal/skeleton.c|hal/stm32c0.c|hal/stm32f4.c|hal/stm32f7.c|hal/stm32g0.c|hal/stm32h5.c|hal/stm32h7.c|hal/stm32l0.c|hal/stm32l4.c|hal/stm32l5.c|hal/stm32_tz.c|hal/stm32u5.c|hal/stm32wb.c|hal/ti_hercules.c|hal/x86_64_efi.c|hal/x86_fsp_qemu.c|hal/x86_fsp_qemu_loader.c|hal/x86_fsp_tgl.c|hal/x86_uart.c" flags="VALUE_WORKSPACE_PATH|RESOLVED" kind="sourcePath" name=""/>
+                        <entry excluding="lib/wolfssl/wolfcrypt/src/port/arm/thumb2-poly1305-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-kyber-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-chacha-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-kyber-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-poly1305-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-kyber-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-chacha-asm.S|src/qspi_flash.c|IDE/AURIX|IDE/CCS|IDE/MPLAB|IDE/Renesas|.git|IDE/IAR|test-app|tools|lib/wolfPKCS11|lib/wolfTPM|lib/wolfssl/linuxkm|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-aes-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha256-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-32-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/armv8-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-aes-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-curve25519.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha256-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha3-asm.S|lib/wolfssl/wolfcrypt/src/port/arm/thumb2-sha512-asm.S|lib/wolfssl/wolfcrypt/src/port/autosar|lib/wolfssl/wrapper|lib/wolfssl/zephyr|src/boot_x86_fsp.c|src/boot_x86_fsp_start.S|src/boot_x86_fsp_payload.c|src/boot_x86_64.c|src/boot_renesas.c|src/boot_renesas_start.S|src/boot_ppc_start.S|src/boot_ppc_mp.S|src/boot_ppc.c|src/x86|lib/wolfTPM/examples|lib/wolfTPM/tests|lib/wolfTPM/IDE|lib/wolfssl/tests|lib/wolfssl/tirtos|lib/wolfssl/swig|lib/wolfssl/mqx|lib/wolfssl/mplabx|lib/wolfssl/IPP|lib/wolfssl/mcapi|lib/wolfssl/testsuite|lib/wolfssl/examples|lib/wolfssl/IDE|lib/wolfssl/wolfcrypt/user-crypto|lib/wolfssl/wolfcrypt/src/aes_asm.S|lib/wolfssl/wolfcrypt/src/aes_gcm_asm.S|lib/wolfssl/wolfcrypt/src/aes_gcm_x86_asm.S|lib/wolfssl/wolfcrypt/src/aes_xts_asm.S|lib/wolfssl/wolfcrypt/src/chacha_asm.S|lib/wolfssl/wolfcrypt/src/fe_x25519_asm.S|lib/wolfssl/wolfcrypt/src/poly1305_asm.S|lib/wolfssl/wolfcrypt/src/sha256_asm.S|lib/wolfssl/wolfcrypt/src/sha3_asm.S|lib/wolfssl/wolfcrypt/src/sha512_asm.S|lib/wolfssl/wolfcrypt/src/sm3_asm.S|lib/wolfssl/wolfcrypt/src/sp_sm2_x86_64_asm.S|lib/wolfssl/wolfcrypt/src/sp_x86_64_asm.S|lib/wolfssl/wolfcrypt/src/wc_kyber_asm.S|src/vector_riscv.S|src/update_flash_hwswap.c|src/update_flash.c|src/boot_riscv.c|src/boot_arm.c|src/boot_arm32_start.S|src/boot_arm32.c|hal/aurix_tc3xx.c|hal/cc26x2.c|hal/hifive1.c|hal/imx_rt.c|hal/kinetis.c|hal/kontron_vx3060_s2.c|hal/kontron_vx3060_s2_loader.c|hal/library.c|hal/lpc.c|hal/mcxa.c|hal/nrf52.c|hal/nxp_p1021.c|hal/nxp_ppc.c|hal/nxp_t1024.c|hal/nxp_t2080.c|hal/psoc6.c|hal/raspi3.c|hal/renesas-ra.c|hal/renesas-rx.c|hal/renesas-rz.c|hal/rx65n.c|hal/rx72n.c|hal/same51.c|hal/sama5d3.c|hal/samr21.c|hal/sim.c|hal/skeleton.c|hal/stm32c0.c|hal/stm32f4.c|hal/stm32f7.c|hal/stm32g0.c|hal/stm32h5.c|hal/stm32h7.c|hal/stm32l0.c|hal/stm32l4.c|hal/stm32l5.c|hal/stm32_tz.c|hal/stm32u5.c|hal/stm32wb.c|hal/ti_hercules.c|hal/x86_64_efi.c|hal/x86_fsp_qemu.c|hal/x86_fsp_qemu_loader.c|hal/x86_fsp_tgl.c|hal/x86_uart.c" flags="VALUE_WORKSPACE_PATH|RESOLVED" kind="sourcePath" name=""/>
                     </sourceEntries>
                 </configuration>
             </storageModule>

IDE/XilinxSDK/README.md

@@ -45,8 +45,51 @@ These template settings are also in this `.cproject` as preprocessor macros. The
 #define WOLFBOOT_LOAD_DTS_ADDRESS            0x11800000
 ```
 
+The default .cproject build symbols are:
+
+```
+ARCH_AARCH64
+ARCH_FLASH_OFFSET=0x0
+CORTEX_A53
+DEBUG_ZYNQ=1
+EXT_FLASH=1
+FILL_BYTE=0xFF
+IMAGE_HEADER_SIZE=1024
+MMU
+NO_QNX
+NO_XIP
+PART_BOOT_EXT=1
+PART_SWAP_EXT=1
+PART_UPDATE_EXT=1
+TARGET_zynq
+WC_HASH_DATA_ALIGNMENT=8
+WOLFBOOT_ARCH_AARCH64
+WOLFBOOT_DUALBOOT
+WOLFBOOT_ELF
+WOLFBOOT_HASH_SHA3_384
+WOLFBOOT_ORIGIN=0x0
+WOLFBOOT_SHA_BLOCK_SIZE=4096
+WOLFBOOT_SIGN_RSA4096
+WOLFBOOT_UBOOT_LEGACY
+```
+
 Note: If not using Position Independent Code (PIC) the linker script `ldscript.ld` must have the start address offset to match the `WOLFBOOT_LOAD_ADDRESS`.
 
+
+## Zynq UltraScale+ ARMv8 Crypto Extensions
+
+To enable ARM assembly speedups for SHA:
+
+1) Add these build symbols:
+
+```
+WOLFSSL_ARMASM
+WOLFSSL_ARMASM_INLINE
+```
+
+2) Add these compiler misc flags: `-mcpu=generic+crypto -mstrict-align -DWOLFSSL_AARCH64_NO_SQRMLSH`
+
+
 ## Generate signing key
 
 The keygen tool creates an RSA 4096-bit private key (`wolfboot_signing_private_key.der`) and exports the public key to `src/keystore.c` for wolfBoot to use at compile-time as the default root-of-trust.
@@ -91,9 +134,13 @@ Xilinx uses a `bootgen` tool for generating a boot binary image that has Xilinx
 * Use "offset=" option to place the application into a specific location in flash.
 * Use "load=" option to have FSBL load into specific location in RAM.
 
-Generating a boot.bin (from boot.bif).
-Run the Xilinx -> Vitis Shell and cd into the workspace root.
+Default install locations for bootgen tools:
+* Linux: `/tools/Xilinx/Vitis/2022.1/bin`
+* Windows: `C:\Xilinx\Vitis\2022.1\bin`
 
+Open the Vitis Shell from the IDE by using file menu "Xilinx" -> "Vitis Shell".
+
+Generating a boot.bin (from boot.bif).
 Example boot.bif in workspace root:
 
 ```
@@ -102,11 +149,15 @@ Example boot.bif in workspace root:
 the_ROM_image:
 {
 	[bootloader, destination_cpu=a53-0] zcu102\zynqmp_fsbl\fsbl_a53.elf
-	[destination_cpu=a53-0, exception_level=el-1] wolfboot\Debug\wolfboot.elf
+	[destination_cpu=a53-0, exception_level=el-2] wolfboot\Debug\wolfboot.elf
 	[destination_cpu=a53-0, partition_owner=uboot, offset=0x800000] hello_world\Debug\hello_world_v1_signed.bin
 }
 ```
 
+You can also use exception level 3 or 1 depending on your needs.
+
+From the workspace root:
+
 ```sh
 bootgen -image boot.bif -arch zynqmp -w -o BOOT.bin
 
@@ -184,10 +235,10 @@ Successfully ran Hello World application
     ```
 
 6. Build “boot.bin” image:
-    * `bootgen.exe -image boot.bif -arch zynqmp -o i BOOT.BIN -w`
+    * `bootgen -image boot.bif -arch zynqmp -o i BOOT.BIN -w`
 
-Note: To generate a report of a boot.bin use the `bootgen_utility`:
-`bootgen_utility -arch zynqmp -bin boot.bin -out boot.bin.txt`
+Note: To generate a report of a boot.bin use the `bootgen_utility` or after 2022.1 use `bootgen -read`:
+`bootgen -arch zynqmp -read BOOT.BIN`
 
 ## Post Quantum
 
@@ -207,7 +258,8 @@ WOLFSSL_XMSS_VERIFY_ONLY
 WOLFSSL_XMSS_MAX_HEIGHT=32
 WOLFBOOT_SHA_BLOCK_SIZE=4096
 IMAGE_SIGNATURE_SIZE=2500
-IMAGE_HEADER_SIZE=4096
+XMSS_IMAGE_SIGNATURE_SIZE=2500
+IMAGE_HEADER_SIZE=5000
 ```
 
 2) Create and sign image:
@@ -300,3 +352,4 @@ Output image(s) successfully created.
 ### References:
 * [ZAPP1319](https://www.xilinx.com/support/documentation/application_notes/xapp1319-zynq-usp-prog-nvm.pdf): Programming BBRAM and eFUSEs
 * [UG1283](https://www.xilinx.com/support/documentation/sw_manuals/xilinx2018_2/ug1283-bootgen-user-guide.pdf): Bootgen User Guide
+* [Using Cryptography in Zynq UltraScale MPSoC](https://xilinx-wiki.atlassian.net/wiki/spaces/A/pages/18842541/Using+Cryptography+in+Zynq+UltraScale+MPSoC)

arch.mk

@@ -68,21 +68,30 @@ ifeq ($(ARCH),AARCH64)
   CFLAGS+=-DARCH_AARCH64
   OBJS+=src/boot_aarch64.o src/boot_aarch64_start.o
 
-  ifeq ($(TARGET),nxp_ls1028a)
-    ARCH_FLAGS=-mcpu=cortex-a72+crypto -march=armv8-a+crypto -mtune=cortex-a72
-    CFLAGS+=$(ARCH_FLAGS) -DCORTEX_A72
+  ifeq ($(TARGET),zynq)
+    ARCH_FLAGS=-march=armv8-a+crypto
+    CFLAGS+=$(ARCH_FLAGS) -DCORTEX_A53
+    CFLAGS+=-DNO_QNX
+    # Support detection and skip of U-Boot legacy header */
+    CFLAGS+=-DWOLFBOOT_UBOOT_LEGACY
+    CFLAGS+=-DWOLFBOOT_DUALBOOT
+  else
+    ifeq ($(TARGET),nxp_ls1028a)
+      ARCH_FLAGS=-mcpu=cortex-a72+crypto -march=armv8-a+crypto -mtune=cortex-a72
+      CFLAGS+=$(ARCH_FLAGS) -DCORTEX_A72
 
-    CFLAGS +=-ffunction-sections -fdata-sections
-    LDFLAGS+=-Wl,--gc-sections
+      CFLAGS +=-ffunction-sections -fdata-sections
+      LDFLAGS+=-Wl,--gc-sections
 
-    ifeq ($(DEBUG_UART),0)
-      CFLAGS+=-fno-builtin-printf
-    endif
+      ifeq ($(DEBUG_UART),0)
+        CFLAGS+=-fno-builtin-printf
+      endif
 
-    SPI_TARGET=nxp
-  else
-    # By default disable ARM ASM for other targets
-    NO_ARM_ASM?=1
+      SPI_TARGET=nxp
+    else
+      # By default disable ARM ASM for other targets
+      NO_ARM_ASM?=1
+    endif
   endif
 
   ifeq ($(SPMATH),1)
@@ -789,12 +798,6 @@ ifeq ($(TARGET),nxp_p1021)
   SPI_TARGET=nxp
 endif
 
-ifeq ($(TARGET),zynq)
-  # Support detection and skip of U-Boot legecy header */
-  CFLAGS+=-DWOLFBOOT_UBOOT_LEGACY
-  CFLAGS+=-DWOLFBOOT_DUALBOOT
-endif
-
 ifeq ($(TARGET),ti_hercules)
   # HALCoGen Source and Include?
   CORTEX_R5=1
@@ -1082,12 +1085,12 @@ ifeq ($(ARCH),AARCH64)
   CFLAGS+=-DMMU -DWOLFBOOT_DUALBOOT
   OBJS+=src/fdt.o
   UPDATE_OBJS:=src/update_ram.o
+else
+  ifeq ($(DUALBANK_SWAP),1)
+    CFLAGS+=-DWOLFBOOT_DUALBOOT
+    UPDATE_OBJS:=src/update_flash_hwswap.o
+  endif
 endif
-ifeq ($(DUALBANK_SWAP),1)
-  CFLAGS+=-DWOLFBOOT_DUALBOOT
-  UPDATE_OBJS:=src/update_flash_hwswap.o
-endif
-
 # Set default update object (if not library)
 ifneq ($(TARGET),library)
 ifeq ($(UPDATE_OBJS),)

config/examples/sim-tpm-seal.config

@@ -31,6 +31,9 @@ WOLFBOOT_TPM_SEAL?=1
 WOLFBOOT_TPM_SEAL_NV_BASE=0x01400300
 #WOLFBOOT_TPM_SEAL_AUTH?=SealAuth
 
+# Default image header size is larger to support room for policy
+IMAGE_HEADER_SIZE?=512
+
 # TPM Logging
 #CFLAGS_EXTRA+=-DDEBUG_WOLFTPM
 #CFLAGS_EXTRA+=-DWOLFTPM_DEBUG_VERBOSE

config/examples/zynqmp.config

@@ -1,5 +1,8 @@
 ARCH?=AARCH64
 TARGET?=zynq
+
+WOLFBOOT_VERSION?=0
+
 # Default to ZCU102 as hardware platform (QSPI sizes)
 CFLAGS_EXTRA+=-DZCU102
 
@@ -28,15 +31,16 @@ IMAGE_HEADER_SIZE?=1024
 #IMAGE_HEADER_SIZE?=5288
 
 DEBUG?=0
+DEBUG_SYMBOLS=1
 DEBUG_UART=1
-#DEBUG_ZYNQ=1
+CFLAGS_EXTRA+=-DDEBUG_ZYNQ=1
+#OPTIMIZATION_LEVEL=2
 
 VTOR?=1
 CORTEX_M0?=0
 NO_ASM?=0
 ALLOW_DOWNGRADE?=0
 NVM_FLASH_WRITEONCE?=0
-WOLFBOOT_VERSION?=0
 V?=0
 SPMATH?=1
 RAM_CODE?=0
@@ -48,6 +52,7 @@ SPI_FLASH?=0
 NO_XIP=1
 USE_GCC=1
 ELF?=1
+#DEBUG_ELF?=1
 
 # Flash Sector Size
 WOLFBOOT_SECTOR_SIZE=0x20000
@@ -73,3 +78,6 @@ CROSS_COMPILE=aarch64-none-elf-
 
 # Speed up reads from flash by using larger blocks
 CFLAGS_EXTRA+=-DWOLFBOOT_SHA_BLOCK_SIZE=4096
+
+# QSPI Clock at 0=150MHz, 1=75MHz, 2=37.5MHz (default)
+#CFLAGS_EXTRA+=-DGQSPI_CLK_DIV=0