[dgarske]

Description

Bare-metal wolfBoot port for the Infineon PSOC Edge E8 family, running on the Secure CM33 as the first image extended boot launches from QSPI, with optional TrustZone and a wolfHSM server in the Secure world.

What it adds

• hal/psoc_e8.{c,h,ld} - SCB console, QSPI program/erase through the generic src/qspi_flash.c driver while executing in place, RRAM writes
• hal/psoc_e8_tz.c, hal/psoc_e8-tz.ld - SAU and memory protection, TRNG entropy, console gateway for the Non-secure app
• config/examples/psoc_e8_ai*.config, arch.mk - KIT_PSE84_AI: plain, TrustZone, and TrustZone with WOLFCRYPT_TZ_WOLFHSM=1; PSOC_E8_BOOT_RRAM=1 for an RRAM-resident wolfBoot
• tools/scripts/psoc_e8/ - adds the boot header extended boot requires and programs the kit over KitProg3/OpenOCD
• test-app support including wolfCrypt test/benchmark, unit tests, CI jobs, docs/Targets.md, docs/wolfHSM.md

Touches shared code

• src/qspi_flash.c - opt-in QSPI_FLASH_RAM_CODE and QSPI_NO_4BYTE_MODE, overridable program/erase opcodes
• test-app/Makefile - the test-app builds its HAL copy as test-app/hal_$(TARGET).o, so a second make no longer relinks it into wolfBoot (undefined hal_init on psoc_c3 and psoc_e8)

Testing

Validated on KIT_PSE84_AI (KitProg3): boot and ECC256 verify, A/B update with and without TrustZone, resume after a mid-swap reset, RRAM write, wolfCrypt test and benchmark, and the wolfHSM client suite against the Secure server.

RRAM boot is build-tested only (needs Edge Protect boot policy provisioning). CM55, crypto acceleration and the Secure Enclave are follow-on.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #949

Scan targets checked: wolfboot-src, wolfboot-bugs
Not reviewed (no scan target covers them): .github/workflows/test-configs.yml, .gitignore, Makefile, arch.mk, config/examples/psoc_e8_ai-tz-wolfhsm.config, config/examples/psoc_e8_ai-tz.config, config/examples/psoc_e8_ai.config, docs/Targets.md, docs/wolfHSM.md, hal/psoc_e8-tz.ld, hal/psoc_e8.h, hal/psoc_e8.ld, test-app/ARM-psoc_e8-ns.ld, test-app/ARM-psoc_e8.ld, test-app/Makefile, tools/scripts/psoc_e8/psoc_e8_boot_header.py, tools/scripts/psoc_e8/psoc_e8_flash.sh, tools/unit-tests/Makefile
Coverage: 5 of 7 in-scope changed file(s) opened by the reviewer; not opened: hal/psoc_e8_tz.c, test-app/app_psoc_e8.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[aidangarske]

Skoll Code Review

Scan type: review

Overall recommendation: REQUEST_CHANGES
Findings: 6 total — 6 posted, 0 skipped
6 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [High] Apply the PSOC E8 output selection outside the TrustZone guard — Makefile:386-389
• [High] Reserve space for the appended boot-image TLV — arch.mk:768-777
• [High] Keep the private application HAL object forced — test-app/Makefile:1729
• [Medium] Verify application images after programming — tools/scripts/psoc_e8/psoc_e8_flash.sh:52-55
• [Medium] Add coverage for the extended-boot image format — tools/scripts/psoc_e8/psoc_e8_boot_header.py:20-29
• [Low] Scope the documented alias layout correctly — docs/Targets.md:10017

Review generated by Skoll

[mattia-moffa]

In these two lines, firstly an ECC error is checked (RRAMC_NVM_STATUS_ECC_MULTI) and then the memory is accessed (blk[i]).

This means that:

• the copy is done only when the previous (not current) read was successful
• an ECC error in the last iteration of this loop is not detected.