Minor improvements. STM32H5 non-secure flash watermark. Fixing layout of linker script. Still getting fault on calls to smse functions like wcs_get_random.

Author: dgarske

Makefile

@@ -431,6 +431,7 @@ keys: $(PRIVATE_KEY)
 
 clean:
 	$(Q)rm -f src/*.o hal/*.o hal/spi/*.o test-app/*.o src/x86/*.o
+	$(Q)rm -f src/wc_secure_calls.o
 	$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/hal/*.o $(WOLFBOOT_LIB_WOLFTPM)/examples/pcr/*.o
 	$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/Renesas/*.o
 	$(Q)rm -f wolfboot.bin wolfboot.elf wolfboot.map test-update.rom wolfboot.hex

docs/Targets.md

@@ -914,8 +914,8 @@ The example configuration for this scenario is available in [/config/examples/st
 
 `STM32_Programmer_CLI -c port=swd -ob TZEN=0xB4`
 
-- set the option bytes to enable flash secure protection of first 384KB:
-`STM32_Programmer_CLI -c port=swd -ob SECWM1_PSTRT=0x0 SECWM1_PEND=0x2F SECWM2_PEND=0x0 SECWM2_PSTRT=0x2F`
+- set the option bytes to enable flash secure protection of first 384KB and remainder as non-secure:
+`STM32_Programmer_CLI -c port=swd -ob SECWM1_PSTRT=0x0 SECWM1_PEND=0x2F SECWM2_PSTRT=0x2F SECWM2_PEND=0x0`
 
 - flash the wolfboot image to the secure partition:
 `STM32_Programmer_CLI -c port=swd -d wolfboot.bin 0x0C000000`
@@ -984,6 +984,7 @@ Any version except the first one will also turn on the orange LED.
 
 ### STM32H5 Debugging
 
+
 OpenOCD: `openocd -s /usr/local/share/openocd/scripts -f board/st_nucleo_h5.cfg`
 
 ```sh

hal/stm32h5.ld

@@ -1,11 +1,12 @@
 MEMORY
 {
-    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @BOOTLOADER_PARTITION_SIZE@ - 0x1C000
+    /* If FLASH_KEYVAULT or FLASH_NSC length is adjusted FLASH length needs adjusted too */
+    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @BOOTLOADER_PARTITION_SIZE@ - 0x1C000 - 0x4000
     RAM (rwx) :     ORIGIN = 0x30000000, LENGTH = 0x20000
     RAM_KV (rw):    ORIGIN = 0x30020000, LENGTH = 0x10000
     RAM_HEAP (rw):  ORIGIN = 0x30030000, LENGTH = 0x10000 /* 64KB Heap for wolfcrypt/PKCS11 */
-    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_ORIGIN@ + 0x44000, LENGTH = 0x18000
-    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_ORIGIN@ + 0x5C000, LENGTH = 0x8000
+    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_ORIGIN@ + LENGTH(FLASH), LENGTH = 0x1C000
+    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_ORIGIN@ + LENGTH(FLASH) + LENGTH(FLASH_KEYVAULT), LENGTH = 0x4000
 }
 
 SECTIONS
@@ -31,7 +32,7 @@ SECTIONS
         . = ALIGN(32);
         *(.gnu.sgstubs*)   /* Secure Gateway stubs */
         . = ALIGN(4);
-    } >FLASH_NSC
+    } > FLASH_NSC
 
     _stored_data = .;
     .data : AT (_stored_data)

src/libwolfboot.c

@@ -200,7 +200,7 @@ static uint8_t NVM_CACHE[NVM_CACHE_SIZE] XALIGNED(16);
 static int nvm_cached_sector = 0;
 static uint8_t get_base_offset(uint8_t *base, uintptr_t off)
 {
-    return *(base - off); /* ignore array bounds error */
+    return *(uint8_t*)((uintptr_t)base - off); /* ignore array bounds error */
 }
 
 void WEAKFUNCTION hal_cache_invalidate(void)