Add support for PQC secure boot with MCXA 5xx family of MCUs

.github/workflows/check.yml

@@ -41,12 +41,18 @@ jobs:
       - name: cargo fmt --check (libs)
         run: cargo fmt --check
         working-directory: "./libs"
-      - name: cargo fmt --check (examples)
+      - name: cargo fmt --check (examples/rt685s)
         run: cargo fmt --check
         working-directory: "./examples/rt685s"
+      - name: cargo fmt --check (examples/mcxa-577app)
+        run: cargo fmt --check
+        working-directory: "./examples/mcxa-577app"
       - name: cargo fmt --check (bootloader-tool)
         run: cargo fmt --check
         working-directory: "./bootloader-tool"
+      - name: cargo fmt --check (mcxa-security-provisioning)
+        run: cargo fmt --check
+        working-directory: "./mcxa-security-provisioning"
 
   clippy:
     runs-on: ubuntu-latest
@@ -70,12 +76,18 @@ jobs:
       - name: cargo clippy (libs)
         run: cargo clippy --locked --features mimxrt685s -- -F clippy::suspicious -D clippy::correctness -F clippy::perf -F clippy::style
         working-directory: "./libs"
-      - name: cargo clippy (examples)
+      - name: cargo clippy (examples/rt685s)
         run: cargo clippy --locked -- -F clippy::suspicious -D clippy::correctness -F clippy::perf -F clippy::style
         working-directory: "./examples/rt685s"
+      - name: cargo clippy (examples/mcxa-577app)
+        run: cargo clippy --locked -- -F clippy::suspicious -D clippy::correctness -F clippy::perf -F clippy::style
+        working-directory: "./examples/mcxa-577app"
       - name: cargo clippy (bootloader-tool)
         run: cargo clippy --locked -- -D clippy::suspicious -D clippy::correctness -D clippy::perf -D clippy::style
         working-directory: "./bootloader-tool"
+      - name: cargo clippy (mcxa-security-provisioning)
+        run: cargo clippy --locked -- -F clippy::suspicious -D clippy::correctness -F clippy::perf -F clippy::style
+        working-directory: "./mcxa-security-provisioning"
 
   # Enable once we have a released crate
   # semver:
@@ -119,7 +131,7 @@ jobs:
         working-directory: "./libs"
         env:
           RUSTDOCFLAGS: --cfg docsrs
-      - name: cargo doc (examples)
+      - name: cargo doc (examples/rt685s)
         run: cargo doc --locked --no-deps
         working-directory: "./examples/rt685s"
         env:
@@ -189,6 +201,18 @@ jobs:
           manifest-path: ./examples/rt685s/Cargo.toml
           command: check
           arguments: --locked
+      - name: Cargo deny (examples/mcxa-577app)
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          log-level: warn
+          manifest-path: ./examples/mcxa-577app/Cargo.toml
+          command: check
+      - name: Cargo deny (mcxa-security-provisioning)
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          log-level: warn
+          manifest-path: ./mcxa-security-provisioning/Cargo.toml
+          command: check
 
   msrv:
     # check that we can build using the minimal rust version that is specified by this crate
@@ -219,12 +243,18 @@ jobs:
       - name: cargo +${{ matrix.msrv }} check (libs)
         run: cargo check --locked --features mimxrt685s
         working-directory: "./libs"
-      - name: cargo +${{ matrix.msrv }} check (examples)
+      - name: cargo +${{ matrix.msrv }} check (examples/rt685s)
         run: cargo check --locked
         working-directory: "./examples/rt685s"
+      - name: cargo +${{ matrix.msrv }} check (examples/mcxa-577app)
+        run: cargo check
+        working-directory: "./examples/mcxa-577app"
       - name: cargo +${{ matrix.msrv }} check (bootloader-tool)
         run: cargo check --locked
         working-directory: "./bootloader-tool"
+      - name: cargo +${{ matrix.msrv }} check (mcxa-security-provisioning)
+        run: cargo check
+        working-directory: "./mcxa-security-provisioning"
 
   fuzz:
     runs-on: ubuntu-latest

.gitignore

@@ -0,0 +1,2 @@
+# Rust build artifacts
+target/

deny.toml

@@ -94,6 +94,7 @@ allow = [
     "MIT",
     "Apache-2.0",
     "Unicode-3.0",
+    "BSD-3-Clause",
     #"Apache-2.0 WITH LLVM-exception",
 ]
 # The confidence threshold for detecting a license from license text.

examples/mcxa-577app/.cargo/config.toml

@@ -0,0 +1,21 @@
+[build]
+target = "thumbv8m.main-none-eabihf"
+
+# Runner for app and bootloader. Provisioner overrides this in its own config.
+[target.thumbv8m.main-none-eabihf]
+runner = "probe-rs run --chip MCXA577 --speed 10000"
+
+# Flags for all workspace members (app, bootloader).
+# The provisioner sub-workspace uses RUSTFLAGS in its [env] to override this
+# set and exclude -Tdefmt.x, since it uses log/rtt-target instead of defmt.
+[target.'cfg(all(target_arch = "arm", target_os = "none"))']
+rustflags = [
+    "-C", "linker=flip-link",
+    "-C", "link-arg=-Tlink.x",
+    "-C", "link-arg=-Tdefmt.x",
+    "-C", "link-arg=--nmagic",
+    "-C", "force-frame-pointers=yes",
+]
+
+[env]
+DEFMT_LOG = "trace"