Add wolfBoot target for STM32H7S3L8 with partitions on external Octo-SPI NOR

.github/workflows/test-build.yml

@@ -88,6 +88,7 @@ jobs:
         if: |
           inputs.config-file == './config/examples/stm32h7.config' ||
           inputs.config-file == './config/examples/stm32h7-octospi.config' ||
+          inputs.config-file == './config/examples/stm32h7s.config' ||
           inputs.config-file == './config/examples/stm32u3.config' ||
           inputs.config-file == './config/examples/stm32u5.config' ||
           inputs.config-file == './config/examples/stm32u5-wolfcrypt-tz.config' ||

.github/workflows/test-configs.yml

@@ -892,6 +892,12 @@ jobs:
       arch: arm
       config-file: ./config/examples/stm32h7-octospi.config
 
+  stm32h7s_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/stm32h7s.config
+
   stm32l0_test:
     uses: ./.github/workflows/test-build.yml
     with:

Makefile

@@ -487,6 +487,12 @@ ifeq ($(TARGET),stm32n6)
     MAIN_TARGET:=wolfboot.bin test-app/image_v1_signed.bin
 endif
 
+ifeq ($(TARGET),stm32h7s)
+    # wolfBoot is in internal flash, app on the external NOR - the two are
+    # in different address spaces, so there is no contiguous factory.bin
+    MAIN_TARGET:=wolfboot.bin test-app/image_v1_signed.bin
+endif
+
 ifeq ($(TARGET),rp2350)
     MAIN_TARGET:=include/target.h keytools wolfboot_signing_private_key.der pico-sdk-info
 endif
@@ -924,6 +930,11 @@ flash: wolfboot.bin test-app/image_v1_signed.bin
 	$(Q)tools/scripts/stm32n6_flash.sh --skip-build
 endif
 
+ifeq ($(TARGET),stm32h7s)
+flash: wolfboot.bin test-app/image_v1_signed.bin
+	$(Q)tools/scripts/stm32h7s_flash.sh --skip-build
+endif
+
 
 cppcheck:
 	cppcheck -f --enable=warning --enable=portability \

arch.mk

@@ -521,6 +521,26 @@ ifeq ($(ARCH),ARM)
     SPI_TARGET=stm32
   endif
 
+  # STM32H7S/H7R: wolfBoot runs from the 64 KB internal flash and keeps
+  # all three partitions on an external Octo-SPI NOR reached over XSPI2.
+  # The HAL implements ext_flash_* directly, so OCTOSPI_FLASH is left off:
+  # setting it would alias ext_flash_* onto src/qspi_flash.c, whose
+  # transfer helper disables the controller on every command.
+  ifeq ($(TARGET),stm32h7s)
+    CORTEX_M7=1
+    CFLAGS+=-Ihal
+    ARCH_FLASH_OFFSET=0x08000000
+    WOLFBOOT_ORIGIN=0x08000000
+    EXT_FLASH=1
+    PART_UPDATE_EXT=1
+    PART_SWAP_EXT=1
+    # hal_init() takes PLL1 to 600 MHz and drives the XSPI2 kernel clock
+    # from PLL2. Set STM32H7S_HSI_ONLY=1 to stay on the 64 MHz HSI reset
+    # clock instead, which is a smaller thing to debug during bring-up.
+    STM32H7S_HSI_ONLY?=0
+    CFLAGS+=-DSTM32H7S_HSI_ONLY=$(STM32H7S_HSI_ONLY)
+  endif
+
   # Defaults for linker script placeholders (overridden when WOLFHAL=1)
   WOLFHAL_FLASH_EXCLUDE_TEXT?=*(.text*)
   WOLFHAL_FLASH_EXCLUDE_RODATA?=*(.rodata*)

config/examples/stm32h7s.config

@@ -0,0 +1,61 @@
+# STM32H7S / STM32H7R (NUCLEO-H7S3L8 reference board)
+#
+# wolfBoot runs from the 64 KB internal flash at 0x08000000. All three
+# partitions live on the external Octo-SPI NOR reached over XSPI2, which
+# is memory mapped at 0x70000000, and the application executes in place
+# from there.
+#
+# The boot partition is given its absolute memory-mapped address because
+# the application's vector table has to be fetchable there. Update and
+# swap are device-relative offsets. ext_flash_addr() in hal/stm32h7s.c
+# accepts both forms.
+#
+# Board-specific values (NOR size, page and sector size, which XSPI
+# instance, XSPI pins, UART) are overridable defaults in hal/stm32h7s.h;
+# a board with a different NOR should not need to change the HAL body.
+#
+# On-board NOR is a Macronix MX25UW25645G, 32 MB, 4 KB erase subsector.
+# Partition map on the device:
+#   swap    0x00010000  0x1000
+#   boot    0x00020000  0x400000   (0x70020000 memory mapped)
+#   update  0x00420000  0x400000
+ARCH?=ARM
+TARGET?=stm32h7s
+SIGN?=ECC256
+HASH?=SHA256
+DEBUG?=0
+DEBUG_UART?=1
+VTOR?=1
+NO_ASM?=0
+NO_MPU=1
+SPI_FLASH?=0
+QSPI_FLASH?=0
+OCTOSPI_FLASH?=0
+ALLOW_DOWNGRADE?=0
+NVM_FLASH_WRITEONCE?=0
+WOLFBOOT_VERSION?=1
+V?=0
+SPMATH?=1
+# Deliberately 0. RAM_CODE compiles the bootloader self-update path in
+# src/update_flash.c, which erases
+# WOLFBOOT_PARTITION_BOOT_ADDRESS - ARCH_FLASH_OFFSET. With wolfBoot in
+# internal flash and the partitions on the NOR that is 0x68020000, far
+# past the 64 KB device, so the erase is rejected and the update would be
+# written into flash that was never erased. The bootloader does not need
+# RAMFUNCTION here: it runs from internal flash and only ever writes the
+# external NOR. The test application does need it, and test-app/Makefile
+# sets -DRAM_CODE for this target directly.
+RAM_CODE?=0
+WOLFBOOT_SECTOR_SIZE?=0x1000
+WOLFBOOT_PARTITION_SIZE?=0x400000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x70020000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x00420000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x00010000
+IMAGE_HEADER_SIZE?=1024
+BOOTLOADER_PARTITION_SIZE=0x10000
+# Boot, update and swap are on the same physical NOR. PART_BOOT_EXT keeps
+# every boot-partition access on the ext_flash_* path so no read depends
+# on the memory-mapped window, which an update tears down.
+CFLAGS_EXTRA+=-DPART_BOOT_EXT
+# Print registers over the console if the bootloader faults
+CFLAGS_EXTRA+=-DDEBUG_HARDFAULT

config/openocd/openocd_stm32h7s.cfg

@@ -0,0 +1,10 @@
+# STM32H7S / STM32H7R (NUCLEO-H7S3L8)
+#
+# Pass the probe serial when more than one ST-LINK is attached, otherwise
+# OpenOCD picks the first one it finds:
+#   openocd -c "adapter serial <SN>" -f config/openocd/openocd_stm32h7s.cfg
+source [find interface/stlink.cfg]
+source [find target/stm32h7rsx.cfg]
+init
+reset
+halt