Add NXP FRDM-RW612 port and test NXP HALs against the real MCUXpresso SDK

[aidangarske]

RW612 port

• Adds the NXP RW612 (FRDM-RW612) target with rw612 and rw612-tz configs; wolfCrypt-TZ with PKCS11 is make WOLFCRYPT_TZ=1 WOLFCRYPT_TZ_PKCS11=1 on rw612-tz.
• Flash support through the boot ROM FlexSPI API, erasing in 4KB NOR sectors so a larger WOLFBOOT_SECTOR_SIZE works; enables the
  FlexSPI XIP cache the boot ROM leaves off.
• TrustZone support: wolfBoot runs secure and the application non-secure, with optional wolfCrypt/PKCS11 calls into the secure
  side.
• Post-quantum ML-DSA (44/65/87) signatures work alongside ECC and RSA; docs/Targets.md has the ML-DSA build line.
• wolfCrypt Cortex-M Thumb-2 assembly by default; hal_get_timer_us() for BOOT_BENCHMARK.
• CI jobs in test-configs.yml and a docs/Targets.md section.

NXP unit tests on the real SDK (all NXP ports)

• NXP HAL unit tests now build against NXP's real MCUXpresso SDK headers (device headers, fsl_common, drivers, ROM APIs) instead
  of hand-written fsl_*.h stubs. Only the Arm CMSIS core is mocked, in tools/unit-tests/cmsis_stub/core_cm33.h, which any Cortex-M33
  vendor SDK can reuse.
• New tools/ci/fetch-mcuxsdk-headers.sh fetches the needed SDK folders at pinned commits (sparse, about 12MB, same layout as a
  west checkout). test-units.yml runs it and passes MCUXSDK to the unit tests; without MCUXSDK the NXP tests are skipped with a
  message.
• Each test points the SDK peripheral instances (FLEXSPI, TRNG, ...) at its mock objects and sets its flash layout in the test, so
  a new NXP chip needs only its SDK paths and a test, with no stub files.
• MCXA: unit-flash-write-mcxa now runs through NXP's real ROM API (a mock ROM tree via FSL_FEATURE_ROMAPI_BASE), mcxa_fsl_stub/ is
  removed, and the test also runs on non-x86 hosts.
• The MCX W71 port PR builds on this and converts its tests the same way.

Testing

• On an FRDM-RW612: boot, update and persistence across reset for rw612, rw612-tz and rw612-tz with wolfCrypt-TZ, bootloader
  self-update, and boot with ECC256, ECC384, RSA-4096 and ML-DSA-44/65/87.
• Unit tests against the fetched SDK: unit-rw612-flash 14/14, unit-rw612-tz 12/12, unit-flash-write-mcxa 6/6.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #926

Scan targets checked: wolfboot-src, wolfboot-bugs
Coverage: 1 of 5 in-scope changed file(s) opened by the reviewer; not opened: src/boot_arm.c, test-app/app_rw612.c, tools/unit-tests/unit-rw612-flash.c, tools/unit-tests/unit-rw612-tz.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

Copilot review overview

🟡 Changes recommended

The SAU currently exposes address ranges beyond the documented FLEXCOMM0–3 peripherals.

Review effort: Balanced
Findings: 1

Open (1)

• SAU window marks five unintended FLEXCOMM ranges non-secure · New

What changed in this PR

Adds FRDM-RW612 support, including FlexSPI flash operations, TrustZone isolation, secure wolfCrypt services, test applications, CI, documentation, and unit tests.

Changes:

• Adds RW612 HAL, linker layouts, boot metadata, and target configurations.
• Adds secure/non-secure test applications and TrustZone/TRNG/flash unit tests.
• Adds RW612 CI builds and user documentation.

File	Description
.github/​workflows/​test-build-rw612.yml	Builds four RW612 configurations.
.gitignore	Ignores new unit-test binaries.
arch.mk	Adds RW612 SDK and architecture settings.
config/​examples/​rw612.config	Defines the standard RW612 configuration.
config/​examples/​rw612-tz.config	Defines the TrustZone configuration.
config/​examples/​rw612-wolfcrypt-tz.config	Enables secure wolfCrypt/PKCS11.
docs/​Targets.md	Documents setup, layout, flashing, and updates.
hal/​rw612-ns.ld	Defines the non-TrustZone bootloader layout.
hal/​rw612.c	Implements flash, UART, SAU, and TRNG support.
hal/​rw612.ld	Defines the secure bootloader layout.
src/​boot_arm.c	Adds RW612 ROM image vector metadata.
test-app/​ARM-rw612-ns.ld	Defines non-secure application memory.
test-app/​ARM-rw612.ld	Defines standard application memory.
test-app/​Makefile	Integrates RW612 application builds.
test-app/​app_rw612.c	Adds the RW612 demonstration application.
tools/​unit-tests/​Makefile	Registers RW612 unit tests.
tools/​unit-tests/​rw612_fsl_stub/​fsl_clock.h	Stubs the clock header.
tools/​unit-tests/​rw612_fsl_stub/​fsl_common.h	Provides common register mocks.
tools/​unit-tests/​rw612_fsl_stub/​fsl_romapi_flexspi.h	Mocks the ROM FlexSPI API.
tools/​unit-tests/​rw612_fsl_stub/​fsl_trng.h	Mocks the TRNG API.
tools/​unit-tests/​rw612_fsl_stub/​target.h	Defines the test memory layout.
tools/​unit-tests/​unit-rw612-flash.c	Tests flash operations and failure paths.
tools/​unit-tests/​unit-rw612-tz.c	Tests SAU attribution, IRQs, and TRNG.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #926

Scan targets checked: wolfboot-src, wolfboot-bugs
Coverage: 3 of 6 in-scope changed file(s) opened by the reviewer; not opened: test-app/app_rw612.c, tools/unit-tests/unit-rw612-flash.c, tools/unit-tests/unit-rw612-tz.c

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[Copilot]

🟡 Changes recommended

SDK-gated unit-test executables are missing from unconditional cleanup, leaving stale binaries when the SDK is unavailable.

1 open finding

• Add SDK-gated binaries to CONDITIONAL_TESTS for clean · New

1 resolved since last review

• SAU window marks five unintended FLEXCOMM ranges non-secure

🧠 Review effort: Balanced

[dgarske]

Tested this on an FRDM-RW612 here (A1 silicon, CHIP_INFO rev 2) over the on-board MCU-Link running J-Link firmware. All three configs pass: rw612.config and rw612-tz.config both boot v1, update to v2 and confirm, and v2 survives a reset. rw612-tz.config with WOLFCRYPT_TZ=1 WOLFCRYPT_TZ_PKCS11=1 also prints a fresh TRNG value on every boot, so the NSC path into the secure world works in both directions. The host rw612-flash and rw612-tz unit tests pass, as does the reworked MCXA one. wolfboot.bin carries the FCB at 0x400 and the ROM image header at 0x1020/0x1034 as described, and boots from flash offset 0 with no wrapping.

I could not exercise the pyOCD path, since pyOCD will not drive the MCU-Link once it carries J-Link firmware, so that half of the flashing docs is still unverified by me.

One docs suggestion, patch below. The J-Link fallback line is accurate but omits two things that make a scripted flash silently do nothing: connect must be the first command in the command file (anything before it triggers an implicit connect, after which J-Link Commander prints Script processing completed. and drops the rest, so loadbin never runs), and an explicit erase range needs exec EnableEraseAllFlashBanks because the FlexSPI NOR is not an internal bank. I lost a while to the first one reading it as a flash-loader failure. The patch also notes that factory.bin does both writes in one, and that west update mcux-devices-wireless is enough instead of the full update_board.

diff --git a/docs/Targets.md b/docs/Targets.md
index 974134ab..7a12ce72 100644
--- a/docs/Targets.md
+++ b/docs/Targets.md
@@ -7289,6 +7289,11 @@ west update_board --set board frdmrw612
 deactivate
 ```
 
+`update_board` fetches the whole `frdmrw612.yml` repo list. The only project
+this target needs is `mcux-devices-wireless`, which provides
+`devices/Wireless/RW/RW612`, so `west update mcux-devices-wireless` is enough
+in an existing workspace.
+
 ### RW612: Configuring and compiling
 
 ```sh
@@ -7343,8 +7348,35 @@ pyocd flash -t rw612eta2i -a 0x08000000 -e sector wolfboot.bin
 pyocd flash -t rw612eta2i -a 0x08100000 -e sector test-app/image_v1_signed.bin
 ```
 
-If the MCU-Link has been updated to J-Link firmware, `JLinkExe -device RW612
--if SWD` with `loadbin <file> <address>` works at the same addresses.
+`factory.bin` covers both writes in one: `bin-assemble` lays it out relative to
+its lowest address, so `-a 0x08000000` programs wolfBoot and the signed v1
+application together.
+
+If the MCU-Link has been updated to J-Link firmware, `loadbin <file> <address>`
+works at the same addresses:
+
+```sh
+JLinkExe -device RW612 -if SWD -speed 4000 -NoGui 1 -CommanderScript flash.jlink
+```
+
+```
+exec EnableEraseAllFlashBanks
+connect
+h
+erase 0x08200000 0x08420FFF
+loadbin factory.bin 0x08000000
+r
+g
+qc
+```
+
+`connect` has to be the first command in the script. Any other command ahead of
+it triggers an implicit connect, after which J-Link Commander reports `Script
+processing completed.` and discards the remaining lines, so `loadbin` never
+runs. `exec EnableEraseAllFlashBanks` is needed for an explicit `erase` range,
+because the FlexSPI NOR is not an internal bank; without it J-Link reports `No
+Flash bank within given address range` and erases nothing. `loadbin` erases the
+sectors it writes on its own.
 
 The debug console is FLEXCOMM3 on the MCU-Link virtual COM port at 115200
 baud. After reset:

Fixed