Add AArch64 UEFI support (NVIDIA Jetson Orin) by dgarske · Pull Request #818 · wolfSSL/wolfBoot

dgarske · 2026-07-07T17:05:56Z

Summary

Adds a generic AArch64 UEFI-application target, the direct sibling of the existing x86_64_efi target. wolfBoot builds as wolfboot.efi (a PE/COFF EFI application), is launched by platform UEFI firmware, verifies the next-stage image with wolfCrypt, and boots it through UEFI LoadImage/StartImage. It uses only UEFI Boot Services (no SoC-specific registers), so a single binary runs on any AArch64 UEFI platform. Validated end-to-end on the NVIDIA Jetson Orin Nano (Tegra234), booting a signed L4T kernel to an Ubuntu 22.04 login prompt.

Features

AArch64 UEFI verified boot: reads the kernel image from the EFI Simple File System, verifies it with wolfCrypt (validated with ED25519/SHA256; the standard SIGN/HASH options apply), and hands off via LoadImage/StartImage. A/B image selection uses the RAM updater.
Portable, board-agnostic binary: relies only on UEFI Boot Services, so one wolfboot.efi runs on any AArch64 UEFI platform rather than being tied to a board.
UEFI Secure Boot enrollment: tools/scripts/sign-efi-secureboot.sh generates PK/KEK/db keys, sbsigns wolfboot.efi, and emits the .auth variable updates so the firmware verifies wolfBoot, making the chain continuous (firmware -> wolfboot.efi -> kernel). Document-only NVIDIA PKC/SBK fuse-provisioning steps included (no fuses burned).
Measured boot into the platform TPM: measures the verified kernel into a PCR through EFI_TCG2_PROTOCOL (HashLogExtendEvent), extending both the SHA-256 and SHA-384 banks with no TPM driver of its own. Enabled with MEASURED_BOOT_TCG2=1; best-effort on platforms without a firmware TPM.
FIPS-ready configuration: documents the approved selection (SIGN=ECC384 HASH=SHA384 SPMATH=1) vs. the default ED25519/SHA256, with docs/FIPS.md scoping what a validated build additionally requires.
gnu-efi build integration: pei-aarch64-little PE output; tools/scripts/build-gnu-efi-aarch64.sh builds the runtime from a pinned gnu-efi tag (4.0.4) for reproducibility.
Hardware-free iteration: tools/scripts/aarch64-efi-qemu.sh runs wolfboot.efi under QEMU + AAVMF, with a --gdb mode for source-level debugging.
Continuous integration: a compile-only aarch64_efi_test job builds the gnu-efi runtime and wolfboot.efi on every push, mirroring the x86_64_efi job.
Tegra234 bare-metal skeleton (groundwork): UART + generic-timer HAL and a compile-only tegra234_test CI job, as a starting point for the future vendor-firmware-replacement path (not a validated boot path).

Notable fix

For a UEFI-application target the keystore must not be placed in the .keystore linker section (the gnu-efi PE does not load it, so PubKeys reads back as zeros). keygen.c emits the keystore as plain const data for aarch64_efi, matching x86_64_efi.

Build and run

./tools/scripts/build-gnu-efi-aarch64.sh          # one-time: AArch64 gnu-efi
cp config/examples/aarch64_efi.config .config
make                                              # -> wolfboot.efi
./tools/scripts/aarch64-efi-qemu.sh               # optional: run in QEMU

See docs/Targets.md (NVIDIA Jetson Orin section) for the full validated L4T recipe and Secure Boot enrollment steps.

Validation

QEMU (qemu-system-aarch64 + AAVMF): launch -> read kernel.img -> ED25519 verify PASS -> LoadImage/StartImage -> the real L4T kernel EFI stub runs.
Jetson Orin Nano: Verifying signature...done -> boots the signed L4T kernel -> mounts the SD rootfs -> Ubuntu 22.04.5 login prompt.
Build coverage: aarch64_efi (default and FIPS ECC384/SHA384) and tegra234 build clean; x86_64_efi and raspi3 unregressed. Secure Boot tool round-trips (sign -> sbverify PASS; unsigned -> rejected).

Copilot

Pull request overview

This pull request adds a new aarch64_efi target so wolfBoot can run as an AArch64 UEFI application (validated on NVIDIA Jetson Orin), loading/verifying kernel.img/update.img from the ESP and booting via UEFI LoadImage/StartImage.

Changes:

Add a new AArch64 UEFI HAL (hal/aarch64_efi.c) plus boot glue (src/boot_aarch64_efi.c) and linker-script stub.
Extend the build system to support an AArch64 PE/COFF wolfboot.efi output and a new example config.
Add helper scripts and documentation for building gnu-efi for AArch64 and running under QEMU/Jetson deployment.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tools/scripts/build-gnu-efi-aarch64.sh	Helper to clone/build/install gnu-efi (AArch64) into the repo tree
tools/scripts/aarch64-efi-qemu.sh	Convenience runner for `wolfboot.efi` under QEMU + AAVMF
tools/keytools/keygen.c	Extends keystore section handling for the new UEFI target macro
src/boot_aarch64_efi.c	Adds UEFI-target `do_boot()` glue for AArch64
Makefile	Makes the `wolfboot.efi` objcopy output format configurable per target
hal/aarch64_efi.ld	Empty placeholder linker script (gnu-efi script used instead)
hal/aarch64_efi.c	New AArch64 UEFI HAL: ESP file loading, verification, LoadImage/StartImage handoff
docs/Targets.md	Adds `aarch64_efi` target documentation (Jetson Orin + QEMU workflow)
config/examples/aarch64_efi.config	Example configuration for `aarch64_efi`
arch.mk	Adds `aarch64_efi` target build flags, gnu-efi paths, and linking rules
.gitignore	Ignores gnu-efi build artifacts and staging dirs for the new target

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 11 comments.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 8 comments.

AArch64 UEFI-application target (sibling of x86_64_efi): builds wolfboot.efi, verifies the next-stage image with wolfCrypt, and boots via UEFI LoadImage/StartImage. Validated on the Jetson Orin Nano through to the Ubuntu login. Includes gnu-efi build and QEMU scripts, CI, a UEFI Secure Boot signing tool (sign-efi-secureboot.sh) with enrollment/fuse docs, and FIPS-approved algorithm guidance (docs/FIPS.md).

UART + ARMv8 generic timer HAL on the shared AArch64 startup; builds wolfboot.bin (RAM boot, like raspi3). Groundwork for the Path B firmware-replacement direction; adds a compile-only CI job.

Adds MEASURED_BOOT_TCG2: wolfBoot extends the verified kernel into the platform firmware TPM (PCR MEASURED_PCR_A) via EFI_TCG2_PROTOCOL HashLogExtendEvent before handoff, no wolfTPM transport. Validated on the NVIDIA Orin Nano fTPM (TPM present, SHA-256+SHA-384 banks, measured into PCR 9).

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 12 comments.

Comments suppressed due to low confidence (1)

hal/aarch64_efi.c:1

UEFI EFI_FILE_PROTOCOL.Open() ignores the Attributes parameter unless EFI_FILE_MODE_CREATE is set; passing READ_ONLY|HIDDEN|SYSTEM here is nonstandard and can cause opens to fail on stricter firmwares. For read-only opens, pass 0 for the Attributes argument and keep access control via EFI_FILE_MODE_READ.

/* aarch64_efi.c

+    . = ALIGN(4);
+}
+
+END_STACK = _start_text;


+typedef struct {
+    UINT32 Size;
+    WOLFBOOT_TCG2_EVENT_HEADER Header;
+    UINT8  Event[1];
+} __attribute__((packed)) WOLFBOOT_TCG2_EVENT;


+    WOLFBOOT_TCG2_CAPABILITY cap;
+    EFI_STATUS status;
+    static const char desc[] = "wolfBoot kernel.img";
+    uint8_t buf[sizeof(WOLFBOOT_TCG2_EVENT) + sizeof(desc)];


+    ZeroMem(buf, sizeof(buf));
+    evt->Size = (UINT32)sizeof(buf);


+    evt->Header.HeaderVersion = 1;
+    evt->Header.PCRIndex = (UINT32)WOLFBOOT_MEASURED_PCR_A;
+    evt->Header.EventType = (UINT32)WOLFBOOT_TCG2_EV_IPL;
+    CopyMem(evt->Event, (void *)desc, sizeof(desc));


+int RAMFUNCTION hal_flash_write(uintptr_t address, const uint8_t *data, int len)
+{
+    return 0;
+}


+int RAMFUNCTION hal_flash_erase(uintptr_t address, int len)
+{
+    return 0;
+}


+    EFI_STATUS status;
+    uint32_t kernel_size, update_size;


+#   KEYDIR   directory for the generated keys/certs (default tools/efi-secureboot-keys)
+#   EFI_BIN  the PE image to sign (default: first arg, else wolfboot.efi)
+#   CN       common-name prefix for the generated certs (default "wolfBoot")
+set -e


+        openssl req -new -x509 -newkey rsa:2048 -nodes -sha256 -days 3650 \
+            -subj "/CN=$subject/" -keyout "$name.key" -out "$name.crt"


dgarske self-assigned this Jul 7, 2026

Copilot AI review requested due to automatic review settings July 7, 2026 17:05

Copilot started reviewing on behalf of dgarske July 7, 2026 17:07 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

Comment thread hal/aarch64_efi.c

Comment thread src/boot_aarch64_efi.c Outdated

Comment thread hal/aarch64_efi.c Outdated

Comment thread hal/aarch64_efi.c

Comment thread tools/scripts/build-gnu-efi-aarch64.sh Outdated

Comment thread arch.mk

dgarske force-pushed the aarch64_efi branch from 4843214 to f13a354 Compare July 8, 2026 00:01

dgarske requested a review from Copilot July 8, 2026 00:05

Copilot AI reviewed Jul 8, 2026

View reviewed changes

Copilot started reviewing on behalf of dgarske July 8, 2026 00:29 View session

dgarske force-pushed the aarch64_efi branch 2 times, most recently from 308bf22 to 1963856 Compare July 11, 2026 00:03

dgarske requested a review from Copilot July 11, 2026 00:29

dgarske marked this pull request as ready for review July 11, 2026 00:39

Copilot AI reviewed Jul 11, 2026

View reviewed changes

Copilot started reviewing on behalf of dgarske July 11, 2026 00:49 View session

dgarske added 3 commits July 22, 2026 14:56

tegra234: add bare-metal skeleton target

7e66402

UART + ARMv8 generic timer HAL on the shared AArch64 startup; builds wolfboot.bin (RAM boot, like raspi3). Groundwork for the Path B firmware-replacement direction; adds a compile-only CI job.

dgarske force-pushed the aarch64_efi branch from d9a062b to adfceb4 Compare July 22, 2026 22:02

dgarske requested a review from Copilot July 22, 2026 22:02

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Copilot started reviewing on behalf of dgarske July 22, 2026 22:37 View session

		openssl req -new -x509 -newkey rsa:2048 -nodes -sha256 -days 3650 \
		-subj "/CN=$subject/" -keyout "$name.key" -out "$name.crt"

Uh oh!

Conversation

dgarske commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Features

Notable fix

Build and run

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dgarske commented Jul 7, 2026 •

edited

Loading