Add the NXP FDRM-MCXN947 port

.github/workflows/README.md

@@ -6,7 +6,7 @@ matrix on labels, main pushes, and nightly.
 
 `codeql.yml` runs C security queries. `coverity.yml` runs on Sundays at
 00:00 UTC or by manual dispatch. Both build the host suites and secure images
-for STM32H563 and MIMXRT700 with both crypto engines.
+for STM32H563, MIMXRT700, and MCXN947 with both crypto engines.
 
 Coverity scans wolfTrust runtime, ports, tests, and generated policy code.
 `tools/ci-coverity-filter.py` removes dependency source units before upload
@@ -21,8 +21,8 @@ An accepted upload queues analysis; results appear after Coverity processes it.
 | Tier | Trigger | Purpose |
 |------|---------|---------|
 | **Fast (per-PR)** | every PR; push to main | host unit suites, ISO C99, house style, bare-scope scan, Arm PSA-FF conformance, cross-compile, compiler matrix, sanitizers, valgrind, integrations, core/port split guard |
-| **M33MU smoke** | every PR | per port, on both crypto engines: STM32H563 `positive gtzcneg crossdomain bothpsa confboot devcrypto`; MIMXRT700 `positive ahbscneg crossdomain bothpsa confboot devcrypto` |
-| **M33MU full** | PR labels `ci:all`, `ci:h5`, `ci:rt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) |
+| **M33MU smoke** | every PR | per port, on both crypto engines: STM32H563 `positive gtzcneg crossdomain bothpsa confboot devcrypto`; MIMXRT700 `positive ahbscneg crossdomain bothpsa confboot devcrypto`; MCXN947 `positive sauneg crossdomain bothpsa confboot devcrypto` |
+| **M33MU full** | PR labels `ci:all`, `ci:h5`, `ci:rt700`, `ci:mcxn947`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) |
 
 The M33MU workflow (`m33mu.yml`) is label-selected the way wolfProvider's
 `pr-osp-select.yml` is: a `select` job checks the routing table
@@ -35,6 +35,7 @@ groups it picked, so a job that is not selected never appears as skipped.
 | (no label) | each port's smoke tier on both engines |
 | `ci:h5` | the STM32H563 full matrix (the change touched only that port) |
 | `ci:rt700` | the MIMXRT700 full matrix (the change touched only that port) |
+| `ci:mcxn947` | the MCXN947 full matrix (the change touched only that port) |
 | `ci:all` / `ci:m33mu` | every scenario of every port (a core change) |
 
 A label keeps applying on later pushes to the PR. Pushes to
@@ -74,10 +75,14 @@ test-target` also reads. The table below is a representative slice:
 | `mimxrt700_devstorage_devattest_devattestqcbor_<engine>` | `devstorage devattest devattestqcbor` | PSA ITS/PS and Initial Attestation conformance (the token parses under wolfCOSE's shim and reference QCBOR) |
 | `mimxrt700_devcrypto_vaultrecover_vaultrecoversec_<engine>` | `devcrypto vaultrecover vaultrecoversec` | PSA Crypto conformance on wolfPSA; a foreign vault pool self-heals in development and fails closed when SECURED |
 | `mimxrt700_rollbackneg_remeasureneg_manifestneg_spbudgetneg_<engine>` | `rollbackneg remeasureneg manifestneg spbudgetneg` | shared Secure-verdict table: rollback refusal, re-measure tamper, corrupted manifest, restart budget |
+| `mcxn947_positive_<engine>` | `positive` | MCXN947 chain under the MCXN947 model (internal flash, ROM flash API, EdgeLock entropy), both guests finish |
+| `mcxn947_sauneg_<engine>` | `sauneg` | guest0's store into guest1's RAM refused by the SAU, contained |
+| `mcxn947_<group>_<engine>` | as the MIMXRT700 groups above | the same scenario groups on the MCXN947 model; `tests/target/lib/scenario_matrix.py` is the list |
 
 An unlabeled PR runs only each port's smoke tier; the full matrix needs a
 `ci:` label. To run a single scenario locally, use `tests/target/run_m33mu_scenario.sh <key>` (the
-RT700 checks use `tests/target/run_rt700_m33mu.sh <key>`); to run a port's
+RT700 checks use `tests/target/run_rt700_m33mu.sh <key>`, the MCXN947 checks
+`tests/target/run_mcxn947_m33mu.sh <key>`); to run a port's
 full matrix on a PR, add its `ci:` label; off-PR against a branch,
 `workflow_dispatch` on `m33mu.yml` with the `port` input.
 

.github/workflows/cross-compile.yml

@@ -49,7 +49,7 @@ jobs:
           echo "LTO flash: $no_lto_flash -> $lto_flash bytes"
       - name: Verify an unimplemented isolation level stops the build
         run: |
-          for target in stm32h563 mimxrt700; do
+          for target in stm32h563 mimxrt700 mcxn947; do
             for level in 1 2; do
               if make TARGET=$target WT_ISOLATION_LEVEL=$level \
                   BUILD_DIR=build-level-$level secure-image \
@@ -119,3 +119,22 @@ jobs:
               WT_CONFORMANCE=1 secure-image TOOLPREFIX=arm-none-eabi- \
               BUILD_DIR=build_rt700_conf_$engine
           done
+      - name: Build the MCXN947 secure image (both engines, default layout)
+        run: |
+          for engine in native hsm; do
+            make TARGET=mcxn947 WT_ENGINE=$engine WT_ATTEST_COSE=0 \
+              secure-image TOOLPREFIX=arm-none-eabi- \
+              BUILD_DIR=build_mcxn947_$engine
+            # The default must leave wolfBoot's 0x400 header before the vectors.
+            vectors="$(arm-none-eabi-objdump -h build_mcxn947_$engine/wolftrust.elf \
+              | awk '$2 == ".vectors" { print $4 }')"
+            test "$vectors" = "10040400" || \
+              { echo "MCXN947 .vectors at 0x$vectors, want 0x10040400"; exit 1; }
+          done
+      - name: Build the MCXN947 conformance secure image (both engines)
+        run: |
+          for engine in native hsm; do
+            make TARGET=mcxn947 WT_ENGINE=$engine WT_ATTEST_COSE=0 \
+              WT_CONFORMANCE=1 secure-image TOOLPREFIX=arm-none-eabi- \
+              BUILD_DIR=build_mcxn947_conf_$engine
+          done

.github/workflows/m33mu.yml

@@ -1,9 +1,9 @@
 name: M33MU
 
 on:
-  # Pull requests run each port's smoke tier; the ci:all, ci:h5, and ci:rt700
-  # labels, pushes to main, the nightly schedule (workflow_call from
-  # nightly.yml), and manual dispatch run a port's full matrix.
+  # Pull requests run each port's smoke tier; the ci:all, ci:h5, ci:rt700, and
+  # ci:mcxn947 labels, pushes to main, the nightly schedule (workflow_call
+  # from nightly.yml), and manual dispatch run a port's full matrix.
   pull_request:
     types: [opened, synchronize, reopened, labeled]
   push:
@@ -13,7 +13,7 @@ on:
       port:
         description: Port whose full matrix to run
         type: choice
-        options: [all, stm32h563, mimxrt700]
+        options: [all, stm32h563, mimxrt700, mcxn947]
         default: all
   workflow_call:
 
@@ -278,7 +278,7 @@ jobs:
           fi
 
   # Label-selected, the wolfProvider way: one select job reads the ci:* labels
-  # (ci:h5 or ci:rt700 for that port's full matrix when only that port
+  # (ci:h5, ci:rt700 or ci:mcxn947 for that port's full matrix when only that port
   # changed, ci:all or ci:m33mu for everything after a core change, no label
   # for each port's smoke tier), the event, and the dispatch input, then one
   # matrix job runs exactly those scenario groups, so nothing shows up skipped.
@@ -324,40 +324,43 @@ jobs:
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           git config --global url."https://github.com/".insteadOf git@github.com:
 
-      # The RT700 wolfBoot first stage builds against the MCUXpresso SDK, staged
-      # the way wolfBoot's own imxrt700 emulator workflow stages it.
+      # The RT700 and MCXN947 wolfBoot first stages build against the
+      # MCUXpresso SDK, staged the way wolfBoot's own imxrt700 emulator
+      # workflow stages it, one board per port.
       - uses: actions/checkout@v4
-        if: matrix.port == 'mimxrt700'
+        if: matrix.port == 'mimxrt700' || matrix.port == 'mcxn947'
         with:
           repository: nxp-mcuxpresso/CMSIS_5
           ref: f9cf5df6d51a95f0146930d75af3d71977cf795a
           path: CMSIS_5
 
       - name: Cache MCUXpresso SDK
-        if: matrix.port == 'mimxrt700'
+        if: matrix.port == 'mimxrt700' || matrix.port == 'mcxn947'
         id: cache-mcuxpresso
         uses: actions/cache@v4
         with:
           path: |
             mcuxpresso-sdk
             venv
-          key: mcuxpresso-sdk-mimxrt700evk-${{ hashFiles('.github/workflows/m33mu.yml') }}
+          key: mcuxpresso-sdk-${{ matrix.port == 'mimxrt700' && 'mimxrt700evk' || 'frdmmcxn947' }}-${{ hashFiles('.github/workflows/m33mu.yml') }}
 
       - name: Setup MCUXpresso SDK
-        if: matrix.port == 'mimxrt700' && steps.cache-mcuxpresso.outputs.cache-hit != 'true'
+        if: (matrix.port == 'mimxrt700' || matrix.port == 'mcxn947') && steps.cache-mcuxpresso.outputs.cache-hit != 'true'
+        env:
+          SDK_BOARD: ${{ matrix.port == 'mimxrt700' && 'mimxrt700evk' || 'frdmmcxn947' }}
         run: |
           python3 -m venv venv
           . venv/bin/activate
           pip install west==1.5.0
           west init -m https://github.com/nxp-mcuxpresso/mcuxsdk-manifests.git \
             --mr v26.06.00-LTS mcuxpresso-sdk
           cd mcuxpresso-sdk
-          sed -i '/se_hostlib\|emwin/d' manifests/boards/mimxrt700evk.yml
-          west update_board --set board mimxrt700evk
+          sed -i '/se_hostlib\|emwin/d' "manifests/boards/$SDK_BOARD.yml"
+          west update_board --set board "$SDK_BOARD"
 
       - name: Run target scenarios
         env:
-          MCUXSDK: ${{ matrix.port == 'mimxrt700' && '1' || '' }}
+          MCUXSDK: ${{ (matrix.port == 'mimxrt700' || matrix.port == 'mcxn947') && '1' || '' }}
           MCUXPRESSO: ${{ github.workspace }}/mcuxpresso-sdk/mcuxsdk
           MCUXPRESSO_CMSIS: ${{ github.workspace }}/CMSIS_5/CMSIS
         run: tests/target/run_suite.sh ${{ matrix.arm }} ${{ matrix.key }}

.gitignore

@@ -3,6 +3,7 @@
 tests/firmware/stm32h563/build/
 tests/firmware/stm32h563-vnet/build/
 tests/firmware/mimxrt700-baremetal/build/
+tests/firmware/mcxn947-baremetal/build/
 tests/firmware/stm32h563-vnet/stm32h563_OTP.bin
 *.o
 /wolftrust

Makefile

@@ -43,6 +43,7 @@ test:
 	@python3 tests/scripts/test_m33mu_console.py
 	@$(MAKE) --no-print-directory -C tests/host test
 	@$(MAKE) --no-print-directory test-provisioning
+	@tests/target/test_mcxn947_suite_evidence.sh
 
 # Production lock gates of both provisioning backends, against stub tools.
 test-provisioning:
@@ -72,8 +73,8 @@ c99-check:
 
 # FF-M target scenarios for one port under the M33MU emulator, separate from
 # `make test` (host-only). TARGET picks the port (stm32h563 by default,
-# mimxrt700 for the RT700 chain, whose runner builds its own pinned emulator
-# and wolfBoot first stage); WT_TIER=smoke (default) runs the per-PR set,
+# mimxrt700 or mcxn947 for the NXP chains, whose runners build their own
+# pinned emulator and wolfBoot first stage); WT_TIER=smoke (default) runs the per-PR set,
 # WT_TIER=full every scenario, both from tests/target/lib/scenario_matrix.py.
 # The STM32H563 path auto-detects an M33MU (or WT_TARGET_SCENARIOS=1) and skips
 # explicitly otherwise so it never silently passes. Runs inside the
@@ -84,6 +85,8 @@ WT_SCENARIOS = $(shell python3 tests/target/lib/scenario_matrix.py \
 test-target:
 ifeq ($(TARGET),mimxrt700)
 	@tests/target/run_suite.sh rt700-m33mu $(WT_SCENARIOS)
+else ifeq ($(TARGET),mcxn947)
+	@tests/target/run_suite.sh mcxn947-m33mu $(WT_SCENARIOS)
 else
 	@if ! tests/target/detect_m33mu.sh >/dev/null 2>&1; then \
 		echo "SKIP: FF-M target scenarios ($$(tests/target/detect_m33mu.sh 2>&1))"; \
@@ -99,6 +102,8 @@ endif
 test-hardware:
 ifeq ($(TARGET),mimxrt700)
 	@tests/target/run_rt700_suite.sh
+else ifeq ($(TARGET),mcxn947)
+	@tests/target/run_mcxn947_suite.sh
 else
 	@tests/target/run_h5_suite.sh
 endif

README.md

@@ -88,13 +88,14 @@ current reference port, not a requirement imposed on every intended port.
 
 ## Ports
 
-wolfTrust currently supports two ports; each guide covers the board, the
+wolfTrust currently supports three ports; each guide covers the board, the
 first-stage loader contract, and the runners:
 
 - STM32H563 (NUCLEO-H563ZI): [STM32H5 Guide](docs/STM32H5-Guide.md)
 - NXP MIMXRT700 (MIMXRT700-EVK): [MIMXRT700 Guide](docs/MIMXRT700-Guide.md)
+- NXP MCXN947 (FRDM-MCXN947): [MCXN947 Guide](docs/MCXN947-Guide.md)
 
-Both build with `TARGET=<port>` (`stm32h563` is the default) and run the
+All build with `TARGET=<port>` (`stm32h563` is the default) and run the
 same scenario set under the M33MU emulator with `make test-target
 TARGET=<port>`.
 
@@ -137,14 +138,16 @@ Common validation entry points:
 make test
 make test-target
 make test-target TARGET=mimxrt700
+make test-target TARGET=mcxn947
 make test-conformance
 WT_H5_DOCKER_IMAGE=ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.15 make test-hardware
+make test-hardware TARGET=mcxn947
 ```
 
 `make test-target` runs the port's smoke tier under M33MU (`WT_TIER=full` for
 every scenario): the STM32H563 default skips explicitly when M33MU is
-unavailable, and `TARGET=mimxrt700` builds its pinned emulator and wolfBoot
-first stage itself.
+unavailable, and `TARGET=mimxrt700` or `TARGET=mcxn947` builds its pinned
+emulator and wolfBoot first stage itself.
 `make test-conformance` instead runs its 20-test host subset and warns that it
 is not full emulator or hardware evidence. `make test-hardware` skips when
 board detection fails; on hosts without `lsusb`, a missing ST-Link can instead

docs/Home.md

@@ -118,3 +118,4 @@ port's five CMSE gateway veneers.
 | [Project Structure](Project-Structure.md) | Repository layout |
 | [STM32H5 Guide](STM32H5-Guide.md) | STM32H563 provisioning, flashing, WRP, and recovery safety |
 | [MIMXRT700 Guide](MIMXRT700-Guide.md) | MIMXRT700 provisioning, flashing, XSPI guest fence, and recovery safety |
+| [MCXN947 Guide](MCXN947-Guide.md) | MCXN947 internal flash, ELS entropy, emulator runner, life cycle rehearsal, and open items |