Various TrustZone improvements

Makefile

@@ -402,6 +402,10 @@ $(LSCRIPT): $(LSCRIPT_IN) FORCE
 		sed -e "s/@ARCH_FLASH_OFFSET@/$(ARCH_FLASH_OFFSET)/g" | \
 		sed -e "s/@BOOTLOADER_PARTITION_SIZE@/$(BOOTLOADER_PARTITION_SIZE)/g" | \
 		sed -e "s/@WOLFBOOT_ORIGIN@/$(WOLFBOOT_ORIGIN)/g" | \
+		sed -e "s/@WOLFBOOT_KEYVAULT_ADDRESS@/$(WOLFBOOT_KEYVAULT_ADDRESS)/g" | \
+		sed -e "s/@WOLFBOOT_KEYVAULT_SIZE@/$(WOLFBOOT_KEYVAULT_SIZE)/g" | \
+		sed -e "s/@WOLFBOOT_NSC_ADDRESS@/$(WOLFBOOT_NSC_ADDRESS)/g" | \
+		sed -e "s/@WOLFBOOT_NSC_SIZE@/$(WOLFBOOT_NSC_SIZE)/g" | \
 		sed -e "s/@WOLFBOOT_PARTITION_BOOT_ADDRESS@/$(WOLFBOOT_PARTITION_BOOT_ADDRESS)/g" | \
 		sed -e "s/@WOLFBOOT_PARTITION_SIZE@/$(WOLFBOOT_PARTITION_SIZE)/g" | \
 		sed -e "s/@WOLFBOOT_PARTITION_UPDATE_ADDRESS@/$(WOLFBOOT_PARTITION_UPDATE_ADDRESS)/g" | \
@@ -480,6 +484,8 @@ include/target.h: $(TARGET_H_TEMPLATE) FORCE
 	$(Q)cat $(TARGET_H_TEMPLATE) | \
 	sed -e "s/@WOLFBOOT_PARTITION_SIZE@/$(WOLFBOOT_PARTITION_SIZE)/g" | \
 	sed -e "s/@WOLFBOOT_SECTOR_SIZE@/$(WOLFBOOT_SECTOR_SIZE)/g" | \
+	sed -e "s/@WOLFBOOT_NSC_ADDRESS@/$(WOLFBOOT_NSC_ADDRESS)/g" | \
+	sed -e "s/@WOLFBOOT_NSC_SIZE@/$(WOLFBOOT_NSC_SIZE)/g" | \
 	sed -e "s/@WOLFBOOT_PARTITION_BOOT_ADDRESS@/$(WOLFBOOT_PARTITION_BOOT_ADDRESS)/g" | \
 	sed -e "s/@WOLFBOOT_PARTITION_UPDATE_ADDRESS@/$(WOLFBOOT_PARTITION_UPDATE_ADDRESS)/g" | \
 	sed -e "s/@WOLFBOOT_PARTITION_SWAP_ADDRESS@/$(WOLFBOOT_PARTITION_SWAP_ADDRESS)/g" | \

arch.mk

@@ -687,6 +687,12 @@ ifeq ($(TARGET),mcxw)
       $(MCUXPRESSO_DRIVERS)/drivers/fsl_romapi.o
 endif
 
+ifeq ($(TARGET),nrf5340_net)
+  # Net core doesn't support DSP and FP
+  CFLAGS+=-mcpu=cortex-m33+nodsp+nofp
+  LDFLAGS+=-mcpu=cortex-m33+nodsp+nofp
+endif
+
 ifeq ($(TARGET),imx_rt)
   CFLAGS+=\
       -I$(MCUXPRESSO_DRIVERS) \

config/examples/nrf5340.config

@@ -26,8 +26,8 @@ QSPI_FLASH?=1
 # Flash is 4KB pages (app)
 WOLFBOOT_SECTOR_SIZE?=0x1000
 
-# Application offset (reserve 48KB for wolfBoot)
-WOLFBOOT_PARTITION_BOOT_ADDRESS?=0xC000
+# Application offset (reserve 64KB for wolfBoot)
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x10000
 
 # Application Partition Size (952KB)
 WOLFBOOT_PARTITION_SIZE?=0xEE000

config/examples/nrf5340_net.config

@@ -30,8 +30,8 @@ ARCH_FLASH_OFFSET=0x01000000
 # Flash is 2KB pages
 WOLFBOOT_SECTOR_SIZE?=0x800
 
-# Application offset (reserve 48KB for wolfBoot)
-WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x0100C000
+# Application offset (reserve 64KB for wolfBoot)
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x01010000
 
 # Application Partition Size (184KB)
 WOLFBOOT_PARTITION_SIZE?=0x2E000

config/examples/stm32h5-tz-dualbank-otp-lms.config

@@ -20,6 +20,10 @@ RAM_CODE?=1
 DUALBANK_SWAP?=1
 WOLFBOOT_PARTITION_SIZE?=0xA0000
 WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C160000
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0xFFFFFFFF

config/examples/stm32h5-tz-dualbank-otp.config

@@ -20,6 +20,10 @@ RAM_CODE?=1
 DUALBANK_SWAP?=1
 WOLFBOOT_PARTITION_SIZE?=0xA0000
 WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C160000
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0xFFFFFFFF

config/examples/stm32h5-tz-dualbank.config

@@ -20,6 +20,10 @@ RAM_CODE?=1
 DUALBANK_SWAP?=1
 WOLFBOOT_PARTITION_SIZE?=0xA0000
 WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C160000
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0xFFFFFFFF

config/examples/stm32h5-tz-tpm.config

@@ -20,6 +20,10 @@ RAM_CODE?=1
 DUALBANK_SWAP?=0
 WOLFBOOT_PARTITION_SIZE?=0xA0000
 WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C100000
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0C1A0000
@@ -29,4 +33,4 @@ WOLFCRYPT_TZ=1
 WOLFCRYPT_TZ_PKCS11=1
 IMAGE_HEADER_SIZE?=1024
 ARMORED=1
-WOLFTPM=1
+WOLFTPM=1

config/examples/stm32h5-tz.config

@@ -20,6 +20,10 @@ RAM_CODE?=1
 DUALBANK_SWAP?=0
 WOLFBOOT_PARTITION_SIZE?=0xA0000
 WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C100000
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0C1A0000

config/examples/stm32h5.config

@@ -20,6 +20,10 @@ RAM_CODE?=0
 DUALBANK_SWAP?=0
 WOLFBOOT_PARTITION_SIZE?=0xA0000
 WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x08100000
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x081A0000

config/examples/stm32l5-wolfcrypt-tz.config

@@ -20,6 +20,10 @@ RAM_CODE?=0
 DUALBANK_SWAP?=0
 WOLFBOOT_PARTITION_SIZE?=0x1F800
 WOLFBOOT_SECTOR_SIZE?=0x800
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C020000
+WOLFBOOT_KEYVAULT_SIZE?=0x18000
+WOLFBOOT_NSC_ADDRESS?=0xC038000
+WOLFBOOT_NSC_SIZE?=0x8000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08040000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x805F800
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0807F000

config/examples/stm32u5-wolfcrypt-tz.config

@@ -20,6 +20,10 @@ RAM_CODE?=0
 DUALBANK_SWAP?=0
 WOLFBOOT_PARTITION_SIZE?=0x1F800
 WOLFBOOT_SECTOR_SIZE?=0x800
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C020000
+WOLFBOOT_KEYVAULT_SIZE?=0x18000
+WOLFBOOT_NSC_ADDRESS?=0x0C038000
+WOLFBOOT_NSC_SIZE?=0x8000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08040000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x805F800
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0807F000

config/examples/stm32u5.config

@@ -22,6 +22,10 @@ RAM_CODE?=0
 DUALBANK_SWAP?=0
 WOLFBOOT_PARTITION_SIZE?=0x1F800
 WOLFBOOT_SECTOR_SIZE?=0x800
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C020000
+WOLFBOOT_KEYVAULT_SIZE?=0x18000
+WOLFBOOT_NSC_ADDRESS?=0x0C038000
+WOLFBOOT_NSC_SIZE?=0x8000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08040000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x805F800
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0807F000

docs/STM32-TZ.md

@@ -55,6 +55,17 @@ image header size must be supplied as an environment variable. For example:
 IMAGE_HEADER_SIZE=1024 ./tools/keytools/sign --sha256 --ecc256 myapp.bin wolfboot_signing_private_key.der 1
 ```
 
+### Setting option bytes automatically
+
+In order to use wolfBoot with an STM32 device, the device's option bytes need
+to be consistent with wolfBoot's configuration. The script at
+[tools/scripts/set-stm32-tz-option-bytes.sh](tools/scripts/set-stm32-tz-option-bytes.sh)
+will attempt to read the wolfBoot `.config` file and automatically calculate
+and set your device's TrustZone-related option bytes according to it, using
+`STM32_Programmer_CLI`, which is part of the
+[STM32CubeProg](https://www.st.com/en/development-tools/stm32cubeprog.html)
+tool.
+
 ### NSC API
 
 wolfBoot provides a few Non-Secure Callable functions to allow a non-secure

docs/Targets.md

@@ -2735,14 +2735,22 @@ Debugging with JLink:
 
 1) Start GDB Server:
 ```
+# To debug the app core:
 JLinkGDBServer -device nRF5340_xxAA_APP -if SWD -port 3333
+# To debug the net core:
+JLinkGDBServer -device nRF5340_xxAA_NET -if SWD -port 3334
 ```
 
 2) Start GDB
-This will use .gdbinit, but can supply `wolfboot.elf -ex "target remote localhost:3333"` if permissions not allowing.
 
 ```
-arm-none-eabi-gdb
+cd tools/scripts/nrf5340
+
+# To debug the app core:
+arm-none-eabi-gdb -x app.gdbinit
+# To debug the net core:
+arm-none-eabi-gdb -x net.gdbinit
+
 b main
 mon reset
 c

hal/nrf5340.c

@@ -340,6 +340,14 @@ void ext_flash_unlock(void)
 }
 #endif /* TARGET_nrf5340_net */
 
+static void hal_handle_approtect(void) {
+#ifdef DEBUG_SYMBOLS
+    /* Needed to allow debugger access */
+    CTRLAP_APPROTECT_DISABLE = 0x50FA50FA;
+    CTRLAP_SECUREAPPROTECT_DISABLE = 0x50FA50FA;
+#endif
+}
+
 static void clock_init(void)
 {
 #ifdef TARGET_nrf5340_app
@@ -692,6 +700,8 @@ void hal_init(void)
 
     clock_init();
 
+    hal_handle_approtect();
+
 #ifdef DEBUG_UART
     uart_init();
     #ifdef __WOLFBOOT

hal/nrf5340.h

@@ -113,10 +113,27 @@ void sleep_us(uint32_t usec);
     #define SPU_FLASHREGION_PERM_LOCK    (1 << 8) /* The content of this register can't be changed until the next reset */
 #endif
 
-/* OTP */
-#define UICR_BASE (0x00FF8000UL)
+/* UICR */
+#ifdef TARGET_nrf5340_app
+    #define UICR_BASE (0x00FF8000UL)
+#else
+    #define UICR_BASE (0x01FF8000UL)
+#endif
 #define UICR_USER (UICR_BASE)
-#define UICR_OTP  (UICR_BASE + 0x100)
+#define UICR_APPROTECT       (*(volatile uint32_t *)(UICR_BASE + 0x000))
+#define UICR_SECUREAPPROTECT (*(volatile uint32_t *)(UICR_BASE + 0x01C))
+#define UICR_OTP             (UICR_BASE + 0x100)
+
+/* CTRLAP */
+#ifdef TARGET_nrf5340_app
+    #define CTRLAP_BASE (0x50006000)
+#else
+    #define CTRLAP_BASE (0x41006000)
+#endif
+#define CTRLAP_APPROTECT_LOCK          (*(volatile uint32_t *)(CTRLAP_BASE 0x540))
+#define CTRLAP_APPROTECT_DISABLE       (*(volatile uint32_t *)(CTRLAP_BASE 0x544))
+#define CTRLAP_SECUREAPPROTECT_LOCK    (*(volatile uint32_t *)(CTRLAP_BASE 0x548))
+#define CTRLAP_SECUREAPPROTECT_DISABLE (*(volatile uint32_t *)(CTRLAP_BASE 0x54C))
 
 /* Reset */
 #ifdef TARGET_nrf5340_app

hal/stm32_tz.c

@@ -37,6 +37,7 @@
 
 #include "image.h"
 #include "hal.h"
+#include "target.h"
 #if defined (__ARM_FEATURE_CMSE) && (__ARM_FEATURE_CMSE == 3U) && (!defined(FLAGS_HOME) || !defined(DISABLE_BACKUP))
 
 
@@ -297,7 +298,8 @@ void hal_tz_sau_init(void)
     /* SAU is set up before staging. Set up all areas as secure. */
 
     /* Non-secure callable: NSC functions area */
-    sau_init_region(0, 0x0C040000, 0x0C05FFFF, 1);
+    sau_init_region(0, WOLFBOOT_NSC_ADDRESS,
+            WOLFBOOT_NSC_ADDRESS + WOLFBOOT_NSC_SIZE - 1, 1);
 
     /* Secure: application flash area (first bank) */
     sau_init_region(1, WOLFBOOT_PARTITION_BOOT_ADDRESS, FLASH_BANK2_BASE - 1, 0);
@@ -331,10 +333,13 @@ void hal_tz_sau_init(void)
 void hal_tz_sau_init(void)
 {
     /* Non-secure callable: NSC functions area */
-    sau_init_region(0, 0x0C038000, 0x0C040000, 1);
+    sau_init_region(0, WOLFBOOT_NSC_ADDRESS,
+            WOLFBOOT_NSC_ADDRESS + WOLFBOOT_NSC_SIZE - 1, 1);
 
     /* Non-secure: application flash area */
-    sau_init_region(1, 0x08040000, 0x0807FFFF, 0);
+    sau_init_region(1, WOLFBOOT_PARTITION_BOOT_ADDRESS,
+            WOLFBOOT_PARTITION_BOOT_ADDRESS + 2 * WOLFBOOT_PARTITION_SIZE - 1,
+            0);
 
     /* Non-secure RAM region in SRAM1/SRAM2 */
     sau_init_region(2, 0x20020000, 0x2003FFFF, 0);

hal/stm32h5.ld

@@ -1,12 +1,11 @@
 MEMORY
 {
-    /* If FLASH_KEYVAULT or FLASH_NSC length is adjusted FLASH length needs adjusted too */
-    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @BOOTLOADER_PARTITION_SIZE@ - 0x20000
+    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @WOLFBOOT_KEYVAULT_ADDRESS@ - @ARCH_FLASH_OFFSET@
     RAM (rwx) :     ORIGIN = 0x30000000, LENGTH = 0x20000
     RAM_KV (rw):    ORIGIN = 0x30020000, LENGTH = 0x10000
     RAM_HEAP (rw):  ORIGIN = 0x30030000, LENGTH = 0x10000 /* 64KB Heap for wolfcrypt/PKCS11 */
-    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_ORIGIN@ + LENGTH(FLASH), LENGTH = 0x1C000
-    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_ORIGIN@ + LENGTH(FLASH) + LENGTH(FLASH_KEYVAULT), LENGTH = 0x4000
+    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_KEYVAULT_ADDRESS@, LENGTH = @WOLFBOOT_KEYVAULT_SIZE@
+    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_NSC_ADDRESS@, LENGTH = @WOLFBOOT_NSC_SIZE@
 }
 
 SECTIONS

hal/stm32l5.ld

@@ -1,11 +1,11 @@
 MEMORY
 {
-    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @BOOTLOADER_PARTITION_SIZE@ - 0x20000
+    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @WOLFBOOT_KEYVAULT_ADDRESS@ - @ARCH_FLASH_OFFSET@
     RAM (rwx) :     ORIGIN = 0x30000000, LENGTH = 0x00012000
     RAM_HEAP (rw):  ORIGIN = 0x30012000, LENGTH = 0xc000 /* 49152 B Heap for wolfcrypt/PKCS11 */
     RAM_KV (rw):    ORIGIN = 0x3001e000, LENGTH = 0x2000
-    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_ORIGIN@ + 0x20000, LENGTH = 0x18000
-    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_ORIGIN@ + 0x38000, LENGTH = 0x8000
+    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_KEYVAULT_ADDRESS@, LENGTH = @WOLFBOOT_KEYVAULT_SIZE@
+    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_NSC_ADDRESS@, LENGTH = @WOLFBOOT_NSC_SIZE@
 }
 
 SECTIONS

hal/stm32u5.c

@@ -471,14 +471,22 @@ void RAMFUNCTION hal_flash_dualbank_swap(void)
 
 static void led_unsecure()
 {
-    uint32_t pin;
-
+#ifdef STM32_DISCOVERY
     /* Enable clock for User LED GPIOs */
     RCC_AHB2ENR1_CLOCK_ER|= GPIOH_AHB2ENR1_CLOCK_ER;
 
     /* Un-secure User LED GPIO pins */
-    GPIOH_SECCFGR&=~(1<<LED_USR_PIN);
-    GPIOH_SECCFGR&=~(1<<LED_BOOT_PIN);
+    GPIOH_SECCFGR &= ~(1 << LED_USR_PIN);
+    GPIOH_SECCFGR &= ~(1 << LED_BOOT_PIN);
+#else
+    /* Enable clock for User LED GPIOs */
+    RCC_AHB2ENR1_CLOCK_ER |= GPIOC_AHB2ENR1_CLOCK_ER;
+    RCC_AHB2ENR1_CLOCK_ER |= GPIOG_AHB2ENR1_CLOCK_ER;
+
+    /* Un-secure User LED GPIO pins */
+    GPIOG_SECCFGR &= ~(1 << LED_USR_PIN);
+    GPIOC_SECCFGR &= ~(1 << LED_BOOT_PIN);
+#endif
 }
 
 #if defined(DUALBANK_SWAP) && defined(__WOLFBOOT)

hal/stm32u5.h

@@ -248,14 +248,25 @@
 #define FLASH_OPTKEY2                         (0x4C5D6E7FU)
 
 /* GPIO*/
+#define GPIOC_BASE 0x52020800
+#define GPIOG_BASE 0x52021800
 #define GPIOH_BASE 0x52021C00
 
+#define GPIOC_SECCFGR (*(volatile uint32_t *)(GPIOC_BASE + 0x30))
+#define GPIOG_SECCFGR (*(volatile uint32_t *)(GPIOG_BASE + 0x30))
 #define GPIOH_SECCFGR (*(volatile uint32_t *)(GPIOH_BASE + 0x30))
 
+#ifdef STM32_DISCOVERY
 #define LED_BOOT_PIN (7) /* PH7 - Discovery - Green Led */
 #define LED_USR_PIN (6)  /* PH6 - Discovery  - Red Led */
+#else
+#define LED_BOOT_PIN (7) /* PC7 - Nucleo-U575ZI-Q - Green Led */
+#define LED_USR_PIN (2)  /* PG2 - Nucleo-U575ZI-Q - Red Led */
+#endif
 
 #define RCC_AHB2ENR1_CLOCK_ER (*(volatile uint32_t *)(RCC_BASE + 0x8C ))
+#define GPIOC_AHB2ENR1_CLOCK_ER (1 << 2)
+#define GPIOG_AHB2ENR1_CLOCK_ER (1 << 6)
 #define GPIOH_AHB2ENR1_CLOCK_ER (1 << 7)
 #define TRNG_AHB2_CLOCK_ER      (1 << 18)
 

hal/stm32u5.ld

@@ -1,11 +1,11 @@
 MEMORY
 {
-    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @BOOTLOADER_PARTITION_SIZE@ - 0x20000
+    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @WOLFBOOT_KEYVAULT_ADDRESS@ - @ARCH_FLASH_OFFSET@
     RAM (rwx) :     ORIGIN = 0x30000000, LENGTH = 0x00012000
     RAM_HEAP (rw):  ORIGIN = 0x30012000, LENGTH = 0xc000 /* 49152 B Heap for wolfcrypt/PKCS11 */
     RAM_KV (rw):    ORIGIN = 0x3001e000, LENGTH = 0x2000
-    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_ORIGIN@ + 0x20000, LENGTH = 0x18000
-    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_ORIGIN@ + 0x38000, LENGTH = 0x8000
+    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_KEYVAULT_ADDRESS@, LENGTH = @WOLFBOOT_KEYVAULT_SIZE@
+    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_NSC_ADDRESS@, LENGTH = @WOLFBOOT_NSC_SIZE@
 }
 
 SECTIONS