Skip to content

Fix embedded images built with the clang compiler #730

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
danielinux wants to merge 19 commits into
base: master
Choose a base branch
from
Open

Fix embedded images built with the clang compiler #730

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
ed15e3a
Fix embedded images built with the clang compiler
danielinux Mar 19, 2026
6082543
Added explicit discard list for clang compiler
danielinux Mar 23, 2026
cd556ce
Added clang pass for arm build tests
danielinux Mar 23, 2026
f6ec476
Discard volatile sections during app objcopy when compiling with clang
danielinux Mar 23, 2026
f7b2e5a
Fix stdlib in clang, limit test to a few targets
danielinux Mar 23, 2026
9982734
Exclude stm32c0 (too small for clang) and stm32h5 (no ARMORED support)
danielinux Mar 23, 2026
8583a87
Concentrate flags for clang in arch.mk
danielinux Mar 23, 2026
bcd4d8b
Fixed Clang sections in TZEN images
danielinux Mar 24, 2026
ce24cd2
CLANG: fix sparse image for test-app in trustzone
danielinux Mar 25, 2026
92ed25d
Removed clang install + fix path in tests
danielinux Mar 25, 2026
7591d67
test-app: add dummy .data and .bss sections when using clang
mattia-moffa Mar 31, 2026
82e8148
Undo redundant workarounds
mattia-moffa Mar 31, 2026
1bcac24
Don't override OBJCOPY_IMAGE_FLAGS
mattia-moffa Apr 3, 2026
9778552
Remove redundant comment
mattia-moffa Apr 3, 2026
8572e20
Use LLVM LDD with clang
mattia-moffa Apr 3, 2026
a0a3dae
Use llvm-ar, llvm-objcopy, llvm-size when USE_CLANG=1
mattia-moffa Apr 3, 2026
5cd5a19
Update test container to 1.3
mattia-moffa Apr 3, 2026
8bfdf5b
Explicitly place .keystore
mattia-moffa Apr 3, 2026
e01c613
Fix CI tests
mattia-moffa Apr 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion .github/workflows/test-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
build:
runs-on: ubuntu-latest
container:
image: ghcr.io/wolfssl/wolfboot-ci-arm:v1.0
image: ghcr.io/wolfssl/wolfboot-ci-arm:v1.3
timeout-minutes: 30

steps:
Expand All @@ -45,3 +45,17 @@ jobs:
- name: Build wolfboot
run: |
make ${{inputs.make-args}}

- name: Rebuild wolfboot with Clang
if: |
inputs.config-file == './config/examples/stm32h7.config' ||
inputs.config-file == './config/examples/stm32h7-octospi.config' ||
inputs.config-file == './config/examples/stm32u5.config' ||
inputs.config-file == './config/examples/stm32u5-wolfcrypt-tz.config' ||
inputs.config-file == './config/examples/stm32u5-nonsecure-dualbank.config' ||
inputs.config-file == './config/examples/stm32n567.config'
Comment on lines +55 to +56
Copy link

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Clang rebuild condition includes ./config/examples/stm32n567.config, but that config file is not present in this repository. This makes the workflow inconsistent and will fail if the reusable workflow is ever called with that inputs.config-file value; either add the missing config file or remove/rename this entry to an existing config path.

Suggested change
inputs.config-file == './config/examples/stm32u5-nonsecure-dualbank.config' ||
inputs.config-file == './config/examples/stm32n567.config'
inputs.config-file == './config/examples/stm32u5-nonsecure-dualbank.config'

Copilot uses AI. Check for mistakes.
run: |
make distclean
cp ${{inputs.config-file}} .config
make -C tools/keytools && make -C tools/bin-assemble
make USE_CLANG=1 USE_GCC=0 ${{inputs.make-args}}
5 changes: 5 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,10 @@ OBJS:= \
./src/libwolfboot.o \
./hal/hal.o

ifeq ($(USE_CLANG),1)
OBJS+=./src/clang_sections.o
endif

ifeq ($(WOLFCRYPT_TZ_PSA),1)
OBJS+=./src/dice/dice.o
endif
Expand Down Expand Up @@ -197,6 +201,7 @@ ifeq ($(USE_GCC_HEADLESS),1)
LSCRIPT_FLAGS+=-T $(LSCRIPT)
OBJCOPY_FLAGS+=--gap-fill $(FILL_BYTE)
endif

ifeq ($(TARGET),ti_hercules)
LSCRIPT_FLAGS+=--run_linker $(LSCRIPT)
endif
Expand Down
10 changes: 6 additions & 4 deletions arch.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1288,14 +1288,16 @@ ifeq ($(USE_CLANG),1)
CLANG_NEWLIB_INCLUDE?=$(abspath $(dir $(CLANG_LIBC_A))/../include)

CC=$(CLANG_DRIVER)
LD=$(CLANG_DRIVER)
LD=$(CLANG_DRIVER) -fuse-ld=lld
AS=$(CLANG_DRIVER)
AR=$(CROSS_COMPILE)ar
OBJCOPY?=$(CROSS_COMPILE)objcopy
SIZE=$(CROSS_COMPILE)size
AR=llvm-ar
OBJCOPY?=llvm-objcopy
SIZE=llvm-size

CFLAGS+=-isystem $(CLANG_NEWLIB_INCLUDE)
CFLAGS+=-DWOLFSSL_NO_ATOMIC -DWOLFSSL_NO_ATOMICS
CFLAGS+=-Wno-unknown-attributes -Wno-error=unknown-attributes
CFLAGS+=-fno-unwind-tables -fno-asynchronous-unwind-tables
LDFLAGS+=-nostdlib
endif

Expand Down
2 changes: 1 addition & 1 deletion hal/lpc55s69.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.gnu.sgstubs :
.gnu.sgstubs ORIGIN(FLASH_NSC) :
{
. += 0x400;
. = ALIGN(4);
Expand Down
2 changes: 1 addition & 1 deletion hal/mcxn.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.gnu.sgstubs :
.gnu.sgstubs ORIGIN(FLASH_NSC) :
{
. += 0x400;
. = ALIGN(4);
Expand Down
2 changes: 1 addition & 1 deletion hal/mcxw.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.gnu.sgstubs :
.gnu.sgstubs ORIGIN(FLASH_NSC) :
{
. += 0x400;
. = ALIGN(4);
Expand Down
6 changes: 6 additions & 0 deletions hal/nrf5340-ns.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,12 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.keystore :
{
. = ALIGN(4);
KEEP(*(.keystore*))
} > FLASH

_stored_data = .;

.data : AT (_stored_data)
Expand Down
2 changes: 1 addition & 1 deletion hal/nrf5340.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.gnu.sgstubs :
.gnu.sgstubs ORIGIN(FLASH_NSC) :
{
. += 0x400;
. = ALIGN(4);
Expand Down
6 changes: 6 additions & 0 deletions hal/nrf54l-ns.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,12 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.keystore :
{
. = ALIGN(4);
KEEP(*(.keystore*))
} > FLASH

_stored_data = .;

.data : AT (_stored_data)
Expand Down
2 changes: 1 addition & 1 deletion hal/nrf54l.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.gnu.sgstubs :
.gnu.sgstubs ORIGIN(FLASH_NSC) :
{
. += 0x400;
. = ALIGN(4);
Expand Down
2 changes: 1 addition & 1 deletion hal/rp2350.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ SECTIONS
. = ALIGN(4);
} > FLASH

.gnu.sgstubs :
.gnu.sgstubs ORIGIN(FLASH_NSC) :
{
*(.gnu.sgstubs*) /* Secure Gateway stubs */
. = ALIGN(4);
Expand Down
6 changes: 6 additions & 0 deletions hal/stm32h5-ns.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,12 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.keystore :
{
. = ALIGN(4);
KEEP(*(.keystore*))
} > FLASH

_stored_data = .;
.data : AT (_stored_data)
{
Expand Down
2 changes: 1 addition & 1 deletion hal/stm32h5.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.gnu.sgstubs :
.gnu.sgstubs ORIGIN(FLASH_NSC) :
{
. = ALIGN(32);
*(.gnu.sgstubs*) /* Secure Gateway stubs */
Expand Down
6 changes: 6 additions & 0 deletions hal/stm32h7.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,12 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.keystore :
{
. = ALIGN(4);
KEEP(*(.keystore*))
} > FLASH

_stored_data = .;
.data : AT (_stored_data)
{
Expand Down
1 change: 1 addition & 0 deletions hal/stm32l4.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ SECTIONS
. = ALIGN(4);
_end_text = .;
} > FLASH

.edidx :
{
. = ALIGN(4);
Expand Down
6 changes: 6 additions & 0 deletions hal/stm32l5-ns.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,12 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.keystore :
{
. = ALIGN(4);
KEEP(*(.keystore*))
} > FLASH

_stored_data = .;
.data : AT (_stored_data)
{
Expand Down
2 changes: 1 addition & 1 deletion hal/stm32l5.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.gnu.sgstubs :
.gnu.sgstubs ORIGIN(FLASH_NSC) :
{
. += 0x400;
. = ALIGN(4);
Expand Down
6 changes: 6 additions & 0 deletions hal/stm32u5-ns.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,12 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.keystore :
{
. = ALIGN(4);
KEEP(*(.keystore*))
} > FLASH

_stored_data = .;
.data : AT (_stored_data)
{
Expand Down
2 changes: 1 addition & 1 deletion hal/stm32u5.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ SECTIONS
*(.ARM.exidx*)
} > FLASH

.gnu.sgstubs :
.gnu.sgstubs ORIGIN(FLASH_NSC) :
{
. += 0x400;
. = ALIGN(4);
Expand Down
19 changes: 17 additions & 2 deletions options.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ ifeq ($(USE_CLANG),1)
ifeq ($(USE_GCC),1)
$(error USE_CLANG=1 is incompatible with USE_GCC=1; set USE_GCC=0)
endif
ifeq ($(ARMORED),1)
$(error USE_CLANG=1 requires ARMORED=0)
endif
endif

# Support for Built-in ROT into OTP flash memory
Expand Down Expand Up @@ -800,7 +803,13 @@ ifeq ($(WOLFCRYPT_TZ_PKCS11),1)
CFLAGS+=-DCK_CALLABLE="__attribute__((cmse_nonsecure_entry))"
CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPKCS11)
CFLAGS+=-DWP11_HASH_PIN_COST=3
LDFLAGS+=--specs=nano.specs
ifeq ($(USE_CLANG),1)
CLANG_MULTILIB_FLAGS:=$(filter -mthumb -mlittle-endian,$(LDFLAGS)) $(filter -mcpu=%,$(CFLAGS))
LIBS+=$(shell $(CLANG_GCC_NAME) $(CLANG_MULTILIB_FLAGS) -print-file-name=libc.a)
LIBS+=$(shell $(CLANG_GCC_NAME) $(CLANG_MULTILIB_FLAGS) -print-libgcc-file-name)
else
LDFLAGS+=--specs=nano.specs
endif
WOLFCRYPT_OBJS+=src/store_sbrk.o
WOLFCRYPT_OBJS+=src/pkcs11_store.o
WOLFCRYPT_OBJS+=src/pkcs11_callable.o
Expand Down Expand Up @@ -847,7 +856,13 @@ ifeq ($(WOLFCRYPT_TZ_PSA),1)
CFLAGS+=-DNO_DES3 -DNO_DES3_TLS_SUITES
WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)
WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)/wolfpsa
LDFLAGS+=--specs=nano.specs
ifeq ($(USE_CLANG),1)
CLANG_MULTILIB_FLAGS:=$(filter -mthumb -mlittle-endian,$(LDFLAGS)) $(filter -mcpu=%,$(CFLAGS))
LIBS+=$(shell $(CLANG_GCC_NAME) $(CLANG_MULTILIB_FLAGS) -print-file-name=libc.a)
LIBS+=$(shell $(CLANG_GCC_NAME) $(CLANG_MULTILIB_FLAGS) -print-libgcc-file-name)
else
LDFLAGS+=--specs=nano.specs
endif
WOLFCRYPT_OBJS+=src/store_sbrk.o
WOLFCRYPT_OBJS+=src/psa_store.o
WOLFCRYPT_OBJS+=src/arm_tee_psa_veneer.o
Expand Down
8 changes: 8 additions & 0 deletions src/clang_sections.S
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
/* Workaround for GNU ld mishandling AT() on output sections when no input
* object contributes a matching section. Clang does not emit empty .data/.bss
* sections in object files (GCC does), so GNU ld fails to assign the correct
* LMA for the .data output section, producing a huge sparse binary.
* Including this object ensures .data and .bss exist as inputs.
Comment on lines +1 to +5
Copy link

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The header comment attributes the sparse-binary issue to “GNU ld”, but Clang builds now force -fuse-ld=lld in arch.mk. If the real failure mode is tied to the linker being used with USE_CLANG=1, consider updating this comment to describe the problem more generally (or name the specific linker/toolchain combination that still needs the workaround) so future maintenance doesn’t incorrectly assume GNU ld is still involved.

Suggested change
/* Workaround for GNU ld mishandling AT() on output sections when no input
* object contributes a matching section. Clang does not emit empty .data/.bss
* sections in object files (GCC does), so GNU ld fails to assign the correct
* LMA for the .data output section, producing a huge sparse binary.
* Including this object ensures .data and .bss exist as inputs.
/* Workaround for the linker used with Clang builds mishandling AT() on
* output sections when no input object contributes a matching section.
* Clang does not emit empty .data/.bss sections in object files (GCC does),
* so the linker can assign the wrong LMA for the .data output section,
* producing a huge sparse binary. Including this object ensures .data and
* .bss exist as inputs.

Copilot uses AI. Check for mistakes.
*/
Comment on lines +1 to +6
Copy link

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This new assembly file is missing the project’s standard wolfBoot GPL license header comment that appears at the top of other assembly sources. Add the usual license boilerplate (and any required file-level copyright line) to keep licensing consistent across the codebase.

Copilot uses AI. Check for mistakes.
.section .data
.section .bss
6 changes: 6 additions & 0 deletions test-app/ARM-stm32h7.ld
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,12 @@ SECTIONS
_end_text = .;
} > FLASH

.edidx :
{
. = ALIGN(4);
*(.ARM.exidx*)
} > FLASH

_stored_data = .;

.data : AT (_stored_data)
Expand Down
18 changes: 15 additions & 3 deletions test-app/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ endif
include ../arch.mk

ifeq ($(USE_CLANG),1)
APP_OBJS+=../src/string.o
APP_NEEDS_STRING:=1
endif

# Optional alias for clearer TZ PSA selection in app builds.
Expand All @@ -103,8 +103,16 @@ LDFLAGS+=-T $(LSCRIPT) -Wl,-gc-sections -Wl,-Map=image.map -nostartfiles
# Setup default objcopy flags
OBJCOPY_FLAGS+=--gap-fill $(FILL_BYTE)

ifeq ($(USE_CLANG),1)
APP_OBJS+=../src/clang_sections.o
endif

ifeq ($(DEBUG_UART),1)
CFLAGS+=-DDEBUG_UART
APP_NEEDS_STRING:=1
endif

ifeq ($(APP_NEEDS_STRING),1)
APP_OBJS+=../src/string.o
endif

Expand Down Expand Up @@ -292,8 +300,12 @@ ifeq ($(TZEN),1)
WOLFCRYPT_APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/random.o
endif
endif
CFLAGS+=-DWOLFBOOT_SECURE_CALLS -Wstack-usage=19184
LDFLAGS+=--specs=nosys.specs -u _printf_float
CFLAGS+=-DWOLFBOOT_SECURE_CALLS
ifneq ($(USE_CLANG),1)
CFLAGS+=-Wstack-usage=19184
LDFLAGS+=--specs=nosys.specs
endif
LDFLAGS+=-u _printf_float
endif
ifeq ($(WOLFCRYPT_TZ_PSA),1)
CFLAGS+=-DWOLFCRYPT_TZ_PSA -DWOLFSSL_HAVE_PSA
Expand Down
Loading