Add NXP i.MX95 post-quantum demo for the A55 cluster and Cortex-M7

[dgarske]

A demo running entirely on a Toradex SMARC iMX95: wolfBoot verifies and boots Linux on the Cortex-A55 cluster with ML-DSA-87, a second wolfBoot verifies and boots Zephyr on the Cortex-M7 with the same algorithm, and both cores then run wolfCrypt ML-KEM and ML-DSA benchmarks. Output is a single stream on the board's serial console, tagged by core.

Depends on wolfBoot wolfSSL/wolfBoot#888 for the imx95_a55 target, including the stage 1 that replaces U-Boot SPL. The imx95_m7 target it also uses is already merged.

What it adds

• demo/ - board-side orchestration, the console stream, and its systemd units
• m7/ - the Zephyr payload wolfBoot verifies, and its overlay
• container/ - the wolfCrypt benchmark container for the A55 cluster
• tools/ - AHAB container packaging, eMMC boot-partition write and select, and memtool for reading the two cores' consoles
• docs/BUILD.md - building the whole demo from a stock module
• docs/BOOT-WALKTHROUGH.md - the boot explained stage by stage, and how to switch between the stock and wolfBoot chains

Notes

• The Zephyr payload deliberately does not use samples/subsys/ipc/openamp_rsc_table. That sample assumes Linux loaded its ELF and resolved its vring addresses, but here Linux loads wolfBoot, so the sample would wait forever for a resource table that is not the one being polled. This payload uses fixed vring addresses matching wolfBoot's table.
• The Cortex-M7 starts once per Linux boot: echo stop > .../state fails on this BSP while the core is running, so replaying the boot means a power cycle.

Hardware / test status

Validated on a Toradex SMARC iMX95 (LPUART1, 115200 8N1): cold boot to Torizon userspace with both cores verified, over repeated power cycles. The build path in docs/BUILD.md was reproduced end to end from a stock module - both AHAB containers and the kernel FIT it produces come out byte-identical to the ones running on the board.

Scope

The A55 benchmark runs in a container; a native build is not provided. The serial console is the demo; the DisplayPort two-pane renderer is still in demo/ and is opt-in via install-autostart.sh --display.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds an i.MX95 “post-quantum on both clusters” demo that pairs Linux-side wolfCrypt PQC benchmarks (A55) with wolfBoot ML-DSA-87 verified boot and console relay from the Cortex-M7.

Changes:

• Add a /dev/mem mmap-based memtool utility for staging payloads and dumping the M7 shared-memory console.
• Add a Zephyr OpenAMP/RPMsg payload for M7 that relays wolfBoot’s shared-memory console to Linux as an RPMsg TTY.
• Add board orchestration scripts, a two-pane console renderer, and a benchmark container build/runtime setup.

Reviewed changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
imx95-pqc-demo/tools/memtool.c	Adds /dev/mem mmap read/write/load/fill and M7 console ring dump tooling.
imx95-pqc-demo/m7/zephyr-app/src/main.c	Implements the M7-side OpenAMP/RPMsg endpoint and wolfBoot console relay logic.
imx95-pqc-demo/m7/zephyr-app/prj.conf	Configures Zephyr for OpenAMP + minimal logging and documents MPU constraints.
imx95-pqc-demo/m7/zephyr-app/CMakeLists.txt	Defines the Zephyr application build.
imx95-pqc-demo/m7/imx95_wolfboot.overlay	Relocates the Zephyr image, enables MU, and declares MPU-accessible console/status region.
imx95-pqc-demo/m7/build.sh	Provides a reproducible Zephyr build producing a raw binary payload.
imx95-pqc-demo/demo/twopane.py	Renders the two-pane demo view on a console without tmux/screen dependencies.
imx95-pqc-demo/demo/stage.sh	Stages demo artifacts to the board and builds/stages memtool.
imx95-pqc-demo/demo/m7-start.sh	Starts remoteproc and stages the signed payload into the M7 boot partition region.
imx95-pqc-demo/demo/m7-console-tail.sh	Provides a console-ring tailer for the M7 pane (alternative to RPMsg TTY).
imx95-pqc-demo/demo/demo-run.sh	Orchestrates container start, M7 start, and launches the renderer to a target TTY.
imx95-pqc-demo/container/entrypoint.sh	Runs benchmark cycles and selects baseline vs sha3-crypto build at runtime.
imx95-pqc-demo/container/docker-compose.yml	Defines the benchmark container service for on-board execution/logging.
imx95-pqc-demo/container/build-image.sh	Builds (and optionally pushes) the arm64 demo container image.
imx95-pqc-demo/container/build-aarch64.sh	Cross-builds wolfSSL for aarch64 in baseline and sha3-crypto configs.
imx95-pqc-demo/container/Dockerfile	Multi-stage image build that cross-compiles wolfSSL and ships benchmarks.
imx95-pqc-demo/README.md	Documents the demo purpose, measurements, build steps, and key gotchas.
README.md	Adds the new i.MX95 PQC demo to the repository’s example list.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.