Add flashing tool support (enabled with UART_QSPI_PROGRAM=1)

Author: dgarske

.gdbinit

@@ -1,7 +1,9 @@
 file wolfboot.elf
 tar rem:3333
-add-symbol-file test-app/image.elf
+add-symbol-file ../hart-software-services/build/hss-l2scratch.elf
 set pagination off
 foc c
 
-
+set $target_riscv=1
+set mem inaccessible-by-default off
+set architecture riscv:rv64

arch.mk

@@ -1637,6 +1637,13 @@ ifeq ($(DEBUG_UART),1)
   endif
 endif
 
+# UART QSPI programmer (PolarFire SoC MPFS): receive binary over UART and
+# write it directly to QSPI flash. Requires EXT_FLASH=1 and DEBUG_UART=1.
+# Use tools/scripts/mpfs_qspi_prog.py on the host side.
+ifeq ($(UART_QSPI_PROGRAM),1)
+  CFLAGS+=-DUART_QSPI_PROGRAM
+endif
+
 ifeq ($(NXP_CUSTOM_DCD),1)
   CFLAGS+=-DNXP_CUSTOM_DCD
   OBJS+=$(NXP_CUSTOM_DCD_OBJS)

config/examples/polarfire_mpfs250_m_qspi.config

@@ -100,3 +100,10 @@ CFLAGS_EXTRA+=-DWOLFBOOT_SHA_BLOCK_SIZE=4096
 # Optional QSPI flash test (erase/write/read on update partition)
 # Uncomment to run test during hal_init()
 #CFLAGS_EXTRA+=-DTEST_EXT_FLASH
+
+# UART QSPI programmer (disabled by default)
+# When enabled, wolfBoot prompts on UART at startup to receive a signed firmware
+# image and write it to QSPI flash -- no Libero/JTAG tool required for updates.
+# Use: python3 tools/scripts/mpfs_qspi_prog.py <port> <image.bin> [qspi_offset]
+# Requires EXT_FLASH=1 (already set) and DEBUG_UART=1.
+UART_QSPI_PROGRAM?=0

docs/Targets.md

@@ -904,6 +904,70 @@ Notes:
 - The MSS QSPI path expects external flash on the MSS QSPI pins; the SC QSPI path is for
   fabric-connected flash (design flash) accessed via the System Controller's QSPI instance.
 
+### PolarFire SoC M-Mode (bare-metal eNVM boot)
+
+In M-Mode wolfBoot runs directly on the E51 monitor core from eNVM — no HSS required. The signed
+application is loaded from SC QSPI flash into LIM (on-chip RAM). This is the simplest bring-up path.
+
+**Boot flow:**
+1. CPU starts at eNVM reset vector (`0x20220100`)
+2. Startup code copies wolfBoot to L2 Scratchpad (`0x0A000000`) and jumps there
+3. wolfBoot reads the signed image from QSPI flash into LIM (`0x08000000`)
+4. Signature is verified, then execution jumps to the application
+
+**Build:**
+```sh
+cp config/examples/polarfire_mpfs250_m_qspi.config .config
+make clean && make wolfboot.elf
+```
+
+**Flash wolfBoot to eNVM** (requires SmartDesign / SmartFusion2 Libero SoC install):
+```sh
+java -jar $SC_INSTALL_DIR/extras/mpfs/mpfsBootmodeProgrammer.jar \
+    --bootmode 1 --die MPFS250T --package FCG1152 --workdir $PWD wolfboot.elf
+```
+
+**Build and sign the test application:**
+```sh
+make test-app/image_v1_signed.bin
+```
+
+**Flash the signed application to QSPI** using the UART programmer (requires `EXT_FLASH=1` and
+`UART_QSPI_PROGRAM=1` in `.config`, and `pyserial` installed):
+```sh
+python3 tools/scripts/mpfs_qspi_prog.py /dev/ttyUSB1 \
+    test-app/image_v1_signed.bin 0x20000
+```
+
+The script:
+1. Waits for wolfBoot to print the `QSPI-PROG: Press 'P'` prompt (power-cycle the board)
+2. Sends `P` to enter programming mode
+3. Transfers the binary in 256-byte ACK-driven chunks
+4. wolfBoot erases, writes, and then continues booting the new image
+
+Use `0x20000` for the boot partition and `0x2000000` for the update partition.
+
+**Expected serial output on successful boot:**
+```
+wolfBoot Version: 2.7.0 (...)
+Running on E51 (hart 0) in M-mode
+QSPI: Using SC QSPI Controller (0x37020100)
+QSPI: Flash ID = 0x20 0xBA 0x21
+QSPI-PROG: Press 'P' within 3s to program flash
+QSPI-PROG: No trigger (got 0x00 ...), booting
+Versions: Boot 1, Update 0
+...
+Firmware Valid
+Booting at 0x...
+```
+
+**Notes:**
+- The E51 is `rv64imac`; the `rdtime` CSR instruction is not available in bare-metal M-mode.
+  wolfBoot uses a calibrated busy-loop for all delays (`udelay()` in `hal/mpfs250.c`).
+- `UART_QSPI_PROGRAM=1` adds a 3-second boot pause every time. Set to `0` once the flash
+  contents are stable.
+- The config uses `WOLFBOOT_LOAD_ADDRESS=0x08000200` to keep the image header within LIM.
+
 ### PolarFire testing
 
 This section describes how to build the test-application, create a custom uSD with required partitions and copying signed test-application to uSD partitions.

hal/mpfs250.c

@@ -246,6 +246,9 @@ void secondary_hart_entry(unsigned long hartid, HLS_DATA* hls)
 #if defined(EXT_FLASH) && defined(TEST_EXT_FLASH) && defined(__WOLFBOOT)
 static int test_ext_flash(void);
 #endif
+#if defined(EXT_FLASH) && defined(UART_QSPI_PROGRAM) && defined(__WOLFBOOT)
+static void qspi_uart_program(void);
+#endif
 
 void hal_init(void)
 {
@@ -279,12 +282,14 @@ void hal_init(void)
 #ifdef EXT_FLASH
     if (qspi_init() != 0) {
         wolfBoot_printf("QSPI: Init failed\n");
-    }
+    } else {
 #if defined(TEST_EXT_FLASH) && defined(__WOLFBOOT)
-    else {
         test_ext_flash();
-    }
 #endif
+#if defined(UART_QSPI_PROGRAM) && defined(__WOLFBOOT)
+        qspi_uart_program();
+#endif
+    }
 #endif /* EXT_FLASH */
 }
 
@@ -998,6 +1003,130 @@ int ext_flash_erase(uintptr_t address, int len)
     return total;
 }
 
+/* ============================================================================
+ * UART QSPI Programmer
+ *
+ * Allows programming the QSPI flash over the debug UART without a JTAG/Libero
+ * tool. Enabled at build time with UART_QSPI_PROGRAM=1 in the .config.
+ *
+ * Protocol (after wolfBoot prints the "QSPI-PROG" prompt):
+ *   1. Host sends 'P' within the timeout window to enter programming mode
+ *   2. wolfBoot sends "READY\r\n"
+ *   3. Host sends [4-byte LE QSPI address][4-byte LE data length]
+ *   4. wolfBoot erases required sectors, sends "ERASED\r\n"
+ *   5. For each 256-byte chunk:
+ *        wolfBoot sends ACK byte (0x06) -> host sends chunk -> wolfBoot writes
+ *   6. wolfBoot sends "DONE\r\n" and continues normal boot
+ *
+ * Host side: tools/scripts/mpfs_qspi_prog.py
+ * ============================================================================ */
+#if defined(UART_QSPI_PROGRAM) && defined(__WOLFBOOT)
+
+#define QSPI_PROG_CHUNK     256
+#define QSPI_PROG_ACK       0x06
+
+static uint8_t uart_qspi_rx(void)
+{
+    while (!(MMUART_LSR(DEBUG_UART_BASE) & MSS_UART_DR))
+        ;
+    return MMUART_RBR(DEBUG_UART_BASE);
+}
+
+static void uart_qspi_tx(uint8_t c)
+{
+    while (!(MMUART_LSR(DEBUG_UART_BASE) & MSS_UART_THRE))
+        ;
+    MMUART_THR(DEBUG_UART_BASE) = c;
+}
+
+static void uart_qspi_puts(const char *s)
+{
+    while (*s)
+        uart_qspi_tx((uint8_t)*s++);
+}
+
+static void qspi_uart_program(void)
+{
+    uint8_t ch = 0;
+    uint32_t addr, size, n_sectors, written, t;
+    uint8_t chunk[QSPI_PROG_CHUNK];
+
+    wolfBoot_printf("QSPI-PROG: Press 'P' within 3s to program flash\r\n");
+
+    /* Drain any stale RX bytes before opening the window */
+    while (MMUART_LSR(DEBUG_UART_BASE) & MSS_UART_DR)
+        (void)MMUART_RBR(DEBUG_UART_BASE);
+
+    /* Wait up to 3s: 3000 iterations of 1ms each */
+    for (t = 0; t < 3000U; t++) {
+        udelay(1000);
+        if (MMUART_LSR(DEBUG_UART_BASE) & MSS_UART_DR) {
+            ch = MMUART_RBR(DEBUG_UART_BASE);
+            break;
+        }
+    }
+
+    if (ch != 'P' && ch != 'p') {
+        wolfBoot_printf("QSPI-PROG: No trigger (got 0x%02x LSR=0x%02x), booting\r\n",
+                        (unsigned)ch,
+                        (unsigned)MMUART_LSR(DEBUG_UART_BASE));
+        return;
+    }
+
+    wolfBoot_printf("QSPI-PROG: Entering programmer mode\r\n");
+    uart_qspi_puts("READY\r\n");
+
+    /* Receive destination address then data length (4 bytes LE each) */
+    addr = 0;
+    for (int i = 0; i < 4; i++)
+        addr |= ((uint32_t)uart_qspi_rx() << (i * 8));
+    size = 0;
+    for (int i = 0; i < 4; i++)
+        size |= ((uint32_t)uart_qspi_rx() << (i * 8));
+
+    wolfBoot_printf("QSPI-PROG: addr=0x%x size=%u bytes\r\n", addr, size);
+
+    if (size == 0 || size > 0x200000U) {
+        wolfBoot_printf("QSPI-PROG: Invalid size, aborting\r\n");
+        return;
+    }
+
+    /* Erase all required sectors (FLASH_SECTOR_SIZE = 64 KB) */
+    n_sectors = (size + FLASH_SECTOR_SIZE - 1) / FLASH_SECTOR_SIZE;
+    wolfBoot_printf("QSPI-PROG: Erasing %u sector(s) at 0x%x...\r\n",
+                    n_sectors, addr);
+    ext_flash_unlock();
+    for (uint32_t s = 0; s < n_sectors; s++)
+        ext_flash_erase(addr + s * FLASH_SECTOR_SIZE, FLASH_SECTOR_SIZE);
+
+    /* "ERASED\r\n" must be the last bytes before the first ACK (0x06).
+     * Do not insert any wolfBoot_printf between here and the transfer loop. */
+    uart_qspi_puts("ERASED\r\n");
+
+    /* Chunk transfer: wolfBoot requests each 256-byte block with ACK 0x06 */
+    written = 0;
+    while (written < size) {
+        uint32_t chunk_len = size - written;
+        if (chunk_len > QSPI_PROG_CHUNK)
+            chunk_len = QSPI_PROG_CHUNK;
+
+        uart_qspi_tx(QSPI_PROG_ACK);          /* request next chunk */
+
+        for (uint32_t i = 0; i < chunk_len; i++)
+            chunk[i] = uart_qspi_rx();
+
+        ext_flash_write(addr + written, chunk, (int)chunk_len);
+        written += chunk_len;
+    }
+    ext_flash_lock();
+
+    wolfBoot_printf("QSPI-PROG: Wrote %u bytes to 0x%x\r\n", written, addr);
+    uart_qspi_puts("DONE\r\n");
+    wolfBoot_printf("QSPI-PROG: Done, continuing boot\r\n");
+}
+
+#endif /* UART_QSPI_PROGRAM */
+
 /* Test for external QSPI flash erase/write/read */
 #ifdef TEST_EXT_FLASH
 

hal/mpfs250.h

@@ -151,6 +151,7 @@ static const unsigned long MSS_UART_BASE_ADDR[] = {
 #define MSS_UART_ONE_STOP_BIT       ((uint8_t)0x00)
 
 /* LSR (Line Status Register) */
+#define MSS_UART_DR                 ((uint8_t)0x01)    /* Data ready (receive buffer full) */
 #define MSS_UART_THRE               ((uint8_t)0x20)    /* Transmitter holding register empty */
 #define MSS_UART_TEMT               ((uint8_t)0x40)    /* Transmit empty */
 

src/boot_riscv.c

@@ -463,10 +463,19 @@ void do_boot(const uint32_t *app_offset)
      * Use this for test-apps; define WOLFBOOT_MMODE_SMODE_BOOT for Linux.
      */
     wolfBoot_printf("M-mode direct jump to 0x%lx\n", (unsigned long)app_offset);
-    /* Drain UART before jumping */
+    /* Diagnostics before jump */
+    {
+        volatile uint8_t lsr = MMUART_LSR(DEBUG_UART_BASE);
+        uint32_t *p = (uint32_t*)app_offset;
+        wolfBoot_printf("Pre-jump: LSR=0x%x THRE=%d\n",
+                        (unsigned)lsr, (lsr & MSS_UART_THRE) ? 1 : 0);
+        wolfBoot_printf("App[0]=0x%lx [1]=0x%lx\n",
+                        (unsigned long)p[0], (unsigned long)p[1]);
+    }
+    /* Extended drain: allow all diagnostic output to finish (~10ms at 40MHz) */
     {
         volatile int i;
-        for (i = 0; i < 100000; i++) {}
+        for (i = 0; i < 400000; i++) {}
     }
     (void)hartid;
     (void)dts_addr;

test-app/app_mpfs250.c

@@ -36,10 +36,11 @@
 
 void main(void)
 {
-    /* wolfBoot already initialized L2 cache, UART clocks, and QSPI.
-     * Just re-init UART registers (clocks already on). Do NOT call
-     * hal_init() - it would try to write to _main_hart_hls=0 (NULL). */
-    uart_init();
+    /* wolfBoot fully configured UART0 before jumping here.
+     * Calling uart_init() again clears the TX FIFO (FCR write) while wolfBoot's
+     * last output may still be draining, which can leave THRE stuck at 0.
+     * Calling hal_init() writes to _main_hart_hls=0 (NULL ptr crash).
+     * So use wolfBoot_printf directly — UART0 is already ready. */
 
     wolfBoot_printf("========================\r\n");
     wolfBoot_printf("PolarFire SoC MPFS250 wolfBoot demo Application\r\n");

test-app/startup_riscv.c

@@ -42,10 +42,10 @@ void __attribute__((naked,section(".init"))) _reset(void) {
     asm volatile("la gp, _global_pointer");
     asm volatile("la sp, _end_stack");
 
-    /* Set up vectored interrupt, with IV starting at offset 0x100.
-     * Always use stvec: wolfBoot M-mode uses enter_smode() to transition
-     * the payload to S-mode, so stvec is correct in all cases. */
-    asm volatile("csrw stvec, %0":: "r"((uint8_t *)(&_start_vector) + 1));
+    /* Set up M-mode vectored interrupt table.
+     * wolfBoot M-mode does a direct jr (no enter_smode), so payload runs in M-mode.
+     * Use mtvec. The +1 sets MODE=1 (vectored). */
+    asm volatile("csrw mtvec, %0":: "r"((uint8_t *)(&_start_vector) + 1));
 
     src = (uint32_t *) &_stored_data;
     dst = (uint32_t *) &_start_data;
@@ -77,8 +77,8 @@ void do_boot(const uint32_t *app_offset)
 static uint32_t synctrap_cause = 0;
 void __attribute__((naked)) isr_synctrap(void)
 {
-    /* Always use scause: payload always runs in S-mode under wolfBoot */
-    asm volatile("csrr %0, scause" : "=r"(synctrap_cause));
+    /* Use mcause: payload runs in M-mode (wolfBoot does M-mode direct jump) */
+    asm volatile("csrr %0, mcause" : "=r"(synctrap_cause));
 }
 
 void isr_empty(void)

test-app/vector_riscv.S

@@ -62,8 +62,8 @@
     ld x30, 112(sp)
     ld x31, 120(sp)
     addi sp, sp, 128
-    /* Always sret: payload always runs in S-mode under wolfBoot */
-    sret
+    /* mret: payload runs in M-mode (wolfBoot does M-mode direct jump) */
+    mret
 .endm
 
 #else /* __riscv_xlen == 32 */
@@ -107,8 +107,8 @@
   lw x30, 56(sp)
   lw x31, 60(sp)
   addi sp, sp, 64
-  /* Always sret: payload always runs in S-mode under wolfBoot */
-  sret
+  /* mret: payload runs in M-mode (wolfBoot does M-mode direct jump) */
+  mret
 .endm
 
 #endif /* __riscv_xlen */