PolarFire SoC QSPI support and ELF parser hardening

[dgarske]

QSPI Flash Support

Add full QSPI flash support for PolarFire SoC (MPFS250T), including read, write, and erase
operations for both QSPI controllers:

• MSS QSPI (0x21000000) — for external flash on MSS QSPI pins
• SC QSPI (0x37020100) — for fabric-connected flash via the System Controller

Both controllers share the CoreQSPI v2 register interface. Build-time selection via
MPFS_SC_SPI define. Includes example config config/examples/polarfire_mpfs250_qspi.config.

HAL changes (hal/mpfs250.c, hal/mpfs250.h):

• CoreQSPI v2 register definitions and driver (init, read, write, erase)
• QSPI transfer function with TX/RX FIFO management and timeout protection
• JEDEC ID read and flash status polling
• System Controller mailbox API for device serial number readout
• QSPI_IO_FENCE() macro for RISC-V RVWMO memory ordering on MMIO writes
• Optional TEST_EXT_FLASH and DEBUG_QSPI build flags
• ext_flash_read return value checked consistently during erase verify

RISC-V improvements:

• 32-bit trap_exit macro now uses sret/mret conditional on WOLFBOOT_RISCV_MMODE,
  matching the existing 64-bit behavior (test-app/vector_riscv.S, src/vector_riscv.S)
• PLIC register access helpers added to hal/riscv.h
• Test app vector table and linker script updates for MPFS250

Documentation:

• New "PolarFire SoC QSPI" section in docs/Targets.md with architecture diagram and
  build instructions for both MSS and SC QSPI modes

ELF parser bounds checking

Add image_sz parameter to elf_load_image_mmu() to validate that all offsets and sizes
read from ELF headers stay within the image buffer. Applies to both ELF32 and ELF64 code paths.

Checks added:

• Verify image is large enough for the ELF header (elf32 or elf64)
• Validate program header table offset and size fit within image bounds
• Validate each segment's file offset and size before copying

Example output

wolfBoot Version: 2.7.0 (Feb  3 2026 15:23:58)
QSPI: Using SC QSPI Controller (0x37020100)
QSPI: Flash ID = 0x20 0xBA 0x21
Versions: Boot 1, Update 0
Trying Boot partition at 0x20000
Loading header 512 bytes from 0x20000 to 0x8DFFFE00
Loading image 147568 bytes from 0x20200 to 0x8E000000...done
Boot partition: 0x8DFFFE00 (sz 147568, ver 0x1, type 0x601)
Checking integrity...done
Verifying signature...done
Successfully selected image in part: 0
Firmware Valid
Booting at 0x8E000B00
FDT: Invalid header! -1
QSPI: Using SC QSPI Controller (0x37020100)
QSPI: Flash ID = 0x20 0xBA 0x21
========================
PolarFire SoC MPFS250 wolfBoot demo Application
Copyright 2025 wolfSSL Inc
GPL v3
========================

[danielinux]

Looks good, some minor visibility issues

[Copilot]

Pull request overview

Adds QSPI NOR flash support for PolarFire SoC MPFS250 and updates the RISC-V/PolarFire boot flow to better support RAM-loaded (NO_XIP) and ELF-based images.

Changes:

• Introduces MPFS250 QSPI NOR driver + EXT_FLASH integration (including SC QSPI vs MSS QSPI selection).
• Updates RISC-V trap/vector handling to switch between S-mode and M-mode via WOLFBOOT_RISCV_MMODE.
• Adjusts build/link flow for RISC-V (update loader selection based on disk config; sign ELF when ELF=1) and documents PolarFire QSPI usage.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
hal/mpfs250.c	Implements QSPI init + transfer/read/write/erase and hooks it into hal_init() when EXT_FLASH is enabled.
hal/mpfs250.h	Adds SCB mailbox helpers/constants and CoreQSPI v2 register/flash command definitions under EXT_FLASH.
hal/riscv.h	Centralizes privilege-mode selection helpers and adds an I-cache sync helper for RISC-V.
src/elf.c	Uses memmove() for safer in-place ELF segment loading and syncs I-cache on RISC-V.
src/vector_riscv.S	Switches S-mode/M-mode selection logic to WOLFBOOT_RISCV_MMODE.
src/boot_riscv_start.S	Uses MODE_PREFIX from hal/riscv.h and updates mode checks to WOLFBOOT_RISCV_MMODE.
src/boot_riscv.c	Updates satp/MMU teardown conditional for S-mode vs M-mode.
test-app/vector_riscv.S	Adds RV64 trap entry/exit macros and uses sret vs mret based on WOLFBOOT_RISCV_MMODE.
test-app/startup_riscv.c	Sets stvec vs mtvec and reads scause vs mcause based on privilege mode.
test-app/RISCV64-mpfs250.ld	Adjusts placement for RAM boot / NO_XIP style execution and changes where .data/.bss live.
arch.mk	Chooses update loader based on disk enablement and switches signing target to .elf when ELF=1.
docs/Targets.md	Documents PolarFire QSPI usage and build-time selection between MSS QSPI and SC QSPI.
config/examples/polarfire_mpfs250_qspi.config	New example configuration for MPFS250 QSPI + NO_XIP + ELF flows.
config/examples/polarfire_mpfs250.config	Clarifies EXT_FLASH meaning for PolarFire MPFS250.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 8 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.