PolarFire SoC QSPI support and ELF parser hardening

arch.mk

@@ -582,10 +582,19 @@ endif
 ifeq ($(ARCH),RISCV64)
   CROSS_COMPILE?=riscv64-unknown-elf-
   CFLAGS+=-DMMU -DWOLFBOOT_DUALBOOT
-  CFLAGS+=-DWOLFBOOT_UPDATE_DISK -DMAX_DISKS=1
-  UPDATE_OBJS:=src/update_disk.o
-  OBJS += src/gpt.o
-  OBJS += src/disk.o
+
+  # If SD card or eMMC is enabled use update_disk loader with GPT support
+  ifneq ($(filter 1,$(DISK_SDCARD) $(DISK_EMMC)),)
+    CFLAGS+=-DWOLFBOOT_UPDATE_DISK -DMAX_DISKS=1
+    UPDATE_OBJS:=src/update_disk.o
+    OBJS += src/gpt.o
+    OBJS += src/disk.o
+  else
+    # Use RAM-based update path for non-memory-mapped flash (SC SPI)
+    # Images are loaded into RAM before execution
+    UPDATE_OBJS?=src/update_ram.o
+  endif
+
   ARCH_FLAGS=-march=rv64imafd -mabi=lp64d -mcmodel=medany
   CFLAGS+=-fno-builtin-printf -DUSE_M_TIME -g -nostartfiles -DARCH_RISCV -DARCH_RISCV64
   CFLAGS+=$(ARCH_FLAGS)
@@ -1522,6 +1531,11 @@ endif
 CFLAGS+=-DARCH_FLASH_OFFSET=$(ARCH_FLASH_OFFSET)
 BOOT_IMG?=test-app/image.bin
 
+# When ELF loading is enabled, sign the ELF file (not the flat binary)
+ifeq ($(ELF),1)
+  BOOT_IMG=test-app/image.elf
+endif
+
 ## Update mechanism
 ifeq ($(ARCH),AARCH64)
   CFLAGS+=-DMMU -DWOLFBOOT_FDT -DWOLFBOOT_DUALBOOT

config/examples/polarfire_mpfs250.config

@@ -26,6 +26,10 @@ DEBUG?=0
 DEBUG_SYMBOLS?=1
 DEBUG_UART?=1
 VTOR?=1
+
+# Flash Configuration
+# EXT_FLASH=0: Use eMMC/SD card for firmware storage (default)
+# EXT_FLASH=1: Use QSPI flash (Micron MT25QL01G 128MB)
 EXT_FLASH?=0
 SPI_FLASH?=0
 NO_XIP?=1
@@ -44,8 +48,6 @@ ELF?=1
 
 # Use RISC-V assembly version of ECDSA and SHA
 NO_ASM?=0
-# Optional: Use smaller SHA512
-#CFLAGS_EXTRA+=-DUSE_SLOW_SHA512
 
 # SDCard or eMMC support via SDHCI driver
 DISK_SDCARD?=1

config/examples/polarfire_mpfs250_qspi.config

@@ -0,0 +1,103 @@
+ARCH?=RISCV64
+TARGET?=mpfs250
+
+# ECC P384 + SHA384
+SIGN?=ECC384
+HASH?=SHA384
+IMAGE_HEADER_SIZE=512
+
+# ML-DSA 87 + SHA256
+#SIGN=ML_DSA
+#HASH=SHA256
+#ML_DSA_LEVEL=5
+#IMAGE_SIGNATURE_SIZE=4627
+#IMAGE_HEADER_SIZE=12288
+
+WOLFBOOT_VERSION?=1
+ARMORED?=0
+DEBUG?=0
+DEBUG_SYMBOLS?=1
+DEBUG_UART?=1
+VTOR?=1
+
+NO_XIP?=1
+
+NVM_FLASH_WRITEONCE?=0
+UART_FLASH?=0
+V?=0
+NO_MPU?=1
+RAM_CODE?=0
+SPMATH?=1
+DUALBANK_SWAP?=0
+PKA?=0
+ENCRYPT=0
+WOLFTPM?=0
+ELF?=1
+#DEBUG_ELF?=1
+
+# Use RISC-V assembly version of ECDSA and SHA
+NO_ASM?=0
+
+# QSPI Flash Configuration
+# Using Micron MT25QL01GBBB (128MB, 64KB sectors)
+EXT_FLASH?=1
+SPI_FLASH?=0
+
+# SPI Flash Controller Selection:
+# MPFS_SC_SPI: Use SC QSPI Controller (0x37020100) for fabric-connected flash.
+#              Direct register access to System Controller's QSPI instance.
+# DEFAULT:     Use MSS QSPI Controller (0x21000000) for external flash
+#              on MSS QSPI pins.
+CFLAGS_EXTRA+=-DMPFS_SC_SPI
+
+
+# Enable SD card temporarily (wolfBoot still loads from SD, apps from QSPI)
+# For pure QSPI boot, HSS would need to load wolfBoot from QSPI
+DISK_SDCARD?=0
+DISK_EMMC?=0
+
+# DDR Address for wolfBoot to start from
+# Comes from hal/mpfs.yaml
+WOLFBOOT_ORIGIN?=0x80000000
+
+# DDR Address where application image will be loaded from flash
+# Used by update_ram.c for non-XIP boot
+# Must be well above wolfBoot's memory region
+WOLFBOOT_LOAD_ADDRESS?=0x8E000000
+
+# Flash geometry (64 KB sector)
+WOLFBOOT_SECTOR_SIZE?=0x10000
+
+# Partition layout for 128MB QSPI flash
+# HSS Boot Info:      0x00000000 - 0x00000400 (1KB)
+# wolfBoot partition: 0x00000400 - 0x0001FFFF (127KB)
+# Boot partition:     0x00020000 - 0x01FFFFFF (~32MB)
+# Update partition:   0x02000000 - 0x03FFFFFF (~32MB)
+# Swap partition:     0x04000000 - 0x0400FFFF (64KB)
+# Remaining:          0x04010000 - 0x07FFFFFF (~64MB available)
+WOLFBOOT_PARTITION_SIZE?=0x1FE0000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x20000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x2000000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x4000000
+
+# DTS (Device Tree)
+WOLFBOOT_LOAD_DTS_ADDRESS?=0x8A000000
+WOLFBOOT_DTS_BOOT_ADDRESS?=0x6000000      # DTS at 96MB (after swap)
+WOLFBOOT_DTS_UPDATE_ADDRESS?=0x6010000    # DTS update at 96MB + 64KB
+
+# Speed up reads from flash by using larger blocks
+CFLAGS_EXTRA+=-DWOLFBOOT_SHA_BLOCK_SIZE=4096
+
+# Optional Encryption
+#CUSTOM_ENCRYPT_KEY=1
+#ENCRYPT=1
+#ENCRYPT_WITH_AES256=1
+#OBJS_EXTRA=src/my_custom_encrypt_key.o
+
+# Optional QSPI debugging
+# Uncomment for verbose QSPI debug output
+#CFLAGS_EXTRA+=-DDEBUG_QSPI
+
+# Optional QSPI flash test (erase/write/read on update partition)
+# Uncomment to run test during hal_init()
+#CFLAGS_EXTRA+=-DTEST_EXT_FLASH

docs/Targets.md

@@ -857,7 +857,51 @@ The HSS tinyCLI supports the `USBDMSC` command to mount the eMMC or SD card as a
 sudo dd if=wolfboot.bin of=/dev/sdc1 bs=512 && sudo cmp wolfboot.bin /dev/sdc1
 ```
 
-Note:
+### PolarFire SoC QSPI
+
+PolarFire SoC has two CoreQSPI v2 controllers with identical register layouts. The selection
+is made at build time via `MPFS_SC_SPI` and affects which QSPI base address wolfBoot uses:
+
+```text
+            +-------------------+                         +----------------------+
+            |      U54 cores    |                         |      U54 cores       |
+            |      (wolfBoot)   |                         |      (wolfBoot)      |
+            +---------+---------+                         +----------+-----------+
+                      |                                              |
+                      | direct register access                       | direct register access
+                      | (MSS QSPI @ 0x2100_0000)                    | (SC QSPI @ 0x3702_0100)
+                      v                                              v
+            +-------------------+                         +----------------------+
+            |  MSS QSPI IP      |                         |  SC QSPI IP          |
+            |  (CoreQSPI v2)    |                         |  (CoreQSPI v2)       |
+            +---------+---------+                         +----------+-----------+
+                      |                                              |
+                      v                                              v
+              External QSPI flash                           Fabric-connected flash
+```
+
+Build options:
+
+- MSS QSPI controller (direct register access at 0x21000000, read/write/erase)
+  - `EXT_FLASH=1`
+  - Do not set `MPFS_SC_SPI`
+  - Example config: `config/examples/polarfire_mpfs250_qspi.config` with `CFLAGS_EXTRA` line removed.
+
+- SC QSPI controller (direct register access at 0x37020100, read/write/erase)
+  - `EXT_FLASH=1`
+  - `CFLAGS_EXTRA+=-DMPFS_SC_SPI`
+  - Example config: `config/examples/polarfire_mpfs250_qspi.config` as-is.
+  - Both controllers share the same CoreQSPI v2 register interface.
+    The only difference is that SC QSPI does not need MSS clock/reset setup.
+
+Example single-shot build: `cp config/examples/polarfire_mpfs250_qspi.config .config && make clean && make wolfboot.bin && hss-payload-generator -vvv -c ./hal/mpfs.yaml wolfboot.bin && make test-app/image.elf && ./tools/keytools/sign --ecc384 --sha384 test-app/image.elf wolfboot_signing_private_key.der 1`
+
+Notes:
+- Both modes support full read, write, and erase operations.
+- For QSPI-based boot flows, disable SD/eMMC in the config (`DISK_SDCARD=0`, `DISK_EMMC=0`) unless you
+  explicitly want wolfBoot to load from disk and the application from QSPI.
+- The MSS QSPI path expects external flash on the MSS QSPI pins; the SC QSPI path is for
+  fabric-connected flash (design flash) accessed via the System Controller's QSPI instance.
 
 ### PolarFire testing
 
@@ -1321,7 +1365,6 @@ Benchmark complete
 
 ### PolarFire TODO
 
-* Add support for QSPI NOR flash
 * Add support for full HSS replacement using wolfboot
   - Machine level assembly startup
   - DDR driver