PolarFire SoC M-Mode LPDDR4 + minimal SBI runtime

[dgarske]

Summary

wolfBoot runs standalone in M-mode on the E51 monitor core, replacing both HSS and OpenSBI: it brings up LPDDR4 in software, secure-boots a signed Yocto FIT from SD, and stays resident as a minimal SBI runtime so the U54 cores boot Linux. Result: secure-boot 4-CPU SMP Yocto Linux to a login prompt in ~40 s from power-on, with no Microchip firmware in the boot chain.

Commits

1. PolarFire SoC: LPDDR4 DDR init for MPFS250T Video Kit (M-Mode) - software LPDDR4 init/training (all-4-lane WRCALIB gate + retry), SD secure boot of a signed Yocto FIT (SDHCI PIO + PDMA-to-DDR staging with read-back verify), SHA384 + ECC384 verification, FIT parse, L2 dtb fixups, and S-mode hand-off. The licensed Cadence DDR controller logic (controller CSR programming, Memory Test Controller, LPDDR4 mode-register protocol) is a target-independent driver in src/ddr_cadence.c + include/ddr_cadence.h; the Microchip PHY/PLL/clock/training and the board LIBERO_SETTING_* values stay in hal/mpfs250_ddr.c.
2. RISC-V: minimal SBI runtime; PolarFire SoC boots 4-CPU SMP Yocto Linux - a minimal M-mode SBI runtime (src/riscv_sbi.c): BASE/TIME/IPI/RFENCE/HSM/DBCN plus the legacy calls, with per-hart M-mode trap stacks, rdtime and misaligned load/store emulation, atomic cross-hart IPI ops with self-directed SSIP delivery, and the trap-entry / M->S hand-off wiring. PolarFire SoC bring-up adds CLINT MTIME enable, per-hart HSM hart_start mailboxes, the watchdog policy, and the dtb fixups that bring up 4-CPU SMP Linux.

Key design points

• Generic Cadence driver: the controller half is reusable across Cadence-DDR SoCs (controller base overridable via DDR_CADENCE_CTRL_BASE); the SoC-specific PHY/PLL/training is behind the platform HAL. Both compile only when MPFS_DDR_INIT is set.
• Cross-hart state in DTIM, not L2-scratch: cacheable stores to the L2 scratchpad can be lost on dirty-line eviction, so the SBI shared state, HSM mailboxes and the secondary-hart release gate live in the E51 DTIM; the M-mode trap stacks live in reserved DDR.
• No timer/rdtime CSR on these harts: CLINT MTIME is enabled from SYSREG and rdtime is emulated in M-mode for S and U mode.
• Watchdog policy: the MSS watchdogs always count and reset the chip and cannot be disabled, so the parked E51 monitor refreshes all five and the OS watchdog nodes are disabled in the dtb.
• DDR data path: direct CPU writes to DDR do not land on this board, so the kernel/dtb copies and the SD load go through the PDMA master with a non-cached read-back verify.

Validation (MPFS250T Video Kit, power-controlled cold boots)

• 5/5 and repeated 3/3 clean cold boots to the systemd login prompt; smp: Brought up 1 node, 4 CPUs with zero "failed to come online"; login at ~40 s.
• 12-minute idle soaks with no watchdog reset.
• All five PolarFire template configs build (M-mode SD, M-mode QSPI, S-mode SDCard, S-mode QSPI, S-mode L2-LIM); the M-mode QSPI build links no ddr_cadence.o (driver correctly gated). versal_vmk180_sdcard, zynqmp_sdcard, zynq7000_sdcard also build (shared sdhci/boot files).
• The S-mode SDCard, S-mode QSPI, S-mode L2-LIM and M-mode QSPI configs were each booted on hardware via HSS to confirm no regression.

Notes for reviewers

• src/vector_riscv.S trap-macro changes are WOLFBOOT_RISCV_MMODE-gated; S-mode builds keep the original frame behavior.
• src/sdhci.c keeps the cross-platform driver clean: the MPFS PDMA/watchdog specifics are behind weak sdhci_platform_block_copy() / sdhci_platform_wdt_pet() hooks.
• src/fdt.c gains a weak wolfBoot_fit_memcpy hook so the platform can route FIT subimage copies through PDMA.
• CI: tools/ci/mpfs_libero_stub/fpga_design_config.h lets the M-mode + DDR path compile in GitHub Actions (compile-only; not runnable).
• lib/wolfssl submodule pointer is bumped (came in with the DDR work); drop it if the project prefers to bump separately.
• docs/Targets.md documents the M-mode + DDR Linux boot flow, the wolfSBI runtime, the watchdog policy, and the generic Cadence driver split.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds standalone wolfBoot M-mode support for the PolarFire SoC MPFS250T Video Kit, including LPDDR4 bring-up (replacing HSS in the early boot path) and Linux S-mode handoff plumbing.

Changes:

• Enhance SDHCI diagnostics and reliability workarounds (CMD0→CMD8 delay, single-block read option, capability logging).
• Extend RISC-V M-mode boot flow with a reusable M→S handoff API and MPFS-specific “release U54 hart” implementation.
• Introduce MPFS250 DDR/PHY init infrastructure, build-time enablement via LIBERO_FPGA_CONFIG_DIR, new config template, and CI build job.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/sdhci.c	Adds richer error logging, controller register dump, and reliability workarounds for Cadence SD4HC.
src/boot_riscv.c	Adds trap register dump support (regs frame) and factors M→S handoff into overridable helpers.
hal/mpfs250.h	Adds MPFS250 peripheral bits and extensive DDRC/PHY register definitions + DDR init declarations.
hal/mpfs250.c	Implements MPFS250 DDR/PLL/PHY init, M→S boot on a U54 via IPI handoff, and UART reinit after PLL.
docs/Targets.md	Documents new “M-Mode + DDR” configuration and build-time Libero config integration.
config/examples/polarfire_mpfs250_m.config	Adds new example config for M-mode + LPDDR4 + SD + S-mode Linux boot.
arch.mk	Enables MPFS DDR init when LIBERO_FPGA_CONFIG_DIR is provided (adds -DMPFS_DDR_INIT and include path).
.github/workflows/test-configs.yml	Adds CI build job for the new MPFS250 M-mode + DDR config template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 20 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 3 comments.

[danielinux]

it seems that PDMA copy could fail when DMA-based copy is on, and the error is not propagated. This is not a security issue, but missed DMA copy might let the callers panic explicitly if a void* is returned

[danielinux]

Error propagation; see comment on wolfBoot_fit_memcpy weak prototype

[danielinux]

Should those be gated by RISC-V arch only?