PolarFire SoC M-Mode LPDDR4 + minimal SBI runtime by dgarske · Pull Request #774 · wolfSSL/wolfBoot

dgarske · 2026-05-07T22:48:08Z

Summary

wolfBoot runs standalone in M-mode on the E51 monitor core, replacing both HSS and OpenSBI: it brings up LPDDR4 in software, secure-boots a signed Yocto FIT from SD, and stays resident as a minimal SBI runtime so the U54 cores boot Linux. Result: secure-boot 4-CPU SMP Yocto Linux to a login prompt in ~40 s from power-on, with no Microchip firmware in the boot chain.

Commits

PolarFire SoC: LPDDR4 DDR init for MPFS250T Video Kit (M-Mode) - software LPDDR4 init/training (all-4-lane WRCALIB gate + retry), SD secure boot of a signed Yocto FIT (SDHCI PIO + PDMA-to-DDR staging with read-back verify), SHA384 + ECC384 verification, FIT parse, L2 dtb fixups, and S-mode hand-off. The licensed Cadence DDR controller logic (controller CSR programming, Memory Test Controller, LPDDR4 mode-register protocol) is a target-independent driver in src/ddr_cadence.c + include/ddr_cadence.h; the Microchip PHY/PLL/clock/training and the board LIBERO_SETTING_* values stay in hal/mpfs250_ddr.c.
RISC-V: minimal SBI runtime; PolarFire SoC boots 4-CPU SMP Yocto Linux - a minimal M-mode SBI runtime (src/riscv_sbi.c): BASE/TIME/IPI/RFENCE/HSM/DBCN plus the legacy calls, with per-hart M-mode trap stacks, rdtime and misaligned load/store emulation, atomic cross-hart IPI ops with self-directed SSIP delivery, and the trap-entry / M->S hand-off wiring. PolarFire SoC bring-up adds CLINT MTIME enable, per-hart HSM hart_start mailboxes, the watchdog policy, and the dtb fixups that bring up 4-CPU SMP Linux.

Key design points

Generic Cadence driver: the controller half is reusable across Cadence-DDR SoCs (controller base overridable via DDR_CADENCE_CTRL_BASE); the SoC-specific PHY/PLL/training is behind the platform HAL. Both compile only when MPFS_DDR_INIT is set.
Cross-hart state in DTIM, not L2-scratch: cacheable stores to the L2 scratchpad can be lost on dirty-line eviction, so the SBI shared state, HSM mailboxes and the secondary-hart release gate live in the E51 DTIM; the M-mode trap stacks live in reserved DDR.
No timer/rdtime CSR on these harts: CLINT MTIME is enabled from SYSREG and rdtime is emulated in M-mode for S and U mode.
Watchdog policy: the MSS watchdogs always count and reset the chip and cannot be disabled, so the parked E51 monitor refreshes all five and the OS watchdog nodes are disabled in the dtb.
DDR data path: direct CPU writes to DDR do not land on this board, so the kernel/dtb copies and the SD load go through the PDMA master with a non-cached read-back verify.

Validation (MPFS250T Video Kit, power-controlled cold boots)

5/5 and repeated 3/3 clean cold boots to the systemd login prompt; smp: Brought up 1 node, 4 CPUs with zero "failed to come online"; login at ~40 s.
12-minute idle soaks with no watchdog reset.
All five PolarFire template configs build (M-mode SD, M-mode QSPI, S-mode SDCard, S-mode QSPI, S-mode L2-LIM); the M-mode QSPI build links no ddr_cadence.o (driver correctly gated). versal_vmk180_sdcard, zynqmp_sdcard, zynq7000_sdcard also build (shared sdhci/boot files).
The S-mode SDCard, S-mode QSPI, S-mode L2-LIM and M-mode QSPI configs were each booted on hardware via HSS to confirm no regression.

Notes for reviewers

src/vector_riscv.S trap-macro changes are WOLFBOOT_RISCV_MMODE-gated; S-mode builds keep the original frame behavior.
src/sdhci.c keeps the cross-platform driver clean: the MPFS PDMA/watchdog specifics are behind weak sdhci_platform_block_copy() / sdhci_platform_wdt_pet() hooks.
src/fdt.c gains a weak wolfBoot_fit_memcpy hook so the platform can route FIT subimage copies through PDMA.
CI: tools/ci/mpfs_libero_stub/fpga_design_config.h lets the M-mode + DDR path compile in GitHub Actions (compile-only; not runnable).
lib/wolfssl submodule pointer is bumped (came in with the DDR work); drop it if the project prefers to bump separately.
docs/Targets.md documents the M-mode + DDR Linux boot flow, the wolfSBI runtime, the watchdog policy, and the generic Cadence driver split.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds standalone wolfBoot M-mode support for the PolarFire SoC MPFS250T Video Kit, including LPDDR4 bring-up (replacing HSS in the early boot path) and Linux S-mode handoff plumbing.

Changes:

Enhance SDHCI diagnostics and reliability workarounds (CMD0→CMD8 delay, single-block read option, capability logging).
Extend RISC-V M-mode boot flow with a reusable M→S handoff API and MPFS-specific “release U54 hart” implementation.
Introduce MPFS250 DDR/PHY init infrastructure, build-time enablement via LIBERO_FPGA_CONFIG_DIR, new config template, and CI build job.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/sdhci.c	Adds richer error logging, controller register dump, and reliability workarounds for Cadence SD4HC.
src/boot_riscv.c	Adds trap register dump support (regs frame) and factors M→S handoff into overridable helpers.
hal/mpfs250.h	Adds MPFS250 peripheral bits and extensive DDRC/PHY register definitions + DDR init declarations.
hal/mpfs250.c	Implements MPFS250 DDR/PLL/PHY init, M→S boot on a U54 via IPI handoff, and UART reinit after PLL.
docs/Targets.md	Documents new “M-Mode + DDR” configuration and build-time Libero config integration.
config/examples/polarfire_mpfs250_m.config	Adds new example config for M-mode + LPDDR4 + SD + S-mode Linux boot.
arch.mk	Enables MPFS DDR init when `LIBERO_FPGA_CONFIG_DIR` is provided (adds `-DMPFS_DDR_INIT` and include path).
.github/workflows/test-configs.yml	Adds CI build job for the new MPFS250 M-mode + DDR config template.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 6 comments.

Copilot

Pull request overview

Copilot reviewed 19 out of 20 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 31 out of 33 changed files in this pull request and generated 2 comments.

- wolfBoot_fit_memcpy: return int so a failed PDMA copy propagates instead of being swallowed. The weak default (memcpy) returns 0; the MPFS250 PDMA override returns -1 if any chunk's mpfs_pdma_memcpy() fails. Callers now fail closed: fit_load_image_inner returns NULL (kernel load then panics via update_disk.c), the update_disk DTS copy panics, and hal_dts_fixup returns an error on a failed L2->DDR copy-back. - options.mk: gate -DSTACK_SIZE_PER_HART behind RISC-V arch (RISCV/RISCV64). The macro is only consumed by the RISC-V startup asm and the mpfs250-m.ld sed token, so it is no longer emitted for PPC/ARM/other targets. The unconditional default (?= 0) is kept because the linker sed always needs a value to substitute.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #774

Scan targets checked: wolfboot-bugs, wolfboot-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot · 2026-07-16T08:41:32Z

+            if (regs[A0] >= (unsigned long)MPFS_NUM_HARTS) {
+                err = SBI_ERR_INVALID_PARAM;
+            }
+            else if (sbi_hart_state[regs[A0]] == SBI_HSM_STARTED) {


🟠 [Medium] HSM hart_start accepts START_PENDING hart, overwriting pending boot parameters · Concurrency / Race Condition

The SBI_EXT_HSM hart_start handler (line 648) only rejects the call when the target hart is in SBI_HSM_STARTED state. It does not reject SBI_HSM_START_PENDING. Per the SBI v0.2 HSM specification, hart_start must return SBI_ERR_ALREADY_AVAILABLE for any hart that is not in STOPPED state. If a caller issues a second hart_start for the same hart while it is already START_PENDING (e.g., a concurrent or retried call), the else-branch executes: sbi_hart_state[hartid] is written back to START_PENDING (harmless), but sbi_hal_hart_start is called again, which overwrites the pending mailbox entry address and opaque value in DTIM and fires a second MSIP to the target hart. The target hart may already be reading the old mailbox fields mid-boot, so overwriting them races against the target's read of its boot address and opaque data.

Fix: Change the condition from an equality check for STARTED to an inequality check for STOPPED:

else if (sbi_hart_state[regs[A0]] != SBI_HSM_STOPPED) { err = SBI_ERR_ALREADY_AVAIL; }

This ensures the handler rejects any hart not in the STOPPED state, as required by the SBI v0.2 HSM specification.

dgarske self-assigned this May 7, 2026

Copilot AI review requested due to automatic review settings May 7, 2026 22:48

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread hal/mpfs250.c Outdated

Comment thread hal/mpfs250.c Outdated

Comment thread hal/mpfs250.c Outdated

Comment thread hal/mpfs250.c Outdated

Comment thread src/boot_riscv.c

Comment thread src/sdhci.c

Comment thread .github/workflows/test-configs.yml

Copilot started reviewing on behalf of dgarske May 8, 2026 01:44 View session

dgarske marked this pull request as ready for review May 8, 2026 21:48

dgarske requested a review from Copilot May 8, 2026 21:48

dgarske force-pushed the polarfire_ddr_2 branch from 9410252 to b67a191 Compare May 8, 2026 21:52

Copilot AI reviewed May 8, 2026

View reviewed changes

Comment thread hal/mpfs250.c Outdated

Comment thread hal/mpfs250.c

Comment thread hal/mpfs250.c

Comment thread docs/Targets.md Outdated

Comment thread hal/mpfs250.c Outdated

Comment thread src/sdhci.c Outdated

Copilot started reviewing on behalf of dgarske May 8, 2026 22:26 View session

dgarske force-pushed the polarfire_ddr_2 branch from b67a191 to acf120d Compare May 8, 2026 23:10

dgarske force-pushed the polarfire_ddr_2 branch from acf120d to 07e1012 Compare May 15, 2026 23:56

dgarske force-pushed the polarfire_ddr_2 branch from 07e1012 to 8432eb5 Compare June 12, 2026 23:11

dgarske changed the title ~~PolarFire SoC: LPDDR4 init for MPFS250T Video Kit (M-Mode)~~ PolarFire SoC M-Mode LPDDR4 + minimal SBI runtime Jun 12, 2026

dgarske requested a review from Copilot June 12, 2026 23:14

Copilot started reviewing on behalf of dgarske June 12, 2026 23:17 View session

Copilot AI reviewed Jun 12, 2026

View reviewed changes

Comment thread src/sdhci.c Outdated

Comment thread src/sdhci.c Outdated

Comment thread src/sdhci.c Outdated

Comment thread src/riscv_sbi.c Outdated

Comment thread src/riscv_sbi.c

dgarske force-pushed the polarfire_ddr_2 branch 2 times, most recently from 115db4a to 776474f Compare June 15, 2026 23:00

dgarske requested a review from Copilot June 15, 2026 23:01

Copilot AI reviewed Jun 15, 2026

View reviewed changes

Comment thread src/ddr_cadence.c Outdated

Comment thread src/riscv_sbi.c

Comment thread hal/mpfs250.c Outdated

Comment thread arch.mk Outdated

Comment thread src/boot_riscv.c

Copilot started reviewing on behalf of dgarske June 15, 2026 23:11 View session

dgarske force-pushed the polarfire_ddr_2 branch from 776474f to 68789e3 Compare June 15, 2026 23:28

dgarske requested a review from Copilot June 15, 2026 23:28

Copilot started reviewing on behalf of dgarske June 15, 2026 23:30 View session

Copilot AI reviewed Jun 15, 2026

View reviewed changes

Comment thread src/sdhci.c

Comment thread src/sdhci.c

dgarske force-pushed the polarfire_ddr_2 branch 2 times, most recently from 4310c4b to 730fa69 Compare June 17, 2026 23:05

dgarske requested a review from Copilot June 18, 2026 15:15

Copilot started reviewing on behalf of dgarske June 18, 2026 15:16 View session

Copilot AI reviewed Jun 18, 2026

View reviewed changes

Comment thread src/boot_riscv_start.S

Comment thread hal/mpfs250-m.ld Outdated

Comment thread tools/ci/mpfs_libero_stub/fpga_design_config.h Outdated

dgarske force-pushed the polarfire_ddr_2 branch 3 times, most recently from 036fee2 to 21aafa9 Compare June 22, 2026 19:45

dgarske assigned danielinux and wolfSSL-Bot and unassigned dgarske Jun 23, 2026

dgarske requested a review from danielinux June 23, 2026 18:23

danielinux requested changes Jun 24, 2026

View reviewed changes

Comment thread src/fdt.c Outdated

Comment thread hal/mpfs250.c Outdated

Comment thread options.mk Outdated

dgarske assigned dgarske and unassigned danielinux Jun 24, 2026

dgarske force-pushed the polarfire_ddr_2 branch from 21aafa9 to af85a52 Compare June 25, 2026 18:38

dgarske requested a review from danielinux June 25, 2026 19:03

dgarske assigned danielinux and unassigned dgarske Jun 25, 2026

dgarske force-pushed the polarfire_ddr_2 branch from af85a52 to fec15b2 Compare June 25, 2026 22:23

dgarske requested a review from Copilot July 1, 2026 21:44

Copilot started reviewing on behalf of dgarske July 1, 2026 21:58 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

Comment thread config/examples/polarfire_mpfs250_m.config Outdated

Comment thread src/boot_riscv.c Outdated

dgarske added 4 commits July 1, 2026 15:38

PolarFire SoC: LPDDR4 DDR init for MPFS250T Video Kit (M-Mode)

0fec421

RISC-V: minimal SBI runtime; PolarFire SoC boots 4-CPU SMP Yocto Linux

4b02169

test-app: run wolfCrypt test/benchmark on PolarFire SoC MPFS250

a40192d

danielinux assigned dgarske Jul 2, 2026

dgarske force-pushed the polarfire_ddr_2 branch from 26505bc to a40192d Compare July 2, 2026 23:53

dgarske assigned danielinux and unassigned danielinux and dgarske Jul 6, 2026

danielinux requested a review from wolfSSL-Fenrir-bot July 16, 2026 08:13

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

danielinux assigned dgarske Jul 16, 2026

Uh oh!

Conversation

dgarske commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Commits

Key design points

Validation (MPFS250T Video Kit, power-controlled cold boots)

Notes for reviewers

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #774

Uh oh!

wolfSSL-Fenrir-bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

dgarske commented May 7, 2026 •

edited

Loading