Fixes for QSPI flashing tool and getting test-app booting on E51 core.

Author: dgarske

config/examples/polarfire_mpfs250_m_qspi.config

@@ -5,7 +5,7 @@
 #
 # Boot flow:
 #   1. eNVM (0x20220100) -> L2_SCRATCH (0x0A000000) - wolfBoot starts
-#   2. Load signed app image from SC QSPI flash to LIM (0x08000000)
+#   2. Load signed app image from SC QSPI flash to L2_SCRATCH (0x0A010200)
 #   3. Verify signature and boot
 #
 # Flash using mpfsBootmodeProgrammer (bootmode 1):
@@ -70,10 +70,13 @@ DISK_EMMC?=0
 # Stack grows down from end of L2_SCRATCH
 WOLFBOOT_ORIGIN?=0x0A000000
 
-# Load application to LIM (Loosely Integrated Memory, 2MB)
+# Load application to L2 Scratchpad (above wolfBoot code, below stack)
+# wolfBoot occupies ~40KB at 0x0A000000, stack is 64KB at top of 256KB.
 # Note: update_ram places header at (LOAD_ADDRESS - IMAGE_HEADER_SIZE),
-# so offset by header size to keep everything within LIM (starts at 0x08000000)
-WOLFBOOT_LOAD_ADDRESS?=0x08000200
+# so offset by header size to keep header aligned.
+# IMPORTANT: Strip debug symbols from test-app ELF before signing to keep
+# the image small enough to fit in L2 Scratchpad (~150KB available).
+WOLFBOOT_LOAD_ADDRESS?=0x0A010200
 
 # Flash geometry (64 KB sector to match QSPI flash)
 WOLFBOOT_SECTOR_SIZE?=0x10000

docs/Targets.md

@@ -907,12 +907,13 @@ Notes:
 ### PolarFire SoC M-Mode (bare-metal eNVM boot)
 
 In M-Mode wolfBoot runs directly on the E51 monitor core from eNVM — no HSS required. The signed
-application is loaded from SC QSPI flash into LIM (on-chip RAM). This is the simplest bring-up path.
+application is loaded from SC QSPI flash into L2 Scratchpad (on-chip RAM). This is the simplest
+bring-up path.
 
 **Boot flow:**
 1. CPU starts at eNVM reset vector (`0x20220100`)
 2. Startup code copies wolfBoot to L2 Scratchpad (`0x0A000000`) and jumps there
-3. wolfBoot reads the signed image from QSPI flash into LIM (`0x08000000`)
+3. wolfBoot reads the signed image from QSPI flash into L2 Scratchpad (`0x0A010200`)
 4. Signature is verified, then execution jumps to the application
 
 **Build:**
@@ -935,7 +936,7 @@ make test-app/image_v1_signed.bin
 **Flash the signed application to QSPI** using the UART programmer (requires `EXT_FLASH=1` and
 `UART_QSPI_PROGRAM=1` in `.config`, and `pyserial` installed):
 ```sh
-python3 tools/scripts/mpfs_qspi_prog.py /dev/ttyUSB1 \
+python3 tools/scripts/mpfs_qspi_prog.py /dev/ttyUSB0 \
     test-app/image_v1_signed.bin 0x20000
 ```
 
@@ -966,7 +967,17 @@ Booting at 0x...
   wolfBoot uses a calibrated busy-loop for all delays (`udelay()` in `hal/mpfs250.c`).
 - `UART_QSPI_PROGRAM=1` adds a 3-second boot pause every time. Set to `0` once the flash
   contents are stable.
-- The config uses `WOLFBOOT_LOAD_ADDRESS=0x08000200` to keep the image header within LIM.
+- The config uses `WOLFBOOT_LOAD_ADDRESS=0x0A010200` to place the application in L2 Scratchpad
+  above wolfBoot code (~64KB at `0x0A000000`), with the stack at the top of the 256KB region.
+- **LIM instruction fetch limitation:** The on-chip LIM (`0x08000000`, 2MB) is backed by L2
+  cache ways. When `L2_WAY_ENABLE` is set to `0x0B` (all cache ways 0-7 active for caching),
+  no ways remain for LIM backing SRAM. Data reads from LIM work through the L2 cache, but
+  instruction fetch silently hangs — the CPU stalls with no trap generated. For this reason the
+  application is loaded into L2 Scratchpad (`0x0A000000`), which is always accessible regardless
+  of `L2_WAY_ENABLE`. To use LIM, reduce `L2_WAY_ENABLE` to free cache ways for LIM backing.
+- **Strip debug symbols** before signing the test-app ELF. The debug build is ~150KB but the
+  stripped ELF is ~5KB. L2 Scratchpad has ~150KB available between wolfBoot code and the stack:
+  `riscv64-unknown-elf-strip --strip-debug test-app/image.elf`
 
 ### PolarFire testing
 

hal/mpfs250.c

@@ -116,12 +116,13 @@ static void mpfs_config_l2_cache(void)
 }
 
 /* Microsecond delay using busy loop.
- * MTIME counter is not running in bare-metal M-mode (no HSS),
- * so use a calibrated loop at ~40 MHz reset clock. */
-static void udelay(uint32_t us)
+ * MTIME counter is not running in bare-metal M-mode (no HSS), so use a
+ * calibrated loop. E51 runs at ~40 MHz on reset; with volatile load/store
+ * overhead each iteration is ~10 cycles → 4 iterations per microsecond.
+ * noinline prevents the compiler from collapsing the loop at call sites. */
+static __attribute__((noinline)) void udelay(uint32_t us)
 {
     volatile uint32_t i;
-    /* ~10 cycles per iteration at -O2, 40 MHz = 4 iterations per us */
     for (i = 0; i < us * 4; i++)
         ;
 }
@@ -1644,47 +1645,4 @@ void uart_write_hart(unsigned long hartid, const char* buf, unsigned int sz)
     }
 }
 
-/**
- * uart_printf_hart - Simple printf to a specific hart's UART
- * Only supports %d, %x, %s, %lu formats for minimal footprint
- */
-static void uart_printf_hart(unsigned long hartid, const char* fmt, ...)
-{
-    char buf[128];
-    int len = 0;
-    const char* p = fmt;
-
-    /* Very simple printf implementation */
-    while (*p && len < (int)sizeof(buf) - 1) {
-        if (*p == '%') {
-            p++;
-            if (*p == 'l' && *(p+1) == 'u') {
-                /* %lu - unsigned long */
-                p += 2;
-                /* Skip for now - just print placeholder */
-                buf[len++] = '[';
-                buf[len++] = 'N';
-                buf[len++] = ']';
-            } else if (*p == 'd') {
-                p++;
-                buf[len++] = '[';
-                buf[len++] = 'N';
-                buf[len++] = ']';
-            } else if (*p == 's') {
-                p++;
-                buf[len++] = '[';
-                buf[len++] = 'S';
-                buf[len++] = ']';
-            } else {
-                buf[len++] = '%';
-                buf[len++] = *p++;
-            }
-        } else {
-            buf[len++] = *p++;
-        }
-    }
-    buf[len] = '\0';
-
-    uart_write_hart(hartid, buf, len);
-}
 #endif /* WOLFBOOT_RISCV_MMODE */

src/boot_riscv.c

@@ -175,6 +175,15 @@ unsigned long WEAKFUNCTION handle_trap(unsigned long cause, unsigned long epc,
     last_epc = epc;
     last_tval = tval;
 
+#ifdef DEBUG_BOOT
+    /* Debug: print trap info for synchronous exceptions (not interrupts) */
+    if (!(cause & MCAUSE_INT)) {
+        wolfBoot_printf("TRAP: cause=%lx epc=%lx tval=%lx\n", cause, epc,
+            tval);
+        while (1) ; /* halt to prevent infinite trap-mret loop */
+    }
+#endif
+
 #ifdef PLIC_BASE
     /* Check if this is an interrupt (MSB set) */
     if (cause & MCAUSE_INT) {
@@ -463,7 +472,8 @@ void do_boot(const uint32_t *app_offset)
      * Use this for test-apps; define WOLFBOOT_MMODE_SMODE_BOOT for Linux.
      */
     wolfBoot_printf("M-mode direct jump to 0x%lx\n", (unsigned long)app_offset);
-    /* Diagnostics before jump */
+#ifdef DEBUG_BOOT
+    /* Verify UART TX is idle and check first two words of the image */
     {
         volatile uint8_t lsr = MMUART_LSR(DEBUG_UART_BASE);
         uint32_t *p = (uint32_t*)app_offset;
@@ -472,13 +482,23 @@ void do_boot(const uint32_t *app_offset)
         wolfBoot_printf("App[0]=0x%lx [1]=0x%lx\n",
                         (unsigned long)p[0], (unsigned long)p[1]);
     }
-    /* Extended drain: allow all diagnostic output to finish (~10ms at 40MHz) */
+    /* Drain UART TX FIFO before jumping.
+     * 400000 iters ≈ 10 ms at 40 MHz E51 reset clock (~10 cycles/iter). */
     {
         volatile int i;
         for (i = 0; i < 400000; i++) {}
     }
+#endif /* DEBUG_BOOT */
     (void)hartid;
     (void)dts_addr;
+    /* Synchronize I-cache/pipeline after ELF loading wrote new instructions.
+     * fence ensures all stores are committed; fence.i ensures the instruction
+     * fetch unit sees the new code. Required even on E51 (no I-cache) because
+     * the store buffer may not have drained.
+     * Note: -march=rv64imac does not define __riscv_zifencei, so
+     * riscv_icache_sync() in elf.c is a no-op. We emit fence.i manually. */
+    asm volatile("fence" ::: "memory");
+    asm volatile(".word 0x0000100f" ::: "memory"); /* fence.i */
     asm volatile("jr %0" : : "r"(app_offset));
     __builtin_unreachable();
 #endif /* WOLFBOOT_MMODE_SMODE_BOOT */

src/sdhci.c

@@ -1466,14 +1466,15 @@ int sdhci_init(void)
         status = sdhci_set_timeout(SDHCI_DATA_TIMEOUT_US);
     }
 
-    wolfBoot_printf("sdhci_init: %s status: %d\n",
-    #ifdef DISK_EMMC
-        "eMMC"
-    #else
-        "SD"
-    #endif
-        , status
-    );
+    {
+        const char *card_type;
+#ifdef DISK_EMMC
+        card_type = "eMMC";
+#else
+        card_type = "SD";
+#endif
+        wolfBoot_printf("sdhci_init: %s status: %d\n", card_type, status);
+    }
 
     return status;
 }

test-app/startup_riscv.c

@@ -42,6 +42,31 @@ void __attribute__((naked,section(".init"))) _reset(void) {
     asm volatile("la gp, _global_pointer");
     asm volatile("la sp, _end_stack");
 
+    /* Direct UART diagnostic: write "!\r\n" to confirm test-app is running.
+     * MPFS MMUART: THR at offset 0x100, LSR at offset 0x14, THRE = bit 5. */
+    asm volatile(
+        "li a0, 0x20000000\n"    /* UART0 base */
+        /* write '!' */
+        "1: lbu a1, 0x14(a0)\n"  /* read LSR */
+        "andi a1, a1, 0x20\n"    /* check THRE (bit 5) */
+        "beqz a1, 1b\n"
+        "li a2, 0x21\n"          /* '!' */
+        "sb a2, 0x100(a0)\n"     /* write to THR */
+        /* write '\r' */
+        "2: lbu a1, 0x14(a0)\n"
+        "andi a1, a1, 0x20\n"
+        "beqz a1, 2b\n"
+        "li a2, 0x0d\n"          /* '\r' */
+        "sb a2, 0x100(a0)\n"
+        /* write '\n' */
+        "3: lbu a1, 0x14(a0)\n"
+        "andi a1, a1, 0x20\n"
+        "beqz a1, 3b\n"
+        "li a2, 0x0a\n"          /* '\n' */
+        "sb a2, 0x100(a0)\n"
+        ::: "a0", "a1", "a2"
+    );
+
     /* Set up M-mode vectored interrupt table.
      * wolfBoot M-mode does a direct jr (no enter_smode), so payload runs in M-mode.
      * Use mtvec. The +1 sets MODE=1 (vectored). */