zynq7000: add Xilinx Zynq-7000 (ZC702) port

Author: dgarske

Makefile

@@ -285,6 +285,10 @@ ifeq ($(TARGET),sama5d3)
     MAIN_TARGET:=wolfboot.bin test-app/image_v1_signed.bin
 endif
 
+ifeq ($(TARGET),zynq7000)
+    MAIN_TARGET:=wolfboot.bin test-app/image_v1_signed.bin
+endif
+
 ifeq ($(TARGET),rp2350)
     MAIN_TARGET:=include/target.h keytools wolfboot_signing_private_key.der pico-sdk-info
 endif

arch.mk

@@ -303,6 +303,19 @@ ifeq ($(ARCH),ARM)
      CFLAGS+=-DWOLFBOOT_USE_STDLIBC
   endif
 
+  ifeq ($(TARGET),zynq7000)
+     # AMD/Xilinx Zynq-7000 (Cortex-A9, ARMv7-A) - ZC702 Evaluation Kit.
+     # Loaded by Xilinx FSBL into DDR; see hal/zynq7000.{c,h,ld}.
+     CORTEX_A9=1
+     UPDATE_OBJS:=src/update_ram.o
+     CFLAGS+=-DWOLFBOOT_DUALBOOT -fno-builtin -ffreestanding
+     # Do NOT define WOLFBOOT_USE_STDLIBC: newlib's memcpy uses unaligned
+     # LDRs which fault on Cortex-A9 when MMU is off (FSBL leaves MMU off
+     # on Zynq-7000). Use wolfBoot's own aligned-safe memcpy from src/string.c.
+     # U-Boot legacy header detection for Linux/U-Boot payloads (Milestone 5)
+     CFLAGS+=-DWOLFBOOT_UBOOT_LEGACY
+  endif
+
   ifeq ($(TARGET),va416x0)
     CFLAGS+=-I$(WOLFBOOT_ROOT)/hal/vorago/ \
             -I$(VORAGO_SDK_DIR)/common/drivers/hdr/ \
@@ -344,6 +357,32 @@ ifeq ($(CORTEX_A5),1)
               -DWOLFSSL_ARM_ARCH=7 -DWOLFSSL_ARMASM_INLINE -DWOLFSSL_ARMASM_NO_NEON
     endif
   endif
+else
+ifeq ($(CORTEX_A9),1)
+  # Cortex-A9 (ARMv7-A, 32-bit) - Zynq-7000.
+  # Build in ARM state (-marm); reset vector lands in ARM mode after FSBL.
+  # Note: do not filter out -mthumb from CFLAGS/LDFLAGS - that converts the
+  # variables to simple-expansion flavor and breaks lazy $(LSCRIPT) expansion
+  # in test-app/Makefile. -marm appended later wins over -mthumb anyway.
+  FPU=-mfpu=vfp3-d16
+  CFLAGS+=-mcpu=cortex-a9 -mtune=cortex-a9 -marm -static -z noexecstack \
+          -mno-unaligned-access
+  LDFLAGS+=-mcpu=cortex-a9 -mtune=cortex-a9 -marm -static -z noexecstack
+  # Cortex-A9 uses boot_arm32.o (shared do_boot) + a Zynq-7000-specific
+  # startup (VBAR, MMU/cache disable, all-mode stacks). The shared
+  # boot_arm32_start.S used by SAMA5D3/Cortex-A5 lacks those.
+  OBJS+=src/boot_arm32.o src/boot_zynq7000_start.o
+  ifeq ($(NO_ASM),1)
+    MATH_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sp_c32.o
+  else
+    MATH_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sp_arm32.o
+    ifneq ($(NO_ARM_ASM),1)
+      OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/arm/armv8-32-sha256-asm.o
+      OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/arm/armv8-32-sha256-asm_c.o
+      CFLAGS+=-DWOLFSSL_SP_ARM32_ASM -DWOLFSSL_ARMASM -DWOLFSSL_ARMASM_NO_HW_CRYPTO \
+              -DWOLFSSL_ARM_ARCH=7 -DWOLFSSL_ARMASM_INLINE -DWOLFSSL_ARMASM_NO_NEON
+    endif
+  endif
 else
   # All others use boot_arm.o
   OBJS+=src/boot_arm.o
@@ -456,6 +495,7 @@ else
 endif
 endif
 endif
+endif
 
 
 ## Renesas RX

config/examples/zynq7000.config

@@ -0,0 +1,42 @@
+ARCH?=ARM
+TARGET?=zynq7000
+SIGN?=ECC256
+HASH?=SHA256
+
+# Cortex-A9 (Zynq-7000) - selected automatically via TARGET=zynq7000 in arch.mk
+DEBUG?=0
+DEBUG_UART?=1
+V?=0
+SPMATH?=1
+
+# wolfBoot itself is loaded by Xilinx FSBL to DDR at 0x04000000 (hal/zynq7000.ld).
+# WOLFBOOT_LOAD_ADDRESS is the *app* staging address: where wolfBoot copies
+# the verified signed image before do_boot. Must NOT overlap wolfBoot itself
+# AND src/update_ram.c expects dst > wolfBoot's _end - so place it above the
+# wolfBoot region (0x04000000-0x040FFFFF) at 16 MB.
+WOLFBOOT_LOAD_ADDRESS=0x10000000
+
+# QSPI flash (16 MB N25Q128A on ZC702) via XQspiPs (hal/zynq7000.c).
+# Override EXT_FLASH=0 on the make command line for JTAG-only dev builds.
+EXT_FLASH?=1
+NO_XIP=1
+
+# QSPI partition layout (16 MB total):
+#   0x000000 - 0x0FFFFF  BOOT.BIN (FSBL + wolfboot)
+#   0x100000 - 0x6FFFFF  BOOT_A   (~6 MB primary)
+#   0x700000 - 0xCFFFFF  UPDATE_B (~6 MB update)
+#   0xD00000 - 0xD0FFFF  SWAP scratch (64 KB sector)
+WOLFBOOT_PARTITION_BOOT_ADDRESS=0x00100000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x00700000
+WOLFBOOT_PARTITION_SWAP_ADDRESS=0x00D00000
+WOLFBOOT_PARTITION_SIZE=0x00600000
+WOLFBOOT_SECTOR_SIZE=0x10000
+
+# DTS placeholders (used in Milestone 5 for Linux payload)
+WOLFBOOT_LOAD_DTS_ADDRESS=0x00100000
+WOLFBOOT_DTS_BOOT_ADDRESS=0x00080000
+WOLFBOOT_DTS_UPDATE_ADDRESS=0x00680000
+
+IMAGE_HEADER_SIZE=1024
+
+CROSS_COMPILE=arm-none-eabi-

docs/Targets.md

@@ -53,6 +53,7 @@ This README describes configuration of supported targets.
 * [TI Hercules TMS570LC435](#ti-hercules-tms570lc435)
 * [Vorago VA416x0](#vorago-va416x0)
 * [Xilinx Zynq UltraScale](#xilinx-zynq-ultrascale)
+* [Xilinx Zynq-7000 (ZC702)](#xilinx-zynq-7000-zc702)
 * [Versal Gen 1 VMK180](#versal-gen-1-vmk180)
 
 ## STM32F4
@@ -3391,6 +3392,220 @@ Entering idle loop...
 ```
 
 
+## Xilinx Zynq-7000 (ZC702)
+
+AMD/Xilinx Zynq-7000 (XC7Z020) on the ZC702 Evaluation Kit - dual ARM Cortex-A9 (ARMv7-A 32-bit), 1 GB DDR3, 16 MB QSPI NOR (N25Q128A), SDIO, dual UART. Older sibling of the ZynqMP family - distinct silicon, different controllers (`XQspiPs` not `XQspiPsu`, Arasan SDHCI v2.0 not v3.0, no CSU/PMU/PUF, PL310 L2).
+
+wolfBoot is loaded by the Xilinx Zynq-7000 FSBL into DDR:
+```
+BootROM -> FSBL -> wolfBoot -> signed app (or U-Boot/Linux)
+```
+
+The FSBL handles all PS init (DDR, MIO, clocks, QSPI ref clock); wolfBoot only initializes UART, the QSPI controller, runs the verify/swap logic, and chain-loads the next stage.
+
+This target supports:
+- **QSPI boot** (primary): `config/examples/zynq7000.config`
+- **SD card boot** (Milestone 6, planned): `config/examples/zc702_sdcard.config`
+- **JTAG-loaded dev** via Platform Cable II + xsdb (no flash required)
+
+### Prerequisites
+
+1. **Toolchain**: `arm-none-eabi-gcc` (Arm bare-metal). Tested with 13.2.
+2. **Xilinx Vitis** (provides `bootgen`, `xsdb`, and `program_flash`). Source the env once per shell:
+   ```sh
+   source /opt/Xilinx/2025.2/Vitis/settings64.sh
+   ```
+   Vivado's `settings64.sh` works equivalently if you don't have Vitis installed.
+3. **Platform Cable II USB drivers** (one-time, requires root). Without these the
+   cable enumerates as `03fd:0013` with empty descriptors and `xsdb` reports no
+   JTAG targets:
+   ```sh
+   sudo /opt/Xilinx/2025.2/Vitis/data/xicom/cable_drivers/lin64/install_script/install_drivers/install_drivers
+   ```
+   Unplug/replug the cable afterward so udev can load the firmware.
+4. **Pre-built ZC702 FSBL + DTB** (clone next to wolfboot-alt2):
+   ```sh
+   git clone https://github.com/wolfSSL/soc-prebuilt-firmware.git
+   export PREBUILT_DIR=$(pwd)/../soc-prebuilt-firmware/zc702-zynq
+   ls $PREBUILT_DIR/zynq_fsbl.elf  # required
+   ```
+5. **Hardware**: ZC702 with Platform Cable II (USB JTAG) connected to J22 and powered.
+
+### Configuration Options
+
+Key options in `config/examples/zynq7000.config`:
+
+- `ARCH=ARM` - 32-bit ARM
+- `TARGET=zynq7000` - selects `hal/zynq7000.{c,h,ld}` and the `CORTEX_A9` arch.mk block
+- `SIGN=ECC256` / `HASH=SHA256` - smaller and faster than RSA on Cortex-A9
+- `EXT_FLASH=1` - QSPI as external flash via `XQspiPs`
+- `WOLFBOOT_LOAD_ADDRESS=0x10000000` - DDR offset 256 MB, where the verified app is staged before `do_boot`. Must be **above** wolfBoot's own region (`0x04000000`-`0x040FFFFF`) because `src/update_ram.c` enforces `dst > _end`.
+- `WOLFBOOT_PARTITION_BOOT_ADDRESS=0x00100000` - 16 MB QSPI layout below
+- `CROSS_COMPILE=arm-none-eabi-`
+
+DDR layout:
+
+| Region | Address range | Contents |
+|---|---|---|
+| App stage | `0x10000000`+ | Verified signed image, app text/data/bss/stack |
+| Image header staging | `0x0FFFFC00`-`0x0FFFFFFF` | wolfBoot copies the 1 KB header here just before the load address |
+| wolfBoot | `0x04000000`-`0x040FFFFF` | Loaded by FSBL, runs in place |
+| FSBL/BootROM/OCM | `0x00000000`-`0x000FFFFF` | OCM low-mapped during boot |
+
+QSPI partition layout (16 MB on-board flash):
+
+| Offset      | Size    | Contents                          |
+|-------------|---------|-----------------------------------|
+| `0x000000`  | ~512 KB | BOOT.BIN (FSBL + wolfboot)        |
+| `0x100000`  | 6 MB    | BOOT_A (signed primary image)     |
+| `0x700000`  | 6 MB    | UPDATE_B (signed update slot)     |
+| `0xD00000`  | 64 KB   | SWAP scratch sector               |
+| `0xD10000`+ |         | reserved                          |
+
+### Building wolfBoot
+
+```sh
+cp config/examples/zynq7000.config .config
+make keysclean && make keytools
+make TARGET=zynq7000 wolfboot.elf
+```
+
+The result is a 32-bit ARM ELF with entry point `0x04000000` and `.text` start at the same address (vector table at the load base).
+
+### Building BOOT.BIN (production QSPI boot)
+
+```sh
+cp ${PREBUILT_DIR}/zynq_fsbl.elf .
+bootgen -arch zynq -image tools/scripts/zc702/zc702_qspi.bif -w -o BOOT.BIN
+```
+
+`bootgen` ships with Vitis. The `.bif` template at `tools/scripts/zc702/zc702_qspi.bif` is the minimum bootable image; add `download.bit` and a DTB if you also need to load the PL bitstream and a Linux device tree (see Milestone 5).
+
+### Programming QSPI
+
+Set ZC702 boot mode straps to **JTAG** for programming, then either:
+- Vitis: `program_flash -f BOOT.BIN -flash_type qspi_single -fsbl ${PREBUILT_DIR}/zynq_fsbl.elf`
+- Vivado Hardware Manager: Tools -> Add Configuration Memory Device -> select N25Q128 -> program with BOOT.BIN at offset 0.
+
+After programming, set boot mode to **QSPI** (SW16 - see UG850 ch.1.2.4) and power-cycle. Console comes up on UART1 (J17 USB-UART), 115200 8N1.
+
+### JTAG-loaded development (no flash)
+
+For driver bring-up or quick iteration, skip bootgen and load directly via Platform Cable II:
+
+```sh
+source /opt/Xilinx/2025.2/Vitis/settings64.sh   # once per shell
+xsdb tools/scripts/zc702/jtag_load.tcl
+```
+
+The script runs the prebuilt FSBL (PS init: DDR/MIO/clocks/UART), then loads `wolfboot.elf` over the top, sets PC to `0x04000000` and CPSR to SVC with IRQ/FIQ masked, and resumes. Override paths via `FSBL_ELF=...` or `WOLFBOOT_ELF=...` env vars.
+
+With a signed image programmed at QSPI offset `0x100000` (see "Building and flashing the signed test app" below), expected UART output is:
+
+```
+wolfBoot Zynq-7000 (ZC702) hal_init
+Versions: Boot 1, Update 0
+Trying Boot partition at 0x100000
+Loading header 1024 bytes from 0x100000 to 0xFFFFC00
+Loading image 396 bytes from 0x100400 to 0x10000000...done
+Boot partition: 0xFFFFC00 (sz 396, ver 0x1, type 0x201)
+Checking integrity...done
+Verifying signature...done
+Successfully selected image in part: 0
+Firmware Valid
+Booting at 0x10000000
+
+=== ZC702 test-app: BOOT OK ===
+wolfBoot verified + chain-loaded this image
+.....
+```
+
+On a **blank** QSPI (no signed image yet), wolfBoot prints `Versions: Boot 0, Update 0 / No valid image found! / wolfBoot: PANIC!` instead - that is correct behavior, not a bug.
+
+If `xsdb` reports `no targets found` or empty `jtag servers`, either:
+- Cable USB drivers not installed - see step 3 of Prerequisites, OR
+- A previous run left the CPU in a stuck JTAG state - power-cycle the ZC702 (SW10, the Pi4 GPIO 20 power relay, or your PSU control) and retry.
+
+A separate JTAG-only dev build (no QSPI driver) can be produced with `make EXT_FLASH=0`.
+
+### Building and flashing the signed test app
+
+A minimal Cortex-A9 test app lives at `test-app/app_zynq7000.c` (UART banner + heartbeat dots). The top-level `make` target produces both `wolfboot.elf` and `test-app/image_v1_signed.bin` with the keys generated under `wolfboot_signing_private_key.der`:
+
+```sh
+cp config/examples/zynq7000.config .config
+make keysclean && make            # builds wolfboot.elf + test-app/image_v1_signed.bin
+```
+
+Program the signed image to QSPI offset `0x100000` (the BOOT_A partition):
+
+```sh
+program_flash -f test-app/image_v1_signed.bin \
+    -fsbl ${PREBUILT_DIR}/zynq_fsbl.elf \
+    -flash_type qspi_single -offset 0x100000
+```
+
+`program_flash` ships with Vitis. Then run wolfBoot via `xsdb tools/scripts/zc702/jtag_load.tcl` - it should verify and chain-load the test app, producing the heartbeat output above.
+
+### QSPI driver self-test (`TEST_EXT_FLASH`)
+
+To exercise the `XQspiPs` driver in isolation - read JEDEC ID, sector erase + page program + linear-mode read-back of a 256-byte pattern at `0x200000`:
+
+```sh
+make CFLAGS_EXTRA=-DTEST_EXT_FLASH wolfboot.elf
+xsdb tools/scripts/zc702/jtag_load.tcl
+```
+
+Expected output:
+
+```
+qspi: --- TEST_EXT_FLASH start ---
+qspi: JEDEC ID = 0x20bb18  rc=00            <- Micron N25Q128
+qspi: read @0x100000 = 574f4c468c010000     <- "WOLF" magic from a programmed signed image
+qspi: erase sector @ 0x00200000 ...
+qspi: page program ...
+qspi: post-program JEDEC = 0x20bb18
+qspi: rdback[0..7] = 0001020304050607
+qspi: --- TEST_EXT_FLASH PASS ---
+```
+
+### QSPI driver design
+
+The driver in `hal/zynq7000.c` splits read vs cmd-only paths similarly to how the ZynqMP HAL splits SDHCI CMD17 (single-block PIO) vs CMD18 (multi-block SDMA):
+
+| Operation | Path | Why |
+|---|---|---|
+| JEDEC ID, RDSR, WREN, sector erase, page program | I/O mode (TXD0/TXD1/2/3 + auto-start) | Short, command-shaped transactions; needs precise byte counts on MOSI |
+| Bulk reads (signed image, partition headers) | Linear/XIP mode (`memcpy` from `0xFC000000+offset`) | Hardware-accelerated; controller drives cmd+addr+dummy and presents data through the AXI window |
+
+`qspi_linear_mode_setup()` configures `LQSPI_CR=0x8000010B` (single-bit `FAST_READ` 0x0B + 1 dummy byte) which avoids needing the flash QE bit set. A sacrificial first-byte read primes the linear-mode pipeline before the actual `memcpy`.
+
+For TX-only commands sent without RX capture, `qspi_xfer4` picks `TXD1`/`TXD2`/`TXD3` so the controller clocks exactly *N* bytes on the wire (no 4-byte padding that some flash interprets as additional commands - this caused our WREN to fail in an early iteration).
+
+### Boot flow notes
+
+- **Cortex-A9 startup**: `src/boot_zynq7000_start.S` (Z7-specific) plus shared `src/boot_arm32.c` for `do_boot()`. Sets VBAR to wolfBoot's vector table at `0x04000000`, clears `SCTLR.{A,C,I,V}`, invalidates I-cache + branch predictor + TLB, sets stack pointers for IRQ/FIQ/ABT/UND/SVC modes, then unmasks async aborts and calls `main`.
+- **MMU stays ON**, inheriting FSBL's flat 1:1 DDR mapping. Disabling the MMU on Cortex-A9 makes all memory Strongly-Ordered, which traps unaligned LDR/STR and breaks any ARMv7-A unrolled `memcpy`.
+- **memcpy/memset**: do **not** define `WOLFBOOT_USE_STDLIBC` for this target. newlib's ARMv7-A `memcpy` uses unaligned word LDRs from arbitrary alignments and faults under any code path that runs without the MMU configured for Normal memory. wolfBoot's own byte-wise / aligned-word `memcpy` in `src/string.c` is used instead.
+- **`ext_flash_read` returns bytes-read** (not 0 on success): `src/update_ram.c` checks `ret != IMAGE_HEADER_SIZE` for the header read and `ret < 0` for the body read.
+- **Cache teardown** in `hal_prepare_boot()`: cleans+invalidates L1 D-cache by set/way, invalidates L1 I-cache and branch predictor, then disables MMU+caches via SCTLR before `do_boot()` performs `bx r4`.
+- **Register handoff**: per ARM Linux boot ABI - `r0 = 0`, `r1 = 0`, `r2 = DTB ptr` (Linux/U-Boot, Milestone 5), entry in `r4`.
+- **L2 (PL310)**: not touched by wolfBoot. Stock ZC702 FSBLs do not enable PL310; if your customised FSBL does, extend `hal_prepare_boot()` with an L2x0 clean-invalidate + disable.
+
+### Differences from the ZynqMP port
+
+| Aspect           | ZynqMP (`hal/zynq.c`)         | Zynq-7000 (`hal/zynq7000.c`) |
+|------------------|-------------------------------|------------------------------|
+| CPU              | Cortex-A53 quad, AArch64      | Cortex-A9 dual, ARMv7-A      |
+| QSPI controller  | GQSPI (`XQspiPsu`)            | Linear/Static (`XQspiPs`)    |
+| UART IP          | XUartPs @ `0xFF000000`        | XUartPs @ `0xE0001000`       |
+| SDHCI            | Arasan v3.0 + Cadence shim    | Arasan v2.0 (planned)        |
+| Crypto HW        | CSU (AES-GCM, SHA3, PUF)      | none (DevC AES only)         |
+| Boot chain       | FSBL + PMUFW + BL31 + wolfBoot| FSBL + wolfBoot              |
+| Linux EL         | EL2 (hypervisor)              | SVC (no exception levels)    |
+| `bootgen -arch`  | `zynqmp`                      | `zynq`                       |
+
+
 ## Versal Gen 1 VMK180
 
 AMD Versal Prime Series VMK180 Evaluation Kit - Versal Prime XCVM1802-2MSEVSVA2197 Adaptive SoC - Dual ARM Cortex-A72.