Fixes for T2080 from VxWorks testing

Author: dgarske

arch.mk

@@ -1063,6 +1063,9 @@ ifeq ($(TARGET),nxp_t2080)
   CFLAGS+=$(ARCH_FLAGS)
   BIG_ENDIAN=1
   CFLAGS+=-DMMU -DWOLFBOOT_FDT -DWOLFBOOT_DUALBOOT
+  # Support U-Boot legacy uImage header: strip 64-byte header before jumping
+  # to the OS image (e.g. uVxWorks, uImage Linux kernel).
+  CFLAGS+=-DWOLFBOOT_UBOOT_LEGACY
   CFLAGS+=-pipe # use pipes instead of temp files
   CFLAGS+=-feliminate-unused-debug-types
   LDFLAGS+=$(ARCH_FLAGS)

config/examples/nxp-t2080.config

@@ -89,6 +89,7 @@ WOLFBOOT_LOAD_DTS_ADDRESS?=0x200000
 #WOLFBOOT_PARTITION_SWAP_ADDRESS=0xFFDD0000
 #WOLFBOOT_DTS_BOOT_ADDRESS=0xF0040000
 #WOLFBOOT_DTS_UPDATE_ADDRESS=0xF0050000
+#WOLFBOOT_LOAD_DTS_ADDRESS=0xF000000
 
 # Flash erase/write/read test at update partition address
 #TEST_FLASH?=1

docs/Targets.md

@@ -4071,6 +4071,17 @@ flash VA range (`0xF0000000`–`0xFFFFFFFF`). The startup assembly relocates
 CCSRBAR to `0xEF000000` (just below flash). The CPC SRAM and L1 cache addresses
 are also relocated to `0xEE900000`/`0xEE800000` to avoid overlap.
 
+**Boot ROM TLB invalidation (CW VPX3-152 only)**
+
+For VPX3-152, TLB1 Entry 2 maps the full 256 MB flash at `0xF0000000-0xFFFFFFFF`
+with IPROT. This range overlaps with the boot ROM TLB (default 4 KB at
+`0xFFFFF000`, resized to 256 KB at `0xFFFC0000` by `shrink_default_tlb1`).
+Overlapping TLB1 entries cause an e6500 multi-hit machine check. After Entry 2
+is created, the boot ROM TLB is cleared via `tlbwe` with `V=0` and `IPROT=0`;
+Entry 2 then serves all instruction fetches for the flash region including the
+boot ROM range. For NAII 68PPC2 and T2080 RDB (128 MB flash at `0xE8000000`),
+there is no overlap and the boot ROM TLB remains valid alongside Entry 2.
+
 **RAMFUNCTION Constraints**
 
 The NOR flash (two S29GL01GS x8 in parallel, 16-bit bus) enters

hal/nxp_ppc.h

@@ -217,11 +217,13 @@
     #endif
     #endif
 
-    /* DDR stack configuration - relocate from CPC SRAM after DDR init
-     * Stack is at top of first 32MB of DDR, with 64KB reserved for stack
-     * Stack grows downward from DDR_STACK_TOP */
+    /* DDR stack configuration - relocate from CPC SRAM after DDR init.
+     * Stack must be ABOVE the image load area to avoid being overwritten
+     * when the OS image is copied to WOLFBOOT_LOAD_ADDRESS (0x100000).
+     * With WOLFBOOT_PARTITION_SIZE=0x800000 the image area ends at 0x900000.
+     * Place stack at 16MB to be safely above the image + DTS regions. */
     #define DDR_STACK_SIZE    (64 * 1024)        /* 64KB stack in DDR */
-    #define DDR_STACK_TOP     0x02000000UL       /* Top of first 32MB */
+    #define DDR_STACK_TOP     0x01000000UL       /* 16MB - above image area */
     #define DDR_STACK_BASE    (DDR_STACK_TOP - DDR_STACK_SIZE)
 
     /* DDR address where .ramcode is copied before CPC SRAM is released.

include/image.h

@@ -1380,7 +1380,11 @@ static inline int wb_flash_write_verify_word(struct wolfBoot_image *img,
 
 /* -- Image Formats -- */
 /* Legacy U-Boot Image */
+#ifdef BIG_ENDIAN_ORDER
+#define UBOOT_IMG_HDR_MAGIC 0x27051956UL
+#else
 #define UBOOT_IMG_HDR_MAGIC 0x56190527UL
+#endif
 #define UBOOT_IMG_HDR_SZ    64
 
 /* --- Flattened Device Tree Blob */

src/boot_ppc_mp.S

@@ -27,16 +27,31 @@
 
 #define TORESET(x)     (x - _secondary_start_page + BOOT_ROM_ADDR)
 
+/* e6500 has 64-bit GPRs. When loading 32-bit addresses with bit 31 set
+ * (addresses >= 0x80000000), the lis instruction sign-extends, putting
+ * 0xFFFFFFFF in the upper 32 bits. This causes memory access failures.
+ * Use LOAD_ADDR32 macro to properly load 32-bit addresses on e6500. */
+#ifdef CORE_E6500
+#define LOAD_ADDR32(reg, addr) \
+        li      reg, 0; \
+        oris    reg, reg, (addr)@h; \
+        ori     reg, reg, (addr)@l
+#else
+#define LOAD_ADDR32(reg, addr) \
+        lis     reg, (addr)@h; \
+        ori     reg, reg, (addr)@l
+#endif
+
 /* Additional cores (mp) assembly code for core minimum startup and spin table.
  * All code must fit in 4KB, which gets virtually mapped via the TLB1 (MMU) and
  * loaded by core 0. Spin table entry TLB1(0) mapped for work is 64MB.
  */
         .section .bootmp, "ax"
         .globl        _secondary_start_page
 _secondary_start_page:
-        /* Time base, MAS7 and machine check pin enable */
-        lis     r0,     (HID0_EMCP | HID0_TBEN | HID0_ENMAS7)@h
-        ori     r0, r0, (HID0_EMCP | HID0_TBEN | HID0_ENMAS7)@l
+        /* Time base, MAS7 and machine check pin enable.
+         * HID0_EMCP=0x80000000 has bit 31 set; use LOAD_ADDR32 for e6500. */
+        LOAD_ADDR32(r0, (HID0_EMCP | HID0_TBEN | HID0_ENMAS7))
         mtspr   SPRN_HID0, r0
 
 #ifdef CORE_E500
@@ -98,9 +113,10 @@ branch_prediction:
         andi.   r1, r3, L1CSR_CE@l
         beq     2b
 
-        /* Get our PIR to figure out our table entry */
-        lis     r3,     TORESET(_spin_table_addr)@h
-        ori     r3, r3, TORESET(_spin_table_addr)@l
+        /* Get our PIR to figure out our table entry.
+         * TORESET(...) resolves to address near BOOT_ROM_ADDR (0xFFFFF000),
+         * bit 31 set; use LOAD_ADDR32 for e6500. */
+        LOAD_ADDR32(r3, TORESET(_spin_table_addr))
         lwz     r3, 0(r3)
 
         /* Use PIR to determine cluster/core for spin table base at r10 */
@@ -160,8 +176,9 @@ l2_poll_invclear:
         addi    r3, r8, 1
         mtspr   L2CSR1, r3
 
-        /* enable L2 with no parity */
-        lis     r3, (L2CSR0_L2E)@h
+        /* enable L2 with no parity.
+         * L2CSR0_L2E=0x80000000 has bit 31 set; use LOAD_ADDR32 for e6500. */
+        LOAD_ADDR32(r3, L2CSR0_L2E)
         mtspr   L2CSR0, r3
         isync
 2:
@@ -171,33 +188,37 @@ l2_poll_invclear:
 #endif
 #endif /* CORE_E5500 || CORE_E6500 */
 3:
-        /* setup mapping for the spin table, WIMGE=0b00100 */
-        lis     r13, TORESET(_spin_table_addr)@h
-        ori     r13, r13, TORESET(_spin_table_addr)@l
+        /* setup mapping for the spin table, WIMGE=0b00100.
+         * TORESET(...) has bit 31 set; use LOAD_ADDR32 for e6500. */
+        LOAD_ADDR32(r13, TORESET(_spin_table_addr))
         lwz     r13, 0(r13)
         /* mask by 4K */
         rlwinm  r13, r13, 0, 0, 19
 
         lis     r11, (MAS0_TLBSEL(1) | MAS0_ESEL(1))@h
         mtspr   MAS0, r11
-        lis     r11, (MAS1_VALID | MAS1_IPROT)@h
-        ori     r11, r11, (MAS1_TS | MAS1_TSIZE(BOOKE_PAGESZ_4K))@l
+        /* MAS1_VALID=0x80000000 has bit 31 set; use LOAD_ADDR32 for e6500. */
+        LOAD_ADDR32(r11, (MAS1_VALID | MAS1_IPROT | MAS1_TS |
+                          MAS1_TSIZE(BOOKE_PAGESZ_4K)))
         mtspr   MAS1, r11
+        /* Build MAS2 = r13 (spin table base, 4K aligned) | MAS2_M | MAS2_G.
+         * Note: both oris and ori must use r11 as source for the second op
+         * (the original code erroneously used r13 on the second op, which
+         * overwrote the upper 16 bits from the first oris). */
         oris    r11, r13, (MAS2_M | MAS2_G)@h
-        ori     r11, r13, (MAS2_M | MAS2_G)@l
+        ori     r11, r11, (MAS2_M | MAS2_G)@l
         mtspr   MAS2, r11
         oris    r11, r13, (MAS3_SX | MAS3_SW | MAS3_SR)@h
-        ori     r11, r13, (MAS3_SX | MAS3_SW | MAS3_SR)@l
+        ori     r11, r11, (MAS3_SX | MAS3_SW | MAS3_SR)@l
         mtspr   MAS3, r11
         li      r11, 0
         mtspr   MAS7, r11
         tlbwe
 
         /* _bootpg_addr has the address of _second_half_boot_page
-         * jump there in AS=1 space with cache enabled
-         */
-        lis     r13, TORESET(_bootpg_addr)@h
-        ori     r13, r13, TORESET(_bootpg_addr)@l
+         * jump there in AS=1 space with cache enabled.
+         * TORESET(...) has bit 31 set; use LOAD_ADDR32 for e6500. */
+        LOAD_ADDR32(r13, TORESET(_bootpg_addr))
         lwz     r11, 0(r13)
         mtspr   SRR0, r11
         mfmsr   r13
@@ -295,8 +316,8 @@ _second_half_boot_page:
         /* Add tlb 1 entry 0 64MB for new entry */
         lis     r10, (MAS0_TLBSEL(1) | MAS0_ESEL(0))@h
         mtspr   MAS0, r10
-        lis     r10, (MAS1_VALID | MAS1_IPROT)@h
-        ori     r10, r10, (MAS1_TSIZE(BOOKE_PAGESZ_64M))@l
+        /* MAS1_VALID=0x80000000 has bit 31 set; use LOAD_ADDR32 for e6500. */
+        LOAD_ADDR32(r10, (MAS1_VALID | MAS1_IPROT | MAS1_TSIZE(BOOKE_PAGESZ_64M)))
         mtspr   MAS1, r10
         mtspr   MAS2, r12 /* WIMGE = 0 */
         ori     r12, r12, (MAS3_SX | MAS3_SW | MAS3_SR)

src/update_ram.c

@@ -277,10 +277,10 @@ void RAMFUNCTION wolfBoot_start(void)
     image_ptr = wolfBoot_peek_image(&os_image, 0, NULL);
     if (image_ptr) {
         if (*((uint32_t*)image_ptr) == UBOOT_IMG_HDR_MAGIC) {
-            /* Note: Could parse header and get load address at 0x10 */
-
-            /* Skip 64 bytes (size of Legacy format image header) */
-            load_address += UBOOT_IMG_HDR_SZ;
+            /* Skip 64-byte legacy header in source; load address unchanged
+             * so kernel is placed at WOLFBOOT_LOAD_ADDRESS */
+            wolfBoot_printf("U-Boot Legacy header detected, skipping %d bytes\n",
+                UBOOT_IMG_HDR_SZ);
             os_image.fw_base += UBOOT_IMG_HDR_SZ;
             os_image.fw_size -= UBOOT_IMG_HDR_SZ;
         }