Peer review fixes (thanks copilot and customer)

Author: dgarske

config/examples/nxp-t2080.config

@@ -10,7 +10,11 @@
 #CFLAGS_EXTRA+=-DBOARD_NAII_68PPC2
 #
 # For CW VPX3-152 (256 MB NOR flash at 0xF0000000), uncomment the BOARD
-# define AND the address override block at the bottom of this file.
+# define below AND the entire address-override block at the bottom of this
+# file. That block includes OS_64BIT=1, which is REQUIRED to boot a 64-bit
+# RTOS (VxWorks 7 / Green Hills INTEGRITY-178 tuMP) -- it gates the e6500 SMP
+# spin-table + DDR-LAW handoff in hal/nxp_t2080.c; without it the loader runs
+# but the OS hangs silently right after "do_boot: jumping".
 #CFLAGS_EXTRA+=-DBOARD_CW_VPX3152
 
 ARCH=PPC
@@ -79,28 +83,40 @@ WOLFBOOT_DTS_UPDATE_ADDRESS?=0xE8050000
 WOLFBOOT_LOAD_DTS_ADDRESS?=0x200000
 
 # -----------------------------------------------------------------------------
-# CW VPX3-152 address overrides (256 MB NOR flash @ 0xF0000000)
-# Uncomment ALL lines below when building for VPX3-152.
-# Also uncomment CFLAGS_EXTRA+=-DBOARD_CW_VPX3152 at the top of this file.
+# CW VPX3-152 overrides (256 MB NOR flash @ 0xF0000000, 4 GB DDR3L)
+# Uncomment ALL lines below when building for VPX3-152, AND uncomment
+# CFLAGS_EXTRA+=-DBOARD_CW_VPX3152 at the top of this file. This is the
+# known-good config used to boot VxWorks 7 and Green Hills INTEGRITY-178
+# tuMP (Ada Scheduler) on this board.
 # -----------------------------------------------------------------------------
 #ARCH_FLASH_OFFSET=0xFFFE0000
 #L2SRAM_ADDR=0xEE900000
 #WOLFBOOT_ORIGIN=0xFFFE0000
-#WOLFBOOT_PARTITION_BOOT_ADDRESS=0xFFEE0000
-#WOLFBOOT_PARTITION_UPDATE_ADDRESS=0xFFDE0000
-#WOLFBOOT_PARTITION_SWAP_ADDRESS=0xFFDD0000
+# 8 MB partitions -- full RTOS images do not fit the 1 MB RDB default.
+#WOLFBOOT_PARTITION_SIZE=0x800000
+#WOLFBOOT_PARTITION_BOOT_ADDRESS=0xFF000000
+#WOLFBOOT_PARTITION_UPDATE_ADDRESS=0xFE800000
+#WOLFBOOT_PARTITION_SWAP_ADDRESS=0xFE7F0000
 #WOLFBOOT_DTS_BOOT_ADDRESS=0xF0040000
 #WOLFBOOT_DTS_UPDATE_ADDRESS=0xF0050000
-#WOLFBOOT_LOAD_DTS_ADDRESS=0xF000000
-# ELF staging buffer. wolfBoot copies the signed image here, then
-# elf_load scatters PT_LOAD segments IN PLACE to their vaddrs. It MUST sit
-# ABOVE the ELF's vaddr span (e.g. a VxWorks/Integrity ELF spanning
-# 0x2000-0x75F000) or the in-place loader's collide-guard silently drops
-# the segment overlapping the program-header table -- the OS then executes
-# unloaded memory and traps early. The 0x19000 default overlaps the span;
-# 0x900000 is above it, below the 16MB DDR stack, inside the 32MB cache-
-# inhibit window. Raw uImage kernels override this via ih_load (unaffected).
+#WOLFBOOT_LOAD_DTS_ADDRESS=0x03FE6000
+# REQUIRED for 64-bit RTOS boot (VxWorks 7 / INTEGRITY-178 tuMP). Gates the
+# e6500 SMP spin-table (0x7FEE41C0) + DDR-LAW-slot-17 handoff in
+# hal/nxp_t2080.c. Without it the loader runs but the OS hangs silently after
+# "do_boot: jumping" (it is NOT a missing device tree -- tuMP has no FDT
+# parser; this build option is what was actually missing).
+#OS_64BIT=1
+# ELF staging buffer. wolfBoot copies the signed image here, then elf_load
+# scatters PT_LOAD segments IN PLACE to their vaddrs. It MUST sit ABOVE the
+# ELF's vaddr span (a VxWorks/INTEGRITY ELF spans ~0x2000-0x75F000) or the
+# in-place loader's collide-guard silently drops the segment overlapping the
+# program-header table -- the OS then executes unloaded memory and traps
+# early. The 0x19000 default overlaps the span; 0x900000 is above it, below
+# the 16 MB DDR stack, inside the 32 MB cache-inhibit window. Raw uImage
+# kernels override this via ih_load (unaffected).
 #WOLFBOOT_LOAD_ADDRESS=0x900000
+# Optional: verbose pre-OS register/TLB/LAW dump for handoff debugging.
+#CFLAGS_EXTRA+=-DWOLFBOOT_PPC_PRE_OS_DUMP
 
 # Flash erase/write/read test at update partition address
 #TEST_FLASH?=1

hal/nxp_t2080.c

@@ -1398,6 +1398,10 @@ extern uint32_t _spin_table_addr;
  * hal_dts_fixup() for cpu-release-addr fixups. Also read by boot_ppc.c
  * pre-jump dump to capture spin-table contents at handoff. */
 uint32_t g_spin_table_ddr = 0;
+/* DDR address of the secondary-core boot page, set by hal_mp_init() and used
+ * by hal_dts_fixup() to /memreserve/ the actual page (it differs by config:
+ * 0x7E3FF000 for VPX3 OS64BIT, 0x7FFFF000 otherwise). */
+uint32_t g_bootpg_ddr = 0;
 extern uint32_t _bootpg_addr;
 
 /* Startup additional cores with spin table and synchronize the timebase.
@@ -1597,6 +1601,7 @@ static void hal_mp_init(void)
 
     /* Persist DDR spin-table base for hal_dts_fixup() (cpu-release-addr). */
     g_spin_table_ddr = spin_table_ddr;
+    g_bootpg_ddr = bootpg;
 
     /* Release all cores from reset into the spin loop. The cluster L2 runs
      * with ECC ON (boot_ppc_start.S), so the secondaries spin ECC-consistent
@@ -1681,17 +1686,18 @@ int hal_dts_fixup(void* dts_addr)
     {
         int rsv_ret;
         uint64_t spin_pg = (uint64_t)(g_spin_table_ddr & ~0xFFFU);
+        uint64_t boot_pg = (uint64_t)(g_bootpg_ddr & ~0xFFFU);
 
         rsv_ret = fdt_add_mem_rsv(fdt, spin_pg, 0x1000ULL);
         if (rsv_ret != 0) {
             wolfBoot_printf("FDT: failed to reserve spin-table page "
                 "@ 0x%llx: %d\n", spin_pg, rsv_ret);
             return rsv_ret;
         }
-        rsv_ret = fdt_add_mem_rsv(fdt, 0x7ffff000ULL, 0x1000ULL);
+        rsv_ret = fdt_add_mem_rsv(fdt, boot_pg, 0x1000ULL);
         if (rsv_ret != 0) {
             wolfBoot_printf("FDT: failed to reserve boot page "
-                "@ 0x7ffff000: %d\n", rsv_ret);
+                "@ 0x%llx: %d\n", boot_pg, rsv_ret);
             return rsv_ret;
         }
         rsv_ret = fdt_add_mem_rsv(fdt, 0xfffff000ULL, 0x1000ULL);

src/boot_ppc_mp.S

@@ -48,7 +48,7 @@ _secondary_start_page:
          * may exhibit cache speculation / DVA-stale / coherency bugs.
          * VPX3-152 ships rev 1.1 (PVR 0x85380011). */
         mfspr   r3, SPRN_PVR
-        rlwinm  r3, r3, 28, 0xf  /* major_rev */
+        rlwinm  r3, r3, 28, 28, 31  /* major_rev = (PVR>>4)&0xF */
         cmpwi   r3, 0x1
         bne     mp_t2080_errata_done
 

src/boot_ppc_start.S

@@ -229,7 +229,7 @@ _reset:
          * VPX3-152 ships rev 1.1 (PVR 0x85380011) per CW U-Boot banner.
          * Read PVR major_rev and gate the rev-1-only fixes accordingly. */
         mfspr   r3, SPRN_PVR
-        rlwinm  r3, r3, 28, 0xf  /* r3 = major_rev */
+        rlwinm  r3, r3, 28, 28, 31  /* r3 = major_rev = (PVR>>4)&0xF */
         cmpwi   r3, 0x1          /* is rev 1? */
         bne     t2080_errata_done
 

src/string.c

@@ -495,7 +495,9 @@ void uart_vprintf(const char* fmt, va_list argp)
                         long long sll = va_arg(argp, long long);
                         if (sll < 0) {
                             is_neg = 1;
-                            val = (unsigned long long)(-sll);
+                            /* Negate in unsigned space so LLONG_MIN
+                             * does not overflow. */
+                            val = 0ULL - (unsigned long long)sll;
                         }
                         else {
                             val = (unsigned long long)sll;

src/update_ram.c

@@ -447,8 +447,10 @@ void RAMFUNCTION wolfBoot_start(void)
             load_address = (uint32_t*)(uintptr_t)ih_load;
         } else {
             /* Linux PPC path: leave load_address alone, just advance it
-             * past the header to match upstream behaviour. */
-            load_address += UBOOT_IMG_HDR_SZ;
+             * past the header to match upstream behaviour. load_address is
+             * a uint32_t*, so advance by BYTES, not words. */
+            load_address = (uint32_t*)((uint8_t*)load_address +
+                UBOOT_IMG_HDR_SZ);
         }
         (void)ih_ep; /* TODO: pass through to do_boot when ih_ep != ih_load */
     }