Skip to content

Commit 347aab6

Browse files
uLipeuLipe
committed
backport: standalone boot — MPX entry, CPXE map, early WDT
Cherry-picked surgically from main for this release tag.
1 parent 060de12 commit 347aab6

329 files changed

Lines changed: 13546 additions & 77 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.hil_tmp/_status.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
flash_size 95
2+
flash: ulmk (49800 B, sectors 0-3)
3+
erase...
4+
program...
5+
start...
6+
flash + start — done
7+
---
8+
1030528 /bin/bash -O extglob -c snap=$(command cat <&3) && builtin shopt -s extglob && builtin eval -- "$snap" && { builtin set +u 2>/dev/null || true; builtin eval "${__CURSOR_SANDBOX_ENV_RESTORE:-}" 2>/dev/null; builtin export PWD="$(builtin pwd)"; builtin shopt -s expand_aliases 2>/dev/null; builtin eval "$1"; }; COMMAND_EXIT_CODE=$?; dump_bash_state >&4; builtin exit $COMMAND_EXIT_CODE -- exec > /home/ulipe/fun/ulmk/.hil_tmp/_status.txt 2>&1 set +x +v python3 -c ' from pathlib import Path p=Path("/home/ulipe/fun/ulmk/.hil_tmp/flash.log") print("flash_size", p.stat().st_size if p.exists() else None) if p.exists(): t=p.read_bytes()[-6000:].decode("utf-8","replace").replace("\r","\n") for ln in [x for x in t.splitlines() if x.strip()][-40:]: print(ln) ' echo --- pgrep -af openocd || echo no_openocd echo STATUS_OK
9+
STATUS_OK

‎.hil_tmp/a14-diear.gdb‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
set pagination off
2+
set remotetimeout 15
3+
target extended-remote :3333
4+
printf "PC=%p\n", $pc
5+
# CPU0 Class4: DATR/DIEAR/DIETR — try several known maps
6+
set $addrs[0]=0xF7E1A010
7+
set $addrs[1]=0xF7E1A014
8+
set $addrs[2]=0xF7E1A018
9+
set $i=0
10+
while $i < 3
11+
printf "mmio 0x%08x = 0x%08x\n", $addrs[$i], *(unsigned*)$addrs[$i]
12+
set $i = $i + 1
13+
end
14+
# also try DSEAR style
15+
x/4xw 0xF7E19080
16+
# root_stack symbol
17+
printf "root_stack:\n"
18+
info address root_stack_g
19+
p/x &root_stack_g
20+
p/x sizeof(root_stack_g)
21+
detach
22+
quit

‎.hil_tmp/a14-diear2.gdb‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
set pagination off
2+
set remotetimeout 15
3+
target extended-remote :3333
4+
x/1xw 0xF7E19080
5+
x/1xw 0xF7E19084
6+
x/1xw 0xF7E1A010
7+
x/1xw 0xF7E1A014
8+
x/1xw 0xF7E1A018
9+
x/1xw 0xF000E010
10+
# PSW from CSA
11+
printf "PSW=0x%08x IO=%u PRS=%u\n", 0x18001584, (0x18001584>>10)&3, (0x18001584>>14)&3
12+
# stack bounds
13+
printf "root_stack_g=0x70007280 top~0x70008280 store=0x7000822c\n"
14+
x/8xw 0x70008220
15+
detach
16+
quit

‎.hil_tmp/a14-fault.txt‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
TC275 A14 / st.w [A14]-4 class-4 interpretation
2+
================================================
3+
Date: 2026-07-16
4+
Attach: .hil_tmp/tc275_attach_only.cfg (already in trap; PC=ulmk_kern_trap_panic)
5+
ELF: /home/ulipe/fun/build/ulipe-tricore-tc275_lite/ulmk
6+
git -C ulmk diff kernel/ipc/ep.c | head -100 → (empty; no local ep.c changes)
7+
8+
CSA frame @ 0x70002cc0 (Upper context; A11=0xa0009630 as requested)
9+
-----------------------------------------------------------------
10+
Word idx field (UC) value
11+
0 0 PCXI 0x003700b2
12+
1 1 PSW 0x18001584
13+
2 2 A10 (SP) 0x70008228
14+
3 3 A11 (PC/RA) 0xa0009630
15+
4 4 D8 0x00000000
16+
5 5 D9 0x00000000
17+
6 6 D10 0x00000000
18+
7 7 D11 0x00000000
19+
8 8 A12 0x00000000
20+
9 9 A13 0x00000000
21+
10 10 A14 0x70008230
22+
11 11 A15 0xa000b8b8
23+
12 12 D12 0x00000000
24+
13 13 D13 0x00000000
25+
14 14 D14 0x00000000
26+
15 15 D15 0x00000000
27+
28+
PSW decode: CDC=4 CDE=1 IS=0 IO=1 (User-1/driver) PRS[13:12]=1 (userspace)
29+
scratch @ 0x70008280 = 1 (hil_mark(1) done; pinmux_init never reached 0x11/0x70)
30+
31+
A14 / A10 / store EA
32+
--------------------
33+
A14 (word 10) = 0x70008230 → DSPR frame pointer, NOT a code pointer
34+
addr2line(A14): N/A (RAM). Symbol: root_stack_g+4016
35+
A10 (word 2) = 0x70008228 → SP (= A14-8)
36+
A15 (word 11) = 0xa000b8b8 → ulmk_user_thread_entry
37+
A11 (word 3) = 0xa0009630 → pinmux_init+0x48
38+
39+
store address = A14 - 4 = 0x7000822c
40+
mdw: readable, currently 0 (root_stack_g+4012)
41+
root_stack_g @ 0x70007280 size 0x1000 → top 0x70008280
42+
EA is 84 bytes below stack top (0x54) — inside the root thread stack BSS
43+
44+
addr2line A11:
45+
0xa0009630 pinmux_init (insn: st.w [%a14]-4, %d2)
46+
47+
Faulting instruction
48+
--------------------
49+
a000962c: call a00090e2 <ulmk_ep_create> /* server.c stub: syscall 30 */
50+
a0009630: st.w [%a14]-4, %d2 ← A11 / fault PC
51+
a0009634: ld.w %d2, [%a14]-4
52+
53+
So class-4 fires on the *caller* spill of ulmk_ep_create's return value
54+
into a stack local, immediately after the CALL returns — not on a
55+
peripheral SFR pointer.
56+
57+
User call chain (UC A11, oldest → fault)
58+
----------------------------------------
59+
_ulmk_thread_trampoline → ulmk_user_thread_entry → ulmk_root_thread
60+
→ board_services_init (hil_mark(1); pinmux_init(0))
61+
→ pinmux_init +0x48 (after call ulmk_ep_create) ← FAULT
62+
63+
ulmk_ep_create @ 0xa00090e2 (first ~8 insns):
64+
mov.aa a14, sp
65+
sub.a sp, 8
66+
syscall 30
67+
st.w [a14]-4, d2
68+
ld.w d2, [a14]-4
69+
ret
70+
71+
pinmux_init @ 0xa00095e8 (prologue + path to fault):
72+
mov.aa a14, sp
73+
sub.a sp, 48
74+
... memset / g_pinmux_eps check ...
75+
call ulmk_ep_create
76+
st.w [a14]-4, d2 ← class-4 site
77+
78+
Why st.w [A14]-4 class-4'd
79+
--------------------------
80+
1. The effective address is a *normal stack slot* (root_stack_g+4012), not
81+
MMIO. A14 is the C frame pointer from `mov.aa %a14,%sp` in pinmux_init.
82+
This is not "A14 held a bad code/SFR pointer".
83+
84+
2. Class-4 entry is confirmed via CSA walk through _trap_class4 (see
85+
trap-pc-summary.txt). DIEAR/DIETR @ 0xF7E19080/84 and 0xF7E1A014/18
86+
are 0 at panic halt — panic/printk nest cleared or never latched for
87+
postmortem; cannot re-read the precise fault EA from SFRs now.
88+
89+
3. Best interpretation of the locus:
90+
- Primary: data-memory class-4 on the post-ep_create stack store in
91+
pinmux_init (fault PC = 0xa0009630).
92+
- The store itself is innocuous C ABI; a class-4 on DSPR user stack
93+
after syscall 30 points to *kernel/syscall/MPU return path* leaving
94+
the thread unable to write its own stack (or a bus/data error on
95+
that line), not to pinmux SFR programming (pinmux_port intentionally
96+
avoids mem_map for that reason — see server.c comment).
97+
- Note: A10=0x70008228 is only A14-8, whereas pinmux_init's prologue
98+
subtracts 48 (expected SP 0x70008200). That SP anomaly is consistent
99+
with context corruption or a partial restore around the syscall/CALL
100+
boundary; the store EA still follows A14 and lands in root_stack.
101+
102+
4. ep.c: no uncommitted diff — if ep_create/syscall is implicated, it is
103+
in the already-built kernel image, not a dirty working-tree patch.
104+
105+
5. Not the fault: A14-as-code (RAM); g_pinmux_eps lookup (already passed);
106+
pinmux PORT SFR writes (those happen later in pinmux_server / apply).
107+
108+
Bottom line
109+
-----------
110+
class-4 at st.w [%a14]-4 in pinmux_init right after ulmk_ep_create returns,
111+
EA=0x7000822c ∈ root_stack_g. A14 is FP (DSPR), A10 is SP. Investigate
112+
syscall-30 / MPU / context restore on return to userspace — not pinmux
113+
pad MMIO, and not a bad A14 code pointer.

‎.hil_tmp/a14.gdb‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
set pagination off
2+
set remotetimeout 20
3+
target extended-remote :3333
4+
printf "PC=0x%lx\n", (unsigned long)$pc
5+
printf "CSA@0x70002cc0:\n"
6+
x/16xw 0x70002cc0
7+
printf "A10(SP)=0x%08x A11(RA)=0x%08x A14=0x%08x A15=0x%08x\n", *(unsigned*)0x70002cc8, *(unsigned*)0x70002ccc, *(unsigned*)0x70002ce8, *(unsigned*)0x70002cec
8+
printf "store_addr A14-4=0x%08x\n", (*(unsigned*)0x70002ce8)-4
9+
x/4xw ((*(unsigned*)0x70002ce8)-4)
10+
# walk prev from PCXI word0
11+
set $link = *(unsigned*)0x70002cc0
12+
set $i=0
13+
while ($i < 4)
14+
set $a = (($link & 0x70000)<<12) | (($link & 0xffff)<<6)
15+
printf "prev[%d] link=0x%x addr=0x%x\n", $i, $link, $a
16+
x/16xw $a
17+
set $link = *(unsigned*)$a
18+
set $i = $i + 1
19+
if ($link & 0xfffff) == 0
20+
loop_break
21+
end
22+
end
23+
detach
24+
quit

‎.hil_tmp/addr2line-endinit-hil.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
0xa00064e8
2+
ulmk_arch_cpu_idle
3+
??:?

‎.hil_tmp/addr2line-endinit-naked.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
0xa00064e8
2+
ulmk_arch_cpu_idle
3+
??:?

‎.hil_tmp/addr2line-hil-pinmux.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
0xa00064e8
2+
ulmk_arch_cpu_idle
3+
??:?

‎.hil_tmp/addr2line-naked-pinmux.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
0xa0000162
2+
_trap_class3
3+
??:?

‎.hil_tmp/addr2line.log‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
0xa0000162 _trap_class3 at ??:?
2+
0xa0000178 _trap_class3 at ??:?
3+
0xa0006d58 ulmk_arch_trap_entry at ??:?
4+
0xa000019c _trap_class4 at ??:?
5+
0xa00032b2 _ulmk_printk at ??:?
6+
0xa0005ee0 dump_puts at arch.c:?
7+
0xa0005ee1 dump_puts at arch.c:?
8+
0xa0005eeb dump_puts at arch.c:?
9+
0xa0005eed dump_puts at arch.c:?
10+
0xa0003204 _ulmk_printk at ??:?
11+
0xa000316c _ulmk_printk at ??:?
12+
0xa00090d6 board_services_init at ??:?
13+
0xa000923a board_console_start at ??:?
14+
0xa0009f48 pinmux_init at ??:?
15+
0xa000ba08 asclin_init at ??:?
16+
==== nm nearby ====
17+
awk: line 8: function strtonum never defined

0 commit comments

Comments
 (0)