profiles: cap hi3516cv200's SPL upload at its 16 KB SRAM ceiling

hi3516cv200 is the hi3518ev200's sibling in every way that matters here:
identical ADDRESS and FILELEN (only PRESTEP0 differs), so the same
spl_address 0x04010500 and the same 0x04014000 SRAM ceiling. Both come
out of OpenIPC/u-boot-hi3516cv200's build.sh, and both shipped images
carry their LZMA payload at 0x4BB0 — so detection returns 0x4800 on
cv200 too and overruns the window by the same 3328 bytes.

The ev200 side of this was confirmed on real hardware in
OpenIPC/firmware#2299: chunks 1-14 ACK first try, chunk 15 crosses
0x04014000, the bootrom stops answering and 32 retries time out.
cv200 runs the identical numbers through the identical code path.

This does not make cv200 recoverable — the prelude these builds produce
is 19376 bytes against a 15104-byte window, so the capped SPL is still
missing 4272 bytes of live code and won't execute
(OpenIPC/u-boot-hi3516cv200#5 tracks that). It does stop defib writing
over the bootrom's stack on the way to finding out, which is the
difference between a clean failure and a chip that has to be
power-cycled out of a wedged state.

No cv200 on the bench; ev200's hardware trace plus the byte-identical
profile parameters are the evidence.

Author: openipc-ai

src/defib/profiles/data/hi3516cv200.json

@@ -1 +1 @@
-{"name": "hi3518ev200", "DDRSTEP0": [4, 224, 45, 229, 36, 0, 159, 229, 36, 16, 159, 229, 0, 16, 128, 229, 32, 0, 159, 229, 32, 16, 159, 229, 4, 16, 128, 228, 0, 224, 128, 229, 4, 240, 157, 228, 239, 190, 173, 222, 239, 190, 173, 222, 239, 190, 173, 222, 60, 1, 5, 32, 120, 86, 52, 18, 64, 1, 5, 32, 117, 106, 105, 122], "ADDRESS": ["0x04013000", "0x04010500", "0x81000000"], "FILELEN": ["0x0040", "0x3b00"], "STEPLEN": ["0x0040", "0x0060"]}
+{"name": "hi3518ev200", "DDRSTEP0": [4, 224, 45, 229, 36, 0, 159, 229, 36, 16, 159, 229, 0, 16, 128, 229, 32, 0, 159, 229, 32, 16, 159, 229, 4, 16, 128, 228, 0, 224, 128, 229, 4, 240, 157, 228, 239, 190, 173, 222, 239, 190, 173, 222, 239, 190, 173, 222, 60, 1, 5, 32, 120, 86, 52, 18, 64, 1, 5, 32, 117, 106, 105, 122], "ADDRESS": ["0x04013000", "0x04010500", "0x81000000"], "FILELEN": ["0x0040", "0x3b00"], "STEPLEN": ["0x0040", "0x0060"], "SRAMLIMIT": "0x3B00"}

tests/test_protocol_standard.py

@@ -411,6 +411,17 @@ def test_hi3518ev200_openipc_layout_is_capped(self):
             firmware, profile_max=0x3B00, sram_limit=0x3B00,
         ) == 0x3B00
 
+    def test_hi3516cv200_profile_wires_sram_limit(self):
+        # Same silicon window as its hi3518ev200 sibling: identical ADDRESS and
+        # FILELEN (only PRESTEP0 differs), so spl_address 0x04010500 + 0x3B00
+        # lands on the same 0x04014000 ceiling. u-boot-hi3516cv200-universal.bin
+        # carries its LZMA payload at 0x4BB0 too, so detection returns the same
+        # 0x4800 and would overrun by the same 3328 B. See OpenIPC/firmware#2299
+        # for the ev200 hardware trace this is derived from.
+        profile = load_profile("hi3516cv200", PROFILES_DIR)
+        assert profile.spl_sram_limit == 0x3B00
+        assert profile.spl_address + profile.spl_sram_limit == 0x04014000
+
     def test_profile_without_sram_limit_returns_none(self):
         # Chips without the optional SRAMLIMIT field continue to return None.
         profile = load_profile("hi3516ev300", PROFILES_DIR)