diff --git a/Makefile b/Makefile
index c25413327f..6de53a8cb0 100644
--- a/Makefile
+++ b/Makefile
@@ -18,6 +18,7 @@ SECURE_LDFLAGS:=
 LD_START_GROUP:=-Wl,--start-group
 LD_END_GROUP:=-Wl,--end-group
 LSCRIPT_IN:=hal/$(TARGET).ld
+L2SRAM_ADDR?=0xF8F00000
 V?=0
 DEBUG?=0
 DEBUG_UART?=0
@@ -522,7 +523,8 @@ $(LSCRIPT): $(LSCRIPT_IN) FORCE
 		sed -e "s/@BOOTLOADER_START@/$(BOOTLOADER_START)/g" | \
 		sed -e "s/@IMAGE_HEADER_SIZE@/$(IMAGE_HEADER_SIZE)/g" | \
 		sed -e "s/@FSP_S_LOAD_BASE@/$(FSP_S_LOAD_BASE)/g" | \
-		sed -e "s/@WOLFBOOT_L2LIM_SIZE@/$(WOLFBOOT_L2LIM_SIZE)/g" \
+		sed -e "s/@WOLFBOOT_L2LIM_SIZE@/$(WOLFBOOT_L2LIM_SIZE)/g" | \
+		sed -e "s/@L2SRAM_ADDR@/$(L2SRAM_ADDR)/g" \
 		> $@
 
 hex: wolfboot.hex
diff --git a/config/examples/nxp-t2080.config b/config/examples/nxp-t2080.config
index 76fe7e4634..6627f5b7bc 100644
--- a/config/examples/nxp-t2080.config
+++ b/config/examples/nxp-t2080.config
@@ -36,13 +36,22 @@ WOLFTPM?=0
 OPTIMIZATION_LEVEL?=1
 
 # NOR Base Address
+# T2080 RDB:   128MB flash at 0xE8000000, wolfBoot at top (0xEFFE0000)
+# CW VPX3-152: 256MB flash at 0xF0000000, wolfBoot at top (0xFFFE0000)
 ARCH_FLASH_OFFSET?=0xEFFE0000
+#ARCH_FLASH_OFFSET?=0xFFFE0000  # CW VPX3-152
+
+# CPC SRAM address (must match L2SRAM_ADDR in nxp_ppc.h)
+# CW VPX3-152: relocated to 0xEE900000 to avoid 256MB flash TLB overlap
+L2SRAM_ADDR?=0xF8F00000
+#L2SRAM_ADDR?=0xEE900000  # CW VPX3-152
 
 # Flash Sector Size
 WOLFBOOT_SECTOR_SIZE?=0x10000
 
 # wolfBoot start address
 WOLFBOOT_ORIGIN?=0xEFFE0000
+#WOLFBOOT_ORIGIN?=0xFFFE0000  # CW VPX3-152
 # wolfBoot partition size (custom)
 BOOTLOADER_PARTITION_SIZE=0x20000
 
@@ -50,18 +59,23 @@ BOOTLOADER_PARTITION_SIZE=0x20000
 WOLFBOOT_PARTITION_SIZE?=0x100000
 # Location in Flash for Application Partition
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0xEFEE0000
+#WOLFBOOT_PARTITION_BOOT_ADDRESS?=0xFFEE0000  # CW VPX3-152
 # Load Partition to RAM Address
 WOLFBOOT_LOAD_ADDRESS?=0x19000
 
 # Location in Flash for Update Partition
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0xEFDE0000
+#WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0xFFDE0000  # CW VPX3-152
 
 # Location of temporary sector used during updates
 WOLFBOOT_PARTITION_SWAP_ADDRESS?=0xEFDD0000
+#WOLFBOOT_PARTITION_SWAP_ADDRESS?=0xFFDD0000  # CW VPX3-152
 
 # DTS (Device Tree)
 WOLFBOOT_DTS_BOOT_ADDRESS?=0xE8040000
+#WOLFBOOT_DTS_BOOT_ADDRESS?=0xF0040000  # CW VPX3-152
 WOLFBOOT_DTS_UPDATE_ADDRESS?=0xE8050000
+#WOLFBOOT_DTS_UPDATE_ADDRESS?=0xF0050000  # CW VPX3-152
 # DTS Load to RAM Address
 WOLFBOOT_LOAD_DTS_ADDRESS?=0x200000
 
diff --git a/hal/nxp_ppc.h b/hal/nxp_ppc.h
index beb33cf83c..06c0d6d32f 100644
--- a/hal/nxp_ppc.h
+++ b/hal/nxp_ppc.h
@@ -118,13 +118,18 @@
      * CPC SRAM (via CoreNet) is unreliable on cold power cycle —
      * store buffer drains cause bus errors. L1 locked cache is
      * core-local and works reliably from first instruction.
-     * Address chosen below CPC SRAM range, no backing memory needed. */
+     * Address chosen below CPC SRAM range, no backing memory needed.
+     *
+     * VPX3-152: default addresses (0xF8E/F8F) fall within 256MB flash
+     * VA range (0xF0000000-0xFFFFFFFF), causing TLB overlap on e6500.
+     * Relocated below CCSRBAR (0xEF000000) to avoid conflict. */
+#ifdef BOARD_CW_VPX3152
+    #define L1_CACHE_ADDR (0xEE800000UL)
+    #define L2SRAM_ADDR   (0xEE900000UL) /* CPC as SRAM (1MB) */
+#else
     #define L1_CACHE_ADDR (0xF8E00000UL)
-
-    /* T2080 CPC SRAM config - 1MB for ECC P384 stack requirements.
-     * CPC hardware is configured in early ASM but NOT used for stack.
-     * CPC SRAM becomes usable after cache hierarchy is initialized in C. */
     #define L2SRAM_ADDR   (0xF8F00000UL) /* CPC as SRAM (1MB) */
+#endif
     #define L2SRAM_SIZE   (1024UL * 1024UL)
 
     #define INITIAL_SRAM_ADDR     L2SRAM_ADDR
@@ -137,10 +142,18 @@
 
     #define ENABLE_INTERRUPTS
 
+#ifdef BOARD_CW_VPX3152
+    /* Relocate CCSRBAR: default 0xFE000000 (16MB) falls within 256MB flash
+     * VA range 0xF0000000-0xFFFFFFFF. Move to 0xEF000000 (just below flash).
+     * The existing relocation code in boot_ppc_start.S handles the hardware
+     * CCSRBAR register write when CCSRBAR_DEF != CCSRBAR_PHYS. */
+    #define CCSRBAR 0xEF000000UL
+#endif
+
     #define ENABLE_DDR
     #ifndef DDR_SIZE
     #ifdef BOARD_CW_VPX3152
-    #define DDR_SIZE (8192ULL * 1024ULL * 1024ULL) /* TODO: confirm from CS_BNDS dump (4/8/16 GB) */
+    #define DDR_SIZE (4096ULL * 1024ULL * 1024ULL) /* CW VPX3-152: 4 GB (CS0_BNDS=0x000000FF, CS1 disabled) */
     #else
     #define DDR_SIZE (8192ULL * 1024ULL * 1024ULL) /* T2080 RDB / NAII 68PPC2: 8 GB */
     #endif
@@ -158,13 +171,13 @@
      * RAMFUNCTION code continues to work after CPC becomes L2 cache. */
     #define DDR_RAMCODE_ADDR  0x03000000UL       /* 48MB into DDR */
 
-    /* Flash base address and size — may differ between board variants.
-     * TODO: Confirm VPX3-152 flash mapping from IFC CSPR(0)/AMASK(0) dump.
-     * If the new board uses a different base address (e.g. 0xF0000000 for
-     * 256 MB flash), update the BOARD_CW_VPX3152 values and uncomment. */
-#if 0 && defined(BOARD_CW_VPX3152)
-    #define FLASH_BASE_ADDR      0xF0000000UL  /* TODO: from IFC dump */
-    #define FLASH_BASE_PHYS_HIGH 0x0ULL
+    /* Flash base address and size.
+     * CW VPX3-152: 256 MB NOR at 0xF_F000_0000
+     *   Confirmed from U-Boot: IFC CSPR(0)=0xF0000105 (EXT=0xF), AMASK(0)=0xF0000000,
+     *   LAW0: addr=0xF_F000_0000, size=256MB, target=IFC. */
+#ifdef BOARD_CW_VPX3152
+    #define FLASH_BASE_ADDR      0xF0000000UL  /* 256MB NOR flash (0xF0000000-0xFFFFFFFF) */
+    #define FLASH_BASE_PHYS_HIGH 0xFULL
     #define FLASH_LAW_SIZE       LAW_SIZE_256MB
     #define FLASH_TLB_PAGESZ     BOOKE_PAGESZ_256M
 #else
diff --git a/hal/nxp_t2080.h b/hal/nxp_t2080.h
index 67e13837fd..5428b7c60b 100644
--- a/hal/nxp_t2080.h
+++ b/hal/nxp_t2080.h
@@ -19,11 +19,13 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  *
  * Board support:
- *   Default:          T2080 RDB (66.66 MHz oscillator, DDR3L SODIMM)
- *   BOARD_CW_VPX3152: CW VPX3-152 (66.667 MHz oscillator, DDR3L)
+ *   Default:           T2080 RDB (66.66 MHz oscillator, DDR3L SODIMM)
+ *   BOARD_CW_VPX3152:  Curtiss-Wright VPX3-152 (66.667 MHz oscillator,
+ *                      4GB DDR3L single-rank, 256MB NOR flash at 0xF0000000)
  *   BOARD_NAII_68PPC2: NAII 68PPC2 (100 MHz oscillator, 8GB DDR3)
  *
- * NXP T2080E Rev 1.1, e6500 core 2.0, PVR 8040_0120 and SVR 8538_0011
+ * NXP T2080E Rev 1.1, e6500 core 2.0, PVR=0x80400120 SVR=0x85380011
+ * (confirmed on CW VPX3-152 via U-Boot: md.l 0xfe0e00a0 2)
  */
 
 #ifndef NXP_T2080_H
@@ -141,7 +143,11 @@ enum ifc_amask_sizes {
 
 
 /* ---- NOR Flash ---- */
-#define FLASH_BANK_SIZE   (128*1024*1024)
+#ifdef BOARD_CW_VPX3152
+#define FLASH_BANK_SIZE   (256*1024*1024) /* 256MB NOR flash (IFC CS0 AMASK=0xF0000000) */
+#else
+#define FLASH_BANK_SIZE   (128*1024*1024) /* 128MB NOR flash */
+#endif
 #define FLASH_PAGE_SIZE   (512) /* program buffer (256 bytes per chip x 2 chips) */
 #define FLASH_SECTOR_SIZE (128*1024)
 #define FLASH_SECTORS     (FLASH_BANK_SIZE / FLASH_SECTOR_SIZE)
@@ -242,8 +248,35 @@ enum ifc_amask_sizes {
 #define DDR_TWTR_PS     7500
 #define DDR_TRTP_PS     7500
 #define DDR_REF_RATE_PS 7800000
+#elif defined(BOARD_CW_VPX3152)
+/* CW VPX3-152: 4 GB single-rank DDR3L
+ * Confirmed from U-Boot: CS0_BNDS=0x000000FF (4GB), CS1_CONFIG bit31=0 (disabled) */
+#define DDR_N_RANKS     1     /* CS0 only; CS1 disabled (CS1_CONFIG=0x00014402) */
+#define DDR_RANK_DENS   0x100000000 /* 4 GB per rank */
+#define DDR_SDRAM_WIDTH 64
+#define DDR_EC_SDRAM_W  8
+#define DDR_N_ROW_ADDR  16
+#define DDR_N_COL_ADDR  10
+#define DDR_N_BANKS     8
+#define DDR_EDC_CONFIG  2
+#define DDR_BURSTL_MASK 0x0c
+#define DDR_TCKMIN_X_PS 1500  /* DDR3-1333 (from TIMING_CFG_3=0x020E1100) */
+#define DDR_TCMMAX_PS   3000
+#define DDR_CASLAT_X    0x000007E0
+#define DDR_TAA_PS      13500
+#define DDR_TRCD_PS     13500
+#define DDR_TRP_PS      13500
+#define DDR_TRAS_PS     36000
+#define DDR_TRC_PS      49500
+#define DDR_TFAW_PS     30000
+#define DDR_TWR_PS      15000
+#define DDR_TRFC_PS     260000
+#define DDR_TRRD_PS     6000
+#define DDR_TWTR_PS     7500
+#define DDR_TRTP_PS     7500
+#define DDR_REF_RATE_PS 7800000
 #else
-/* T2080 RDB / CW VPX3-152: DDR3L SODIMM */
+/* T2080 RDB: DDR3L SODIMM */
 /* TODO: Fill SPD parameters from DDR3L SODIMM datasheet */
 #define DDR_N_RANKS     2     /* TODO: confirm from CS_CONFIG dump */
 #define DDR_RANK_DENS   0x100000000 /* TODO: confirm */
@@ -314,10 +347,55 @@ enum ifc_amask_sizes {
 #define DDR_DDRCDR_1_VAL       0x80040000
 #define DDR_DDRCDR_2_VAL       0x00000001
 
+#define DDR_ERR_INT_EN_VAL     0x0000001D
+#define DDR_ERR_SBE_VAL        0x00010000
+#elif defined(BOARD_CW_VPX3152)
+/* CW VPX3-152: DDR register values from U-Boot hardware dump */
+#define DDR_CS0_BNDS_VAL       0x000000FF /* CS0: 0-4GB (4GB rank) */
+#define DDR_CS1_BNDS_VAL       0x00000000 /* CS1: disabled */
+#define DDR_CS2_BNDS_VAL       0x00000000
+#define DDR_CS3_BNDS_VAL       0x00000000
+#define DDR_CS0_CONFIG_VAL     0x80014402 /* CS0 enabled */
+#define DDR_CS1_CONFIG_VAL     0x00014402 /* CS1 disabled (bit31=0) */
+#define DDR_CS2_CONFIG_VAL     0x00000000
+#define DDR_CS3_CONFIG_VAL     0x00000000
+#define DDR_CS_CONFIG_2_VAL    0x00000000
+
+#define DDR_TIMING_CFG_3_VAL   0x020E1100
+#define DDR_TIMING_CFG_0_VAL   0x8066000F
+#define DDR_TIMING_CFG_1_VAL   0xD0D8B067
+#define DDR_TIMING_CFG_2_VAL   0x0049315A
+#define DDR_TIMING_CFG_4_VAL   0x00000001
+#define DDR_TIMING_CFG_5_VAL   0x05401400
+
+#define DDR_SDRAM_MODE_VAL     0x00461014
+#define DDR_SDRAM_MODE_2_VAL   0x00A00000
+#define DDR_SDRAM_MODE_3_8_VAL 0x00000000
+#define DDR_SDRAM_MD_CNTL_VAL  0x00000000
+
+#define DDR_SDRAM_CFG_VAL      0xE7240000 /* MEM_EN|SREN|ECC_EN, DDR3 */
+#define DDR_SDRAM_CFG_2_VAL    0x00401000 /* ODT_CFG, NUM_PR=1 */
+
+#define DDR_SDRAM_INTERVAL_VAL 0x0E3C071C
+#define DDR_DATA_INIT_VAL      0xDEADBEEF /* ECC init pattern */
+#define DDR_SDRAM_CLK_CNTL_VAL 0x01400000
+#define DDR_ZQ_CNTL_VAL        0x8A090700
+
+/* Write leveling - board-specific PCB trace delays */
+#define DDR_WRLVL_CNTL_VAL     0x8655F604
+#define DDR_WRLVL_CNTL_2_VAL   0x05030709
+#define DDR_WRLVL_CNTL_3_VAL   0x0E090D08
+
+#define DDR_SDRAM_RCW_1_VAL    0x00000000 /* unbuffered DDR3L */
+#define DDR_SDRAM_RCW_2_VAL    0x00000000
+
+#define DDR_DDRCDR_1_VAL       0x80000000
+#define DDR_DDRCDR_2_VAL       0x00000001
+
 #define DDR_ERR_INT_EN_VAL     0x0000001D
 #define DDR_ERR_SBE_VAL        0x00010000
 #else
-/* T2080 RDB / CW VPX3-152: DDR register values */
+/* T2080 RDB: DDR register values */
 /* TODO: Fill ALL values from Phase 1 U-Boot register dump:
  *   md.l 0xfe008000 4; md.l 0xfe008010 4  (CS BNDS)
  *   md.l 0xfe008080 4; md.l 0xfe0080c0 4  (CS CONFIG)
@@ -335,10 +413,10 @@ enum ifc_amask_sizes {
 #define DDR_CS3_CONFIG_VAL     0x00000000 /* TODO: from dump */
 #define DDR_CS_CONFIG_2_VAL    0x00000000 /* TODO: from dump */
 
+#define DDR_TIMING_CFG_3_VAL   0x00000000 /* TODO: from dump */
 #define DDR_TIMING_CFG_0_VAL   0x00000000 /* TODO: from dump */
 #define DDR_TIMING_CFG_1_VAL   0x00000000 /* TODO: from dump */
 #define DDR_TIMING_CFG_2_VAL   0x00000000 /* TODO: from dump */
-#define DDR_TIMING_CFG_3_VAL   0x00000000 /* TODO: from dump */
 #define DDR_TIMING_CFG_4_VAL   0x00000000 /* TODO: from dump */
 #define DDR_TIMING_CFG_5_VAL   0x00000000 /* TODO: from dump */
 
diff --git a/hal/nxp_t2080.ld b/hal/nxp_t2080.ld
index a688b99840..36812db312 100644
--- a/hal/nxp_t2080.ld
+++ b/hal/nxp_t2080.ld
@@ -2,20 +2,27 @@ OUTPUT_ARCH( "powerpc" )
 
 ENTRY( _reset )
 
-/* On initial start, only a limited space(4k) is accessible.
- * Code here bootstraps to enable access to other needed address spaces */
-BOOTSTRAP_TLB = 0xEFFFF000;
+/* On initial start, only a limited space (4K) is accessible.
+ * Code here bootstraps to enable access to other needed address spaces.
+ * Boot code must be at the top of flash (last 4KB of bootloader partition).
+ * Computed from FLASH region so it adapts to any board flash layout:
+ *   T2080 RDB (128MB @ 0xE8000000):   0xEFFFF000 / 0xEFFFFFFC
+ *   CW VPX3-152 (256MB @ 0xF0000000): 0xFFFFF000 / 0xFFFFFFFC */
+BOOTSTRAP_TLB = ORIGIN(FLASH) + LENGTH(FLASH) - 0x1000;
 
 /* Entry point where RCW directs code to execute from */
-BOOTSTRAP_ENTRY = 0xEFFFFFFC;
+BOOTSTRAP_ENTRY = ORIGIN(FLASH) + LENGTH(FLASH) - 0x4;
 
 MEMORY
 {
     FLASH (rx) : ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @BOOTLOADER_PARTITION_SIZE@
 
     /* CPC as SRAM - 1MB (T2080 supports up to 2MB, using 1MB for P384 stack)
-     * Layout: .ramcode at bottom, stack grows down from top */
-    RAM (rwx) : ORIGIN = 0xF8F00000, LENGTH = 0x100000
+     * Layout: .ramcode at bottom, stack grows down from top
+     * Address must match L2SRAM_ADDR in nxp_ppc.h:
+     *   T2080 RDB:   0xF8F00000
+     *   CW VPX3-152: 0xEE900000 (relocated to avoid 256MB flash VA overlap) */
+    RAM (rwx) : ORIGIN = @L2SRAM_ADDR@, LENGTH = 0x100000
 
     /* DDR - 2GB */
     DRAM (rwx) : ORIGIN = 0x00000000, LENGTH = 0x7FFFFFFF