Remove the "zephyr,memory-region-mpu" property, deprecated in Zephyr 3.5
in favor of the "zephyr,memory-attr" bitmask.
The three BUILD_ASSERT tripwires in the ARM/ARM64 MPU drivers already
turned any remaining use of the property into a build failure, so they go
away with it, together with the now unused NODE_HAS_PROP_AND_OR helper.
The migration section in doc/services/mem_mgmt/index.rst documented a
property that no longer exists, so it is dropped and its value mapping
table moved to the 4.5 migration guide.
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Assisted-by: Claude:opus-5
Writing RBAR with the VALID bit and the region number set also updates
RNR (Arm v7-M ARM, B3.5.7), so explicitly selecting the region with a
separate RNR write first is only needed on Cortex-R, whose RBAR variant
has no VALID/REGION fields. Move the RNR write into the Cortex-R
branch, saving one MPU register write per programmed region on every
context switch when MPU_STACK_GUARD or USERSPACE is enabled.
Measured standalone against main (latency_measure in cycles, lower is
better; thread_metric scores, higher is better):
* mps2/an385 (Cortex-M3, QEMU icount, instruction-exact):
- latency_measure, stack guard: mean -1.3%, min/max/median
-3.4/+0.0/-0.4%.
- latency_measure, userspace: mean -1.1%, min/max/median
-2.9/+0.0/-0.6%.
- thread_metric, stack guard: cooperative and preemptive +0.5%.
* az3166_iotdevkit (STM32F412, Cortex-M4 @ 96 MHz):
- thread_metric: +0.2–0.3%.
- latency_measure: within the platform's ±2–3% code-placement
noise (stack guard min/max/median -3.2/+2.4/+0.0%).
* Flash, az3166 stack-guard image: -8 B at -Os, +8 B at -O2.
Assisted-by: Claude:fable-5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
MISRA C:2012 Rule 8.2 requires every parameter in a function type to be
named, including the parameters of function pointer parameters.
The C++ ABI __cxa_atexit() stub, its local prototype in the ARM
__aeabi_atexit() wrapper and that wrapper itself left the destructor's
parameter unnamed.
Name them after the arguments the documentation or the
definitions already use. No functional change.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Automatically select ARM_GCC_FP_WORKAROUND (renamed to
ARM_FP_CLOBBER_WORKAROUND as the workaround is needed for
clang as well as GCC) whenever CONFIG_FRAME_POINTER is set.
CONFIG_FRAME_POINTER passes -fno-omit-frame-pointer as a
compile flag, forcing frame pointers to be enabled on all
files. Thus the FP workaround is needed to manually
spill/restore r7 around the context switch.
Similarly the workaround is needed if the scheduler is using
a red-black tree, as this uses dynamic stack allocation.
Signed-off-by: Laurie Fay <Laurie.Fay@arm.com>
The AArch32 A-profile support was shared between ARMv7-A and ARMv8-A
AArch32 by threading "defined(CONFIG_ARMV7_A) ||
defined(CONFIG_AARCH32_ARMV8_A)" through every affected site. Each new
A-profile AArch32 variant would have to be added to all of those guards.
Introduce a hidden capability flag, ARM_A_PROFILE_AARCH32, selected by
both ARMV7_A and AARCH32_ARMV8_A, and migrate the shared guards to the
single CONFIG_ARM_A_PROFILE_AARCH32 symbol. Since the flag is selected
by exactly those two symbols, the guards are logically unchanged; a
future A-profile AArch32 variant now only needs to select the flag to
pick up the shared code paths.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Pei Cheng Sung <pc_sung@realtek.com>
Across the tree, I/DCACHE_LINE_SIZE is required at compile-time for
macros, compiler attributes, & linker scripts to function correctly
even if run-time cache line detection is available.
So remove the dependency of ICACHE_LINE_SIZE on
ICACHE_LINE_SIZE_DETECT=n, and of DCACHE_LINE_SIZE on
DCACHE_LINE_SIZE_DETECT=n.
DCACHE_LINE_SIZE_DETECT & ICACHE_LINE_SIZE_DETECT Kconfig options
enable querying some SoC register for finding the i/d-cache line size
at the expense of taking more memory and code and a slightly
increased boot time.
Add new hidden options D/ICACHE_LINE_SIZE_DETECT_SUPPORT only selected
by the software component (arch/SoC layer, driver) implementing the system
cache API.
Signed-off-by: Abderrahmane JARMOUNI <git@jarmouni.me>
USE_SWITCH isn't yet supported for a non-secure Zephyr image on
Cortex-M, as CONFIG_ARM_STORE_EXC_RETURN is not implemented.
Prevent such a non-functional build by only selecting
USE_SWITCH_SUPPORTED if Zephyr is not running as non-secure.
(USE_SWITCH is fine if Zephyr is running as secure or if there
is no security extension.)
Signed-off-by: Laurie Fay <Laurie.Fay@arm.com>
Vendor HAL interrupt handlers are often entered without their vector
number and have to discover it themselves. On Cortex-M the IPSR
register answers that, but on Cortex-A/R with a GIC the INTID exists
only at acknowledge time inside the ISR wrapper. The Renesas RZ SoCs
work around this today by selecting ARM_CUSTOM_INTERRUPT_CONTROLLER
with pass-through z_soc_irq_* wrappers around the standard GIC driver,
purely to intercept the ack/eoi moments and log the INTID into a
fixed-depth side stack for the FSP HAL, duplicated across six SoCs.
Add k_irq_get_active(), backed by arch_irq_get_active(): the
interrupt line whose handler is executing on the current CPU, or
K_IRQ_ACTIVE_NONE outside interrupt context. The capability symbol
ARCH_HAS_IRQ_GET_ACTIVE only promises the query; whether an
architecture reads it from a register or records it in the dispatch
path is its own business.
On Cortex-A/R recording is the only option, so the implementation is
gated behind an arch-level opt-in, ARM_TRACK_ACTIVE_IRQ, keeping the
cost decision where the cost lives: the shared ISR wrapper publishes
the acknowledged INTID in a per-CPU field of _cpu_arch and keeps the
previous value on the exception stack across the dispatch, so nested
interrupts unwind to the preempted INTID and the outermost exit back
to "none". The stored value is biased by one so the zero-initialized
boot state reads as "none" on every CPU without explicit
initialization, including secondary SMP cores. The wrapper records
whatever get_active returned, so it works with both the GIC and a
custom interrupt controller. Cost is zero when the option is off and
a few instructions per interrupt entry and exit when on.
Assisted-by: Claude:claude-fable-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Drivers that need to touch an interrupt's latched pending state
currently reach into the interrupt controller themselves.
NVIC_ClearPendingIRQ() alone appears at 88 call sites across 50 files
under drivers/, NVIC_SetPendingIRQ() at 34 (26 of them in
drivers/counter/, which pends its own IRQ to fire an alarm whose
deadline has already passed) and NVIC_GetPendingIRQ() at 11. Each
site pulls cmsis_core.h and a CONFIG_CPU_CORTEX_M guard into
otherwise portable code, and several counter drivers had already
written private GIC-or-NVIC dispatch helpers for exactly these
operations.
Add k_irq_set_pending(), k_irq_clear_pending() and k_irq_is_pending()
as ALWAYS_INLINE wrappers over matching arch_irq_* functions, and
implement them for the ARM NVIC (AArch32 Cortex-M) and the GIC
(AArch32 Cortex-A/R and AArch64), where the GIC driver already
exported all three as arm_gic_irq_*.
The k_ prefix is deliberate: vendor HAL headers already declare
plain irq_set_pending()/irq_clear_pending() as their own functions
(the Realtek Ameba ROM ABI, pico-sdk's hardware/irq.h), and several
drivers carry private static helpers or API struct members with the
bare names. A namespaced API collides with none of them, needs no
macro tricks, and no renaming of existing code.
The operations are gated on a single capability symbol,
CONFIG_ARCH_HAS_IRQ_PENDING_OPS, so an unported target fails to
build instead of silently doing nothing. Both implemented backends
support all three operations; should an architecture with partial
support materialize (a RISC-V PLIC can report pending state but only
clears it by claiming, and cannot latch from software), the symbol
can be split then.
Assisted-by: Claude:claude-fable-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Remove CONFIG_PLATFORM_SPECIFIC_INIT and its z_arm_platform_init() hook,
deprecated in favour of CONFIG_SOC_RESET_HOOK / soc_reset_hook() well
before Zephyr 4.2 and therefore due for removal in 4.5.
The option had no reader left: neither cortex_m/reset.S nor
cortex_a_r/reset.S tests it, both only branch to soc_reset_hook(). Its
single in-tree selector, soc/renode/cortex_r8_virtual, is migrated to
select SOC_RESET_HOOK and its hook renamed to soc_reset_hook(); the body
is unchanged. Note that this re-activates the SCTLR.V clear on that SoC,
which had silently been dead code since the reset paths stopped calling
z_arm_platform_init() - the SoC now again selects the low exception
vector base as originally intended. It runs slightly later in the reset
sequence, after the per-mode stack pointers are set up. This should be
smoke-tested under Renode.
The stale z_arm_platform_init mention in the IAR linker script helper
comment is updated to soc_reset_hook.
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Assisted-by: Claude:opus-5
Add 'config CPU_CORTEX_A5' to arch/arm/core/cortex_a_r/Kconfig file.
Set 'GCC_M_CPU' to 'cortex-a5' in cmake/gcc-m-cpu.cmake for the
compiler.
Signed-off-by: Tony Han <tony.han@microchip.com>
The CFSR register uses write-1-to-clear semantics for all fault
status bits per the ARMv7-M/ARMv8-M Architecture Reference Manual.
Two locations in the MemManage and BusFault handlers incorrectly
used `&= ~Msk` (write-0) instead of `= Msk` (write-1), which has
no effect on these sticky bits.
This caused stale VALID bits to persist, leading subsequent fault
handlers to read expired MMFAR/BFAR addresses and potentially
misdiagnose stack overflows.
Fixeszephyrproject-rtos/zephyr#113515
Signed-off-by: Hongquan Li <hongquan.li@processmission.com>
We already determine whether the target is PMSAv8 or (PMSAv6/PMSAv7)
using the selected architecture profile (ARMv6-M/ARMv7-M or ARMv8-M
Baseline/Mainline) and define a symbol accordingly. Make use of that
symbol everywhere instead of repeating CPU checks all over arch code.
While at it, drop the allowlist which generated a build error when the
MPU was enabled on an "unknown" CPU. The header is only included from
SoC-specific code which knows whether an MPU exists or not, or generic
code gated behind CONFIG_ARM_MPU, which guarantees that the MPU exists
as CONFIG_ARM_MPU depends on CONFIG_CPU_HAS_ARM_MPU.
Note: this tangentially fixes a bug that misclassified ARMv8-R targets
as using the PMSAv6/PMSAv7 MPU. This bug did not seem to have any
adverse effect though...
Signed-off-by: Mathieu Choplain <mathieu.choplain-ext@st.com>
The loop loaded s[counter] before checking counter == maxsize, so it
read s[maxsize] when the first maxsize bytes were all non-NUL and
dereferenced s[0] when maxsize == 0, violating the strnlen()
semantics required by arch_user_string_nlen(). The over-read byte
cannot change the returned length, but if it is not accessible the
exception fixup reports a spurious error and callers reject valid
input with EFAULT.
Check the limit before the load instead.
Fixeszephyrproject-rtos/zephyr#113722
Signed-off-by: Hongquan Li <hongquan.li@processmission.com>
This reverts commit c18885e95f:
the issue that this commit worked around was fixed in the
previous commit by preserving the original stack alignment.
Signed-off-by: Laurie Fay <Laurie.Fay@arm.com>
Preserve the alignment indication and rebuild the hardware frame with its
padding word to ensure the stack is always 8-byte aligned when returning
from exception: this is required on Armv8-M.
When an exception is taken with a stack pointer that is not 8-byte
aligned, Armv8-M, and Armv7-M when configured, adds a 4-byte padding word
to align the exception frame. Bit 9 of xPSR records the presence of this
padding.
However, arm_m_switch_to_cpu() does not restore the padding word when
rebuilding the hardware frame. The existing workaround clears the xPSR
alignment bit, which is sufficient on Armv7-M but is invalid on Armv8-M.
Signed-off-by: Laurie Fay <Laurie.Fay@arm.com>
Declare dummy as a read-write output operand, to reflect how it
is used in the assembly block.
The inline assembly overwrites dummy before reading it, but declares the
operand as input-only. The compiler may therefore assume that the backing
register is unchanged and reuse it for another live value, even though the
assembly clobbers it.
Signed-off-by: Laurie Fay <Laurie.Fay@arm.com>
Add a Cortex-M perf backend that samples interrupted context from the
SysTick exception frame.
Install a SysTick wrapper when stack-sampling perf is enabled and
capture the interrupted stack pointer, EXC_RETURN, and r7 on exception
entry. Validate the complete hardware-stacked frame, including optional
alignment padding and extended FP state, against the Thread-mode or
Handler-mode stack before unwinding with arch_stack_walk().
The Arm stack walker uses EHABI unwind tables, so the backend does not
require CONFIG_FRAME_POINTER. Preserve r7 because EHABI unwind recipes
may use it to recover VSP even when frame pointers are not enabled
globally.
Return -EAGAIN when the interrupted context is invalid or unavailable
so the perf core discards that sample without reporting buffer
exhaustion.
Limit the backend to uniprocessor configurations because its captured
sample state is global and remote SMP sampling does not enter the
SysTick wrapper.
Disable the backend for Non-secure Trusted Execution images. A
Non-secure SysTick can be taken while the core executes Secure code,
but Non-secure firmware cannot access the Secure exception frame.
The stack pointer read by the wrapper instead refers to the suspended
Non-secure context, so it cannot be unwound as the interrupted frame.
Sampling across Security states is unsupported.
Signed-off-by: Sudan Landge <sudan.landge@arm.com>
Cortex-M exception frames can be stacked on MSP when execution is
interrupted in handler mode. The Arm EHABI stack walker currently seeds
VSP from the saved PSP unconditionally, which only works for frames
stacked on PSP.
Select the exception frame stack pointer from EXC_RETURN.SPSEL so
MSP-backed frames seed the unwinder from extra_info.msp, while preserving
the existing PSP path. This also allows perf sampling backends to unwind
handler-mode call chains captured on MSP.
Signed-off-by: Sudan Landge <sudan.landge@arm.com>
Otherwise, "warning: implicit declaration of function 'dump_fault'" is
generated, which may be promoted to an error when also using
CONFIG_COMPILER_WARNINGS_AS_ERRORS=y.
Some variables may be unused when the dump_fault isn't called, so mark them
as unused to avoid warnings.
Signed-off-by: Phil Hindman <phindman@xes-inc.com>
Commit 2222fa1426 removed all callers of
the function arm_core_mpu_mem_partition_config_update()... but not the
function itself, which became dead code lingering in tree since then...
Get rid of this function - it has served no purpose for long enough.
Signed-off-by: Mathieu Choplain <mathieu.choplain-ext@st.com>
Rename pm_s2ram.S to pm_s2ram_asm.S and update the
Cortex-M source list to reference the new filename.
This avoids generating colliding object paths for the
C and assembly suspend-to-RAM sources when both are
built together.
Assisted-by: GitHub Copilot:GPT-5.4
Signed-off-by: Evan Chen <bugena123@gmail.com>
Code using this header is only built when CONFIG_ARM_MPU=y so it isn't
necessary to gate the header's declarations behind that option.
Signed-off-by: Mathieu Choplain <mathieu.choplain-ext@st.com>
`arm_core_mpu_dev.h` is the header describing the API that must be
implemented by drivers compatible with the core. Some functions were
were however accessed using an extern declaration inside the ARM MPU
Core module instead of a declaration in the API header.
Move the offending functions to the API header, making the extern
declaration unnecessary. While at it, also make `z_arm_mpu_init()`
part of the header because it is required, even if not consumed by
the ARM MPU Core module itself.
Signed-off-by: Mathieu Choplain <mathieu.choplain-ext@st.com>
XN on device-type regions only protects mapped regions; unmapped holes
in the MPU map remain reachable through the PRIVDEFENA background map,
both by Cortex-M7 speculative instruction fetches (Cortex-M7 TRM) and
by PLD linefills to faulting addresses (erratum 1013783, SDEN-1068427,
all M7 revisions).
Add opt-in CONFIG_ARM_MPU_CM7_UNMAPPED_REGION to program region 0 as a
4GB Strongly-ordered, no-access, Execute-Never catch-all, as
recommended by the erratum workaround; static regions start from
region 1 and take precedence. Opt-in because the catch-all defeats the
PRIVDEFENA background map: the static MPU region table must explicitly
cover all memory the firmware uses.
Signed-off-by: Lucien Zhao <lucien.zhao@nxp.com>
Header file include/zephyr/sys_clock.h is deprecated and will be removed
someday. Update the whole file tree to include zephyr/sys/clock.h
straight instead of zephyr/sys_clock.h.
This change was made running the sed shell command below:
$ sed -i 's/zephyr\/sys_clock\.h/zephyr\/sys\/clock\.h/' \
`grep -rsl "zephyr/sys_clock\.h" arch/`
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Add support for stacktrace of threads. The shell command
"kernel unwind <thread_ptr>" now works.
Signed-off-by: Mike J. Chen <mjchen@google.com>
Co-authored-by: Filip Kokosinski <fkokosinski@antmicro.com>
Signed-off-by: Filip Kokosinski <fkokosinski@antmicro.com>
Mapping large memory regions at the soc level will consume too
many l2 entries, adding l1 section mapping functionality to
reduce excessive use of l2 entries.
Signed-off-by: CHEN Xing <xing.chen@microchip.com>
arm_cpu_boot_params stack pointer fields used pointer arithmetic on
two-dimensional K_KERNEL_STACK_ARRAY_DECLARE arrays before casting to
char *, producing invalid initialized pointer values.
Use K_KERNEL_STACK_BUFFER() on the CPU 0 stack elements instead,
matching the runtime initialization in arch_cpu_start().
Fixes#113125
Signed-off-by: Hongquan Li <hongquan.li@processmission.com>
z_main_thread is only needed if multithreading is enabled, so move its
definition inside a multithreading check.
Signed-off-by: Josh DeWitt <josh.dewitt@garmin.com>
Commit f5a1585426 removed the extra
pointers for the IAR toolchain tls pointer setup. Update the size
returned from arch_tls_stack_setup to keep in sync with the tls pointer.
Signed-off-by: Josh DeWitt <josh.dewitt@garmin.com>
The architecture idle paths call sys_trace_idle() and
sys_trace_idle_exit() to notify subscribers when the CPU enters and
leaves the idle state. These calls were guarded by CONFIG_TRACING,
which tied idle-time accounting to the tracing subsystem even though
no tracing backend is required to service the hooks.
Introduce a hidden Kconfig symbol, SYS_IDLE_HOOKS, that any subsystem
needing these notifications can select, and have TRACING select it.
Switch the idle-path guards in every architecture and SoC that emits
the hooks from CONFIG_TRACING to CONFIG_SYS_IDLE_HOOKS. Because
TRACING selects the new symbol, existing tracing behaviour is
unchanged; the change only lets non-tracing consumers receive the
hooks.
This is a prerequisite for building the CPU load module without the
tracing subsystem.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
The Cortex-M arch cache backend exposed sys_cache_data_invd_all()
through CMSIS SCB_InvalidateDCache(). That routine invalidates the whole
D-cache by set/way, which unconditionally discards every dirty line,
including cache lines holding the current call stack and other runtime
state. Doing this while Zephyr is running can therefore drop the
caller's own return address and stack frame, corrupting execution and
hanging the cache API test on i.MX RT Cortex-M7 platforms. A prior
sys_cache_data_flush_all() does not help, because the stack is dirtied
again after the flush and during the invalidate itself.
Report the operation as unsupported instead. The cache API permits
-ENOTSUP for unsupported operations, and the whole-cache clean and
clean-invalidate paths remain available for callers that need safe
maintenance.
Reproduced on mimxrt1064_evk/mimxrt1064 with tests/arch/common/cache
(J-Link, COM42): with the original implementation the test flushed
successfully and then hung inside sys_cache_data_invd_all() at
"START - test_data_cache_api"; with this change the operation returns
-ENOTSUP and the suite reports PROJECT EXECUTION SUCCESSFUL. Also built
the same test for mimxrt1170_evk/mimxrt1176/cm7.
Signed-off-by: Holt Sun <holt.sun@nxp.com>
The Cortex-A/R interrupt wrapper enables IRQs to support nested interrupt
handling while running the registered ISR.
Move cpsie i after the spurious IRQ check so only valid ISR calls run
with IRQs enabled, and add cpsid i after the ISR returns. This prevents
EOI and z_arm_int_exit() from running with IRQs enabled.
Signed-off-by: Andrei-Edward Popa <andrei.popa105@yahoo.com>
When Secure firmware handles a fault with a recovered Non-Secure
exception frame, keep that context through fault classification.
Use it when reporting SecureFaults so the dump makes clear that the
fault originated in Non-Secure state and escalated into Secure state.
Also include guidance for the missing or disabled Non-Secure fault
handler case, where this escalation is commonly seen.
Handle the unexpected case where an exception frame cannot be recovered
without relying on __ASSERT(). Report the failure through the fault log
and terminate through z_arm_fatal_error(), so the path remains fatal
even when assertions are disabled.
Signed-off-by: Sudan Landge <sudan.landge@arm.com>
The fault assembly wrapper saves r4-r11 after exception entry. When
EXC_RETURN says callee stacking was skipped, the processor has already
saved the interrupted Secure r4-r11 in the Secure additional context
block, so the wrapper's live r4-r11 are not the interrupted values.
Keep a pointer to the skipped Secure additional context and use it to
populate extra_info.callee when available, so fault dumps and other ESF
consumers report the interrupted Secure context.
Signed-off-by: Sudan Landge <sudan.landge@arm.com>
Secure exception entry can place an integrity signature and additional
Secure context at the top of the stack before the basic exception frame.
Detect that signature when resolving the ESF and skip the additional
context before casting the stack pointer to struct arch_esf.
When EXC_RETURN says callee stacking was skipped, treat a missing
integrity signature as an invalid frame instead of silently using the
original stack pointer as the ESF. This avoids reporting misleading
fault state when the Secure stack shape is inconsistent or corrupt.
Signed-off-by: Sudan Landge <sudan.landge@arm.com>
Fix a compilation error when CONFIG_EXTRA_EXCEPTION_INFO is enabled
on platforms that do not define EXC_RETURN_STACK_FRAME_TYPE_Msk
(which is only defined for Cortex-M).
For Cortex-A/R devices we just default to the same code path as before
bce6f0de63
Signed-off-by: Alberto Escolar Piedras <alberto.escolar.piedras@nordicsemi.no>
Check the exc_return flags to determine if the FPU registers were actually
pushed onto the stack by the exception handler and only dump them if they
are used. Otherwise the stack locations for the FPU registers are invalid
and we're just dumping garbage.
Signed-off-by: Mike J. Chen <mjchen@google.com>
Add CONFIG_ARM_MPU_SKIP_ARCH_INIT for platforms where early boot code
(for example a TCM-resident stub) enables the MPU before z_arm_mpu_init()
runs. On Versal RPU split TCM/OCM images the kernel is linked in OCM while
reset code runs from TCM; z_arm_mpu_init() must not disable and reprogram
the MPU while the CPU is executing from an OCM-only region map.
When SCTLR.M is already set, z_arm_mpu_init() records the SoC static MPU
region count in static_regions_num and returns without touching the live
region table. That preserves the boot-time map (TCM, peripherals, OCM)
and keeps vector fetches at 0x0 executable after relocation.
SoCs that need this behavior select CONFIG_ARM_MPU_SKIP_ARCH_INIT from
their Kconfig; no Versal-specific logic is added under arch/.
Signed-off-by: Appana Durga Kedareswara rao <appana.durga.kedareswara.rao@amd.com>
Implement CONFIG_INIT_STACKS for the main stack when
CONFIG_MULTITHREADING is disabled. This keeps the config behavior
consistent between the main stack and the interrupt stack which is
memset in reset.S.
Signed-off-by: Josh DeWitt <josh.dewitt@garmin.com>
The ARM zImage header (header.S) ends with three words that follow
the Linux self-decompressor convention:
.long 0x016f2818 // Magic number
.long __rom_region_start // start address of zImage
.long __end // end address of zImage
A standard ARM zImage consumer (e.g. U-Boot bootz, or the Xen arm32
kernel loader) reads the third word and computes the on-disk file
size of the zImage as (__end - __rom_region_start). Linux establishes
the same invariant in arch/arm/boot/compressed/head.S, where the
analogous field is encoded as "_edata - start", i.e. the LMA of the
last byte of the image relative to its load address.
The current zimage_header.ld emits __end with:
KEEP(*(.image_header))
KEEP(*(.".image_header.*"))
__end = .;
zimage_header.ld is plugged into the linker script via the ROM_START
hook (see arch/arm/core/CMakeLists.txt) and runs immediately after
the 48-byte .image_header section is placed. At that point '.' is
still just past the header, so __end ends up only 0x30 bytes past
__rom_region_start regardless of how large the actual image is.
Every zImage built with CONFIG_ARM_ZIMAGE_HEADER=y therefore
advertises a size of 48 bytes in its header.
For Zephyr standalone this is invisible: the FVP / debugger loads
the whole file unconditionally and never consults the header. It
breaks any consumer that honours the header, though. On a Cortex-R52
FVP under Xen dom0less, the guest fails to boot:
(XEN) Loading zImage from 11000000 to 30000000-30000030
(XEN) CPU0: Unexpected Trap: Undefined Instruction
Xen copied only the 48 header bytes into the DomU and the guest
branched into uninitialised memory.
Fix it by computing __end the way Linux's head.S computes _edata:
take the LMA of the very last output section. Zephyr already exposes
that anchor as .last_section, and uses
LOADADDR(.last_section) + SIZEOF(.last_section)
elsewhere for the same purpose (e.g. _flash_used in
include/zephyr/arch/arm/cortex_a_r/scripts/linker.ld and the
equivalent cortex_m / arm64 / riscv linker scripts). The expression
is resolved lazily by the linker at final link time, so referring
to it from a ROM_START fragment that runs before .last_section is
emitted is safe.
After this change, a build of samples/hello_world for
fvp_baser_aemv8r/fvp_aemv8r_aarch32 with -DCONFIG_ARM_ZIMAGE_HEADER=y
produces a 27268-byte zephyr.bin whose header reads:
magic = 0x016f2818
start = 0x30000000
end = 0x30006a84 (end - start == file size)
`file(1)` now identifies it as "Linux kernel ARM boot executable
zImage", U-Boot bootz accepts it without complaint, and the same
binary boots cleanly as a Xen R52 dom0less DomU using Xen's standard
zImage loader path (no special payload-only handling required).
Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Signed-off-by: Satya Sri <satyasri.katru@amd.com>
Fix the MCR instruction in switch.S to use the 'p15' coprocessor prefix
required by ARMv7-A toolchains.
Signed-off-by: Chidvilas Yerramsetti <cyerrams@qti.qualcomm.com>
Use <> operator to include a Zephyr header file instead of "" that
is intended to local header files, not header files relative to
specifically defined search paths.
This change was made running the sed shell command below:
$ sed -i -E 's/#include "zephyr\/([^"]+)\.h"/#include <zephyr\/\1.h>/g' \
`grep -rsl "#include \"zephyr/" arch/`
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
