Skip to content

Add ARM_AARCH64_ARMV9 port (SVE2, MTE, PAC, BTI) #1435

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rpcme wants to merge 12 commits into
base: main
Choose a base branch
from
Open

Add ARM_AARCH64_ARMV9 port (SVE2, MTE, PAC, BTI) #1435

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
c985868
Add ARM_AARCH64_ARMV9 port with SVE2 context switch
rpcme May 7, 2026
c23ed2d
armv9: implement per-task PAC keys, MTE heap redirect, BTI landing pads
rpcme Jun 15, 2026
d4a16e4
armv9: fix MTE tagged pointer handling in stack assertions
rpcme Jun 17, 2026
a84f510
armv9: reconcile critical section, add stack overflow MTE fix, per-ta…
rpcme Jun 18, 2026
c1b37ea
armv9: register port in CMake, fix Coverity/MISRA findings
rpcme Jun 23, 2026
d18a43e
armv9: optimize portASM.S barriers, ISB merge, IRQ register save
rpcme Jun 24, 2026
294945f
armv9: document Armv9 port MISRA deviations in MISRA.md
rpcme Jun 24, 2026
f025e43
armv9: fix CI checks (spelling, header, unit test, formatting)
rpcme Jun 24, 2026
0454271
armv9: fix stack overflow method 2 watermark read for MTE
rpcme Jun 26, 2026
612f709
armv9: portASM.S: include FreeRTOSConfig.h so config guards work
rpcme Jul 22, 2026
a640688
armv9: portASM.S: move pointer-literal pool to .data for W^X loaders
rpcme Jul 22, 2026
c03b473
armv9: fix taskCHECK_FOR_STACK_OVERFLOW backslash alignment
rpcme Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/.cSpellWords.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1017,3 +1017,10 @@ XPSR
XRAM
xtal
XTENSA
ACLE
acle
APDA
APDB
REGEN
SSVE
SVCR
35 changes: 35 additions & 0 deletions MISRA.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,16 @@ with ( Assuming rule 8.4 violation; with justification in point 1 ):
grep 'MISRA Ref 8.4.1' . -rI
```

#### Dir 4.3

@AniruddhaKanhere AniruddhaKanhere Aug 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need to check the ports for MISRA violations. We generally use a mock interface for running the tests.


MISRA C:2012 Dir 4.3: Assembly language shall be encapsulated and isolated.

_Ref 4.3.1_
- AArch64 port files (portable/GCC/ARM_AARCH64_ARMV9/) use inline assembly
to access system registers (GIC, generic timer, PAC keys, MTE, SVE
configuration) that have no C-language equivalent. Assembly is confined to
the port layer and isolated from application code.

#### Dir 4.7

MISRA C:2012 Dir 4.7: If a function returns error information, then that error
Expand Down Expand Up @@ -116,6 +126,31 @@ _Ref 11.5.5_
because data storage buffers are implemented as uint8_t arrays for the
ease of sizing, alignment and access.

#### Rule 5.8

MISRA C:2012 Rule 5.8: Identifiers that define objects or functions with
external linkage shall be unique.

_Ref 5.8.1_
- The Armv9 port (portable/GCC/ARM_AARCH64_ARMV9/portmacro.h) defines macros
that redirect `pvPortMalloc` and `vPortFree` to MTE-tagged wrapper functions
when `configARMV9_MTE_HEAP == 1`. This keeps MTE heap tagging logic isolated
in the port without modifying shared upstream kernel files. An alternative
that eliminates this deviation (integrating tagging into heap_4.c) is
documented in the source.

#### Rule 11.6

MISRA C:2012 Rule 11.6: A cast shall not be performed between a pointer to void
and an arithmetic type.

_Ref 11.6.1_
- The Armv9 MTE port (portable/GCC/ARM_AARCH64_ARMV9/mte_port.c) casts
between pointer and uintptr_t to strip the MTE tag bits (top byte) from
tagged pointers before passing them to the underlying allocator. This is
required because MTE tags are encoded in pointer bits 56-59 and must be
removed to recover the canonical address.

#### Rule 14.3

MISRA C-2012 Rule 14.3: Controlling expressions shall not be invariant.
Expand Down
4 changes: 4 additions & 0 deletions include/FreeRTOS.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2748,6 +2748,10 @@
#define portTASK_USES_FLOATING_POINT()
#endif

#ifndef portSTRIP_ADDRESS_TAG
#define portSTRIP_ADDRESS_TAG( pxPointer ) ( pxPointer )
#endif

#ifndef portALLOCATE_SECURE_CONTEXT
#define portALLOCATE_SECURE_CONTEXT( ulSecureStackSize )
#endif
Expand Down
72 changes: 38 additions & 34 deletions include/stack_macros.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,10 @@
#define portSTACK_LIMIT_PADDING 0
#endif

#ifndef portSTRIP_ADDRESS_TAG
#define portSTRIP_ADDRESS_TAG( pxPointer ) ( pxPointer )
#endif

/* Stack overflow check is not straight forward to implement for MPU ports
* because of the following reasons:
* 1. The context is stored in TCB and as a result, pxTopOfStack member points
Expand All @@ -67,15 +71,15 @@
#if ( ( configCHECK_FOR_STACK_OVERFLOW == 1 ) && ( portSTACK_GROWTH < 0 ) && ( portUSING_MPU_WRAPPERS != 1 ) )

/* Only the current stack state is to be checked. */
#define taskCHECK_FOR_STACK_OVERFLOW() \
do \
{ \
/* Is the currently saved stack pointer within the stack limit? */ \
if( pxCurrentTCB->pxTopOfStack <= pxCurrentTCB->pxStack + portSTACK_LIMIT_PADDING ) \
{ \
char * pcOverflowTaskName = pxCurrentTCB->pcTaskName; \
vApplicationStackOverflowHook( ( TaskHandle_t ) pxCurrentTCB, pcOverflowTaskName ); \
} \
#define taskCHECK_FOR_STACK_OVERFLOW() \
do \
{ \
/* Is the currently saved stack pointer within the stack limit? */ \
if( portSTRIP_ADDRESS_TAG( pxCurrentTCB->pxTopOfStack ) <= pxCurrentTCB->pxStack + portSTACK_LIMIT_PADDING ) \
{ \
char * pcOverflowTaskName = pxCurrentTCB->pcTaskName; \
vApplicationStackOverflowHook( ( TaskHandle_t ) pxCurrentTCB, pcOverflowTaskName ); \
} \
} while( 0 )

#endif /* configCHECK_FOR_STACK_OVERFLOW == 1 */
Expand All @@ -84,37 +88,37 @@
#if ( ( configCHECK_FOR_STACK_OVERFLOW == 1 ) && ( portSTACK_GROWTH > 0 ) && ( portUSING_MPU_WRAPPERS != 1 ) )

/* Only the current stack state is to be checked. */
#define taskCHECK_FOR_STACK_OVERFLOW() \
do \
{ \
/* Is the currently saved stack pointer within the stack limit? */ \
if( pxCurrentTCB->pxTopOfStack >= pxCurrentTCB->pxEndOfStack - portSTACK_LIMIT_PADDING ) \
{ \
char * pcOverflowTaskName = pxCurrentTCB->pcTaskName; \
vApplicationStackOverflowHook( ( TaskHandle_t ) pxCurrentTCB, pcOverflowTaskName ); \
} \
#define taskCHECK_FOR_STACK_OVERFLOW() \
do \
{ \
/* Is the currently saved stack pointer within the stack limit? */ \
if( portSTRIP_ADDRESS_TAG( pxCurrentTCB->pxTopOfStack ) >= pxCurrentTCB->pxEndOfStack - portSTACK_LIMIT_PADDING ) \
{ \
char * pcOverflowTaskName = pxCurrentTCB->pcTaskName; \
vApplicationStackOverflowHook( ( TaskHandle_t ) pxCurrentTCB, pcOverflowTaskName ); \
} \
} while( 0 )

#endif /* configCHECK_FOR_STACK_OVERFLOW == 1 */
/*-----------------------------------------------------------*/

#if ( ( configCHECK_FOR_STACK_OVERFLOW > 1 ) && ( portSTACK_GROWTH < 0 ) && ( portUSING_MPU_WRAPPERS != 1 ) )

#define taskCHECK_FOR_STACK_OVERFLOW() \
do \
{ \
const uint32_t * const pulStack = ( uint32_t * ) pxCurrentTCB->pxStack; \
const uint32_t ulCheckValue = ( uint32_t ) 0xa5a5a5a5U; \
\
if( ( pxCurrentTCB->pxTopOfStack <= pxCurrentTCB->pxStack + portSTACK_LIMIT_PADDING ) || \
( pulStack[ 0 ] != ulCheckValue ) || \
( pulStack[ 1 ] != ulCheckValue ) || \
( pulStack[ 2 ] != ulCheckValue ) || \
( pulStack[ 3 ] != ulCheckValue ) ) \
{ \
char * pcOverflowTaskName = pxCurrentTCB->pcTaskName; \
vApplicationStackOverflowHook( ( TaskHandle_t ) pxCurrentTCB, pcOverflowTaskName ); \
} \
#define taskCHECK_FOR_STACK_OVERFLOW() \
do \
{ \
const uint32_t * const pulStack = ( uint32_t * ) pxCurrentTCB->pxStack; \
const uint32_t ulCheckValue = ( uint32_t ) 0xa5a5a5a5U; \
\
if( ( portSTRIP_ADDRESS_TAG( pxCurrentTCB->pxTopOfStack ) <= ( StackType_t * ) portSTRIP_ADDRESS_TAG( pxCurrentTCB->pxStack ) + portSTACK_LIMIT_PADDING ) || \
( pulStack[ 0 ] != ulCheckValue ) || \
( pulStack[ 1 ] != ulCheckValue ) || \
( pulStack[ 2 ] != ulCheckValue ) || \
( pulStack[ 3 ] != ulCheckValue ) ) \
{ \
char * pcOverflowTaskName = pxCurrentTCB->pcTaskName; \
vApplicationStackOverflowHook( ( TaskHandle_t ) pxCurrentTCB, pcOverflowTaskName ); \
} \
} while( 0 )

#endif /* #if( configCHECK_FOR_STACK_OVERFLOW > 1 ) */
Expand All @@ -134,7 +138,7 @@
\
pcEndOfStack -= sizeof( ucExpectedStackBytes ); \
\
if( ( pxCurrentTCB->pxTopOfStack >= pxCurrentTCB->pxEndOfStack - portSTACK_LIMIT_PADDING ) || \
if( ( portSTRIP_ADDRESS_TAG( pxCurrentTCB->pxTopOfStack ) >= pxCurrentTCB->pxEndOfStack - portSTACK_LIMIT_PADDING ) || \
( memcmp( ( void * ) pcEndOfStack, ( void * ) ucExpectedStackBytes, sizeof( ucExpectedStackBytes ) ) != 0 ) ) \
{ \
char * pcOverflowTaskName = pxCurrentTCB->pcTaskName; \
Expand Down
9 changes: 9 additions & 0 deletions portable/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,12 @@ add_library(freertos_kernel_port OBJECT
GCC/ARM_AARCH64_SRE/port.c
GCC/ARM_AARCH64_SRE/portASM.S>

# ARMv9-A port for GCC (SVE2, MTE, PAC, BTI)
$<$<STREQUAL:${FREERTOS_PORT},GCC_ARM_AARCH64_ARMV9>:
GCC/ARM_AARCH64_ARMV9/port.c
GCC/ARM_AARCH64_ARMV9/mte_port.c
GCC/ARM_AARCH64_ARMV9/portASM.S>

# ARMv6-M port for GCC
$<$<STREQUAL:${FREERTOS_PORT},GCC_ARM_CM0>:
GCC/ARM_CM0/port.c
Expand Down Expand Up @@ -1014,6 +1020,9 @@ target_include_directories(freertos_kernel_port_headers INTERFACE
$<$<STREQUAL:${FREERTOS_PORT},GCC_ARM_AARCH64>:${CMAKE_CURRENT_LIST_DIR}/GCC/ARM_AARCH64>
$<$<STREQUAL:${FREERTOS_PORT},GCC_ARM_AARCH64_SRE>:${CMAKE_CURRENT_LIST_DIR}/GCC/ARM_AARCH64_SRE>

# ARMv9-A port for GCC
$<$<STREQUAL:${FREERTOS_PORT},GCC_ARM_AARCH64_ARMV9>:${CMAKE_CURRENT_LIST_DIR}/GCC/ARM_AARCH64_ARMV9>

# ARMv6-M port for GCC
$<$<STREQUAL:${FREERTOS_PORT},GCC_ARM_CM0>:${CMAKE_CURRENT_LIST_DIR}/GCC/ARM_CM0>

Expand Down
79 changes: 79 additions & 0 deletions portable/GCC/ARM_AARCH64_ARMV9/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
# Armv9-A Architecture Port

This port extends the AArch64 SRE (System Register Enable) port with Armv9-A
architectural features. It targets processors implementing FEAT_SVE2, FEAT_MTE2,
FEAT_PAuth, FEAT_BTI, and FEAT_RME.

## Relationship to ARM_AARCH64_SRE

This port is based on `ARM_AARCH64_SRE` and shares the same GICv3 system
register interface and generic timer infrastructure. The Armv9 additions are
guarded by `configARMV9_*` configuration flags — when all flags are disabled
(default), this port behaves identically to the Armv8 SRE port.

**Note:** This port is currently maintained as a separate directory from
`ARM_AARCH64_SRE`. A future decision will determine whether to fold these
changes into the existing SRE port (behind `configARMV9_*` guards) or maintain
them as a distinct port. Until that decision is made, this directory exists
independently to avoid regression risk to the Armv8 user base.

## Configuration Flags

All flags default to 0 (disabled). Set in `FreeRTOSConfig.h`:

| Flag | Feature |
|------|---------|
| `configARMV9_SVE2` | SVE2 register save/restore (Z0-Z31, P0-P15, FFR) |
| `configARMV9_SSVE` | Streaming SVE mode (SVCR save/restore) |
| `configARMV9_TASK_VL` | Per-task vector length (ZCR_EL1) |
| `configARMV9_PAC` | Per-task PAC key loading |
| `configARMV9_PAC_FRAME` | PAC-signed saved context frame |
| `configARMV9_MTE_HEAP` | MTE-tagged heap allocations |
| `configARMV9_MTE_STACK` | MTE-tagged task stacks |
| `configARMV9_BTI` | BTI landing pads in port assembly |
| `configARMV9_RME` | Realm Management Extension |
| `configARMV9_RME_EL2` | EL2 hypervisor operation |

## Hardware Prerequisites

- `CPACR_EL1.ZEN = 3` (SVE access from EL1/EL0)
- `CPTR_EL3.EZ = 1` (no SVE trap from EL3)
- `ZCR_EL2` / `ZCR_EL1` configured for desired vector length
- `SCTLR_EL1.EnIA = 1` (PAC enabled)
- `SCR_EL3.API/APK = 1`, `HCR_EL2.API/APK = 1` (PAC not trapped)
- `SCTLR_EL1.ATA = 1` (MTE enabled)
- `TCR_EL1.TBI0 = 1` (Top Byte Ignore for MTE pointers)
- MMU with GP bit (BTI) and Tagged Normal memory (MTE)

## Files

| File | Description |
|------|-------------|
| `port.c` | Task initialization, tick handler, critical sections |
| `portASM.S` | Context switch macros with `#if configARMV9_SVE2` guards |
| `portmacro.h` | Type definitions, macros, config flag declarations |
| `README.md` | This file |

## Context Switch Frame Layout

### With `configARMV9_SVE2 = 0` (Armv8 compatible)
```
[SP] → FPU flag + critical nesting (16 bytes)
FPSR + FPCR (16 bytes)
Q0-Q31 (512 bytes)
SPSR + ELR (16 bytes)
X0-X30 (256 bytes)
```

### With `configARMV9_SVE2 = 1`
```
[SP] → FPU flag + critical nesting (16 bytes)
P0-P15 + FFR (3 × VL bytes, 16-byte aligned)
Z0-Z31 (32 × VL bytes)
FPSR + FPCR (16 bytes)
SPSR + ELR (16 bytes)
X0-X30 (256 bytes)
```

Total SVE frame at VL=128: 32×16 + 3×16 + 16 = 576 bytes
Total SVE frame at VL=256: 32×32 + 3×32 + 16 = 1136 bytes
Loading
Loading