Added Cortex-R52 port with Armv8-R AEM FVP example build (#579)

Added a ThreadX port for Arm Cortex-R52 with the GNU toolchain

Adds ports/cortex_r52/gnu together with a CMake build, an example build for the
freely available Armv8-R AEM FVP, and an automated test suite.

The port is EL2-aware by construction.  Cortex-R52 always implements EL2 and
resets into it, so the reset path configures EL2, installs both the EL2 and EL1
vector tables, and only then drops to EL1 to run the kernel.  Keeping that
structure from the start lets partitioning work reuse the boot path rather than
replace it; TX_R52_BOOT_AT_EL1 skips the EL2 stage where a vendor monitor has
already dropped privilege.

This is also the first R-profile port in the tree with a working CMake build.
cmake/cortex_a9.cmake exists but ports/cortex_a9/gnu/CMakeLists.txt is empty, so
no A- or R-profile port could be built this way before.

Contents:

  - Kernel port: 16 assembly sources plus tx_port.h, seeded from the
    Cortex-R5/GNU port.
  - Build: cmake/cortex_r52.cmake and the port CMakeLists.txt, with soft/hard
    float, VFP, FIQ and IRQ/FIQ nesting options.
  - Example BSP: EL2 to EL1 boot, GICv3, generic timer, PMSAv8-R MPU,
    semihosting and PL011 consoles.
  - Tests: six images registered with CTest, each judging itself and
    terminating the model.
  - tx_port_offset_check.c: compile-time assertions on the TX_THREAD offsets
    the assembly reaches by hard-coded displacement.  This is the same defect
    class fixed for Cortex-R4/R5 in #578; nothing in the toolchain ties those
    literals to the C structure.

Two facts were established by experiment rather than taken from documentation,
and are recorded in the code and the readme because both are traps:

  - PRBAR.AP bit order is reversed relative to th
    AArch64 macro set: the low bit is read-only and the high bit grants EL0
    access.  Programming four disjoint regions, one per encoding, and
    attempting a privileged write to each gave 0b
    and 0b10 allowed.  Using the AArch64 ordering
    as read-only and silently accept writes, because region coverage is still
    enforced: an unmapped address faults while a "read-only" region does not.
  - The generic timer PPI is INTID 30, recorded from ICC_IAR1 after enabling
    the whole PPI range 25-31, rather than assume

Model behaviour that a silicon port must revisit: the FVP leaves CNTFRQ at zero
with the system counter stopped, so the BSP programs both; CNTHCTL.PL1PCTEN,
CNTHCTL.PL1PCEN and ICC_HSRE must be set at EL2 or EL1 accesses trap; and
tx_thread_vfp_enable() sets only a per-thread software flag, so enabling the FPU
hardware (CPACR, FPEXC.EN) is the board support package's responsibility, not
the kernel's.  The FVP reports MIDR 0x410FD0F0, an architecture envelope model
rather than a Cortex-R52, so it validates architecture and not implementation.
Nothing in the port is gated on MIDR.

Changes outside ports/cortex_r52, three and all small: cmake/cortex_r52.cmake is
a new toolchain file; CMakeLists.txt gains enable_testing() at the top level,
without which add_test() in a subdirectory generat
the root never references, so ctest reports no tests from the build root; and
.gitignore covers build directories and __pycache__.

Verification: all six images build warning-free a
FVP_BaseR_AEMv8R in three configurations -- protection off, protection and
caches on, and both together with hard-float VFP.  Six build-option
combinations build clean and pass the tick-and-preemption demo at run time.

The tests assert behaviour rather than configuration, which is what caught the
problems above: the cooperative demo asserts the order of execution, because
counting alone cannot distinguish working context switches from one thread
running to completion, and the MPU test provokes real faults, because reading
SCTLR back only proves a bit was set.

The 96-test regression suite is host-side and pas
configurations on the Linux port.  It is not cross-run here: it validates
portable kernel logic, while the port-specific risk is the assembly, which the
FVP images exercise.  Structural coverage is therefore not claimed.

Deliberate deviations: passing a string literal to tx_thread_create reports a
discarded const qualifier from common/inc/tx_api.
CHAR *; demo_threadx.c keeps the shipped sample's int main() so the demo body
stays byte-identical to it; and the floating-point test compares exactly on
purpose, since a tolerance would mask a restored
wrong.

Not included: modules support, split-mode SMP and
support. The example targets the FVP only, and NXP S32Z280 bring-up is
separate work; the readme flags what to re-verify there.

Assisted-by: Claude Code (Opus 5) <[email protected]>

0 files changed, 0 insertions, 0 deletions