xtensa: build: add support for build with upstream llvm clang with binutils backend

arch/xtensa/Kconfig

@@ -92,6 +92,60 @@ config XTENSA_EXCEPTION_ENTER_GDB
 	  When an exception like invalid address access or division by zero is
 	  hit, enter the GDB stub.
 
+config XTENSA_ADSP_FATAL_BREADCRUMB
+	bool "Record fatal exception breadcrumbs in HP-SRAM window0"
+	depends on SOC_FAMILY_INTEL_ADSP
+	default y if XTENSA_ADSP_TRIPLE_FAULT_BREADCRUMB
+	help
+	  When a fatal exception is taken, record the faulting PC, exception
+	  cause, faulting virtual address and the faulting instruction word
+	  into HP-SRAM window0 via its uncached alias. The host SOF driver
+	  prints window0[0] as "Firmware state" and window0[1] as "status/error
+	  code" on an IPC timeout, so the crash information becomes visible
+	  in the host dmesg even when no console or mtrace output is available.
+	  Only the first fatal exception is latched so the original fault is
+	  preserved across a crash loop. This is a debug aid and should be
+	  left disabled in production builds.
+
+if XTENSA_ADSP_FATAL_BREADCRUMB
+
+choice XTENSA_ADSP_FATAL_BREADCRUMB_DATA
+	prompt "Fatal breadcrumb data selection"
+	default XTENSA_ADSP_FATAL_BREADCRUMB_DATA_CAUSE
+	help
+	  Select which exception diagnostic data to write into window0[1], which
+	  is printed as the "status/error code" in the host dmesg log.
+
+config XTENSA_ADSP_FATAL_BREADCRUMB_DATA_CAUSE
+	bool "Exception cause"
+	help
+	  Record the exception cause in window0[1].
+
+config XTENSA_ADSP_FATAL_BREADCRUMB_DATA_VADDR
+	bool "Faulting virtual address (excvaddr)"
+	help
+	  Record the faulting virtual address (excvaddr) in window0[1].
+
+config XTENSA_ADSP_FATAL_BREADCRUMB_DATA_A0
+	bool "Caller return address (a0)"
+	help
+	  Record the calling function's return address (a0) in window0[1].
+
+endchoice
+
+endif # XTENSA_ADSP_FATAL_BREADCRUMB
+
+config XTENSA_ADSP_TRIPLE_FAULT_BREADCRUMB
+	bool "Record triple fault breadcrumbs in HP-SRAM window0"
+	depends on SOC_FAMILY_INTEL_ADSP
+	default y
+	help
+	  When a double exception escalates to a triple fault (escaping the
+	  CPU), record the EPC1, double-exception EXCCAUSE, and DEPC into
+	  HP-SRAM window0 via its uncached alias. This is a lightweight
+	  tracing aid that can be enabled in production builds to diagnose
+	  fatal CPU locks and double faults.
+
 menu "Xtensa HiFi Options"
 
 config XTENSA_CPU_HAS_HIFI

arch/xtensa/core/CMakeLists.txt

@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 zephyr_cc_option(-mlongcalls)
+zephyr_cc_option(-mtext-section-literals)
 
 zephyr_library()
 
@@ -13,6 +14,7 @@ zephyr_library_sources(
   thread.c
   vector_handlers.c
   prep_c.c
+  popcount.c
   )
 
 zephyr_library_sources_ifdef(CONFIG_XTENSA_USE_CORE_CRT1 crt1.S)
@@ -41,9 +43,13 @@ if(CONFIG_SOC_FAMILY_ESPRESSIF_ESP32)
       -I${ZEPHYR_HAL_ESPRESSIF_MODULE_DIR}/components/xtensa/${CONFIG_SOC}/include
      )
 else()
-  set(XTENSA_CONFIG_HAL_INCLUDE_DIR
-      -I${ZEPHYR_XTENSA_MODULE_DIR}/zephyr/soc/${CONFIG_SOC}
-     )
+  set(XTENSA_CONFIG_HAL_INCLUDE_DIR)
+  if(EXISTS ${ZEPHYR_XTENSA_MODULE_DIR}/zephyr/soc/${CONFIG_SOC_TOOLCHAIN_NAME})
+    list(APPEND XTENSA_CONFIG_HAL_INCLUDE_DIR -I${ZEPHYR_XTENSA_MODULE_DIR}/zephyr/soc/${CONFIG_SOC_TOOLCHAIN_NAME})
+  endif()
+  if(EXISTS ${ZEPHYR_XTENSA_MODULE_DIR}/zephyr/soc/${CONFIG_SOC})
+    list(APPEND XTENSA_CONFIG_HAL_INCLUDE_DIR -I${ZEPHYR_XTENSA_MODULE_DIR}/zephyr/soc/${CONFIG_SOC})
+  endif()
 endif()
 
 add_subdirectory(startup)

arch/xtensa/core/crt1.S

@@ -37,8 +37,19 @@
 
 	.text
 	.align 4
+	.literal_position
 
 _start:
+#if XCHAL_HAVE_CP
+#ifdef CONFIG_XTENSA_LAZY_HIFI_SHARING
+	movi	a2, 0xFF & ~(1 << XCHAL_CP_ID_AUDIOENGINELX)
+#else
+	movi	a2, 0xFF
+#endif
+	wsr	a2, CPENABLE
+	rsync
+#endif
+
 	/*
 	 *  _start is typically NOT at the beginning of the text segment --
 	 *  it is always called from either the reset vector (__start) or other

arch/xtensa/core/elf.c

@@ -32,7 +32,7 @@
 #define R_XTENSA_ASM_EXPAND	11
 #define R_XTENSA_SLOT0_OP	20
 
 static int xtensa_elf_relocate(struct llext_loader *ldr, struct llext *ext,
 			       const elf_rela_t *rel, uintptr_t addr,
 			       uint8_t *loc, int type, uint32_t stb,
 			       const struct llext_load_param *ldr_parm)
@@ -78,26 +78,34 @@
 	case R_XTENSA_SLOT0_OP:
 		/* Apparently only actionable with LOCAL bindings */
 		;
-		elf_sym_t rsym;
-		int ret = llext_seek(ldr, ldr->sects[LLEXT_MEM_SYMTAB].sh_offset +
-				     ELF_R_SYM(rel->r_info) * sizeof(elf_sym_t));
+		uintptr_t link_addr;
 
-		if (!ret) {
-			ret = llext_read(ldr, &rsym, sizeof(elf_sym_t));
-		}
-		if (ret) {
-			LOG_ERR("Failed to read a symbol table entry, LLEXT linking might fail.");
-			return ret;
-		}
+		if (stb == STB_GLOBAL) {
+			link_addr = addr;
+		} else {
+			elf_sym_t rsym;
+			int ret = llext_seek(ldr, ldr->sects[LLEXT_MEM_SYMTAB].sh_offset +
+					     ELF_R_SYM(rel->r_info) * sizeof(elf_sym_t));
 
-		/*
-		 * So far in all observed use-cases
-		 * llext_loaded_sect_ptr(ldr, ext, rsym.st_shndx) was already
-		 * available as the "addr" argument of this function, supplied
-		 * by arch_elf_relocate_local() from its non-STT_SECTION branch.
-		 */
-		uintptr_t link_addr = (uintptr_t)llext_loaded_sect_ptr(ldr, ext, rsym.st_shndx) +
-			rsym.st_value + rel->r_addend;
+			if (!ret) {
+				ret = llext_read(ldr, &rsym, sizeof(elf_sym_t));
+			}
+			if (ret) {
+				LOG_ERR("Failed to read a symbol table entry, LLEXT linking might fail.");
+				return ret;
+			}
+
+			uintptr_t sec_addr;
+			if (rsym.st_shndx != SHN_UNDEF && rsym.st_shndx < ext->sect_cnt) {
+				elf_shdr_t *shdr = ext->sect_hdrs + rsym.st_shndx;
+				sec_addr = shdr->sh_addr &&
+					(!ldr_parm || !ldr_parm->section_detached || !ldr_parm->section_detached(shdr)) ?
+					shdr->sh_addr : (uintptr_t)llext_loaded_sect_ptr(ldr, ext, rsym.st_shndx);
+			} else {
+				sec_addr = 0;
+			}
+			link_addr = sec_addr + rsym.st_value + rel->r_addend;
+		}
 		ssize_t value = (link_addr - (((uintptr_t)got_entry + 3) & ~3)) >> 2;
 
 		/* Check the opcode */
@@ -143,15 +151,26 @@
 	int type = ELF32_R_TYPE(rel->r_info);
 	uintptr_t sh_addr;
 
-	if (ELF_ST_TYPE(sym->st_info) == STT_SECTION) {
-		elf_shdr_t *shdr = ext->sect_hdrs + sym->st_shndx;
-
-		/* shdr->sh_addr is NULL when not built for a specific address */
-		sh_addr = shdr->sh_addr &&
-			(!ldr_parm->section_detached || !ldr_parm->section_detached(shdr)) ?
-			shdr->sh_addr : (uintptr_t)llext_loaded_sect_ptr(ldr, ext, sym->st_shndx);
+	if (ldr->hdr.e_type == ET_REL) {
+		if (sym->st_shndx != SHN_UNDEF && sym->st_shndx < ext->sect_cnt) {
+			elf_shdr_t *shdr = ext->sect_hdrs + sym->st_shndx;
+			uintptr_t sec_addr = shdr->sh_addr &&
+				(!ldr_parm->section_detached || !ldr_parm->section_detached(shdr)) ?
+				shdr->sh_addr : (uintptr_t)llext_loaded_sect_ptr(ldr, ext, sym->st_shndx);
+			sh_addr = sec_addr + sym->st_value;
+		} else {
+			sh_addr = sym->st_value;
+		}
 	} else {
-		sh_addr = ldr->sects[LLEXT_MEM_TEXT].sh_addr;
+		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION) {
+			elf_shdr_t *shdr = ext->sect_hdrs + sym->st_shndx;
+
+			sh_addr = shdr->sh_addr &&
+				(!ldr_parm->section_detached || !ldr_parm->section_detached(shdr)) ?
+				shdr->sh_addr : (uintptr_t)llext_loaded_sect_ptr(ldr, ext, sym->st_shndx);
+		} else {
+			sh_addr = ldr->sects[LLEXT_MEM_TEXT].sh_addr;
+		}
 	}
 
 	return xtensa_elf_relocate(ldr, ext, rel, sh_addr, rel_addr, type,

arch/xtensa/core/gen_vectors.py

@@ -119,6 +119,6 @@
 print("    KEEP(*(.WindowVectors.text));")
 for s in sects:
     print(f"    KEEP(*(.{s}Vector.literal));")
-    print(f"    . = 0x{offsets[s]:x};")
+    print(f"    . = z_xtensa_vecbase + 0x{offsets[s]:x};")
     print(f"    KEEP(*(.{s}Vector.text));")
 print("  }")

arch/xtensa/core/popcount.c

@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: Apache-2.0
+ *
+ * Copyright (c) 2024 Intel Corporation
+ *
+ * __popcountsi2 — compiled with -mtext-section-literals (see CMakeLists.txt)
+ * so that all literal-pool entries are interleaved with the code and remain
+ * within l32r reach.  This overrides the precompiled libgcc version, whose
+ * separate .literal section can fall out of range when the image is large.
+ */
+
+int __popcountsi2(unsigned int x)
+{
+	x = x - ((x >> 1) & 0x55555555u);
+	x = (x & 0x33333333u) + ((x >> 2) & 0x33333333u);
+	x = (x + (x >> 4)) & 0x0f0f0f0fu;
+	return (int)((x * 0x01010101u) >> 24);
+}

arch/xtensa/core/ptables.c

@@ -431,6 +431,8 @@ static inline uint32_t *alloc_l2_table(void)
  * @param[in] attrs Page table attributes for the memory region.
  * @param[in] options Options for the memory region.
  */
+
+
 static void map_memory_range(const uint32_t start, const uint32_t end,
 			     const uint32_t attrs, const uint32_t options)
 {
@@ -465,6 +467,8 @@ static void map_memory_range(const uint32_t start, const uint32_t end,
 
 			init_page_table(l2_table, L2_PAGE_TABLE_NUM_ENTRIES, PTE_L2_ILLEGAL);
 
+
+
 			xtensa_kernel_ptables[l1_pos] =
 				PTE((uint32_t)l2_table, RING_KERNEL, XTENSA_MMU_PAGE_TABLE_ATTR);
 		}
@@ -476,7 +480,7 @@ static void map_memory_range(const uint32_t start, const uint32_t end,
 
 static void xtensa_init_page_tables(void)
 {
-	volatile uint8_t entry;
+	uint32_t entry;
 	static bool already_inited;
 
 	if (already_inited) {
@@ -527,6 +531,8 @@ void xtensa_mmu_init(void)
 {
 	xtensa_init_page_tables();
 
+
+
 	xtensa_mmu_init_paging();
 
 	/*

arch/xtensa/core/startup/reset_vector.S

@@ -79,6 +79,9 @@ _ResetHandler:
 	 *  section is in place (which is sometimes only after unpacking).
 	 */
 	.begin	no-absolute-literals
+#ifdef __clang__
+	.begin	auto-litpools
+#endif
 
 	/*
 	 * If we have dynamic cache way support, init the caches as soon
@@ -708,6 +711,9 @@ unpackdone:
 	.size	__start, . - __start
 #endif
 
+#ifdef __clang__
+	.end	auto-litpools
+#endif
 	.text
 	.global xthals_hw_configid0, xthals_hw_configid1
 	.global xthals_release_major, xthals_release_minor

arch/xtensa/core/userspace.S

@@ -114,7 +114,8 @@ _not_checking_user_context:
 	l32i a2, a1, 0
 	l32i a2, a2, ___xtensa_irq_bsa_t_a2_OFFSET
 	movi a0, K_SYSCALL_LIMIT
-	bgeu a2, a0, _bad_syscall
+	bltu a2, a0, _id_ok
+	j _bad_syscall
 
 _id_ok:
 	/* Find the function handler for the given syscall id. */

arch/xtensa/core/vector_handlers.c

@@ -19,6 +19,12 @@
 #include <xtensa_internal.h>
 #include <xtensa_stack.h>
 
+#if defined(CONFIG_XTENSA_ADSP_FATAL_BREADCRUMB)
+#include <adsp_memory.h>
+#include <mem_window.h>
+#include <zephyr/cache.h>
+#endif
+
 LOG_MODULE_DECLARE(os, CONFIG_KERNEL_LOG_LEVEL);
 
 extern char xtensa_arch_except_epc[];
@@ -564,6 +570,42 @@ void *xtensa_excint1_c(void *esf)
 
 	cause = bsa->exccause;
 
+#if defined(CONFIG_XTENSA_ADSP_FATAL_BREADCRUMB)
+	/* DEBUG breadcrumb: when no console/mtrace is available, record the
+	 * faulting PC/cause/vaddr into HP-SRAM window0 via its uncached alias.
+	 * The host SOF driver prints window0[0] as "Firmware state" and
+	 * window0[1] as "status/error code" on IPC timeout, so the crash PC
+	 * becomes visible in dmesg. Latch only the FIRST fatal exception so we
+	 * see the original fault, not the last in a crash loop. Skip level-1
+	 * interrupts which are not faults. win0[3] counts all exceptions.
+	 */
+	if (cause != EXCCAUSE_LEVEL1_INTERRUPT) {
+		volatile uint32_t *win0 = (volatile uint32_t *)sys_cache_uncached_ptr_get((void *)HP_SRAM_WIN0_BASE);
+
+		if (win0[0] < 0xa0000000U) {
+			win0[0] = (uint32_t)bsa->pc;
+#if defined(CONFIG_XTENSA_ADSP_FATAL_BREADCRUMB_DATA_VADDR)
+			win0[1] = (uint32_t)bsa->excvaddr;
+#elif defined(CONFIG_XTENSA_ADSP_FATAL_BREADCRUMB_DATA_A0)
+			win0[1] = (uint32_t)bsa->a0;
+#else
+			win0[1] = 0xe0000000U | ((uint32_t)cause & 0xffU);
+#endif
+			win0[2] = (uint32_t)bsa->excvaddr;
+		/* Only read the faulting instruction if the PC is within
+		 * the DSP SRAM range to avoid a double exception when the
+		 * exception was caused by a bad/unmapped function pointer.
+		 */
+		uint32_t fault_pc = (uint32_t)bsa->pc & ~3U;
+
+		if (fault_pc >= 0xa0000000U && fault_pc < 0xa2000000U) {
+			win0[4] = *(volatile uint32_t *)fault_pc;
+		}
+		}
+		win0[3]++;
+	}
+#endif
+
 	switch (cause) {
 	case EXCCAUSE_LEVEL1_INTERRUPT:
 #ifdef CONFIG_XTENSA_MMU
@@ -709,6 +751,19 @@ void *xtensa_excint1_c(void *esf)
 
 skip_checks:
 		if (reason != K_ERR_KERNEL_OOPS) {
+#if XCHAL_HAVE_CP
+			/* Enable all coprocessors before printing. LLVM generates
+			 * HiFi4 ae_* instructions in print_fatal_exception and
+			 * its callees (printk/LOG_ERR). If CPENABLE has the HiFi4
+			 * CP bit cleared (e.g. via lazy HiFi sharing on context
+			 * switch), those instructions trigger EXCCAUSE_CP_DISABLED
+			 * which becomes a double exception -> triple fault because
+			 * PS.EXCM is set inside the exception handler.
+			 */
+			unsigned int cp_all = (1U << XCHAL_CP_NUM) - 1U;
+
+			__asm__ volatile("wsr.cpenable %0\n\trsync" :: "r"(cp_all));
+#endif
 			print_fatal_exception(print_stack, is_dblexc, depc);
 		}
 #ifdef CONFIG_XTENSA_EXCEPTION_ENTER_GDB