0.8.0 —— trap 组补上一个动作,第四台机器实现了它

[Sunrisepeak]

0.8.0 — the trap group gains an action, and the fourth machine implements it

The primitive that was missing, and what showed it

arch_trap_set_handler lets a kernel SEE a trap; arch_trap_enable_interrupts
lets it MASK one. Neither can change what the trap returns to — and that is the
whole of preemption, which is the principal reason to use this layer on a
microcontroller at all.

void arch_trap_switch(arch_trap_frame* f, void* from, void* to);

Called from a handler. The interrupted context is saved through from, the trap
resumes to, and the call returns normally: the switch happens when the trap
does. It sits beside arch_context_switch, takes the same storage and the same
arch_context_init, and differs only in WHEN it takes effect.

examples/preempt found the gap. Its first version called arch_context_switch
from PendSV: it built, booted, and reported that neither of two tasks had ever
observed the other. Nothing failed — the tasks were simply never interleaved,
and only a counter neither task advanced itself told that apart from success.

⭐⭐ Four machines, and they do not implement it the same way

	how the trap resumes elsewhere
riscv64	a cooperative switch inside the dispatcher, mepc saved across it
aarch64	the same, ELR_EL1 and SPSR_EL1 saved across it
x86_64	the same, nothing to save — the iret frame travels with the stack
Cortex-M	not that at all: pend PendSV, taken by the hardware at exception exit

The first three work because the trap runs on the interrupted context's own
stack. M-profile's does not — the handler is on MSP while the task is on PSP —
so a cooperative swap there swaps the HANDLER's state and the exception return
unstacks a frame belonging to nobody. That difference is exactly what an
interface function earns its place by hiding.

⭐ And the mechanism M-profile does offer turns out to be the interface's own
sentence about the two primitives: PendSV pended from thread mode is taken AT
ONCE, pended from a handler it is taken WHEN THE HANDLER EXITS. So
arch_context_switch and arch_trap_switch on that backend are one instruction
sequence and the hardware supplies the difference.

⚠️ That forced the Cortex-M context layout to change. Two layouts — one for the
cooperative path, one for the preempted one — would let a kernel that mixed a
yield with a timer corrupt a context by resuming it through the other door,
silently, because both are just words. One mechanism, one layout, and the
example's probe resumes a trap-saved context with the cooperative call to say so.

The first partial backend

openarch-cortex-m declares openarch-backend and openarch:preemption, and
NOT openarch:address-space or openarch:percpu-register: M-profile has a
region-based MPU with no page-table entry to construct, and no TPIDR-class
register. A kernel that needs either is refused by name at resolution rather
than by a wall of undefined reference to arch_pte_* at link time. The three
application-class backends declare all four.

Splitting the capability is what made admitting the machine possible, and
openarch:preemption is what made it worth doing.

What is asserted, and where

• examples/switch gains a preemption probe on all three application machines:
  a breakpoint whose handler switches, and a counter the OTHER context advanced.
  A synchronous trap rather than a timer, so the probe stays one piece of code.
  Measured: a backend whose arch_trap_switch does nothing prints steps=0 and
  reaches every other assertion.
• examples/preempt runs in its own CI job on mps2-an385, because the gate
  matrix runs examples/switch, which needs the two capabilities this machine
  does not have. A gate with a branch in it stops being one.
• CI greps examples/preempt/src/main.cpp for assembly and fails if it returns.
  Thirty lines of hand-written PendSV are gone; if they come back, the primitive
  has stopped carrying its weight.

Also

• [xlings] deps → [xlings.workspace] in every example and the template.
• The engine pin moves to 2026.9.4.1, which is the release carrying the
  Cortex-M target rows. The OLDEST version this repository needs, not the
  newest that exists: pinning further ahead would make the repository
  unbuildable between a merge here and a release there.

Measured: 3/3 host tests; examples/switch on riscv64, aarch64 and x86_64;
examples/preempt on thumbv7m under xim:qemu-arm@9.2.4-1.