[soc:zx/soc 1/1] htmldocs: Documentation/arch/arm/zte/zx297520v3.rst:66: WARNING: Title underline too short.
kernel test robot
lkp at intel.com
Wed May 20 19:57:02 PDT 2026
tree: https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git zx/soc
head: 220ae5d36dba278003d265aabd080ffa78553f5a
commit: 220ae5d36dba278003d265aabd080ffa78553f5a [1/1] ARM: zte: Add zx297520v3 platform support
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
docutils: docutils (Docutils 0.21.2, Python 3.13.5, on linux)
reproduce: (https://download.01.org/0day-ci/archive/20260521/202605210401.8D6jRbz8-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp at intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605210401.8D6jRbz8-lkp@intel.com/
All warnings (new ones prefixed by >>):
WARNING: Documentation/ABI/testing/sysfs-class-reboot-mode-reboot_modes:36: abi_sys_class_reboot_mode_driver_reboot_modes doesn't have a description
WARNING: /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/os_mode is defined 2 times: Documentation/ABI/testing/sysfs-driver-hid-lenovo-go:364; Documentation/ABI/testing/sysfs-driver-hid-lenovo-go-s:234
WARNING: /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/os_mode_index is defined 2 times: Documentation/ABI/testing/sysfs-driver-hid-lenovo-go:373; Documentation/ABI/testing/sysfs-driver-hid-lenovo-go-s:243
WARNING: /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/touchpad/enabled is defined 2 times: Documentation/ABI/testing/sysfs-driver-hid-lenovo-go:636; Documentation/ABI/testing/sysfs-driver-hid-lenovo-go-s:252
WARNING: /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/touchpad/enabled_index is defined 2 times: Documentation/ABI/testing/sysfs-driver-hid-lenovo-go:645; Documentation/ABI/testing/sysfs-driver-hid-lenovo-go-s:261
>> Documentation/arch/arm/zte/zx297520v3.rst:66: WARNING: Title underline too short.
--
3. Building for built-in U-Boot
--------------------------- [docutils]
>> Documentation/arch/arm/zte/zx297520v3.rst:90: WARNING: Enumerated list ends without a blank line; unexpected unindent. [docutils]
>> Documentation/arch/arm/zte/zx297520v3.rst:116: WARNING: Inline literal start-string without end-string. [docutils]
Documentation/arch/arm/zte/zx297520v3.rst:137: ERROR: Unexpected indentation. [docutils]
>> Documentation/arch/arm/zte/zx297520v3.rst:138: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils]
Documentation/arch/arm/zte/zx297520v3.rst:164: WARNING: Inline literal start-string without end-string. [docutils]
>> Documentation/arch/arm/zte/zx297520v3.rst:164: WARNING: Inline interpreted text or phrase reference start-string without end-string. [docutils]
>> Documentation/arch/arm/zte/zx297520v3.rst:7: WARNING: Document or section may not begin with a transition. [docutils]
Documentation/arch/riscv/zicfilp.rst:79: WARNING: Inline literal start-string without end-string. [docutils]
Documentation/core-api/kref:328: ./include/linux/kref.h:72: WARNING: Invalid C declaration: Expected end of definition. [error at 96]
int kref_put_mutex (struct kref *kref, void (*release)(struct kref *kref), struct mutex *mutex) __cond_acquires(true# mutex)
------------------------------------------------------------------------------------------------^
Documentation/core-api/kref:328: ./include/linux/kref.h:94: WARNING: Invalid C declaration: Expected end of definition. [error at 92]
vim +66 Documentation/arch/arm/zte/zx297520v3.rst
6
> 7 ...............................................................................
8
9 Author: Stefan Dösinger
10
11 Date : 27 Jan 2026
12
13 1. Hardware description
14 ---------------------------
15 Zx297520v3 SoCs use a 64 bit capable Cortex-A53 CPU and GICv3, although they
16 run in arm32 mode only. The CPU has support EL3, but no hypervisor (EL2) and
17 it seems to lack VFP and NEON.
18
19 The SoC is used in a number of cheap LTE to WiFi routers, both battery powered
20 MiFis and stationary CPEs. In addition to the CPU these devices usually have
21 64 MB Ram (although some is shared with the LTE chip), 128 MB NAND flash, an
22 SDIO connected RTL8192-type Wifi chip limited to 2.4 ghz operation, USB 2,
23 and buttons. Devices with as low as 32 MB or as high as 128 MB ram exist, as
24 do devices with 8 or 16 MB of NOR flash.
25
26 Some devices, especially the stationary ones, have 100 mbit Ethernet and an
27 Ethernet switch.
28
29 Usually the devices have LEDs for status indication, although some have SPI or
30 I2C connected displays
31
32 Some have an SD card slot. If it exists, it is a better choice for the root
33 file system because it easily outperforms the built-in NAND.
34
35 The LTE interface runs on a separate DSP called ZSP880. It is probably derived
36 from LSI ZSPs and has an undocumented instruction set. The ZSP communicates
37 with the main CPU via SRAM and DRAM and a mailbox hardware that can generate
38 IRQs on either ends.
39
40 There is also a Cortex M0 CPU, which is responsible for early HW initialization
41 and starting the Cortex A53 CPU. It does not have any essential purpose once
42 U-Boot is started. A SRAM-Based handover protocol exists to run custom code on
43 this CPU.
44
45 2. Booting via USB
46 ---------------------------
47
48 The Boot ROM has support for booting custom code via USB. This mode can be
49 entered by connecting a Boot PIN to GND or by modifying the third byte on NAND
50 (set it to anything other than 0x5A aka 'Z'). A free software tool to start
51 custom U-Boot and kernels can be found here:
52
53 https://github.com/zx297520v3-mainline/zx297520v3-loader
54
55 If USB download mode is entered but no boot commands are sent through USB, the
56 device will proceed to boot normally after a few seconds. It is therefore
57 possible to enable USB boot permanently and still leave the default boot files
58 in place.
59
60 https://github.com/zx297520v3-mainline/u-boot-mainline
61
62 Contains an U-Boot version that can be used with the USB loader and sets up the
63 CPU and interrupt controller to comply with Linux's booting requirements.
64
65 3. Building for built-in U-Boot
> 66 ---------------------------
67 The devices come with an ancient U-Boot that loads legacy uImages from NAND and
68 boots them without a chance for the user to interrupt. The images are stored in
69 files ap_cpuap.bin and ap_recovery.bin on a jffs2 partition named imagefs,
70 usually mtd4. A file named "fotaflag" switches between the two modes.
71
72 In addition to the uImage header, those files have a 384 byte signature header,
73 which is used for authenticating the images on some devices. Most devices have
74 this authentication disabled and it is enough to pad the uImage files with 384
75 zero bytes.
76
77 Builtin U-Boot also poorly sets up the CPU. Read the next section for details
78 on this. It has no support for loading DTBs, so CONFIG_ARM_APPENDED_DTB is
79 needed.
80
81 So to build an image that boots from NAND the following steps are necessary:
82
83 1) Patch the assembly code from section 3 into arch/arm/kernel/head.S.
84 2) make zx29_defconfig
85 3) make [-j x]
86 4) cat arch/arm/boot/zImage arch/arm/boot/dts/zte/[device].dtb > kernel+dtb
87 5) mkimage -A arm -O linux -T kernel -C none -a 0x20008000 -d kernel+dtb uimg
88 6) dd if=/dev/zero bs=1 count=384 of=ap_recovery.bin
89 7) cat uimg >> ap_recovery.bin
> 90 8) Place this file onto imagefs on the device. Delete ap_cpuap.bin if the
91 free space is not enough.
92 9) Create the file fotaflag: echo -n FOTA-RECOVERY > fotaflag
93
94 For development, booting ap_recovery.bin is recommended because the normal boot
95 mode arms the watchdog before starting the kernel.
96
97 4. CPU and GIC Setup
98 ---------------------------
99
100 Generally CPU and GICv3 need to be set up according to the requirements spelled
101 out in Documentation/arch/arm64/booting.rst. For zx297520v3 this means:
102
103 1. GICD_CTLR.DS=1 to disable GIC security
104 2. Enable access to ICC_SRE
105 3. Disable trapping IRQs into monitor mode
106 4. Configure EL2 and below to run in insecure mode.
107 5. Configure timer PPIs to active-low.
108
109 The kernel sources provided by ZTE do not boot either (interrupts do not work
110 at all). They are incomplete in other aspects too, so it is assumed that there
111 is some workaround similar to the one described in this document somewhere in
112 the binary blobs.
113
114 The assembly code below is given as an example of how to achieve this:
115
> 116 ```
117 #include <linux/irqchip/arm-gic-v3.h>
118 #include <asm/assembler.h>
119 #include <asm/cp15.h>
120
121 @ Detect sane bootloaders and skip the hack
122 ldr r3, =0xf2000000
123 ldr r3, [r3]
124 ldr r4, =(GICD_CTLR_ARE_NS | GICD_CTLR_DS)
125 cmp r3, r4
126 beq skip_zx_hack
127 @ This allows EL1 to handle ints hat are normally handled by EL2/3.
128 ldr r3, =0xf2000000
129 str r4, [r3]
130
131 cps #MON_MODE
132
133 @ Work in non-secure physical address space: SCR_EL3.NS = 1. At least the UART
134 @ seems to respond only to non-secure addresses. I have taken insipiration from
135 @ Raspberry pi's armstub7.S here.
136 mov r3, #0x131 @ non-secure, Make F, A bits in CPSR writeable
137 @ Allow hypervisor call.
> 138 mcr p15, 0, r3, c1, c1, 0
139
140 @ AP_PPI_MODE_REG: Configure timer PPIs (10, 11, 13, 14) to active-low.
141 ldr r3, =0xF22020a8
142 ldr r4, =0x50
143 str r4, [r3]
144 ldr r3, =0xF22020ac
145 ldr r4, =0x14
146 str r4, [r3]
147
148 @ Enable EL2 access to ICC_SRE (bit 3, ICC_SRE_EL3.Enable). Enable system reg
149 @ access to GICv3 registers (bit 0, ICC_SRE_EL3.SRE) for EL1 and EL3.
150 mrc p15, 6, r3, c12, c12, 5 @ ICC_SRE_EL3
151 orr r3, #0x9 @ FIXME: No defines for SRE_EL3 values?
152 mcr p15, 6, r3, c12, c12, 5
153 mrc p15, 0, r3, c12, c12, 5 @ ICC_SRE_EL1
154 orr r3, #(ICC_SRE_EL1_SRE)
155 mcr p15, 0, r3, c12, c12, 5
156
157 @ Like ICC_SRE_EL3, enable EL1 access to ICC_SRE and system register access
158 @ for EL2.
159 mrc p15, 4, r3, c12, c9, 5 @ ICC_SRE_EL2 aka ICC_HSRE
160 orr r3, r3, #(ICC_SRE_EL2_ENABLE | ICC_SRE_EL2_SRE)
161 mcr p15, 4, r3, c12, c9, 5
162 isb
163
> 164 @ Back to SVC mode
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
More information about the linux-arm-kernel
mailing list