Eliminate measured boot-time hot paths

Trace evidence (kernel_summary.txt top symbols) drove four targeted
changes plus a methodology fix.  Together they cut matched_kernel_blocks
by 8.4% (3,384,139 -> 3,100,408) and shift PGO concentration over
the layout-ordering threshold (top_32_ratio 0.3301 -> 0.3966,
layout_ordering_recommended flips no -> yes).  linux.axf size is
unchanged at 1,303,072 bytes -- these are perf wins, not size wins.

patches/0011-tiny-arm-nommu-pfn-valid.patch
  Make `select HAVE_ARCH_PFN_VALID` conditional on
  `MMU || !ARM_SINGLE_ARMV7M` so Cortex-M boards drop the heavyweight
  arch override (memblock_overlaps_region per call, plus the slow
  for_each_valid_pfn fallback that calls pfn_valid per PFN inside
  init_unavailable_range).  On a single contiguous DRAM bank with
  virt == phys the generic FLATMEM bounds check is correct.  Trace
  before: pfn_valid 271,195 hits (8.0%) + init_unavailable_range
  135,178 hits (4.0%) = ~12% of matched boot blocks, both gone after.
  Older ARM7/ARM9 NOMMU multi-bank boards keep the old check via
  the !ARM_SINGLE_ARMV7M clause.

configs/mps2-slim.dts
  Hand-pruned replacement for the kernel-shipped mps2-an385.dtb
  (3,756 -> 1,550 bytes).  Drops nodes with no driver or status =
  "disabled" on this build: armv7m-systick (disabled), sp804
  dual-timer (disabled), serial@5000/6000 (disabled), sp805 watchdog
  (no driver), 4 unused fixed-clocks + 2 fixed-factor-clocks,
  fpga@40020000/register-bit-led (no syscon, no LEDS_CLASS),
  smb/ethernet@0,0 smsc,lan9220 (no SMSC driver, CONFIG_NET=n).
  Keeps NVIC, mps2-timer0+1 (the driver requires both for
  clocksource + clockevent), serial@4000, clock-50000000 +
  clock-sys, aliases, chosen, memory.  build_bootwrapper compiles
  this DTS via host dtc instead of copying mps2-an385.dtb; a dtc
  preflight check fails fast if the host package is missing.
  Trace: fdt32_ld + fdt_offset_ptr + fdt_next_tag dropped from
  217,177 hits (7.3%) to 84,292 (2.7%), a -54.5% reduction.

configs/pgo-workload.txt + scripts/{validate,qemu-profile}.expect
  PGO trace was inflated by ~225K hits (8% of matched blocks) of
  UART/n_tty/uart_port_* code driven by verbose `cat /proc/<file>`
  output.  Workload now redirects bulk output to /dev/null and emits
  a single "ok" marker; restricted to applets actually compiled into
  busybox (echo, uname, cat, cp, ln, ls, mkdir, mv, rm, test) since
  the original used readlink/grep/printf/rmdir which aren't built
  and only "passed" earlier because expect's regex matched the
  echoed command line, not real output.

  The expect runners now disable terminal echo via `busybox stty
  -echo` right after wait_for_shell -- without it the line discipline
  feeds each "...echo ok" command back into expect's buffer and the
  generic `ok` regex would match the echoed command line before the
  program ran.  wait_for_shell itself was hardened with the same
  double-marker pattern (match both the echo and the actual stdout)
  so it cannot return while busybox is still forking.

build.sh comment block
  Records the negative result for LZ4 and ZSTD initramfs compression:
  lib/decompress_unlz4.c hardcodes an 8 MiB output buffer (chunk
  size from the LZ4 legacy format) and lib/decompress_unzstd.c
  derives DStream workspace from the compressed file's window header,
  which under `zstd -19` (scripts/Makefile.lib cmd_zstd) becomes
  another 8 MiB request.  Neither fits in a 16 MiB SSRAM bank's
  buddy allocator (no order-11 contiguous block exists at boot, and
  bumping ARCH_FORCE_MAX_ORDER does not coalesce one).  Both panic
  during initramfs unpack; gzip stays.  inflate_fast remains 2.8% of
  matched boot blocks -- the cost is real but the alternatives are
  unbootable as wired today.

Validated end-to-end on a freshly extracted linux-7.0 source tree:
patch applies with no fuzz, build produces 1,303,072-byte linux.axf
plus 1,550-byte mps2.dtb, validate-qemu.sh + collect-kernel-profile.sh
both pass, and the final trace reproduces the headline numbers above.

Author: jserv

build.sh

@@ -645,7 +645,7 @@ build_linux() {
     cd linux-${LINUX_VERSION}
 
     # Apply linux-tiny patches for reduced memory footprint and LTO support
-    for p in ../patches/0002-*.patch ../patches/0003-*.patch ../patches/0004-*.patch ../patches/0005-*.patch ../patches/0006-*.patch ../patches/0010-*.patch; do
+    for p in ../patches/0002-*.patch ../patches/0003-*.patch ../patches/0004-*.patch ../patches/0005-*.patch ../patches/0006-*.patch ../patches/0010-*.patch ../patches/0011-*.patch; do
         [ -f "${p}" ] || continue
         apply_patch_once "${p}"
     done
@@ -689,6 +689,21 @@ build_linux() {
     sed -i "/CONFIG_INITRAMFS_SOURCE=/d" .config
     echo "CONFIG_INITRAMFS_SOURCE=\"${ROOTFS} ${ROOTDIR}/configs/rootfs.dev\"" >>.config
     echo "CONFIG_INITRAMFS_COMPRESSION_GZIP=y" >>.config
+    # NOTE: LZ4 and ZSTD have been evaluated on this 16 MiB SSRAM target
+    # and both panic during initramfs unpack. lib/decompress_unlz4.c
+    # hardcodes an 8 MiB output buffer (LZ4_DEFAULT_UNCOMPRESSED_CHUNK_SIZE)
+    # which requires an order-11 contiguous block; the buddy allocator
+    # never forms one at boot on this RAM size even with
+    # ARCH_FORCE_MAX_ORDER=11. lib/decompress_unzstd.c sizes its DStream
+    # workspace from the compressed file's windowSize header, and the
+    # default `zstd -19` (scripts/Makefile.lib cmd_zstd) emits an
+    # 8 MiB window so the workspace also exceeds MAX_PAGE_ORDER. Any
+    # switch away from gzip on this target needs either kernel patches
+    # (chunk size in the LZ4 wrapper, or zstd command-line in
+    # scripts/Makefile.lib) or installing lzop on the build host. Until
+    # then, gzip stays and inflate_fast remains ~2.8% of matched boot
+    # blocks (95k TB hits) -- the cost is real but the alternatives are
+    # unbootable as wired today.
     if [ -n "${KERNEL_CONFIG_FRAGMENT}" ] && [ -f "${KERNEL_CONFIG_FRAGMENT}" ]; then
         cat "${KERNEL_CONFIG_FRAGMENT}" >>.config
     fi
@@ -1699,15 +1714,29 @@ build_kernel_pgo_cycle() {
 build_bootwrapper() {
     echo "BUILD: building ARM CORTEX boot wrapper"
 
+    # Reuse the kernel-built dtc when available so fresh hosts do not need
+    # a separate device-tree-compiler package just for the bootwrapper DTB.
+    DTC_BIN="${ROOTDIR}/linux-${LINUX_VERSION}/scripts/dtc/dtc"
+    if [ -x "${DTC_BIN}" ]; then
+        :
+    elif command -v dtc >/dev/null 2>&1; then
+        DTC_BIN=dtc
+    else
+        echo "ERROR: no dtc available (expected ${DTC_BIN} or host 'dtc' in PATH)" >&2
+        exit 1
+    fi
+
     if [ ! -d bootwrapper ]; then
         run_logged "clone bootwrapper" git clone --depth 1 --single-branch https://github.com/ARM-software/bootwrapper.git -b cortex-m-linux
     fi
 
     cd bootwrapper
     cp ../linux-${LINUX_VERSION}/arch/arm/boot/Image .
-    # Linux 7.0 does not ship an AN386 DTS; the AN385 DTB is compatible
-    # because both FPGA images share the same peripheral and memory map.
-    cp ../linux-${LINUX_VERSION}/arch/arm/boot/dts/arm/mps2-an385.dtb mps2.dtb
+    # Hand-pruned DTS strips disabled peripherals (sp804/sp805/extra UARTs),
+    # the SMSC ethernet, FPGA LED MFD, and unused fixed-clocks; this halves
+    # the bootwrapper DTB and roughly halves the early-boot fdt_* hot path.
+    run_logged "compile slim mps2 dtb" \
+        "${DTC_BIN}" -q -I dts -O dtb -o mps2.dtb ../configs/mps2-slim.dts
     sed -i -e 's/mps2-an399.dtb/mps2.dtb/' -e 's/mps2-an385.dtb/mps2.dtb/' Makefile
     sed -i 's/0x60000000/0x21000000/' Makefile
     sed -i 's/. = PHYS_OFFSET;/. = 0x0;/' linux.lds.S

configs/mps2-slim.dts

@@ -0,0 +1,85 @@
+/dts-v1/;
+
+/ {
+	#address-cells = <0x01>;
+	#size-cells = <0x01>;
+	model = "ARM MPS2 Application Note 385/386 (slim)";
+	compatible = "arm,mps2";
+
+	chosen {
+		bootargs = "earlycon";
+		stdout-path = "serial0:9600n8";
+	};
+
+	aliases {
+		serial0 = "/soc/apb@40000000/serial@4000";
+	};
+
+	memory@21000000 {
+		device_type = "memory";
+		reg = <0x21000000 0x1000000>;
+	};
+
+	interrupt-controller@e000e100 {
+		compatible = "arm,armv7m-nvic";
+		interrupt-controller;
+		#interrupt-cells = <0x01>;
+		reg = <0xe000e100 0xc00>;
+		phandle = <0x01>;
+	};
+
+	clock-50000000 {
+		compatible = "fixed-clock";
+		#clock-cells = <0x00>;
+		clock-frequency = <0x2faf080>;
+		phandle = <0x03>;
+	};
+
+	clock-sys {
+		compatible = "fixed-factor-clock";
+		clocks = <0x03>;
+		#clock-cells = <0x00>;
+		clock-div = <0x02>;
+		clock-mult = <0x01>;
+		phandle = <0x02>;
+	};
+
+	soc {
+		#address-cells = <0x01>;
+		#size-cells = <0x01>;
+		compatible = "simple-bus";
+		interrupt-parent = <0x01>;
+		ranges;
+
+		apb@40000000 {
+			compatible = "simple-bus";
+			#address-cells = <0x01>;
+			#size-cells = <0x01>;
+			ranges = <0x00 0x40000000 0x10000>;
+
+			mps2-timer0@0 {
+				compatible = "arm,mps2-timer";
+				reg = <0x00 0x1000>;
+				interrupts = <0x08>;
+				clocks = <0x02>;
+				status = "okay";
+			};
+
+			mps2-timer1@1000 {
+				compatible = "arm,mps2-timer";
+				reg = <0x1000 0x1000>;
+				interrupts = <0x09>;
+				clocks = <0x02>;
+				status = "okay";
+			};
+
+			serial@4000 {
+				compatible = "arm,mps2-uart";
+				reg = <0x4000 0x1000>;
+				interrupts = <0x00 0x01 0x0c>;
+				clocks = <0x02>;
+				status = "okay";
+			};
+		};
+	};
+};

configs/pgo-workload.txt

@@ -1,18 +1,29 @@
 # label|command|expected regex
-busybox-help|busybox|BusyBox v
-uname|busybox uname -s|Linux
-list-bin|busybox ls /bin|busybox
-proc-version|busybox cat /proc/version|Linux version
-proc-mounts|busybox cat /proc/mounts|/proc
-proc-self-stat|busybox cat /proc/self/stat| \(
-list-proc|busybox ls /proc|self
-read-self-exe|busybox readlink /proc/self/exe|busybox
-shell-path|busybox test -x /bin/sh && busybox echo /bin/sh-ok|/bin/sh-ok
-create-file|busybox sh -c 'busybox echo alpha >/tmp/pgo-file && busybox cat /tmp/pgo-file'|alpha
-rename-file|busybox sh -c 'busybox mv /tmp/pgo-file /tmp/pgo-file-renamed && busybox cat /tmp/pgo-file-renamed'|alpha
-hardlink-file|busybox sh -c 'busybox ln /tmp/pgo-file-renamed /tmp/pgo-file-link && busybox ls -l /tmp/pgo-file-link'|pgo-file-link
-truncate-file|busybox sh -c ': >/tmp/pgo-file-renamed && busybox test ! -s /tmp/pgo-file-renamed && busybox echo zero-ok'|zero-ok
-mkdir-rmdir|busybox sh -c 'busybox mkdir -p /tmp/pgo-dir && busybox ls /tmp | busybox grep pgo-dir && busybox rmdir /tmp/pgo-dir'|pgo-dir
-copy-file|busybox sh -c 'busybox cp /bin/busybox /tmp/pgo-copy && busybox ls -l /tmp/pgo-copy'|pgo-copy
-poll-path|busybox sh -c 'busybox printf \"poll-data\" >/tmp/pgo-poll && busybox cat /tmp/pgo-poll'|poll-data
-cleanup-tmp|busybox sh -c 'busybox rm -f /tmp/pgo-file-renamed /tmp/pgo-file-link /tmp/pgo-poll && busybox echo cleanup-ok'|cleanup-ok
+#
+# Each command does the work, redirects bulk output to /dev/null, and emits
+# a single short marker so the expect runner sees a constant short string.
+# Restricted to applets compiled into BusyBox per configs/busybox-1.37.0.config:
+# echo, uname, cat, cp, ln, ls, mkdir, mv, rm, test (and the hush builtins
+# `:`, test, echo). Avoids grep, readlink, rmdir, printf, true, head -- all
+# disabled in this build.
+#
+# This keeps the workload's UART/n_tty/uart_port hot path off the boot trace,
+# which previously inflated matched_kernel_blocks by ~8% with no insight into
+# kernel code paths that matter for layout or size decisions.
+busybox-help|: && busybox echo ok|ok
+uname|busybox uname -s >/dev/null && busybox echo ok|ok
+list-bin|busybox ls /bin >/dev/null && busybox echo ok|ok
+proc-version|busybox cat /proc/version >/dev/null && busybox echo ok|ok
+proc-mounts|busybox cat /proc/mounts >/dev/null && busybox echo ok|ok
+proc-self-stat|busybox cat /proc/self/stat >/dev/null && busybox echo ok|ok
+list-proc|busybox ls /proc >/dev/null && busybox echo ok|ok
+read-self-exe|busybox ls -l /proc/self/exe >/dev/null && busybox echo ok|ok
+shell-path|busybox test -x /bin/sh && busybox echo ok|ok
+create-file|busybox sh -c 'busybox echo alpha >/tmp/pgo-file && busybox cat /tmp/pgo-file >/dev/null' && busybox echo ok|ok
+rename-file|busybox sh -c 'busybox mv /tmp/pgo-file /tmp/pgo-file-renamed && busybox cat /tmp/pgo-file-renamed >/dev/null' && busybox echo ok|ok
+hardlink-file|busybox sh -c 'busybox ln /tmp/pgo-file-renamed /tmp/pgo-file-link && busybox ls /tmp/pgo-file-link >/dev/null' && busybox echo ok|ok
+truncate-file|busybox sh -c ': >/tmp/pgo-file-renamed && busybox test ! -s /tmp/pgo-file-renamed' && busybox echo ok|ok
+mkdir-rmdir|busybox sh -c 'busybox mkdir -p /tmp/pgo-dir && busybox ls /tmp/pgo-dir >/dev/null && busybox rm -rf /tmp/pgo-dir' && busybox echo ok|ok
+copy-file|busybox sh -c 'busybox cp /bin/busybox /tmp/pgo-copy && busybox ls /tmp/pgo-copy >/dev/null' && busybox echo ok|ok
+poll-path|busybox sh -c 'busybox echo poll-data >/tmp/pgo-poll && busybox cat /tmp/pgo-poll >/dev/null' && busybox echo ok|ok
+cleanup-tmp|busybox sh -c 'busybox rm -f /tmp/pgo-file-renamed /tmp/pgo-file-link /tmp/pgo-poll' && busybox echo ok|ok

patches/0011-tiny-arm-nommu-pfn-valid.patch

@@ -0,0 +1,51 @@
+From: Jim Huang <jserv@ccns.ncku.edu.tw>
+Subject: [PATCH] tiny: arm: skip HAVE_ARCH_PFN_VALID on ARMv7-M
+
+The ARM-specific pfn_valid() in arch/arm/mm/init.c walks memblock via
+memblock_overlaps_region() on every call. It exists to handle the
+mismatch between mem_map and physical memory layout on classic ARM/A
+systems with split banks, holes, or aliased physical addresses.
+
+On Cortex-M (CPU_V7M) NOMMU boards built via ARM_SINGLE_ARMV7M the
+picture is much simpler:
+  - one contiguous DRAM bank (e.g. MPS2-AN386 SSRAM at 0x21000000),
+  - virt == phys, mem_map covers the bank linearly,
+  - PFN never truncates because the address space fits a u32.
+
+In that regime the generic FLATMEM pfn_valid (single bounds check
+against max_mapnr) is both correct and cheap, and disabling
+HAVE_ARCH_PFN_VALID also re-enables the tight integer-range
+for_each_valid_pfn() loop in init_unavailable_range() instead of the
+fallback that calls pfn_valid() per pfn.
+
+Older ARM7/ARM9 NOMMU boards can have multiple discontinuous memory
+banks where the FLATMEM bounds check would incorrectly accept PFNs in
+the holes; gating on `MMU || !ARM_SINGLE_ARMV7M` keeps those
+configurations on the heavyweight memblock-aware check.
+
+Boot-trace (TB-execution rollup) before:
+
+  pfn_valid               271,195 hits   8.0% of matched kernel blocks
+  init_unavailable_range  135,178 hits   4.0%
+
+Together ~12% of matched boot blocks were spent inside the heavyweight
+arch override -- pure overhead with a single contiguous bank.
+
+Patch makes the select conditional; MMU builds and non-ARMV7M NOMMU
+builds keep the old behavior unchanged.
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -90,7 +90,7 @@ config ARM
+ 	select HAVE_ARCH_KASAN_VMALLOC if HAVE_ARCH_KASAN
+ 	select HAVE_ARCH_KSTACK_ERASE
+ 	select HAVE_ARCH_MMAP_RND_BITS if MMU
+-	select HAVE_ARCH_PFN_VALID
++	select HAVE_ARCH_PFN_VALID if MMU || !ARM_SINGLE_ARMV7M
+ 	select HAVE_ARCH_SECCOMP
+ 	select HAVE_ARCH_SECCOMP_FILTER if AEABI && !OABI_COMPAT
+ 	select HAVE_ARCH_THREAD_STRUCT_WHITELIST

scripts/qemu-profile.expect

@@ -34,8 +34,12 @@ proc wait_for_shell {} {
     for {set attempt 0} {$attempt < 8} {incr attempt} {
         set marker "__PROFILE_READY__$attempt"
         send -- "busybox echo ${marker}\r"
+        # Match the marker TWICE: once in the line-discipline echo of the
+        # input, then in busybox's actual stdout. The single-match form
+        # races against shell init -- it returns when the tty buffers the
+        # echoed command line, before busybox has even forked.
         expect {
-            -re $marker { return }
+            -re "${marker}\[\\r\\n\]+${marker}" { return }
             timeout {
                 send -- "\r"
             }
@@ -153,6 +157,23 @@ expect {
 
 wait_for_shell
 
+# See validate-qemu.expect for the rationale -- disable terminal echo
+# so workload commands like "... && busybox echo ok" only have their
+# actual output reach expect's buffer (not the echoed command line),
+# letting trimmed workloads use simple markers without false positives.
+send -- "busybox stty -echo; busybox echo __ECHO_DISABLED__\r"
+expect {
+    -re "__ECHO_DISABLED__\[\\r\\n\]+__ECHO_DISABLED__" {}
+    timeout {
+        send_user "ERROR: failed to disable terminal echo\n"
+        exit 1
+    }
+    eof {
+        send_user "ERROR: QEMU exited before terminal echo could be disabled\n"
+        exit 1
+    }
+}
+
 set workload_steps [load_workload $workload_path]
 set step_index 0
 foreach step $workload_steps {

scripts/validate-qemu.expect

@@ -26,8 +26,12 @@ proc wait_for_shell {} {
     for {set attempt 0} {$attempt < 6} {incr attempt} {
         set marker "__SHELL_READY__$attempt"
         send -- "busybox echo ${marker}\r"
+        # Match the marker TWICE: once in the line-discipline echo of the
+        # input, then in busybox's actual stdout. Without the second match
+        # we may return while busybox has not yet finished forking, so
+        # subsequent commands race against shell init.
         expect {
-            -re $marker {
+            -re "${marker}\[\\r\\n\]+${marker}" {
                 set shell_ready_ms [clock milliseconds]
                 return
             }
@@ -148,6 +152,26 @@ expect {
 
 wait_for_shell
 
+# Disable terminal echo before running the workload. Without this the
+# tty line-discipline echoes each "busybox echo ok" command back to
+# expect's buffer, and a generic regex such as "ok" matches the echoed
+# command line before the program's actual output. The double-marker
+# expect below waits for both the echoed copy and the actual echo of
+# __ECHO_DISABLED__, so by the time we return, stty -echo has taken
+# effect and subsequent run_guest_check sees only program output.
+send -- "busybox stty -echo; busybox echo __ECHO_DISABLED__\r"
+expect {
+    -re "__ECHO_DISABLED__\[\\r\\n\]+__ECHO_DISABLED__" {}
+    timeout {
+        send_user "ERROR: failed to disable terminal echo\n"
+        exit 1
+    }
+    eof {
+        send_user "ERROR: QEMU exited before terminal echo could be disabled\n"
+        exit 1
+    }
+}
+
 set workload_steps [load_workload $workload_path]
 set step_index 0
 foreach step $workload_steps {