Research note: Zephyr RTOS kernel

Kind: Read-only source analysis, 2026-10-07, on a sparse shallow clone of zephyrproject-rtos/zephyr at commit d175d3bfb6c2 (v4.5.0-rc1; kernel/, include/zephyr/, arch/arm/core/cortex_m/, arch/riscv/core/, doc/kernel/, doc/services/logging/, doc/services/tracing/, lib/os/, subsys/logging/, subsys/tracing/). Paths relative to the repository root. Line numbers drift; paths and symbols are the durable reference. Synthesized in R-001.

Q1 Scheduler

  • Three ready-queue backends chosen by choice SCHED_ALGORITHM (kernel/Kconfig:271-320): SCHED_SIMPLE is a priority-sorted dlist, O(N) insert (kernel/include/priority_q.h:114-126); SCHED_SCALABLE is an rbtree with a monotonically increasing order_key for FIFO within priority, renumbered on wrap (priority_q.h:207-237); SCHED_MULTIQ is per-priority dlists plus a bitmap, UP caches the best index (priority_q.h:291-371). MULTIQ depends on !SCHED_DEADLINE (Kconfig:307). Dispatch via _priq_run_* macros (priority_q.h:14-46); wait queues share SIMPLE and SCALABLE (priority_q.h:49-58).

  • Priorities: cooperative are negative (-NUM_COOP..-1), preemptible 0..N-1, idle lowest; lower number is higher priority (Kconfig:26-64; ksched.h:185-193). Preemptibility is a merged preempt field versus _PREEMPT_THRESHOLD (kthread.h:66-70, kernel_structs.h:86-89).

  • z_sched_prio_cmp compares prio, then under SCHED_DEADLINE the 32-bit modular difference of prio_deadline (priority_q.h:81-112): EDF only orders threads within one priority. Deadlines are k_cycle_get_32 relative, clamped to INT32_MAX/2, and updates must dequeue and requeue to keep rbtree invariants (kernel/deadline.c:259-300).

  • Time slicing: one _timeout per CPU (kernel/timeslicing.c:14-19); applies only to preemptible threads at or below TIMESLICE_PRIORITY (timeslicing.c:44-64; Kconfig:600-608); per-thread slices plus an expiry callback (timeslicing.c:137-148); rotation via move_current_to_end_of_prio_q (timeslicing.c:198).

  • k_sched_lock decrements a per-thread sched_locked counter under the scheduler lock and asserts not in ISR (kernel/scheduler.c:282-306); meta-IRQs bypass it (Kconfig:110-124).

  • struct z_kernel {cpus[], ready_q, threads, pending_ipi} and struct _cpu {nested, irq_stack, current, idle_thread, metairq_preempted, swap_ok} (include/zephyr/kernel_structs.h:147-248). UP keeps ready_q.cache as the next thread (kernel_structs.h:130-134; sched.c:167-182); _current on SMP reads _current_cpu->current with IRQs masked (kernel_structs.h:262-306; kernel/smp/smp.c:276-287).

  • SMP: a single global run queue under _sched_spinlock; per-CPU queues only with SCHED_CPU_MASK_PIN_ONLY (kernel/include/run_q.h:17-49). _current is never in the queue on SMP and is re-added only on the switch path (run_q.h:77-98; kswap.h:420-431). next_up does the SMP choice (sched.c:57-158). IPIs: flag_ipi and ipi_mask_create with IPI_OPTIMIZE and idle-CPU reservations; signal_pending_ipi must run under the sched lock (kernel/smp/ipi.c:414-542); z_sched_ipi runs time slicing and IPI work (ipi.c:627-649). Affinity masks are changeable only while the thread cannot run (kernel/smp/cpu_mask.c:666-693). Cross-CPU abort: flag plus IPI plus spin (sched.c:285-374).

  • Meta-IRQ: the top NUM_METAIRQ_PRIORITIES cooperative levels preempt even cooperative and sched-locked threads; metairq_preempted records the victim and next_up returns to it (kernel/include/metairq.h:431-478; sched.c:76). Intent: interrupt bottom halves (Kconfig:110-124; doc/kernel/services/threads/index.rst:290-300).

  • Idle: computes the next expiry, calls pm_system_suspend(_kernel.idle) with IRQs locked, else k_cpu_idle (kernel/idle.c:376-400); spins when SMP lacks IPI (idle.c:364-369); a “legacy mess” yield for !PREEMPT_ENABLED (idle.c:406-421).

Q2 Context switch and interrupts

  • Two models: legacy arch_swap(key) (kswap.h:473-509) and handle-based arch_switch under USE_SWITCH, required for SMP (Kconfig:1085-1101; smp/Kconfig:8). do_swap releases the caller’s lock, takes the sched lock, spins on switch_handle (the documented SMP chicken-and-egg race, kswap.h:318-351), re-queues the old thread, then arch_switch (kswap.h:361-456).

  • Cortex-M legacy path: PendSV at lowest priority (cortex_m/exception.h:55-57) saves r4-r11 plus PSP, raises BASEPRI to _EXC_IRQ_DEFAULT_PRIO, loads ready_q.cache into current, clears PendSV, restores the thread’s saved BASEPRI key, reprograms the MPU (z_arm_configure_dynamic_mpu_regions) and CONTROL.nPRIV, handles lazy FP (arch/arm/core/cortex_m/swap_helper.S:48-375). _isr_wrapper demuxes _sw_isr_table then z_arm_exc_exit pends PendSV iff ready_q.cache != current (isr_wrapper.c:104-169; exc_exit.c:55-71). The new USE_SWITCH Cortex-M port synthesises frames and hijacks the ISR’s stacked LR to run exit code after return (arm-m-switch.c:10-131; include/zephyr/arch/arm/arm-m-switch.h:157-187). Because PendSV sits below IRQs, SWAP_NONATOMIC workarounds exist (pending_current, timeslicing.c:21-28, 166-173; kthread.h:249-257; Kconfig:710-720).

  • arch_irq_lock returns the prior BASEPRI (v7-M, via BASEPRI_MAX) or PRIMASK (v6-M); arch_irq_unlocked is key == 0 (include/zephyr/arch/arm/asm_inline_gcc.h:44-121). On SMP irq_lock becomes a global recursive spinlock (include/zephyr/irq.h:288-321; smp.c:58-94).

  • Zero-latency IRQs: priority levels above _IRQ_PRIO_OFFSET are never masked (exception.h:40-53; irq_manage.c:272-303). Rules: must use IRQ_DIRECT_CONNECT, return 0, no kernel calls, no ISR_DIRECT_PM (include/zephyr/arch/arm/irq.h:136-196; cortex_m/Kconfig:331-354; include/zephyr/irq.h:159-231). arch_zli_lock uses PRIMASK (asm_inline_gcc.h:141-164).

  • Direct ISRs: ISR_DIRECT_DECLARE emits an __attribute__((interrupt)) wrapper; the body’s return controls z_arm_int_exit (arm/irq.h:205-252); dynamic direct dispatchers (irq_manage.c:445-471).

  • Stacks and nesting: z_interrupt_stacks[CPUs] of ISR_STACK_SIZE (kernel/init.c:142, 394-396; Kconfig:166-171). Cortex-M relies on hardware MSP and PSP; RISC-V counts _current_cpu->nested, switches to irq_stack at depth 0 and reschedules only at depth 0 via z_get_next_switch_handle(NULL) (arch/riscv/core/isr.S:755-783, 834-910).

  • k_is_in_isr is arch_is_in_isr (thread.c:71-75; the ARM inline lives in arch/arm/include, outside the clone).

  • Misuse detection: z_pend_curr panics on an ISR pend in every build (sched.c:531-534); sem, msgq, and mutex assert (sem.c:154, msg_q.c:326, mutex.c:179, 385). SPIN_VALIDATE stores owner|cpu in the lock, tracks the outermost held lock and count, and z_assert_can_swap forbids switching with extra spinlocks or irq_lock held (kernel/spinlock_validate.c:12-20, 146-185). __ASSERT is (void)0 when off (sys/__assert.h:105-111); CHECKIF is error, assert, or nothing (sys/check.h:46-56).

Q3 Time

  • kernel/timeout.c is a backend-independent front end: 64-bit curr_tick, timeout_lock, announce_remaining, announcing_cpu, and an inflight_timeout pointer whose low bit means “superseded” (timeout.c:19-70). The backend is from choice TIMEOUT_BACKEND: delta dlist by default; minheap, wheel, bucket, skiplist experimental (Kconfig:788-855), included as a header (timeout.c:108-118). The delta list stores dticks relative to the predecessor; abort folds the delta into the successor (kernel/timeout_list.h:44-77).

  • z_add_timeout: a relative add gets +1 tick round-up unless this CPU is inside announce (timeout.c:196-218); absolute uses Z_TICK_ABS(t) = K_TICKS_FOREVER-1-t (sys/clock.h:148), minimum 1 tick (timeout.c:220-222); programs sys_clock_set_timeout(next_timeout()) capped at SYS_CLOCK_MAX_WAIT = UINT32_MAX/2 (timeout.c:126-157; drivers/timer/system_timer.h:27-37).

  • Driver API: the ISR takes sys_clock_lock() and announces with key transfer; sys_clock_elapsed and set_timeout are called with the lock held (system_timer.h:57-163). The announce loop advances ticks, pops due nodes, drops the lock around each handler; a second SMP announcer just folds its ticks in (timeout.c:343-417).

  • Race handling: z_try_abort_timeout returns -EAGAIN while a handler runs on another CPU and marks it superseded; handlers check z_timeout_inflight_superseded (timeout.c:239-286; timeout_q.h:258-284; sched.c:502-519).

  • k_timeout_t is {k_ticks_t ticks}, compared with K_TIMEOUT_EQ; k_ticks_t is int64 under TIMEOUT_64BIT (default y) and absolute timeouts need it (sys/clock.h:45-80, 151-158; Kconfig:777-786).

  • k_timer: expiry runs in timer-ISR context with timer_lock dropped around expiry_fn (kernel/timer.c:72-153); periodic rearm uses K_TIMEOUT_ABS_TICKS(k_uptime_ticks()+period) to avoid drift (timer.c:100-112); k_timer_status_sync pends on the timer wait_q (timer.c:367-426); k_timer_cleanup spins out in-flight handlers (156-216).

  • k_uptime_get is the ms conversion of curr_tick + elapsed (kernel.h:2199-2217; timeout.c:438-446); k_cycle_get_32 and _64 are raw arch_k_cycle_get (kernel.h:2286-2313); timeutil offers timegm and timeutil_sync skew estimation (sys/timeutil.h:14-19, 120-170).

Q4 Blocking and waiting

  • _wait_q_t is a sorted dlist or rbtree (kernel_structs.h:308-328; kernel/include/wait_q.h:23-98), inserted by z_sched_prio_cmp so the head is the best waiter.

  • z_pend_curr does a “lock swap”: take the sched lock, add_to_waitq_locked (unready, mark pending, set pended_on), arm the thread timeout, release the caller’s lock, z_swap_locked (sched.c:437-464, 522-553). The default swap_retval is -EAGAIN (kswap.h:375); wakers set retval and data then ready under the sched lock (z_sched_wake, ksched.h:250-310).

  • Timeout versus wake: both run under _sched_spinlock; the waker aborts the timeout, which marks an in-flight handler superseded so z_thread_timeout bails (sched.c:502-519, 812-820); z_unpend_thread retries -EAGAIN while dropping the lock (sched.c:570-582).

  • Deletion with waiters: no generic object teardown; thread abort unpends joiners and waits for in-flight timeouts before storage reuse (sched.c:856-983); k_timer_cleanup returns -EAGAIN if waiters exist (timer.c:169-184); pipe close and reset wake all with -EPIPE or -ECANCELED (kernel/pipe.c:290-313); sem reset wakes with -EAGAIN (sem.c:184-202).

  • k_poll: events are registered on per-object poll_events lists sorted by poller priority (kernel/poll.c:110-168); is_condition_met is evaluated under poll_lock during registration so a ready object is never missed (poll.c:228-257); signalers clear is_polling and ready the thread (poll.c:259-280, 443-482); pend on a static wait_q (poll.c:327-329); only NOTIFY_ONLY mode (poll.c:45). Triggered work submits a k_work_poll instead (poll.c:574-645).

  • k_event: post walks the wait queue under the sched lock via z_sched_waitq_walk, two-phase for the rbtree (kernel/events.c:138-219); ANY, ALL, RESET, CLEAR options (events.c:282-322).

  • k_futex: one global wait_q filtered by futex_pointer; the header admits O(N) scaling and no PI (kernel/userspace/futex.c:14-40, 98-140).

  • k_condvar: unlock the mutex under condvar_lock, pend, always re-lock the mutex even on timeout (kernel/condvar.c:105-138).

Q5 Synchronization and PI

  • k_mutex PI is transitive: lock walks the owner chain through mutex_pended_on, boosting each owner, capped at MUTEX_CHAIN_WALK_MAX_HOPS=16, with K_FOREVER deadlock detection under MUTEX_DEADLOCK_DETECT (kernel/mutex.c:112-118, 227-308; Kconfig:83-91). Each thread keeps held_mutexes; orig_prio is captured on first acquisition (mutex.c:195-204). Unlock recomputes priority as the highest remaining waiter across all held mutexes and hands off to the best waiter atomically under the sched lock (mutex.c:424-470). Ceiling via PRIORITY_CEILING (Kconfig:99-108; ksched.h:160-168).

  • Documented limitations: a bounded walk; deferred priority drop on timeout (done in the waiter after it resumes, not in the timer ISR, because mutex_lock then _sched_spinlock ordering forbids it); chain priority-down not propagated (mutex.c:29-49). The timeout path re-takes mutex_lock, clears mutex_pended_on, recalculates the owner priority (mutex.c:325-363). One global mutex_lock spinlock (mutex.c:68-75).

  • k_sem: give wakes one waiter else bumps the count and signals poll; take has a fast path or pends; ISR-safe give; optional SEM_LOCK_STRIPES on SMP (sem.c:116-182; Kconfig:353-358).

  • Spinlocks: k_spin_lock is arch_irq_lock plus CAS or a ticket lock (spinlock.h:45-73, 194-224); the K_SPINLOCK scope macro (spinlock.h:463-465); LOCK_SCHED_SPINLOCK compiles out on UP (kspinlock.h:14-26). SPIN_VALIDATE catches recursive lock, foreign unlock, and switching with locks held (spinlock_validate.c:27-99, 146-185). There is no general lock-order checker; order is documented per file.

Q6 IPC and memory

  • k_msgq: a ring buffer with copy; get hands the freed slot to a pending sender under the sched lock (kernel/msg_q.c:324-370); user mode validates the message buffer (msg_q.c:286-304).

  • k_queue: an intrusive sys_sflist, first word reserved; _alloc variants allocate an alloc_node from the thread resource pool and flag the node (kernel/queue.c:33-59, 151-181); get passes data via swap_data (queue.c:345-375).

  • k_pipe (2024 rewrite): ring_buf, data and space wait queues, direct copy into pending readers’ stack pipe_buf_spec under the sched lock, partial transfers with timepoints, close and reset (pipe.c:39-150, 152-313); direct copy disabled under KERNEL_COHERENCE (pipe.c:180-190).

  • k_mbox: zero-copy, descriptors live on sender and receiver stacks, matched by thread ids, dispose wakes the sender (kernel/mailbox.c:119-208, 254-290, 457-496); async sends via a dummy-thread pool (NUM_MBOX_ASYNC_MSGS, Kconfig:649-657).

  • k_mem_slab: a free list threaded through blocks, alignment and overflow checks, free hands the block to a waiter (kernel/mem_slab.c:109-139, 218-296). k_heap is sys_heap plus a spinlock and a wait_q with retry until timepoint (kernel/kheap.c:26-91); sys_heap is segregated-fit, power-of-two buckets, 8-byte chunks, 4-byte header, bounded constant-time operations (sys/sys_heap.h:22-48).

  • Static definitions: STRUCT_SECTION_ITERABLE places objects in _<type>_list sections, the linker emits _list_start and _end, STRUCT_SECTION_FOREACH iterates (sys/iterable_sections.h:50-73, 244-299); used by K_SEM_DEFINE, K_MSGQ_DEFINE, K_THREAD_DEFINE (kernel.h:3874-3879, 5351-5356, 1029-1034); static heaps init at PRE_KERNEL_1 (kheap.c:35-49); static threads start at boot (thread.c:69).

  • Work queue v2: a single work_lock; state bits RUNNING, CANCELING, QUEUED, DELAYED, FLUSHING (kernel.h:4577-4588); resubmit-while-running pins to the same queue to avoid handler re-entrancy (kernel/work.c:320-348); cancel_sync waits on a pending_cancels record (work.c:80-151, 533-547); main loop (work.c:671-699).

Q7 Isolation

  • Syscalls: __syscall is a static inline marker (toolchain/common.h:207); scripts/build/gen_syscalls.py emits the inline wrapper that traps when z_syscall_trap(), z_mrsh_* unmarshallers taking 6 uintptr_t (extra args via an untrusted more array checked with K_SYSCALL_MEMORY_READ), 64-bit returns via an untrusted stack slot (gen_syscalls.py:236-266, 358-389; doc/kernel/usermode/syscalls.rst:218-233). Missing verifiers alias a weak “unimplemented” one (syscalls.rst:162-167). Cortex-M SVC copies the frame onto the privileged stack and returns into z_arm_do_syscall (svc.S:175-373).

  • Kernel objects: gen_kobject_list.py scans the DWARF of the prebuilt ELF and emits a gperf hash address to struct k_object {name, perms[MAX_THREAD_BYTES], type, flags, data} (script docstring; sys/internal/kobject_internal.h:58-64); flags INITIALIZED, PUBLIC, ALLOC, DRIVER (sys/kobject.h:74-80). k_object_find tries gperf then dynamic objects (kernel/userspace/userspace.c:593-613); k_object_validate checks type, permission bit, init state (userspace.c:909-952); grant, revoke, inherit via thread-index bitmaps (userspace.c:749-907). Verifier macros K_SYSCALL_OBJ, K_SYSCALL_MEMORY_READ and WRITE (calls arch_buffer_validate), K_OOPS to arch_syscall_oops (internal/syscall_handler.h:378-500, 653-670).

  • Memory domains: partitions with overlap and W^X checks, maximum from arch_mem_domain_max_partitions_get (kernel/userspace/mem_domain.c:22-120, 207-232, 402); threads inherit the parent’s domain (mem_domain.c:351-362); arch_mem_domain_* hooks (arch_interface.h:928-1042); MPU regions reprogrammed inside PendSV (swap_helper.S:224-231, 301-307).

  • Two stacks: user threads get a privileged stack (priv_stack_start, PRIVILEGED_STACK_SIZE) used on SVC (svc.S:260-286); arch_user_mode_enter sets it up then z_arm_userspace_enter (cortex_m/thread.c:277-318); k_thread_user_mode_enter sets K_USER, clears essential, asserts a user-capable stack (thread.c:1148-1168).

  • Not protected: supervisor code is fully trusted and z_impl_ does no checks (syscalls.rst:239-241); supervisor stack overflow “integrity cannot be guaranteed” (usermode/overview.rst:126-127); kernel objects on stacks are invisible to user mode (userspace.c:968-972); K_THREAD_DEFINE threads cannot drop to user (kernel.h:1049-1050).

  • SMP plus userspace: no explicit incompatibility in the docs; ARCH_MEM_DOMAIN_SYNCHRONOUS_API and MEM_DOMAIN_ISOLATED_STACKS handle live updates (userspace/Kconfig.mem_domain:27-64); USERSPACE depends on ARCH_HAS_USERSPACE (arch/Kconfig:412-417).

Q8 Observability

  • Logging v2 modes: DEFERRED (mpsc_pbuf), IMMEDIATE, MINIMAL, FRONTEND (subsys/logging/Kconfig.mode:11-71); a processing thread with a trigger threshold (Kconfig.processing:56-64; log_core.c:169-189); drop-oldest overflow (Kconfig.processing:21-26). A log call builds a cbprintf package in place with CBPRINTF_STATIC_PACKAGE (logging/log_msg.h:344-377) and commits it with a timestamp or processes inline (log_core.c:720-747).

  • Dictionary logging: format strings live in the log_strings iterable section; with LOG_FMT_SECTION_STRIP they link into a DEVNULL region and are decoded on the host from the ELF (linker/common-rom/common-rom-logging.ld:5-26; Kconfig.misc:53-68; Kconfig.formatting:99-107). Wire format: a packed header plus package plus hexdump, the source identified by address (log_output_dict.c:15-67; log_output_dict.h:39-53).

  • Tracing: SYS_PORT_TRACING_* macros are no-ops without CONFIG_TRACING (tracing/tracing_macros.h:17-28); format choice CTF, SystemView, Percepio (external module), test, user (subsys/tracing/Kconfig:73-114); sync versus async ring buffer plus a tracing thread (Kconfig:151-163; tracing_core.c:55-74, 164-177); CTF events assembled under irq_lock (ctf/ctf_top.h:61-71); backends iterable (tracing_core.c:92-112).

  • The thread analyzer API reports stack used and utilization (debug/thread_analyzer.h:26-40, 103-126); k_thread_stack_space_get (thread.c:1311-1322); runtime stats stamp usage0 on each switch (kernel/usage.c:21-120; Kconfig:460-491). Thread names (THREAD_NAME, thread.c:149-220); the _kernel.threads monitor list (thread.c:786-790).

  • Fatal: z_fatal_error prints, coredumps, calls the weak k_sys_fatal_error_handler (halt or reboot), then aborts the thread unless panic or ISR (kernel/fatal.c:38-53, 92-206); Cortex-M z_arm_fault captures an ESF copy and recovers user faults via fixup tables (fault.c:1106-1136, 147-171). FIXME #17656: nested-exception detection unreliable (fatal.c:114-119).

  • Debugger: debug/thread_info.c is outside the clone; object-core links objects per type for tooling (kernel/obj_core.h:160-165; Kconfig.obj_core:4-14).

Q9 Configuration, portability, quality

  • Kconfig: kernel/Kconfig plus Kconfig.{device,init,obj_core,vm}, smp/Kconfig, userspace/Kconfig*; three algorithm choices (sched, waitq, timeout) and many hidden select and depends chains.

  • Arch contract: about 112 arch_* entry points in groups timing, threads, pm, smp, irq, mmu, userspace, gdbstub, stackwalk (include/zephyr/arch/arch_interface.h:8-1554) plus the private kernel_arch_interface.h (arch_new_thread, arch_switch or arch_swap, arch_is_in_isr, arch_mem_map, coredump, TLS; kernel/include/kernel_arch_interface.h:39-762).

  • Toolchain: toolchain.h dispatches to xcc, mwdt, armclang, iar, llvm, gcc (include/zephyr/toolchain.h:49-65); attributes __aligned, __packed, __weak, __used, __fallthrough, __must_check, BUILD_ASSERT to static_assert or _Static_assert (toolchain/gcc.h:76-89, 253-325); TOOLCHAIN_HAS_* capability flags (toolchain.h:103-139).

  • Guidelines: AGENTS.md routes to doc/contribute/coding_guidelines (a MISRA-C subset), checkpatch, and the compliance script; MISRA_SANE and “Enforce coding guideline rules” (Kconfig.zephyr:410, 597); MISRA justifications appear inline (userspace.c:602-605); per-subsystem hardening.yaml. Tests are not in the clone; the twister layout is described in AGENTS.md. CHECKIF gives a single API-validation idiom (sys/check.h:46-56).

Q10 Noteworthy and weak points

  • Devicetree: a pure token-pasting layer, devicetree.h about 6,400 lines plus about 13,000 lines under devicetree/*.h, node ids as macro names and DT_CAT up to 8 arguments (devicetree.h:197, 873, 6429-6441).

  • Tiny targets: MULTITHREADING=n compiles nothread.c with k_sleep via a timer and k_cpu_idle (kernel/nothread.c:12-81; Kconfig:12-24); SYS_CLOCK_EXISTS=n stubs timeouts (timeout_q.h:307-323).

  • Comments admitting awkwardness: “legacy mess” idle yield (idle.c:83), “Kludgey global initialization” (arm-m-switch.c:465), duplicated lock-swap code because z_swap is a “legacy API” (sched.c:541-548), an IRQ-lock-only reschedule violating the IPI locking rule (sched.c:652-656), poll locking “subtle” (poll.c:28-34), “Mystic arts for cycle nerds” (ksched.h:70-79), the skiplist _timeout grows to 88 bytes (Kconfig:847-852).

Ideas to borrow

  1. Pluggable ready-queue and timeout backends behind tiny macro and header seams (priority_q.h:14-58; timeout.c:108-118).

  2. Opaque k_timeout_t with absolute encoding in the sign space and K_TIMEOUT_EQ (sys/clock.h:65-80, 148-158); drift-free periodic timers (timer.c:100-112).

  3. The in-flight timeout “superseded” bit plus -EAGAIN retry protocol for safe cancel and free on SMP (timeout.c:51-70, 239-286).

  4. The lock-swap pend (z_pend_curr) and swap-return-value plus swap_data handoff (sched.c:522-553; ksched.h:293-310).

  5. Meta-IRQ threads with “return to the preempted cooperative thread” bookkeeping (metairq.h).

  6. Spinlock validation with owner|cpu packing and z_assert_can_swap (spinlock_validate.c).

  7. Iterable sections for zero-runtime-registration static objects (iterable_sections.h).

  8. A build-time kernel-object table from DWARF plus gperf and generated syscall marshallers (gen_kobject_list.py; gen_syscalls.py).

  9. cbprintf packaging with host-side dictionary decoding and DEVNULL-linked strings (log_msg.h:344-377; common-rom-logging.ld:5-26).

  10. Deferred ISR-exit work by patching the stacked LR on Cortex-M (arm-m-switch.h:157-187).

  11. CHECKIF tri-mode argument validation (check.h:46-56).

Weaknesses

  1. A global scheduler spinlock and global run queue on SMP; per-CPU queues only with PIN_ONLY (run_q.h:17-49); SCHED_CPU_MASK makes the best-thread search O(N) (smp/Kconfig:54-90).

  2. Legacy irq_lock on SMP is a global recursive spinlock reacquired on switch (irq.h:288-321; doc/kernel/services/smp/smp.rst:55-74).

  3. Cortex-M PendSV below IRQ priority forces SWAP_NONATOMIC workarounds spread across the scheduler (Kconfig:710-720; timeslicing.c:21-28; kthread.h:249-257).

  4. Mutex PI: a bounded chain walk, priority drop deferred on timeout, chain drop not propagated, a global mutex_lock (mutex.c:29-49, 68-75, 112-118).

  5. Futex uses one global wait queue (futex.c:14-33); k_poll has one global lock and NOTIFY_ONLY only (poll.c:28-35, 45).

  6. Delta-list timeout insert is O(n); alternatives are experimental, capacity-bounded (minheap panics on overflow), or fatten every _timeout (Kconfig:806-852).

  7. Deadline scheduling is EDF only within one priority and documented as “simple” (Kconfig:131-138); incompatible with MULTIQ.

  8. Configuration explosion: three queue choices, five timeout backends, SMP, IPI, metairq, userspace permutations; many comments describe edge cases only reachable in some permutations (sched.c:93-96, 652-656).

  9. The userspace permission bitmap is per thread index (MAX_THREAD_BYTES), objects on stacks cannot be shared with user threads, and supervisor code is fully trusted (kobject_internal.h:58-64; userspace.c:968-972; syscalls.rst:239-241).

  10. Fatal-error nested-exception detection is unreliable across architectures (fatal.c:114-119, 164).

  11. The devicetree macro layer is huge and opaque to tooling (devicetree.h, about 19,000 lines of macros).