@@ -0,0 +1,135 @@
+// Copyright (c) 2026, Arm Limited and contributors.
+// SPDX-License-Identifier: Apache-2.0
+//
+// S32Z2 board bring-up: RTD init, UART9 console, newlib _write retarget.
+
+#include <stdint.h>
+#include <unistd.h>
+#include <errno.h>
+
+#include "platform/freertos/s32z2/board_init.h"
+
+#include "Clock_Ip.h"
+#include "Siul2_Port_Ip.h"
+#include "Linflexd_Uart_Ip.h"
+#include "Linflexd_Uart_Ip_VS_0_PBcfg.h"
+
+// S32CT-generated pin-mux table. NUM_OF_CONFIGURED_PINS comes from the board
+// Siul2_Port_Ip_Cfg.h; g_pin_mux_InitConfigArr_VS_0 (the actual pad settings)
+// from the generated PB cfg. This table muxes the NETC ETH0 RGMII pins
+// (SIUL2_1[58..65] -> ALT1 = ETH_0_RGMII_TXD/RXD/TXC/TXCTL/RXCTL/RX_CLK) plus
+// the PHY GPIO control pins. The lwip example applies it via Port_Init(); we
+// apply it directly with Siul2_Port_Ip_Init() (see board_init()).
+#include "Siul2_Port_Ip_Cfg.h"
+#include "Siul2_Port_Ip_VS_0_PBcfg.h"
+
+// AUTOSAR Mcu_Init / Port_Init / Platform_Init would require Mcu_Cfg.c /
+// Port_Cfg.c / Platform_Cfg.c — those PB configs are absent from the lwip
+// S32CT example (Components view does not instantiate them), so the build
+// filters them out. The NXP startup.s + SystemInit handle MCU bring-up
+// before main(); we still need the IP-layer Clock_Ip_Init below to enable
+// the LINFLEXD9 module clock that SystemInit does not touch.
+
+// Mcu_aClockConfigPB[] is defined in Clock_Ip_VS_0_PBcfg.c (S32CT
+// generated). The lwip example uses the AUTOSAR-Mcu naming
+// (Mcu_aClockConfigPB) rather than the bare Clock_Ip_aClockConfig from
+// non-AUTOSAR examples — both are the same Clock_Ip_ClockConfigType
+// array. Element 0 is the default ClockConfig0 that turns the LINFLEXD9
+// module clock on.
+extern const Clock_Ip_ClockConfigType Mcu_aClockConfigPB[];
+
+// LINFLEXD instance 9 is wired to the X-S32Z27X-DC FT232RQ console
+// (matches the Zephyr `_D` overlay's `zephyr,console = &uart9`).
+// PB cfg symbol is generated by S32CT into Linflexd_Uart_Ip_VS_0_PBcfg.c.
+extern const Linflexd_Uart_Ip_UserConfigType Linflexd_Uart_Ip_xHwConfigPB_0_VS_0;
+
+// SIUL2_5 PORT150 → ALT1 → LIN_9_TX. The S32CT Pins tool added the routing
+// to the .mex but the Update Code action did not regenerate the Siul2_Port
+// PB cfg, so we configure the pad inline via the RTD IP-layer API.
+static const Siul2_Port_Ip_PinSettingsConfig kLin9TxPin = {
+    .base                     = IP_SIUL2_5,
+    .pinPortIdx               = 150U,
+    .mux                      = PORT_MUX_ALT1,
+    .safeMode                 = PORT_SAFE_MODE_DISABLED,
+    .pullConfig               = PORT_INTERNAL_PULL_NOT_ENABLED,
+    .slewRateCtrlSel          = PORT_SLEW_RATE_CONTROL0,
+    .receiverSel              = PORT_RECEIVER_NOT_AVAILABLE,
+    .terminationResistor      = PORT_TERMINATION_RESISTOR_NOT_AVAILABLE,
+    .currentReferenceControl  = PORT_CURRENT_REFERENCE_CONTROL_NOT_AVAILABLE,
+    .rxCurrentBoost           = PORT_RX_CURRENT_BOOST_NOT_AVAILABLE,
+    .openDrain                = PORT_OPEN_DRAIN_DISABLED,
+    .inputBuffer              = PORT_INPUT_BUFFER_DISABLED,
+    .outputBuffer             = PORT_OUTPUT_BUFFER_ENABLED,
+    .initValue                = 0U,
+    .inputMuxReg              = { 0U, 0U, 0U, 0U, 0U, 0U, 0U, 0U },
+    .inputMux                 = { 0U, 0U, 0U, 0U, 0U, 0U, 0U, 0U },
+};
+
+void uart9_init_115200_8N1(void) {
+    Siul2_Port_Ip_PinInit(&kLin9TxPin);
+    (void)Linflexd_Uart_Ip_Init(9U, &Linflexd_Uart_Ip_xHwConfigPB_0_VS_0);
+}
+
+int uart9_tx_byte(uint8_t b) {
+    return (Linflexd_Uart_Ip_SyncSend(9U, &b, 1U, 100U)
+            == LINFLEXD_UART_IP_STATUS_SUCCESS) ? 0 : -1;
+}
+
+int board_init(void) {
+    (void)Clock_Ip_Init(&Mcu_aClockConfigPB[0U]);
+    uart9_init_115200_8N1();
+    // Mux the NETC ETH0 RGMII + PHY-control pins. Without this the MAC<->PHY
+    // RGMII pins stay at their reset function and the Ethernet wire interface is
+    // dead in BOTH directions (no TX on the wire, no RX) -- the lwip example
+    // does this inside Port_Init(), which the board otherwise skips.
+    (void)Siul2_Port_Ip_Init(NUM_OF_CONFIGURED_PINS, g_pin_mux_InitConfigArr_VS_0);
+    return 0;
+}
+
+// generic_timer.c registers SysTick_Handler as the physical-timer ISR but
+// leaves it up to the application. We alias it to the CR52 port's
+// xPortSysTickHandler via a linker --defsym in CMakeLists.txt.
+
+// Newlib retarget: every printf/puts/fwrite to stdout/stderr ends up here.
+int _write(int fd, const char *buf, int len) {
+    if (fd != 1 && fd != 2) {
+        errno = EBADF;
+        return -1;
+    }
+    for (int i = 0; i < len; ++i) {
+        if (uart9_tx_byte((uint8_t)buf[i]) != 0) {
+            return i;
+        }
+    }
+    return len;
+}
+
+// Newlib stubs to keep the link clean for bare metal.
+int _close(int fd) { (void)fd; errno = EBADF; return -1; }
+int _lseek(int fd, int off, int whence) { (void)fd; (void)off; (void)whence; errno = EBADF; return -1; }
+int _read(int fd, char *buf, int len) { (void)fd; (void)buf; (void)len; errno = EBADF; return -1; }
+int _fstat(int fd, void *st) { (void)fd; (void)st; errno = EBADF; return -1; }
+int _isatty(int fd) { return (fd == 1 || fd == 2) ? 1 : 0; }
+int _getpid(void) { return 1; }
+int _kill(int pid, int sig) { (void)pid; (void)sig; errno = EINVAL; return -1; }
+
+// ---- PIT-driven FreeRTOS tick ----
+// Engineer substitutes the actual PIT register layout from the S32Z2
+// reference manual; the RTD typically exposes Pit_Ip_Init / Pit_Ip_StartChannel.
+// PIT channel 0, period = configCPU_CLOCK_HZ / configTICK_RATE_HZ.
+
+#include "FreeRTOSConfig.h"
+
+extern void Pit_Ip_Init(void);
+extern void Pit_Ip_StartChannel(uint8_t instance, uint8_t channel, uint32_t ticks);
+extern void Pit_Ip_ClearInterruptFlag(uint8_t instance, uint8_t channel);
+
+void s32z2_pit_setup_tick_interrupt(void) {
+    Pit_Ip_Init();
+    Pit_Ip_StartChannel(0u, 0u,
+        (uint32_t)(configCPU_CLOCK_HZ / configTICK_RATE_HZ));
+}
+
+void s32z2_pit_clear_tick_interrupt(void) {
+    Pit_Ip_ClearInterruptFlag(0u, 0u);
+}
@@ -0,0 +1,243 @@
+// Copyright (c) 2026, Arm Limited and contributors.
+// SPDX-License-Identifier: Apache-2.0
+//
+// ARM-mode replacements for NXP's RTD Thumb-encoded CP15 / VFP accessors,
+// hooked in via `-Wl,--wrap=read_CPACR,...` so callers reach these
+// instead of NXP's. NXP ships read_CPACR / write_CPACR / write_FPEXC
+// inside core_utility.s with `.thumb2`. Core_FPU_Init in core.c is
+// ARM-mode and reaches them via `blx`; the `blx` correctly switches to
+// Thumb on entry, but the Thumb `mov pc, lr` epilogue does *not*
+// interwork back to ARM on this Cortex-R52 — the T bit stays set, the
+// caller's ARM-encoded body is decoded as Thumb-2, and the CPU branches
+// off into the .intc_vector data area. Replacing the helpers with
+// ARM-mode versions that finish with `bx lr` keeps the LSB-clear LR set
+// by the caller's `blx`, so the return is interworked correctly and
+// control comes back to the caller in ARM state.
+
+    .syntax unified
+    .arch armv8-r
+    .arm
+
+    .section .sram_code, "ax"
+
+    .global __wrap_read_CPACR
+    .type   __wrap_read_CPACR, %function
+__wrap_read_CPACR:
+    mrc     p15, 0, r0, c1, c0, 2
+    bx      lr
+    .size   __wrap_read_CPACR, . - __wrap_read_CPACR
+
+    .global __wrap_write_CPACR
+    .type   __wrap_write_CPACR, %function
+__wrap_write_CPACR:
+    mcr     p15, 0, r0, c1, c0, 2
+    isb     sy
+    bx      lr
+    .size   __wrap_write_CPACR, . - __wrap_write_CPACR
+
+    .global __wrap_write_FPEXC
+    .type   __wrap_write_FPEXC, %function
+__wrap_write_FPEXC:
+    vmsr    fpexc, r0
+    isb     sy
+    bx      lr
+    .size   __wrap_write_FPEXC, . - __wrap_write_FPEXC
+
+    .global __wrap_read_FPEXC
+    .type   __wrap_read_FPEXC, %function
+__wrap_read_FPEXC:
+    vmrs    r0, fpexc
+    bx      lr
+    .size   __wrap_read_FPEXC, . - __wrap_read_FPEXC
+
+    // write_64bit(lo=r0, hi=r1, dest=r2) — 64-bit atomic store for ECC SRAM.
+    // NXP's Thumb-encoded original has the same `mov pc, lr` non-interwork
+    // problem as the CPACR helpers; init_data_bss → zero_copy64 → write_64bit
+    // is the chain that derailed before this wrap was added.
+    .global __wrap_write_64bit
+    .type   __wrap_write_64bit, %function
+__wrap_write_64bit:
+    strd    r0, r1, [r2]
+    bx      lr
+    .size   __wrap_write_64bit, . - __wrap_write_64bit
+
+    // ===== CP15 / MPU / GIC helpers =====
+    // The same `mov pc, lr` interworking failure also affects every other
+    // CP15 accessor NXP ships in core_utility.s. SystemInit → Core_IC_Init
+    // and the GIC500 init path call these via `blx` from ARM C code, and
+    // any non-interworked return derails into Thumb decode of ARM bytes.
+    // Wrap every helper that is actually called via BLX in the current
+    // build (15 total, identified by `objdump -d | grep 'blx 321012...'`).
+    //
+    // Encodings are byte-identical to NXP's originals at 0x32101276..
+    // 0x32101324, just re-emitted as ARM-mode with a `bx lr` epilogue.
+
+    .global __wrap_read_SCTLR
+    .type   __wrap_read_SCTLR, %function
+__wrap_read_SCTLR:
+    mrc     p15, 0, r0, c1, c0, 0
+    bx      lr
+    .size   __wrap_read_SCTLR, . - __wrap_read_SCTLR
+
+    .global __wrap_write_SCTLR
+    .type   __wrap_write_SCTLR, %function
+__wrap_write_SCTLR:
+    mcr     p15, 0, r0, c1, c0, 0
+    isb     sy
+    bx      lr
+    .size   __wrap_write_SCTLR, . - __wrap_write_SCTLR
+
+    .global __wrap_write_PRSELR
+    .type   __wrap_write_PRSELR, %function
+__wrap_write_PRSELR:
+    mcr     p15, 0, r0, c6, c2, 1
+    isb     sy
+    bx      lr
+    .size   __wrap_write_PRSELR, . - __wrap_write_PRSELR
+
+    .global __wrap_write_PRBAR
+    .type   __wrap_write_PRBAR, %function
+__wrap_write_PRBAR:
+    mcr     p15, 0, r0, c6, c3, 0
+    bx      lr
+    .size   __wrap_write_PRBAR, . - __wrap_write_PRBAR
+
+    .global __wrap_write_PRLAR
+    .type   __wrap_write_PRLAR, %function
+__wrap_write_PRLAR:
+    mcr     p15, 0, r0, c6, c3, 1
+    bx      lr
+    .size   __wrap_write_PRLAR, . - __wrap_write_PRLAR
+
+    .global __wrap_write_MAIR0
+    .type   __wrap_write_MAIR0, %function
+__wrap_write_MAIR0:
+    mcr     p15, 0, r0, c10, c2, 0
+    bx      lr
+    .size   __wrap_write_MAIR0, . - __wrap_write_MAIR0
+
+    .global __wrap_write_MAIR1
+    .type   __wrap_write_MAIR1, %function
+__wrap_write_MAIR1:
+    mcr     p15, 0, r0, c10, c2, 1
+    bx      lr
+    .size   __wrap_write_MAIR1, . - __wrap_write_MAIR1
+
+    .global __wrap_read_MPIDR
+    .type   __wrap_read_MPIDR, %function
+__wrap_read_MPIDR:
+    mrc     p15, 0, r0, c0, c0, 5
+    bx      lr
+    .size   __wrap_read_MPIDR, . - __wrap_read_MPIDR
+
+    .global __wrap_write_ICC_SRE
+    .type   __wrap_write_ICC_SRE, %function
+__wrap_write_ICC_SRE:
+    mcr     p15, 0, r0, c12, c12, 5
+    isb     sy
+    bx      lr
+    .size   __wrap_write_ICC_SRE, . - __wrap_write_ICC_SRE
+
+    // gic500_enableCpuInterface reaches write_ICC_PMR via *plain* ARM `bl`,
+    // not `blx` — the compiler/linker did not insert an interworking veneer.
+    // Without a wrap the ARM caller jumps to a Thumb-encoded body and decodes
+    // its first halfword as ARM (UndefInstr). All other ICC_* helpers in the
+    // same call sequence happen to be reached via `blx` and are caught by
+    // the BLX-only audit; PMR is the lone exception, so it needs a wrap too.
+    .global __wrap_write_ICC_PMR
+    .type   __wrap_write_ICC_PMR, %function
+__wrap_write_ICC_PMR:
+    mcr     p15, 0, r0, c4, c6, 0
+    isb     sy
+    bx      lr
+    .size   __wrap_write_ICC_PMR, . - __wrap_write_ICC_PMR
+
+    .global __wrap_write_ICC_BPR0
+    .type   __wrap_write_ICC_BPR0, %function
+__wrap_write_ICC_BPR0:
+    mcr     p15, 0, r0, c12, c8, 3
+    bx      lr
+    .size   __wrap_write_ICC_BPR0, . - __wrap_write_ICC_BPR0
+
+    .global __wrap_write_ICC_BPR1
+    .type   __wrap_write_ICC_BPR1, %function
+__wrap_write_ICC_BPR1:
+    mcr     p15, 0, r0, c12, c12, 3
+    bx      lr
+    .size   __wrap_write_ICC_BPR1, . - __wrap_write_ICC_BPR1
+
+    .global __wrap_write_ICC_IGRPEN0
+    .type   __wrap_write_ICC_IGRPEN0, %function
+__wrap_write_ICC_IGRPEN0:
+    mcr     p15, 0, r0, c12, c12, 6
+    isb     sy
+    bx      lr
+    .size   __wrap_write_ICC_IGRPEN0, . - __wrap_write_ICC_IGRPEN0
+
+    .global __wrap_write_ICC_IGRPEN1
+    .type   __wrap_write_ICC_IGRPEN1, %function
+__wrap_write_ICC_IGRPEN1:
+    mcr     p15, 0, r0, c12, c12, 7
+    isb     sy
+    bx      lr
+    .size   __wrap_write_ICC_IGRPEN1, . - __wrap_write_ICC_IGRPEN1
+
+    .global __wrap_read_ICC_CTLR
+    .type   __wrap_read_ICC_CTLR, %function
+__wrap_read_ICC_CTLR:
+    mrc     p15, 0, r0, c12, c12, 4
+    bx      lr
+    .size   __wrap_read_ICC_CTLR, . - __wrap_read_ICC_CTLR
+
+    .global __wrap_write_ICC_CTLR
+    .type   __wrap_write_ICC_CTLR, %function
+__wrap_write_ICC_CTLR:
+    mcr     p15, 0, r0, c12, c12, 4
+    isb     sy
+    bx      lr
+    .size   __wrap_write_ICC_CTLR, . - __wrap_write_ICC_CTLR
+
+    // ===== Undefined-Instruction vector -> FreeRTOS lazy-FPU handler =====
+    // NXP's Vector_Table.s routes the undef vector to a .weak UndefInstr_Handler
+    // (exceptions.c) that just spins. The ARM_CR52_GIC port instead ships its
+    // own vPortUndefinedInstruction (port.c, built when configENABLE_FPU==1)
+    // that lazily re-enables the FPU on a task's first VFP instruction and
+    // manages per-task FP context -- but it is never wired up. The port clears
+    // FPEXC.EN on every task switch and *relies* on this handler to re-enable
+    // it, so without the wiring the first VFP op in any task (e.g. _vfprintf_r's
+    // `vpush {d8-d9}`) traps into the spinning default and hangs.
+    //
+    // Provide a strong UndefInstr_Handler (overriding the weak one) that jumps
+    // to vPortUndefinedInstruction. The vector reaches this exactly as it
+    // reached the spinning default (ARM-mode, UND mode, LR_und set); the
+    // `ldr pc, =` interworks to the port handler (Thumb) without disturbing LR,
+    // which vPortUndefinedInstruction adjusts itself. FP-using tasks must be
+    // created with xTaskCreateFpu so the handler finds their FP context in TLS.
+    .global UndefInstr_Handler
+    .type   UndefInstr_Handler, %function
+UndefInstr_Handler:
+    ldr     pc, 1f
+1:  .word   vPortUndefinedInstruction
+    .size   UndefInstr_Handler, . - UndefInstr_Handler
+
+    // ===== IRQ vector -> FreeRTOS interrupt dispatcher =====
+    // NXP's Vector_Table.s routes the IRQ vector to a weak IRQ_Handler
+    // (exceptions_stack.s) that saves the interrupted context onto the SYS
+    // (task) stack, calls the registered ISR, and returns. It cannot perform a
+    // FreeRTOS context switch: xPortSysTickHandler calls vTaskSwitchContext()
+    // (updating pxCurrentTCB) but the generic handler never swaps stacks, and
+    // the periodic-timer IRQ data-aborts in its `ldmia sp!, {r0-r12}` epilogue.
+    //
+    // The port ships vPortInterruptDispatcher (port.c) -- the real FreeRTOS IRQ
+    // entry that reads ICC_IAR1, dispatches low-priority ISRs, and routes OS
+    // interrupts (>= configMAX_SYSCALL_INTERRUPT_PRIORITY) through its osInt
+    // path which does the full save / vTaskSwitchContext / restore. Override
+    // the weak IRQ_Handler to jump to it. It uses the IRQ/SVC mode stacks that
+    // startup.s set up, and looks up ISRs via __VECTOR_RAM (defsym'd to the
+    // core-0 RAM vector table that NXP's startup populates).
+    .global IRQ_Handler
+    .type   IRQ_Handler, %function
+IRQ_Handler:
+    ldr     pc, 2f
+2:  .word   vPortInterruptDispatcher
+    .size   IRQ_Handler, . - IRQ_Handler