Covered the second MISRA loop the always-true shim controls

2026-09-21T00:09:11Z

TX_LOOP_FOREVER appears twice in common_smp/src. Under TX_MISRA_ENABLE both expand to a call on _tx_misra_always_true rather than to a literal, so each carries an exit arm the kernel never takes. The timer thread's loop was already covered by replacing that shim; the per-core state initialisation loop in _tx_thread_smp_current_state_set was not, because the kernel reaches it only from the three initialisation paths that run before the scheduler starts a thread. The existing test drives it directly instead, with the shim already armed and the timer thread already ended, so nothing else in the run can reach the shim while it is refusing. The service is handed back the state its highest core already holds, so the one assignment a shortened loop performs writes the value that was there; the test asserts afterwards that every core's state is the one it saw before the call, and that the shim refused exactly twice. No second symbol is replaced and no test is added to the list of those that replace one. 2/2 at tx_thread_smp_current_state_set.c:97, seven executions of the loop and one exit, measured with the coverage isolated to this test. 135/135 in each of eight configurations and 3587/3612 branch outcomes on the union basis. Fifty standalone repeats in each of the eight, no failures. Assisted-by: Claude Code (Opus 5)

Covered the timer thread loop's exit through the shim it tests

2026-09-20T00:03:21Z

The timer thread's body is one loop whose controlling expression is, under TX_MISRA_ENABLE, a call to a function that returns a constant rather than the literal the other six configurations compile. The exit arm therefore never executes, and in the configurations without the macro gcc folds the condition and the branch does not exist at all. The function has no behaviour of its own -- its whole body is return(TX_TRUE) -- so the test defines it. The kernel is built shared and every internal reference goes through the procedure linkage table, so the definition in the test executable is the one the loop reaches, with no linker option and no preloading. It has exactly two callers in the library: this loop, and the initialisation loop in _tx_thread_smp_current_state_set, which is reached only from the three initialisation paths that run before the scheduler starts a thread and so cannot be reached from a running test. What that costs is the timer thread, because the loop is the whole of its entry function. The test therefore does it deliberately and last: it proves three expirations have been processed, arms the shim, waits for the thread to end, and reports. Nothing after the arming depends on a tick. The test file carries the disclosure this needs -- which symbol is replaced, what the library's version does, why replacing it leaves the rest intact, and where the replaced function's own coverage comes from. tx_timer_thread_entry.c:112 reads two of two in misra_build and misra_trace_build. The file stands at 73/73 lines and 28/30 branch outcomes; the two left are the spin-on-error loops over _tx_thread_smp_core_exclude, which has behaviour of its own. 116/116 tests pass in each of eight configurations, twice from clean, with retries disabled. Assisted-by: Claude Code (Opus 5)

threadx.git/test/smp/regression/threadx_timer_misra_loop_test.c, branch v6.4.1_cert

Covered the second MISRA loop the always-true shim controls

Covered the timer thread loop's exit through the shim it tests