threadx.git/test/tx, branch v6.4.1_cert

Excluded the regression-test hook code from the coverage denominator

2026-09-23T11:39:47Z

The test build defines TX_REGRESSION_TEST for every configuration, which opens a block in the Linux port header defining eight *_EXTENSION macros. They expand to live code -- flag tests, state changes and calls -- at eight sites in common/src, and an application defines none of them and compiles none of it. gcov attributes a macro expansion to the file that invokes it, so the harness's own scaffolding was being counted as certified source. coverage_union.py now drops those expansions and prints what it dropped beside the configurations it merged, so the exclusion is auditable, and a site that no longer matches the report fails the run rather than being skipped. tx_timer_initialize.c:275 keeps its line and loses only its branches: it is the one macro whose tx_api.h fallback is not empty, so under TX_MISRA_ENABLE that line still carries a statement in a build that ships. gcovr's merged report is not touched. The hook code is 8 lines and 22 branch outcomes, all covered, 0.183% of lines and 0.694% of outcomes. The union goes from 4383/4383 and 3150/3170 to 4376/4376 and 3128/3148: line coverage stays at 100.00%, and the branch rate falls from 99.36909% to 99.364676%, since removing an all-covered block from a figure below 100% moves it down. Both thresholds are unchanged and both pass, the branch one by 0.15 of an outcome. Seven configurations from a wiped tree, 115/115 tests in each, and the twenty uncovered outcomes are the same twenty at the same sixteen sites. Assisted-by: Claude Code (Opus 5)

Raised the coverage gate to the certified baseline figure

2026-09-16T17:35:51Z

The gate carried a margin below the measured figure, set while the coverage work was still in progress so that run-to-run variance could not redden a tree nobody had changed. The work is finished and the variance is gone: the same seven configurations now measure the same figure on a workstation and on a clean runner, so the margin only bought room for a regression to pass. The gate is now the figure the tree achieves -- 100% of the lines of common/src, and every branch outcome but the twenty defensive ones no test can reach. The branch value is written to the two decimal places the report prints, which reads a hundredth of a point below 3150/3170; that is under a third of one outcome, so losing a single line or branch still fails. Verified against the seven per-configuration tracefiles: 4383/4383 lines and 3150/3170 branches pass, 4382/4383 lines and 3149/3170 branches do not. Assisted-by: Claude Code (Opus 5)

Covered the byte allocate's overwritten trace entry via the port hook

2026-09-16T15:27:52Z

The byte allocate saves the time stamp of its own trace entry and comes back to fill in the address it allocated, unless a later event overwrote the entry meanwhile. Interrupts are off across all of the service but the pool search, and nothing in the kernel writes a trace event in that gap, so the other arm never ran. The Linux port already calls out to the harness inside that gap: TX_BYTE_ALLOCATE_EXTENSION exists for coverage work and sits between the restore and the disable that bracket the search. It gains a second clause, under its own flag, calling a routine the harness declares weakly. A new test filters the byte pool event class so the allocate's own insert writes nothing and leaves the buffer parked on the saved entry, then has the hook write a user event, which lands on exactly that entry. Neither half reaches the arm alone. One configuration cannot take it at all, and that is a property of the port rather than of the test: under TX_MISRA_ENABLE the trace time stamp comes from a function whose body returns zero, so every entry reads zero and the comparison is 0 == 0 whatever overwrites it. The test drives the overwrite there too and asserts the consequence only where the time source is real. 805/805 in each of the seven configurations. Union coverage is 4383/4383 lines and 3150/3170 branches against 3147/3168; the denominator gains the new clause's two outcomes and both are covered. Gate raised to 99.30. Assisted-by: Claude Code (Opus 5)

Covered the MISRA loop exits by interposing the shims they test

2026-09-16T14:34:54Z

Under TX_MISRA_ENABLE three kernel loops test a value produced by a function whose whole body returns a constant, so the arm that goes round again cannot execute; the six configurations without the macro compile a plain call, with no loop and no branch at all. Two of the three are the mutex put's prioritize loops and the third is the timer thread's own body. Two new tests define those shim functions themselves. The kernel is built shared and every internal call to either goes through the procedure linkage table, so the executable's definition is the one the kernel reaches and no build file changes. A shim that withholds success on alternate calls sends each mutex loop round exactly twice; the prioritize processing runs unaltered and is idempotent, so the release still leaves the mutex unowned, the suspension list empty and the inherited priority given back, which the test asserts. The timer thread's loop is that thread's whole body, so leaving it ends the thread: that test proves the timer is doing its work first, arms the shim last, and depends on no tick afterwards. Both files record which symbol they replace, why replacing it preserves what surrounds it, and where the replaced function's own coverage comes from -- the other tests, which call both shims through these same constructs. 798/798 in each of the seven configurations. Union coverage is 4383/4383 lines and 3147/3168 branches against 3144 before, the three being one loop exit each; no other outcome moved. Gate raised to 99.25. Assisted-by: Claude Code (Opus 5)

Covered the stack check's null arm by constructing an idle system

2026-09-16T14:29:51Z

Four scheduler services check the stack of the thread they are about to hand the processor to, and reach that check through a test of whether it differs from the thread that is running. An idle system satisfies that test with no thread to execute at all, and the kernel counts the case explicitly, but no ordinary sequence produces it: the one path that leaves no thread to execute returns to the scheduler from inside the suspend, without reaching any of the four. A new test clears the thread to execute and enters one of the four services inside a single interrupt lockout, so the tick cannot put a thread back between the clear and the test the service makes of it. The ready list, the priority map and the highest ready priority are left correct, so the first scheduler operation afterwards recomputes the pointer; a periodic one-tick timer runs throughout, so each idle period ends at the next tick rather than at a retry. The test asserts that the thread was rescheduled and is the thread to execute again, so a service that returned without going through the scheduler fails it rather than covering nothing. 784/784 in each of the seven configurations. Union coverage is 4383/4383 lines and 3144/3168 branches against 3140 before, the four being the null arm at each of the four sites; no other outcome moved. Gate raised to 99.15. Assisted-by: Claude Code (Opus 5)

Added the MISRA event trace configuration, completing the denominator

2026-09-16T02:43:06Z

common/src/tx_misra.c holds a region behind TX_ENABLE_EVENT_TRACE with six functions in it: the MISRA form of the in-line trace insert and five pointer conversions the trace sources use. No build configuration compiled it. misra_build defines TX_MISRA_ENABLE alone and trace_build defines TX_ENABLE_EVENT_TRACE alone, so the region was absent from the coverage denominator rather than uncovered in it - which is the reason misra_build was added in the first place. misra_trace_build defines both. It needs TX_SOURCE_CODE as well, because tx_misra.c is the only one of the 185 files in common/src that does not define it for itself and the prototypes for those five conversions sit behind it in tx_trace.h; without it the file defines five functions with no previous declaration and the build fails. The define goes on the kernel target rather than on every target, because TX_SOURCE_CODE also suppresses the public API mappings that the tests and the sample need. Its empty value matches the plain define the other 184 files carry, so no object code changes in any configuration. The defect itself is in the header and is reported upstream as eclipse-threadx/threadx#745. The existing trace tests drive the region as it stands: all twelve outcomes of the insert and all but one line arrive covered without new work. The exception is _tx_misra_entry_to_uchar_pointer_convert, whose macro no kernel source uses at all, so the MISRA shim test asserts it alongside the conversions it already covers. common/src is at 4383/4383 lines and 3140/3168 branches unioned over the seven configurations, up 44 lines and 12 outcomes on the denominator and covering all of them. The 28 uncovered outcomes are the same 28 in the same 14 files as before. 111/111 tests pass in each of the seven. Assisted-by: Claude Code (Opus 5)

Reported coverage of the source rather than of the compiled configurations

2026-09-16T02:42:53Z

The merged report's branch denominator is not the number of branches in common/src. gcovr keys each branch by the basic-block pair gcov assigned it, and those numbers shift when a file compiles to a different amount of code, so a source branch that survives block renumbering between two configurations is counted twice. Measured over the six configurations: 521 of 1123 branch sites carry more branches in the merged report than any single configuration has, and the denominator reads 4627 where the source carries 3156. The inflation is symmetric for a branch covered everywhere, so the percentage stays plausible and the fault is easy to miss. It is not harmless. A figure quoted as branch coverage of the source has to have the source in its denominator, and this one moves when a build configuration is added for reasons that have nothing to do with the code. coverage_union.py reports the union instead: a line is covered if any configuration executed it, and the Nth branch on a line is covered if any configuration took it, keyed by position within the line rather than by block number. gcovr's merged report is still produced and published unchanged; the ratchet now gates on the union, so the floor tracks the source. Both figures agree on what is uncovered: the same 28 branch outcomes in the same 14 files either way. Over the six configurations the union reads 4339/4339 lines and 3128/3156 branches, against 4339/4339 and 4599/4627 merged, with the gates set to 99.95 and 99.00. Assisted-by: Claude Code (Opus 5)

Removed the thread sleep test's unbuildable interrupt condition block

2026-09-16T00:10:45Z

Six conditional regions in the thread sleep test sit behind TEST_INTERRUPT_CONDITION, a macro no build in the repository defines. Between them they hold an adaptive calibration loop, a delay function, a semaphore and eleven file-scope variables, none of which is ever compiled. Left in place they read to any later reader as though the kernel path they target has a dedicated test, when it does not; that path is covered by other tests. The regions are removed, along with the two kernel headers whose only users in the file were inside them and a commented-out define that only enabled prints inside them. Nothing outside the regions is touched, and the SMP copy is left alone. Merged coverage over the six build configurations is bit identical across the deletion: 4339/4339 lines and 4599/4627 branches, with zero lines and zero branch outcomes differing anywhere in common/src. 111/111 tests pass in each of the six. Assisted-by: Claude Code (Opus 5)

Covered the trace object registry's name copy and reuse choice

2026-09-16T00:04:48Z

The trace object registry carried three decisions ordinary use never reaches. The name copy stops at the string's terminator, so it never left the loop by its own count; it had no caller that passed no name at all, so the check that recognises one was never true and the line behind it never ran; and the search that reuses an old entry prefers a later free entry to an earlier one unless the earlier one has never held a valid object, which nothing the kernel registers produces. A new regression test creates one object whose name is longer than a registry entry keeps room for and one with no name at all, and asserts the entry each leaves behind. It then fills the registry, registering one entry with the object type the registry treats as not valid, frees that entry last so the search starts there, and registers again - so the search meets a free entry that has never held a valid object and keeps it rather than moving on. The test asserts the new object landed in that entry. The registry is now at 65/65 lines and 42/42 branches, and common/src is at 4339/4339 lines - every line of the certified source is reached in at least one of the six build configurations. Branches are at 4599/4627, up 3 outcomes and the last uncovered line, with the gates raised to 99.95 and 99.30 to hold them. 111/111 tests pass in each of the six. Assisted-by: Claude Code (Opus 5)

Covered the trace inserts in the tracing machinery's own services

2026-09-15T23:59:33Z

Five in-line trace inserts sit in the trace component itself rather than in a service that uses it: two in the enable, one in the interrupt control, one in each of the two inserts a port's interrupt shim makes around an ISR, and one in the user event insert. Between them they scored four to seven of the twelve branch outcomes the macro carries. A new regression test walks the four ordinary ones once per condition the macro distinguishes: tracing off altogether, thread context with every event enabled, their three event classes filtered out, interrupt context through the test ISR dispatch, initialization context, the state an interrupt presents, and a positioned buffer wrap with and without a buffer-full notification registered. None of these services has an error checking shell in front of it and none refuses a caller on the strength of the system state, so the published entry points reach every insert in every state. The interrupt control is driven as the kernel's own lockout macros drive it, a disable whose returned posture is handed straight back, so the pair is balanced whatever posture it is called in. The buffer is positioned and the service called under one lockout, because the tick's own ISR inserts would otherwise take the boundary. A second test drives the two inserts the enable writes itself. They run a few lines after the buffer pointer and the event enable bits are both set, so the only things left free are the system state, whether the buffer holds a single entry, and what a notification called from inside the first insert does before the second runs. The enable is given a buffer sized from the kernel's own structures to hold exactly one event, with three notifications: one that counts, one that filters the running event's class, and one that turns tracing off - the shape an application capturing a single bufferful of history uses. Four of the five inserts now score twelve of twelve. The user event insert reaches eleven: its own guard on the buffer pointer, a few lines above and inside the same lockout, makes the insert's null arm unreachable. The enable's first insert reaches ten for the same kind of reason - the buffer pointer and the enable bits are assigned above it. Merged over the six build configurations: 4338/4339 lines and 4596/4627 branches, up 36 outcomes, with the branch gate raised to 99.20 to hold them. 110/110 tests pass in each of the six. Assisted-by: Claude Code (Opus 5)