threadx.git/test, branch v6.4.1_cert

Excluded the SMP regression-test hook code from the coverage figure

2026-09-23T13:42:51Z

Every SMP build configuration is compiled with -DTX_REGRESSION_TEST, which opens a block in the Linux SMP port header defining ten macros that expand to live code -- flag tests, state changes and calls -- at eleven sites in common_smp/src. An application defines none of them and tx_api.h expands them all to nothing, but gcov attributes a macro expansion to the file that invokes it, so the harness's own scaffolding was being counted as certified source. coverage_union.py now drops those sites and prints what it dropped, covered and total on both axes, so the exclusion can be audited rather than inferred. One site keeps its line: tx_api.h defines TX_TIMER_INITIALIZE_EXTENSION as a real statement under TX_MISRA_ENABLE, so that line ships and only its branches come out. A listed site that no longer matches the report is a hard failure naming the macro, not a silent skip. The branch gate moves 99.05 to 99.04 because the margin is ten outcomes rather than a percentage, and a smaller denominator buys nine at the old value; the line gate is unchanged. The excluded code measured 10 lines and 36 branch outcomes, every one of them covered, so the uncovered set is untouched: the same 24 outcomes at the same 22 sites in the same 13 files, over the same 194 files. Eight configurations from a wiped tree, 136/136 tests in each, 0 failed. The union goes from 5449/5450 lines and 3588/3612 branch outcomes to 5439/5440 and 3552/3576, re-derived key by key against the previous measurement. gcovr's merged report is published unchanged. Assisted-by: Claude Code (Opus 5)

Excluded the regression-test hook code from the coverage denominator

2026-09-23T11:39:47Z

The test build defines TX_REGRESSION_TEST for every configuration, which opens a block in the Linux port header defining eight *_EXTENSION macros. They expand to live code -- flag tests, state changes and calls -- at eight sites in common/src, and an application defines none of them and compiles none of it. gcov attributes a macro expansion to the file that invokes it, so the harness's own scaffolding was being counted as certified source. coverage_union.py now drops those expansions and prints what it dropped beside the configurations it merged, so the exclusion is auditable, and a site that no longer matches the report fails the run rather than being skipped. tx_timer_initialize.c:275 keeps its line and loses only its branches: it is the one macro whose tx_api.h fallback is not empty, so under TX_MISRA_ENABLE that line still carries a statement in a build that ships. gcovr's merged report is not touched. The hook code is 8 lines and 22 branch outcomes, all covered, 0.183% of lines and 0.694% of outcomes. The union goes from 4383/4383 and 3150/3170 to 4376/4376 and 3128/3148: line coverage stays at 100.00%, and the branch rate falls from 99.36909% to 99.364676%, since removing an all-covered block from a figure below 100% moves it down. Both thresholds are unchanged and both pass, the branch one by 0.15 of an outcome. Seven configurations from a wiped tree, 115/115 tests in each, and the twenty uncovered outcomes are the same twenty at the same sixteen sites. Assisted-by: Claude Code (Opus 5)

Corrected the gate comment's count of single-carrier outcomes

2026-09-21T12:36:35Z

The comment added in the previous commit said six outcomes in the figure have no configuration to cover for them. That was the count of outcomes that both have a single carrier and were seen moving between runs, not the count of single-carrier outcomes, and as written it is wrong. Measured over sixteen runs at two commits: thirty-five outcomes are compiled by two configurations and covered by only one of them in at least one run, almost all TX_THREAD_STACK_CHECK fence ordinals that stack_checking_build holds alone because its random-fill sibling short-circuits before them. A further 894 are compiled by exactly one configuration at all, which is structural rather than fragile, the racing outcome excepted. The margin's justification is restated on the figure that actually sizes it: the largest movement observed in any one configuration is eight outcomes, and the margin is ten. No threshold changes. The gate stays at 99.79 line and 99.05 branch, and sixteen runs read 5449/5450 lines and 3588/3612 branch outcomes on the union basis with an empty unstable set on both axes. Assisted-by: Claude Code (Opus 5)

Settled the SMP coverage gate margin on the evidence measurement

2026-09-21T12:18:43Z

The gate's comment left open whether the ten-line, ten-outcome margin could be removed once the unstable set closed, and deferred the answer to the coverage evidence work. It has now been measured. The thresholds do not move, and the comment records why. Read per configuration over eight CI runs at one commit, eight branch outcomes and four lines move between runs, and six outcomes in the published figure are compiled by only one configuration that covers them: five TX_THREAD_STACK_CHECK arms that stack_checking_build carries alone in most runs, because stack_checking_rand_fill_build misses them in seven and four runs of eight, and the trace race outcome, which only trace_build compiles. The union figure is stable because the eight configurations cover for each other, not because the suite is deterministic, so a zero-margin gate would read a runner's timing as a regression. Eight runs at the preceding commit read 5449/5450 lines and 3588/3612 branch outcomes identically on the union basis, unstable set empty on both axes, 136/136 tests in each of the 64 configuration-runs. gcovr's merged report over those same runs reads 6561, 6563 and 6564 of 6601, which is the same movement seen through a denominator that does not collapse it. Assisted-by: Claude Code (Opus 5)

Raised the SMP gate onto the floor the trace race test lifted

2026-09-21T04:01:02Z

The coverage ratchet sat at 99.03 branch, set below the 3587 outcomes every run of the previous sample reached. Covering the user event insert's disabled-buffer arm moves that floor by one. Raised to 99.05, still ten outcomes below the set covered in every run, which is now 3588 of 3612. The line gate is unchanged at 99.79: neither the line total nor its denominator moved. The comment above the thresholds gains the one thing about this figure a later reader has to know -- a single outcome in it is reached by two cores racing rather than by a thread doing something in order, and it is counted in the always-covered set on a measurement over ten runs on two machines rather than on one sample. Seven CI runs at the test head, all green, 136/136 in each of eight configurations, 5449/5450 and 3588/3612 in every one. Two clean local cycles read the same two totals. Assisted-by: Claude Code (Opus 5)

Covered the user event insert's own test of a disabled trace buffer

2026-09-21T04:01:02Z

_tx_trace_user_event_insert tests the trace buffer pointer and returns TX_NOT_DONE if it is null; the insert sits in the else, and the macro reads the same variable and tests it again a few instructions later, inside one protection with nothing between. The second test's false arm had no route on one core and was carried as unreachable. It is an ordinary state of the running kernel on SMP, and no fault has to be invented for it. _tx_trace_disable clears that pointer and takes no lock of any kind, so a thread disabling tracing on one core while another is inside the insert clears it under that core. A new test drives 300,000 inserts against a second thread on a core of its own writing the same store the disable service writes. No kernel symbol is replaced and both services run their own code from end to end; the test asserts that the two threads held different cores and that the writer's stores reached the service, and says in the file that the arm itself is evidenced by the coverage report because nothing outside the macro can observe it. The pass count is sized from measurement on the slower of two machines. The arm is taken 49 to 132 times per run on this workstation over three runs and 521 to 1298 times per run on a CI runner over seven. 136/136 in each of eight configurations, twice from clean, 3588/3612 branch outcomes on the union basis against 3587/3612 before. Fifty standalone repeats in each of the eight, no failures. Assisted-by: Claude Code (Opus 5)

Raised the SMP gate onto the new denominator and floor

2026-09-21T00:09:11Z

The coverage ratchet sat at 99.79 line and 98.97 branch against a branch denominator of 3610. The port hook's new clause adds two covered outcomes to tx_byte_allocate.c, so the denominator is 3612, and the sweep closed two further outcomes on top of that. The branch gate goes to 99.03, still ten outcomes below the 3587 of 3612 covered in every run of the sample. The line gate is unchanged at 99.79: neither the line total nor its denominator moved. The comment above the thresholds records why the denominator moved, and that the unstable set is now empty in two consecutive samples on two different trees rather than one. The margin stays for the reason it was kept before -- five earlier samples moved an outcome in every direction there is -- and whether it can go is the evidence step's question. Seven CI runs at the sweep head, all green, 135/135 in each of eight configurations, 5449/5450 and 3587/3612 in every one. Two clean local cycles read the same two totals. Assisted-by: Claude Code (Opus 5)

Covered the second MISRA loop the always-true shim controls

2026-09-21T00:09:11Z

TX_LOOP_FOREVER appears twice in common_smp/src. Under TX_MISRA_ENABLE both expand to a call on _tx_misra_always_true rather than to a literal, so each carries an exit arm the kernel never takes. The timer thread's loop was already covered by replacing that shim; the per-core state initialisation loop in _tx_thread_smp_current_state_set was not, because the kernel reaches it only from the three initialisation paths that run before the scheduler starts a thread. The existing test drives it directly instead, with the shim already armed and the timer thread already ended, so nothing else in the run can reach the shim while it is refusing. The service is handed back the state its highest core already holds, so the one assignment a shortened loop performs writes the value that was there; the test asserts afterwards that every core's state is the one it saw before the call, and that the shim refused exactly twice. No second symbol is replaced and no test is added to the list of those that replace one. 2/2 at tx_thread_smp_current_state_set.c:97, seven executions of the loop and one exit, measured with the coverage isolated to this test. 135/135 in each of eight configurations and 3587/3612 branch outcomes on the union basis. Fifty standalone repeats in each of the eight, no failures. Assisted-by: Claude Code (Opus 5)

Covered the byte allocate's overwritten trace entry

2026-09-21T00:08:56Z

The byte allocate records a trace event on the way in, saves the entry's time stamp, and comes back to write the address it returned into that same entry -- but only if the time stamp says nothing overwrote the entry meanwhile. Nothing in the kernel writes a trace event inside the window, so the other arm had no agent and no test. The Linux SMP port's TX_BYTE_ALLOCATE_EXTENSION gains a second clause, guarded by its own flag and calling a routine the harness declares weakly, in the shape TX_BYTE_RELEASE_EXTENSION already uses. The hook runs between the restore and the disable that bracket the pool search, which on SMP is a real release of the protection rather than an interrupt gap. A new test filters the byte pool event class so the allocate's own insert writes nothing and leaves the buffer parked on the saved entry, then lets the hook write a user event onto it; neither lever reaches the arm without the other. No kernel symbol is replaced and the allocate runs its own code end to end. The macro expands inside tx_byte_allocate.c, so the new clause's if is certified-source branch: the union branch denominator moves from 3610 to 3612 and both new outcomes are covered. The arm closes in trace_build alone. Under TX_MISRA_ENABLE the port's trace time source returns a constant, so the comparison reads 0 == 0 whatever the hook writes, and the test asserts the consequence only where the time source is real. 135/135 in each of eight configurations, 3586/3612 branch outcomes on the union basis against 3583/3610 before. Fifty standalone repeats in each of the eight, no failures. Assisted-by: Claude Code (Opus 5)

Raised the SMP gate onto the floor the trace batch lifted

2026-09-20T22:40:57Z

The coverage ratchet sat at 99.32 line and 97.42 branch, set below the 5423 lines and 3527 branch outcomes every run of the previous sample reached. The initialize, trace and MISRA shim batch has moved both floors. Raised to 99.79 and 98.97, still ten lines and ten outcomes below the set covered in every run of the sample, which is now 5449 lines and 3583 outcomes of 5450 and 3610. The comment above the thresholds is rewritten around the fact that made this sample different: all seven runs read the same two totals, so the unstable set is empty for the first time and the always-covered floor and the worst observation coincide. The margin stays, because five earlier samples moved an outcome in every direction there is, twice on the pair this batch has just closed; whether it can go is the evidence step's question and not this one's. Seven CI runs at the batch head, all green, 134/134 in each of eight configurations, 5449/5450 and 3583/3610 in every one. Two clean local cycles read the same two totals. Assisted-by: Claude Code (Opus 5)