Added a QEMU module execution harness for the Cortex-M3 and M4 ports (#821)dev

No Cortex-M module port ran in CI. gcc_check compiles each port's module manager
sources and links nothing that loads a module, and the host tests under
test/tx/module_manager compile a few portable sources against stubs. A module's
start-up, its kernel calls through the supervisor call, the MPU programming on context
switches and the fault path that terminates a misbehaving module were exercised only
on the Cortex-R52 FVP.

test/tx/cmake/module_qemu is a stand-alone CMake project, like test/tx/cmake/riscv, that
builds the kernel and Module Manager with a module port's headers, builds test modules
position-independent with the port's module linker script, embeds their raw images in
manager images, and registers each image with CTest. A Python runner starts it on
QEMU's MPS2 board for the core, mps2-an385 for cortex_m3 and mps2-an386 for cortex_m4
built for its FPU with the hard-float ABI, and judges the result line the image prints
over semihosting and the exit status it sets. Three images per port: a protected module
loaded, started, exercising queues, semaphores, a worker thread and the timer, stopped
and unloaded twice with its memory returned; the same module faulting on a read of
kernel memory, reported to the fault notification with its module, thread and address
and terminated, then stopped and unloaded; and the module built privileged and
unprotected, whose identical read succeeds. The fault image is also the check that
QEMU's MPU enforces at all. The new module_qemu workflow runs both ports on changes to
common/, common_modules/, the two module ports and the harness, installing QEMU from
the Ubuntu archive through the bounded apt helpers in scripts/tx_ci_common.sh.

Both ports pass 3/3 on QEMU 8.2.2 with Arm GNU 14.3.rel1, using the workflow's commands,
with zero compiler warnings; configure, build and run take 9 seconds for both. The AI
disclosure check passes. The workflow itself has not run on GitHub yet.

Assisted-by: Claude Code (Opus 5.5) <[email protected]>

1 files changed, 73 insertions, 0 deletions

diff --git a/test/tx/cmake/module_qemu/tests/test_module_privileged.c b/test/tx/cmake/module_qemu/tests/test_module_privileged.c
new file mode 100644
index 00000000..288117dd
--- /dev/null
+++ b/test/tx/cmake/module_qemu/tests/test_module_privileged.c
@@ -0,0 +1,73 @@
+/***************************************************************************
+ * Copyright (c) 2026 Eclipse ThreadX contributors
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available at
+ * https://opensource.org/licenses/MIT.
+ *
+ * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5).
+ * The AI-generated portions may be considered public domain (CC0-1.0)
+ * and not subject to the project's licence. The human contributor has
+ * reviewed and verified that the code is correct.
+ *
+ * SPDX-License-Identifier: MIT and CC0-1.0
+ **************************************************************************/
+
+
+/**************************************************************************/
+/**************************************************************************/
+/**                                                                       */
+/** ThreadX Test                                                          */
+/**                                                                       */
+/**   Module execution harness: privileged, unprotected module            */
+/**                                                                       */
+/**************************************************************************/
+/**************************************************************************/
+
+/* The same module built privileged and without memory protection.  It runs
+   with the kernel's privileges, so the read that faults in the protected image
+   succeeds here, which shows that the fault in that image comes from the
+   module's protection and not from the address itself.  Its kernel services
+   must work just as the protected module's do.  */
+
+#include "harness_checks.h"
+
+#define MODULE_WAIT_TICKS       ((ULONG) 500UL)
+#define PRIVILEGED_PROPERTIES   ((ULONG) 0x02000000UL)  /* GNU; privileged, no memory protection */
+#define KERNEL_WORD_VALUE       ((ULONG) 0x6B65726EUL)
+
+extern UCHAR                    module_services_privileged[];
+
+static TXM_MODULE_INSTANCE      test_module;
+static volatile ULONG           kernel_word = KERNEL_WORD_VALUE;
+
+
+VOID  harness_test(VOID)
+{
+ULONG   available_before;
+
+    harness_print("Module privileged: unprotected module reads kernel memory\n");
+
+    available_before = harness_module_pool_available();
+
+    harness_shared_clear();
+    MODULE_SHARED[MODULE_IN_CYCLE] =       1UL;
+    MODULE_SHARED[MODULE_IN_KERNEL_WORD] = (ULONG) &kernel_word;
+
+    harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services privileged",
+                                                                         (VOID *) module_services_privileged),
+                   (ULONG) TX_SUCCESS);
+    harness_expect("module properties", test_module.txm_module_instance_property_flags, PRIVILEGED_PROPERTIES);
+    harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS);
+    harness_expect("module finished", (ULONG) harness_wait_for_module(MODULE_WAIT_TICKS), (ULONG) TX_TRUE);
+
+    harness_check_services(1UL);
+    harness_expect("module ran privileged", MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, 0UL);
+    harness_expect("kernel read completed", MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE], 1UL);
+    harness_expect("kernel value read", MODULE_SHARED[MODULE_OUT_KERNEL_VALUE], KERNEL_WORD_VALUE);
+    harness_expect("no memory fault", harness_fault_count, 0UL);
+
+    harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS);
+    harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS);
+    harness_expect("module memory returned", harness_module_pool_available(), available_before);
+}