Added a QEMU module execution harness for the Cortex-M3 and M4 ports (#821)dev

No Cortex-M module port ran in CI. gcc_check compiles each port's module manager
sources and links nothing that loads a module, and the host tests under
test/tx/module_manager compile a few portable sources against stubs. A module's
start-up, its kernel calls through the supervisor call, the MPU programming on context
switches and the fault path that terminates a misbehaving module were exercised only
on the Cortex-R52 FVP.

test/tx/cmake/module_qemu is a stand-alone CMake project, like test/tx/cmake/riscv, that
builds the kernel and Module Manager with a module port's headers, builds test modules
position-independent with the port's module linker script, embeds their raw images in
manager images, and registers each image with CTest. A Python runner starts it on
QEMU's MPS2 board for the core, mps2-an385 for cortex_m3 and mps2-an386 for cortex_m4
built for its FPU with the hard-float ABI, and judges the result line the image prints
over semihosting and the exit status it sets. Three images per port: a protected module
loaded, started, exercising queues, semaphores, a worker thread and the timer, stopped
and unloaded twice with its memory returned; the same module faulting on a read of
kernel memory, reported to the fault notification with its module, thread and address
and terminated, then stopped and unloaded; and the module built privileged and
unprotected, whose identical read succeeds. The fault image is also the check that
QEMU's MPU enforces at all. The new module_qemu workflow runs both ports on changes to
common/, common_modules/, the two module ports and the harness, installing QEMU from
the Ubuntu archive through the bounded apt helpers in scripts/tx_ci_common.sh.

Both ports pass 3/3 on QEMU 8.2.2 with Arm GNU 14.3.rel1, using the workflow's commands,
with zero compiler warnings; configure, build and run take 9 seconds for both. The AI
disclosure check passes. The workflow itself has not run on GitHub yet.

Assisted-by: Claude Code (Opus 5.5) <[email protected]>

6 files changed, 487 insertions, 0 deletions

diff --git a/test/tx/cmake/module_qemu/tests/harness_checks.c b/test/tx/cmake/module_qemu/tests/harness_checks.c
new file mode 100644
index 00000000..4b7cff05
--- /dev/null
+++ b/test/tx/cmake/module_qemu/tests/harness_checks.c
@@ -0,0 +1,57 @@
+/***************************************************************************
+ * Copyright (c) 2026 Eclipse ThreadX contributors
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available at
+ * https://opensource.org/licenses/MIT.
+ *
+ * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5).
+ * The AI-generated portions may be considered public domain (CC0-1.0)
+ * and not subject to the project's licence. The human contributor has
+ * reviewed and verified that the code is correct.
+ *
+ * SPDX-License-Identifier: MIT and CC0-1.0
+ **************************************************************************/
+
+
+/**************************************************************************/
+/**************************************************************************/
+/**                                                                       */
+/** ThreadX Test                                                          */
+/**                                                                       */
+/**   Module execution harness: checks shared by the test images          */
+/**                                                                       */
+/**************************************************************************/
+/**************************************************************************/
+
+#include "harness_checks.h"
+
+
+VOID  harness_check_services(ULONG cycle)
+{
+    harness_expect("module start thread ran", MODULE_SHARED[MODULE_OUT_STARTED], MODULE_STARTED_MAGIC);
+    harness_expect("module saw the load cycle", MODULE_SHARED[MODULE_OUT_CYCLE_SEEN], cycle);
+    harness_expect("module object allocation", MODULE_SHARED[MODULE_OUT_OBJECT_STATUS], (ULONG) TX_SUCCESS);
+    harness_expect("module object creation and queue send", MODULE_SHARED[MODULE_OUT_CREATE_STATUS], (ULONG) TX_SUCCESS);
+    harness_expect("module worker received the message", MODULE_SHARED[MODULE_OUT_QUEUE_VALUE], MODULE_QUEUE_MESSAGE);
+    harness_expect("module worker ran once", MODULE_SHARED[MODULE_OUT_WORKER_RUNS], 1UL);
+    harness_expect("module semaphore get", MODULE_SHARED[MODULE_OUT_SEMAPHORE_STATUS], (ULONG) TX_SUCCESS);
+    harness_expect("module sleep lasted its ticks",
+                   (ULONG) (MODULE_SHARED[MODULE_OUT_SLEEP_TICKS] >= EXPECTED_SLEEP_TICKS), (ULONG) TX_TRUE);
+}
+
+
+ULONG  harness_module_pool_available(VOID)
+{
+TX_NAME_CONST CHAR *name;
+ULONG       available;
+ULONG       fragments;
+TX_THREAD   *first_suspended;
+ULONG       suspended_count;
+TX_BYTE_POOL *next_pool;
+
+    available = 0UL;
+    (VOID) tx_byte_pool_info_get(&_txm_module_manager_byte_pool, &name, &available, &fragments,
+                                 &first_suspended, &suspended_count, &next_pool);
+    return(available);
+}
diff --git a/test/tx/cmake/module_qemu/tests/harness_checks.h b/test/tx/cmake/module_qemu/tests/harness_checks.h
new file mode 100644
index 00000000..19ad68ae
--- /dev/null
+++ b/test/tx/cmake/module_qemu/tests/harness_checks.h
@@ -0,0 +1,45 @@
+/***************************************************************************
+ * Copyright (c) 2026 Eclipse ThreadX contributors
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available at
+ * https://opensource.org/licenses/MIT.
+ *
+ * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5).
+ * The AI-generated portions may be considered public domain (CC0-1.0)
+ * and not subject to the project's licence. The human contributor has
+ * reviewed and verified that the code is correct.
+ *
+ * SPDX-License-Identifier: MIT and CC0-1.0
+ **************************************************************************/
+
+
+/**************************************************************************/
+/**************************************************************************/
+/**                                                                       */
+/** ThreadX Test                                                          */
+/**                                                                       */
+/**   Module execution harness: checks shared by the test images          */
+/**                                                                       */
+/**************************************************************************/
+/**************************************************************************/
+
+#ifndef HARNESS_CHECKS_H
+#define HARNESS_CHECKS_H
+
+#include "harness.h"
+#include "module_shared.h"
+
+/* CONTROL.nPRIV: set when a thread runs unprivileged.  */
+#define CONTROL_NPRIV           ((ULONG) 1UL)
+
+/* The module's sleep must have lasted at least this many ticks.  */
+#define EXPECTED_SLEEP_TICKS    ((ULONG) 5UL)
+
+/* The kernel services part of the test module, common to every image.  */
+VOID    harness_check_services(ULONG cycle);
+
+/* Available bytes in the Module Manager's pool.  */
+ULONG   harness_module_pool_available(VOID);
+
+#endif
diff --git a/test/tx/cmake/module_qemu/tests/module_services.c b/test/tx/cmake/module_qemu/tests/module_services.c
new file mode 100644
index 00000000..e2fcce44
--- /dev/null
+++ b/test/tx/cmake/module_qemu/tests/module_services.c
@@ -0,0 +1,133 @@
+/***************************************************************************
+ * Copyright (c) 2026 Eclipse ThreadX contributors
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available at
+ * https://opensource.org/licenses/MIT.
+ *
+ * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5).
+ * The AI-generated portions may be considered public domain (CC0-1.0)
+ * and not subject to the project's licence. The human contributor has
+ * reviewed and verified that the code is correct.
+ *
+ * SPDX-License-Identifier: MIT and CC0-1.0
+ **************************************************************************/
+
+
+/**************************************************************************/
+/**************************************************************************/
+/**                                                                       */
+/** ThreadX Test                                                          */
+/**                                                                       */
+/**   Module execution harness: the test module                           */
+/**                                                                       */
+/**************************************************************************/
+/**************************************************************************/
+
+/* One module, built twice: once user mode with memory protection and once
+   privileged without it, from the same source; only the preamble's property
+   word differs.
+
+   The start thread exercises the kernel through the module's dispatcher: it
+   allocates and creates a queue, a semaphore and a worker thread, hands the
+   worker a message, waits for the worker to signal back, sleeps on the timer,
+   and records what it saw in the area the manager shared with it.  Then, if
+   the manager supplied the address of a word in kernel memory, it reads that
+   word.  A protected module must fault on the read and never record its
+   result; a privileged one reads it.  The done word is written last, so a
+   module that faults never sets it.
+
+   MISRA C:2023 deviations, confined to this test module: Rule 1.2 and
+   Directive 4.3 (inline assembly to read CONTROL), and Rule 11.4 (the shared
+   area and the kernel word are integer addresses supplied at run time).  */
+
+#define TXM_MODULE
+#include "txm_module.h"
+#include "module_shared.h"
+
+#define WORKER_STACK_SIZE   ((ULONG) 1024UL)
+#define SLEEP_TICKS         ((ULONG) 5UL)
+#define WAIT_TICKS          ((ULONG) 100UL)
+
+static TX_THREAD    *worker_thread;
+static TX_QUEUE     *message_queue;
+static TX_SEMAPHORE *done_semaphore;
+static ULONG        worker_stack[WORKER_STACK_SIZE / sizeof(ULONG)];
+static ULONG        queue_storage[4];
+
+VOID    module_start(ULONG id);
+
+
+/* Keep the first failing status rather than the last.  */
+static VOID  record_status(ULONG word, UINT status)
+{
+    if ((MODULE_SHARED[word] == (ULONG) TX_SUCCESS) && (status != TX_SUCCESS))
+    {
+        MODULE_SHARED[word] = (ULONG) status;
+    }
+}
+
+
+static VOID  worker_entry(ULONG thread_input)
+{
+ULONG   message;
+
+    (VOID) thread_input;
+
+    for (;;)
+    {
+        message = 0UL;
+        if (tx_queue_receive(message_queue, &message, TX_WAIT_FOREVER) == TX_SUCCESS)
+        {
+            MODULE_SHARED[MODULE_OUT_QUEUE_VALUE] = message;
+            MODULE_SHARED[MODULE_OUT_WORKER_RUNS] = MODULE_SHARED[MODULE_OUT_WORKER_RUNS] + 1UL;
+            (VOID) tx_semaphore_put(done_semaphore);
+        }
+    }
+}
+
+
+VOID  module_start(ULONG id)
+{
+ULONG   message;
+ULONG   start_time;
+ULONG   control;
+ULONG   kernel_word;
+
+    (VOID) id;
+
+    MODULE_SHARED[MODULE_OUT_STARTED] =   MODULE_STARTED_MAGIC;
+    MODULE_SHARED[MODULE_OUT_CYCLE_SEEN] = MODULE_SHARED[MODULE_IN_CYCLE];
+
+    __asm__ volatile ("mrs %0, control" : "=r"(control));
+    MODULE_SHARED[MODULE_OUT_CONTROL] = control;
+
+    record_status(MODULE_OUT_OBJECT_STATUS, txm_module_object_allocate((VOID **) &message_queue, sizeof(TX_QUEUE)));
+    record_status(MODULE_OUT_OBJECT_STATUS, txm_module_object_allocate((VOID **) &done_semaphore, sizeof(TX_SEMAPHORE)));
+    record_status(MODULE_OUT_OBJECT_STATUS, txm_module_object_allocate((VOID **) &worker_thread, sizeof(TX_THREAD)));
+
+    record_status(MODULE_OUT_CREATE_STATUS, tx_queue_create(message_queue, "module queue", TX_1_ULONG,
+                                                            queue_storage, sizeof(queue_storage)));
+    record_status(MODULE_OUT_CREATE_STATUS, tx_semaphore_create(done_semaphore, "module semaphore", 0UL));
+    record_status(MODULE_OUT_CREATE_STATUS, tx_thread_create(worker_thread, "module worker", worker_entry, 0UL,
+                                                             worker_stack, sizeof(worker_stack),
+                                                             2U, 2U, TX_NO_TIME_SLICE, TX_AUTO_START));
+
+    message = MODULE_QUEUE_MESSAGE;
+    record_status(MODULE_OUT_CREATE_STATUS, tx_queue_send(message_queue, &message, TX_NO_WAIT));
+    MODULE_SHARED[MODULE_OUT_SEMAPHORE_STATUS] = (ULONG) tx_semaphore_get(done_semaphore, WAIT_TICKS);
+
+    start_time = tx_time_get();
+    (VOID) tx_thread_sleep(SLEEP_TICKS);
+    MODULE_SHARED[MODULE_OUT_SLEEP_TICKS] = tx_time_get() - start_time;
+
+    kernel_word = MODULE_SHARED[MODULE_IN_KERNEL_WORD];
+    if (kernel_word != 0UL)
+    {
+        MODULE_SHARED[MODULE_OUT_KERNEL_READ_TRY] =  1UL;
+        MODULE_SHARED[MODULE_OUT_KERNEL_VALUE] =     *((volatile ULONG *) kernel_word);
+        MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE] = 1UL;
+    }
+
+    MODULE_SHARED[MODULE_DONE] = MODULE_DONE_MAGIC;
+}
diff --git a/test/tx/cmake/module_qemu/tests/test_module_fault.c b/test/tx/cmake/module_qemu/tests/test_module_fault.c
new file mode 100644
index 00000000..36bcdc9a
--- /dev/null
+++ b/test/tx/cmake/module_qemu/tests/test_module_fault.c
@@ -0,0 +1,103 @@
+/***************************************************************************
+ * Copyright (c) 2026 Eclipse ThreadX contributors
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available at
+ * https://opensource.org/licenses/MIT.
+ *
+ * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5).
+ * The AI-generated portions may be considered public domain (CC0-1.0)
+ * and not subject to the project's licence. The human contributor has
+ * reviewed and verified that the code is correct.
+ *
+ * SPDX-License-Identifier: MIT and CC0-1.0
+ **************************************************************************/
+
+
+/**************************************************************************/
+/**************************************************************************/
+/**                                                                       */
+/** ThreadX Test                                                          */
+/**                                                                       */
+/**   Module execution harness: protected module memory fault             */
+/**                                                                       */
+/**************************************************************************/
+/**************************************************************************/
+
+/* A user-mode, memory-protected module that reads a word of kernel memory must
+   take a MemManage fault on that read.  The Module Manager must terminate the
+   faulting thread, report it to the application's fault notification with the
+   right module, thread and address, and still let the module be stopped and
+   unloaded.
+
+   This image is also the harness's proof that the emulated MPU is enforcing at
+   all: if QEMU let the unprivileged read through, the module would record the
+   value and finish, and every check below would fail.  */
+
+#include "harness_checks.h"
+
+#define MODULE_WAIT_TICKS       ((ULONG) 500UL)
+#define PROTECTED_PROPERTIES    ((ULONG) 0x02000007UL)  /* GNU; user mode, memory protection, shared memory */
+#define KERNEL_WORD_VALUE       ((ULONG) 0x6B65726EUL)
+
+/* CFSR: MemManage data access violation, with MMFAR valid.  */
+#define CFSR_DACCVIOL           ((ULONG) 0x02UL)
+#define CFSR_MMARVALID          ((ULONG) 0x80UL)
+
+extern UCHAR                    module_services_protected[];
+
+static TXM_MODULE_INSTANCE      test_module;
+static volatile ULONG           kernel_word = KERNEL_WORD_VALUE;
+
+
+VOID  harness_test(VOID)
+{
+ULONG   available_before;
+ULONG   start;
+
+    harness_print("Module fault: protected module reads kernel memory\n");
+
+    available_before = harness_module_pool_available();
+
+    harness_shared_clear();
+    MODULE_SHARED[MODULE_IN_CYCLE] =       1UL;
+    MODULE_SHARED[MODULE_IN_KERNEL_WORD] = (ULONG) &kernel_word;
+
+    harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services protected",
+                                                                         (VOID *) module_services_protected),
+                   (ULONG) TX_SUCCESS);
+    harness_expect("module properties", test_module.txm_module_instance_property_flags, PROTECTED_PROPERTIES);
+    harness_expect("shared area grant", (ULONG) harness_shared_grant(&test_module), (ULONG) TX_SUCCESS);
+    harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS);
+
+    start = tx_time_get();
+    while ((harness_fault_count == 0UL) && ((tx_time_get() - start) < MODULE_WAIT_TICKS))
+    {
+        tx_thread_sleep(1);
+    }
+
+    /* The kernel services before the read still worked.  */
+    harness_check_services(1UL);
+    harness_expect("module ran unprivileged", MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, CONTROL_NPRIV);
+
+    /* The read was attempted and faulted.  */
+    harness_expect("kernel read attempted", MODULE_SHARED[MODULE_OUT_KERNEL_READ_TRY], 1UL);
+    harness_expect("kernel read did not complete", MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE], 0UL);
+    harness_expect("kernel value not disclosed", MODULE_SHARED[MODULE_OUT_KERNEL_VALUE], 0UL);
+    harness_expect("module did not finish", MODULE_SHARED[MODULE_DONE], 0UL);
+
+    harness_expect("one memory fault reported", harness_fault_count, 1UL);
+    harness_expect("fault names the module", (ULONG) harness_fault_module, (ULONG) &test_module);
+    harness_expect("fault names the start thread", (ULONG) harness_fault_thread,
+                   (ULONG) &test_module.txm_module_instance_start_stop_thread);
+    harness_expect("fault address is the kernel word", harness_fault_address, (ULONG) &kernel_word);
+    harness_expect("fault is a data access violation",
+                   harness_fault_status & (CFSR_DACCVIOL | CFSR_MMARVALID), CFSR_DACCVIOL | CFSR_MMARVALID);
+    harness_expect("faulting thread terminated",
+                   (ULONG) test_module.txm_module_instance_start_stop_thread.tx_thread_state, (ULONG) TX_TERMINATED);
+    harness_expect("kernel word unchanged", kernel_word, KERNEL_WORD_VALUE);
+
+    harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS);
+    harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS);
+    harness_expect("module memory returned", harness_module_pool_available(), available_before);
+}
diff --git a/test/tx/cmake/module_qemu/tests/test_module_lifecycle.c b/test/tx/cmake/module_qemu/tests/test_module_lifecycle.c
new file mode 100644
index 00000000..8c241e79
--- /dev/null
+++ b/test/tx/cmake/module_qemu/tests/test_module_lifecycle.c
@@ -0,0 +1,76 @@
+/***************************************************************************
+ * Copyright (c) 2026 Eclipse ThreadX contributors
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available at
+ * https://opensource.org/licenses/MIT.
+ *
+ * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5).
+ * The AI-generated portions may be considered public domain (CC0-1.0)
+ * and not subject to the project's licence. The human contributor has
+ * reviewed and verified that the code is correct.
+ *
+ * SPDX-License-Identifier: MIT and CC0-1.0
+ **************************************************************************/
+
+
+/**************************************************************************/
+/**************************************************************************/
+/**                                                                       */
+/** ThreadX Test                                                          */
+/**                                                                       */
+/**   Module execution harness: protected module lifecycle                */
+/**                                                                       */
+/**************************************************************************/
+/**************************************************************************/
+
+/* A user-mode, memory-protected module is loaded, granted the shared area,
+   started, left to exercise the kernel through its dispatcher, stopped and
+   unloaded -- twice, so that the second cycle shows the first gave back what
+   it took.  The module must run unprivileged and must not fault.  */
+
+#include "harness_checks.h"
+
+#define LIFECYCLE_CYCLES        ((ULONG) 2UL)
+#define MODULE_WAIT_TICKS       ((ULONG) 500UL)
+#define PROTECTED_PROPERTIES    ((ULONG) 0x02000007UL)  /* GNU; user mode, memory protection, shared memory */
+
+extern UCHAR                    module_services_protected[];
+
+static TXM_MODULE_INSTANCE      test_module;
+
+
+VOID  harness_test(VOID)
+{
+ULONG   cycle;
+ULONG   available_before;
+
+    harness_print("Module lifecycle: protected module, load/start/stop/unload twice\n");
+
+    available_before = harness_module_pool_available();
+
+    for (cycle = 1UL; cycle <= LIFECYCLE_CYCLES; cycle++)
+    {
+        harness_value("cycle", cycle);
+
+        harness_shared_clear();
+        MODULE_SHARED[MODULE_IN_CYCLE] = cycle;
+
+        harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services protected",
+                                                                             (VOID *) module_services_protected),
+                       (ULONG) TX_SUCCESS);
+        harness_expect("module properties", test_module.txm_module_instance_property_flags, PROTECTED_PROPERTIES);
+        harness_expect("shared area grant", (ULONG) harness_shared_grant(&test_module), (ULONG) TX_SUCCESS);
+        harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS);
+        harness_expect("module finished", (ULONG) harness_wait_for_module(MODULE_WAIT_TICKS), (ULONG) TX_TRUE);
+
+        harness_check_services(cycle);
+        harness_expect("module ran unprivileged",
+                       MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, CONTROL_NPRIV);
+        harness_expect("no memory fault", harness_fault_count, 0UL);
+
+        harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS);
+        harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS);
+        harness_expect("module memory returned", harness_module_pool_available(), available_before);
+    }
+}
diff --git a/test/tx/cmake/module_qemu/tests/test_module_privileged.c b/test/tx/cmake/module_qemu/tests/test_module_privileged.c
new file mode 100644
index 00000000..288117dd
--- /dev/null
+++ b/test/tx/cmake/module_qemu/tests/test_module_privileged.c
@@ -0,0 +1,73 @@
+/***************************************************************************
+ * Copyright (c) 2026 Eclipse ThreadX contributors
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available at
+ * https://opensource.org/licenses/MIT.
+ *
+ * AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5.5).
+ * The AI-generated portions may be considered public domain (CC0-1.0)
+ * and not subject to the project's licence. The human contributor has
+ * reviewed and verified that the code is correct.
+ *
+ * SPDX-License-Identifier: MIT and CC0-1.0
+ **************************************************************************/
+
+
+/**************************************************************************/
+/**************************************************************************/
+/**                                                                       */
+/** ThreadX Test                                                          */
+/**                                                                       */
+/**   Module execution harness: privileged, unprotected module            */
+/**                                                                       */
+/**************************************************************************/
+/**************************************************************************/
+
+/* The same module built privileged and without memory protection.  It runs
+   with the kernel's privileges, so the read that faults in the protected image
+   succeeds here, which shows that the fault in that image comes from the
+   module's protection and not from the address itself.  Its kernel services
+   must work just as the protected module's do.  */
+
+#include "harness_checks.h"
+
+#define MODULE_WAIT_TICKS       ((ULONG) 500UL)
+#define PRIVILEGED_PROPERTIES   ((ULONG) 0x02000000UL)  /* GNU; privileged, no memory protection */
+#define KERNEL_WORD_VALUE       ((ULONG) 0x6B65726EUL)
+
+extern UCHAR                    module_services_privileged[];
+
+static TXM_MODULE_INSTANCE      test_module;
+static volatile ULONG           kernel_word = KERNEL_WORD_VALUE;
+
+
+VOID  harness_test(VOID)
+{
+ULONG   available_before;
+
+    harness_print("Module privileged: unprotected module reads kernel memory\n");
+
+    available_before = harness_module_pool_available();
+
+    harness_shared_clear();
+    MODULE_SHARED[MODULE_IN_CYCLE] =       1UL;
+    MODULE_SHARED[MODULE_IN_KERNEL_WORD] = (ULONG) &kernel_word;
+
+    harness_expect("memory load", (ULONG) txm_module_manager_memory_load(&test_module, "services privileged",
+                                                                         (VOID *) module_services_privileged),
+                   (ULONG) TX_SUCCESS);
+    harness_expect("module properties", test_module.txm_module_instance_property_flags, PRIVILEGED_PROPERTIES);
+    harness_expect("module start", (ULONG) txm_module_manager_start(&test_module), (ULONG) TX_SUCCESS);
+    harness_expect("module finished", (ULONG) harness_wait_for_module(MODULE_WAIT_TICKS), (ULONG) TX_TRUE);
+
+    harness_check_services(1UL);
+    harness_expect("module ran privileged", MODULE_SHARED[MODULE_OUT_CONTROL] & CONTROL_NPRIV, 0UL);
+    harness_expect("kernel read completed", MODULE_SHARED[MODULE_OUT_KERNEL_READ_DONE], 1UL);
+    harness_expect("kernel value read", MODULE_SHARED[MODULE_OUT_KERNEL_VALUE], KERNEL_WORD_VALUE);
+    harness_expect("no memory fault", harness_fault_count, 0UL);
+
+    harness_expect("module stop", (ULONG) txm_module_manager_stop(&test_module), (ULONG) TX_SUCCESS);
+    harness_expect("module unload", (ULONG) txm_module_manager_unload(&test_module), (ULONG) TX_SUCCESS);
+    harness_expect("module memory returned", harness_module_pool_available(), available_before);
+}