blueflare/bfe-core1106-sdk
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

review: fix review findings (correctness, hardening, doc-accuracy)

Browse Source 
First recursive code-review-harness pass over the authored SDK code (sim/,
config-lint, flowgen, drivers/{relays,freshness}, build/, ci.yml). Four parallel
dimension reviewers; all findings at every severity corrected per workspace rule.

Correctness / reliability:
- freshness.c min_budget_ms: use a `seen` flag, not `best==0`, as the empty
  sentinel — a zero-tolerance (max_stale_ms==0) binding was silently widened to a
  looser neighbour's budget. Regression test added; still 66/66 MC/DC.
- config-lint parse_reserved_ranges: match `reg` as a whole property token (ident
  boundary before, `=` after) so `reg-names` / a `region-*` label no longer
  mis-parses into a bogus reserved range.
- config-lint loader check: fail closed — flag any loader with a LOAD_ADDR that is
  not a known-safe boot component, instead of only known MCU names, so a future
  coprocessor ("Rtos"/"Bl32") can't slip past the 0x40000-brick gate.
- build-kernel.sh: sha256 verification is now mandatory (refuse to build if the pin
  is missing) and the mktemp scratch tree is removed on exit (trap), while a
  caller-provided WORK is left intact for CI artifact upload.

Test quality:
- freshness: added the age==max_stale boundary case and a clock-wraparound
  (now < last_ok) fail-safe-to-UNKNOWN test.
- relays: unsetenv(WARDEN_GPIO_ROOT) at main() so the NULL-env arm is hermetic.

Security / CI:
- ci.yml: top-level `permissions: contents: read` (badges overrides to write);
  pin taiki-e/install-action to commit SHA (v2.86.7).

Maintainability / docs:
- drivers/enforce-mcdc.sh: one shared, name-derived gate replaces the two
  copy-pasted per-driver scripts; Makefiles call ../../enforce-mcdc.sh.
- docs/architecture.md: §3/§4/§6/§7 rewritten to match reality — NPU/RGA models,
  config-lint, and the relays+freshness MC/DC harnesses are done; kernel §6 now
  reflects the 5.10->6.18.46 forward-port (ADR-0001), not the superseded plan44/6.6.
- README: status blurb + layout table corrected (kernel/, .github/; stale ci/ and
  patches/ descriptions fixed). hpmcu "8 tests" -> 7 in docs.
- freshness.{c,h}: ADR reference points at flare-edge ADR-0004 (warden-sdk's
  ADR-0004 is the CI runner — number collision).
- normalize rustfmt drift across sim/ + config-lint.

All green: sim 37 tests, config-lint 8 tests, both drivers 100% MC/DC (relays
40/40, freshness 66/66), clippy clean under -D warnings, gitleaks clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf
This commit is contained in:
BFE Engineering
2026-08-25 15:48:52 -06:00
co-authored by Claude Opus 4.8
parent 75ff711e43
commit 4ee4dfcf88
21 changed files with 375 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/freshness/test/Makefile
+1 -1
View File
@@ -31,7 +31,7 @@ check: $(BUILD)/test
@echo "== MC/DC (condition) coverage of freshness.c =="
@$(GCOV) --conditions --branch-probabilities -o $(BUILD) ../freshness.c >$(BUILD)/gcov.log 2>&1 || true
@mv -f *.gcov $(BUILD)/ 2>/dev/null || true
@bash enforce-mcdc.sh $(BUILD)/gcov.log $(BUILD)/freshness.c.gcov $(BUILD)/test.rc
@bash ../../enforce-mcdc.sh $(BUILD)/gcov.log $(BUILD)/freshness.c.gcov $(BUILD)/test.rc
report: check
@grep -nE "condition.*not covered|conditions covered" $(BUILD)/freshness.c.gcov || true
drivers/freshness/test/enforce-mcdc.sh
-48
View File
@@ -1,48 +0,0 @@
#!/usr/bin/env bash
# Gate: fail unless every unit check passed AND freshness.c reached 100% MC/DC
# (condition) coverage with no uncovered executable lines.
# $1 = gcov stdout log $2 = freshness.c.gcov $3 = test exit-code file
set -uo pipefail
LOG="$1"; GCOV="$2"; RCFILE="$3"
rc=0
testrc="$(cat "$RCFILE" 2>/dev/null || echo 1)"
if [ "$testrc" != "0" ]; then
echo "RESULT: unit checks FAILED (test exit $testrc)"; rc=1
else
echo "RESULT: all unit checks passed"
fi
if [ ! -f "$GCOV" ]; then
echo "RESULT: no coverage file ($GCOV) produced"; exit 1
fi
notcov="$(grep -nE "condition[s]? .*not covered" "$GCOV" || true)"
uncov_lines="$(grep -nE "^ +#####:" "$GCOV" || true)"
# Summary lines for freshness.c from gcov stdout. Match the exact file so
# 'test_freshness.c' (which also contains "freshness.c") is NOT picked up.
FMATCH="File '([^']*/)?freshness[.]c'"
cond_line="$(awk -v patt="$FMATCH" '$0 ~ patt {f=1} f&&/Condition outcomes covered:/{print; f=0}' "$LOG")"
line_line="$(awk -v patt="$FMATCH" '$0 ~ patt {f=1} f&&/Lines executed:/{print; f=0}' "$LOG")"
echo " ${line_line:-Lines executed: (n/a)}"
echo " ${cond_line:-Condition outcomes covered: (n/a)}"
if [ -n "$notcov" ]; then
echo "RESULT: MC/DC gaps (conditions not covered):"
echo "$notcov" | sed 's/^/ /'
rc=1
fi
if [ -n "$uncov_lines" ]; then
echo "RESULT: uncovered executable lines in freshness.c:"
echo "$uncov_lines" | sed 's/^/ /'
rc=1
fi
if ! echo "$cond_line" | grep -q "100.00%"; then
echo "RESULT: condition coverage is below 100%"
rc=1
fi
[ "$rc" = "0" ] && echo "RESULT: 100% MC/DC + all checks green ✓"
exit "$rc"
drivers/freshness/test/test_freshness.c
+29 -1
View File
@@ -44,6 +44,9 @@ static void test_decide(void) {
EXPECT(warden_fresh_decide(FRESH_UNKNOWN, false, false, 0, 100) == FRESH_RENDER_UNKNOWN);
EXPECT(warden_fresh_decide(FRESH_UNKNOWN, true, false, 200, 100) == FRESH_RENDER_UNKNOWN);
EXPECT(warden_fresh_decide(FRESH_UNKNOWN, true, false, 50, 100) == FRESH_RENDER_NOCHANGE);
/* boundary: age == max_stale is NOT stale (guards a `>`->`>=` regression that
* MC/DC alone would not catch — both outcomes are already covered above). */
EXPECT(warden_fresh_decide(FRESH_UNKNOWN, true, false, 100, 100) == FRESH_RENDER_NOCHANGE);
}
/* --- 2. bind: !produce, !render, valid, and table-full (FRESH_MAX=2) --- */
@@ -121,10 +124,18 @@ static void test_invalidate(void) {
EXPECT(g_render_calls == 1);
}
/* --- 6. min_budget: best==0 first, then max_stale<best true and false --- */
/* --- 6. min_budget: unseen first, then max_stale<best true and false --- */
static void test_min_budget(void) {
warden_fresh_reset();
EXPECT(warden_fresh_min_budget_ms() == 0); /* nothing bound */
/* regression (correctness review): a zero-tolerance binding (max_stale=0) must
* win the minimum, not be mistaken for the "nothing scanned" sentinel and
* widened to a looser neighbour's budget. */
warden_fresh_bind((void*)1, fake_produce, NULL, 0, "s", fake_render, (void*)9);
warden_fresh_bind((void*)1, fake_produce, NULL, 300, "s", fake_render, (void*)9);
EXPECT(warden_fresh_min_budget_ms() == 0);
warden_fresh_reset();
EXPECT(warden_fresh_min_budget_ms() == 0); /* nothing bound (post-reset) */
warden_fresh_bind((void*)1, fake_produce, NULL, 300, "s", fake_render, (void*)9); /* best=0->300 */
warden_fresh_bind((void*)1, fake_produce, NULL, 100, "s", fake_render, (void*)9); /* 100<300 -> 100 */
EXPECT(warden_fresh_min_budget_ms() == 100);
@@ -160,6 +171,22 @@ static void test_false_arms(void) {
EXPECT(g_render_calls == 0);
}
/* --- 8. clock wraparound: a uint32 ms counter wraps every ~49.7 days, so a tick
* can arrive with now_ms < last_ok_ms. The unsigned `now - last_ok_ms` then
* underflows to a huge age; the contract must fail SAFE to UNKNOWN, never
* assert the last value as if still fresh. --- */
static void test_wraparound(void) {
warden_fresh_reset();
warden_fresh_bind((void*)1, fake_produce, NULL, 100, "s", fake_render, (void*)9);
set_produce(FRESH_OK, "9"); reset_render();
warden_fresh_tick(1000); /* last_ok_ms = 1000, ever_ok */
EXPECT(g_render_calls == 1 && g_render_what == FRESH_RENDER_VALUE);
/* now wraps behind last_ok_ms: age underflows -> treated as stale -> UNKNOWN */
set_produce(FRESH_UNKNOWN, NULL); reset_render();
warden_fresh_tick(10);
EXPECT(g_render_calls == 1 && g_render_what == FRESH_RENDER_UNKNOWN);
}
int main(void) {
test_decide();
test_bind();
@@ -168,6 +195,7 @@ int main(void) {
test_invalidate();
test_min_budget();
test_false_arms();
test_wraparound();
fprintf(stderr, "%d checks, %d failures\n", g_checks, g_fail);
return g_fail ? 1 : 0;
}