blueflare/bfe-core1106-sdk
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

review: fix review findings (correctness, hardening, doc-accuracy)

Browse Source 
First recursive code-review-harness pass over the authored SDK code (sim/,
config-lint, flowgen, drivers/{relays,freshness}, build/, ci.yml). Four parallel
dimension reviewers; all findings at every severity corrected per workspace rule.

Correctness / reliability:
- freshness.c min_budget_ms: use a `seen` flag, not `best==0`, as the empty
  sentinel — a zero-tolerance (max_stale_ms==0) binding was silently widened to a
  looser neighbour's budget. Regression test added; still 66/66 MC/DC.
- config-lint parse_reserved_ranges: match `reg` as a whole property token (ident
  boundary before, `=` after) so `reg-names` / a `region-*` label no longer
  mis-parses into a bogus reserved range.
- config-lint loader check: fail closed — flag any loader with a LOAD_ADDR that is
  not a known-safe boot component, instead of only known MCU names, so a future
  coprocessor ("Rtos"/"Bl32") can't slip past the 0x40000-brick gate.
- build-kernel.sh: sha256 verification is now mandatory (refuse to build if the pin
  is missing) and the mktemp scratch tree is removed on exit (trap), while a
  caller-provided WORK is left intact for CI artifact upload.

Test quality:
- freshness: added the age==max_stale boundary case and a clock-wraparound
  (now < last_ok) fail-safe-to-UNKNOWN test.
- relays: unsetenv(WARDEN_GPIO_ROOT) at main() so the NULL-env arm is hermetic.

Security / CI:
- ci.yml: top-level `permissions: contents: read` (badges overrides to write);
  pin taiki-e/install-action to commit SHA (v2.86.7).

Maintainability / docs:
- drivers/enforce-mcdc.sh: one shared, name-derived gate replaces the two
  copy-pasted per-driver scripts; Makefiles call ../../enforce-mcdc.sh.
- docs/architecture.md: §3/§4/§6/§7 rewritten to match reality — NPU/RGA models,
  config-lint, and the relays+freshness MC/DC harnesses are done; kernel §6 now
  reflects the 5.10->6.18.46 forward-port (ADR-0001), not the superseded plan44/6.6.
- README: status blurb + layout table corrected (kernel/, .github/; stale ci/ and
  patches/ descriptions fixed). hpmcu "8 tests" -> 7 in docs.
- freshness.{c,h}: ADR reference points at flare-edge ADR-0004 (warden-sdk's
  ADR-0004 is the CI runner — number collision).
- normalize rustfmt drift across sim/ + config-lint.

All green: sim 37 tests, config-lint 8 tests, both drivers 100% MC/DC (relays
40/40, freshness 66/66), clippy clean under -D warnings, gitleaks clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf
This commit is contained in:
BFE Engineering
2026-08-25 15:48:52 -06:00
co-authored by Claude Opus 4.8
parent 75ff711e43
commit 4ee4dfcf88
21 changed files with 375 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sim/src/cru.rs
+5 -1
View File
@@ -203,7 +203,11 @@ mod tests {
cru.poll(0);
bus.poke32(DW_WDT_CRR, DW_WDT_PET); // pet at t=5 -> new deadline 13
assert_eq!(cru.poll(5), None);
assert_eq!(cru.poll(8), None, "petted: original deadline no longer applies");
assert_eq!(
cru.poll(8),
None,
"petted: original deadline no longer applies"
);
assert_eq!(cru.poll(13), Some(ResetCause::Watchdog));
}
sim/src/hpmcu.rs
+18 -6
View File
@@ -92,7 +92,8 @@ impl<B: MemBus> HpmcuSim<B> {
return;
}
self.polls = self.polls.wrapping_add(1);
self.bus.poke32(self.base + OFF_CYC, (now & 0xffff_ffff) as u32);
self.bus
.poke32(self.base + OFF_CYC, (now & 0xffff_ffff) as u32);
let magic = self.bus.peek32(self.base + OFF_MAGIC);
let counter = self.bus.peek32(self.base + OFF_COUNTER);
let poll_lo = self.polls & 0xffff;
@@ -100,7 +101,8 @@ impl<B: MemBus> HpmcuSim<B> {
if magic == MAGIC_DISARM {
// Deliberate stand-down: resume the moment Linux re-arms; the grace
// clock restarts so a disarm-then-silence never fires.
self.bus.poke32(self.base + OFF_STATE, STATE_DISARMED | poll_lo);
self.bus
.poke32(self.base + OFF_STATE, STATE_DISARMED | poll_lo);
self.t0 = now;
self.last_change = now;
} else if magic == MAGIC_ARMED {
@@ -110,7 +112,8 @@ impl<B: MemBus> HpmcuSim<B> {
self.bus.poke32(self.base + OFF_SEEN, counter);
self.last_change = now;
}
self.bus.poke32(self.base + OFF_STATE, STATE_ARMED | poll_lo);
self.bus
.poke32(self.base + OFF_STATE, STATE_ARMED | poll_lo);
if now.saturating_sub(self.last_change) > HEARTBEAT_TIMEOUT_S {
self.fire();
}
@@ -186,7 +189,10 @@ mod tests {
// Heartbeat stops (counter frozen). Fires just past 90s.
for now in (5..=90).step_by(5) {
m.tick(now);
assert!(!m.fired(), "must not fire within the heartbeat window (@{now}s)");
assert!(
!m.fired(),
"must not fire within the heartbeat window (@{now}s)"
);
}
m.tick(91);
assert!(m.fired(), "must fire just past the 90s heartbeat timeout");
@@ -225,7 +231,10 @@ mod tests {
counter += 1;
arm_beat(&bus, counter);
m.tick(now);
assert!(!m.fired(), "flared armed before boot-grace: must never fire (@{now}s)");
assert!(
!m.fired(),
"flared armed before boot-grace: must never fire (@{now}s)"
);
}
assert_eq!(m.state(), STATE_ARMED);
}
@@ -252,6 +261,9 @@ mod tests {
assert!(!m.fired(), "within the heartbeat window (@{now}s)");
}
m.tick(695); // 695 - 600 = 95 > 90
assert!(m.fired(), "flared dead > heartbeat timeout: MCU fires the reset");
assert!(
m.fired(),
"flared dead > heartbeat timeout: MCU fires the reset"
);
}
}
sim/src/modbus.rs
+16 -4
View File
@@ -28,7 +28,11 @@ pub fn crc16(bytes: &[u8]) -> u16 {
for &b in bytes {
crc ^= b as u16;
for _ in 0..8 {
crc = if crc & 1 != 0 { (crc >> 1) ^ 0xA001 } else { crc >> 1 };
crc = if crc & 1 != 0 {
(crc >> 1) ^ 0xA001
} else {
crc >> 1
};
}
}
crc
@@ -202,7 +206,11 @@ impl ModbusSlave {
if count == 0 || count > 2000 {
return Err(exc::ILLEGAL_DATA_VALUE);
}
let bank = if discrete { &self.discrete } else { &self.coils };
let bank = if discrete {
&self.discrete
} else {
&self.coils
};
if start + count > bank.len() {
return Err(exc::ILLEGAL_DATA_ADDRESS);
}
@@ -272,7 +280,10 @@ impl ModbusSlave {
let start = u16::from_be_bytes([pdu[0], pdu[1]]) as usize;
let count = u16::from_be_bytes([pdu[2], pdu[3]]) as usize;
let bytecount = pdu[4] as usize;
if count == 0 || count > 1968 || bytecount != count.div_ceil(8) || pdu.len() != 5 + bytecount
if count == 0
|| count > 1968
|| bytecount != count.div_ceil(8)
|| pdu.len() != 5 + bytecount
{
return Err(exc::ILLEGAL_DATA_VALUE);
}
@@ -361,7 +372,8 @@ mod tests {
fn coils_write_then_read() {
let mut s = ModbusSlave::new(1, 0, 16);
// FC05 write single coil 3 = ON
s.handle_frame(&request(1, &[0x05, 0, 3, 0xFF, 0x00])).unwrap();
s.handle_frame(&request(1, &[0x05, 0, 3, 0xFF, 0x00]))
.unwrap();
assert!(s.coil(3));
// FC01 read coils 0..8 -> bit 3 set => byte 0x08
let resp = s.handle_frame(&request(1, &[0x01, 0, 0, 0, 8])).unwrap();
sim/src/npu.rs
+12 -3
View File
@@ -20,12 +20,18 @@ pub struct NpuSim {
impl NpuSim {
/// A present NPU reporting 0% load.
pub fn new() -> Self {
Self { present: true, load: 0 }
Self {
present: true,
load: 0,
}
}
/// An absent NPU (rknpu.ko not loaded): `/proc/rknpu/load` does not exist.
pub fn absent() -> Self {
Self { present: false, load: 0 }
Self {
present: false,
load: 0,
}
}
/// Set the reported load, clamped to 0..=100.
@@ -105,6 +111,9 @@ mod tests {
#[test]
fn default_is_present_idle() {
assert_eq!(NpuSim::default().proc_load(), Some("NPU load: 0%\n".to_string()));
assert_eq!(
NpuSim::default().proc_load(),
Some("NPU load: 0%\n".to_string())
);
}
}
sim/src/rga.rs
+25 -6
View File
@@ -52,7 +52,10 @@ pub struct RgaSim {
impl RgaSim {
/// A working RGA whose `improcess` succeeds.
pub fn new() -> Self {
Self { status: ImStatus::Success, blits: Vec::new() }
Self {
status: ImStatus::Success,
blits: Vec::new(),
}
}
/// Program the status `improcess` returns (set `Failed` to drive the driver's
@@ -63,7 +66,12 @@ impl RgaSim {
/// Model one `improcess()` call: record it and return the programmed status.
pub fn improcess(&mut self, src: Surface, dst: Surface, srect: Rect, drect: Rect) -> ImStatus {
self.blits.push(Blit { src, dst, srect, drect });
self.blits.push(Blit {
src,
dst,
srect,
drect,
});
self.status
}
@@ -99,7 +107,11 @@ mod tests {
use super::*;
fn surf(w: i32, h: i32) -> Surface {
Surface { width: w, height: h, format: 0 }
Surface {
width: w,
height: h,
format: 0,
}
}
fn rect(w: i32, h: i32) -> Rect {
Rect { x: 0, y: 0, w, h }
@@ -108,7 +120,12 @@ mod tests {
#[test]
fn records_a_successful_blit() {
let mut r = RgaSim::new();
let st = r.improcess(surf(720, 720), surf(360, 360), rect(720, 720), rect(360, 360));
let st = r.improcess(
surf(720, 720),
surf(360, 360),
rect(720, 720),
rect(360, 360),
);
assert_eq!(st, ImStatus::Success);
assert_eq!(r.count(), 1);
let b = r.last().unwrap();
@@ -120,8 +137,10 @@ mod tests {
fn failed_status_drives_fallback() {
let mut r = RgaSim::new();
r.set_status(ImStatus::Failed);
assert_eq!(r.improcess(surf(10, 10), surf(10, 10), rect(10, 10), rect(10, 10)),
ImStatus::Failed);
assert_eq!(
r.improcess(surf(10, 10), surf(10, 10), rect(10, 10), rect(10, 10)),
ImStatus::Failed
);
// the op is still recorded — the driver dispatched it, then fell back.
assert_eq!(r.count(), 1);
}