BFE EngineeringandClaude Opus 4.8
4ee4dfcf88
First recursive code-review-harness pass over the authored SDK code (sim/,
config-lint, flowgen, drivers/{relays,freshness}, build/, ci.yml). Four parallel
dimension reviewers; all findings at every severity corrected per workspace rule.
Correctness / reliability:
- freshness.c min_budget_ms: use a `seen` flag, not `best==0`, as the empty
sentinel — a zero-tolerance (max_stale_ms==0) binding was silently widened to a
looser neighbour's budget. Regression test added; still 66/66 MC/DC.
- config-lint parse_reserved_ranges: match `reg` as a whole property token (ident
boundary before, `=` after) so `reg-names` / a `region-*` label no longer
mis-parses into a bogus reserved range.
- config-lint loader check: fail closed — flag any loader with a LOAD_ADDR that is
not a known-safe boot component, instead of only known MCU names, so a future
coprocessor ("Rtos"/"Bl32") can't slip past the 0x40000-brick gate.
- build-kernel.sh: sha256 verification is now mandatory (refuse to build if the pin
is missing) and the mktemp scratch tree is removed on exit (trap), while a
caller-provided WORK is left intact for CI artifact upload.
Test quality:
- freshness: added the age==max_stale boundary case and a clock-wraparound
(now < last_ok) fail-safe-to-UNKNOWN test.
- relays: unsetenv(WARDEN_GPIO_ROOT) at main() so the NULL-env arm is hermetic.
Security / CI:
- ci.yml: top-level `permissions: contents: read` (badges overrides to write);
pin taiki-e/install-action to commit SHA (v2.86.7).
Maintainability / docs:
- drivers/enforce-mcdc.sh: one shared, name-derived gate replaces the two
copy-pasted per-driver scripts; Makefiles call ../../enforce-mcdc.sh.
- docs/architecture.md: §3/§4/§6/§7 rewritten to match reality — NPU/RGA models,
config-lint, and the relays+freshness MC/DC harnesses are done; kernel §6 now
reflects the 5.10->6.18.46 forward-port (ADR-0001), not the superseded plan44/6.6.
- README: status blurb + layout table corrected (kernel/, .github/; stale ci/ and
patches/ descriptions fixed). hpmcu "8 tests" -> 7 in docs.
- freshness.{c,h}: ADR reference points at flare-edge ADR-0004 (warden-sdk's
ADR-0004 is the CI runner — number collision).
- normalize rustfmt drift across sim/ + config-lint.
All green: sim 37 tests, config-lint 8 tests, both drivers 100% MC/DC (relays
40/40, freshness 66/66), clippy clean under -D warnings, gitleaks clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf
45 lines
2.7 KiB
Markdown
45 lines
2.7 KiB
Markdown
# drivers/ — our own hardened, hardware-facing drivers
|
|
|
|
Per **ADR-0002** (tiered MC/DC) and **ADR-0005** (source-of-truth), our own
|
|
hardware-facing code migrates here behind a HAL seam and is hardened. "100% MC/DC on
|
|
100% of drivers" is infeasible (≈97% of kernel-driver LOC is vendor blobs — AIC8800
|
|
alone is 88.5K lines); the realistic, honest target is tiered.
|
|
|
|
## Tier 1 — real 100% MC/DC (here now, CI-enforced)
|
|
|
|
Self-contained logic with a clean seam, measured to **100% MC/DC** (gcc-14
|
|
`-fcondition-coverage`) by the CI `mcdc` job (`make -C drivers/*/test check`):
|
|
|
|
| Driver | Seam | MC/DC |
|
|
|---|---|---|
|
|
| `relays/` | `relay_io` vtable (sysfs backend + in-memory fake) | 40/40 conditions, 100% |
|
|
| `freshness/` | produce/render callbacks (the "no stale numbers" guard) | 66/66 conditions, 100% |
|
|
|
|
**Adding a Tier-1 driver:** copy `<name>.{c,h}` here, put the hardware/OS calls behind
|
|
a small injectable seam, then mirror `relays/test/` (a fake backend for the logic
|
|
branches + a real backend over a scratch tree for the plumbing). Reuse the shared
|
|
gate — the Makefile calls `bash ../../enforce-mcdc.sh <gcov.log> build/<name>.c.gcov
|
|
build/test.rc` (it derives the driver name from the `.gcov` file, so there is no
|
|
per-driver copy to keep in sync). The CI `mcdc` job picks up any
|
|
`drivers/*/test/Makefile` automatically.
|
|
|
|
## Tier 2 — serious testing + fault-injection + benchmarks
|
|
|
|
Drivers too large or too vendor/UI-coupled for literal MC/DC get fault-injection,
|
|
branch coverage, and benchmarks against the simulator instead. Their **hardware side
|
|
is already modelled and tested here** in `../sim/`:
|
|
|
|
| Driver | Serious-testing status | SDK model |
|
|
|---|---|---|
|
|
| `modbus_engine.c` (RS485 master) | 11 pty scenarios + fault-injection + a compiled corpus walk (flare-edge `tools/modbus-sim/`, green) | `sim::modbus` RTU slave (11 tests, silent-drop/forced-NAK faults) + `modbus_read_holding` benchmark |
|
|
| `warden_rga.c` (RGA offload) | offload-dispatch + CPU-fallback logic | `sim::rga` recording `improcess` fake (programmable IM_STATUS) + `rga_improcess` benchmark |
|
|
| HPMCU supervisor (`hpmcu.rs`) | arm/beat/fire + boot-grace safety property | `sim::hpmcu` (7 tests) + `hpmcu_tick` benchmark |
|
|
|
|
**Why the Tier-2 *source* isn't vendored here yet:** `modbus_engine.c` and
|
|
`warden_rga.c` pull in shared UI headers (`platform.h`, `settings.h`, `lv_*`) and
|
|
librga. Copying those in would duplicate exactly the shared surface the
|
|
**flare-edge↔warden-sdk unification** (ADR-0003/0005, a separate [maintainer]-gated step) is
|
|
meant to resolve cleanly. So the Tier-2 *models* (the hardware ends) live here now;
|
|
the Tier-2 *driver sources* migrate in with the unification, at which point their
|
|
existing flare-edge harnesses point at this repo.
|