Fixed stack address truncation with MISRA stack checking

[jnsagai]

With TX_MISRA_ENABLE and TX_ENABLE_STACK_CHECKING enabled, _tx_thread_create converts the supplied stack address through ULONG. On ports where ULONG is narrower than a pointer, this loses the high address bits before the stack metadata reaches the port builder. The native x86_64 Linux/GNU port demonstrates the defect with 32-bit ULONG, 64-bit ALIGN_TYPE and 64-bit pointers, for both aligned and misaligned high-address stacks.

The fix uses the port-defined, pointer-capable ALIGN_TYPE for both conversions around stack alignment. It preserves the existing alignment, usable-size calculation and guard reservations. The conversion comment documents the required MISRA C:2012/2023 Rule 11.6 deviation (C:2004 Rule 11.3), consistent with the SMP creation path. Formal MISRA compliance is not established by these tests.

The regression adds an independent native64 lane to the Linux/GNU host suite while retaining its native32 coverage. The metadata harness executes the real create service and MISRA shim across 16 alignment/size combinations, checking full-width addresses, usable size, fill boundaries, guard space, caller padding and creation state. A non-MISRA control exercises the same combinations. Four further tests use the real Linux kernel to create, resume, sleep/wake and complete threads at offsets 0–3; a wrapper checks metadata before the real stack builder can dereference it. The Linux simulator uses pthread-owned execution stacks, so this verifies supplied-stack metadata and simulator scheduling rather than execution on the supplied hardware stack.

Validation below is bound to frozen patch SHA-256 20e8f835c769f33dd69cae1bff51824b7f26e8b158c67ba01d62006ece3eb80e, based on dev commit e73752681bd405deddf247d1cf2b899d502dceaa. Local runtime checks used GCC 14.2.0 in container image sha256:a8a3d92ee0ba622304a79ce1dcc51aba1ad1d0ac52767c71b7c1e158520275cc, with SYS_NICE and rtprio=3:3. The retained evidence bundle contains freeze.json, verification.json, native logs and JUnit reports; its overall status is prepared-with-baseline-failure, with local_validation_complete: false.

Completed local check	Result and scope	Retained evidence
Original-code regression control	Expected failure: 5/6 tests failed, CTest exit 8. The MISRA harness reported 64 failed metadata assertions across 16 cases; all four scheduling cases rejected truncated metadata safely. The non-MISRA control passed.	verification/baseline-test.log, verification/baseline.xml
Frozen-patch focused configure/build and CTest	6/6 passed, CTest exit 0, with a 30-second invocation timeout. New tests and the changed create service compile as C99 with -Werror; unchanged native64 sources retain warnings.	verification/focused-configure.log, verification/focused-build.log, verification/focused-test.log, verification/focused.xml
scripts/build_tx.sh and scripts/test_tx.sh	Both exited 0; 807/807 test instances passed across seven configurations, including native64 regression discovery in each. Used TX_COVERAGE=ON, CTEST_REPEAT_FAIL=1, CTEST_TIMEOUT=120.	verification/tx-build.log, verification/tx-test.log, verification/tx/*.xml
scripts/build_smp.sh and scripts/test_smp.sh	Build exited 0; suite FAILED, test exit 8: 589 passed and 1 failed among 590 instances across five configurations. Same coverage/repeat/timeout settings; test affinity 0,2,4,6.	verification/smp-build.log, verification/smp-test.log, verification/smp/*.xml
FreeRTOS configure/build and CTest	All exited 0; 3/3 passed with TX_ENABLE_CONST_NAMES explicitly enabled and a 120-second timeout. This does not establish a pass for the stock default profile.	verification/freertos-configure.log, verification/freertos-build.log, verification/freertos-test.log, verification/freertos.xml
Preparation license-header audit	Passed: 28 audited files, 12 recorded exemptions. The publisher repeats the header audit before committing.	verification/license-headers.log, license-headers.json
scripts/check_ai_disclosure.sh	Passed, exit 0.	verification/ai-disclosure.log
scripts/check_ports.sh --no-regen	Passed, exit 0; generated-port regeneration was skipped.	verification/port-consistency.log

The current SMP failure is default_build_coverage::threadx_smp_random_resume_suspend_exclusion_pt_test, assertion ERROR #7. An independent run of that test on the unchanged original baseline at e73752681bd405deddf247d1cf2b899d502dceaa failed the same assertion, exit 1, with the same image, GCC 14.2/C99/native32 build profile, configuration and CPU affinity 0,2,4,6. Relevant SMP, port, test, shared, toolchain and script inputs are unchanged; normalized compile/link commands match. This reproduces this particular failure on baseline and does not waive the failed suite. See smp-baseline-reproduction.json and verification/baseline-smp-default_build_coverage-1.log. Final-head upstream SMP CI must pass before requesting review or claiming merge readiness.

Historical failures remain recorded separately in diagnostics/smp-retained-failures-index.json. In particular, an earlier trace_build::threadx_event_flag_suspension_timeout_test failed ERROR #7 after the 63-tick sleep, where the allowed counters are 32–33 and 13–14. All ten original-baseline diagnostic runs passed with affinity 0,2,4,6: no matching failure or baseline waiver is established. The exact earlier candidate Ninja command comparison is unavailable because the next verification removed that build directory. This event-flag assertion is distinct from the randomized preemption-threshold assertion, and later verification does not erase that failed attempt. Historical randomized default and disabled-notification failures reproduced on baseline; the historical trace failure at affinity 0,1,2,3 did not reproduce in ten baseline attempts. Separate paired trace failures at 0,2,4,6 do not establish equivalence for the earlier affinity. See diagnostics/baseline-smp-event-flag-timeout/summary.json and the retained index.

Measured merged line coverage is 99.364% for the single-core kernel (4374/4402 lines) and 99.78% for SMP (4989/5000); branch coverage is 85.792% and 84.463%, respectively. These are local measurements, including coverage from the failed SMP run, and do not establish complete coverage or successful remote coverage gates. RISC-V, reference Arm GCC/clang, Cortex-M, FVP and real-hardware execution have not been validated locally on this frozen patch. Stock FreeRTOS and generated-port regeneration still require upstream validation; FVP execution counts only if the model actually runs.

There are no outstanding code dependencies or new external dependencies. PR #742, needed for the native MISRA simulator build, is already in the base and explicitly excluded #744. A required companion clarification of tx_thread_create is prepared for rtos-docs-asciidoc against main; its submitted PR is linked below. This kernel contribution targets dev.

This contribution was developed with AI assistance from Codex (gpt-6.1-sol), as recorded in the patch headers and review evidence; this PR text is also AI-assisted. The human contributor's actual conversation confirmation is retained in human-review.json and human-review-conversation.json. The receipt binds to the finalized patch digest above and approves only the three new-file header wording changes from the reviewed patch; comparison confirms no substantive delta. The independent technical and process review records both pass for this digest and are automated reviews. The receipt does not establish copyright ownership, employer permission or maintainer approval. The submitting human retains technical and provenance responsibility under ThreadX CONTRIBUTING.md and the Eclipse AI guidelines. Any substantive patch change requires renewed human review, freezing, verification and independent review.

Acceptance remains conditional. The publisher requires a passing publication-phase license audit and verifies the effective and committed Author email against the human-confirmed ECA email before submission. Both contributions are submitted as drafts. A successful Eclipse username ECA lookup is recorded; final-head eclipsefdn/eca success is required for both contributions; the ECA API distinguishes lookup from contribution validation. Required final-head checks are tx / run_tests, smp / run_tests, freertos / run_tests and riscv / run_tests, including the kernel/SMP 99% line coverage gates. Applicable gnu, atfe, Cortex-M0/M3/M4/M7 build, cortex-m, cortex-a, r52 and repository checks jobs also remain pending, as does any required fork-workflow authorization. One upstream approving review, code-owner review and documentation maintainer review are still required. No maintainer approval is evidenced.

• Updated function header with a short description and version number (description updated; version field unchanged)
• Added test case for bug fix or new feature
• Validated on real hardware

Fixes #744

Matching documentation: eclipse-threadx/rtos-docs-asciidoc#107.

[fdesbiens]

Hi @jnsagai.

Thank k you for this contribution. I will look into it.

[fdesbiens]

Thanks for this — the truncation is real and the diagnosis is correct. new_stack_start and updated_stack_start are already ALIGN_TYPE, so the loss is confined to the TX_MISRA_ENABLE path, and any port where ULONG is narrower than a pointer is exposed. Worth fixing.

I'd like the fix to take a different shape, though. TX_MISRA_ENABLE exists so that every pointer/integer conversion in the kernel routes through a shim in tx_misra.c, which is the single place the Rule 11.6 deviation is documented and audited. Replacing the macro with an inline cast in common/src/tx_thread_create.c moves that deviation into the kernel, so every MISRA build now carries it in the kernel sources rather than in the shim module. The comment documents it, but relocating it is the part I'd push back on.

common/src/tx_misra.c:551 already defines _tx_misra_uchar_to_align_type_pointer_convert, so an ALIGN_TYPE shim is an established shape in that file. Adding _tx_misra_pointer_to_align_type_convert and _tx_misra_align_type_to_pointer_convert alongside it, and defining TX_POINTER_TO_ALIGN_TYPE_CONVERT and TX_ALIGN_TYPE_TO_POINTER_CONVERT in the TX_MISRA_ENABLE arm of tx_api.h, lets tx_thread_create.c drop both #ifdef blocks and use the macro unconditionally. Same end state in the source, deviation stays where it is documented.

On "consistent with the SMP creation path": common_smp/src/tx_thread_create.c:142 uses TX_POINTER_TO_ALIGN_TYPE_CONVERT itself rather than an inline cast, so the macro approach is the one that matches it.

There is also a reason to prefer that shape beyond tidiness. TX_POINTER_TO_ALIGN_TYPE_CONVERT is defined only in the non-MISRA arm of both headers, and the SMP file uses it unconditionally, so SMP does not compile with TX_MISRA_ENABLE and TX_ENABLE_STACK_CHECKING together:

common_smp/src/tx_thread_create.c:142:24: error: implicit declaration of function
  'TX_POINTER_TO_ALIGN_TYPE_CONVERT'; did you mean 'TX_POINTER_TO_ULONG_CONVERT'?

Nothing builds that combination today, which is why it has gone unnoticed, but the native64 MISRA stack-checking lane this PR adds is exactly the kind of configuration that would reach it. Defining the macros in the MISRA arm fixes SMP at the same time. Whether SMP belongs in this PR or a follow-up is your call — it has the same truncation, since it converts through the same path once it compiles.

[fdesbiens]

Correction to my earlier comment. I checked the SMP path against the 6.4.1 tag rather than against the base this targets, and two of my three points are wrong as a result.

#742 already moved common_smp/src/tx_thread_create.c to the same inline conversion this PR proposes for the single-core path, so "consistent with the SMP creation path" is accurate as written and my correction of it was not. The compile break I described under TX_MISRA_ENABLE with TX_ENABLE_STACK_CHECKING is a property of the 6.4.1 tag; #742 fixed it on dev.

That also settles the Rule 11.6 placement question against what I argued. #742 chose the inline conversion for the simulator ports and the SMP create path rather than adding shims to tx_misra.c, so the pattern is established and this PR follows it. I withdraw that as a change request. This PR documents the deviation at the conversion site, which #742 did not, so the two paths read more consistently with this than without it.

No objection to the approach from me. The open items are the ones already in your own list rather than anything from my comment.