fix: guard FreeRtosSysUpTime against tick configs that wrap early#634
Conversation
xTaskGetTickCount() wraps at TickType_t width; below 64-bit ticks (or a 32-bit tick counter above 100 Hz) the scaled uptime wraps well before the RFC 3418 2^32-hundredths period and jumps backwards. Add a _Static_assert that refuses to build outside the faithful envelope — 64-bit ticks at any rate, or 32-bit ticks with configTICK_RATE_HZ <= 100 — and update the doc-comment to state the RFC 3418 contract. Integrators outside the envelope widen the tick type, lower the rate, or supply their own SolidSyslogSysUpTimeFunction. Closes #609 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
WalkthroughFreeRTOS ChangesFreeRTOS uptime compliance
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
☀️ Quality Summary 🚦 build-linux-gcc: 100% successful (✔️ 1524 passed) Created by Quality Monitor v1.14.0 (#f3859fd). More details are shown in the GitHub Checks Result. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Platform/FreeRtos/Source/SolidSyslogFreeRtosSysUpTime.c`:
- Around line 21-26: Add compile-only configuration cases covering the
_Static_assert in SolidSyslogFreeRtosSysUpTime: verify 16-bit TickType_t and
unsupported 32-bit tick-rate configurations fail, while supported 32-bit and
64-bit configurations pass. Ensure these cases exercise every assertion branch
and preserve the existing 100% line and branch coverage requirement.
- Around line 11-26: Narrow the uptime contract to tick rates that divide
HUNDREDTHS_PER_SECOND and prevent overflow in the 64-bit tick-to-hundredths
conversion. In SolidSyslogFreeRtosSysUpTime.c, update the static assertion and
conversion logic accordingly, using division-before-multiplication or wider
arithmetic; in Platform/FreeRtos/Interface/SolidSyslogFreeRtosSysUpTime.h lines
14-21, update the corresponding supported-configuration documentation or
declaration contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 41eb40ee-b141-4344-bf33-013cc916b6cb
📒 Files selected for processing (2)
Platform/FreeRtos/Interface/SolidSyslogFreeRtosSysUpTime.hPlatform/FreeRtos/Source/SolidSyslogFreeRtosSysUpTime.c
… scale overflow Address CodeRabbit review on #634: - The 32-bit faithful envelope is a tick rate that *divides* 100, not merely <= 100. A non-divisor rate (e.g. 40 Hz) injects a phase discontinuity at the tick-counter wrap (offset = 2^32*100/RATE mod 2^32 != 0), a reachable backwards jump. Guard now requires (100 % configTICK_RATE_HZ) == 0 on the 32-bit path; 64-bit ticks stay any-rate (wrap is millions of years out). - Divide the tick count before scaling by 100 (exact whole/remainder split) so the intermediate cannot overflow a 64-bit TickType_t. Doc-comment updated to the divisor-of-100 contract. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Platform/FreeRtos/Source/SolidSyslogFreeRtosSysUpTime.c`:
- Around line 12-21: Update the header comment around the TickType_t wrap
behavior to qualify the 64-bit guarantee: state that its 2^64-tick wrap is
beyond any realistic uptime rather than claiming every wrap is phase-continuous
or that the offset is always zero. Retain the exact phase-continuity and
zero-offset claims only for 32-bit TickType_t rates that divide 100, and
preserve the existing guidance for unsupported widths or rates.
- Around line 22-28: The compile-time check in SolidSyslogFreeRtosSysUpTime must
support the documented C99 baseline. Replace the direct _Static_assert in
SolidSyslogFreeRtosSysUpTime with SOLIDSYSLOG_STATIC_ASSERT from
SolidSyslogMacros.h, preserving the existing condition and diagnostic message.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6d338801-a206-4388-8910-63503744f25c
📒 Files selected for processing (2)
Platform/FreeRtos/Interface/SolidSyslogFreeRtosSysUpTime.hPlatform/FreeRtos/Source/SolidSyslogFreeRtosSysUpTime.c
☀️ Quality Summary 🚦 build-linux-gcc: 100% successful (✔️ 1524 passed) Created by Quality Monitor v1.14.0 (#f3859fd). More details are shown in the GitHub Checks Result. |
Address CodeRabbit re-review on #634: the raw _Static_assert is a C11 primitive, so it breaks the documented C99 portability target (the c99 preset). Switch to SOLIDSYSLOG_STATIC_ASSERT from SolidSyslogMacros.h, which tiers to static_assert (C++), _Static_assert (C11), or a negative- array-size fallback (C99) — matching every other static-assert site (SolidSyslogFormatter.c, SolidSyslogMbedTlsAesGcmPolicy.c). Condition and message are unchanged. Add Core/Source to the SysUpTime host-test include path (the FreeRtos production pack already exposes it); bump the file's misra-5.7 suppression line for the added include. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
☀️ Quality Summary 🚦 build-linux-gcc: 100% successful (✔️ 1524 passed) Created by Quality Monitor v1.14.0 (#f3859fd). More details are shown in the GitHub Checks Result. |
1 participant
Closes #609 (S24.22).
The gap
SolidSyslogFreeRtosSysUpTime_Getis(uint64) xTaskGetTickCount() * 100 / configTICK_RATE_HZcast touint32.xTaskGetTickCount()returns the raw FreeRTOS tick counter, which wraps atTickType_twidth. Below a 64-bit tick type — or a 32-bit one above 100 Hz — the scaled uptime wraps well before the RFC 3418 2³²-hundredths (~497-day) period and jumps backwards early (seconds-to-minutes underconfigUSE_16_BIT_TICKS).The fix (option B — guard the faithful envelope)
A compile-time
_Static_assertthat refuses to build outside the envelope where the result is a faithful RFC 3418 modulo-2³² counter:TickType_tat any tick rate, orTickType_twithconfigTICK_RATE_HZ <= 100(at 100 Hz the tick wrap lands exactly on the hundredths wrap).A 16-bit tick counter, or 32-bit above 100 Hz, fails to build. The guard is width-agnostic (
sizeof(TickType_t)), so it accepts a 64-bit integrator without depending on the newerconfigTICK_TYPE_WIDTH_IN_BITSmacro. An integrator outside the envelope widens the tick type, lowers the rate, or supplies their ownSolidSyslogSysUpTimeFunction.The
_Getdoc-comment is updated from "not a full TimeTicks counter" to state the new RFC 3418 contract.Why a guard, not a wrap-tracking extension
Discussed on the issue: the overflow-extension (a wrap counter) adds state to a currently-stateless getter for a payoff only 16-bit/high-rate integrators need. The guard turns a silent, subtly-wrong uptime into an informed build-time choice, and a faithful counter is an easy function for those integrators to provide.
Scope note
All repo FreeRTOS configs (test fake + both BDD targets) run 32-bit ticks at 100 Hz, so they sit inside the envelope and compile unchanged.
Verification
SolidSyslogFreeRtosSysUpTimeTest4/4 pass.🤖 Generated with Claude Code
Summary by CodeRabbit