change code coverage

docs/contribute/development/cpp/code_analysis.rst

@@ -102,25 +102,34 @@ Adress/ Leak Sanitizer (ASAN/LSAN)
 
 If both tools are combined at runtime memory leaks and the corresponding address can be investigated.
 
-Coverage
-========
+Code Coverage
+=============
 
-As required by the verification guideline coverage needs to be calculated for the code which is used in the project. Therefore two approaches should be available:
+As required by the verification guideline code coverage needs to be calculated for the code which is used in the project. Coverage is calculated on the host using LLVM's source-based coverage:
 
-* As a quick solution it is possible to calculate the coverage on the host via gcc.
-* But for a more accurate statement coverage can also be calculated with the qcc compiler with the appropriate libraries and POSIX interfaces. This method will also be used for the reporting.
+* Coverage is calculated on the host via clang/llvm. This method is also used for the reporting.
+
+In Bazel-based development, this does not imply that every build uses the same compiler configuration. Normal host builds may use the default host compiler/toolchain, while coverage builds select a dedicated host configuration with LLVM source-based instrumentation enabled. The resulting raw profiles are merged with ``llvm-profdata`` and evaluated with ``llvm-cov``.
+
+S-CORE determines structural coverage on the host using LLVM's source-based coverage. Structural coverage on the target is not determined by S-CORE. It shall be determined by the user or distributor for the target on which the S-CORE software is integrated. Target structural coverage is needed to identify uncovered target-specific code and to provide evidence for the absence of undefined behaviour on the target.
+
+LLVM's source-based coverage is preferred over ``gcov``-based coverage for the following reasons:
+
+
+* **Precision with templates, generics and modern C++:** legacy GCC line-based coverage ``gcov`` is line-oriented, so with heavy templating, inlining and macros the mapping is coarse and multiple template instantiations collapse onto the same lines, producing imprecise or misleading results. LLVM's source-based coverage is region- and instantiation-based and therefore significantly more accurate for modern C++.
+* **MC/DC support:** LLVM/clang supports MC/DC natively (``-fcoverage-mcdc``), which is required for the higher ASIL levels.
 
 To enable this, following tools are used:
 
 .. needuml::
 
    object "Coverage" as coverage
    object "gtest" as gtest
-   object "gcov + gcovr" as gcov
+   object "llvm-cov + llvm-profdata" as llvm
    object "host" as host
-   object "QNX" as qnx
 
    coverage --> gtest
-   gtest --> gcov
-   gcov --> host
-   gcov --> qnx
+   gtest --> llvm
+   llvm --> host
+
+Host and target coverage have different responsibilities. LLVM coverage on the host provides S-CORE's structural-coverage result. The user or distributor shall determine structural coverage on the target used for integration, including target-specific code paths, as required by the platform AoU :need:`aou_req__platform__target_structural_coverage`. Target execution tests and target structural-coverage results are separate verification evidence and shall not be treated as interchangeable.

docs/design_decisions/DR-001-infra.md

@@ -167,7 +167,7 @@ _Provided via devcontainer_
 - `buildifier`, `bazel-compile-commands`
 - `curl`, `qemu-system-aarch64`, `sshpass` (??)
 - `protoc`
-- `gcovr`
+- `llvm-cov`, `llvm-profdata`
 
 **Not Natively Cacheable in Bazel**
 _Provided via devcontainer_

docs/platform_management_plan/software_verification.rst

@@ -547,18 +547,18 @@ components, documentation, and automated tests.
 The software components of the project written in C++ are unit tested with the help of
 `GoogleTest <https://google.github.io/googletest/>`__.
 
-.. rubric:: gcov/gcovr
+.. rubric:: Code Coverage (llvm-cov/llvm-profdata)
 
-For C++ code the structural coverage reached by unit testing in the project is evaluated by the gcov/gcovr tool chain
-`gcovr <https://github.com/gcovr/gcovr>`__ - gcov is part of the GNU compiler collection (gcc).
+For C++ code the structural coverage reached by unit testing in the project is evaluated by the llvm-cov/llvm-profdata tool chain
+`llvm-cov <https://llvm.org/docs/CommandGuide/llvm-cov.html>`__ and `llvm-profdata <https://llvm.org/docs/CommandGuide/llvm-profdata.html>`__ are part of the LLVM toolchain.
 
 The C++ unit test tooling supports several coverage metrics:
 
 - "line" - used in S-CORE for the ``structural-statement-coverage`` method
 - "branch" - used in S-CORE for the ``structural-branch-coverage`` method
 - "function" - used in S-CORE for the ``structural-function-coverage`` as additional supporting coverage value for further analysis.
 
-Note gcov/gcovr are not applicable for Rust code. Here coverage values are created using the tooling provided by the Ferrocene.
+Note: Rust coverage evidence in S-CORE is primarily generated via Rust/Ferrocene tooling. llvm-cov/llvm-profdata may be used in dedicated host-based LLVM workflows, but this is not the default Rust coverage reporting path.
 
 
 .. rubric:: Integration Testing Framework (ITF)

docs/requirements/platform_assumptions/index.rst

@@ -256,6 +256,19 @@ This is the highest level of integration. This is the level where the S-CORE SW-
    Note: The SW-platform integtion tests provided by S-CORE for :need:`aou_req__platform__testing` are for demonstration purpose only,
    as described in the tailoring section of :need:`doc__score_platform_safety_plan` and thus do not claim correctness and completeness.
 
+.. aou_req:: Target structural coverage
+   :id: aou_req__platform__target_structural_coverage
+   :reqtype: Non-Functional
+   :security: YES
+   :safety: ASIL_B
+   :status: valid
+   :version: 1
+   :tags: user
+
+   If the system using the SW-platform has safety goals, the system integrator or distributor shall determine structural coverage for the target on which the SW-platform is integrated.
+
+   Note: S-CORE determines structural coverage on the host using LLVM's source-based coverage. Target structural coverage is required to cover target-specific code and undefined behaviour and is not determined by S-CORE.
+
 .. aou_req:: Integrator safety anomaly reporting
    :id: aou_req__platform__integration_safety_anomaly
    :reqtype: Non-Functional

docs/score_tools/score_tools_evaluation_list.rst

@@ -186,6 +186,14 @@ release, as part of the Tool Verification Report.
      - :need:`rl__infrastructure_tooling_community`
      - N/A
      - YES
+   * - 2a-6
+     - Clang + llvm-cov + llvm-profdata
+     - Code coverage tool from LLVM, used with Clang compiler
+     - 19.x (see [1]_)
+     - YES
+     - :need:`rl__infrastructure_tooling_community`
+     - :need:`doc_tool__clang`
+     - YES
 
 
 2b Rust
@@ -227,6 +235,14 @@ release, as part of the Tool Verification Report.
      - :need:`rl__infrastructure_tooling_community`
      - N/A
      - YES
+   * - 2b-4
+     - llvm-cov + llvm-profdata
+     - LLVM source-based code coverage toolchain, usable in dedicated Rust/LLVM host workflows
+     - 19.x (see [1]_)
+     - YES
+     - :need:`rl__infrastructure_tooling_community`
+     - :need:`doc_tool__clang`
+     - YES
 
 
 2c Python
@@ -547,6 +563,14 @@ release, as part of the Tool Verification Report.
      - :need:`rl__infrastructure_tooling_community`
      - :need:`doc_tool__qcc`
      - N/A
+   * - 5a-3
+     - Clang
+     - Host C++ compiler used for LLVM source-based coverage instrumentation and reporting workflows
+     - 19.x (see [1]_)
+     - YES
+     - :need:`rl__infrastructure_tooling_community`
+     - :need:`doc_tool__clang`
+     - YES
 
 
 5b Rust Compiler