Skip to content

v4.3.0

Latest
Latest

Choose a tag to compare

View all tags
@LeStarch LeStarch released this 20 Aug 01:46
· 22 commits to devel since this release
v4.3.0
7d8f579
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Full Changelog: v4.2.2...v4.3.0

Highlights

Major Features

  • CCSDS File Delivery Protocol (CFDP): new Svc::Ccsds::CfdpManager for standards-based file transfer, with hardened RX handling of malformed remote PDUs.
  • CCSDS AOS Deframer, plus configurable spacecraft/VC IDs in the AOS Framer.
  • Encryption interfaces: framework hooks for encrypted communication stacks (e.g. SDLS).
  • Initial FPP system modeling: deployments are now modeled as FPP systems.
  • Direct port calls supported in generated code for faster, more memory-efficient port invocation.
  • FpySequencer: sequence arguments via CmdSeqIn, cancel port, CANCEL_ALL, argument name/type validation, SEQ_BASE_DIR parameter, and new directives (POP_EVENT, PUSH_RAND/SET_SEED, FFLOOR/FABS/IABS).
  • Performance: optimized CRC-32 (~3x faster), lockless priority queue, and non-virtual serialization buffers with optional inlining.
  • OSAL: new Os::CountingSemaphore module; PassiveRateGroup timer-source selection and per-component duty-cycle metrics; settable time context in Svc::PosixTime.
  • Platform support: Linux GPIO chardev uAPI v2 with v1 fallback; generic aarch64-clang-linux cross-compilation toolchain.
  • Build system: find_package(FPrime) support, DESTDIR-correct installs, and progress toward fully independent F´ builds.

Security Fixes

This release contains a large number of security and robustness fixes, many found via static analysis, CodeQL, and adversarial review — upgrading is strongly recommended:

  • Bounds/overflow fixes: frame detector integer underflow/overflow, packet-length overflow, unchecked memcpy, stack push off-by-one, and command/DP buffer size validation.
  • Hardening of externally-reachable inputs against assertion denial-of-service and path traversal; malformed CFDP PDU handling; FileUplink destination-path validation; bounded Os::File::open inputs.
  • Replaced asserts with events on corrupt or attacker-controllable data (data product files, sequencer ports); rejection of invalid event filter levels; DpCatalog/PrmDb file validation and corruption fixes.
  • Buffer-ownership and queue fixes: ComQueue buffer leak on drop, atomic ownership state, and PriorityMemQueue semaphore credit drift.
  • New CodeQL query for unguarded unsigned subtraction and division-guard fixes.

Breaking Changes

Configuration Changes

PrmDb file name must be supplied by the deployment

The FileHandling subtopology no longer hardcodes PrmDb.dat. Call configure() in your topology setup before parameters are read:

 void configureTopology(const TopologyState& state) {
+    // FileHandling requires the using topology to supply the parameter database file name
+    FileHandling::prmDb.configure("PrmDb.dat");
     FileHandling::fileUplink.configure(...);
 }

New fields in ComCfg::FrameContext

The com-config FrameContext struct gained fields supporting Space Packet secondary headers and sequence flags, AOS deframing, and SDLS security associations. A new Pvn (Packet Version Number) dictionary enum and a FW_PACKET_PARAM APID were also added. Projects overriding ComCfg.fpp must add:

 struct FrameContext {
     comQueueIndex: FwIndexType
     apid: Apid
+    hasSecHdr: bool             @< Secondary header flag for SpacePacketFramer
+    sequenceFlags: U8           @< 2 bit sequence flags (0b11 = unsegmented)
     sequenceCount: U16
     vcId: U8
+    pvn: Pvn                    @< Packet Version Number - used for AOS deframing
     sendNow: bool
+    saIndex: U16                @< Security Association Index - set/read by SDLS components
 }

Socket driver hostname renamed to ipv4Address

F´ IP drivers do not perform DNS resolution; the parameter is now named accordingly. SOCKET_MAX_HOSTNAME_SIZE remains as a deprecated alias of SOCKET_MAX_IPV4_ADDRESS_SIZE:

-    comDriver.configure(state.hostname, state.port);
+    comDriver.configure(state.ipv4Address, state.port);

SO_REUSEADDR enabled by default

IP_SOCKET_OPTIONS in the IP configuration now enables SO_REUSEADDR by default; override the config if the previous behavior is required.

ComCcsds subtopology owns its includes

Includes for the ComCcsds subtopology moved into the subtopology itself — remove the duplicates from your topology files.

DataProducts subtopology adds a BufferAccumulator

A Svc::BufferAccumulator instance (in DRAIN mode) now sits between DpManager and DpWriter. Add its telemetry-packet and health entries to your deployment.

CPU affinity configurable for subtopology active instances

Active instances in the core subtopologies expose CPU affinity as overridable configuration alongside priority and stack size.

New SERIALIZABLE_INLINE option

FpConfig.h gains a SERIALIZABLE_INLINE option to control inlining of serializeFrom/deserializeTo for performance tuning.

User Breaking Changes

Fw::Buffer rework: offset, capacity, and advance()

Fw::Buffer now tracks its original allocation pointer, an offset, and a capacity. setData() only accepts pointers within the original allocation — wrapping unrelated memory requires constructing a new buffer. Use advance() to strip headers:

-    // Shift data pointer to effectively remove the header
-    data.setData(data.getData() + FrameHeader::SERIALIZED_SIZE);
-    data.setSize(data.getSize() - FrameHeader::SERIALIZED_SIZE - FrameTrailer::SERIALIZED_SIZE);
+    // Advance past the header (adjusts size accordingly)
+    data.advance(FrameHeader::SERIALIZED_SIZE);
+    data.setSize(data.getSize() - FrameTrailer::SERIALIZED_SIZE);

Command handler signatures: non-primitive args by const reference

Auto-generated handler functions now pass non-primitive arguments by const reference. Update your handler overrides:

 void REGISTER_AES_KEY_cmdHandler(FwOpcodeType opCode,
                                  U32 cmdSeq,
-                                 ExternalLibs::AesKeyType key) override;
+                                 const ExternalLibs::AesKeyType& key) override;

FPP system modeling

Deployments must mark their topology with the deployment keyword and add a system.fpp registered in the build:

 # topology.fpp
-  topology MyDeployment {
+  deployment topology MyDeployment {
 # Top/system.fpp (new file; add to AUTOCODER_INPUTS in Top/CMakeLists.txt)
+module MyDeployment {
+  system MySystem: MyDeployment
+}

PrmDb CRC is now endian-independent

The parameter database CRC is now serialized in a platform-independent form. Existing parameter database files will fail CRC validation on load and must be regenerated.

FileUplink adds a FilesReceivedFailed telemetry channel

Corrupt uplinked files no longer count as received. Add the channel to your telemetry packet definitions:

     FileHandling.fileUplink.FilesReceived
+    FileHandling.fileUplink.FilesReceivedFailed
     FileHandling.fileUplink.PacketsReceived

Developer Breaking Changes

SerializeBufferBase renamed to LinearBufferBase

The rename completes the buffer-type naming transition. getBuffAddr()/getCapacity() are no longer virtual, and the constructor now requires the buffer address and capacity.

Revised FPP enum code generation

Constructing an invalid enum value in memory now causes an assertion failure (avoiding C++ undefined behavior). Unit tests must use the new mechanism for generating invalid serialized enums instead of constructing invalid enum objects.

Fw.LogSeverity is now a dictionary enum

Event severity is emitted into dictionaries as a proper enum, affecting ground tooling that parsed the old representation.

configure() method parameters made const

configure() methods across Svc components take const parameters — update overrides and derived classes accordingly.

Deprecations

  • FPP enum .e member is deprecated: code accessing the type-specific .e field of generated FPP enum classes should migrate to using the enum class directly (constructors, assignment, and comparison operators), as .e will be removed in a future release.
  • Os::Directory::readDirectory(Fw::String filenameArray[], ...): use the Fw::ExternalArray<Fw::String> overload instead.
  • Svc::ActiveRateGroup::configure(const U32 contexts[], ...) and Svc::PassiveRateGroup::configure(const U32 contexts[], ...): use the ContextArray-based configure() overloads instead.
  • Svc::DpCatalog::configure(Fw::FileNameString directories[], ...): use the Fw::ExternalArray<Fw::FileNameString> overload instead.
  • Legacy Fw::Buffer::getBuffLength() (use getSize()) and SOCKET_MAX_HOSTNAME_SIZE (use SOCKET_MAX_IPV4_ADDRESS_SIZE) remain as deprecated aliases.

New Contributors

Full Changelog: v4.2.2...v4.3.0

Contributors

nateinaction, evshary, and 34 other contributors
Assets 2
Loading