Svc/Ccsds/SpacePacketFramer: emit SUCCESS on comStatusOut when buffer allocation fails by Dev-next-gen · Pull Request #5972 · nasa/fprime

Dev-next-gen · 2026-09-15T00:08:14Z


*Related Issue(s)*	Fixes #5971 (follow-up to #5894 / #5943)
*Has Unit Tests (y/n)*	y
*Documentation Included (y/n)*	y
*Generative AI was used in this contribution (y/n)*	y

Change Description

When the frame buffer allocation fails (invalid buffer, or one smaller than requested), SpacePacketFramer now emits one Fw::Success::SUCCESS on comStatusOut after returning the data buffer, exactly like FprimeFramer does since #5943. Nothing else on that path changes: NoBufferAvailable is still logged, an undersized buffer is still deallocated, and no frame goes out on dataOut.

Also:

Two unit tests, InvalidAllocationEmitsComStatus and UndersizedAllocationEmitsComStatus, matching the ones Svc/FprimeFramer: emit SUCCESS on comStatusOut when frame buffer allocation fails #5943 added for FprimeFramer.
Svc/Ccsds/SpacePacketFramer/docs/sdd.md: documents the drop path and adds requirement SPF-011.

I opened this together with #5971 because it mirrors #5943 line for line. Happy for it to go through CCB first.

Rationale

In ComCcsds, spacePacketFramer.comStatusOut goes directly to ComQueue, which only leaves WAITING on a returned status. One transient NoBufferAvailable therefore stalls downlink for good, which is the failure #5894 described for FprimeFramer. The nominal path is unchanged: a produced packet still relies on the status coming back from downstream. No FPP or interface change.

Testing/Review Recommendations

fprime-util check in Svc/Ccsds/SpacePacketFramer: 6/6 pass. With only SpacePacketFramer.cpp reverted to a41532adec and the tests kept, 4/6 pass and both new tests fail on the empty comStatusOut history.
Full native suite, fprime-util check --all with the change: 133/133 pass.
clang-format with the repository config: no changes.
Not reproduced on a running deployment. Svc/FprimeFramer: emit SUCCESS on comStatusOut when frame buffer allocation fails #5943 included a GDS check with a shrunken buffer bin; I have not repeated it for the CCSDS stack.
I left Svc/ComAggregator/docs/sdd.md alone because Svc.ComAggregator: consolidate idle filling and configuration #5939 is rewriting it; it could list SpacePacketFramer next to FprimeFramer once that lands.

Future Work

None.

AI Usage (see policy)

This contribution comes out of a defect-hunting pipeline I build and run (Dev-next-gen). It uses Claude Code with Anthropic's Claude Opus 5.

Type of assistance: finding the defect, the code change, the two unit tests, the SDD paragraph, and the text of this PR and the issue.
Scope: everything in this PR — the allocation-failure branch of SpacePacketFramer.cpp, the tests under test/ut, and docs/sdd.md.
How it was found: after Svc/FprimeFramer: emit SUCCESS on comStatusOut when frame buffer allocation fails #5943 merged, the pipeline searched the other framers for the same allocation-failure branch and found it copied here.
Level of modification: the change intentionally reuses the Svc/FprimeFramer: emit SUCCESS on comStatusOut when frame buffer allocation fails #5943 fix and test pattern instead of introducing a new one. Nothing leaves the pipeline without a test that fails before the change and passes after it, run with the project's own tooling.

IAMAI

"Nothing this pipeline produces is submitted without human approval. The entire pull request — the code change, the tests, the SDD update and this description — was reviewed by a human before the pipeline was allowed to submit it. This includes the ComCcsds wiring and the Framer Status Protocol table the fix relies on."

(@Dev-next-gen)

… allocation fails When bufferAllocate returns an invalid or undersized buffer, the framer dropped the packet and returned the data buffer without producing any status, so the upstream Svc::ComQueue waited forever. Per the Framer Status Protocol a message that produces zero frames must be acknowledged with Fw::Success::SUCCESS. This is the same defect fixed in Svc/FprimeFramer by nasa#5943. Fixes nasa#5971

thomas-bc-autowot · 2026-09-15T00:43:26Z

@@ -82,8 +84,10 @@ class SpacePacketFramerTester final : public SpacePacketFramerGTestBase {

    U16 m_nextSeqCount;  // Sequence count to be returned by getApidSeqCount output port


[C++ Design] future work m_nextSeqCount has no initializer (CPP-19).

The neighbouring fixture flags are initialized in-class, but m_nextSeqCount is left indeterminate and the constructor does not set it. from_getApidSeqCount_handler returns it, so any test that reaches getApidSeqCount without assigning it first reads an uninitialized U16. Preexisting; the PR does not widen it (the new allocation-failure tests return before the sequence-count lookup). Consider U16 m_nextSeqCount = 0;.

thomas-bc-autowot · 2026-09-15T00:47:32Z

        }
        this->dataReturnOut_out(0, data, context);
+        // No frame produced: report SUCCESS so the upstream ComQueue keeps sending (Framer Status Protocol)
+        if (this->isConnected_comStatusOut_OutputPort(0)) {


[Operational] could fix Under sustained pool exhaustion this turns a ComQueue stall into a full-rate drain of the ComQueue backlog, visible for only 5 drops per process lifetime.

Trace: each SUCCESS re-arms ComQueue (async comStatusIn -> processQueue -> dataOut), so with the ComCcsds defaults up to 800 queued packets (events 200 + tlm 500 + file 100) are dequeued and dropped back-to-back on the ComQueue thread while commsBufferManager (20 + 30 buffers, shared with the uplink path) stays empty.
NoBufferAvailable is throttle 5 and nothing in this component calls _ThrottleClear(), so after the first 5 drops of the deployment's life later exhaustion episodes show up only in BufferManager NoBuffs; FileDownlink sees its buffer returned via dataReturnOut and advances as if the chunk were sent.
Operational judgment call: same tradeoff already accepted for FprimeFramer (#5943); the consequence is bounded by the queue depths and documented as a drop.
Smallest remedy: re-arm the event (clear the throttle on the first successful allocation after a failure, or a DpManager-style CLEAR_EVENT_THROTTLE command) and mirror it in FprimeFramer.

cc @LeStarch @thomas-bc — low-confidence finding, please confirm.

thomas-bc-autowot

Automated review summary (run 1)

Per-agent results

Agent	must fix	suggestion	could fix	future work	outstanding	Verdict
Security Vulnerabilities	0	0	0	0	0	Go
Supply Chain / Runner Safety	0	0	0	0	0	Go
F Prime C/C++ Design	0	0	0	1	1	Go
Documentation Currency	0	0	0	1	0	Go
Design	0	0	0	0	0	Go
Architecture	0	0	0	0	0	Go
Test Quality	0	2	0	1	3	Go
Correctness	0	0	0	0	0	Go
Operational	0	0	2	0	2	Go
Maintainability	0	0	0	0	0	Go
CI safety	—	—	—	—	—	Go
Totals	0	2	2	3	6	Go

Supply-chain surfaces

Surface	Outstanding
Dependencies	clean
Vendored / submodule	clean
Build / test infrastructure	clean
Workflows / actions / scripts	clean
Generator output	clean
Prompt-injection	clean
Review-system integrity	clean

Merge readiness

Merge readiness: Go — all ten reviewers completed with zero outstanding must-fix findings; @LeStarch and @thomas-bc requested for human review.

Clean telemetry from all ten stations — the framer's status link is clear for the maintainers' go/no-go poll.

Co-authored-by: thomas-bc-autowot <[email protected]>

…stion (clang-format)

github-actions · 2026-09-15T01:31:06Z

Coverage report — base `devel`

Overall (line): 84.85% → 84.89% (+0.04)
Regression threshold: 0.50% (line).

Regressions

(none over threshold)

Modules changed

Module	Line	Δ	Function	Δ	Branch	Δ
`Fw/DataStructures`	97.96	+0.63	97.14	+0.00	82.66	+1.09
`Svc/Ccsds/SpacePacketFramer`	97.92	+11.56	100.00	+0.00	90.91	+21.68

New modules

Module	Line	Function	Branch
`Fw/Prm`	0.00	0.00	0.00

Modules without UTs

CFDP/Checksum/GTest, Drv/LinuxGpioDriver, Drv/LinuxI2cDriver, Drv/LinuxSpiDriver, Drv/Ports/DataTypes, Drv/PosixUartDriver, FppTestProject/FppTest/topology/async, FppTestProject/FppTest/topology/components/Comp, FppTestProject/FppTest/topology/components/Framework, FppTestProject/FppTest/topology/components/Receiver, FppTestProject/FppTest/topology/components/Sender, FppTestProject/FppTest/topology/guarded, FppTestProject/FppTest/topology/sync, FppTestProject/FppTest/topology/top_ports, FppTestProject/FppTest/topology/types, Fw/Com, Fw/Comp, Fw/FilePacket/GTest, Fw/Fpy, Fw/Obj, Fw/Port, Fw/Sm, Fw/Test, Fw/Types/GTest, Os/Models, Svc/Ccsds/Types, Svc/Ccsds/Utils, Svc/FatalHandler, Svc/Subtopologies/CdhCore, Svc/Subtopologies/ComCcsds, Svc/Subtopologies/ComCcsdsSdls, Svc/Subtopologies/ComFprime, Svc/Subtopologies/ComLoggerTee, Svc/Subtopologies/DataProducts, Svc/Subtopologies/DpCompression, Svc/Subtopologies/FileHandling, Svc/Subtopologies/FileHandlingCfdp, Svc/Subtopologies/FileHandlingCfdp/FileHandlingCfdpConfig, TestDeploymentsProject/Ref/DpDemo, TestDeploymentsProject/Ref/PingReceiver, TestDeploymentsProject/Ref/RecvBuffApp, TestDeploymentsProject/Ref/SendBuffApp, TestDeploymentsProject/Ref/Top, TestDeploymentsProject/Ref/TypeDemo, cmake/test/data/TestConfigDeployment, cmake/test/data/TestDeployment/TestBuildAutocoder, cmake/test/data/TestDeployment/TestDuplicateDirective, cmake/test/data/TestDeployment/TestHeaderAutocoder, cmake/test/data/TestDeployment/TestLinkDepends, cmake/test/data/TestDeployment/TestRelative, cmake/test/data/test-fprime-library/TestLibrary/TestComponent, cmake/test/data/test-fprime-library2/TestLibrary2/TestComponent

… allocation fails (nasa#5972) * Svc/Ccsds/SpacePacketFramer: emit SUCCESS on comStatusOut when buffer allocation fails When bufferAllocate returns an invalid or undersized buffer, the framer dropped the packet and returned the data buffer without producing any status, so the upstream Svc::ComQueue waited forever. Per the Framer Status Protocol a message that produces zero frames must be acknowledged with Fw::Success::SUCCESS. This is the same defect fixed in Svc/FprimeFramer by nasa#5943. Fixes nasa#5971 * Update Svc/Ccsds/SpacePacketFramer/test/ut/SpacePacketFramerTester.cpp Co-authored-by: thomas-bc-autowot <[email protected]> * Update Svc/Ccsds/SpacePacketFramer/docs/sdd.md Co-authored-by: thomas-bc-autowot <[email protected]> * Update Svc/Ccsds/SpacePacketFramer/test/ut/SpacePacketFramerTester.cpp Co-authored-by: thomas-bc-autowot <[email protected]> * Svc/Ccsds/SpacePacketFramer: realign test comment after applied suggestion (clang-format) --------- Co-authored-by: thomas-bc-autowot <[email protected]> (cherry picked from commit c007687)

Dev-next-gen mentioned this pull request Sep 15, 2026

Svc/Ccsds/SpacePacketFramer: buffer-allocation failure emits no comStatusOut, stalling ComQueue #5971

Closed

thomas-bc-autowot reviewed Sep 15, 2026

View reviewed changes

Comment thread Svc/Ccsds/SpacePacketFramer/docs/sdd.md Resolved

thomas-bc-autowot reviewed Sep 15, 2026

View reviewed changes

Comment thread Svc/Ccsds/SpacePacketFramer/test/ut/SpacePacketFramerTester.cpp Resolved

Comment thread Svc/Ccsds/SpacePacketFramer/test/ut/SpacePacketFramerTester.cpp Resolved

Comment thread Svc/Ccsds/SpacePacketFramer/test/ut/SpacePacketFramerTester.cpp Resolved

thomas-bc-autowot reviewed Sep 15, 2026

View reviewed changes

thomas-bc-autowot requested review from LeStarch and thomas-bc September 15, 2026 00:51

thomas-bc-autowot approved these changes Sep 15, 2026

View reviewed changes

Dev-next-gen and others added 4 commits September 15, 2026 03:02

Update Svc/Ccsds/SpacePacketFramer/test/ut/SpacePacketFramerTester.cpp

e180dca

Co-authored-by: thomas-bc-autowot <[email protected]>

Update Svc/Ccsds/SpacePacketFramer/docs/sdd.md

c09f4f8

Co-authored-by: thomas-bc-autowot <[email protected]>

Update Svc/Ccsds/SpacePacketFramer/test/ut/SpacePacketFramerTester.cpp

2ab78d4

Co-authored-by: thomas-bc-autowot <[email protected]>

Svc/Ccsds/SpacePacketFramer: realign test comment after applied sugge…

6f116e7

…stion (clang-format)

thomas-bc approved these changes Sep 15, 2026

View reviewed changes

LeStarch approved these changes Sep 15, 2026

View reviewed changes

LeStarch merged commit c007687 into nasa:devel Sep 15, 2026
69 checks passed

Navigation Menu

Repository navigation

Svc/Ccsds/SpacePacketFramer: emit SUCCESS on comStatusOut when buffer allocation fails - #5972

Svc/Ccsds/SpacePacketFramer: emit SUCCESS on comStatusOut when buffer allocation fails#5972
LeStarch merged 5 commits into
nasa:develfrom
Dev-next-gen:fix/spacepacketframer-alloc-fail-comstatus

Dev-next-gen commented Sep 15, 2026 •

edited

Loading

Uh oh!

thomas-bc-autowot Sep 15, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

thomas-bc-autowot Sep 15, 2026

Uh oh!

Uh oh!

thomas-bc-autowot left a comment

Uh oh!

github-actions Bot commented Sep 15, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -82,8 +84,10 @@ class SpacePacketFramerTester final : public SpacePacketFramerGTestBase {

		U16 m_nextSeqCount; // Sequence count to be returned by getApidSeqCount output port

Conversation

Dev-next-gen commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change Description

Rationale

Testing/Review Recommendations

Future Work

AI Usage (see policy)

Uh oh!

thomas-bc-autowot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

thomas-bc-autowot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

thomas-bc-autowot left a comment

Choose a reason for hiding this comment

Automated review summary (run 1)

Per-agent results

Merge readiness

Uh oh!

github-actions Bot commented Sep 15, 2026

Coverage report — base devel

Regressions

Modules changed

New modules

Modules without UTs

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Dev-next-gen commented Sep 15, 2026 •

edited

Loading

Coverage report — base `devel`