Skip to content

Finished Phase 1: removed custody transfer, no admin record processing. - #110

Open
scburleigh wants to merge 181 commits into
nasa-jpl:integrationfrom
scburleigh:feature-4.2-bibe-update
Open

Finished Phase 1: removed custody transfer, no admin record processing.#110
scburleigh wants to merge 181 commits into
nasa-jpl:integrationfrom
scburleigh:feature-4.2-bibe-update

Conversation

@scburleigh

Copy link
Copy Markdown
Contributor

No description provided.

iondev33 and others added 27 commits June 29, 2026 11:14
The bounds check in both the SDR read (_sdrfetch) and write (_sdrput)
primitives computed `to = from + length` before comparing against
dsSize. That addition can wrap (from/length are uaddr/size_t), letting
a crafted from/length pair slip past the `to > dsSize` guard and read or
write outside the dataspace.

Reorder to the overflow-safe form `length > dsSize || from > dsSize - length`,
evaluated before any addition, and drop the now-unused `to` local.

Ports the public ION-DTN _sdrfetch hardening and extends it to the
matching _sdrput write path.
…C 9171

CTEB custodian_eid, CREB source_eid/report_to_eid, and the Bundle Sequence
source EID item were encoded as CBOR text strings, diverging from the
RFC 9171 structured [uri-code, SSP] array form required by Orange Book
Draft K (CCSDS).

Add serializeEidString() and acquireEidString() helpers in libbp.c that
wrap the existing primary-block EID codec (serializeEid/acquireEid plus
parseEidString/jotEid/readEid), inheriting correct 2-tuple and 3-tuple IPN
handling. Replace the cbor_encode_text_string / cbor_decode_text_string
calls in cteb.c, creb.c, and cbr.c with these helpers. Declare both in
bp.h and bpP.h.

Remove tests/pylib/cteb.py, dead scaffolding from a removed era with no
callers in the current tree.

Verified with custody-simple end-to-end test (2-node custody transfer with
CCS round-trip): 2 passed, 0 failed.
Two follow-up fixes to the Orange Book wire-format work:

CREB EID persistence: CrebScratchpad stored sourceEid and reportToEid as
SDR Object handles, but creb_parse always set them to 0 after decoding,
dropping the EIDs before creb_record could persist them to SDR. Change
both fields to embedded char arrays (matching the CTEB pattern), so
creb_parse can istrcpy the decoded EID directly into the scratchpad.
Simplifies creb_release (no SDR strings to free) and creb_copy (plain
sdr_write suffices for embedded arrays).

seq-id-ref per-destination mode: per Orange Book CDDL, seq-id-ref is
(uint .gt 0) / eid. When seqId == 0 (per-destination counter mode),
cbr_encodeBundleSequence now serializes the destination EID as the CBOR
item 1 instead of integer 0. cbr_decodeBundleSequence peeks at the CBOR
major type of item 1: if it is an array it decodes a structured EID
(setting seqId = 0) and returns it via new char **seqDestEid output
parameter; otherwise it decodes an integer seqId as before. Update
cbr.h declaration and all callers (cbr_handleCcs, cbr_handleCrs,
bptrace.c).

Verified with custody-simple end-to-end test in container: 2 passed,
0 failed.
…ession test

Add m crebexpliciteid <0|1> to bpadmin so CREB blocks can be forced to
include an explicit source EID (arrayLen=4), enabling ION-to-ION testing
of the creb_parse EID persistence path that was fixed in the prior commit.

Add tests/cbr-ct-orange-book/creb-eid-persist: a 3-node relay test that
sets crebexpliciteid on the source node, sends a bundle requesting CRS
signals for rcv+dlv, and verifies that Node 1 receives CRS back, Node 3
delivers the bundle, and no [?] CREB parse errors appear at any node.
Verifies the deletion CRS path in sendCompressedStatusRpt: when a bundle
with the del-report flag is forwarded to a relay that has no route to the
destination, the relay abandons with SrNoKnownRoute and sends a deletion
CRS (status=3) back to the report-to EID.

Node 1 loads cgr-hint.ionrc (contacts 2<->3) so its CGR computes path
1->2->3 and forwards the bundle to Node 2. Node 2 omits cgr-hint.ionrc,
so its ipnfw immediately abandons with SrNoKnownRoute rather than holding
the bundle for a bpclock cycle (~60 s) waiting for an outduct.

Three checks: CRS Signals Recv increments at Node 1, "[i] CRS received:
status: 3" in Node 1's ion.log, no "[?] CRS" parse errors at either node.
…ray test

createBundle in libbpP.c copied most BpAncillaryData fields but silently
dropped cbrSeqId, so every bundle got seqId=0 regardless of what the
caller passed.  This made creb_offer always encode seqId=0 in the CREB
block, forcing all CRS aggregation into per-destination sequence counters
even when a global seqId was requested.

Add the missing cbrSeqId copy to createBundle.

Add range-array count logging to cbr_handleCrs so decoded non-contiguous
CRS signals are visible in ion.log.

Add tests/cbr-ct-orange-book/seqid-gap: a 3-node regression test that
sends 4 bundles sharing global seqId=1, drops one mid-stream to create a
gap in the sequence numbers, and verifies that the aggregated forwarding
CRS uses CBOR range-array encoding rather than a simple contiguous length.
Add opt-in timer-based custody retransmission to the Orange Book CBR
implementation.  By default retransmission is disabled (CBR_RETX_NONE);
operators enable it via a new bpadmin command:

  m cbrretx timer <interval-seconds> <max-retransmissions>

The new manageCbrRetx function in bpadmin.c parses the command and
calls cbr_configureRetransmission.  A second SDR transaction block is
added to cbr_processTimeouts in cbr.c that walks the custodyBundles
list once per bpclock second; any entry whose lastTransmit age exceeds
retransmitIntervalSec (and whose retransmitCount is below the configured
cap) is reforwarded via bpReforwardBundle and logged with
"CBR: Timer-triggered retransmit".

Add regression test custody-retransmit-timer: Node 1 sends one custody
bundle to Node 2, which has no return path for the CCS.  After the 5-
second interval the timer walk fires and the test confirms the retransmit
log entry appears within 12 seconds.
Add per-dimension custody acceptance policy to the Orange Book CBR-CT
layer. Two independent SDR lists in CbrDb — one keyed by custodian EID
(the node requesting custody transfer) and one by bundle source EID —
act as whitelists. An empty list means accept from anyone (default,
backward-compatible). When either list is non-empty, an incoming custody
request whose EID is absent from that list is refused with a CCS refusal
signal.

New public API in cbr.c/cbr.h: cbr_addCustodyAccept,
cbr_removeCustodyAccept, cbr_getCustodyAcceptList, and
cbr_isCustodyAccepted. The policy check is applied in
cteb_processOnAccept before cbr_acceptCustody.

New bpadmin commands: a/d/l cbraccept custodian|source <eid>.
bprc.pod updated to document cbraccept, cbrretx, and crebexpliciteid
(the latter two were previously undocumented).
Two-phase regression test for the cbraccept whitelist policy:

  Phase 1 (refusal): Node 1 starts with custodian whitelist {ipn:9.0}.
  Node 2 sends a custody bundle; Node 1 refuses because ipn:2.0 is not
  whitelisted and sends a CCS refusal.

  Phase 2 (acceptance): ipn:2.0 is added to Node 1's custodian whitelist
  via bpadmin at runtime. Node 2 sends another bundle; Node 1 accepts.

Covers the a/d/l cbraccept bpadmin commands, the SDR whitelist
persistence, and the cteb_processOnAccept policy enforcement path.
  Replace UTF-8 em-dashes with ASCII -- in the cbraccept section.
  pod2man requires =encoding utf8 before any non-ASCII characters;
  using ASCII dashes avoids the issue consistently with all other
  pod files in the tree.
Add a custodyReqDests SDR list to CbrDb that holds destination EIDs
eligible for automatic custody transfer promotion.  When bpSend is
called with NoCustodyRequested and Orange Book custody mode is active,
the destination EID is checked against the list; if matched, custodySwitch
is promoted to SourceCustodyRequired before CTEB construction, triggering
full CBR-CT processing without requiring the application to set the flag.

New bpadmin commands: a custodyreq <eid>, d custodyreq <eid>,
l custodyreq.  New API in cbr.c/cbr.h: cbr_addCustodyReq,
cbr_removeCustodyReq, cbr_isCustodyRequired, cbr_getCustodyReqList.

Add regression test custody-auto-request that verifies policy-active
(custody accepted at Node 1, CCS returned to Node 2) and policy-removed
(no custody accepted) phases, with no ION errors in either phase.
cbr_handleCrs now stores one ReceivedCrsRecord per status-code entry in a
per-node SDR ring buffer (CbrDb.crsHistory, default max 100).  The sender
EID is captured from dlv.bundleSourceEid at the libbpP.c call site.  When
the ring is full the oldest entry is evicted.

New bpadmin commands:
  l crslog [<eid>]   - list received CRS records newest-first, with optional
                       sender-EID filter
  m crsmaxlog <n>    - set ring-buffer limit (0 = unlimited)

cbr_getCrsHistoryList() exposes the SDR list to bpadmin using the same
getter pattern as cbr_getCustodyReqList(); cbr_setCrsHistoryMax() updates
the limit.  The old cbr_listCrsHistory() (which used printText, unavailable
outside bpadmin) is removed.

bprc.pod updated with l crslog and m crsmaxlog documentation.

Regression test: tests/cbr-ct-orange-book/crs-history (8/8 pass).
Three changes complete the end-to-end path for custody-event CRS:

creb_offer: now attaches a CREB block when BP_CT_REQUESTED is set, even
when no traditional SRR flags are present.  Previously CREB was skipped
for custody-only bundles.

mapSrrToCrebFlags: maps BP_CT_REQUESTED to
CREB_REQUEST_CUSTODY_ACCEPT | CREB_REQUEST_CUSTODY_REFUSE.  Bundles
requesting custody automatically ask the custodian for custody-event CRS.

cteb_processOnAccept: after each custody decision (acceptance or
whitelist refusal), calls sendCustodyCrsIfRequested() which reads the
CREB requestFlags and -- if the matching bit is set -- calls
cbr_reportStatus with CBR_STATUS_CUSTODY_ACCEPTED (4) or
CBR_STATUS_CUSTODY_REFUSED (5).  The CRS goes to bundle->reportTo and
is stored in the G2 CRS history log at the receiving node.

creb_getRequestFlags() added to creb.c/creb.h to read the requestFlags
byte from the CrebScratchpad.

Regression test: tests/cbr-ct-orange-book/creb-custody-flags (6/6 pass).
…ecode

Two bugs in cbr_handleCcs in cbr.c:

1. Loop variable shadowing — the signal-triggered retransmit inner loops
   for both the contiguous-range path and the range-array path reused the
   outer map-level loop variable 'i' as their own counter.  Added uvast k
   and renamed both inner counters to k so the outer for-i-mapLen loop is
   not corrupted.  The bug is latent with the current ION CCS encoder
   (mapLen is always 1) but would silently skip disposition entries in a
   conformant multi-disposition CCS from a third-party implementation.

2. Refused CCS CBOR decode failure — the disposition key was decoded with
   cbor_decode_integer (unsigned only), causing a hard CBOR error and
   ipnadminep crash when the disposition value is the CBOR negative integer
   -1 (refused).  Replaced with cbor_decode_signed_int which handles both
   major type 0 (accepted +1) and major type 1 (refused -1).

Regression test: tests/cbr-ct-orange-book/ccs-retransmit-range-array
  Surface the cbr_listCustodyBundles and cbr_getCustodyStatus APIs (cbr.c)
  through two new bpadmin commands:

    l custodybundle - lists every bundle currently held in custody tracking
    (seqId, seqNum, next-custodian EID, accept time, last-retransmit time,
    retransmit count).

    i custodybundle <sourceEid> <seqId> <seqNum> - reports the custody status
    of a specific bundle: pending (in tracking, awaiting next-hop CCS) or
    not-found (released, expired, or never tracked).

  Both require Orange Book custody mode. Also document the previously
  undocumented l crslog command. Man page bprc.pod updated.

  Regression test tests/cbr-ct-orange-book/custody-bundle-query (2-node,
  RETX_NONE plus cbraccept whitelist refusal) passes 6/6.
  Let a node redirect all its Compressed Reporting Signals to a fixed
  collection EID instead of each bundle's primary reportTo field.

  New bpadmin commands m crebreportto <eid> / m crebreportto - set and
  clear a per-node override stored in CbrDb.crebDefaultReportToEid
  (cbrP.h); l crebreportto displays it. Accessors cbr_setCrebReportToEid
  and cbr_getCrebReportToEid added in cbr.c.

  Source side: when the override is set, creb_offer (creb.c) emits it as
  CREB element 4 (reportToEid), forcing array length 5 and including the
  source EID (element 3) that a length-5 array requires.

  Receiving side: new creb_getReportToEid (creb.c) extracts element 4 from
  a received CREB block. Both CRS-generating paths now honor it when
  building the CrebBlk for cbr_reportStatus - sendCompressedStatusRpt
  (libbpP.c) for delivery/receipt reports and sendCustodyCrsIfRequested
  (cteb.c) for custody-event reports - so the CRS is addressed to the
  override rather than bundle->reportTo.

  Requires m srmode compressed (or both). Man page bprc.pod updated.

  Regression test tests/cbr-ct-orange-book/crebreportto-redirect (3-node)
  passes 7/7: Node 1 overrides to ipn:3.0, the delivery CRS arrives at
  Node 3 and not at Node 1. The test runs a bpsink on Node 2 because a
  delivery status report only fires on actual delivery to an application -
  without a receiver the bundle is discarded and no CRS is generated.
Per Orange Book Section 3.2.9 a bundle sequence counter may wrap at a
16-, 32-, or 64-bit maximum, and matching a constrained peer's width is
required for End-to-End Gap Detection. Previously counterMaxValue was
hardcoded to CBR_COUNTER_MAX_64BIT in cbr_createSeqCounter with no way to
change it.

Add a node-wide default in the new CbrDb.counterMaxValue field (cbrP.h),
defaulted to 64-bit in cbr_initialize. cbr_createSeqCounter now seeds each
new counter from this default (falling back to 64-bit when the field is
zero). New accessors cbr_setCounterMaxValue / cbr_getCounterMaxValue in
cbr.c; the setter accepts only the three valid CBR_COUNTER_MAX_* values.

New bpadmin commands in bpadmin.c: m cbrcounterwidth { 16 | 32 | 64 } maps
the bit-width to the matching maximum and rejects other values;
l cbrcounterwidth shows the current width and maximum. The width applies
to counters created after the command; existing counters are unchanged.
Man page bprc.pod updated.

Regression test tests/cbr-ct-orange-book/cbr-counter-width (single node)
passes 5/5: startup 16-bit, runtime change to 32- and 64-bit, and
rejection of an out-of-range width.
The aggregation limits (crsAggregateLimit, ccsAggregateLimit,
aggregateTimeoutSec) were read through the cached _cbrConstants() snapshot,
which each process populates once at startup. A running daemon - notably
bpclock, which runs the periodic timeout sweep - never saw a runtime
m cbraggr, so the change only took effect after a restart.

Add cbr_liveAggregateConfig in cbr.c, which sdr_reads the limits from the
CbrDb inside the caller's transaction, and use it at the three decision
points: cbr_processTimeouts (both timeout loops), cbr_reportStatus (CRS
immediate-transmit check), and queueCcs (CCS immediate-transmit check).
cbr_getConfig now also reads straight from the SDR so reported values are
live.

Add l cbraggr (bpadmin.c) to display the current CRS limit, CCS limit, and
timeout; manageCbrAggr moved ahead of executeList so both dispatchers can
reach it. Man page bprc.pod updated to note runtime effect and the l form.

Regression test tests/cbr-ct-orange-book/cbr-aggr-runtime (2-node) passes
6/6: Node 2 starts with a 1-hour timeout so a generated delivery CRS is
held pending; after m cbraggr lowers the timeout at runtime, bpclock
flushes the pending CRS to Node 1. Verified no regressions in the
crebreportto-redirect, custody-bundle-query, and cbr-counter-width tests.
The CBR/CT tutorial documented only m custodymode and m cbraggr and leaned
on the cbrcustodytest developer utility for monitoring; it also was not
referenced in mkdocs.yml, so it never appeared in the site navigation.

Add a Command Reference section covering every Orange Book bpadmin option,
grouped as mode/reporting (m custodymode, m srmode), aggregation
(m/l cbraggr), retransmission (m cbrretx), CREB (m crebexpliciteid,
m/l crebreportto, m/l cbrcounterwidth), custody-acceptance whitelist
(a/d/l cbraccept), auto custody-request policy (a/d/l custodyreq), and
monitoring/history (l/i custodybundle, m crsmaxlog, l crslog), each with
syntax, examples, and defaults, plus a startup-vs-runtime note.

Refresh the monitoring, retransmission, and testing-chain sections to use
the supported bpadmin commands (l/i custodybundle, l crslog, m cbrretx)
instead of cbrcustodytest, which is now described as a developer test tool.

Add the page to mkdocs.yml under Configuration as "CBR/CT (Orange Book)
Tutorial" so it is reachable from the site navigation.
Extract atomic tier computation, CFLAGS configuration, and RTEMS QEMU
verification into standalone scripts. This reduces workflow file
complexity and makes the logic testable and reusable across workflows.

- compute-atomic-tiers.sh: Dynamic test tier assignment
- compute-tier-cflags.sh: Tier-specific compiler flags
- rtems-verify-qemu-output.sh: QEMU output validation

🚀 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
Replace timestamp-based cache keys with content hashes for more
efficient caching. RTEMS build artifacts and atomic tier builds now
use file content hashing to determine cache validity, improving
cache hit rates and reducing unnecessary rebuilds.

- RTEMS: Cache based on source file hashes
- Atomic tiers: Content-hash keys with workflow script integration
- Enable cache reuse across workflow runs when source unchanged

🚀 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
Enhance test summary script to handle runner names with dashes, preserve
test logs, and generate compact JSON for GitHub Actions. Externalize PR
status logic to the summary script for better separation of concerns.

- Robust runner name parsing
- Comprehensive test log preservation
- Compact JSON output for artifacts
- Bundled artifact handling

🚀 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
Introduce build-runner-matrix.sh for dynamic runner selection. Improve
multi-platform test summary generation.

- Dynamic runner matrix based on platform requirements
- Enhanced test summary with multi-platform support

🚀 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
Align ARC and Solaris workflows with project-wide naming conventions:
test_batch replaces test_group, num_runners replaces runner_count.
Update generate-test-matrix action for consistency.

🚀 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
Configure PR test workflow to use direct timestamp references and
support automatic execution. Streamlines CI/CD process for pull
request validation.

🚀 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
This was only used for debugging purposes.

🚀 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
Improve EXTRA_CONFIGURE_FLAGS handling in compile-and-buildcheck
script with proper word splitting

🚀 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
zebastian and others added 28 commits June 29, 2026 11:14
The LTP duct addresses and the LTP engine number appear in several
CLA-setup calls; extract them into TEST_LTP_DUCT and LTP_ENGINE_STR so
each value has a single definition (and the engine number's required
match with ION_NODE_NBR is documented).
ShellCheck warns about these ln statements because they don't have an
explicit destination [1]. Seems like POSIX ln requires a target operand
[2]. Also change shebang line to #!/bin/sh to help in our goal of
removing Bash as a dependency.

[1]: https://www.shellcheck.net/wiki/SC2226
[2]: https://pubs.opengroup.org/onlinepubs/9799919799/utilities/ln.html
The symlinks for the CBR/CT C files were added in commit 80d37e7 (Add
c source to rtems symlinks and build scripts, 2026-01-21), and the
headers were added in commit 7bfc43e (fix missing header for rtems
port, 2026-01-21), but this shell script was never updated.
The srclinks script invokes this srcremove script to remove all symbolic
links. While it replaces the C source files and header files, it does
not replace rtems_waf. So exclude rtems_waf from deletion, otherwise
we'd have to manually add it back ourselves. Shebang line is also
changed to #!/bin/sh in line with the goal to remove Bash as a
dependency.
Wires tcpcli/tcpclo into the minimal RTEMS port and runs a TCP loopback
test alongside the existing UDP/LTP one.
PSM small-pool blocks are aligned to WORD_SIZE (4 bytes on 32-bit), so
8-byte-aligned types (long long, time_t) embedded in PSM-allocated
structs traps on RTEMS 6 sparc/leon3.

Introduce PSM_BLK_ALIGN -- the larger of WORD_SIZE and 8 -- as the
small-block grain/overhead so user data is always suitably aligned for
any basic C type.  Identical to the old behaviour on LP64; lets the
RTEMS port keep LONG_LONG_OKAY=1 on every BSP.
The SIGTERM -> grace-wait -> SIGKILL escalation is used to reap
snooze-based daemons at shutdown (needed on RTEMS, where the SIGTERM
handler's sm_TaskVar flag is not updated from signal context) is
copy-pasted across many stop paths.

Extract it into one ICI helper, sm_TaskKillWait(taskId, text, note), and
use it in bpStop and the scheme/plan/induct/outduct waiters (libbpP.c),
ltpStop / waitForSpan / waitForSeat (libltpP.c), bsspStop and its
span/seat waiters (libbsspP.c), rfx_stop (rfx.c), and cfdpStop.
For a root-level dest ("/foo.dat") getQualifiedFileName's last-separator
scan finds none (it stops short of the leading '/'), so the whole path
was mkdir'd as a directory -> EISDIR on open. Return early when there's
no interior separator (parent already exists). Also route cfdpStop
through sm_TaskKillWait().
Commit 45e46e9 (Resolved reported concurrency issues in udplsi.c /
udplso.c: add mutex usage, join threads, remove close() race,
2025-03-19) made rtp a static variable which breaks the alignment of the
declaration names. Run clang-format on these lines to align them again.
We perform a platform test to guess whether the iphdr, udphdr, udpiphdr
structures are available. This isn't robust (FreeBSD and libbsd has the
ip structure in netinet/ip.h) and it goes against our goal to test for
features instead of guessing based on platforms. It's also unnecessary.
We know, a priori, the sizes of these UDP, IPv4, and IPv6 headers.

Commit 4f05601 (prototype LTP with dual stack ipv6 and ipv4 support
with regression test, 2025-10-15) added support for IPv6 to udplso, but
did not update this header size logic to handle IPv6.

Remove the platform checks, remove the macros using the structures, and
just use named constants with the known header sizes. Also rework udplso
to use different sizes based on the address family.
pseudoshell passes task argument string pointers through FUNCPTR, and on
64-bit RTEMS targets (riscv rv64, aarch64) an int parameter would
truncate them. Use saddr (pointer-sized) instead.
Single build script that fetches/builds the RTEMS kernel and
rtems-libbsd and compiles the ION BPv7 minimal port for the supported
BSPs (sparc/leon3, aarch64, arm, riscv, powerpc), then runs the loopback
tests under QEMU.
With configuration "format.quote-style = 'single'" to minimize diffs
since that's the predominant style in this file.
The Waf script assumes SPACE_ORDER=3 which is incorrect for 32-bit
systems. Set SPACE_ORDER based on the architecture.
Really don't like the idea of disabling warnings to avoid dealing with
parseEidString() incorrectly assuming LONG_WIDTH == 64 and cbr.h
incorrectly assuming uvast is 64 bits wide. That code should just be
fixed. Disabling these warnings can also mask other issues.

But given that 32-bit architectures aren't official targets for ION, we
decided it was acceptable to disable these and file an issue to address
the wrong assumptions at a later time.
Tasks use the RTEMS_NO_FLOATING_POINT attribute by default. A
RTEMS_NO_FLOATING_POINT task attempting to access the FPU on LEON3
results in an exception.
The deep admin call chain in startDTN() allocates large local variables
on the stack. The default CONFIGURE_MINIMUM_TASK_STACK_SIZE is
insufficient, causing a silent overflow that corrupts adjacent libio
structures and results in ENXIO filesystem errors. 128 KiB seems to be
enough to address this.
bpcp and bpcpd are removed from cfdpsources because they're user-facing
scp-like utilities that depend on CFDP proxy/remote operations
(CfdpProxyTask, cfdp_rput, cfdp_get, cfdp_rls) which require -UNO_PROXY.
We keep NO_PROXY defined in this minimal port, so they're omitted;
cfdpadmin/cfdpclock/bputa are all the ionrtems.c smoke test needs.

Commit acdaa6c (Updating Makefile.am and configure.ac to reflect the
change to INB to build cfdp and ams., 2018-03-05) made CFDP
unconditionally built in ION's regular build system. To avoid
discrepancies, the RTEMS port will also build CFDP unconditionally.

ION_OPEN_SOURCE is removed from srclinks since it has no effect.
(ION_OPEN_SOURCE and NASA_PROTECTED_FLIGHT_CODE were supposed to be
scrubbed in 4.1.3s).
AMS and CFDP used to be built conditionally. The IS_NASA_B variable at
configuration time set the ION_NASA_B Automake conditional and defined
the NASA_PROTECTED_FLIGHT_CODE macro to conditionally guard AMS and CFDP
code.

AMS and CFDP were made unconditional in commit acdaa6c (Updating
Makefile.am and configure.ac to reflect the change to INB to build cfdp
and ams., 2018-03-05), and NASA_PROTECTED_FLIGHT_CODE was mostly removed
by 4.1.3s.

ionexit and ionrestart still used this macro since the RTEMS port used
to build CFDP conditionally. Now that CFDP is unconditional on RTEMS, we
can finally clean up the last usages of NASA_PROTECTED_FLIGHT_CODE.
AMS is resource intensive. We have to bump the max number of POSIX
Threads for the init task (must be greater than the platform_sm
MAX_POSIX_TASKS set in the Waf script). SDR size and working memory size
are also bumped to seemingly sufficient levels.

Since we don't have name resolution, loadTestMib()'s usage of
getNameOfHost() won't work properly since the result (e.g.,
localhost:2357) won't resolve. So we need to set the hostname to be an
IP address.
Remove "Hello World" placeholder and list the BSPs we support.
The RTEMS QEMU loopback test now exercises TCP/TCPCL, CFDP, and AMS in
addition to the baseline UDP/LTP loopback. Extend the externalized
verifier rtems-verify-qemu-output.sh to assert each added scenario ran
and delivered, so the script-based verification matches the expanded
coverage of the test in ionrtems.c.

The RTEMS multi-test runs UDP/LTP, TCP/TCPCL, CFDP, and AMS in sequence.
AMS is last and needs a short registration retry window, so it does not
deliver until ~40s in; the previous 30s QEMU timeout killed the run
before AMS completed. Extend the timeout to 60s so all scenarios finish.

Also make the bundle xmt/rcv statistics checks in
rtems-verify-qemu-output.sh honor the --qemu-output argument instead of
a hardcoded rtems-test-output/qemu-output.txt path, so the verifier
works when invoked against an output file elsewhere.
gh-pages doc: restructure into Verified / Community-contributed / Known
broken sections; list the full set of modules now exercised on the
verified target (BP, LTP, TCPCL, CFDP, BSSP, DGR, AMS); add a footprint
note about the PSM small-block alignment widening on 32-bit RTEMS
targets.

Streamlined the RTEMS 6.1 port documentation by:

- Removed obsolete RTEMS 5.1 and 4.10.2 archive sections (130+ lines)
- Fixed incorrect dates (was "11/7/2025", now current)
- Corrected version reference (4.1.5 -> 4.1.4+)
- Reduced from 515 to 374 lines while preserving all essential info
- Improved readability with better organization
- Kept all technical details users need for adaptation

The README now focuses exclusively on the current RTEMS 6.1 ARM64 port
without historical clutter. All build instructions, configuration
details, and implementation notes remain intact.
@scburleigh
scburleigh requested a review from 250MHz as a code owner July 14, 2026 20:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants