Skip to content

fix(comms): make ComQueue comStatusIn blocking so the one-shot arming status can't be dropped (#494) - #495

Open
Mikefly123 wants to merge 2 commits into
mainfrom
fix/494-comqueue-blocking-comstatus
Open

fix(comms): make ComQueue comStatusIn blocking so the one-shot arming status can't be dropped (#494)#495
Mikefly123 wants to merge 2 commits into
mainfrom
fix/494-comqueue-blocking-comstatus

Conversation

@Mikefly123

Copy link
Copy Markdown
Contributor

Fixes #494.

What

One-line FPP change in the fprime fork, delivered as a submodule pin bump (03c645123 on fix/comqueue-blocking-comstatus-main, based directly on main's current pin 8a62e455a):

-      async input port comStatusIn: Fw.SuccessCondition
+      async input port comStatusIn: Fw.SuccessCondition block

Why

See #494 for the full trace. Summary: the com-status arming protocol is one-shot — the single SUCCESS emitted at startup by ComAggregator::preamble() shares ComQueue's IPC message queue with the boot event burst on comPacketQueueIn. If the queue is momentarily full, the generated handler FW_ASSERTs (invisibly, with CONFIG_LOG=n) and the arming message is lost. ComQueue then sits in WAITING forever: no telemetry, no events, no command acks — on every boot of that binary, for both the UART and LoRa stacks. The race outcome is deterministic per build, so any change to startup workload (components, events, init timing — e.g. PR #472's littlefs mount) can flip a passing build into a permanently silent one.

block makes the low-rate status sender wait for a queue slot instead: delivery guaranteed, zero RAM, no deadlock exposure (the comQueue thread never blocks back toward the aggregator; at most one frame is in flight per status).

Why not just deepen the queue

Tried first: QueueSizes.comQueue at 48/64/100 all exhaust the malloc arena at boot (BufferManager's ~27KB contiguous configComponents allocation returns NULL → usage fault). Heap slack with littlefs on is <8KB. Depth also only re-wins the race probabilistically; block removes it categorically.

Verification (bench, two V5e units)

Binary Board 1 Board 2
pre-fix (littlefs present) FAIL every boot — comQueue.m_state == WAITING, GDB-traced enqueue → PriorityQueue FULL → assert hook identical failure signature
with this fix PASS 3× incl. cold reset — SequenceNumberGet/OpCodeCompleted round-trips PASS 2×, telemetry channels flowing

Note this PR fixes the latent protocol bug on main itself; main currently happens to win the boot race, so there is no observable behavior change expected — the regression only manifests when combined with boot-workload changes like the #472 keystore. Suggested review focus: the blocking-semantics deadlock argument in the fork commit message.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WpBURCutAx8281i59nj6fo

…atusIn blocking (#494)

Bumps the fprime pin to pick up fix/comqueue-blocking-comstatus-main
(03c645123, one FPP change in Svc/ComQueue/ComQueue.fpp):

    async input port comStatusIn: Fw.SuccessCondition block

The com-status arming protocol is one-shot: the single SUCCESS emitted at
startup (ComAggregator preamble) shares ComQueue's IPC message queue with
the boot event burst on comPacketQueueIn. If that queue is momentarily full,
the generated handlerBase FW_ASSERTs -- which on this deployment reports to
a disabled console and continues -- and the arming message is silently lost.
ComQueue then stays in WAITING forever: no telemetry, no events, no command
acks, on every boot of that binary (the race is deterministic per-build).
Both the UART and LoRa com stacks wedge identically.

GDB-traced end to end on bench hardware and verified on two V5e units:
pre-fix binary fails every boot (comQueue.m_state == WAITING, enqueue ->
PriorityQueue FULL -> assert hook), fixed binary passes every boot including
cold reset, with full GET_SEQ_NUM round-trips and flowing telemetry.

Blocking the low-rate status sender until a queue slot frees guarantees
delivery at zero memory cost. Deepening the queue instead is not viable:
depth >=48 exhausts the malloc arena at boot (BufferManager's ~27KB
contiguous allocation fails).

Fixes #494

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpBURCutAx8281i59nj6fo
@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7d1aa4c7-8cbe-46c8-870c-6340f08ca6ab

📥 Commits

Reviewing files that changed from the base of the PR and between f7ee882 and 8b81a2c.

📒 Files selected for processing (1)
  • lib/fprime

📝 Walkthrough

Summary by CodeRabbit

  • Chores
    • Updated the bundled FPrime component to a newer version.
    • No user-facing feature or behavior changes are included in this update.
    • The update maintains existing functionality while incorporating the latest available component changes.

Walkthrough

The pull request updates the lib/fprime submodule reference from commit 8a62e455a90b6d4f498c332d45d65a2a819988d8 to commit 03c6451237d4442248703947693c1985a1948e88. No local source declarations change.

Changes

F´prime Submodule Update

Layer / File(s) Summary
Update F´prime reference
lib/fprime
The submodule pointer changes to commit 03c6451237d4442248703947693c1985a1948e88.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

A rabbit checks the pointer bright,
One F´prime commit comes in sight.
The source stays still today,
While the newer pin leads the way.
Hop, hop, update complete!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly describes the blocking comStatusIn change that fixes the one-shot arming race.
Description check ✅ Passed The description explains the cause, fix, rejected alternative, linked issue, and verification results, despite omitting some template sections.
Linked Issues check ✅ Passed The submodule pin includes the blocking comStatusIn fix required by issue #494 to prevent ComQueue from remaining in WAITING.
Out of Scope Changes check ✅ Passed The only change is the fprime submodule pin, which directly implements the linked issue objective.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

nateinaction
nateinaction previously approved these changes Aug 4, 2026

@nateinaction nateinaction left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This worked for me.

@nateinaction

Copy link
Copy Markdown
Collaborator

Oh wait. It looks like I did not use this.

…idn't exist

The previous gitlink (03c645123ba8933e33e4c621bafd433d5c1a56de) shares
only its first 9 hex chars with the real commit and exists in no repo —
it looks like an abbreviated SHA that was expanded incorrectly. The
actual ComQueue blocking-comStatusIn fix is the tip of the fork branch
fix/comqueue-blocking-comstatus-main: 03c6451237d4442248703947693c1985a1948e88.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

2 participants