Repository navigation
feat(uds_services): an application may decline a listed service at run time - #95
Conversation
JustinKovacich
left a comment
There was a problem hiding this comment.
Stack review of #92–#96, this PR's part: 2 Required, 4 Optional.
Gate: fmt clean; clippy pedantic 0 hits; all tests pass; workspace powerset clean; cargo doc with -D missing_docs clean; size unchanged from #94; check_governance.py and its self-tests pass.
Skills run for this review: rust-quality-gate, rust-principles, rust-api-design, rust-embedded, rust-design-review (change-scoped), /code-review, writing-for-customers.
23dd424 to
19e8ab1
Compare
JustinKovacich
left a comment
There was a problem hiding this comment.
Every point from the first round is fixed:
- One
serves = fkey onuds_server!, consulted for every listed service, replaces the five per-trait methods and the hand-kept list. ServiceSet::DECLINESletsuds_crefuse to compile without it.- The constancy rule is documented.
supports,begin_withand UDSSVC_ARCH_0013 are updated.- The stray
allowis gone. - The
DataTransferdecline test covers 0x34, 0x36 and 0x37. - The governance commit moved to #96.
No comments.
Gates at this head, run locally: cargo fmt --check, clippy pedantic on the workspace (0 hits), cargo test --workspace --all-features, the cargo hack powerset (depth 2), cargo doc with -D missing_docs and broken links denied, and just embedded with both size baselines. All clean.
Skills: rust-quality-gate, rust-principles, rust-api-design, rust-embedded, rust-design-review (change-scoped) and writing-for-customers. /code-review not run: the fixups are small, and I read each line by hand.
Security Audit is red on main too (RUSTSEC-2026-0110 and RUSTSEC-2026-0386), so its failure here is not this PR's.
19e8ab1 to
931d668
Compare
…n time ReadDtcInformation, ClearDiagnosticInformation, CommunicationControl, ControlDtcSetting and DataTransfer gain a provided serves, true by default. The assembly asks it with Figure 5's first check, so a service the application declines is serviceNotSupported (0x11), as one the assembly does not list, ahead of Table 23's 0x7F and of every check its trait would otherwise answer. This is for an application whose handlers come from tables at run time, such as the C binding. UDSSVC_ARCH_0006 names it. The embedded probe's size is unchanged.
931d668 to
ccf4de3
Compare
…s of handlers (#96) The new `uds_c` crate embeds the uds_stack server in C firmware: the firmware lists its identifiers and handlers in C tables (`uds_c.h`), supplies non-blocking sockets and a clock, and polls the server from one task. Handlers answer through `uds_record_copy`, bounded by each identifier's table length, so C never writes server memory. `uds_record_copy_16_be`, `_32_be` and `_64_be` copy an integer big-endian, the byte order of UDS records. For the DTC services a layer keeps a DTC memory the server reads (each DTC's number, status and snapshot record), and the server encodes the ReadDTCInformation reports itself; the memory updates each status with the ISO 14229-1 Annex D transitions `uds_services::dtc_status` adds (UDSSVC_ARCH_0047), which `uds_c.h` exports as pure functions; `validate` refuses a second DTC memory, or a snapshot or clear without its memory. After a confirmed response the server resumes DTC setting and communication on entering a session where ControlDTCSetting and CommunicationControl are not served, or after a reset whose execute returns (ISO 14229-1 10.2), so firmware does not restate the rule. A response is confirmed once the firmware's `uds_tcp_transmitted` reports its bytes transmitted, through simple_doip's opt-in `OnTransmit` confirmation, so a reset's execute runs only after its response has left the ECU. Each layer's transition hooks (check, prepare, execute, abandon, with the active session) let a layer undo a prepare another layer refused. `Firmware` is the one way to drive the server: it keeps the server and its run future in one `static`, `arm` takes the proof `validate` returns and `poll` reads that server's layers, both unsafe on the one-context contract. A transport error between requests is recoverable and `poll` runs the same server on (`RunError::Interrupted`); one mid-request stops it for good (`RunError::Stopped`), and the firmware restarts to serve again; naming the run future's type for the `static` takes the nightly `type_alias_impl_trait` in the firmware's crate, while this crate stays on stable. The governance tool admits the restated lint table that relaxes `unsafe_code` for this crate alone. Depends on #95. ## Issue URL Towards luminartech/halo#5100 ## Testing Run on this branch with the commits of the PRs below it, each commit alone and on the stack's top: - tool self-tests, `validate`, `governance`, the Sphinx needs build, and prose (plain and CI's `--strict crates/uds_c`) - `cargo test --workspace --all-features`; clippy on the host and for `thumbv7em-none-eabihf` - `just embedded` builds on 1.91 for both targets and the size check (matches the baseline) - `cargo doc` with `-D warnings`; `pre-commit run --all-files` - On the stack's top also the uds_c Miri job from `ci.yml` and the package job (`cargo package -p simple_doip -p uds_services -p uds_on_ip -p uds_c`) - Halo's `rust_diag_tc4` builds and serves over this branch's tip (luminartech/halo#5928 and its children) --------- Co-authored-by: Justin Kovacich <justin_kovacich@microvision.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
An application can decline a listed service at run time through one
serves = fkey onuds_server!(fn(&App, UdsServiceType) -> bool, constant for the server's life): the server answers serviceNotSupported, in the order ISO 14229-1 Figure 5 gives, instead of a later NRC. A C binding whose tables leave a service unserved needs this.Depends on #94.
Issue URL
Towards https://github.com/luminartech/halo/issues/5100
Testing
Run on this branch with the commits of the PRs below it, each commit alone and on the stack's top:
validate,governance, the Sphinx needs build, and prose (plain and CI's--strict crates/uds_c)cargo test --workspace --all-features; clippy on the host and forthumbv7em-none-eabihfjust embeddedbuilds on 1.91 for both targets and the size check (matches the baseline)cargo docwith-D warnings;pre-commit run --all-filesci.ymlandcargo package -p uds_c --no-verify