RPC Transport And Framing

RPC Transport And Framing#

This chapter describes the CGW Java application’s common SOME/IP stack.

Application Registry#

The compiled application registry closure is exactly five service IDs: 300, 400, 500, 600, 65280. The three published catalogs contain 81 distinct service/method pairs and 28 distinct service/event pairs, matching the client transport call sites and notification switch cases. This includes all three REQUEST_NO_RETURN calls, not just request/response calls. There are no missing service, method, or event IDs in that comparison. Business payload schemas remain described in NetworkAccess and Voice, Configuration and PubSub, and Testability.

These registries describe the Java application’s interfaces. Enabled services and remote peer support depend on software version and configuration; client codecs do not establish that a remote server exposes the corresponding interface.

Application Version#

  • Verified SHA-256: 80f240465f2d0afadb078dddcfb6916fc02f5bc0c6324fce958d301b4edaffaf.

  • Actual manifest Implementation-Version: v15.3.3-r1.

  • Actual manifest Implementation-VersionCode: Y317.

  • Actual manifest Implementation-VersionDateTime: 2018-03-16T21:23:48Z.

  • Version code Y317 is distinct from the 2018 build timestamp.

  • Equivalence to native PPC interfaces or other deployed builds is unspecified.

Five Registries#

Service

ID (hex)

Interface

Source entry / compiled client

Methods

Events

Recovered enable

NetworkAccess

300 (0x012c)

2

b.a.b.b.a.c / b.a.b.b.a.c$a

17

7

true

VoiceManager

400 (0x0190)

1

b.a.d.c.a.c / b.a.d.c.a.c$a

23

15

true

PubSub

500 (0x01f4)

2

b.a.e.c.a.c / b.a.e.c.a.c$a

5

2

false

CBoxConfiguration

600 (0x0258)

1

b.a.a.c.a.c / b.a.a.c.a.c$a

13

3

true

Testability

65280 (0xff00)

1

b.a.c.c.a.c / b.a.c.c.a.c$a

23

1

false

Total

81

28

Exact method/event sets, including unused holes, are in the catalog. Each nested $a calls the common someip.c.a.b API; each $a$1 dispatches events. The outer classes instantiate these clients, not additional version aliases. someip.SomeIpServiceManager$a instantiates the four business clients on its shared link (SomeIpServiceManager.java:938-958). Testability also has a compiled client for its optional control/callback behavior (someip/d/e.java:191-225).

someip.c.a.b.a(int,int,char,byte[],int) is request/response; .b(int,int,char,byte[],int) is no-return (someip/c/a/b.java:11-16). The latter occurs only for Testability methods 31, 32, 33. The implementation explicitly emits service 65280/interface 1 for .b (someip/c/a/a.java:267-276), consistent with those callers. Do not generalize that API as an arbitrary-service no-return sender in this optimized image.

Server Closure#

The only class implementing the common server interface someip.c.e.f is b.a.c.c.a.d. Its non-default method switch targets equal the same 23 Testability method IDs. Its JVM tableswitch 1..88 contains holes targeting default: that range is not 88 implemented methods. The registry insertion in someip.c.e.a.a(f) hardcodes (65280,1), confirmed in bytecode as well as source (someip/c/e/a.java:38-45). Unknown service, wrong interface, and unknown method are rejected through this registry/dispatcher, not evidence of more services.

Exactly five classes contain direct method-send call sites, and exactly one implements the common server interface. Reflectively loaded or native-library interfaces are outside this Java API inventory.

Ping, Internal Control, And Discovery#

Ping/onPong are methods/events of the existing business registries, not a sixth service. Their IDs are already included in the catalogs. The manager schedules per-service ping and pong checks (SomeIpServiceManager.java:959-1008), and the someip.d.* adapters bind those operations to the existing generated interfaces. Testability control/callback paths reuse 65280, not another internal service ID.

No additional Service Discovery registry, SD packet codec, multicast/UDP discovery path, or separate internal-control service was identified in the reviewed Java stack. The manager establishes a fixed TCP connection to configured host/port; it does not discover a service before constructing these clients. This is scoped negative evidence only: not a complete-firmware or remote-network SD absence claim. The six-byte vehicle bridge/FOD names, including 420-related names, are not SOME/IP service or method IDs and are excluded.

Header And Message Types#

The wire RPC header is 16 bytes, big-endian, implemented by someip.c.e. ByteBuffer retains its default big-endian order; there is no instance field.

Offset

Width

Meaning

0

2

unsigned service ID

2

2

unsigned method/event ID

4

4

declared length = payload bytes + 8

8

2

client ID (upper half of Request ID)

10

2

session ID (lower half of Request ID)

12

1

protocol version, emitted value 1

13

1

interface version, 1 or 2 in these registries

14

1

message type

15

1

numeric return code

16

variable

payload

Full frame size is declared length + 8, equivalently payload + 16. someip/c/e.java:31-103,118-127 proves offsets and arithmetic. The configured domain.vehicle.v1.a.aw request-ID pool composes (client & 0xffff)<<16 | (session & 0xffff), skips session zero for request/response, and uses session zero for no-return. Notifications emitted by the server use Request ID zero (someip/c/e/e.java:26-31). Instance IDs are adapter/connection/subscription metadata, not an extra header word and not the Request ID session.

Value

Enum name

Observed role in this implementation

0x00

REQUEST

emitted by .a; server accepts

0x01

REQUEST_NO_RETURN

emitted by .b; server accepts and suppresses reply

0x02

NOTIFICATION

emitted by event forwarding; client event filter

0x40

REQUEST_ACK

enum + client explicitly ignores it while waiting

0x41

REQUEST_NO_RETURN_ACK

enum only; no emitting path identified

0x42

NOTIFICATION_ACK

enum only; no emitting path identified

0x80

RESPONSE

server emits; client completes on return code 0

0x81

ERROR

server emits; client preserves numeric return code

0xc0

RESPONSE_ACK

enum only; no emitting path identified

0xc1

ERROR_ACK

enum only; no emitting path identified

Enum names/numbers are verified from <clinit> bytecode of someip.c.a, not inferred from obfuscated field names. Unknown types return Java null, not a normalized/masked base type (someip/c/a.java:29-39). Server reception registers only REQUEST/REQUEST_NO_RETURN. The Testability method dispatcher itself switches on method ID, not a per-method message-type allowlist; generated no-return intent does not prove other known methods reject that type.

Return Codes#

Bytecode enum names: 0 E_OK, 1 E_NOT_OK, 2 E_UNKNOWN_SERVICE, 3 E_UNKNOWN_METHOD, 4 E_NOT_READY, 5 E_NOT_REACHABLE, 6 E_TIMEOUT, 7 E_WRONG_PROTOCOL_VERSION, 8 E_WRONG_INTERFACE_VERSION, 9 E_MALFORMED_MESSAGE, 10 E_WRONG_MESSAGE_TYPE. These are enum membership, not a claim each is emitted by this application. OTHER_ERROR is the internal Integer.MAX_VALUE sentinel, not a wire code; unrecognized values map to it while the original byte remains available via someip.c.e.k() / someip.c.d.b().

Custom 32 (0x20) is a return code, used by optional Testability paths that return new someip.c.d(' ') (someip/d/e.java:409,422,433,443,450). The single-char constructor in this optimized image hardcodes 32 (someip/c/d.java:49-52); the char-plus-message constructor retains its supplied numeric code. The server copies the exception’s numeric code into the ERROR header. This must not be confused with a TP message-type flag at offset 14.

The server clears diagnostic error payloads to length zero through org.a.b.b.e.c.a(someip.c.e) even where it initially allocates room for a message string (someip/c/e/b.java:81-104,126-137; helper bytecode). Do not assume error strings are serialized as a global string schema. No-return requests suppress both success/error replies (someip/c/e/b.java:155).

Framing And Validation#

The stream assembler is someip.c.g.a.a(ByteBuffer), reached from someip.c.c.b.a.a(ByteBuffer).

  • It buffers partial TCP reads, extracts multiple frames, starts with 4096 bytes, grows its buffer, and can shrink it using recent frame sizes. 4096 is not a maximum payload or a SOME/IP-TP fragment size.

  • It waits for at least 16 buffered bytes to read a header, and normally waits for the calculated full frame length before extracting a frame.

  • The configured size check is only message.payloadLength > maximum; an oversized message is dropped/skipped using its calculated full frame length.

  • someip.a initializes both receive maxima to Integer.MAX_VALUE (someip/a.java:46-47); the manager does not install a smaller cap. These are not strong practical allocation bounds.

  • The header wrapper simply wraps the byte array. The signed getInt(4)-8 payload calculation and 16+payload frame calculation have no explicit lower-bound (declared length >= 8) or overflow check. The assembler’s minimum-header check does not repair this. Do not describe all declared lengths as validated unsigned lengths or claim malformed frames cleanly produce E_MALFORMED_MESSAGE. Exact exception/resource effects depend on runtime state.

  • Header writing narrows service/method to short and interface/type/return code to byte; it is not an explicit numeric range validator. Payload writing checks length <= capacity-16, then uses ByteBuffer.put; invalid negative lengths or source-array bounds rely on JVM exceptions. Allocation/addition arithmetic has no separate overflow guard (someip/c/e.java:15-22,38-61).

Per-Codec Rules#

Framing checks, DTO constraints, codec checks, and actual whole-payload consumption are separate. There is no one global payload schema or maximum.

  • Scalar readers in someip.e.d check the caller’s remaining span for each primitive. Boolean parsing accepts only 0 or 1, rejecting other bytes (someip/e/d.java:12-22). Numeric/string writers in org.a.b.b.e.c check destination space and applicable unsigned ranges. JVM array bounds are an additional guard, not a protocol-validity proof.

  • Strings use field-specific prefixes and modes. For example, b.a.a.c.a.c.f.parse uses a 2-byte length and someip.e.f.b (UTF-8, no BOM/terminator), while b.a.a.b.e.a(b.a.c.a.d,...) uses a 1-byte string length. The helper also has 4-byte and fixed-string forms; their existence must not replace the actual field bindings in the business catalogs.

  • Variable string parsers check available encoded bytes, not the model’s nominal maximum. Writers separately enforce their supplied maximum encoded length. For a 2-byte prefix the underlying unsigned-16 writer additionally enforces 0..65535. getSize is not itself all the validation done by serialize.

  • Dynamic-array prefixes describe encoded byte length, not element count. E.g. b.a.a.b.c.a(b.a.c.a.b,...) reads a u16 length and loops until consumed bytes reach that length. Element bounds/nominal capacities and exact end equality are per codec; the loop condition alone is not an exact subspan check. Optional-value codecs can test only length > 0 before consuming one value.

  • Normal generated sends allocate getSize then serialize. Parse callers often ignore the returned consumed-byte count; notably Testability’s server parser does so (b/a/c/c/a/d.java:732-747). Successful decoding need not mean all advertised bytes were consumed. Preserve catalog notes for ignored response and event payloads; an ignored payload is not proof of required wire emptiness.

TP/Fragmentation Boundary#

No SOME/IP-TP message-type entries (0x20, 0x21, 0x22, 0xa0, 0xa1), TP header parsing, offset/more-segments handling, or TP reassembly was identified in this reviewed Java framing/type-dispatch path. It uses exact type lookup, not type & ~0x20. TCP read reassembly is present and is not SOME/IP-TP. An SDK/header field named SomeIPTPSupported alone does not establish an implementation. Global firmware, native-stack and remote-peer TP support remain unspecified by this Java path.

Configuration And Exposure#

The recovered SOME/IP configuration contains these port, instance and enable values:

  • Remote TCP server port: 29173; local client bind range: 29170…29998; SOME/IP client ID 1; four configured remote service instance IDs 1.

  • The manager uses SocketChannel.connect through someip.a and explicitly binds the chosen local port (SomeIpServiceManager.java:818-827; someip/a.java:69-95). Those configuration values prove intended roles, not current runtime exposure. The configured peer role is the cbox link; its deployed hostname is unspecified here.

  • NetworkAccess, VoiceManager, CBoxConfiguration are enabled in recovered preferences. PubSub and Testability are disabled. Generated clients for all four business services are still constructed when the shared connection is established; enablement is not absence of compiled support.

  • Optional Testability binds a TCP listener via someip.d.e only when enabled. Code defaults: port 30601, local instance 4 (someip/d/e.java:73-108). Deployment preferences may override these defaults; they do not establish listener availability. Its event connection subscription is hardcoded to 65280/interface 1/event 32769 (someip/c/e/e.java:66-90).

Contents