* MeshPacketQueue: fix millis() rollover in the late-packet drop test
replaceLowerPriorityPacket() read `backPacket->tx_after < now`, with `now`
taken from millis() on the line above. tx_after is an absolute deadline, so
that comparison inverts while the deadline sits on the far side of the 32-bit
wrap: a queued late packet reads as not-yet-due for the rest of the wrap
window, or every late packet reads as droppable at once. The same statement
ordered two deadlines against each other with `backPacket->tx_after >
p->tx_after`, which has the same problem.
#11291 swept every site where millis() sits next to the comparison operator,
and its CI guard matches that shape. Stashing the clock in a local first is
the same bug written so the guard cannot see it.
Both tests now subtract before comparing: the due test through
Throttle::deadlinePassedAt(), and the ordering through the elapsed-since-now
form already used in AdminModule's oldest-slot scan. The snapshot comes from
Time::getMillis() so the deadlines and the test read one clock, per the
convention deadlinePassedAt() documents.
The `dt` the log line reports is now derived from the same elapsed value
rather than recomputed. Behaviour is otherwise unchanged, save the boundary:
deadlinePassedAt() is inclusive, so a deadline landing exactly on `now` reads
as due rather than one millisecond early.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* RadioLibInterface: don't widen a uint32_t deadline delta into a 64-bit long
TRANSMIT_DELAY_COMPLETED tested whether the front packet was still waiting
with
long delay_remaining = txp->tx_after ? txp->tx_after - millis() : 0;
if (delay_remaining > 0) ...
The subtraction is uint32_t. Where long is 32-bit - every embedded target -
an already-due deadline lands negative and the packet transmits, which is why
this has never been visible on device. Where long is 64-bit (portduino, and
the native test build) the same value zero-extends to ~4.29e9, reads as
positive, and the packet is rescheduled 49.7 days out. It stays parked until
some later notifyLater() with overwrite happens to reset the timer.
That is not an edge case. notifyLater() schedules through
setIntervalFromNow(), so the thread wakes at or after the deadline; being a
millisecond past due is the ordinary path through this branch.
Ask Throttle instead. deadlinePassedAt() is the unsigned half-range test, so
there is no signed conversion to get wrong at any width, and the remaining
delay handed to notifyLater() is computed from the same snapshot. On 32-bit
the behaviour is identical, including at the boundary: a deadline equal to
now transmitted before and still does.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* ExpressLRSFiveWay: convert the two remaining raw window checks to Throttle
runOnce() dismissed the alert frame with `now > alertingSinceMs + 2000` and
chose its poll rate with `now < keyDownStart + 20000`, both against a millis()
snapshot in a local. Same rollover inversion as any other naive compare, and
invisible to the millis-deadline-check guard because millis() is not adjacent
to the operator. update() in the same file was already on Throttle.
hasElapsed()/isWithinTimespanMs() with the stored event give the full ~49.7
day range and need no snapshot. Sentinels are unchanged in meaning:
`alerting` is the armed flag for alertingSinceMs and is tested first, and
keyDownStart == 0 reads as "recent" for the first 20s of uptime exactly as
`now < 0 + 20000` did - a poll rate either way.
The arm sites move to Time::getMillis() so the writes land on the clock
Throttle reads, which also puts them within reach of Time::setTestMillis().
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* GPSUpdateScheduling: record whether a search is running, don't infer it
elapsedSearchMs() answered "am I searching?" by ordering two raw millis()
stamps: searchStartedMs > searchEndedMs. Whichever stamp lands on the far
side of the 32-bit wrap reads as the larger one, so the answer inverts once
per wrap cycle, in both directions:
- a search that started before the wrap and ended after it keeps reading as
"searching". elapsedSearchMs() then grows without bound and
searchedTooLong() aborts a search that is not running.
- a search that started after the wrap, following one that ended before it,
reads as "idle". elapsedSearchMs() returns 0, so an unproductive search is
never aborted and the receiver stays powered until it locks.
Both self-heal at the next informSearching(), which bounds the damage to one
GPS cycle - but the ordering test cannot be made wrap-correct, because the
two stamps carry no information about which wrap they belong to.
It does not need to be. Whether a search is in progress is a fact the three
inform*() calls already have in hand; the ordering was only ever standing in
for it. Add the flag and set it there. elapsedSearchMs() keeps its unsigned
subtraction, which was always the correct part.
The file's clock reads move to Time::getMillis() so the suite can drive them
across the wrap. Behaviour-preserving in production - Time::getMillis() is
millis() unless a test injects a clock.
test_gps_update_scheduling/ gains seven cases: the idle/searching/ended
states, elapsed exactness across the wrap, both inversion directions above,
and reset(). The two wrap cases fail on the old predicate.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* MessageStore: date boot-relative messages in uptime seconds
A message received before the wall clock is trustworthy is stamped
boot-relative and healed by upgradeBootRelativeTimestamps() once the RTC
arrives. Both the stamp and the "same boot?" test were millis() / 1000, which
wraps every 49.7 days: a stamp taken before the wrap reads as newer than
`bootNow` afterwards, so `m.timestamp <= bootNow` declines to heal it and the
message shows "???" until it ages out. MessageRenderer's own copy of the test
falls the same way and prints invalidTime.
Neither produces a wrong time - the guard is what fails safe - but
Time::getUptimeSecs() landed in #11291 for exactly this, and does not wrap for
136 years. Both sites take it, which makes the comparison exact rather than
merely fail-safe.
While here, the autosave tick had its own hand-rolled deadline helper -
`reachedMs(now, target)` as `(int32_t)(now - target) >= 0`. Wrap-correct, but
a competing idiom for what Throttle::isWithinTimespanMs() already answers, and
the signed cast is the form #11291 replaced everywhere else. Deleted; the
stamps read Time::getMillis() so the whole path is on one clock.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* WebServer: drop the hand-rolled millis() wrap branch
getAdaptiveInterval() special-cased the wrap by hand:
if (currentTime >= lastActivityTime)
timeSinceActivity = currentTime - lastActivityTime;
else
timeSinceActivity = (UINT32_MAX - lastActivityTime) + currentTime + 1;
Those two expressions are the same number - unsigned subtraction already
computes the difference modulo 2^32 - so this is not a bug, just eight lines
reimplementing what Throttle does. It also reads like a site that has thought
about the wrap and settled it, which makes it a bad example to copy.
Two isWithinTimespanMs() calls against the stored activity stamp, matching
ethApiServer's shape for the same adaptive-interval decision. The stamps move
to Time::getMillis() so the writes and the reads share a clock.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* MeshPacketQueue: only order elapsed times once both deadlines have passed
The late-packet eviction I rewrote compared how long ago each deadline passed:
backElapsed < (uint32_t)(now - p->tx_after)
That is only an ordering when both deadlines are in the past. An incoming
packet whose tx_after is still in the future subtracts to a near-2^32 elapsed,
which reads as the most overdue packet in the queue rather than the least - so
a full queue would drop the overdue packet it was about to transmit in favour
of one that is not ready yet. The comparison it replaced,
`backPacket->tx_after > p->tx_after`, got this right away from the wrap; I
lost it in the conversion.
Classify before ordering: p->tx_after must be unset, or passed, before its
elapsed time means anything. Two expired deadlines still order by which is
further overdue, which is what the branch is for.
Caught by CodeRabbit on #11483.
test/test_meshpacket_queue/ pins the branch: the future-dated arrival that
started this, both directions of the both-expired ordering, the undelayed
arrival, and all of it again with the deadlines and `now` on opposite sides of
the wrap. maxLen is 1 so the suite reaches the branch without dragging in
CompareMeshPacketFunc and a NodeDB.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* ExpressLRSFiveWay: treat "no key pressed yet" as no activity
keyDownStart is 0 until the first press of a boot, and the fast-poll window
read that as a press at time zero: 100ms polling for the first 20s of uptime
with no activity at all, re-triggering once per millis() wrap. The arithmetic
this replaced (`now < keyDownStart + 20000`) did the same, so it is not a
regression - but the sentinel is exactly what the conventions say to test
before the elapsed comparison, and "has there been recent key activity" has an
honest answer here.
250ms is the documented floor for not missing presses, so an idle node simply
starts there and moves to 100ms on the first press.
Also trims the wrap-cases comment in test_gps_update_scheduling to the
two-line house limit.
Both from CodeRabbit review on #11483.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
- MeshService::sendQueueStatusToPhone: release the pooled QueueStatus
when the toPhone queue enqueue fails, matching what
sendMqttMessageToClientProxy and sendClientNotification already do.
The full-queue guard makes this failure rare, but the check/enqueue
sequence is not atomic and this path is reachable concurrently from
the main loop and the nRF52 BLE write callback; each failure
permanently lost one of the four pool slots, and after four losses
the phone never receives QueueStatus again until reboot.
- MessageStore::storeTextInPool: bail out when the boot-time pool
allocation failed instead of memcpy'ing through a null pointer. The
read side (getTextFromPool) already guards and maps offset 0 to an
empty string.
- RF95Interface: hold the RadioLibRF95 driver in a unique_ptr. It is
constructed in init(), and when init() subsequently fails (e.g. chip
probe NOT_FOUND) initLoRa() destroys the interface, leaking the
driver; every sibling interface holds its driver by value so nothing
else needed a destructor here.
* Strip the default PSK when licensed defaults are installed
* Only record rate-limited portnums from the phone
* Bound payload reads by the received size
Removed:
- MessageStore::addFromPacket and addFromString, superseded by
tryAddFromPacket
- GeoCoord rangeRadiansToMeters, distanceTo, bearingTo
- Router::rawSend, declared virtual with no override and no caller
- ContentHandler handleHotspot, handleFs, handleAdminSettings,
handleAdminSettingsApply, handleDeleteFsContent and their commented
route registrations, plus the now unreachable htmlDeleteDir and the
handleUpdateFs declaration that had no definition
- ContentHelper replaceAll
- OnScreenKeyboardModule popup chain: showPopup, clearPopup, drawPopup,
drawPopupOverlay and their state, unreachable since the frame based UI
was replaced by baseUI
- DebugRenderer drawDebugInfoTrampoline, drawDebugInfoSettingsTrampoline
and the orphaned drawFrameSettings
- NodeListRenderer calculateMaxScroll, drawColumns and a stale extern
haveGlyphs declaration with no definition
- UIRenderer::haveGlyphs, Screen::blink,
NotificationRenderer::showKeyboardMessagePopupWithTitle,
VirtualKeyboard::getInputText
- InkHUD touchNavLeft, touchNavRight, Applet::getActiveNodeCount,
ThreadedMessageApplet::saveMessagesToFlash
- TwoButton::setHandlerUp, TwoButtonExtended setHandlerUp,
setJoystickDownHandlers, setJoystickUpHandlers
- CannedMessageModule LaunchRepeatDestination, isCharInputAllowed,
hasMessages
- TrafficManagementModule resetStats, recordRouterHopPreserved,
saturatingIncrement
- UnitConversions::MetersPerSecondToMilesPerHour
- EncryptedStorage getSessionRemainingSeconds
- BMI270Sensor::writeRegisters, GPS::hasFlow, FSCommon copyFile,
SerialConsole consolePrintf, buzz playLongPressLeadUp,
memGet displayPercentHeapFree
* Add MemAudit: per-subsystem heap accounting in the boot log
The 2.8.0 nRF52840 heap-exhaustion field reports had to be diagnosed by
hand, reconstructing each subsystem's heap footprint from source and
build flags one report at a time. This makes every future report
self-diagnosing from the serial log: a tiny fixed-size registry
(src/memory/MemAudit.*) that big long-lived allocations report into,
printed as one line at the end of setup() and alongside the periodic
"Heap free:" log:
MemAudit[boot]: tmm=2500 warm=4000 pkthist=5824 nodedb=13440
msgstore=2200 pktpool(live)=3270 total=31234
Instrumented: NodeDB hot vector (nodedb) + satellite maps (satmaps,
rb-tree overhead estimated), WarmNodeStore (warm), PacketHistory records
and hash index (pkthist), TrafficManagement caches (tmm/tmm_ni),
MessageStore text pool (msgstore), TFT line/repaint buffers (display),
and live in-flight packets (pktpool(live)) via an optional audit tag on
the packet pool allocator - the one hot path, counted with a relaxed
32-bit atomic add (single instructions on Cortex-M, no locks).
Cost: 128 B RAM for the 16-tag table, well under 1 KB flash on rak4631.
MESHTASTIC_MEM_AUDIT=0 compiles it out to inline no-op stubs (call
sites need no ifdefs); STM32WL, the tightest flash target, defaults off.
New native suite test_mem_audit covers add/set/snapshot arithmetic, tag
reuse (pointer and cross-TU strcmp fallback), null/unknown tags, and
table-full behavior; test/native-suite-count bumped to 28.
* native-wasm: add src/memory/ to the curated source filter
The wasm env denies all sources and adds an explicit file list; MemAudit
callers (main, MeshService, NodeDB, PacketHistory) are in that list but
src/memory/MemAudit.cpp was not, so wasm-ld failed on undefined
memaudit:: symbols.
* Wipe message Store on factory reset
* Check for destination 0 in a new message, and convert to broadcast
* Make sure CHARGE_LED_state gets turned off, to avoid stuck LEDs
* Take the spiLock in MessageStore when clearing messages
* Trunk
* Add thinknode M5 voltage curve
* Fix the oops
* Autosave Messages
* fix
* Add logging, code cleanup, and add save on delete.
* We already save as part of delete messages, no need to do it again
* fix spelling errors
* Updating comment
---------
Co-authored-by: Jason P <applewiz@mac.com>
I thought git would be smart enough to understand all the whitespace changes but even with all the flags I know to make it ignore theses it still blows up if there are identical changes on both sides.
I have a solution but it require creating a new commit at the merge base for each conflicting PR and merging it into develop.
I don't think blowing up all PRs is worth for now, maybe if we can coordinate this for V3 let's say.
This reverts commit 0d11331d18.
* First try at multimessage storage and display
* Nrf built issue fix
* Message view mode
* Add channel name instead of channel slot
* trunk fix
* Fix for DM threading
* fix for message time
* rename of view mode to Conversations
* Reply in thread feature
* rename Select View Mode to Select Conversation
* dismiss all live fix
* Messages from phone show on screen
* Decoupled message packets from screen.cpp and cleaned up
* Cannedmessage cleanup and emotes fixed
* Ack on messages sent
* Ack message cleanup
* Dismiss feature fixed
* removed legacy temporary messages
* Emote picker fix
* Memory size debug
* Build error fix
* Sanity checks are okay sometimes
* Lengthen channel name and finalize cleanup removal of Broadcast
* Change DM to @ in order to unify on a single method
* Continue unifying display, also show message status on the "isMine" lines
* Add context for incoming messages
* Better to say "in" vs "on"
* crash fix for confirmation nodes
* Fix outbound labels based to avoid creating delays
* Eink autoscroll dissabled
* gating for message storage when not using a screen
* revert
* Build fail fix
* Don't error out with unset MAC address in unit tests
* Provide some extra spacing for low hanging characters in messages
* Reorder menu options and reword Respond
* Reword menus to better reflect actions
* Go to thread from favorite screen
* Reorder Favorite Action Menu with simple word modifications
* Consolidate wording on "Chats"
* Mute channel fix
* trunk fix
* Clean up how muting works along with when we wake the screen
* Fix builds for HELTEC_MESH_SOLAR
* Signal bars for message ack
* fix for notification renderer
* Remove duplicate code, fix more Chats, and fix C6L MessageRenderer
* Fix to many warnings related to BaseUI
* preset aware signal strength display
* More C6L fixes and clean up header lines
* Use text aligns for message layout where necessary
* Attempt to fix memory usage of invalidLifetime
* Update channel mute for adjusted protobuf
* Missed a comma in merge conflicts
* cleanup to get more space
* Trunk fixes
* Optimize Hi Rez Chirpy to save space
* more fixes
* More cleanup
* Remove used getConversationWith
* Remove unused dismissNewestMessage
* Fix another build error on occassion
* Dimiss key combo function deprecated
* More cleanup
* Fn symbol code removed
* Waypoint cleanup
* Trunk fix
* Fixup Waypoint screen with BaseUI code
* Implement Haruki's ClockRenderer and broadcast decomposeTime across various files.
* Revert "Implement Haruki's ClockRenderer and broadcast decomposeTime across various files."
This reverts commit 2f65721774.
* Implement Haruki's ClockRenderer and broadcast decomposeTime across various files. Attempt 2!
* remove memory usage debug
* Revert only RangeTestModule.cpp change
* Switch from dynamic std::string storage to fixed-size char[]
* Removing old left over code
* More optimization
* Free Heap when not on Message screen
* build error fixes
* Restore ellipsis to end of long names
* Remove legacy function renderMessageContent
* improved destination filtering
* force PKI
* cleanup
* Shorten longNames to not exceed message popups
* log messages sent from apps
* Trunk fix
* Improve layout of messages screen
* Fix potential crash for undefined variable
* Revert changes to RedirectablePrint.cpp
* Apply shortening to longNames in Select Destination
* Fix short name displays
* Fix sprintfOverlappingData issue
* Fix nullPointerRedundantCheck warning on ESP32
* Add "Delete All Chats" to all chat views
* Improve getSafeNodeName / sanitizeString code.
* Improve getSafeNodeName further
* Restore auto favorite; but only if not CLIENT_BASE
* Don't favorite if WE are CLIENT_BASE role
* Don't run message persistent in MUI
* Fix broken endifs
* Unkwnown nodes no longer show as ??? on message thread
* More delete options and cleanup of code
* fix for delete this chat
* Message menu cleanup
* trunk fix
* Clean up some menu options and remove some Unit C6L ifdefines
* Rework Delete flow
* Desperate times call for desperate measures
* Create a background on the connected icon to reduce overlap impact
* Optimize code for background image
* Fix for Muzi_Base
* Trunk Fixes
* Remove the up/down shortcut to launch canned messages (#8370)
* Remove the up/down shortcut to launch canned messages
* Enabled MQTT and WEBSERVER by default (#8679)
Signed-off-by: kur1k0 <zhuzirun@m5stack.com>
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
Co-authored-by: Jonathan Bennett <jbennett@incomsystems.biz>
---------
Signed-off-by: kur1k0 <zhuzirun@m5stack.com>
Co-authored-by: Riker <zhuzirun@m5stack.com>
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
* Correct string length calculation for signal bars
* Manual message scrolling
* Fix
* Restore CannedMessages on Home Frame
* UpDown situational destination for textMessage
* Correct up/down destinations on textMessage frame
* Update Screen.h for handleTextMessage
* Update Screen.cpp to repair a merge issue
* Add nudge scroll on UpDownEncoder devices.
* Set nodeName to maximum size
* Revert "Set nodeName to maximum size"
This reverts commit e254f39925.
* Reflow Node Lists and TLora Pager Views (#8942)
* Add files via upload
* Move files into the right place
* Short or Long Names for everyone!
* Add scrolling to Node list
* Pagination fix for Latest to oldest per page
* Page counters
* Dynamic scaling of column counts based upon screen size, clean up box drawing
* Reflow Node Lists and TLora Pager Views (#8942)
* Add files via upload
* Move files into the right place
* Short or Long Names for everyone!
* Add scrolling to Node list
* Pagination fix for Latest to oldest per page
* Page counters
* Dynamic scaling of column counts based upon screen size, clean up box drawing
* Update exempt labels for stale bot workflow
Adds triaged and backlog to the list of exempt labels.
* Update naming of Frame Visibility toggles
* Fix to scrolling
* Fix for content cutting off when from us
* Fix for "delete this chat" now it does delete the current one
* Rework isHighResolution to be an enum called ScreenResolution
* Migrate Unit C6L macro guards into currentResolution UltraLow checks
* Mistakes happen - restoring NodeList Renderer line
---------
Signed-off-by: kur1k0 <zhuzirun@m5stack.com>
Co-authored-by: Jason P <applewiz@mac.com>
Co-authored-by: Jonathan Bennett <jbennett@incomsystems.biz>
Co-authored-by: Riker <zhuzirun@m5stack.com>
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
Co-authored-by: whywilson <m.tools@qq.com>
Co-authored-by: Tom Fifield <tom@tomfifield.net>
