Reject pressure readings outside the sensor's operating range
(30-125 kPa) to detect I2C data corruption. When I2C transfers
complete successfully but return corrupted data, this check
prevents invalid samples from being published.
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
* feat(pps_capture): allow selecting GPS receiver by device ID
Add PPS_CAP_GPS_ID parameter to select which GPS receiver's data
is used for PPS timestamp correlation. Matches by device ID rather
than uORB instance index, which avoids dependence on instance ordering.
When set to 0 (default), uses the first available instance for
backward compatibility.
* docs(pps_capture): document PPS_CAP_GPS_ID for multi-GPS setups
* fix(pps_capture): use GPS_MAX_RECEIVERS constant and mark PPS_CAP_GPS_ID reboot-required
When a CRSF frame arrives with packet_size < 2 (PACKET_SIZE_TYPE_SIZE),
the subtraction `packet_size - PACKET_SIZE_TYPE_SIZE` underflows the
uint32_t working_segment_size to 0xFFFFFFFF. The subsequent overflow
check also wraps and fails to catch it. Since working_segment_size is
static, the parser is permanently stalled — no further CRSF messages
can be processed until reboot.
Validate packet_size >= PACKET_SIZE_TYPE_SIZE early, before any
subtraction, protecting both the known variable-length and unknown
packet branches in a single check.
Supersedes #26782 which only guarded the unknown-packet branch.
Update the opencyphal/public_regulated_data_types submodule to latest
master which renames all .uavcan files to .dsdl, eliminating ~456
Nunavut deprecation warnings per build.
Overhauls the DShot driver with per-timer BDShot selection, multi-timer
sequential capture, Extended DShot Telemetry (EDT), and AM32 ESC EEPROM
read/write via MAVLink. Expands ESC support from 8 to 12 channels.
BDShot:
- Per-timer BDShot protocol selection via actuator config UI
- Multi-timer sequential burst/capture on any DMA-capable timer
- Adaptive per-channel GCR bitstream decoding
- Per-channel online/offline detection with hysteresis
Extended DShot Telemetry (EDT):
- Temperature, voltage, current from BDShot frames (no serial wire)
- New DSHOT_BIDIR_EDT parameter
- EDT data merged with serial telemetry when both available
AM32 EEPROM:
- Read/write AM32 ESC settings via MAVLink ESC_EEPROM message
- ESCSettingsInterface abstraction for future ESC firmware types
- New DSHOT_ESC_TYPE parameter
Other changes:
- Per-motor pole count params DSHOT_MOT_POL1–12 (replaces MOT_POLE_COUNT)
- EscStatus/EscReport expanded to 12 ESCs with uint16 bitmasks
- Numerous bounds-check, overflow, and concurrency fixes
- Updated DShot documentation
* refactor(mixer_module): change MixingOutput to use float outputs
MixingOutput now passes float values to output drivers instead of
uint16_t. This removes the need for the 8192 offset encoding and
allows reversible motors to receive negative values directly.
* fix(mixer_module): fix float safety issues
-EscClient and voxl2_io: replace outputs[i] with fabs(outputs[i]) > 0.fto fix compilation issues
-GZMixingInterface: add explicit double cast to prevent compilation error
-PWMSim: replaced unit16 cast with lroundf given that now motors outputs can be negative and casting a negative float to unit16 is undefinder behaviour
-mixer_module: same fix of PWM (unit126 cast on negative float is undefined behaviour)
* refactor(mixer_module): float rounding suggestions
* fix(pwm_sim): fix inverted disarmed condition
* fix(mixer_module): more float rounding improvements
* fix(mixer_module_tests): use casting method which are now in drivers for rounding tests
---------
Co-authored-by: Matthias Grob <maetugr@gmail.com>
Add bounds checking in the CAN frame assembly loop to prevent a buffer
overflow when copying payloads into the Tattu12SBatteryMessage struct.
A crafted CAN frame with a corrupt payload_size could write past the
48-byte struct boundary. Also guard against payload_size of 0 which
would cause an unsigned integer underflow on the size_t subtraction.
Fixes GHSA-wxwm-xmx9-hr32
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Variable-length known packet types (CRSF_PACKET_TYPE_ELRS_STATUS,
CRSF_PACKET_TYPE_LINK_STATISTICS_TX, CRSF_PACKET_TYPE_MSP_WRITE)
bypassed the bounds check that exists for unknown packets. A crafted
packet with a large size field could overflow the 64-byte process_buffer
during QueueBuffer_PeekBuffer() in the CRC state.
Apply the same CRSF_MAX_PACKET_LEN bounds check to variable-length
known packets that already exists for unknown packets.
Fixes GHSA-mqgj-hh4g-fg5p
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Reject replies with length >= sizeof(BSTPacket) to prevent OOB read
in CRC calculation. Clamp dev_name_len to buffer size to prevent OOB
write during null termination.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Add a new parameter to map a MAVLink MANUAL_CONTROL button to turtle
mode activation. When the manual control data source is a MAVLink
instance, the driver uses the buttons field directly instead of aux
channels. When the source is RC, the existing aux channel behavior
via VOXL_ESC_MODE is preserved. Set to -1 (default) to disable.
migrateFWFromRoot held the SD root directory open via opendir/readdir
while performing heavy file I/O (getFileInfo, copyFw, unlink) inside the
loop. Between readdir calls the FAT semaphore is released, allowing
other tasks (e.g. logger) to dirty the shared FAT sector cache. When
the next FAT operation needed a different sector, fat_fscacheflush
would write the dirty data followed by an immediate read — triggering
a write-busy to read transition in the SDMMC WRCOMPLETE path that
kills the SD card on STM32H7.
Split into two phases: first collect .bin filenames with the directory
open, then close it before doing any file I/O. This also fixes a
missing closedir on the mkdir error path and avoids modifying directory
entries (via unlink) while iterating them with readdir.
* refactor: use parseDefaultArguments
* style: reverted changes to docs (should be auto-generated)
* refactor: use parseDefaultArguments
* style: reverted changes to docs (should be auto-generated)
When the PI controller computed zero on-time (e.g. temperature already
above target), the heater was still momentarily turned on every cycle
before being immediately turned off. Skip the on/off toggle entirely
when the computed on-time is zero.
* heater: add multi-instance support, refactor parameter handling, remove legacy params file
This change introduces multi-instance heater support to allow independent temperature control for multiple IMUs.
Main changes:
- Add support for multiple heater instances
- Refactor parameter handling to use per-instance parameters
- Remove the legacy parameter file and migrate to the updated parameter structure
This improves scalability and makes heater configuration consistent across setups with multiple sensors.
* Refactor heater configuration across multiple boards
- Updated heater GPIO definitions to introduce a new naming convention for better clarity and consistency.
- Replaced `GPIO_HEATER_OUTPUT` with `GPIO_HEATER1_OUTPUT` and adjusted the corresponding output enable macros.
- Changed parameter names from `SENS_TEMP_ID` to `HEATER1_IMU_ID` in various board default configurations to reflect the new heater setup.
- Ensured all affected board configurations are updated to maintain functionality with the new heater definitions.
* heater: fix missing HEATER1_OUTPUT_EN control
* heater: fix more missing HEATER1_OUTPUT_EN control
* heater: tidy config, docs, and instance handling
- Remove unused controller period member and use CONTROLLER_PERIOD_DEFAULT
- Improve HEATER${i}_IMU_ID description and instance-related logging/behavior
- Add a guard when HEATER_NUM exceeds HEATER_MAX_INSTANCES
Note: drop intermediate/reverted change around the 'celsius' spelling.
* heater: refactor constructor to remove unused parameter and add instance name function
- Remove unused ModuleParams argument from Heater constructor
- Add heater_instance_name() helper to provide per-instance work queue task names
- Use instance-specific parameter lookup (HEATER{n}_*) during initialization
Use heater_instance_name() to label each instance (heater_1/2/3) in work queue.
Also drop unused ModuleParams argument from constructor and keep per-instance
parameter handle lookup in initialization.
* format
* board: update GPIO configuration for multiple heater instances, add HEATER_NUM for boards using PX4IO
* heater: update heater control to use HEATER1_OUTPUT_EN when using PX4IO for consistency
* heater: add a TODO for px4io multi-instance
* heater: update missing GPIO_HEATER1_OUTPUT in sky-drones
* heater: fix multiple newlines at EOF (resolve CI check failure)
* heater: switch to PublicationMulti for heater_status and log multi-instance
- Changed _heater_status_pub from Publication to PublicationMulti to support independent per-instance publications without overwriting.
- Updated logged_topics.cpp to use add_optional_topic_multi("heater_status")
This fixes the issue where multiple heater instances were writing to the same heater_status topic, causing data overwriting and incorrect update rates in logs.
---------
Co-authored-by: Jacob Dahl <dahl.jakejacob@gmail.com>
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
* lightware_grf_serial: disable flow control
This might fix serial comms with the Lightware sensor.
* update sf45 to disable hw flow control
Signed-off-by: dirksavage88 <dirksavage88@gmail.com>
---------
Signed-off-by: dirksavage88 <dirksavage88@gmail.com>
Co-authored-by: dirksavage88 <dirksavage88@gmail.com>
long is a 32-bit signed integer, which means the maximum it will hold is 0x7FFFFFFF.
strtol is overflowing, resulting in clamping the value to LONG_MAX (or 0x7FFFFFFF) and returns that instead.
Fixes by using strtoul, which corrects the returned value.
Can be tested by building a UAVCAN Node on the tag v1.16.1, flashing and checking the value displayed in dronecan_gui_tool. Screenshot added for convenience.
Jacob Dahl