Several helper scripts assumes bash is available at /bin/bash. That breaks on systems
such as NixOS, where bash is resolved from PATH instead of a fixed /bin location and
causes failures like `bad interpreter` during `make format`, e.g., on my host machine:
```sh
$ make format
/PX4-Autopilot/Tools/astyle/check_code_style.sh: /PX4-Autopilot/Tools/astyle/fix_code_style.sh: /bin/bash: bad interpreter: No such file or directory
```
This change switches these entrypoints to `#!/usr/bin/env bash` so they locate bash properly.
No functional changes intended.
Signed-off-by: Onur Özkan <work@onurozkan.dev>
Disable EKF2 fusion features with no corresponding hardware:
- px4_fmu-v2: optical flow, range finder (~17 KB saved)
- mamba-f405-mk2: optical flow, range finder, external vision,
aux global position, aux velocity, baro compensation,
drag fusion (~42 KB saved)
Before this change, filtered test runs still built every gtest target
because `test_results` depended on all unit and functional gtest targets.
This updates both `px4_add_unit_gtest()` and `px4_add_functional_gtest()`
to use the filtered dependency helper so filtered runs only build the
selected targets.
Signed-off-by: Onur Özkan <work@onurozkan.dev>
The MPL3115A2 ADC conversion at OSR 2 (ratio 4) takes ~18ms. The
driver polls until the conversion completes, so the read time is at
the end of the integration window. Correct timestamp_sample to the
midpoint by subtracting CONVERSION_TIME / 2.
The LPS25H one-shot measurement is integrated over a ~40ms window
(at 25Hz-equivalent internal averaging). The read time corresponds to
the end of the integration window. Correct timestamp_sample to the
midpoint by subtracting CONVERSION_INTERVAL / 2.
The LPS22HB one-shot measurement is integrated over a ~40ms window
(at 25Hz-equivalent internal averaging). The read time corresponds to
the end of the integration window. Correct timestamp_sample to the
midpoint by subtracting CONVERSION_INTERVAL / 2.
Same fix as MS5611: the MS5837 ADC conversion at OSR 1024 takes
~2.28ms, but the data is read after a 10ms scheduling delay. Correct
timestamp_sample by subtracting (CONVERSION_INTERVAL - CONVERSION_TIME/2)
from the read time.
The MS5611 ADC conversion at OSR 1024 takes ~2.28ms, but the data is
read after a 10ms scheduling delay. The current code timestamps the
read time, which is ~8.9ms after the true integration midpoint.
Correct timestamp_sample by subtracting the full offset
(CONVERSION_INTERVAL - CONVERSION_TIME/2) from the read time.
The BMP581 pressure measurement is integrated over a configurable
window (~23ms at 32x pressure / 2x temperature oversampling). The
read time corresponds to the end of the integration window, introducing
a systematic timing bias. Correct timestamp_sample to the midpoint by
subtracting measurement_time / 2.
The BMP280 pressure measurement is integrated over _measure_interval
(~43ms at 16x pressure / 2x temperature oversampling). The read time
corresponds to the end of the integration window, introducing a
systematic timing bias. Correct timestamp_sample to the midpoint by
subtracting measurement_time / 2.
Set all high_rate_sensors_topics to 100hz (10ms interval) and add
vehicle_air_data, vehicle_thrust_setpoint, estimator_aid_src_baro_hgt,
and vehicle_magnetometer.
The BMP388 pressure measurement is integrated over a configurable
window (e.g. 37ms at 16x oversampling). The previous code used the
read time as timestamp_sample, which is the end of the integration
window. Correct to the midpoint by subtracting half the measurement
time, with a guard against unsigned underflow.
rc.mc_defaults sets MAV_TYPE=2 (quadrotor) which the hex airframe
never overrides. Set MAV_TYPE=13 (hexarotor) so the heartbeat
correctly identifies the vehicle type.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* Swap joystick surge/heave mapping in manual, stabilized and acro modes to make it similar to position modes
* docs: update UUV/BlueROV2 modes and joystick mapping
* Document basic control axes and joystick mapping
Added basic control axes and stick mapping for BlueROV2.
* Fixed formatting issue
* Enhance clarity of control axes and stick mapping
Clarified descriptions of motion axes and joystick controls for BlueROV2.
The MAVLink standard defines ACTUATOR_OUTPUT_FUNCTION_MOTOR1=1..MOTOR16=16,
but PX4 internally uses OutputFunction::Motor1=101..Motor12=112. The DShot
driver only handled PX4 internal values (101+) and QGC legacy values (1101+),
so any standards-compliant GCS sending the MAVLink enum values would get
VEHICLE_CMD_RESULT_UNSUPPORTED back from MAV_CMD_CONFIGURE_ACTUATOR.
Add a mapping from MAVLink standard values (1-16) to PX4 internal values
(101-116) by adding 100, matching the existing QGC backwards-compat pattern.
* fix(commander): add tab character to critical system loss messages
* fix(commander): extend timeout for traffic avoidance system heartbeat check
* Commander: Only Warn the user about traffic avoidance system loss if COM_ARM_TRAFF is set
Signed-off-by: Claudio Micheli <claudio@auterion.com>
---------
Signed-off-by: Claudio Micheli <claudio@auterion.com>
Co-authored-by: Claudio Micheli <claudio@auterion.com>
GCC 14.3.0 emits `-Wstringop-overflow` when `RtcmTest::buildRawFrame()`
is optimized and inlined.
This change marks the helper `noinline` to keep it out of that optimization path.
Preserves the existing logic and only changes how the compiler emits the test helper.
Fixes https://github.com/PX4/PX4-Autopilot/issues/26875
Signed-off-by: Onur Özkan <work@onurozkan.dev>
When all subscription topics are commented out in dds_topics.yaml,
the build failed in two ways:
1. KeyError in generate_dds_topics.py when the subscriptions key is
absent from YAML — fixed by using dict.get() with fallback to
empty list, consistent with how subscriptions_multi is handled.
2. Unused variable errors (-Werror) in the generated dds_topics.h
when no subscriptions exist — fixed by guarding on_topic_update(),
time_offset_us, and uxr_set_topic_callback() with conditional
template blocks. Also marked create_data_reader() as
__attribute__((unused)) since it is only called from generated
subscription code.
Closes#26799
Signed-off-by: Pavel Guzenfeld <pavelgu@gmail.com>
* [feat] allowed to assign up to 16 ESC CAN
* Update EscStatus.msg
lowered down to 12 motors, hardware tested
* Update module.yaml
lowered down to 12 motors, hardware tested
---------
Co-authored-by: klelkov <kon.lelkov@yandex.ru>
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
Add INA226 and INA228 power monitor drivers to the voxl2 SLPI board
config and add startup options in voxl-px4-start to select them via
the POWER_MANAGER environment variable.
Give the operator the optiont to configure a "Hold at position where
the data link was still coming through" by setting NAV_DLL_ACT to Hold
and the new param NAV_LTR_LAST_DL to 1.
Signed-off-by: Silvan <silvan@auterion.com>
Existing saved parameters store RC*_REV as float. The parameter
import system does strict type checking and would silently skip
these on firmware update. Add migration to preserve user settings.
RC*_REV parameters are binary toggles (-1 or 1) immediately converted
to bool. Using int32 allows reverting the module schema enum key type
from number back to integer, keeping validation strict.
All parameters are now defined in YAML module configuration files.
Remove the cmake infrastructure that discovered and processed
legacy params.c files:
- Remove GLOB_RECURSE for *params.c/*parameters.c
- Remove .c file scanning from DISABLE_PARAMS_MODULE_SCOPING
- Remove module_list from px_process_params.py --src-path
- Remove PX4_MODULE_PATHS usage (no longer needed for param scanning)
- migrate_c_params.py: preserve newlines and paragraph breaks in long
descriptions, use YAML block scalars for multi-line strings
- generate_params.py: support @value tags on float type parameters
(fixes RC*_REV enum values being lost during yaml generation)
Reject pressure readings outside the sensor's operating range
(30-125 kPa) to detect I2C data corruption. When I2C transfers
complete successfully but return corrupted data, this check
prevents invalid samples from being published.
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
The failure_detector_status bitmask in vehicle_status duplicates the
separate FailureDetectorStatus topic. Remove it and read directly from
the dedicated topic in failureDetectorCheck and HIGH_LATENCY2.
* feat(pps_capture): allow selecting GPS receiver by device ID
Add PPS_CAP_GPS_ID parameter to select which GPS receiver's data
is used for PPS timestamp correlation. Matches by device ID rather
than uORB instance index, which avoids dependence on instance ordering.
When set to 0 (default), uses the first available instance for
backward compatibility.
* docs(pps_capture): document PPS_CAP_GPS_ID for multi-GPS setups
* fix(pps_capture): use GPS_MAX_RECEIVERS constant and mark PPS_CAP_GPS_ID reboot-required
Extend the arm throttle safety check to all vehicle types including
rovers, which were previously excluded. Unify the two separate throttle
checks into a single evaluation at arm-time that accounts for vehicle
type and control mode: rovers require centered stick, climb-rate modes
require stick at or below center, and manual/stab/acro modes require
stick at bottom.
This is not only needed for engine warmup but in general, when the
vehicle is static on the ground, relying on fixed position to maintain a
valid global position estimate before takeoff, even when bumping it or
starting the engine.
* boards: corvon 743v1 support (Docs and LED alignment)
This PR addresses #24769 by providing the required official documentation, while simultaneously aligning the board's LED semantics entirely with the PX4 standard.
Key Changes:
- Add complete corvon 743v1 hardware documentation and manufacturer link.
- Fix LED out-of-bounds bug and strictly align RGB states to Pixhawk standard (LED_BLUE=0, LED_RED=1, LED_GREEN=3).
- Update bootloader pin config (hw_config.h) to use red LED for boot/error, and update pre-built bootloader.bin.
* Prettier and file reduce
* docs: address reviewer feedback & board ID fix
* Apply suggestion from @hamishwillee
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* docs: resolve final reviewer feedback (PPM, Debug Port, Manufacturer List)
---------
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
Co-authored-by: Ramon Roche <mrpollo@gmail.com>
When a CRSF frame arrives with packet_size < 2 (PACKET_SIZE_TYPE_SIZE),
the subtraction `packet_size - PACKET_SIZE_TYPE_SIZE` underflows the
uint32_t working_segment_size to 0xFFFFFFFF. The subsequent overflow
check also wraps and fails to catch it. Since working_segment_size is
static, the parser is permanently stalled — no further CRSF messages
can be processed until reboot.
Validate packet_size >= PACKET_SIZE_TYPE_SIZE early, before any
subtraction, protecting both the known variable-length and unknown
packet branches in a single check.
Supersedes #26782 which only guarded the unknown-packet branch.
The flow output table shows forward movement producing +Y flow and
rightward movement producing -X flow, which confuses users whose sensors
have X-forward/Y-right coordinate systems. Add an info note explaining
that integrated flow values are angular rotations (radians) about the
body axes using the right-hand convention, which is why the axes are
cross-coupled with translational motion.
Add reusable skill definitions for common contributor workflows:
- commit: creates conventional commits with proper type(scope) format
- pr: creates PRs with conventional commit titles
- rebase-onto-main: handles rebasing onto main when parent branches
were squash-merged
Add a scalable .deb packaging framework for VOXL2, built on the
existing cmake/package.cmake CPack infrastructure. The framework
handles multi-processor boards by having the POSIX (_default) build
own the .deb and pull in the companion SLPI build's artifacts.
Board-specific files:
- cmake/package.cmake: CPack variable overrides (name, deps, version)
- cmake/install.cmake: install() rules for all .deb contents
- debian/postinst: px4-* symlinks, DSP signature, directory setup
- debian/prerm: service stop, symlink cleanup
- debian/voxl-px4.service: systemd unit (after sscrpcd)
Infrastructure changes:
- cmake/package.cmake: hook for board-specific CPack overrides
- platforms/posix/CMakeLists.txt: hook for board install.cmake
- Makefile: %_deb pattern rule (build _default, then cpack -G DEB)
- CI: auto-discover _deb targets, collect .deb artifacts, upload
to GitHub Releases
Future boards: add cmake/package.cmake + cmake/install.cmake and
CI discovers it automatically. No new file formats or tools needed.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Read companion_targets files from board directories and exclude those
targets from CI grouped builds. The parent target builds them via
Make prerequisite, avoiding redundant CI jobs.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Add Makefile rules so that both `make modalai_voxl2` and
`make modalai_voxl2_default` build the SLPI DSP firmware first.
Add companion_targets file listing modalai_voxl2_slpi so CI knows
to exclude it from independent build groups.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Consolidate the VOXL2 SLPI (DSP) board from a separate directory into
the existing voxl2 board as a variant. Multi-processor SoCs like the
QRB5165 should use one board directory with multiple .px4board files
rather than separate directories per processor.
Changes:
- Add slpi.px4board (QURT/DSP) alongside default.px4board (POSIX/apps)
- Merge board_config.h with __PX4_QURT / __PX4_POSIX preprocessor guards
- Merge CMakeLists.txt with PX4_PLATFORM conditionals
- Split bus definitions into platform-specific files (i2c/spi_posix/qurt)
- Reorganize drivers into drivers/posix/ and drivers/qurt/ subdirectories
- Guard cmake/init.cmake and cmake/link_libraries.cmake for posix-only
- Update build and install scripts for new target names
- Delete boards/modalai/voxl2-slpi/ entirely
Build targets change:
- modalai_voxl2-slpi_default -> modalai_voxl2_slpi
- modalai_voxl2_default (unchanged)
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* ci(ros): use matching branch for px4-ros2-interface-lib
When running on release branches, the ROS integration tests now
check if a matching branch exists in px4-ros2-interface-lib and
clone it instead of always using main. This prevents build failures
caused by uORB message divergence between main and release branches.
Fixes https://github.com/Auterion/px4-ros2-interface-lib/issues/184
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* ci(ros): dispatch release branch creation to px4-ros2-interface-lib
Add a standalone workflow triggered by the create event that fires a
repository_dispatch to Auterion/px4-ros2-interface-lib when a
release/X.Y branch is created. Also supports manual workflow_dispatch.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* ci(ros): add empty permissions block to dispatch workflow
Fixes code scanning alert about missing GITHUB_TOKEN permissions.
This workflow only uses a PAT secret, not GITHUB_TOKEN, so no
permissions are needed.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
---------
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
There are many settings falling into the RC_* category
that definitely should be reset when e.g. placing the autopilot
into a new airframe.
And even for RC calibration values: it's not the worst
if those are newly calibrated after a reset. Or if they
are not expected to change one can bake them into the
airframe file.
Signed-off-by: Silvan <silvan@auterion.com>
PR #25799 added 'servo-launch-lock' to apply_identifiers (6 items) but
did not add a corresponding 6th entry to the 19 rule item arrays, causing
QGC to reject all servo-type rules with "unexpected num items expected: 6".
Remove the @volatile flag from ASPD_SCALE_1/2/3 so the estimated
airspeed scale persists across reboots and can be transferred between
vehicles of the same model. The scale is primarily determined by pitot
position on the airframe, not the individual sensor.
To avoid corrupting the param transfer hash with negligible changes
every flight, raise the save threshold from FLT_EPSILON to 3% relative
change, per dev-call consensus.
Supersedes #22760
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update the opencyphal/public_regulated_data_types submodule to latest
master which renames all .uavcan files to .dsdl, eliminating ~456
Nunavut deprecation warnings per build.
The N after MB was parsed as "play note 0" (rest) rather than "Music Normal" mode, since M already consumed B. Replacing it with a trailing P matches the ERROR_TUNE pattern and provides an intentional inter-repetition pause at the correct tempo.
After #25648, when performing RTL mission fast reverse, the vehicle would go to the waypoint before the previous one (i.e., two waypoints back). If the drone was already on its way to the first waypoint at that moment, it would even fly to the second waypoint first, and only then reverse back toward the takeoff point. This PR fixes that bug. #25648 was intended to address issues with NAV_CMD_CONDITION_GATE. The modification proposed in this PR also correctly bypasses NAV_CMD_CONDITION_GATE waypoints.
Line 319 used nested quotes inside f-strings, a feature only available
in Python 3.12+. The CI Docker image (px4-dev-base-focal:2021-08-18)
runs Python 3.8, causing the "msg file docs" Jenkins stage to fail on
every main build since 6bf73d9d89.
Extract the join expressions into local variables to restore
compatibility with Python 3.8+.
* sensors: add per-receiver GPS delay parameters
Add SENS_GPS{0,1}_DELAY params to vehicle_gps_position, following the
same device-ID matching pattern used for antenna offsets. Each receiver
can now have its own measurement delay relative to the IMU.
The delay is applied to timestamp_sample before blending. When PPS time
correction is active it takes priority over the parameter-based delay.
When a GPS driver already provides its own timestamp_sample the
per-receiver delay is not applied on top of it.
* fix(ekf2): remove EKF2_GPS_DELAY and perform param transation
* fix(param_translation): fix GPS param migration return values
Add missing return for EKF2_GPS_POS_Z and remove incorrect return for
EKF2_GPS_DELAY (1-to-many migration should not return PARAM_MODIFIED).
* fix(sensors,ekf2): rename pps_compensation and clarify delay default
* fix(ekf2): account for SENS_GPS*_DELAY in observation buffer sizing
* fix(docs): migrate EKF2_GPS_DELAY param
* sensors: move GPS antenna offsets to per-receiver parameters
Move antenna position configuration from the single EKF2_GPS_POS_X/Y/Z
parameter set into per-receiver SENS_GPS{0,1}_OFF{X,Y,Z} parameters in
the sensors module. Each offset slot is matched to a physical receiver
by device ID (SENS_GPS{0,1}_ID), falling back to uORB instance index
when no IDs are configured.
The antenna offset is now carried through the SensorGps uORB message
and blended alongside other GPS states when multi-receiver blending is
active, so EKF2 receives the correct lever arm for whichever receiver
(or weighted combination) is selected.
- Add antenna_offset_{x,y,z} fields to SensorGps.msg
- Remove EKF2_GPS_POS_X/Y/Z params; EKF2 reads offset from gnssSample
- Add SENS_GPS{0,1}_ID and SENS_GPS{0,1}_OFF{X,Y,Z} params (module.yaml)
- Blend antenna offsets in GpsBlending (weighted average)
- Add unit tests for single, blended, and failover antenna offset cases
- Migrate params.c to module.yaml for the vehicle_gps_position module
* sensors: gps_blending: add asymmetric weight and fallthrough offset tests
Add two additional antenna offset test cases:
- dualReceiverAsymmetricWeightAntennaOffset: verify that unequal eph
values produce correctly skewed blend weights (0.8/0.2) and that the
output antenna offset reflects the weighted average
- blendingFallthroughAntennaOffset: verify that when blending is enabled
but can_do_blending evaluates false (eph=0), the non-blending path
correctly assigns the selected receiver's antenna offset
* feat(param_translation): translate EKF2_GPS_POS_ to SENS_GPS0_OFF_
* fix(msgs): proper formatting
* chore(msg): 0 if invalid/unknown
* fix(ROMFS): migrate EKF2_GPS_POS_ params
* fix(docs): migrate EKF2_GPS_POS_ params
* fix(blending): unsigned param
* Update msg/SensorGps.msg
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(sensors/gps): remove 'values:' tag in module.yaml
* fix(sensors/gps): unsigned instance index
* fix(blending): restore const on gps_blend_states()
Move antenna offset blending into blend_gps_data() where the
weights are computed, keeping gps_blend_states() const.
* fix(sensors/gps): fix msg annotation and restore SENS_GPS_PRIME values
Remove incorrect @invalid NaN annotation from antenna offset fields
(0.0 default is correct, not a sentinel). Restore values tag for
SENS_GPS_PRIME so QGC shows a dropdown.
* fix(gps_blending): fix pre-existing bug to clear _gps_updated flags
The loop iterates over i but always clears gps_select_index. The intent is to clear
all updated flags, but only the selected one gets cleared (N times)
* test(gps_blending): add stale update flag regression test
Overhauls the DShot driver with per-timer BDShot selection, multi-timer
sequential capture, Extended DShot Telemetry (EDT), and AM32 ESC EEPROM
read/write via MAVLink. Expands ESC support from 8 to 12 channels.
BDShot:
- Per-timer BDShot protocol selection via actuator config UI
- Multi-timer sequential burst/capture on any DMA-capable timer
- Adaptive per-channel GCR bitstream decoding
- Per-channel online/offline detection with hysteresis
Extended DShot Telemetry (EDT):
- Temperature, voltage, current from BDShot frames (no serial wire)
- New DSHOT_BIDIR_EDT parameter
- EDT data merged with serial telemetry when both available
AM32 EEPROM:
- Read/write AM32 ESC settings via MAVLink ESC_EEPROM message
- ESCSettingsInterface abstraction for future ESC firmware types
- New DSHOT_ESC_TYPE parameter
Other changes:
- Per-motor pole count params DSHOT_MOT_POL1–12 (replaces MOT_POLE_COUNT)
- EscStatus/EscReport expanded to 12 ESCs with uint16 bitmasks
- Numerous bounds-check, overflow, and concurrency fixes
- Updated DShot documentation
* fix(rcS): reset the flight mode assignments during an airframe reset
because there are many products that have a default flight mode assignment in the airframe file and if the user resets to airframe defaults the flight mode assignment stays custom and doesn't get reset to "factory settings". It's neither a unit specific calibration nor a parameter to track total flights or flight time. I suggest to reset it as well.
* fix(posix rcS): sync airframe reset with the px4 common startup script
to make simulation testing of an airframe reset more realistic.
This commit introduces a new control mode for fixed-wing aircraft that
utilizes Euler angles for attitude control.
Additionally, a new logged topic has been added to facilitate debugging and
monitoring of the Euler rates setpoints during flight.
Recommend setting SENS_GPS_PRIME to the moving base CAN node ID
when using dual antenna GPS heading. The rover receiver in a
moving baseline configuration can experience degraded navigation
rate and increased data latency when corrections are intermittent,
making the moving base the better primary position source.
* refactor(mixer_module): change MixingOutput to use float outputs
MixingOutput now passes float values to output drivers instead of
uint16_t. This removes the need for the 8192 offset encoding and
allows reversible motors to receive negative values directly.
* fix(mixer_module): fix float safety issues
-EscClient and voxl2_io: replace outputs[i] with fabs(outputs[i]) > 0.fto fix compilation issues
-GZMixingInterface: add explicit double cast to prevent compilation error
-PWMSim: replaced unit16 cast with lroundf given that now motors outputs can be negative and casting a negative float to unit16 is undefinder behaviour
-mixer_module: same fix of PWM (unit126 cast on negative float is undefined behaviour)
* refactor(mixer_module): float rounding suggestions
* fix(pwm_sim): fix inverted disarmed condition
* fix(mixer_module): more float rounding improvements
* fix(mixer_module_tests): use casting method which are now in drivers for rounding tests
---------
Co-authored-by: Matthias Grob <maetugr@gmail.com>
* fix(mathlib): rename euler312YawTest to match tested function
The test calls getEuler321Yaw() but was named euler312YawTest.
Fixes#22103
* test(mathlib): add unit test for getEuler312Yaw
The existing test was named euler312YawTest but actually tested
getEuler321Yaw. Rename it and add a proper test for getEuler312Yaw
that verifies the quaternion and DCM overloads agree, and that
312 and 321 yaw match for a pure-yaw rotation.
Fixes#22103
* fix(fmu-v6c): correct GPIO_VDD_3V3_SENSORS_EN macro name
VDD_3V3_SENSORS_EN() referenced GPIO_VDD_3V3_SENSORS4_EN which
does not exist. The correct macro is GPIO_VDD_3V3_SENSORS_EN.
Fixes#26454
* fix(boards): rename VDD_3V3_SENSORS4_EN to VDD_3V3_SENSORS_EN
These boards have a single sensor power rail that was incorrectly
named SENSORS4_EN (copy-paste from boards with 4 rails). Rename
to SENSORS_EN to match the actual hardware.
Boards with legitimately numbered rails (fmu-v6xrt, x25-evo,
x25-super) are not changed.
In dd2322d622, the local PressureToAltitude(pressure_pa, temperature)
was replaced with the shared getAltitudeFromPressure(pressure_pa,
pressure_sealevel_pa), but the call sites continued passing temperature
where sea-level pressure was expected. This caused the binary search to
never converge, hanging "commander calibrate baro" indefinitely.
The original function used measured temperature in its hypsometric
equation. The replacement uses standard atmosphere temperature (15C)
internally, which is sufficient since the calibration computes a
relative offset against GPS altitude.
- Pass kPressRefSeaLevelPa as the second argument instead of temperature
- Remove the now-unused temperature accumulation
- Replace unbounded while loop with iteration-capped for loop to prevent
hangs from float precision stalls, matching VehicleAirData.cpp
Subscription::update() already copies data into the destination buffer,
making the subsequent copy() call redundant. This eliminates an
unnecessary memcpy every cycle on the 400 Hz rate control loop.
Note that internally higher update rates are likely also not useful but this needs to be carefully checked with the interface. It seems like the ADSB driver keeps track of what to publish when which is not a scalable/well-testable solution.
Add a CITATION.cff file so GitHub shows a "Cite this repository"
button. Lists the project founder and "The PX4 Contributors",
linking to the Zenodo concept DOI (10.5281/zenodo.595432).
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
- Use %*s in state_listing() to skip filepath that was parsed but never used
- Remove unused opendir()/closedir() in log_entry_from_id()
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
- Size LogEntry.filepath to PX4_MAX_FILEPATH instead of hardcoded 60 bytes
- Add width specifier to sscanf calls to prevent buffer overflow
- Move platform defines from .cpp to .h for reuse
- Add static_assert to enforce scanf width < buffer size at compile time
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
RunsOn v2.12.0 (March 6, 2026) removed v1 cache toolkit support,
causing the buildx GHA cache proxy to return 404 for v1 endpoints.
This has broken container builds on main since March 12.
Removing the explicit version=1 parameter lets buildkit auto-detect
the v2 protocol, which is the only version now supported by both
GitHub (since April 2025) and RunsOn.
First build after this change will have a cold cache.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
The mavlink_tests module was deleted in 1009268d31 but several
references were left behind, breaking builds on all targets.
Removed:
- CMakeLists.txt: add_subdirectory(mavlink_tests)
- mavlink_ftp.cpp: #include of deleted mavlink_ftp_test.h
- mavlink_ftp.h: MavlinkFtpTest forward decl and friend class
- posix-configs/SITL/init/test/test_mavlink: dead init script
- sitl_tests.cmake: sitl-mavlink CTest target
- install-voxl.sh: px4-mavlink_tests symlink
Ref: https://github.com/PX4/PX4-Autopilot/issues/26738
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Reject Zenoh payloads that exceed the expected uORB topic size plus
CDR header (4 bytes), or that are too small to contain a valid CDR
header. This prevents a stack overflow from crafted network input
where z_bytes_len(payload) controls a VLA allocation.
Fixes GHSA-69g4-hcqf-j45p
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Use logical OR (||) instead of AND (&&) in _workWrite() and _workBurst()
session validation, matching the correct logic already used in _workRead()
and _workTerminate(). The AND operator allowed operations to proceed with
an invalid session ID as long as a valid file descriptor existed.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Remove the old MAVLINK_FTP_UNIT_TEST infrastructure that has been dead
code for years (not enabled in any board config). This includes:
- src/modules/mavlink/mavlink_tests/ directory (test suite, CMakeLists)
- All #ifdef MAVLINK_FTP_UNIT_TEST blocks in mavlink_ftp.cpp
- set_unittest_worker() callback mechanism in mavlink_ftp.h
- Conditional uAvionix include in mavlink_bridge_header.h
The test suite will be ported to GTest as a follow-up.
Ref: https://github.com/PX4/PX4-Autopilot/issues/26738
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Add bounds checking in the CAN frame assembly loop to prevent a buffer
overflow when copying payloads into the Tattu12SBatteryMessage struct.
A crafted CAN frame with a corrupt payload_size could write past the
48-byte struct boundary. Also guard against payload_size of 0 which
would cause an unsigned integer underflow on the size_t subtraction.
Fixes GHSA-wxwm-xmx9-hr32
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Variable-length known packet types (CRSF_PACKET_TYPE_ELRS_STATUS,
CRSF_PACKET_TYPE_LINK_STATISTICS_TX, CRSF_PACKET_TYPE_MSP_WRITE)
bypassed the bounds check that exists for unknown packets. A crafted
packet with a large size field could overflow the 64-byte process_buffer
during QueueBuffer_PeekBuffer() in the CRC state.
Apply the same CRSF_MAX_PACKET_LEN bounds check to variable-length
known packets that already exists for unknown packets.
Fixes GHSA-mqgj-hh4g-fg5p
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Reject replies with length >= sizeof(BSTPacket) to prevent OOB read
in CRC calculation. Clamp dev_name_len to buffer size to prevent OOB
write during null termination.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
airframes.xml and all_events.json.xz on the px4-travis S3 bucket have
been stale since October 2025 because package_build_artifacts.sh had
wrong paths for both files after the migration from metadata.yml to
build_all_targets.yml.
- airframes.xml: SITL builds produce it under docs/, not at the build
root (only NuttX does that). Use explicit file checks to try both.
- all_events.json.xz: was copied flat into artifacts/$build_dir/ but
the _general section expected it under events/. Preserve the
subdirectory so the copy to _general/ actually finds the file.
- Remove duplicate cp lines that were misleadingly commented as
"ROS 2 msgs".
- Fail with an error when critical _general metadata files are missing
rather than silently producing incomplete artifacts.
Also uploaded fresh metadata to S3 manually to unblock Flight Review.
Fixes#26713
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Add explicit coding standards section referencing astyle and
clang-tidy enforcement. Add formal test policy requiring tests
where practical and types of tests table.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Update supported versions to 1.16.x, add response process with
7-day acknowledgment timeline, reporter credit policy, and secure
development practices section.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* docs(mavlink): add security hardening guide for production deployments
Add a dedicated security hardening page covering MAVLink authentication
risks, a hardening checklist (enable signing, secure physical access,
secure network links), and integrator responsibility for deployment
security. Add a warning block to the main MAVLink page linking to the
new guide.
---------
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* docs(ekf2): clarify EKF2_HGT_REF param description
To me it was not obvious that with EKF2_GPS_CTRL=0 this altitude
initialisation based on GPS again does not apply.
* docs(ekf2): separate paragraph
description: Create a conventional commit for PX4 changes
disable-model-invocation: true
argument-hint: "[optional: description of changes]"
allowed-tools: Bash, Read, Glob, Grep
---
# PX4 Conventional Commit
Create a git commit: `type(scope): description`
**NEVER add Co-Authored-By lines. No Claude attribution in commits.**
Follow [CONTRIBUTING.md](../../CONTRIBUTING.md) for full project conventions.
## Steps
1.**Read [CONTRIBUTING.md](../../CONTRIBUTING.md)** for commit message format, types, scopes, and conventions.
2. Check branch (`git branch --show-current`). If on `main`, create a feature branch. Use `<username>/<description>` format where `<username>` comes from `gh api user --jq .login`. If unavailable, just use `<description>`.
3. Run `git status` and `git diff --staged`. If nothing staged, ask what to stage.
4. Follow the commit message convention from CONTRIBUTING.md: pick the correct **type** and **scope**, write a concise imperative description.
5. Body (if needed): explain **why**, not what.
6. Run `make format` or `./Tools/astyle/fix_code_style.sh <file>` on changed C/C++ files before committing.
7. Check if GPG signing is available: `git config --get user.signingkey`. If set, use `git commit -S -s`. Otherwise, use `git commit -s`.
8. Stage and commit. No `Co-Authored-By`.
If the user provided arguments, use them as context: $ARGUMENTS
description: Create a pull request with conventional commit title and description
disable-model-invocation: true
argument-hint: "[optional: target branch or description]"
allowed-tools: Bash, Read, Glob, Grep
---
# PX4 Pull Request
**No Claude attribution anywhere (no Co-Authored-By, no "Generated with Claude").**
Follow [CONTRIBUTING.md](../../CONTRIBUTING.md) for full project conventions.
## Steps
1. Check branch. If on `main`, create a feature branch. Use `<username>/<description>` format where `<username>` comes from `gh api user --jq .login`. If unavailable, just use `<description>`.
3. PR **title**: `type(scope): description` — under 72 chars, describes the overall change across all commits. This becomes the squash-merge commit message.
4. PR **body**: brief summary + bullet points for key changes. No filler.
5. Push with `-u` if needed, then `gh pr create`. Default base is `main` unless user says otherwise.
6. Return the PR URL.
If the user provided arguments, use them as context: $ARGUMENTS
description: Rebase a branch onto main, handling squash-merged parent branches cleanly
argument-hint: "[optional: branch name, defaults to current branch]"
allowed-tools: Bash, Read, Glob, Grep, Agent
---
# Rebase Branch onto Main
Rebase the current (or specified) branch onto `main`, correctly handling the case where the branch was built on top of another branch that has since been squash-merged into `main`.
## Background
When a parent branch is squash-merged, its individual commits become a single new commit on `main` with a different hash. A normal `git rebase main` will try to replay the parent's original commits, causing messy conflicts. The fix is to **cherry-pick only the commits unique to this branch** onto a fresh branch from `main`.
## Steps
1.**Identify the branch.** Use `$ARGUMENTS` if provided, otherwise use the current branch.
2.**Fetch and update main:**
```
git fetch origin main:main
```
3. **Find the merge base** between the branch and `main`:
```
git merge-base <branch> main
```
4. **List all commits** on the branch since the merge base:
```
git log --oneline <merge-base>..<branch>
```
5. **Identify which commits are unique to this branch** vs. inherited from a parent branch. Look for:
- Squash-merged commits on `main` that correspond to a group of commits at the bottom of the branch's history (check PR titles, commit message keywords).
- The boundary commit: the first commit that belongs to *this* branch's work, not the parent's.
- If ALL commits are unique (no parent branch), just do a normal `git rebase main` and skip the rest.
6. **Create a fresh branch from `main`:**
```
git checkout -b <branch>-rebase main
```
7. **Cherry-pick only the unique commits** (oldest first):
```
git cherry-pick <first-unique-commit>^..<branch>
```
The `A^..B` range means "from the parent of A through B inclusive."
8. **Handle conflicts** if any arise during cherry-pick. Resolve and `git cherry-pick --continue`.
9. **Replace the old branch:**
```
git branch -m <branch> <branch>-old
git branch -m <branch>-rebase <branch>
```
10. **Verify** the result:
```
git log --oneline main..<branch>
```
Confirm only the expected commits are present.
11. **Ask the user** before force-pushing. When approved:
The [developer guide](https://docs.px4.io/main/en/development/development.html) explains how to set up the development environment on Mac OS, Linux or Windows. Please take note of our [coding style](https://docs.px4.io/main/en/contribute/code.html) when editing files.
The [developer guide](https://docs.px4.io/main/en/development/development.html) explains how to set up the development environment on Mac OS, Linux or Windows.
### Coding standards
All C/C++ code must follow the [PX4 coding style](https://docs.px4.io/main/en/contribute/code.html). Formatting is enforced by [astyle](http://astyle.sourceforge.net/) in CI (`make check_format`). Code quality checks run via [clang-tidy](https://clang.llvm.org/extra/clang-tidy/). Pull requests that fail either check will not be merged.
Python code is checked with [mypy](https://mypy-lang.org/) and [flake8](https://flake8.pycqa.org/).
## Commit message convention
@@ -141,6 +147,20 @@ git push --force-with-lease
## Test your changes
PX4 is safety-critical software. All contributions must include adequate testing where practical:
- **New features** must include unit tests and/or integration tests that exercise the new functionality, where practical. Hardware-dependent changes that cannot be tested in SITL should include bench test or flight test evidence.
- **Bug fixes** must include a regression test where practical. When automated testing is not feasible (hardware-specific issues, race conditions, etc.), provide a link to a flight log demonstrating the fix and the reproduction steps for the original bug.
- **Reviewers** will verify that tests or test evidence exist before approving a pull request.
Since we care about safety, we will regularly ask you for test results. Best is to do a test flight (or bench test where it applies) and upload the log file from it (on the microSD card in the logs directory) to Google Drive or Dropbox and share the link.
The following is a list of versions the development team is currently supporting.
The following versions receive security updates:
| Version | Supported |
| ------- | ------------------ |
| 1.4.x | :white_check_mark: |
| 1.3.3 | :white_check_mark: |
| < 1.3 | :x: |
| 1.16.x | :white_check_mark: |
| < 1.16 | :x: |
## Reporting a Vulnerability
We currently only receive security vulnerability reports through GitHub.
We receive security vulnerability reports through GitHub Security Advisories.
To begin a report, please go to the top-level repository, for example, PX4/PX4-Autopilot,
and click on the Security tab. If you are on mobile, click the ... dropdown menu, and then click Security.
To begin a report, go to the [PX4/PX4-Autopilot](https://github.com/PX4/PX4-Autopilot) repository
and click on the **Security** tab. If you are on mobile, click the **...** dropdown menu, then click **Security**.
Click Report a Vulnerability to open the advisory form. Fill in the advisory details form.
Make sure your title is descriptive, and the development team can find all of the relevant details needed
to verify on the description box. We recommend you add as much data as possible. We welcome logs,
screenshots, photos, and videos, anything that can help us verify and identify the issues being reported.
Click **Report a Vulnerability** to open the advisory form. Fill in the advisory details form.
Make sure your title is descriptive and the description contains all relevant details needed
to verify the issue. We welcome logs, screenshots, photos, and videos.
At the bottom of the form, click Submit report. The maintainer team will be notified and will get back to you ASAP.
At the bottom of the form, click **Submit report**.
## Response Process
1.**Acknowledgment**: The maintainer team will acknowledge your report within **7 days**.
2.**Triage**: We will assess severity and impact and communicate next steps.
3.**Disclosure**: We coordinate disclosure with the reporter. We follow responsible disclosure practices and will credit reporters in the advisory unless they request anonymity.
If you do not receive acknowledgment within 7 days, please follow up by emailing the [release managers](MAINTAINERS.md).
## Secure Development Practices
The PX4 development team applies the following practices to reduce security risk:
- **Code review**: All changes require peer review before merging.
- **Static analysis**: [clang-tidy](https://clang.llvm.org/extra/clang-tidy/) runs on every pull request with warnings treated as errors.
- **Fuzzing**: A daily fuzzing pipeline using [Google fuzztest](https://github.com/google/fuzztest) tests MAVLink message handling and GNSS driver protocol parsing.
- **Input validation**: All external inputs (MAVLink messages, RC signals, sensor data) are validated against expected ranges before use.
- **Compiler hardening**: Builds use `-Wall -Werror`, stack protectors, and other hardening flags where supported by the target platform.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.