mirror of
https://github.com/PX4/PX4-Autopilot.git
synced 2026-07-26 16:28:06 +08:00
5cfcdd2401b8eccd7f691612fa4e271740df8d92
18 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
PX4 BuildBot
|
5cfcdd2401 | update all px4board kconfig | ||
|
DuoYuWang
|
05be273a35 |
fix(boards): enable CONFIG_FS_LARGEFILE for NuttX boards with MMC/SD (#28043)
* boards: enable CONFIG_FS_LARGEFILE for NuttX boards with MMC/SD
Without large file support, fsblkcnt_t/off_t are 32-bit and statfs
consumers (procfs /fs/usage, df) compute the volume size as
f_bsize * f_blocks in 32 bits, which wraps at 4GB. Boards with an
SD card or eMMC larger than 4GB report the wrong capacity, e.g. a
32GB SD card on FMU-V6X:
nsh> ls -l /dev/mmcsd0
brw-rw-rw-1850212352 /dev/mmcsd0 (= 31914983424 mod 2^32)
nsh> df -h
vfat 1749M 240K 1749M /fs/microsd
With CONFIG_FS_LARGEFILE=y the same card reports the full 29G.
This enables the option on the 77 boards that build the MMC/SD block
driver (CONFIG_MMCSD=y, SDIO or SPI). Boards without removable storage
and constrained-flash targets (CONFIG_BOARD_CONSTRAINED_FLASH=y) are
left unchanged.
Note: on the px4_firmware_nuttx-10.3.0+ branch the 64-bit file types
are additionally gated on CONFIG_HAVE_LONG_LONG, which is only defined
via nuttx/compiler.h include order, making the option unreliable. That
gating is fixed by the companion NuttX backport PR
(PX4/NuttX, branch backport-fs-largefile, upstream commit 92b2f1bd3d3).
Tested on a custom STM32H743 board with 8GB eMMC and on FMU-V6X with a
32GB SD card.
* fix(boards): enable CONFIG_FS_LARGEFILE for MMC/SD variant configs
The test/console/stackcheck/socketcan/sysview/cyphal/debug/cryptotest
variant configs of boards covered by the previous commit were missed,
leaving them with 32-bit off_t. fmu-v5 protected is intentionally
excluded: protected-mode syscall proxies keep 32-bit widths.
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
* chore(nuttx): bump submodule for FS_LARGEFILE backport
Picks up the backport of upstream NuttX 92b2f1bd3d3, which gates the
64-bit file types on CONFIG_FS_LARGEFILE alone instead of the
include-order-dependent CONFIG_HAVE_LONG_LONG.
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
---------
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
Co-authored-by: Jacob Dahl <dahl.jakejacob@gmail.com>
|
||
|
Claudio Chies
|
d63f30c612 |
feat(failure_injection): Enable failure-injection on hardware, and through RC-switch (#27832)
* feat(failure_injection): integrate failure injection support across sensor drivers * feat(failure_injection): enhance failure injection with RC switch support and instance bitmasking feat(failure_injection): add disabled failure injection manager and system command support for v5x and v6x boards * feat(failure_injection): add battery failure injection Add a value-mutating apply-site for FAILURE_UNIT_SYSTEM_BATTERY. On an injected OFF the outgoing battery_status is reported as a depleted pack (zero remaining, emergency warning) so the low-battery failsafe triggers. The apply-site lives in the shared Battery library, covering the analog ADC, INA power monitors, ESC battery and SITL in one place, plus the UAVCAN battery driver which publishes battery_status directly. The previous SITL-only hack in BatterySimulator is removed in favour of this shared path so simulation and hardware behave identically. * fix(failure_injection): change parameter types from int32 to enum * refactor(failure_injection): disable failure injection manager and system commands across multiple boards * feat(failure_injection): enhance failure injection with timestamp handling and message-less support * refactor(failure_injection): simplify has_timestamp_sample implementation and remove unused includes * refactor(failure_injection):move conditional compilation into helper libary * refactor(failure_injection): update CMakeLists to include failure_injection dependency across multiple drivers --------- Co-authored-by: Claudio Chies <chiesc@chies.com> |
||
|
Roman Bapst
|
40e61d2429 |
feat(navigator): Geofence Aware RTL (#27145)
Plan RTL paths that route around geofence boundaries — both inclusion and exclusion zones — instead of flying straight through them and breaching. The planner builds a visibility graph over the margin-inflated geofence polygons and circles and runs Dijkstra to find the shortest legal return path, falling back to a straight line to the destination when no valid path exists. Highlights: - New reusable libraries: src/lib/dijkstra (generic shortest path) and src/lib/geofence (fixed-point geometry, polygon inflation, bitangent visibility); the RTL planner lives in navigator/RTLPlanner. - Visibility graph keeps only bitangent edges and skips edges that poke into a forbidden region, greatly reducing edge-cost computation. - Corner splitting is limited to sharp convex corners. - Geometry validation: reject self-intersecting polygons and vertices outside the fixed-point range; centimeter fixed-point scaling keeps orientation tests exact and avoids drift at large distances. - Failure handling: a Status enum replaces silent bool returns, and failures (unbuildable fence, planner capacity overflow, dataman load errors, NaN waypoints, destinations that breach the fence) are surfaced to the operator via MAVLink warnings/criticals; the planner falls back to a straight-line RTL. - Destination updates are centralized in RTL::setRtlTypeAndDestination; the path is replanned only when the destination or geometry changes. - VTOLs always use the fixed-wing margin (FW loiter radius). - kMaxNodes is exposed as a Kconfig option (default 100); the feature is disabled on flash-constrained boards (FMUv4 and older, various F4/F7). - Tests: unit tests for the Dijkstra lib, geofence geometry utils, and the avoidance planner, plus a MAVSDK SITL test flying an RTL through a geofence. - Documentation: new "Geofence Awareness" section in the RTL docs. Co-authored-by: Balduin <balduin@auterion.com> |
||
|
Julian Oes
|
225c1b70ef |
fix(mavlink): require CONFIG_PTHREAD_MUTEX_TYPES for recursive send mutex
The per-channel send mutex is genuinely recursive: callers hold lock_send() while the MAVLink C library re-enters send_start()/send_finish() on the same mutex via MAVLINK_START_UART_SEND. On NuttX a recursive mutex only works with CONFIG_PTHREAD_MUTEX_TYPES; without it pthread_mutexattr_settype() is a no-op and the nested lock deadlocks. Only a handful of boards happened to enable the option (for Zenoh), so mavlink could deadlock at startup on most boards, e.g. when bringing up a USB link. Enable CONFIG_PTHREAD_MUTEX_TYPES on the NuttX boards that build mavlink, add a compile-time guard so a board missing the option fails the build loudly instead of deadlocking silently, and check the settype() return. Enabling the option is free in flash and RAM on these boards since they already enable CONFIG_PRIORITY_INHERITANCE / CONFIG_PTHREAD_MUTEX_ROBUST. Signed-off-by: Julian Oes <julian@oes.ch> |
||
|
Claudio Chies
|
f937bd5818 |
refactor(failure_injection): centralize MAV_CMD_INJECT_FAILURE behind a manager module (#27572)
* feat(failure_injection): add failure_injection topic and helper library * feat(failure_injection): add failure injection manager module * refactor(commander): route motor failure injection through the manager * refactor(simulation): route sensor sim failure injection through the manager * refactor(simulation): route SimulatorMavlink failure injection through the manager * feat(failure_injection): start the manager in the SITL startup * docs(failure_injection): document per-simulator failure support * feat(failure_injection): enhance failure injection management and configuration * fix(rebase): baro failure injectionb * refactor(failure_injection): simplify FailureInjectionManager and FailureTable implementations * refactor(failure_injection): replace Subscriber with Config in various modules and add update method * update(uorb): FailureInjection.msg to docs standard * docs(docs): subedit * fix(failure_injection): correct comment formatting in FailureInjection.msg * feat(failure_injection): add failure injection manager support across multiple boards and modules * feat(mavlink): implement failure injection functionality --------- Co-authored-by: Claudio Chies <chiesc@chies.com> Co-authored-by: Hamish Willee <hamishwillee@gmail.com> |
||
|
Vincello
|
9ef2131d3b |
feat(boards): add corvon_v5 flight controller (#26286)
* add files * add corvon_V5 docs docs: fix connectors image path * docs: address Copilot formatting suggestions * Subedit * docs: add radio control wiring details for corvon_V5 * Update docs/en/flight_controller/corvon_V5.md Co-authored-by: Hamish Willee <hamishwillee@gmail.com> * boards/corvon: rename V5 subdirectory to v5 This renames the corvon_V5 board to corvon_v5 to conform to PX4 lowercase naming conventions as requested by @mrpollo. Renames target files, docs, and assets accordingly. * Apply suggestion from @hamishwillee Co-authored-by: Hamish Willee <hamishwillee@gmail.com> * docs: add DSU7 debug port pinout and warnings for corvon_v5 This addresses reviewer feedback to include debug port information, placed immediately after the Radio Control section as requested. * Apply suggestion from @hamishwillee * fix(boards/corvon_v5): remove unused heater and temperature_compensation - heater: board has no IMU heater; fixes build after #26325 (requires HEATER_NUM) - temperature_compensation: modern IMU doesn't need it, follow #27015 Signed-off-by: holydust <holydust@live.ca> * docs(update): Subedit. Add pwm outputs and gps * Update docs/en/flight_controller/corvon_v5.md * Update docs/en/flight_controller/corvon_v5.md Co-authored-by: Hamish Willee <hamishwillee@gmail.com> * docs(corvon_v5): add UART flow control, power details, fix broken links * docs(corvon_v5): fix UART table typo * fix(boards/corvon_v5): remove unused PX4IO macros. Board has no PX4IO co-processor Signed-off-by: holydust <holydust@live.ca> * Apply suggestions from code review Co-authored-by: Hamish Willee <hamishwillee@gmail.com> * docs(corvon_v5): update board images Signed-off-by: holydust <holydust@live.ca> * fix(corvon_v5): drop unused dshot, fix can3 and adc comments - Remove CONFIG_DRIVERS_DSHOT=y from default.px4board: DShot is not supported on this board (no IO timer is DShot-configured) and the docs already state it as unsupported. - Fix ADC1_IN8 GPIO list comment from PB8 to PB0 (PB0 is the correct pin on STM32F765; matches GPIO_RSSI_IN definition below). - Clarify CAN3 comment in nuttx-config board.h: the pins are unused on CORVON_V5 (no transceiver populated). manifest.c already marks CAN3 as not present. - Update corvon_v5_pinout.xlsx 'All Pinouts' sheet so PA7 (HEATER) and PA8/PA15/PH4 (CAN3 RX/TX/SILENT) read 'Unused', matching the actual hardware. Signed-off-by: holydust <holydust@live.ca> * fix(corvon_v5): use MCS Electronics USB VID/PID Set VID/PID to 0x16D0/0x152A (MCS Electronics) in the app defconfig and regenerate the bootloader binary, replacing the 3DR FMUv5 IDs inherited from the reference config. Signed-off-by: holydust <holydust@live.ca> --------- Signed-off-by: holydust <holydust@live.ca> Co-authored-by: Hamish Willee <hamishwillee@gmail.com> |
||
|
Jacob Dahl
|
6849612e97 |
fix(boards): update STM32H7 bootloaders with ECC scrub and enable bl_update (#27715)
* fix(boards): update STM32H7 bootloaders with ECC scrub and enable bl_update The committed extras/*_bootloader.bin for every STM32H7 flash-parameter target predate #27642, so none carry the uncorrectable-flash-ECC scrub that keeps a torn parameter-flash write from bricking the board on every boot. Rebuild each bootloader from current main with the release toolchain (GCC 13.2.1) and enable CONFIG_SYSTEMCMDS_BL_UPDATE so the fix can be applied in the field via SYS_BL_UPDATE without a debugger; the ~40-45 KB image is embedded in ROMFS only when the option is on. ark/fpv drops LANDING_TARGET_ESTIMATOR to fit the embedded image, x-mav/ap-h743v2 gets its first committed bin, and a stray duplicate bootloader bin is removed from kakuteh7dualimu/extras. Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com> * fix(boards): remove SCH16T from ARK FPV mavlink-dev.px4board --------- Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com> |
||
|
Vincello
|
868fd1bb6b |
fix(boards/corvon_743v2): correct analog airspeed ADC macro (#27628)
Rename ADC_AIRSPEED_IN_CHANNEL to ADC_AIRSPEED_VOLTAGE_CHANNEL so the sensors module actually picks up the analog airspeed input. Drop the redundant CBRK_IO_SAFETY default. Fix linker script comments inherited from the Durandal template (wrong MCU variant, nonexistent boot switch). Note that M10 (TIM4_CH4) has no capture DMA, so no BDShot. |
||
|
Vincello
|
f808ed1560 |
feat(boards): add corvon_743v2 flight controller (#27569)
feat(boards): add corvon_743v2 flight controller + Documentation Co-authored-by: Hamish Willee <hamishwillee@gmail.com> |
||
|
Julian Oes
|
ec8718f05e |
feat(bootloader): Revive secure-boot with example, docs, and various fixes (#27237)
* feat(secure_bootloader): add ed25519 key and signing helpers
Scaffolding for PX4 secure-boot firmware signing, split into two
self-contained scripts:
- generate_signing_keys.py: produces <name>.json (private+public hex)
for use by sign_firmware.py and <name>.pub (C-array public key)
for inclusion in the bootloader build via CONFIG_PUBLIC_KEYn.
Refuses to overwrite existing private-key files.
- sign_firmware.py: pads an input .bin to a 4-byte boundary and
appends a 64-byte ed25519 signature, producing a file that drops
directly into the flash slot described by the image TOC.
Optionally appends an R&D certificate binary after the signature.
Replaces the signing path of the old Tools/cryptotools.py that was
removed along with the log-encryption cleanup; the new layout keeps
bootloader-signing tooling separate from log encryption to avoid
confusing the two independent crypto surfaces.
* fix(bootloader): panic if px4_get_secure_random is ever called
sw_crypto's crypto_open() unconditionally references
px4_get_secure_random from its XCHACHA20 path, so even a bootloader
that only performs ed25519 signature verification (and never touches
stream ciphers) pulls in an undefined symbol at link time.
The app build resolves it through nuttx_random.c, which is gated
behind CONFIG_CRYPTO_RANDOM_POOL and only compiled in when the
NuttX random pool is enabled. That config isn't on in the tiny
bootloader NuttX defconfig, and enabling it would pull in a pile
of kernel code the bootloader doesn't need.
Supply the symbol locally, but make it call up_assert() instead of
returning zeros. Silently handing out predictable bytes would be a
serious security bug if anyone later enables the XCHACHA20 path in
the bootloader without wiring up a real RNG. Aborting makes the
mistake impossible to miss.
* fix(bootloader): add PROTO_VERIFY_SIG opcode for upload-time signature check
Today a signed-boot failure is invisible to the uploader: verify_app()
runs inside jump_to_app() after PROTO_BOOT has already rebooted the
chip, so the host sees a successful upload followed by the device
silently staying in the bootloader. There is no protocol-level signal
that the image that was just written is not going to run.
Add PROTO_VERIFY_SIG (0x39) so the host can ask the bootloader to run
find_toc() + verify_app(0) *before* the reboot and get a concrete
OK / FAILED / INVALID answer back over the still-open USB connection.
The new opcode is gated on BOOTLOADER_USE_SECURITY: bootloaders built
without secure boot return cmd_bad (INSYNC/INVALID) so an uploader
can tell "I don't know this command" apart from "verification failed".
Two subtleties required care:
1. PROG_MULTI deliberately defers the very first word of the app
image to a RAM variable (first_word) and only commits it to flash
inside PROTO_BOOT, so a partial upload can never become bootable.
But verify_app() reads directly from flash, so if we verified
before committing first_word, even a valid image would always
fail (the first four bytes at APP_LOAD_ADDRESS would still be
0xffffffff). The handler therefore mirrors the first half of the
PROTO_BOOT handler: gate on STATE_ALLOWS_REBOOT, program the
deferred first word, then run the crypto check.
2. On failure we deliberately do not try to "undo" the first-word
write — H7 flash programming granularity makes it impossible to
revert in place, and the device was going to end up in the same
reject state at the next boot either way. The improvement is
purely that the uploader sees the failure before REBOOT instead
of after.
Chose opcode 0x39 to stay clear of ArduPilot's 0x28 (READ_MULTI) and
0x40 (CHIP_FULL_ERASE), which PX4 does not currently use but which
an AP-compatible uploader might.
ArduPilot also has bootloader secure boot (monocypher ed25519, like
us) but their verification runs at boot time, not upload time — so
neither project currently solves the "upload silently wrote a bad
image" problem. This puts PX4 ahead on that.
* feat(Tools): add --image_signed to mark signed firmware for uploader
px_uploader.py only needs to run signature verification over USB for
images that actually carry a signature — asking the bootloader to
verify an unsigned image would always fail, and the extra round trip
is wasted time for the common unsigned case. It therefore needs a
reliable way to tell the two apart.
We cannot tell by inspecting the bytes: a sign_firmware.py output is
just the raw .bin with 64 bytes of ed25519 signature glued on the
end, indistinguishable in content from an unsigned image of the same
padded length. The natural place to put the flag is the .px4 JSON
envelope, which already carries board_id / version / summary / etc.
Add --image_signed to px_mkfw.py, which sets "image_signed": true
in the emitted JSON. The flag has no effect on what bytes actually
end up on the device — it just tells the uploader "this blob has a
signature, please verify it before booting".
* feat(Tools): verify firmware signature before reboot
After PROG_MULTI + GET_CRC, send a new VERIFY_SIG opcode (0x39) to
the bootloader to check the ed25519 signature over the freshly
flashed image *before* sending REBOOT. This way a signature failure
is reported as a clean error from the uploader script, instead of a
silent "device stays in bootloader after reboot" that leaves the user
guessing.
The uploader always probes VERIFY_SIG. The bootloader is the source
of truth for whether secure boot is enabled:
- INSYNC/OK -> verification passed, proceed to REBOOT
- INSYNC/FAILED -> raise; "Signature does not verify against any
trusted key" if the firmware claims to be signed,
"Secure bootloader rejected an unsigned image"
otherwise (= helpful guidance for the common
misconfiguration of uploading default firmware
to a secureboot bootloader)
- INSYNC/INVALID -> bootloader has no secure boot. Quietly proceed
unless the firmware metadata says image_signed,
in which case raise.
- recv timeout -> assume a pre-VERIFY_SIG bootloader, proceed.
Surfaces a "Verifying image signature... passed" line on the upload
status path when the firmware is marked signed, so users get a clear
positive signal that the secure-boot pipeline ran end-to-end.
Also drop the redundant logger.error in the upload() loop, which was
duplicating the error message printed by the top-level handler in
main() for every UploadError path (not specific to verify_signature,
but only became obvious once these clean error messages started
firing in normal usage).
* fix(cmake): fix .px4board variant resolution to require exact match
px4_config.cmake matched the requested CONFIG against each candidate
.px4board with `MATCHES`, which is a regex partial match. For a
config like `px4_fmu-v6x_bootloader_secureboot`, the iteration over
.px4board files (alphabetical glob order) would match
`bootloader.px4board` first — because "px4_fmu-v6x_bootloader" is a
prefix of "px4_fmu-v6x_bootloader_secureboot" — and stop, silently
selecting the wrong board config.
Use `STREQUAL` instead so each candidate has to match the full
requested CONFIG. Existing single-label cases (e.g. exact match on
`px4_fmu-v2_default` or `px4_fmu-v2`) are unaffected because they
were already exact in practice; this just plugs the prefix-match
hole that any future `<label>_<suffix>` variant would trip over.
* fix(nuttx): support bootloader_<variant> labels
Boards can ship bootloader variants beyond the default `bootloader`
label — e.g. a `bootloader_secureboot` that adds crypto + keystore
Kconfig on top of the same source tree. Two pieces of build glue
were hardcoded to the exact label `bootloader` and need to relax to
match any `bootloader_*` label:
1. platforms/nuttx/CMakeLists.txt picked the bootloader linker
script and bootloader-specific library list only when the label
was exactly `bootloader`. Any other label (including
`bootloader_secureboot`) silently fell through to the app build,
producing nonsensical link flags. Match `^bootloader` instead,
and explicitly set SCRIPT_PREFIX to `bootloader_` so all
bootloader variants share the single existing linker script
regardless of their full label.
2. platforms/nuttx/cmake/px4_impl_os.cmake selects the NuttX config
subdirectory by exact label match, falling back to `nsh` when no
matching directory exists. For `bootloader_secureboot` that fell
through to `nsh`, dragging in a full app-style NuttX with cromfs,
networking, and the full heap subsystem — a 128 KB bootloader
sector overflowed by ~50 KB. Add an intermediate fallback: if the
label starts with `bootloader` and a `bootloader/` subdir exists,
use that instead of `nsh`.
Both changes are backward-compatible: existing single-label
`bootloader` builds take exactly the same path as before. They only
gain the ability for boards to add `bootloader_<suffix>.px4board`
files without duplicating bootloader build wiring.
* feat(build): auto-sign secure-boot images via BOARD_SECUREBOOT
Add a Kconfig pair that boards can opt into:
CONFIG_BOARD_SECUREBOOT -- bool: sign the .px4 with ed25519
CONFIG_BOARD_SECUREBOOT_KEY -- string: path to JSON private key
(default: Tools/test_keys/test_keys.json)
When set, the .px4 build rule inserts a Tools/secure_bootloader/sign_firmware.py
step between the unsigned .bin and px_mkfw.py, and passes --image_signed
so the .px4 envelope's metadata flags it for the uploader's VERIFY_SIG
step. The unsigned .bin is still produced alongside the .px4, so users
can sign with their own key out-of-tree if they prefer.
A BOARD_SECUREBOOT_KEY environment variable overrides the Kconfig path
at build time, mirroring the override pattern used for CONFIG_PUBLIC_KEYn
in stub_keystore. This makes release builds practical:
BOARD_SECUREBOOT_KEY=/secure/path/release.json make px4_<board>_secureboot
Relative paths in the Kconfig are resolved against the repo root (not
the build directory) so the same value works regardless of where the
build runs from.
Default builds are byte-identical to before; the new code path is gated
on CONFIG_BOARD_SECUREBOOT being set.
* feat(boards): add secureboot demo variant + docs
Two coordinated build variants demonstrate end-to-end secure boot
on px4_fmu-v6x without touching the default builds:
px4_fmu-v6x_secureboot -- the app, with TOC + signing
px4_fmu-v6x_bootloader_secureboot -- the matching secure bootloader
App side (secureboot.px4board):
- Selects nuttx-config/scripts/secureboot-script.ld via
CONFIG_BOARD_LINKER_PREFIX. The script is a copy of the default
layout plus a fixed 0x800 reservation past the vector table for
the image TOC, and an empty .signature section at end-of-FLASH
so sign_firmware.py knows where the appended ed25519 signature
will land.
- Compiles src/toc.c (a four-entry IMAGE_MAIN_TOC matching the
layout used elsewhere in the tree) into drivers_board, gated on
PX4_BOARD_LABEL == secureboot so the default build still
produces the existing layout.
- Sets CONFIG_BOARD_SECUREBOOT=y so the .px4 build rule signs the
image with the upstream test key by default.
Bootloader side (bootloader_secureboot.px4board):
- Enables CONFIG_BOARD_CRYPTO + DRIVERS_SW_CRYPTO + DRIVERS_STUB_KEYSTORE,
which links monocypher and the stub keystore into the bootloader.
- Bakes Tools/test_keys/key0.pub in as CONFIG_PUBLIC_KEY0, paired
with the test_keys.json the app variant signs with.
- hw_config.h gates BOOTLOADER_USE_SECURITY, BOOTLOADER_SIGNING_ALGORITHM
(CRYPTO_ED25519), and BOARD_IMAGE_TOC_OFFSET (0x800) on PX4_CRYPTO,
so they only activate in this variant.
Together the two variants implement the workflow:
make px4_fmu-v6x_bootloader_secureboot # build + flash via SWD once
make px4_fmu-v6x_secureboot upload # signs with test key, verifies
Bootloader fits in 128 KB (~57 KB used) thanks to --gc-sections
stripping the unused libtomcrypt code; nothing in the bootloader
binary depends on monocypher beyond the ed25519 verifier.
Replace the bundled test key for production with
Tools/secure_bootloader/generate_signing_keys.py output and update
both .px4board files (or set BOARD_SECUREBOOT_KEY at build time) —
see docs/en/advanced_config/bootloader_secure_boot.md.
* fix(boards): cap H7 bootloader linker scripts at 128 KB
Roughly half of the H7 boards in tree had `LENGTH = 2048K` for the
bootloader sector in their bootloader_script.ld, even though the
matching app linker script places APP_LOAD_ADDRESS at 0x08020000 —
i.e. the bootloader actually only owns the first 128 KB sector.
The 2048K constraint is wrong: it lets a bootloader that grew past
the 128 KB sector silently overflow into the app sector at link
time and corrupt the start of the app on flash. The linker should
fail the build instead.
The current default bootloader is ~46 KB, well under 128 KB on every
affected board, so this change is a no-op for default builds. It
just plugs a footgun for anyone adding bootloader features (secure
boot, extra UI, network boot, ...) that would have otherwise
silently grown into the app's flash range.
Boards fixed:
3dr-style H7 reference boards: cubepilot/cubeorange,
cubepilot/cubeorangeplus, holybro/durandal-v1, narinfc/h7
vendor variants: corvon/743v1, cuav/nora, cuav/x7pro,
gearup/airbrainh743, hkust/nxt-dual, hkust/nxt-v1,
matek/h743, matek/h743-mini, matek/h743-slim,
micoair/h743, micoair/h743-aio, micoair/h743-lite,
micoair/h743-v2, x-mav/ap-h743r1, x-mav/ap-h743v2
Boards already correct (LENGTH = 128K) are unchanged.
* fix(ci): add pynacl to Python requirements
Tools/secure_bootloader/sign_firmware.py uses PyNaCl for ed25519
signing, and the .px4 build rule for boards with CONFIG_BOARD_SECUREBOOT
calls it as part of the normal build (e.g. px4_fmu-v6x_secureboot).
Without pynacl in the dev requirements, those builds fail in CI and
fresh dev setups.
* docs(update): Subedit
* docs(update): Fix example error I made
* fix(docs): document BOOT and SIG1 regions
* fix(platforms): style fix
* fix(ci): workaround to get pip dependency
* fix(ci): fall back to plain pip on older build containers
The voxl2 build image ships a pip that predates --break-system-packages
(added in pip 23.0.1), so the install step blew up with "no such option".
Modern containers enforce PEP 668 and need the flag; older ones don't
support it but also don't enforce PEP 668, so plain pip works there.
Try the modern flag first, fall back if pip rejects it.
Signed-off-by: Julian Oes <julian@oes.ch>
* fix(build): strip BUILD_DIR_SUFFIX from CONFIG in cmake-build
cmake-build was passing the full build-dir name (including any
BUILD_DIR_SUFFIX like _replay or _failsafe_web) as -DCONFIG=, which
the board-lookup in cmake/px4_config.cmake then tried to match
against <vendor>_<model>_<label> .px4board files. That used to work
by accident because px4_config.cmake matched with regex MATCHES, but
since the switch to STREQUAL (needed to disambiguate
bootloader_secureboot from bootloader) the suffixed CONFIG no longer
matches anything and LABEL ends up empty, tripping a CMake error in
kconfig.cmake.
Pass the bare CONFIG and keep the suffix only on the build dir so
both concerns are independent.
Signed-off-by: Julian Oes <julian@oes.ch>
---------
Signed-off-by: Julian Oes <julian@oes.ch>
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
|
||
|
Julian Oes
|
1a3d232e7b |
fix(bootloader): remove broken PROTO_SET_DELAY boot-delay feature (#27081)
The bootloader boot-delay feature has been mechanically broken on every modern FMU board since the STM32F7/H7 transition. It has three independent bugs that prevent it from ever working: 1. Offset mismatch: BOOT_DELAY_ADDRESS is hardcoded to 0x1a0, but the NuttX vector table is 504 B (F76x) to 664 B (H743) long. The linker places _bootdelay_signature at ALIGN(32) past end of vectors (e.g. 0x2a0 on CubeOrange), never at 0x1a0. The bootloader reads random exception_common pointers in place of the magic and never matches BOOT_DELAY_SIGNATURE1/2. Verified on CubeOrange with objdump of cubepilot_cubeorange_default.elf. 2. Flash cache never flushes: fc_write() stores arbitrary writes in cache line 1 and only flushes on a very specific condition tied to the sequential firmware upload flow. A standalone write during PROTO_SET_DELAY is cached forever. fc_read() then returns the cached value, so the post-write verify lies and the bootloader reports success. Nothing ever reaches flash. 3. H7 write granularity: the STM32H7 flash controller requires a full 32-byte program cycle per write. Single 32-bit writes from flash_func_write_word() would not be accepted by the controller even if they reached it. The feature has been silently dead on every H7/F7 FMU board for years and no one noticed, which is strong evidence nothing actually depends on it. Rather than fix it (which would mean rewriting PROTO_SET_DELAY, the flash cache path, and the H7 flash programming path), remove it. Changes: - bl.c: PROTO_SET_DELAY case now immediately NACKs (goto cmd_bad) so clients that still send the command get a clear rejection instead of the previous silent fake-success. The opcode stays in the protocol enum for backwards compatibility. - bl.h: drop BOOT_DELAY_SIGNATURE1/2 and BOOT_DELAY_MAX. - stm/stm32_common/main.c, nxp/imxrt_common/main.c: drop the startup boot-delay sig check block. - image_toc.c: decouple find_toc() from BOOT_DELAY_ADDRESS. BOARD_IMAGE_TOC_OFFSET is now the required define when BOOTLOADER_USE_TOC is enabled. The body is wrapped in #ifdef BOOTLOADER_USE_TOC and falls back to a stub returning false when the TOC is not in use (no upstream board currently enables it). - Linker scripts: strip EXTERN(_bootdelay_signature) and the FILL/. += 8 block from all 142 affected .ld files across boards/. - hw_config.h: strip the #define BOOT_DELAY_ADDRESS and its comment block entry from all 48 affected boards. - Tools/px4_uploader.py, Tools/teensy_uploader.py: remove --boot-delay, set_boot_delay(), and SET_BOOT_DELAY client-side counterpart. Smoke-built on cubepilot_cubeorange_default and cubepilot_cubeorange_bootloader; no link errors, no unresolved symbols, flash usage unchanged. Tested: - New BL, new FW - Old BL, old FW - Old BL, new FW - New BL, old FW |
||
|
Julian Oes
|
cc19b1f52c |
fix(boards): remove default SYS_AUTOSTART from generic autopilot boards (#27052)
These are generic flight controller boards (not drone-specific products), so they should not come with a pre-selected airframe like every other PX4 board. Drop the SYS_AUTOSTART default, matching the convention used across the rest of the tree. Drone-specific products (bitcraze/crazyflie, atl/mantis-edu) retain their default airframe. |
||
|
Andrew Brahim
|
f0453f5694 |
fix(temperature_compensation): remove temp compensation from enclosed autopilots (#27015)
* fix(temperature_compensation): remove temp compensation from enclosed autopilots Signed-off-by: dirksavage88 <dirksavage88@gmail.com> * fix(temperature_compensation): remove from 3dr/mro Signed-off-by: dirksavage88 <dirksavage88@gmail.com> * fix(temperature_compensation): remove manually from 6x default kconfig Signed-off-by: dirksavage88 <dirksavage88@gmail.com> * fix(temperature_compensation): remove from modalai fc-vx boards Signed-off-by: dirksavage88 <dirksavage88@gmail.com> * fix(temperature_compensation): remove from all other boards Signed-off-by: dirksavage88 <dirksavage88@gmail.com> * Update boards/px4/sitl/default.px4board --------- Signed-off-by: dirksavage88 <dirksavage88@gmail.com> Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com> |
||
|
Vincello
|
4cf95fdcb4 |
fix(boards): align LED indices and add docs for corvon 743v1 (#26699)
* boards: corvon 743v1 support (Docs and LED alignment) This PR addresses #24769 by providing the required official documentation, while simultaneously aligning the board's LED semantics entirely with the PX4 standard. Key Changes: - Add complete corvon 743v1 hardware documentation and manufacturer link. - Fix LED out-of-bounds bug and strictly align RGB states to Pixhawk standard (LED_BLUE=0, LED_RED=1, LED_GREEN=3). - Update bootloader pin config (hw_config.h) to use red LED for boot/error, and update pre-built bootloader.bin. * Prettier and file reduce * docs: address reviewer feedback & board ID fix * Apply suggestion from @hamishwillee Co-authored-by: Hamish Willee <hamishwillee@gmail.com> * docs: resolve final reviewer feedback (PPM, Debug Port, Manufacturer List) --------- Co-authored-by: Hamish Willee <hamishwillee@gmail.com> Co-authored-by: Ramon Roche <mrpollo@gmail.com> |
||
|
Vincello
|
b010fe904c | fix board_id | ||
|
Silvan
|
8c1f7ec7c0 |
rename FWPositionController to FWModeManager
Signed-off-by: Silvan <silvan@auterion.com> |
||
|
Vincello
|
ff8c4b918a | boards: new Corvon 743v1 board support |