* add files
* add corvon_V5 docs
docs: fix connectors image path
* docs: address Copilot formatting suggestions
* Subedit
* docs: add radio control wiring details for corvon_V5
* Update docs/en/flight_controller/corvon_V5.md
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* boards/corvon: rename V5 subdirectory to v5
This renames the corvon_V5 board to corvon_v5 to conform to PX4 lowercase naming conventions as requested by @mrpollo. Renames target files, docs, and assets accordingly.
* Apply suggestion from @hamishwillee
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* docs: add DSU7 debug port pinout and warnings for corvon_v5
This addresses reviewer feedback to include debug port information, placed immediately after the Radio Control section as requested.
* Apply suggestion from @hamishwillee
* fix(boards/corvon_v5): remove unused heater and temperature_compensation
- heater: board has no IMU heater; fixes build after #26325 (requires HEATER_NUM)
- temperature_compensation: modern IMU doesn't need it, follow #27015
Signed-off-by: holydust <holydust@live.ca>
* docs(update): Subedit. Add pwm outputs and gps
* Update docs/en/flight_controller/corvon_v5.md
* Update docs/en/flight_controller/corvon_v5.md
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* docs(corvon_v5): add UART flow control, power details, fix broken links
* docs(corvon_v5): fix UART table typo
* fix(boards/corvon_v5): remove unused PX4IO macros. Board has no PX4IO co-processor
Signed-off-by: holydust <holydust@live.ca>
* Apply suggestions from code review
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* docs(corvon_v5): update board images
Signed-off-by: holydust <holydust@live.ca>
* fix(corvon_v5): drop unused dshot, fix can3 and adc comments
- Remove CONFIG_DRIVERS_DSHOT=y from default.px4board: DShot is not
supported on this board (no IO timer is DShot-configured) and the
docs already state it as unsupported.
- Fix ADC1_IN8 GPIO list comment from PB8 to PB0 (PB0 is the correct
pin on STM32F765; matches GPIO_RSSI_IN definition below).
- Clarify CAN3 comment in nuttx-config board.h: the pins are unused
on CORVON_V5 (no transceiver populated). manifest.c already marks
CAN3 as not present.
- Update corvon_v5_pinout.xlsx 'All Pinouts' sheet so PA7 (HEATER)
and PA8/PA15/PH4 (CAN3 RX/TX/SILENT) read 'Unused', matching the
actual hardware.
Signed-off-by: holydust <holydust@live.ca>
* fix(corvon_v5): use MCS Electronics USB VID/PID
Set VID/PID to 0x16D0/0x152A (MCS Electronics) in the app defconfig
and regenerate the bootloader binary, replacing the 3DR FMUv5 IDs
inherited from the reference config.
Signed-off-by: holydust <holydust@live.ca>
---------
Signed-off-by: holydust <holydust@live.ca>
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* Add Sony AS-DT1 Distance Sensor and Documentation
* Ensuring Rotation Parameter works
* Sony ASDT1 Sensor and Documentaiton
* Fixed formatting and added additional comments
* Forgot to stage 1 formatting issue
* fix(drivers): use AS-DT1 parameters consistently
remove the Sony-ASDT1 -R command line rotation, as well as some other small fixes. Updated the docs to reflect this as well.
* refactor(drivers): clarify Sony AS-DT1 variable names
---------
Co-authored-by: Sean Hickey <sean@ascendengineer.com>
Co-authored-by: Andrew Brahim <35986980+dirksavage88@users.noreply.github.com>
Add hardware documentation for the VOLOLAND NarinFC-H7 flight controller
including pinouts, serial port mapping, PWM output groups, and analog
inputs. Fix version badge to v1.17 and clarify RC_IN is wired directly
to FMU via RC_INPUT driver.
Based on work by @vololand and @hamishwillee from PR #26542.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* feat(boards): add support for AEDROXH7 flight controller
STM32H743-based FPV / racing flight controller from AEDROX.
Brings up:
- ICM-42688-P IMU on SPI2
- DPS310 baro on internal I2C2
- W25N NAND flash on SPI3 with littlefs at /fs/flash
- MAX7456 analog OSD on SPI1
- 8 motor outputs (TIM1 + TIM8) all bidirectional-DShot capable
- CAN1
- External I2C1 connector for compass / sensors
- 6 UARTs (TEL1, GPS1, RC, TEL2, ESC telemetry, debug console on UART8),
- Two user GPIOs on the M5-M8 connector, VTX power and camera-switch GPIOs,
buzzer on PA7 (active-buzzer transistor low-side switch), battery V/I sensing
via ADC1.
Board ID 1198 shared with ArduPilot's AP_HW_AEDROXH7 entry.
USB enumerates as 0x16D0:0x14FE with VENDORSTR "AEDROX".
Signed-off-by: Julian Oes <julian@oes.ch>
* docs(docs): Minor subedit
---------
Signed-off-by: Julian Oes <julian@oes.ch>
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* feat(boards): add CBUnmanned H753-Stamp flight controller
* Update board_id to 1302
* docs: update CBUnmanned H753-Stamp board docs
Apply review feedback: correct the I2C bus count (add internal bus),
clarify SPI (IMUs on a dedicated internal bus), note the debug console
alongside the user UARTs, and describe how the board is powered from an
external 5 V supply with separate battery voltage sensing.
Add the pinout image and a PWM Outputs section.
Signed-off-by: Julian Oes <julian@oes.ch>
* refactor(boards): rename CBUnmanned H753-Stamp to H753-SOM
Rename the board directory, build target (cbunmanned_h753-som), USB
product strings, docs page, asset directory and pinout image, and the
bundled bootloader binary from -Stamp to -SOM. The hardware is a
System-on-Module, so SOM is the accurate name.
Signed-off-by: Julian Oes <julian@oes.ch>
---------
Signed-off-by: Julian Oes <julian@oes.ch>
* feat(secure_bootloader): add ed25519 key and signing helpers
Scaffolding for PX4 secure-boot firmware signing, split into two
self-contained scripts:
- generate_signing_keys.py: produces <name>.json (private+public hex)
for use by sign_firmware.py and <name>.pub (C-array public key)
for inclusion in the bootloader build via CONFIG_PUBLIC_KEYn.
Refuses to overwrite existing private-key files.
- sign_firmware.py: pads an input .bin to a 4-byte boundary and
appends a 64-byte ed25519 signature, producing a file that drops
directly into the flash slot described by the image TOC.
Optionally appends an R&D certificate binary after the signature.
Replaces the signing path of the old Tools/cryptotools.py that was
removed along with the log-encryption cleanup; the new layout keeps
bootloader-signing tooling separate from log encryption to avoid
confusing the two independent crypto surfaces.
* fix(bootloader): panic if px4_get_secure_random is ever called
sw_crypto's crypto_open() unconditionally references
px4_get_secure_random from its XCHACHA20 path, so even a bootloader
that only performs ed25519 signature verification (and never touches
stream ciphers) pulls in an undefined symbol at link time.
The app build resolves it through nuttx_random.c, which is gated
behind CONFIG_CRYPTO_RANDOM_POOL and only compiled in when the
NuttX random pool is enabled. That config isn't on in the tiny
bootloader NuttX defconfig, and enabling it would pull in a pile
of kernel code the bootloader doesn't need.
Supply the symbol locally, but make it call up_assert() instead of
returning zeros. Silently handing out predictable bytes would be a
serious security bug if anyone later enables the XCHACHA20 path in
the bootloader without wiring up a real RNG. Aborting makes the
mistake impossible to miss.
* fix(bootloader): add PROTO_VERIFY_SIG opcode for upload-time signature check
Today a signed-boot failure is invisible to the uploader: verify_app()
runs inside jump_to_app() after PROTO_BOOT has already rebooted the
chip, so the host sees a successful upload followed by the device
silently staying in the bootloader. There is no protocol-level signal
that the image that was just written is not going to run.
Add PROTO_VERIFY_SIG (0x39) so the host can ask the bootloader to run
find_toc() + verify_app(0) *before* the reboot and get a concrete
OK / FAILED / INVALID answer back over the still-open USB connection.
The new opcode is gated on BOOTLOADER_USE_SECURITY: bootloaders built
without secure boot return cmd_bad (INSYNC/INVALID) so an uploader
can tell "I don't know this command" apart from "verification failed".
Two subtleties required care:
1. PROG_MULTI deliberately defers the very first word of the app
image to a RAM variable (first_word) and only commits it to flash
inside PROTO_BOOT, so a partial upload can never become bootable.
But verify_app() reads directly from flash, so if we verified
before committing first_word, even a valid image would always
fail (the first four bytes at APP_LOAD_ADDRESS would still be
0xffffffff). The handler therefore mirrors the first half of the
PROTO_BOOT handler: gate on STATE_ALLOWS_REBOOT, program the
deferred first word, then run the crypto check.
2. On failure we deliberately do not try to "undo" the first-word
write — H7 flash programming granularity makes it impossible to
revert in place, and the device was going to end up in the same
reject state at the next boot either way. The improvement is
purely that the uploader sees the failure before REBOOT instead
of after.
Chose opcode 0x39 to stay clear of ArduPilot's 0x28 (READ_MULTI) and
0x40 (CHIP_FULL_ERASE), which PX4 does not currently use but which
an AP-compatible uploader might.
ArduPilot also has bootloader secure boot (monocypher ed25519, like
us) but their verification runs at boot time, not upload time — so
neither project currently solves the "upload silently wrote a bad
image" problem. This puts PX4 ahead on that.
* feat(Tools): add --image_signed to mark signed firmware for uploader
px_uploader.py only needs to run signature verification over USB for
images that actually carry a signature — asking the bootloader to
verify an unsigned image would always fail, and the extra round trip
is wasted time for the common unsigned case. It therefore needs a
reliable way to tell the two apart.
We cannot tell by inspecting the bytes: a sign_firmware.py output is
just the raw .bin with 64 bytes of ed25519 signature glued on the
end, indistinguishable in content from an unsigned image of the same
padded length. The natural place to put the flag is the .px4 JSON
envelope, which already carries board_id / version / summary / etc.
Add --image_signed to px_mkfw.py, which sets "image_signed": true
in the emitted JSON. The flag has no effect on what bytes actually
end up on the device — it just tells the uploader "this blob has a
signature, please verify it before booting".
* feat(Tools): verify firmware signature before reboot
After PROG_MULTI + GET_CRC, send a new VERIFY_SIG opcode (0x39) to
the bootloader to check the ed25519 signature over the freshly
flashed image *before* sending REBOOT. This way a signature failure
is reported as a clean error from the uploader script, instead of a
silent "device stays in bootloader after reboot" that leaves the user
guessing.
The uploader always probes VERIFY_SIG. The bootloader is the source
of truth for whether secure boot is enabled:
- INSYNC/OK -> verification passed, proceed to REBOOT
- INSYNC/FAILED -> raise; "Signature does not verify against any
trusted key" if the firmware claims to be signed,
"Secure bootloader rejected an unsigned image"
otherwise (= helpful guidance for the common
misconfiguration of uploading default firmware
to a secureboot bootloader)
- INSYNC/INVALID -> bootloader has no secure boot. Quietly proceed
unless the firmware metadata says image_signed,
in which case raise.
- recv timeout -> assume a pre-VERIFY_SIG bootloader, proceed.
Surfaces a "Verifying image signature... passed" line on the upload
status path when the firmware is marked signed, so users get a clear
positive signal that the secure-boot pipeline ran end-to-end.
Also drop the redundant logger.error in the upload() loop, which was
duplicating the error message printed by the top-level handler in
main() for every UploadError path (not specific to verify_signature,
but only became obvious once these clean error messages started
firing in normal usage).
* fix(cmake): fix .px4board variant resolution to require exact match
px4_config.cmake matched the requested CONFIG against each candidate
.px4board with `MATCHES`, which is a regex partial match. For a
config like `px4_fmu-v6x_bootloader_secureboot`, the iteration over
.px4board files (alphabetical glob order) would match
`bootloader.px4board` first — because "px4_fmu-v6x_bootloader" is a
prefix of "px4_fmu-v6x_bootloader_secureboot" — and stop, silently
selecting the wrong board config.
Use `STREQUAL` instead so each candidate has to match the full
requested CONFIG. Existing single-label cases (e.g. exact match on
`px4_fmu-v2_default` or `px4_fmu-v2`) are unaffected because they
were already exact in practice; this just plugs the prefix-match
hole that any future `<label>_<suffix>` variant would trip over.
* fix(nuttx): support bootloader_<variant> labels
Boards can ship bootloader variants beyond the default `bootloader`
label — e.g. a `bootloader_secureboot` that adds crypto + keystore
Kconfig on top of the same source tree. Two pieces of build glue
were hardcoded to the exact label `bootloader` and need to relax to
match any `bootloader_*` label:
1. platforms/nuttx/CMakeLists.txt picked the bootloader linker
script and bootloader-specific library list only when the label
was exactly `bootloader`. Any other label (including
`bootloader_secureboot`) silently fell through to the app build,
producing nonsensical link flags. Match `^bootloader` instead,
and explicitly set SCRIPT_PREFIX to `bootloader_` so all
bootloader variants share the single existing linker script
regardless of their full label.
2. platforms/nuttx/cmake/px4_impl_os.cmake selects the NuttX config
subdirectory by exact label match, falling back to `nsh` when no
matching directory exists. For `bootloader_secureboot` that fell
through to `nsh`, dragging in a full app-style NuttX with cromfs,
networking, and the full heap subsystem — a 128 KB bootloader
sector overflowed by ~50 KB. Add an intermediate fallback: if the
label starts with `bootloader` and a `bootloader/` subdir exists,
use that instead of `nsh`.
Both changes are backward-compatible: existing single-label
`bootloader` builds take exactly the same path as before. They only
gain the ability for boards to add `bootloader_<suffix>.px4board`
files without duplicating bootloader build wiring.
* feat(build): auto-sign secure-boot images via BOARD_SECUREBOOT
Add a Kconfig pair that boards can opt into:
CONFIG_BOARD_SECUREBOOT -- bool: sign the .px4 with ed25519
CONFIG_BOARD_SECUREBOOT_KEY -- string: path to JSON private key
(default: Tools/test_keys/test_keys.json)
When set, the .px4 build rule inserts a Tools/secure_bootloader/sign_firmware.py
step between the unsigned .bin and px_mkfw.py, and passes --image_signed
so the .px4 envelope's metadata flags it for the uploader's VERIFY_SIG
step. The unsigned .bin is still produced alongside the .px4, so users
can sign with their own key out-of-tree if they prefer.
A BOARD_SECUREBOOT_KEY environment variable overrides the Kconfig path
at build time, mirroring the override pattern used for CONFIG_PUBLIC_KEYn
in stub_keystore. This makes release builds practical:
BOARD_SECUREBOOT_KEY=/secure/path/release.json make px4_<board>_secureboot
Relative paths in the Kconfig are resolved against the repo root (not
the build directory) so the same value works regardless of where the
build runs from.
Default builds are byte-identical to before; the new code path is gated
on CONFIG_BOARD_SECUREBOOT being set.
* feat(boards): add secureboot demo variant + docs
Two coordinated build variants demonstrate end-to-end secure boot
on px4_fmu-v6x without touching the default builds:
px4_fmu-v6x_secureboot -- the app, with TOC + signing
px4_fmu-v6x_bootloader_secureboot -- the matching secure bootloader
App side (secureboot.px4board):
- Selects nuttx-config/scripts/secureboot-script.ld via
CONFIG_BOARD_LINKER_PREFIX. The script is a copy of the default
layout plus a fixed 0x800 reservation past the vector table for
the image TOC, and an empty .signature section at end-of-FLASH
so sign_firmware.py knows where the appended ed25519 signature
will land.
- Compiles src/toc.c (a four-entry IMAGE_MAIN_TOC matching the
layout used elsewhere in the tree) into drivers_board, gated on
PX4_BOARD_LABEL == secureboot so the default build still
produces the existing layout.
- Sets CONFIG_BOARD_SECUREBOOT=y so the .px4 build rule signs the
image with the upstream test key by default.
Bootloader side (bootloader_secureboot.px4board):
- Enables CONFIG_BOARD_CRYPTO + DRIVERS_SW_CRYPTO + DRIVERS_STUB_KEYSTORE,
which links monocypher and the stub keystore into the bootloader.
- Bakes Tools/test_keys/key0.pub in as CONFIG_PUBLIC_KEY0, paired
with the test_keys.json the app variant signs with.
- hw_config.h gates BOOTLOADER_USE_SECURITY, BOOTLOADER_SIGNING_ALGORITHM
(CRYPTO_ED25519), and BOARD_IMAGE_TOC_OFFSET (0x800) on PX4_CRYPTO,
so they only activate in this variant.
Together the two variants implement the workflow:
make px4_fmu-v6x_bootloader_secureboot # build + flash via SWD once
make px4_fmu-v6x_secureboot upload # signs with test key, verifies
Bootloader fits in 128 KB (~57 KB used) thanks to --gc-sections
stripping the unused libtomcrypt code; nothing in the bootloader
binary depends on monocypher beyond the ed25519 verifier.
Replace the bundled test key for production with
Tools/secure_bootloader/generate_signing_keys.py output and update
both .px4board files (or set BOARD_SECUREBOOT_KEY at build time) —
see docs/en/advanced_config/bootloader_secure_boot.md.
* fix(boards): cap H7 bootloader linker scripts at 128 KB
Roughly half of the H7 boards in tree had `LENGTH = 2048K` for the
bootloader sector in their bootloader_script.ld, even though the
matching app linker script places APP_LOAD_ADDRESS at 0x08020000 —
i.e. the bootloader actually only owns the first 128 KB sector.
The 2048K constraint is wrong: it lets a bootloader that grew past
the 128 KB sector silently overflow into the app sector at link
time and corrupt the start of the app on flash. The linker should
fail the build instead.
The current default bootloader is ~46 KB, well under 128 KB on every
affected board, so this change is a no-op for default builds. It
just plugs a footgun for anyone adding bootloader features (secure
boot, extra UI, network boot, ...) that would have otherwise
silently grown into the app's flash range.
Boards fixed:
3dr-style H7 reference boards: cubepilot/cubeorange,
cubepilot/cubeorangeplus, holybro/durandal-v1, narinfc/h7
vendor variants: corvon/743v1, cuav/nora, cuav/x7pro,
gearup/airbrainh743, hkust/nxt-dual, hkust/nxt-v1,
matek/h743, matek/h743-mini, matek/h743-slim,
micoair/h743, micoair/h743-aio, micoair/h743-lite,
micoair/h743-v2, x-mav/ap-h743r1, x-mav/ap-h743v2
Boards already correct (LENGTH = 128K) are unchanged.
* fix(ci): add pynacl to Python requirements
Tools/secure_bootloader/sign_firmware.py uses PyNaCl for ed25519
signing, and the .px4 build rule for boards with CONFIG_BOARD_SECUREBOOT
calls it as part of the normal build (e.g. px4_fmu-v6x_secureboot).
Without pynacl in the dev requirements, those builds fail in CI and
fresh dev setups.
* docs(update): Subedit
* docs(update): Fix example error I made
* fix(docs): document BOOT and SIG1 regions
* fix(platforms): style fix
* fix(ci): workaround to get pip dependency
* fix(ci): fall back to plain pip on older build containers
The voxl2 build image ships a pip that predates --break-system-packages
(added in pip 23.0.1), so the install step blew up with "no such option".
Modern containers enforce PEP 668 and need the flag; older ones don't
support it but also don't enforce PEP 668, so plain pip works there.
Try the modern flag first, fall back if pip rejects it.
Signed-off-by: Julian Oes <julian@oes.ch>
* fix(build): strip BUILD_DIR_SUFFIX from CONFIG in cmake-build
cmake-build was passing the full build-dir name (including any
BUILD_DIR_SUFFIX like _replay or _failsafe_web) as -DCONFIG=, which
the board-lookup in cmake/px4_config.cmake then tried to match
against <vendor>_<model>_<label> .px4board files. That used to work
by accident because px4_config.cmake matched with regex MATCHES, but
since the switch to STREQUAL (needed to disambiguate
bootloader_secureboot from bootloader) the suffixed CONFIG no longer
matches anything and LABEL ends up empty, tripping a CMake error in
kconfig.cmake.
Pass the bare CONFIG and keep the suffix only on the build dir so
both concerns are independent.
Signed-off-by: Julian Oes <julian@oes.ch>
---------
Signed-off-by: Julian Oes <julian@oes.ch>
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* docs(arkv6s): add flight controller documentation
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
* docs(arkv6s): add product photo and note single-IMU variant
Drop in docs/assets/flight_controller/arkv6s/ark_v6s_front.jpg
so the page renders the board photo it already references, and
align the intro with the upstream description by spelling out
that the V6S is the single-IMU variant of the V6X.
* docs(arkv6s): add bootloader UART note, fix arkv6x RAM typo
Add the bootloader serial port note (TELEM1-only in bootloader mode)
to the ARKV6S docs, matching the ARKV6X docs. Also fix the ARKV6X
MCU spec listing "1MB Flash" instead of "1MB RAM".
---------
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
* docs(sim_sih): link Hawkeye visualizer, add stub page
Replaces jMAVSim display-only mode references in the SIH page with Hawkeye,
which is purpose-built for this role and actively maintained. The 3D
visualization section now covers the hawkeye command, the port alignment
with SIH (UDP 19410), and links out to the full Hawkeye documentation.
Adds a short sim_hawkeye/index.md stub covering what Hawkeye is, install
on macOS and Linux, and basic SIH usage. Everything else (multi-vehicle,
ULog replay, HUD modes, CLI reference) lives at px4.github.io/Hawkeye
and is linked from the stub, so PX4 docs don't carry the maintenance
burden of two parallel sources.
Also updates the port reference table: UDP 19410 is now labeled
"Hawkeye visualizer" instead of "jMAVSim display-only", and adds the
page to SUMMARY.md nested under SIH Simulation.
* docs(update): subedit
---------
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
Adds documentation for the SITL containers and .deb packages introduced in #26495. The containers are now live on Docker Hub: [`px4io/px4-sitl:latest`](https://hub.docker.com/r/px4io/px4-sitl) and [`px4io/px4-sitl-gazebo:latest`](https://hub.docker.com/r/px4io/px4-sitl-gazebo).
The main addition is a [Try PX4 Simulation](https://docs.px4.io/main/en/dev_setup/try_px4) page that leads with a single `docker run` command and gets someone flying in under a minute. It lives in Getting Started, right after Recommended Hardware/Setup, so it's one of the first things new users see.
The existing `.deb` package reference has been moved from `packaging/px4_sitl_deb.md` to `simulation/px4_sitl.md` and expanded to cover both containers and `.deb` packages on one page. Sections are ordered by how people use them: what's available, install, configure, connect QGC/MAVSDK, connect ROS 2.
Other changes:
- README now has a "Try PX4" section with the docker one-liner above "Build from Source"
- Landing page (`index.md`) reworked to lead with "Try PX4" before "For Developers"
- Toolchain page (`dev_env.md`) gets a tip redirecting simulation-only users to pre-built packages
- `getting_started.md` and `SUMMARY.md` updated with links to the new pages
- Simulation index tip updated to mention containers alongside `.deb` packages
The SIH container image is published as `px4io/px4-sitl` (renamed from `px4io/px4-sitl-sih`) so the default lightweight option carries the simplest name. The Gazebo image remains `px4io/px4-sitl-gazebo`.
Also upgrades all GitHub Actions in the SITL workflow to Node.js 24 compatible versions (`actions/checkout@v6`, `actions/cache@v5`, `actions/upload-artifact@v7`, `actions/download-artifact@v8`, `docker/setup-buildx-action@v4`, `docker/build-push-action@v7`) to fix the Node.js 20 deprecation warning ahead of the June 2026 deadline.
---------
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* boards: corvon 743v1 support (Docs and LED alignment)
This PR addresses #24769 by providing the required official documentation, while simultaneously aligning the board's LED semantics entirely with the PX4 standard.
Key Changes:
- Add complete corvon 743v1 hardware documentation and manufacturer link.
- Fix LED out-of-bounds bug and strictly align RGB states to Pixhawk standard (LED_BLUE=0, LED_RED=1, LED_GREEN=3).
- Update bootloader pin config (hw_config.h) to use red LED for boot/error, and update pre-built bootloader.bin.
* Prettier and file reduce
* docs: address reviewer feedback & board ID fix
* Apply suggestion from @hamishwillee
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* docs: resolve final reviewer feedback (PPM, Debug Port, Manufacturer List)
---------
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
Co-authored-by: Ramon Roche <mrpollo@gmail.com>
Add a scalable .deb packaging framework for VOXL2, built on the
existing cmake/package.cmake CPack infrastructure. The framework
handles multi-processor boards by having the POSIX (_default) build
own the .deb and pull in the companion SLPI build's artifacts.
Board-specific files:
- cmake/package.cmake: CPack variable overrides (name, deps, version)
- cmake/install.cmake: install() rules for all .deb contents
- debian/postinst: px4-* symlinks, DSP signature, directory setup
- debian/prerm: service stop, symlink cleanup
- debian/voxl-px4.service: systemd unit (after sscrpcd)
Infrastructure changes:
- cmake/package.cmake: hook for board-specific CPack overrides
- platforms/posix/CMakeLists.txt: hook for board install.cmake
- Makefile: %_deb pattern rule (build _default, then cpack -G DEB)
- CI: auto-discover _deb targets, collect .deb artifacts, upload
to GitHub Releases
Future boards: add cmake/package.cmake + cmake/install.cmake and
CI discovers it automatically. No new file formats or tools needed.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* docs(mavlink): add security hardening guide for production deployments
Add a dedicated security hardening page covering MAVLink authentication
risks, a hardening checklist (enable signing, secure physical access,
secure network links), and integrator responsibility for deployment
security. Add a warning block to the main MAVLink page linking to the
new guide.
---------
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* Applying PR #17084
* Comitting missing changes
* Adding incoming SETUP_SIGNING handling
* Adding proper message decoding for SETUP_SIGNING
* Adding persistance of sign key in chunks of 32 bits into parameters
* Allowing SETUP_SIGNING to be handled only on usb_uart
* Removing unused type and variable
* Changing the default for Mavlink Timestamp
* Fixing styling
* Merging
* Merging submodules
* Replacing parameters with sdcard storage for secured key and ts
* Fixing styles
* Isolating signing related items in separate class
* Adding new files
* Syncing with main
* Fixing styles
* Changing the signing logic to work only if key and ts properly initialized, adding store the ts on stop
* Updated submodules to latest versions
* Updated gz to proper version
* libfc-sensor-api to proper version
* libcanard to proper version
* Updated fuzztest to proper version
* Updated public_regulated_data_types to proper version
* Updated mip_sdk to proper version
* Updated pydronecan to proper version
* Updated rosidl to proper version
* Fixing styles
* Fixing cyclonedds version
* initializing sign control in the member declaration
* Update src/modules/mavlink/mavlink_main.h
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
* Fixing comments
* Fixing duplicate method
* Fixing defines
* Fixing styles
* Fixing the define errors
* replace duplicate logic with write_key_and_timestamp() function
* add docs
* Update docs/en/mavlink/message_signing.md
Co-authored-by: Julian Oes <julian@oes.ch>
* Update src/modules/mavlink/mavlink_sign_control.cpp
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* Update src/modules/mavlink/mavlink_sign_control.h
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* Update docs/en/mavlink/message_signing.md
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* rename to MAV_SIGN_CFG, fix copyright dates, fix docs SHA type, rename secrets file
* fix newlines
---------
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
Co-authored-by: Jacob Dahl <dahl.jakejacob@gmail.com>
Co-authored-by: Julian Oes <julian@oes.ch>
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* Creating a base for grf lidar
* Serial Drive is working, need to work out distance publish
* WIP Getting Range Data in cm
* Working Rand Distance Values for GRF 250 and GRF500
* Review Changes
* Compiler fixes
* Update to date
* small update
* Fix typo and remover unused libs
* removing unused enum
* Update to the Documentation
* Fiving scaling issue
* update to the logic
* [Feature] Adding I2C driver for the GRF250 and GRF500 models (#26425)
* Adding the GRF I2C driver
* I2C Driver Working
* Removing a lot of unnecessary code
* fixing names
* Changing the i2c Driver to be in the lightware laser
* remove the old driver
* formatting fix
* Adding Ligthware GRF to documentation
* Update to the Documentation
* Ensuring sample_perf ends
* Updating Docs
* uavcannode: implement hardpoint commands (#26334)
* implement cannode hardpoint commands
Signed-off-by: dirksavage88 <dirksavage88@gmail.com>
* Update src/drivers/uavcannode/Subscribers/HardpointCommand.hpp
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
* Update src/drivers/uavcannode/Subscribers/HardpointCommand.hpp
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
* add hardpoint sub to ark cannode, simplify handling of hardpoint broadcast
Signed-off-by: dirksavage88 <dirksavage88@gmail.com>
---------
Signed-off-by: dirksavage88 <dirksavage88@gmail.com>
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
* voxl_esc: Limit frequency of UART passthru writes to 20Hz
* voxl2_io: Added UART passthru
* docs: update link for px4 ros2 interface lib python api docs
* estimator_interface: remove unused getter
* gnss_checks: always run strict checks on ground
With the goal to never take off if the GNSS solution is not fullfilling the configured requirements still not stopping to use it in case it degrades mid air.
* ekf2 unit-tests: adapt to strict GNSS checks on ground
* escCheck: rework online check to properly report offline ESCs
previous to this
09d79b221f
set `esc_online_flags` e.g. for UAVCAN ESCs which specific one is online and that then got compared to a mask where the first `esc_count` bits were set.
So if only ESC 5 is mapped and online you get the message "ESC 156 offline" because `esc_online_flags = 0b1000` gets compared to `online_bitmask = 0b1` based on `esc_count = 1` and the motor index is `esc[0].actuator_function = 0` wrapped using `0 - actuator_motors_s::ACTUATOR_FUNCTION_MOTOR1 + 1 = 156`.
* FailureDetector: consistent timestamp naming
* FailureDetector: rework motor status check
* FailureDetector: implement upper and lower current limit with offset
* Update src/modules/commander/failure_detector/FailureDetector.cpp
Prevent Buffer overflow
* Update Format
* Subedit
* Shrink and rename image
* Apply suggestion from @hamishwillee
Sounds good
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* Apply suggestion from @hamishwillee
More universal approach
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* Update to the Documentation
* FailureDetector: rework motor status check
* FailureDetector: implement upper and lower current limit with offset
* Subedit
* docs: update parameter reference metadata
* Remove pregenerated files - that should all be tidied up next time this runs
* remover GRF parameters
* Documentation updates
* Fixing Merge Conflicts
* remove @
* Undo Changes to parameter_reference
* remove the code that will be autogen-ed
* Update the Camake File
---------
Signed-off-by: dirksavage88 <dirksavage88@gmail.com>
Co-authored-by: Andrew Brahim <35986980+dirksavage88@users.noreply.github.com>
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
Co-authored-by: Eric Katzfey <eric.katzfey@modalai.com>
Co-authored-by: Beat Küng <beat-kueng@gmx.net>
Co-authored-by: Matthias Grob <maetugr@gmail.com>
Co-authored-by: Marco Hauswirth <marco.hauswirth@auterion.com>
Co-authored-by: Nick <145654544+ttechnick@users.noreply.github.com>
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
Co-authored-by: Ramon Roche <mrpollo@gmail.com>
This feature periodically spins the unused motors on VTOL airframes, to
break off ice that has built up in the motor while it is still feasible
to do so. Each ice shedding event sends a motor ouput of 0.01 to the
unused motors for 2 seconds.
Configured by `CA_ICE_PERIOD`, the duration of the entire cycle. Set to
0 to disable.
* moving raptor
bump
compiles and raptor mode appears
hovering with RAPTOR seems to work
Using Raptor to execute offboard commands works (using multirobot f03825a5795a77c5a095f799eeb8e0b646fe7176 to feed the trajectory_setpoint). Requires more testing
simplified rotmat
runtime inference frequency multiple
arming request response reflects actual readiness
adjusting to fit IMU gyro ratemax
relaxing control timing warning thresholds for SITL
Using mode registration to signal if offboard commands should be forwarded to trajectory_setpoint instead of just hardcoding vehicle_status.nav_state == vehicle_status_s::NAVIGATION_STATE_OFFBOARD
adopting new "request_offboard_setpoint" in raptor module
replace offboard seems good
mc_raptor: overwrite offboard parameter
separate raptor config
addendum
Raptor off by default
RAPTOR readme
Loading raptor checkpoint from tar works.
check if load was successful
refactoring: cutting out the pure C interface to allow direct testing of the policy input/output behavior from the file, without fully loading it into memory first
adapter not needed anymore
ripping out test observation mode (not used in a long time)
fixing warnings
bump RLtools to fix the remaining warnings
Loading RAPTOR checkpoint from sdcard seems to work on FMU-6C
embedding Raptor policy into flash works again
also printing checkpoint name when using the embedded policy
cleaner handling of the checkpoint name
back to reading from file
ripping out visual odometry checks
cleaner
more debug but no success
bump rlt
bump
pre next rebase
we can publish the no angvel update because we latch onto it with the scheduled work item anyways
this kind of runs on the 6c
still bad
SIH almost flying
saving stale traj setpoint yaw
new error. timestamp not the problem anymore
bump rlt; SIH works with executor
shaping up
bumping blob (include tar checkpoint)
cleaning up
fixing formatting
update readme
* moving raptor
bump
compiles and raptor mode appears
hovering with RAPTOR seems to work
Using Raptor to execute offboard commands works (using multirobot f03825a5795a77c5a095f799eeb8e0b646fe7176 to feed the trajectory_setpoint). Requires more testing
simplified rotmat
runtime inference frequency multiple
arming request response reflects actual readiness
adjusting to fit IMU gyro ratemax
relaxing control timing warning thresholds for SITL
Using mode registration to signal if offboard commands should be forwarded to trajectory_setpoint instead of just hardcoding vehicle_status.nav_state == vehicle_status_s::NAVIGATION_STATE_OFFBOARD
adopting new "request_offboard_setpoint" in raptor module
replace offboard seems good
mc_raptor: overwrite offboard parameter
separate raptor config
addendum
Raptor off by default
RAPTOR readme
Loading raptor checkpoint from tar works.
check if load was successful
refactoring: cutting out the pure C interface to allow direct testing of the policy input/output behavior from the file, without fully loading it into memory first
adapter not needed anymore
ripping out test observation mode (not used in a long time)
fixing warnings
bump RLtools to fix the remaining warnings
Loading RAPTOR checkpoint from sdcard seems to work on FMU-6C
embedding Raptor policy into flash works again
also printing checkpoint name when using the embedded policy
cleaner handling of the checkpoint name
back to reading from file
ripping out visual odometry checks
cleaner
more debug but no success
bump rlt
bump
pre next rebase
we can publish the no angvel update because we latch onto it with the scheduled work item anyways
this kind of runs on the 6c
still bad
SIH almost flying
saving stale traj setpoint yaw
new error. timestamp not the problem anymore
bump rlt; SIH works with executor
shaping up
bumping blob (include tar checkpoint)
cleaning up
fixing formatting
update readme
updating gitignore
* fixing format and declaring submodules as cmake dependencies
* adding uORB message documentation
* fixing comment alignment
* Adding option to restrict mc_raptor to not listen to the trajectory_setpoint (use the position and yaw at activation time as reference instead)
* bump RLtools; relax timing thresholds and adding real world readme
* smooth traj tracking performance
* Measuring trajectory_setpoint timing (providing stats in raptor_status); reverting accidental .gitignore modification
* More ideomatic way of setting the path to the policy checkpoint
* Reset trajectory_setpoint on raptor mode activation
* Adding internal trajectory generation (feeding trajectory_setpoint over Mavlink is too noisy). Quite agile trajectory tracking, good performance
* stable flight
* Update msg/versioned/RaptorInput.msg
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
* adopting message formatting conventions
* sort raptor.px4board
* Archiving RegisterExtComponentRequestV1.msg
* Add message versioning for VehicleStatus v2 and RegisterExtComponentRequest v2
* fixing formatting
* making internal reference configurable via command
* RAPTOR docs wip
* raptor internal reference documentation
* Finishing RAPTOR docs first draft
* adding logging instructions
* Fixing missing command documentation test error
* fixing format
* adding motor layout warning
* raptor minimal subedit - prettier, images etc
* Improve intro
* Fix up Neural_Networks version
* Mentioning "Adaptive" in the RAPTOR documentation's title
* Adding clarifications about the internal reference trajectory generator
* Removing "foundation policy" wording
* Fixing new-line check
* Removing redundant (evident through directory hierarchy) raptor_ from filenames
* Unifying Neural Network docs (mc_nn_control and mc_raptor) under the "Neural Network" topic
* Fix to standard structure
* Making the distinction between mc_nn_control and mc_raptor more clear and fixing the comparison table
* Removing trajectory_setpoint forwarding flag from external mode registration request and from the vehicle status
* Trivial layout and wording fixes
* fixing docs error
---------
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
