The single gps_inject_data topic served two unrelated purposes:
external fixed-base RTCM corrections (from MAVLink GPS_RTCM_DATA or
UAVCAN RTCMStream) and moving-base-to-rover RTCM 4072. In a
dual-GPS-with-moving-base plus fixed-base setup, the two streams
collided on the same queue and the FMU UAVCAN bridge mirrored
fixed-base RTCM onto the MovingBaselineData CAN message, breaking
rover heading or RTK fix (see PX4/PX4-Autopilot#27088).
Split by role:
- rtcm_corrections (renamed from gps_inject_data): external RTCM
flowing into the vehicle; producers are
MAVLink, UAVCAN RTCMStream, and GPS drivers in
dump mode.
- rtcm_moving_baseline (new): moving-base GPS output intended for a
rover; single producer per vehicle.
GPS driver routes publishRTCMCorrections() based on a new
GPSHelper::isMovingBase() virtual (overridden in UBX). Septentrio's
publish_rtcm_corrections() always publishes to rtcm_moving_baseline
(only the Secondary moving base calls it). Rover-side consumers
(gps, septentrio, uavcan bridge) drain both topics independently;
each gets its own stale-link switchover state.
FMU UAVCAN bridge: two independent drain loops, one per topic. No
more dual-publish of a single uORB message onto both RTCMStream and
MovingBaselineData CAN streams.
CANnode MovingBaselineDataPub subscribes to rtcm_moving_baseline and
drops the bus_type == UAVCAN heuristic that was papering over the
conflation. CANnode RTCMStream subscriber switches to
PublicationMulti so multiple CAN RTCM sources coexist (e.g. dual
rovers outputting MSM7 for logging plus a fixed-base feed).
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
* fix(uxrce_dds_client): fix session reconnection after agent restart
When the Micro XRCE-DDS Agent is restarted (e.g. via systemd or
Docker), the PX4 client stays "Running, disconnected" forever and
never re-establishes the session. Three bugs prevented reconnection:
1. session.on_pong_flag was never reset after being checked. Once set
to 1 by the first successful pong, it stayed 1 forever, causing
checkConnectivity() to believe pings were still succeeding even
after the agent was gone. Fixed by resetting to 0 after reading.
2. _subs->reset() was never called during session teardown. Stale
uORB file descriptors from the previous session persisted across
reconnection attempts, causing the new session's publishers to
malfunction. Fixed by calling _subs->reset() in deleteSession().
3. _connected was not explicitly reset in deleteSession(). While the
outer loop checked this flag, explicitly clearing it ensures clean
state for the next reconnection attempt.
Closes#26022
Signed-off-by: Pavel Guzenfeld <pavelgu@gmail.com>
* fix(uxrce_dds_client): clear fds[].events in reset() for reconnection
Without clearing events, init() skips orb_subscribe() on reconnect
because the POLLIN guard (fds[idx].events == 0) is never true again.
This causes all fds to remain at -1, px4_poll() returns 0, TX rate
stays zero, and the client enters a disconnect/reconnect loop.
Reported-by: sansha (tested on Pixhawk 6X with serial transport)
* ci: re-trigger SITL tests (flaky offboard test)
* docs(uxrce_dds_client): explain why reset() clears fds[].events
---------
Signed-off-by: Pavel Guzenfeld <pavelgu@gmail.com>
Once a serial telem channel hit 10 consecutive timeouts it was added
to a skip mask and never polled again. Channels that came online late
(e.g. ESC power-cycled after the autopilot boots) stayed permanently
offline, and with both serial and bdshot enabled the motor was
reported offline overall because the combined health check requires
both sources.
Periodically clear the skip mask while disarmed so recovered channels
get another chance. If still broken they are re-skipped after the
normal timeout threshold. Disarmed-only to avoid timeout blips on
healthy channels during flight.
The airframe 10043 (make px4_sitl sihsim_standard_vtol) currently does
not have enough forward thrust to reach VT_ARSP_TRANS (10) or
VT_ARSP_BLEND (8), so we get front transition timeout.
By bisecting, we find that #26720 breaks it. The PR introduces a new
dynamic prop model, which is now used in the airframes 1101, 1102, 1103,
and 1105 (new addition), but not 10043.
The PR also removes a previous magic number that gave the standard VTOL
pusher twice the max thrust of the hover motors (2 * 2N = 4N). It
introduces a separate SIH_F_T_MAX, but by default it is 2N, causing the
weak pusher for 10043.
Fix by using the new dynamic propeller model by default, with the same
params that #26720 introduces for airframe 1103 (It would also suffice
to only set SIH_F_T_MAX=6, but now that we have the nicer model let's
use it).
Note that 10041 (sihsim_airplane) is not broken by #26720 in this way,
as it already has SIH_T_MAX of 6N.
MODULES_TEMPERATURE_COMPENSATION defaults to n in Kconfig, so explicit
=n and "is not set" entries are unnecessary.
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
These are generic flight controller boards (not drone-specific
products), so they should not come with a pre-selected airframe like
every other PX4 board. Drop the SYS_AUTOSTART default, matching the
convention used across the rest of the tree.
Drone-specific products (bitcraze/crazyflie, atl/mantis-edu) retain
their default airframe.
* forwarding offboard setpoints in modes using the external mode registration
* requesting offboard setpoint in RAPTOR
* adding old message versions
* bumping vehicle status
* adding message translations
* updating reference to versioned old message on previous translations
Detects when a rotary-wing vehicle drops more than FD_ALT_LOSS metres
below a NED-z reference while altitude control is active,
and immediately triggers flight termination (parachute deployment).
Detection (FailureDetector):
- FD_ALT_LOSS: drop threshold in metres (0 = disabled, default)
- FD_ALT_LOSS_T: hysteresis time
- Guards: rotary-wing only, altitude control active, z_valid, setpoint
fresh (<1 s). Manual, Acro and FW/VTOL-FW modes are excluded.
- Ratcheting reference: initialises to lpos.z on first sample below
setpoint, preventing false triggers on new waypoints
Failsafe action (commander):
- New fd_alt_loss flag in FailsafeFlags.msg
- COM_ALT_LOSS_ACT: -1=Disabled (default), 0=Terminate
- Terminate fires immediately, cannot be overridden, and never clears
until disarm (parachute deployment is irreversible)
* fix(mavlink): align signing with MAVLink spec and fix performance regression
Remove the non-standard MAV_SIGN_CFG parameter and align the signing
implementation with the MAVLink specification.
Key changes:
- Remove MAV_SIGN_CFG parameter that conflicted with GCS implementations
- Only enable signing when a valid key is present on the SD card
- Accept SETUP_SIGNING on any link, not just USB
- Reject SETUP_SIGNING while the vehicle is armed
- Allow disabling signing via signed all-zero key SETUP_SIGNING message
- Propagate key changes to all mavlink instances
- Zero CPU/bandwidth overhead when signing is not active
Fixes#26893
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* Signing minor subedit
---------
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
Co-authored-by: Jacob Dahl <dahl.jakejacob@gmail.com>
* refactor: make timer_io_channels[].timer_channel 0-indexed
timer_channel was 1-indexed (1-4) to mirror STM32 hardware naming
(TIM_CH1-CH4), but this was purely cosmetic — the ccr_offset field
already handles register mapping. Every consumer did timer_channel - 1
to get a 0-based index, creating underflow bugs when the guard was
missing (e.g. dshot.c capture_complete_callback,
output_channel_from_timer_channel, up_bdshot_get_erpm).
Changes:
- STM32: Timer::Channel enum starts at 0, initIOTimerChannel assigns
directly, removed all timer_channel - 1 in dshot.c and io_timer.c
- NXP (kinetis, s32k1xx, s32k3xx): removed the + 1 in
initIOTimerChannel, removed timer_channel - 1 in io_timer.c,
led_pwm.cpp, and input_capture.c
- RPI: Channel enum starts at 0, removed timer_channel - 1 in
io_timer.c
- Validity checks updated from timer_channel <= 0 || >= 5 to
timer_channel >= 4
Closes#26747
Signed-off-by: Pavel Guzenfeld <pavelgu@gmail.com>
* fix: complete 0-indexed timer_channel migration across all platforms
Address review feedback for incomplete migration:
1. STM32H7 io_timer_hw_description.h: update standalone
initIOTimerChannel() to assign timer_channel from enum
(0-based) instead of hardcoded 1/2/3/4
2. Switch case labels: update all switch(timer_channel) blocks
from 1/2/3/4 to 0/1/2/3 in:
- stm32_common: input_capture.c (4 blocks), led_pwm.cpp (3),
io_timer.c DMA base register switch
- kinetis: input_capture.c (2 filter blocks)
- s32k1xx: input_capture.c (2 filter blocks)
- spix_sync.c (ark/fpv + ark/pi6x, 3 blocks each)
3. Sentinel checks: replace timer_channel != 0 / == 0 (which
now conflicts with valid channel 0) with gpio_out-based
checks in:
- io_timer_validate_channel_index() across all 5 platforms
- led_pwm_channel_init() and led_pwm_servo_get() in all
led_pwm.cpp variants (STM32 + 4 NXP)
- spix_sync_channel_init() and spix_sync_servo_get()
Tested: px4_fmu-v6x_default (H7) build OK, px4_sitl_default
build OK, 154/154 unit tests pass, ASan build clean.
* fix: update NXP board led_pwm_channels to 0-indexed timer_channel
These 4 board files manually specify led_pwm_channels[] with
1-indexed timer_channel values. Since the platform code no longer
subtracts 1, decrement all values to match the new 0-indexed
convention.
* fix: correct FTM CH3 filter mask in kinetis and s32k1xx input capture
Case 3 in up_input_capture_set_filter() was using CH2FVAL_MASK/SHIFT
instead of CH3FVAL_MASK/SHIFT due to a copy-paste error, causing
channel 3 filter writes to modify channel 2's filter register instead.
---------
Signed-off-by: Pavel Guzenfeld <pavelgu@gmail.com>
Co-authored-by: Jacob Dahl <dahl.jakejacob@gmail.com>
* refactor(battery_simulator): remove SIM_BAT_ENABLE
disable instead with SIM_BAT_DRAIN <= 0
* fix(battery_simulator): disable battery sim only if SIM_BAT_DRAIN strictly < 0
* fix(battery_simulator): disable if 0, adjust limit to 0
* fix(battery_simulator): remove constraining again
now that SIM_BAT_DRAIN=0 means the module is not started we are safe
from division by zero again (param compare has a tolerance of 1e-7)
* fix(battery_simulator): constrain param to min of 1
to avoid division by zero.
This reverts commit 6380c4fdee.
* fix(battery_simulator): remove arbitrary param max
* fix(battery_simulator): reword long param description
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
* fix(battery_simulator): reword short param description
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
---------
Co-authored-by: Jacob Dahl <37091262+dakejahl@users.noreply.github.com>
The pr-review-poster was flagging `gtest/gtest.h file not found` on any
PR that added or modified a test file, because clang-tidy-diff-18.py
ran against files that weren't in the compilation database. PR #27004
and PR #26233 both hit this. The root cause is that test TUs only
enter compile_commands.json when BUILD_TESTING is ON, which the
historical clang-tidy build does not enable.
This PR fixes both halves of the problem:
1. Add a second make target `px4_sitl_default-clang-test` that configures
a separate build dir with -DCMAKE_TESTING=ON. Test TUs land in its
compile_commands.json with resolved gtest/fuzztest include paths.
2. Add an umbrella `clang-ci` target that depends on both
`px4_sitl_default-clang` and `px4_sitl_default-clang-test` so the PR
job prepares both build dirs with one make invocation.
3. On PR events the workflow uses `make clang-ci`, installs
libclang-rt-18-dev (needed so fuzztest's FUZZTEST_FUZZING_MODE flags
do not fail the abseil try_compile with a misleading "pthreads not
found" error), and routes the clang-tidy-diff producer at the
test-enabled build dir.
4. Push-to-main is left entirely alone: same single build dir, same
`make px4_sitl_default-clang`, same `make clang-tidy`. Test files
are not in that DB so run-clang-tidy.py keeps ignoring them exactly
as before. This preserves green main while ~189 pre-existing
clang-tidy issues in test files remain untouched; fixing those is
out of scope for this change.
5. Replace the fragile `:!*/test/*` pathspec filter (which missed flat
`*Test.cpp` files in module roots) with
`Tools/ci/clang-tidy-diff-filter.py`, which reads the compilation
database and drops any changed source file that is not a TU.
Headers always pass through. Production code that happens to use
test-like names (src/systemcmds/actuator_test, src/drivers/test_ppm,
etc.) stays analyzed because those are real px4_add_module targets.
Verified in the ghcr.io/px4/px4-dev:v1.17.0-rc2 container and on the
real CI runner:
- cmake configure with CMAKE_TESTING=ON succeeds after installing
libclang-rt-18-dev (Found Threads: TRUE)
- compile_commands.json grows from 1333 to 1521 TUs
- Modifying HysteresisTest.cpp with a new `const char *p = NULL`
correctly flags hicpp-use-nullptr and
clang-diagnostic-unused-variable on the new line, while pre-existing
issues on other lines of the same file stay suppressed by
clang-tidy-diff-18.py's line filter ("Suppressed ... 1 due to line
filter")
- No gtest/gtest.h false positives
- Push-to-main path unchanged, still green
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Replace make quick_check with two explicit build targets:
px4_sitl_default (validates native SITL toolchain) and
px4_fmu-v5_default (validates NuttX cross-compile toolchain).
quick_check built four targets: px4_sitl_test, px4_fmu-v5_default,
tests, and check_format. The tests and check_format targets are
redundant with checks.yml which already runs them on 8cpu RunsOn
with ccache.
The purpose of this workflow is to validate that PX4 builds from a
fresh ubuntu.sh install on both Ubuntu 22.04 and 24.04, not to run
tests or check formatting. Two targeted builds are sufficient.
px4_fmu-v5_default is kept as the hardware target (same as
quick_check) since it builds with the arm-none-eabi-gcc version
that ubuntu.sh installs on both 22.04 and 24.04.
Expected duration drop from 16-17 min to 6-8 min per matrix entry.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
The v1.17.0-rc2 container's clang 18 + cmake 3.28 combination fails
abseil's cmake try_compile tests for C++17 and pthreads. This breaks
the fuzztest build which depends on abseil. Verified locally:
- px4io/px4-dev:v1.16.0-rc2 + apt install clang: cmake configure passes
- ghcr.io/px4/px4-dev:v1.17.0-rc2 (clang 18 pre-installed): cmake
configure fails with "ABSL_INTERNAL_AT_LEAST_CXX17 - Failed" and
"Could NOT find Threads"
- apt install clang on v1.17.0-rc2 is a no-op (already installed)
Revert to the old container image which has a working clang+cmake
combination. The apt install clang step (already in the workflow)
installs clang on the old container which doesn't ship it by default.
Remove the explicit fetch-depth: 0 added in the previous fix attempt
since the original workflow used the default depth (1) and it worked.
Fixes#27060
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Branch protection rules block the GITHUB_TOKEN from dismissing reviews
(HTTP 403), so every push added another undismissable REQUEST_CHANGES
review. PR #27004 accumulated 12 identical blocking reviews.
Switch to COMMENT-only reviews. Findings still show inline on the diff
but don't create blocking reviews that require manual maintainer
dismissal. The CI check status (pass/fail) gates merging, not the
review state.
Also enable CMAKE_TESTING=ON in the clang-tidy build so test files get
proper include paths in compile_commands.json. Without this,
clang-tidy-diff runs on test files from the PR diff but can't resolve
gtest headers, producing false positives.
Fixes#27004
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
.claude/settings.local.json contains user-specific Claude Code
permissions and should never be in the repo. Remove it and add
a .gitignore entry to prevent it from being committed again.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
This board is not available for purchase online and the author confirmed
that it is "only used for research and educational purposes". Given
there are no docs about it, we should just remove it.
Migrate the fuzzing workflow from GitHub-hosted ubuntu-latest to
RunsOn 4cpu with s3-cache. Bump the container from the stale
px4io/px4-dev:v1.16.0-rc2 to ghcr.io/px4/px4-dev:v1.17.0-rc2.
Wire setup-ccache / save-ccache with cache-key-prefix ccache-sitl
and max-size 300M, sharing the SITL build cache with checks:tests.
Both build px4_sitl_test/px4_sitl_default so the ccache contents
overlap significantly.
Drop the manual apt install clang step since the v1.17.0-rc2
container already ships clang. Replace the git config --global
safe.directory workaround with --system to match the repo convention.
Add runs-on/action@v2 for the S3 cache proxy. Add fetch-depth: 1
since the fuzzer doesn't need git history.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Jacob Dahl
Farhang
Pavel Guzenfeld
PX4BuildBot
Hamish Willee
Jonas Perolini
Jacob Dahl
ttechnick
Balduin
Pablo
Julian Oes
Shara
Andrew Brahim
Jonas Eschmann
gguidone
alexcekay
Ramon Roche
Balduin
Eurus
Ashwani Sihag
Silvan
丁勇