The bootloader boot-delay feature has been mechanically broken on
every modern FMU board since the STM32F7/H7 transition. It has three
independent bugs that prevent it from ever working:
1. Offset mismatch: BOOT_DELAY_ADDRESS is hardcoded to 0x1a0, but the
NuttX vector table is 504 B (F76x) to 664 B (H743) long. The
linker places _bootdelay_signature at ALIGN(32) past end of
vectors (e.g. 0x2a0 on CubeOrange), never at 0x1a0. The bootloader
reads random exception_common pointers in place of the magic and
never matches BOOT_DELAY_SIGNATURE1/2. Verified on CubeOrange with
objdump of cubepilot_cubeorange_default.elf.
2. Flash cache never flushes: fc_write() stores arbitrary writes in
cache line 1 and only flushes on a very specific condition tied
to the sequential firmware upload flow. A standalone write during
PROTO_SET_DELAY is cached forever. fc_read() then returns the
cached value, so the post-write verify lies and the bootloader
reports success. Nothing ever reaches flash.
3. H7 write granularity: the STM32H7 flash controller requires a
full 32-byte program cycle per write. Single 32-bit writes from
flash_func_write_word() would not be accepted by the controller
even if they reached it.
The feature has been silently dead on every H7/F7 FMU board for
years and no one noticed, which is strong evidence nothing actually
depends on it. Rather than fix it (which would mean rewriting
PROTO_SET_DELAY, the flash cache path, and the H7 flash programming
path), remove it.
Changes:
- bl.c: PROTO_SET_DELAY case now immediately NACKs (goto cmd_bad)
so clients that still send the command get a clear rejection
instead of the previous silent fake-success. The opcode stays in
the protocol enum for backwards compatibility.
- bl.h: drop BOOT_DELAY_SIGNATURE1/2 and BOOT_DELAY_MAX.
- stm/stm32_common/main.c, nxp/imxrt_common/main.c: drop the
startup boot-delay sig check block.
- image_toc.c: decouple find_toc() from BOOT_DELAY_ADDRESS.
BOARD_IMAGE_TOC_OFFSET is now the required define when
BOOTLOADER_USE_TOC is enabled. The body is wrapped in #ifdef
BOOTLOADER_USE_TOC and falls back to a stub returning false when
the TOC is not in use (no upstream board currently enables it).
- Linker scripts: strip EXTERN(_bootdelay_signature) and the
FILL/. += 8 block from all 142 affected .ld files across boards/.
- hw_config.h: strip the #define BOOT_DELAY_ADDRESS and its comment
block entry from all 48 affected boards.
- Tools/px4_uploader.py, Tools/teensy_uploader.py: remove --boot-delay,
set_boot_delay(), and SET_BOOT_DELAY client-side counterpart.
Smoke-built on cubepilot_cubeorange_default and
cubepilot_cubeorange_bootloader; no link errors, no unresolved
symbols, flash usage unchanged.
Tested:
- New BL, new FW
- Old BL, old FW
- Old BL, new FW
- New BL, old FW
The px4-sim / px4-sim-gazebo Homebrew meta-formulae can no longer
pull their Gazebo dependency chain because Homebrew 4.5+ stopped
auto-resolving cross-tap deps. PX4/homebrew-px4#104 already
deprecated px4-dev into a no-op; #111 does the same for the sim
formulae. This PR is the PX4-side counterpart: move the sim install
into Tools/setup/macos.sh with an explicit package list and tap
registration, mirroring the pattern already used for the toolchain
block. Adds xquartz install on --sim-tools.
Beyond install, three runtime and configure gaps kept make px4_sitl
gz_x500 from working on a clean macOS:
- gz-gui8 (pulled in by gz-sim8) links against Qt5, but Homebrew's
qt@5 is keg-only so CMake cannot find it. Add a POSIX-scoped hint
in platforms/posix/cmake/px4_impl_os.cmake that resolves
brew --prefix qt@5 and appends it to CMAKE_PREFIX_PATH. No-ops on
non-APPLE builds and respects a user-set Qt5_DIR.
- On macOS, dyld does not search /opt/homebrew/lib by default.
gobject-introspection typelibs reference libs by bare basename,
causing gst-plugin-scanner to fail to load plugins and adding
~90s of timeout to Gazebo's cold start. Set
DYLD_FALLBACK_LIBRARY_PATH to the Homebrew prefix lib dir in
gz_env.sh so the bridge launch inherits it. Darwin-scoped, no
effect on Linux or CI.
- configure_file on gz_env.sh.in now uses @ONLY so shell ${VAR}
references pass through untouched.
Verified locally on macOS 26.4 / arm64 / Homebrew 5.1.7: configure
clean, 1119/1119 targets compile and link, vehicle spawns in
Gazebo Harmonic 8.11.0 with a single "Waiting for Gazebo world"
wait (was ~18 before the dyld fix).
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
* refactor: make timer_io_channels[].timer_channel 0-indexed
timer_channel was 1-indexed (1-4) to mirror STM32 hardware naming
(TIM_CH1-CH4), but this was purely cosmetic — the ccr_offset field
already handles register mapping. Every consumer did timer_channel - 1
to get a 0-based index, creating underflow bugs when the guard was
missing (e.g. dshot.c capture_complete_callback,
output_channel_from_timer_channel, up_bdshot_get_erpm).
Changes:
- STM32: Timer::Channel enum starts at 0, initIOTimerChannel assigns
directly, removed all timer_channel - 1 in dshot.c and io_timer.c
- NXP (kinetis, s32k1xx, s32k3xx): removed the + 1 in
initIOTimerChannel, removed timer_channel - 1 in io_timer.c,
led_pwm.cpp, and input_capture.c
- RPI: Channel enum starts at 0, removed timer_channel - 1 in
io_timer.c
- Validity checks updated from timer_channel <= 0 || >= 5 to
timer_channel >= 4
Closes#26747
Signed-off-by: Pavel Guzenfeld <pavelgu@gmail.com>
* fix: complete 0-indexed timer_channel migration across all platforms
Address review feedback for incomplete migration:
1. STM32H7 io_timer_hw_description.h: update standalone
initIOTimerChannel() to assign timer_channel from enum
(0-based) instead of hardcoded 1/2/3/4
2. Switch case labels: update all switch(timer_channel) blocks
from 1/2/3/4 to 0/1/2/3 in:
- stm32_common: input_capture.c (4 blocks), led_pwm.cpp (3),
io_timer.c DMA base register switch
- kinetis: input_capture.c (2 filter blocks)
- s32k1xx: input_capture.c (2 filter blocks)
- spix_sync.c (ark/fpv + ark/pi6x, 3 blocks each)
3. Sentinel checks: replace timer_channel != 0 / == 0 (which
now conflicts with valid channel 0) with gpio_out-based
checks in:
- io_timer_validate_channel_index() across all 5 platforms
- led_pwm_channel_init() and led_pwm_servo_get() in all
led_pwm.cpp variants (STM32 + 4 NXP)
- spix_sync_channel_init() and spix_sync_servo_get()
Tested: px4_fmu-v6x_default (H7) build OK, px4_sitl_default
build OK, 154/154 unit tests pass, ASan build clean.
* fix: update NXP board led_pwm_channels to 0-indexed timer_channel
These 4 board files manually specify led_pwm_channels[] with
1-indexed timer_channel values. Since the platform code no longer
subtracts 1, decrement all values to match the new 0-indexed
convention.
* fix: correct FTM CH3 filter mask in kinetis and s32k1xx input capture
Case 3 in up_input_capture_set_filter() was using CH2FVAL_MASK/SHIFT
instead of CH3FVAL_MASK/SHIFT due to a copy-paste error, causing
channel 3 filter writes to modify channel 2's filter register instead.
---------
Signed-off-by: Pavel Guzenfeld <pavelgu@gmail.com>
Co-authored-by: Jacob Dahl <dahl.jakejacob@gmail.com>
CMake 3.27+ warns on cmake_minimum_required(VERSION < 3.10), and CMake
4.x will make it a hard error. Align the lockstep_scheduler subdir with
the root CMakeLists.txt, which is already at 3.10.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
- Replace all MINDPX/MINDPXv2/PX4FMU board references with SaamPixV1_1
- Update Airmind Development Team to Saam Drones Development Team in copyright headers
- Update PX4 copyright year range to 2020-2026 on all C/C++ files
- Rename bootloader binary to match board version (v1_1)
- Remove untracked backup files
POSIX/SITL builds on macOS produce two classes of benign warnings that
clutter output and obscure real issues:
ranlib: warning: 'lib*.a(foo.o)' has no symbols
ld: warning: ignoring duplicate libraries: ...
The ranlib warnings come from sources wrapped in #if defined(CONFIG_*)
guards (i2c.cpp, spi.cpp, board_common.c, pab_manifest.c,
px4_log_history.cpp) and dummy.cpp placeholders, which legitimately
compile to empty object files on POSIX. GNU ranlib ignores this;
Apple's warns. The warning is emitted by 'ar qc' (which implicitly
builds a symbol table), not by ranlib itself, so overriding only
ARCHIVE_FINISH is insufficient. Use 'ar qcS' to skip the implicit
symbol table, then let ranlib -no_warning_for_no_symbols build it
quietly via ARCHIVE_FINISH.
The duplicate-library warnings come from CMake intentionally
re-emitting static libraries on the link line to resolve circular
dependencies between px4_layer, px4_work_queue, px4_daemon and
lockstep_scheduler. GNU ld silently dedupes; Apple's ld-prime
(Xcode 15+) warns. Pass -no_warn_duplicate_libraries to the linker.
Both fixes are Darwin-only and have no effect on Linux CI or NuttX
builds.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Add cmake/cpack infrastructure for building .deb packages from
px4_sitl_sih and px4_sitl_default targets. Includes install rules,
package scripts, Gazebo wrapper, and CI workflow.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Add a scalable .deb packaging framework for VOXL2, built on the
existing cmake/package.cmake CPack infrastructure. The framework
handles multi-processor boards by having the POSIX (_default) build
own the .deb and pull in the companion SLPI build's artifacts.
Board-specific files:
- cmake/package.cmake: CPack variable overrides (name, deps, version)
- cmake/install.cmake: install() rules for all .deb contents
- debian/postinst: px4-* symlinks, DSP signature, directory setup
- debian/prerm: service stop, symlink cleanup
- debian/voxl-px4.service: systemd unit (after sscrpcd)
Infrastructure changes:
- cmake/package.cmake: hook for board-specific CPack overrides
- platforms/posix/CMakeLists.txt: hook for board install.cmake
- Makefile: %_deb pattern rule (build _default, then cpack -G DEB)
- CI: auto-discover _deb targets, collect .deb artifacts, upload
to GitHub Releases
Future boards: add cmake/package.cmake + cmake/install.cmake and
CI discovers it automatically. No new file formats or tools needed.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Overhauls the DShot driver with per-timer BDShot selection, multi-timer
sequential capture, Extended DShot Telemetry (EDT), and AM32 ESC EEPROM
read/write via MAVLink. Expands ESC support from 8 to 12 channels.
BDShot:
- Per-timer BDShot protocol selection via actuator config UI
- Multi-timer sequential burst/capture on any DMA-capable timer
- Adaptive per-channel GCR bitstream decoding
- Per-channel online/offline detection with hysteresis
Extended DShot Telemetry (EDT):
- Temperature, voltage, current from BDShot frames (no serial wire)
- New DSHOT_BIDIR_EDT parameter
- EDT data merged with serial telemetry when both available
AM32 EEPROM:
- Read/write AM32 ESC settings via MAVLink ESC_EEPROM message
- ESCSettingsInterface abstraction for future ESC firmware types
- New DSHOT_ESC_TYPE parameter
Other changes:
- Per-motor pole count params DSHOT_MOT_POL1–12 (replaces MOT_POLE_COUNT)
- EscStatus/EscReport expanded to 12 ESCs with uint16 bitmasks
- Numerous bounds-check, overflow, and concurrency fixes
- Updated DShot documentation
The mavlink_tests module was deleted in 1009268d31 but several
references were left behind, breaking builds on all targets.
Removed:
- CMakeLists.txt: add_subdirectory(mavlink_tests)
- mavlink_ftp.cpp: #include of deleted mavlink_ftp_test.h
- mavlink_ftp.h: MavlinkFtpTest forward decl and friend class
- posix-configs/SITL/init/test/test_mavlink: dead init script
- sitl_tests.cmake: sitl-mavlink CTest target
- install-voxl.sh: px4-mavlink_tests symlink
Ref: https://github.com/PX4/PX4-Autopilot/issues/26738
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Fix return value bug in px4_task_spawn_internal returning the arg-parsing
loop variable instead of the task index. Add pthread_attr_destroy calls
to prevent resource leaks on task creation failure, deletion, and exit.
Fix race condition in px4_task_delete by unlocking the mutex before
pthread_join and properly joining after pthread_cancel. Fix mutex unlock
placement in px4_task_exit to only unlock when the mutex was acquired.
This cherry-picks upstream commits adding NAND flash support for the
Winbond W25N specifically W25N01GV chip.
NAND flash is used together with littlefs, hence I updated that to 2.5.1
to match upstream NuttX.
call into a new UORB COMMUNICATOR ICHANNEL shutdown interface if it has been configured, otherwise it
does nothing. This allows ICHANNEL implementations to pass on a shutdown indication to a remote processor.
Implemented the shutdown interface in the muorb module for VOXL flight controllers.
* Tools: rewrite uploader script
This adds a script called px4_uploader.py which is a complete rewrite
using Claude Code of px_uploader.py.
The main improvements over the previous px_uploader.py script are:
- Separate smaller classes instead of one big uploader class.
- Easier debugging with --verbose or --debug flags.
- Nicer progress animation.
- No more hard to debug Exception swallowing over multiple levels.
- Auto-detection and looping of devices, removing the functionality from
cmake.
- Auto-detection of PX4 devices by USB VID/PID.
- Add noninteractive mode
- Add JSON output mode
* Implemented driver for MCP23017
* fixed compatability with mcp23009. (naming of instantiated GPIO-Devices)
* removed some comments
* removed even more comments
* commented out instatntiation of driver since it will not be used with v6x
* removed last useless comments
* re-activated gpio_mcp23009 driver, removed useless comments and empty lines
* removed empty lines at the end of mcp23017.cpp
* removed empty line
* Implemented driver for MCP23017
* fixed compatability with mcp23009. (naming of instantiated GPIO-Devices)
* removed some comments
* removed even more comments
* commented out instatntiation of driver since it will not be used with v6x
* removed last useless comments
* re-activated gpio_mcp23009 driver, removed useless comments and empty lines
* removed empty lines at the end of mcp23017.cpp
* removed empty line
* basic working implementation
* first improved driver version with shared code base for MCP23009 & MCP23017 (built as state machine with sanity checks)
* removed unused imports
* changed module name from MCP to MCP230XX
* removed debug print statements
* adjusted auto start command of driver
* removed comments
* -added seperate main functions for both derivative modules (mcp23009 and mcp23017)
* compile common functions as shared library in src/lib/drivers
* fixed cleanup of modules
* ->unclean working version with shared common library
* used make format
* working & cleaned version
* -> Added CallbackHandler to be able to use multiple reading GPIO-expanders simultaneously
-> Removed old mcap23009 calls and pin registrations
-> Adjusted GpioIn.msg to contain MAX_INSTANCES
* ->removed unused imports
->used make format
* Fix: Re-enabled platform_mcp_gpio for accton-godwit, cuav, fmu-v5x
* Fix: enabled platform_mcp_gpio in px4/fmu-v5x
* added depency to fmu-v5x
* Fix: removed new lines
* Fix: fixed linker errors
* removed unused linkage against mcp-library
* Made mcp start calls consistent for fmu-v5x and fmu-v6x
* moved logging of comm errors to read/write function directly
* added perf_count for sanity_check
* removed error message
* ensured member variables follow naming convention
* added retries to probe function
* simplyfied state-logic
* add break to terminate loop early
* ensured clean state when register_gpios() fails
* add registered-flag to pins
* used path from top dir instead of relative path in CMakeLists
* used constexpr to set parameters instead of calculating them at runtime
* style: used make format
* fix: corrected i2c_bus assignment
* style: init input of callbackhandler to 0
* fix: mark pin as registered if successful
* style: made arguments const type
---------
Co-authored-by: Alexander Lerach <alexander@auterion.com>
AM32 bdshot doesn't do clock compensation like BLHeli32 did.
Instead we traing BDSHOT timing on known zero value to lock on
best bdshot baudrate to receive.
Reduces CRC and frame errors on AM32 a lot
* rt106x: Use platform SPI hal layer
* rt106x: Add romapi support and reboot to isp/bootloader
* bootloader: imxrt_common: Add rt106x support
* NXP MR-Tropic initial commit
* Add missing file for mr-tropic bootloader
* nxp-mr-tropic:Bootloader Alow Assertion debugging & Keep Ram Vectors
* nxp-mr-tropic: Firmware Boot from bootloader
* nxp-mr-tropic:Add Bootloader bin file
* mr-tropic: Update config and linker
Fixes enet issues with write-back and some code cleanup.
Furthermore increase NOR LittleFS to 256kB to reflect on linker
* Update NuttX
* mr-tropic: fix itcm apping and add mr-tropic to itcm check
---------
Co-authored-by: David Sidrane <David.Sidrane@NscDg.com>
Julian Oes
alexcekay
abhijithcv
Ramon Roche
Jacob Dahl
Pavel Guzenfeld
Ashwani Sihag
Ashwani Sihag
Nick
Eric Katzfey
Jacob Dahl
Ege Kural
Eric Katzfey
Phil-Engljaehringer
Tarmo Tänav
Alexis Guijarro
Peter van der Perk
Niklas Hauser
Peter van der Perk
Thijs Hof