Scope of the Board Support Package in Software, Standard vs. Extended BSP
- October 17, 2026
- CAVU Aerospace UK
We have a std. scope of supply for every single OBC which covers all requirements that a developer/ end-user needs to have on OBC. For PolarFire computers including OBC-Hyper-Polar, OBC-Cube-Polar & PF-VPX, this includes:
- Microchip MSS drivers (mpfs-hal, mss-can, mss-ethernet-mac, mss-gpio, mss-i2c, mss-mmc, mss-mmuart, mss-pdma, mss-qspi, mss-rtc, mss-spi, mss-sys-services, mss-timer, mss-usb, and mss-watchdog)
- Microchip FPGA IP core drivers (x40 RS422 UART, CAN, RS485, RS232, ADC, CoreMMC, PF_PCIe, GPIO)
- Custom drivers developed for HYPER peripherals and interfaces
- A test application platform to evaluate HYPER performance
- Comprehensive SoftConsole test projects to verify the performance of critical modules, including Ethernet and DDR memory
Std. Board Support Package including:
The bare-metal:
- Microchip MSS drivers (mpfs-hal, mss-can, mss-ethernet-mac, mss-gpio, mss-i2c, mss-mmc, mss-mmuart, mss-pdma, mss-qspi, mss-rtc, mss-spi, mss-sys-services, mss-timer, mss-usb, and mss-watchdog)
- Microchip FPGA IP core drivers (RS422 UART, CAN, RS485, RS232, ADC, CoreMMC, PF_PCIe, GPIO)
- Custom drivers developed for HYPER peripherals and interfaces
- A test application platform to evaluate HYPER performance
- Comprehensive SoftConsole test projects to verify the performance of critical modules, including Ethernet and DDR memory
The Yocto:
- HSS SoftConsole project for HYPER
- A Yocto layer for HYPER built on top of Microchip’s main Yocto BSP
- Documentation for creating a HYPER image
- MSS and fabric device tree files
But software support & user guide can be much wider. Software support mostly happens in CAVU GitLab, but we also provide several software users guides for specific purposes. Below is just outline of CAVU PolarFire SoC OBC Software User Manual.
Scope and applicability
- OBC-Cube-Polar scope
- OBC-HYPER-POLAR scope
- PF-VPX SOSA aligned computers & storage cards
- HYPER-2, HYPER-2 QE, and Hyper-PCI variants
- Cube hardware and option-sheet variants
- Optional or customer-specific features
- Supported software combinations
- Unsupported and retired configurations
- Planned capabilities and design intent
How to use this manual
Operator reading path
System integrator reading path
Linux application developer reading path
Firmware developer reading path
FPGA developer reading path
Test and assurance reading path
Support and recovery reading path
Conventions
Applicability labels
Evidence and verification labels
Command prompts and execution contexts
Addresses, units, and byte ordering
Signal names, pin numbers, and directions
Warnings and irreversible operations
Examples and placeholders
Versioned paths and device names
Controlled references
Product hardware manuals
Connector and option-sheet documents
Software and firmware repositories
Programming and recovery guides
Watchdog and FDIR guide
SpaceWire guides
Upstream tool and silicon documents
Standards and assurance documents
Microchip PolarFire SoC MSS and PCIe guides
Upstream HSS service and payload guides
Yocto development, testing, and release guides
CAVU Cube start guide
CAVU HYPER watchdog and FDIR guide
CAVU boot and programming guides
CAVU camera and PCIe project records
Source revision and retrieval record
CAVU WDM release and verification table
Microchip watchdog, health-monitor, and reboot guides
Delivered HSS binary and source-branch cross-reference
Microchip AMP, IHC, RPMsg, and remoteproc guides
Microchip AMP example release and memory-map version
CAVU Zephyr, RTEMS, and bare-metal release records
RTEMS BSP and Zephyr board documentation
Publication architecture
Master outline and controlled chapter sources
Volume and part boundaries
Common chapters and product-specific profiles
User procedures and engineering reference separation
Normative text and informative examples
Evidence needed before a section is released
Cross-reference and citation conventions
Figure, table, and code-listing registers
Search terms and navigation aids
Translation and accessible-format policy
Release and feature status
Feature availability by product
Feature availability by board revision
Feature availability by FPGA job
Feature availability by firmware build
Feature availability by Linux image
Demonstrated, unverified, and planned behavior
Deviations and customer-specific exceptions
Known conflicts between source documents
Safety and procedure governance
Hazardous and destructive operations
Required competence and access
Preconditions and go/no-go criteria
Expected observations
Abort and rollback criteria
Evidence capture and sign-off
Independent review requirements
Part 1 – Product identity and release identification
1.1 Product-family map
OBC-Cube-Polar identity
OBC-HYPER-POLAR identity
Historical names and aliases
Board revisions and serial numbers
FPGA device and package options
Add-on cards and expansion options
Client-specific configurations
1.2 Software release composition
Release identifier and manifest
HSS revision
OpenSBI revision
U-Boot revision
Linux kernel revision
Yocto layers and machine
Device-tree revision
FPGA design and programming job
Root filesystem and applications
RTOS and bare-metal payloads
AMP context-A and context-B image revisions
Zephyr SDK and west manifest revisions
RTEMS Source Builder and BSP revisions
FreeRTOS kernel, HAL, and application revisions
RPMsg, remoteproc, and IHC protocol revisions
1.3 Identify a delivered board
Label and serial-number evidence
Fitted memory and storage options
Connector and harness options
Programming-job evidence
HSS boot banner and TinyCLI version
U-Boot banner and environment
Linux release files and kernel identity
Device-tree model and compatible values
Release consistency check
1.4 Compatibility and change control
Hardware-FPGA compatibility
FPGA-device-tree compatibility
HSS-payload compatibility
U-Boot-kernel compatibility
Kernel-module and UAPI compatibility
Boot media and partition compatibility
Downgrade and migration constraints
Known release limitations
Hardware option to FPGA job compatibility
FPGA job to HSS compatibility
HSS payload to U-Boot compatibility
Device tree to fabric register-map compatibility
Camera module to capture-build compatibility
PCIe endpoint to root-port-build compatibility
Part 2 – First use and bench preparation
2.1 Before applying power
Product and variant identification
ESD and bench setup
Power supply and current limit
Ground and isolation
Harness verification
Boot switch and jumper record
Debug and programming access
2.2 Host computer preparation
Supported host operating systems
Serial-terminal software
USB serial drivers
FlashPro and Libero tools
Disk-image writing tools
Git and repository access
Checksums and release-package validation
2.3 First power-on
Capture both console streams where fitted
Identify boot stages
Enter HSS TinyCLI
Enter U-Boot
Confirm Linux or RTOS startup
Confirm selected boot medium
Record first-boot evidence
2.4 First-session acceptance
Hardware and firmware identity
Memory and storage detection
Network and serial interfaces
Time and RTC status
Health and fault indicators
Baseline support bundle
Acceptance record and handover
Part 3 – Platform architecture
3.1 Processing and execution domains
E51 supervisory hart
U54 application harts
MSS and FPGA fabric boundary
Linux SMP allocation
AMP and mixed-criticality allocations
Interrupt and inter-hart communication
Reset domains
One or two U54 software contexts
HSS ownership of the E51 hart
SMP harts within one context
AMP context boundaries between harts
Machine and supervisor privilege by payload
3.2 Memory architecture
On-chip memory
MSS LPDDR4
Fabric DDR where fitted
Cached and non-cached windows
Reserved firmware and payload regions
DMA and contiguous memory
Shared memory for AMP
Retained non-volatile memory
Memory protection and ownership
ECC coverage by memory region
DDR address aliases and cache attributes
32-bit and 38-bit address windows
DMA reachability by bus master
Memory barriers and cache maintenance
Per-context DDR region allocation
Shared-memory and vring reservation
Firmware resource-table location
Context-specific cache attributes
3.3 Storage architecture
eNVM and sNVM
QSPI devices and bank selection
MSS eMMC
Fabric eMMC
Micro-SD where fitted
SPI MRAM where fitted
Parallel MRAM where fitted
SPI FRAM where fitted
Storage naming across HSS, U-Boot, and Linux
3.4 Fabric integration
FPGA design hierarchy
FIC address windows
APB and AXI clocks
Fabric interrupts
DMA masters and address reachability
Reset and clock dependencies
Device-tree representation
Design-specific optional IP
FIC initiator and target paths
APB and AXI register-access paths
Fabric clock and reset domains
SerDes lane allocation
Shared fabric resources across add-ons
3.5 Software stack and handoffs
System controller to HSS
HSS to OpenSBI and U-Boot
U-Boot to Linux
HSS to RTOS or bare-metal payload
Linux to application services
Version and integrity evidence at each handoff
Part 4 – Boot chain and boot policy
4.1 Power-on and early initialization
System-controller sequence
eNVM image selection
FPGA fabric availability
MSS clock initialization
DDR training
Early console
Reset-cause capture
Reset-cause lifetime across warm and cold reboot
Retained FDIR record load before boot-source selection
4.2 HSS payload discovery
Product-specific search order
Storage selection and boot switch
Payload container format
Header validation
Load and execution addresses
Hart ownership
Boot timeouts
Fallback behavior by release
GPT partition discovery and validation
Payload chunk table and zero-fill regions
Compression and decompression bounds
Signed-payload policy where enabled
Null AMP payload option by HSS release
Source-selection telemetry
Multiple image entries in one AMP payload
Owner and secondary-hart fields
Privilege mode and OpenSBI skip flag
Late-attach skip-autoboot option
Context-specific entry points
Unused-hart or null-payload behavior by release
4.3 OpenSBI handoff
Privilege transition
Hart startup
SBI services
Vendor extensions by release
Interrupt delegation
Debugging handoff failures
4.4 U-Boot startup
Console and prompt
Board initialization
Environment source
Boot script selection
eMMC and SD enumeration
QSPI access
Network boot facilities
Device-tree and overlay loading
4.5 Kernel and root filesystem selection
FIT image components
Kernel command line
Device-tree configuration
Initramfs
Root partition identification
Filesystem mount and first process
Readiness milestone
4.6 Alternate boot models
Zephyr fast boot
RTEMS boot
Bare-metal payload boot
AMP multipayload boot
Network-assisted development boot
Recovery-media boot
Linux plus bare-metal early boot
Linux plus FreeRTOS early boot
Linux plus RTOS late attach
RTOS plus RTOS simultaneous boot
Bare-metal plus bare-metal simultaneous boot
Linux remoteproc-managed secondary context
4.7 Boot evidence and timing
Annotated boot log
Stage-by-stage timing
Boot-source evidence
Failure classification
Repeated-boot evidence
Controlled boot-time optimization
Per-stage time origin and clock source
Cold, warm, and watchdog-reset timing
Payload size and load-time contribution
Golden-image recovery timing
Camera and PCIe initialization timing
Watchdog event to restart time
OS-ready deadline start and cancellation evidence
Boot-stage and retained-event correlation
Part 5 – Hart Software Services
5.1 HSS source and board ports
Repository structure
Cube board configuration
HYPER board configuration
Build profiles
Configuration ownership
Release source identification
Upstream HSS versus CAVU fork boundaries
Service registry and state-machine superloop
Event triggers and service ordering
Board-specific memory and health-monitor tables
Feature-detection method for a delivered binary
Watchdog Kconfig comparison by board
WDM release to HSS build provenance
Upstream health monitor versus CAVU FDIR ownership
5.2 HSS services
DDR service
Boot service
QSPI service
MMC and SD services
USB mass-storage service
Watchdog service
Inter-hart communication
Memory test and ECC diagnostics
PCIe service where fitted
Error reporting
Startup and post-boot trigger events
Payload parser and staging service
GPT and partition validation
Scatter-gather DMA service
Block error unit and double-bit ECC response
Memory scrubbing and cache coordination
System-controller and reset services
Health-monitor service
E51 lockdown service where configured
Suspend and resume service by HSS release
Custom CAVU service registration
Per-service Kconfig and dependencies
Per-hart watchdog status polling
E51 watchdog refresh responsibility
Boot-set restart request path
Cold-reboot permission and payload entitlement
Health-monitor register sampling where enabled
FDIR-to-boot-service coordination on applicable builds
Multiple boot sets and hart release
Per-context PMP and OpenSBI domain setup
Early boot versus late-attach preparation
Context warm restart and system cold reset
AMP-specific watchdog policy
5.3 TinyCLI
Entering and leaving the console
Command availability by release
Boot-source selection commands
Storage inspection commands
USB mass-storage commands
Memory and ECC commands
Watchdog and FDIR commands
Reset and reboot commands
Error and status output
Console privilege and access policy
Command side effects and persistence
Version, build, and feature interrogation
Payload and boot-source diagnostics
MRAM and FDIR diagnostic readout
Output capture for support evidence
FDIR read-only telemetry command
FDIR timeout suspension command by release
Watchdog and health-monitor debug commands
Console capture before destructive recovery
5.4 HSS build and programming
Toolchain and host prerequisites
Board defconfig
Configuration changes
Build outputs
Payload generation
eNVM image packaging
FlashPro job integration
eNVM-only programming
Post-program verification
MSS configuration XML provenance
eNVM wrapper, compression, and size budget
HSS payload-generator YAML schema
Multi-hart payload descriptors
Signed-payload generation and verification
Factory and field build profiles
HSS binary to Libero job compatibility
5.5 HSS diagnostics and faults
No HSS banner
DDR training failure
Missing boot source
Payload validation failure
Hart-release failure
USB export failure
Watchdog reset
Retained diagnostic evidence
Service state-transition trace
Trigger and event tracing
Memory scrub statistics
BEU and ECC event interpretation
Watchdog forbidden-window diagnosis
HSS profiling and time budget
Failed eNVM wrapper or decompression
E51 watchdog reset signature
U54 watchdog boot-set restart signature
BEU fault to watchdog response
FDIR-triggered cold reset signature
Reset request rejected by privilege policy
Superloop delay and missed refresh diagnosis
Part 6 – OpenSBI and U-Boot
6.1 OpenSBI configuration
Build provenance
Platform hooks
SBI service availability
Vendor-call compatibility
Console and debug output
SBI extension inventory
Vendor SBI reporting contract
Timer and IPI delegation
Platform build and version provenance
OpenSBI per-context domain registration
PMP access limits for mixed privilege payloads
HSM and remote-hart lifecycle calls
SBI availability to supervisor-mode context
Machine-mode payload isolation assumptions
6.2 U-Boot source and configuration
Repository and patch set
Defconfig by product
Device-tree selection
Driver enablement
Build outputs
Image packaging with HSS
Board defconfig provenance
Device-tree matching to FPGA job
PCIe and camera-related boot settings
Secure FIT and verified-boot options
6.3 U-Boot environment
Default variables
Persistent environment location
Inspection and modification
Save and rollback
Corruption recovery
Variables controlled by release scripts
6.4 U-Boot storage and network operations
Enumerating eMMC and SD
Reading partitions and filesystems
Loading FIT images
QSPI operations
Ethernet configuration
TFTP and network transfer
Manual boot
6.5 Boot scripts and overlays
Boot script source
Script compilation
Kernel search order
FIT configuration choice
Overlay selection
Overlay compatibility
Failure recovery
Part 7 – Linux image and runtime administration
7.1 Image composition
Image families and intended use
Kernel and modules
Base packages
CAVU packages
Development tools
Factory credentials and access policy
Image manifest and licences
7.2 Linux startup
Kernel log and early console
Device-tree loading
Driver probe order
Init system by release
Service dependency graph
Application readiness
Shutdown and reboot
7.3 Users and access
Factory account state
Password and SSH key provisioning
Local console login
Remote administration
Group and device permissions
Service accounts
Audit trail
7.4 Filesystems and persistent data
Partition layout
Mount table
Read-only and writable regions
Log persistence
Application data location
Wear and write amplification
Free-space monitoring
Backup scope
Secondary-context firmware storage
Remoteproc firmware-name and load path
Shared-memory ownership across reboot
7.5 Services and process management
Service inventory
Start, stop, and restart
Startup ordering
Service failure policy
Resource limits
Watchdog integration
Deployment and rollback
Linux readiness service ordering
systemd watchdog ownership where configured
Application heartbeat and escalation policy
7.6 Logging and observability
Kernel ring buffer
System log or journal by release
Persistent logs
Boot log correlation
Fault and crash capture
Time synchronization in logs
Support bundle generation
Kernel panic and watchdog log collection
Reboot reason across volatile and retained logs
FDIR report submission audit trail
7.7 Timekeeping
RTC sources
Boot-time clock initialization
NTP and PTP
Clock accuracy and drift
Timestamp provenance
Battery and holdover state
7.8 Linux performance and capacity
CPU loading
Memory and CMA
Storage bandwidth
Network bandwidth
Interrupt loading
Thermal and power effects
Baseline measurement method
DMA buffer allocation and fragmentation
Cache coherency measurements
IRQ affinity and worst-case service time
Concurrent camera and PCIe load
Part 8 – Yocto and reproducible Linux builds
8.1 Source repositories and manifests
Cube Yocto repository
HYPER Yocto repository
Upstream layers
CAVU layer structure
Branches, tags, and pinned revisions
Source mirrors and archives
Archived versus maintained upstream BSP layers
Yocto release-series compatibility
Source revision lockfile
License and source-archive inventory
8.2 Build-host preparation
Supported host distribution
Host packages
Disk, RAM, and network requirements
Git and credentials
Build cache and shared state
Proxy and offline builds
8.3 Machine and image selection
Cube machine configuration
HYPER machine configuration
Hyper-PCI machine configuration
Development and production images
Distro and init-system settings
Kernel, U-Boot, and HSS providers
AMP-specific CAVU machine status
Upstream Icicle AMP demo versus CAVU product build
Second-context firmware package selection
Early-boot and late-attach image profiles
8.4 First build
Workspace setup
Layer verification
Configuration inspection
Image build
Build logs
Deploy artifacts
Build reproducibility record
Layer compatibility check
BitBake environment dump
Build-history capture
WIC image and partition inspection
Artifact hashes and signatures
Clean-room rebuild comparison
8.5 Customization
Package selection
Kernel configuration
Device-tree changes
U-Boot changes
HSS payload changes
Application recipes
Users, services, and security settings
WIC partition layout
Product packagegroups and feature flags
Camera pipeline packages versus fitted hardware
PCIe endpoint-driver packages
Fabric-dependent device-tree variants
Systemd service enablement
Read-only root filesystem option
Initramfs recovery image option
Multiconfig firmware and Linux build option
AMP device-tree CPU disablement
Reserved-memory nodes for second context
RPMsg vring and buffer reservations
Remoteproc resource-table packaging
FreeRTOS or bare-metal ELF recipe
Zephyr and RTEMS companion-image options
8.6 Development SDK
SDK generation
Cross-compiler setup
Sysroot use
Debug symbols
Application packaging
On-target deployment
8.7 Build troubleshooting
Fetch and authentication failures
Pseudo and tar failures
Host AppArmor or namespace restrictions
Disk and inode exhaustion
Stale shared-state artifacts
Kernel and device-tree errors
Image and WIC generation errors
Layer priority and bbappend selection
Recipe license-check failures
Kernel patch-order conflicts
Host contamination and uninative issues
Reproducibility mismatch diagnosis
8.8 Yocto release assurance
SBOM generation and storage
CVE and vulnerability triage
License manifest and source offer
Reproducible build checks
Package provenance and build history
Automated image and package tests
Binary artifact signing
Long-term branch migration
AMP payload reproducibility
Mixed-OS license and SBOM coverage
Version lock across both context images
Part 9 – Device trees, kernel configuration, and drivers
9.1 Device-tree organization
Base SoC tree
Product board tree
Fabric include files
Variant overlays
Aliases and chosen node
Reserved-memory nodes
Runtime tree inspection
PCIe host bridge ranges and DMA ranges
Camera media graph and endpoint links
Clock, reset, and regulator phandles
Reserved memory for capture and DMA
Fabric IP binding version
Context-owned CPU nodes
Linux-visible versus excluded peripherals
Secondary-context reserved memory
IHC channels and mailbox binding
Remoteproc and RPMsg nodes
Shared-memory cacheability and alignment
9.2 Kernel configuration
CAVU configuration fragments
Built-in versus module drivers
Required filesystems
Networking and SocketCAN
Industrial I/O
UIO and DMA buffers
Debug and tracing options
9.3 Driver integration
Driver source ownership
Device-tree bindings
Probe and error handling
DMA and cache coherency
Interrupt handling
User-space ABI
Module packaging and signing
Regression and compatibility tests
Linux media-controller and V4L2 subdevice drivers
PCIe host and endpoint-driver dependencies
DMA API and cache-coherency contract
Kernel module signing and packaging policy
RPMsg bus and client drivers
Remoteproc driver and firmware loader
IHC interrupt controller integration
Shared-memory DMA and cache API
9.4 Device-node mapping
MSS serial nodes
CoreUARTapb nodes
CAN interfaces
GPIO chips and line names
I2C and SPI buses
MTD devices
eMMC and SD block devices
UIO devices
Stable naming policy
Part 10 – Bare-metal, AMP, and RTOS development
10.1 SoftConsole and bare-metal workspace
Cube workspace
HYPER workspace
Toolchain and project setup
Board support package
MSS configuration
Linker scripts and memory placement
Debug launch configurations
CAVU board project versus Microchip example
MSS XML and HAL version pairing
Bare-metal startup code by hart
AMP-compatible linker configuration
Per-context UART debug allocation
10.2 Bare-metal boot and debugging
LIM execution
LPDDR4 execution
Fabric-memory execution where fitted
HSS payload generation
Hart assignment
JTAG download
Trap and fault diagnosis
Standalone payload versus AMP companion
HSS-trained DDR versus application DDR initialization
Machine-mode startup without OpenSBI
Interrupt and PLIC initialization ownership
MMU absence and physical-address contract
Remoteproc-loaded ELF option
Halted-hart debugger attachment
Fault register and stack capture
10.3 AMP architecture
Linux and RTOS hart partitioning
Shared-memory contract
IHC and mailbox
Device ownership
Interrupt ownership
Cache-coherency rules
Startup and shutdown ordering
Recovery from one-domain failure
Null payload for unused harts where supported
Remoteproc and RPMsg applicability
Memory ownership and coherency
Inter-hart fault containment
Per-context watchdog responsibilities
Single-hart versus boot-set restart
Cold reset entitlement across AMP contexts
Fault containment and shared-resource recovery
SMP versus AMP terminology and limits
Two-context maximum in the upstream model
Context A and context B hart sets
Boot set versus software context
Early simultaneous boot
Late attach under Linux control
Machine-mode versus supervisor-mode contexts
OpenSBI domains and PMP isolation
CPU node exclusion from Linux
Reserved-memory no-map policy
Per-context linker and load addresses
32-bit versus 38-bit shared-memory reachability
MMUART and debug-console ownership
IHC channel and interrupt routing
RPMsg master and remote roles
Remoteproc firmware life-cycle control
Remote crash detection and restart policy
Shared peripheral handoff policy
Release-specific memory-map compatibility
10.4 Zephyr
Supported board and release combinations
Workspace and west setup
Board definition and device tree
Fast-boot HSS pairing
Application build
Payload generation
Programming and boot verification
Driver coverage
Debugging and known limitations
HYPER validated single-U54 profile
Cube board-port status
Zephyr version and SDK pinning
Fabric DDR4 initialization and staging boundary
Zephyr device-tree chosen and memory-region nodes
Board root, DTS root, and west manifest
Machine-mode payload and OpenSBI bypass
Peripheral driver coverage by product build
Multi-hart SMP roadmap and prerequisites
Zephyr as second AMP context feasibility
Linux and Zephyr IPC integration status
FDIR OS-ready report contract for Zephyr
10.5 RTEMS
Supported BSP and release combinations
SDK build
BSP configuration
Device-tree embedding
Hello-world and periodic examples
SMP example
Payload generation
Programming and boot verification
Driver coverage and limitations
HYPER single-core demonstrated profile
HYPER four-core SMP demonstrated profile
Cube BSP port status
RTEMS Source Builder and toolchain pinning
mpfs64imafdc BSP variant and CAVU overrides
Embedded device-tree generation
Boot hart and secondary-hart assignment
Product HSS DDR-training requirement
LPDDR4 linker region and payload address
SMP clock, CLINT, and PLIC validation
RTEMS as second AMP context feasibility
Linux and RTEMS IPC integration status
Fabric DDR4 execution roadmap
FDIR OS-ready report contract for RTEMS
10.6 Other execution environments and isolation
Third-party RTOS integration checklist
Hypervisor or partitioning feasibility
Safety-critical software integration
Qualification evidence requirements
Third-party RTOS port requirements
Linux PREEMPT_RT versus separate RTOS context
Hypervisor and partitioning feasibility
Trusted execution and PMP boundaries
Safety-critical execution considerations
10.7 FreeRTOS on CAVU boards
Upstream Microchip example versus CAVU validation
CAVU status by delivered release
HYPER Ethernet and MAC initialization gap
Cube applicability and board-port status
FreeRTOS kernel and HAL version baseline
SoftConsole launch versus HSS payload launch
MSS clocks, PLIC, and pinmux initialization
Network, UART, CAN, and storage driver selection
Tick source and interrupt priority configuration
Task stack, heap, and memory placement
HSS payload YAML and machine-mode entry
FreeRTOS with Linux AMP profile
FreeRTOS with bare-metal AMP profile
FreeRTOS with FreeRTOS AMP profile
Watchdog and FDIR readiness reporting contract
Demonstration and qualification evidence
10.8 Multi-OS architecture and combination matrix
Linux plus bare-metal combination
Linux plus FreeRTOS combination
Linux plus Zephyr candidate
Linux plus RTEMS candidate
Zephyr plus bare-metal candidate
RTEMS plus bare-metal candidate
FreeRTOS plus FreeRTOS combination
FreeRTOS plus bare-metal combination
Bare-metal plus bare-metal combination
RTOS plus RTOS other than FreeRTOS candidate
One RTOS in SMP mode versus two AMP contexts
Per-combination applicability and evidence level
10.9 AMP payload and boot orchestration
Payload-generator YAML schema and version
Two image entries and boot-set ownership
Hart-entry-points and execution addresses
Owner and secondary-hart semantics
Privilege mode and skip-opensbi choice
Early-boot image loading order
Late-attach skip-autoboot configuration
HSS preparation of dormant context
Null payload and unused-hart options
U-Boot and RTOS concurrent startup logs
Firmware update coordination between contexts
Boot fallback with mismatched context images
10.10 AMP resource partition and protection
Hart ownership table
MSS and fabric peripheral ownership table
LPDDR4 and fabric DDR4 partitioning
Linux reserved-memory and no-map nodes
RTOS linker script and heap boundaries
Shared-memory region and access rights
Cache attributes and flush protocol
PMP and OpenSBI domain setup
Interrupt and PLIC context ownership
DMA channel and bus-master ownership
Clock, reset, and power-domain ownership
Security and fault-containment limits
10.11 IHC, RPMsg, and shared-memory IPC
IHC hardware and fabric-IP revision
Context A and B channel assignment
Mailbox interrupt and acknowledgment
RPMsg transport and virtqueue layout
Shared buffer and vring placement
Resource table and endpoint names
RPMsg master and remote roles
Linux RPMsg sample, TTY, and char clients
FreeRTOS and bare-metal RPMsg examples
Message framing, ordering, and backpressure
Cache coherency and memory barriers
Lost interrupt and remote-reset recovery
IPC compatibility and protocol versioning
10.12 Linux remoteproc and late attach
Applicability to delivered CAVU kernel and fabric
Early boot versus remoteproc late boot
Firmware resource-table content
HSS skip-autoboot payload setting
Device-tree binding and reserved memory
Linux firmware path and image authentication
Remoteproc start, stop, and restart
RPMsg endpoint creation after start
Remote crash notification and coredump
Watchdog and FDIR coordination
Firmware update and rollback
10.13 Mixed-OS build and release workflow
Unified version manifest across contexts
Yocto multiconfig firmware build option
Zephyr west manifest and board revision
RTEMS Source Builder and BSP revision
FreeRTOS and Microchip HAL revision
Bare-metal workspace and MSS XML revision
HSS payload generator version and YAML
ELF load-address and symbol inspection
Image pairing, signing, and checksums
Reproducible build and SBOM coverage
Per-context debug-symbol archive
10.14 Multi-OS debugging and recovery
Simultaneous console timestamping
HSS boot-service trace per context
GDB attach without disturbing other context
RTOS task and scheduler inspection
Remoteproc and RPMsg sysfs diagnostics
IHC interrupt and vring inspection
Cross-context deadlock diagnosis
Per-context watchdog and restart evidence
Memory overlap and PMP fault diagnosis
Fault isolation before full-system reset
10.15 Multi-OS verification and acceptance
Both contexts boot and remain responsive
Resource ownership and isolation tests
Shared-memory corruption and cache tests
RPMsg integrity, latency, and throughput
Remoteproc start-stop-repeat test
One-context crash with peer operating
Boot-set watchdog restart scope
FDIR OS-ready producer and deadline test
Warm versus cold reset consequences
Power-cycle and software-update tests
Long-duration mixed-load soak
Variant-specific acceptance record
Part 11 – Serial and console interfaces
11.1 Console ownership
HSS console
U-Boot console
Linux console
RTOS console
Simultaneous capture
Console handoff and time correlation
Two simultaneous AMP context consoles
RTOS or bare-metal UART ownership
RPMsg TTY as a logical console
Console access after remote context restart
11.2 MSS UARTs
Controller and pin assignment
Electrical interface by product
Baud rate and framing
Linux device names
Flow control
Debug access and conflicts
11.3 Fabric CoreUARTapb
Fitted channel inventory
Address and interrupt map
Driver and device names
Clock and baud calculation
FIFO and buffering
Permissions
Throughput and error testing
11.4 RS-232
Product and variant availability
Connector and pinout
RS-232 electrical levels
Cable and mating parts
Linux access
Loopback and peer testing
Fault isolation
11.5 RS-422
Product and variant availability
Connector and pair naming
Driver and receiver control
Termination and bias
Full-duplex operation
Linux access
Loopback and peer testing
Fault isolation
11.6 RS-485
Product and variant availability
Connector and pair naming
Half- and full-duplex options
RE and DE control
Termination and bias
Linux access
Turnaround timing
Fault isolation
11.7 Cube P2 console connector
Fitted connector and mating assembly
Pin 1 through pin 5 signals
HSS channel
U-Boot and Linux channel
RS-232 level interface
Harness verification
Part 12 – Common peripheral interfaces
12.1 CAN
Controller inventory by product
Connector and transceiver map
Termination and topology
Device tree and driver
SocketCAN naming
Bit timing and modes
Frame transmission and reception
Error counters and bus-off recovery
12.2 GPIO and Direct I/O
MSS and fabric banks
Connector mapping
Input and output electrical limits
Bank direction and enable
Linux line names
libgpiod commands and API
Edge events and timing
Safe startup state
12.3 ADC
Fitted converter by product
Channel-to-connector map
Input range and protection
Reference and calibration
Driver and user interface
Sampling rate and latency
Conversion and scaling
Diagnostic test
12.4 I2C
Bus inventory
Connector and pull-up map
Voltage levels
Address inventory
Linux adapter numbering
User-space transactions
Bus recovery
Device contention and faults
12.5 SPI
Controller and chip-select inventory
Connector exposure
Voltage and mode
Kernel driver ownership
spidev availability
Timing and throughput
Safe transaction procedure
12.6 Housekeeping sensors
Voltage rails
Current monitors
Temperature sensors
Thresholds and calibration
Linux hwmon paths
Telemetry sampling
Fault interpretation
12.7 RTC and time sources
External RTC by product
MSS RTC
Battery and holdover
Linux RTC device names
Set and read procedures
Time validity at boot
Leap seconds and time zones
12.8 PWM, timers, and watchdog peripherals
Available timers
Clock sources
Linux and firmware ownership
Capture and compare
Timeout calculations
Verification and fault injection
Part 13 – Non-volatile storage and removable media
13.1 QSPI boot flash
Device inventory and bank map
HSS access
U-Boot access
Linux MTD access
Erase, write, and verify
Golden image protection
Bank-selection evidence
Endurance and retention
13.2 MSS eMMC
Device population and capacity
HSS source role
U-Boot numbering
Linux block-device mapping
Partition layout
pSLC configuration
Health counters
Clone, backup, and restore
13.3 Fabric eMMC
CoreMMC and high-speed eMMC variants
FPGA and clock dependencies
Driver selection
U-Boot enumeration
Linux block-device mapping
Provisioning and fallback
Performance and health
13.4 Micro-SD
Product availability
Card qualification
Connector and insertion
HSS use
U-Boot use
Linux use
Recovery-image layout
Removal and data-integrity rules
13.5 MRAM and FRAM
HYPER SPI MRAM
Cube parallel MRAM options
Cube SPI FRAM
Device-tree and user-space access
Write-protection signals
Record format and ownership
Retention and integrity tests
Failure handling
HYPER SPI MRAM diagnostic commands
Cube parallel MRAM address and usable-size limits
Cube SPI FRAM access and persistence tests
Retained-state corruption and recovery tests
13.6 Filesystems and partitions
Boot FAT partition
Payload partition
Root filesystem
Update or recovery partition
Partition UUIDs and labels
Filesystem checks
Resize and migration
Part 14 – Networking and external data links
14.1 Ethernet
MAC and PHY inventory
Connector and magnetics options
Interface naming
MAC-address provenance
DHCP and static addressing
Link negotiation
VLAN and routing
Throughput and latency
Fault isolation
14.2 Precision time protocol
Hardware timestamp capability
Clock-device mapping
PTP daemon configuration
Synchronization measurement
Holdover and failure behavior
14.3 USB
Host and device roles
Physical connector and VBUS
Linux host drivers
Gadget functions
HSS USB mass-storage mode
Enumeration diagnostics
Cable and host compatibility
14.4 PCIe
Variant availability
Root-complex configuration
Lane and clock requirements
Enumeration and BAR map
DMA and interrupts
Endpoint-driver integration
Link training diagnostics
HYPER Hyper-PCI and QE applicability
Cube SerDes add-on applicability
Root-port and endpoint role boundaries
Libero PCIe hard-IP configuration
FIC and AXI data paths
APB register-access path
32-bit versus 38-bit addressing configuration
Inbound and outbound address translation
DDR window and BAR sizing
Reference clock, PERST, and reset sequencing
SerDes lane allocation and link width
Link generation, equalization, and training
Bus enumeration and resource allocation
Legacy INTx and MSI routing
Endpoint DMA addressability and cache coherency
IOMMU or isolation availability by build
NVMe, Ethernet, and custom endpoint profiles
QE four-port Ethernet card enumeration
PCIe peer or Jetson experimental integration
Hot-plug support and power-cycle requirements
AER and error-recovery support by release
Throughput, latency, and error counters
PCIe acceptance log and topology capture
14.5 SpaceWire
Variant and IP availability
Connector and link map
FPGA register and interrupt map
Linux driver and user API
Bare-metal driver
Link initialization
Packets and routing
RMAP and CCSDS profiles
DMA descriptors
Performance and error tests
Clock recovery and link-state timing
Time-code generation and capture
RMAP target access control
Packet loss and retry policy
Camera trigger and frame protocol where used
14.6 LVDS and other fabric links
Variant availability
Connector and pair assignment
Clocking and termination
FPGA IP and software interface
Test pattern and loopback
Signal-integrity evidence
Part 15 – Expansion and special-purpose interfaces
15.1 Expansion connectors and add-on cards
HYPER add-on connector
Cube expansion headers
Power and sequencing
Pin multiplexing
FPGA design changes
Device-tree overlays
Driver and application integration
Compatibility record
SerDes resource conflict matrix
Add-on identity and board-revision detection
Expansion power budget and inrush
Hot-plug prohibition or qualification
Add-on-specific release manifest
15.2 HYPER-2 QE Ethernet expansion
Add-on hardware variants
MAC and port map
PHY and magnetics
Linux naming
Switching or routing configuration
Port-by-port validation
15.3 Camera and video interfaces
Product and variant applicability
Sensor or Camera Link connection
FPGA capture pipeline
DMA buffers
Linux media devices
Frame formats and timestamps
Performance measurement
Fault isolation
Cube Camera Link add-on status
Cube MIPI CSI-2 add-on status
HYPER camera-interface options
SpaceWire camera transport distinction
Microchip Video Kit heritage versus CAVU build
Sensor module and lens identification
Capture driver status by delivered release
15.4 MIPI CSI-2 camera input
Applicability and delivered-build gate
Sensor, connector, and adapter identification
Sensor power and reset sequencing
I2C sensor control and register sets
D-PHY lane count, mapping, and polarity
Lane rate and clock budget
CSI-2 virtual channels and data types
RAW Bayer packing and bit depth
Receiver decoder and fabric clocks
Device-tree media graph
V4L2 subdevices, pads, and links
Video DMA and capture node
Frame-start, frame-end, and timestamps
Test pattern and first-frame bring-up
Packet CRC, ECC, and lane-error counters
Multi-camera synchronization
Driver and application qualification status
15.5 Camera Link camera input
Cube add-on and project-build applicability
Camera and cable identification
Base, Medium, and Full mode applicability
Tap count, ordering, and pixel mapping
Camera control and serial channel
Pixel clock and fabric-domain crossings
FVAL, LVAL, and DVAL handling
Trigger, exposure, and synchronization
Receiver register map and status
Frame geometry and line-stride configuration
Crosshair or test-pattern capture
Frame DMA and buffer layout
Missing-clock and tap-mismatch diagnosis
Project-specific driver and V4L2 status
15.6 Shared camera pipeline and data products
Sensor-to-memory block diagram
FPGA capture IP and DMA ownership
Reserved-memory and udmabuf choices
Media-bus format to memory-format conversion
Debayer, color, and compression options
Multi-camera arbitration and backpressure
Frame metadata, sequence, and timestamp model
Dropped, partial, and corrupt frame policy
Storage, network, and SpaceWire delivery paths
Calibration and bad-pixel data
CPU and fabric processing partition
Capture API and application examples
Acceptance images and test-pattern archive
15.7 User-defined fabric IP
Register map
Address and interrupt allocation
Device-tree binding
UIO versus kernel driver
DMA buffer ownership
ABI versioning
Test and release evidence
Part 16 – OBC-Cube-Polar product profile
16.1 Cube configuration identification
Board revisions
SoC and memory variants
Power-input variants
Option-sheet selections
FPGA programming-job identity
Client-specific differences
16.2 Cube connectors and harnesses
P1 and P8 GPIO
P2 dual RS-232
P3 and P10 CAN
P4 and P9 ADC
P5 and P11 I2C and UART options
P6 JTAG
P7 power
J1 RS-422
J2 LVDS
J5 micro-SD
H1, H2, and H3 expansion
16.3 Cube software map
HSS and console profile
Boot-source profile
Yocto machine and image
Device tree and overlays
Fabric peripheral map
Linux device-node table
Storage and retained-memory map
Bare-metal and AMP profile
Camera Link fabric-build mapping
CSI-2 add-on software mapping
Cube PCIe and NVMe option mapping
16.4 Cube bring-up and recovery
Bench harness
First boot
SD-card recovery
eMMC provisioning
QSPI programming
JTAG and FlashPro
Known variant-specific issues
Part 17 – OBC-HYPER-POLAR product profile
17.1 HYPER configuration identification
HYPER-2 revision
HYPER-2 QE variant
Hyper-PCI variant
SoC and memory variants
FPGA programming-job identity
Client-specific differences
17.2 HYPER connectors and harnesses
Power and supervisor interfaces
Dual-channel debug adapter
RS-232 connectors
RS-422 connectors
RS-485 connectors
CAN connectors
ADC connectors
Ethernet connectors and magnetics
Expansion and add-on connector
JTAG and programming
17.3 HYPER software map
HSS and console profile
Boot-source profile
Yocto machine and image
Device tree and overlays
Fabric peripheral map
Linux device-node table
Storage and retained-memory map
DDR4 and DMA map
Zephyr and RTEMS profiles
Hyper-PCI image and device-tree mapping
QE PCIe Ethernet driver mapping
Camera and video options by variant
17.4 HYPER bring-up and recovery
First boot
QSPI A and B programming
MSS and fabric eMMC provisioning
JTAG and FlashPro
Watchdog and FDIR commissioning
QE port validation
Hyper-PCI validation
Known variant-specific issues
Part 18 – FPGA design and software integration
18.1 Libero project structure
Product design repositories
Tool and device-pack versions
Top-level design and SmartDesign
IP configuration
Constraints and pin assignment
Build scripts
Generated design reports
PCIe hard-IP and SerDes configuration
CSI-2 receiver IP integration
Camera Link receiver and tap configuration
Capture DMA and frame-buffer integration
18.2 FPGA programming artifacts
Programming-job contents
Fabric image
eNVM contents
Security settings
Job identity and checksum
Release packaging
18.3 Software-visible fabric changes
Address map changes
Interrupt map changes
Clock and reset changes
DMA and memory changes
Device-tree updates
Driver changes
ABI and application changes
Regression impact
PCIe address-window changes
Camera register-map changes
Interrupt and DMA-channel changes
Clock-frequency changes
Fabric feature-identification register
18.4 Device-tree overlay workflow
Overlay source
Symbol and phandle handling
Build and packaging
U-Boot application
Linux runtime confirmation
Rollback and fault isolation
18.5 FPGA debug
Design instrumentation
Signal capture
Register inspection
Clock and reset measurements
Hardware/software trace correlation
Reproduction package
Part 19 – Programming, updates, and recovery
19.1 Programming decision tree
Normal update
Bootloader recovery
Storage repair
FPGA or eNVM recovery
Factory re-provisioning
Escalation when no console is available
19.2 Programming tools
FlashPro Express
Libero programming flow
HSS TinyCLI USB export
U-Boot storage commands
Linux storage commands
Host disk-image writers
Tool-version record
CAVU guide to tool and target crosswalk
USB-MSC exported-device identification
QSPI bank identity and protection
eMMC0 versus eMMC1 Linux-node confirmation
19.3 QSPI procedures
Select device or bank
Erase and program
Read-back and checksum
Golden-bank handling
Fallback test
Restore original selection
19.4 eMMC and SD procedures
Write complete disk image
Program boot partition only
Clone between eMMC devices
Build recovery SD card
Verify partition and filesystem
Restore backup
Health check after programming
19.5 FPGA and HSS programming
Match job to board
Program full job
Program eNVM only
Verify device and revision
Confirm HSS banner
Recover interrupted programming
19.6 Software update policy
Application update
Kernel and device-tree update
Root filesystem update
HSS and U-Boot update
FPGA update
Atomicity and power-loss behavior
Rollback
Post-update acceptance
19.7 Backup and restore
What to back up
Credentials and keys
Boot-bank images
eMMC and SD images
Retained FDIR records
Restore test
Secure disposal
MRAM diagnostic readout before recovery
Boot log preservation
QSPI golden-bank preservation
Factory image hash and manifest comparison
Retained FDIR counters before and after programming
Evidence handling when MRAM is unreadable
Recovery image readiness before fault injection
19.8 CAVU tutorial procedure crosswalk
Cube start-guide boot and update paths
CAVU boards boot and programming guide paths
SD-card recovery guide paths
Retained FDIR readout before destructive work
Cube versus HYPER procedure applicability
Conflicting device-node or bank names
Procedure revision and board applicability
Part 20 – Watchdog, FDIR, and system health
20.1 Watchdog ownership
E51 watchdog
Linux watchdog interfaces
Application health supervision
Timeout budget
Reset scope
Maintenance suspension
Per-hart watchdog mapping
Forbidden refresh window
HSS boot-set restart semantics
Linux watchdog userspace contract
Suspend and maintenance interaction
MSS hardware timer inventory
E51 versus U54 watchdog register ownership
HSS virtual watchdog service state machine
Hardware countdown and trigger threshold
Maximum value for refresh permitted
Allowed and forbidden refresh intervals
Interrupt versus reset consequences
E51 refresh during HSS superloop
U54 refresh responsibility by workload
Watchdog enable lock and reset persistence
Watchdog handling during HSS storage services
Watchdog handling during sleep and suspend
Linux watchdog device mapping by release
Bare-metal watchdog driver contract
Watchdog refresh in each AMP context
Boot-set restart versus full-system FDIR reset
Remoteproc stop and watchdog interaction
20.2 FDIR applicability
HYPER release matrix
Cube supervision status
Firmware and hardware dependencies
Demonstrated behavior
Pending verification
Design intent
WDM v1.0 feature baseline
Delivered HSS and Linux component identification
Required SPI MRAM assembly and access path
Firmware feature probing before FDIR commands
Cube watchdog behavior versus HYPER retained FDIR
Upstream health-monitor service versus CAVU policy
Golden-image provision and qualification status
Reserved eMMC-B and MRAM rescue status
20.3 FDIR state and events
Retained-state layout
Record validity and CRC
Event log
Boot-source history
Reset and fault codes
Counter semantics
Data export and interpretation
State-slot selection and generation counter
CRC failure and partial-write handling
Event-ring wrap and sequence interpretation
MRAM diagnostic readout procedure
Evidence preservation before reprogramming
State-slot A and B allocation
Encoded record length and reserved bytes
Magic, format version, and endianness
Alternating-slot sequence comparison
Action indexes and per-action fault counters
Boot-source indexes and statistics
Event-record magic and timestamp units
Log head and circular wrap semantics
CRC coverage for state and event records
Write, read-back, and acceptance sequence
Torn write and invalid-slot recovery
MRAM transfer timeout and bus recovery
Persistence failure without boot inhibition
20.4 Readiness and recovery
HSS startup milestone
U-Boot milestone
Linux readiness milestone
Application readiness milestone
Deadline evaluation
Repeated failure policy
Golden-image selection
Recovery after a successful boot
SOURCE_SELECTED and U54_RELEASED milestones
UBOOT_READY producer and nonfatal report failure
OS_READY producer and accepted ready point
APPLICATIONS_READY reserved-policy boundary
First-U54-release deadline start
Deadline expiry event and cold-reset sequence
Failed-before-OS reconciliation on next HSS start
Consecutive-failure counter clearing
Golden-bank preconditions and source selection
Invalid or absent golden-image fallback
Recovery behavior after MRAM failure
Rescue Linux image without readiness reporting
Linux-ready policy in Linux plus RTOS AMP
RTOS-only OS-ready producer qualification
Secondary-context crash without Linux failure
Multi-OS application-ready policy status
20.5 FDIR diagnostics and verification
TinyCLI status
Linux reporting interface
Normal-boot test
Timeout test
Kernel-panic test
Power-cycle retention test
Golden-bank test
Maintenance-mode test
WDM verification table crosswalk
Command behavior by delivered HSS build
FDIR TIMEOUT OFF maintenance preconditions
Reset cause versus retained event reconciliation
Unprovisioned golden-image test status
FDIR output field-by-field interpretation
Read-only TinyCLI diagnostic collection
Deadline-active check before maintenance
Timeout-suspension confirmation and lifetime
OS-ready report acceptance evidence
U-Boot-ready report evidence
Linux panic report and retained-counter deltas
MRAM SPI timeout and recovery evidence
Corrupt state-slot and event-record tests
Reset-request count versus reset-cause evidence
Power-loss during retained-state update
Golden-image pre-provisioning gate
Pending versus demonstrated test separation
20.6 Other health monitoring
ECC counters
Memory tests
eMMC health
Thermal sensors
Rail and current telemetry
Link and bus error counters
Predictive maintenance data
Generic HSS health-monitor enablement status
Board-specific monitor register definitions
Threshold, equality, and change checks
Register shift, mask, and unit conversion
Per-monitor throttling and callback behavior
BEU correctable and uncorrectable events
Scrubbing and DMA-coherency interaction
Thermal threshold and sensor-failure policies
Storage health and wear limits
Telemetry producer and consumer ownership
20.7 Watchdog configuration and reset semantics
Hardware countdown register and clock source
Trigger and maximum-refresh-permitted values
Forbidden refresh window calculation
Watchdog interrupt routing by hart
E51 watchdog and HSS superloop refresh
U54 watchdog and application refresh
Boot-set membership for SMP and AMP payloads
Individual hart restart versus boot-set restart
System cold reboot versus context warm reboot
Payload cold-reboot entitlement
Watchdog state during debug and long maintenance
Reset reason visibility after each reset type
Configuration lock, persistence, and reinitialization
20.8 FDIR report producers and trust path
U-Boot-ready report location
Linux readiness service and root-only endpoint
Linux panic notifier and crash report
User-space request to kernel component
Supervisor-mode vendor SBI call
OpenSBI dispatch and U54-to-E51 IPI
HSS report validation and deduplication
Per-hart failure attribution
Missing, rejected, and repeated report behavior
Future RTOS and bare-metal readiness producer
Application-ready policy reserved for future release
20.9 Retained MRAM forensic decoding
State-slot selection after reboot
Boot count and source statistics
Action counter and last-fault interpretation
Reset requester and crash counts
Event sequence and timestamp interpretation
Invalid, blank, and mixed-format records
Circular log reconstruction after wrap
Counter rollover behavior
Decoder version and evidence integrity
Read-only export and custody record
20.10 FDIR policy limits and degraded operation
MRAM unavailable at initialization
Write or read-back failure during monitoring
Persistence failure during reset handling
Golden image unprovisioned or corrupt
Boot-source mapping reserved but unavailable
Rescuer image lacking OS-ready report
Repeated reboot or reset storm
Boot progress without retained evidence
Ground-command recovery boundaries
20.11 Fault injection and qualification
Test safety preconditions and recovery media
Baseline FDIR snapshot before each test
U54 hang and watchdog expiry
E51 hang and hardware watchdog reset
U-Boot-ready report missing
OS-ready report late or absent
Controlled Linux panic
MRAM SPI timeout and bus recovery
State-slot CRC corruption
Power cut during alternate-slot write
Golden-bank boot after three failed attempts
Evidence comparison after power cycle
Test-status sign-off by release
20.12 Watchdog and FDIR assurance case
Hazard and failure-mode inventory
Detection coverage by fault class
False positive and nuisance reset analysis
Common-cause power, clock, and bus failures
Independence of HSS, Linux, and retained memory
Worst-case detection and recovery time
Data retention and diagnostic completeness
Qualification gaps and operational constraints
Part 21 – Security and resilience
21.1 Threat model and trust boundaries
Physical access
Debug access
Removable media
Network services
Firmware update
FPGA programming
Customer applications
PCIe endpoint DMA trust boundary
Camera sensor and control-bus trust boundary
Diagnostic command access boundary
Factory programming-station trust boundary
Cross-context mailbox input validation
Remote firmware authentication
Shared-memory and DMA isolation
Machine-mode payload privilege risk
21.2 Boot and firmware trust
Secure-boot capability by variant
Key provisioning
Authentication and rollback policy
HSS and payload integrity
U-Boot and FIT verification
Recovery trust policy
Evidence and attestation
Libero job authentication status
HSS payload signature policy
FIT image authentication
Rollback counter and anti-rollback policy
Recovery-image trust and key rotation
21.3 Linux hardening
Account provisioning
SSH configuration
Service minimization
Firewall and network exposure
Read-only root filesystem
File permissions
Kernel hardening
Audit and logging
21.4 Secrets and key management
Factory secrets
Per-device identity
Storage of keys
Rotation
Backup and escrow
Revocation
Secure decommissioning
21.5 Fault tolerance and radiation effects
ECC-protected memories
Retained-memory integrity
Flash and eMMC resilience
FPGA fabric behavior
Scrubbing and resets
Fault injection
Radiation-test evidence
Limits of qualification claims
Watchdog diagnostic coverage and limitations
Retained-record single-point failure analysis
Reset-storm prevention and safe fallback
Fault-injection evidence for recovery claims
Part 22 – Application and mission integration
22.1 Application architecture
Process and service boundaries
Device ownership
Startup dependencies
Configuration format
Health reporting
Logging and telemetry
Graceful shutdown
22.2 Application development
SDK and toolchain
Native versus cross build
APIs and device nodes
Concurrency and real-time needs
Error handling
Packaging and deployment
Debugging and profiling
22.3 Data handling
Storage allocation
Data integrity
Timestamping
Compression
Encryption
Downlink or transfer
Retention and deletion
Frame metadata and provenance
Raw and processed image formats
DMA buffer lifecycle
Dropped-frame accounting
Onboard retention and downlink selection
22.4 Mission software integration
External bus protocol
Telecommand and telemetry
Mode management
Fault responses
Time synchronization
Interface acceptance tests
End-to-end rehearsal
Part 23 – Verification, qualification, and acceptance
23.1 Verification strategy
Requirements traceability
Unit and component tests
Hardware-in-the-loop tests
Integration tests
Environmental tests
Regression selection
Test independence
23.2 Boot and recovery tests
Cold and warm boot
Boot-source fallback
Interrupted programming
Corrupt payload
Missing storage
Watchdog timeout
Power interruption
E51 watchdog expiry
U54 watchdog expiry in SMP boot set
U54 watchdog expiry in AMP context
OS-ready deadline expiry
Linux panic FDIR report
MRAM write/read-back failure
MRAM SPI transfer timeout
Invalid state-slot CRC
Power interruption during slot alternation
Golden image absent and present cases
Three-failure recovery threshold
Early AMP dual-context boot
Late attach remoteproc start and stop
Secondary-context watchdog restart
Master-context failure with remote active
Remote-context crash recovery
23.3 Interface tests
Serial ports
CAN
GPIO
ADC
I2C and SPI
eMMC and SD
Ethernet and PTP
USB and PCIe
SpaceWire and LVDS
PCIe endpoint enumeration and BAR access
PCIe DMA and interrupt integrity
PCIe reset and link recovery
CSI-2 sensor discovery and media graph
CSI-2 lane and virtual-channel validation
Camera Link tap and line-alignment validation
Camera frame DMA and data-integrity checks
Multi-camera concurrency and isolation
IHC interrupt delivery across contexts
RPMsg endpoint discovery and message integrity
RPMsg TTY and character-device clients
Remoteproc resource-table validation
Shared-memory cache-stress test
23.4 Stress and long-duration tests
Thermal corners
Supply variation
Memory pressure
Storage endurance
Network load
Interrupt and DMA load
Repeated reset cycles
Soak and telemetry capture
PCIe sustained transfer and error injection
Camera frame-drop and backpressure tests
Concurrent capture, storage, and network load
Capture thermal drift and clock tolerance
23.5 Security tests
Factory-access review
Key and credential handling
Unauthorized programming attempts
Update-integrity tests
Network exposure scan
Log and audit review
23.6 Acceptance records
Hardware and software identity
Test configuration
Expected versus observed results
Deviations and waivers
Evidence archive
Approval and handover
WDM test-status cross-reference
Before-and-after FDIR command transcript
Hardware reset-cause capture
Watchdog configuration and timeout record
Retained record decoder version
Golden-image provisioning proof
Part 24 – Troubleshooting and support
24.1 Fault isolation method
Identify the first failing boot stage
Confirm product and release identity
Capture both consoles
Check power and reset evidence
Correlate firmware, FPGA, and Linux logs
Preserve the original state
24.2 Boot failures
No HSS output
DDR training stops
Payload not found
U-Boot does not start
FIT image not found
Kernel panic
Root filesystem not mounted
Repeated watchdog reset
Repeated boot count without OS_READY
OS-ready deadline reset loop
Golden bank unavailable or invalid
No valid MRAM state slot
Secondary context never released by HSS
One context starts and the other stalls
Remoteproc firmware load rejected
RPMsg endpoint absent after boot
24.3 Interface failures
Missing device node
Driver probe failure
Wrong connector or option sheet
Electrical-level mismatch
Interrupt not firing
DMA timeout
Link or bus errors
Performance below baseline
PCIe link down or width downgrade
PCIe endpoint detected without driver
PCIe DMA fault or stale data
CSI-2 lane lock and packet errors
Camera Link tap mismatch or line shift
Camera capture node absent
Frame corruption or dropped frames
24.4 Programming failures
FlashPro connection
Device or job mismatch
USB mass-storage enumeration
Host write failure
QSPI verify failure
eMMC partition mismatch
Recovery-media failure
Maintenance window exceeds OS-ready deadline
Readiness reporting absent in rescue image
Retained evidence lost during recovery
24.5 Build failures
Repository access
Host dependencies
Yocto fetch and patch
Pseudo and tar
Device-tree compile
Kernel module build
FPGA synthesis or place-and-route
Release packaging
24.6 Support bundle
Product and serial identity
Release manifest
Full power-on console logs
Kernel and service logs
Device tree and configuration
Storage and health state
Reproduction steps
Redaction and secure transfer
Part 25 – Development, delivery, and maintenance process
25.1 Repository map
Firmware repositories
Yocto repositories
Bare-metal and RTOS repositories
FPGA repositories
Tutorial and guide repositories
Client delivery repositories
Issue trackers
CAVU Tutorials source and revision index
CAVU PCIe and camera project repositories
Microchip documentation baseline
Upstream HSS and Yocto documentation baseline
25.2 Branching and review
Branch naming
Commit and merge policy
Code review
Release tags
Dependency updates
Security fixes
Traceability to issues
25.3 Build and release pipeline
Build environment
Reproducible inputs
Continuous integration
Static analysis
Test reports
Artifact checksums
Release manifest
Archive and retention
Software bill of materials and SPDX output
CVE and vulnerability review
Open-source license review
Build-history and reproducibility checks
Automated image tests and ptests
Firmware and FPGA artifact pairing
25.4 Customer delivery
Contents of a delivery package
Installation and programming instructions
Compatibility statement
Known limitations
Acceptance evidence
Support route
Feedback and defect handling
25.5 In-service maintenance
Periodic health review
Storage and log housekeeping
Credential renewal
Firmware update planning
Configuration drift detection
Spare-board preparation
End-of-support and migration
Part 26 – Mission operations and autonomy
26.1 Operational concept
Mission phases
Ground and spacecraft responsibilities
Product versus mission-software boundary
Normal, degraded, and safe operations
Autonomous and commanded behavior
Operational constraints by release
26.2 Modes and state transitions
Power-off and startup
Initialization
Standby
Nominal operation
Payload operation
Maintenance and update
Degraded operation
Safe mode
Recovery and return to service
Mode-transition guards
State persistence across reset
Imaging mode and capture readiness
PCIe add-on operating mode
Degraded camera and data-link modes
Multi-OS context start and stop states
Remote processor maintenance mode
Partial mission operation after one-context fault
26.3 Command handling
Command sources
Command authentication and authorization
Validation and parameter limits
Sequencing and scheduling
Acknowledgement and completion reporting
Idempotence and retry behavior
Timeout and cancellation
Rejected-command evidence
Emergency commands
26.4 Telemetry and events
Telemetry sources
Sampling schedules
Units, scaling, and calibration
Quality and validity flags
Event severity
Event persistence
Time tagging
Packetization and transport
Backpressure and dropped data
Ground interpretation
26.5 Onboard scheduling
Periodic tasks
Event-triggered tasks
Priority and deadlines
Resource reservation
Overrun behavior
Schedule changes
Time discontinuities
Test and simulation
26.6 Data products and storage
Data-product catalogue
File and record naming
Buffering and queueing
Capacity management
Integrity checks
Compression
Transfer and acknowledgement
Retention and deletion
Recovery after interrupted transfer
26.7 Autonomous fault responses
Health predicates
Detection latency
Escalation levels
Local retry
Process restart
Interface reset
Hart or system reset
Boot-source change
Ground notification
Inhibition during maintenance
Watchdog restart versus FDIR cold reset
Mission-mode effects of boot-set restart
Golden-image selection after failed boots
Failed MRAM persistence and degraded operation
Reset-loop detection and ground intervention
26.8 Operational logging and audit
Command history
Mode history
Reset history
Configuration-change history
Time-correlation record
Log retention
Ground export
Forensic preservation
Part 27 – Software interface contracts and API reference
27.1 Interface inventory
Firmware-to-firmware interfaces
Firmware-to-operating-system interfaces
Kernel-to-user-space interfaces
Application-to-application interfaces
Network interfaces
FPGA register interfaces
Persistent data formats
Human command interfaces
PCIe endpoint driver contract
CSI-2 sensor-control contract
Camera Link acquisition contract
Frame metadata and buffer API
Cross-context service API inventory
RPMsg endpoint and channel inventory
Remoteproc firmware management API
27.2 HSS payload contract
Container header and metadata
Hart entry points
Privilege levels
Load and execution addresses
Memory ownership
Startup ordering
Error return and diagnostic codes
Version compatibility
27.3 SBI and inter-hart contracts
Standard SBI calls in use
Vendor-call register convention
Available vendor calls by release
Mailbox and IHC messages
Shared-memory layout
Concurrency and ordering
Timeout and retry
Compatibility and deprecation
U-Boot FDIR milestone report
Linux supervisor-mode FDIR report
Vendor SBI to E51 IPI path
Report type, caller, and privilege validation
Report acknowledgment and failure semantics
IHC channel assignment per context
OpenSBI domain and privilege contract
Context reset request and authorization
27.4 U-Boot-to-Linux contract
FIT configuration naming
Device-tree selection
Kernel command line
Initramfs handoff
Reserved-memory layout
Boot-source indication
Environment variables
Error and fallback reporting
27.5 Linux device and driver API
Character-device ABI
ioctl commands and structures
sysfs attributes
procfs entries
netlink interfaces
IIO channels
hwmon attributes
GPIO line names
SocketCAN interfaces
UIO maps
MTD layout
ABI stability policy
27.6 User-space libraries and SDK
Library inventory
Header files
Data types and byte ordering
Thread safety
Error codes
Memory ownership
Version and feature discovery
Examples and test applications
Binary compatibility
27.7 Service and network APIs
Service discovery
Endpoint inventory
Transport and ports
Message schema
Authentication and authorization
Timeouts and retries
Rate limits
Error reporting
Version negotiation
Compatibility tests
27.8 Configuration schemas
Configuration-file locations
Schema and field definitions
Defaults
Validation
Change application
Persistence across update
Secret fields
Migration and rollback
27.9 Persistent record formats
Boot metadata
FDIR state and event records
Application state
Calibration records
Checksums and CRCs
Atomic update
Schema versioning
Recovery from corruption
FDIR state-slot schema version 2
FDIR 24-byte event-record schema
CRC32 and byte-order contract
Reserved-field forward compatibility
Record decoder compatibility tests
27.10 Command-line contracts
HSS TinyCLI grammar
U-Boot command environment
Linux maintenance commands
Application command-line options
Exit codes and output formats
Script compatibility
Deprecation policy
Part 28 – Factory provisioning and production acceptance
28.1 Production configuration baseline
Assembly revision
Fitted options
SoC and memory population
Serial number and traceability
FPGA job selection
Software release selection
Customer configuration
28.2 Incoming and pre-programming checks
Visual inspection
Connector and harness inspection
Resistance and continuity checks
Supply and current-limit setup
Programming-tool readiness
Device identification
Baseline record
28.3 FPGA and eNVM provisioning
Select approved programming job
Check device and package
Program fabric and eNVM
Verify job and eNVM contents
Read back available identifiers
Preserve tool logs
Handle programming failure
28.4 Boot-media provisioning
QSPI A image
QSPI B image
MSS eMMC image
Fabric eMMC image
Micro-SD recovery media
Partition labels and UUIDs
Read-back hashes
Boot selection and fallback test
28.5 Identity and security provisioning
Per-device identifiers
MAC addresses
SSH host keys
Certificates
Secure-boot keys where applicable
Debug access policy
Factory-account removal or change
Escrow and recovery records
28.6 Calibration and configuration
ADC calibration
Housekeeping sensor calibration
RTC setting and battery status
Serial and CAN configuration
Network defaults
Thermal thresholds
Customer configuration
28.7 Production functional tests
Power-on and current draw
HSS and console
Boot and storage
Memory and ECC
Serial buses
CAN and GPIO
ADC and housekeeping
Ethernet and USB
Optional PCIe, SpaceWire, and add-on IP
Watchdog and reset
PCIe add-on factory check where fitted
Camera test-pattern capture where fitted
Sensor identity and calibration evidence
E51 and U54 watchdog configuration readout
FDIR MRAM read/write acceptance where fitted
FDIR status at first release boot
Golden-image provisioning verification
Dual-context boot acceptance where configured
Cross-context message test where configured
Remote firmware image identity check
28.8 Burn-in and stress screening
Test profile
Temperature and supply conditions
Boot-cycle count
Memory stress
Storage stress
Interface traffic
Error thresholds
Data retention and review
28.9 Factory acceptance and shipment
Test report
Deviations and rework
Release manifest
Image and job checksums
Access and credential handover
Recovery media
Packaging and labelling
Customer acceptance record
Part 29 – Lifecycle, configuration, and obsolescence
29.1 Configuration-item register
Hardware
FPGA design
HSS and OpenSBI
U-Boot
Kernel and device tree
Root filesystem
Applications
Calibration and keys
Documentation
29.2 Change-impact analysis
Interface changes
Timing changes
Memory-map changes
Boot-policy changes
Security changes
Test and qualification impact
Customer migration impact
PCIe fabric to kernel and device-tree impact
Camera sensor to FPGA and media-graph impact
HSS service to boot and FDIR impact
Yocto layer upgrade and regression impact
29.3 Field configuration management
Approved baseline
Configuration drift
Local customer changes
Change authorization
Field update record
Rollback record
Fleet inventory
29.4 Long-term maintenance
Dependency tracking
Security advisories
Kernel and BSP updates
Toolchain updates
Compiler and ABI changes
Storage-media health
Spare-board compatibility
Regression maintenance
29.5 Obsolescence and migration
Component end-of-life
Tool-version retirement
Repository migration
Yocto release migration
Interface deprecation
Data-format migration
Documentation migration
Legacy release support
29.6 Decommissioning
Data export
Key and credential revocation
Retained-memory clearing
Storage sanitization
Device disposal
Audit evidence
29.7 Future-feature intake and qualification
Proposed capability and product ownership
Hardware option and FPGA resource budget
HSS, kernel, Yocto, and application dependencies
PCIe expansion candidates
CSI-2 and Camera Link candidates
Camera processing and V4L2 roadmap
Prototype, demonstrated, qualified, and released states
Entry and exit criteria for each state
Retirement and supersession of planned topics
Cube Zephyr and RTEMS ports
CAVU FreeRTOS HSS payload validation
Linux plus Zephyr and Linux plus RTEMS candidates
Multi-OS FDIR policy qualification
Part 30 – Timing, performance, and resource budgets
30.1 Timing model
Clock domains
Timestamp sources
Interrupt latency
Scheduling latency
DMA completion latency
End-to-end response time
Measurement equipment and uncertainty
30.2 Boot-time budget
System-controller time
DDR training time
HSS initialization time
Payload search time
U-Boot time
Kernel time
Service-readiness time
Variant and temperature effects
30.3 Processing and memory budget
Hart allocation
CPU loading
Stack and heap
Kernel memory
CMA and DMA pools
Cache behavior
Worst-case and margin
Hart allocation by context
RTOS worst-case task load
Shared-memory and vring budget
Cross-context IPC CPU cost
30.4 Storage budget
Image sizes
Partition free space
Log growth
Application data growth
Write endurance
Update staging capacity
Recovery reserve
30.5 Data-link budget
UART throughput
CAN bus loading
Ethernet bandwidth
USB throughput
PCIe bandwidth
SpaceWire throughput
Protocol overhead
Buffering and loss
PCIe payload and DMA throughput
Camera raw pixel-rate budget
Camera Link tap and clock budget
CSI-2 lane and protocol overhead
Capture-to-storage throughput
30.6 Power and thermal budget
Power states
Startup and peak current
Interface loading
CPU and FPGA activity
Temperature sensing
Thermal throttling or shutdown
Margin and environmental conditions
30.7 Fault-response budget
Detection time
Reporting time
Watchdog timeout
Recovery action time
Reboot and service restoration
Data-loss window
Ground notification time
Hardware watchdog trigger-to-detection interval
HSS superloop monitor latency
U54 boot-set restart duration
FDIR report persistence latency
OS-ready deadline margin
Cold-reset and reinitialization duration
Repeated-failure recovery duration
30.8 Performance evidence
Benchmark configuration
Test data and scripts
Repeated runs and variance
Release-to-release comparison
Acceptance limits
Deviation investigation
Part 31 – Reference appendices
31.1 Product and release matrices
Board-revision matrix
FPGA job matrix
Firmware matrix
Yocto machine and image matrix
Interface availability matrix
Optional-feature status matrix
PCIe endpoint compatibility matrix
Camera module and capture-build matrix
Planned-feature qualification matrix
Watchdog configuration matrix by board and HSS build
FDIR feature and verification matrix
Golden-image provisioning matrix
OS support by product and release
SMP and AMP combination matrix
Early-boot and late-attach support matrix
RPMsg and remoteproc support matrix
31.2 Electrical and connector references
Console connector summary
Serial connector summary
CAN connector summary
GPIO connector summary
Storage and programming connectors
Add-on connectors
31.3 Address and resource maps
Memory map
Storage map
Fabric address map
Interrupt map
Clock and reset map
DMA pool map
PCIe outbound and inbound windows
PCIe BAR and interrupt maps
CSI-2 register and media-graph maps
Camera Link register and DMA maps
AMP hart and memory partition map
RPMsg vring, buffer, and resource-table map
IHC channel and interrupt map
Per-context UART and peripheral map
31.4 Software configuration references
HSS configuration options
TinyCLI command matrix
U-Boot environment variables
Kernel configuration fragments
Device-tree aliases
Linux device-node map
Service inventory
PCIe kernel and HSS configuration matrix
Camera kernel and Yocto package matrix
Media-bus format and pixel-format crosswalk
HSS watchdog Kconfig and timing values
HSS cold-reboot authorization settings
CAVU FDIR commands by firmware release
Linux watchdog and FDIR module configuration
31.5 Command quick reference
Host programming commands
HSS TinyCLI
U-Boot
Linux system inspection
Network and serial commands
Storage and image commands
Health and FDIR commands
31.6 Templates and forms
Procedure template
Build record
Programming record
Interface test record
Fault report
Support bundle checklist
Release checklist
Acceptance record
PCIe topology and link-test record
Camera frame-capture record
Source-evidence and release-status record
Watchdog timing and reset-scope worksheet
FDIR retained-data readout form
Fault-injection test record
Golden-image qualification record
Mixed-OS payload manifest
Hart and peripheral ownership worksheet
Shared-memory and IPC test record
Multi-OS fault-injection record
