Abstract: A system and related method for PCIe device configuration in a certified multi-core avionics processing system on which several guest operating systems (GOS) are running may allow a GOS to access or communicate with PCIe devices not owned by that GOS. The system may configure PCIe controllers and the PCI devices connected by those controllers by issuing addresses and determine, via a configuration vector of the system hypervisor, which PCIe devices are accessible to which non-owning guest operating systems. The hypervisor may provide each non-owning GOS with the GOS physical addresses corresponding to each non-owned PCIe device accessible to that GOS. Configuration of an unpowered or otherwise unprepared PCIe device may be deferred until device information is requested by the owning GOS to preserve compliance with system timing requirements.

Abstract: A multicore processor system and a method of operating the system defines a processor partition (which may include one or more processor cores) as a network offload engine for a network connected to the processor system. Network operations requests from other cores or partitions of the processor system are forwarded to the network offload engine by a cross-platform inter-partition communications component including a relay task in the network offload engine for receiving network operations requests from network proxies in the other partitions. The network offload engine then controls access to network resources by the other cores or partitions and applications running thereon. A second or additional core or partition of the processor system may be similarly defined as a network offload engine for a second or additional network, receiving network operations requests from the other partitions through a similar system of relay task and network proxies.

Abstract: A method including initializing the processing platform, wherein initializing the processing platform includes performing a power on self-test (POST) configured to determine an operational state of one or more hardware sub-components of the processing platform, the POST further configured to determine an error detection state of one or more monitoring functions of the processing platform, initializing a safety monitoring function of the processing platform, analyzing one or more results of the POST utilizing the safety monitoring function of the processing platform in order to determine compliance of the processing platform with operational requirements, configuring the safety monitoring function of the processing platform utilizing one or more sets of safety monitoring configuration data, initializing and configuring a security monitoring function of the processing platform, and initializing and configuring one or more security functions.

Abstract: A system and method for detection and correction of single-bit errors in a multi-core processing resource (MCPR) of an avionics processing system includes a RAM EDAC testing module called by the MCPR health monitor to access EDAC registers of a system-on-chip module coupled to the MCPR and access memory addresses passed by the MCPR health monitor to detect single-bit errors. Single-bit errors detected in memory mapped to the hypervisor are corrected by the RAM EDAC testing module. Single-bit errors detected in memory associated with a partition or core of the MCPR are corrected by the health monitor running on the particular partition or core with which the memory portion is associated. Single-bit errors may be detected in unmapped memory associated with a partition or core by accessing the unmapped memory via a temporary TLB entry.

Abstract: A multicore adaptive scheduler of tasks in an ARINC 653-compliant avionics system allocates flight critical tasks execution time equivalent to their worst case execution time and allocates quality-driven tasks minimum execution time equivalent to their minimum completion time. The scheduler may also offset the start time of a task or define an upper bound for completion time of a quality-driven task. The scheduler generates and executes partition schedules of tasks, reallocating execution time unused by completed tasks and reallocating execution time from interrupt handlers to tasks preempted by interrupts. The scheduler may also analyze the viability of a generated schedule. The scheduler uses rate limiting and flow control techniques to ensure a predictable amount of execution time to be reallocated for interrupt handling.

Abstract: A multi-core processor system and a method of operating the system allocates fault queues in a shared system memory for each virtual machine of a partitioned guest operating system running on a core or partition of the processor system. Health monitors of the partitioned guest operating system log faults in the fault queue corresponding to the appropriate virtual machine. The health monitors may take additional action in response to warning-level or virtual machine-level faults. A health monitor of the multi-core processor resource then polls each fault queue, as well as the partition-level and module-level event logs maintained by the module operating system, for available faults and logs all faults in a single nonvolatile event log of the multi-core processor resource.

Abstract: Systems and methods for providing safety and security functions are disclosed. The system includes a computing device that provides at least a first partition and a second partition. The computing device implements time and space partitioning to isolate resources available to the first partition and the second partition. The system also includes a safety module that operates in the first partition for providing safety functions for the system. The system further includes a security module that operates in the second partition for providing security functions for the system. A predefined communication interface is utilized to facilitate communications between the safety module and the security module. The communication interface defines a set of communications allowable between the safety module and the security module, wherein information sharing between the safety module and the security module is restricted to only the set of communications allowed through the communication interface.