QNX BSP and IO API Changes

Software Development Platform 8.0 Changes

• Deprecations: Utilities and APIs are deprecated. For the complete list, refer to the QNX Software Development Platform 8.0: Discontinuation and Deprecation Notice

• Interrupt Handling:

  • The flags _NTO_INTR_FLAGS_TRK_MSK, _NTO_INTR_FLAGS_PROCESS are no longer supported for InterruptAttachEvent(). _NTO_INTR_FLAGS_TRK_MSK is the default behavior in SDP 8.0 (for example, kernel always tracks the number of times an interrupt is masked or unmasked)

  • InterruptAttachThread() is more efficient than InterruptAttachEvent() for waiting for interrupts.

  • Replace interruptevent ability with interrupt. interrupt ability is now used for both InterruptAttachEvent() and InterruptAttachThread().

  • InterruptUnmask() and InterruptMask() do not allow interupt ID to be passed as -1.

• Thread Priorities: The maximum user thread priority is 253. Priority 255 is used for per core IPI thread, and priority 254 is used for per core timer IST.

• Signal Handling: Signal 32 (SIGDOOM) is not allowed to have a signal handler.

• Channel Limits: There is a new limit for the number of actively open channels. For RLIMIT_CHANNELS_NP, the limit is 100. For applications with over 100 open channels, increase the limit with setrlimit() or with iolauncher while starting the process.

Note

A process linking to a library can create channels. Run pidin -p <pid> channelds` for the number of open channels.

• Directory File Descriptors: To open a file descriptor for a directory, use O_DIRECTORY to call open(); otherwise fchdir() will fail like fdopendir().

• Command-line Utilities: The toybox package combines command-line utilities into a single executable. Utilities available in previous QNX SDP versions are replaced or discontinued with Toybox tools. For information about specific utilities, refer to the Utilities Reference in the SDP documentation and the QNX Software Development Platform 8.0: Discontinuation and Deprecation Notice.

• io-char: io-char now has a dependency on libsecpol.so and libfsnotify.so.

• DHCP client: dhcpcd replaces dhclient.

• Inline Functions: Use __attribute__((always_inline)) to ensure inline functions are always inlined.

• GDB Requirements: SDP 8.0 requires GLIBC 2.29 or 2.30 (available on Ubuntu 20.04).

• Tickless Kernel: SDP 8 remains tickless, but it uses a periodic tick per core.

• Tracelogger:

  • _NTO_TRACE_INTENTER is replaced with _TRACE_INT_DELIVER.

  • Use the traceprinter tool for SDP 8 to analyze logs.

• Thread Abilities: xthread, threadctl, and keydata abilities are deprecated; the functionality moved under different abilities. For details, refer to Abilities.

• Semaphore Behavior: sem_wait() is not unblocked by sem_close(). Unblocking sem_wait() requires an explicit sem_post(). The change is still POSIX compliant.

• MAP_BELOW Semantics: MAP_BELOW starts from the bottom of the address space and goes up, finding the lowest address that matches the requested size.

QNX SDP8 Kernel Clusters

Target Changes	Backward Compatible	Platform	OS
QNX SDP8 kernel introduces Clusters. A thread can only have a runmask that matches the runmask of a Cluster. The QNX kernel defines C_all and C_cpu-<num> Clusters by default per the QNX documentation. Any other Cluster needs to be defined prior to booting the QNX kernel. If an application thread needs to have a runmask that does not match the default Clusters, it needs to define new Clusters with the desired runmask.	No.	NSR, SR	QNX

Migration Path

• Orin to Thor

Migration Rationale

Changes in QNX SDP8 from 6.x to 7.x

Steps to Migrate

For the steps to migrate, refer to the next section

Steps to Migrate Example Per the Previous Table

To define a custom Cluster, modify the Device Tree. For example, to add one Cluster with Core0 and Core1 and another Cluster with Core 2 and Core 3, add the following DT nodes:

/ {

    os-cpu-clusters {
        cpus {
            cpu-map {
                os-cluster_0_1 {
                    cluster-type = "OS-CLUSTER";
                    cluster-name = "cluster_0_1";
                    cpumask = <0x3>;
                    status = "okay";
                };
                os-cluster_2_3 {
                    cluster-type = "OS-CLUSTER";
                    cluster-name = "cluster_2_3";
                    cpumask = <0xc>;
                    status = "okay";
                };
            };
        };
    };

};

IOLaucher has a new option to set thread affinity using a Cluster name: “–cluster <cluster_name>”. The previous approach of setting affinity by specifying the runmask will continue to be supported, but the runmask needs to match an existing cluster.

nvdt_set_thr_attr() added support to set affinity using Cluster name. To do this, in the Device tree, replace “thr-runmask” with “thr-cluster” and specify the cluster name string as the value. The previous approach of using “thr-runmask” will continue to be supported. Only one of “thr-runmask” or “thr-cluster” should be specified for a given thread.

/ {

    thread-priority {
        nvi2c-bpmp {
            dvms_events_listener {
                thr-name="dvms_events_listener";
                thr-prio=<0x17>;
                thr-prio-range=<&asil_prio_range_other>;
                thr-priv=<0x0>;
                thr-cluster="cluster_0_1";
            };
        };
    };

};

Adding enum(s)

Target Changes	Backward Compatible	Platform	OS
Adding enum(s)	Yes	NSR, SR	QNX

Migration Path

• Orin to Thor

Migration Rationale

Due to new feature support, additional enums are defined and an external API is updated to accept the new enum. This feature supports Runtime SC7/ReInit functionality starting with the 6.0.9.3 release. Customers moving from releases prior to 6.0.9.3 to 7.x are affected.

Steps to Migrate

Only the required new functionality can be called.

For Init API for NvDVMS Client Library - nvdvms_init()

The constructor is deprecated in 7.2. Ensure the nvdvms_init() API is called for client library init.

For De-Init API for NvDVMS Client Library - nvdvms_deinit()

The destructor is deprecated in 7.2.

Ensure nvdvms_deinit is called during deinit for client library deinit.

For additional information, refer to the nvdvms_sample application in the DriveOS SDK.

Enum defines for power profile are changing from NVDVMS_SOC_OP_* to NVDVMS_VM_OP_*. Nothing changes as SOC OP is similar to VM OP.

Enum name NvDvmsSocOp is changing to NvDvmsVmOp. This means typedef NvDvmsPowerProfile is pointing to NvDvmsVmOp instead of NvDvmsSocOp.

NvDVMS enum Value and Error Code Changes (nvdvms_types.h)

Target Changes	Backward Compatible	Platform	OS
In release 7.2.4.0, NvDVMS power profile and IP op enum values are renumbered; the new error codes are in nvdvms_types.h	No	NSR, SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5 to 7.x

Migration Rationale

Enum NvDvmsVmOp (power profile) values changed from 0-based to 300-based (for example, NVDVMS_VM_OP_0 = 300U). Enum NvDvmsIpOp values changed from 0-based to 400-based. New error codes NvDvmsInvalidResponse (0xFF00U) and NvDvmsInvalidFd (0xFF0FU) are added to NvDvmsStatus. Customers who serialize/deserialize power profile values, compare against hardcoded integers, or use switch statements with explicit case values, must update their code.

Steps to Migrate

Do not rely on specific integer values for power profiles; use enum symbols only. Update serialization, configuration files, or databases that store raw enum values. Handle NvDvmsInvalidResponse and NvDvmsInvalidFd in error paths where NvDVMS client APIs are used.

Expanded NvDVMS power profiles (nvdvms_types.h)

Target Changes	Backward Compatible	Platform	OS
New power profile enum values NVDVMS_VM_OP_10 through NVDVMS_VM_OP_63 (54 new values) in release 7.2.4.0	Yes	NSR, SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5 to 7.x

Migration Rationale

The power profile range expanded from 10 to 64 profiles for more granular power management.

Steps to Migrate

Optional: use the new profile values where finer-grained power control is needed. No mandatory change for existing code.

Target Changes	Backward Compatible	Platform	OS
Adding new enum(s)	No	NSR, SR	QNX

Migration Path

• Orin to Thor

Migration Rationale

Some NvDT external APIs have the incorrect order of parameters for input, output. Parameter orders are rearranged to follow the order of input to output. Customers moving from releases prior to 6.0.9.3 to 7.x are affected.

Steps to Migrate

The following NvDT APIs have changes in parameter order.

Changed from

• nvdt_error nvdt_read_prop_array_by_name(const void *nvdt_node, const char *name, uint32_t *array_addr, uint32_t array_size);

• nvdt_error nvdt_read_prop_array_by_index(const void *nvdt_node, const char *name, uint32_t *array_addr, uint32_t array_size, uint32_t index);

To

• nvdt_error nvdt_read_prop_array_by_name(const void *nvdt_node, const char *name, uint32_t array_size, uint32_t *array_addr);

• nvdt_error nvdt_read_prop_array_by_index(const void *nvdt_node, const char *name, uint32_t array_size, uint32_t index, uint32_t *array_addr);

NvDT applications using nvdt_read_prop_array_by_name() and nvdt_read_prop_array_by_index() require updated code to follow the new parameter order.

Timesync (Nvtime_GTSD) Changes

Following are the changes to nvtime_gtsd in 7.2.5.0

Changes to increase expected PTP logSyncInterval field in nvtime_gtsd launch cmds

Target Changes	Backward Compatible	Platform	OS
The expected PTP frame count per second (that is, logSyncInterval passed via -s) is increased to -3 (8 Sync frames per second) from -1 (2 Sync frames per second) in the platform nvtime_gtsd launch command.	No	NSR, SR	QNX

Migration Path

• Orin to Thor

• Thor to Thor

Migration Release Path

6.5 to 7.2

7.2.4.0 to 7.2.5.0

Migration Rationale

This change achieves faster time synchronization of the local PTP clock (PHC) with the external PTP master clock.

Steps to Migrate

The PTP Grandmaster (for example, switch or dedicated GM), along with any intermediate master nodes in the PTP topology, should configure logSyncInterval to achieve 8 PTP frames per second.

Configure the nvtime_gtsd using the -s option to match the logSyncInterval settings used by the PTP master(s) on your platform.

Changes to expected packet count for stable clock in nvtime_gtsd launch cmds

Target Changes	Backward Compatible	Platform	OS
The SERVO_LOCKED debounce count (number of consecutive Sync cycles required in the SERVO_UNLOCKED state before achieving stable sync and transitioning to SERVO_LOCKED state) is reduced from 5 to 3 via the -K option.	No	SR & NSR	QNX

Migration Path

• Orin to Thor

• Thor to Thor

Migration Release Path

6.5 to 7.2

7.2.4.0 to 7.2.5.0

Migration Rationale

This change is required to achieve faster time synchronization of the local PTP clock (PHC) with the external PTP master clock.

Steps to Migrate

In the nvtime_gtsd launch command, -K is set to 3 based on local profiling for faster time synchronization, and is optimal for a good-quality external GM. For development with a lower-quality GM, increase -K as per the interface guidelines. Note that a higher value improves stability but may slow synchronization and impact KPIs.

Following are the changes to nvtime_gtsd in 7.2.4.0:

Changes to Error encoding information of existing errors reported to Safety Services

Target Changes	Backward Compatible	Platform	OS
The error codes reported by nvtime_gtsd to the Safety Services have been modified. In the error reports, the values of ErrorCode and Error_Attribute are now the same, and ErrorCode will have same value as Error_Attribute.	Yes	NSR, SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5 to 7.2

Migration Rationale

Existing errors were uniquely identified by Error_Attribute rather than ErrorCode. This change fixes this to align with expectation from Safety services to identify error uniquely with ErrorCode.

Steps to Migrate

While handling nvtime_gtsd errors in SEH, consider using ErrorCode instead of Error_Attribute.

Timesync (NvTime_Resmgr) - SOC Plugin Path Option (-p)

Following are the changes related to multisoc/HAL support in NvTime_Resmgr.

Optional ``-p`` command-line argument introduced in 7.2.4; is mandatory in 7.2.5

Target Changes	Backward Compatible	Platform	OS
io-nvtime2 supports a new command-line argument -p <path> that specifies the path to the SoC-specific HAL plugin shared library (for example, /proc/boot/libnvtime2_hal.so), enabling pluggable architecture support. In release 7.2.4 this argument is optional; if omitted, the default path is used. From release 7.2.5 onward, -p is required and must be supplied on every invocation.	Yes (7.2.4); No (7.2.5)		QNX

Migration Path

• Orin to Thor

Migration Release Path

7.2.4 to 7.2.5

Migration Rationale

Pluggable architecture support requires the driver to load a SoC-specific plugin. Explicitly specifying the plugin path via the -p argument allows different platforms and build layouts to use the correct plugin library. Making -p mandatory in 7.2.5 ensures consistent configuration and avoids reliance on the default path.

Steps to Migrate

7.2.4: Specify -p <path> when launching io-nvtime2 if a non-default plugin path is needed.

7.2.5: Ensure all io-nvtime2 invocations include -p <path>. Invocations without -p no longer use a default path and may fail or be rejected. Make sure to update the path to the correct plugin library.

Obsolete and Removed Files

Obsolete structures, members, macros, options, statically compiled library, and old headers (for example, nvtime.h) are removed in 7.2.5. Applications and Resmgr invocations must stop relying on the following:

Target Changes	Backward Compatible	Platform	OS
Obsolete structures, members, macros, and options are removed in 7.2.5. The statically compiled library and old headers (for example, nvtime.h) and other legacy nvtime files are also removed in 7.2.5. Applications and Resmgr invocations must stop relying on these.	Yes (7.2.4); No (7.2.5)	Orin to Thor	QNX

Migration Path

7.2.4 to 7.2.5

Migration Rationale

These items are obsolete and only kept for backward compatibility. Removing them simplifies the API and avoids misuse of deprecated behavior. The statically compiled library and old headers (for example, nvtime.h) are superseded by the current nvtime2 library and headers; removing them in 7.2.5 avoids maintaining two code paths.

Header (nvtime2.h):

• Remove usage of NVTIME_MAX_IFACE_COUNT, NVTIME_ETH_INTF_MGBE0, NVTIME_ETH_INTF_MGBE1, NVTIME_ETH_INTF_MGBE2, NVTIME_ETH_INTF_MGBE3, NVTIME_ETH_INTF_EQOS.

• Do not use the structure struct nvtime_config

• Do not use the members evt_mode, tsc_mode, intr_tsc_latency, tsc_ptp_latency, primary_ptp_iface, secondary_ptp_iface of the structure struct nvtime_timeevent. These are obsolete. Resmgr only supports timer mode and timestamps in nanoseconds; latency and interface-name fields are obsolete.

• Do not pass the option -u to Resmgr. It is ignored today.

Steps to Migrate

7.2.5: Do not use the obsolete structures, members, macros, and options. Migrate off the statically compiled library and old headers (for example, nvtime.h) and any other legacy nvtime files; use the current nvtime2 library and headers (for example, nvtime2.h) only. Remove references to the old library and headers from build and source before 7.2.5.

Increase in Interface Name Length Macro

Target Changes	Backward Compatible	Platform	OS
The macro NVTIME_MAX_IFACE_LEN (nvtime2.h), which defines the maximum length of an interface name string, is to be increased to 20 characters to support longer interface names.	Yes (7.2.4); No (7.2.5)	Orin to Thor	QNX

Migration Path

7.2.4 to 7.2.5

Migration Rationale

Support for longer interface names is required as the resmgr is moving to a pluggable architecture.

Steps to Migrate

Client applications using the macro NVTIME_MAX_IFACE_LEN for any buffer or array size that stores an interface name should be rebuilt/recompiled to use the new value.

New FSI Error Codes Reported by nvdvms_set_vm_state (nvdvms_client.h)

Target Changes	Backward Compatible	Platform	OS
nvdvms_set_vm_state now documents seven additional FSI error codes that may be reported during VM state transitions: nvdvms_resume_error_state_failure (0x1c) nvdvms_mutex_api_failure (0x1d) nvdvms_process_reinit_failure (0x1e) nvdvms_process_graceful_termination (0x1f) nvdvms_process_ungraceful_termination (0x20) nvdvms_resume_get_power_profile_failure (0x21) nvdvms_resume_update_vm_state_to_sysmgr_failure (0x22) A new @note documents that if a monitored process terminates, nvdvms_set_vm_state returns failure and an FSI error containing the terminated process’s PID is reported.	No. The source rebuilds, but runtime behavior changed.	SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5.4.2 to 7.2.5.0

Migration Rationale

Expanded FSI error reporting covers new internal failure paths (mutex API failures, reinit failures, monitored-process termination, and resume-time power-profile / sysmgr update failures) that nvdvms_set_vm_state can now raise.

Steps to Migrate

1. Extend FSI error-code handlers to recognize codes 0x1c through 0x22 in addition to the previously documented 0x01..0x1b range:

   /* Pre-7.2 set_vm_state callers handled the documented
    * 0x01..0x1b FSI error codes. */
   

   becomes:

   /* 7.2: also handle FSI error codes 0x1c..0x22:
    *   0x1c nvdvms_resume_error_state_failure
    *   0x1d nvdvms_mutex_api_failure
    *   0x1e nvdvms_process_reinit_failure
    *   0x1f nvdvms_process_graceful_termination
    *   0x20 nvdvms_process_ungraceful_termination
    *   0x21 nvdvms_resume_get_power_profile_failure
    *   0x22 nvdvms_resume_update_vm_state_to_sysmgr_failure
    */
   

2. Treat a non-success return from nvdvms_set_vm_state as a possible monitored-process termination and inspect the accompanying FSI error payload for the terminated PID.

NvClock API Surface Updates (nvclockapi.h)

Target Changes	Backward Compatible	Platform	OS
A new API, NvClockCheckIfSharedClock, lets callers query whether a given clock ID refers to a shared clock. The output isShared is set true for shared clocks and false otherwise. The clock setters NvClockChangeDeviceClockSource, NvClockSetClockFreqHz, and NvClockSetMaxDeviceClockFreq are now documented as no-ops that return success when invoked on a shared clock. Callers should gate them with NvClockCheckIfSharedClock. The NvClockError @return semantics were tightened across NvClockGetClockFreqHz, NvClockDeviceClockControl, NvClockDeviceResetControl and NvClockSetClockFreqHz: a NULL Frequency, an invalid clock state, an invalid reset state or a negative Frequency is now classified as NvClockError (previously some of these mapped to NvClockInvalidParam). The doxygen @usage doc-contract was reformatted across the entire NvClock API surface: “API Group / Init / Runtime / De-Init” was replaced by “Allowed execution state” (Initialization / Operational / Reinit/Deinit Preparation); new Implementation ASIL: ASIL D (gated by NV_ASIL) and Maturity: GA annotations were added; the privilege contract on NvClockGetDeviceResetStatus dropped the AsilLevel: <1..4> requirement.	No. Source rebuilds, but runtime behavior changed.	SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5.4.2 to 7.2.5.0

Migration Rationale

Surface the long-undocumented shared-clock no-op semantics so callers can detect the condition before issuing setters; tighten the @return classification to match the runtime; and standardize the NvClock @usage template against the wider safety/usage doc-contract refresh.

Steps to Migrate

1. Where appropriate, gate clock setters with the new shared-clock probe:

   bool isShared = false;
   NvClockErrCode rc = NvClockCheckIfSharedClock(clockId, &isShared);
   if (rc == NvClockSuccess && !isShared) {
       (void)NvClockSetClockFreqHz(clockId, freqHz);
   }
   

2. Audit error-handling switches on NvClockErrCode to recognise that NULL / invalid-state / negative-frequency inputs now return NvClockError rather than NvClockInvalidParam.

3. If your manifest provisioned the AsilLevel custom ability on NvClockGetDeviceResetStatus, you can drop it. The privilege is no longer required for that read-only status query.

4. Adopt the new Allowed execution state classification when planning when to call NvClock APIs during the application lifecycle.

NvGpio API Surface Updates (nvgpio_lib.h, nvgpio_types.h)

Target Changes	Backward Compatible	Platform	OS
The NvGpioDir_Force32 enumerator (which forced NvGpioDir to a 32-bit signed underlying type) was removed. NvGpioDir now contains only NvGpioDir_Input (0) and NvGpioDir_Output (1). NvGpioOpen documentation was reordered so gpio_handler is documented before gpio_name, matching the prototype’s declaration order. The prototype itself is unchanged. The header also drops the conditional include of nvgpio_lib_debug.h. NvGpioOpen now documents its pin-lookup algorithm: a /dev/nvgpio/<ctrl_num>/<pin_name> path is used directly, while /dev/nvgpio/<pin_name> causes a search across all controller directories (0..6) under /dev/nvgpio/. The NvGpio_InvalidName failure now reads “pin name could not be found in any of the GPIO controller directories under /dev/nvgpio”. NvGpioWaitforInterruptEvent documentation tightened the valid event_count range from [0..INT_MAX] to [1..INT_MAX]; a new NvGpio_StdErrno @retval was added to surface pulse-pool shortage; the Async/Sync classification was corrected from “Async” to “Sync”. The defgroup ingroup classification moved from qnx_lib_group to gpio_ifc, and the @usage doc-contract was reformatted across all NvGpio APIs (Allowed execution state / Implementation ASIL: ASIL D / Maturity: GA). The nvgpio/pin custom-ability description was extended to cover both the Tegra234 (controllers 0..6) and Tegra264 (Main 0,3-5; Uphy 1-2; AON 6) topologies.	No. Source changes are required.	SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5.4.2 to 7.2.5.0

Migration Rationale

The NvGpioDir_Force32 sentinel was unused. The toolchain is now relied on to size the enum. The remaining changes harden documented contracts (pin-lookup, valid event-count range, sync/async, doc taxonomy) against new platform topologies (Tegra264) and standardize the safety/usage doc-contract template.

Steps to Migrate

1. Replace any reference to NvGpioDir_Force32 with one of the two real enumerators:

   NvGpioDir d = NvGpioDir_Input;   /* was NvGpioDir_Force32 */
   

   Compile-time signal of this break: 'NvGpioDir_Force32' undeclared.

2. For NvGpioWaitforInterruptEvent, do not pass event_count = 0 and add a branch for NvGpio_StdErrno:

   rc = NvGpioWaitforInterruptEvent(h, &t, 1);
   if (rc == NvGpio_StdErrno) { /* pulse-pool shortage */ }
   

3. When using a single-segment pin path (/dev/nvgpio/<pin_name>), confirm the pin is unique across controllers 0..6 (Tegra234) or the Tegra264 Main/Uphy/AON layout, since lookup now searches every controller directory.

4. Provision the nvgpio/pin custom ability per the new Tegra234 / Tegra264 topology mapping documented in the header.

NvLauncher API Redesign (nvlauncher.h)

Target Changes	Backward Compatible	Platform	OS
The NvLauncher API was reworked end-to-end to be reentrant and thread-safe; per-call context is now routed through a new callback_arg parameter rather than stored on nvl_config_t.cb. Highlights: nvl_execute_command was redesigned: cmd is now const char *; the cmdIdx, config_idx and skipCrosscheck parameters were removed; a new void *callback_arg was introduced as the per-invocation argument forwarded to all callbacks. A new two-step parse-then-execute API was added: nvl_parse_command produces an iolcfg_cmd_handle_t and a nvl_cmdtype_t classification; nvl_get_priority lets callers inspect the parsed command priority; nvl_execute_command_handle executes a parsed handle (single use). nvl_reset_credentials drops root privileges to the configured uid/gid set. A new nvl_cmdtype_t enum was added: NVL_CMDTYPE_UNDEFINED (0x00000000U), NVL_CMDTYPE_USERCMD (0x000000FFU), NVL_CMDTYPE_PREDEF_CMD (0x0000FF00U), NVL_CMDTYPE_ICMD (0x00FF0000U), NVL_CMDTYPE_HELP (0xFF000000U), NVL_CMDTYPE_INVALID (0xFFFFFFFFU). Values are spaced for a Hamming distance of 8. Two new nvl_err_t codes: NVL_ETIMEOUT (0x000003A6UL) and NVL_ENOMEM (0x000003C0UL). The NVL_EINVAL doxygen typo “arguement” was corrected to “argument”. The launcher callback signatures (iol_cb_prepare_done, iol_cb_spawn_done, iol_cb_failure) were rewritten: return type changed from int32_t to nvl_err_t; cmd_idx / config_idx / skipCrosscheck parameters were removed; iol_cb_prepare_done’s num_of_instance was renamed to instance. iol_cb_launched and the matching nvl_config_t.cb.cb_launched / cb_launched_arg fields were removed; track command completion via cb_executed and cb_failure. nvl_config_t.cb lost its per-callback argument fields (cb_prepare_arg, cb_executed_arg, cb_failure_arg); arguments are now passed per-invocation via nvl_execute_command’s callback_arg. Style cleanup: NVL_MAX_GROUPS macro definition simplified from (384U) to 384U; the numeric value is unchanged. The defgroup was renamed from iolauncherlib_api to libnvlauncher_group and the @usage / @note doc-contract was rewritten across every NvLauncher symbol (Allowed execution state / Implementation ASIL: ASIL D / Maturity: Experimental); the file-level @file/@brief block at the top of the header was also removed.	No. Source changes are required.	SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5.4.2 to 7.2.5.0

Migration Rationale

The previous global per-callback argument storage on nvl_config_t.cb was not safe in multi-threaded launchers. The redesigned API moves all per-invocation context into a per-call callback_arg and offers a parse-then-execute flow that lets callers inspect and filter commands (by type or priority) before launching, alongside an explicit credential-reset hook for launchers that boot as root.

Steps to Migrate

1. Update every nvl_execute_command call site to drop cmd_idx / config_idx / skipCrosscheck and pack them into a per-call context:

   struct ctx { uint32_t cmd_idx; uint32_t cfg_idx; } c = { idx, 0U };
   nvl_err_t e = nvl_execute_command(cmdbuf, &c, &status, &pid);
   

   Compile-time signal of this break: too many arguments to function 'nvl_execute_command'.

2. Update callback signatures to return nvl_err_t and read the previously implicit context out of the arg parameter:

   nvl_err_t cb_prepare(void *arg, uint32_t instance);
   // pack ci/cfg into *arg via callback_arg from nvl_execute_command()
   

3. Drop cfg.cb.cb_*_arg initialisers and the cb_launched / cb_launched_arg hook; track completion via cb_executed and cb_failure:

   nvl_config_t cfg = {
       .cb = { .cb_prepare = on_prepare, .cb_executed = on_executed, },
   };
   (void)nvl_execute_command(cmd, my_ctx, &status, &pid);
   

   Compile-time signal of this break: 'struct ::cb' has no member named 'cb_prepare_arg'.

4. Optionally adopt the new parse-then-execute flow when you need to inspect commands before launch:

   char buf[256];
   iolcfg_cmd_handle_t hcmd = NULL;
   nvl_cmdtype_t ct = NVL_CMDTYPE_UNDEFINED;
   nvl_err_t e = nvl_parse_command(cmd, buf, sizeof buf, &hcmd, &ct);
   if (e == NVL_OK) {
       (void)nvl_execute_command_handle(hcmd, buf, ct, cmd, &arg,
                                        &status, &pid);
   }
   

5. Extend nvl_err_t switches to recognise NVL_ETIMEOUT and NVL_ENOMEM.

6. Note that the redesigned API is currently tagged Maturity: Experimental; track future revisions before adopting in production safety builds.

mnand Refresh-Progress: Fixed-Point Migration (nvmnand.h, nvmnand_ufs.h)

Target Changes	Backward Compatible	Platform	OS
mnand_emmc_get_rfsh_progress (eMMC) changed its rfsh_progress parameter from double * to uint64_t *; the value is now returned in fixed-point representation scaled by 1000 (for example, 123456 represents 123.456%). mnand_ufs_lib_get_rfsh_progress (UFS) is updated the same way: double * -> uint64_t * with x1000 fixed-point encoding.	No. Persisted data / wire values may differ.	SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5.4.2 to 7.2.5.0

Migration Rationale

Eliminate floating-point in the refresh-progress reporting paths so the APIs are usable on safety-critical builds that disable hardware floating-point, and standardize on a deterministic fixed-point integer encoding shared across eMMC and UFS.

Steps to Migrate

1. Update both the function-pointer typedef registration and any call-site to consume uint64_t * and convert from x1000 fixed point at the read-out:

   uint64_t rfsh_x1000 = 0U;
   chip->ops.get_rfsh_progress(chip, &rfsh_x1000);
   printf("%lu.%03lu%%\n",
          (unsigned long)(rfsh_x1000 / 1000U),
          (unsigned long)(rfsh_x1000 % 1000U));
   

   Compile-time signal of this break: incompatible pointer type passing 'double *' where 'uint64_t *' is expected.

2. Apply the same change to the UFS-side ops table:

   uint64_t rfsh_x1000 = 0U;
   ufs_ops.get_rfsh_progress(chip, &rfsh_x1000);
   // rfsh_x1000 / 1000U is the integer percentage
   

NvQNX Common: NV_DIO* Compile-Time Guards and Helpers (nvqnx_common.h)

Target Changes	Backward Compatible	Platform	OS
Four new internal-tag typedefs (class_range_guard, cmd_range_guard, data_range_guard, dir_range_guard, all aliases for char) were added as infrastructure for the new compile-time field-range checks. New limit macros NV_DIOTF_DATA_MAX (16383U), NV_DIOTF_CLASS_MAX (255U) and NV_DIOTF_CMD_MAX (255U) were added, along with the compile-time guard macros NV_DIO_CLASS_GUARD, NV_DIO_CMD_GUARD, NV_DIO_DATA_GUARD, NV_DIO_DIR_GUARD, and the composite NV_DIOTF_FIELDS_OK / NV_DION_FIELDS_OK / NV_DIO_FIELDS_OK that the rewritten NV_DIO* encoders use to fail the build when class/cmd/size/dir overflow their bit fields. A new NV_SHMCTL_SEAL (0x00000004U) override constant for shmctl flags was also added. The five NV_DIO* devctl encoder macros (NV_DIO_RAW, NV_DION, NV_DIOF, NV_DIOT, NV_DIOTF) were rewritten to add the compile-time guards. The encoded runtime value is unchanged when all inputs are within range. An out-of-range argument now produces a build-time error from the sized-array trick; previously it silently truncated. The NV_IOFUNC_NFUNCS, NV_RESMGR_CONNECT_NFUNCS and NV_RESMGR_IO_NFUNCS macros internally swapped the leading-field sizeof(uint32_t) to sizeof(unsigned) (matches the actual QNX struct field type; numerically unchanged on supported targets). The two static-inline helpers nv_verify_devctl_msg_length and nv_verify_devctl_ocb_permissions were removed from the public header; their bodies are now inlined back into nv_iofunc_devctl_verify. Out-of-tree callers must switch to nv_iofunc_devctl_verify. nv_iofunc_devctl_verify doxygen @return was tightened: EMSGSIZE clause rephrased; the EINVAL clause now absorbs unsupported verification flags, replacing the previously-separate EOPNOTSUPP line. The MISRA-deviation Coverity annotations were updated from MISRA_C_2012 to MISRA_C_2023.	No. Source changes are required.	SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5.4.2 to 7.2.5.0

Migration Rationale

Hardens the NV_DIO* devctl encoders against silent integer overflow into adjacent bit fields by promoting the check to compile time, adds the SEAL shmctl flag override required for sealed shared-memory objects, and trims the public header by inlining helpers that had no documented client need.

Steps to Migrate

1. Replace any direct call to the removed helpers with the wrapping verify API:

   /* before */
   ret = nv_verify_devctl_msg_length(ctp, msg, sz, checks);
   /* after */
   ret = nv_iofunc_devctl_verify(ctp, msg, ocb, checks);
   

   Compile-time signal of this break: implicit declaration of function 'nv_verify_devctl_msg_length'.

2. Audit any NV_DIO* macro usage in your headers. Payloads larger than NV_DIOTF_DATA_MAX (16383U) or out-of-range class/cmd values now fail to build. Compile-time signal: negative array bound in NV_DIO_DATA_GUARD/NV_DIO_CLASS_GUARD/NV_DIO_CMD_GUARD.

3. Adopt NV_SHMCTL_SEAL when you want to seal a shared-memory object’s layout:

   (void)shm_ctl(fd, NV_SHMCTL_SEAL, 0U, 0U);
   

4. If your error handler distinguished EOPNOTSUPP from EINVAL on nv_iofunc_devctl_verify, fold both into a single “unsupported request” path; the documented surface now classifies unknown checks as EINVAL (the implementation still returns EOPNOTSUPP in the deeper trailing branch).

NvThermmon API Surface Updates (nvthermmonapi.h)

Target Changes	Backward Compatible	Platform	OS
The BPMPComm/ZoneID custom-ability documentation generalized from a hard-coded 0..8 list (CPU-therm = 0, GPU-therm = 1, …, tj-therm = 8) to a “List of Zone IDs” form supporting comma-separated values and hyphen ranges (for example, BPMPComm/ZoneID:0,3-5,7). Customers must reference zone IDs by the platform-specific mapping rather than the previously enumerated 9-zone table. NvThermmonSetAlert is now documented as valid only for external thermal zones; calls for internal zones return the documented invalid-parameter error. NvThermmonPerformCorrelationCheck gained a new @note requiring the temperature-delta parameters to be configured based on the board’s safety analysis, and its “Allowed execution state / Reinit/Deinit Preparation” tightened from “Yes” to “No”. The @usage doc-contract was reformatted across all NvThermmon APIs: “Custom abilites” -> “Custom abilities” (typo fix), “API group / Init / Runtime / De-Init” replaced by “Allowed execution state”; per-API Implementation ASIL tags (ASIL-D for NvThermmonOpen / NvThermmonGetZoneTemp / NvThermmonClose; QM for NvThermmonSetAlert; ASIL-B for NvThermmonPerformCorrelationCheck) and Maturity: GA tags were added.	No. Source rebuilds, but runtime behavior changed.	SR	QNX

Migration Path

• Orin to Thor

Migration Release Path

6.5.4.2 to 7.2.5.0

Migration Rationale

Decouple the privilege grammar from a fixed 9-zone topology so platforms with different zone counts can use the same ability scheme; tighten the input-domain contract for NvThermmonSetAlert and the lifecycle contract for NvThermmonPerformCorrelationCheck; and align the @usage template with the wider safety/usage doc-contract refresh.

Steps to Migrate

1. Update QNX manifests to use the new BPMPComm/ZoneID comma/hyphen syntax and look up zone IDs for your target platform (the previously enumerated 0..8 mapping is no longer authoritative).

2. Restrict NvThermmonSetAlert calls to external thermal zones; any internal-zone invocation should be removed or rerouted.

3. Tune TempDelta_1 / TempDelta_2 for NvThermmonPerformCorrelationCheck per the board’s safety analysis, and ensure the API is not invoked during the reinit/deinit-preparation phase.

4. Reflect the per-API Implementation ASIL tag in any internal safety analyses (ASIL-D / QM / ASIL-B per the bullets above).

NvThermmon Component Rename: Platform Suffix Removed (io-nvthermmon, libnvthermmonapi.so)

Target Changes	Backward Compatible	Platform	OS
The QNX thermal-monitor driver components are renamed in release 7.2.6.0 to drop the _t23x platform suffix, because the driver is common to all Tegra platforms: io-nvthermmon_t23x -> io-nvthermmon io-nvthermmon_t23x_errinj -> io-nvthermmon_errinj libnvthermmonapi_t23x.so -> libnvthermmonapi.so Security-policy types io_nvthermmon_t23x_ext_t and io_nvthermmon_t23x_ext_board_t -> io_nvthermmon_ext_t and io_nvthermmon_ext_board_t Users and groups io_nvthermmon_t23x_soc and io_nvthermmon_t23x_board -> io_nvthermmon_soc and io_nvthermmon_board The C API is unchanged: the public header (nvthermmonapi.h), all NvThermmon* symbols, error codes, the devctl protocol, the /dev/nvthermmon/<zone> device namespace, and the NvThermmon/Zone/<name> custom abilities are identical. The per-platform test utilities (thermmon_control_t23x and thermmon_control_t264) keep their platform-specific names.	No. Relinking and name-reference updates are required. No source-code changes.	NSR, SR	QNX

Migration Path

• Orin to Thor

• Thor to Thor

Migration Release Path

• 7.2.5.0 to 7.2.6.0

Migration Rationale

The thermal-monitor driver (resmgr and client library) is a single platform-common implementation; platform differences are handled through the device tree (/thermal-zones), not per-chip code. The _t23x suffix wrongly implied an Orin (T234)-only component and caused recurring confusion, because only the thermal test utilities legitimately differ per chip. This is an artifact-name change only, with no behavioral or API change.

Steps to Migrate

1. Relink applications against the renamed library:

   # before
   LDFLAGS += -lnvthermmonapi_t23x
   # after
   LDFLAGS += -lnvthermmonapi
   

   Link-time signal of this break: cannot find -lnvthermmonapi_t23x.

2. Update any launch, monitoring, or packaging configuration that references the binary or library by filename, for example iolauncher launch commands, pidin -p or slay invocations, and filesystem or IFS manifests:

   io-nvthermmon_t23x        ->  io-nvthermmon
   io-nvthermmon_t23x_errinj ->  io-nvthermmon_errinj
   libnvthermmonapi_t23x.so  ->  libnvthermmonapi.so
   

   Runtime signal of this break: pidin -p io-nvthermmon_t23x finds no process; launch of the old binary name fails with path-not-found.

3. If a custom security policy references the thermal driver identities, update the type names to io_nvthermmon_ext_t / io_nvthermmon_ext_board_t and the user/group names to io_nvthermmon_soc / io_nvthermmon_board, including any iolauncher --secpol-type arguments and -U user specifications.

4. No source-code changes are required: #include <nvthermmonapi.h> and all NvThermmon* API usage remain valid, and applications opening /dev/nvthermmon/<zone> device paths are unaffected.