Alp SDK v0.17 — DEEPX DX-M1, DRP-AI3 and ONNX Runtime verified on an E1M-V2M, i.MX 93 support removed, and tan 0.7.0

Alp SDK v0.17 released on 2026-10-13. Its headline is a status change: silicon evidence now covers three SoM families — the E1M-X V2N, the E1M-AEN801 (Alif Ensemble E8) and, for the first time, the E1M-V2M, the V2N with a DEEPX DX-M1 accelerator. All three Cortex-A55 inference backends behind <alp/inference.h> are now marked verified on silicon in the SDK verification ledger, each measured on an E1M-V2M103.

The numbers, from docs/verification-status.md. DEEPX DX-M1 (#1262): a yolo11n model opens and invokes under both the DEEPX_DXM1 and AUTO backends, 50 of 50 invokes at a mean of 46.93 ms, and the decoded output matches ONNX Runtime on the CPU for the same model with box correlation 0.9997 and the same top detection. Below the inference API, the DX-M1 flash-boots firmware 2.4.0, enumerates as PCIe 1ff4:0000 Gen3 x2, and all seven of its core sets rebind and invoke cleanly at about 45-48 ms per invoke. DRP-AI3 (#1268): YOLOX-S/VOC runs 20 of 20 invokes at about 40 ms per 640x640 frame, with outputs matching the compiler’s interpreter reference; a run from a baked alp-image-edge image is still owed. ONNX Runtime CPU floor: 10 of 10 invokes at about 1670 ms per 640x640 frame, with all three output heads matching a reference run. That last result was measured against the DEEPX layer’s ONNX Runtime 1.20.1 — the SDK’s own 1.28.0 recipe builds but has still not run on silicon.

The ledger itself grew. It now parses 105 silicon/HIL-gated rows across 13 sections, up from 84 rows across 7 at v0.16; its glyph counts read 20 verified, 51 partial, 35 untested and 1 failing, and those counts can exceed the row total because a row may carry two glyphs. Most of that growth is sections that were not counted before, such as the AEN801 peripheral matrix, rather than rows changing status. One set of rows did move: the AEN I²C, SPI, UART and GPIO backends went from untested to partial — the underlying mechanism is bench-proven on real silicon, while dispatch through the portable backend is not.

The E1M-NX9101 / NXP i.MX 93 module has not gone into production and is on hold, so the SDK no longer carries it (#2781): its SoM preset, family metadata, SoC spec, Yocto machine, the pca9451a PMIC driver and the rpmsg-imx93 example are gone. This is also the release’s sharpest ABI edge. ALP_CAP_ID_HW_LCDIF sat in the middle of alp_cap_id_t, so removing it makes every later enumerator, from ALP_CAP_ID_XSPI_DMA through ALP_CAP_ID_COUNT, one lower — rebuild anything that stores or compares those numeric IDs. Across the release the public ABI records 323 symbols added, 53 changed and 27 removals. Other breaking changes to plan for: alp_shmem_config_t.cacheable and alp_rpc_config_t.cacheable are removed (#2556); the som-preset schema is now v2, with no v1 compatibility path, so an out-of-tree preset that still declares schema_version: 1 fails validation (#2024); coreMQTT-SN is dropped because its upstream repository no longer exists (#1784); and the rest of the old alp_cli command surface is deleted, leaving tan as the CLI (#1367, #1368).

On the display side, the E1M-EVK gains support for the Riverdi RVT121HVDFWCA0-B 12.1-inch LVDS panel through a new, clean-room driver for the TI SN65DSI83 DSI-to-LVDS bridge. Around it sits a display-agnostic layer: the SDK sets a display’s default backlight at boot, and a display declares how it is mounted, reported through alp_display_caps_t.rotation (marked [ABI-EXPERIMENTAL]). The aen-trace-runner exhibition game now ships as an example (#2446) and moves to the Riverdi panel by changing only the shield; the panel runs on the bench on an E1M-AEN803 with the E1M-EVK at rotation 90. Known issue: body control is not yet bench-tested on the Riverdi build. Cameras grow too: OV5647 (#2213) and Sony IMX296 (#2287) Zephyr sensor drivers and IMX335 support — OV9281, IMX296, IMX335 and OV5647 are all verified on an E1M-AEN803 — plus the aen-camera-firstlight, aen-isp-capture and aen-isp-ov5647-viewfinder examples, and a camera-to-MJPEG HTTP stream in connectivity/camera-mjpeg-stream. On V2N and V2M, <alp/camera.h> gains a Linux V4L2 backend with metadata-generated camera devicetree (#2616, #2633); IMX296LQ is bench-proven there on an E1M-V2M103 (as is OV9281 through a hand-written devicetree), and the other Linux sensor fragments are marked bench-unverified.

The 2D graphics layer moves on both platforms. On Alif parts the D/AVE 2D backend for <alp/gpu2d.h> now runs on silicon (#2515): fill, blit and blend all match on an E1M-AEN803 M55-HE over 9 of 9 runs, with ADDITIVE and MULTIPLY still served by the software fallback. The V2N and V2M platform picks up several opt-in features, each labelled with how far it has been proven. <alp/gpu2d.h> gains a backend on the Mali-G31 through the vendor EGL/GLES stack, falling back to the CPU when it cannot help — bench-unverified. ROS 2 Humble becomes an opt-in, layer-gated feature, with a micro-ROS example in examples/multicore/microros-ros2-v2n whose M33 slice builds and boots on an E1M-V2M103 — no ROS 2 round-trip with an agent yet. Linux remoteproc can attach to the CM33 that TF-A already started (opt-in, #2671): on an E1M-V2M103 the attach-only production path attaches, refuses a stop and re-probes cleanly after a reboot with the CM33 heartbeat advancing throughout; the dev-image stop, start and reload half has not been exercised. And U-Boot keeps a persistent, allowlisted environment on eMMC boot partition 2. On the NPU side, examples/v2n/v2n-drpai-inference arrives with the ALP_ENABLE_DRPAI opt-in, and examples/v2n/v2n-two-models opens one model on DRP-AI3 and one on the DEEPX DX-M1 to run them at the same time on an E1M-V2M (#2398). That example is not bench-verified: the two accelerators have never run together.

On Alif parts, a Secure Enclave STOP / STANDBY power backend lands (#2784). It is bench-proven on an E1M-AEN803: STOP wakes on the LPTIMER and both RV-3028 paths on the M55-HE and on the M55-HP (also while the HE keeps running), and STANDBY plus 256 KiB DTCM retention across STOP passed three of three cycles on the M55-HE; the HP has no STANDBY by design. The E1M-AEN801 HP is not verified, and the new ALP_POWER_WAKE_GPIO wake-on-LPGPIO path has never run, because no pad on the AEN801/803 R2 is free to exercise it. The GD32 supervisor bridge gains host-side protocol updates (#2692, #2748, #2697); the E1M IO15 and IO26 pads now need bridge firmware reporting protocol minor 16 or newer (#2725); and alp-sdk no longer redistributes the GigaDevice GD32G5x3 firmware library (#2702). The CC3501E host speaks wire protocol 4.0 and still accepts 3.x; use bridge firmware v0.9.2. The example tree goes from 158 to 183 directories: 33 added and 8 removed.

Alongside the SDK, the tan CLI cut v0.7.0 on the same day. It is a minor release because it breaks v0.6.0 consumers: it requires alp-sdk v0.17.0 or newer, reads only som-preset schema v2, and refuses a Flow D (alif_mram_jlink) MRAM write until --atoc-unqueryable acknowledges that it replaces the whole ATOC. tan bootstrap now installs the arm-zephyr-eabi toolchain by default (--no-toolchain opts out), tan doctor gains a toolchain check that can fail with exit code 4, and the retired tan build --plan, --manifest, --manifest-from and --no-auto-bootstrap flags refuse with build.flag-retired. New for bench work: tan flash --ram for AEN J-Link ITCM RAM-runs that never write MRAM, tan flash --raw, --probe-serial and --probe-usb-path to pick the J-Link, tan reset, tan probe identify --core m55_he, tan model zoo and tan model add, and tan monitor --capture and --break-uboot. The Alp IDE extension for VS Code still pins tan 0.6.0, so it does not use tan 0.7.0 yet.

What stays untested: the AEN30x–70x parts carry no verified ledger row on real hardware, and a family carrying some verified rows does not mean every row for it is verified — check the specific row you depend on before you build on it. The full per-SKU sweep remains the v1.0 gate.