Back to Eliza

Android on simulated chip TODO audit - 2026-05-17

packages/chip/docs/project/android-on-simulated-chip-todo-2026-05-17.md

2.0.19.0 KB
Original Source

Android on simulated chip TODO audit - 2026-05-17

Scope: everything needed to run Android against the Eliza simulated-chip story without overstating the current hardware. This audit separates three tracks:

  • Android virtual-device evidence: AOSP/Cuttlefish/QEMU/Renode software smoke.
  • Eliza CPU/AP simulator evidence: generated Chipyard/Rocket AP boot path.
  • Current e1-chip RTL evidence: debug/MMIO prototype only, not Android boot.

Current claim boundary

Android is not proven running on the current e1-chip RTL. The central platform contract still has e1_chip.has_cpu=false, so the checked-in RTL is not an Android-capable AP. QEMU/Cuttlefish/Renode evidence is useful software and simulator plumbing evidence only. A real "Android on our simulated chip" claim requires a generated CPU/AP simulator, boot firmware handoff, Linux boot, Android userspace smoke, and manifest-bound transcripts.

Completed in this pass

StatusTODOResult
DONEUnify Android evidence file names across the capture helper, simulator driver, checker, docs, and manifests.capture-aosp-evidence.sh, boot_android_simulator.sh, check_android_sim_boot.py, AOSP docs, and sw/aosp-device/evidence_manifest.json now use the strict nine-log AOSP evidence set. Legacy cuttlefish_riscv64_boot.log, cts_virtual_device_subset.log, and vts_virtual_device_subset.log are documented as aliases only.
DONEAdd capture modes for all strict AOSP evidence logs.Added sepolicy-build, selinux-neverallow, cts-vts-plan, cuttlefish-smoke, qemu-smoke, and renode-smoke modes.
DONEKeep Android simulator reports from claiming e1-chip proof.check_android_sim_boot.py requires reference-only claim boundaries and rejects pass reports unless scripts/check_software_bsp.py aosp evidence status clears.
DONEAlign boot_android_simulator.sh with the strict AOSP gate.Full mode attempts build/VINTF/SELinux, CTS/VTS intake, Cuttlefish, QEMU, and Renode categories. --build-only stops before virtual-device and compatibility-intake categories.
DONEFix default AOSP product mismatch for repo-local product files.Capture and simulator scripts default to eliza_ai_soc-userdebug, which is exported by AndroidProducts.mk.
DONEFix QEMU payload manifest discovery.check_qemu_linux_payload_status.py now accepts the timestamped Debian payload directory written by fetch_qemu_linux_payload.py while preserving the older non-timestamped path.
DONEAlign QEMU payload docs with the fetch helper default.The QEMU README and payload plan now mention debian-installer-riscv64-20260517T000000Z.
DONEEnsure Buildroot kernel fragment enables the parent Eliza BSP symbol.Added CONFIG_ELIZA_E1_BSP=m alongside NPU/DMA module selections.
DONERemove hardcoded personal path from the AOSP local manifest seed.Replaced the old local path/project name with a clear placeholder and repo name.

Remaining blockers

PriorityTODOWhy it blocks Android on simulated chipRequired evidence to clear
BLOCKERGenerate or import the selected CPU/AP simulator path.The current e1-chip contract has no CPU. Android needs an AP with reset, DRAM, timer, interrupts, UART, and MMU-capable CPU.Generated Chipyard/Rocket manifest with DTS, memmap, Verilog/FIRRTL, simulator binary, hashes, and tool versions.
BLOCKERBuild the generated AP Verilator simulator.Android/Linux boot evidence must come from an executable AP simulator, not only generated source files.Verilator build transcript and simulator executable referenced by the generated manifest.
BLOCKERDefine the AP hardware ABI in the central platform contract.The platform JSON only describes the debug/MMIO e1 chip and not the AP boot ABI.Contract entries for reset vector, DRAM, UART, CLINT/ACLINT, PLIC/IMSIC, boot ROM/firmware handoff, and generated AP source of truth.
BLOCKERCreate a real firmware handoff path.Linux/Android needs OpenSBI or equivalent machine-mode firmware and a deterministic next-stage handoff.OpenSBI build log, handoff transcript, payload load addresses, and generated DTB reference.
BLOCKERBoot Linux on the selected AP simulator.Android userspace depends on a booting kernel, initrd/rootfs, console, timer, interrupt, and memory path.eliza_e1_linux_boot.log, trap/timer/IRQ log, ISA/cache/MMU log, AP benchmark/sanity log, and CPU/AP evidence manifest hashes.
BLOCKERBuild or import Android-capable AOSP artifacts.The repo-local AOSP tree is a scaffold; no strict vendorimage, VINTF, SELinux, or smoke evidence is complete.The nine logs required by scripts/check_software_bsp.py aosp: lunch, vendorimage, checkvintf, SELinux build, neverallow, CTS/VTS plan, Cuttlefish smoke, QEMU smoke, Renode smoke.
BLOCKERProduce an Android smoke transcript tied to the AP simulator.Cuttlefish and qemu-virt are reference-only. They do not prove Eliza AP ABI.A transcript from the generated AP simulator showing Android init/userspace progress and explicit claim boundary.
BLOCKERAdd an AP boot DTB source of truth.Checked-in Linux/AOSP DTS scaffolds are not complete boot DTBs.Generated Chipyard DTS/DTB audit with CPU, memory, timer, interrupt controller, UART console, and payload-safe DRAM range.
BLOCKERImplement or import boot-grade UART, timer, and interrupt contracts.Android/Linux cannot close without early console, clocksource/timer, and interrupt delivery.RTL/generator contract entries, Linux binding/driver configuration, and boot transcript evidence.
BLOCKERReplace the tiny local SRAM model for OS boot claims.The local AXI-lite DRAM model is far too small for Linux/Android payloads.Generated AP DRAM model/controller evidence with enough capacity for the selected payloads.

High-priority follow-ups

PriorityTODORequired work
HIGHAdd active Android HAL build rules only after binaries/source exist.Add reviewed source or prebuilts for e1_npu.default and any hwcomposer.eliza_ai_soc path, then enable packages and VINTF entries with fail-closed behavior.
HIGHComplete SELinux policy for future Android services.Add device/service/hwservice contexts and access rules, then archive policy build and neverallow transcripts.
HIGHRework simulator fstab once the boot target is selected.Avoid AVB/A-B/file-encryption flags that cannot be satisfied by the selected virtual target unless real keys, partitions, and mount evidence exist.
HIGHAdd BoardConfig boot image/vendor_boot/DTB packaging decisions.Define kernel, DTB, bootconfig, partition sizing, and image flow for the external AOSP tree.
HIGHPatch external Linux integration into Kconfig/Makefile.The import helper copies BSP files, but the external kernel must include the Eliza driver directory and DT bindings.
HIGHAdd strict import-check behavior for CI/release modes.Current import checks intentionally block softly when external tree env vars are unset; release gates should require them only when claiming external integration.
HIGHBring AP CLINT/interrupt coverage into platform-contract checks.Hidden timer/software interrupt windows must either become contract entries or be excluded from the boot story.
HIGHWire e1_soc_top/CLINT tests into the standard sim ladder.Current default cocotb ladder does not cover all boot-relevant top-level behavior.
HIGHFix Chipyard import manifest reproducibility issues.Remove duplicate JSON keys and use one canonical full commit/tag representation.

Medium-priority follow-ups

PriorityTODORequired work
MEDIUMRestore scripts/test_software_bsp_evidence.py.Update stale API/CLI expectations or remove it from maintained test surfaces.
MEDIUMAdd host-buildable NPU probe automation to AOSP scaffold checks.Compile/run the fail-closed probe in CI where a host C++ compiler is available.
MEDIUMAdd pinned independent hashes for Debian QEMU payloads.Current fetch verifies against downloaded SHA256SUMS from the selected Debian source; a lock manifest would strengthen reproducibility.
MEDIUMClean duplicated architecture prose before using docs as contract evidence.De-duplicate boot, interconnect, and Linux CPU contract docs.
MEDIUMAdd CI coverage for QEMU Linux payload status when artifacts exist.Keep this optional unless payload artifacts are fetched in CI.

Current validation commands

Run these after local changes:

sh
python3 scripts/test_android_sim_boot_status.py
python3 scripts/check_android_sim_boot.py
python3 scripts/test_software_bsp_checks.py
python3 scripts/check_software_bsp.py aosp --scaffold-only
python3 scripts/check_qemu_linux_payload_status.py
python3 scripts/test_qemu_smoke_status.py
make docs-check

Expected current outcome: local scaffold/status tests pass or block honestly. Strict AOSP/CPU/AP evidence gates remain blocked until external AOSP, generated AP simulator, and boot transcripts exist.