On the reliability of hardware event monitors in MPSoCs for critical domains

Abstract

Performance Monitoring Units (PMUs) are at the heart of most-advanced timing analysis techniques to control and bound the impact of contention in Commercial Off-The-Shelf (COTS) SoCs with shared resources (e.g. GPUs and multicore CPUs). In this paper, we report discrepancies on the values obtained from the PMU event monitors and the number of events expected based on PMU event description in the processor's official documentation. Discrepancies, which may be either due to actual errors or inaccurate specifications, make PMU readings unreliable. This is particularly problematic in consideration of the critical role played by event monitors for timing analysis in domains such as automotive and avionics. This paper proposes a systematic procedure for event monitor validation. We apply it to validate event monitors in the NVIDIA Xavier and TX2, and the Zynq UltraScale+ MPSoC. We show that, while some event monitors count as expected, this is not the case for others whose discrepancies with expected values we analyze.

GPU Devices for Safety-Critical Systems: A Survey

“…-Device hardware architecture and component-specific (e.g., memory [70,43,68,101,109,104], cache [69,87,154,96,97,194]) -Exclusive access policies [96,97,194] -Software virtualization [84,114,141,41,174,112] -WCET analysis [48,29,30,85,33,16,90,89,88] -Execution time variability reduction and management [18,41,42,67,82,84,88,142,144,200,101,70,68,109,43,141,147,47,81,24] -Temporal diagnostics …”

“…The most relevant GPU device architectural components are described in Section 2.1 and Figure 1. Except for the SM, all described components are also common for multi-core devices: processing units (CPU cores, SMs), memory None [119,54,100,201]; ARM [12,14,34,40,47,162,15,25,32,39,47,105,142] Pascal None [12,14,13,16,40,169,39,96,81,120]; ARM [18, 9,…”

“…Finally, even though reasonable measures are defined and implemented to avoid temporal interference, temporal diagnostics are required to check the fulfillment of safety time constraints, by means of techniques such as time watchdog, detecting unexpected interrupts and run-time monitoring (e.g., performance monitoring [25]) [153].…”

Empirical Evidence for MPSoCs in Critical Systems: The Case of NXP's T2080 Cache Coherence

“…In this line, some authors already reported different observed behavior of the coherence protocol to that reported in the Technical Reference Manuals (TRMs) [12]. Others reported discrepancies in the hardware monitors between the observed values and the description provided in the TRM [1,11,16].…”

“…case in Table II (conclusion-L2A). A GetS/GetM message is sent for every address read or written by the DMAr1 . Hence, the number of expected ESR is 65,536 in (A) and (B) and 32,768 in (C) and (D), matching the observed results in TableII (M2S) (conclusion-ESR).…”