On the analysis of hardware event monitors accuracy in MPSoCs for real-time computing systems

The number of mechanical subsystems enhanced or completely replaced by electrical/electronic components is on the rise in critical real-time embedded systems (CRTES) like those in cars, planes, trains, and satellites. In this line, software is increasingly used to control (safety-related) critical aspects of CRTES. More complex software requires unprecedented computing performance requirements, that can only be achieved by deploying aggressive processor designs, multiprocessor system on chips (SoCs or MPSoCs). The other side of the coin is that MPSoCs make software timing analysis -- a mandatory pre-requisite for CRTES -- more complex. Performance Monitoring Units (PMUs) are at the heart of most advanced software timing analysis techniques to control and bound the impact of contention in Commercial Off The-Shelf (COTS) System-on-Chips (SoCs) with shared resources (e.g., GPUs and multicore CPUs). However, PMUs are designed with an assurance level below the role they assume in software timing analysis. In this Thesis, we aim at taking an initial step toward reconciling PMU verification with its key role for timing analysis. In particular, this Thesis covers the analysis of the correctness of hardware event monitor (HEM) in embedded processors for CRTES domains. This Thesis illustrates that some event monitors do not behave as expected in their specification, which can in turn invalidate the software timing analysis process performed building on those HEMs. For three real processors used in different CRTES domains, we report discrepancies on the values obtained from the PMU's HEMs and the number of events expected based on HEM description in the processor's official documentation. Discrepancies, which may be either due to actual errors or inaccurate specifications, make PMU readings unreliable. This is particularly problematic in consideration of the critical role played by event monitors for timing analysis in domains such as automotive and avionics. This Thesis proposes a systematic procedure for event monitor validation. We apply this procedure to validate event monitors in the NVIDIA AGX Xavier, NVIDIA TX2, and the Xilinx Zynq UltraScale+ MPSoC. We show that while some event monitors count as expected, this is not the case for others whose discrepancies with expected values we analyze