www.bsc.es

Time-randomized Processors for Secure andReliable High-Performance Computing
David Trilla†,‡, Carles Hernández‡, Jaume Abella‡, Francisco J. Cazorla‡,*‡†1st Workshop on Pionering Processor Paradigms
Austin, TX, US*Time-randomized Processors (TRPs)
Proposed to reduce the timing verification costs of criticalsoftware using complex processors– Autonomous automotive driving systems– Unmaned aerial vehicles– Industry 4.0

High performance features challenge worst-case execution
time (WCET) estimation– Caches– Speculation– Shared resources2

Time-randomized Processors (TRPs)
Control the sources of execution time variability– Randomizing  probabilistically• Caches replacement and placement policies• Shared resources Arbitration policies– Upperbounding  when randomizing is not possible• Fixed-Latency floating point unit

In TRPs execution time can be probabilistically modeled
system1, 4, 5, 2,… unknown
Probability of 1, 1, 1, 1, 1?

1, 4, 5, 2,…

 1   6 53

Time-randomized Processors
Timing verification step  collecting measurements
Probabilistic WCET  Extreme Value Theory (EVT)– I.I.D properties– Representative measurements

0100

200

300

400

500

600

700

1,E+00

1,E-01

1,E-02

1,E-03EVT

1,E-044

Extreme Value Theory (EVT)
Considers the system as a black box
Technique to derive the combined probability of appearanceof those events observed (captured)
Cannot predict those events that are not observed
EVT must be fed with meaningful (representative)
observations data from the execution of that program at
operation  derived bounds hold at operation

5

Time-randomized Processors (TRPs)
Example: LEOPARD processor (joint Gaisler-BSC work)
IOMMU

GEShared L2

AMBA AHB On-chip BUSI/O

DL1 IL1
MMU

DL1 IL1
MMU

DL1 IL1
MMU

DL1 IL1
MMUCoreCoreCoreCoreMemoryController– Leon-based Multicore• Simple for HPC  Complex for critical applications– Modifications• Random Replacement and Random placement in Caches• Random permutations arbiter in the bus and memory controller• Worst-latency FPU– Can be enabled/disabled selectively6

Architectural Modifications
Randomized Cache Designs– To make cache conflicts behave probabilistically andremove pathological cases– Random replacement– Random placement• Covers probabilistically conflicts due to variations in the memory
mappingAddress
Random number(given at execution start)

Parametricfunction

7

Architectural Modifications
Random Arbitration in the on-chip bus and memory controller– Round-robin is time analysable but forces assuming the worst-possiblealignment of requests• In a 4 core multicore  3 arbitration rounds is the only safe bound– Random arbitration• Requests aligment is captured probabilistically– Lottery– Random permutations

8Architectural Modifications
Worst-Latency Floating Point Unit (FPU)

LEON FPU (FDIV, FSQRT)– FDIV latency: 15-18 cycles• Enforce always 18– FSQRT latency: 23-26 cycles• Enforce always 26Probabilities– In general the end-user cannot reason about the operated values– Delay upperbounding is the only safe assumption

Upperbounding

Execution time

– End user does not need to control input values

9Enhanced Reliability Properties
Example: Aging effect reduction in caches– Hot carrier injection effects are proportional to utilization– Randomized caches provide uniform set access distribution

10

Enhanced Reliability Properties
Power/Performance stability– Pathological cases occur with a quantifiable (low) probability

11Enhanced Security Properties
Randomization techniques has been proposed for Security– Caches• Layout randomization• Random fill cache– Pipeline• Random stalls insertion

Randomization protect the processor against :– Cache side channel attacks– Power analysis attacks

TRPs  Inherit security properties from randomization
Randomization security techniques do not meet TRPs
requirements
12Time-randomized Processors for HPC
What they can offer?
– Guaranteed Performance at a low cost

IOMMU

GE

Shared L2AMBA AHB On-chip BUS

I/O

DL1 IL1
MMU

DL1 IL1
MMU

DL1 IL1
MMU

DL1 IL1
MMUCoreCoreCore

Core

Time-CriticalApplication

MemoryController
Performance
demading
Applications– Enhanced Security and reliability properties

13

Time-randomized Processors (TRPs) for HPC
TRPs reduce verification effort required to test extreme
situations– With deterministic processors a huge effort is required to trigger worstcase conditions (e.g power viruses)• Current processors complexity is very high• Post-silicon validation is thorough process– In TRPs extreme events will emerge naturally  reducing thecomplexity of the verification process• An arbitrarily low probability canbe attached to the non-observed events
avoiding safe guardbands
for the unfeasible situations
14

Time-randomized Processors (TRPs) for HPC
With TRPs extreme events occur with a given probability– The architect is provided with a solid argument• Extremely low probable events (e.g below meteorit impact) can be simply
discarded• Having quantifiable events helps finding the most adequate safetymeasurement (as for random hardware failures)– Extreme value theory can be employed to argue about extreme power,temperature, execution conditions

15QUESTIONS?

16