XAVIER | TRM | DP-09253-002_v1.1 | SUBJECT TO CHANGE | www.nvidia.com Page of 5921 8287
Each ARM processor complex is associated with one WDT. For the CCPLEX, all cores are in the same coherency
domain and are considered as one SMP processor for software purposes; i.e., all cores inside CCPLEX are
associated with the same WDT (WDT0 in the top TKE).
Select as reference time base either:
Any of the timer zero pulses
A transition on any bit in a defined subset of the bits of the local TSC counter
Implements a periodic downcounter decrementing at the selected rate. The downcounter generates an expiration
event when it reaches zero.
At each expiration, the WDT increases the expiration level, saturating at level 5
The increase may be larger than 1, the exact increase is configurable per expiration level
The WDT logic can assert specific output signals based on the current expiration
For the first three expiration levels, the WDT can assert a corresponding interrupt, each with a specific use:
If the expiration level is 1 or more, a normal priority interrupt (IRQ) directly routed to the associated
processor complex. This may be used to restart the timer inside an interrupt handler in non-safety
critical applications.
If the expiration level is 2 or more, a high priority interrupt (FIQ) directly routed to the associated
processor complex. This interrupt can also be made visible to other processor by using a shared
interrupt line if supported by the specific TKE. In Android, the corresponding interrupt handler assumes
the system is in a bad state and captures some state information for a potential post mortem analysis.
The interrupt handler may not attempt to correct the problem.
If the expiration level is 3 or more, a normal interrupt (IRQ) routed to the LIC and from there routed to a
set of processors, this is meant to trigger system wide actions, in particular recovery actions of the
processor associated with the WDT. This is also known as a remote interrupt.
If the expiration level transitions from a value strictly below 4 to a value above or equal to 4, the WDT can assert a
system wide debug reset. When debug is allowed, this reset can be intercepted by debug logic, and specific actions
taken to preserve information about the state of the system before reset assertion clears them, allowing for post-
mortem debug analysis. In particular, DFD logic attempts to flush the processor caches and local memories to DRAM,
save processor state, and put the DRAM in self-refresh before allowing the reset to take effect. WDT and CAR logic
uses a four phase handshake to communicate the WDT debug reset request.
If the expiration level is 5, the WDT can assert a system wide reset, equivalent to a Power On Reset, this reset can
optionally include a PMIC power cycling depending on the configuration in PMC. This is the last safety net for
recovery purposes, attempting to bring the system to a working state without any specific attempt at preserving
information.
Each WDT signals an error to the Hardware Safety Manager (HSM) when its expiration level is greater or equal than
a programmable threshold.
The watchdog timer features are disabled by default for backwards compatibility.
The counter can only be optionally restarted in defined windows of time instead of at any time
The granularity of the window mechanism in Xavier has been improved from its predecessor.
The counter can only be optionally restarted or disabled using a Challenge/Response pair (also known as Question
/Answer, QA).
The windowing operation works like this: