Fault Testing a Synthesizable Embedded Processor at Gate Level using UltraScale FPGA Emulation
Fault Testing a Synthesizable Embedded Processor at Gate Level using UltraScale FPGA Emulation
复制标题
使用 UltraScale FPGA 仿真在门级对可综合嵌入式处理器进行故障测试
DOI：
10.1145/3289602.3293931
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Moslema Sharif
中科院分区：
文献类型：
--
作者：
T. Mannos;Brian Dziki;Moslema Sharif
虽然在抽象级故障测试软件中存在多种应用，但门级故障测试传统上仅限于将故障注入小型专用电路，这是因为门级仿真所需的计算时间和FPGA仿真所需的逻辑资源(LUT和寄存器)。在我们的工作中，我们利用UltraScale和UltraScale+平台的大量资源，系统地测试运行用户应用程序的嵌入式处理器的ASIC或FPGA实现的所有门级输入的故障。使用可配置、可综合的破坏电路，通过扫描链连接并由状态机控制，我们测试了运行AES256应用程序的LEON3 CPU的每个逻辑门上的四种不同类型的故障。整个过程花费了不到两个小时，与门级模拟相比，加速了7200倍。虽然硬件和软件都没有采用故障缓解技术，但我们惊讶地发现了多个固定在0、固定在1和延迟故障，这些故障导致通过通信串口泄露全部或部分密钥和明文。总体而言，我们确定了22种独特的错误行为，其中4种涉及某种形式的密码或内存泄漏。这些在LEON3的ASIC和FPGA网表中出现的比例大致相同，这表明分析对不同实施的稳健性。在测试的四种静态故障类型中，延迟故障在发现关注的行为方面是最有效的。
While several applications exist to fault-test software at the abstract level, gate-level fault testing has traditionally been limited to injecting faults into small, dedicated circuits, due the computational time required for gate-level simulations and the logic resources (LUTs and registers) required for FPGA emulation. In our work, we leverage the extensive resources of the Ultrascale and Ultrascale+ platforms to systematically test faults on all gate-level inputs of an ASIC or FPGA implementation of an embedded processor running a user application. Using a configurable, synthesizable saboteur circuit connected using a scan chain and controlled with a state machine, we tested four different types of faults on each logic gate of the LEON3 CPU running an AES 256 application. The entire process took just under two hours, a 7200X speedup from gate-level simulation. Though neither the hardware nor software employed fault mitigation techniques, we were surprised to discover multiple stuck-at-0, stuck-at-1, and delay faults that resulted in total or partial key and plaintext leakage through the communications serial port. Overall, we identified 22 unique faulty behaviors, four of which involve some form of crypto or memory leakage. These occurred in roughly the same proportions in ASIC and FPGA netlists of the LEON3, suggesting robustness of the analysis to different implementations. Of the four static fault types tested, delay faults were the most effective at uncovering behaviors of concern.