[rtl] Faults that reach only the register file can go unnoticed

Aperta
  • Qualcosa non va?
#2,576 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Attiva
Ambito
security

Direzione di ricerca

Start by reading security.rst and the fault-injection findings described in the issue, then trace the register file ECC and lockstep coverage in the OpenTitan ibex_top configuration. The issue asks whether register-file-only faults are in scope; the expected outcome is a decision on that coverage and, if they are out of scope, a one-line clarification in security.rst.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

A fault that reaches only the register file, not the lockstep, can still go unnoticed. #2566 added the register file's read addresses and write port to the lockstep compare, through u_signals_prim_buf. A fault that the lockstep does not receive is left to the register file ECC. That ECC misses a wrong value with the same check bits as the correct one, for example its inverse. A fault in the register file's own address decoding could do the same, but I did not test that.

I ran a SymbiYosys fault-injection check on #2566, using ibex_top in the opentitan config with CHERIoT mode off and on. It flipped one bit of the port A read address, the write address or the write enable for one cycle. A flip on the core's output reaches both the register file and the lockstep. Every such flip was followed by a lockstep mismatch and the major alert, unless it came too late for the check to see the response. For flips that reached only the register file, the check found cases with no major alert within three clock cycles of the core using the wrong value.

The check ran about 10 clock cycles deep, without interrupts or debug requests. Address flips hit a read or a write that an instruction made. Write-enable flips could also hit a cycle without a write. I did not inject faults on the write data, the port B address, address bit 4 in CHERIoT mode, or during dummy instructions.

security.rst counts the register file as covered by its ECC and the lockstep compare. If faults that reach only the register file are out of scope, should I send a one-line follow-up that says so?

Lingua principale
SystemVerilog
Stelle
2.2k
Fork
836
Merge medio
5g 8h
PR unite (30g)
22

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di lowRISC/ibex

Tutte le issue di lowRISC/ibex

Issue simili

Altre issue su Security

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.