[rtl] Faults that reach only the register file can go unnoticed

オープン
  • 何か問題がありますか？
#2,576 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 2 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
バグ
明瞭さ
説明が足りない
活発さ
活発
領域
security

調査の方向性

Start by reading security.rst and the fault-injection findings described in the issue, then trace the register file ECC and lockstep coverage in the OpenTitan ibex_top configuration. The issue asks whether register-file-only faults are in scope; the expected outcome is a decision on that coverage and, if they are out of scope, a one-line clarification in security.rst.

索引モデルが issue の本文から書いたものです。

説明

A fault that reaches only the register file, not the lockstep, can still go unnoticed. #2566 added the register file's read addresses and write port to the lockstep compare, through u_signals_prim_buf. A fault that the lockstep does not receive is left to the register file ECC. That ECC misses a wrong value with the same check bits as the correct one, for example its inverse. A fault in the register file's own address decoding could do the same, but I did not test that.

I ran a SymbiYosys fault-injection check on #2566, using ibex_top in the opentitan config with CHERIoT mode off and on. It flipped one bit of the port A read address, the write address or the write enable for one cycle. A flip on the core's output reaches both the register file and the lockstep. Every such flip was followed by a lockstep mismatch and the major alert, unless it came too late for the check to see the response. For flips that reached only the register file, the check found cases with no major alert within three clock cycles of the core using the wrong value.

The check ran about 10 clock cycles deep, without interrupts or debug requests. Address flips hit a read or a write that an instruction made. Write-enable flips could also hit a cycle without a write. I did not inject faults on the write data, the port B address, address bit 4 in CHERIoT mode, or during dummy instructions.

security.rst counts the register file as covered by its ECC and the lockstep compare. If faults that reach only the register file are out of scope, should I send a one-line follow-up that says so?

主要言語
SystemVerilog
スター
2.2k
フォーク
836
平均マージ
5日 8時間
マージ済み PR（30日）
22

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

lowRISC/ibex のほかの issue

lowRISC/ibex の issue をすべて見る

似ている issue

Security の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。