OpenSPARC T2 Research Articles

Logic Bug Detection and Localization Using Symbolic Quick Error Detection

We present Symbolic Quick Error Detection (Symbolic QED), a structured approach for logic bug detection and localization which can be used both during pre-silicon design verification as well as post-silicon validation and debug. This new methodology leverages prior work on Quick Error Detection (QED) which has been demonstrated to drastically reduce the latency, in terms of the number of clock cycles, of error detection following the activation of a logic (or electrical) bug. QED works through software transformations, including redundant execution and control flow checking, of the applied tests. Symbolic QED combines these error-detecting QED transformations with bounded model checking-based formal analysis to generate minimal-length bug activation traces that detect and localize any logic bugs in the design. We demonstrate the practicality and effectiveness of Symbolic QED using the OpenSPARC T2, a 500-million-transistor open-source multicore System-on-Chip (SoC) design, and using “difficult” logic bug scenarios observed in various state-of-the-art commercial multicore SoCs. Our results show that Symbolic QED: (i) is fully automatic, unlike manual techniques in use today that can be extremely time-consuming and expensive; (ii) requires only a few hours in contrast to manual approaches that might take days (or even months) or formal techniques that often take days or fail completely for large designs; and (iii) generates counter-examples (for activating and detecting logic bugs) that are up to 6 orders of magnitude shorter than those produced by traditional techniques. Significantly, this new approach does not require any additional hardware.

Runtime Malware Detection Using Embedded Trace Buffers

Anti-virus software (AVS) tools are used to detect malware in a system. However, AVS are vulnerable to attacks. A malicious entity can exploit these vulnerabilities to subvert the AVS. Recently, hardware components such as hardware performance counters have been used for malware detection. In this article, we propose preempts malware by examining embedded processor traces (PREEMPT), a zero overhead, high-accuracy, low-latency technique to detect malware by repurposing embedded trace buffer (ETB), a debug hardware component available in most modern processors. The ETB is used for postsilicon validation and debug and allows us to control and monitor the internal activities of a chip, beyond what is provided by the input/output pins. PREEMPT combines these hardware-level observations with machine learning-based classifiers to preempt malware before it causes damage. The benefits of reusing ETB for malware detection include the increased robustness against attacks and no performance penalties. PREEMPT can detect malware on an OpenSPARC T1 core running Linux operating system with a F1-score of 96.6%.

McPAT-Monolithic: An Area/Power/Timing Architecture Modeling Framework for 3-D Hybrid Monolithic Multicore Systems

Three-dimensional integrated circuits (3-D ICs) have the potential to push Moore’s law further by accommodating more transistors per unit footprint area along with a reduction in power consumption, interconnect length, and the number of repeaters. Monolithic 3-D integration is particularly promising in this regard as it offers a very high connectivity between vertical transistor layers owing to its nanoscale monolithic intertier vias. Monolithic integration can be realized at block-, gate-, and transistor-level granularity. A hybrid monolithic (HM) design aims to further optimize area, power, and performance of the chip by combining different monolithic styles. In this article, we introduce McPAT-monolithic, a framework for modeling HM multicore architectures. We use the OpenSPARC T2 processor as a case study to compare different monolithic implementation styles and explore the benefits of HM design. Our simulations show that, under the same timing constraint, an HM design offers 47.2% reduction in footprint area and 5.3% in power consumption compared to a 2-D design at the cost of slightly higher on-chip temperature.

Emphasizing Functional Relevance Over State Restoration in Post-Silicon Signal Tracing

The state restoration ratio (SRR) has been a de facto standard for evaluating the quality of signals selected for post-silicon tracing and debug. In this paper, we establish that SRR is intrinsically unsuitable as a metric for evaluating trace signal quality, as it captures neither the higher-level functionality of the design nor the constraints and requirements on trace signals. We present an algorithm, based on PageRank [PageRank on Netlist (PRoN)], for post-silicon trace signal selection. PageRank is not designed to maximize SRR and is applied to the circuit netlist. We demonstrate that optimizing for SRR typically generates signals that are functionally irrelevant to the design and unusable for debug, for a comprehensive set of SRR-based techniques. We assess the scalability of different signal selection algorithms by applying them to an industrial scale OpenSPARC T2 design. Our results show that our PRoN algorithm consistently outperformed other techniques with respect to scalability and functional relevance of signals selected. It also has higher restorability than the other algorithms, despite not being optimized for that metric.

Hardware Trojan Detection Using Changepoint-Based Anomaly Detection Techniques

There has been a growing trend in recent years to outsource various aspects of the semiconductor design and manufacturing flow to different parties spread across the globe. Such outsourcing increases the risk of adversaries adding malicious logic, referred to as hardware Trojans, to the original design. The increased complexity of modern microprocessors increases the difficulty in detecting hardware Trojans at early stages of design and manufacturing. Therefore, there is a need for run-time detection techniques to capture Trojans that escape detection at these stages. In this paper, we introduce a machine learning-based run-time hardware Trojan detection method for microprocessor cores. This approach uses changepoint-based anomaly detection algorithm to detect the activation of Trojans that introduce abnormal patterns in the data streams obtained from performance counters. It does not modify the original microprocessor design to integrate on-chip monitoring sensors. We evaluate our method by detecting the activation of Trojans that cause denial-of-service, the degradation of system performance, and change in functionality of a microprocessor core. Results obtained using the OpenSPARC T1 core and an field-programmable gate array (FPGA) prototyping framework show that the Trojan activation is detected with a true positive rate of above 99% and a false positive rate of 0% for most of the implemented Trojans.

Toward a Formal and Quantitative Evaluation Framework for Circuit Obfuscation Methods

Since the first circuit obfuscation technique was proposed to thwart reverse engineering (RE) attacks to integrated circuits (ICs), there have been active research in de-obfuscation attacks and new obfuscation countermeasures. Although it is crucial for an obfuscation method to be secure against known de-obfuscation attacks, it is equally important to keep the cost of circuit obfuscation low. Most importantly, obfuscation methods need to be formally analyzed for their effectiveness and efficiency. In this paper, we propose a set of quantitatively evaluable metrics for this purpose, particularly facilitated by a recently proposed circuit partition attack (CPA) and the powerful SAT-based attack (SATA). Moreover, we find that CPA can be applied prior to any de-obfuscation attacks to reduce RE efforts exponentially. We then propose a new equivalent class guided obfuscation scheme (ECG-Obfus) to defeat CPA which leverages specially designed camouflaged cells to replace judiciously selected logic gates. Specifically, we select candidate gates for obfuscation from one certain equivalent class, in which the underlying equivalent relation is defined based on IC topological structure information. We evaluate ECG-Obfus using the proposed metrics and conduct experiments on ISCAS 85/89 standard benchmark suites and OpenSparc T1 microprocessor. The results show that ECG-Obfus gains good resilience against known de-obfuscation attacks (including CPA and SATA), with low design complexity and performance overhead.

Revealing Cluster Hierarchy in Gate-level ICs Using Block Diagrams and Cluster Estimates of Circuit Embeddings

Contemporary integrated circuits (ICs) are increasingly being constructed using intellectual property blocks (IPs) obtained from third parties in a globalized supply chain. The increased vulnerability to adversarial changes during this untrusted supply chain raises concerns about the integrity of the end product. The difference in the levels of abstraction between the initial specification and the final available circuit design poses a challenge for analyzing the final circuit for malicious insertions. Reverse engineering presents one way to help reduce the difficulty of circuit analysis and inspection. In this work, we provide a framework that given (i) a gate-level netlist of a design and (ii) a block diagram for the design with relative sizes of the blocks, outputs a matching between the partitions of the circuit and blocks in the block diagram. We first compute a geometric embedding for each node in the circuit and then apply a clustering algorithm on the embedding features to obtain circuit partitions. Each partition is then mapped to the high-level blocks in the block diagram. These partitions can then be further analyzed for malicious insertions with much reduced complexity in comparison with the full chip. We tested our algorithm on different designs with varying sizes to evaluate the efficacy of algorithm, including the open-source processor OpenSparc T1, and showed that we can successfully match over 90% of gates to their corresponding blocks.

Layout Resynthesis by Applying Design-for-manufacturability Guidelines to Avoid Low-coverage Areas of a Cell-based Design

Design-for-manufacturability (DFM) guidelines are recommended layout design practices intended to capture layout features that are difficult to manufacture correctly. Avoiding such features prevents the occurrence of potential systematic defects. Layout features that result in DFM guideline violations may not be avoided completely due to the design constraints of chip area, performance, and power consumption. A framework for translating DFM guideline violations into potential systematic defects, and faults, was described earlier. In a cell-based design, the translated faults may be internal or external to cells. In this article, we focus on undetectable faults that are external to cells. Using a resynthesis procedure that makes fine changes to the layout while maintaining the design constraints, we target areas of the design where large numbers of external faults related to DFM guideline violations are undetectable. By eliminating the corresponding DFM guideline violations, we ensure that the circuit does not suffer from low-coverage areas that may result in detectable systematic defects escaping detection, but failing the circuit in the field. The layout resynthesis procedure is applied to benchmark circuits and logic blocks of the OpenSPARC T1 microprocessor. Experimental results indicate that the improvement in the coverage of potential systematic defects is significant.

Toward Increasing the Difficulty of Reverse Engineering of RSFQ Circuits

Integrated circuit (IC) camouflaging is a defense to defeat image-based reverse engineering. The security of CMOS ICs has been extensively studied and camouflage techniques have been developed. A camouflaging method is introduced here to protect superconducting electronics, specifically, rapid single flux quantum (RSFQ) technology, from reverse engineering. RSFQ camouflaged units have been developed by applying the structural similarity of RSFQ standard cells. A defense using camouflaged RSFQ cells combined with obfuscating the temporal distribution of inputs to the IC increases the attacker's effort to decamouflage. The approach establishes the complexity class of RSFQ decamouflaging and a model checker is applied to evaluate the strength of the defenses. These techniques have been evaluated on ISCAS’85 combinational benchmarks and the controllers of the OpenSPARC T1 microprocessor. A dummy Josephson junction fabrication process adds two additional mask steps that increase the cost overhead. Camouflaging 100% of the benchmark circuits results in an area and power overhead of almost 40%. In the case of the OpenSPARC processor, the approach requires near-zero area, power, and performance overhead even when 100% of the sensitive parts of the processor are camouflaged.

Custard: ASIC Workload-Aware Reliable Design for Multicore IoT Processors

In the typical application-specified integrated circuit (ASIC) design flow, reliability-driven performance loss is computed, in part, with switching activity files. However, for ASIC designs of multicore processors, the typical switching activity files lack multithreaded software workload information. An accurate switching activity for a multicore design can be generated using a logic simulator. However, the logic simulator process suffers from long runtimes when dealing with real workloads. This paper analyzes the effects of scaling multithreaded workloads and proposes Custard, a hardware methodology for lifetime improvement of multicore processors by obtaining multithreaded switching activity signatures in a short period of time using a performance simulator (gem5), logic simulator (VCS), and thermal simulator (HotSpot). Custard is particularly important for multicore, Internet of Things processors as the runtime feedback-based reliability mechanisms used on current multicore processors incur area and power overhead that could be prohibitive for smaller form factors and power budgets. Experiments are performed with Custard using real workloads on an OpenSPARC T1 design with two, four, and eight cores that are fully synthesized and routed. The default-sized T1 core is improved to have a reliability increase of $4.1\times $ , with 0.08% and 1.57% increase on average in cell area and switching power, respectively.

On-Chip Self-Test Methodology With All Deterministic Compressed Test Patterns Recorded in Scan Chains

This paper presents a novel test architecture that combines the advantages of high-quality deterministic scan-based test and low-cost built-in self-test. The main idea is to record (store) all required compressed test data in a novel scan chain structure, and extract and decompress them during testing. This requires a very high compression ratio to obtain a low test data volume, that is, smaller than the number of scan cells in the circuit under test. To achieve such a high compression ratio, we propose a novel compression method that combines broadcast scan as well as a tailored single-input compression architecture. We also utilize the concept of scan chain partitioning and clock gating to reduce the test time and test power. An on-chip test controller is employed to automatically generate all required control signals for the whole test procedure. This significantly reduces the requirements on external automatic test equipment. Experimental results show that our method is well suitable for multicore designs. For example, experiments on the 8-core open-source OpenSPARC T2 processor with 5.7M gates show that all required test data for 100% testable stuck-at fault coverage can be stored in just 59.4% of the scan cells of the processor. Experimental results for transition faults are also presented, which show that more identical cores are needed in order to store all test data for transition faults. We also discuss how to extend this paper to address fault diagnosis and engineering change order problems.

On-Chip Diagnosis of Generalized Delay Failures Using Compact Fault Dictionaries

One approach for achieving a robust integrated system centers on first performing test during runtime, then identifying the locations of any faults (or potential faults), and finally repairing/replacing/avoiding the affected portion(s) of the system. Conventional fault dictionary approaches can be used to locate failures but are limited to simplistic fail behaviors due to the significant computational resources required for dictionary generation and memory storage. Several contributions are described to overcome these limitations, and include: 1) enhancement of an unspecified-transition fault model (called here the transition-X fault model, or TRAX) for capturing the misbehaviors expected from scaled technologies; 2) development of a hierarchical dictionary that only localizes to the level required; and 3) the design of a scalable architecture for retrieving and using the hierarchical dictionary for on-chip failure diagnosis. The OpenSPARC T2 processor and other circuits are used in experiments to demonstrate the low-overhead, accurate diagnosis of early life and wear-out failures, using TRAX dictionaries that are over five orders of magnitude smaller than full-response dictionaries.

IC Protection Against JTAG-Based Attacks

Security is now becoming a well-established challenge for integrated circuits (ICs). Various types of IC attacks have been reported, including reverse engineering IPs, dumping on-chip data, and controlling/modifying IC operation. IEEE 1149.1, commonly known as Joint Test Action Group (JTAG), is a standard for providing test access to an IC. JTAG is primarily used for IC manufacturing test, but also for in-field debugging and failure analysis since it gives access to internal subsystems of the IC. Because the JTAG needs to be left intact and operational after fabrication, it inevitably provides a “backdoor” that can be exploited outside its intended use. This paper proposes machine learning-based approaches to detect illegitimate use of the JTAG. Specifically, JTAG operation is characterized using various features that are then classified as either legitimate or attack. Experiments using the OpenSPARC T2 platform demonstrate that the proposed approaches can classify legitimate JTAG operation and known attacks with significantly high accuracy. Experiments also demonstrate that unknown and disguised attacks can be detected with high accuracy as well (99% and 94%, respectively).

Parallelizing SAT-based de-camouflaging attacks by circuit partitioning and conflict avoiding

As one of the most effective proactive countermeasures against reverse engineering, circuit camouflaging has emerged to be a hot research topic and it is becoming a mature technology with the development of various de-camouflaging attacks. Among them, the SAT-based method is the most powerful one to defeat circuit camouflaging. However, SAT-based attacks have scalability problem due to the complexity of the underlying SAT solvers, and straightforward approach to parallelize SAT-based attacks will fail. In this article, we propose a novel parallelization framework for SAT-based attacks, which consists of a two-level partition method (independent module partitioning and k-medoids clustering), together with a novel conflict avoidance strategy. Specifically, we first break down the camouflaged netlist into multiple independent modules that can be solved in parallel. However, any good circuit camouflaging approach should produce one or multiple large modules. To solve this problem, we further apply the k-medoids algorithm to partition the large modules into multiple “high cohesion” and “low coupling” clusters. Utilizing the relative independence of these clusters, we propose a two-stage attack method to avoid conflicts among clusters. Experimental results on OpenSparc T1 microprocessor controller demonstrate that our approach can on average reduce the scales of the SAT formulas by more than 50%, reduce the attack iteration number by 45%, and achieves on average 3.6× and maximum 10× speed up over the best-known SAT-based de-camouflaging tool.

Hybrid Monolithic 3-D IC Floorplanner

With continued technology scaling, interconnects have become the bottleneck in further performance and power consumption improvements in modern microprocessors. 3-D integrated circuits (3-D ICs) provide a promising approach for alleviating this bottleneck and enabling higher performance while reducing the footprint area, wirelength, and overall power consumption. Among various 3-D IC solutions, monolithic 3-D ICs stand out as they can utilize the third dimension most efficiently owing to high-density monolithic intertier vias. Monolithic integration is possible at different levels of granularity: block level, gate level, and transistor level. A hybrid monolithic design has modules implemented in different monolithic styles to further optimize the design objectives such as area, wirelength, and power consumption. However, a lack of electronic design automation tools makes the hybrid monolithic 3-D IC design quite challenging. In this paper, we introduce the first hybrid monolithic 3-D IC floorplanner. We characterize the OpenSPARC T2 processor core using different monolithic implementations and compare their footprint area, wirelength, power consumption, and temperature. We show, via simulations, that under the same timing constraint, a hybrid monolithic design offers 48.1% reduction in the footprint area and 14.6% reduction in power consumption compared to those of the 2-D design at the cost of higher power density and slightly higher temperature.

Reverse Engineering Digital ICs through Geometric Embedding of Circuit Graphs

Outsourcing of design and manufacturing processes makes integrated circuits (ICs) vulnerable to adversarial changes and raises concerns about their integrity. Reverse engineering the manufactured netlist helps identify malicious insertions. In this article, we present an automated approach that, given a reference design description with high-level blocks, infers these blocks in an untrusted gate-level (test) implementation. Using the graph connectivity of the netlists, we compute a geometric embedding for each wire in the circuits, which, then, is used to compute a bipartite matching between the nodes of the two designs and identify high-level blocks in the test circuit. Experiments to evaluate the efficacy of the proposed technique on various-sized designs, including the multi-core processor OpenSparc T1, show that it can correctly match over 90% of gates in the test circuit to their corresponding block in the reference model.

Shrunk-2-D: A Physical Design Methodology to Build Commercial-Quality Monolithic 3-D ICs

Monolithic 3-D (M3D) integrated circuits (ICs) are an emerging technology that offer much higher integration densities than previous 3-D IC approaches. In this paper, we present a complete netlist-to-layout design flow to design an M3D block, as well as to integrate 2-D and 3-D blocks into an M3D SoC. This design flow is based on commercial tools built for 2-D ICs, and enhanced with our 3-D specific methodologies. We use the OpenSPARC T2 SoC as a case study, implement it in a 28-nm fully depleted silicon on insulator foundry process, and demonstrate that we can achieve up to 12% and 8% power savings for a single block and SoC, respectively, when compared with their 2-D counterparts implemented using commercial tools.

System-Level Effects of Soft Errors in Uncore Components

The effects of soft errors in processor cores have been widely studied. However, little has been published about soft errors in uncore components, such as the memory subsystem and I/O controllers, of a system-on-a-chip (SoC). In this paper, we study how soft errors in uncore components affect system-level behaviors. We have created a new mixed-mode simulation platform that combines simulators at two different levels of abstraction, and achieves $20~000{\times }$ speedup over register-transfer-level-only simulation. Using this platform, we present the first study of the system-level impact of soft errors inside various uncore components of a large-scale, multicore SoC using the industrial-grade, open-source OpenSPARC T2 SoC design. Our results show that soft errors in uncore components can significantly impact system-level reliability. We also demonstrate that uncore soft errors can create major challenges for traditional system-level checkpoint recovery techniques. To overcome such recovery challenges, we present a new replay recovery technique for uncore components belonging to the memory subsystem. For the L2 cache controller and the dynamic random-access memory controller components of OpenSPARC T2, our new technique reduces the probability that an application run fails to produce correct results due to soft errors by more than $50 {\times }$ with 1.82% and 2.58% chip-level area and power impact, respectively.

Design Methodologies for Low-Power 3-D ICs With Advanced Tier Partitioning

Low power is considered as the driving force for 3-D ICs, yet there have been few thorough design studies on how to reduce power in 3-D ICs. In this paper, we discuss computer-aided design techniques and design methodologies to reduce power consumption in 3-D IC designs using a commercial grade CPU core (OpenSPARC T2 core). To demonstrate power benefits in 3-D ICs, four design techniques are explored: 1) 3-D floorplanning; 2) metal layer usage control for intrablock-level routing; 3) dual-Vth design; and 4) functional unit block (FUB) folding. The benefits and challenges of multiple FUB folding are also discussed. Finally, the through-silicon via technology scaling impact on FUB folding and 3-D power benefit is examined. With the aforementioned methods combined, our 2-tier 3-D designs provide up to 52.3% reduced footprint, 27.9% shorter wirelength, 35.4% decreased buffer cell count, and 27.8% power reduction over the 2-D counterpart under the same performance.

Automatic Model Generation for Gate-Level Circuit PDES with Reverse Computation

Gate-level circuit simulation is an important step in the design and validation of complex circuits. This step of the process relies on existing libraries for gate specifications. We start with a generic gate model for Rensselaer’s Optimistic Simulation System, a parallel discrete-event simulation framework. This generic model encompasses all functionality needed by optimistic simulation using reverse computation. We then describe a parser system that uses a standardized gate library to create a specific model for simulation. The generated model is composed of several functions, including those needed for an accurate model of timing behavior. To quantify the improvements that an automatically generated model can have over a hand written model, we compare two gate library models: an automatically generated lsi -10 k library model and a previously investigated, handwritten, simplified gtech library model. We conclude that the automatically generated model is a more accurate model of actual hardware. In comparison to previous results, we find that the automatically generated model is able to achieve better optimistic simulation performance when measured against conservative simulation. To test the automatically generated model, we evaluate the performance of a simulation of a full-scale OpenSPARC T2 processor model. This model consists of nearly 6 million LPs. We achieve a peak performance of 1.63 million events per second during a conservative simulation. To understand the relatively weaker performance of optimistic simulation, we investigate hot spots of event activity and visually identify a workload imbalance.