Low cost control flow protection using abstract control signatures

Abstract

The continual trend of shrinking feature sizes and reducing voltage levels makes transistors faster and more efficient. However, it also makes them more susceptible to transient hardware faults. Transient faults due to high energy particle strikes or circuit crosstalk can corrupt the output of a program or cause it to crash. Previous studies have reported that as much as 70% of the transient faults disturb program control flow, making it critical to protect control flow. Traditional approaches employ signatures to check that every control flow transfer in a program is valid. While having high fault coverage, large performance overheads are introduced by such detailed checking. We propose a coarse-grain control flow checking method to detect transient faults in a cost effective way. Our software-only approach is centered on the principle of abstraction: control flow that exhibits simple run-time properties (e.g., proper path length) is almost always completely correct. Our solution targets off-theshelf commodity embedded systems to provide a low cost protection against transient faults. The proposed technique achieves its efficiency by simplifying signature calculations in each basic block and by performing checking at a coarse-grain level. The coarsegrain signature comparison points are obtained by the use of a region based analysis. In addition, we propose a technique to protect control flow transfers via call and return instructions to ensure all control flow is covered by our technique. Overall, our proposed technique has an average of 11% performance overhead in comparison to 75% performance overhead of previously proposed signature based techniques while maintaining approximately the same degree of fault coverage.

Bit-Flip Aware Control-Flow Error Detection

“…However, the probability of CFE occurrence due to single bit-flip in the program counter is relatively low as it is a small circuitry compared to the rest of processor components. For these reasons, in the recent works the main cause of CFEs is considered to be erroneous branch instruction destinations [3]. In this work, also, we target CFEs caused by faulty bit-flips in branch instructions destinations.…”

“…Several software optimization methods for CFE detection exist: CCA [11], ECCA [12], CFCSS [1], YACCA [13], CEDA [14], ACFC [15], Abstract Control Signatures (ACS) [3] and SWIFT [16]. SWIFT is a hybrid method combining CFCSS for CFE and EDDI for data error detection.…”

Clover

“…Many commodity embedded processors have already integrated ECC protection to these components [1]. Second, execution of program is guaranteed to follow its static control flow paths; we assume a low-cost, low-latency solution such as [18]. Third, stores in the region has to be safely buffered as with branch misprediction until the region is verified.…”

“…Finally, the address generation unit is protected for stores to write in the correct locations. Those four components are widely assumed in the literature on software-based error recovery [8,9,28], and there have been many solutions to realize them [18,24,27,28]. All other microarchitectural units remain unchanged and can be protected by Clover.…”