Post-Silicon Bug Diagnosis with Inconsistent Executions

Size: px

Start display at page:

Download "Post-Silicon Bug Diagnosis with Inconsistent Executions"

Dina Melton
6 years ago
Views:

1 Post-Silicon Bug Diagnosis with Inconsistent Executions Andrew DeOrio Daya Shanker Khudia Valeria Bertacco University of Michigan ICCAD 11 9 November 2011

flawed processors $475 M Kris Kaspersky: Remote Code Execution Through Intel CPU Bugs

2 Functional bugs 17 Jan 1995 Electrical failures Transistor faults Impact of errors FDIV bug: Intel announces a pre-tax charge of $475M dollars against earnings for replacement of flawed processors $475 M Kris Kaspersky: Remote Code Execution Through Intel CPU Bugs 1024-bit RSA secret key extracted in 100 hours $1 B Sandy Bridge Bug 2X Costly as Pentium FDIV Bug 2

3 Post-silicon validation Pre-Silicon Post-Silicon Product Debug prototypes before shipment + Fast prototypes + High coverage + Test full system + Find deep bugs - Poor observability - Slow off-chip transfer - Noisy - Intermittent bugs 3

4 Post-silicon bugs Intermittent post-silicon bugs are challenging A same test does not expose the bug in every run Each run exhibits different behaviors Our goal: locate intermittent bugs pushl %epb movl %epb same postsilicon test post-si platform many different results difficult to debug! 4

5 Post-silicon debugging Scan chains, logic analyzers [Whetsel 1991, Abramovici 2006, Dahlgren 2003] Limited observability Large manual effort Processor-core specific debugging [Park 2009] Limited areas of chip Limited time to catch bug Deterministic replay [Gao 2009, Li 2010, Yang 2008] HW/performance overhead Perturbation may prevent bug manifestation 5

6 BPS: Bug Positioning System Localize failures Time (cycle) and space (signals) Tolerate non-repeatable executions Statistical approach Scalable, adaptable to many HW subsystems post-si test HW logging post-si platform hw sensors SW post-analysis signatures pass fail band model bug location bug occurrence time 6

7 HW logging SW post-analysis Signatures Goal: summarize signal value Encodings (hamming, CRC, etc.) Large hardware Small change in input -> large change in output Counting schemes toggles) signal A window window 7

8 Distribution HW logging SW post-analysis traditional debugging passing testcase Statistical approach statistical debugging passing testcases failing testcases 0.6 match? failing testcase distribution of signature values: same test can yield different results Signature value time@ window size 8

9 Distribution Distribution HW logging SW post-analysis Signatures for statistical approach Characterize populations of signatures Statistical separation between noise and bug passing testcases failing testcases Example: CRC Example: passing testcases failing testcases Signature value Signature value 9

10 HW logging SW post-analysis Signature hardware Measure Use custom hardware or reuse existing debug infrastructure 1 EN register Memory Buffer 11KB for 100 signals x 100 windows Off-chip 1 register through debug port EN chip under test 10

11 BPS: Bug Positioning System 1. Hardware logging 2. Software post-analysis post-si test HW logging post-si platform hw sensors SW post-analysis signatures pass fail band model bug location bug occurrence time 11

12 Signature value HW logging SW post-analysis Bug band model Failing band Passing band bug band 0.2 µ ± 2σ bug occurrence behavior of 1 signal from the MEM stage of a 5-stage pipeline processor bug detected Window 12

HW logging SW post-analysis SW post-analysis Passing group signals signalc signalb signala 1 2 3 4

13 HW logging SW post-analysis SW post-analysis Passing group signals signalc signalb signala windows signatures windows bug band signals signala signalb windows signalc signatures Failing group 13

1000 buggy runs 100 passing runs Experimental

SW detected signals detection latency 10 bugs:

14 1000 buggy runs 100 passing runs Experimental setup 10 random seeds: variable memory delay, crossbar random traffic 10 testcases BPS HW monitored 41,744 top level control signals BPS SW detected signals detection latency 10 bugs: e.g., functional bug in PCX, electrical error in Xbar 14

15 Testcases PCX gnt SA Xbar elect BR fxn MMU fxn PCX atm SA PCX fxn Xbar combo MCU combo MMU combo EXU elect bug signal not observable Signal Localization Bugs blimp_rand f.n. + f.n. fp_addsub n.b. f.p. + f.p. n.b. + f.p. fp_muldiv n.b. f.p. + f.p. f.p. + f.p. isa2_basic n.b. f.n. n.b n.b. f.n. isa3_asr_pr n.b. f.n isa3_window n.b. n.b. + f.n. f.n. n.b. ldst_sync n.b n.b. mpgen_smc n.b n2_lsu_asi n.b. f.n. f.n n.b. tlu_rand n.b n.b. no bug found + exact signal f.p. false pos. f.n. false neg. 15

16 Testcases PCX gnt SA Xbar elect BR fxn MMU fxn PCX atm SA PCX fxn Xbar combo MCU combo MMU combo EXU elect 3 noisy signals excited by floating point benchmarks Signal Localization Bugs blimp_rand f.n. + f.n. fp_addsub n.b. f.p. + f.p. n.b. + f.p. fp_muldiv n.b. f.p. + f.p. f.p. + f.p. isa2_basic n.b. f.n. n.b n.b. f.n. isa3_asr_pr n.b. f.n isa3_window n.b. n.b. + f.n. f.n. n.b. ldst_sync n.b n.b. mpgen_smc n.b n2_lsu_asi n.b. f.n. f.n n.b. tlu_rand n.b n.b. no bug found + exact signal f.p. false pos. f.n. false neg. 16

17 Testcases PCX gnt SA Xbar elect BR fxn MMU fxn PCX atm SA PCX fxn Xbar combo MCU combo MMU combo EXU elect wider effects, easier to catch Signal Localization Bugs blimp_rand f.n. + f.n. fp_addsub n.b. f.p. + f.p. n.b. + f.p. fp_muldiv n.b. f.p. + f.p. f.p. + f.p. isa2_basic n.b. f.n. n.b n.b. f.n. isa3_asr_pr n.b. f.n isa3_window n.b. n.b. + f.n. f.n. n.b. ldst_sync n.b n.b. mpgen_smc n.b n2_lsu_asi n.b. f.n. f.n n.b. tlu_rand n.b n.b. no bug found + exact signal f.p. false pos. f.n. false neg. 17

18 PCX gnt SA XBar elect BR fxn MMU fxn PCX atm SA PCX fxn XBar combo MCU combo MMU combo EXU elect AVERAGE Δ time bug injection to detection (cycles) Time to detect bug 6,000 5,000 4,000 3,000 2,000 1,000 1,273 cycles 0 18

19 PCX gnt SA XBar elect BR fxn MMU fxn PCX atm SA PCX fxn XBar combo MCU combo MMU combo EXU elect AVERAGE Number of signals detected Number of signals detected signals (0.2%) 0 19

20 Sum total Threshold selection false negatives false positives sum threshold trade-off bug band Bug detection threshold (bug band) 20

21 Area overhead Option 1: reuse existing debug structures Option 2: add counters and memory buffer Record a few signals at a time 11KB for 100 signals x 100 precision 1.35mm 2 with 65nm library 0.4% of OpenSPARC 1 EN register Memory Buffer Off-chip 1 EN register through debug port chip under test 21

22 Conclusions BPS automatically localizes bug time and location Leverages a statistical approach to tolerate noise Effective for a variety of bugs: functional, electrical and manufacturing 1,273 cycles, 75 signals on average 22

SiS9255. Projected Capacitive. Touch-Screen Micro Processor. Data sheet. Rev. 1.2 August 18, 2015

SiS9255. Projected Capacitive. Touch-Screen Micro Processor. Data sheet. Rev. 1.2 August 18, 2015 SiS9255 Projected Capacitive Touch-Screen Micro Processor Data sheet Rev. 1.2 August 18, 2015 This specification is subject to change without notice. Silicon Integrated Systems Corporation assumes no responsibility