Automated fault injection testing
An automated fault injection testing and analysis approach drives fault injection into a processor driven instruction sequence to quantify and define susceptibility to external fault injections for manipulating instruction execution and control flow of a set of computer instructions. A fault injection such as a voltage or electromagnetic pulse directed at predetermined locations on a processor (Central Processing Unit, or CPU) alters a result of a processor instruction to change values or execution paths. One or more quantified injections define an injection chain that causes a predictable or repeatable deviant result from an expected execution path through the code executed by the processor. Based on accumulation of fault injections and results, a repeatable injection chain and probability identifies an external action taken on a processing device to cause unexpected results that differ from an expected execution of a program or set of computer instructions.
1. A method for forcing a control flow of an instruction sequence, comprising:
identifying a memory location in an instruction sequence under analysis;
estimating a duration for execution to proceed to the identified memory location;
performing a sample injection directed to modifying a value of the memory location at an execution time based on the estimated duration, the memory location including a candidate instruction, and the result of the candidate instruction determines an execution path taken as a result of the sample injection; and
evaluating a result of the sample injection, the sample injection defined by a location on a planar area of a processor executing the candidate instruction, the injection including a power, delay and repetition of an electromagnetic pulse directed at the location.
2. The method of claim 1 further comprising
identifying a plurality of candidate paths through the instruction sequence, the plurality of candidate paths based on branches taken at identified branch instructions in the instruction sequence;
gathering a plurality of points of interest (POIs) based on the identified candidate paths, each point of interest defining an instruction selected based on a likelihood of responding to a sample injection; and
selecting the candidate instruction from plurality of POIs.
3. The method of claim 1 further comprising estimating the duration by:
identifying the instructions included in the execution path; and
accumulating a time required for aggregate processing of each of the instructions on the execution path prior to the candidate instruction.
4. The method of claim 1 wherein the injection includes at least one of a power surge, electromagnetic interference, magnetic interference, and a magnitude, duration and location on a processor on which the candidate instruction is performed.
5. The method of claim 1 further comprising, for each sample injection,
computing a memory location on the processor storing the candidate instruction;
storing the memory location; and
storing a next execution address which is executed based on the injection inducing a result in execution and a next execution address which is executed based on the injection having no effect on the execution of the candidate instruction.
6. The method of claim 1 further comprising:
evaluating the result of the sample injection by storing a next execution address which is executed based on the sample injection inducing a result in execution and a next execution address which is executed based on the injection having no effect on the execution of the candidate instruction.
7. The method of claim 1 further comprising:
evaluating the result of the sample injection based on whether execution of the candidate instruction proceeds to a successive instruction, the successive instruction indicative of either success or failure of the sample injection.
8. A method for forcing a control flow of an instruction sequence, comprising:
identifying a memory location in an instruction sequence under analysis;
estimating a duration for execution to proceed to the identified memory location by identifying the instructions included in the execution path and accumulating a time required for aggregate processing of each of the instructions on the execution path prior to the memory location;
performing a sample injection directed to modifying a value of the memory location at an execution time based on the estimated duration, the memory location including a candidate instruction, and a result of the candidate instruction determines an execution path taken as a result of the sample injection;
evaluating the result of the sample injection;
iteratively repeating the sample injection for dynamically analyzing an injection likely to modify the candidate instruction;
gathering, based on a probability of a sample injection resulting in taking a branch leading to a result injection path caused by the modified result of the candidate instruction; and
accumulating the sample injections leading to the modified result during the iterative repetitions.
9. A method for forcing a control flow of an instruction sequence, comprising:
identifying a memory location in an instruction sequence under analysis;
estimating a duration for execution to proceed to the identified memory location
performing a sample injection directed to modifying a value of the memory location at an execution time based on the estimated duration, the memory location including a candidate instruction, and the result of the candidate instruction determines an execution path taken as a result of the sample injection, performing the injection further comprising:
identifying an instruction in the instruction sequence that precedes the candidate instruction;
generating an injection instruction sequence for generating the sample injection;
identifying a non-executed memory region in a program memory space allocated to the instruction sequence, the non-executed memory region having sufficient space for storing the injection instruction sequence;
storing the injection instruction sequence in the identified non-executed memory region; and
directing a breakpoint at the identified preceding instruction for executing the injected instruction sequence upon program execution attaining the identified preceding instruction; and
evaluating a result of the sample injection.
10. The method of claim 9 wherein the preceding instruction is an instruction immediately before the address of the candidate instruction, further comprising
directing program control to the injection instruction sequence by setting debugger triggers at the immediately preceding instruction;
setting breakpoints at successive memory locations on paths corresponding to both a successful injection flow modification and a failed injection flow modification; and
storing the success or failure of the sample injection based on the set breakpoints.
11. A computer program embodying program code on a non-transitory storage media that, when executed by a processor, performs steps for implementing a method of forcing a control flow of an instruction sequence, the method comprising: identifying a candidate instruction in an instruction sequence under analysis; estimating a duration for execution to proceed to the candidate instruction; performing a sample injection directed to modifying a result of the candidate instruction at an execution time based on the estimated duration, the memory location including a candidate instruction, and the result of the candidate instruction determines an execution path taken as a result of the sample injection; and evaluating a path result based on an execution path taken as a result of the sample injection, the sample injection defined by a location on a planar area of a processor executing the candidate instruction, the injection including a power, delay and repetition of an electromagnetic pulse directed at the location.