# Fault Injection Attack Implementation

## Detector 使用流程

### 1. Create Project
勾選"Do note specify sources at this time"
點選上方的board，搜尋zedboard

### 2. Add Design Sources
進入Wenwei->3.Implementation->Detector->src->"clocking_generator.v" "controlClk.v" "detector.v" "test_clock_detector.v"
Note:若路徑太長可能會有問題，建議額外把src內的檔案存出來

記得勾選"Copy sources into project"

### 3.Add Design Constriants
進入Wenwei->3.Implementation->Detector->constraint->"IOPlan.xdc"

### 4. Generate Bitstream
Note:記得開到16核心，這樣跑比較快

### 5. Open Hardware Manager
要把zedboard的電源打開

Open Target -> Auto Connect

Program Device

### 6. Experiment Setting
點選左邊的Settings (hw_ila_1)，將Capture Mode改成BASIC

設定Trigger Setup
設定rst_IBUF，並將value設成"R"(0 to 1 transition)

設定Capture Mode
設定rst_IBUF，並將operation設成"!="、value設成"R"(0 to 1 transition)

因無法直接看clock，因此我們在這邊有設定counter
設定cnt[3:0]，並將operation設成"<="或"!="、value設成"F"(4'b1111)

### 7. Run Experiment
按Run

長按板子上的中間的button

我們是設定在reset後才看得到Glitch發生
Setup發生的位置

Glitch發生的狀況

## Instruction Skipping 使用流程

### 1. Create Project
勾選"Do note specify sources at this time"
點選上方的board，搜尋zedboard

### 2. Add Design Sources
進入Wenwei->3.Implementation->SkipInstruction->src
-> "Add.v" "ALU.v" "clocking_generator.v" "Compare.v" "Control.v" "controlClk.v" "CPZero.v" "Divide.v" "EXMEM_Stage.v" "Hazard_Detection.v" "IDEX_Stage.v" "IFID_Stage.v" "IM.v" "Interface.v" "MemControl.v" "MEMWB_Stage.v" "MIPS_Parameters.v" "Mux2.v" "Mux4.v" "Processor.v" "Register.v" "RegisterFile.v" "TrapDetect.v"
Note:若路徑太長可能會有問題，建議額外把src內的檔案存出來

### 3. Add Design Constriants
進入Wenwei->3.Implementation->SkipInstruction->constraint->"IOPlan.xdc"

### 4. Generate Bitstream
Note:記得開到16核心，這樣跑比較快

### 5. Ila Error (If there's no error, then skip)
打開左側Synthesis->Open Synthesized Design->Set Up Debug
選Disconnect all nets and remove debug cores

點開"IOPlan.xdc"，刪除關於ila的相關constriants

Run Synthesis

打開左側Synthesis->Open Synthesized Design->Set Up Debug
點選Open Design

打開左側Netlist，點開Nets，選要關注的Signals，拉進來Nets to Debug
我們在這邊選擇要觀察的Signals有：
- cnt
- rst_IBUF
- InstMem_Addr
- InstMem_In
- glitch_OBUF

打開Capture control

### 6. Open Hardware Manager
要把zedboard的電源打開
點選Open Hardware Manager

Open Target -> Auto Connect

Program Device

### 7. Experiment Setting
點選左邊的Settings (hw_ila_1)，將Capture Mode改成BASIC

設定Trigger Setup
設定rst_IBUF，並將value設成"R"(0 to 1 transition)
設定InstMem_In，並將value設成"8'h00000000"

設定Capture Mode
設定rst_IBUF，並將operation設成"!="、value設成"R"(0 to 1 transition)
設定cnt[3:0]，並將operation設成"<="或"!="、value設成"F"(4'b1111)

### 8. Run Experiment
按Run

長按板子上的中間的button

我們是設定在reset後才看得到Glitch發生
Setup發生的位置

Glitch發生的狀況

原本應該有的Instruction(已寫好在memory的instructions)

可以對比上面兩張圖發現，在Glitch發生的時候，第10個指令32'h01094820被跳過，證明有完成instruction skipping。

## Recovery 使用流程 (only Simulation)

### 1. Create Project
勾選"Do note specify sources at this time"
點選上方的board，搜尋zedboard

### 2. Add Design Sources
進入Wenwei->3.Implementation->RecoverySimulation->src
-> "Add.v" "ALU.v" "clocking_generator.v" "Compare.v" "Control.v" "controlClk.v" "CPZero.v" "detector.v" "Divide.v" "DM.v" "DM_buffer.v" "EXMEM_Stage.v" "Hazard_Detection.v" "IDEX_Stage.v" "IFID_Stage.v" "IM.v" "Interface.v" "MemControl.v" "MEMWB_Stage.v" "MIPS_Parameters.v" "Mux2.v" "Mux4.v" "Processor.v" "Register.v" "RegisterFile.v" "TrapDetect.v"
Note:若路徑太長可能會有問題，建議額外把src內的檔案存出來

### 3. Add Create Simulation Sources
進入Wenwei->3.Implementation->RecoverySimulation->sim->testbench.v

### 4. Run Simulation
按Run Simulation->Run Behavior Simulation

### 5. Run Experiment
打開左側"Scope"，選要關注的Signals
我們在這邊選擇要觀察的Signals有：
- glitch/glitch_test
- Glitch_Flush(ID/IF/EX/M)
- InstMem_In/InstMem_Address
- registers

如何找到這些Signals
glitch及glitch_test在testfixture/DUT底下
Glitch_Flush(ID/IF/EX/M)在testfixture/DUT/mips32底下
InstMem_In及InstMem_Address在testfixture/DUT/mips32底下
registers在testfixture/DUT/mips32/RegisterFile底下

將全部的訊號拉好之後，在Tcl Console輸入：

 run 5ns

上述訊號的波形便可以生成，如下圖示
由這邊可以發現0a指令因為受到glitch的關係，因此在五個回合做recovery，回復到0a指令，由0a指令重新繼續執行instructions，recovery後的值是相同的。