FAME v2

FAME v2 overview

The core of FAME v2, including the secure trap mechanism and the fault recovery registers, are integrated into a LEON-3 core as a FAME extension. We applied the same strategy as used on FAME v1. FAMEv2 has an increased memory size compared to FAMEv1 (128Kbyte instead of 64Kbyte). FAMEv2 also includes a serial memory interface for external serial flash memory. This enables the chip to boot and operate in a stand-alone mode.

Through a bus bridge, a set of peripherals is integrated into the SoC. We used a systematic coprocessor integration strategy to partition the various chip-level functions into coprocessor modules which are added and tested separately. The peripheral bus connects the following peripherals.

• A sensor coprocessor (cp1) including 32 timing sensors and 160 EM sensors. The timing sensors are based on an internal, programmable delay line, while the EM sensors are based on a dual flip-flop configuration. The sensor coprocessor provides a logical view on the sensor configuration and supports a uniform software interface. In the chip back-end flow, we used a custom sensor-placement methodology to ensure the regular distribution of sensors over the chip surface.
• AES coprocessor (cp2) with encryption/decryption functionality and support for ECB and CBC modes of operation. This coprocessor is an unprotected, 1 round-per-cycle design that serves as a reference hardware module for experiments with side-channel analysis and fault injection.
• A protected AES coprocessor (cp4), derived from the other AES design, with in-situ sensor support. The internal registers used for encryption, decryption, and for the AES key-schedule are implemented using EM fault sensors, resulting in 768 in-situ EM sensors. In contrast to the generic sensors in the sensor coprocessor, the in-site sensors do not require special placement, since they are intrinsically part of the protected design.
• A Timer peripheral with five timer modules, which can be used for integration of measurement equipment control with application software running on LEON-3. For example, the timers can be used for precise fault injection.
• A 4-bit GPIO, which can be used for integration of measurement equipment control with application software running on LEON-3.
• A user UART for terminal I/O and an interrupt controller.

FAME v2 differences with FAME v1

Like FAMEv1, FAMEv2 is a fault-attack aware microprocessor able to detect faults, recover from them, and pass control to a secure trap handler.

• FAMEv2 deals with tamper from EM glitching, voltage glitching and clock glitching.
• FAMEv2 contains 33 timing sensors and 160 EM sensors distributed over the layout area, and 768 in-situ sensors integrated in the architectural state.
• FAMEv2 also contains several hardware coprocessors, with and without in-situ fault detection.

FAME v2 Chip Layout

FAME v2 PCB

FAME v2 PCB Power Traces vs FAME v1 PCB Power Traces