## 3 Preliminaries
### Fault Self-Repairing Based on Checkpoint-Rollback Scheme
#### 3.2.2 Buffer and Backup Registers for Checkpoint Rollback  
As BB integrity signature recalculation and reference information search require several clock cycles, the integrity verification of each BB will take time after the end of the P3 stage. This can cause a wrong situation that when the checkpoint-backup registers (storing the values of a previous successful checkpoint) need to be updated with the values of the current BB instruction set registers at the end of P3. Once the subsequent integrity check is invalid, checkpoint-rollback will revert back to the current BB's checkpoint with the updated values of registers.  
In order to avoid this wrong situation, we configured the two-stage registers of buffer-purpose and backup-purpose registers for the checkpoint-rollback operation. The schematic implementation of two-stage registers for the checkpoint rollback operation is shown in Figure 4. When the processor executing instructions and each BB's integrity signature check are successful, the CPU checkpoint-rollback operation are not activated, and the instruction set registers are updated according to the current instruction execution.  
At the end of the current BB, the values of instruction set registers are first buffered into buffer-purpose registers, and the values in backup-purpose registers maintain unchanged until the BB integrity signature is verified successfully. If the current BB integrity verification is invalid, the buffered values of the buffer-purpose registers will not be backed up into backup-purpose registers and will be overwritten at the next BB integrity checking pass. The CPU checkpoint-rollback operation is activated, the values of the previously-saved checkpoint in backup-purpose registers will be restored into the instruction set registers to resume the normal instruction execution of the current BB.  
Applying the above two-stage registers to the CPU's checkpoint-rollback operation is based on the contingency of instruction tampering attacks induced by hardware Trojans. Once an instruction is tampered with in program execution, it inevitably destroys the integrity signature of BB, and the checkpoint-rollback operation will revert the processor back to the initial instruction of the current BB with all saved checkpoint data for BB re-execution. In order to expatiate the proposed checkpoint-rollback operation based on two-stage registers, the specific example of an instruction stream tampering attack aiming at the benchmark of OpenECC is shown in Figure 5.  
Firstly, the \(BB_{i-1}\) is already verified with the integrity of the instructions at the end of the delay slot instruction. The values of the instruction set registers are backed up into the backup-purpose registers at the checkpoint. Secondly, the CPU begins to execute \(BB_{i}\), the values of instruction set registers will be buffered into the buffer-purpose registers at the end of \(BB_{i}\) for the waiting BB integrity verification and thus will not interfere with the execution of the following instructions of the next BB in writing the instruction set registers. Once the \(BB_{i}\) integrity is valid, the buffered values in buffer-purpose registers will be backed up into the backup-purpose registers as new checkpoint data.  
Figure 4: The schematic implementation of two-stage registers for checkpoint-rollback operation.  
On the other hand, if the \(BB_{i}\) integrity is invalid, we assumed the branch transfer instruction _l.bf 1f744_ was tampered with by an attack to a wrong target branch address of _l.bf 1f730_, the values of buffer-purpose registers will be overwritten in the next BB execution. Finally, the checkpoint rollback is activated, and the values of backup-purpose registers are restored into CPU instruction set registers, and the CPU re-fetches the \(BB_{i}\) instruction order from the instruction memory for \(BB_{i}\) re-execution.