arXiv subjects

Rainer Leupers

Publications and source records attributed to Rainer Leupers.

At least 19 recordsLinked to original sources

arXiv2026

Optimizing ML Workload Partitioning between CPUs and CIM Accelerators for Heterogeneous Computing

Computing-in-Memory (CIM) accelerators execute Matrix-Vector Multiplications (MVMs) in memory, making them a compelling solution for Machine Learning (ML) workloads. However, existing ML workload partitioning approaches for CIM accelerators do not fully account for Resistive Random Access Memory (RRAM) constraints such as limited memory, high write latency, and limited endurance. They also neglect parallelism, low-level architectural effects, or the Central Processing Unit (CPU) as a complementary compute resource. To address these limitations, we propose an Integer Linear Programming (ILP)-based workload partitioning framework for heterogeneous CPU-CIM systems. It minimizes end-to-end inference latency under RRAM constraints, captures parallelism, and combines empirical profiling with analytical models. Using our framework, heterogeneous CPU-CIM execution achieves speedups of up to 30.9x over CPU-only execution on an edge CPU and 7.3x over a high-performance CPU. A Design Space Exploration (DSE) yields further design insights for future CIM accelerators.

cs.ET↗

arXiv2026

Stateful Embedded Fuzzing with Peripheral-Accurate SystemC Virtual Prototypes

The increasing complexity of embedded software has made comprehensive manual testing impractical, motivating the use of automated techniques such as fuzzing. Coverage-guided fuzzers like AFL++ have shown strong results for conventional software but remain challenging to apply effectively in embedded contexts, where peripheral behaviors play critical roles. Existing approaches either use fast user-mode simulators, sacrificing peripheral realism, or rely on full-system simulators with manual instrumentation, limiting applicability to large-scale software. In this work, we present a novel framework that integrates AFL++ with a stateful SystemC-TLM virtual prototype to enable realistic fuzzing of embedded software. Fuzzer-generated inputs are injected directly into peripheral models, allowing peripherals to trigger natural side effects such as interrupts and FIFO updates. By integrating fuzzing with full-system simulation, our framework advances the effectiveness of pre-silicon testing for embedded systems. Results on embedded workloads show that our approach eliminates false positives while maintaining comparable code coverage and execution performance as state-of-the-art tools.

cs.SE↗

arXiv2026

Mixed-Precision Training and Compilation for RRAM-based Computing-in-Memory Accelerators

Computing-in-Memory (CIM) accelerators are a promising solution for accelerating Machine Learning (ML) workloads, as they perform Matrix-Vector Multiplications (MVMs) on crossbar arrays directly in memory. Although the bit widths of the crossbar inputs and cells are very limited, most CIM compilers do not support quantization below 8 bit. As a result, a single MVM requires many compute cycles, and weights cannot be efficiently stored in a single crossbar cell. To address this problem, we propose a mixed-precision training and compilation framework for CIM architectures. The biggest challenge is the massive search space, that makes it difficult to find good quantization parameters. This is why we introduce a reinforcement learning-based strategy to find suitable quantization configurations that balance latency and accuracy. In the best case, our approach achieves up to a 2.48x speedup over existing state-of-the-art solutions, with an accuracy loss of only 0.086 %.

cs.LG↗

arXiv2026

NQC2: A Non-Intrusive QEMU Code Coverage Plugin

Code coverage analysis has become a standard approach in software development, facilitating the assessment of test suite effectiveness, the identification of under-tested code segments, and the discovery of performance bottlenecks. When code coverage of software for embedded systems needs to be measured, conventional approaches quickly meet their limits. A commonly used approach involves instrumenting the source files with added code that collects and dumps coverage information during runtime. This inserted code usually relies on the existence of an operating and a file system to dump the collected data. These features are not available for bare-metal programs that are executed on embedded systems. To overcome this issue, we present NQC2, a plugin for QEMU.NQC2 extracts coverage information from QEMU during runtime and stores them into a file on the host machine. This approach is even compatible with modified QEMU versions and does not require target-software instrumentation. NQC2 outperforms a comparable approach from Xilinx by up to 8.5 x.

cs.SE↗

arXiv2025

Automatic Microarchitecture-Aware Custom Instruction Design for RISC-V Processors

An Application-Specific Instruction Set Processor(ASIP) is a specialized microprocessor that provides a trade-off between the programmability of a General Purpose Processor (GPP) and the performance and energy-efficiency of dedicated hardware accelerators. ASIPs are often derived from off-the-shelf GPPs extended by custom instructions tailored towards a specific software workload. One of the most important challenges of designing an ASIP is to find said custom instructions that help to increase performance without being too costly in terms of area and power consumption. To date, solving this challenge is relatively labor-intensive and typically performed manually. Addressing the lack of automation, we present Custom Instruction Designer for RISC-V Extensions (CIDRE), a front-to-back tool for ASIP design. CIDRE automatically analyzes hotspots in RISC-V applications and generates custom instruction suggestions with a corresponding nML description. The nML description can be used with other electronic design automation tools to accurately assess the cost and benefits of the found suggestions. In a RISC-V benchmark study, we were able to accelerate embedded benchmarks from Embench and MiBench by up to 2.47x with less than 24% area increase. The entire process was conducted completely automatically.

cs.AR↗

arXiv2025

Leveraging SystemC-TLM-based Virtual Prototypes for Embedded Software Fuzzing

SystemC-based virtual prototypes have emerged as widely adopted tools to test software ahead of hardware availability, reducing the time-to-market and improving software reliability. Recently, fuzzing has become a popular method for automated software testing due to its ability to quickly identify corner-case errors. However, its application to embedded software is still limited. Simulator tools can help bridge this gap by providing a more powerful and controlled execution environment for testing. Existing solutions, however, often tightly couple fuzzers with built-in simulators that lack support for hardware peripherals and offer limited flexibility, restricting their ability to test embedded software. To address these limitations, we present a framework that allows the integration of American-Fuzzy-Lop-based fuzzers and SystemC-based simulators. The framework provides a harness to decouple the adopted fuzzer and simulator. In addition, it intercepts peripheral accesses and queries the fuzzer for values, effectively linking peripheral behavior to the fuzzer. This solution enables flexible interchangeability of peripherals within the simulation environment and supports the interfacing of different SystemC-based virtual prototypes. The flexibility of the proposed solution is demonstrated by integrating the harness with different simulators and by testing various softwares.

cs.SE↗

arXiv2025

FMI Meets SystemC: A Framework for Cross-Tool Virtual Prototyping

As systems become more complex, the demand for thorough testing and virtual prototyping grows. To simulate whole systems, multiple tools are usually needed to cover different parts. These parts include the hardware of a system and the environment with which the system interacts. The Functional Mock-up Interface (FMI) standard for co-simulation can be used to connect these tools. The control part of modern systems is usually a computing unit, such as a System-on-a-Chip (SoC) or Microcontroller Unit (MCU), which executes software from a connected memory and interacts with peripherals. To develop software without requiring access to physical hardware, full-system simulators, the so-called Virtual Platforms (VPs), are commonly used. The IEEE-standardized framework for VP development is SystemC TLM. SystemC provides interfaces and concepts that enable modular design and model exchange. However, SystemC lacks native FMI support, which limits the integration into broader co-simulation environments. This paper presents a novel framework to control and interact with SystemC-based VPs using the FMI. We present a case study showing how a simulated temperature sensor in a SystemC simulation can obtain temperature values from an external tool via FMI. This approach allows the unmodified target software to run on the VP and receive realistic environmental input data such as temperature, velocity, or acceleration values from other tools. Thus, extensive software testing and verification is enabled. By having tests ready and the software pre-tested using a VP once the physical hardware is available, certifications like ISO 26262 can be done earlier.

cs.SE↗

arXiv2025

Bridging the Gap: Physical PCI Device Integration Into SystemC-TLM Virtual Platforms

In today's technology-driven world, early-stage software development and testing are crucial. Virtual Platforms (VPs) have become indispensable tools for this purpose as they serve as a platform to execute and debug the unmodified target software at an early design stage. With the increasing complexity of software, especially in areas like Artificial Intelligence (AI) applications, VPs need to provide high simulation speed to ensure the target software executes within a reasonable time. Hybrid simulation, which combines virtual models with real hardware, can improve the performance of VPs. This paper introduces a novel approach for integrating real Peripheral Component Interconnect (PCI) devices into SystemC-TLM-2.0-based VPs. The embedded PCI devices enable high performance, easy integration, and allow introspection for analysis and optimization. To illustrate the practical application of our approach, we present a case study where we integrate Google Coral's Edge Tensor Processing Unit (TPU) into an ARM-based VP. The integration allows efficient execution of AI workloads, accelerating simulation speeds by up to 480x while eliminating the need for complex virtual device models. Beyond accelerating AI-workload execution, our framework enables driver development, regression testing across architectures, and device communication analysis. Our findings demonstrate that embedding PCI devices into SystemC simulations significantly enhances

cs.SE↗

arXiv2025

Optimizing Binary and Ternary Neural Network Inference on RRAM Crossbars using CIM-Explorer

Using Resistive Random Access Memory (RRAM) crossbars in Computing-in-Memory (CIM) architectures offers a promising solution to overcome the von Neumann bottleneck. Due to non-idealities like cell variability, RRAM crossbars are often operated in binary mode, utilizing only two states: Low Resistive State (LRS) and High Resistive State (HRS). Binary Neural Networks (BNNs) and Ternary Neural Networks (TNNs) are well-suited for this hardware due to their efficient mapping. Existing software projects for RRAM-based CIM typically focus on only one aspect: compilation, simulation, or Design Space Exploration (DSE). Moreover, they often rely on classical 8 bit quantization. To address these limitations, we introduce CIM-Explorer, a modular toolkit for optimizing BNN and TNN inference on RRAM crossbars. CIM-Explorer includes an end-to-end compiler stack, multiple mapping options, and simulators, enabling a DSE flow for accuracy estimation across different crossbar parameters and mappings. CIM-Explorer can accompany the entire design process, from early accuracy estimation for specific crossbar parameters, to selecting an appropriate mapping, and compiling BNNs and TNNs for a finalized crossbar chip. In DSE case studies, we demonstrate the expected accuracy for various mappings and crossbar parameters. CIM-Explorer can be found on GitHub.

cs.ET↗

arXiv2025

Introducing Instruction-Accurate Simulators for Performance Estimation of Autotuning Workloads

Accelerating Machine Learning (ML) workloads requires efficient methods due to their large optimization space. Autotuning has emerged as an effective approach for systematically evaluating variations of implementations. Traditionally, autotuning requires the workloads to be executed on the target hardware (HW). We present an interface that allows executing autotuning workloads on simulators. This approach offers high scalability when the availability of the target HW is limited, as many simulations can be run in parallel on any accessible HW. Additionally, we evaluate the feasibility of using fast instruction-accurate simulators for autotuning. We train various predictors to forecast the performance of ML workload implementations on the target HW based on simulation statistics. Our results demonstrate that the tuned predictors are highly effective. The best workload implementation in terms of actual run time on the target HW is always within the top 3 % of predictions for the tested x86, ARM, and RISC-V-based architectures. In the best case, this approach outperforms native execution on the target HW for embedded architectures when running as few as three samples on three simulators in parallel.

cs.AR↗

arXiv2025

High-Performance ARM-on-ARM Virtualization for Multicore SystemC-TLM-Based Virtual Platforms

The increasing complexity of hardware and software requires advanced development and test methodologies for modern systems on chips. This paper presents a novel approach to ARM-on-ARM virtualization within SystemC-based simulators using Linux's KVM to achieve high-performance simulation. By running target software natively on ARM-based hosts with hardware-based virtualization extensions, our method eliminates the need for instruction-set simulators, which significantly improves performance. We present a multicore SystemC-TLM-based CPU model that can be used as a drop-in replacement for an instruction-set simulator. It places no special requirements on the host system, making it compatible with various environments. Benchmark results show that our ARM-on-ARM-based virtual platform achieves up to 10 x speedup over traditional instruction-set-simulator-based models on compute-intensive workloads. Depending on the benchmark, speedups increase to more than 100 x.

cs.SE↗

arXiv2025

Evaluating the Scalability of Binary and Ternary CNN Workloads on RRAM-based Compute-in-Memory Accelerators

The increasing computational demand of Convolutional Neural Networks (CNNs) necessitates energy-efficient acceleration strategies. Compute-in-Memory (CIM) architectures based on Resistive Random Access Memory (RRAM) offer a promising solution by reducing data movement and enabling low-power in-situ computations. However, their efficiency is limited by the high cost of peripheral circuits, particularly Analog-to-Digital Converters (ADCs). Large crossbars and low ADC resolutions are often used to mitigate this, potentially compromising accuracy. This work introduces novel simulation methods to model the impact of resistive wire parasitics and limited ADC resolution on RRAM crossbars. Our parasitics model employs a vectorised algorithm to compute crossbar output currents with errors below 0.15% compared to SPICE. Additionally, we propose a variable step-size ADC and a calibration methodology that significantly reduces ADC resolution requirements. These accuracy models are integrated with a statistics-based energy model. Using our framework, we conduct a comparative analysis of binary and ternary CNNs. Experimental results demonstrate that the ternary CNNs exhibit greater resilience to wire parasitics and lower ADC resolution but suffer a 40% reduction in energy efficiency. These findings provide valuable insights for optimising RRAM-based CIM accelerators for energy-efficient deep learning.

eess.SP↗

arXiv2025

The Impact of Logic Locking on Confidentiality: An Automated Evaluation

Logic locking secures hardware designs in untrusted foundries by incorporating key-driven gates to obscure the original blueprint. While this method safeguards the integrated circuit from malicious alterations during fabrication, its influence on data confidentiality during runtime has been ignored. In this study, we employ path sensitization to formally examine the impact of logic locking on confidentiality. By applying three representative logic locking mechanisms on open-source cryptographic benchmarks, we utilize an automatic test pattern generation framework to evaluate the effect of locking on cryptographic encryption keys and sensitive data signals. Our analysis reveals that logic locking can inadvertently cause sensitive data leakage when incorrect logic locking keys are used. We show that a single malicious logic locking key can expose over 70% of an encryption key. If an adversary gains control over other inputs, the entire encryption key can be compromised. This research uncovers a significant security vulnerability in logic locking and emphasizes the need for comprehensive security assessments that extend beyond key-recovery attacks.

cs.CR↗

arXiv2024

Exploiting the Lock: Leveraging MiG-V's Logic Locking for Secret-Data Extraction

The MiG-V was designed for high-security applications and is the first commercially available logic-locked RISC-V processor on the market. In this context logic locking was used to protect the RISC-V processor design during the untrusted manufacturing process by using key-driven logic gates to obfuscate the original design. Although this method defends against malicious modifications, such as hardware Trojans, logic locking's impact on the RISC-V processor's data confidentiality during runtime has not been thoroughly examined. In this study, we evaluate the impact of logic locking on data confidentiality. By altering the logic locking key of the MiG-V while running SSL cryptographic algorithms, we identify data leakages resulting from the exploitation of the logic locking hardware. We show that changing a single bit of the logic locking key can expose 100% of the cryptographic encryption key. This research reveals a critical security flaw in logic locking, highlighting the need for comprehensive security assessments beyond logic locking key-recovery attacks.

cs.CR↗

arXiv2024

A Calibratable Model for Fast Energy Estimation of MVM Operations on RRAM Crossbars

The surge in AI usage demands innovative power reduction strategies. Novel Compute-in-Memory (CIM) architectures, leveraging advanced memory technologies, hold the potential for significantly lowering energy consumption by integrating storage with parallel Matrix-Vector-Multiplications (MVMs). This study addresses the 1T1R RRAM crossbar, a core component in numerous CIM architectures. We introduce an abstract model and a calibration methodology for estimating operational energy. Our tool condenses circuit-level behaviour into a few parameters, facilitating energy assessments for DNN workloads. Validation against low-level SPICE simulations demonstrates speedups of up to 1000x and energy estimations with errors below 1%.

eess.SP↗

arXiv2024

parti-gem5: gem5's Timing Mode Parallelised

Detailed timing models are indispensable tools for the design space exploration of Multiprocessor Systems on Chip (MPSoCs). As core counts continue to increase, the complexity in memory hierarchies and interconnect topologies is also growing, making accurate predictions of design decisions more challenging than ever. In this context, the open-source Full System Simulator (FSS) gem5 is a popular choice for MPSoC design space exploration, thanks to its flexibility and robust set of detailed timing models. However, its single-threaded simulation kernel severely hampers its throughput. To address this challenge, we introduce parti-gem5, an extension of gem5 that enables parallel timing simulations on modern multi-core simulation hosts. Unlike previous works, parti-gem5 supports gem5's timing mode, the O3CPU, and Ruby's custom cache and interconnect models. Compared to reference single-thread simulations, we achieved speedups of up to 42.7x when simulating a 120-core ARM MPSoC on a 64-core x86-64 host system. While our method introduces timing deviations, the error in total simulated time is below 15% in most cases.

cs.AR↗

arXiv2024

A Fully Automated Platform for Evaluating ReRAM Crossbars

Resistive Random Access Memory (ReRAM) is a promising candidate for implementing Computing-in-Memory (CIM) architectures and neuromorphic circuits. ReRAM cells exhibit significant variability across different memristive devices and cycles, necessitating further improvements in the areas of devices, algorithms, and applications. To achieve this, understanding the stochastic behavior of the different ReRAM technologies is essential. The NeuroBreakoutBoard (NBB) is a versatile instrumentation platform to characterize Non-Volatile Memories (NVMs). However, the NBB itself does not provide any functionality in the form of software or a controller. In this paper, we present a control board for the NBB able to perform reliability assessments of 1T1R ReRAM crossbars. In more detail, an interface that allows a host PC to communicate with the NBB via the new control board is implemented. In a case study, we analyze the Cycle-to-Cycle (C2C) variation and read disturb TiN/Ti/HfO2/TiN cells for different read voltages to gain an understanding of their operational behavior.

cs.ET↗

arXiv2024

QTFlow: Quantitative Timing-Sensitive Information Flow for Security-Aware Hardware Design on RTL

In contemporary Electronic Design Automation (EDA) tools, security often takes a backseat to the primary goals of power, performance, and area optimization. Commonly, the security analysis is conducted by hand, leading to vulnerabilities in the design remaining unnoticed. Security-aware EDA tools assist the designer in the identification and removal of security threats while keeping performance and area in mind. Cutting-edge methods employ information flow analysis to identify inadvertent information leaks in design structures. Current information leakage detection methods use quantitative information flow analysis to quantify the leaks. However, handling sequential circuits poses challenges for state-of-the-art techniques due to their time-agnostic nature, overlooking timing channels, and introducing false positives. To address this, we introduce QTFlow, a timing-sensitive framework for quantifying hardware information leakages during the design phase. Illustrating its effectiveness on open-source benchmarks, QTFlow autonomously identifies timing channels and diminishes all false positives arising from time-agnostic analysis when contrasted with current state-of-the-art techniques.

cs.CR↗