Example - 1

Consider example design module system verilog code shown below. The register_example module is an example parameterized module that defines two parameters, REGISTER_WIDTH and REGISTER_DEFAULT. Register_example module defines a Secure_mode setting, which when set makes the register content read-only and not modifiable by software writes. register_top module instantiates two registers, Insecure_Device_ID_1 and Insecure_Device_ID_2. Generally, registers containing device identifier values are required to be read only to prevent any possibility of software modifying these values.

Data_out <= REGISTER_DEFAULT; // Register content set to Default at reset Secure_mode <= REGISTER_DEFAULT[0]; // Register Secure_mode set at reset 

Data_out <= Data_in; 
if (~resetn) begin end else if (write & ~Secure_mode) begin end 

.REGISTER_WIDTH (32), .REGISTER_DEFAULT (1224) // Incorrect Default value used bit 0 is 0. 

.Data_in (Data_in), .Data_out (Secure_reg), .Clk (Clk), .resetn (resetn), .write (write) 

.REGISTER_WIDTH (32) // Default not defined 2^32-2 value will be used as default. 

.Data_in (Data_in), .Data_out (Insecure_reg), .Clk (Clk), .resetn (resetn), .write (write) 
// Parameterized Register module example // Secure_mode : REGISTER_DEFAULT[0] : When set to 1 register is read only and not writable// module register_example #( parameter REGISTER_WIDTH = 8, // Parameter defines width of register, default 8 bits parameter [REGISTER_WIDTH-1:0] REGISTER_DEFAULT = 2**REGISTER_WIDTH -2 // Default value of register computed from Width. Sets all bits to 1s except bit 0 (Secure _mode) ) ( input [REGISTER_WIDTH-1:0] Data_in, input Clk, input resetn, input write, output reg [REGISTER_WIDTH-1:0] Data_out ); reg Secure_mode; always @(posedge Clk or negedge resetn) endmodule module register_top ( input Clk, input resetn, input write, input [31:0] Data_in, output reg [31:0] Secure_reg, output reg [31:0] Insecure_reg ); register_example #( ) Insecure_Device_ID_1 ( ); register_example #() Insecure_Device_ID_2 ( ); endmodule 

These example instantiations show how, in a hardware design, it would be possible to instantiate the register module with insecure defaults and parameters.

In the example design, both registers will be software writable since Secure_mode is defined as zero.

.REGISTER_WIDTH (32), .REGISTER_DEFAULT (1225) // Correct default value set, to enable Secure_mode 

.Data_in (Data_in), .Data_out (Secure_reg), .Clk (Clk), .resetn (resetn), .write (write) register_example #( ) Secure_Device_ID_example ( );

Example - 2

The example code is taken from the fuse memory inside the buggy OpenPiton SoC of HACK@DAC'21 [REF-1356]. Fuse memory is used to store keys/passwords and most configuration information. For example, the keys of JTAG and HMAC are stored in the fuse memory. During the firmware setup phase, the data in the Fuse memory is transferred into the registers of corresponding SoC peripherals for initialization. However, if the offset to access keys is set incorrectly, programs cannot access the correct keys from the fuse memory, breaking the functionalities of peripherals and even exposing sensitive information through other peripherals.

<xhtml_b>parameter  MEM_SIZE = 100;</xhtml_b>
<xhtml_b>localparam JTAG_OFFSET = 81;</xhtml_b>

// JTAG expected hamc hash32'h49ac13af, 32'h1276f1b8, 32'h6703193a, 32'h65eb531b,32'h3025ccca, 32'h3e8861f4, 32'h329edfe5, 32'h98f763b4,
const logic [MEM_SIZE-1:0][31:0] mem = {...assign jtag_hash_o = {mem[JTAG_OFFSET-1],mem[JTAG_OFFSET-2],mem[JTAG_OFFSET-3],mem[JTAG_OFFSET-4],mem[JTAG_OFFSET-5],mem[JTAG_OFFSET-6],mem[JTAG_OFFSET-7],mem[JTAG_OFFSET-8]};...

The following vulnerable code accesses the JTAG key from the fuse memory. However, the JTAG_OFFSET is incorrect, and the fuse memory outputs the wrong values to jtag_hash_o. Moreover, setting incorrect offset gives the ability to attackers to access JTAG by knowing other low-privileged peripherals' passwords.

To mitigate this, change JTAG_OFFSET to the correct address of the JTAG key [REF-1357].

<xhtml_b>localparam JTAG_OFFSET = 100;</xhtml_b>
parameter  MEM_SIZE = 100;