2183
Ensure that the translation maps signals in such a way that untrusted agents cannot map to
trusted agents or vice-versa.
Demonstrative Examples
Example 1:
The bridge interfaces between OCP and AHB end points. OCP uses MReqInfo signal to indicate
security attributes, whereas AHB uses HPROT signal to indicate the security attributes. The width
of MReqInfo can be customized as needed. In this example, MReqInfo is 5-bits wide and carries
the privilege level of the OCP controller.
The values 5'h11, 5'h10, 5'h0F, 5'h0D, 5'h0C, 5'h0B, 5'h09, 5'h08, 5'h04, and 5'h02 in MReqInfo
indicate that the request is coming from a privileged state of the OCP bus controller. Values 5'h1F,
5'h0E, and 5'h00 indicate untrusted, privilege state.
Though HPROT is a 5-bit signal, we only consider the lower, two bits in this example. HPROT
values 2'b00 and 2'b10 are considered trusted, and 2'b01 and 2'b11 are considered untrusted.
The OCP2AHB bridge is expected to translate trusted identities on the controller side to trusted
identities on the responder side. Similarly, it is expected to translate untrusted identities on the
controller side to untrusted identities on the responder side.
Example Language: Verilog (Bad)
module ocp2ahb
(
ahb_hprot,
ocp_mreqinfo
);
output [1:0] ahb_hprot; // output is 2 bit signal for AHB HPROT
input [4:0] ocp_mreqinfo; // input is 5 bit signal from OCP MReqInfo
wire [6:0] p0_mreqinfo_o_temp; // OCP signal that transmits hardware identity of bus controller
wire y;
reg [1:0] ahb_hprot;
// hardware identity of bus controller is in bits 5:1 of p0_mreqinfo_o_temp signal
assign p0_mreqinfo_o_temp[6:0] = {1'b0, ocp_mreqinfo[4:0], y};
always @*
begin
case (p0_mreqinfo_o_temp[4:2])
000: ahb_hprot = 2'b11; // OCP MReqInfo to AHB HPROT mapping
001: ahb_hprot = 2'b00;
010: ahb_hprot = 2'b00;
011: ahb_hprot = 2'b01;
100: ahb_hprot = 2'b00;
101: ahb_hprot = 2'b00;
110: ahb_hprot = 2'b10;
111: ahb_hprot = 2'b00;
endcase
end
endmodule
Logic in the case statement only checks for MReqInfo bits 4:2, i.e., hardware-identity bits 3:1.
When ocp_mreqinfo is 5'h1F or 5'h0E, p0_mreqinfo_o_temp[2] will be 1. As a result, untrusted IDs
from OCP 5'h1F and 5'h0E get translated to trusted ahb_hprot values 2'b00.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1203 Peripherals, On-chip Fabric, and Interface/IO Problems 1194 2472
CWE Version 4.14
CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall