{"@ID": "1461", "@Name": "Hardware Simulation / Synthesis Mismatch", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The hardware design contains structures that are interpreted\n\t\tdifferently during synthesis than during simulation, which\n\t\tcause inconsistencies in security-relevant behavior between\n\t\tthe synthesized implementation and the simulation.", "Extended_Description": {"xhtml:p": "Hardware-description-language (HDL) code describes\n\t\tfunctionality which can be verified as correct using\n\t\tsimulation tools. Synthesis tools then (automatically) convert\n\t\tthis into a physically-realizable representation. Certain HDL\n\t\tcode structures cannot be exactly represented, or have\n\t\tmultiple valid representations from which the synthesis tool\n\t\tmust choose. This can result in output which behaves\n\t\tdifferently to the (functionally-correct) HDL code. These\n\t\t\"simulation/synthesis mismatches\" may have security\n\t\tconsequences.", "#text_blocks": ["Hardware-description-language (HDL) code describes\n\t\tfunctionality which can be verified as correct using\n\t\tsimulation tools. Synthesis tools then (automatically) convert\n\t\tthis into a physically-realizable representation. Certain HDL\n\t\tcode structures cannot be exactly represented, or have\n\t\tmultiple valid representations from which the synthesis tool\n\t\tmust choose. This can result in output which behaves\n\t\tdifferently to the (functionally-correct) HDL code. These\n\t\t\"simulation/synthesis mismatches\" may have security\n\t\tconsequences."]}, "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "435", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Resultant", "Description": "This is a resultant weakness as the primary would be\n\t\t\tsomething like bad RTL coding practices or Synthesis\n\t\t\toptimization that then would result in a mismatch."}}, "Applicable_Platforms": {"Language": [{"@Name": "Verilog", "@Prevalence": "Undetermined"}, {"@Name": "VHDL", "@Prevalence": "Undetermined"}, {"@Class": "Hardware Description Language", "@Prevalence": "Undetermined"}], "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "System on Chip", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": [{"Custom_Phase": {"@Domain": "Hardware", "#text": "Implementation & Physical Design"}, "Note": {"xhtml:p": "This weakness can be introduced when HDL\n\t\t\tconstructs, assignment ordering, synthesis directives, or\n\t\t\ttool-dependent semantics are used whose simulation\n\t\t\tbehavior may not match synthesis interpretation. These\n\t\t\tconstructs may behave correctly during HDL simulation but\n\t\t\tproduce different security-relevant behavior in the\n\t\t\tsynthesized implementation.", "#text_blocks": ["This weakness can be introduced when HDL\n\t\t\tconstructs, assignment ordering, synthesis directives, or\n\t\t\ttool-dependent semantics are used whose simulation\n\t\t\tbehavior may not match synthesis interpretation. These\n\t\t\tconstructs may behave correctly during HDL simulation but\n\t\t\tproduce different security-relevant behavior in the\n\t\t\tsynthesized implementation."]}}, {"Custom_Phase": {"@Domain": "Hardware", "#text": "Implementation & Physical Design"}, "Note": {"xhtml:p": "This weakness can be introduced or exposed during\n\t\t\tsynthesis when the synthesis tool applies assumptions,\n\t\t\toptimizations, or transformations to HDL structures that\n\t\t\tcannot be physically implemented exactly as the simulation\n\t\t\tsemantics dictate, or that permit multiple (valid)\n\t\t\thardware implementations. The resulting netlist may behave\n\t\t\tdifferently from the model that was verified during\n\t\t\tsimulation.", "#text_blocks": ["This weakness can be introduced or exposed during\n\t\t\tsynthesis when the synthesis tool applies assumptions,\n\t\t\toptimizations, or transformations to HDL structures that\n\t\t\tcannot be physically implemented exactly as the simulation\n\t\t\tsemantics dictate, or that permit multiple (valid)\n\t\t\thardware implementations. The resulting netlist may behave\n\t\t\tdifferently from the model that was verified during\n\t\t\tsimulation."]}}]}, "Common_Consequences": {"Consequence": {"Scope": "Other", "Impact": "Varies by Context", "Note": {"xhtml:p": "The consequences depend on the affected hardware\n\t\t\tbehavior. The synthesized implementation may make\n\t\t\tdifferent control decisions, incorrectly update protected\n\t\t\tstate, expose data, or fail to enforce restrictions that\n\t\t\tappeared to operate correctly during HDL\n\t\t\tsimulation.", "#text_blocks": ["The consequences depend on the affected hardware\n\t\t\tbehavior. The synthesized implementation may make\n\t\t\tdifferent control decisions, incorrectly update protected\n\t\t\tstate, expose data, or fail to enforce restrictions that\n\t\t\tappeared to operate correctly during HDL\n\t\t\tsimulation."]}}}, "Detection_Methods": {"Detection_Method": [{"Method": "Automated Static Analysis - Source Code", "Description": {"xhtml:p": "HDL linting, rule-based static analysis, and HDL\n\t\t\tchecker tools can examine source code for structures that\n\t\t\tmay be interpreted differently by simulation and synthesis\n\t\t\ttools. They may identify synthesis-sensitive coding\n\t\t\tpatterns associated with this weakness.", "#text_blocks": ["HDL linting, rule-based static analysis, and HDL\n\t\t\tchecker tools can examine source code for structures that\n\t\t\tmay be interpreted differently by simulation and synthesis\n\t\t\ttools. They may identify synthesis-sensitive coding\n\t\t\tpatterns associated with this weakness."]}, "Effectiveness": "Moderate", "Effectiveness_Notes": {"xhtml:p": "This method can be useful for detecting potential\n\t\t\tcoding issues, but it may not reveal whether these\n\t\t\tconstructs result in observable behavioral divergence\n\t\t\tafter synthesis. Moreover, a user may suppress or bypass\n\t\t\tthese warnings and still produce the erroneous synthesized\n\t\t\thardware implementation. This method can give false\n\t\t\tpositives.", "#text_blocks": ["This method can be useful for detecting potential\n\t\t\tcoding issues, but it may not reveal whether these\n\t\t\tconstructs result in observable behavioral divergence\n\t\t\tafter synthesis. Moreover, a user may suppress or bypass\n\t\t\tthese warnings and still produce the erroneous synthesized\n\t\t\thardware implementation. This method can give false\n\t\t\tpositives."]}}, {"Method": "Manual Analysis", "Description": {"xhtml:p": "Synthesis warning review can examine synthesis\n\t\t\tlogs and reports for tool messages associated with\n\t\t\tpossible simulation/synthesis mismatch. It may identify\n\t\t\tignored constructs, unsupported HDL semantics, synthesis\n\t\t\tassumptions, or optimizations that could affect\n\t\t\tsecurity-relevant behavior.", "#text_blocks": ["Synthesis warning review can examine synthesis\n\t\t\tlogs and reports for tool messages associated with\n\t\t\tpossible simulation/synthesis mismatch. It may identify\n\t\t\tignored constructs, unsupported HDL semantics, synthesis\n\t\t\tassumptions, or optimizations that could affect\n\t\t\tsecurity-relevant behavior."]}, "Effectiveness": "Limited", "Effectiveness_Notes": {"xhtml:p": "Can reveal potential synthesis issues but relies\n\t\t\ton engineers interpreting warnings. Moreover, a user may\n\t\t\tsuppress or bypass these warnings and still produce the\n\t\t\terroneous synthesized hardware implementation.", "#text_blocks": ["Can reveal potential synthesis issues but relies\n\t\t\ton engineers interpreting warnings. Moreover, a user may\n\t\t\tsuppress or bypass these warnings and still produce the\n\t\t\terroneous synthesized hardware implementation."]}}, {"Method": "Formal Verification", "Description": {"xhtml:p": "HDL-source-to-netlist formal equivalence checking\n\t\t\tcan examine the simulated model and synthesized netlist\n\t\t\tfor behavioral mismatch associated with this weakness. It\n\t\t\tmay identify non-equivalent outputs, failed\n\t\t\tcompare-points, state-mapping issues, or counterexamples\n\t\t\tunder the checked constraints.", "#text_blocks": ["HDL-source-to-netlist formal equivalence checking\n\t\t\tcan examine the simulated model and synthesized netlist\n\t\t\tfor behavioral mismatch associated with this weakness. It\n\t\t\tmay identify non-equivalent outputs, failed\n\t\t\tcompare-points, state-mapping issues, or counterexamples\n\t\t\tunder the checked constraints."]}, "Effectiveness": "High", "Effectiveness_Notes": {"xhtml:p": "Formal equivalence checking can be effective at\n\t\t\tthe IP level for identifying mismatches between the\n\t\t\tsource-code model and synthesized implementation. However,\n\t\t\teffectiveness may decrease as design complexity grows,\n\t\t\tparticularly at the SoC level, due to state-space\n\t\t\texpansion and difficulty mapping non-equivalent\n\t\t\tpoints. Synthesis optimizations may merge, eliminate, or\n\t\t\trename signals, which can also produce false positives or\n\t\t\trequire additional setup to account for expected\n\t\t\ttransformations.", "#text_blocks": ["Formal equivalence checking can be effective at\n\t\t\tthe IP level for identifying mismatches between the\n\t\t\tsource-code model and synthesized implementation. However,\n\t\t\teffectiveness may decrease as design complexity grows,\n\t\t\tparticularly at the SoC level, due to state-space\n\t\t\texpansion and difficulty mapping non-equivalent\n\t\t\tpoints. Synthesis optimizations may merge, eliminate, or\n\t\t\trename signals, which can also produce false positives or\n\t\t\trequire additional setup to account for expected\n\t\t\ttransformations."]}}, {"Method": "Simulation / Emulation", "Description": {"xhtml:p": "Cross-simulation across HDL-source and\n\t\t\tpost-synthesis models can examine both abstraction levels\n\t\t\tfor observable behavioral divergence associated with this\n\t\t\tweakness. It may identify mismatches when\n\t\t\tsecurity-relevant behaviors are explicitly\n\t\t\texercised.", "#text_blocks": ["Cross-simulation across HDL-source and\n\t\t\tpost-synthesis models can examine both abstraction levels\n\t\t\tfor observable behavioral divergence associated with this\n\t\t\tweakness. It may identify mismatches when\n\t\t\tsecurity-relevant behaviors are explicitly\n\t\t\texercised."]}, "Effectiveness": "High", "Effectiveness_Notes": {"xhtml:p": "This method can be useful for detecting\n\t\t\tobservable behavioral mismatches, but it may not exercise\n\t\t\tall execution scenarios and should be combined with other\n\t\t\tdetection methods to improve coverage.", "#text_blocks": ["This method can be useful for detecting\n\t\t\tobservable behavioral mismatches, but it may not exercise\n\t\t\tall execution scenarios and should be combined with other\n\t\t\tdetection methods to improve coverage."]}}, {"Method": "Fuzzing", "Description": {"xhtml:p": "Coverage-guided differential fuzzing can examine\n\t\t\tHDL source code and synthesized implementation models for\n\t\t\tbehavioral divergence associated with this weakness. It\n\t\t\tmay identify generated inputs or state conditions that\n\t\t\texpose synthesis-induced mismatches.", "#text_blocks": ["Coverage-guided differential fuzzing can examine\n\t\t\tHDL source code and synthesized implementation models for\n\t\t\tbehavioral divergence associated with this weakness. It\n\t\t\tmay identify generated inputs or state conditions that\n\t\t\texpose synthesis-induced mismatches."]}, "Effectiveness": "High", "Effectiveness_Notes": {"xhtml:p": "This method can be useful for detecting\n\t\t\tpreviously unknown synthesis-induced behavioral mismatches\n\t\t\tby exploring diverse execution paths through\n\t\t\tcoverage-guided input generation. However, it may not\n\t\t\texercise every reachable design state and should be\n\t\t\tcombined with other detection methods to improve\n\t\t\tcoverage.", "#text_blocks": ["This method can be useful for detecting\n\t\t\tpreviously unknown synthesis-induced behavioral mismatches\n\t\t\tby exploring diverse execution paths through\n\t\t\tcoverage-guided input generation. However, it may not\n\t\t\texercise every reachable design state and should be\n\t\t\tcombined with other detection methods to improve\n\t\t\tcoverage."]}}]}, "Potential_Mitigations": {"Mitigation": [{"Custom_Phase": {"@Domain": "Hardware", "#text": "Implementation & Physical Design"}, "Description": {"xhtml:p": "Establish and enforce HDL coding and review\n\t\t\tpractices that minimize differences between simulation\n\t\t\tsemantics and synthesis interpretation. Avoid HDL\n\t\t\tconstructs, synthesis directives, and tool-dependent\n\t\t\tbehaviors known to cause simulation/synthesis mismatch,\n\t\t\twith particular attention to security-relevant\n\t\t\tlogic.", "#text_blocks": ["Establish and enforce HDL coding and review\n\t\t\tpractices that minimize differences between simulation\n\t\t\tsemantics and synthesis interpretation. Avoid HDL\n\t\t\tconstructs, synthesis directives, and tool-dependent\n\t\t\tbehaviors known to cause simulation/synthesis mismatch,\n\t\t\twith particular attention to security-relevant\n\t\t\tlogic."]}, "Effectiveness": "High", "Effectiveness_Notes": {"xhtml:p": "Avoidance of the patterns of code which can\n\t\t\tresult in these errors removes the opportunity for\n\t\t\terror. However, in some cases (notably state machine\n\t\t\tencodings) this can be very difficult to achieve\n\t\t\tefficiently.", "#text_blocks": ["Avoidance of the patterns of code which can\n\t\t\tresult in these errors removes the opportunity for\n\t\t\terror. However, in some cases (notably state machine\n\t\t\tencodings) this can be very difficult to achieve\n\t\t\tefficiently."]}}, {"Custom_Phase": {"@Domain": "Hardware", "#text": "Implementation & Physical Design"}, "Description": {"xhtml:p": "For security-critical logic, preserve intentional\n\t\t\tredundancy that is required for security. Examples may\n\t\t\tinclude redundant logic, triple modular redundancy (TMR)\n\t\t\tstructures, Hamming-distance state encodings, or\n\t\t\tstate-machine recovery logic. Use synthesis constraints,\n\t\t\tpreservation attributes, carefully controlled structural\n\t\t\timplementation, or manual implementation of selected\n\t\t\tcritical blocks to prevent this redundancy from being\n\t\t\tmerged, re-encoded, or optimized away.", "#text_blocks": ["For security-critical logic, preserve intentional\n\t\t\tredundancy that is required for security. Examples may\n\t\t\tinclude redundant logic, triple modular redundancy (TMR)\n\t\t\tstructures, Hamming-distance state encodings, or\n\t\t\tstate-machine recovery logic. Use synthesis constraints,\n\t\t\tpreservation attributes, carefully controlled structural\n\t\t\timplementation, or manual implementation of selected\n\t\t\tcritical blocks to prevent this redundancy from being\n\t\t\tmerged, re-encoded, or optimized away."]}, "Effectiveness": "High", "Effectiveness_Notes": {"xhtml:p": "This mitigation removes the structures which\n\t\t\tcause the problem, at the expense of additional design and\n\t\t\tverification effort, and additional risk of inclusion of\n\t\t\tother functional errors.", "#text_blocks": ["This mitigation removes the structures which\n\t\t\tcause the problem, at the expense of additional design and\n\t\t\tverification effort, and additional risk of inclusion of\n\t\t\tother functional errors."]}}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"Intro_Text": {"xhtml:p": "A hardware designer implements an access control\n\t\t\tlatch which takes in lock and unlock signals (which are\n\t\t\tonly active for a single cycle) and a reset signal, and\n\t\t\toutputs an unlocked state signal. During operation, the\n\t\t\tunlocked signal is synchronously set high by the unlock\n\t\t\tinput and set low by the lock input. The unlocked signal\n\t\t\talso intended to be low from startup and set low by\n\t\t\treset.", "#text_blocks": ["A hardware designer implements an access control\n\t\t\tlatch which takes in lock and unlock signals (which are\n\t\t\tonly active for a single cycle) and a reset signal, and\n\t\t\toutputs an unlocked state signal. During operation, the\n\t\t\tunlocked signal is synchronously set high by the unlock\n\t\t\tinput and set low by the lock input. The unlocked signal\n\t\t\talso intended to be low from startup and set low by\n\t\t\treset."]}, "Example_Code": [{"@Nature": "Bad", "@Language": "Verilog", "xhtml:br": [null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null], "#text": "input  wire clk,\n\t\t\t  input  wire reset,\n\t\t\t  input  wire lock,\n\t\t\t  input  wire unlock,\n\t\t\t  output reg  unlocked"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked_next = 1'b1;"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked_next = 1'b0;"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked_next = 1'b1;"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked_next = unlocked;"}], "#text": "if (reset == 1'b1) begin\n\t\t\t\t\n\t\t\t\tend else if (lock == 1'b1) begin\n\t\t\t\t\n\t\t\t\tend else if (unlock == 1'b1) begin\n\t\t\t\t\n\t\t\t\tend else begin\n\t\t\t\t\n\t\t\t\tend"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked <= unlocked_next;"}], "#text": "reg unlocked_next = 1'b0;\n\t\t\t  \n\t\t\t  always @(lock or unlock or unlocked) begin\n\t\t\t  \n\t\t\t  end\n\t\t\t  \n\t\t\t  always @(posedge clk) begin\n\t\t\t  \n\t\t\t  end"}], "#text": "module lock_control (\n\t\t\t\n\t\t\t);\n\t\t\t\n\t\t\t\n\t\t\tendmodule", "#text_blocks": ["module lock_control (", "input  wire clk,", "input  wire reset,", "input  wire lock,", "input  wire unlock,", "output reg  unlocked", ");", "reg unlocked_next = 1'b0;", "always @(lock or unlock or unlocked) begin", "if (reset == 1'b1) begin", "unlocked_next = 1'b1;", "end else if (lock == 1'b1) begin", "unlocked_next = 1'b0;", "end else if (unlock == 1'b1) begin", "unlocked_next = 1'b1;", "end else begin", "unlocked_next = unlocked;", "end", "end", "always @(posedge clk) begin", "unlocked <= unlocked_next;", "end", "endmodule"]}, {"@Nature": "Bad", "@Language": "VHDL", "xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null], "#text": "clk      : in  std_logic;\n\t\t\t\treset    : in  std_logic;\n\t\t\t\tlock     : in  std_logic;\n\t\t\t\tunlock   : in  std_logic;\n\t\t\t\tunlocked : out std_logic"}, "#text": "port (\n\t\t\t  \n\t\t\t  );"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "signal unlocked_reg  : std_logic:=\u20190\u2019;\n\t\t\t  signal unlocked_next : std_logic;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked_next <= '1';"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked_next <= '0';"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked_next <= '1';"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked_next <= unlocked_reg;"}], "#text": "if reset = '1' then\n\t\t\t\t\n\t\t\t\telsif lock = '1' then\n\t\t\t\t\n\t\t\t\telsif unlock = '1' then\n\t\t\t\t\n\t\t\t\telse\n\t\t\t\t\n\t\t\t\tend if;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unlocked_reg <= unlocked_next;"}, "#text": "if rising_edge(clk) then\n\t\t\t\t\n\t\t\t\tend if;"}], "#text": "process(lock, unlock, unlocked_reg)\n\t\t\t  begin\n\t\t\t  \n\t\t\t  end process;\n\t\t\t  \n\t\t\t  process(clk)\n\t\t\t  begin\n\t\t\t  \n\t\t\t  end process;\n\t\t\t  \n\t\t\t  unlocked <= unlocked_reg;"}], "#text": "library ieee;\n\t\t\tuse ieee.std_logic_1164.all;\n\t\t\t\n\t\t\tentity lock_control is\n\t\t\t\n\t\t\tend entity lock_control;\n\t\t\t\n\t\t\tarchitecture behavioral of lock_control is\n\t\t\t\n\t\t\tbegin\n\t\t\t\n\t\t\t\n\t\t\tend architecture behavioral;", "#text_blocks": ["library ieee;", "use ieee.std_logic_1164.all;", "entity lock_control is", "port (", "clk      : in  std_logic;", "reset    : in  std_logic;", "lock     : in  std_logic;", "unlock   : in  std_logic;", "unlocked : out std_logic", ");", "end entity lock_control;", "architecture behavioral of lock_control is", "signal unlocked_reg  : std_logic:=\u20190\u2019;", "signal unlocked_next : std_logic;", "begin", "process(lock, unlock, unlocked_reg)", "begin", "if reset = '1' then", "unlocked_next <= '1';", "elsif lock = '1' then", "unlocked_next <= '0';", "elsif unlock = '1' then", "unlocked_next <= '1';", "else", "unlocked_next <= unlocked_reg;", "end if;", "end process;", "process(clk)", "begin", "if rising_edge(clk) then", "unlocked_reg <= unlocked_next;", "end if;", "end process;", "unlocked <= unlocked_reg;", "end architecture behavioral;"]}, {"@Nature": "Good", "@Language": "Algorithm", "xhtml:br": null, "xhtml:p": ["For combinational logic, ensure that simulation is\n\t\t\ttriggered by every signal read by the block. This can be\n\t\t\tdone by listing both inputs explicitly, but this is not\n\t\t\trecommended.", "A safer and more maintainable approach is to use (in\n\t\t\tVerilog) always @*, which tells the simulator to include\n\t\t\tall signals used inside the block. In SystemVerilog, use\n\t\t\talways_comb. In VHDL use process(all)."], "#text_blocks": ["For combinational logic, ensure that simulation is\n\t\t\ttriggered by every signal read by the block. This can be\n\t\t\tdone by listing both inputs explicitly, but this is not\n\t\t\trecommended.", "A safer and more maintainable approach is to use (in\n\t\t\tVerilog) always @*, which tells the simulator to include\n\t\t\tall signals used inside the block. In SystemVerilog, use\n\t\t\talways_comb. In VHDL use process(all)."]}], "Body_Text": [{"xhtml:p": "The following VHDL example is written for VHDL-93\n\t\t\tor later.", "#text_blocks": ["The following VHDL example is written for VHDL-93\n\t\t\tor later."]}, {"xhtml:p": ["The always block is intended to describe\n\t\t\tcombinational logic for unlocked_next, which depends on\n\t\t\tfour signals (lock, unlock, unlocked and reset). However,\n\t\t\tthe sensitivity list is missing reset.", "During pre-synthesis RTL simulation, this tells\n\t\t\tthe simulator not to rerun the block when reset changes\n\t\t\t(only when the other signals change). The signal\n\t\t\tunlocked_next defaults to 1\u2019b0 so the simulation sees the\n\t\t\texpected locked state and so the tests of the state after\n\t\t\treset will pass.", "Synthesis tools assume a complete sensitivity\n\t\t\tlist and will therefore infer logic including the reset\n\t\t\tsignal. When reset is high, the unlocked _next signal is\n\t\t\t(erroneously) set to 1\u2019b1. This is a bug (as reset should\n\t\t\tforce a non-unlocked state), which would be expected to be\n\t\t\tfound in simulation. The design uses a two-process state\n\t\t\tmachine style which masks this bug in the code during\n\t\t\tsimulation, but allows it to propagate to the synthesized\n\t\t\timplementation."], "#text_blocks": ["The always block is intended to describe\n\t\t\tcombinational logic for unlocked_next, which depends on\n\t\t\tfour signals (lock, unlock, unlocked and reset). However,\n\t\t\tthe sensitivity list is missing reset.", "During pre-synthesis RTL simulation, this tells\n\t\t\tthe simulator not to rerun the block when reset changes\n\t\t\t(only when the other signals change). The signal\n\t\t\tunlocked_next defaults to 1\u2019b0 so the simulation sees the\n\t\t\texpected locked state and so the tests of the state after\n\t\t\treset will pass.", "Synthesis tools assume a complete sensitivity\n\t\t\tlist and will therefore infer logic including the reset\n\t\t\tsignal. When reset is high, the unlocked _next signal is\n\t\t\t(erroneously) set to 1\u2019b1. This is a bug (as reset should\n\t\t\tforce a non-unlocked state), which would be expected to be\n\t\t\tfound in simulation. The design uses a two-process state\n\t\t\tmachine style which masks this bug in the code during\n\t\t\tsimulation, but allows it to propagate to the synthesized\n\t\t\timplementation."]}, {"xhtml:p": "The synthesized hardware exits reset in an\n\t\t\tinsecure state (with unlocked set to 1\u2019b1) and remains in\n\t\t\tthat state until one of the lock/unlock signals changes\n\t\t\tstate. An adversary can take advantage of this by\n\t\t\texploiting whatever logic makes use of this signal to set\n\t\t\titself to a secure state.", "#text_blocks": ["The synthesized hardware exits reset in an\n\t\t\tinsecure state (with unlocked set to 1\u2019b1) and remains in\n\t\t\tthat state until one of the lock/unlock signals changes\n\t\t\tstate. An adversary can take advantage of this by\n\t\t\texploiting whatever logic makes use of this signal to set\n\t\t\titself to a secure state."]}]}, {"Intro_Text": {"xhtml:p": "A hardware developer is debugging logic which\n\t\t\trequires the system to be in an unprotected mode.  In\n\t\t\torder to enable their work, they have (temporarily)\n\t\t\tremoved some code related to the \"protected_mode_enabled\"\n\t\t\tflag in a way that does not cause the simulations to\n\t\t\tfail.", "#text_blocks": ["A hardware developer is debugging logic which\n\t\t\trequires the system to be in an unprotected mode.  In\n\t\t\torder to enable their work, they have (temporarily)\n\t\t\tremoved some code related to the \"protected_mode_enabled\"\n\t\t\tflag in a way that does not cause the simulations to\n\t\t\tfail."]}, "Example_Code": [{"@Nature": "Bad", "@Language": "VHDL", "xhtml:br": [null, null, null, null, null, null, null, null, null, null, null], "#text": "-- The following VHDL example is written for VHDL-93 or later.\n\t\t\tsignal secure     : boolean; -- implicitly initialized to \u2018false\u2019\n\t\t\tsignal policy_ok  : boolean;\n\t\t\tsignal lock_ready : boolean;\n\t\t\t...\n\t\t\t-- synthesis translate_off\n\t\t\tsecure <= security_check(policy_ok, lock_ready); -- TODO: restore this after debugging\n\t\t\t-- synthesis translate_on\n\t\t\tprotected_mode_enabled <= secure;", "#text_blocks": ["-- The following VHDL example is written for VHDL-93 or later.", "signal secure     : boolean; -- implicitly initialized to \u2018false\u2019", "signal policy_ok  : boolean;", "signal lock_ready : boolean;", "...", "-- synthesis translate_off", "secure <= security_check(policy_ok, lock_ready); -- TODO: restore this after debugging", "-- synthesis translate_on", "protected_mode_enabled <= secure;"]}, {"@Nature": "Bad", "@Language": "Verilog", "xhtml:br": [null, null, null, null, null, null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "#text": "secure = 1'b0; // default value\n\t\t\t  // synopsys translate_off\n\t\t\t  secure = security_check(policy_ok, lock_ready); // TODO: restore this after debugging\n\t\t\t  // synopsys translate_on"}, "#text": "reg secure; \n\t\t\twire policy_ok;\n\t\t\twire lock_ready;\n\t\t\twire protected_mode_enabled;\n\t\t\t...\n\t\t\talways @(*) begin\n\t\t\t\n\t\t\tend\n\t\t\tassign protected_mode_enabled = secure;", "#text_blocks": ["reg secure;", "wire policy_ok;", "wire lock_ready;", "wire protected_mode_enabled;", "...", "always @(*) begin", "secure = 1'b0; // default value", "// synopsys translate_off", "secure = security_check(policy_ok, lock_ready); // TODO: restore this after debugging", "// synopsys translate_on", "end", "assign protected_mode_enabled = secure;"]}, {"@Nature": "Good", "@Language": "Algorithm", "xhtml:p": ["Do not place security-relevant assignments inside\n\t\t  synthesis-excluded regions. Any logic that affects\n\t\t  protected-mode behavior should be represented consistently\n\t\t  in both simulation and synthesis.", "Limit synthesis translate_off / translate_on regions to\n\t\t  simulation-only code that cannot assign, modify, override,\n\t\t  or mask security-sensitive signals.", "Carefully review all uses of translate_on/off directives.\n\t\t  Ensure that developers can efficiently authorize their\n\t\t  activities during development work, to avoid the temptation\n\t\t  to bypass security features in this way."], "#text_blocks": ["Do not place security-relevant assignments inside\n\t\t  synthesis-excluded regions. Any logic that affects\n\t\t  protected-mode behavior should be represented consistently\n\t\t  in both simulation and synthesis.", "Limit synthesis translate_off / translate_on regions to\n\t\t  simulation-only code that cannot assign, modify, override,\n\t\t  or mask security-sensitive signals.", "Carefully review all uses of translate_on/off directives.\n\t\t  Ensure that developers can efficiently authorize their\n\t\t  activities during development work, to avoid the temptation\n\t\t  to bypass security features in this way."]}, {"@Nature": "Good", "@Language": "VHDL", "xhtml:br": [null, null, null, null, null, null, null, null], "#text": "-- The following VHDL example is written for VHDL-93 or later.\n\t\t  signal secure     : boolean; -- implicitly initialized to \u2018false\u2019\n\t\t  signal policy_ok  : boolean;\n\t\t  signal lock_ready : boolean;\n\t\t  ...\n\t\t  secure <= security_check(policy_ok, lock_ready);\n\t\t  protected_mode_enabled <= secure;", "#text_blocks": ["-- The following VHDL example is written for VHDL-93 or later.", "signal secure     : boolean; -- implicitly initialized to \u2018false\u2019", "signal policy_ok  : boolean;", "signal lock_ready : boolean;", "...", "secure <= security_check(policy_ok, lock_ready);", "protected_mode_enabled <= secure;"]}, {"@Nature": "Good", "@Language": "Verilog", "xhtml:br": [null, null, null, null, null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "secure = security_check(policy_ok, lock_ready);"}, "#text": "reg secure;\n\t\t  wire policy_ok;\n\t\t  wire lock_ready;\n\t\t  wire protected_mode_enabled;\n\t\t  ...\n\t\t  always @(*) begin\n\t\t  \n\t\t  end\n\t\t  assign protected_mode_enabled = secure;", "#text_blocks": ["reg secure;", "wire policy_ok;", "wire lock_ready;", "wire protected_mode_enabled;", "...", "always @(*) begin", "secure = security_check(policy_ok, lock_ready);", "end", "assign protected_mode_enabled = secure;"]}], "Body_Text": [{"xhtml:p": ["The design assigns the security-relevant secure\n\t\t\tsignal using logic that is hidden from synthesis by\n\t\t\ttranslate_off / translate_on or equivalent synthesis\n\t\t\texclusion directives. Simulation tools treat these\n\t\t\tdirectives as comments and include the enclosed\n\t\t\tassignment, so simulation updates secure according to\n\t\t\tsecurity_check(policy_ok, lock_ready) and appears to\n\t\t\tvalidate the intended protected-mode behavior.", "Synthesis tools omit the code between the\n\t\t\texclusion directives. The synthesized implementation\n\t\t\ttherefore does not contain the same assignment that was\n\t\t\texercised during simulation. This creates a\n\t\t\tsimulation/synthesis mismatch in security-relevant\n\t\t\tbehavior: the HDL model used for verification enables or\n\t\t\tdisables protected mode using logic that is absent from\n\t\t\tthe synthesized hardware."], "#text_blocks": ["The design assigns the security-relevant secure\n\t\t\tsignal using logic that is hidden from synthesis by\n\t\t\ttranslate_off / translate_on or equivalent synthesis\n\t\t\texclusion directives. Simulation tools treat these\n\t\t\tdirectives as comments and include the enclosed\n\t\t\tassignment, so simulation updates secure according to\n\t\t\tsecurity_check(policy_ok, lock_ready) and appears to\n\t\t\tvalidate the intended protected-mode behavior.", "Synthesis tools omit the code between the\n\t\t\texclusion directives. The synthesized implementation\n\t\t\ttherefore does not contain the same assignment that was\n\t\t\texercised during simulation. This creates a\n\t\t\tsimulation/synthesis mismatch in security-relevant\n\t\t\tbehavior: the HDL model used for verification enables or\n\t\t\tdisables protected mode using logic that is absent from\n\t\t\tthe synthesized hardware."]}, {"xhtml:p": "Because the synthesized implementation does not\n\t\t\tinclude the same logic that was present during simulation,\n\t\t\tthe hardware defaults to an insecure state. An attacker\n\t\t\tcan take advantage of this to execute activities which\n\t\t\twould normally require some form of authorization, even\n\t\t\tthough simulation results suggested that protected mode\n\t\t\twould be enforced.", "#text_blocks": ["Because the synthesized implementation does not\n\t\t\tinclude the same logic that was present during simulation,\n\t\t\tthe hardware defaults to an insecure state. An attacker\n\t\t\tcan take advantage of this to execute activities which\n\t\t\twould normally require some form of authorization, even\n\t\t\tthough simulation results suggested that protected mode\n\t\t\twould be enforced."]}]}, {"Intro_Text": {"xhtml:p": "A hardware developer is designing a controller that\n\t\t  manages whether protected configuration registers can be\n\t\t  written. The controller includes states for reset handling,\n\t\t  user-level operation, and privileged operation.", "#text_blocks": ["A hardware developer is designing a controller that\n\t\t  manages whether protected configuration registers can be\n\t\t  written. The controller includes states for reset handling,\n\t\t  user-level operation, and privileged operation."]}, "Example_Code": [{"@Nature": "Bad", "@Language": "VHDL", "xhtml:br": [null, null, null, null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= RESET;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= USER_ONLY;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= PRIVILEGED;"}, "#text": "if auth_passed then\n\t\t\t\t  \n\t\t\t\t  end if;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= USER_ONLY;"}, "#text": "if privilege_revoke then\n\t\t\t\t  \n\t\t\t\t  end if;"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= USER_ONLY; -- intended recovery for unexpected encodings"}], "#text": "when RESET =>\n\t\t\t\t\n\t\t\t\twhen USER_ONLY =>\n\t\t\t\t\n\t\t\t\twhen PRIVILEGED =>\n\t\t\t\t\n\t\t\t\twhen others =>\n\t\t\t\t\n\t\t\t\tend case;"}, "#text": "case priv_state is\n\t\t\t  \n\t\t\t  end if;"}], "#text": "if reset_n = '0' then\n\t\t\t\n\t\t\telsif rising_edge(clk) then\n\t\t\t\n\t\t\tend process;\n\t\t\tprotected_cfg_write_en <= (priv_state = PRIVILEGED);"}, "#text": "-- The following VHDL example is written for VHDL-93 or later.\n\t\t  type t_priv_state is (RESET, USER_ONLY, PRIVILEGED);\n\t\t  signal priv_state       : t_priv_state := RESET;\n\t\t  signal auth_passed      : boolean := false;\n\t\t  signal privilege_revoke : boolean := false;\n\t\t  ...\n\t\t  process(clk, reset_n)\n\t\t  begin", "#text_blocks": ["-- The following VHDL example is written for VHDL-93 or later.", "type t_priv_state is (RESET, USER_ONLY, PRIVILEGED);", "signal priv_state       : t_priv_state := RESET;", "signal auth_passed      : boolean := false;", "signal privilege_revoke : boolean := false;", "...", "process(clk, reset_n)", "begin", "if reset_n = '0' then", "priv_state <= RESET;", "elsif rising_edge(clk) then", "case priv_state is", "when RESET =>", "priv_state <= USER_ONLY;", "when USER_ONLY =>", "if auth_passed then", "priv_state <= PRIVILEGED;", "end if;", "when PRIVILEGED =>", "if privilege_revoke then", "priv_state <= USER_ONLY;", "end if;", "when others =>", "priv_state <= USER_ONLY; -- intended recovery for unexpected encodings", "end case;", "end if;", "end process;", "protected_cfg_write_en <= (priv_state = PRIVILEGED);"]}, {"@Nature": "Bad", "@Language": "Verilog", "xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= RESET;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= USER_ONLY;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= PRIVILEGED;"}, "#text": "if (auth_passed) begin\n\t\t\t\t\t\n\t\t\t\t\tend"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= USER_ONLY;"}, "#text": "if (privilege_revoke) begin\n\t\t\t\t\t\n\t\t\t\t\tend"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "priv_state <= USER_ONLY; // intended recovery for unexpected encodings"}], "#text": "RESET: begin\n\t\t\t\t  \n\t\t\t\t  end\n\t\t\t\t  \n\t\t\t\t  USER_ONLY: begin\n\t\t\t\t  \n\t\t\t\t  end\n\t\t\t\t  \n\t\t\t\t  PRIVILEGED: begin\n\t\t\t\t  \n\t\t\t\t  end\n\t\t\t\t  \n\t\t\t\t  default: begin\n\t\t\t\t  \n\t\t\t\t  end"}, "#text": "case (priv_state)\n\t\t\t\t\n\t\t\t\tendcase"}], "#text": "if (!reset_n) begin\n\t\t\t  \n\t\t\t  end else begin\n\t\t\t  \n\t\t\t  end"}, "#text": "localparam RESET      = 2'b00;\n\t\t\tlocalparam USER_ONLY  = 2'b01;\n\t\t\tlocalparam PRIVILEGED = 2'b10;\n\t\t\treg [1:0] priv_state    = RESET;\n\t\t\twire      auth_passed;       // Implicitly 1-bit (boolean equivalent)\n\t\t\twire      privilege_revoke;  // Implicitly 1-bit (boolean equivalent)\n\t\t\twire      clk;\n\t\t\twire      reset_n;\n\t\t\twire      protected_cfg_write_en;\n\t\t\t...\n\t\t\talways @(posedge clk or negedge reset_n) begin\n\t\t\t\n\t\t\tend\n\t\t\tassign protected_cfg_write_en = (priv_state == PRIVILEGED);", "#text_blocks": ["localparam RESET      = 2'b00;", "localparam USER_ONLY  = 2'b01;", "localparam PRIVILEGED = 2'b10;", "reg [1:0] priv_state    = RESET;", "wire      auth_passed;       // Implicitly 1-bit (boolean equivalent)", "wire      privilege_revoke;  // Implicitly 1-bit (boolean equivalent)", "wire      clk;", "wire      reset_n;", "wire      protected_cfg_write_en;", "...", "always @(posedge clk or negedge reset_n) begin", "if (!reset_n) begin", "priv_state <= RESET;", "end else begin", "case (priv_state)", "RESET: begin", "priv_state <= USER_ONLY;", "end", "USER_ONLY: begin", "if (auth_passed) begin", "priv_state <= PRIVILEGED;", "end", "end", "PRIVILEGED: begin", "if (privilege_revoke) begin", "priv_state <= USER_ONLY;", "end", "end", "default: begin", "priv_state <= USER_ONLY; // intended recovery for unexpected encodings", "end", "endcase", "end", "end", "assign protected_cfg_write_en = (priv_state == PRIVILEGED);"]}, {"@Nature": "Good", "@Language": "Algorithm", "xhtml:p": ["Do not rely on a VHDL others choice or Verilog default\n\t\t\t  branch to guarantee post-synthesis recovery behavior for\n\t\t\t  security-critical state machines. If recovery from\n\t\t\t  unexpected state encodings affects access to protected\n\t\t\t  configuration registers, the implementation should not\n\t\t\t  depend on synthesis inferring and preserving that\n\t\t\t  behavior from RTL alone.", "For this type of security-critical controller, implement\n\t\t\t  the state machine using a carefully-controlled\n\t\t\t  structural or hand-synthesized representation where the\n\t\t\t  relevant state elements, reset behavior, transition\n\t\t\t  logic, and fail-closed recovery behavior are\n\t\t\t  explicit. Be careful that the synthesiser does not infer\n\t\t\t  a state machine from the crafted logic, and \u201cundo\u201d the\n\t\t\t  work. Review the resulting gate-level or structural\n\t\t\t  implementation to confirm that unintended encodings are\n\t\t\t  handled as required.", "Perform post-synthesis simulations where faults are\n\t\t\t  injected into the state registers and confirm the\n\t\t\t  behavior.", "Perform formal analysis to prove that the behavior of\n\t\t\t  these critical blocks has not been altered by the\n\t\t\t  synthesis process.", "After the implementation is verified and validated,\n\t\t\t  preserve it during integration so later synthesis or\n\t\t\t  whole-design optimization does not re-encode, merge,\n\t\t\t  remove, or otherwise transform the security-critical\n\t\t\t  recovery logic.", "This approach is costly and design-specific, but it is\n\t\t\t  appropriate when relying on ordinary RTL synthesis would\n\t\t\t  create unacceptable security risk."], "#text_blocks": ["Do not rely on a VHDL others choice or Verilog default\n\t\t\t  branch to guarantee post-synthesis recovery behavior for\n\t\t\t  security-critical state machines. If recovery from\n\t\t\t  unexpected state encodings affects access to protected\n\t\t\t  configuration registers, the implementation should not\n\t\t\t  depend on synthesis inferring and preserving that\n\t\t\t  behavior from RTL alone.", "For this type of security-critical controller, implement\n\t\t\t  the state machine using a carefully-controlled\n\t\t\t  structural or hand-synthesized representation where the\n\t\t\t  relevant state elements, reset behavior, transition\n\t\t\t  logic, and fail-closed recovery behavior are\n\t\t\t  explicit. Be careful that the synthesiser does not infer\n\t\t\t  a state machine from the crafted logic, and \u201cundo\u201d the\n\t\t\t  work. Review the resulting gate-level or structural\n\t\t\t  implementation to confirm that unintended encodings are\n\t\t\t  handled as required.", "Perform post-synthesis simulations where faults are\n\t\t\t  injected into the state registers and confirm the\n\t\t\t  behavior.", "Perform formal analysis to prove that the behavior of\n\t\t\t  these critical blocks has not been altered by the\n\t\t\t  synthesis process.", "After the implementation is verified and validated,\n\t\t\t  preserve it during integration so later synthesis or\n\t\t\t  whole-design optimization does not re-encode, merge,\n\t\t\t  remove, or otherwise transform the security-critical\n\t\t\t  recovery logic.", "This approach is costly and design-specific, but it is\n\t\t\t  appropriate when relying on ordinary RTL synthesis would\n\t\t\t  create unacceptable security risk."]}], "Body_Text": [{"xhtml:p": ["The design relies on a VHDL others choice or\n\t\t\tVerilog default branch to express recovery behavior for\n\t\t\tstate values not explicitly listed in the state transition\n\t\t\tlogic. In RTL simulation, the intended behavior is that\n\t\t\tunexpected controller states will transition to USER_ONLY,\n\t\t\twhere protected configuration writes are\n\t\t\tblocked.", "The error is assuming that this RTL-level\n\t\t\trecovery behavior will necessarily be preserved after\n\t\t\tsynthesis. During synthesis, the state machine may be\n\t\t\tencoded, optimized, or transformed based on the states\n\t\t\tconsidered reachable during normal operation. As a result,\n\t\t\tlogic associated with unused or faulty hardware encodings\n\t\t\tmay be removed or altered, and the synthesized\n\t\t\timplementation may not preserve the same recovery behavior\n\t\t\tthat appeared in RTL simulation."], "#text_blocks": ["The design relies on a VHDL others choice or\n\t\t\tVerilog default branch to express recovery behavior for\n\t\t\tstate values not explicitly listed in the state transition\n\t\t\tlogic. In RTL simulation, the intended behavior is that\n\t\t\tunexpected controller states will transition to USER_ONLY,\n\t\t\twhere protected configuration writes are\n\t\t\tblocked.", "The error is assuming that this RTL-level\n\t\t\trecovery behavior will necessarily be preserved after\n\t\t\tsynthesis. During synthesis, the state machine may be\n\t\t\tencoded, optimized, or transformed based on the states\n\t\t\tconsidered reachable during normal operation. As a result,\n\t\t\tlogic associated with unused or faulty hardware encodings\n\t\t\tmay be removed or altered, and the synthesized\n\t\t\timplementation may not preserve the same recovery behavior\n\t\t\tthat appeared in RTL simulation."]}, {"xhtml:p": ["If the synthesized implementation does not\n\t\t\tpreserve the unexpected-state recovery behavior, the\n\t\t\thardware may fail to return to USER_ONLY after a fault,\n\t\t\treset anomaly, voltage glitch, clock disturbance, or other\n\t\t\tcondition that places the state storage into an unintended\n\t\t\tencoding.", "An attacker who can induce or influence such\n\t\t\tconditions may be able to leave protected configuration\n\t\t\twrites enabled, or cause them to become enabled, even\n\t\t\tthough simulation suggested that unexpected state values\n\t\t\twould be forced into a state where those writes are\n\t\t\tblocked."], "#text_blocks": ["If the synthesized implementation does not\n\t\t\tpreserve the unexpected-state recovery behavior, the\n\t\t\thardware may fail to return to USER_ONLY after a fault,\n\t\t\treset anomaly, voltage glitch, clock disturbance, or other\n\t\t\tcondition that places the state storage into an unintended\n\t\t\tencoding.", "An attacker who can induce or influence such\n\t\t\tconditions may be able to leave protected configuration\n\t\t\twrites enabled, or cause them to become enabled, even\n\t\t\tthough simulation suggested that unexpected state values\n\t\t\twould be forced into a state where those writes are\n\t\t\tblocked."]}]}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2025-51678", "Description": "The synthesized netlist incorrectly calculates\n\t\tmemory addresses and fetches co-processor instructions,\n\t\tpotentially causing unintended memory accesses or incorrect\n\t\tcustom-instruction execution.", "Link": "https://www.cve.org/CVERecord?id=CVE-2025-51678"}, {"Reference": "CVE-2025-51677", "Description": "Debug-load requests should return complete load\n\t\tstore unit (LSU) data, but the synthesized netlist returned\n\t\tincomplete data, potentially causing incorrect interpretation\n\t\tof memory state.", "Link": "https://www.cve.org/CVERecord?id=CVE-2025-51677"}, {"Reference": "CVE-2025-51679", "Description": "Instruction execution should update\n\t\tprogram-counter state correctly, but the synthesized netlist\n\t\tproduced incomplete or undefined updates, potentially causing\n\t\tunintended control flow.", "Link": "https://www.cve.org/CVERecord?id=CVE-2025-51679"}, {"Reference": "CVE-2025-51675", "Description": "The program counter should update when the\n\t\tnext-program-counter value changes, but the synthesized\n\t\tnetlist allowed stale PC state, potentially causing incorrect\n\t\tinstruction fetches or stalls.", "Link": "https://www.cve.org/CVERecord?id=CVE-2025-51675"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-1552"}, {"@External_Reference_ID": "REF-1553"}, {"@External_Reference_ID": "REF-1554"}, {"@External_Reference_ID": "REF-1555"}, {"@External_Reference_ID": "REF-1556"}, {"@External_Reference_ID": "REF-1557"}, {"@External_Reference_ID": "REF-1558"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Since this entry is often resultant, there might be\n        other CWEs that are more appropriate as the root cause,\n        although there might be some gaps.  Carefully read both the\n        name and description to ensure that this mapping is an\n        appropriate fit. Do not try to 'force' a mapping to a\n        lower-level Base/Variant simply to comply with this preferred\n        level of abstraction.", "Reasons": {"Reason": [{"@Type": "Frequently-Resultant"}, {"@Type": "Acceptable-Use"}]}}, "Content_History": {"Submission": [{"Submission_Name": "Raghul Saravanan", "Submission_Organization": "George Mason University", "Submission_Date": "2025-05-20", "Submission_Version": "5.0", "Submission_ReleaseDate": "2026-10-28"}, {"Submission_Name": "Sudipta Paria", "Submission_Organization": "University of Florida", "Submission_Date": "2025-05-20", "Submission_Version": "5.0", "Submission_ReleaseDate": "2026-10-28"}], "Contribution": [{"@Type": "Content", "Contribution_Name": "CWE Ad Hoc RTL WG", "Contribution_Date": "2026-03-30", "Contribution_Version": "5.0", "Contribution_ReleaseDate": "2026-10-28", "Contribution_Comment": "Participated in a series of\n\t\t\t\t\tmeetings betwee March 2026 and September 26, in\n\t\t\t\t\twhich members contributed significant feedback\n\t\t\t\t\trelated to this entry as it evolved before\n\t\t\t\t\tpublication in CWE 5.0."}, {"@Type": "Content", "Contribution_Name": "MITRE", "Contribution_Date": "2026-03-30", "Contribution_Version": "5.0", "Contribution_ReleaseDate": "2026-10-28", "Contribution_Comment": "Guided evolution of the name\n\t\t\t\t\tand description for this entry, followed by\n\t\t\t\t\tsuggestions for mitigations, demonstrative\n\t\t\t\t\texamples, and detection methods. Note: some\n\t\t\t\t\tcontent development was AI-assisted, with expert\n\t\t\t\t\treview and editing by MITRE and members of the CWE\n\t\t\t\t\tAd Hoc RTL WG."}]}, "entry_type": "Weakness"}