This repository holds all code used to check if SonicBOOM is susceptible to Spectre attacks. These attacks are implemented based on the boom-attacks.

This is working with the version of SonicBOOM located at this commit. We tested Small and Medium core configurations.

• Xilinx Vivado block designs for FPGA RISC-V SoC running Debian Linux distro from this repository.
  • OS: Debian Linux 64-bit OS with the kernel v15.11.16 with gcc v10.2.1
• Target FPGA: Kintex-7 XC7K325T-2FFG900C (on Genesys-2 board)
  • Core frequency = 100MHz
• Small core machine
  • 1-wide, 3-issue, 16KB D$ (2 MSHRs), 16KB I$, 512KB L2$
• Medium core machine
  • 2-wide, 3-issue, 16KB D$ (2 MSHRs), 16KB I$, 512KB L2$

The following attacks are implemented in this repository:

• Spectre-v1 or Bounds Check Bypass [1]
  • condBranchMispred.c
• Spectre-v2 or Branch Target Injection [1]
  • indirBranchMispred.c
• Spectre-v5 or Return Stack Buffer Attack [2]
  • returnStackBuffer.c

To build binaries and generate assembly codes you need to run make all. Note, make bin only creates binaries.

To build binaries and generate assembly codes for the Verilator simulation you need to run make allrv. Verilator elevates the CHISEL/Verilog codes to C++ to perform a "software" RTL simulation. We used Verilator v4.034 as part of the Chipyard framework. Note, make binrv only creates binaries.

Running make all (make allrv) builds linux binaries that run on the SonicBOOM machine. Binaries are located in the bin (binrv) folder and the assembly programs are located in the dump (dumprv) folder.

If you use SonicBOOM attacks in your published work, please cite it as:

@article{sabbaghsboomattacks,
  title={Secure Speculative Execution via RISC-V Open Hardware Design},
  author={Sabbagh, Majid and Fei, Yunsi and Kaeli, David},
  booktitle={Fifth Workshop on Computer Architecture Research with RISC-V},
  year={2021},
  month={June}
}

[1] P. Kocher, D. Genkin, D. Gruss, W. Haas, M. Hamburg, M. Lipp, S. Mangard, T. Prescher, M. Schwarz, and Y. Yarom, “Spectre attacks: Exploiting speculative execution,” ArXiv e-prints, Jan. 2018

[2] E. M. Koruyeh, K. N. Khasawneh, C. Song, N. Abu-Ghazaleh, “Spectre Returns! Speculation Attacks using the Return Stack Buffer,” 12th USENIX Workshop on Offensive Technologies, 2018