Hardware Security For Open Source Processors

Abstract

This thesis proposes several hardware security enhancements to the Rocket Core: an open source, general-purpose processor capable of running the RISCV open source ISA. Implementations of the Rocket Core such as the Rocket Chip and the BOOM core are among the first modern, open source architectures both fully silicon synthesizable and capable of supporting a full standard OS. As fully open source projects, these architectures have enormous potential even compared to current privatized chips regarding performance and security. However, as of today, Rocket Core implementations not significantly security aware. If Rocket Core chips are ever going to be competitive in a world of evolving security threats, these novel architectures should be reexamined through the lens of security-aware hardware development.Here, we first analyze the recent Spectre and Meltdown side-channel attacks in the BOOM cache and present vulnerabilities, caching variations and solutions. We discover that while immune to Meltdown, BOOM is vulnerable to several varieties of Spectre attacks. Additionally, we propose a secure Rocket Chip stack running the seL4 microkernel and Simple OS (SOS). Under this stack we also implement features from the Bastion security architecture to provide memory encryption and lay the groundwork for secure software modules and additional hardware protection features. This combination of memory and caching security solutions provides a varied and comprehensive look at the future for security in open source processors and lays the groundwork for the advent of an open source secure processor.