Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/102 Thanks!
Please welcome Dominic, also known
as by Theresa.
Computer scientist working on
reconfigurable hardware and processors
FPGAs and which
also brings with him a lot of
interest in computer security
and has already held
a lightning talk today on the topic.
And he's also a long time visitor
of hacker events and has
also already given similar presentations
at previous events.
And today, Dominic
will give us an introduction through
a process of design and describe
a small processor core
how it works, why
someone would write the processor
core himself. Maybe you
will talk about finite state machines.
I understand, and I don't create
hardware internals.
Unprocessed Santa Anas allows,
and you will last but not least show
us a demonstration.
I hope of how
Specter could be hidden in the processor
itself and used to exploit a
Linux system.
Thank you.
OK.
Can everybody hear me?
OK, thank you very much for this
introduction.
Welcome to my talk.
I'm amazed how many people are in
here, so we
just stop because we have only a few
time, only a few time.
Well, I'm a resource research assistant
here at the Hermit Schmidt University in
Hamburg. I normally walk with
runtime reconfigure of a systems system,
half which can change during runtime
of some computations and so on.
In my spare time, I like to
to program and FPGA
like hacking. I work a
lot of was politics.
And last but not least, I own
I do rowing.
If you want to contact me afterwards, you
can just use these contact information
and you certainly will reach me.
A hand out for this talk is available on
my home page. I think you
could have seen that in the far
plum, erm, later on the talk.
This handout might
help to follow some
some simulation I do on the slides.
I will start by some
small introduction.
I will tell you
what you need to.
Oh, OK.
I just forgot my Mike.
So I will give a small introduction
what you need to bribe your own processor
core. I will tell you a bit about the
functional principle of processor cause.
I will show you a bit of the
implementations and I give
will give a small presentation
of a very small processor core.
I've written at this year's
hacker camp in the Netherlands and
I will show you and
uh, it processor an arm core
which was written by a lab by a friend
of mine, which is actually
booting Linux.
And at the end, I will do a short
conclusion of what I showed you.
This talk is just an introduction.
I will do a talk nothing about
processor, performance, pipeline
or anything else, just about very simple,
unpatched processor core, which is often
used in educate students.
So the first thing you
can ask us which requirements
are which are the requirements
to build and process, of course.
What do I need if I want to do it at
home? Well, the first thing you need
an FPGA.
I think some of you have to
talk before mine.
Its advice about FPGA
is different FPGA bots, which are
available for the hacker community.
Here you can see a small fraction
of bots which are available, which with
which I've worked.
They are from cheap
to expensive ones.
I think the the small one at
the bottom just cost 50 euros
and the very big one at the right.
It's a prototyping bot where you can fix
everything you ever want.
It just costs 10000 euros,
so you have everything from small to
big, from cheap to expensive.
You can see on some of these components,
some of these bots, a lot of external
components like arrested two
hundred thirty two SDRAM,
A, C, D, displays, DV
or anything is a real thing what you
want.
So we just start
with a small one.
And what you always need is
a serial cable because you need
debug. You always need DBA.
Dybbuk is very,
very, very important.
And that's not all the way to get simple,
very simple hiebert code from
out of the FPGA just to use
a serial cable.
The next thing you can use is a logic
analyzer. A logic analyzer always
is very basic. You have to connect it to
a lot of pins and, well, it makes
your life very hard.
But at the end, if you do not get
enough debug code out of
the ray cable, you will just have to use
a logic analyzer.
The next thing you need is some, some
knowledge about some hardware description
language.
There are some hardware switch and
the switch from language available
very like this one, and we still have the
other one. I personally prefer we
HDL and for
for we each day, there are some very nice
documentation and tutorials available at
the University of Hamburg.
I have put some the URLs
on the slides, so you can afterwards
look at them. If your knowledge about we
still are very lock is not
good enough to write process, of course.
May I ask how many of you have
experience, but we are still
OK? That are some.
That's cool.
So the next unit
is some start up knowledge about
processor design.
That's the topic of this talk for, well,
for the most half of the talk.
So how do you write and
process car?
What do you need?
First of all, a process I was never
running alone.
In most cases, you don't have the
processor and it's just the processor.
You always have some RAM, some random
access memory and some
kind of device where you can output your
your data or you can input your data.
In this case, we are just talking about
some fundamental architecture.
You have instructions and data
in the same RAM. You see it on the
on the left side and you
have an siru device connected
with
memory i o
to the same address and database.
Another architecture you can have is how
what architecture there is.
The instruction RAM and data ram are
completely
different ramps.
That's a bit more secure.
So you can see
that I highlighted irrigates
the file into the processor.
Core processor always have some very
fast
storage memory inside the processor,
though, so it can calculate very
fast and does not need to access it
any time. But I want to execute
an instruction.
This is an instruction set off
of a process of call I describe here.
They are not very much instructions.
If you look at the instruction set of
an arm processor core
or an 86 processor
core. It's much more.
More instructions.
These are just the essentials.
Just some instructions for
you. You need to get the process of
running.
Via GIPHY With instructor set before
designing the processor, I will
explain later and the hand
out. You can see this instruction set
also. So you can follow the next slides
more easily.
You see at the top the
early instruction it's followed
immediate.
With this instruction, you can load
some immediate, some value into
the entire register file of a process
of car.
It's just to get any data
into the processor without loading from
memory.
The other another instruction is that
instruction. I think all of you know that
you just add two registers
to their use from the registers
and the processor core and save
the result into another processor core.
You can see it now and
at a destination
address off the register and
and one and opera and two in
it, just in addition to
another
instruction we need on
the next slides. It's a
jump zero instruction.
You see it at the bottom.
It's it's jumping
to another address in
the source code, in the assembler code,
in the room.
If the last operation has
returned is zero value.
So if you add two two
values and the result is
zero.
For example, if you add two zeros,
you can jump was jump zero to another
address.
The last instruction I will explain, it's
a jump instruction. It's an unconditional
jump. You just jump to the
address assigned to the as
a parameter and you the
code execution starts from that.
On,
we start with a very small C
program.
It's a very simple multiplication
without command line parameters.
Some of you will notice that I have left
everything unnecessary away.
We just want to add to the five
and to six and want to save the result
in the reside variable.
And we are just doing it with a follow
up.
The next step everyone needs
everyone to use us with.
If it's writing see code is he is
just running the compiler.
We will do that by hand.
We will. We will compile without
optimization because if we want, if we
want to turn on optimization,
the actual assembler code would be empty.
And because we'd
output nothing, we just save something
in some register and that's the output.
So the compiler would just drop
everything.
You can see
that the the first line in the
UM
in the C code is mapped
to the first line in the assembler
code, and it's just doing and load
immediate. So we just load
the five into the first
register.
This means the
the one here, the first register, not
the resistor zero register
one below the five into it.
The next steps are
very similar.
Here we just select a next register
and load the sick as a fix.
And because we have the
reciprocal variable and
we initialized it to zero, we just
do that with our third register
to
the next step.
First, we have to implement the loop.
The loop is just
implemented with another
register where we put the one because we
want to increment the loop
every loop with a one.
So we have to put the one into the
process of so you can do the computation.
And the loop is just we.
At the start
request, we save
the addition of of, um,
register three and register one
into registers three registers
three.
Oh, here
is a result variable we we just defined
at the beginning.
After that, we just
decrement.
Yeah, we just decrement
here, we have a copy of it to
the first operand, to another register
to sew so we can quantify it
without losing the parameter.
So we we have
I've done that was an ad because we have
no move instruction in our instruction
set. We have to two at zero
took to save it to another register.
So this battery with
rests are five four.
We subtract by by one
and
at the end, if we have
zero in the last operation,
we jump to end.
And if it's not the last
substructure, we just start
to loop again.
That's just what the compiler normally
does. It just takes the C code
and puts out the assembler code.
You might see that
I do not use any RAM because
if we wanted to use RAM,
everything would get more complicated.
We would need some instruction
to load and store data to the RAM.
I just quit that and
we are just doing it into the processor
against us.
Process loss normally only
understand binary numbers, you can
kind of just say, Hey, he had do Annette,
you have to encoded in some some
kind. And in this case, we have
a 32 bit instruction, but
and we have somehow encode our
instruction into this.
You can see it.
This is a two format instruction
set architecture.
We have one instruction format.
When you put an up code in the front,
the reciter register is encoded
in the second four
register four bits.
The upper end and the next
four bits and other to
in the next four bits.
And you have some space left
with this, which is not used
in this instruction format.
And that's that instruction format is,
for example, for the load immediate
instruction where you just require an
up code and recite
a register and the immediate
you, which which is just 16 bits.
You see that the result operant
one and upper and two and the opcode
at fixed positions in the instruction set
format. So we are later when we are
developing the process of core,
which is much simpler to select.
Select the operands if they are at
fixed positions and not always
at every instruction, at a different
position.
Some instruction set do that
for the instruction
we will use.
I have put the code on
the slide
that is just some binary representation
of the instruction.
You can just count
through. I think I did that, so I
started with a first instruction and
count it down to two some somewhere
you.
The next step you have to do is you have
to create, you have to assemble it.
You have to create a
binary code from the monarchs,
which are in the assembly code.
And another thing is if you have if you
do not have an operating system, you
have to create an image
in the correct byte order of the
processor core to get it running.
You put the RAM image somewhere in
the RAM. Jump there and start
executing executing these instructions.
In my case, I put everything
at a start at at addresses
zero and everything follows down.
You can see it here.
I have put the address at the front
and you see here the opcode.
If you remember from the from the
previous slide, you can see that this is
the code for the load immediate
instruction.
This is
the
register one.
The inside register.
The next to register
operations are ignored and
you put the immediate the five
in a binary representation in the
immediate field.
In this case of this, everything this
simple view, because normally you have
byte addressing in the processor core
AI and you
have to select, which is the most
important byte in a word.
So I just said, well, we have
what addressing and put every word into
one address, so we don't
have to
to think about that.
So random access memory
you have, you have to to just
think about it a bit.
We have what addressing that is.
We if we put an address to the
RAM, it always selects 32
bits and not eight bits.
If we put
it
and put the IOC operation
signal high, we want to read from them.
And if we put it low, we want to
have right to the RAM.
The address is put at this
six 16 bit signal
and you can
select which word you want to write or
read from. And this is a bidirectional
part so you can get the
32 bit data in and out
of this room.
The last signal enables
sickness just if you want to save power
so you can deactivate the RAM if you
are not using it.
I hope everyone can see that this is a
data part of the process of call,
which
for which he has just
created the instruction set architecture.
You have a fetch decode
component.
This is our responsibility to fetch
the instruction from the RAM and
decode it so that the
other components can work with the data.
You can see we have a program count,
a jump register
at an address song
and
the program count.
The address is saved where we actually
are in the code.
For example, we always start at
a PC of zero and the
jump register you save the
where you. If this jump instruction is
encoded, for example,
Jump Zero comes in.
You save the jump address
because the
jump is actually used
as a way to edit a step
later. So we have to somehow save
the way you somewhere.
And it's even with the address rate
register,
for
example, then you want to read
from RAM, you have to save the address
you want to read from somewhere.
But that does not
is not important for us at the moment.
The next very important component
is the register file.
It contains
32 general purpose
registers where you can save
and
load data from, as
I
showed in the assembler example
and the Fetch Decode unit
is
dividing the instruction format
to the
correct values. For example, the upper
and
the upper end.
One
value is put to the register file
at the top signal, then
the upper two and last the
resized register.
So the register file knows on which
registers to operate when the actual
computations taking place.
Then we have to use a critical
and logical unit.
This component is just
for doing the real computation, for doing
the additions of subtraction
or
combining with X are
everything you can think about,
and
this component just needs the op code
of the instruction.
Causes up up code.
It's encoded which operation to
to use, for example, and add or a sap
or whatever,
and
it actually needs the immediate value.
If you want to load an immediate or at
an immediate to another where you just
have to put it into the EU.
The you get the actual
the actual operant from the register
files because in the instruction
set you only say Edge register
one to Edra to register two
so
that you
require the actual values which are saved
into the ISA registers.
So Register File puts these values
out here to the U.
And if the last operation
was a zero R
carry, which we just ignore at the
moment.
So we have some control signals
left.
We have an address, lecture
and increment PC a jump.
Here's an output of the op code
and we often load enable to the register
file because we
only want to save
something to address stuff when we really
want to save it.
So was this data pass we just could
as a as a human being, just do some
simple computations and
we would have to
control this data path by ourself.
But that's not what we want.
We want that.
The process, of course, automatically
selecting the correct instruction is
doing our computations or saving
everything in the correct registers.
So we need a control unit
which does actually this.
You see just some another component
with all the control signals
coming in and going out
to the data path.
You can see it again.
These all these control signals go
into the control
unit and the control unit decides
what to do,
and the lack is the exact
correct output
signals.
Yeah. The theory behind this is
so the control unit is the most
interesting part of the process I call.
Call it there you can can achieve
the later, the performance improvements
and everything else.
So it is always
used.
It's always implemented as an
finished state machine.
And you can see here are the theoretical
descriptions the definition of a state
machine. There are some
multiple state machines, implementations
of state machines available, for
example, merely more.
If so, we just stay with a more
implementation.
And that's all I want to give on theory.
So we just switch to an
example finished state machine graph.
We have a stop state at the top,
it seems to the load state
in the load state.
The processor core fetches instruction
from the RAM and just
holds it for step.
And the next step we jump
to the decode stage.
We cannot jump to any other state.
We just go to the digital stage in
the decode stage. We just
put the right signals to our register
fire, to our view and so
on.
And in this case, we decide
in which next state we jump.
According to the code we have.
If you have an instruction
jump instruction, for example, jump zero,
we have to check if
the opcode is a jump zero and we
have to check if our last instruction
has.
The last reside was zero.
And then we jump
to this state and otherwise we jump
to execute the actual instruction.
Now we come to a small
simulation of this process,
a call, you see the data path I just
played earlier.
And you see
the RAM
on the front.
The simulation is also in the hand out,
so you can better follow these slides.
And at the bottom, you have the control
unit.
You see, at the moment, we are
in the state load.
We want to load some data from the RAM.
And the first instruction we want to load
is at address zero because the
program counter is set to
zero.
The first instruction is at the top
here. It's a load
each
of the five into the first, into
a register one.
And you can see nothing happens at the
moment here.
Just only
the control unit puts.
We want to read from the RAM.
You want to enable the RAM
and.
Yeah.
And the opcode
is at the moment shift left because
we have nothing to decode.
The next step is we decode
load and load instruction.
We have just load
it. And you can see that a retired
register at this Tickner
just jumps to the one.
And that here
the the op code for the instruction.
What we what we want to do is jumping to
the Leaf,
though,
so we have now decoded the instruction.
The data pass knows what to do
and then the next step
we are doing
both.
That execute early in
this state, we execute the
actual
instruction.
You can see that the EU
is putting the six
further into the register
file
and the
control unit is selecting
A to enable.
So you can
select where where you can be saved into
the process of car.
This is a I just have some more slides,
but I think I'm very I'm running out of
time. So,
yeah, so I have a presentation to do so.
It's just I
switch to a more interesting
instruction. You see, that's all the
the load immediately we have.
It's the first time from
the C coach is a simpler code
to the binary representation.
And in this case, we have an asset
we load and at this moment
and Annette from
the riggers register five to register
zero and register zero
only you can look
it up here.
That's a zero.
So it's not very interesting,
but it's actually
a load, and you can
see that the PC has actually incremented
to the address here.
And if we switch to the decode
stage, you see that
register the row and
register to the lected as the operands
and register five ETA
as a result, register
you have
an add up code the EU.
You knows what you're doing in the next
step, and the control
unit knows that it's not
a jump so it can put the right
values at the signals in the next step.
The next step is the execute stage
we execute and the ET.
Well, you can see here
the upper end one is the euro.
The operand two is six.
Yeah, the result is six.
Next time, I think I will put a more,
more interesting simulation
into these slides
and
the control you register.
The control unit is
saying to the register file that it's
actually required to save this
value, which are
lying here and.
Yeah, it's now we come to the actual
implementation, the actual implementation
is done and we did it runs at
the moment on Vertex and Spartan FPGA
of Xilinx Inc..
And it's mostly for simple teaching
purposes.
Students I talked to, I
want to explain processor design.
I always give this process also where
they could yet learn
from it.
The control unit is the most interesting
and the most important part of the
processor core, and its implementation
implemented was a finished state
machine. And you can see here it's a
well, it's a case statement, and we feel
it's very similar to the case statement
in C.
So most of you should understand
what it's doing. It's just looking
in which state we are.
We just simulated if we are in
the load state, we always jump to the
decode stage. We have no no eternities.
If we are in the decode stage,
we just check
which
instruction, which opcode asla is
actually loaded
or decode it, and we
jump to the correct state in the
control unit to actually
compute to this execute.
Is this an instruction?
This is the output part of the
control unit, you have seen
that the actual values of the control
unit change in every state.
And in this case, I just
show it when we under load stage,
we select the drum we want to read
from the RAM. We do not want her to
write to the register file.
We want the RAM enabled because we want
to read from it.
We do not.
We do not want to decode an instruction.
The Aussie load instruction is actually
an OCD code instruction.
And if you want don't want to
select the next PC,
but we want to select the address
that it's the address
in the PC onto the
address bus.
And if decode stage, it's a bit
different.
We um,
we do not require the RAM so we can
disable it to save some power or anything
else and set the
other sickness, in addition,
according to the decode stage.
This is actually the complete
implementation of the register file, it's
just some part of the
the entity description we feel is
missing.
So we have just 32
registers and
on every clock tick every process.
Chorus is
it's running at a site and clock speed.
So at every clock tick, if we have
a load enabler, we save to the register
file. And if we
have no load enabled, we do not do
anything.
But we put always
the
selected register file to the outputs
and everything is fine.
Yeah, it's no.
I've wanted to do a small presentation.
This process, of course, I just
introduce
is running at 30 megahertz on
a vertex, five FPGA, I've just put
here in the front.
I have a self written assembler in part
for it because there is no assembler
for this kind of architecture because
I just made the instruction set up
for myself.
So I have two to think
about an instruction set
about an assembler.
So now
I hopefully would get it running.
You see, I just using money from a very
old a terminal emulation program.
I have to select specific
Syria
where use.
You.
And now I have to program the
FPGA.
Yeah, and you see just the simple
output where you can say, well, that's
the my, my Arduino and my
my Raspberry Pi can do that very
much faster and much more.
Yeah, well, either.
Yeah, yeah, but this is running on my
own processor call.
I have rooted myself.
So it's a name
graphic processor core because if
I was a member of the Garafolo Village
at the last Kemps,
so and next I want
to show you this and
to.
Yeah.
I didn't thought about
how to of the right slides.
Though.
Yeah, the next process I want to
to
present is a partial
reconfiguration of the path, the
partial, reconfigurable, heterogeneous
system. It's a button by a friend
of mine, Marcel Eckart, at our
university. It's an arm 810
no thumb. It's running at 100 megahertz
was 40 Budgam.
It's under Linux and it's doing
120 megabytes.
Read from RAM and
95 megabytes right to
rim.
It's has a full moon
cache and it's a Harvard architecture, so
it's so data and instructions are
separated.
I hope I have to select the
another
trade.
So you
won't see the whole
boot
process because the DVD adapter,
it's not working with a with a beamer
here, so I can only show you
the first steps of the boot process.
You can see here the arm booting the
Linux kernel.
It's running at 100
megahertz. It's not very fast, but very
fast for some implementation
on a soft core as a soft core on an FPGA.
So now we have to wait for some seconds
so I can until I can
ping
the Linux running on to it.
I think that will require a
minute or so.
This processor core is currently not
available on the open source because
my colleague is doing its
his Ph.D.
thesis with US processor core, and we
suddenly have problems
because of some license issues
off the internals of the arm processor.
We are currently not sure if you
are able to to open source it
because ARM has the license up
to
enter to produce arm process,
of course. And we do not own a license
and fox.
For most of all, we do not own a license
to make it open source.
We really would like to do it, and if we
have time and our
our department is able to
actually
solve this issue, it all with a license
as we will make it open
source and make it available for the
community.
So
I hope.
Yeah, it's currently running a
Linux, Debian, Linux,
and I hope that the
the
the C.F.
cart is very slow, so the the
boot process requires a lot of time
because it wants to to delete from the
temp directory and so on.
What I want to show you is this process
of core is just
as any other process occur.
It's just written somewhere.
And if you
if you
add some lines of code,
this is execution stage of the arm
process. Of course I can show you.
And if you
you look here, there's some backdoor
code.
If you if
you look and compare it to the rest
around it, you won't notice any
great differences.
This is just an operation it checks if
a certain operation is selected
in certain operation and if the procedure
is a part of this
operation, for example an arm, you can
add an enregistre to shift
the second upper end
about
somewhere about some bits,
according to the value in this last
register and arm documentation says
Please don't use the PC
at this register.
So we just check if we use
this.
The PC at this pushes position
and we jump from the normal
user mode of the processor core in
security mode or in system mode
and disable or interrupt.
So we weren't interrupted by the
operating system.
So I hope the processor
is has booted.
The system has booted.
I think it's better.
Yeah,
I
just put it here.
So I just log in.
You see, I lock NSA as
yeah, as anyone, as just the simple
user if byte.
And we are locked in and
you can see I'm just whereas
I know root and other thing else.
You can see if you if I put procs,
if you
info,
you just see what what kind of armor it
is.
Yeah.
And now I can
just run the
backdoor.
The backdoor is just accessing the
normal kernel memory, and it's trying
to find its processor structure and
change the value of my, my
user and my group identity
to the identity of Root.
That would normally not work because
the operating system and the
menu protects this memory.
But because I have a special
instruction to jump into
into into system mode
and we disable all interrupts, we can
just search through the whole memory
of everything else and get
through it. If you can see it, well, I'm
route now. I can do anything.
I can even care to
the shadow.
And if I wanted, I could change every
password and everything else.
So I just jump
back to my slides, I think
because I have only some minutes
left.
You know, sometime I
knew how to get the overview in the press
after it was elected.
Correct slide but currently I
think I'm too nervous to find it,
so I have to go through all my slides.
Yeah, here it started.
So security consideration, but
I showed you how a backdoor can
be implemented in a very
yeah, in a small processor core.
It's either hidden
structures are also possible.
You can add additional registers, you can
add additional features, and these
features won't be detected detectable
because you can check if a feature
is available, but you cannot check if a
feature a feature is not
available.
You have to to just check everything and
every instruction with every combination
of everywhere you you ever can
think about. This won't work.
So in any hard core processor
core, you own every home, every
x eighty six and everything.
Some backdoor could be implemented
because you only require six lines
of code to implement such
an backdoor.
And if you remember how the the NSA
is actually putting
code into other open source
and closed source project to
try to influence the security of
these systems, it can also be possible
that in every processor, call your own
is such a backdoor and you do not know
that and you won't.
You cannot
fight against it in software because
it's in hardware, and the hardware only
needs to deactivate all interrupts, and
it's just running one program alone
on the car.
So why should I build my own processor
car?
Well, it's not simple to build one,
but
a lot of other processors exist.
But yeah, we can
get independent from them, from the
major processor manufacturers.
We can.
Yeah,
well, you know, the code of the processor
call you wrote you can find back to us
because you know the code, you can make
it open source. You can share it with
friends. You can at crypto functions,
you want it.
You can add everything you want,
every
instructions you need.
You can just put it into it and use it,
and everything is fine.
So.
Yeah, so everyone can
can his own processor core
half could be compromised?
And yeah,
I just want to motivate everyone
to start writing open source process, of
course.
Yeah. And thanks for the tension
questions.
Thank you very much.
Since the next talk is going
to start in an hour from more than an
hour from now, we do actually have some
time.
So are there any questions,
please, from IFC?
Not at this time.
Yes, please. If you have questions,
please line up in front of the microphone
microphones.
Please.
So your program will SPG
via Visa Visa, all
right.
Excuse me.
Glenn, your programing and
SPG, right?
Yes. And.
And what if the FBI continues to
backdoor?
Yeah, that's another problem.
Right. So this doesn't take anything
else.
This layer, it's it's it gets you
deep as deep
as you get into these hardware, the
more hard it's tougher to write
actually the backdoor, but it's it's
possible to.
OK, thanks.
Please. What kind of
FPGA or what size do you need
for something like this?
How you demonstrated.
I think around 50000
slides you
require because you always need
addition to the memory controller and
Mamu and everything else.
I think you can.
The the the processor core,
it's surface just 10000
slices on an FPGA.
I don't know much about FPGA.
Is that much of.
Yeah.
From this, this board RF
here, I just
put it up.
The actual process, of course, is half
of this chip.
So it's actually, yeah,
it's much for this processor, for this
FPGA, but a lot of bigger
FPGA is available
where you can put three five six
seven of these arm cores and
power on and onto it.
Thanks.
Thanks, Chris. Please.
So we know
how to hold it.
For example, she called and told the
other languages we use right now.
But you showed that this backdoor is
actually not really discernible
from the rest of the video, but we
have actually if you have an open source
poster, how can you actually know what
it's doing and that it doesn't have any
backdoors?
Yeah, it's the same question for every
open source project
you have to go to.
Well, you have to hope that anyone
who has kept a capable of actually
understanding the code is actually
reviewing the code and making sure
no backdoors into it.
So the same questions it's for
for open SSL, for example,
how do you know that there is no backdoor
into it? You hope that the right
of measures are just good
enough to find such backdoors
and everyone would be able
to to review these these
code. So is much more
security into this than
injustice closed process?
And so
there's a question from RC
Iris.
So one question from us is,
can you could you have a backdoor
in the Bechdel compiler?
So I mean, if it's
closed source who you could have a
like a self-replicating backdoor,
like trusting just trust problem?
Yeah, yeah, that's a problem.
There are actually no open source tools
for doing wheelchairs
and tasers and
anything like that.
I think the first step is to get in
a good community running form, writing
open source process, of course, and open
source hardware.
And afterwards you have to fork some part
of this community to actually write
their own their own synthesis tools
like it's done with the G6E project or
LVM or anything else.
Next question, please.
It's great to have those tools available
for FPGAs, but
FPGA is, well, catalyst for when it comes
to.
Yeah, they are not too efficient when
you're on the television.
So what would be needed to
put those designs to real
silicon?
It's not.
It's only a small problem.
Normally you can just take
the DNA code and send
it to a manufacturer, and that
the manufacturer will look over the code
and say, Well, you have to improve it.
They are there to get the good silicon.
And afterwards, you can just produces for
some, but very much thousand
years.
How? How much?
How many pieces would need
to be produced so that it's not that many
thousand euros anymore per piece
too much?
OK, thank you.
On the right, please.
OK, the
simple call you showed
in the beginning of your presentation.
So not the Amcor.
Yes.
Is it available online?
That's the first question.
And the other one.
What are the minimum minimum requirements
to run it? Do you have a need to have
a
part time or?
Yeah, we have actually run that on a
Spartan three and
I think on a Spartan six, it's also
possible it's currently
not available because I wanted to review
some part of the code before I put it
online, but I promised that I will
review it in the new year and put it
online on my home page so everyone can
download it.
OK, thank you.
Next question, please.
So thank you.
Do you know of any instruction set
architecture that is supported by Linux,
but it's, well, open enough so that I
could just implement it and run Linux
on it?
Our instruction set architectures,
I think, are not patentable or
licensable.
For example, I'm just copying it's
on the AMD.
Just copy it the entire instruction
set at the beginning.
So I think you can take any
instruction set, but the
instruction set is very much
well.
You have to submit the processor
according to instruction set, and you
will always implement it.
Very similar to the original
implementation of the original window.
So every time you do that,
you just have to make sure
you are not using any Pentium relies on
that hardware description.
So
but it's the easiest part.
You just take some instruction set, which
is available, implement a processor core
and you have a complete environment or to
compile and everything else.
We will.
We are just doing that, for example, the
arm core we do.
My colleague did that because the arm
tools are publicly available
and are easy to use.
And I'm currently working on in this
process, of course, because the MIPS
tools are available and
are working just fine.
So you have always, yeah,
made a threat
like your
second to last question,
please.
It's not any serious,
but I would like give it feedback.
You tell the students with good,
cheap and simple, possess a
long history.
You should start.
This is look serious was eight bit
and urged the students to
spend much time about parity
and overflow
handling to get even the six.
In addition, because this
is the two way the all
of the 80s, we wished that the eight
bit processors had 32 bit of edges
that no matter how slow they have been.
So this is if you do something
in FPGA, of course you should do it, but
try to tell students,
by the way, if it passes in ways the
industry was not willing to
to give us eight and 16 bit
chip away and say we made we
make 30 bit register even in eight
good CPU's.
Would you wish
if you have the time with a students to
do that, you could do that.
But mostly we have one three
master to teach the two students how to
work with a process from the ground
up. So we do not have the time to start
with an eight bit process or
actually the simple process of code was
a 16 bit process, of course, before I
pumped it and made
and 32 bit process, of course, to
present it here. But but because I don't
want to present it present here, a
16 bit processor core was almost without
any jumps and carry and anything
else.
Last question please
do you exploit your shirt?
Can you mitigate that if you had some
kind of awkward verification?
So if you because you
two exploit it, you always have
to execute some some sort of code?
Could you, um,
some somewhat sanitized steel
codes of that binary you execute
before the operating system actually
allows you to execute it?
Yeah, sure. But you would have to know
that there was actually a backdoor into
the processor to do that.
You have to search for a four specific
opcode, or perhaps you could only allow
a specific opcode, but
the processor just
executes the instruction.
So if you every time you can put an
instruction into the process thirst for
execution, he can
stop all
all interrupts. And the
operating system won't have any control
over the processor anymore because
the operating system is only
running.
For example, if an interim timer
interrupt is issued so
you wouldn't be able to
to overlook all code you, you put
enter into the processor.
Yes, but you set that, for example,
for you, for you exploit.
You were using some of code which would
actually not be allowed by the
specifications specifications of
you.
It's it's it's actually allowed.
But the recommendation from
ARM is that please do not use
that. That makes no sense.
Yes. But if you know that's officially
according to ARM, it doesn't make any
sense. You would.
You could simply disallow.
Yes, sure. The operating system to
execute such an yeah,
sure that you could do.
But the next thing I would add,
in addition to register into my processor
as if I wanted to create a vector
and this register
about some kind of combination of
instructions, I. Activates this register
and put some stuff into it.
And this stuff activates the
the backdoor again, so
I just do displayed a very simple
back door because it was simple to
implement and very hard to
a disco anguish between the other
parts of the execution stage of the
process.
So even if you were to have some
really frustrating operating system
running on it and you know
some some would be, yeah,
let's say you had some
some validating
code in your operating system, which
verified every opcode before it was
actually loaded into the CPU.
Yeah, sure, you could do that.
That's a possibility, too, to get
some part of the the attack
vector.
OK.
But not all.
OK, thank you.
And one last question.
Hi, thank you for your
presentation.
I just asking now or I'm thinking
about the idea when I
thought, OK, my thinking about the idea
when I run the interpreter based on the
CPU and I can control
the set of all operations that will
be put through to the
CPU kernel.
Is it then possible because enough a
block set of Operation Coats
because I put up an interpreter on
it and only allow the user
to run an interpreter?
And then then I can block all kinds
of operation codes that have not
scanned how possible.
I think it would get harder to to get
some backdoor code through.
But you could think about
that. A combination of instructions you
issue to the processor actually activates
the processor and the backdoor.
So not not an invalid
instruction, but but only a combination
of instruction.
For example, you put some load immediate,
for example, six load
immediately after another and then
you issue to X.
And again, to load immediate.
This could also be activate
the backdoor,
but I need a closed
interpreter. Nobody needs to know what
kind of doing, switching and doing
of the operation.
Coats are using their donuts will be fun
or randomized. So if something like this?
Yes. OK, this
could be a help for that.
Yes.
OK, thanks.
One more question.
OK, I got one question about
your suggestion to make more
open source hopper descriptions.
Yeah, because I'm working at the
university with digital
signal processing and voices on the
object registers transfer level.
And without the schematics that we draw,
still, on paper, they are like the
vehicle code is basically useless because
you don't get the overview.
Like, I had something that I didn't have
to schematics to and I spend one hour
just decoding. It was just a really
simple code.
So what do you propose as a format
to better document like
the HDL code
or something that I can use a
system,
preferably to document future?
Could I just use a doctor, Dr. John?
I just to create a
normal comments into it, and
we tried at our university to
to get some students into actually
parsing. We still input and
producing schematics from it
and vice versa.
But we,
our students, are always electro
electrical engineering students, and
they do not have
mostly the required skills to program
in C++ or anything else to
get something like that running.
But it would be great if something like
that would be in existence.
Yeah, that would be a good idea, because
then the visual code and
documentation wouldn't differ.
Yeah, if you're trying to the airport,
the documentation would. Oh yeah, that
would be great. Thanks.
All right. Go ahead.
You could make the FPGA windows
and make FPGA
switch. Recognize that you loads a
processor on the FPGA
and now and then they
apply a vector to the FPGA
in in.
And I do not
know that you actually
could have that in the synthesis
process. When you create
from video to the actual but
file of the FPGA, you always could
implement such code to recognize
what you are actually
creating hat hardware.
But it's very hard, but
on every layer you could have a backdoor.
The FPGA vendor could implement
some some kind of method
to to read and write
every
other bit
in the FPGA, whether that's
actually possible.
So you could read from the FPGA
chains to state and write it back and
have a complete different.
The process of running, but a complete
different state and operating system, so
that would be possible.
Dominic, thank you for your talk.
It was very great.