Slashdot Mirror

Check out this Actel whitepaper (PDF). Describes a similar phenomenon, with such errors taking place three times more often in mile-high Denver than Baghdad by the Bay San Francisco.

I came here to say "Ok, so they discovered the JTAG port." Seems that blog was already on it.

Now, the researchers claim demonstrate that, via the JTAG port, they can subvert one form of Actel's AES security (but not all--see below) on someone's design to allow reverse-engineering a circuit design loaded into the FPGA. That's fairly interesting. I know that there's a fair bit of business in claiming an FPGA is invulnerable to such snooping, so that vendor A can ship a prototype design to customer B without worrying that customer B might rip off vendor A's design. For example, vendor A might ship an FPGA-based version of a chip they're designing to customer B, so they can design/debug their system while vendor A finishes the design, so both A and B can ramp their products more closely together.

Here's Actel's pitch on design security. The hack claims to expose the AES key for at least one of their encrypted modes, which implies that that particuler security feature is busted, and the guarantees against counterfeiting, reverse engineering and overbuilding it provides are also busted. According to the (occasionally somewhat breathless) claims in this draft paper, that is indeed what they've accomplished. Even then, they didn't break everything:

There are several security protection levels in the PA3 devices according to the manufacturer's datasheet [14]. The Passkey offers the highest level of reversible protection mechanism. Various DPA techniques were attempted to extract the Passkey, however, we were unable to get even a single bit in two weeks time using our off-the-shelf DPA equipment (oscilloscope with differential probe and PC with MatLab). The Passkey hardware security had robust countermeasures that proved to be DPA resistant. In addition to the unstable internal clock and high noise from other parts of the circuit, the Passkey access verification had its side-channel leakage reduced by a factor of 100. Only noise can be observed in the power traces without any characteristic peaks in the frequency domain. This was likely to be achieved through using a well compensated silicon design together with ultra-low-power transistors instead of standard CMOS library components. In addition, the useful leakage signal has a spread spectrum with no characteristic peaks in frequency domain, thus making narrow band filtering useless.

It'll be interesting to see how Actel responds.

As for "ZOMG, the Chinese can infect all our nukes! RUN!" that seems unlikely. To perform this analysis, you need to be able to isolate the FPGA and its bitstream in a circuit where you can observe all the pieces functioning together. This is trivial in the "vendor A / customer B" scenario above. It's not so easy to do without a specimen of the system you're trying to hack, though.

You have to digg up yourself if you want sources, but apparently the chip is Actel ProASIC3.

You can get FPGAs with ADCs.

Or, we could use Actel parts:

http://www.actel.com/products/solutions/security/default.aspx

Based on my half remembered conversations from 10 years ago, FPGAs are great for prototyping, but not for flight systems, because they are power hogs.

When you measure your power consumption in surface area of solar panel and weight of battery that need to be put on orbit...

With your typical Xilinx FPGA, power consumption would be the least of your problems. Even with unlimited power, single event upset problems would prevent them from being usable in anything you put into orbit. There have been a number of white papers written on this problem, such as from Xilinx and Altera as well as Actel (sort of) [PDF warning].

For the people talking about use only in low-volume items: I recently looked at the innards of a couple of thoroughly mass-market oriented LCD TVs that each included an FPGA. A small FPGA isn't necessarily all that expensive, and can allow things like doing a single physical design that works with either PAL or NTSC, depending purely on how you program one part...

Reading the paper provided by another poster, it seems like configuration of these FPGA's is solely done by use of antifuse nanoconnections. This would essentially mean that these things were one-time configurable. That is, you configure the FPGA and it'd stay like that for the rest of its life. Kinda like one-time-write PROMs. Actel has been making FPGA's like this for years:

http://www.actel.com/products/mx/

Albeit not to the same scale. These types of FPGA's are much less convenient or usable as you can just keep re-configuring them to iterate and trouble-shoot your design. This makes using them as prototyping platforms impractical.

Someone who's been able to read more into this than I and can explain to me why I'm wrong, please do so. Have they come up with an anti-fuse method that allow re-fusing?

The one on my far left is a laptop that I use mainly as a music box (one of its USB ports is connected via an external converter to a Hi-Fi preamp and thus to my main stereo system so I don't have to listen to the crappy audio from the laptop's builtin audio system, and the laptop is also connected to an external USB 250GB hard drive containing about 50GB of MP3 recordings of my favorite music.), and to run background computing tasks on - factoring algorithms mostly).

The middle monitor sits on my adjustable computer monitor table next to my desk and an $700 all leather and wood very comfortable office chair..., which I never use anymore now that I've installed a third "monitor."

My third "monitor" is a 4x5 feet front projection screen mounted on the far wall about 8 feet in front of my all leather Barkolounger recliner (Note: Here's something only Slashdotters could appreciate: When I went to purchase my recliner, I told the sales clerk that I wanted a color of leather that would match the color of my computer case! She said that was a first for her, but managed to match it perfectly :-).

Anyhow, a high resolution (1280x1024) video projector is securely mounted near the ceiling above and to the right of my easy chair so that with my wireless keyboard and mouse, I can do my programming and web-surfing from the comfort of my Barcolounger! I don't even need to wear my computer glasses anymore. I'm sure everyone on Slashdot who wears reading glasses knows what I mean by "computer glasses" but for the rest of you, they are glasses with a prescription such that they focus at about arms length (which is how far away my regular computer monitor normally is from my eyes) instead of up closer like normal reading glasses do. I don't need any glasses at all to use my four by five foot computer "monitor" however, and movies look great on it! :-)

As for software development tools, I highly recommend either the free Actel Libero® Integrated Design Environment (IDE) development tools, or one of the Lattice ispLEVER packages. Seriously folks, Verilog HDL or SystemC are just as much programming languages as C/C++ or Java, etc. As FPGA's get larger and cheaper, I expect to see more and more functions that are traditionally performed on old-fashioned sequential computers like your desktop computer, and will be embedded into special purposes devices rather than general purpose computers. As a bona-fide retired 35+ years of experience computer programmer, I think I am qualified to discourage anyone from entering the field of traditional computer programming. I would instead encourage young people these days to study VLSI design and learn at least one VLSI design language if you want to be a programmer, or preferably to instead study something like biological (ie genetic) engineering which is the "next big thing."

• comp.arch.fpga Google archive of Usenet groups, where people interested in FPGA hang out.
• Opencores A set of free IP cores that can be implemented in FPGAs
• Comprehensive tutorial on FPGA
• A comprehensive list of FPGA CPUs
• A good FPGA tools overview
• FPGAworld news, jobs, forums, demos etc.(http://www.fpgaworld.com)
• FPGA Basics by Ray Andraka
• Fpga4Fun various fpga projects
• FPGA Boards
• AP100 PCI Platform FPGA Development Board
• Information about signal processing on FPGA by RF Engines
• FPGA manufacturers
  • Xilinx Xilinx has traditionally been the FPGA leader. Their general philosophy is to provide all the features possible, at the cost of extra complexity.
  • Altera Altera is the second FPGA heavyweight. Their philosophy is to provide the features that most people want while keeping their devices easy to use.
  • Lattice Lattice's focus is on low-cost, feature-optimized FPGAs and non-volatile, flash-based FPGAs.
  • Actel (http://www.actel.com/) and QuickLogic have antifuse (programmable-only-once) products.
  • Cypress
  • Atmel
  • Debian FPGA.

Another reason that people don't use FPGAs that much in consumer applications is the security of the IP on the FPGA. They are loaded on power-on with a PROM chip and it is a somewhat trivial task to read the entire contents of the FPGA at power-on. This would be a nightmare for companies like Nvidia and ATI, who value their custom hardware.

Fortunately, there are some companies that are incorporating flash memory on to their FPGAs instead of using the standard SRAM. The problem is that flash-based FPGAs are usually a few generations behind SRAM-based FPGAs in terms of die size (and henceforth storage space and speed).

I think that as flash-based securable FPGAs become more popular, cheaper, and less power consuming, we'll start to see cards for the computer that come with completely configurable hardware.

-Montag

Much of what you're saying is true about reprogrammable (Xilinx, Altera) FPGAs, but this "open source video card" would be an excellent application for one-time-programmable (antifuse) FPGAs, like the chips made by Actel or QuickLogic. Once the FPGA code has been written, there shouldn't be any need for reprogrammability, and antifuse FPGAs are cheaper, faster, and have much better routing potential than reprogrammable FPGAs. In fact antifuse FPGAs can come very close to the speed of an ASIC.

I'm actually quite surprised that they're opting for a Xilinx FPGA here; I must be missing something. Is there any particular reason that reprogrammability is more important than cost and speed for this?

For the more common SRAM and EEPROM types, yes. The anti-fuse type, however, are not too bad on price-performance: 500 MHz clock and 2 million equivalent gates on-chip. Still only about a third of 90 nm CMOS (not counting Intel processors that are specifically architechted for high clock frequency) , but if you have a supercomputer budget you can use more of them and architect for more instructions per clock. They never became popular because you can't erase them, so prototyping is a pain. Imagine trashing a $15 chip every time you recompiled software.

There is a trade-off between speed, reliability, cost, and re-programmability.

SRAM types
Are re-programmable but require a rather slow serial load at boot-up. Reliability in embedded systems leaves something to be deisired since any brownout-induced glitch can create errors that are even worse (harder to recover from) than software glitches because wired logic doesn't have anything equivalent to code checksums or interrupt vectors. Well-paid FPGA designers are versed in the arcane art of self-verifying logic.

EEPROM types
Come alive at boot up and are much more resistant to glitches. Their performance, however, is slow. And you have limited (100,000 maybe) rewrite cycles.

Anti-fuse types
are made by Actel. They have the highest performance and best density. They come alive at boot up and are dead-nuts reliable under the worst of conditions; for example, properly qualified, they can survive the cosmic radiation in spacecraft that would leave other types toasted. The big drawback: the anti-fuse process, which works by melting diodes into short-circuits, is not eraseable.

Desktop systems (say, an add-on FPGA card) would be best served by SRAM types, since you already have a processor that requires gluttinous gobs of puritanically clean DC power. Basement hardware hackers would be better served by EEPROM or anitfuse types (depending on performance requirements), since they don't require super-expensive exotic design software.

Exactly, and this should work just like the active noise-canceling technology available in aviation headsets, as well as quite a few consumer-level headphones.

Here's a doc which seems to have a little more than one might ever want to know about the technology:

http://www.actel.com/documents/s06_07.pdf

I've never had the opportunity to try a pair, but if you ask me, they should work on a pair that's effective with human voices and sell them as spouse-coping mechanisms implemented in the form of in-ear hearing aids.

They sell like friggen' hotcakes!

FPGA stands for Field Programmable Gate Array. If it isn't reprogrammable, it isn't an FPGA. I'm sure Actel or QuickLogic would have you believe their OTP parts are "FPGAs" but I'm afraid they just aren't.

oh bah, that's such nonsense. the term "FPGA" has become a broad term to mean basically any programmable logic more complex than a CPLD. granted that while the field part of the acronym refers the ability for these parts to being programmed in the "field," the term has become generic enough that "antifuse-FPGA" is perfectly acceptable. but whatever, it's still a valid use of the term these days, and they could be used in this case. but lighten up: nobody likes a literalist ;) hah.

About the speed: the parts Xilinx released a year ago run to 100MHz.

yeah, exactly: 100Mhz. big deal. i know from personal experience that Actel's SX (from around the same time period) operate at well over 300Mhz (though they only guarantee 250Mhz in a production setting, as not all designs will run that fast).

The main problem isn't the speed of the parts. It's the cost.

exactly, which is why antifuse clearly wins out here (if you're willing to put up with the fact that it's OTP). antifuse "FPGAs" are about 1/10th the cost of a comparable SRAM FPGA. plus it's easy to routinely get utilizations of over 95% with Antifuse: you'd be lucky to get 60% utilization on an SRAM FPGA. this is simply because the SRAM cells are too large to justify putting at every horizontal/vertical path junction. you can get 100% pin-locking on an antifuse FPGA even at full logic utilization! that's a considerably better value for your money.

the thing is, Antifuse FPGAs are superior to SRAM in absolutely every way (price, power consumption, performace and efficiency, plus you don't need an external EEPROM) except that they're only one-time programmable. hobbists usually like to get a handful of reprogrammables and "play around" with them, and that's fine. but if you're serious about making "open hardware" and using it in a device that you actually care about it would be worth your while to do good synthesis on the PC and then burn the antifuse FPGA for a high speed, low cost, low power decent device.

end rant. hah. that was longer than i intended it to be. can you tell that i used to work in Marketing at Actel? (and before you blow me off completely for that, i worked in Product Engineering too) :) more information on Antifuse can be found here. i should know, i helped write it :).

- j

Still, it's cool and nice to see this sort of thing (see also Open Cores project, etc.) but at the moment it's a bit of academic fun and nothing more - you won't be throwing away your Athlons for now :)

and that's really the issue here: putting cores into an FPGA is nothing new, but i think the software-leaning slashdot crew need to get a handle on the sacrifices you make by using an FPGA (especially an SRAM-based FPGA like Xilinx or Altera). FPGAs are painfully slow when compared to an ASIC; they're really not even comparable. and when this chip doesn't even implement pipelining, it's going to have very few applications outside of casual, academic use.

while it may sound like a godsend to use VHDL to create hardware and put it in an FPGA, there's a really big difference between hardware and software. there are so many other steps that occur in creating an ASIC after the VHDL synthesis process, such as layout and floorplanning, that optimize an ASIC for speed and power consumption. an FPGA is only used to get a "rough" idea of the functionality of the chip, or to put simple "glue" logic on a board that doesn't justify spinning an ASIC. again, you really can't compare an FPGA-based processor to a real fabbed processor.

additionally, if you're looking to create a chip that you can actually use in any sort of device with reasonable speed and power consumption, you'd be much better off using a non-volatile technology FPGA from Actel or QuickLogic. while you sacrifice reprogrammability, you'll gain considerably faster speeds, considerably lower power consumption, and a lower cost chip. once you program these FPGAs they're programmed for life (so if you make a mistake you'll have to throw it out), but if you synthesize your design sufficiently using software, the benefits of such a device are far outwieghted by their lack of reprogrammability.

at any rate, the dream of "open source" hardware is a nice one, but it's not nearly as golden an opportunity as you'd think by reading the slashdot comments. hardware and software are two totally different beasts, and the tools and techniques that work on one are not guaranteed to work on the other. after working in the hardware and semiconductor fields long enough i realize that hardware companies have the really solid business models, and aren't going to see opensource as competition anywhere in the forseeable future. in fact, opensource is being embraced by the semiconductor industry to increase the "value add" of the hardware itself. i personally push Linux at my company as much as possible, as i firmly believe that selling software isn't a solid business model unless that software is highly specific, or your company enjoys a monopoly in your industry. as much as this community may want it, opensource hardware is a long way off. you'd be much better off working with hardware companies to show them why funding opensource projects is in their best interest (and as a nice co-incidence, also in the best interest of the open-source community).

- j

you might want to open up your MP3 player and see just how "specific" the hardware is

The blockdiagram of the Rio Player shows four main parts. First, the MP3 decoder which is located under a metal casing, so you can not see it on the pictures, it is an MAS3507D from Micronas / Intermetall. Second the CPU, an OTP version of NEC's &# 181;pD78P064. This CPU is contolling the user interface and in my opinion does the file-structure management in flash memory. Third part is the flash memory which is consists of 4 8MByte chips KM29U64000 from Samsung and an optional flash memory card. The last chip is an A40MX04 FPGA from Actel. This chip is responsible for address decoding, controlling the PC-Interface and implementing all logic functions in the Rio.