Modern computers are vulnerable to malicious peripheral devices
Getting started with Thunderclap on FPGA
Contact: theo.markettos [at] cl.cam.ac.uk
This article describes how to get Thunderclap up and running on an FPGA.
To use Thunderclap, the recommended shopping list is as follows:
Thunderclap PE1 clock injector module. The PE1 does not generate a clock necessary to bring the PCIe transceivers up. We designed (GitHub repo) and manufactured a module to provide this clock. A limited number of modules are available free of charge to users of Thunderclap - please email us with your shipping address to receive one.
For this you need a computer with a serial terminal program and a means to write disk images to SD cards via Win32DiskImager, dd or balenaEtcher
picocom -b 115200 /dev/ttyUSB1opens a simple terminal (you may need to install picocom; press Ctrl-A then Ctrl-Q to exit it)
U-Boot 2014.10 (Apr 03 2019 - 18:19:55), Build: jenkins-thunderclap-arria10-ubuntu-sdcard-master-42 CPU : Altera SOCFPGA Arria 10 Platform BOARD : Altera SOCFPGA Arria 10 Dev Kit I2C: ready DRAM: WARNING: Caches not enabled SOCFPGA DWMMC: 0 FPGA: writing socfpga.rbf ... FPGA: writing socfpga.rbf ... Full Configuration Succeeded. DDRCAL: Success SDRAM: Initializing ECC 0x00000000 - 0x80000000 SDRAM-ECC: Initialized success with 4294 ms INFO : Skip relocation as SDRAM is non secure memory Reserving 2048 Bytes for IRQ stack at: ffe386e8 DRAM : 2 GiB WARNING: Caches not enabled MMC: *** Warning - bad CRC, using default environment In: serial Out: serial Err: serial Model: SOCFPGA Arria10 Dev Kit Skipped ethaddr assignment due to invalid EMAC address in EEPROM Net: dwmac.ff800000 Error: dwmac.ff800000 address not set. Hit any key to stop autoboot: 0 FPGA must be in Early Release mode to program core. fpga - loadable FPGA image support ** Unable to read file u-boot.scr ** 4874072 bytes read in 441 ms (10.5 MiB/s) 20009 bytes read in 6 ms (3.2 MiB/s) FPGA BRIDGES: enable Kernel image @ 0x008000 [ 0x000000 - 0x4a5f58 ] ## Flattened Device Tree blob at 00000100 Booting using the fdt blob at 0x000100 Loading Device Tree to 01ff8000, end 01fffe28 ... OK Starting kernel ... [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 4.19.0-00114-ge3b47dd63c0f (root@thunderclap-build-images) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #1 SMP Wed Apr 3 18:12:09 UTC 2019 [ 0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c5387d [ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache [ 0.000000] OF: fdt: Machine model: ALTR,system
and more messages as the Linux kernel boots. Eventually you’ll reach a login prompt:
[ OK ] Started LSB: automatic crash report generation. [ OK ] Started Set console scheme. [ OK ] Started LSB: daemon to balance interrupts for SMP systems. Starting Authenticate and Authorize Users to Run Privileged Tasks... [ OK ] Started Apply the settings specified in cloud-config. Ubuntu 16.04.4 LTS arria10 ttyS0 First login username 'ubuntu', password 'ubuntu', sudo available arria10 login:
As described, the login user is ‘ubuntu’ and the first-time login password is ‘ubuntu’ - you will be prompted to change it on your first login.
You are now logged into a more-or-less standard Ubuntu 16.04 ARMv7 system, so all the features of a headless Ubuntu system (similar to a Raspberry Pi and other boards) are available. For instance networking, USB mass storage, package installation, SSH, etc.
A basic version of the Thunderclap device model is provided on the SD card image. To do this, run
Some debugging information will be printed, such as:
INIT PAGE LIST Starting. PCIe Core Drained. Let's go. Starting packet processing coroutine. ~~~~~~~~~~ Init client. ~~~~ Init default. Setting device nic_id... !!!!!! Realising e1000e! qemu_new_nic called. Creating new nic with 1 queues. WARNING: e1000e: Device requires 2 network backend queues for optimal performance. Current number of queues is 1. Init done. Let's go.
At this point we’re ready to hotplug the Thunderclap platform into our target. We won’t see more messages on the console (Thunderclap stays quiet so as to respond to PCIe messages in a timely manner), but if you boot a PCIe PC or plug in to a Thunderbolt port you should see an Intel ethernet controller appear. This is Thunderclap in operation.
You can now build the thunderclap-qemu repository, replacing the supplied /root/thunderclap binary with your own.