HW弹药库之红队作战⼿册 红⽅⼈员实战⼿册 声明 Author : By klion Date : 2020.2.15 寄语 : 愿 2020 后⾯的每⼀天都能⼀切安好 分享初衷 ⼀来, 旨在为 "攻击" / "防御"⽅ 提供更加全⾯实⽤的参考 还是那句⽼闲话 "未知攻焉知防", 所有单纯去说 "攻" 或者 "防" 的都是耍流氓, 攻守兼备才能把路越⾛越宽 ⼆来,

1 © 2023 Intel Corporation and Jeffrey E. Erickson cppcon 2023 1cppcon 2023 Behavioral Modeling in HW/SW Co-design using C++ coroutines Jeffrey E Erickson, Ph.D. Sebastian Schönberg, Ph.D.© 2023 Intel software developer working on a new HW peripheral that is in development. • Timelines are tight and you want to be able to work on the SW that interacts with this HW early – so-called “shift left” • on a simulator or emulator • Use the transactional/behavioral/functional definition to model the HW using SW elementsIntel Confidential Department or Event Name 5 © 2023 Intel Corporation and Jeffrey

ode::can_msg), *can_msg_in); } uint32_t hw_status_word = HardwareLayer::get_debug_status_word(); ecat_data::status_mode status_mode = ecat_data::status_mode::hw_status1; using boost::sml::operator""_s; ecat_data::status_mode::can_error; } return as_status(toggle_status(status_mode), app_loop_count_shadow_, hw_status_word); } app ecat_data::status_out get_cyclic_status() { using ecat_data::as_status; // See ode::can_msg), *can_msg_in); } uint32_t hw_status_word = HardwareLayer::get_debug_status_word(); ecat_data::status_mode status_mode = ecat_data::status_mode::hw_status1; using boost::sml::operator""_s;

e�ective use of C++ How did we end up with C language HW interactions? What are best practices for using C from C++? How can we use C++ to make HW access cleaner, safer, and more testable?Why is C so proli�c be like the kernel right? NO! C++ has advantages, so take advantage of itNaive HW access First concept: Hide all the HW access within functions class my_uart { ... void set_baud_rate(const uint32_t& pointer-to-register HW access in ‘pure’ C++ �. De�ne a struct that represents the HW, packed and aligned �. Smart pointer initialized to HW address �. Custom deleter – don’t try to deallocate the HW struct my_uart_regs

: ∃ x, p x ∧ q x) : ∃ x, q x ∧ p x := exists.elim h (assume w, assume hw : p w ∧ q w, show ∃ x, q x ∧ p x, from ⟨w, hw.right, hw.left⟩) It may be helpful to compare the exists-elimination rule to the that the anonymous constructor notation ⟨w, hw.right, hw.left⟩ abbreviates a nested constructor application; we could equally well have written ⟨w, ⟨hw.right, hw.left⟩⟩. Notice that an existential proposition Type*) (p q : α → Prop) example (h : ∃ x, p x ∧ q x) : ∃ x, q x ∧ p x := match h with ⟨w, hw⟩ := ⟨w, hw.right, hw.left⟩ end The match statement is part of Lean’s function definition system, which provides

available // if the goal is allowed, do it task(goal, model_[0], left_state_, *hw_.at(model_[0].description).get()); // much more management code... } catch (std::exception auto arbiter = arbiter_dual_async{left_arm, std::make_unique<hw>("/dev/ttyACM0"), right_arm,std::make_unique<hw>("/dev/ttyACM1"), bin_grid}; auto arbiter = arbiter_dual_async{left_arm, std::make_unique<hw>("/dev/ttyACM0"), right_arm,std::make_unique<hw>("/dev/ttyACM1"), bin_grid};

solution: 131 ⊡ Reset the HW after 1 hour of silence.PROBLEMS & SOLUTIONS First solution: 132 ⊡ Reset the HW after 1 hour of silence. Second solution : ⊡ Reset the HW after 4 minutes of silence (sweet 133 ⊡ Reset the HW after 1 hour of silence. Second solution : ⊡ Reset the HW after 4 minutes of silence (sweet spot).PROBLEMS & SOLUTIONS First solution: 134 ⊡ Reset the HW after 1 hour of silence silence. Second solution : ⊡ Reset the HW after 4 minutes of silence (sweet spot).PROBLEMS & SOLUTIONS 135 Frame 1 Frame 2 Frame 3 Months later, I was looking in logs of a unit that had this silence

NAME READY STATUS RESTARTS AGE hw-event-proxy-operator-controller-manager-74d5649b7c-dzgtl 2/2 Running 0 25s OpenShift SERVICES PORT TERMINATION WILDCARD hw-event-proxy hw-event-proxy-openshift-bare-metal-events.apps.compute-1.example.com hw-event-proxy-service 9087 edge None apiVersion: Container Platform 4.10 监 监控 控 106 1 2 指定生成 Redfish 事件的 worker 节点的名称或 UUID。 指定裸机事件代理服务，例如 https://hw-event-proxy-openshift-bare-metal- events.apps.compute-1.example.com/webhook。 b. 创建 BMCEventSubscription

system.hw.chassis[full|type|vendor|model|serial] - default is [full], root permissions needed • system.hw.cpu[all|cpunum,full|maxfreq|vendor|model|curfreq] - default is [all,full] • system.hw.devices[pci|usb] devices[pci|usb] - default is [pci] • system.hw.macaddr[interface,short|full] - default is [all,full], interface is regex • system.sw.arch • system.sw.os[name|short|full] - default is [name] • system.sw system.hw.chassis[full|type|vendor|model|serial] - default is [full], root permissions needed • system.hw.cpu[all|cpunum,full|maxfreq|vendor|model|curfreq] - default is [all,full] • system.hw.devices[pci|usb]

Background  HW http://www.intel.com/AC57-Support  SW I. Background 3.2 Raspberry Pi RPi4 (8GB LPDDR4) with Fedora 37 I. Background  HW  SW I I. Background  https://www.raspberrypi.com/products/raspberry-pi-3-model-b-plus/  HW  SW RPi3 B+ (1G LPDDR2) 1) CantripOS(KataOS) 1.1 Getting started II. Practicing Sparrow playing an more and more important role in HW-SW collaboration! You may look forward to our upcoming follow-ups "The first exploration of Rust for HW-SW collaboration", "Rust for Formal Verification