Baochip

Baochip

@baochip.com

Baochip makes open-source hardware.

474 followers23 following51 posts

Baochip
@baochip.com

Here's a nicely written article that discusses some of the new opportunities unlocked in security by open source hardware: cambridgeanalytica.org/digital-curi... We're looking forward to learning what flaws the DEFCON community discovers, and working with them to improve the state of the art!

cambridgeanalytica.orgThe hardware hacker who built a chip you can literally see through—and Defcon just handed 27,000 to hackersAndrew Bunnie Huang created a see-through security chip for Defcon 34 badges. 27,000 hackers now have one designed to be deliberately broken open.
Baochip
@baochip.com

Sorry for the re-post, Bluesky posted the image with the transparency layer mapped to black, making all text unreadable.

Baochip
@baochip.com

Baochip is proud to be an inaugural member of the Pavona consortium. It's a strong step towards making secure, open source silicon broadly available. We look forward to vigorously advocating for the interests of small, independent contributors like ourselves. Source code at github.com/pavona/pavona

github.comGitHub - pavona/pavona: A library of modular, tapeout-proven, and secure-by-default open silicon blocksA library of modular, tapeout-proven, and secure-by-default open silicon blocks - pavona/pavona
Baochip
@baochip.com

Production tester for the dabao is ready! 100% of boards run through a test where every I/O is toggled, both buttons are pressed, serial ports tickled, and an initial OS image is loaded. Voltages and currents are also checked. The test checks for errors in soldering, and/or faulty components.

Baochip
@baochip.com

Note that this initial campaign is limited to 3,500 boards total. I don't think we're at risk of hitting that limit, but it's probably worth a mention just in case!

Baochip
@baochip.com

Here's what a socket looks like for chip scale packages. Each one is custom made for a given chip package. A couple samples of the 0.4mm pitch Baochip CSP devices are laid out on the lower rim of the socket for size reference.

View full thread
Baochip
@baochip.com

The socket has seen heavy use for initial device bring up and chip probe test development. However, its high cost and fragility limits its use to just the earliest bring up phases. If you are a lucky dabao Alpha board owner, the chip on that board was tested and programmed in this very socket!

Baochip
@baochip.com

Here's what a socket looks like for chip scale packages. Each one is custom made for a given chip package. A couple samples of the 0.4mm pitch Baochip CSP devices are laid out on the lower rim of the socket for size reference.

Baochip
@baochip.com

The socket mounts to the board with spring loaded contacts; the carrier board is also custom to the socket. You can see some of the chip test & measurement power supplies on the board near the socket. The socket itself is quite expensive, a couple thousand dollars and some weeks to manufacture.

Baochip
@baochip.com

Behold the graveyard of Baochips! Security testing is hard, after the chips are locked the only recourse is to desolder and replace them when a test goes wrong or an attack sensor is tripped. On the upside, I'm getting really good at reworking CSPs.

Baochip
@baochip.com

Woo hoo! just in time: tape & reel packaged Dabao for #39c3. They will be at the #fail0verflow assembly with @bunnie.org . Also come see our talk on Day 2 23:00 in Room 1: "Xous: A Pure-Rust Rethink of the Embedded Operating System", where bunnie & xobs will co-present on Xous running on Baochip!

Baochip
@baochip.com

It's nice to be able to simulate your constant-time code and prove to yourself that you got it right. Pictured is a simulation of AES chaffing, where fake and real data are computed in a random order. The timing of fake->real and real->fake has to be identical in order to mask power side channels.

Baochip
@baochip.com

The first cut of the code missed a branch delay slot, and so the two paths were different by three cycles. Open source means you can simulate code running on your chip, and be sure you got it right!

Baochip
@baochip.com

Backside IR image of the chip! The Baochip-1x is packaged specifically to enable you to verify that you've got the correct chip, and not a fake or a substitute part (see bunnie.org/iris for how). The final chip will have part numbering that overlaps the memory array on the lower third of the chip.

Baochip
@baochip.com

CHIIIIIIPS!!! 12" wafer of CSP bumped chips, hot off the line (solder balls are face-up in this photo, with a couple die already removed for testing).

Baochip
@baochip.com

A killer app for SoC source code is debugging your code with RTL simulation. Simulation gets you cycle-accurate views into what's happening throughout the system - the program counter, registers, state machines. Learn more on how to simulate the Baochip-1x here: baochip.github.io/baochip-1x/c...

You are up to date.