Abstract The thesis comprises two different IC design projects, which are briefly introduced as follows. The first part is the NIC (Network Interface Controller) design. The NIC implements all of the Media Access Control (MAC) layer functions for transmission and reception of packets in accordance with the IEEE 802.3 standard. The design is compatible with CSMA/CD type Local Area Network, i.e, 100/10 Mbps Ethernet. The second part is a post-amplifier for a 16Mbps infrared transceiver module. We presents a design of the post-amplifier to convert the pre-amplifier output into digital pulses such that the baseband digital codec can further translate the pulses into the format of IrDA protocols. The design of the amplifier is aimed at the VFIR (very fast infrared) which is supposed to provide a 16 Mbps data transmission rate. The circuit design is carried out by TSMC 0.35 um 1P4M CMOS technology. The simulations results of the design meet the required specification of IrDA VFIR.

The thesis is composed of two different IC design projects, which are briefly introduced as follows. The first topic is an area-saving decoder structure for ROMs. In this part of work, we propose a novel 3-dimensional decoding method. The stages of address decoding are drastically shortened. Hence, the delay is reduced as well as the power consumption. The overall transistor count and the delay are thoroughly derived. A physical 256x8 ROM using the proposed decoder is fabricated by UMC 0.5 mm 2P2M CMOS technology. The second part is the NIC (Network Interface Controller) design. The NIC transfers data frames from and to transmitter and receiver buffers in the host memory, respectively. Meanwhile, the transferred data must also comply with the IEEE 802.3 standard. The design is compatible with CSMA/CD type Local Area Network, including 10/100 Mbps Ethernet.

ITC/USA 2005 Conference Proceedings / The Forty-First Annual International Telemetering Conference and Technical Exhibition / October 24-27, 2005 / Riviera Hotel & Convention Center, Las Vegas, Nevada / As requirements for the amount of test data continues to increase, instrumentation engineers are under pressure to deploy data acquisition systems that reduce the amount of associated wiring and overall system complexity. Smart sensor buses have been long considered as one approach to address this issue by placing the appropriate signal conditioners close to their respective sensors and providing data back over a common bus. However, the inability to adequately synchronize the operation of the sensor bus to the system master, which is required to correlate analog data measurements, has precluded their use. The ongoing development and deployment of smart sensor buses has reached the phase in which integration into a larger data acquisition system environment must be considered. Smart sensor buses, such as IntelliBus™, have their own unique mode of operation based on a pre-determined sampling schedule, which however, is typically asynchronous to the operation of the (master or controller) data acquisition system and must be accounted for when attempting to synchronize the two systems. IRIG Chapter 4 type methods for inserting data into a format, as exemplified by the handling of MIL-STD-1553 data, could be employed, with the disadvantage of eliminating any knowledge as to when a particular measurement was sampled, unless it is time stamped (similar to the time stamping function that is provided to mark receipt of 1553 command words). This can result in excessive time data as each sensor bus can manage a large number of analog sensor inputs and multiple sensor buses must be accommodated by the data acquisition system. The paper provides an example, using the Boeing developed IntelliBus system and the L3 Communications - Telemetry East NetDAS system, of how correlated data can be acquired from a smart sensor bus as a major subsystem component of a larger integrated data acquisition system. The focus will be specifically on how the IntelliBus schedule can be synchronized to that of the NetDAS formatter. Sample formats will be provided along with a description of how a standalone NetDAS stack and an integrated NetDAS-IntelliBus system would be programmed to create the required output, taking into account the unique sampling characteristics of the sensor bus.

The thesis of this dissertation is that, despite widespread belief in the security community, systems are still vulnerable to attacks from malicious peripherals delivered over the PCI Express (PCIe) protocol. Malicious peripherals can be plugged directly into internal PCIe slots, or connected via an external Thunderbolt connection. To prove this thesis, we designed and built a new PCIe attack platform. We discovered that a simple platform was insufficient to carry out complex attacks, so created the first PCIe attack platform that runs a full, conventional OS. To allows us to conduct attacks against higher-level OS functionality built on PCIe, we made the attack platform emulate in detail the behaviour of an Intel 82574L Network Interface Controller (NIC), by using a device model extracted from the QEMU emulator. We discovered a number of vulnerabilities in the PCIe protocol itself, and with the way that the defence mechanisms it provides are used by modern OSs. The principal defence mechanism provided is the Input/Output Memory Management Unit (IOMMU). The remaps the address space used by peripherals in 4KiB chunks, and can prevent access to areas of address space that a peripheral should not be able to access. We found that, contrary to belief in the security community, the IOMMUs in modern systems were not designed to protect against attacks from malicious peripherals, but to allow virtual machines direct access to real hardware. We discovered that use of the IOMMU is patchy even in modern operating systems. Windows effectively does not use the IOMMU at all; macOS opens windows that are shared by all devices; Linux and FreeBSD map windows into host memory separately for each device, but only if poorly documented boot flags are used. These OSs make no effort to ensure that only data that should be visible to the devices is in the mapped windows. We created novel attacks that subverted control flow and read private data against systems running macOS, Linux and FreeBSD with the highest level of relevant protection enabled. These represent the first use of the relevant exploits in each case. In the final part of this thesis, we evaluate the suitability of a number of proposed general purpose and specific mitigations against DMA attacks, and make a number of recommendations about future directions in IOMMU software and hardware.

ITC/USA 2007 Conference Proceedings / The Forty-Third Annual International Telemetering Conference and Technical Exhibition / October 22-25, 2007 / Riviera Hotel & Convention Center, Las Vegas, Nevada / While any vehicle that is typically part of a flight test campaign is heavily instrumented to validate its performance, long term vehicle health monitoring is performed by a significantly reduced number of sensors due to a number of issues including cost, weight and maintainability. The development and deployment of smart sensor buses has reached a time in which they can be integrated into a larger data acquisition system environment. The benefits of these types of buses include a significant reduction in the amount of wiring and overall system complexity by placing the appropriate signal conditioners close to their respective sensors and providing data back over a common bus, that also provides a single power source. The use of a smart-sensor data collection bus, such as IntelliBus™1 or IEEE-1451, along with the continued miniaturization of signal conditioning devices, leads to the interesting possibility of permanently embedding data collection capabilities within a vehicle after the initial flight test effort has completed, providing long-term health-monitoring and diagnostic functionality that is not available today. This paper will discuss the system considerations and the benefits of a smart sensor based system and how pieces can be transitioned from flight qualification to long-term vehicle health monitoring in production vehicles.