The formidable Roma! Just as I finished writing the first one, the second part was uploaded on a torrent site, and then later uploaded onto archiving websites. The episode accordingly came from a Best Buy test sample DVD. The entire second Christmas special on a sample DVD from Best Buy, Gunu, the episode was directed by the same guy that directed Battlestar Galactica and Robotronical. It was James Almas, and was written by Joseph Winters. The episode started immediately after the first one, with the camera focusing immediately on Mortimer outside, holding boxes. He was noticeably groaning before setting down the boxes with a fed, softening it from the snow. Mortimer let out an exhausted sigh. Welcome back mortals. We've got a decorative treat for you. What happens when something as simple as a decoration starts murdering random people? You'll soon find out with inflatable killer. The camera zooms before transitioning to nighttime, with two men plugging in their decorations. Well, we've got that situated. Chaz explained, patting his friend on the back. Since when did we get that inflatable snowman? His buddy, Rick asked. Chaz looked at the snowman before saying, I think we got that from a garage sale. Rick nodded. I think so too. There wasn't really a box either way. The next day, with the decorations up, Chaz noticed something red. He went outside and checked. Um, Rick. Chaz screamed. Rick got his coat and boots on before running on the snow in the front yard. Rick saw what Chaz was screaming about. The mailman was laying on the snow, with what looked like a huge hole through his chest. You wouldn't think.  No, it wouldn't. Rick said, in shock. The montage shows more and more people dying in creative ways from the inflatable, with one being blasted by the coal on its body. Each of them popping off and smacking into the person with what sounded like a shotgun blast sound. That is it. Chaz screamed. He grabbed a pair of scissors and went for the inflatable, as this was happening. Rick was noticeably stammering in the background, trying to warn Chaz the potential risks. This figure should haunt us now. Suddenly, the inflatable arm grabbed Chaz with a death grip. Its face contorted into an evil look, like from the horror movie, Jet Frost. Its other hand plunged into Chaz's body with a gushing. His body was shoved through, with Chaz spurting blood out of his mouth.  Rick screamed, running away from this thing. There was a loud, noise as two of the Christmas lights grabbed Rick. Rick fell into the snow as Rick was suddenly dragged, with him screaming. The episode ended with two detectives that should sound familiar. That's right, the voices for F-Rank and C-9 were heard as references to Robotronical, which would make sense. Detective Ken, F-Rank, looked at the blood on the snow. Looks like someone was gutted. He said, touching the snow. Detective Robert, C-9, noticed it too. Yeah, maybe these decorations tell a story.  The screen fades and shows Mortimer, staring at his lights before he said. Oh my apologies. You know what they say, decorations are captivating to the eyes, even the murderous ones. He said with a grim laugh. Well, this calls it. I'll see you all next time in my manner. Tata and Merry Christmas. Mortimer waved as the credits played. While it was amazing for some people to hear two familiar robotic voices as cameos, most people were thinking the show was losing its steam, like, really? A killer inflatable decoration that kills the two people. Most of the team had already left the studio, with most staying in to write and make more episodes. There were other planned holiday specials, but they were all cancelled due to one glaring problem. One problem that can be described in one episode. What is it? Find out soon.


Senator Bernie Sanders has ruffled quite a bit of feathers at Amazon, especially as of lately because he's been so vocal and unapologetic in advocating for the Amazon Union effort currently taking place in Bessemer, Alabama, and they're so angered at his advocacy for their workers that the CEO of Amazon himself, Dave Clark, chose to publicly denounce Bernie Sanders via Twitter. We talked about that last week on the program, but Bernie Sanders did actually do a speech for the workers of Amazon. So we tweeted out a video of his speech along with some of the testimonies from workers. We share how the company abuses them and exploits them. And he also states Amazon workers in Alabama are sick and tired of being treated like robots. They're standing up and fighting back and I am proud to support them. So we're going to play the video that he shared and then I'm going to show you the response from Amazon because once again, they sent one of their cronies to respond to and attack Bernie Sanders. And the issue of working conditions, I'm very proud of our working conditions. We now have documents that reporters have uncovered showing that Amazon is in fact aware of drivers peeing in bottles. These people in the name of the convenience of getting dropped at our door are being used and abused because it's peak season. The stories of the workers there that I met in Bessemer at that plant were horrific. We're being treated like we're prisoners who's there to get a job done. Constance and surveillance.  The inability to meet whatever the demands are. When I first got there, they said that after 30 days, you have an opportunity to move somewhere else. After my 30 days, they added another stipulation. You got to pack 300 bucks an hour to be able to move the bus. I don't know where that comes from. I have a lady right now who's my heart going out to right now because she's off with an injury. If history teaches us anything, is that big money interests do not give you anything. You got to stand up and fight for it. I need messed up on when I was at birth and then they sent me right back to pick it. Martin Luther King said the best anti-poverty program he knew of was the union. What is the story about elevators? You can't use the elevators. They got tons of elevators in here. They just don't have them for the employees. You and you can bring it in to make a change when it comes to job security, you're safe and well-fowed. When I asked my superiors, I was like, I cannot do this. My knee. Why would y'all send me back to picking when this is what messed my knee up? And she was like, I can't help it. It's not me. You know, she said it's the company. Let's win this thing. Let's make history. So we just watched the video. We all heard with our own eyes and ears, Amazon workers themselves describe the conditions. And on top of that, there's been other reporting journalist Ken Clippenstein explains how Amazon is currently deploying a troll farm to combat anti-Amazon rhetoric online. I mean, this is a PR nightmare for the company. But when you have a monopoly and when you have so much resources, you know, you can put money into trying to spread misinformation at the behest of your company. So Bernie Sanders shared that video. And guess who decided to respond?  We treat our employees with dignity and respect. It's funny because they just said that you don't in the video we all watched. We offer a $15 an hour minimum wage, health care from day one and a safe, inclusive workplace. Once again, we invite you to take a tour so you can see for yourself. And since there are 40 million Americans earning less than Amazon starting wage, we ask you and your colleagues to please raise the federal minimum to $15 as well. So this is basically the same thing that Amazon CEO Dave Clark said. They use the $15 an hour minimum wage as an excuse as to why their employees shouldn't form a union when we all know that if their workers were unionized, they'd be making well over $15 per hour.  Now, if that name Jay Carney sounded familiar to you, well, you might have remembered him from the Obama administration because he actually was the White House press secretary for Obama and he now works for Amazon.   I mean, David, don't put out a phenomenal video of all of these fake accounts that are popping up online from bots or paid trolls to basically do propaganda at the behest of Amazon where they say, hey, I'm Peggy from Oak Four, you know, that warehouse and I love my job at Amazon and I don't want a union because, you know, Amazon is a great job and we're like a family and I don't want any outsider to come into my family and dictate the terms of, you know, my family and I, it's just, it's laughable. So some people buy this, it works on a lot of people and in Alabama, you know, they have a right to work law that is on the books. So I don't necessarily know if the Amazon union effort is going to succeed. I hope it does because this could be the start of a new wave of unionization in America. And that's really important. Perhaps by the time you see this video, we'll have some more information because the vote has already taken place at the time I filmed this. I don't know how long it's going to take for them to tell you the votes. But this is something that needs to happen. If you care about workers, then unions are one of the most pro worker things that you can support because this is what empowers workers. It gives them not an equal footing with, you know, the employer, but it gives them more of a say and allows for less exploitation, higher wages. It's just, it's crucial. And, you know, with how much Amazon is going out of their way to stop this union effort, that alone should speak to the importance of unions. They view unions as a threat. And because they're doing so much to stop it, it goes to show you how powerful unions could be in the fight in America for labor rights. So yeah, I absolutely am rooting for the Amazon warehouse workers in Bessemer, Alabama.


What's up everyone? It's your girl Kenzie here from Layton Sports Cards and I'm ripping a personal for Tyler W We've got a 21-22 Panini prison basketball hobby best of luck here Tyler Let's see what we get you Get everyone no one is in queue after Tyler so get those orders in about five minute wait right now Oh, just big mojo, big mojo flashback Got Pulsar on the first one Josh Christopher rookie got Pulsar Jason Williams for the for the Kings Blue Torian Prince for the T-wolves 102 of 199 KD prismatic Christian Wood Bobon Semenovic rookie Herbert Jones rookie Juan Toscano Anderson rookie Got Silver James Harden Hyper of John Collins mindset Zion Wendell Carter Jr Kessler Edwards rookie got Josh giddy rookie base Thunder Rashid Wallace fireworks hyper Kevin Durant And we've got for the Knicks Sensational signatures rookie Otto Miles McBride Next rookie Otto. Thanks for subscribing Gerville Gervieger John Wong you know Maldon Trey Mann rookie base for the Thunder Brandon Boston Jr. Corey Kisper rookie Silver Haliburn Silver prismatic of Kevin Durant And we've got Nets on the rookie Otto Darren Sharp Darren Sharp rookie Otto Jeremy Grant quickly Quentin Grimes rookie we've got red wave rookie of Mamalouchevilley. How do you say this one? Momokelashvilley close nice one there hyper Rashid Wallace Bones Highland rookie base Carmelone Chris Duarte on the rookie. We've got Silver Luca Garza for the Pistons Purple ice of Xavier Tillman for the Grizzlies 19 of 149 Penny Hardaway fearless Base All right second half here for you Tyler morning Aaron Wiggins rookie Luca Garza Silver Alaria Markinen got hyper Tyrese Halliburton mindset Russell Westbrook Chamberlain Keita rookie got Evan Mobley on the rookie Orange wave of David Robinson for the Spurs 13 of 60 Prismatic John Trey Murphy the third Santi Aldama rookie got Silver Aaron Gordon Silver fearless of Penny Hardaway prismatic Ant-Man Johnston got red wave of Lonnie Walker the fourth the Spurs Hyper Ricky Rubio Cavs fearless Yanis onto the Kubo A couple packs left here for you Tyler See some nice rookie color Jaden Springer Charles Bassie Silver Rookie of Josh Christopher for the Rockets Red sub bonus for the Pacers 35 of 2.99 Anthony Davis 75 years insert Scotty Lewis got red carousel overt for the Pacers to 75 on the anniversary Eric Gordon for the Rockets 68 out of 75 Bradley Beale fireworks and base Alrighty Tyler that will do it for your prison box. Thanks for hopping in and we will get these cards right out to you


Welcome to the U.S. Naval War College, the Navy's home of thought. NWC Talks features our world-class experts examining national security matters. We hope you enjoy the conversation. We live in an age of unprecedented intelligence capabilities. For example, I know you're watching me right now, but do you know who's watching you? Like it or not, intelligence is a feature of our daily lives, and this new reality poses challenges to the U.S. government, the intelligence community, and national security professionals. But there are also greater historical forces at work that we must face as an entire country. Now military historians have distinguished between a revolution in military affairs and a military revolution. Briefly, a revolution in military affairs refers to changes in tactics, doctrine, or technology that change the character of warfare. But a military revolution refers to changes in warfare that fundamentally transform state and society. For many years now, intelligence studies have proposed an ongoing revolution in intelligence affairs, and they say that it's affecting traditional intelligence organizations, operations, and analysis. But the world is also experiencing an intelligence revolution that is changing state and society as we know it. I'm Dr. Jeff Rogg, a postdoctoral fellow in the National Security Affairs Department, and this is NWC Talks, America and the Intelligence Revolution. Today, I want to discuss why the United States is struggling to adapt to the intelligence revolution, and therefore why the United States is at risk as both a global power and a constitutional state in the 21st century. Intelligence is often called the world's second oldest profession, but it's really only been a profession for the past century, give or take a few decades in the 19th century. Over this time, the world began to experience an intelligence revolution. Now, paradoxically, the United States played a pivotal role in igniting the intelligence revolution, but the history of intelligence in the United States has not prepared us for its challenges. As it turns out, both the cause of and solution to these problems lie in civil intelligence relations. Civil intelligence relations refers to the relationship between intelligence on the one hand and the state and society that it serves on the other. There have been two major themes in American civil intelligence relations. First, there's an ideological theme. Since the very beginning, this country has always used intelligence. This goes back to the Revolutionary War even. But the American people didn't like the idea of their government doing sneaky spy stuff, and they especially didn't like the idea of their own government spying on them. And this ideological theme interacts with a structural theme. The US has continuously faced problems with how we organize, legislate, guide, and really define the role of intelligence in American national security. One major issue that reflects this is that we've had a tendency to subordinate intelligence to other institutions of national security, like the military, diplomacy, and law enforcement. These national security institutions and their executive departments compete with each other and they've prevented intelligence coordination. They've also inhibited the emergence of an independent intelligence profession and institution. Jumping a little bit ahead in American history, the Cold War was really the formative period for American intelligence. After the Second World War, the threat of the Soviet Union and communism provided the basis for a Cold War consensus between the American people and the government. And this allowed the creation of an American national security state with a large peacetime intelligence system. But this US intelligence system reflected rather than resolved tensions in American civil intelligence relations. For example, the CIA was created in 1947. And under the 1947 National Security Act, it had a legislative mandate to coordinate intelligence. But immediately, competition with other executive departments, like the State Department or Department of Defense, undermined its ability to coordinate intelligence. At the same time, we also created an artificial wall between foreign and domestic intelligence, because we said that the CIA couldn't have any domestic police powers. But this, in fact, was a reflection of civil intelligence relations. First, there was bureaucratic competition with the FBI, which was really a law enforcement organization that absorbed domestic intelligence powers. And second, there was American ideological concerns at the time over a super spy system or an American Gestapo. Also during the Cold War, the US created even more intelligence organizations like the National Reconnaissance Office and the National Security Agency. And it subordinated them to the Department of Defense. But this, in fact, reflected ongoing tensions in civil intelligence relations, including competition over key intelligence functions, like signals intelligence in the case of the NSA, and a sort of ideological belief that intelligence should serve defense purposes, especially in the context of the Cold War. Now, this is just a brief survey of what was happening with intelligence in the United States. But I really want to emphasize what happened with intelligence in the Soviet Union. The Soviet Union set out to create the new communist citizen. And in order to do this, it had to watch people and monitor their behavior. So it used pervasive intelligence with the goal of reordering state and society. Other communist states like China used intelligence for similar purposes. It's this motivation to use intelligence to transform society that helped generate the intelligence revolution. Another pillar of the intelligence revolution that evolved out of the Cold War intelligence competition was with technology.  And they used these aside from traditional human espionage. So the Cold War actually helps usher in the information age with satellites, computers, and the internet. Today, this new technology allows states to spy on their citizens beyond anything the Soviet Union could have dreamed of. Consider China's emerging social credit system. The goal is to shape people's actions, behavior, relationships, even their minds. So China is using the combination of intelligence and technology to change state and society. As the US government accuses the Chinese company Huawei of being a proxy for Chinese intelligence in the Chinese state, there's a long history in the United States of cooperation between the US intelligence community and the private sector. This goes back to the 1920s in the Cypher Bureau, to the Cold War NSA programs, Shamrock and Minaret, to the post-911 NSA programs, Stellar Wind and Prism. And at the same time, today, private companies like Google are using intelligence collection and big data to monetize surveillance. So really, there's no place to hide as a private citizen these days as big governments and corporations exploit intelligence to try and understand and influence our behavior. In short, we're in the middle of an intelligence revolution. Ongoing events actually further reinforce the effects of the intelligence revolution. Take, for instance, COVID. Countries like China, South Korea, Israel and Singapore leveraged intelligence organizations or capabilities to do what we all now know as contact tracing. But we're not tracing a virus. We're tracing human beings, including their daily activities, their social lives, even their spending habits. The US has proven resistant to downloading these contact tracing apps. And part of this is due to the American people's continuing fear over surveillance, privacy and civil liberties. But even beyond COVID, we face an onslaught of intelligence challenges that strike at fault lines in American civil intelligence relations and have left us fumbling for responses to the intelligence revolution. For instance, some SolarWinds cyber intrusion. Members of the government, the media and national security professionals have referred to it as a cyber attack. At the same time, the US intelligence community have said that it was cyber espionage. So the US still tends to conflate intelligence in the military, just like it did during the Cold War. And this point raises the issue with how the United States has organized and structured intelligence as part of the national security establishment. SolarWinds has generated a new debate over the functions of the NSA and cyber command. Importantly, both Department of Defense components. The Department of Defense still controls the most organizations, capabilities and has the biggest budget in the US intelligence community. This is a problem and often an overlooked one for civil military relations because the US military controls key intelligence functions and capabilities that provide even further pathways for the military to potentially threaten American liberty. When we combine this with the NSA's history of surveillance that has swept up millions of Americans, even if unintentionally, the old boundary between foreign and domestic intelligence and the view that intelligence is a subordinate function of the military are increasingly irrelevant.  At the same time, the United States still tends to regard military strength as the ultimate measure of national power. Nikita Khrushchev allegedly once said that the Soviet Union would defeat the United States even without firing a shot. Whether or not he said this, it didn't come true. But today, Russia is trying to do something similar by using intelligence and disinformation to target the American political system and civil society. Americans have utterly failed to unify against this foreign intelligence threat. And we've actually rewarded Russia by further dividing ourselves politically. China has also weaponized disinformation. In the case of COVID, China has used propaganda to tell the world that the United States was responsible for creating COVID. And so it's trying to use disinformation to raise its standing and lower ours as a global power. And aside from the better known cases of Chinese economic espionage, China is currently collecting the private data and biometrics, including the DNA of tens of millions of Americans. So the Chinese state is honing its ability to target American citizens individually and collectively. Just imagine if China is able to apply the lessons of its social credit system in the United States without our knowledge or even our understanding. What this means is that the United States must transition from a state designed around industrial warfare because we're no longer in the industrial age, we're in the information age. So subordinating intelligence to the military, which was seemingly legitimate course of action for most of American history, will not satisfy the disruptive transformations of 21st century conflict and competition. Now as a product of its past, the United States currently does not have a unified coordinated intelligence institution.  One possible solution and something we always talk about is structural intelligence reform. So one idea is a department of intelligence. According to this model, the National Reconnaissance Office, the National Geospatial Intelligence Agency and the National Security Agency would no longer be Department of Defense components because their mandates and capabilities exceed defense. The CIA would also be part of this Department of Intelligence, as would a new domestic intelligence agency that absorbs the domestic intelligence functions of the FBI, because it's really a law enforcement organization, not an intelligence organization. But as we can guess, the two enduring tensions in American civil intelligence relations would continue to plague any attempt at structural intelligence reform. First we have the problem with bureaucratic competition from executive departments that always undermines intelligence coordination. And then we have American ideological concerns over a powerful unified intelligence institution that can threaten our liberty and our privacy. Still it's increasingly apparent to many observers that the United States needs structural intelligence reform. But perhaps the main flaw in this approach is the tendency of the US government and national security professionals to try to reorganize our way out of crises. Again, the idea of a revolution in intelligence affairs dominates the debate in government and among national security professionals because it proposes that the solutions to our intelligence problems lie within the ability of the government to solve. But this isn't just a revolution in intelligence affairs, it's an intelligence revolution that is changing state and society as we know it and therefore requires the attention of the American people. In other words, the American people simply cannot remain mired in older patterns of structure and thought regarding intelligence. Reforming not only how we organize our intelligence system but also how we legislate it, define its roles and balance its dangers, requires the participation of the American people. I just want to lay out a few of the tensions that we need to grapple with as an entire country. The biggest problem is that there's too much secrecy, mythology, and even distortions that complicate the American people's understanding of how our intelligence system was created and how it's evolved across history. The US government and the intelligence community have actually contributed to this problem because they haven't been transparent with the American people. In at least one instance that I've already mentioned, it's very clear, and since the very beginning, the intelligence community has frequently monitored the American people and it's done so on the basis of dubious legal and constitutional grounds. Problematically though, our laws and our statutory authorities are struggling to keep up with technological transformations that make intelligence not only more practical but also more necessary for national security. Furthermore, technology in the way our adversaries are harnessing it has destroyed the wall between foreign and domestic intelligence. And while the boundaries between foreign and domestic intelligence may be artificial, they're still important to the American people. The American people simply won't tolerate some things that the intelligence community does abroad done here. Now the exception to this is when there's a perceived threat and this is where things often go wrong. Many people are calling for a new domestic war on terror in response to the terrible attacks on the US Capitol on January 6th, 2021. However, American intelligence history provides ample warnings about how domestic intelligence eviscerate civil liberties. And this is something that goes back to the Revolutionary War, but we see continuously with the Spanish-American War, the First World War, the Second World War, most of the Cold War, all the way to the near contemporary global war on terror. So what the American people need to learn is that we have to be careful what we wish for. Intelligence is a liberal by its nature, but the American people have a hard time coming to terms with the trade-offs between liberty and security. Far too often, we sweep aside liberty for security during a crisis, but then it's really hard to roll back intelligence powers and capabilities just because people no longer feel they're necessary. Our present predicament is particularly fraught, and this is because we're mixing intelligence with domestic politics. Foreign interference and disinformation aren't going anywhere, but the American people have made intelligence issues the basis for domestic partisan political disputes. So in effect, we're doing most of our adversaries' work for them. So as is often the case in American intelligence history, we are the authors of our own misfortune here. Mixing intelligence and politics has been a real Achilles heel in American civil intelligence relations throughout history, and it's one that our foreign adversaries will continue to exploit to undermine our faith in our political system. And worst of all today, we really don't have any good solutions to this, and we're still further dividing ourselves politically. Now in response to these provocations, many national security professionals are calling for a new era of political warfare, but U.S. intelligence operations during the Cold War era of political warfare didn't necessarily serve us all that well. We tend to define intelligence by its failures rather than successes, and these perceptions affect civil intelligence relations. And so during the Cold War, by the 1970s, revelations of U.S. intelligence operations abroad in countries like Iran, Guatemala, Cuba, and Chile clashed with American principles of self-determination and democracy. Meanwhile, U.S. intelligence operations at home by the CIA, the NSA, and the FBI embarrassed, but also fundamentally scared the American people about our own intelligence system. And finally, revelations that American intelligence targeted student and civic groups, journalists and media companies, academics and academic institutions as part of what we call the cultural Cold War, ultimately clashed with the idea that American culture is just manifestly good, and it's something that people would accept without needing to use sneaky spy stuff to encourage them to. So as a result, during the Cold War, intelligence operations conflicted with American values and they eroded public trust between the intelligence community, the government, and the American people, the three pillars of American civil intelligence relations. So the lesson here is that we must take care that our response to intelligence activities by other states doesn't undermine our own constitutional system and the principles that give it meaning. Still, ultimately states like China and Russia are refining their intelligence systems according to the advances of the intelligence revolution in order to control their populations and influence ours. And at the same time, the whole of the United States, including the government, the intelligence community, private companies and social media giants like Facebook and Twitter, and the American people themselves are struggling to respond to the transformational challenges that the intelligence revolution poses. Here's the central tension facing the United States. In order to effectively confront our intelligence adversaries and intelligence threats in the 21st century, it seems like we're gonna have to adopt illiberal measures in both at home and abroad. But this was what the United States did during the early Cold War. And by adopting these measures necessary for national security and our status as a global power, we undercut our values as a representative government in a free society. So the United States potentially faces a startling trade-off in the 21st century. Either we create a new powerful national security state that wields intelligence across all its liberal forms, both at home and abroad, or we Americans fiercely protect our constitutional state and our civil liberties, but at the cost of global power and national security. Now this sounds like a rather stark answer to a seemingly reconcilable problem, but there's a saying in intelligence that you should always try to make sure you ask the right questions before thinking you've got the right answers. So I wanna leave you with a key question facing America in the era of the intelligence revolution. Can the American people adopt a new understanding and institution of intelligence to address the national security challenges facing us? And at the same time, can we achieve a healthy balance of civil intelligence relations that preserves American values, liberty, and our constitutional republic? I'd like to thank you all again for joining me. I'm Jeff Rog, and this has been NWC Talks, America and the Intelligence Revolution.


Every year, thousands go missing around the world as a result of conflict or other forms of violence. People can be killed or imprisoned without the knowledge of their families and friends. Children, migrants and other vulnerable groups can be abducted for ransom or forced to fight. The families of the missing are plunged into an abyss of anguish and uncertainty over the fate and whereabouts of their relatives. Many spend years searching or waiting for their loved ones to return, while struggling with the ambiguity of this loss, never knowing if the person is alive or dead. Between 1986 and 2006, 75,000 people were abducted by armed groups in northern Uganda. Over 10,000 of those are still thought to be missing. Alfonso's son is one of them, taken 10 years ago and never heard of again. Alfonso has been looking for his child ever since. He's talked to other children who have managed to escape their captors, but none of them had news of Francis. In Mexico, hundreds of migrants go missing each year, attempting to cross the border into the US. Some don't survive the long and arduous journey. Others are kidnapped for ransom or killed in armed violence. His brother disappeared in 2008. He left for the United States in search of work, and told his family he'd be home in just a few months. We don't know anything about him. The disappearance of my brother Ulises has affected us a lot, because when he left, we were enraged. Until now, we have been paying for the interests of the money we had lent to us. It has affected us all, both economically and emotionally. Sometimes we meet on December 24th or 31st. Where is he? Did he eat, if he lives? If he doesn't live, where is his body, what did they do to him? It's a great pleasure. Solidad has found comfort in a friendship with Goudilia, whose husband went missing. They met at an ICRC peer support group and motivate each other to attend the meetings. They must travel by foot and bus for two days to reach Oaxaca, where the meetings are held. I have a friendship with Goudilia, we are in the same situation, we want to meet our loved ones. As well as offering peer-to-peer counselling, the meetings provide an opportunity for people looking for their relatives to make contact with the authorities and other organisations that can help them with their search. The families have many difficulties when it comes to search for the family members. They don't know which are the institutions which can help them, because there are no standard search mechanisms. Also if they get to talk to the authorities, the communication is not very regular, so they don't have feedback. Finding out the fate and whereabouts of people who have gone missing takes time. Some families wait years until they get an answer, some will never know. Helping people deal with this uncertainty is also essential. We also train forensic specialists and other government agencies to encourage better practice when it comes to documenting missing cases and identifying human remains. Families often need support during this process. We bring people together, we link them to each other, we make them share their experiences, so then this reflection always helps to resituate the families and give them the feeling that life doesn't have to be focused only on this missing person. In Uganda, peer support groups help relatives of abducted children cope with the psychological and social impact of their loss. What we have realised with these groups is that coming together, sharing this kind of talk with the families of the missing really helps a lot. When they started coming, something we can cry, it's very emotional, but as we continue for the second group now, we find the emotion is getting down, they look much happier. For Alphonse, the sessions have been a way to meet people going through a similar experience. Now he looks forward to leaving the house and attending the meetings. When I come back home, I want to talk to the people who are coming to my home. The ICRC works with community organisations to assess the needs of the people looking for their relatives and offer tailored support. It also advocates for better recognition of the difficulties relatives face and works with the authorities to reduce legal and administrative hurdles. Right now in most of the legislations, there are only two statuses, either you are dead or you are alive and there is no status for missing persons. And this is where we come in, we are advocating to introduce legal statuses for those that have disappeared and for their families. We are supporting them in the process of starting their own small businesses by giving them a loan that could help them start the business and in this way have them earn their own money instead of being in a victim position that is always just receiving assistance. In Georgia, over 2,000 families are waiting for news of loved ones lost in the conflicts that have ravaged the region over two decades. Lile's brother is suspected to have died in a plane shot down in 1993, but his remains were never found. Since her brother disappeared, Lile has become the sole breadwinner for the family, supporting her bereft mother as well as caring for her own daughter. This year, she received help to develop her jewellery business. Her creations are now for sale, not just in her workshop, but also in one of Tbilisi's most prestigious jewellers. The Georgian authorities are currently examining remains from the crash, which means that Lile may soon find out if her brother was on the plane. The possibility of getting an answer after all these years is daunting. For some families, an answer may be on the horizon, but for many others, the anguish and need for support continues. Finding a positive way to remember, celebrate or commemorate a missing person can be a great comfort to families. It can help them move on with their lives, while the search continues.


I'm excited to be here too. Let's first do a little poll. Who of the audience has heard of Nova or who has worked with Nova? Maybe a quick short of hands. Okay. I think about half the folks. So today I'll be giving a talk about Nova hypervisor all of the Nova which is our port of Nova to the most recent arm architecture. And since only half of you know Nova very well, the first part of the talk will go a little bit into detail about what Nova is and where we came from. Then the second part of the talk I'll talk about virtualization on arm V8A. Arm A is the A profile for the performance course. There's also arm R for real-time course and arm M. We are talking about cortex A. And then I'll conclude the talk with the current status. We'll do a little demo here. We've already put some equipment here and then I'll talk a little bit about roadmap. So those of you who've been following the micro-common dev room today, you've seen this system which is Nova on x86 already in action when Norman gave his talk on G-node. So Nova on x86 is a system that has existed for more than 10 years. And the way that virtualization works on x86 is that without the virtualization extensions you have two processor rings, really four of which only two are used. You have ring zero which is used by the kernel and ring three which is user mode. And you have an operating system and applications running in those two modes. This virtualization, these rings are now called guest rings which is why we call them ring zero G and ring three G. And you get the same set of rings duplicated for host mode. We have ring zero H and ring three H. So ring zero host is occupied by the Nova micro hypervisor and ring three host is occupied by what we call hyper processes. And the whole G-node framework that you saw two talks ago is a framework that runs in ring three host. It's interesting to note that the Nova micro hypervisor is the only component that runs privileged and everything else, all the colorful apps that run in the host and everything that runs in guest runs deep privileged. There's a little footnote there that says obviously we have no control of firmware. What's also interesting to note is that we give every virtual machine its own instance of a user level virtual machine monitor which means that should something go wrong in a virtual machine, should you have a VM escape, should an instruction not be virtualized properly or something like that, then a VM escape will only affect that VMM instance and the rest of the system will not be affected. So now we took this system and we said let's build something like that on ARMv8. And the next slide shows what does Nova look like on an ARMv8 architecture. So at the bottom we have the hardware and then we have four privileged levels which ARM calls execution levels. So starting at the top we have EL0 which is user mode, EL1 which is supervisor mode where kernel runs, EL2 is called hypervisor mode this is where Nova lives and then we have EL3 which is called monitor mode in which a firmware monitor sits that can switch between a non-secure and a secure world. And we do not own this monitor, we do not control it and we also do not control a trusted execution environment like an opti that runs along the side. But in the world that we own which is the top left corner the non-secure world upwards from EL2 Nova is the only privileged component and all the other properties that we had on X86 including a virtual machine monitor, pure guest VM and the deep privileged host environment, all of that has been carried forward to ARM. Now let's talk a little bit about Nova. Nova is hypervisor, micro hypervisor that takes the best ideas from micro kernels, capability based systems, high performance virtualization and puts all of that together in a small piece of code where the X86 version is less than 10,000 and the ARM version currently is less than 7,000 lines of code. It is based around capabilities. What does that mean? We have a bunch of kernel objects that I've shown in the middle. We have protection domains, these are address bases. We have execution contacts, you can think of them as threads or virtual CPUs. We have portals, these are communication endpoints by which protection domains and threads inside them can communicate and all these kernel objects cannot be referenced directly. Instead, we give every protection domain that needs to access them a capability. What is the capability? You can think of a capability as a pointer to a kernel object plus associated permissions. Possession of a capability gives you the right to invoke that capability and to access that object. If you don't have a capability to an object, you can neither name the object nor access it. That's a very powerful security system. SEO4 has the same and a lot of newer micro kernels do. You can build really powerful other systems on top as Norman has demonstrated with Genome. The same principle, by the way, works for memory where you can think of a virtual address as being a capability to a physical memory page with read-write execute permissions. That same principle is also applied for NOVA. We have multiple spaces, we have an object space for these capabilities and we have a memory space for delegation of writes to memory. In the older version, the X86 version, we used to have a mapping database that tracked all these dependencies of who gave the capability to whom and things like that. When we got rid of all that, we replaced it with a new hypercall called control protection domain, which takes two capabilities, the sender and the receiver protection domain, and you have a take-grant model where the possession of, let's say, a capability A and a capability B for those two protection domains, you can say, take the two capabilities from slots two and three in protection domain A and put them in slots six and seven of protection domain B. Obviously, we have more than eight slots. This is just for illustrative purposes. If anyone wants to refer to a capability, they give a select door which is a number and index into that space and say, I want to do something with capability two. This is how it works, it's like a file script. So upon this, we built some basic abstractions and these are the basic abstractions that the NOVA version on X86 has had for a long time. So on the left, you can see two protection domain, think of them as two address spaces, two applications that want to communicate with each other and in the protection domain A, call us red and EC here, and it has a scheduling context attached to it. And those of you who saw Garnet's talk this morning know that the scheduling context is a really nice abstraction for expressing scheduling parameters and for delegating it along a call to implement priority inheritance and NOVA has had this for 10 years. And we also have on the other side a call the execution context that has no scheduling context. For the very same reason that Garnet gave that you can completely account the execution of a server invocation to the caller. So what would that look like? The caller makes a hyper call, in this case called IPC call. It gives a capability, or a selector to a caller and what's called an MTD. We call this message transfer descriptor and the message transfer descriptor tells NOVA how many words to copy from the UTCB of the caller to the UTCB of the callee. So the UTCB is like a message in an outbox. It's very abstract and the same mechanism applies no matter whether you're on X86 or on ARM. So once that call has been made we now transition over to the right side. The situation looks like this. The scheduling context has been given to the callee. This achieves priority inheritance or in case of real-time bandwidth inheritance. The callee can now execute because it has a time slice. The time is accounted to the caller and at some point the callee is going to do a reply. It invokes IPC reply, gives a message transfer descriptor, says how many words do I want to copy back from my UTCB to the caller and then we are back to the left side. This is the basic mechanism by which protection domains and threads in protection domains communicate with each other. And this also illustrates how the different kernel objects sort of come into play there. So the MTD defines the number of words to copy between those two yellow UTCBs and we'll see in the next slide how the MTD is also used for other purposes. Now I said NOVA is a micro hypervisor. This means at some point we need to deal with virtual machines, with virtual CPUs, with emulating instructions and devices. So a lot of you will notice that this slide looks very, very similar to the previous slide. Why is that? Because we layer VM exit handling and the emulation exactly on top of IPC. So the difference is that we now have two protection domains that I'll call the virtual machine in which an execution context run that is a VCPU and we have a VMM which in this case is a server. It provides the virtual machine service and the execution context here we call it handler. So at some point the virtual CPU is going to take a VM exit on x86 or an exception on ARM which requires the attention of the virtualization there. This VM exit takes us into NOVA. NOVA will save the state in a page which we call virtual machine control block because we came from x86. And then NOVA is going to synthesize an IPC call on behalf of the virtual CPU send it to the handler. And the question is now what state do we transmit? And that state is called MTD arc and it comes out of a portal where every event has its own portal. So you can say if I see this event here's that state that I want. If I see some other event here's this state that I want. And then the VMM gets this message in its UTCB and the reply works exactly like an IPC reply except that the handler specifies an MTD arc the result gets stored in a VMCB and when the VCPU resumes or erads back to the guest that state will be restored. So MTD arc is similar to the MTD that I showed you before which copies state around except this time between VMCB and UTCB and not between two UTCBs. Same with the scheduling context the entire accounting of the emulation goes onto the scheduling context of the VCPU. Now we get into ARM territory and before we do that I'll show you how we hide the differences between x86 and ARM and you don't have to understand all these details but here I've shown you the MTD the MTD arc for ARM and x86 which is basically a bit field that describes the different fields and these will also be listed in the NOVA interface specification. So the VMM gets to decide for every event which parts of the architectural states it wants to see and by using this architecture dependent message transfer descriptor we can completely reuse all the mechanisms it's just a message that looks different depending on which architecture you're on. FPU is an interesting state because it's kind of large. So on ARM it's 32 128 bits words which is 512 bytes. This is something you do not want to switch on every VM exit or on every context switch so we switch the FPU lazily which has some consequences. So we call this thread which currently has its state saved in the FPU we call it the FPU owner and then whenever some other thread wants to access the FPU we take the state from the owner we save it lazily give it to the other guy. So that means that the hypervisor has to do two things when we switch away from the FPU owner we have to disable the FPU to see any other access trapping and when we switch back to the FPU owner we have to re-enable the FPU because we don't want the owner to trap the owner has its state in the FPU and that means on a typical kernel exit pass you have multiple conditions to check like am I going back to the FPU owner is the FPU enabled if not and this can all be very time consuming because it's branch heavy code. So how do we make this efficient? Nova has a notion of hazards which are exceptional conditions that the kernel needs to fix up before it goes back to user mode and we have two types we have a CPU hazard for certain exceptional conditions on the CPU like the CPU needs to reschedule the CPU needs to restore a certain state and we have the same thing for ECs the EC needs to reload some state the EC has been recalled and things like that so what we do is we overlay two bits of the state from the CPU hazard and the EC hazard namely the state FPU is disabled and the EC is not the FPU owner and FPU is enabled and the EC is the FPU owner and only if the XOR of both states yields a value of one which means these two conditions are out of sync we actually vector through the hazard pass and do we do this FPU switching magic in the fast case where the FPU is already in the right state so it's disabled and the EC is not the owner or it's enabled or it is the owner we will not take the slow pass so these are some of the performance tricks that Nova is using to get really excellent virtualization performance I'll talk a little bit about intra-virtualization on ARM because unlike X86 we get a lot of help from the hardware ARM V8 has the interrupt controller split into two parts there's one part that lives in the chip set which is called which is the upper part the upper box consisting of the gig distributor and the gig redistributor you can think of it like an IOAPIC the distributor is the global part which takes shared peripheral interrupts coming from devices and the redistributors are CPU local parts which take interrupts like core local timer interrupts and counter interrupts and things like that and then the distributor and redistributor send physical interrupts to the CPU interface which is called gig C and then they normally go to the processing element which is your processor so that's the left side of this diagram and this is the thing that gets used when virtualization is not in the game with virtualization you get the right side of this processing element consisting of something called gig H and gig V and there is they created the virtual interface of the gig C which looks exactly the same like the physical CPU interface except that it doesn't get its interrupt from the distributors it gets its interrupt from the hypervisor control interface and this is what Nova drives so what we do is the map gig V directly into the physical address space of the VM so the guest can access it anywhere at once without causing any exits and all the interrupt injections that come from the hypervisor go to the control interface and this control interface autonomously injects interrupts into the guest so this is very efficient how we expose this at the API level is two fold first of all the interrupt injection logic between gig 2 and gig 3 uses a different format which is really not so nice so we abstract on the injection interface the difference is the way we let the VMM always tell us interrupts in gig 3 format and if you run on something older we convert and then we have a hypercall called assign interrupt which the partition manager can use to steer interrupts to specific cores next thing is timer virtualization ARM has a global system counter which distributes the time in the entire system to all the cores and this is exposed on each core in form of two counters and two timer instances one is called the physical timer which is directly reflects the system counter and the other is called virtual timer which has an offset applied or subtracted from the system counter so that you can hide time progression from a guest the good thing is that the physical timer can be trapped so it can be disabled you can trap and emulate it and this is what we do and this emulation works much similar to x86 so the VMM uses a timer interrupt summer 4 to catch this timer expiring and then this interrupt is asynchronously delivered it's much more complicated for the virtual timer because the ARM architecture does not allow you to trap or to intercept the virtual timer which really forces you to context widget so every time we switch from one vcpu to another we context switch the virtual timer which is obviously a little bit ugly from a context state-saving perspective but the good thing is that the timer interrupt will always be synchronous to the execution of the vcpu so timer interrupt can never come when that vcpu is not running and whenever a timer interrupt comes it is for exactly this vcpu so we deliver such a timer interrupt directly synchronously via a portal next thing is I want to talk about is a system MMU system MMU is a crucial piece of a security critical system because you need not only protect applications from viding to each other's address spaces by means of virtual memory and MMU you also need to prevent rogue drivers that can do DMA from DMAing all over the place like overriding the hypervisor overriding the neighboring protection domain and this is what x86 uses an IOMMU for and the ARM concept is called a system MMU so a DMA transaction that arrives at the system MMU on the left side of the picture has two attributes it has a stream ID which identifies which device it's coming from and it has a let's call it a virtual address or an IO address which is where the device wants to DMA to and then ARM has a configuration piece in the SMMU that consists of stream mapping group which allows you to associate streams to translation context so we have two streams mapping to the first translation mapping to the first translation context and two streams mapping to the second translation context so this would be two devices assigned to the same PD and then a translation context directly maps to a DMA page table TLD in the middle that can cache frequently used translations so it's really important to have this piece supported in the hypervisor otherwise DMA is a critical attack vector so there's a limited number of these stream mapping groups and context which is why we let the partition manager manage them and NOVA then manages the translation part keeping the page tables and the TLD consistent assigning devices to PDs and there's an assigned device hyper call for doing this assignment and binding a device to protection domain so with that let's take a look at all the platforms that we currently support we'll do a little demo here in a few minutes we'll do this demo on the top left board which is an Affnit Tiling Ultra96 and the reason we are doing that is precisely because it has an SMMU a lot of the other boards do not but this board has one and we obviously want to use the best infrastructure that we can have we also run on the nxpimx8mquad and those of you who were in Stefan's talk just a couple minutes ago you already saw that board in action and the VMM that we used on top of NOVA was as Stefan pointed out a joint development effort between Badrock and G-Node and it was a lot of fun to work on this together we also run on Reneser's R-Car the difference for the R-Car is that it's actually two clusters of course but also it's a big little system so we also support big little and then as we know Fostom is a community conference and a lot of you have probably gotten a Raspberry Pi 4 so NOVA also runs on that and we also did a lot of prototyping on QMU so naturally we support QMU out of the box the nxp by the way is the only board we have that has a gigs 3 so we have sort of all combinations of different gigs with MMU without SMMU single cluster all of this is supported so with that I'd like to invite my colleague Shantanu up here who will do a little demo for you I'll quickly summarize what we are going to show so we have NOVA hypervisor we have a bunch of devices we'll assign different devices to different virtual machines using SMMU as you can see here in these shaded colors every virtual machine has a bunch of VR interfaces like a virtual ethernet we connect the different virtual machines together using a virtual ethernet switch and we also have a console into every virtual machine using a URT multiplexer with the URT driver being a component in the host that has direct access to the URT hardware so with that I'll give the mic to Shantanu and he will walk you through the demo and show you a bunch of things so UDOT do you make this full screen can you make this full screen I don't know just destroy sorry okay it was that easy okay so going by the picture that UDOT showed earlier so we've now booted into our URT multiplexer this is the administrative console of our multiplexer it's an asynchronous console and we have basically we can cache all the data coming from our virtual machines so we can list the clients that are connected right now so as you see we have three virtual machines so three VMMs we have the console from NOVA we have the MSC that's the master controller that's our root hyper process and then we have the three guests which is an android and two linuxes so just to show you the boot logs maybe from NOVA because we just had the talk so the screen is not big enough but what you see here is the typical boot log you get from NOVA so most of what's here is basically the interrupts are being passed on and configured for the guests so to show you maybe a virtual machine monitor so these are the logs from our VMM this one is hosting an android system so what you see here is pass through for the devices the display the USB controller because of the touch screen attached and also a connection to the vSwitch so we have a virtual switch it connects three virtual machines here like Udo showed earlier so let me quickly get into a guest here so this one is running the network driver so it has our Wi-Fi driver and I'll also set it up to use the virtual console to use the virtual switch and set up DHCP server so that the other machines can get an IP so what I need to do is probably define myself an IP address and also start a DHCP server so to make sure that this is working I have another Linux system this one doesn't have network connection right now but I can run DHCP clients here so now I have a virtual connection and I also got myself an IP address from the other VM we can exercise this interface maybe sending some bits possibly doing throughput test with the other VM sorry I think I put the wrong IP address so I can definitely ping so I put the wrong IP address earlier so we have a throughput of 580 megabits or so between the two virtual machines this is just exercising the interface and because this is the VM you are Wi-Fi driver I can also connect it maybe I'll just set up a quick hotspot on my cell phone not trusting the Wi-Fi here so I just use WPS applicants to set up a Wi-Fi network now I have Wi-Fi on my Linux I have a virtual Ethernet now I can show you the console from Android this is a development build so please ignore all the red logs coming from AC Linux and as you can see here Android has also picked up an IP address because of our DHCP server running so basically what it now needs is just a connection to the internet and to do that I'll just set up NAT tables and make my network VM behave as a router so now my Android should have access to the network this is how we isolate the network driver from Android it's running in a separate virtual machine and Android itself can be connected to the outside world through this connection and because there was already Star Wars shown before this I will probably run some other web page maybe the date and time today so I don't know if people at the back can see I think I mis-typed something this is some issue with my phone so unfortunately not very used to German keyboards but you should see a page loading here telling you the date and time today and I think that is it for the demo it's a very slow internet connection sorry for that but it's kind of loading so we have today's date time getting it from the network so our Android has a network connection so I'll hand it back to Udo to conclude this thanks Shantanu for this really impressive demo Shantanu spent a lot of time working on this together with the other parts of our userland team so it's only fair to let him demo this system in action so let me just repeat what you just saw we showed three VMs an Android with two virtual CPUs and another Linux with a single core so we actually can support SMP and uniprocessor virtual machines we can show different types of virtual machines Android and we saw two different versions of Linux we have virtual devices we have pass-through devices with the SMMU we have a virtual ethernet switch that can connect all the different VMs together we can do host drivers and all of this on an RMV8 system so let's talk a little bit about roadmap because this is obviously not the end of the road we made the ARM port as a rapid prototyping together with our friends from Genote who helped us on the VMM side and we developed this independently on a separate branch which means that today the ARM and the X86 version have a little bit diverged so the next effort that I'll be spending time on is to merge significant portions of the X86 and ARM branch and I said we have roughly 10,000 lines of code on one side and 7,000 on the other side and we can probably get that well below 17,000 or maybe half that or something like that we want to support newer ARM features because ARM has put a lot of cool features into the architecture such as pointer authentication, memory tagging all of which is useful in a secure system in terms of what additional functionality we'll add to NOVA then in the X86 and ARM version you make the hypervisor binary relocatable which means you can move it anywhere in memory and it will run so that's good for different systems which have different physical memory layouts features which will help people build VM introspection on top of NOVA which means you can use the hypervisor to peek into what's happening inside a virtual machine maybe protect stuff inside a virtual machine from the outside we have a lot of ideas how we can improve the current resource management and obviously as part of the effort of merging these two branches we'll also take a look at all the cool things that other people have built on top of NOVA and see which of those are useful for us and there's I bet also a bunch of bug fixes that we haven't yet incorporated. There will always be performance optimizations I think performance is already on par with the best microcurrents that we have but we encourage independent benchmarking and we have a big effort going on around formal verification of the hypervisor code and of the verification of the components that run on top of it and those of you who heard the SL4 talk today know that verifying something is a really hard exercise especially if you're talking about something like S&P8 and especially if you're talking about S&P. So what does formal verification on NOVA roughly look like and I don't want to go into the details here the head of our form message team is here so if there are any detailed questions I will just directly hand those questions to him but to give you a feeling for what that would look like you have a really simple function here and obviously the functions in NOVA are a lot more complicated a function that adds two unsigned 32-bit numbers X and Y and returns the result and what programmers do to make that code formally verifiable is they annotate it with pre and post conditions component-lit already showed a similar structure so what we say here is we have we introduce in the precondition two new variables V1 and V2 that carry integer values V1 and V2 that we bind to the parameters X1 and X2 otherwise the precondition is empty because this function does not touch any global state and we have a post condition that also does not touch any external global state except for the return value and the return value is the sum of V1 plus V2 but since we are adding two 32-bit numbers this addition can obviously overflow so we have to trim the result to a 32-bit value and all the functions in the kernel will be annotated with specifications like this and then we have a tool chain that looks like the bottom of this slide so the way this works is it follows from a high-level perspective we have the source code which is written in cpp or hpp files then we run a tool on it which is called cpp2v cpp2v is a tool that we wrote at bedrock Gregory wrote it the gentleman sitting there it's a clang plug-in which takes the abstract syntax tree of nova and converts it into a cog representation of that abstract syntax tree so what you get out of this is a file called foo.cpp.v or the annotations of the source code which you can either write inline or we nowadays prefer to write them out of line come in a separate file called foo.cpp.spec.v these two files are put in the cog compiler along with semantics of the C++ language and we are also heavily investing in proof automation because proving something, as you heard earlier today is a lot of manual effort and the more you can automate this the faster you can re-prove things the more you make a change which touches only a minor portion of the code there's a high chance that significant portions of that proof will just go through the automation what you get out of it is then a file called foo.cpp.proof.vo which is the machine check proof and this is an ongoing effort so we are not as far as SEO4 but I think the toolchain that we have there is already looking really really good so with that I'll conclude my talk and take questions we just made the source code of the NOVA ARM port public as the rest of NOVA it's available under gplv2 license you can download it from those two links there's a bedrock systems repository and there's the repository where NOVA has always left my private one it's important to pick up the ARM branch not the old x86 branch and there's web pages that have further information, papers, links and so forth and with that I'll conclude the talk and I'll be happy to take any questions you may have where do you see the differentiating points to SEO4? so as far as I understand SEO4 has mostly, so the question was where do we see the differentiating points to SEO4? so I think the major focus of SEO4 has always been on the formal verification of the kernel the major focus for NOVA's existence was always to make virtualization and component-based systems on top of a single hypervisor possible at some point you also have to formally verify to get a compelling security story so this is something where I see SEO4 clearly as the thought leader but performance-wise I think we are very competitive I'm not sure maybe Garnet can comment on that the way I understood it SEO4 only runs on ARMv7 and there's an ongoing effort to port it to ARMv8 so NOVA is now running on ARMv8 you're running on ARMv8? okay so SEO4 also runs on ARMv8 but it's not verified we do not plan to support ARMv7 as a hypervisor interface but we support 32-bit guests which are ARMv7 backward compatible verification bit I do understand that we actually could use some kind of input to form a verifier from the SQL that's my understanding but that's different from having well A design actually breaking down stuff and improving stuff in regard to the design so what you can prove is that A functions probably has specific characteristics but this has nothing about the overall architecture so what is the approach so you need a model so the question was if you have a simple function like this how does this connect to the overall architecture because proving a simple function doesn't prove that your whole system is correct we use a concept called separation logic to be able to reason independently about different functions of the system which makes the whole proof effort very modular which means if you can reason about this function only touches a certain fraction of the state and does not affect anything in the other portion of the state then you can verify that function and you know it doesn't affect the other side you need to prove certain things at different level so we need to have a model of how the system behaves like how NOVA behaves but you also need to show that the source code actually conforms to that model so the system specification and the specification of the NOVA functions will be connected through those annotations the actual source code will be connected to the functional specification of all these functions through the tool cpp2v which shows that the code that the compiler generated the abstract syntax tree conforms to the specification that this function has that's also something that we built okay Gregor you want to take that question? yeah so the question was is the aimful functional correctness so one of the properties that we will prove at bedrock is what we call the bare metal property and the bare metal property in a nutshell expresses that if you execute something in a virtual machine it will behave as if you executed it on bare hardware minus some timing requirements but from a correctness perspective you want to show that execution of something in a VM does not differ except for small timing effects from execution on a bare metal machine and this function or this property obviously also entails that NOVA does not crash and that the VMM emulates the instructions correctly and so forth yes another question so the question was will formal verification require us to re-architect certain aspects of NOVA or do we expect it to be formally verifiable as is I expect that we may find maybe one or two things that we want to change maybe also not because they were incorrect but because they make the verification easier but overall I don't expect too many surprises in terms of code being correct because the exercise is already quite a lot and other people like Geno do too and you've seen the complex scenarios that run on code are we surprised of course of course the question in the middle so the question was we've listed VM introspection and our roadmap what kind of VM introspection do we do right so we provide mechanisms for VM introspection for being able to look at the memory of a virtual machine to be able to look at register state maybe set break points intercept execution control at critical points but these are low level mechanisms the more richer VM introspection features that we built on top we have not yet disclosed so the question was what is our plan for open sourcing the remaining parts of the stack so NOVA has just gone open source the remaining parts of the system will progressively go open source over the course of the next year like we said we jointly developed the user level virtual machine monitor with Geno before we make that public we want to make sure that it really fits their model and our model very well because we want this to be a community effort so we don't want to go out with something that is half baked so we will polish that a little bit before we make it public but the plan is to make the entire virtualization layer basically everything that's shown in the host public come on Gregory the question was will the verification artifacts be open sourced so the answer was we would like to make the artifacts public but this is a separate discussion and we will discuss it offline yep I think Gregory would agree with that there was another question here so the primary use case for the proof automation is that we want the code to be agile not in the development sense but in the sense that we want to add new features we want to make changes, we want to make additions new architecture port and we do not want to go through a lot of manual labor of fixing up the proof so we want to automate this as much as possible so the whole purpose of proof automation is to make the proof go through faster to make the proof less manual and I think we also have a plan to work a lot with academia on developing new tactics to make the proof automation smarter so if anybody is interested in working in these areas talk to Gregory any further questions I think that's it, thank you very much


We don't have time for another round of questions and answers, so we're going to move to Member's Statement. And I recognize a member from Brampton North. Thank you. Thank you, Speaker. Colleagues, the traffic in Brampton is out of control. Our population has doubled in the last 20 years. Our transit, road and highway infrastructure has not. Highways are a provincial responsibility, and Brampton residents had to watch as the previous Liberal government study delayed and ultimately cancelled Brampton's bypass highway, the Highway 413. When our party made the 413 a key platform item in the 2022 election, Brampton responded in a huge way, sending me and my four PC Brampton colleagues to Queen's Park as part of the majority government. The message was clear, build the highway, get it done. Apparently, the Federal Liberal Environment Minister wasn't listening, and his government wasn't listening, because they have stepped in and declared a federal impact assessment. This is massive government overreach for one purpose to kill the Highway 413. Colleagues, the federal impact assessment is the same study required for a nuclear power plant. The federal government has never declared one for a new provincial highway before the 413. That means highways like the 401, the 412, 404 and 418 never had to undergo this impact assessment. And yet, when Brampton wants a new highway, we hear all the excuses come out. Speaker, I am and my residents are so tired of excuses. I have one message to the Federal Liberal Environment Minister, get on board with the Highway 413, or get out of our way. Thank you. Thank you. Thank you. All right. I found my river back, so you didn't hear over the noise. Thank you Speaker. I'm proud to rise today on International World Volunteer Day. A day to celebrate the important role that volunteers play in our communities across the globe. According to Volunteer Canada, over 12 million Canadians generously contribute their efforts to numerous causes annually. Here in Ontario, their contributions have shaped our province through their compassion, community and spirit of giving back. Their impact is immeasurable. My community is blessed with countless volunteers and community organizations who give so generously to improve the lives of others. And I thank them all. Today, I'm proud to be joined by two amazing community volunteers, Bridget Contento and Michael Varelli, who lead the Humberlea Community Group and do so much to build a happier, healthier and safer community. They organize food drives and bring food to our most vulnerable. They've created an outdoor skating rink and set up an outdoor library in their park. They host year-round events for our children, like their annual Santa Claus parade, spooky Halloween get-togethers, Easter egg hunts and more. And when they're not busy hosting their own events, they're attending and helping in others. And our members of various committees, like the 31 Division Community Police Liaison Committee. Bridget and Mike, thank you so much for making our community better every day. We are all lucky to have you. And thank you to all volunteers everywhere. Thank you. Thank you very much. Thank you very much. Member Statements, the Member for Markham Unionville. Mr. Speaker, recently I proudly welcome the remarkable Dragon Boat's Team Canada to the House together with the Premier and my colleagues. This summer, the team won gold at 16th annual World Dragon Boat Racing Championship in Pattaya, Thailand. This victory served as a source of pride for our country. It's also a testament to resilience and talent embodied by the team. Meeting this gift at least was not only a privilege, it was also an opportunity to acknowledge their unwavering dedication and skill and to recognize the honour that they have brought to Canada on the global stage. On individual achievements, the visit highlighted the collective spirit and unity that the sportsmanship forced us, emphasizing the significance of athletics in building a sense of community and national identity. The team's triumphs in Thailand exemplifies the panicles of the training and teamwork, reflecting the values of perseverance and excellence. Speaker, it is crucial that we collectively recognize and emphasize the importance of supporting and celebrating achievement in the sporting arena. By doing so, we not only honour the ethic themselves, but also inspire future generations to pursue excellence and contribute the vibrant tapestry of Ontario's sporting legacy. Thank you. Member Statements, the Member for London West. Thank you, Speaker. Speaker, the holidays can be a difficult time and this year more Londoners than ever are struggling. At the same time, more Londoners than ever are also showing up to help and I want to recognize just a few. First, the staff and volunteers at Northwest London Resource Centre who stepped up in a big way to meet the need, expanding food bank services in my riding from two days a week to six in partnership with the London food bank. Next, Fran and Mary, residents of 30 Baseline Road in London West and organisers of their buildings carrying cupboard. When the cupboard was put out of commission by a fire last month, they collected grocery store gift cards for the seniors from their building who relied on emergency food supplies. Thankfully, their cupboard will reopen for food donations again this week. Special appreciation to the hundreds of volunteers at churches around the city who cook and serve community meals for people and families who are struggling, often including musical entertainment as at St John the Divine Parish in London West. And finally, much gratitude to the 700 local businesses and nonprofits that are part of the annual Business Cares Food Drive and the many, many Londoners who contribute so generously in ways big and small. Thank you to all. And to all residents in London West and to everyone in this Chamber, I wish you a safe and happy holiday season. However you celebrate. Thank you very much. Member Statements, the Member for Sault Ste. Marie. Thank you, Mr. Speaker. And good morning. Good morning, everyone. Today I want to congratulate a local Sault Ste. Marie business on their 20th anniversary. Lop Lops Gallery and Lounge is a fixture of downtown Sault Ste. Marie and our local music scene. Owners Steven Alexander and Jennifer Balrose have seen ups and downs during the last several years with our economy, especially the last few years when COVID was happening. Over the last 20 years, they've really been able to see a bit of it all. But they've remained strong through adapting their business model with the changing of the times. It's great to see the fun holiday themed event. The 12 musicians of Christmas is back after a five-year hiatus. And I just want to offer my congratulations to both Steve and Jen on the very many great memories that we've had at Lop Lops over the years. And I'm looking forward to another 20 years ahead. Thank you, Mr. Speaker. Have a great day. Thank you very much. Member Statements, the Member for Hamilton West and Caster Dundas. Unfortunately, Speaker, more Ontarians than ever before are turning to hunger relief organizations because they can no longer afford basic necessities like food and shelter. Hunger in Hamilton is reaching record levels with the number of people turning to food banks nearly doubling since last year. Almost 50% of households say they would become homeless without food banks. People, including families with young children and seniors, cannot keep up with soaring food prices unaffordable costs. It's heartbreaking that in our communities, hungry seniors are seeking help to find meal programs because they can no longer afford to feed themselves. This last weekend, I participated in the Salvation Army Kettlebell Drive and I was moved by the generosity and compassion of Hamiltonians. There are also many ways you too can give back this holiday season. Ancaster Community Services Holiday Assistance Program will provide over 150 holiday hampers and gifts to income challenge families and seniors in the community. Good Shepherd Christmas Wonderland is bringing people together to share a festive meal. Neighbor to neighbor who has been serving our communities for over 35 years through their community food center will be providing a free Christmas meal that is open to all. And we could consider donating to free, support free and low cost programs for vulnerable seniors through Dundas Community Service. So I want to send out my thanks to all of these organizations and volunteers who are bringing joy to people in our communities who are hungry and alone. And this holiday season, I want to express my warmest wishes to you and your family for a joyous and healthy holiday season. Thank you. Thank you very much. Member Statements. Member for Halliburton. For the Lake Sprague. Thank you, Mr. Speaker. As Christmas approaches bringing snow and good tidings, I'll share with you news about fun in my riding. From Sunderland to Halliburton and all places between, there's good times to be had and good friends to be seen. People lining the streets to spread Christmas cheer, hearing carols and laughter when Santa gets near. There's good food and good drinks and of course the reindeer. None of this would happen without volunteers. Kids waiting for Santa along the parade route they stood, smiling and laughing and telling him they've been good. All the local craft shows bring the people flocking. With goodies aplenty, you'll sure fill your stocking. As we continue to celebrate this holiday season, let us always remember that Christ is the reason. Through the cold winter nights that compassion exceed, say hello to a stranger and help those in need. With my speech almost over and my time almost out, come to HKLB and see what it's all about. Merry Christmas and Happy New Year. Thank you very much. Member Statements, the Member for Don Valley North. Thank you, Speaker. From 2015 National Youth Survey, the agency found that Canadians youths are less interested in politics and they feel less strongly that voting will make a difference. Speaker, the water tank of amount used in 2011 was over 35% lower than that of individuals aged 65 to 74 while research shows that political participation affects youth development. Speaker, the High School Model Parliament Program presents an idea opportunity for students to gain hands-on experience as MPPs, fostering an understanding of parliamentary process and the significance of the democratic system. Speaker, several students attending debate classes in my writing of Don Valley North have applied and been chosen to take part in this fantastic program. I look forward with anticipation to seeing them in the chamber engaging in meaningful discussions on various issues. Speaker, this initiative serves a great means to engage and involve the youth. Today, they take every opportunity to learn and experience and tomorrow they will emerge as leaders. Congratulations to all selected participants and we eagerly anticipate hearing the perspective of our youth. Thank you. Thanks again. Thank you. The next statement, the Member for Flamborough-Glanbrook. Thank you and good morning, Mr. Speaker. Today I'm rising to highlight a recent investment that our government has made to combat auto theft in Ontario and specifically in my region of Hamilton. Mr. Speaker, every 14 minutes a vehicle is stolen in Ontario. In the last year alone there was a 14% increase in auto theft spread across Ontario. This investment of over $895,000 over three years will ensure that our Hamilton Police Service has the tools and the resources that they need to fight car theft and to keep our community safe. When the investment was shared, Hamilton Police Chief Frank Bergen said, we thank the provincial government for funds received from this grant which will be used to combat auto theft through increased staffing to new investigators and an analyst. We will also be working closely with our policing partners to share strategic intelligence involving organised crime groups that impact our city. Mr. Speaker, this funding to the Hamilton Police Service is part of the government's new preventing auto theft grant program designed to support new and enhanced crime fighting measures that focus on prevention, detection, analysis and enforcement. This preventing auto theft grant is just one of several measures enacted by our government to fight auto theft earlier this year. Ontario also announced the organised crime towing an auto theft team to help police services identify, disrupt and dismantle organised crime networks. Mr. Speaker, with the crime of auto theft growing across Ontario, I'm proud that our government is tackling the issue head on. Thank you. Thank you very much. Member Statements, the Member for Peterborough, Coortha. Thank you Mr. Speaker. As we approach Christmas, I think back to all of the people that I know who've tried to make life better in some way for others. And there's a truly kind hearted lady in my riding who freely gives her time to make a positive difference for so many. I'm talking about Pam Dickey from Trent Lakes. She lives just outside of Buckhorn and has been volunteering for community care for a number of years. During the pandemic, not only did she help out by delivering groceries to some vulnerable seniors, but she also took to the phones to do wellness checks just to make sure people who couldn't get out still had a friendly voice to talk to on a regular basis. For the last year or so, she's also been volunteering with community care's Meals on Wheels. Speaker, this Christmas, Pam has taken it upon herself to make sure that 20 seniors who lost their spouses will still have a homemade Christmas dinner. In her very own kitchen, she's cooking enough turkey, mashed potatoes, vegetables, cranberries, gravy, and all of the other fixings to make a traditional Christmas dinner. And then she'll personally deliver all of those dinners to 20 very lucky single seniors. Pam, thank you for what you do. You exemplify the true meaning of what Christmas is. Here, here. Thank you very much. That concludes our Member's Statements for this morning. Next, we'll have...


This is stock number 9227. We are here at Summit Automotive in Fond du Lac, Wisconsin, your new and used heavy duty truck headquarters. Today we are checking out this super clean 2011 Ford F250 crew cab long box. This truck has the 6.7 liter power stroke diesel. From this HD video you will be able to tell that this truck is extremely clean all the way around. White platinum tricode is the color. It has Continental Conitrack LT27570R18 tires on it. With the factory painted and polished aluminum rims these tires have about 75-80% of the tread left. See the frame and underbody is very clean on this truck. It does have the Rancho shocks on it because it has the FX4 off-road suspension package. You can see from this HD video just how clean the grille is. The hood is in excellent condition. I didn't see any dents or dings on that. If you have HD capabilities on your computer tablet or smartphone device, turn them on now because it's like you're right here looking at the truck with me. No scuffs or scrapes on that rim. And as you go down this side of the truck you can see just how clean the body is, how reflective and glass like that paint is. You take these HD videos so if you are far away or even if you're close by and you just cannot make the trip down you can still see the truck, hear the truck, and have confidence in the vehicle that you're looking at before you even get here. Cab is in excellent condition. Once again I didn't see any dents or dings down this side. Nice two-tone paint scheme. Back rim is in excellent shape and these back tires have just as much tread as the front tires. Having underbody on this truck is in pretty nice condition. It does have the camper package and it looks like it has all the remaining factory exhaust. Frame and underbody looks really good. Moor rockers are in excellent shape as well. Chrome-tipped exhaust. Rear bumper is in excellent shape. No dents or dings on that. It does have a full towing package which includes receiver hitch, 4-pin, and 7-pin wiring. Back up sensors. Tailgate is in excellent shape as well. Has the backup camera, the locking tailgate. Very nice drop-in penda liner, bed liner. That tailgate shuts nice and solidly. As we go down this side of the truck, just as clean as the passenger side, we want to make sure you get the most accurate representation of the vehicle as possible. This back rim is in nice shape too. Very clean down this side of the truck. I didn't see any dents or dings down this side. It does have the power fold-in tow mirrors and the power telescope tow mirrors. So how those work? Press them in like that. They go like that. You can do this button right here and they'll power telescope out. Also memory driver seat right there. Power windows, power locks, and power mirrors. Auto headlamps, power pedals. The Lariat package gives you the tan leather seats. Both of these seats are heated and cool. Factory all-weather floor mats throughout. Inside you can see that this truck has 40,673 miles. Leather wrap steering wheels in really nice condition. Has cruise controls on that side, Bluetooth, and audio controls on this side. This one does come with the factory navigation system. Back-up camera shows up right there as well. Here you're heated and cooled seat buttons for both sides, dual climate control, the factory tow command brake controller, four up-fitter switches, and you have turned-out four-wheel drive there as well. Downhill assist control and the sync system which gives you AUGS and USB as well as being able to pair it to your Bluetooth cell phone device. Power sliding rear window. Leather seat is absolutely perfect as well. No rips or tears on that. This truck has never been smoked in. Has factory floor mat on that side as well. Cup holders right here. Very clean all the way around. Inside on this truck, very, very nice. Take a quick look at the back seats here. Back seats are just as clean as the front seats. No rips or tears back here. Like I said, it has the power sliding rear window. Every all-weather floor mat back here as well. 110 volt, 150 watt plug-in. Underneath the seats is a lockable storage compartment that locks with the ignition key. And behind the seats here we have a factory subwoofer and the latch tether anchors. Very clean back here. Very clean in front. Very clean all the way around on the truck. Probably one of the nicest 2011's you'll find. Engine bay is very clean, runs very smooth. This truck has been fully safety inspected by our service shop. Has a fresh oil and filter change. All the fluids have been checked and topped off. And this truck is 100% ready to go. And to see more pictures of this truck or one of our other 400 new and used cars, trucks, SUVs, minivans, Wranglers, halftons, 3 quarter tons, one tons, dump trucks, you name it. We got it.  Videos of every single used vehicle that we have all at summitauto.com. Thank you so much for checking out this truck. If you want to make it yours, give us a call,<PHONE_NUMBER>, ask for one of our sales associates to make this truck yours today. Once again, that number is<PHONE_NUMBER>, thanks for checking out the video. If you want to check out more, go to www.youtube.com-summitauto. Remember to like, subscribe and share on those videos. In fact, in a second you'll see a link to subscribe to our YouTube channel. On your left, a link to more Have a New Day Truck videos like this one on your right. If you haven't been to our website on the bottom, link to this truck on our website. Click those checks out. We really look forward to helping you with this super clean 2011 Ford F-250 crew cab long box. Thanks again. Once again, that number is<PHONE_NUMBER>.