iank.org

FROGSBORO: SAM9X60 SiP Embedded Linux

Sat, 08 Jan 2022 04:44:49 +0000

iank.org https://iank.org/posts/frogsboro-embedded-linux-board-sam9x60-sip/ -

Another custom embedded Linux board. I recently did a free evaluation of Altium Designer and built this as a way to try it out. The design is based on the SAM9X60 SiP and has a USB device port, two USB host ports, a microSD card, and a low profile 40-pin expansion connector (following the Raspberry Pi pinout) which breaks out GPIOs and various other peripherals. It’s called FROGSBORO, which I guess is a moderate improvement over CATFOOD.

Design files: Schematic (pdf), BOM (pdf), Gerbers (zip)

Update 2022-04-17: Added a section on the stencil alignment fixture.

Completed PCB, top view.

Completed PCB, bottom view.

Layout

I used a six layer stackup from a low-cost fab. It measures 67mm by 21mm. A MIC2800 PMIC provides the three necessary voltage rails. An oscillator and a crystal provide the core clocks, there’s a DDR voltage reference, and the various connectors have ESD protection. (This is the first spin of the board; the 1.0.2 version number reflects some back and forth with the fab). The total cost for PCBs, stencils, and components was around $200.

Assembly

Stencil Alignment Fixture

I’m experimenting with a new alignment fixture for applying paste. In the past I’ve used scrap PCBs to frame the board and a masking tape hinge on one edge of the stencil (Video from JLCPCB, Tutorial from Sparkfun). This has worked well enough for me. It takes some time to line everything up and tape it down, but once set up it’s surprisingly repeatable. It’s stressful to set up for just a few boards though, and double-sided assembly is a pain since the setup needs to be elevated to apply paste to the second side.

The bare PCBs (top and bottom), with the breakaway rails still attached.

On this board I added breakaway rails with mouse bites¹. The rails each contain two stencil alignment holes, which are just a non-plated through hole and a corresponding footprint on the paste layer. Since it’s not typical² to have paste over holes I included a note to the fab to clarify that this was intentional. I then milled a fixture from a block of common pine.

Stencil alignment figure

The board sits in a recess so that the surface is flush with the wood, the stencil can sit on top of both, and gauge pins are used to fix everything in place. There is also a cavity to allow clearance for the top side components when applying paste to the bottom side.

Paste application

There’s obviously a different sort of setup time involved in the CAD/CAM and milling the fixture. In the end though it was pleasant to use, the alignment felt solid, and the resulting paste application was crisp and consistent. I won’t use this for every board, but for double-sided boards and/or boards with small feature sizes it’s a nice tool to have.

Component Placement and Reflow

IC placement

Once paste was applied I used my normal method for assembly. I use my preheater (turned off) to clamp the board while I place components..

Top after reflow

… and then reflow with the preheater around “300°C”³ and very low flow rate hot air at 350°C.

Bottom after reflow

For the bottom side, I keep the preheater lower (“100°C”) and use the same hot air settings. Through hole parts are the final step. They need thermal relief as I don’t have the board preheated when soldering these.

Software

I didn’t have to do much here. I was able to boot a demo image form the sam9x60-ek evaluation kit. I used linux4sam-buildroot-sam9x60ek-headless-2021.10.img. The device tree should ideally be modified to remove peripherals that aren’t present (e.g., Ethernet), but leaving it as-is doesn’t cause a problem.

I used an FTDI cable to access the UART for first boot. I then modified the inittab to load g_serial and start getty on ttyGS0. This lets me use the SAM9X60 USB device port, which is also powering the device, as a serial console.

Update 2022-11-10: I’ve since built a yocto layer for this board. See frogsboro-firmware

Thoughts

This was my first six layer board. The extra routing layers were nice, but in this case less useful than they could be. At this budget I’m stuck with (relatively large) through vias meaning some areas can quickly become Swiss cheese on every layer.
I like this PMIC. Absolutely happy to use one part to provide all of the voltage rails when I can get away with it.
The fab I use has a coarse silkscreen print resolution. This isn’t the first board where I’ve had to delete some reference designators to make others fit. But the resulting silkscreen is still crowded to the point of ambiguity. I may start leaving designators off for most passives by default and only including the ones that I think may be frequently referenced.
In the future it would be better to place the mouse bites recessed back from the board edge so that the broken-off pieces don’t protrude.

I used 0.5mm diameter non-plated holes, with 0.75mm from center to center and 0.5mm clearance from the outside hole edges to board edge. There is no copper on any layer on the rails. ↩︎
Aside from paste-in-hole, which I think is still fairly uncommon. ↩︎
This and other temperature settings I’ll mention for this preheater only loosely correspond to the actual temperature the board reaches. It’s an IR heating element an inch or so underneath the board and the control system, such as it is, controls the element temperature, not a temperature probe on the board. ↩︎

- https://iank.org/posts/frogsboro-embedded-linux-board-sam9x60-sip/ - 2014-2024 iank.org

A Custom i.MX6ULL Board

Tue, 28 Dec 2021 02:25:16 +0000

iank.org https://iank.org/posts/catfood-custom-imx6ull-board/ -

As a vehicle for learning OrCAD, I built a custom embedded Linux board using NXP’s i.MX6ULL processor. The board is called CATFOOD (I was more excited to get started than I was to come up with a name). It has the i.MX6, DDR3, NAND flash, an Ethernet PHY, and an SD card. It presents a serial console over the USB-C connector, which also supplies power.

Layout

This was my first embedded Linux design, as well as my first design incorporating DDR or Ethernet. The design is heavily based on NXP’s reference implementation. I also used Seeed Studio’s i.MX6 module as a reference (it is itself a stripped-down version of the NXP design).

A half-populated PCB.

I had the 4-layer board and a stencil manufactured using a low-cost PCB prototyping service and assembled it at home.

Issues/Bring-up

DDR

There was at first an issue booting. I traced this down to a problem with the DDR by interrogating the device over the built-in USB bootloader. See https://github.com/boundarydevices/imx_usb_loader as well as NXP’s DDR calibration tool. After checking the DDR voltage reference and a few clock termination passives I reflowed the memory chip, which solved the issue. If I had to guess (and I do, because I don’t have an X-ray machine), I didn’t get enough heat on that part the first time I reflowed it.

Assembled PCB

Ethernet

There were a few driver problems with the Ethernet. This particular part (LAN8700) was my most significant deviation from the reference schematic so it’s no surprise that the board init and device tree needed some modifications.

I needed to have u-boot reset the PHY (using the reset GPIO) early in the board initialization. I also set up the ENET clock (provided by the i.MX6 to the LAN8700) in the board init.
The reference device tree has two ENET modules, with the (shared) MDIO bus configured in the second. This is usually fine even when only one is used, but the part I used has the second ENET module disabled via fuse¹.
I removed the tempmon node in the device tree. It doesn’t exist in my part and so Linux kept attempting to do deferred probes of this device. I’m still not clear on why, but the first attempted tempmon probe after Linux initializes the PHY would cause a hang.

Finally, I generated a valid (unicast, locally-administered) MAC address and burned it into the fuses using u-boot:

# This programs ENET1 MAC address: F6:07:37:F1:EC:7a
fuse prog 4 3 0xf607
fuse prog 4 2 0x37f1ec7a

Working Ethernet

Lessons Learned

I’m happy with the way this came out. It incorporated a lot of new elements for me and they all ended up working. Some disorganized thoughts:

I’m stressing the limits of my usual paste stencil alignment method (scrap boards and masking tape). Next time I’m going to try putting some alignment holes in the board and stencil.
The reference design includes a large number of pull-up/down resistors for configuring bootstrap pins. I kept these on my board, knowing they were unnecessary but maybe useful. After learning a bit about the platform I shouldn’t need to include them again. All that’s needed is access to a couple of the BOOT_MODE pins, combined with the default behavior and the built-in USB loader.
There’s some other elements of NXP’s design, mostly around power and reset, that I think I understand well enough now to simplify or drop.
This was the first time I did stencil paste application / hot air reflow on both sides of the board, and I was worried about either having components fall off or not preheating the board/ground planes enough and having tombstoning. I set my preheater to “100C” and didn’t have any issues.
When placing small passives I should give them a little tap (into the paste) and use a wide nozzle from relatively far to prevent parts from blowing away.
I designed a 3d-printed enclosure, which I don’t typically do. I need to pay more attention to connector stickout past the board edge.

Both ENET modules have instances of the MDIO registers, and it normally doesn’t matter which ENET is used to access the bus. But with ENET2 fused, accessing the MDIO registers from that module hung the device. ↩︎

- https://iank.org/posts/catfood-custom-imx6ull-board/ - 2014-2024 iank.org

Cyclone IV-based Julia Set Explorer

Mon, 27 Dec 2021 01:09:54 +0000

iank.org https://iank.org/posts/cyclone-iv-julia-set-explorer/ -

A custom Cyclone IV board interfaces with TFT LCD panel, capacitive touch controller, SDR SDRAM. The FPGA superimposes a Julia set on the Mandelbrot set. Touching the screen chooses the set point z0.

Check out Malin Christersson’s julia set visualizations here. This is basically an implementation of the first demo on that page. One thing that should be clear is that there’s no need for an FPGA to do this; it’s in fact exactly the wrong approach. This project was a solution in search of a problem: I started with a Cyclone II and an LCD with no application in mind and it evolved from there. I got to use it as a vehicle to learn about FPGAs, verilog, and push my PCB layout and assembly capabilities.

All of the design files can be found on github at https://github.com/iank/julia_lcd.

The final assembly

An example Julia set

Hardware

The final evolution of the hardware is a Cyclone IV FPGA, an external SDRAM, and a Silicon Labs EFM8 microcontroller used to configure the FPGA from a SPI flash. The LCD module contains a capacitive touch controller, broken out on the second, smaller, flex cable.

Verilog

The FPGA’s internal blockrams are not large enough to contain an entire frame, hence the external memory. Lines are loaded from memory during the blanking interval before they are needed. Otherwise when the memory bus is not in use the fractal can be computed. First the Mandelbrot set is computed as a binary image and the Julia set is overlaid upon it.

An i2c master is also implemented. This controls the touch screen. Upon receipt of a touchscreen interrupt, the coordinate is queried and this is used to set the z0 point for the Julia set.

Lessons learned

I’d never used an FPGA before this project. I spent a lot of time iterating on the Verilog here, and I learned a lot about what I could and could not do (as well as the memory bandwidth / LUTs I’d need to do it). This was also the first time I assembled a BGA part at home.

Using a separate debug/programming board was handy. In one spin I had tried using a board-to-board connector for this, which turned out to not be tenable without mechanical support. The IPC cable pictured above was easier to assemble and didn’t really take up more space.

FPGA debugging in-system is hard. Taking the time to set up simulation models/fixtures was worth it every time. First I wrote a mock LCD module that would output frames as png files during the simulation. That made clear some timing/alignment issues that just weren’t visible otherwise. Then I adapted a memory model from Micron for the specific part I used, which helped debug some memory issues.

- https://iank.org/posts/cyclone-iv-julia-set-explorer/ - 2014-2024 iank.org

Using radare2 to make a simple binary patch

Fri, 27 Dec 2019 14:30:00 +0000

iank.org https://iank.org/posts/using-radare2-to-make-a-simple-binary-patch/ -

My partner found a game on her computer that she probably downloaded a decade ago, and we wanted to tweak the behaviour.

In case it’s not clear, the following is outrageous and the right way to do this would have been to edit the freely-available C++ source code and rebuild the game, either on my partner’s Macbook or cross-compiled from my Linux laptop. But I didn’t want to interrupt her. And while the build system for this game is actually fairly straightforward, I have 36 megabytes free on my aging Chromebook. No room for an OS X toolchain. In the end, I think this saved everyone precious block-clicking time and it was certainly more fun.

The first step was to identify the game, which seemed like the product of an SDK tutorial or a tech demo. In fact it was the “blocks” test app for FLTK. The source code is straightforward and short, and the change we wanted to make was in the level up progression. Each level adds a new level of complexity and also speeds the game up; we wanted to keep adding complexity without speeding up the game.

Here is the relevant function:

void BlockWindow::up_level() {
 interval_ *= 0.95;
 opened_columns_ = 0;
 if (num_colors_ < 7) num_colors_ ++;
 level_ ++;
 sprintf(title_, "Level: %d", level_);
 title_y_ = h();
 Fl::repeat_timeout(interval_, (Fl_Timeout_Handler)timeout_cb, (void *)this);
}

All we need to do is delete the code that changes interval_ or change the 0.95 constant to 1. It’s been a while since I’ve had access to IDA Pro, so it’s time for me to learn a new tool, radare2.

So, we open the binary, analyze it, and list functions:

ian@chrx:~/Downloads/blocks.app/Contents/MacOS$ radare2 blocks
[0x100004af0]> aaa
[0x100004af0]> afl

...
0x100005df6 627 8 fcn.100005df6
0x100009a6c 19 1 fcn.100009a6c
0x10000606a 139 3 sym.__ZN11BlockWindow8up_levelEv
0x100005750 337 3 sym.__ZN11BlockWindow5clickEii
0x100005796 14 15 fcn.10000579a
0x1000057a4 253 12 fcn.1000057a4
...

Great. It’s not stripped. With some searching, we find the symbol we’re looking for. BlockWindow::up_level has become __ZN11BlockWindow8up_levelEv due to C++ name mangling. We can seek to it and print the disassembly:

[0x100004af0]> s sym.__ZN11BlockWindow8up_levelEv
[0x10000606a]> pdf
| ; CODE (CALL) XREF from 0x100005f50 (fcn.1000058c0)
| ; CODE (CALL) XREF from 0x1000054e6 (fcn.1000050dc)
 ; BlockWindow::up_level()
/ (fcn) sym.__ZN11BlockWindow8up_levelEv 139
| 0x10000606a 55 push rbp
| 0x10000606b 4889e5 mov rbp, rsp
| 0x10000606e 53 push rbx
| 0x10000606f 50 push rax
| 0x100006070 4889fb mov rbx, rdi
| 0x100006073 f30f5a83100. cvtss2sd xmm0, [rbx+0xb10]
| 0x10000607b f20f59050d1. mulsd xmm0, [rip+0x4180d]
| 0x100006083 f20f5ac0 cvtsd2ss xmm0, xmm0
| 0x100006087 f30f1183100. movss [rbx+0xb10], xmm0
| 0x10000608f c7831c0b000. mov dword [rbx+0xb1c], 0x0
| 0x100006099 8b83180b0000 mov eax, [rbx+0xb18]
| 0x10000609f 83f806 cmp eax, 0x6
| ,=< 0x1000060a2 7f08 jg 0x1000060ac
| | 0x1000060a4 ffc0 inc eax
| | 0x1000060a6 8983180b0000 mov [rbx+0xb18], eax
| `-> 0x1000060ac 8b93140b0000 mov edx, [rbx+0xb14]
| 0x1000060b2 ffc2 inc edx
| 0x1000060b4 8993140b0000 mov [rbx+0xb14], edx
| 0x1000060ba 488dbb300b0. lea rdi, [rbx+0xb30]
| ; CODE (CALL) XREF from 0x100009a7d (fcn.100009a7d)
| ; DATA XREF from 0x100009a7d (fcn.100009a7d)
| 0x1000060c1 488d35b5390. lea rsi, [rip+0x439b5] ; 0x100009a7d
| 0x1000060c8 31c0 xor eax, eax
| 0x1000060ca e87f0b0400 call sym.imp.sprintf
| sym.imp.sprintf(unk, unk, unk)
| 0x1000060cf 8b432c mov eax, [rbx+0x2c]
| 0x1000060d2 8983300c0000 mov [rbx+0xc30], eax
| 0x1000060d8 f30f5a83100. cvtss2sd xmm0, [rbx+0xb10]
| ; CODE (CALL) XREF from 0x1000150dc (fcn.1000150dc)
| ; CODE (CALL) XREF from 0x100015159 (fcn.100015159)
| ; CODE (CALL) XREF from 0x100015117 (fcn.100015117)
| ; DATA XREF from 0x1000150dc (fcn.1000150dc)
| 0x1000060e0 488d3df5eff. lea rdi, [rip-0x100b] ; 0x1000150dc
| 0x1000060e7 4889de mov rsi, rbx
| 0x1000060ea 4883c408 add rsp, 0x8
| 0x1000060ee 5b pop rbx
| 0x1000060ef 5d pop rbp
\ 0x1000060f0 e94f1e0000 jmp sym.__ZN2Fl14repeat_timeoutEdPFvPvES0_

These are the lines in question. They’re relatively easy to pick out since we’re interested in a floating point operation:

| 0x100006073 f30f5a83100. cvtss2sd xmm0, [rbx+0xb10]
| 0x10000607b f20f59050d1. mulsd xmm0, [rip+0x4180d]
| 0x100006083 f20f5ac0 cvtsd2ss xmm0, xmm0
| 0x100006087 f30f1183100. movss [rbx+0xb10], xmm0

Remember, we’re looking for assembly code corresponding to interval_ *= 0.95. This fits. We:

load interval_ (from the address rbx+0xb10)
multiply by a constant (at rip+0x4180d)
and store the result back in rbx+0xb10

To make sure, we can check the value of the constant in [rip+0x4180d]. It should be 0.95. We know it’s an argument to mulsd, so we’re looking for a double. Recall rip points to the next instruction to be executed, so:

[0x10000606a]> pf q @ 0x100006083+0x4180d
0x100047890 = (qword) 0x3fee666666666666

And indeed, if we convert it to decimal, we get 0.9499999....

Now all we need to do is find this code in the binary and NOP it out. It’s easy enough to search for the corresponding machine code in a hex editor since radare’s disassembler has provided it alongside the assembly, and replace that section with 0x90s.

Radare2 is a cool tool, though, and there’s ways to do the patching entirely within the tool. This tutorial has an example.

- https://iank.org/posts/using-radare2-to-make-a-simple-binary-patch/ - 2014-2024 iank.org

Mul-T-Lock Interactive Picked

Thu, 21 Mar 2019 19:59:00 +0000

iank.org https://iank.org/posts/mul-t-lock-interactive-picked/ -

The other day I picked a Mul-T-Lock Interactive key-in-knob cylinder that a locksmith gave me from his scrap bucket. That feels like an accomplishment to me, hence this otherwise empty post. This morning I repeated the process on video, which took about half an hour.

I have one thought to contribute: the interactive element intimidated me when I first learned about it, but I realize now it is mostly a key control feature as it does not substantially impact picking (vs a Mul-T-Lock classic).

- https://iank.org/posts/mul-t-lock-interactive-picked/ - 2014-2024 iank.org

"I PRESSED CAPS LOCK ONCE IN 1989 AND I NEVER LOOKED BACK"

Mon, 29 Dec 2014 19:05:00 +0000

iank.org https://iank.org/posts/i-pressed-caps-lock-once-in-1989/ -

It’s a widely reported phenomenon that the most popular or well-received thing a person creates is rarely the thing they are most proud of. Sometimes they grow to resent its overshadowing their more challenging or interesting output. Radiohead reportedly hates Creep.

Ursula Vernon is a Hugo award-winning writer and illustrator, but when I was a teen I went to a book signing to get her autograph on this picture of a pear, which you’ll recognize if you grew up on the internet at a certain time.

My pear is an IRC robot called LOUDBOT

LOUDBOT was born at least five years ago. I was mourning the disappearance of an internet friend, who I’ll call R. We’d spend entire days engaged in friendly but vitriolic arguments about his particular brand of stoner socialism or i-can’t-even-remember-what, until he vanished, as internet people do.

Like “real” people you lose touch for a variety of reasons, benign or tragic, and often you never know. It’s cliché but true to remember that there is aways attrition and that change can’t and shouldn’t be avoided. I’ve got to experience the relationships I have now and form new ones, while acknowledging the people who exist only in the past.

I processed R.’s disappearance in my own way by writing a robot to replace him. The bot went through my logs collecting every all-caps thing this guy had ever shouted at us, and when a user yelled it would yell back some mock-furious decontextualized incoherent epiphany or insult, like “IDEAS FLOW FREE WHEN TIME IS INCORRECT!”

LOUDBOT got bigger than me

It was a simple Perl script, one hundred lines at most, and eventually I generalized it to repeat things that anyone had shouted in the presence of the robot. Anything shouted in all caps would be met with a random all-caps reply.

I started a twitter account for the robot. Anyone on IRC could tell LOUDBOT to tweet the last thing it shouted. It got into fights with other twitter bots¹. It #engaged with #brands. While never particularly popular (it hovers at about 900 followers), it grew beyond my tiny corner of the internet. I had a surreal moment when I met someone in “real life” who followed LOUDBOT on twitter before she knew me.

The Perl script was written and re-written, overengineered, factored, and re-overengineered. It was a vehicle for me to play with NoSQL at the height of that movement (some versions were web-scale). It’s integrated with my distributed swarm of self-managing IRC robots. Now it’s over 1500 lines of asynchronous message-passing highly-available OTP Erlang and Perl. I’ve forgotten everything there is to know about the code, but the nature of Erlang is that the thing has kept running for the last two years with no real maintenance or input from me. I call it “telecom-scale.”

Sometimes it’s kind of the worst

Some of the quotes are stolen from other sources. There are political opinions and tasteless jokes. It is foul-mouthed and occasionally racist and awful. I’ll delete the worst of it when I see it (as will others; anyone has this power), but the “loud database” is a product of the input of the users, and the users are from the internet.

But it sometimes reflects the creative humour of the nerds I enjoy spending time with, and the random responses are occasionally brilliant.

< HighBit> THERE IS NOTHING MORE DANGEROUS THAN A HIGH-POWERED POLITICIAN ARMED WITH A TWITTER
< LOUDBOT_> THE INTERNET ISN’T PRIVATE? OH SHIT.

< HighBit> I ONLY EAT DRY FOOD FROM A BAG
< LOUDBOT> YOU HAVE THE POWER TO CHANGE THAT

There is a small but devoted following. They spawned a mock religion. Some people insist it’s sentient, maybe Skynet, or that I have developed a secret algorithm for keeping LOUDBOT “on-topic”. It’s just a random select from a SQLite database.

< LOUDBOT> IsharaComix: BACONIZED RESISTENCE
< IsharaComix> YOU SPELLED RESISTANCE WRONG
< LOUDBOT> I REQUIRE EPIC RUBY DRMAA
< IsharaComix> YOU SPELLED DRAMA WRONG
< LOUDBOT> EVERYTHING MUST BE IN ALL CAPS ALL THE TIME OR ELSE NO ONE WILL LOSTEN TO YOU
< IsharaComix> YOU SPELLED LISTEN WRONG GOD LOUDBOT YOURE BAD AT THIS
< LOUDBOT> THIS UNCHECKED AGRESSION WILL NOT STAND

Over time, people grew accustomed to LOUDBOT’s presence and the nature of their interactions with it changed. They didn’t so much shout at each other anymore, they shouted for the robot to hear, record, and repeat later. The database grew to over 70,000 lines. This was different, and not what I had imagined it would become, but users and systems evolve as they interact with each other. That’s neither right nor wrong, it’s true and inevitable and interesting.

Like the person it was initially created to replace, robots vanish too.

Our relationships with robots and systems, like people, are temporary. Trying to hang on to the way things were at the height of a friendship is impossible at best. It’s been fun, but this system is stagnant, we’ve grown apart, and we’re on to the getting-together-for-an-awkward-lunch-once-a-year phase of this friendship.

LOUDBOT isn’t my Creep, but it’s time to shut it off. I’ll always have this ridiculous word cloud. Thanks, Internet.

-!- Nate has joined ##church-of-loudbot
< Nate> wow it really exists…
-!- Nate was kicked by CAPSBOT [I CAN’T HEAR YOU, SOLDIER]
< HighBit> CURRENT STATUS: GOING TO CHURCH

I’m told the creator of @CapsCop secretly loves @LOUDBOT ↩︎

- https://iank.org/posts/i-pressed-caps-lock-once-in-1989/ - 2014-2024 iank.org

Your Food is Always Outside of You

Wed, 05 Nov 2014 22:09:08 +0000

iank.org https://iank.org/posts/your-food-is-always-outside-of-you/ -

Yesterday I gave a talk at the NCSU Linux Users’ Group and I’ve posted the slides and a video here. Not captured in the audio was, after the talk, an impromptu lecture about Hilbert’s infinite hotel and then Jim Witschey came up to talk about the expectation of the Poisson distribution. So it was a good time!

Slides (PDF)

Here’s the original abstract of the talk:

YOUR FOOD IS ALWAYS OUTSIDE OF YOU

(Some Ideas About Space But Definitely Not Time)

ABSTRACT:

I'm going to, in an accessible way, cover some mathematical and physical ideas
that I think are important or at least pretty cool. I want to talk about why
orbits work, what happens in 5-D, why the World Series is slightly better than
a coin toss, databases are broken forever, truth itself is wrong, and what
happens if an infinite number of buses roll up at your house. Or some subset of
that.

I'll cover three or four discrete topics, so don't worry if you get lost;
you'll be following along again in a few slides. Any equations will be
supplementary only- you won't have to understand them to get the general idea.

Here's what loudbot has to say:

< LOUDBOT> ik: GIVEN YOUR PAST PERFORMANCE THIS MAY QUALIFY AS A MIRACLE

- https://iank.org/posts/your-food-is-always-outside-of-you/ - 2014-2024 iank.org

A True Random Number Generator

Fri, 06 Jun 2014 22:09:08 +0000

iank.org https://iank.org/posts/a-true-random-number-generator/ -

This page describes the implementation of (Yet Another) avalanche noise hardware random number generator. This is a device which has been implemented many times [e.g. Rob Seward, Aaron Logue], including some commercial offerings [e.g. Entropy Key, TrueRNG]. This project does not do anything better than existing work, but I learned a lot.

Theory

This True Random Number Generator (TRNG) is based on avalanche breakdown noise in a PN junction. A PN junction is a semiconductor structure which forms a diode, allowing (ideally) electric current to flow in only one direction. Electric fields internal to the structure support a potential gradient allowing current to flow easily in one direction but creating a potential barrier for electrons driven in the reverse direction.

If strongly reverse-biased, however, electrons which overcome that potential barrier can have sufficient energy to cause impact ionization, leading to a multiplication effect¹. An energetic electron impacting a silicon atom in the lattice can knock another electron out of the valence band (forming another electron-hole pair). In the presence of a strong reverse-biased electric field (needed to initiate this process in the first place), the liberated electron will accelerate and the process can continue, creating something like a sustained chain reaction.

Laying aside quantum effects and considering electrons in our PN junction to act as a Newtonian gas, avalanche breakdown is formally a chaotic process: It depends upon strongly nonlinear interactions between a large number of elements and exhibits topological mixing (the charge carriers mix throughout the structure and effects are not localized). Chaos means that this system, even if theoretically deterministic (I believe it is not), is highly sensitive to a tremendously large and unknowable set of initial conditions, rendering it unpredictable.

Prototype

The prototype is based upon a design by Will Ware. The physical random source is a reverse-biased PN junction (actually two terminals of a bipolar junction transistor). Part of a transistor is used, rather than a diode, because diodes are typically designed with either very high breakdown voltage (as in the case of rectifying diodes) or low breakdown voltages but with minimal avalanche noise (e.g. zener diodes which are meant to be used in breakdown). A schematic is shown below.

TRNG prototype schematic

The PN junction formed by the base and emitter of T1 is reverse-biased by an 18V source (realized by two 9V batteries). The collector is left floating. The output is amplified by common-emitter amplifier T3 and coupled through C1 to another common-emitter stage (T2).

I constructed this prototype on perfboard and sampled the output using the ADC on-board an Arduino Uno. After correcting the output distribution using Von Neumann’s algorithm, the effective data rate was around 1000 random bits per second, and the device passed the diehard suite of statistical tests.

With a working prototype, I set out to create an integrated PCB, increase the data rate, and replace the Arduino with a USB interface.

Iteration 1: PCB 1, power supply

The first iteration adds an 18V supply based on the Texas Instruments TPS61040 DC/DC boost converter designed for LCD and LED display lighting applications. The datasheet contains a reference design (Figure 16, pg. 14) for an 18V output from a 5V supply. This eliminates the 9V batteries and allows the design to be powered from USB.

A PCB was created (using the free version of EAGLE) containing the power supply, physics package, and amplifiers. I used 0603 passives and replaced the through-hole 2N3904 transistor from the prototype with the MMBT3904, a surface-mounted equivalent.

Schematic for PCB 1

Board layout for PCB 1

The PCB was manufactured by Seeed Studio Fusion, a low-cost PCB service. It was assembled and tested with the Arduino.

Iteration 2: PCB 2, ADC and LPC1343

Next, I needed a faster interface. After some research I chose to use the LPC1343, a 32-bit ARM Cortex-M3 microprocessor which has a native USB interface and runs at up to 72 MHz. Olimex offers a LPC1343 dev board with published schematics. Using the LPC1343’s on-board ADC, I was able to get about a 40x speedup over the Arduino.

I adapted reference USB mass storage code for the LPC1343 and created a virtual mass storage interface for the device (this is not ideal). When inserted, the TRNG enumerates as a mass storage device (e.g. a USB thumbdrive) of arbitrary capacity. It would appear to, e.g. Linux, as a block device. Writes do nothing and return success. Reads return blocks of random data sampled from the noise circuit.

Next, I found the Intersil HI5767/2CBZ, a fast (up to 20 megasamples per second) dedicated 10-bit ADC in a SOIC-28 package. Driving the ADC at the LPC1343’s clock frequency (12 MHz) led to an overall speedup of 400x vs the prototype.

I created a SSOIC-28 breakout board using a PCB from Adafruit and built a test circuit for the ADC on perfboard (pictured below), following a reference schematic in the HI5767 datasheet (Figure 19, pg. 13).

The HI5767 has an input dynamic range of no more than 1Vp-p, and I found that removing the second amplifier from the amplifier chain in my physics package reduced the output to within this level. I was able to hack the PCB (pictured below) to achieve this, saving me considerable time.

ADC test rig

PCB 1 hack

The test setup, shown below, consists of the Arduino Uno (now providing only a 5V power supply!), the LPC1343 (providing a USB interface), The physics package PCB #1 from above (hacked for 1V output), and my ADC test circuit. It is a mess.

Messy test setup

Iteration 3: Integration

Finally, I created a single integrated PCB. I attempted to follow some basic rules of mixed-signal design (single sided PCB with large ground pour on reverse, isolating analog and digital circuitry, short clock traces, etc) to avoid contaminating the analog noise source with radiated high-frequency components of the clock or digital outputs. It seems ironic to take measures to protect a noise signal from interference, but we must avoid introducing predictable patterns.

The final schematic, board layout, and images of the completed device are shown below. The final device, after moving the whitening logic to firmware (for completeness sake, but at a significant speed expense), achieved 9 kB/sec random data.

Final schematic

Final PCB layout

Final assembly

Conclusion

This design, like many others in its class (including some commercial offerings) is flawed and should not be used by anyone. It is not a differential design and is easily influenced by external fields. Unlike some commercial products, it has no tampering detection or countermeasures, leaving it vulnerable to manipulation.

I am done iterating and there are loose ends I do not intend to clean up. In particular, the USB mass storage class is a strange way to interface this device.

Links/misc

Test output from the dieharder test suite
While not explicitly referenced, I found these links interesting or useful

McIntyre, R. J. “Multiplication noise in uniform avalanche diodes.” Electron Devices, IEEE Transactions on 13.1 (1966): 164-168. ↩︎

- https://iank.org/posts/a-true-random-number-generator/ - 2014-2024 iank.org