[Cryptech Tech] Fwd: Re: [Cryptech Core] Fwd: EIM Problems

[Joachim Strömbergson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Aloha!

Repost to @tech. Thanks to Randy for pointing it out.


- -------- Original Message --------
Subject: Re: [Cryptech Core] Fwd: [Cryptech Tech] EIM Problems
Date: Sun, 04 Jan 2015 22:41:14 +0100
From: Joachim Strömbergson <joachim at secworks.se>
Reply-To: joachim at secworks.se
To: Randy Bush <randy at psg.com>
CC: CrypTech Core <core at cryptech.is>

Aloha!

Randy Bush wrote:
> maybe the question is not so much why it is designed the way it is, 
> though that might be intellectually interesting, but rather how to 
> code to that design.

The question is what the design actually is - What is the actual clock
speed on the real EIM bus on the Novena.

Paul Shatov is correct that the available documentation for the i.MX6
processor states that the maximum frequency for the EIM clock (EIM_BCLK)
is 104 MHz. (And yes, it is settable by SW and happens somewhere in the
boot code, firmware.)

Unfortunately, Freescale does not seem to provide a data sheet for the
exact version of the i.MX6 that is used on the Novena. The one on the
Novena is MCIMX6Q5EYM12AC. The "12" in the code indicates 1.2 GHz. The
"5" near the beginning signifies that it is a consumer application CPU.

The Data Sheet for this family is here (sorry for ugly link):

http://cache.freescale.com/files/32bit/doc/data_sheet/IMX6DQCEC.pdf?fasp=1&WT_TYPE=Data%20Sheets&WT_VENDOR=FREESCALE&WT_FILE_FORMAT=pdf&WT_ASSET=Documentation&fileExt=.pdf

If we look in that documentation, there is no information about 1.2 GHz
devices, only up to 1 GHz, for example the MCIMX6Q5EYM10AC which is the
closest match to the one on the Novena.

Now. In Bunnies ROMulator Novena design the EIM_BCLK clock is fed via
pin C9 on the FPGA into the FPGA where it is connected to a clock buffer
that feeds one of the internal clock networks. The clock is also
conditioned using a specific delay locked loop (dll), the bclk_dll. That
component is configured for the design here:

https://github.com/bunnie/novena-spi-romulator/blob/master/spi-romulator.srcs/sources_1/ip/bclk_dll/bclk_dll.v

In that file we can see that the input clock period is set to 7.518 ns,
or 133 MHz.

Also, the constraint file specifies the EIM_BCLK as a clock with the
frequency 133 MHz:

https://github.com/bunnie/novena-spi-romulator/blob/master/spi-romulator.srcs/constrs_1/imports/imports/novena.ucf

It is the bclk_dll that then drives the eim_registers etc. (There are
also separate input and output clocks generated for the EIM interface to
drive registers next to the I/O buffers.)

I've tested to change the settings for this clock from 133 MHz to 104
MHz (as Paul suggested) and built the design. The result is that it is
impossible to do any readings of data from the FPGA at all (the hard
coded version info for example). The correct speed for the EIM_BCLK on
the Novena board seems to be 133 MHz.

I've sent an email to Bunnie and asked about the discrepancy between the
Freescale documentation and what Bunnie has specified. But since Bunnies
design works with his settings I think it is a question of missing
documentation. Or that I am confused. But changing the settings for
EIM_BCLK seems not to be the way forward for us.

The Romulator is a good project to look at for the clocking used for the
EIM interface. What is missing in the design is a good clock with a nice
relation to the EIM_BCLK (66 MHz for example). The problem is getting
such a clock with zero skew in relation to the EIM_BCLK (or more exactly
bclk_dll)

The DLL instantiated in the design for generating the bclk_dll clock
seems to also have a DIV clock output port for a divided clock. This may
give us what we need. I'll see what the Xilinx documentation says and
try to change the core instatiation.


- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
 Joachim Strömbergson          Secworks AB          joachim at secworks.se
========================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBCAAGBQJUqkhtAAoJEF3cfFQkIuyNvm8P/3ccDyHFTj9Cah3IW7iR1XNR
O0zBFs5z75mx/LDKeXbvhDC5HHWBv+eX5L+pqgCGgWOC1jqmK26f2SzA0MkjNHus
dcxFJtpWIcntoj2k69halory/OYGwHXmgm454+sDj38pwiW9+fjnsytUhBak9mOf
TZGSbiMLpOjnJohGEXhJ6RqXonmlDQxBrQYTa6HtVMN51wd3YcAmVoCUk74ObmFQ
NjudOXwKy4ojy+VgZ8YZNMT9ojWZxtTBNTKdmGrkr/z6+pi/0y7Sl6BH6YLHPvnF
2WDUfgt9nuOsvUmXo6GFPoQqHvEJMHGTf5rTd4AhZSSncMm9KSo98Jj5Efc5yjmn
izcfUvKWvjFnOrTEvC7RapF4UQlNIAIMU9oYb9SOo/Izx/j1tWp6nvsjJnjhUqiP
JVXIZWqS6j0ZrXOEqMiw4kWhS4HqbMQeEZe5UcfG7cAuA+nbJkuvfy3sX9W91idd
OyR0jxRN0DYVY9QBrTvN0gQUMspxCXjIyzAqa/bQd8B9smpMFskWV34cOYNJE6IV
GHi/m6xf+2XmY45bi87Dcfks5SURWktW6LtPuEwQSLAYFg5CJoerad0VNbFufN4l
ueBbSjrcn8BwZ2QEzkVbhbZhQOPMjkmGGghPN4nG1f29+gQfE3RkIP9yDEXUhw5t
Z1/nH1PS5pZtZMWvmp3I
=bJ9Q
-----END PGP SIGNATURE-----