Thursday, June 7, 2018

HiKey 960 Linux Bridged Firewall

The Kirin 960 SoC and on-board USB 3.0 make the HiKey 960 SBC an ideal platform for running a Linux Bridged firewall.  The number of single-board computers with an SoC as powerful as the HiSilicon Kirin 960 are limited.

When compared with the Raspberry Pi series of single board computers (SBC), the HiKey 960 SBC is significantly more powerful.  The Kirin 960 also stands above the ARM powered SoCs which reside in most commercial routers.

USB 3.0 makes the HiKey 960 board an especially attractive option for bridging or routing, filtering network traffic, or connecting to an external gateway via IPSec.  Both network traffic filtering and IPSec tunneling can be computationally expensive operations.  However; the multicore Kirin 960 is well suited for these types of tasks.

In order to be able to run an IPSec client tunnel and a Linux Bridged firewall connected over 1G ethernet links, certain kernel configuration modifications are needed.  Furthermore, the Android Linux kernel for the HiKey 960 board does not boot on a standard Linux root filesystem because it is designed to boot an Android customized rootfs.

The latest googlesource Linux kernel (hikey-linaro-4.9) for Android (designed to boot Android on the HiKey 960 board) has been customized to remove the Android specific components so that the kernel boots on a standard Linux root filesystem, with the proper drivers enabled for network connectivity via attached 1000Mb/s USB 3.0 to ethernet adapters.  The standard UART interface on the board should be used for serial connectivity and shell access.  WiFi and Bluetooth have been removed from the kernel configuration.  The kernel should be booted off of a microSDHC UHS-I card.  The 96boards instructions should be followed for configuring the HiKey 960 board, setting the jumpers on the board, building and flashing the l-loader, firmware package, partition tables, UEFI loader, ARM Trusted Firmware, and optional Op-TEE.  Links for the normal Linux kernel configuration, multi-interface bridge configuration, and single interface IPSec configuration are below.  Additional kernel config modifications may be needed for certain types of applications.

HiKey 960 Linux kernel build instructions
Linux kernel source and custom kernel configuration
Multi-interface bridge configuration
Single interface IPSec configuration



Thursday, February 1, 2018

a Hardware Design for XOR gates using sequential logic in VHDL

VHDL is a powerful, hardware description language.  The learning curve is steep and advanced hardware designs take many years of experience.  As an advanced C and C++ programmer with embedded hardware experience, I decided to take on the task of learning VHDL.  An FPGA board is typically needed if you intend to load your design onto a re-programmable piece of hardware.  There are many choices, from simple to complex, and from cheap to very expensive.

A few years ago, a friend recommended that I purchase an FGPA board without a hybrid ARM core to start with, as working with an FPGA board is already complicated.  Having worked with numerous ARM processors, I decided to instead purchase an FPGA board with a multicore ARM processor.  Hybrid boards such as these integrate the FPGA fabric with an ARM processor, typically multicore, over a high speed bus.  For such a configuration, the ARM processor is termed the hard processor system or HPS.  Writing to the FPGA from the ARM processor is typically performed via C from an embedded Linux  build (yocto or buildroot) running on the ARM core.

ModelSim Wave Output for the xor design
The following is a simple hardware design that I wrote and simulated in ModelSim.  Given the frequency of XOR gates in cryptography, I decided to build a simple design using XOR gates.  The sequential design is comprised of several XOR gates, XNOR'd together with a 50Mhz input clock.  VHDL components are utilized and a testbench is defined for testing the design.  The testbench for the design was loaded into ModelSim and the below image is the wave form simulation of the input signals, clock, and output signal.

The source code is available on github at the following link.
xorchain hardware design in VHDL

ModelSim Full Window view with wave form output of xor simulation. ModelSim-Intel FPGA Starter Edition © Intel