#milkymist IRC log for Tuesday, 2011-09-06

qi-botThe build was successfull, see images here: http://fidelio.qi-hardware.com/~xiangfu/build-milkymist/milkymist-openwrt.minimal-09062011-0117/00:12
Action: wpwrak enjoys the lofty feeling of control when issuing labsw ch1=0 ch2=0 and labsw ch1=1 ch2=1 and watching the M1 power-cycle :)08:26
wpwraklekernel: hmm, to write to that ICAP, should  pld writereg  do the trick ? it accepts all the things i sent it quite willingly, but doesn't boot08:44
lekernel(labsw) cool !!08:44
lekernelhm... maybe you need to write the bits in the opposite order (just guessing)08:44
lekernelinvert the bits in each 16-bit word08:45
rejonwpwrak, that is awesome08:45
wpwrakscary :)08:45
lekernelalso, power cycle before a new try, as you may have confused the configuration system08:45
wpwrakyeah, i just noticed that it wouldn't take a normal boot either08:45
lekernelbtw, you are not using the ICAP through JTAG - the ICAP is only for FPGA designs who want to access the configuration system of the chip they're running on08:48
wpwrakah, i see. well, the config-thingy then :)08:50
wpwrakflipped the data bits -> no luck; swapped the data bytes -> neither08:50
wpwrakthis is my sequence: http://pastebin.com/czRKZeTA08:52
wpwrakderived from table 7-1, page 126 of http://www.xilinx.com/support/documentation/user_guides/ug380.pdf08:54
wpwraknot sure if i got the various layers of registers right, though. maybe there's one more between "pld" and that config-thingy ?08:55
lekernelwhat are 0x13 0x14 0x15 ?08:59
lekernelimo you should just dump everything into CFG_IN08:59
wpwrakthe GENERAL1, GENERAL2, and CMD registers08:59
wpwrak(CFG_IN) yeah, i'm searching for a way to do this now ...08:59
wpwrakah. let's see ...09:00
wpwrakerror: syntax: not a number: 'CFG_IN'09:00
wpwrakseems that "pld" knows some things about the config-thingy. e.g., it complains if CFG_IN/OUT aren't defined.09:01
lekernelah yes, CFG_IN is a JTAG instruction, not a register09:02
wpwrakthat's why i thought the writereg actually goes to the bus of the config-thingy09:02
lekernelthe config-thingy only accepts raw 16 bit words... if you have to write a second value with "pld writereg" there's a problem09:03
wpwrakbut these commands are in turn register writes.09:04
lekernelthere's a "pld reconfigure" command... let's see how it works09:05
lekernelit's probably doing several "pld writereg" internally09:05
wpwrakstrange, nothing happens09:06
wpwrakmaybe it just reloads the standby bitstream09:06
lekernelgrmbl, no09:07
lekernelotoh you can clearly see that "pld writereg" generates a sequence of 16-bit words and writes it into CFG_IN09:08
lekernelgrep for xlx_write_register_xc3s09:08
lekerneland you don't need any bit-flipping, urjtag does it09:09
wpwrakyes, all that looks good09:09
wpwrakso why doesn't it work ? :)09:10
wpwraklet's try something else. i boot up and then issue the commands. see what happens09:13
wpwrakit reset09:14
wpwrak(reset) as if it had power-cycled. but it's not running standby (doesn't respond to the middle button)09:18
wpwrakpld reconfigure  gets me back to standby09:19
wpwrakokay, it better does - it's the equivalent to pulling PROGRAM_B :)09:20
lekernelis it configured?09:24
lekernelif the LEDs are dimly lit, it means it's not configured09:24
lekernelah, maybe it needs another command to tell it to fetch from the NOR flash09:26
wpwrakafter pld reconfigure it's properly configured. boots when i press the middle button.09:26
lekernelok, but after your experimental commands?09:26
wpwrakdo "fast read", "dual fast read", and "quad fast read" tell you something ?09:27
wpwrakyes, after them09:27
lekernelcan you paste the "pld writereg" commands you are using?09:27
wpwraksame as before .. pasting ... http://pastebin.com/Jx8VbQxW09:28
wpwraki tried 0x37 and 0x5 for GENERAL2 (regular and rescue)09:29
lekerneland this sequences reloads the standby bitstream instead of booting?09:29
wpwrakno, it just hangs the box. not sure what it really does. standby doesn't run (or maybe it runs but doesn't work)09:30
lekernelis the FPGA configured during this hang?09:31
wpwrakwhat i can do to properly reset is   pld reconfigure   (just that)09:31
wpwrakonly the power LED is lit in the hang09:31
lekernelbut are the others dimly lit or not?09:31
lekernelthe "dimly lit" you can see a split second after power-up09:32
lekernelon the other two LEDs09:32
wpwraklemme check ...09:32
wpwrakmeanwhile, on page 126 of http://www.xilinx.com/support/documentation/user_guides/ug380.pdf09:32
wpwrakat the very bottom, note 2, does this make any sense to you ?09:32
wpwrakdimly lit, so not configured09:34
lekernelmaybe it's for SPI flash09:34
wpwrakaha, not i FINALLY know what this mysterious "dimly lit" is ;-))09:34
wpwraki mean, what it looks like :)09:35
lekernelXilinx FPGAs support some weird SPI memories with several parallel data lines09:35
lekernelNOR flash doesn't need any opcode to read09:36
wpwrakokay, makes sense. otherwise standby.v shouldn't work either09:36
lekernelwhat happens if you just send IPROG without programming the registers?09:36
lekernelor better09:37
lekernelset all GENERAL_X to 009:37
lekerneland IPROG09:37
lekernelit should reload standby09:37
wpwrak(just IPROG) absolutely nothing happens ;-)09:37
wpwrakIPROG with all zeroes: doesn't configure09:38
lekernelthis is weird09:39
lekerneltry going one level lower and feed the standby.v bitstream directly into CFG_IN09:39
lekernel"pld writereg" inserts NOPs and sync words between writes, maybe this messes it up09:40
lekernelor maybe, IPROG from JTAG doesn't sample the MODE pins and therefore doesn't know it should use the NOR flash interface09:41
lekernelbtw: "The INIT_B pin pulses Low while the FPGA clears its configuration memory"09:43
lekernelso, it's not only on CRC errors it seems ...09:43
wpwrak(mode) do you have a reference for the content of MODE_REG ? i see it mentioned on page 90 of http://www.xilinx.com/support/documentation/user_guides/ug380.pdf09:44
lekernelanyway, if JTAG becomes too annoying, it won't be too hard to modify the standby bitstream so it boots on any serial port activity09:44
wpwrak(init_b) isn't it held low until the config completes anyway ?09:44
wpwrakor it could just boot if the button is held, not just on an edge. that way, i could simply clamp it down :)09:45
lekernelwhat do you think of the "boot on serial activity" solution?09:45
lekernelit did that before, but the problem is that FN uses the same button to shut it down09:46
wpwrakit is galling that jtag wouldn't want to work, though09:46
wpwrakah, crap09:46
wpwrakhmm, i could of course hack urtag to just emit the right sequence, without all the other noise around it09:47
lekernel"boot on serial activity" is ~3 lines of verilog, guaranteed to work, no need to install urjtag on the host machine09:47
lekerneland no more JTAG woes09:47
wpwraklemme first try to hack urtag09:47
wpwrakyou never know what surprising side effects the serial activity may produce :)09:48
wpwraki actually like urtag. works very smoothly so far. at openmoko, we used openocd. the pain ...09:49
lekernelin the same vein, it should also boot on IR activity... but a bit more filtering would be needed there09:50
wpwrakor on USB activity ;-)10:03
wpwrakinteresting. when i do the pld writereg sequence, it goes unconfigured immediately after the IPROG10:07
lekernelIPROG is actually supposed to clear configuration (and hopefully re-read it)10:07
wpwrakwith my hacked urtag sequence, it stays configured (but doesn't boot either). only goes unconfigured when i try to send the sequence again. seems to be some urjtag-internal state, though10:08
wpwraktricky stuff :)10:09
wpwraki'll have my mornig coffee ... maybe some ideas will come10:09
lekernellet's just use the "boot on serial activity" solution then :-)10:16
wpwraknaw, i don't give up so easily. stubborn is my middle name :)10:17
lekernelyes, but pick your battles10:18
wpwraki'll need jtag anyway. maybe not the config thingy, but a lot of the rest10:20
wpwrakaha .. the number of NOPs after the CMD write determines whether something happens or nor11:24
wpwrakmy current theory is that there same bus is used when loading from NOR and when writing from JTAG. so if the configuration process gets kicked off while JTAG still scribbles things on the bus, there could be confusion11:26
qi-botThe build was successfull, see images here: http://fidelio.qi-hardware.com/~xiangfu/build-milkymist/milkymist-openwrt.minimal-09062011-1353/12:49
wpwrakhee hee, le critter bootz ;-)13:40
wpwraknow let's see if i can also go this without dirty hacks to urjtag13:41
wpwrakhmm, not via pld writereg, it seems. well, that would have been too easy.13:43
wpwraklet's check if the boot is reproducible13:43
wpwrakyeah. that much is good. so the M1 splash screen is only shown when the middle button is pressed ?13:44
wpwrakthe secret ingredient was to switch to JSTART at the end13:45
wpwrakwell, i think ... i have some more "magic" things in there. let's see what happens it i remove the others13:45
wpwrakah no. the magic sauce is a bit more complex. binary search then ...13:48
wpwrakcorrection: the magic ingredient is to urj_tap_reset_bypass13:52
wpwrak(before urj_tap_chain_flush)13:52
wpwrakthere seem to be other effects when using writereg, too. so that approach may not work. probably all the setup and un-setup in writereg.13:56
wpwrakhere's my crude hack: http://downloads.qi-hardware.com/people/werner/tmp/urjtag-boot-magic.diff14:01
lekernelso, what was the problem? the extra NOPs at the end?14:01
wpwrakbasically replaces "pld reconfigure" with the prelude of a register write and ends it with part of the xlx_configure (load .bit file) sequence14:02
wpwraki think some of the stuff in the write register sequence interrupt this. plus, you need to urj_tap_reset_bypass before flushing the chain. otherwise it doesn't work.14:03
wpwraki should be able to make a .bit files that does all this without the need to hack urjtag14:03
wpwrakpity urjtag doesn't like .bin files ...14:04
wpwrakoh, and in the config user guide, they say that the CRC check at the end is a _command_ and optional ? that's what i call confidence ;-)14:05
lekernelyeah, urjtag needs a .bit header14:10
lekernelfor pld load14:10
lekernelthere's also an (undocumented) 24-bit frame CRC on spartan614:11
lekernelwhich you can't disable (afaik)14:11
wpwrak(crc) ah, good. making the crc check basically disappear on failure seemed eerily tepco-ish14:12
lekernelwell, i'm actually not totally sure how this works14:14
lekernelmost isn't documented14:15
lekernel"just load the .bit file from ISE"14:15
wpwrakcf. "learned helplessness" :)14:16
lekernelby the way, do you know methods for guessing the CRC polynomial based on data and corresponding CRC values?14:17
wpwrakokay, bit stream seems to work too14:17
lekernelbrute force?14:17
lekernelit's a 24-bit CRC, shouldn't take too long14:17
wpwrakpheew ... no, you can solve it analytically14:17
wpwraki think14:17
wpwrakthat's what makes LSFRs unsuitable for secure hashing14:18
lekernelanother problem is if it's really a CRC or not...14:18
wpwrak(lsfrs unsuitable) i mean without adding a real crypto component. they can be used as part of a secure hash algorithm.14:21
wpwrakfor an LFSR of length n, you need 2 n output bits from the generator to "break" it14:23
wpwrakthe algorithm is called Berlekamp-Massey14:24
Action: wpwrak puts "applied cryptography" back on the bookshelf14:25
lekernelwpwrak, thanks ;-)14:25
wpwrakthank bruce schneier ! :)14:25
wpwrakhere's the boot process: http://projects.qi-hardware.com/index.php/p/wernermisc/source/tree/master/m1/jtag-boot14:39
wpwraknow .. let's see if i can get some signs of life from the serial console ... nice, neocon works :)14:45
wpwrakand there's an "echo" command. very nice.14:48
wpwrakokay, my M1 is now being torture-tested :)14:53
xiangfuwpwrak, what is the 'boot.bit' doing?  I need under the mkboot#L14~23 .14:54
xiangfuseems it's very very simple .14:55
wpwrakxiangfu: it forces an M1 to load the "regular" bitstream, i.e., to boot into flickernoise14:56
wpwrakxiangfu: it does that from any state, as long as the M1 is supplied with power. in particular, this also works out of "standby". so you don't need to press any buttons after power-cycling14:57
xiangfuwpwrak, cool.15:01
xiangfuwpwrak, where I can learn more info about boot.bit ?15:01
xiangfusince it only have 8 commands :)15:02
xiangfu(I guess it only have 8 commands)15:02
xiangfuwpwrak, just tested. works just fine.15:03
wpwrakah, let me write down the references. most of it comes from http://www.xilinx.com/support/documentation/user_guides/ug380.pdf15:03
wpwrakkewl :)15:03
xiangfu(references) great thanks.15:07
xiangfuug380.pdf ok. I need read this 156 pages English pdf :)15:08
wpwrakxiangfu: there's a log of fun stuff in there ;-)15:10
wpwraks/log/lot/ even :)15:13
kristianpaulhum is it posible to use jtag in order TAP a specif wire ..15:54
kristianpauli'm tired of adding test points to the namuru hdl code..15:54
Action: kristianpaul wonder how is going lekernel experiement abour rev eng bitstreams15:55
lekernelkristianpaul, you can try xilinx chipscope17:14
lekernelbut good luck, i never got it to work17:14
wpwrak145 cycles, still boots ...18:02
wpwrakstandby is good, too. even though i guess i could probably now even boot without it18:04
wpwrak282 cycles. still going strong ...21:01
wpwraklekernel: trivia: do 3 LEDs mean "it's rendering" or do they mean "FN has finished booting" ?23:09
wpwrak(well, booting, compiling patches, and so on)23:09
--- Wed Sep 7 201100:00

Generated by irclog2html.py 2.9.2 by Marius Gedminas - find it at mg.pov.lt!