<wpwrak> enjoys the lofty feeling of control when issuing labsw ch1=0 ch2=0 and labsw ch1=1 ch2=1 and watching the M1 power-cycle :)
<wpwrak> lekernel: hmm, to write to that ICAP, should  pld writereg  do the trick ? it accepts all the things i sent it quite willingly, but doesn't boot
<lekernel> (labsw) cool !!
<lekernel> hm... maybe you need to write the bits in the opposite order (just guessing)
<lekernel> invert the bits in each 16-bit word
<rejon> wpwrak, that is awesome
<wpwrak> scary :)
<lekernel> also, power cycle before a new try, as you may have confused the configuration system
<wpwrak> yeah, i just noticed that it wouldn't take a normal boot either
<lekernel> btw, you are not using the ICAP through JTAG - the ICAP is only for FPGA designs who want to access the configuration system of the chip they're running on
<wpwrak> ah, i see. well, the config-thingy then :)
<wpwrak> flipped the data bits -> no luck; swapped the data bytes -> neither
<wpwrak> this is my sequence: http://pastebin.com/czRKZeTA
<wpwrak> derived from table 7-1, page 126 of http://www.xilinx.com/support/documentation/user_guides/ug380.pdf
<wpwrak> not sure if i got the various layers of registers right, though. maybe there's one more between "pld" and that config-thingy ?
<lekernel> what are 0x13 0x14 0x15 ?
<lekernel> 0x5
<lekernel> imo you should just dump everything into CFG_IN
<wpwrak> the GENERAL1, GENERAL2, and CMD registers
<wpwrak> (CFG_IN) yeah, i'm searching for a way to do this now ...
<wpwrak> ah. let's see ...
<wpwrak> error: syntax: not a number: 'CFG_IN'
<lekernel> hmm
<wpwrak> seems that "pld" knows some things about the config-thingy. e.g., it complains if CFG_IN/OUT aren't defined.
<lekernel> ah yes, CFG_IN is a JTAG instruction, not a register
<wpwrak> that's why i thought the writereg actually goes to the bus of the config-thingy
<lekernel> the config-thingy only accepts raw 16 bit words... if you have to write a second value with "pld writereg" there's a problem
<wpwrak> but these commands are in turn register writes.
<lekernel> there's a "pld reconfigure" command... let's see how it works
<lekernel> it's probably doing several "pld writereg" internally
<wpwrak> strange, nothing happens
<wpwrak> maybe it just reloads the standby bitstream
<lekernel> grmbl, no
<lekernel> otoh you can clearly see that "pld writereg" generates a sequence of 16-bit words and writes it into CFG_IN
<lekernel> grep for xlx_write_register_xc3s
<lekernel> and you don't need any bit-flipping, urjtag does it
<wpwrak> yes, all that looks good
<wpwrak> so why doesn't it work ? :)
<wpwrak> let's try something else. i boot up and then issue the commands. see what happens
<wpwrak> it reset
<wpwrak> (reset) as if it had power-cycled. but it's not running standby (doesn't respond to the middle button)
<wpwrak> pld reconfigure  gets me back to standby
<wpwrak> okay, it better does - it's the equivalent to pulling PROGRAM_B :)
<lekernel> is it configured?
<lekernel> if the LEDs are dimly lit, it means it's not configured
<lekernel> ah, maybe it needs another command to tell it to fetch from the NOR flash
<wpwrak> after pld reconfigure it's properly configured. boots when i press the middle button.
<lekernel> ok, but after your experimental commands?
<wpwrak> do "fast read", "dual fast read", and "quad fast read" tell you something ?
<wpwrak> yes, after them
<lekernel> can you paste the "pld writereg" commands you are using?
<wpwrak> same as before .. pasting ... http://pastebin.com/Jx8VbQxW
<wpwrak> i tried 0x37 and 0x5 for GENERAL2 (regular and rescue)
<lekernel> and this sequences reloads the standby bitstream instead of booting?
<wpwrak> no, it just hangs the box. not sure what it really does. standby doesn't run (or maybe it runs but doesn't work)
<lekernel> is the FPGA configured during this hang?
<wpwrak> what i can do to properly reset is   pld reconfigure   (just that)
<wpwrak> only the power LED is lit in the hang
<lekernel> but are the others dimly lit or not?
<lekernel> the "dimly lit" you can see a split second after power-up
<lekernel> on the other two LEDs
<wpwrak> lemme check ...
<wpwrak> at the very bottom, note 2, does this make any sense to you ?
<wpwrak> dimly lit, so not configured
<lekernel> maybe it's for SPI flash
<wpwrak> aha, not i FINALLY know what this mysterious "dimly lit" is ;-))
<wpwrak> i mean, what it looks like :)
<lekernel> Xilinx FPGAs support some weird SPI memories with several parallel data lines
<lekernel> NOR flash doesn't need any opcode to read
<wpwrak> okay, makes sense. otherwise standby.v shouldn't work either
<lekernel> what happens if you just send IPROG without programming the registers?
<lekernel> or better
<lekernel> set all GENERAL_X to 0
<lekernel> and IPROG
<lekernel> it should reload standby
<wpwrak> (just IPROG) absolutely nothing happens ;-)
<lekernel> mh?!
<wpwrak> IPROG with all zeroes: doesn't configure
<lekernel> this is weird
<wpwrak> ;-)
<lekernel> try going one level lower and feed the standby.v bitstream directly into CFG_IN
<lekernel> "pld writereg" inserts NOPs and sync words between writes, maybe this messes it up
<lekernel> or maybe, IPROG from JTAG doesn't sample the MODE pins and therefore doesn't know it should use the NOR flash interface
<lekernel> btw: "The INIT_B pin pulses Low while the FPGA clears its configuration memory"
<lekernel> so, it's not only on CRC errors it seems ...
<wpwrak> (mode) do you have a reference for the content of MODE_REG ? i see it mentioned on page 90 of http://www.xilinx.com/support/documentation/user_guides/ug380.pdf
<lekernel> anyway, if JTAG becomes too annoying, it won't be too hard to modify the standby bitstream so it boots on any serial port activity
<wpwrak> (init_b) isn't it held low until the config completes anyway ?
<wpwrak> or it could just boot if the button is held, not just on an edge. that way, i could simply clamp it down :)
<lekernel> what do you think of the "boot on serial activity" solution?
<lekernel> it did that before, but the problem is that FN uses the same button to shut it down
<wpwrak> it is galling that jtag wouldn't want to work, though
<wpwrak> ah, crap
<wpwrak> hmm, i could of course hack urtag to just emit the right sequence, without all the other noise around it
<lekernel> "boot on serial activity" is ~3 lines of verilog, guaranteed to work, no need to install urjtag on the host machine
<lekernel> and no more JTAG woes
<wpwrak> lemme first try to hack urtag
<wpwrak> you never know what surprising side effects the serial activity may produce :)
<wpwrak> i actually like urtag. works very smoothly so far. at openmoko, we used openocd. the pain ...
<lekernel> in the same vein, it should also boot on IR activity... but a bit more filtering would be needed there
<wpwrak> or on USB activity ;-)
<wpwrak> interesting. when i do the pld writereg sequence, it goes unconfigured immediately after the IPROG
<lekernel> IPROG is actually supposed to clear configuration (and hopefully re-read it)
<wpwrak> with my hacked urtag sequence, it stays configured (but doesn't boot either). only goes unconfigured when i try to send the sequence again. seems to be some urjtag-internal state, though
<wpwrak> tricky stuff :)
<wpwrak> i'll have my mornig coffee ... maybe some ideas will come
<lekernel> weird
<lekernel> let's just use the "boot on serial activity" solution then :-)
<wpwrak> naw, i don't give up so easily. stubborn is my middle name :)
<lekernel> yes, but pick your battles
<wpwrak> i'll need jtag anyway. maybe not the config thingy, but a lot of the rest
<wpwrak> aha .. the number of NOPs after the CMD write determines whether something happens or nor
<wpwrak> my current theory is that there same bus is used when loading from NOR and when writing from JTAG. so if the configuration process gets kicked off while JTAG still scribbles things on the bus, there could be confusion
<wpwrak> hee hee, le critter bootz ;-)
<wpwrak> now let's see if i can also go this without dirty hacks to urjtag
<wpwrak> hmm, not via pld writereg, it seems. well, that would have been too easy.
<wpwrak> let's check if the boot is reproducible
<wpwrak> yeah. that much is good. so the M1 splash screen is only shown when the middle button is pressed ?
<wpwrak> the secret ingredient was to switch to JSTART at the end
<wpwrak> well, i think ... i have some more "magic" things in there. let's see what happens it i remove the others
<wpwrak> ah no. the magic sauce is a bit more complex. binary search then ...
<wpwrak> correction: the magic ingredient is to urj_tap_reset_bypass
<wpwrak> (before urj_tap_chain_flush)
<wpwrak> there seem to be other effects when using writereg, too. so that approach may not work. probably all the setup and un-setup in writereg.
<lekernel> so, what was the problem? the extra NOPs at the end?
<wpwrak> basically replaces "pld reconfigure" with the prelude of a register write and ends it with part of the xlx_configure (load .bit file) sequence
<wpwrak> i think some of the stuff in the write register sequence interrupt this. plus, you need to urj_tap_reset_bypass before flushing the chain. otherwise it doesn't work.
<wpwrak> i should be able to make a .bit files that does all this without the need to hack urjtag
<wpwrak> pity urjtag doesn't like .bin files ...
<wpwrak> oh, and in the config user guide, they say that the CRC check at the end is a _command_ and optional ? that's what i call confidence ;-)
<lekernel> yeah, urjtag needs a .bit header
<lekernel> for pld load
<lekernel> there's also an (undocumented) 24-bit frame CRC on spartan6
<lekernel> which you can't disable (afaik)
<wpwrak> (crc) ah, good. making the crc check basically disappear on failure seemed eerily tepco-ish
<lekernel> well, i'm actually not totally sure how this works
<lekernel> most isn't documented
<lekernel> "just load the .bit file from ISE"
<wpwrak> cf. "learned helplessness" :)
<lekernel> by the way, do you know methods for guessing the CRC polynomial based on data and corresponding CRC values?
<wpwrak> okay, bit stream seems to work too
<lekernel> brute force?
<lekernel> it's a 24-bit CRC, shouldn't take too long
<wpwrak> pheew ... no, you can solve it analytically
<wpwrak> i think
<wpwrak> that's what makes LSFRs unsuitable for secure hashing
<lekernel> another problem is if it's really a CRC or not...
<wpwrak> (lsfrs unsuitable) i mean without adding a real crypto component. they can be used as part of a secure hash algorithm.
<wpwrak> for an LFSR of length n, you need 2 n output bits from the generator to "break" it
<wpwrak> the algorithm is called Berlekamp-Massey
<wpwrak> http://en.wikipedia.org/wiki/Berlekamp–Massey_algorithm
<wpwrak> puts "applied cryptography" back on the bookshelf
<lekernel> wpwrak, thanks ;-)
<wpwrak> thank bruce schneier ! :)
<wpwrak> now .. let's see if i can get some signs of life from the serial console ... nice, neocon works :)
<wpwrak> and there's an "echo" command. very nice.
<wpwrak> okay, my M1 is now being torture-tested :)
<xiangfu> wpwrak, what is the 'boot.bit' doing?  I need under the mkboot#L14~23 .
<xiangfu> seems it's very very simple .
<wpwrak> xiangfu: it forces an M1 to load the "regular" bitstream, i.e., to boot into flickernoise
<wpwrak> xiangfu: it does that from any state, as long as the M1 is supplied with power. in particular, this also works out of "standby". so you don't need to press any buttons after power-cycling
<xiangfu> wpwrak, cool.
<xiangfu> wpwrak, where I can learn more info about boot.bit ?
<xiangfu> since it only have 8 commands :)
<xiangfu> (I guess it only have 8 commands)
<xiangfu> wpwrak, just tested. works just fine.
<wpwrak> ah, let me write down the references. most of it comes from http://www.xilinx.com/support/documentation/user_guides/ug380.pdf
<wpwrak> kewl :)
<xiangfu> (references) great thanks.
<xiangfu> ug380.pdf ok. I need read this 156 pages English pdf :)
<wpwrak> xiangfu: there's a log of fun stuff in there ;-)
<wpwrak> s/log/lot/ even :)
<kristianpaul> hum is it posible to use jtag in order TAP a specif wire ..
<kristianpaul> i'm tired of adding test points to the namuru hdl code..
<kristianpaul> wonder how is going lekernel experiement abour rev eng bitstreams
<lekernel> kristianpaul, you can try xilinx chipscope
<lekernel> but good luck, i never got it to work
<wpwrak> 145 cycles, still boots ...
<wpwrak> standby is good, too. even though i guess i could probably now even boot without it
<wpwrak> 282 cycles. still going strong ...
<wpwrak> lekernel: trivia: do 3 LEDs mean "it's rendering" or do they mean "FN has finished booting" ?
<wpwrak> (well, booting, compiling patches, and so on)