From a082e15c4f3b603d470e7e7e9a50e3088009070b Mon Sep 17 00:00:00 2001 From: Dennis Brentjes Date: Wed, 30 Sep 2026 18:32:18 +0000 Subject: [PATCH] EXI bring-up: device enumerates on hardware over the J4 header First silicon proof of the EXI capture path. A Pi bit-banging EXI into J4 reads the device ID 04 02 02 00 21/21, NWAYS 0x17, HIPR 0x01, writes and reads back PAR0-3, writes IMR, and sees NCRA's reset bit self-clear. Fixes two host-side bugs found getting there: - exi_devid_rpi.py sampled MISO just after the rising edge, racing the slave's own update and landing one bit early (04 came back as 08). Sample in the CLK-low phase, as the simulation does. - pi-exi-wirecheck.py's bridge scan drove HIGH against pull-downs, but the FPGA's SB_IO pull-up out-pulls the Pi's internal pull-down, so every pin reported as bridged. The aggressor now drives LOW against pull-ups. Co-Authored-By: Claude Opus 5 --- CLAUDE.md | 28 +++++++++++++++ hardware/re-bba-rb/exi_devid_rpi.py | 6 +++- hardware/re-bba-rb/exi_regcheck_rpi.py | 47 ++++++++++++++++++++++++++ scripts/pi-exi-wirecheck.py | 23 +++++++------ 4 files changed, 93 insertions(+), 11 deletions(-) create mode 100644 hardware/re-bba-rb/exi_regcheck_rpi.py diff --git a/CLAUDE.md b/CLAUDE.md index e159990..a773d89 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -259,6 +259,34 @@ edge as the EXI pads (x=13–18 vs x=5–9, both y=0 per icestorm's `pinloc_db` have perturbed the one placement variable the pin-co-location experiment showed is worth ±5 MHz — see "Remaining capture bottleneck" above. +**HARDWARE BRING-UP 2026-09-30: the EXI capture path is PROVEN on silicon.** +A Raspberry Pi 4 bit-banging EXI into J4 (EXI_J4 build, seed 8) enumerated the +device and exercised the register file end-to-end: + +| test | result | +|---|---| +| device ID @0x0000, 4 B | `04 02 02 00` — **21/21** | +| NWAYS @0x31 | `0x17` — 21/21 | +| HIPR @0x3A | `0x01` — 21/21 | +| PAR0–3 write `DE AD BE EF` + readback | **match**; restore to `00 09 BF 00` verified | +| IMR @0x08 write `0x86` + readback | `0x86` | +| NCRA @0x00 write `0x01` (reset) | self-cleared to `0x00` on the first poll | + +Two bring-up gotchas, both cost real debugging time: +- **The master must sample MISO during the CLK-LOW phase.** The FPGA drives MISO + on the RISING edge (Mode 3), so sampling just after that edge races the + slave's own update and lands one bit position early — `04 02 02 00` comes back + as `08 ...`. Sample after taking CLK low, before raising it (this is exactly + what the simulation's `spi_byte` does). +- **Clock EXACTLY the requested byte count on a register read.** Over-clocking + (asking for 4 bytes then clocking 8–12) leaves stale prefetched bytes queued + and desynchronises following transactions — the symptom is a *deterministic* + every-Nth-read correctness cycle that looks like a signal-integrity fault but + is speed-independent. The GC driver never over-clocks a register read, so this + is a probe artefact, NOT a gateware bug; reads ≥ 0x100 deliberately stream + until CS (the DMA path). `hardware/re-bba-rb/exi_regcheck_rpi.py` clocks + correctly and is the reference host-side probe. + **Measured 2026-09-30**, `EXI_J4=1` + socket-3 UDP, `--seeds 8`: `clk` 29.2–31.4 MHz (PASS on all 8); `capture_clk` **4 of 8 PASS** (seeds 2, 5, 6, 8), best **seed 8 = 63.09 MHz** (+9.1 MHz / 17% margin). Same pass rate as diff --git a/hardware/re-bba-rb/exi_devid_rpi.py b/hardware/re-bba-rb/exi_devid_rpi.py index 8703cb4..a05bc8f 100644 --- a/hardware/re-bba-rb/exi_devid_rpi.py +++ b/hardware/re-bba-rb/exi_devid_rpi.py @@ -43,8 +43,12 @@ def xfer(b): for i in range(7, -1, -1): GPIO.output(MOSI, (b >> i) & 1) # MOSI stable while CLK is high GPIO.output(CLK, 0) # falling edge -> FPGA samples MOSI - GPIO.output(CLK, 1) # rising edge -> FPGA drives MISO + # Sample MISO HERE, while CLK is low. The FPGA drives MISO on the + # RISING edge, so reading just after that edge races the slave's own + # update and lands one bit position early (04 02 02 00 comes back as + # 08 ...). The low phase is when the bit is settled. r = (r << 1) | GPIO.input(MISO) + GPIO.output(CLK, 1) # rising edge -> FPGA drives next bit return r diff --git a/hardware/re-bba-rb/exi_regcheck_rpi.py b/hardware/re-bba-rb/exi_regcheck_rpi.py new file mode 100644 index 0000000..22ee66d --- /dev/null +++ b/hardware/re-bba-rb/exi_regcheck_rpi.py @@ -0,0 +1,47 @@ +#!/usr/bin/env python3 +"""Clock EXACTLY the requested byte count, the way the GC driver does.""" +import time, collections +import RPi.GPIO as GPIO +CLK, MOSI, MISO, CS = 11, 10, 9, 8 +GPIO.setmode(GPIO.BCM); GPIO.setwarnings(False) +GPIO.setup(CLK, GPIO.OUT, initial=1); GPIO.setup(MOSI, GPIO.OUT, initial=0) +GPIO.setup(CS, GPIO.OUT, initial=1); GPIO.setup(MISO, GPIO.IN) + +def xfer(b): + r = 0 + for i in range(7, -1, -1): + GPIO.output(MOSI, (b >> i) & 1) + GPIO.output(CLK, 0) + r = (r << 1) | GPIO.input(MISO) + GPIO.output(CLK, 1) + return r + +def read(addr, n, gap=0.005, idle=0.010): + GPIO.output(CS, 0); GPIO.output(CLK, 1); time.sleep(0.0005) + xfer((addr >> 6) & 0x7F); xfer(((addr & 0x3F) << 2) | ((n - 1) & 3)) + time.sleep(gap) + out = [xfer(0x00) for _ in range(n)] # EXACTLY n bytes, no more + GPIO.output(CS, 1); time.sleep(idle) + return out + +def trial(tag, addr, n, want, reps=21, idle=0.010): + hits = collections.Counter(); ok = 0 + seq = [] + for _ in range(reps): + r = read(addr, n, idle=idle) + hits[" ".join("%02x" % x for x in r)] += 1 + good = r == want + ok += good + seq.append("." if good else "x") + print(f" {tag:<34} {ok:>2}/{reps} {''.join(seq)}") + for pat, cnt in hits.most_common(3): + print(f" {cnt:>3}x {pat}") + +print("=== exact-length reads, 10ms idle between transactions ===") +trial("device ID @0x0000 (4B)", 0x0000, 4, [0x04, 0x02, 0x02, 0x00]) +trial("NWAYS @0x31 (1B)", 0x31, 1, [0x17]) +trial("HIPR @0x3A (1B)", 0x3A, 1, [0x01]) +print() +print("=== same, but 200ms idle (does state decay?) ===") +trial("device ID @0x0000 (4B)", 0x0000, 4, [0x04, 0x02, 0x02, 0x00], reps=9, idle=0.200) +GPIO.cleanup() diff --git a/scripts/pi-exi-wirecheck.py b/scripts/pi-exi-wirecheck.py index 708cc77..61a9a1e 100755 --- a/scripts/pi-exi-wirecheck.py +++ b/scripts/pi-exi-wirecheck.py @@ -85,25 +85,28 @@ for pin, name, j4 in DRIVEN_BY_PI: print() print("=" * 66) -print("T3 Bridge scan on the Pi-driven lines (catches solder bridges on J4).") -print(" Drive one HIGH, hold the others as inputs with pull-down: any") -print(" victim reading HIGH shares copper with the aggressor.") +print("T3 Bridge scan on the Pi-driven lines (catches solder bridges).") +print(" The aggressor drives LOW and victims are pulled UP: a strong") +print(" driver beats any pull, so a victim dragged low IS bridged.") +print(" (Driving HIGH against pull-downs does NOT work here -- the FPGA's") +print(" SB_IO pull-up out-pulls the Pi's internal pull-down, which would") +print(" report every pin as bridged. T2 shows this directly: down=1.)") print("=" * 66) for pin, name, j4 in DRIVEN_BY_PI: - victims = [(p, n) for p, n, _ in DRIVEN_BY_PI if p != pin] + victims = [(p2, n) for p2, n, _ in DRIVEN_BY_PI if p2 != pin] for vp, _ in victims: - GPIO.setup(vp, GPIO.IN, pull_up_down=GPIO.PUD_DOWN) + GPIO.setup(vp, GPIO.IN, pull_up_down=GPIO.PUD_UP) GPIO.setup(pin, GPIO.OUT) - GPIO.output(pin, 1) + GPIO.output(pin, 0) # aggressor drives LOW time.sleep(0.003) - bad = [n for vp, n in victims if GPIO.input(vp) == 1] - GPIO.output(pin, 0) + bad = [n for vp, n in victims if GPIO.input(vp) == 0] + GPIO.output(pin, 1) GPIO.setup(pin, GPIO.IN, pull_up_down=GPIO.PUD_OFF) if bad: - print(f" drive {name:<5} HIGH -> ** BRIDGED to {', '.join(bad)} **") + print(f" drive {name:<5} LOW -> ** BRIDGED to {', '.join(bad)} **") fails.append(f"{name} is bridged to {', '.join(bad)}") else: - print(f" drive {name:<5} HIGH -> no bridge to {', '.join(n for _, n in victims)}") + print(f" drive {name:<5} LOW -> no bridge to {', '.join(n for _, n in victims)}") print() print("=" * 66)