Programming the FE310 through OpenOCD

Hi everyone,

I am trying to program the FE310 target board through OpenOCD. Unfortunately I have only been able to do so two times (randomly). All my other attempts have resulted in errors. I am using the Chipwhisperer Lite with the CW308 UFO Target board and the FE310 victim board. I have followed the instructions from the following tutorial. Furthermore, I have tried supplying power to the victim from both the capture board and an external DC source. I have also tried multiple different OpenOCD versions.

An example of an error occuring when I run run_openocd.sh script with the “fe310.cfg” file:

Setting up MPSSE mode... Done
running /usr/local/bin/openocd -s /home/jelle/openocd -f cw_openocd.cfg -c 'ftdi vid_pid 0x2b3e 0xace2' -c 'transport select jtag' -f fe310.cfg -c 'init; targets; halt; program /home/jelle/KyberSCA/remote/firmware.elf verify reset exit'
Open On-Chip Debugger 0.11.0+dev-02443-gb337b0cfb (2022-12-14-15:01)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
none separate

Warn : Transport "jtag" was already selected
jtag
Info : clock speed 500 kHz
Info : JTAG tap: riscv.cpu tap/device found: 0x20000913 (mfg: 0x489 (SiFive Inc), part: 0x0000, ver: 0x2)
Error: [riscv.cpu.0] DMSTATUS read didn't complete in 4 seconds. The target is either really slow or broken. You could increase the timeout with `riscv set_command_timeout_sec`.
Warn : target riscv.cpu.0 examination failed
Error: [riscv.cpu.0] DMI operation didn't complete in 4 seconds. The target is either really slow or broken. You could increase the timeout with riscv set_command_timeout_sec.
Error: [riscv.cpu.0] DMI operation didn't complete in 4 seconds. The target is either really slow or broken. You could increase the timeout with riscv set_command_timeout_sec.
Error: [riscv.cpu.0] DMI operation didn't complete in 4 seconds. The target is either really slow or broken. You could increase the timeout with riscv set_command_timeout_sec.
Error: libusb_handle_events() failed with LIBUSB_ERROR_INTERRUPTED
openocd: src/jtag/drivers/mpsse.c:850: mpsse_flush: Assertion `ctx->write_count == 0 && ctx->read_count == 0' failed.
./run_openocd.sh: line 120:  3453 Aborted                 bash -c "$cmd"
Disabling MPSSE mode... Done

I get this output for both of my FE310 victims.

My target board is configured as follows:

I wish I could add more pictures, but I can’t since I am a new user of the forum. I hope that the JTAG wiring is clear from the picture.

The switches have been set to deliver 1.8V and 3.3V from the External DC source to the Victim Board.

Here is also a snippet of the output of OpenOCD with the debug flag enabled:

Debug: 976 6800 riscv-013.c:414 scan():  ->  allresumeack anyresumeack allhalted anyhalted authenticated version=2
Debug: 977 6800 riscv.c:1262 riscv_flush_registers(): [riscv.cpu.0]
Debug: 978 6801 riscv.c:2435 riscv_openocd_poll(): should_remain_halted=0, should_resume=0
Debug: 979 6801 target.c:3072 handle_target(): [riscv.cpu.0] target_poll() -> 0, next attempt in 100ms
Debug: 980 6899 riscv.c:2379 riscv_openocd_poll(): polling all harts
Debug: 981 6899 riscv.c:2216 riscv_poll_hart(): [riscv.cpu.0] polling, target->state=2
Debug: 982 6900 riscv-013.c:404 scan(): 41b r 00000000 @11 -> + 00000000 @00; 3i
Debug: 983 6900 riscv-013.c:404 scan(): 41b - 00000000 @11 -> + 00030382 @11; 3i
Debug: 984 6900 riscv-013.c:414 scan():  ->  allresumeack anyresumeack allhalted anyhalted authenticated version=2
Debug: 985 6900 riscv.c:1262 riscv_flush_registers(): [riscv.cpu.0]
Debug: 986 6901 riscv.c:2435 riscv_openocd_poll(): should_remain_halted=0, should_resume=0
Debug: 987 6901 target.c:3072 handle_target(): [riscv.cpu.0] target_poll() -> 0, next attempt in 100ms
^CDebug: 988 6974 server.c:616 sig_handler(): Terminating on Signal 2
Debug: 989 6975 command.c:166 script_debug(): command - shutdown
Debug: 990 6975 riscv.c:2379 riscv_openocd_poll(): polling all harts
Debug: 991 6975 riscv.c:2216 riscv_poll_hart(): [riscv.cpu.0] polling, target->state=2
Debug: 992 6975 riscv-013.c:404 scan(): 41b r 00000000 @11 -> + 00000000 @00; 3i
Debug: 993 6976 riscv-013.c:404 scan(): 41b - 00000000 @11 -> + 00030382 @11; 3i
Debug: 994 6976 riscv-013.c:414 scan():  ->  allresumeack anyresumeack allhalted anyhalted authenticated version=2
Debug: 995 6976 riscv.c:1262 riscv_flush_registers(): [riscv.cpu.0]
Debug: 996 6976 riscv.c:2435 riscv_openocd_poll(): should_remain_halted=0, should_resume=0
Debug: 997 6976 target.c:3072 handle_target(): [riscv.cpu.0] target_poll() -> 0, next attempt in 100ms
User : 998 6976 server.c:762 handle_shutdown_command(): shutdown command invoked
Debug: 999 6976 riscv.c:422 riscv_deinit_target(): riscv_deinit_target()
Debug: 1000 6976 riscv.c:1262 riscv_flush_registers(): [riscv.cpu.0]
Debug: 1001 6976 riscv-013.c:1516 deinit_target(): riscv_deinit_target()
Debug: 1002 6977 target.c:2214 target_free_all_working_areas_restore(): freeing all working areas

I am guessing that the issue is related to hardware and not software. Maybe I am doing something wrong with the wiring or the issue lies elsewhere. I hope that maybe one of you can aid me in figuring out what exactly is causing this issue.

Thanks in advance!


Settings for supplying the victim board with power.

Small update: It seems that running the openocd command a couple of times will work eventually.

Hi,

Do you know what ChipWhisperer commit you’re on? The FE310 needs to be setup with a clock, so I believe there was issues at one point with programming via OpenOCD.

Alex

Hi! Thanks for the response.

As of now I am on git commit: dddd60023eb43b5d599e7e3a7648ad53391668a0 from 5 Nov.

Hmm, that should be newer than any fixes for that. I’ll see if I can replicate the inconsistency there.

Hi Alex, The behaviour seems to be almost consistent.

The first time you try to program through OpenOCD it timeouts and the flash device is never found.

The second time it throws the following errors:

Info : clock speed 500 kHz
Info : TAP riscv.cpu does not have valid IDCODE (idcode=0x0)
Info : TAP auto0.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto1.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto2.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto3.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto4.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto5.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto6.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto7.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto8.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto9.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto10.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto11.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto12.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto13.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto14.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto15.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto16.tap does not have valid IDCODE (idcode=0x80000000)
Info : TAP auto17.tap does not have valid IDCODE (idcode=0xc0000000)
Info : TAP auto18.tap does not have valid IDCODE (idcode=0x60000000)
Info : TAP auto19.tap does not have valid IDCODE (idcode=0x30000000)
Warn : Unexpected idcode after end of chain: 21 0x98000000
Warn : Unexpected idcode after end of chain: 53 0xf9000048
Error: double-check your JTAG setup (interface, speed, ...)
Error: Trying to use configured scan chain anyway...
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x00000000"
Error: auto0.tap: IR capture error; saw 0x0003 not 0x0001
Warn : Bypassing JTAG setup events due to errors

And then the third time the target is programmed successfully.
Hopefully this might help you in identifying the problem.

Also I was wondering how to interact with the victim after programming. When enabling MPSSE mode the scope disconnects as is intended behaviour. Then I program the FE310 through OpenOCD and I am able to run the SimpleSerial firmware. Afterwards, I would like to reconnect to the scope to do captures and serial communication. However upon instantiating with cw.scope() the victim will reset and halt/wait. (waiting for a debug signal maybe?). And therefore, I am unable to do any captures or communication with the victim. What steps should I undertake to be able to do captures and serial communication again?

Hi,

Thanks for the extra details on the programming failures. I’ll see if that’s what I get as well.

When reconnecting, the clock to the FE310 will probably drop out for a bit. You might be seeing some sort of crash related to that. Have you tried toggling the nrst pin after connecting and reestablishing the clock (via scope.default_setup())?

Alex

Hi Alex,

Thank you very much. I have managed to be able to program the board correctly.

I will leave this here in case somebody else is having the same difficulties.
To correctly reconnect to the scope after programming through MPSSE I had to do the following:

def reconnect():
   scope = cw.scope()
   scope.default_setup()
   target = cw.target(scope)

   scope.io.nrst = "low"
   time.sleep(0.7)
   scope.io.nrst = "high_z"

   return scope, target

Thanks for the reply on that, good to hear that worked for you. I’ll update the FE310 documentation so that it’s clear that you should reset the target when reconnecting.

Alex