From ee803268fe1c3dab15ecb0525536f8a72679db9f Mon Sep 17 00:00:00 2001 From: John McMaster Date: Sat, 29 Dec 2018 17:08:28 +0100 Subject: [PATCH] xadc: fuzzer PoC Signed-off-by: John McMaster --- fuzzers/033-xadc/Makefile | 12 +++++ fuzzers/033-xadc/README.md | 10 ++++ fuzzers/033-xadc/bits.dbf | 0 fuzzers/033-xadc/generate.py | 36 ++++++++++++++ fuzzers/033-xadc/generate.sh | 5 ++ fuzzers/033-xadc/generate.tcl | 33 +++++++++++++ fuzzers/033-xadc/top.py | 93 +++++++++++++++++++++++++++++++++++ 7 files changed, 189 insertions(+) create mode 100644 fuzzers/033-xadc/Makefile create mode 100644 fuzzers/033-xadc/README.md create mode 100644 fuzzers/033-xadc/bits.dbf create mode 100644 fuzzers/033-xadc/generate.py create mode 100644 fuzzers/033-xadc/generate.sh create mode 100644 fuzzers/033-xadc/generate.tcl create mode 100644 fuzzers/033-xadc/top.py diff --git a/fuzzers/033-xadc/Makefile b/fuzzers/033-xadc/Makefile new file mode 100644 index 00000000..c42d95e0 --- /dev/null +++ b/fuzzers/033-xadc/Makefile @@ -0,0 +1,12 @@ +# read/write width is relatively slow to resolve +# Even slower with multi bit masks... +N := 20 +include ../fuzzer.mk + +database: $(SPECIMENS_OK) + +pushdb: + echo "FIXME" && false + +.PHONY: database pushdb + diff --git a/fuzzers/033-xadc/README.md b/fuzzers/033-xadc/README.md new file mode 100644 index 00000000..4a0b8baa --- /dev/null +++ b/fuzzers/033-xadc/README.md @@ -0,0 +1,10 @@ +As of this writing, this fuzzer is not in the ROI +To use it, you must run tilegrid first with these options (artix7): + +export XRAY_ROI_GRID_Y2=103 +export XRAY_ROI="SLICE_X0Y100:SLICE_X35Y149 RAMB18_X0Y40:RAMB18_X0Y59 RAMB36_X0Y20:RAMB36_X0Y29 DSP48_X0Y40:DSP48_X0Y59 IOB_X0Y100:IOB_X0Y149 XADC_X0Y0:XADC_X0Y0" +005-tilegrid$ make monitor/build/segbits_tilegrid.tdb +005-tilegrid$ make + +Then run this fuzzer + diff --git a/fuzzers/033-xadc/bits.dbf b/fuzzers/033-xadc/bits.dbf new file mode 100644 index 00000000..e69de29b diff --git a/fuzzers/033-xadc/generate.py b/fuzzers/033-xadc/generate.py new file mode 100644 index 00000000..2c60aec5 --- /dev/null +++ b/fuzzers/033-xadc/generate.py @@ -0,0 +1,36 @@ +#!/usr/bin/env python3 + +import json + +from prjxray.segmaker import Segmaker +from prjxray import verilog + + +def bus_tags(segmk, ps, site): + for param in ['INIT_43']: + paramadj = int(ps[param]) + bitstr = [int(x) for x in "{0:016b}".format(paramadj)[::-1]] + for i in range(len(bitstr)): + segmk.add_site_tag(site, '%s[%u]' % (param, i), bitstr[i]) + + +def run(): + + segmk = Segmaker("design.bits") + + print("Loading tags") + f = open('params.jl', 'r') + f.readline() + for l in f: + j = json.loads(l) + ps = j['params'] + assert j['module'] == 'my_XADC' + site = verilog.unquote(ps['LOC']) + + bus_tags(segmk, ps, site) + + segmk.compile() + segmk.write() + + +run() diff --git a/fuzzers/033-xadc/generate.sh b/fuzzers/033-xadc/generate.sh new file mode 100644 index 00000000..f42f840c --- /dev/null +++ b/fuzzers/033-xadc/generate.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +set -ex +source ${XRAY_DIR}/utils/top_generate.sh + diff --git a/fuzzers/033-xadc/generate.tcl b/fuzzers/033-xadc/generate.tcl new file mode 100644 index 00000000..b3e18603 --- /dev/null +++ b/fuzzers/033-xadc/generate.tcl @@ -0,0 +1,33 @@ +create_project -force -part $::env(XRAY_PART) design design +read_verilog top.v +synth_design -top top + +set_property -dict "PACKAGE_PIN $::env(XRAY_PIN_00) IOSTANDARD LVCMOS33" [get_ports clk] +set_property -dict "PACKAGE_PIN $::env(XRAY_PIN_01) IOSTANDARD LVCMOS33" [get_ports stb] +set_property -dict "PACKAGE_PIN $::env(XRAY_PIN_02) IOSTANDARD LVCMOS33" [get_ports di] +set_property -dict "PACKAGE_PIN $::env(XRAY_PIN_03) IOSTANDARD LVCMOS33" [get_ports do] + +create_pblock roi + +add_cells_to_pblock [get_pblocks roi] [get_cells roi] +resize_pblock [get_pblocks roi] -add "$::env(XRAY_ROI)" + +set_property CFGBVS VCCO [current_design] +set_property CONFIG_VOLTAGE 3.3 [current_design] +set_property BITSTREAM.GENERAL.PERFRAMECRC YES [current_design] + +set_property CLOCK_DEDICATED_ROUTE FALSE [get_nets clk_IBUF] +# Disable MMCM frequency etc sanity checks +set_property IS_ENABLED 0 [get_drc_checks {PDRC-29}] +set_property IS_ENABLED 0 [get_drc_checks {PDRC-30}] +set_property IS_ENABLED 0 [get_drc_checks {AVAL-50}] +set_property IS_ENABLED 0 [get_drc_checks {AVAL-53}] +set_property IS_ENABLED 0 [get_drc_checks {REQP-126}] +# PLL +set_property IS_ENABLED 0 [get_drc_checks {REQP-161}] + +place_design +route_design + +write_checkpoint -force design.dcp +write_bitstream -force design.bit diff --git a/fuzzers/033-xadc/top.py b/fuzzers/033-xadc/top.py new file mode 100644 index 00000000..eea96280 --- /dev/null +++ b/fuzzers/033-xadc/top.py @@ -0,0 +1,93 @@ +import os +import random +random.seed(int(os.getenv("SEED"), 16)) +from prjxray import util +from prjxray import verilog +from prjxray.verilog import vrandbit, vrandbits +import sys +import json + + +def gen_sites(): + for _tile_name, site_name, _site_type in sorted(util.get_roi().gen_sites( + ["XADC"])): + yield site_name + + +sites = list(gen_sites()) +DUTN = len(sites) +DIN_N = DUTN * 8 +DOUT_N = DUTN * 8 + +verilog.top_harness(DIN_N, DOUT_N) + +f = open('params.jl', 'w') +f.write('module,loc,params\n') +print( + 'module roi(input clk, input [%d:0] din, output [%d:0] dout);' % + (DIN_N - 1, DOUT_N - 1)) + +for loci, site in enumerate(sites): + + ports = { + 'clk': 'clk', + 'din': 'din[ %d +: 8]' % (8 * loci, ), + 'dout': 'dout[ %d +: 8]' % (8 * loci, ), + } + + params = { + "INIT_43": random.randint(0x000, 0xFFFF), + } + + modname = "my_XADC" + verilog.instance(modname, "inst_%u" % loci, ports, params=params) + # LOC isn't support + params["LOC"] = verilog.quote(site) + + j = {'module': modname, 'i': loci, 'params': params} + f.write('%s\n' % (json.dumps(j))) + print('') + +f.close() +print( + '''endmodule + +// --------------------------------------------------------------------- + +''') + +print( + ''' +module my_XADC (input clk, input [7:0] din, output [7:0] dout); + parameter INIT_43 = 16'h0000; + + (* KEEP, DONT_TOUCH *) + XADC #( + .INIT_43(INIT_43) + ) dut ( + .BUSY(), + .DRDY(), + .EOC(), + .EOS(), + .JTAGBUSY(), + .JTAGLOCKED(), + .JTAGMODIFIED(), + .OT(), + .DO(), + .ALM(), + .CHANNEL(), + .MUXADDR(), + .CONVST(), + .CONVSTCLK(clk), + .DCLK(clk), + .DEN(), + .DWE(), + .RESET(), + .VN(), + .VP(), + .DI(), + .VAUXN(), + .VAUXP(), + .DADDR()); +endmodule +''')