bench: die D -- PZSDR P201/P203 Mini (Zynq XC7Z020 rev 2, DNA 0543179c5206c74) as a receipt signer

Owner, 2026-10-10 (translated): "I have another FPGA, a PZSDR P201 Mini / P203 Mini. I plugged it into USB, and an Ethernet cable from it into the second Ethernet port of the AX7203. Flash it; we will sign through it."

Part of #8606 (more than one signer), #8620 (attestation levels) and the network MVP (see #8613).

Measured on this Mac, 2026-10-10

USB: FT2232H "Digilent Adept USB Device", 0403:6010, serial 210203859289. openFPGALoader sees it as -c digilent --busdev-num 0:2. The UART is /dev/cu.usbserial-2102038592891 at 115200.
JTAG chain: ARM Cortex-A9 DAP 0x4ba00477, then PL 0x23727093, which is xc7z020, silicon revision 2.
DNA, read read-only over JTAG with openocd (FUSE_DNA 0x32; ISC_ENABLE, XSC_DNA 0x17, ISC_DISABLE):
- XSC_DNA 0543179c5206c74, the same 15-hex form as dies B (0389c0c2d85e85c) and C (050a5824d85e85c);
- FUSE_DNA 2a18bce290363a73.
PS: the ARM runs the vendor Linux. Its console printed "Waiting up to 20 more seconds for network." The Ethernet port is cabled to the AX7203's second port, with no DHCP on that link.

Plan

No vendor Linux login, and no write to the board's boot flash. The PL is loaded over JTAG into SRAM, which is volatile.

chipdb for xc7z020clg400-1 on the t27c lab, from prjxray-db's zynq7 database, the same way as the 200T chipdbs. The package must be confirmed from the board's marking or manual. A camera photo works.
A PL design that needs no pinout, generated from .t27:
- STARTUPE2 CFGMCLK as the clock;
- DNA_PORT;
- the existing ring-oscillator PUF probe;
- results read over JTAG through BSCANE2 (USER1).
It needs no board pins, so it does not depend on the PZSDR schematic.
Receipts: the host signs with the bench key 4d2ffce012238bd4, and die_binding v2 binds device_dna 0543179c5206c74. This is DEVICE_DNA level: anyone with JTAG can read the DNA, so it identifies the die but does not prove possession.
Device-bound key (receipts: an attestation level -- software-signed work earns testnet credit only; value needs a device-bound identity #8620): a key derived from the PUF response inside the PL, so the private half never leaves the chip. Research: gHashTag/golden-chain-international research/puf_tile_budget.md.
Network: later, the PZSDR <-> AX7203 Ethernet link becomes the first board-to-board link of the ternary network. The AX7203's PHY2 already runs the eth_beacon design.

Writing the board's QSPI or eMMC is a persistent change. It waits for the owner's explicit word, and for a full dump of the vendor image first.

User Scenarios

Given the PZSDR P201 Mini is connected via USB JTAG (FT2232H, serial 210203859289) and Ethernet to the AX7203's second port, When the PL design is loaded over JTAG into volatile SRAM, Then the design reports the device DNA 0543179c5206c74 and a ring-oscillator PUF response over BSCANE2 USER1.
Given the bench key 4d2ffce012238bd4 and device DNA 0543179c5206c74, When a receipt is created with die_binding v2 at DEVICE_DNA level, Then the receipt binds to this specific die and verifies against the bench key.
Given the PUF tile budget research, When a device-bound key is derived from the PUF response inside the PL, Then the private half of the key never leaves the chip.

Requirements

FR-001: The t27c lab MUST produce a chipdb for xc7z020clg400-1 from prjxray-db's zynq7 database.
FR-002: A PL design MUST be generated from .t27 specs using STARTUPE2 CFGMCLK as clock, DNA_PORT, the existing ring-oscillator PUF probe, and BSCANE2 USER1 for JTAG readout.
FR-003: The PL design MUST require no board pinout and not depend on the PZSDR schematic.
FR-004: Receipts MUST be signed with bench key 4d2ffce012238bd4 using die_binding v2 binding device_dna 0543179c5206c74 at DEVICE_DNA level.
FR-005: A device-bound key MUST be derived from the PUF response inside the PL per research/puf_tile_budget.md.
FR-006: The host MUST read DNA and PUF response over JTAG through BSCANE2 USER1.
FR-007: No write to the board's boot flash (QSPI or eMMC) MUST occur.

Success Criteria

t27c specs/tools/trinity/tri/bench.t27 compiles the PL design for xc7z020clg400-1 and exits 0
openFPGALoader -c digilent --busdev-num 0:2 loads the bitstream into SRAM and exits 0
openocd reads XSC_DNA 0543179c5206c74 over JTAG and exits 0
The bench key 4d2ffce012238bd4 signs a receipt with die_binding v2 for device_dna 0543179c5206c74 and the receipt verifies (exit 0)
5 tests in gen/rust/tri/lab/receipt.rs pass for DEVICE_DNA level receipts
specs/tri/lab/receipt.t27 and specs/verified/receipt.t27 validate the receipt structure (exit 0)
cli/t27b/bench/bench.py runs the full bench flow for die D and exits 0
research/puf_tile_budget.md documents the PUF tile budget for the device-bound key derivation

Boundary

specs/tools/trinity/tri/bench.t27
specs/tri/lab/receipt.t27
specs/verified/receipt.t27
cli/t27b/bench/bench.py
gen/rust/tri/lab/receipt.rs
research/puf_tile_budget.md

Hazards for this board, from gHashTag/tri-net (it documents the same Puzhi P201/P203 Mini). PL loads are paused until they are handled.

Ethernet runs through the PL. The PS GEM (macb e000b000) is routed as RGMII through the programmable logic, PHY addr 010 (tri-net docs/W12_SESSION_REPORT.md).
- Loading any bitstream of ours drops Ethernet.
- Loading the PL while Linux has macb bound can hang the PS. tri-net unbinds macb from Linux first (PR feat(boards): board profiles for XC7A100T (minimal + full) #382 quiesce_and_load.sh), and we do not log into that Linux.
- So the first AX7203 link must run on the vendor bitstream.
JTAG on a running board. "Never connect JTAG to a working board": U-Boot's clear_reset_cause breaks the next QSPI boot after a JTAG session. Recovery is SD boot with 5 files (tri-net docs/LOCAL_FLASH.md). Our session so far was read-only (detect, IDCODE, DNA), but the next power cycle may still need SD recovery.
Identity. On the openXC7 flow DNA_PORT reads zero, and the 57-bit DNA_PORT value is not globally unique: up to 32 devices may share one. The unique id is the 64-bit FUSE_DNA, 2a18bce290363a73, read over JTAG. The die's id in receipts is FUSE_DNA.
Every board ships the same identity. Hostname pzp201mini, IP 192.168.1.10, MAC 00:0a:35:00:01:22, with the rootfs in RAM. Spoofing the MAC breaks bulk TX, so identify a board by its UART console.
Readback trick. tri-net fpga/ternary/ps7/ps7_probe.v has zero pins and reads a 0x47C0 anchor plus a heartbeat over EMIO. It tells our bitstream from the vendor's (0x3FF8).

Next step, owner's choice: prepare an SD boot card (5 files) as the safe recovery path, then load the PL with the RGMII path carried or Ethernet given up during the test.

Status after the bring-up lane (stopped on the board hazards above).

Correction to the DNA in this issue's body. 0543179c5206c74 is the RAW XSC_DNA shift. specs/fpga/device_dna.t27 decodes a DNA as the bit-reverse of the raw read, and that rule reproduces dies A (050d58218fd9854) and B (0389c0c2d85e85c). Decoded, die D is 05c6c09473d1854, and the XSC and FUSE reads agree. FUSE_DNA (64-bit) is 2a18bce290363a73.

What happened on the board:

One SRAM load of the PL, at about 14:28Z. It arrived before the stop.
Nothing went to QSPI, eMMC or SD. There was no power cycle and no Linux login.
The board's Ethernet runs through the PL, so it has most likely been down since the load. The PS state is unknown.

Results:

chipdb: build/fpga/openxc7/xc7z020clg400-1.bin, 136,617,100 B, md5 5fe626bc1971d29cbd8770ca93bf47ae. Built on the t27c lab; the package (CLG400) is assumed, not confirmed.
Design, uncommitted drafts in build/die-d/: ro_race.t27 (RoRace) and die_probe.t27 (DieProbe): a CFGMCLK clock, 32 ring-oscillator race pairs, and a USER1 readout. The reference passes both and none of their tests is vacuous. The primitive wrapper (STARTUPE2/DNA_PORT/BSCANE2, 27 lines) stays out of the repo, because gen-verilog cannot instantiate primitives yet and the shrink-only gate refuses it.
USER1 read: d1e108d7 6131e7a2 00000000 00000000.
- The magic and version are right.
- PUF word 0x6131e7a2, from one load; stability across reloads is not yet measured.
- DNA through DNA_PORT reads 0, as tri-net reported for the openXC7 flow.
Receipt: blocked. The only signer of a die_binding v2 receipt is t27c silicon. It is hard-wired to xc7a200tfbg676-1 and to a single-TAP 0x6014 cable, and it refuses two attached cables. A silicon-receipt sign path for other dies is needed: generated from .t27 and shipped in a released macOS binary, not built on this Mac.

Decisions:

The identity in receipts is the decoded 57-bit DNA, 05c6c09473d1854, which fits die_binding v2 today. A v3 binding also carries FUSE_DNA, the globally unique value (see identity and events: one spec mapping key id, executor id, mesh NodeId and device FUSE_DNA, plus the event vocabulary for the atlas and kanban #8649).
The design drops DNA_PORT and keeps the PUF. The id comes from JTAG FUSE/XSC reads.

The owner's choice: prepare the SD boot card (tri-net docs/LOCAL_FLASH.md, 5 files) before any further PL load or power cycle.

Status, 2026-10-10. Everything was SRAM over JTAG. No flash, eMMC or SD write, no power cycle, no Linux login.

chipdb: xc7z020clg400-1.bin, built on the t27c lab. 136,617,100 B, md5 5fe626bc1971d29cbd8770ca93bf47ae. The package is not confirmed from a marking; clg400 is assumed.
Design: specs/fpga/ro_race.t27 and specs/fpga/die_probe.t27, a pin-free race of 32 ring-oscillator pairs read over USER1. PR fpga: a pin-free ring-oscillator probe for die D in .t27 -- RoRace and DieProbe, PUF stable over 5 SRAM loads (Closes #8655) #8659 closes die D: a pin-free ring-oscillator probe in .t27 (RoRace, DieProbe), PUF stable over 5 SRAM loads #8655.
PUF: six SRAM loads; the first ended with DONE low. Ten reads over the next five: RESULT d1e208f7, PUF fc5b6d2a every time. Intra-die Hamming distance 0 of 32, so tri-net's 15% kill switch passes. The word depends on placement: an earlier netlist read 6131e7a2.
DNA, a correction to this issue: 0543179c5206c74 is the raw XSC_DNA shift. Decoded by device_dna.t27 (bit-reversed, the rule behind the receipts for dies A, B and C), die D is 05c6c09473d1854. FUSE_DNA 2a18bce290363a73 decodes to the same value. Both were read before and after the runs.
DNA_PORT read 0 in the fabric: see open flow: DNA_PORT reads 0 on a Zynq XC7Z020 (die D); prjxray lists its pins as always-on pseudo-pips #8661. Primitives cannot be generated from .t27: see gen-verilog cannot instantiate device primitives (STARTUPE2, BUFG, BSCANE2, LUTs), so on-die designs need a hand-written wrapper #8660.
Receipt: not signed. t27c silicon is hard-wired to xc7a200tfbg676-1 and a 0x6014 cable, and on this bench its cable rule would read the AX7203's DNA for a die D run. Proposal in t27c silicon: a board table in .t27 (part, idcode, cable, chain, chipdb) so it signs die_binding v2 for any die, the Zynq included #8662.
Board state: the PL now holds the die probe, so the PS Ethernet (RGMII through the PL) is down. The PS state was not checked.

Navigation Menu

Repository navigation

bench: die D -- PZSDR P201/P203 Mini (Zynq XC7Z020 rev 2, DNA 0543179c5206c74) as a receipt signer #8635

Measured on this Mac, 2026-10-10

Plan

User Scenarios

Requirements

Success Criteria

Boundary

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

bench: die D -- PZSDR P201/P203 Mini (Zynq XC7Z020 rev 2, DNA 0543179c5206c74) as a receipt signer #8635

Description

Measured on this Mac, 2026-10-10

Plan

User Scenarios

Requirements

Success Criteria

Boundary

Activity

gHashTag commented on Oct 10, 2026

gHashTag commented on Oct 10, 2026

gHashTag commented on Oct 10, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions