Georges760
commented
1 year ago I suggest you use Saleae Logic 2 with my High Level Analyzer for BM13xx () it is much more simple to dissect this protocol.
But I can try to tell you what I see in all this hex data :
Opened USB device 0403:6015 ->55 AA 52 05 00 00 0A
- 55 AA is the preamble of any command send from PC to ASIC (the other way is AA 55, see below)
- 52 is a Read Register to ALL chip in the chain (0x42 means Read Register and 0x10 means to ALL chip in the chain)
- 05 is the frame lenght (we ar ein VIL mode) premable excluded
- 00 is the chipAddr(0 because we send the command to ALL ses above)
- 00 is the Register Address we want to read, in this case 0 means ChipAddress -> noted chippy in keno code)
- 0A is the CRC5 of the frame premable excluded
AA 55 13 97 18 00 00 00 06
- AA 55 preamble from ASIC
- 13 97 18 00 is tghe 32 bits value of the read register (in our case we asked for ChipAddress, so it is composed into 1397 is the CHIP_ID, 18 is the CORE_NUM and 00 the CHIP_ADDR)
- 00 copy of the chipAddr from the command above
- 00 copy of the Register Address from the command above
- 06 frame CRC5 premable excluded
->55 AA 53 05 00 00 03
- 53 : ChainInactive to ALL
->55 AA 53 05 00 00 03 ->55 AA 53 05 00 00 03 ->55 AA 40 05 00 00 1C
- 40 : SetAddress to Chip 0 (not ALL, we talk to first Chip here only, this step is used to give logical address to all Chip in the chain one by one, on Bitaxe, only 1 chip...)
->55 AA 51 09 00 80 00 00 00 00 1C
- 51 : Write Register to ALL
- 09: frame length premable excluded
- 00: chipAddr (0 because ALL)
- 80: regAddr : Clock Order Control 0 (see my register map for inside fields)
- 00 00 00 00: 32 bits value of the written register
- 1C: frame CRC5 premable excluded
->55 AA 51 09 00 84 00 00 00 00 11
- 84: Clock Order Control 1
->55 AA 51 09 00 20 00 00 00 01 02
- 20: Ordered Clock Enable
->55 AA 51 09 00 3C 80 00 80 74 10 and so on....
->55 AA 51 09 00 14 00 00 00 00 1C ->55 AA 51 09 00 68 C0 70 01 11 00 ->55 AA 51 09 00 68 C0 70 01 11 00 ->55 AA 51 09 00 28 06 00 00 0F 18 ->55 AA 51 09 00 18 00 00 7A 31 15 ->55 AA 51 09 00 70 0F 0F 0F 00 19 ->55 AA 51 09 00 70 0F 0F 0F 00 19 ->55 AA 51 09 00 08 40 A0 02 25 16 ->55 AA 51 09 00 08 40 A0 02 25 16 ->55 AA 21 96 50 04 00 00 00 00 B2 E0 05 17 24 27 36 64 F5 63 54 DA 33 E2 DE 8F FC DD 48 96 E1 36 D7 03 5C BB 5F A3 FD 5F 68 39 AA A4 BE 10 9C 7E 00 78 4E 69 34 AC 84 05 65 AE 32 58 09 BB EA 44 6D 61 57 F2 61 BE 58 33 FA A8 1D 9A 16 BF E0 82 64 37 91 15 B6 32 93 C4 83 42 B2 E6 63 96 E0 25 02 9E 01 76 D9 24 0F D3 57 27 38 E2 65 DD CD BD 01 E0 61 FB 57 5D D6 AB AE FD 6B 5F 77 74 5C 64 2C F3 34 2F 82 B3 CC C1 2D 84 DD CB 10 DE 5E E0 CD 9C 5B 65 92 BB 2B 26 here it is funky, we start sending mining jobs (works) :
- 21 : Send Works
- other fields, my HLA dissect the beginning, but I need to do more RE with ghidra on this specific point...
AA 55 18 81 67 7D 02 53 99
- AA 55 : preamble fro ASIC
- 18 81 67 7D: should be the nonce
- 02: should be the midstate
- 53: should be the job id
- 99: is composed into 2 parts : 80 means it is on nonce (I think), and 19 is the CRC5 of the frame
AA 55 25 8A 8B 34 05 50 98 more nonce... AA 55 31 18 8C 11 00 52 9C
AA 55 18 81 67 7D 02 53 99 AA 55 25 8A 8B 34 05 50 98 AA 55 31 18 8C 11 00 52 9C
AA 55 18 81 67 7D 02 53 99 AA 55 25 8A 8B 34 05 50 98 AA 55 31 18 8C 11 00 52 9C
AA 55 18 81 67 7D 02 53 99 AA 55 25 8A 8B 34 05 50 98 AA 55 31 18 8C 11 00 52 9C
AA 55 18 81 67 7D 02 53 99 AA 55 25 8A 8B 34 05 50 98 AA 55 31 18 8C 11 00 52 9C
AA 55 18 81 67 7D 02 53 99 AA 55 25 8A 8B 34 05 50 98 AA 55 31 18 8C 11 00 52 9C
skot
->means sent from PC to BM1397. the rest is received from the BM1397