Ikos Pegasus reverse engineering - Revision history

Zilking75: /* CPLD access */

Zilking75 — Thu, 12 Jan 2012 05:02:45 GMT

CPLD access

←Older revision		Revision as of 05:02, 12 January 2012
Line 82:		Line 82:
	Legend: X = missing pin (key), NC = No Connect		Legend: X = missing pin (key), NC = No Connect

-	We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.	+	We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the <span class="plainlinks">[http://www.great-quotes.com/quotes/author/Audrey/Hepburn<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">Audrey Hepburn quotes</span>] CPLD.

	=== How to use boundary scan with urJTAG ===		=== How to use boundary scan with urJTAG ===

Zilking75: /* Situation */

Zilking75 — Thu, 05 Jan 2012 05:10:30 GMT

Situation

←Older revision		Revision as of 05:10, 5 January 2012
Line 34:		Line 34:
	In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.		In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

-	Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.	+	Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the <span class="plainlinks">[http://540seo.com/<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">local search engine optimization</span>] boards with a JTAG probe.

	== FPGA JTAG pins ==		== FPGA JTAG pins ==

Zilking75: /* What? */

Zilking75 — Mon, 02 Jan 2012 15:17:31 GMT

What?

←Older revision		Revision as of 15:17, 2 January 2012
Line 1:		Line 1:
	= Overview =		= Overview =
	== What? ==		== What? ==
-	A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make <span class="plainlinks">[http://www.andrewflusche.com/services/spotsylvania-reckless-driving-defense/<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">Spotsylvania reckless driving</span>] them fast even on slow FPGAs, and it is a great <span class="plainlinks">[http://www.culinarydepotinc.com<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">restaurant supplies</span>] learning tool.	+	A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make <span class="plainlinks">[http://www.premierrivercruises.com/river-cruise-regions-of-the-world/france-river-cruises<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">river cruises in france</span>] <span class="plainlinks">[http://www.andrewflusche.com/services/spotsylvania-reckless-driving-defense/<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">Spotsylvania reckless driving</span>] them fast even on slow FPGAs, and it is a great <span class="plainlinks">[http://www.culinarydepotinc.com<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">restaurant supplies</span>] learning tool.

	* The rack with the power supply can hold up to 7 boards connected via a backplane.		* The rack with the power supply can hold up to 7 boards connected via a backplane.

MacyWales at 04:28, 20 December 2011

MacyWales — Tue, 20 Dec 2011 04:28:19 GMT

←Older revision		Revision as of 04:28, 20 December 2011
Line 1:		Line 1:
	= Overview =		= Overview =
	== What? ==		== What? ==
-	A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make <span class="plainlinks">[http://www.andrewflusche.com/services/spotsylvania-reckless-driving-defense/<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">Spotsylvania reckless driving</span>] them fast even on slow FPGAs, and it is a great learning tool.	+	A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make <span class="plainlinks">[http://www.andrewflusche.com/services/spotsylvania-reckless-driving-defense/<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">Spotsylvania reckless driving</span>] them fast even on slow FPGAs, and it is a great <span class="plainlinks">[http://www.culinarydepotinc.com<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">restaurant supplies</span>] learning tool.

	* The rack with the power supply can hold up to 7 boards connected via a backplane.		* The rack with the power supply can hold up to 7 boards connected via a backplane.

MacyWales at 03:14, 16 December 2011

MacyWales — Fri, 16 Dec 2011 03:14:01 GMT

←Older revision		Revision as of 03:14, 16 December 2011
Line 1:		Line 1:
	= Overview =		= Overview =
	== What? ==		== What? ==
-	A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.	+	A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make <span class="plainlinks">[http://www.andrewflusche.com/services/spotsylvania-reckless-driving-defense/<span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">Spotsylvania reckless driving</span>] them fast even on slow FPGAs, and it is a great learning tool.

	* The rack with the power supply can hold up to 7 boards connected via a backplane.		* The rack with the power supply can hold up to 7 boards connected via a backplane.

Lekernel: /* What? */

Lekernel — Wed, 04 May 2011 10:25:35 GMT

What?

←Older revision		Revision as of 10:25, 4 May 2011
Line 24:		Line 24:

	There are also some reports of using the device in academia, many papers are available from the [http://www.ieeesucks.com I€€€] if you have some grease money to spare.		There are also some reports of using the device in academia, many papers are available from the [http://www.ieeesucks.com I€€€] if you have some grease money to spare.
		+
		+	Some hints about the original software here: http://groups.csail.mit.edu/cag/raw/benchmark/include/vmw/interface/slic/driver/

	== Who? ==		== Who? ==

Aeris: /* How to use boundary scan with urJTAG */

Aeris — Thu, 24 Feb 2011 08:59:36 GMT

How to use boundary scan with urJTAG

←Older revision		Revision as of 08:59, 24 February 2011
Line 83:		Line 83:

	=== How to use boundary scan with urJTAG ===		=== How to use boundary scan with urJTAG ===
		+	For Xilinx cable :
	cable xpc_ext		cable xpc_ext
		+	For FTDI cable :
		+	cable USB-to-JTAG-IF
		+
	bsdl path [path to BSDL files]		bsdl path [path to BSDL files]
	detect		detect

Aeris: Undo revision 2850 by Aeris (Talk)

Aeris — Thu, 28 Oct 2010 11:10:23 GMT

Undo revision 2850 by Aeris (Talk)

←Older revision		Revision as of 11:10, 28 October 2010
Line 3:		Line 3:
	A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.		A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.

-	* The rack with the power supply can hold up to 6 boards connected via a backplane.	+	* The rack with the power supply can hold up to 7 boards connected via a backplane.
	* One main board with:		* One main board with:
	** SCSI controller		** SCSI controller

Aeris: /* What? */

Aeris — Thu, 28 Oct 2010 11:09:39 GMT

What?

←Older revision		Revision as of 11:09, 28 October 2010
Line 3:		Line 3:
	A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.		A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.

-	* The rack with the power supply can hold up to 7 boards connected via a backplane.	+	* The rack with the power supply can hold up to 6 boards connected via a backplane.
	* One main board with:		* One main board with:
	** SCSI controller		** SCSI controller

Lekernel: /* Connection of the FPGA JTAG chain to the CPLD */

Lekernel — Sat, 14 Aug 2010 16:40:47 GMT

Connection of the FPGA JTAG chain to the CPLD

←Older revision		Revision as of 16:40, 14 August 2010
Line 146:		Line 146:
	\|TBD		\|TBD
	\|}		\|}
		+
		+	Pins can be found by soldering LEDs on the FPGA pins and then using dichotomy to isolate each signal on the CPLD. Here are the [[urJTAG commands to set all pins to 1 on the CPLD]]. This should light up all the LEDs you soldered. Set all pins to 0 using similar commands to turn off the LEDs. Then, set only half of the pins to 1, look at the LEDs and this will tell you in which half of the CPLD pins the signal you're looking for is. Repeat the technique until a single pin is found.
		+
		+	Fortunately, the Pegasus does not bomb when you mess up with the CPLD, at least when only one board is inserted with all its FPGAs desoldered.

	== LEDs ==		== LEDs ==