Tmplab - User contributions [en]

Ikos Pegasus reverse engineering

2011-12-20T04:28:19Z

MacyWales:

= Overview =
== What? ==
A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make [http://www.andrewflusche.com/services/spotsylvania-reckless-driving-defense/Spotsylvania reckless driving] them fast even on slow FPGAs, and it is a great [http://www.culinarydepotinc.comrestaurant supplies] learning tool.

* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

See also business articles about the product and its manufacturer:
* [http://www.allbusiness.com/finance/1166622-1.html Mentor Graphics to buy Ikos Systems for 1.69 times revenue]
* [http://www.allbusiness.com/company-activities-management/product-management/6820155-1.html IKOS' VirtuaLogic Emulator Breaks DesignCompilation Time Speed Barrier]
* [http://www.thefreelibrary.com/Rendition+Selects+VirtuaLogic+Emulator+and+Retains+IKOS+Consulting...-a019815460 Rendition Selects VirtuaLogic Emulator]

There are also some reports of using the device in academia, many papers are available from the [http://www.ieeesucks.com I€€€] if you have some grease money to spare.

Some hints about the original software here: http://groups.csail.mit.edu/cag/raw/benchmark/include/vmw/interface/slic/driver/

== Who? ==
[http://lekernel.net Lekernel] and [http://www.aerith.fr Aeris] are doing the reverse engineering, [http://www.ygdes.com Yann] provided the device and [http://www.usinette.org Alex] helped carrying it into the lab. Other contributors are welcome.

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== FPGA JTAG pins ==
Here is the pinout of the JTAG port on the FPGAs (in BGA packages), as published by Xilinx.
{|border="1"
|'''Signal'''
|'''Pin'''
|-
| TMS
| K30
|-
| TCK
| D31
|-
| TDI
| D30
|-
| TDO
| C4
|}

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
For Xilinx cable :
cable xpc_ext
For FTDI cable :
cable USB-to-JTAG-IF

bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

Pins can be found by soldering LEDs on the FPGA pins and then using dichotomy to isolate each signal on the CPLD. Here are the [[urJTAG commands to set all pins to 1 on the CPLD]]. This should light up all the LEDs you soldered. Set all pins to 0 using similar commands to turn off the LEDs. Then, set only half of the pins to 1, look at the LEDs and this will tell you in which half of the CPLD pins the signal you're looking for is. Repeat the technique until a single pin is found.

Fortunately, the Pegasus does not bomb when you mess up with the CPLD, at least when only one board is inserted with all its FPGAs desoldered.

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
Once we have full JTAG access to the FPGAs, the reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2011-12-16T03:14:01Z

MacyWales:

= Overview =
== What? ==
A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make [http://www.andrewflusche.com/services/spotsylvania-reckless-driving-defense/Spotsylvania reckless driving] them fast even on slow FPGAs, and it is a great learning tool.

* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

See also business articles about the product and its manufacturer:
* [http://www.allbusiness.com/finance/1166622-1.html Mentor Graphics to buy Ikos Systems for 1.69 times revenue]
* [http://www.allbusiness.com/company-activities-management/product-management/6820155-1.html IKOS' VirtuaLogic Emulator Breaks DesignCompilation Time Speed Barrier]
* [http://www.thefreelibrary.com/Rendition+Selects+VirtuaLogic+Emulator+and+Retains+IKOS+Consulting...-a019815460 Rendition Selects VirtuaLogic Emulator]

There are also some reports of using the device in academia, many papers are available from the [http://www.ieeesucks.com I€€€] if you have some grease money to spare.

Some hints about the original software here: http://groups.csail.mit.edu/cag/raw/benchmark/include/vmw/interface/slic/driver/

== Who? ==
[http://lekernel.net Lekernel] and [http://www.aerith.fr Aeris] are doing the reverse engineering, [http://www.ygdes.com Yann] provided the device and [http://www.usinette.org Alex] helped carrying it into the lab. Other contributors are welcome.

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== FPGA JTAG pins ==
Here is the pinout of the JTAG port on the FPGAs (in BGA packages), as published by Xilinx.
{|border="1"
|'''Signal'''
|'''Pin'''
|-
| TMS
| K30
|-
| TCK
| D31
|-
| TDI
| D30
|-
| TDO
| C4
|}

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
For Xilinx cable :
cable xpc_ext
For FTDI cable :
cable USB-to-JTAG-IF

bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

Pins can be found by soldering LEDs on the FPGA pins and then using dichotomy to isolate each signal on the CPLD. Here are the [[urJTAG commands to set all pins to 1 on the CPLD]]. This should light up all the LEDs you soldered. Set all pins to 0 using similar commands to turn off the LEDs. Then, set only half of the pins to 1, look at the LEDs and this will tell you in which half of the CPLD pins the signal you're looking for is. Repeat the technique until a single pin is found.

Fortunately, the Pegasus does not bomb when you mess up with the CPLD, at least when only one board is inserted with all its FPGAs desoldered.

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
Once we have full JTAG access to the FPGAs, the reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Main Page

2011-10-30T18:32:02Z

MacyWales:

This is the Wiki from [http://www.tmplab.org/ /tmp/lab]. You can freely edit this, you just need to register and validate your account [http://thebeginnerslens.com/iphone photography] with your email [http://www.diamondlinks.net/link building] address to prevent spam. Thanks!

<div style="float:left; width:48%;"> 
= Intro =
* [http://www.tmplab.org/about/ About /tmp/lab & FAQ]
* [http://www.tmplab.org/contact/ Coming to /tmp/lab & contact information]
* [http://www.allgallbladdersymptoms.org/ Gallbladder Disease in Children]
* [http://www.tmplab.org/ Blog & news]
* /tmp/lab is located near a [http://ec.europa.eu/environment/seveso/index.htm Seveso] classified pharmaceutical plant ([http://www.portalanglais.com/spip.php?article132 lire l'article en français])
* [[A little history of /tmp/lab]] (en) ([http://www.tmplab.org/wiki/index.php/A_little_history_of_/tmp/lab#Fran.C3.A7ais Un petit historique du /tmp/lab])
* [[Press]]
* [[Administratif]]
* [http://www.aheadacheinthepelvis.net/ A Headache in the Pelvis]
* [http://www.bedbugbitesguide.com/ Bed Bug Bites]
* [http://www.tmplab.org/2009/07/31/stages-au-tmplab-internships/ Stages / Internships]
* [[If you want to volunteer]] & [http://www.shoppharmacycounter.com/t-dietpillsonline.aspx diet pills]

= Living =
* [http://www.tmplab.org/wiki/index.php//tmp/lab_How_To How To]
* [[Borrowed things]]
* [[KineKlub]]
* [[Conferences]]
* [[Workshops]]
* [[D&Co]]
* [[/tmp/gaite]]
* [[/tmp/Mac/Val]]
* [[PdTmpLab]]

= Events =
* [[Atelier RepRap & BBQ - 12 au 20 aout 2011 - /tmp/lab Vitry-sur-Seine]]
* [[Workshops Macval (Vitry) (03 juillet 2011)]]
* [[Plastic Hacker Space Festival (29-30-31 oct. 2010)]]
* [[Trail_Sheevaplug_OpenBSD|Code Trail : porting OpenBSD to Marvell Sheevaplug (2-3 sept. 2010)]]
* [[Starinux_2010-07-03|Starinux : modules Linux ; comprendre, manipuler, réparer (3 juillet 2010)]]
* [[26C3]] [http://www.bestpills4weightloss.com/ best weight loss pills]
* [[Hackers at CERN]] (Février/Mars 2010)
* /tmp/lab hors les murs au Palais de Tokyo (4, 11 et 18 Juin 2009)
* [http://www.hackerspace.net/ Hacker Space Fest 2009]
* [[HackerSpaceEurasianTour|HackerSpace Eurasian Tour]]
* [[HackerSpaceEuroTour2|HackerSpace Euro Tour 2, June 2009]] see [[HackerSpaceEuroTours]]
* [[HackerSpaceEuroTour|HackerSpace Euro Tour, May 2009]] see [[HackerSpaceEuroTours]]
* [[Wireless Battle Mesh]]
* [[AndroidLab]] [http://en.wikipedia.org/wiki/Susan_Lim Dr Susan Lim Singapore]

<div style="float:right; width:48%;"> 

= Active projects =
You can find a list of [http://tripfoundry.com/ Trip Foundry] projects you are welcome to join here:
http://dev.tmplab.org/projects/projects/issues
*[[Brain Computer Interface]]
* [[OLPC France]]
** [[OLPC Emulation]]
** [[Backtrack3 on EEE]]
** [[OLPC Live]]
** [[Sugar Xubuntu on EEE]]
** [[FlashEEE]]
* [http://usinette.org usinette @ /tmp/lab]
* [[Bosch PBX]]
* [[BioHacklab | BioHacklab Hackerspace]]
* [[6Bis Technical Assistance]]
* [[Ikos Pegasus reverse engineering]]
* [[HostileWRT]]
* [[tmp/bunker]]
* [[Geodepollution]]
* [[Micro multimediad(a)emon]]

= Old projects =
* [[Hacker Space Fest]]
** [[HSF Organization]]
** [[HSF Task List]]
** [[HSF Spaces]]
* BioEco &
** [[Toxic Gas Sensor]]
** [[/tmp/flower]]
* [[/tmp/van]]
* [[Chip Reverse Engineering]]
* [[FreeTvPerso video relay]]
* [[Domoverse platform]]
* [[DemoParty Compo with MilkyMist]]
* [[Roam#]]
* [[/tmp/order]]
* [[Dream Devices]]
* [[Freedom Not Fear]]
* [[esonoclaste upgrade]]
* [[/tmp/net dn42]]

= Documentation =

* [[MediaWikiLinks]]
* [[Information Design]]
* [[GIT Cheat Sheet]]
* [[BackTrack]]
* [[RFID]] & [http://www.supplementstoweightloss.com/t-adipex.aspx adipex]
* [[Pure Data]]
* [[Mobile Phone Chargers]]
* [[Ruby]]
* [[Ruby on Rails]]
* [[Python]]
* [[Python Django]]
* [[Business Methods]]
* [[HowToUseTheTracer]]
* [[workshop McWire au CreaLab ]]
* [[Reverse Engineering Resources]]
* [[Network management]]
* [[stream Jack/darkice (Roam# perf10)]]
* [[Caméra Elphel]]
* [[OOP in C]]

<div class="right" >
<ul style="display:none;">
[http://www.ocularconcepts.us Website Design Companies OH]

</div>

RepRap, Usinette & FabLabs: Practice and licenses for RepRap objects and FabLabs projects

2011-10-28T13:27:01Z

MacyWales:

= Info =
Date: 25/02/2010
Time: 20h-23h
Location: /tmp/lab

= Presentation =

Lors de cette réunion nous tenterons d'exposer les [http://www.andrewflusche.com/services/spotsylvania-dui-lawyer/Spotsylvania DUI lawyer] différentes possibilités d'usage des licences libres pour des projets de hardware, de design ou d'art plastique.
Les deux RepStraps du /tmp/lab seront elles aussi présentes ;-)

= Attendees =
* Alex
* Phil
* Add your name here...

RepRap, Usinette & FabLabs: Practice and licenses for RepRap objects and FabLabs projects

2011-10-28T13:16:01Z

MacyWales:

= Info =
Date: 25/02/2010
Time: 20h-23h
Location: /tmp/lab

= Presentation =

Lors de cette réunion nous tenterons d'exposer les [http://www.andrewflusche.com/services/stafford-dui-lawyer/Stafford DUI lawyer] différentes possibilités d'usage des licences libres pour des projets de hardware, de design ou d'art plastique.
Les deux RepStraps du /tmp/lab seront elles aussi présentes ;-)

= Attendees =
* Alex
* Phil
* Add your name here...