Réalisation de patches Milkymist

2010-08-14T21:56:14Z

Lekernel: /* Ce que ce n'est pas */

Réalisation de patches Milkymist

2010-08-14T21:55:24Z

Lekernel: /* Ce que c'est */

Réalisation de patches Milkymist

2010-08-14T21:53:30Z

Lekernel: /* Amenez */

Réalisation de patches Milkymist

2010-08-14T21:52:26Z

Lekernel: New page: {{Workshop |title=Réalisation de patches Milkymist |when=Jeudi 19 Août 2010 |where=/tmp/lab |intro=Video Jam Session sur plate-forme Milkymist One |by=lekernel }} = Ce...

Workshops

2010-08-14T21:33:57Z

Lekernel: /* Upcoming Workshops */

Here are the Workshops happening @ /tmp/lab

== Upcoming Workshops ==
19/08/2010 - [[Réalisation de patches Milkymist]]

== Wanted Workshops ==
So, you want to give or take a workshop, but it's not scheduled yet? Open a page for it :)

* [[Réseau : de la conception d'une architecture IPv4 locale à son déploiement]] (contacter {Nico}, tAd ou deadr0m1)
* Programmation comparée (contacter {Nico})
* OpenWrt (contacter {Nico})
* [[RF Jammer advanced]]
* [[Workshop Serial Level Shifter & Router Debrick]]
* [[Awesome Window Manager]]
* [[Ruby for beginners]]
* [[Ruby On Rails]]
* [[Linux Virtualization]] (KVM, Linux-Vserver, OpenVZ)
* [[Vacuum tubes]]
* [[puredata]]
* [[Python : Taste the code]]
* [[Blender : An Open 3D Content Creation Suite]]
* [[DIY AUDIO 3 : easy and efficient mic building]]
* [[OCaml made Obvious]]
* [[BootstrapPIC]]
* PC Rehab
* Church of Security
* DoS, DDoS & Co.
* /tmp/van brico
* Biodiesel
* [[SuperCollider Part II]]
* GIT
* SCTPscan QA & release hacknight
* EGPL release
* CFP-submit workshop
* Secure Server Building from Scratch
* Introduction à l'Electronique
* GPG, TOR and OTR for Privacy on the Internet
* Using your phone for weird goals
* DNS fun
* Histoire, fonctionnement et comment s'amuser avec internet.
* [[Android Lab Workshop: Beginning with AppCelerator]]
* [[Reverse engineering, look behind the software]]

== Past Workshops ==
* 19/02/2009 - [[Python for beginners]]
* 26/02/2009 - [[DIY audio]]
* 12/03/2009 - [[La soudure pour les nuls]]
* 20/03/2009 - [[DIY audio 2]] la suite!
* 21/03/2009 - [[Workshop Introduction aux FPGA]]
* 23/03/2009 - [[Church of Security at SIANA INT]]
* 26/03/2009 - [[Présentation Livecoding]]
* 28/03/2009 - [[FPGA: la suite]]
* 02/04/2009 - [[SuperCollider Part I]]
* 04/04/2009 - [[Workshop OpenWrt]]
* 14/05/2009 - [[Workshop hacking et grand public]]
* 09/07/2009 - [[Workshop post-HSF Open Source Video Editing]]
* 25-26/07/2009 - [[Atelier-Tour de table RepRap et Usinettes, buts du nouveau "FabLab"]]
* 29/08/2009 - [[FPGA Workshop #3: Computer Architecture]]
* ??/09/2009 - [[Défouraille ta Fonera]]
* 10/09/2009 - [[Distributed Crypto SAT Solving]]
* 07/11/2009 - [[Développement logiciel embarqué sur Milkymist]]
* 08/11/2009 - [[FPGA Workshop 4: Behind the Scenes]]
* 26/11/2009 - [[FPGA : une introduction (bis)]] à La Suite Logique
* 21/12/2009 - OpenWrt/Milkymist coding party
* 18/02/2010 - [[Android Lab Workshop: Getting started with Android development and Phonegap discovery]]
* 25/02/2010 - [[RepRap, Usinette & FabLabs: Practice and licenses for RepRap objects and FabLabs projects]]
* 04/03/2010 - [[Hack Roulette 1]]
* 11/03/2010 - [[Lock Picking Build Your Own Tools]]
* 20/05/2010 - [[VoIP hacking workshop]]
* 27/05/2010 - [[SSH_et_SSHFS: accès sécurisé et partage d'un système de fichiers de manière sécurisée en utilisant le protocole SSH.]]
* 17/06/2010 - [[WebOS: développement et hacking]]
* 03/07/2010 - [[Starinux_2010-07-03|Starinux : modules Linux ; comprendre, manipuler, réparer]]
* 08/07/2010 - [[Introduction à la Synthetic Biology et au Biohacking]]

== Adding a Workshop ==
Anybody can create a workshop, this is auto-organization.

# Create a new page on the wiki prefixed with your workshop's keyword, such as "MediaWiki : Why It Doesn't Suck That Much"
## Use the [[Template:Workshop]] :)
## Make sure you add an Attendees section before saving, so that nobody will edit the template itself!
# Add your workshop link on this page with its date
# Add a link in /tmp/lab shared calendar on G00gle Gr0ups
# Announce it on the /tmp/lab mailing list
# Announce it on the #frlab IRC channel and optionnally add it to the topic if it's the next workshop.
# If your workshop involve handling of chemical products, check [http://www.inchem.org/ IPCS (International Programme on Chemical Safety)] for proper handling/disposal instructions

UrJTAG commands to set all pins to 1 on the CPLD

2010-08-14T16:43:54Z

Lekernel: New page: set signal PB00_01 out 1 set signal PB00_02 out 1 set signal PB00_04 out 1 set signal PB00_05 out 1 set signal PB00_07 out 1 set signal PB00_08 out 1 set signal PB00_10 out 1 set s...

set signal PB00_01 out 1
set signal PB00_02 out 1
set signal PB00_04 out 1
set signal PB00_05 out 1
set signal PB00_07 out 1
set signal PB00_08 out 1
set signal PB00_10 out 1
set signal PB00_11 out 1
set signal PB00_13 out 1
set signal PB00_14 out 1
set signal PB00_15 out 1
set signal PB00_16 out 1
set signal PB01_01 out 1
set signal PB01_02 out 1
set signal PB01_04 out 1
set signal PB01_05 out 1
set signal PB01_07 out 1
set signal PB01_08 out 1
set signal PB01_10 out 1
set signal PB01_11 out 1
set signal PB01_13 out 1
set signal PB01_14 out 1
set signal PB01_16 out 1
set signal PB02_01 out 1
set signal PB02_02 out 1
set signal PB02_04 out 1
set signal PB02_05 out 1
set signal PB02_07 out 1
set signal PB02_08 out 1
set signal PB02_10 out 1
set signal PB02_11 out 1
set signal PB02_13 out 1
set signal PB02_14 out 1
set signal PB02_16 out 1
set signal PB03_01 out 1
set signal PB03_02 out 1
set signal PB03_04 out 1
set signal PB03_05 out 1
set signal PB03_07 out 1
set signal PB03_08 out 1
set signal PB03_10 out 1
set signal PB03_11 out 1
set signal PB03_13 out 1
set signal PB03_14 out 1
set signal PB03_16 out 1
set signal PB04_01 out 1
set signal PB04_02 out 1
set signal PB04_04 out 1
set signal PB04_05 out 1
set signal PB04_07 out 1
set signal PB04_08 out 1
set signal PB04_10 out 1
set signal PB04_11 out 1
set signal PB04_13 out 1
set signal PB04_14 out 1
set signal PB04_16 out 1
set signal PB05_01 out 1
set signal PB05_02 out 1
set signal PB05_04 out 1
set signal PB05_05 out 1
set signal PB05_07 out 1
set signal PB05_08 out 1
set signal PB05_10 out 1
set signal PB05_11 out 1
set signal PB05_13 out 1
set signal PB05_14 out 1
set signal PB05_16 out 1
set signal PB06_01 out 1
set signal PB06_02 out 1
set signal PB06_04 out 1
set signal PB06_05 out 1
set signal PB06_07 out 1
set signal PB06_08 out 1
set signal PB06_10 out 1
set signal PB06_11 out 1
set signal PB06_13 out 1
set signal PB06_14 out 1
set signal PB06_16 out 1
set signal PB07_01 out 1
set signal PB07_02 out 1
set signal PB07_04 out 1
set signal PB07_05 out 1
set signal PB07_07 out 1
set signal PB07_08 out 1
set signal PB07_10 out 1
set signal PB07_11 out 1
set signal PB07_13 out 1
set signal PB07_14 out 1
set signal PB07_16 out 1
set signal PB08_01 out 1
set signal PB08_02 out 1
set signal PB08_04 out 1
set signal PB08_05 out 1
set signal PB08_07 out 1
set signal PB08_08 out 1
set signal PB08_10 out 1
set signal PB08_11 out 1
set signal PB08_13 out 1
set signal PB08_14 out 1
set signal PB08_16 out 1
set signal PB09_01 out 1
set signal PB09_02 out 1
set signal PB09_04 out 1
set signal PB09_05 out 1
set signal PB09_07 out 1
set signal PB09_08 out 1
set signal PB09_10 out 1
set signal PB09_11 out 1
set signal PB09_13 out 1
set signal PB09_14 out 1
set signal PB09_16 out 1
set signal PB10_01 out 1
set signal PB10_02 out 1
set signal PB10_04 out 1
set signal PB10_05 out 1
set signal PB10_07 out 1
set signal PB10_08 out 1
set signal PB10_10 out 1
set signal PB10_11 out 1
set signal PB10_13 out 1
set signal PB10_14 out 1
set signal PB10_16 out 1
set signal PB11_01 out 1
set signal PB11_02 out 1
set signal PB11_04 out 1
set signal PB11_05 out 1
set signal PB11_07 out 1
set signal PB11_08 out 1
set signal PB11_10 out 1
set signal PB11_11 out 1
set signal PB11_13 out 1
set signal PB11_14 out 1
set signal PB11_16 out 1
shift dr

Ikos Pegasus reverse engineering

2010-08-14T16:40:47Z

Lekernel: /* Connection of the FPGA JTAG chain to the CPLD */

= Overview =
== What? ==
A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.

* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

See also business articles about the product and its manufacturer:
* [http://www.allbusiness.com/finance/1166622-1.html Mentor Graphics to buy Ikos Systems for 1.69 times revenue]
* [http://www.allbusiness.com/company-activities-management/product-management/6820155-1.html IKOS' VirtuaLogic Emulator Breaks DesignCompilation Time Speed Barrier]
* [http://www.thefreelibrary.com/Rendition+Selects+VirtuaLogic+Emulator+and+Retains+IKOS+Consulting...-a019815460 Rendition Selects VirtuaLogic Emulator]

There are also some reports of using the device in academia, many papers are available from the [http://www.ieeesucks.com I€€€] if you have some grease money to spare.

== Who? ==
[http://lekernel.net Lekernel] and [http://www.aerith.fr Aeris] are doing the reverse engineering, [http://www.ygdes.com Yann] provided the device and [http://www.usinette.org Alex] helped carrying it into the lab. Other contributors are welcome.

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== FPGA JTAG pins ==
Here is the pinout of the JTAG port on the FPGAs (in BGA packages), as published by Xilinx.
{|border="1"
|'''Signal'''
|'''Pin'''
|-
| TMS
| K30
|-
| TCK
| D31
|-
| TDI
| D30
|-
| TDO
| C4
|}

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

Pins can be found by soldering LEDs on the FPGA pins and then using dichotomy to isolate each signal on the CPLD. Here are the [[urJTAG commands to set all pins to 1 on the CPLD]]. This should light up all the LEDs you soldered. Set all pins to 0 using similar commands to turn off the LEDs. Then, set only half of the pins to 1, look at the LEDs and this will tell you in which half of the CPLD pins the signal you're looking for is. Repeat the technique until a single pin is found.

Fortunately, the Pegasus does not bomb when you mess up with the CPLD, at least when only one board is inserted with all its FPGAs desoldered.

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
Once we have full JTAG access to the FPGAs, the reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-14T16:31:37Z

Lekernel: /* FPGA JTAG pins */

= Overview =
== What? ==
A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.

* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

See also business articles about the product and its manufacturer:
* [http://www.allbusiness.com/finance/1166622-1.html Mentor Graphics to buy Ikos Systems for 1.69 times revenue]
* [http://www.allbusiness.com/company-activities-management/product-management/6820155-1.html IKOS' VirtuaLogic Emulator Breaks DesignCompilation Time Speed Barrier]
* [http://www.thefreelibrary.com/Rendition+Selects+VirtuaLogic+Emulator+and+Retains+IKOS+Consulting...-a019815460 Rendition Selects VirtuaLogic Emulator]

There are also some reports of using the device in academia, many papers are available from the [http://www.ieeesucks.com I€€€] if you have some grease money to spare.

== Who? ==
[http://lekernel.net Lekernel] and [http://www.aerith.fr Aeris] are doing the reverse engineering, [http://www.ygdes.com Yann] provided the device and [http://www.usinette.org Alex] helped carrying it into the lab. Other contributors are welcome.

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== FPGA JTAG pins ==
Here is the pinout of the JTAG port on the FPGAs (in BGA packages), as published by Xilinx.
{|border="1"
|'''Signal'''
|'''Pin'''
|-
| TMS
| K30
|-
| TCK
| D31
|-
| TDI
| D30
|-
| TDO
| C4
|}

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
Once we have full JTAG access to the FPGAs, the reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-14T16:31:22Z

Lekernel: /* Programming the auxiliary boards */

= Overview =
== What? ==
A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.

* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

See also business articles about the product and its manufacturer:
* [http://www.allbusiness.com/finance/1166622-1.html Mentor Graphics to buy Ikos Systems for 1.69 times revenue]
* [http://www.allbusiness.com/company-activities-management/product-management/6820155-1.html IKOS' VirtuaLogic Emulator Breaks DesignCompilation Time Speed Barrier]
* [http://www.thefreelibrary.com/Rendition+Selects+VirtuaLogic+Emulator+and+Retains+IKOS+Consulting...-a019815460 Rendition Selects VirtuaLogic Emulator]

There are also some reports of using the device in academia, many papers are available from the [http://www.ieeesucks.com I€€€] if you have some grease money to spare.

== Who? ==
[http://lekernel.net Lekernel] and [http://www.aerith.fr Aeris] are doing the reverse engineering, [http://www.ygdes.com Yann] provided the device and [http://www.usinette.org Alex] helped carrying it into the lab. Other contributors are welcome.

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== FPGA JTAG pins ==
Here is the pinout of the JTAG port on the FPGAs (in BGA packages), as published by Xilinx.
{|border="1"
|'''Signal'''
|'''Pin'''
|-
| TMS
| K30
|-
| TCK
| D31
|-
| TDI
| D30
|-
| TDO
| C4
|}

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
Once we have full JTAG access to the FPGAs, the reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-11T21:11:22Z

Lekernel: /* Interconnect */

= Overview =
== What? ==
A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.

* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

See also business articles about the product and its manufacturer:
* [http://www.allbusiness.com/finance/1166622-1.html Mentor Graphics to buy Ikos Systems for 1.69 times revenue]
* [http://www.allbusiness.com/company-activities-management/product-management/6820155-1.html IKOS' VirtuaLogic Emulator Breaks DesignCompilation Time Speed Barrier]
* [http://www.thefreelibrary.com/Rendition+Selects+VirtuaLogic+Emulator+and+Retains+IKOS+Consulting...-a019815460 Rendition Selects VirtuaLogic Emulator]

There are also some reports of using the device in academia, many papers are available from the [http://www.ieeesucks.com I€€€] if you have some grease money to spare.

== Who? ==
[http://lekernel.net Lekernel] and [http://www.aerith.fr Aeris] are doing the reverse engineering, [http://www.ygdes.com Yann] provided the device and [http://www.usinette.org Alex] helped carrying it into the lab. Other contributors are welcome.

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
Once we have full JTAG access to the FPGAs, the reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-11T21:04:37Z

Lekernel: /* What? */

= Overview =
== What? ==
A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.

* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

See also business articles about the product and its manufacturer:
* [http://www.allbusiness.com/finance/1166622-1.html Mentor Graphics to buy Ikos Systems for 1.69 times revenue]
* [http://www.allbusiness.com/company-activities-management/product-management/6820155-1.html IKOS' VirtuaLogic Emulator Breaks DesignCompilation Time Speed Barrier]
* [http://www.thefreelibrary.com/Rendition+Selects+VirtuaLogic+Emulator+and+Retains+IKOS+Consulting...-a019815460 Rendition Selects VirtuaLogic Emulator]

There are also some reports of using the device in academia, many papers are available from the [http://www.ieeesucks.com I€€€] if you have some grease money to spare.

== Who? ==
[http://lekernel.net Lekernel] and [http://www.aerith.fr Aeris] are doing the reverse engineering, [http://www.ygdes.com Yann] provided the device and [http://www.usinette.org Alex] helped carrying it into the lab. Other contributors are welcome.

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
The reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-11T20:56:50Z

Lekernel: /* What? */

= Overview =
== What? ==
A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.

* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

See also business articles about the product and its manufacturer:
* [http://www.allbusiness.com/finance/1166622-1.html Mentor Graphics to buy Ikos Systems for 1.69 times revenue]
* [http://www.allbusiness.com/company-activities-management/product-management/6820155-1.html IKOS' VirtuaLogic Emulator Breaks DesignCompilation Time Speed Barrier]
* [http://www.thefreelibrary.com/Rendition+Selects+VirtuaLogic+Emulator+and+Retains+IKOS+Consulting...-a019815460 Rendition Selects VirtuaLogic Emulator]

== Who? ==
[http://lekernel.net Lekernel] and [http://www.aerith.fr Aeris] are doing the reverse engineering, [http://www.ygdes.com Yann] provided the device and [http://www.usinette.org Alex] helped carrying it into the lab. Other contributors are welcome.

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
The reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-11T20:54:26Z

Lekernel: /* What? */

= Overview =
== What? ==
A big FPGA based ASIC emulator from the late 90s. Hundreds of FPGAs, thousands of I/Os, hundreds of amperes, dozens of kilos, etc. The FPGAs are quite old (approx. 1/3 the size and 1/3 the speed of a Virtex4 XC4VLX25) but there are ''many'' of them, brute forcing designs can be usually deeply pipelined to make them fast even on slow FPGAs, and it is a great learning tool.

* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

See also business articles about the product and its manufacturer:
* [http://www.allbusiness.com/finance/1166622-1.html Mentor Graphics to buy Ikos Systems for 1.69 times revenue]
* [http://www.allbusiness.com/company-activities-management/product-management/6820155-1.html IKOS' VirtuaLogic Emulator Breaks DesignCompilation Time Speed Barrier]

== Who? ==
[http://lekernel.net Lekernel] and [http://www.aerith.fr Aeris] are doing the reverse engineering, [http://www.ygdes.com Yann] provided the device and [http://www.usinette.org Alex] helped carrying it into the lab. Other contributors are welcome.

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
The reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-11T20:40:19Z

Lekernel: /* Who? */

Ikos Pegasus reverse engineering

2010-08-11T20:39:56Z

Lekernel: /* Who? */

Ikos Pegasus reverse engineering

2010-08-11T20:38:43Z

Lekernel: /* Device overview */

Ikos Pegasus reverse engineering

2010-08-11T20:32:04Z

Lekernel: /* FPGA JTAG programming */

= Device overview =
* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?
* it seems urJTAG has some FPGA programming support.

= Interconnect =
The reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-11T20:31:19Z

Lekernel:

= Device overview =
* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Design tools =
== Synthesis ==
You will need to use Synplify which supports the XC4000 family of FPGAs. There is no Xst support whatsoever.

== Place and route ==
Synplify generates an EDIF netlist which can be fed to the [http://www.xilinx.com/tools/classics.htm ISE Classics] tools for place and route and bitstream generation.

== FPGA JTAG programming ==
TODO
* JTAG tunnelling through the CPLD boundary scan?
* or reprogram the CPLD to re-route JTAG somewhere else?
* does iMPACT support XC4000s?

= Interconnect =
The reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-11T20:27:19Z

Lekernel:

= Device overview =
* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|88
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|90
|-
|TMS
|Q1
|115
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

== LEDs ==
Each auxiliary board has 2 LEDs in the front. They are connected to CPLD pins 58 and 86 in current sink (active low) mode. They can be useful to test your CPLD boundary scan setup.

= Interconnect =
The reverse engineering of the interconnect can be vastly automated by using techniques such as that of [http://nsa.unaligned.org NSA@home].

== FPGA to FPGA ==
TBD

== FPGA to SRAM ==
TBD

== FPGA to I/O port ==
TBD

== Board to board ==
TBD

Ikos Pegasus reverse engineering

2010-08-11T20:24:44Z

Lekernel: /* Connection of the FPGA JTAG chain to the CPLD */

Ikos Pegasus reverse engineering

2010-08-11T20:23:18Z

Lekernel: /* Connection of the FPGA JTAG chain to the CPLD */

Ikos Pegasus reverse engineering

2010-08-11T20:20:33Z

Lekernel: /* Connection of the FPGA JTAG chain to the CPLD */

= Device overview =
* The rack with the power supply can hold up to 7 boards connected via a backplane.
* One main board with:
** SCSI controller
** 8051
** CPLD
** FPGAs
** SDRAM
* 5 auxiliary boards with (each):
** 1 XC95216 CPLD
** 64 XC4036XL FPGAs
** lots of SRAM
* One auxiliary board was destructively reverse engineered, so only 4 are remaining.

Some device photos are [http://ygdes.com/ikos/ here].

= Programming the auxiliary boards =
== Situation ==
In normal operation, the CPLD receives configuration data from the backplane (originating from the mainboard through the SCSI port) and distributes it to the FPGAs. The CPLD uses JTAG to send data to the FPGAs. The 64 FPGAs on each auxiliary board are arranged to form one big JTAG chain driven by the CPLD.

Because this mode of operation uses a proprietary protocol which is especially hard to reverse engineer since we do not have the original software and SCSI device driver, we are trying to program the boards with a JTAG probe.

== CPLD access ==
The CPLD's JTAG port is accessible on each board with a HE10 connector following the [http://www.xilinx.com/itp/xilinx4/data/docs/pac/cables8.html MultiLINX] pinout.

{|border="1"
|Vref
|GND
|NC
|NC
|NC
|NC
|NC
|NC
|NC
|-
|NC
|TDO
|NC
|X
|TDI
|TCK
|TMS
|NC
|NC
|-
|}
Legend: X = missing pin (key), NC = No Connect

We can use [http://urjtag.org urJTAG] to access the CPLD, with the BSDL files released by Xilinx to enable boundary scan. For an unknown reason, the Xilinx iMPACT tool fails to recognize the CPLD.

=== How to use boundary scan with urJTAG ===
cable xpc_ext
bsdl path [path to BSDL files]
detect
instruction EXTEST
shift ir
set signal [pin name from BSDL] out 1
shift dr

== FPGA JTAG chain topology ==
All the 64 FPGAs are arranged in a daisy chain for TDI and TDO.

For TCK and TMS, the board is divided into 4 quadrants and these signals are shared within each quadrant.

[[Image:Ikos_jtag.png]]

== Connection of the FPGA JTAG chain to the CPLD ==
TCK and TMS are not directly connected to the CPLD, but go through a column of 74xx244 TTL buffers in the middle of the board. TDI and TDO are directly connected to the CPLD.

{|border="1"
|'''Signal'''
|'''Quadrant'''
|'''CPLD pin'''
|-
|TDI
|All
|96
|-
|TDO
|All
|92
|-
|TCK
|Q1
|TBD
|-
|TCK
|Q2
|TBD
|-
|TCK
|Q3
|TBD
|-
|TCK
|Q4
|TBD
|-
|TMS
|Q1
|TBD
|-
|TMS
|Q2
|TBD
|-
|TMS
|Q3
|TBD
|-
|TMS
|Q4
|TBD
|}

Ikos Pegasus reverse engineering

2010-08-11T20:17:36Z

Lekernel: /* CPLD access */