This effort is concentrated on reverse engineering of the Lightbits LBASSY0021 Xilinx Virtex Ultrascale+ XCVU7P FLVB2104AAZ FPGA in the form of the PCIe x16 low profile board, its peripherals and subsequent use of them.
Since July 24th the OpenFPGALoader project supports this board and its chip in programming and flashing of QSPI flash via my contribution. (trabucayre/openFPGALoader#695)
The generic flash command looks like so:
openFPGALoader -f -c <programmer of your choosing> --bulk-erase --fpga-part xcvu7p-flvb2104
with the added constraints parameters of the flash chip in the xdc:
set_property CONFIG_MODE SPIx4 [current_design]
set_property BITSTREAM.CONFIG.SPI_BUSWIDTH 4 [current_design]
set_property BITSTREAM.CONFIG.CONFIGRATE 85.0 [current_design]
set_property BITSTREAM.CONFIG.SPI_FALL_EDGE YES [current_design]
set_property BITSTREAM.CONFIG.SPI_32BIT_ADDR YES [current_design]
The initial assessment of the programming interface was done and yelded the table below. The pinout is similar in nature to the 14-pin interface used in the Xilinx programmators.
The board was successfully programmed with a mock logic to test wheter the interface if fully functional, as well as whether the board is not locked in some way that would halt its further use.
| Role | Pin number (latch side) | Pin number | Role |
|---|---|---|---|
| GND | 1 | 2 | VCC sense |
| GND | 3 | 4 | TMS |
| GND | 5 | 6 | TCK |
| GND | 7 | 8 | TDO |
| GND | 9 | 10 | TDI |
| GND | 11 | 12 | NC |
| GND | 13 | 14 | UNKNOWN |
| GND | 15 | 16 | UNKNOWN |
| UNKNOWN | 17 | 18 | UNKNOWN |
| NC | 19 | 20 | NC |
Board programming header
The response from the board after connecting it to a JTAG probe and using Openocd was correct and was in line with what chip is present on this board as per the UltraScale Architecture Configuration User Guide (UG570).
Info : usb blaster interface using libftdi
Info : This adapter doesn't support configurable speed
Info : JTAG tap: XCVU7P.tap tap/device found: 0x14b29093 (mfg: 0x049 (Xilinx), part: 0x4b29, ver: 0x1)
JTAG and IDCODE table of contents
To test the clock source and to get to know its frequency, a test pad was selected to output a certain frequency. On this board, an unpopulated clock footprint was used; it included an exposed pin AL27 with the name of IO_L24P_T3U_N10_EMCCLK_65. This pin was highlighted with its associated path.
Selected test point (red arrow) as a part of the unused crystal circuit, tested clock is visible in the upper-left corner
The pin was a type of general I/O, and thus it could be used to verify that the clock source was working. The correct differential pair is made out of pins AY30, BA30 (positive, negative). The final pulse is confirmed to be 100 MHz based on the output of the logic creating a basic clock counter of 1 Hz.
An excerpt from the logic analysis software showing a correct 1 Hz output
I used a simple universal asynchronous transmitter, sending a unique number for each of the GPIO pins available in this footprint, 702 in total. The pin description effort is ongoing and the current state can be seen in this constraints file.
The board itself features multiple packages that play a role in power management, memory, and clocking. Some elements are yet to be identified and catalogued.
| Integrated circuit marking | Image | Part number | Descritpion |
|---|---|---|---|
| 1000000 DCP1838 05U9 | Probably Abracon ASEMP series 100 MHz differential MEMS clock oscillator | ||
| 32Y 849W S102I | 8P34S1102 | 1:2 LVDS 1.8V/2.5V Fanout Buffer for 1PPS and High-Speed Clocks | |
| 1TIR 91J | Unknown | ||
| 7BDS | PCA9306DCUX | PCA9306 Dual Bidirectional I2C Bus and SMBus Voltage-Level Translator | |
| 0505 XBPX | Unknown | ||
| 7418 GA9D12 | AON7418 | MOSFET N-CH 30V 46A/50A | |
| 1206 89K D8TG | Unknown | ||
| LVC8T245 CWZ82422 TXD930B | SN74LVC8T245 | 8-Bit Dual-Supply Bus Transceiver With Configurable Voltage Translation and 3-State Outputs | |
| 9MAI7 RW299 PC3X | MT25QU512ABB8E12-0AUT | Serial NOR Flash Embedded Memory 1.8 or 3V | |
| TPS2418 66K G4 A10Y | TPS2481 | 9-V to 80-V hot swap controller with I2C current monitor and Auto Retry | |
| TPS24771 TI 871 AJDX | TPS24771 | 2.5-V to 18-V hot swap controller with high performance with analog current monitor | |
| TPS40428 TI 7CI C0KI G4 | TPS40428 | Dual Output, 2-Phase, Stackable PMBus Synchronous Buck Driverless Controller | |
| TPS53515 TI 91I A7IL | TPS53515 | 1.5V to 18V (4.5V to 25V Bias) Input, 12A Single Synchronous Step-Down SWIFT Converter | |
| UCD90160A | UCD90160A | 16-Rail Power Supply Sequencer and Monitor With ACPI Support | |
| MT40A512M16LY-062E:E | 8Gb DDR4 SDRAM |
Reach out to me if you have any questions regarding this work or if you have some information helpful in reverse engineering of this hardware.