• Stars
    star
    136
  • Rank 267,670 (Top 6 %)
  • Language Verilog
  • License
    Apache License 2.0
  • Created almost 6 years ago
  • Updated over 3 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Pano Logic G2 Reverse Engineering Project

Pano Logic Zero Client G2

Questions? Try the Pano Logic gitter.im chat room! https://gitter.im/panologic/community

Introduction

This project contains the reverse engineering results of the Pano Logic Zero Client G2.

It was started by cyrozap, who did all the hard work of figuring out connections between the FPGA and peripheral ICs. Some of this work can also be found on his wiki page, though this GitHub repo should now all have that information as well.

There is a similar effort that focuses, among other things, on expanding the Pano Logic G2 with a break-out board. Check here for further information.

The Pano Logic G2 is the successor of the Pano Logic G1. Like the G1, it has all the interfaces that are needed to build a small mini-computer with an FPGA.

IMPORTANT: There are 2 versions of the Pano Logic G2: some use a Spartan 6 LX150 while others use an LX100, which is smaller but still very large, and with equal amount of block RAM and DSPs. You should be able to distinguish between the two by the revision code: LX150 is rev B and LX100 is rev C. But beware: there are VGA-based Pano G1s that are also called rev C. So always check first that your unit has the right video connector.

Compared to the G1, the most important improvements of G2 are:

  • Much larger FPGA: a Xilinx Spartan-6 XC6SLX150 or XC6SLX100

    This is one of the largest Spartan-6 devices, and a huge upgrade compared to the Spartan-3 1600 FPGA of the G1!

    For the longest time, this device was not supported by the free Xilinx ISE 14.7, and it's still not supported by that Linux version. However, there is now an ISE 14.7 for Win10 version that not only supports Spartan-6, but it supports the larger devices such as the LX150/LX100 as well!

    Download ISE 14.7 Windows 10 here.

  • 128MByte of DDR2 SDRAM instead of 32MByte of LPDDR SDRAM.

  • 128Mbit serial flash instead of 8Mbit.

  • DVI instead of VGA output

    The Chrontel chip that drives the DVI part also supports VGA, and these VGA pins are connected to the analog DVI pins. So VGA is still supported with a simple, passive DVI-to-VGA adapter.

  • Micro-HDMI output

  • Gigabit Ethernet

Disassembly

Overly detailed disassembly pictures can be found here.

Disassembly Complete

JTAG

Instructions on how to get the JTAG going are here.

JTAG Connected

FPGA Connections

See the Pano.ucf file for all the FPGA connections.

These were all reverse engineered by cyrozap.

FPGA External Clocking Architecture

According to the initial reverse engineered pin assignment by cyrozap, there is a fixed 25MHz oscillator input into the FPGA on pin Y13 that will serve all your clocking needs.

The reality is a bit more interesting. The real clocking architecture (with my custom FPGA content) is as follows:

FPGA External Clocking Diagram

There is indeed a 25MHz clock oscillator on the PCB, but instead of going straight to the FPGA, it goes to the Marvell Ethernet PHY instead.

The PHY has a fixed ratio 25MHz to 125MHz PLL. That 125MHz clock is used internally, but also brought out to the 125CLK pin which is in turn connected to pin Y13 of the FPGA.

However, when the PHY is in reset, this PLL is disabled and pin 125CLK carries the original 25MHz instead! (This is not documented in the datasheet of the close cousin of this PHY.)

When you don't use the PHY, it's natural to not assign any value to the FPGA pin that drives the PHY RESET_ pin, so without knowing this quirk of the design, one gets tricked into assuming that pin Y13 always carries a clock of 25MHz.

But as soon as you want to use the PHY and deassert its reset, the clock switches to 125MHz!

For designs with Ethernet support, there are 2 options:

  1. Always have the FPGA deassert (drive to 1) the reset pin of the PHY.

    In this case, pin Y13 will always carry 125MHz and you can design your logic with that clock in mind. It has the disadvantage that you'll never be able to toggle the reset pin of the PHY at will.

  2. Make you design capable of dealing with both 25MHz and 125MHz.

    This is a bit more complicated, but it will allow you to toggle the reset pin.

It's usually not necessary to reset a PHY which makes the first option the most attractive one.

(Since I wasn't aware of this clocking arrangement at first, my initial choice was of course the second one...)

Board to Board Connector

The Board to Board connector was reverse engineered by twj42. The table below is based on this page.

Pin Nr FPGA Pin Function Function FPGA Pin
Outside Inside
1 GND GND
2 3.3V 3.3V
3 ` D17 DVI_D[0] DVI_D[1] A14
4 A15 DVI_D[2] DVI_D[3] A16
5 A17 DVI_D[4] DVI_D[5] A18
6 GND GND
7 D14 DVI_D[6] DVI_D[7] B14
8 B16 DVI_D[8] DVI_D[9] B18
9 E16 DVI_D[10] DVI_D[11] D15
10 GND GND
11 H12 PANO_BUTTON DVI_XCLK_P E14
12 F13 LED_GREEN DVI_XCLK_N F15
13 H13 LED_BLUE 5V
14 5V ?
15 GND DVI_SPD D9
16 5V 5V
17 ? 1.8V
18 GND GND
19 1.8V 1.8V
20 C14 DVI_DDC_SCL DVI_H F12
21 C17 DVI_DDC_SDA DVI_V C16
22 GND GND
23 ? DVI_DE F14
24 ? DVI_RESET_ C15?
25 ? DVI_HPINT D13
26 GND GND
27 Linked to 28 USB J2
28 Linked to 27 USB J2
29 1.2V 1.2V
30 GND USB J3
31 1.2V USB J3
32 GND GND

Programming

There are different ways to program a bitstream into a Pano G2:

  • Use Xilinx ISE and a Xilinx ISE compatible JTAG programmer (see photo above)
  • Use Xilinx ISE, a Xilinx Virtual Cable server and an FT2232H-based JTAG dongle
  • Use xc3sprog
  • Use OpenOCD

Resources

  • Xilinx Spartan-6 XC6SLX150 FGG484 speed grade 2 / Spartan-6 XC6SLX100

    Features:

    • 147K / 101K logic cells
    • 23K / 16K slices (4 6-input LUTs per slice, 8 FFs per slice)
    • 184K / 127K FFs
    • 1355 / 976 Kbit max distributed RAM
    • 4824 / 4824 Kbit max block RAM (268 RAMs)
    • 180 / 180 DSPs (1 18x18 multiplier + pre-addr + accumulator)
    • 6 CMTs (2 DCMs and 1 PLL per CMT)
    • 4 memory controllers (2 used for the DDR2 SDRAM)

    Documents:

  • 2x Micron MT47H32M16NF-25E DDR2 SDRAM

    That's right: there are 2 SDRAM chips on this board! Each one has 512Mbit in x16 configuration, good for 64MByte per DRAM and 128MByte total.

    Theoretical peak BW is 3.2GByte/s, which is pretty decent.

    1920x1200x24@60 requires an average BW of only 3.3 Gbit/s, or 6.6Gbit/s with 2 screen attached. So there's definitely way more BW available than strictly needed.

  • Wolfson WM8750BG Audio Codec

  • 2x Chrontel CH7301C-TF DVI Transmitter

    Supports pixel clocks up to 165MHz, which corresponds to 1920x1200x60 (with reduced blanking.) Also supports analog VGA output. Built-in conversion from YUV to RGB.

    Since HDMI is a superset of DVI, the same chip is also used for HDMI, without support for audio.

    There is no support for HDCP.

    These chips have an I2C slave interface to access configuration and status registers. After bootup, the chips are in power down mode, so you always need an I2C master of some sort to make video work.

  • Marvell 88E1119R-NNW2

    While there is no exact datasheet for this chips, there are a number on the web that are of the same product family with a close feature match.

    Based on the package size of 72 pins, this Lattice ECP3 Evaluation board seems to use two of these devices. The schematics are here, on page 20 and 21.

    Marvell schematic

    Using that schematic, we can derive the following pinout:

    Pin Nr Pin Name
    1 TXD[3]
    2 TXD[4]
    3 TXD[5]
    4 TXD[6]
    5 TXD[7]
    6 GTX_CLK
    7 DVDD
    8 COMA_n
    9 CLK125
    10 LED[0]
    12 LED[1]
    13 VDDO
    14 LED[3]
    15 RESET_N
    15 DIS_REG12
    16 DVDD
    17 AVDDR
    18 AVDDR
    19 AVDDX
    20 CTRL18
    21 NC
    22 MDIN[3]
    23 MDIP[3]
    24 AVDD
    25 AVDD
    26 MDIN[2]
    27 MDIP[2]
    28 MDIN[1]
    29 MDIP[1]
    30 AVDD
    31 AVDD
    32 AVDD
    33 MDIN[0]
    34 MDIP[0]
    35 TSTPT
    36 RSET
    37 AVDDC
    38 HSDACN
    39 HSDACP
    40 AVDDC
    41 XTAL_IN
    42 XTAL_OUT
    43 DVDD
    44 TRST_N
    45 TMS
    46 TCK
    47 TDI
    48 TDO
    49 MDIO
    50 VDDO
    51 DVDD
    52 MDC
    53 COL
    54 CRS
    55 RX_ER
    56 RX_DV
    57 RX_CLK
    58 VDDOR
    59 RXD[0]
    60 RXD[1]
    61 RXD[2]
    62 RXD[3]
    63 RXD[4]
    64 RXD[5]
    65 RXD[6]
    66 RXD[7]
    67 TX_CLK
    68 VDDOR
    69 RX_EN
    70 TXD[0]
    71 TXD[1]
    72 TXD[2]

    This datasheet of the 1111 is the closest. Both the 1111 and then 1119R have a regular GMII interface. Since GMII is a standard, it should be possible to get this working without.

    Feature Comparison sheet of all components in the same product series. The 1119R is the only one that still supports the original MII interface.

    Some driver code for this Ethernet PHY family.

    More driver code that supports 88E1119R directly and highlights the differences with 88E111.

  • Micron M25P128 Serial Flash with SPI

    128Mbit or 32MByte. 54MHz.

    Marked as 25P28V6G. Which translates to M25P128 with this code translator.

  • SMSC 3300-EKZ USB ULPI to USB PHY Transceiver

    ULPI is parallel replacement for the serial USB protocol that's typically used to provide USB PHY capabilities to chips that don't have built-in USB PHY, such a FPGAs.

    It's still up to the FPGA to implement a full USB host controller. This is contrary to the Pano Logic G1, which has a USB chip that includes both controller and PHY.

  • SMSC USB2514HZH USB 4-Port Hub Controller

    This chip has sensible zero-configuration power-up settings to operate as a 4-port hub. Right now, there don't seem to be any connections between the FPGA and this chip, so it's likely configured in this mode. If so, that's great: it's at least one less chip to get up and running.

  • TI LM339 Quad Differential Comparators

    Marked L339.

More Repositories

1

rt

A Full Hardware Real-Time Ray-Tracer
Verilog
89
star
2

math

SpinalHDL Hardware Math Library
Scala
76
star
3

fake_parallel_printer

Capture traffic on parallel printer port to USB
C++
70
star
4

panologic

PanoLogic Zero Client G1 reverse engineering info
Verilog
69
star
5

kv260_bringup

Temporary repo to gather information about the Kria KV260 board
Python
51
star
6

mr1

MR1 formally verified RISC-V CPU
Scala
50
star
7

cxxrtl_eval

Experiments with Yosys cxxrtl backend
Verilog
46
star
8

gdbwave

GDB server to debug CPU simulation waveform traces
C
40
star
9

cisco-hwic-3g-cdma

Reverse Engineering of the Cisco HWIC-3G-CDMA PCB
Verilog
40
star
10

tomverbeure.github.io

HTML
36
star
11

bscan_tools

Various JTAG boundary scan tools
Python
32
star
12

aha363

Python
25
star
13

color3

Information about eeColor Color3 HDMI FPGA board
Verilog
25
star
14

ecp5_jtag

Use ECP5 JTAG port to interact with user design
Verilog
24
star
15

vexriscv_ocd_blog

Repo that shows how to use the VexRiscv with OpenOCD and semihosting.
Assembly
20
star
16

jtag_uart_example

Mini CPU design with JTAG UART support
Verilog
18
star
17

upduino

Verilog
18
star
18

intel_jtag_uart

A Python module to interact with an Intel JTAG UART
Python
18
star
19

usb_system

SpinalHDL USB system for the ULPI based Arrow DECA board
Assembly
18
star
20

pdm

Assembly
17
star
21

intel_jtag_primitive_blog

How to use the Intel JTAG primitive without using virtual JTAG
Verilog
16
star
22

arrow_deca

LED blink example design for the Arrow DECA FPGA board
Shell
15
star
23

fpga_quick_ram_update

Quickly update a bitstream with new RAM contents
Verilog
14
star
24

cube

Scala
14
star
25

sidechan

Side channel communication test within an FPGA
Verilog
11
star
26

yosys_gatemap

An example that shows how to map a design to a custom cell library.
Verilog
10
star
27

cisco-vwic3-2mft

9
star
28

vga_i2c

VGA I2C GPIO + Atari 2600 Joystick Extender
HTML
8
star
29

spdif_pmod

S/PDIF Output PMOD
Verilog
8
star
30

rv32soc

Verilog
8
star
31

multi_port_mem

Implementing multi-port memories in FPGAs
Scala
6
star
32

uart2jtag_uart

Small project to connect UART pins to JTAG UART
Verilog
6
star
33

jtag_gpios

Tutorial on how to integrate custom JTAG functionality into existing tools
Verilog
6
star
34

dsp_guide

Jupyter Notebook
6
star
35

cpu_skeleton

Basic skeleton for an embedded Vexriscv CPU system.
Scala
5
star
36

usb_pmod

5
star
37

led_matrix

Scala
4
star
38

pixel_purse

2
star
39

galois

Python
2
star
40

bangbangbadge

2
star
41

arrow_deca_pmod_cape

2
star
42

yosys_split_ops

Yosys techmaps to split operations on large vectors into multiple smaller ones.
Verilog
2
star
43

ball

LED bal
G-code
2
star
44

arrow_deca_retro_cape

HTML
2
star
45

ocxo_workout

Python
1
star
46

spectroradiometer

C
1
star
47

max10_devkit_blinky

Tcl
1
star
48

icetap

FPGA Internal waveform capture tool
C
1
star
49

multi_video_streamer

HTML
1
star
50

tek420a

Random information about my Tektronix TDS 420A oscilloscope
Python
1
star
51

yosys_deconstructed

Verilog
1
star
52

yosys_techmap_blog

Example repo for blog post
Verilog
1
star
53

tang_primer_20k

GLSL
1
star
54

gps_interposer

C++
1
star
55

logic_analyzer

Verilog
1
star
56

kicad_personal

Personal library with KiCAD components
1
star
57

hp3478a_calibration

Script to dump HP 3478A calibration data over GPIB
Python
1
star
58

siglent_remote

Experiments to remote access my Siglent oscilloscope
C
1
star
59

formal_explorations

SystemVerilog
1
star
60

siglent_remote_blog

Collection of remote control scripts for Siglent oscilloscope
Python
1
star