Obvious Obscurity

I learned of this do-it-yourself ps/2 keylogger design reading Schneier’s weblog today (and this is even a few days old so you can see how well I keep up with current events).

Now if only I had some keypresses worth logging…

Lately I’ve been doing some reading on Reconfigurable Computing, Electronic Design Automation (EDA), and Electronic System Level (ESL) design.

EDA applications include tools like Xilinx ISE WebPACK which I’ve been using to experiment with the FPGA board that I have. The included synthesis tools, for example, automate the process of turning a Register Transfer Logic (RTL) description in VHDL or Verilog into a high level netlist, and the map/place/route tools keep humans from having to fit and implement the netlist into an FPGA by hand.

ESL tools, on the other hand, are supposed to allow you to take something more like a computer program written for “temporal” processing on a microprocessor (one instruction at a time) and turn it into hardware for “spatial” processing (many components operating at the same time) on something like an FPGA. They’re also supposed to allow you to easily integrate the temporal CPU part of the software with the spatial programmable logic part. In short, they’re supposed to make it easy for programmers to utilize FPGAs and similar reconfigurable hardware without having to be concerned with a whole host of hardware design issues like signal timing.

Apparently a couple of vendors have products now that use programmable logic to augment general purpose processors:

• Cray (XD1)
• SGI (RASC)

(Thanks to the Performance Guru Blog for mentioning these.)

Does this mean that ESL design tools have gotten to the point where high-level languages can be used easily by software engineers to accelerate their applications using programmable logic?

Reconfigurable Computing has usually meant using programmable logic devices like FPGAs, but this os not necessarily the case. A few vendors have appeared which provide reconfigurable processors that use higher level logic elements than the ones used by FPGAs along with a RISC processor core on the same die. Some that I’ve found so far:

• SRC Computers
• IPFlex
• Elixent

(And also note that a number of high-end FPGAs have hard MCU cores built into them as well.)

After all of this poking around, I’m thinking that it would be nice to use one of these ESL or reconfigurable computing development environments to get some sense of how well they isolate developers from hardware implementation.

Unfortunately I’m not finding allot of demo versions of these tools available for download, but I did find that IPFlex has a demo version of their DAPDNA-FW II development tool available for download. I filled out their web form but I’ll have to see if they send me an actual download link :) Though I’m unlikely to buy their processors, using their tools should prove educational.

So I don’t really know where this technology is really at right now, but it seems like the big obstacle is the availability of tools to make what is essentially hardware design simple enough for people who aren’t EEs or who don’t have the time to learn hardware. As for me, I plan to keep learning in any case.

Last weekend and the weekend before that, I finally got around to learning a bit more VHDL and digital design. (I’d probably be a little further ahead now but I spend too much time on the weekend watching tv shows and anime, and not mowing the lawn. And I just spent a couple of weeks in China where I could only read about VHDL.)

The book The Designer’s Guide to VHDL has been helpful, though it concentrates more on how the language works than what you can do with it for synthesis, and contains practically nothing about design digital basics. This is certainly good, and what I wanted when I bought the book, but it’s starting to look like I could use something more synthesis-focused.

Until now I haven’t tried to do anything complex enough for this to become very apparent, but it seems that synthesis technology hasn’t quite gotten to the point where anything you can describe behaviorially (in terms of behavior vs. components plugged into each other) in VHDL can just magically be turned into a netlist by a synthesis tool. I’m not too disappointed though. I’m actually somewhat amazed that I can write a simple for loop and have a synthesis tool figure out that a counter is needed, and how to connect it.

One of the things I wanted to learn was how far I could get without having to really think about digital components. Well, apparently the answer is “not very far” :) Note that I’m using the free Xilinx ISE WebPACK software (which uses ‘xst’) which, while very nice (especially for $0), probably doesn’t contain the most sophisticated synthesis tool available. I don’t really want to shell out 1000s of $ for fancy tools, but it might be interesting to do some reading about them.

Here are the results of my experimentation for anyone who’s interested. The code was designed to work with the S3BOARD (same as the Spartan-3 Starter Kit board) from Digilent.

• blinkylights.vhd and blinkylights.ucf - “LED chaser” demo using the 8 red LEDs on the board. Switch 0 starts/stops the movement effect. Switch 2 changes the direction. Switch 3 selects faster/slower movement speed. (Don’t ask what happened to Switch 1; I don’t remember either.)
• ledcounter.vdh and ledcounter.ucf - four digit hexadecimal counter using the seven segment LED displays. Increments once a second. No controls.

These can easily be added to an ISE project. (I didn’t include the projects since it seems like lots of unnecessary cruft for some very simple examples.)

I’m also accumulating pin assignments for the S3BOARD in the file s3board.ucf. I really don’t like retyping these, so I accumulate them here and copy them into projects as required. Eventually I’ll have a file containing signal name mappings for all of the pins on the Digilent S3BOARD, but I’ve been too lazy to go that far at this point.

I think my next project will probably be something more elaborate using the numeric LED displays like a digital clock, or something that displays the contents of a location in external or internal RAM. After that I might start messing with the serial port, and then I’ll probably see if I can integrate this stuff with a small processor core from opencores. (The difficulty of doing any arbitrary thing in hardware really makes the utility of processor cores obvious if it wasn’t already.)

More links to previously unknown-by-me low-cost FPGA boards. Check my programmable logic page for the complete list.

US$99 Altium Xilinx and Altera Boards

One person has reported to me that Altium’s Xilinx and Altera evaluation boards work with the free vendor tools from Xilinx and Altera via the parallel port. I haven’t really looked into this in great detail and I haven’t used any of their boards. These boards are sold by Altium (not to be confused with Altera) for the purpose of evaluating their not-so-free LiveDesign development software. Note that, even if they do work with the free tools, you’re highly unlikely to get any support from them beyond what is needed to evaluatate their non-free software. If you can confirm whether or not these boards work using only the free tools, please post a comment! At US$99, these look like a great deal especially considering that the boards have either a Altera EP1C12 (12,060 LEs) or a Xilinx XC3S400 (8,064 logic cells.) Oh yea, and they come with a time-limited eval version of LiveDesign in case that is of any interest you.

Xilinx S3E Board

Someone named Alex wrote to me saying that Digilent’s S3E board is supposed to be available some time in the next few weeks, even though Xilinx says its not available until December. See Xilinx’s web site for details on their package. Check Digilent’s web site or contact them to see when they start offering it.

A note about buying Digilent boards from Xilinx vs. Digilent: If you buy from Xilinx you get at least two things that you don’t get from Digilent. One is that their “starter kits” come with an eval version of EDK (their embedded development kit, with their MicroBlaze soft core MCU) and some printed documentation/propaganda. The boards from Digilent don’t.

The other is that Xilinx is more likely to let you return the board without much hassle if you have some sort of problem. From talking to Digilent, it doesn’t sound like they’ll let you return a board for some trivial reason; if you’re board is defective (which they say pretty much never happens) you’ll have to go through some effort to prove that to them. In my case one of the switches on the board seemed to be broken and I called them before finding that the switch’s terminals were just dirty. Their customer support is responsive but they appear to work hard to discourage returns without significant troubleshooting. XESS, on the other hand, has a “no questions asked” 1 month return policy and Xilinx simply “reserves the right” to refuse returns if the board can’t be shown to be defective.

So, if you just want the boards Xilinx sells, it’s probably better to buy the Spartan-3 Starter Kit (or 3E kit) from Xilinx. To get the XC3S400 or XC3S1000 boards, you have to buy directly from Digilent which means no EDK eval (which doesn’t matter much to me right now.)

US$149 Altera Board

Alex also let me know about an Altera board from Terasic for US$149 with “byte blaster2″ USB cable interface built in. The FPGA is a Cyclone EP1C6 series, which has 5,980 logic elements (roughly equivalent to Xilinx logic cells; the Xilinx XC3S200 has 4,320.)

I just got back from USENIX Security in Baltimore, Maryland (USA) where I was without my laptop power supply due to my failure to bring it with me. (More on USENIX Security in general later.) Partly due to my need to conserve power I didn’t post anything here during the conference. But back to the subject.

Avi Rubin’s RFID-cracking project (”Analysis of the Texas Instruments DST RFID”) isn’t exactly news, but it was the first paper presented at the conference and the first time that I realized that the FPGA boards that they used appear to be none other than the XESS Corp. XSA-3S1000 board. (This board is very similar to the one that I wrote about earlier and then returned in favor of the Digilent S3BOARD after a couple of weeks.)

For those who don’t know what I’m talking about, the TI RFID product is the one used in the Exxon Mobile SpeedPass™ and in a number of other applications including vehicle immobilizer systems.

I’m not sure why they didn’t mention the specific model of FPGA board in their paper. I’ll have to ask them that since I didn’t think to do it during the conference.

Anyway, the photos on the RFID Analysis web site don’t clearly show the boards, and I wouldn’t have recognized them back when I looked at the site toward the beginning of the year, but the presentation at USENIX security contained a slide with a much larger photo and mentioned the FPGA model again: the Spartan-3 XC3S1000. These things combined with the price they gave for the board (US$200) narrowed the possible set down to only one that I’m familiar with.

I also publically mentioned at the end of the presentation that the price of an equivalent key cracker has come down now that Digilent is selling an XC3S1000 version of their “Spartan-3 Starter Board” for US$150. The presenter (Steve Bono) responded saying that the XC3S1000s only cost [some single-digit(?) number of US$] and that their cracker could be made even more cheaply if you were willing to design and fabricate your own boards.

I may have misheard and he may have actually mentioned some larger amount, but based on what I see at the Xilinx Online Store it appears that the cheapest XC3S1000s cost more like US$50 (for quantities <= 500 units.) Combine that with the cost of designing your own complex multi-layer boards, having them fabricated in small quantities, etc, and it isn't clear to me that a custom-designed multi-FPGA system would cost any less than $150 per FPGA even if you do have some serious hardware design skills.

One thing I found a bit odd is that they decided to use the PS/2 keyboard for input and the led display for output. From the paper:

In addition to the FPGA, each evaluation board contains switches, LEDs, support chips, and a variety of connectors. We chose to connect a PS/2 keyboard to the FPGAs to provide the inputs (the challenge/response pairs) while the outputs (the key) appeared on the LEDs.

I would have thought it would be easier to just use the parallel port interface for this, especially since XESS supplies code for this purpose. Perhaps it isn’t as easy as I think it is (I haven’t gotten that far yet, and I’ve switched to the Digilent board which uses a JTAG interface instead.)

Anyway, all of this is really cool. This project shows exactly how useful these things can be, even the cheap < $200 ones.

I decided to return my XC3S200 “Spartan-3 Starter Kit” board. To replace it I’m buying another configuration of the same board with an XC3S1000 (5 times the number of logic blocks in the XC3S200.) I already returned one board before this, and I’m paying like US$5 each way. As a result I’m going to end up spending $20 on the shipping for the two boards I sent back. I wish I had had just bought the board with the larger FPGA in the first place :)

I’ve made some progress on learning VHDL, but I still haven’t totally mastered the art of blinkey lights.

The other day I decided that I wanted to evaluate Atmel AVR microcontrollers. You can get the smaller ones for like $2 or something, and I should be able to use the Xilinx JTAG cable that came wih my starter kit with a breadboard to create a simple demo circuit with in-sytem programming.

But the the idea hit me that I might try using this FPGA to implement an AVR core from opencores.org. This wouldn’t allow me to really evaluate the actual AVR products from Atmel, but I could at least play with similar capabilities.

Sure enough I found two available for download. An FPGA makes a rather expensive AVR, but I thought it would be interesting to see what I could do with the 200,000 “marketing gates” on the board that I have.

I downloaded pAVR by Doru Cuturela and tried to build it. It didn’t get past the map stage (comes before place-and-route) because it required about 30% more LUTs than the XC3S200 has and ran into some limitations with the number of slices. Ruslan Lepetenok also emailed me his AVR core, but I haven’t tried to do anything with it yet.

Even though I doubt I’ll be able to write anything myself that will make use of the whole chip any time soon, I may want to play with some of the smaller cores that others have developed, possibly in combination with my own designs. So, I may try to see if Xilinx will let me return this so I can get the XC3S1000 for $50 more. Then again, one person I know says I should just keep this one and buy another.

Oh well, deciscions decisions…. At this point I’d probably recommend that, unless you only have $100 to spend, you get the S3 board with 5 times the logic elements for $50 more.

Funny how I may end up spending double on this what I had originally thought I would. I wonder what we’ll be able to get for $100 or $150 a year from now.

Last night I got back from Black Hat. I thought about posting some reports during the conference, but I was busy listening to talks or talking to people pretty much the entire time.

Luckily I have this weekend to recover.

Here are a few highlights from the conference:

• The Cisco Shellcode talk made a big splash of sorts. You didn’t need to be at the conference to know that though, assuming you’ve been reading the news lately. When I arrived I noticed that the slides for the talk had been cut out of the massively wasteful phone book sized binder of 2-up slides. I did actually make the talk and I’m debating whether I should post a writeup on what I remember.
• Joe Grand’s hardware talk was pretty good. It’s amazing how easy it is to interface with hardware devices via JTAG or I2C and download memory contents. Joe is my hero at the moment because this is exactly the sort of stuff that I’ve been thinking about while studying FPGAs and microcontrollers. Joe’s book on hardware hacking came with the conference materials. I read it on the flight back. [Check out Joe’s slides. It was somewhat of a pain to locate them.]
• The Honeynet Project talk was interesting. Honeypots have become rather sophisticated over the years.
• The Grugq’s talk on filesystem forensics was really interesting. I have to admit that I haven’t thought much about hiding data in filesystems. I guess maybe I don’t have anything worth hiding.

That’s it for now. I’m too worn out to write anymore.

This is the latest in my series of writings about my quest for the ultimate low-cost FPGA experiment board. (See Additional Low-Cost Boards for a few more that I found which I decided against purchasing.) Note that dollar amounts are in US currency, though I believe all of these products can be ordered from and shipped to anywhere.

A while back I mentioned that I bought an XESS XSA-50 FPGA board (www.xess.com) and then, after doing some more digging, I ordered the Xylinx Spartan-3 Starter Kit which includes a Digilent S3BOARD (www.digilentinc.com) with a XC3S200 Spartan-3 FPGA. After doing a little comparison I decided to send the XSA-50 board back to XESS (which, thankfully, I was able to do thanks to their 30 day no-questions-asked return policy.)

S3BOARD Varities

First, some advice on ordering the Starter Kit or S3BOARD should you decide to do so:

• Apparently, for:
  • $20 more you can get the same board from Digilent’s web site with an XC3S400 (”400,000 gate-equivalent”)
  • $50 more you can get a XC3S1000 (”1,000,000 gate-equivalent”).

  For now I don’t care too much since I don’t yet know how to use all of the resources on the XC3S200. (Once I do I may buy a much more expensive board.) But these other configurations are not obvious at all from looking at Digilent’s or Xylinx’s web site. This is sad for Digilent because many people might order a more expensive board if they knew the options.

• If a XC3S200 (the “200,000 gate-equivalent” Spartan-3) is all you need, you may be a little better off to order the Xylinx Spartan-3 Starter Kit from Xilinx’s web site instead of from Digilent’s web site. I’m not entirely sure of this based on the package description on Digilent’s site. You may get the exact same package regardless of where you order it.

S3BOARD Documentation and Support

At first I thought there were no data transfer utilities or SDKs for the S3BOARD (based on what I saw on Xilinx’s web site) but then I found the Windows utilities on Digilent’s site. These include a general-purpose data transfer utilitiy and an SDK for JTAG, USB, and Ethernet. (The later two require additional hardware modules though.)

Some useful links on Digilent’s web site that don’t appear on Xylinx’s site at all:

• Adept Suite and SDK (data transfer software mentioned above.) This has some features that iMPACT doesn’t appear to have, like the ability to write to SRAM and registers on the FPGA itself. The SDK API looks fairly complete, and it looks like it is generic enough to be used from C, C++, and other languages that can load a DLL. Unfortunately I don’t see unix/linux versions of any of this.
• Board-specific application notes. They have a document on using ISE, but it doesn’t seem to contain much in the way of Digilent-specific information.
• VHDL components right now, only a UART for the otherwise UART-less serial port.
• ISE project files but unfortunately, nothing for the S3BOARD right now.
• Pinouts and UCF files but, again, nothing for the S3BOARD yet!
• An education section with some videos, but otherwise empty :(

It’s unfortunate that they don’t at least have a UCF file with all of the pinouts. I’m not looking forward to creating that manually though, once I’ve done it, it will be done. It would be nice for them to set some sort of standard for the signal names though.

And I don’t know why Xilinx doesn’t link to these things on their site.

XESS vs. Digilent Support

I haven’t really had any need for technical support yet, so I don’t have much to say about this. I did ask for help with my order and on returning items from XESS, and I received very quick and helpful responses.

XESS has Digilent beat hands-down when it comes to useful information on using their boards. Their web site has an extensive collection of tutorials and example designs from both XESS and their customers. They also provide UCF files for pinouts in addition to application notes and other stuff. In addition, they provide source code for their utilities and support for Linux.

Hardware Comparison

XESS really looks like a great company, and I hate that fact that I just don’t like their hardware as much as I like Digilent’s. Here are some detailed comparisons.

Price vs. Logic Density

First, note that the Digilent Spartan-3 boards come with a Spartan-3. The similarly-priced XESS boards come with a Spartan-2. The only fair direct comparison is with the XESS XSA-3S1000 (just now becoming available) which costs $200 vs. $150 for Digilent’s XC3S1000 version of the S3BOARD.

XC3S200 from Digilent: ~$100. XC2S200 from XESS: $150 (XSA-200 which actually isn’t available until the end of the month).

Another comparison: XC2S200 from Digilent: $54 (D2SB) , similar from XESS: $150 (XSA-200) Note though that this isn’t a totally fair comparison since the D2SB comes with no switches/displays/etc. You’d probably spend at least another $50-$100 on those, or less $ and more of your time building them, if you bought the D2SB.

One note though: these costs could be different if you own previous XESS hardware as newer boards are backward-compatible with their extension board(s). If this applies then the overall cost for the same functionality could be lower with XESS.

Programming

Digilent: Standard JTAG interface which allows programming of the FPGA and the serial programmable platform flash. This works seamlessly with iMPACT (ISE programming tool) and the included JTAG3 parallel cable. Also, the fpga can boot from flash without any configuration that interferes with JTAG programming. Everything just works with no hassle.

XESS: Centronics parallel interface connected directly to a CPLD that controlls programming. This has some advantages and disadvantages. The CPLD is cool because it’s a CPLD and allows for a more flexible interface. Unfortunately the CPLD has to have a different bitstream loaded depending on whether you want the FPGA to boot from flash, load a bitstream from the parallel port using XESS’s utility, or load a bitstream with iMPACT (JTAG3 cable emulation.) It also has to have a different bitstream loaded in order to read/write from SRAM. In addition, XESS’s data transfer software doesn’t work as well. I had allot of problems with the parallel port (software kept crashing) until I went about 5 steps down their troubleshooting documentation and installed another parallel driver.

Memory

The XSA boards have significantly more memory than the S3BOARD: 8MBytes of SDRAM vs 1MByte of SRAM on the S3BOARD. The flash is also larger on the XSA boards: 2MByte on the XSA-200 (128KByte on the XSA-50) vs 256KByte (2Mbit) on the S3BOARD. The advantage of the flash on the S3BOARD though is that it can be programmed directly via the JTAG chain with iMPACT. And, when it comes to RAM, you can add memory to the S3BOARD if you need to (see accessory modules below.)

I’m not yet experienced enough with these things to know how much memory I’ll really need. At least I know I can add it if I need to.

Input/Output Features

This probably sounds dumb to more experienced people that don’t care, but the switches and LEDs on the Digilent board are very useful to me given my limited experience with this kind of stuff. This way I can play around with simple stuff in VHDL before moving on to more difficult interfaces like the VGA output. I had actually ordered LEDs and switches so I could add some to the XSA board. And, being somewhat of a networking guy, I really like the RS-232 port.

The XESS boards do come with a much nicer 3-bit-per-channel VGA port (512 colors) vs. the S3BOARD’s 1 bit-per-channel (8 colors.) I don’t understand why Digilent didn’t put a better VGA interface on their board. The extra DAC shouldn’t cost that much. I suppose this is something else I can build later. I might want the extra colors if I want to try using something from FPGA Arcade.

External Interfaces and Accessories

The XESS boards have headers on the underside of the board. This is nice because the headers can be inserted easily into standard breadboards.

The Digilent boards, on the other hand, have three 40 pin right-angle sockets. These are somewhat less convenient for breadboarding, though for $20 Digilent sells a breadboard with right-angle headers (which isn’t any more than usual for similar sized breadboards.)

The main thing I like about the Digilent connectors is that they have a variety of small, inexpensive accessory boards (most of them around $50 or less) that can be added individually. In comparison, XESS sells their kitchen-sink (as in “everything but the kitchen sink”) XStend board that connects to the XSA/XSB boards via the underside headers. I don’t like the XStend thing because you basically have to buy everything on the board for $300. In contrast, if you only want to add some individual feature, you can simply buy the one you need for the Digilent. Most of their “Accessory Boards” cost from $15-$80.

Conclusion

I really hate the fact that I don’t like the XESS boards as much as the Digilent board. It’s obvious that XESS has done allot for the hobbyist community with the information on their web site and the low-cost boards that they’ve developed. Unfortunately they seem to be one step behind on the FPGAs they offer, and I’m guessing that they’re a smaller company that can’t compete as well with Digilent’s smaller margins.

A couple of days ago I wrote about some other low-cost FPGA experiment boards that I had discovered since buying an XESS XSA-50 board for the low low price of just under $70 incl shipping. I decided that it might be worth spending a little more money to get a somewhat fancier board featuring an FPGA with four times the gates of the XSA-50, and lots of switches and blinkinlights.

On monday I made the order, and this morning I received my Spartan-3 Starter Kit which I ordered from the Xylinx web site. This kit comes with the Digilent Spartan-3 Board, parallel JTAG programming cable, a 60 day eval version of Xylinx ISE and EDK, some introductory booklets, and CDs full of useful documentation.

Some other cool things I like about this board are:

• It comes with a variety of user interface possibilities built-in:
  • Simple: 5 pushbutton switches, eight single-throw switches, eight LEDs, and 4 seven-segment led digit displays.
  • Moderate: an RS-232 serial port.
  • Advanced: VGA and ps/2 keyboard ports.

  This is good for people like me who want to play with a simple user interface before taking on the RS-232 and finally the VGA and keyboard interfaces.

• Digilent makes some reasonably-priced modules which connect to the 40 pin sockets on the board. This is good if I get to the point where I want to try causing some trouble with an ethernet interface before I’m ready to build one myself.
• It has a standard JTAG programming interface, and comes with a JTAG programming cable that could be used with other JTAG devices.
• It has holes in the corners of the board that I might be able to use to mount this in a cool-looking transparent case like this cool (but much more expensive) BurchEd board.
• It has rubber feet on the bottom!

The only thing that worries me about it so far is that it only has 1MB of static ram on the board. If I one day need more (who knows how likely that is) then I’ll have to buy or build a memory module which can be attached to one of the 40 pin sockets.

Now I’m going to stop writing this so I can actually try to use this board.