Beginner's Inquiry: Unexpected FPGA config values when reading

[sadmess]

My device is not EnigmaX1, but its chip is xc7a75t and the storage is mt25ql256. I tried to compile the firmware of EnigmaX1 and flash it in.

After rebooting, the device was recognized by the host (a wireless network card of 0x0666), but some errors occurred when reading with leechcore communication.

The code from leechcore is as follows:

BOOL DeviceFPGA_GetDeviceID_FpgaVersionV4(_In_ PDEVICE_CONTEXT_FPGA ctx)
{
    WORD wbsDeviceId, wMagicPCIe;
    DWORD dwInactivityTimer = 0x000186a0;       // set inactivity timer to 1ms ( 0x0186a0 * 100MHz ) [only later activated on UDP bitstreams]
    if(!DeviceFPGA_ConfigRead(ctx, 0x0008, (PBYTE)&ctx->wFpgaVersionMajor, 1, FPGA_REG_CORE | FPGA_REG_READONLY) || ctx->wFpgaVersionMajor < 4) { return FALSE; }
    DeviceFPGA_ConfigRead(ctx, 0x0009, (PBYTE)&ctx->wFpgaVersionMinor, 1, FPGA_REG_CORE | FPGA_REG_READONLY);
    DeviceFPGA_ConfigRead(ctx, 0x000a, (PBYTE)&ctx->wFpgaID, 1, FPGA_REG_CORE | FPGA_REG_READONLY);
    printf("ctx->wFpgaID %x\n", ctx->wFpgaID);
    DeviceFPGA_ConfigWrite(ctx, 0x0008, (PBYTE)&dwInactivityTimer, 4, FPGA_REG_CORE | FPGA_REG_READWRITE);
    // PCIe
    DeviceFPGA_ConfigRead(ctx, 0x0008, (PBYTE)&wbsDeviceId, 2, FPGA_REG_PCIE | FPGA_REG_READONLY);
    printf("wbsDeviceId %d\n", wbsDeviceId);
}

I added printf, the print result of ctx->wFpgaID is 1, and the expected value should be 9. In addition, I also tried to modify the firmware's source

parameter PARAM_DEVICE_ID = 9, to parameter PARAM_DEVICE_ID = 10, Then the print result of ctx->wFpgaID is 2, and the expected value should be 10.

I also found that the print result of wbsDeviceId is not normal. The device's pci bus is 13 and the device is 0 on my machine, but the print result of wbsDeviceId is 0x500. The expected value should be 0xD00.

From the above experiments, I found that when reading bytes, the binary of 9 is 1001 but it becomes 0001, the binary of 10 is 1010 but it becomes 0010, and the binary of 13 is 1101 but it becomes 0101.

I am a beginner in FPGA and have not read a lot of related materials. If my question is naive, please give me relevant documents to study. Thanks in advance.

EnigmaX1 4.11 firmware

MemProcFS.exe -v -vv -device fpga
DEVICE: FPGA: PCIeScreamer R1 PCIe gen2 x1 [500,0,1000] [v4.11,0500] [ASYNC,NORM]

----- FPGA DEVICE CONFIG REGISTERS: CORE-READ-ONLY     SIZE: 32 BYTES -----
0000    81 ab 00 00 20 00 00 00  04 0b 01 00 00 00 00 00   .... ...........
0010    53 10 f4 b6 01 00 00 00  55 10 f4 b6 01 00 00 00   S.......U.......

----- FPGA DEVICE CONFIG REGISTERS: CORE-READ-WRITE    SIZE: 22 BYTES -----
0000    c5 ef 04 00 16 00 00 00  a0 86 01 00 00 00 00 00   ................
0010    e6 10 07 00 e6 10                                  ......

----- FPGA DEVICE CONFIG REGISTERS: PCIE-READ-ONLY     SIZE: 48 BYTES -----
0000    01 23 00 00 30 00 00 00  05 00 16 08 74 00 00 00   .#..0.......t...
0010    e6 10 66 06 00 00 00 00  30 29 00 00 00 00 c0 00   ..f.....0)......
0020    12 10 00 00 16 7f 00 00  00 00 00 00 00 00 00 00   ..... ..........

----- FPGA DEVICE CONFIG REGISTERS: PCIE-READ-WRITE    SIZE: 80 BYTES -----
0000    45 67 00 f0 50 00 00 00  35 0a 00 01 01 00 00 00   Eg..P...5.......
0010    00 00 00 00 00 f0 40 00  00 00 00 0e 00 00 00 00   ......@.........
0020    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0030    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0040    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................

----- PCIe CORE Dynamic Reconfiguration Port (DRP)  SIZE: 0x100 BYTES -----
0000    00 00 00 01 00 02 00 00  00 00 00 00 00 00 f0 00   ................
0010    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0020    00 00 00 00 00 00 00 00  00 00 00 40 00 00 00 00   ...........@....
0030    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0040    02 a1 00 43 01 00 1f f5  7f f7 09 f7 01 20 01 40   ...C.... .... .@
0050    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0060    00 00 10 60 00 02 40 21  00 40 3d 40 00 23 00 00   ...`..@!.@=@.#..
0070    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0080    00 01 00 00 00 01 00 00  00 01 00 00 00 01 00 00   ................
0090    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00a0    00 00 00 00 00 00 00 00  00 02 00 00 12 34 10 10   .............4..
00b0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00c0    00 20 00 41 ff f7 ff f7  00 e0 00 00 80 00 00 22   . .A..........."
00d0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00e0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00f0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................

----- PCIe CONFIGURATION SPACE (no user set values) SIZE: 0x200 BYTES -----
0000    e6 10 66 06 00 00 10 00  02 00 00 02 10 00 00 00   ..f.............
0010    00 00 50 82 00 00 00 00  00 00 00 00 00 00 00 00   ..P.............
0020    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0030    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0040    01 48 03 78 00 00 00 00  05 60 80 00 00 00 00 00   .H.x.....`......
0050    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0060    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0070    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0080    00 00 00 00 02 00 00 00  00 00 00 00 00 00 00 00   ................
0090    02 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00a0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00b0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00c0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00d0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00e0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00f0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0100    03 00 c1 10 35 0a 00 01  01 00 00 00 00 00 00 00   ....5...........
0110    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0120    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0130    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0140    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0150    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0160    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0170    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0180    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0190    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
01a0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
01b0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
01c0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
01d0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
01e0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
01f0    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................

[sadmess]

Make the following changes and that's it, everything works now

# OLD  ft601_data[19]
set_property PACKAGE_PIN T20  [get_ports ft601_data[19]]
# NEW  ft601_data[19]
#set_property PACKAGE_PIN T18  [get_ports ft601_data[19]]

[ufrisk]

Good to see you managed to resolve the issue.

If I remember correctly this was the change that was made from the prototype enigma version (which should be very rare) to the later enigma version. Nice to see it's working for you :)

But my project does not support the prototype enigma version (and like I mentioned it should be extremely rare) so I'm closing this issue.

Best wishes with your DMA attacks 👍