chmousset / colorlight_reverse

Reverse engineering some colorlight LED receiver cards like the i9+ and i5a-907

Colorlight pinout reverse

This repo contains tools used to reverse engineer the Colorlight I9+ LED receiver card to use it as a general-purpose Artix7 SOM.

The main tool is the PinoutFinder LiteX design. It simply instanciates UART that continuously send the IO name. Then, using a simple serial port, it's possible to probe every interesting peripheral pins to determine on which FPGA IO they are connected.

JTAG boundary scan was also used to guess the pinout, as it was possible to identify patterns in IO signals (level, but also Input or Output types) to identify which pin corresponds to which function.

i9+

https://docs.google.com/spreadsheets/d/1LuqJX827LIg408SDM6qgPPfoHgTK5UOQPo3P7uLQvb8/edit#gid=795288376

i5a 907

Another receiver card closely related to the i5a-75 series. The Ethernet and SDRAM pinouts are identical; only the IO change. This card is slightly more interesting than the i5a-75 as they provide a couple more headers directly connected to the FPGA IOs, a bit more buffered IOs, but it's also easier to swap the buffers as they are on the underside of the PCB.

Manufacturer documentation

https://www.ledcontrollercard.com/media/wysiwyg/ColorLight/i5A-907%20.pdf

Related reverse works

https://github.com/wuxx/Colorlight-FPGA-Projects/blob/master/colorlight_i9_v7.2.md

Components

http://reverse.0cpm.org/grandstream/datasheet/W9816G6CH.pdf https://www.esmt.com.tw/upload/pdf/ESMT/datasheets/M12L16161A(2Q).pdf https://www.esmt.com.tw/upload/pdf/ESMT/datasheets/M12L64322A(2S).pdf

colorlight_reverse's Issues

how to build pinout_finder.py

hello, can you share the build step of the i9_plus/pinout_finder.py , I'm not very familiar with litex...
I try it on my ubuntu 20.04 with litex env (the latest), but it report an error, here is the detail log

ubuntu@ubuntu-virtual-machine:~/oss/colorlight_reverse/i9_plus$ python3 pinout_finder.py
INFO:S7PLL:Creating S7PLL, speedgrade -1.
INFO:S7PLL:Registering Single Ended ClkIn of 25.00MHz.
INFO:S7PLL:Creating ClkOut0 sys of 60.00MHz (+-10000.00ppm).
INFO:SoC:        __   _ __      _  __
INFO:SoC:       / /  (_) /____ | |/_/
INFO:SoC:      / /__/ / __/ -_)>  <
INFO:SoC:     /____/_/\__/\__/_/|_|
INFO:SoC:  Build your hardware, easily!
INFO:SoC:--------------------------------------------------------------------------------
INFO:SoC:Creating SoC... (2023-05-04 21:03:20)
INFO:SoC:--------------------------------------------------------------------------------
INFO:SoC:FPGA device : xc7a50tfgg484-1.
INFO:SoC:System clock: 60.000MHz.
INFO:SoCBusHandler:Creating Bus Handler...
INFO:SoCBusHandler:32-bit wishbone Bus, 4.0GiB Address Space.
INFO:SoCBusHandler:Adding reserved Bus Regions...
INFO:SoCBusHandler:Bus Handler created.
INFO:SoCCSRHandler:Creating CSR Handler...
INFO:SoCCSRHandler:32-bit CSR Bus, 32-bit Aligned, 16.0KiB Address Space, 2048B Paging, big Ordering (Up to 32 Locations).
INFO:SoCCSRHandler:Adding reserved CSRs...
INFO:SoCCSRHandler:CSR Handler created.
INFO:SoCIRQHandler:Creating IRQ Handler...
INFO:SoCIRQHandler:IRQ Handler (up to 32 Locations).
INFO:SoCIRQHandler:Adding reserved IRQs...
INFO:SoCIRQHandler:IRQ Handler created.
INFO:SoC:--------------------------------------------------------------------------------
INFO:SoC:Initial SoC:
INFO:SoC:--------------------------------------------------------------------------------
INFO:SoC:32-bit wishbone Bus, 4.0GiB Address Space.
INFO:SoC:32-bit CSR Bus, 32-bit Aligned, 16.0KiB Address Space, 2048B Paging, big Ordering (Up to 32 Locations).
INFO:SoC:IRQ Handler (up to 32 Locations).
INFO:SoC:--------------------------------------------------------------------------------
INFO:SoC:Controller ctrl added.
INFO:SoC:CPU vexriscv added.
INFO:SoC:CPU vexriscv adding IO Region 0 at 0x80000000 (Size: 0x80000000).
INFO:SoCBusHandler:io0 Region added at Origin: 0x80000000, Size: 0x80000000, Mode: RW, Cached: False Linker: False.
INFO:SoC:CPU vexriscv overriding sram mapping from 0x01000000 to 0x10000000.
INFO:SoC:CPU vexriscv setting reset address to 0x00000000.
INFO:SoC:CPU vexriscv adding Bus Master(s).
INFO:SoCBusHandler:cpu_bus0 added as Bus Master.
INFO:SoCBusHandler:cpu_bus1 added as Bus Master.
INFO:SoC:CPU vexriscv adding Interrupt(s).
INFO:SoC:CPU vexriscv adding SoC components.
INFO:SoCBusHandler:rom Region added at Origin: 0x00000000, Size: 0x00020000, Mode: RX, Cached: True Linker: False.
INFO:SoCBusHandler:rom added as Bus Slave.
INFO:SoC:RAM rom added Origin: 0x00000000, Size: 0x00020000, Mode: RX, Cached: True Linker: False.
INFO:SoCBusHandler:sram Region added at Origin: 0x10000000, Size: 0x00002000, Mode: RWX, Cached: True Linker: False.
INFO:SoCBusHandler:sram added as Bus Slave.
INFO:SoC:RAM sram added Origin: 0x10000000, Size: 0x00002000, Mode: RWX, Cached: True Linker: False.
ERROR:SoC:serial UART not supported/found on board, supported are:
- crossover
- crossover+uartbone
- jtag_uart
- sim
- stub
- stream
- uartbone
- usb_acm
- serial(x).