Many of us think of FPGAs as some new cutting edge technology, but the fact of the matter is that they’ve been around for quite some time. They’ve just traditionally been used in hardware that’s too expensive for us lowly hackers. A case in point is the Cisco HWIC-3G-CDMA WAN card. A decade ago these would have been part of a router valued in the tens of thousands of dollars, but today they can be had for less than $10 USD on eBay. At that price, [Tom Verbeure] thought it would be worth finding out if they could be repurposed as generic FPGA experimentation devices.
So as not to keep you in suspense, the short answer is a resounding yes. In the end, all [Tom] had to do was figure out what voltages the HWIC-3G-CDMA was expecting on the edge connector, and solder a 2×5 connector onto the helpfully labeled JTAG header. Once powered up and connected to the computer, Intel’s Quartus Programmer software immediately picked up the board’s Cyclone II EP2C35F484C8 chip. The blinking LEDs seen in the video after the break serve as proof that these bargain bin gadgets are ripe for hacking.
Unfortunately, there’s a catch. After studying the rest of the components on the board, [Tom] eventually came to the conclusion that the HWIC-3G-CDMA has no means of actually storing the FPGA’s bitstream. Presumably it was provided by the router itself during startup. If you just want to keep the board tethered to your computer for experimenting, that’s not really a big deal. But if you want to use it in some kind of project, you’ll need to include a microcontroller capable of pushing the roughly 1 MB bitstream into the FPGA to kick things off.
It might not be as easy to get up and running as the 2019 Hackaday Superconference badge, but it’s certainly a lot easier to get your hands on.
Looking at the size of the fpga I thing resoldering it to a custom board would be a nice challenge and would get me ankle deep in diagram printouts to get my head around things
Dead bug it, there’s only 484 pads to tag a hair thin wire to, bust it out to 5 16Bit ISA sockets or something.
Oh wow, someone actually does a breakout PCB for them, (for $$$) http://www.proto-advantage.com/store/product_info.php?products_id=4000006
That’s still cheaper than just the chip.
EP2C5 mini-boards are also WAY cheaper than just buying the chip on its own. The EP2C5s have only got 4,608 LEs, but you can still do a heck of a lot in that. The board also has regulators, crystal oscillator, flash, and IDC headers. They’re great fun.
Isa sockets can be sourced from electronic scrap
Removing and re-solding a BGA would certainly be a challenge!
I think I would just go out and buy a new one, and not have to deal with the high likelyhood of thermal-cycle induced failures.
The takeaway is: Cisco routers overpriced.
Doesn’t the Cyclone II support an external EEPROM as config storage, and it inhales it at power-on?
I think this is the chip, Arrow only has 4 million of ’em in stock: https://www.arrow.com/en/products/epcs4si8n/intel
Only 2.3 Million now, order fast LOL
Down to 16 pieces as of this timestamp, they just trolling us to get us to order, or is there a sudden killer app???
Arrow quantity remaining indicator doesn’t really work, it is mostly random. Unless it hits zero for at least a few days, then it usually is really out of stock.
It does in active serial mode. But Cyclone II FPGAs also support passive serial mode where an external host writes the bitstream to the FPGA. In Altera reference designs, this is usually a MAX-II CPLD, but in this case, the router that the plug-in card configures the FPGA after it has been confirmed that it’s an authentic Cisco part.
Agreed. I was thinking of a MaxII device that is flash based. They have surprisingly large ones that can replace an fpga. I transitioned a Spartan3 to a MaxII at Hypercom for one of our POSale terminals.
For sure, I just wanted to add a similar comment. I think every FPGA supports this since the 1990ies and fortunately in the meantime you are not restricted anymore to OTP devices.
Ebay prices rising in 8.7.6…..
They’re available in pretty large quantities by many vendors and they’re also not as turn-key as my favorite FPGA platform, the Pano Logic G1, so prices will stay flat.
They’re excellent for embedded projects that requires a relatively large FPGA and a bunch of GPIOs (something the Pano lacks.)
I did something similar with one PABX board.
https://hackaday.io/project/33754-diy-fpga-dev-board
Nice work!
Looks like you were able to rewire the bootup configuration pins of the FPGA from passive serial to active serial mode.
Also did this with an old DSL modem (NTBBA) from Telekom Germany, which included a Xilinx Spartan XC2S50.
Now FPGAs are relatively cheap, powerful and require few external components, so I wouldn’t do this any more.
So it has to be programmed at powerup, every time? Is there a way to connect up a keyboard and a display, and other input devices?
I’m still waiting for someone to hack one of the ‘tents’ McDonald’s uses with their kiosk systems. How crazy that a computer with more power, RAM and storage than most 1980’s computers is used for the mundane task of guiding McDonald’s employees to tables.
Every $3,– ESP32 has more power than 80s home computers.
But as for your question: FPGA can do almost anything, but they are programmed in Verilog – which you might wanna check out before ordering the board ;-) Basically it’s just a ton of logic gates you have to shape into the kind of logic you desire.
And ye, they traditionally receive their configuration at boot up either from a host, a flash IC or any other means – newer ones have that internally.
Guys it’s jolly easy to reprogram this hardware. Just try to find the eeprom with full version of Quartus, generate elf file and download that in eeprom. If you have further questions write me an email on Tahirsengine@gmail.com. If am a professional fpga programmer.
It’d be jolly easy to reprogram the EEPROM… if there were an EEPROM to program. :-)
The FPGA’s MSEL pins are hard wired to Passive Serial mode, which requires an external agent (CPLD, microcontroller, CPU, …) to configure the FPGA.
Quartus doesn’t create .ELF files for bitstream configuration, but a .SOF, a .POF file, a .RAW file, a .SVF file etc. You don’t need the full version for that, the Web Edition works just fine.
SOF and POF files are temporary programing files. Elf files programs ROM permanently.
You can use any format you want, as long as your programming flow supports the necessary conversion.
POF files are a container format, like ELF. It’s one is the standard ways used by Quartus Programmer to program parallel flash with multiple assets. There’s nothing temporary about it. It’s used heavily in a production environment.
Quartus “Convert Programming Files” doesn’t support ELF files, but if your flow uses objcopy or some other conversion tool to create the ELF file, that’s fine, if not a bit unusual. I assume that whoever set up your programming flow used it because your setup mixes bitstream and compiled C/Rust/… code in the same flash image.
In the end, programming is just a minor part of the whole thing. The important detail for this board is thatit doesn’t have flash, so there’s nothing to permanently program to begin with.
Thanks for detailed answer. Yes we program NIOS and Cyclone at a time with single jic file, not elf file. But it was past, nowadays an ASIC project is hot :)
And the traces are not accessible anywhere?
So far I haven’t found them. The PCB is almost certainly 6+ layers.
FYI: I identified the pull-up resistor on MSEL[0]. After removing it (and removing the active gate on DCLK), the FPGA works in active serial mode.
Then it was “just” a matter of soldering a serial flash onto the board and it all worked.
https://twitter.com/tom_verbeure/status/1199573615366172673?s=21
Maybe not what you’re looking for, but…
https://hackaday.com/2018/08/22/fcc-filing-reveals-tasty-hardware-mcsecrets/
What a great article, i’m a network engineer and have sent truckloads of old kit like this for recycling. I’ll be keeping a closer eye out in future! I did rescue a whole load of Adva optical CPE’s which have a nice SBC inside on a daughter board running Linux – some on board flash, SODIMM, CF card with OS, Spartan-II and Freescale MPC866. They are literally worth nothing on eBay and often discarded.