CWLITE - Controlling the board FPGA from the SAM3U

Embedded Security
1

Hi All,
trying to work out if it’s possible to control the FPGA from the SAM3U firmware, and any pointers to where i can work out how this is done by the scope.io functionality?

I can see from the schematic that the only two pins on the 20pin target adapter addressable directly from the SAM3U are SAM_PDID and SAM_PDIC, and the reset are addressed through the FPGA.
From what i see, all the external targets only use these 2 pins for their direct communications.

Can’t work out however how the SAM3U firmware can toggle the remaining pins (mainly TIO1-4).
It must be possible there given the scope.io python library lets you remap or toggle these, and the SAM3U would be doing it, but can’t find any specific code in the firmware where the comms from the SAM3U to the FPGA are formatted.
Any pointers would be appreciated as to where i should be looking for this code.
Thanks!

2

If you look a bit deeper you’ll find that almost every scope.* setting eventually ends up in a call to sendMessage([CODE_WRITE | CODE_READ] (...)), which does writes or reads to FPGA internal registers via address and data buses (USB_AD and USB_D on the schematic). This is done via the SAM3U’s SMC interface.

So as far as how the target IO lines are controlled, that’s all handled by the FPGA. For example this is what controls the IO1 line in CW-lite/pro: chipwhisperer/reg_chipwhisperer.v at develop · newaetech/chipwhisperer · GitHub

Jean-Pierre