Hacking The confusion needs to be cleared on FPGA updates and clones

[Xzi]

No one "official" confirmed that. Everyone says that they can't be updated but there are also persons saying the opposite.

Unless they're reading a datasheet for a refrigerator, those "persons saying the opposite" are wrong.

 

[kyogre123]

No one "official" confirmed that. Everyone says that they can't be updated but there are also persons saying the opposite.

The people saying the opposite are putting the DSTWO as an example, but for sure that flashcard doesn't use the same FPGA than GW and R4, or maybe I'm wrong

 

[Technicmaster0]

Unless they're reading a datasheet for a refrigerator, those "persons saying the opposite" are wrong.

Has anyone tested whether you can access the lines at the bottom side of the card with the top pins? There have been so many "It's not possible!" in the past in the 3DS scene (and past means some months) which were proven wrong. R4i has experience with flashcards and I don't think that they would make souch a stupid mistake.

The people saying the opposite are putting the DSTWO as an example, but for sure that flashcard doesn't use the same FPGA than GW and R4, or maybe I'm wrong

Nope, they havn't used the DSTWO as an example but they have relatively direct contact to the factory.

 

[kyogre123]

I found the quote:

Pins you are referring to (JTAG) most likely used during production for easy programming. There's no possible way 3DS can JTAG program any device, you need special programmer for that. Gateway doesn't have traced JTAG pins at all. Updating may be done by FPGA itself: it loads bootloader first, bootloader first looks for updates on sd card and if finds reprogram flash memory, and if there's no updates it loads firmware normally. DSTWO works this way, it only needs power from cartridge slot and all updating done by fpga itself (same proasic3, btw), you just need to insert card and wait few mins.

But to be honest, I have no idea.

 

[Technicmaster0]

But to be honest, I have no idea.

At least my chinese "contact" said that GW can't be updated, too. It's quiet obvious that the contacts on the bottom of the cards are used during the production because they would be a waste of money otherwise.

 

[Ratman9977]

FPGAs don't store any of the look up table programming information. They're loaded at power-on from a ROM, such as an SPI rom. JTAG programming is typically done during the prototyping stage of development, not for in the field upgrades.

I'd imagine the clones and gateway will just update the ROM on the flash cart that loads the FPGA configuration into the FPGA.

EDIT: Upon more investigation of this particular FPGA, it differs from Xilinx, Altera products I've seen where it does indeed have a non-volatile rom contained within it to store the programmed design.

There doesn't appear to be any way to program this FPGA without JTAG, but you'd need a JTAG tool to do that, which the Nintendo 3ds isn't. I don't see how you can update the FPGA without an external tool.

 

[Xzi]

Has anyone tested whether you can access the lines at the bottom side of the card with the top pins? There have been so many "It's not possible!" in the past in the 3DS scene (and past means some months) which were proven wrong. R4i has experience with flashcards and I don't think that they would make souch a stupid mistake.

You're kidding, right?

I mean, firstly, this isn't the same R4 team as it was in the DS era. It's just a generic bunch of novice programmers/engineers. They copied the hardware of the Gateway where it would cost the least, and skimmed where they could. Then they removed one or two checks from each of Gateway's firmware releases in order to do the bare minimum to get them running on their hardware.

Then a bunch of other teams copied R4's copy. And here we are.

 

[Technicmaster0]

I mean, firstly, this isn't the same R4 team as it was in the DS era. It's just a generic bunch of novice programmers/engineers. They copied the hardware of the Gateway where it would cost the least, and skimmed where they could. Then they removed one or two checks from each of Gateway's firmware releases in order to do the bare minimum to get them running on their hardware.

R4ids.cn is still R4ids.cn. They're the same team. It's not like they sold the company.
GW is an unknown team coming from nowhere. Everyone trusts them although they only released 4 Firmwares so far and moved one release from month to month (2.0). It appears a bit like DS-X (just sayin').

 

[Xzi]

R4ids.cn is still R4ids.cn. They're the same team. It's not like they sold the company.
GW is an unknown team coming from nowhere. Everyone trusts them although they only released 4 Firmwares so far and moved one release from month to month (2.0). It appears a bit like DS-X (just sayin').

No, they didn't sell the company. Nobody needs to buy anything to use the R4 name. They just do it. It's China after all. What copyright haven't they infringed upon?

The reason people trust Gateway (debatable after the bricking incidents) is that they created their own hardware and firmware. Nobody else is doing that right now (save MT, partly).

 

[Foxi4]

FPGAs don't store any of the look up table programming information. They're loaded at power-on from a ROM, such as an SPI rom. JTAG programming is typically done during the prototyping stage of development, not for in the field upgrades.

I'd imagine the clones and gateway will just update the ROM on the flash cart that loads the FPGA configuration into the FPGA.

EDIT: Upon more investigation of this particular FPGA, it differs from Xilinx, Altera products I've seen where it does indeed have a non-volatile rom contained within it to store the programmed design.

Indeed, just QFT. FPGA's are called FPGA's for a reason - they're programmable arrays and their programming can be changed whenever the manufacturer deems it fit to do so. There's no reason for the designers to restrict themselves in this regard and I'm sure that it was accounted for.

As for the "upgradability" of the whole set, the Gateway team and the R4i Gold Deluxe teams use an ACTEL ProASIC 3 on their carts - I don't see why one would be upgradable and the other one wouldn't unless the team behind the R4i is a bunch of morons or wants to sell a whole lot of different R4's in the future that'll be exactly the same but "now with new features!".

Gateway's PCB
R4i Gold Deluxe

In fact, knowing Chinese manufacturing standards, it's not a far-fetched idea to assume that those products could even be assembled by the exact same manufacturer, as it was often the case with flashcarts in the past.

EDIT: 3DSLink appears to have the same guts as well.

3DSLink PCB

 

[redkeyboard]

How about this. Wait until Gateway ever comes up with their update. Then see if R4i copies them. That's the only way to "confirm" anything. Otherwise take anything someone says (especially on this forum) with a grain of salt.

 

[Ratman9977]

It's quite possible they're all using an ARM soft-core on the FPGA and they'll update the actual program rom from which the soft core's code executes, rather than the actual FPGA's design itself.

Typically in a hardware software co-design, timing sensitive requirements are implemented by digital logic coded into the FPGA, whereas non-timing sensitive functions would be implemented in software, using a softcore processor to accomplish this task.

This is my best guess as to how the FPGA is used here, based on my knowledge as an embedded systems developer.

 

[TheCruel]

I mean, firstly, this isn't the same R4 team as it was in the DS era. It's just a generic bunch of novice programmers/engineers.

Source?

 

[Xzi]

Source?

Old R4 team did their own work on occasion, this one doesn't. So my source is common sense.

 

[redkeyboard]

They don't do their own work? What about their r4i gold 3ds carts which is the only 3DS DS cart that gets updated (besides the DSTWO)

 

[spinner09]

Here it is: http://gbatemp.net/threads/gw-multirom-demo.360958/page-22#post-4896409

But from that same thread, someone said the clone's JTAG pins are located on the back: http://gbatemp.net/threads/gw-multirom-demo.360958/page-21#post-4896392

 

[Xzi]

But from that same thread, someone said the clone's JTAG pins are located on the back: http://gbatemp.net/threads/gw-multirom-demo.360958/page-21#post-4896392

Right, they are located on the back. As in, not connected to where they need to be.

 

[spinner09]

Right, they are located on the back. As in, not connected to where they need to be.

But it says right there they are connected to the SLOT1 pins, which in theory could be used to update them.
"It seems likely that it's been designed with updating/reprogramming in mind.". Are you saying he's wrong?

 

[Xzi]

But it says right there they are connected to the SLOT1 pins, which in theory could be used to update them.
"It seems likely that it's been designed with updating/reprogramming in mind.". Are you saying he's wrong?

I'm saying that even if they are connected (and he doesn't confirm that), they're connected in a manner that differs from Gateway's hardware. Which means that any code used to reprogram their FPGA would need a lot of editing by the R4i team in order to function properly. They have yet to prove that they can do even half as much work as that would require.

TBH if you don't think they'll take this opportunity to make things easier on themselves and make more money at the same time, you're deluding yourself. They'll simply change names and start producing 1:1 hardware clones of the Gateway. Assuming this update does in fact require changes to the FPGA logic, anyway. And why not? New users will assume it's a completely different team selling carts that do the same thing as the Gateway at half the price, and old clone customers will end up paying R4i the same $80 people pay for the Gateway. That's a win-win for them. Can't expect any honor from any of these teams.

Then again, we're all just assuming that Gateway is going to use only the FPGA update as a means to protect their new firmware. 2.0 is pretty groundbreaking for the 3DS scene and it includes a few of the most-wanted features in a flash cart for almost everybody. The safe bet is that they're going to keep some sort of bricking code or crash code to avoid cloning, and simply add a few more layers of checks/security for Gateway users.

 

[JonnyMohawk]

So, can any techno person put these rumors to bed and clear up the confusion; Does GW's 2.0 FW really require an update, or are they only doing it to freeze out clones? Are the clones unable to update their FPGA? If so, isn't there any hardware hack/trick to update it? (I remember reading a while back about an old r4 card that could be updated by cutting or soldering a certain pin). Can't you get multirom working without an FPGA update?

JSON took a lot of time to explain why the clones can't update FGPA, the thread is here:
http://gbatemp.net/threads/3ds-flashcart-clones´s-firmwares.359405/#post-4870962