PROJECT CYAN

01 / THE MACHINE

Running on FPGA

Cold boot. IP20 PROM. SD-backed SCSI. Read/write EFS. Multiuser IRIX 5.3. Native Xsgi. Native LG1 output.

Native LG1 output. A live 1024×768 framebuffer: Twilight, Buttonfly, Electro-Paint, Icon Catalog, winterm, and `hinv`. Pixels pass through REX, RB, VRAM, XMAP/DAC, frame publication, and HDMI.

Electro-Paint. Stock IRIS GL: indexed color, double buffering, palette changes, fullscreen presentation.

Twilight. Managed private colormap, gradient, stars, desktop clients, and 4Dwm furniture.

PHYSICAL HARDWARE VIDEO

The board in motion

WATCH VIDEO ↗

02 / PURPOSE

Reproduce IP20

Original PROM, IDE, IRIX, drivers, and applications define the system boundary. Printed inventory and isolated device tests do not.

CPU, caches, DMA, interrupts, graphics, storage, and Ethernet must remain correct together.

Preserve the failure. Find the first wrong boundary. Fix production RTL. Regress the machine.

Clean sheet

CPU, cache hierarchy, chipset, graphics, peripherals, and board integration. Manuals, binaries, and original-hardware captures constrain the implementation.

One RTL

Focused tests, full-system simulation, and FPGA builds use the same synthesizable modules.

Test contention

Fills, writebacks, DMA snoops, posted I/O, interrupts, graphics, storage, and Ethernet overlap.

03 / uhfR4K

uhfR4K

A clean-sheet 64-bit MIPS III processor for IP20. It executes the original PROM, standalone environment, IRIX kernel, Xsgi, and applications.

IF_→IS→RF→EX→DF→DS→TC→_WB

INTEGER PIPELINE

Eight stages

64-bit integer execution, forwarding, interlocks, architectural delay slots, precise exceptions, LL/SC, unaligned accesses, traps, and multi-cycle multiply/divide.

SYSTEM CONTROL

CP0 and 48-entry TLB

Mapped and unmapped segments, ASIDs, variable page masks, wired/random replacement, probe/read/write operations, Count/Compare, watch registers, and exact exception state.

FLOATING POINT

MIPS III CP1

Thirty-two 64-bit registers, single and double arithmetic, conversions, comparisons, control/status, rounding modes, flags, traps, and precise FPU exceptions. Every original IP20 IDE floating-point diagnostic passes on hardware.

PRIMARY CACHES

8 KiB I + 8 KiB D

Direct-mapped 32-byte lines, write-back data cache, fill and writeback sequencing, indexed and hit CACHE operations, aliases, and inclusion back-invalidations.

SECONDARY CACHE

1 MiB

8,192 direct-mapped 128-byte lines in FPGA block RAM, dirty replacement, inclusion, tag operations, DMA intervention, write snoops, and uncached-access ordering.

ARCHITECTURAL ORACLE

Retirement trace

Committed PC, registers, memory, HI/LO, and exception state are checked against independent architecture and floating-point vectors.

04 / IP20 SYSTEM

IP20

Original address maps, arbitration, DMA, interrupts, timing, and failure behavior.

MC

Memory and GIO control

CPU requests, posted GIO operations, main-memory access, graphics DMA, cache-coherent device DMA, programmable arbitration, interrupt delivery, and the DDR4 boundary.

HPC1.5 + INT2

I/O and interrupts

WD33C93A SCSI, SEEQ 80C03 Ethernet, DSP host access, dual Z85130-compatible SCCs, 8254 timers, 93CS56 EEPROM, DP8572A-compatible RTC, and the interrupt masks and acknowledgement order used by IRIX.

LG1

REX + VC1 + XMAP + Bt479

REX command and raster state, VRAM, VC1 timing/SRAM/cursor, XMAP DID/CID lookup, Bt479 palette/DAC, and native scanout.

STORAGE

WD33C93A SCSI to SD

A synthesizable SCSI target performs command, status, data, and DMA phases against 512-byte SD sectors. The local EFS root is mounted read/write by unmodified IRIX.

NETWORK

SEEQ 80C03 plus management

The guest controller carries ordinary IRIX traffic. A separate raw-Ethernet management endpoint supplies observation and physical keyboard/mouse input without patching guest memory.

MOTOROLA DSP56001

20 MHz audio coprocessor

ALU, AGU, P/X/Y memories, decode, host interface, interrupts, DMA, REP and DO loops, and stock firmware execution are present in current source. Physical DSP diagnostics and the SSI-to-HDMI audio path remain open.

05 / METHOD

Find the first wrong boundary

Fail before. Repair. Pass after. Regress. Prove the exact artifact on hardware.

PRESERVE_→REPRODUCE→DISCRIMINATE→REPAIR→REGRESS→_PROVE ON HARDWARE

INDEPENDENT ORACLE STACK

MIPS ARCHITECTURE

IDE + CHERI/BERI vectors

All original IP20 architecture diagnostics pass on hardware. Adapted vectors cover integer execution, 64-bit operations, branches, CP0, the 48-entry TLB, exceptions, LL/SC, caches, and FPU integration: 483 pass, zero fail.

FLOATING POINT

IDE + SoftFloat/TestFloat

All original IDE FPU diagnostics pass on hardware. SoftFloat/TestFloat uses the R4000 legacy NaN convention. All 92 applicable operation/rounding groups pass; 36 inapplicable groups are declared skips.

STOCK SOFTWARE

PROM, IDE, IRIX

The original binaries, drivers, applications, and disassembly supply machine-specific tests. Every original IP20 IDE diagnostic passes except DSP and parity/ECC enforcement.

ORIGINAL SILICON

Indigo captures

Framebuffer captures, transactions, registers, and workloads settle uncertain semantics. Specifications and original hardware outrank independent emulators.

GRAPHICS

REX to HDMI

Accepted REX/XMAP/DAC traffic is correlated with RB/VRAM, scanout, indexed-color resolution, DDR publication, fetch, and HDMI. Pixel-exact oracles cover primitives, textport, login, palettes, and application lifecycles.

CONCURRENCY

Ownership and order

CPU, cache, HPC, LG1, management, and DDR run with delayed responses and competing grants. Each accepted transaction retires once to its issuer.

FAIL-BEFORE

Production RTL

Reduce the physical symptom to the smallest production-path test. It must fail before the change and pass after it. Expected results remain independent.

NEGATIVE CONTROLS

Discard bad fixes

A proposed S-cache stage met 10 ns timing but broke tag-first snoops. The patch and its premise were discarded.

Original IP20 IDE on the board. NVRAM, clock, HPC1, UTLB, TLB, floating-point, and `icache2` pass. DSP and parity/ECC enforcement remain open.

Bind every result

Tests bind to source and fixtures. Timing binds to a route. Hardware results bind to bitstream hashes and workloads.

Unidentified results are discarded.

06 / R4X00 COMPATIBILITY

R4X00 compatibility

Subject: Re: R4X00 compatibility

A pre-existing MIPS core with a new PRId and a mustache can boot surprisingly far.

PRId does not add R4000 CP0, a 48-entry TLB, 64-bit exception rules, primary and secondary `CACHE` operations, a 1 MiB inclusive S-cache, or DMA intervention. uhfR4K implements them.

The mustache may be excellent. `icache2` remains unmoved.

07 / CI, IMPLEMENTATION, DELIVERY

Release discipline

An exact clean commit is tested on Eclipse, implemented on Watson, collected with its reports and hashes, then accepted or rejected on the board.

SOURCE POLICY_→FOCUSED FAIL / PASS→CPU CI→PORTABLE SoC GATE→CLEAN COMMIT→XSIM / OOC / CDC→FRESH FULL ROUTE→HASHED RELEASE→_BOARD ACCEPT / REJECT

DEVELOPMENT HOST / ECLIPSE

Source and simulation

Canonical Git, policy checks, CPU CI, production-RTL tests, full-system simulation, oracles, fixtures, and host tools.

_exact clean commit_IMPLEMENTATION HOST / WATSON

Vivado and KCU105

An exact detached commit enters XSIM/XPM, memory-shape, OOC timing, CDC, synthesis, route, DRC, and bus-skew gates.

_immutable release_COLLECTED ARTIFACT

Hash, program, accept

Source, constraints, reports, bitstream, probes, and hashes are collected before programming. Board results attach to that release.

Only clean commits enter implementation. Only collected, hashed releases reach the board. Hardware accepts or rejects the exact release.

08 / PHYSICAL IMPLEMENTATION

Routed utilization

Exact KCU105 alpha `883c641`, including DDR4 calibration/debug, capture, trace, management, BIST, and probes.

| Resource | Used | KU040 available | Utilization | | --------------------------- | ------- | --------------- | ----------- | | CLB LUTs | 139,234 | 242,400 | 57.44% | | CLB registers | 115,211 | 484,800 | 23.76% | | Occupied CLBs | 26,968 | 30,300 | 89.00% | | 36 Kb-equivalent BRAM tiles | 512.5 | 600 | 85.42% | | DSP48E2 | 19 | 1,920 | 0.99% | | Bonded I/O | 167 | 520 | 32.12% |

BRAM allocation

1 MiB S-cache 256 RAMB36

512 KiB dual-read PROM ≈128 RAMB36

LG1 configuration trace 43 RAMB36

All remaining memories and FIFOs ≈85.5 tiles

512.5 tiles

The 1 MiB S-cache and current on-chip PROM consume three quarters. Cache stays. PROM moves out of fabric.

The 16K×96 LG1 trace uses 43 RAMB36. Capture, BIST, telemetry, probes, and DDR calibration/debug are development infrastructure.

FINAL COST-REDUCED TARGET

AMD Artix-7 XC7A25T

23,360 logic cells · 3,650 slices · 45 × 36 Kb BRAM · 80 DSP48E1

Cost reduction removes KCU105 DDR4 debug, HDMI capture, telemetry, recorders, BIST, probes, and fabric PROM. Structures may be serialized where IP20-visible order and timing permit.

uhfR4K, caches, MC/HPC behavior, LG1 semantics, and the stock-software boundary remain.

Device capacity: AMD DS180, 7 Series FPGAs Overview.

09 / CANONICAL RTL

66 files. 53,483 lines.

Current synthesizable KCU105 product manifest.

EXPAND ALL COLLAPSE ALL

rtl/66 files · 53,483 lines · 2.2 MiB

common/shared inferred memory · 2 files · 108 lines · 3 KiB

• `cyan_simple_dual_port_ram.v`79 lines · dual-port memory
• `cyan_sync_byte_ram.v`29 · byte-write memory
cpu/uhfR4K · 9 files · 16,371 lines · 721 KiB
• `r4000_core.v`4,099 lines · pipeline, CP0, retirement
• `r4000_fpu.v`4,622 · CP1
• `r4000_scache.v`3,042 · 1 MiB secondary cache
• `r4000_dcache.v`1,521 · primary D-cache
• `r4000_icache.v`1,154 · primary I-cache
• `r4000_top.v`654 · cache/CPU composition
• `r4000_tlb.v`612 · 48-entry TLB
• `r4000_muldiv.v`555 · integer multiply/divide
• `r4000_alu.v`112 · integer ALU
soc/MC and storage · 5 files · 3,963 lines · 158 KiB
• `mc.v`1,764 · IP20 memory/GIO controller
• `sd_spi_block.v`902 · SD block transport
• `scsi_raw_disk_target.v`642 · SCSI target
• `sd_scsi_bridge.v`602 · command/data bridge
• `ip20_misc.v`53 · board identification
hpc1/HPC1.5 and INT2 · 8 files · 7,115 lines · 315 KiB
• `scc_z8530.v`1,888 · dual Z8530/Z85130 SCCs
• `hpc1.v`1,782 · top-level HPC1.5
• `hpc1_enet.v`1,325 · SEEQ 80C03 Ethernet
• `wd33c93.v`809 · WD33C93A SCSI controller
• `hpc1_scsi_dma.v`471 · SCSI DMA
• `eeprom_93cs56.v`318 · 93CS56 EEPROM
• `hpc1_dma_arbiter.v`278 · channel arbitration
• `int2.v`244 · interrupt controller
dsp/Motorola DSP56001 · 10 files · 5,238 lines · 225 KiB
• `dsp56001_core.v`1,917 · execution/control
• `dsp56001_decode.v`974 · instruction decode
• `dsp56001_alu.v`542 · 56K arithmetic
• `dsp56001_top.v`514 · subsystem composition
• `dsp56001_mem.v`334 · P/X/Y memory
• `dsp56001_host.v`325 · host interface
• `dsp56001_dma.v`190 · normal DMA
• `dsp56001_periph.v`180 · peripherals/SSI boundary
• `dsp56001_agu.v`159 · address generation
• `dsp56001_sram.v`103 · external SRAM
lg1/REX + VC1 + XMAP + Bt479 · 13 files · 9,517 lines · 390 KiB
• `lg1_vc1_xmap_dac_scanout.v`2,669 · timing, maps, DAC, scanout
• `lg1_rex_frontend.v`2,232 · REX command/state
• `lg1_rb_backend.v`1,059 · pixel operations
• `lg1_draw_iter.v`1,037 · primitive iteration
• `lg1_clean_core.v`840 · LG1 composition
• `lg1_scanout_line_fetch.v`395 · scanout fetch
• `lg1_line_cache_64b.v`330 · line cache
• `lg1_rex_context_queue.v`299 · accepted context ordering
• `lg1_clean_line_core.v`192 · line path
• `lg1_write_combiner_64b.v`184 · VRAM write combining
• `lg1_mem_line_adapter_64b.v`122 · memory adaptation
• `lg1_mem_arb_ssram.v`103 · memory arbitration
• `lg1_vc1_ram_64k.v`55 · VC1 SRAM
board/KCU105 integration · 19 files · 11,171 lines · 454 KiB
• `ip20_kcu_soc_core.v`3,101 · complete SoC composition
• `kcu105_hdmi_frame_resampler.v`1,552 · video publication
• `gmii_ethernet_mac.v`1,315 · physical Ethernet MAC
• `cyan_mgmt_endpoint.v`841 · independent control plane
• `mc_mig_bridge.v`682 · MC to DDR4
• `kcu105_adv7511_tx.v`449 · HDMI transmitter control
• `cyan_cpu_island_bridge.v`441 · 100/50 MHz transaction boundary
• `kcu105_lg1_mig_bridge.v`384 · LG1/DDR bridge
• `kcu105_mig_app_arbiter.v`333 · DDR ownership
• `cyan_sgi_input_device.v`320 · SGI keyboard/mouse model
• `kcu105_sgmii_ethernet.v`258 · PHY/SGMII
• `cyan_lg1_config_trace.v`237 · accepted LG1 trace
• `cyan_mgmt_frame_router.v`231 · guest/management split
• `kcu105_lg1_capture_bist.v`236 · capture validation
• `cyan_frame_arbiter.v`186 · frame ownership
• `cyan_hpc_dma_coordinator.v`179 · HPC/MC quiescence
• `kcu105_lg1_capture_reader.v`178 · coherent capture reads
• `ip20_prom_rom.v`170 · PROM memory boundary
• `cyan_lg1_config_event_encoder.v`78 · trace records

HPC first; one owned cache transfer may drain.

// HPC is an always-real-time requester and preempts either
// long-burst owner.  Its service pauses the active tenure.
if (dma_valid) begin
    if (dma_ram_valid) begin
        ram_addr  <= dma_ram_idx;
        ram_wdata <= dma_wdata;
        ram_wmask <= dma_wmask;
        ram_wen   <= dma_write;
        ram_valid <= 1'b1;
        state     <= S_DMA_RAM;
    end else begin
        // DMA to non-existent RAM — return zeros, complete
        dma_rdata <= 64'h0;
        dma_ready <= 1'b1;
        state     <= S_WAIT;
    end
// Raw HPC demand reserves MC while the tag-first S-cache
// lookup resolves. No new CPU or VDMA external transfer
// may enter in that interval. A fill/writeback already
// serialized by the S-cache must drain, however, because
// the coherence lookup can depend on its completion.
end else if (arb_grant_vdma && !dma_rt_request) begin
    if (!arb_owner_vdma) begin
        arb_owner_vdma <= 1'b1;
        arb_time_left <= lb_time;
    end

HPC is real-time. CPU and graphics DMA are long-burst. One serialized cache transfer may drain to avoid deadlock.

DMA writes racing a fill merge after the fill.

// A Primary-D intervention beat is accepted only when it owns the shared
// data-RAM write port.  Queued DMA merges have priority in the mux below.
assign backinv_ready = (state == S_BACKINV_WAIT) &&
                       !snoop_update_ram_write;
// A DMA write can arrive after a fill has started but before the new tag
// is installed.  Metadata lookup then cannot report a hit even though
// already-returned fill words may be stale.  CDE zeroing has the same
// ownership window: the target tag is not installed until the final zero
// write.  Queue DMA bytes exactly as for an installed-line hit and apply
// them after the fill/CDE RAM writes.
wire snoop_fill_match =
    snoop_wr_accept &&
    (state == S_DFILL || state == S_IFILL || state == S_CDE_ZERO ||
     state == S_DONE) &&
    (snoop_addr[31:7] == fill_addr[31:7]);
wire snoop_update_push =
    (snoop_meta_hit_q || snoop_fill_match_q) &&
    (snoop_meta_wmask_q != 8'h00);
wire snoop_update_pop = snoop_update_ram_write;
wire snoop_update_push_accept = snoop_update_push &&
                                (!snoop_update_full || snoop_update_pop);
// A completed DMA write is already visible in external RAM when its
// registered S-cache lookup and queued merge arrive.  Hold an unaccepted
// CPU writeback until that merge reaches cache RAM, then re-prime the
// synchronous writeback word.  Raw pending DMA reads are deliberately not
// part of this exclusion: MC may already own the CPU writeback.
wire writeback_dma_write_block = snoop_wr_accept || snoop_meta_req_q ||
                                  snoop_update_pending;

External DMA updates or invalidates the inclusive write-back S-cache, including the interval before the new tag is installed.

R4000 NaNs use the legacy signaling bit.

// Classification
wire s_is_nan_a = (s_exp_a == 8'hFF) && (s_man_a != 0);
wire s_is_nan_b = (s_exp_b == 8'hFF) && (s_man_b != 0);
wire s_is_inf_a = (s_exp_a == 8'hFF) && (s_man_a == 0);
wire s_is_inf_b = (s_exp_b == 8'hFF) && (s_man_b == 0);
// R4000 legacy NaN convention:
// mantissa MSB = 1 → SNaN, mantissa MSB = 0 → QNaN
wire s_is_snan_a = s_is_nan_a && s_man_a[22];
wire s_is_snan_b = s_is_nan_b && s_man_b[22];
wire s_is_qnan_a = s_is_nan_a && !s_man_a[22];
wire d_is_snan_a = d_is_nan_a && d_man_a[51];
wire d_is_snan_b = d_is_nan_b && d_man_b[51];
wire d_is_qnan_a = d_is_nan_a && !d_man_a[51];
// Default QNaN values (R4000 legacy: MSB=0 is quiet)
wire [31:0] s_default_qnan = 32'h7FBFFFFF;
wire [63:0] d_default_qnan = 64'h7FF7FFFFFFFFFFFF;
// Propagate the first NaN operand, quieted under that convention.
wire [31:0] s_prop_nan = s_is_nan_a ?
    {fs_val[31], 8'hFF, 1'b0, fs_val[21:0]} :
    {ft_val[31], 8'hFF, 1'b0, ft_val[21:0]};

CP1 and SoftFloat/TestFloat use the R4000 convention. Native IDE FPU diagnostics and all 92 applicable external groups pass.

10 / KCU105 ALPHA

KCU105 alpha 883c641

Physically tested bitstream, probes, hashes, and host input tools.

TargetXilinx KCU105 / XCKU040

Source`883c641a0c185af0ae9cc61501e8cbc616d8e3d2`

BIT SHA-256`9e6fe09283d74b5daeddac718d6535564492c7b8d8898ee884438c3f6233d20f`

Download the bitstream

I affirm that I own an original SGI Indigo IP20 and will use my own lawfully obtained system software and media. DOWNLOAD 883c641 BITSTREAM · 15 MiB

debug probesSHA256SUMSrelease notes

This is a research alpha supplied without warranty. It may hang, panic, corrupt removable-media contents, or even explode your FPGA. Use an expendable SD card and retain your source image elsewhere. No IRIX disk image is included.

HOST INPUT

SGI input over SCC

`cyanctl` converts host events to SGI keyboard and five-byte mouse packets, queues them at serial-wire pace, and feeds the synthesized Z8530 receive path. PROM and IRIX receive normal bytes and interrupts. The management endpoint is independent of guest Ethernet.

DOWNLOAD HOST INPUT TOOLS + PROTOCOL · 32 KiB

\*Raw Ethernet Control Interface

sudo python3 tools/cyanctl.py input \ --interface ens18 text 'root' sudo python3 tools/cyanctl.py input \ --interface ens18 key enter sudo python3 tools/cyanctl.py input \ --interface ens18 mouse --buttons 0 --dx 24 --dy -8

destination 02:43:59:41:4e:01 EtherType 0x88b5 KBD_BYTES opcode 0x10 MOUSE_BYTES opcode 0x11 buttons 1=left 2=middle 4=right

11 / CURRENT STATE

Status

Hardware results belong to `883c641`. Later source admissions are listed separately.

883c641 / HARDWARE

Accepted on the downloadable release.

uhfR4K CPUOPERATING

100.04 MHz, 64-bit MIPS III, CP0, 48-entry TLB, CP1, precise exceptions, stock PROM/IDE/IRIX.

CACHE HIERARCHYOPERATING

8 KiB I/D caches; 1 MiB S-cache; indexed/hit `CACHE`; inclusion; dirty writeback; DMA intervention. TLB and `icache2` pass.

MC + MEMORYOPERATING

128 MiB DDR-backed memory; CPU/GIO requests; posted writes; priority arbitration; coherent device access.

HPC1.5 + INT2OPERATING

DMA ownership, interrupt masks and acknowledgement, timers, and IRIX programmed I/O.

WD33C93A SCSIOPERATING

Command, status, data, and HPC DMA to SD. Local EFS mounts read/write.

SEEQ 80C03 ETHERNETOPERATING

Descriptor DMA, packets, interrupts, physical MAC, routed IRIX traffic. Separate management plane.

Z85130 SCC + INPUTOPERATING

Dual channels; console; paced SGI keyboard and five-byte mouse packets; receive FIFO interrupts.

DP8572A RTC + 93CS56 MAPOPERATING

Runtime clock and nonvolatile registers through HPC. External devices and canonical defaults remain open.

NATIVE LG1OPERATING

REX, RB, VRAM, VC1 timing/cursor, XMAP, DAC, Xsgi, and HDMI. VRAM, CID, VC1, SRAM, DAC, and REX diagnostics pass.

IRIX DESKTOP + SERVICESOPERATING

XDM, Xsgi, 4Dwm, Toolchest, System Manager, ObjectServer, storage, networking, and SCC input.

CONTROL + EVIDENCEOPERATING

Board management, framebuffer capture, SCC/LG1 traces, exact-commit simulation, guarded programming, hash-locked releases.

CURRENT SOURCE / PRESYNTHESIS

Newer than the hardware alpha.

MOTOROLA DSP56001SOURCE-ADMITTED

20 MHz core, P/X/Y memories, host port, interrupts, RTC/SRAM, normal DMA, REP/DO, installed firmware startup, driver command, and composed stock diagnostic pass production-RTL oracles.

OPEN

Promotion gates and deferred reliability work.

LG1 COLOR LIFECYCLENARROW OPEN EDGE

Most applications match pixel-exact real-hardware replays. Managed private-colormap pressure can expose an Xsgi/4Dwm residency-reinstall edge.

DSP56001 PHYSICAL + AUDIOOPEN

Hardware IDE and S83audio; remaining ISA/ROM, fast vectors, nesting, folded DMA, SSI, SPDIF/ADV7511, playback.

ECC + PARITY ENFORCEMENTNOT IMPLEMENTED

Main-memory/cache parity and S-cache ECC: generation, storage, checking, injection, status, exceptions.

PROM POLISHDEFERRED

External EEPROM and battery backed clock support with finalized canonical NVRAM defaults.

RELEASE PROMOTIONIN PROGRESS

Repeated clean boots, independent I/O load, native shutdown, stable graphics lifecycle.