Post B5CSkUUR6eGxtz9KcK by azonenberg@ioc.exchange
(DIR) More posts by azonenberg@ioc.exchange
(DIR) Post #B5CR2ZRBFafiYC7VJY by whitequark@social.treehouse.systems
0 likes, 1 repeats
first impressions of the Lego smart brick, before I do any actual tearing down: wow, I forgot how good they are at working with plastic. the injecton molding remains impeccable, at least for this specific piece (I know about their recent QC issues elsewhere)it's hard for me to look at the positively microscopic (I am literally using a microscope to look at it) "Li-Ion" lettering and think of anything but "showing off!"(treehouse doesn't let me attach the full size images, you can grab them here: front, side)
(DIR) Post #B5CR2Zl23mYFXlPMG0 by whitequark@social.treehouse.systems
0 likes, 0 repeats
on the side, there are microscopic openings for the speaker to move air through. I would have really liked to be a fly on the wall in a meeting with the mold engineer who had to make this happenoriginal
(DIR) Post #B5CR2a0z6TJOLEs67c by whitequark@social.treehouse.systems
0 likes, 0 repeats
I'm not yet sure how I'll open it up. I don't have a hacksaw (somehow... I should fix that), so my options are somewhat limited: it's either cracking or melting plastic. from what others have done I know I there's plastic welding all around the joined region.
(DIR) Post #B5CR2aGw9A4X8iKpzE by whitequark@social.treehouse.systems
0 likes, 0 repeats
okay I've decided on an idea: I will heat up the plastic to make it pliable and then cut it with a knifeas a knfe girl, this is my professional obligation.
(DIR) Post #B5CR2aTLP1zrlC8kKG by whitequark@social.treehouse.systems
0 likes, 0 repeats
here's a video that shows in more detail the moldwork in the transparent plastic part
(DIR) Post #B5CR2agScGUMPsHDlo by whitequark@social.treehouse.systems
0 likes, 0 repeats
if you've never heard of anybody opening welded plastic this way, i can now tell you why: because it's a bad idea. until you heat ABS to the point where it flows (which you don't want here, as it'll make later teardown even worse), it acts rubbery. imagine cutting hot rubber. doesn't work
(DIR) Post #B5CR2audlXpb7quXs8 by whitequark@social.treehouse.systems
0 likes, 0 repeats
it did however let me lop off the top of it easilythis is I think a 2.4G antenna?next step is sanding
(DIR) Post #B5CR2fROvgPhAcGlUW by whitequark@social.treehouse.systems
0 likes, 0 repeats
yep that did the thing. probably should've started with sanding at the beginning.it was somewhat more destructively than i wanted, but that's ok: i was trying to challenge my (incorrect) belief that sanding is always a tedious pan in the arse
(DIR) Post #B5CR2goTpMT7QU4i6S by whitequark@social.treehouse.systems
0 likes, 0 repeats
took it apart. there's a sort of a plastic "carrier" that gets manufacured first, then inserted into the final package that's welded shut
(DIR) Post #B5CR2iJiEj2u5dhAQK by whitequark@social.treehouse.systems
0 likes, 0 repeats
okay, i've extracted the firmware-bearing parts. this is a tiny 45 mAh battery. (part of the lettering was torn off by the glue it was attached with)
(DIR) Post #B5CR2m5KE9ujmAzjYO by whitequark@social.treehouse.systems
0 likes, 0 repeats
close-ups of the component side (well, the side with more components)originals: 1 2
(DIR) Post #B5CR2oG29JfUVy1JWS by whitequark@social.treehouse.systems
0 likes, 0 repeats
EM9305 is an em|bleu microcontroller in QFN
(DIR) Post #B5CR2pvXwST7h0Ryro by whitequark@social.treehouse.systems
0 likes, 0 repeats
it has over half a megabyte of flash!
(DIR) Post #B5CR2rTcBHJYUxOhbk by whitequark@social.treehouse.systems
0 likes, 0 repeats
ok so this would be the JTAG pins
(DIR) Post #B5CR2tEReeMtwUJcEy by whitequark@social.treehouse.systems
0 likes, 0 repeats
also, here's a close-up of the markings on the tiny WLCSP between the BGA and QFN
(DIR) Post #B5CR2um9umvkjL63Qe by whitequark@social.treehouse.systems
0 likes, 0 repeats
decided the next thing to do would be to dump the presumed Winbond flash WLCSPhere it is mounted on a SOIC-8 pinout with a tiny bit of UV epoxy, like a particularly exotic dead bug
(DIR) Post #B5CR2wY3KCpqEAVoie by whitequark@social.treehouse.systems
0 likes, 0 repeats
connected half of the padsthis is my first time soldering a 0.3mm pitch WLCSP, so it took me a bit to set up the workspace the way that makes it possible, but it's not too bad
(DIR) Post #B5CR2ySoCfpSAU4ep6 by whitequark@social.treehouse.systems
0 likes, 1 repeats
finally done. no shorts and (as far as i can tell under mag) no opens
(DIR) Post #B5CR4YqcPj6XIhy3Xc by ldcd@social.treehouse.systems
0 likes, 0 repeats
@whitequark Calling an ARC CPU industry standard is very funny to me
(DIR) Post #B5CR4Z6vR69G7Hb4xU by ftg@mastodon.radio
0 likes, 0 repeats
@ldcd @whitequark It is quite widespread, even if not visible to end users.Being in most Intel CPU's and all that.
(DIR) Post #B5CR4ZJKgy4ajlOzIW by ldcd@social.treehouse.systems
0 likes, 0 repeats
@ftg @whitequark yeah that's why it's kind of funny, it is simultaneously a very common CPU and a very obscure CPU (ie it's hard to get comprehensive documentation, the devkit is literally an FPGA, etc)Like they're not lying but they're trying to imply it's a normal CPU to use and be able to program which isn't really true
(DIR) Post #B5CR4ZVjwpzvMFCtdY by gsuberland@chaos.social
0 likes, 0 repeats
@ldcd @ftg @whitequark I have yet to come across any SoC with an ARC core where the docs weren't partially or fully NDA'd, or at least gated behind a sales call.
(DIR) Post #B5CR4ZhRFLM5wWgEs4 by Rairii@labyrinth.zone
0 likes, 0 repeats
@gsuberland @ldcd @ftg @whitequark can we blame star fox for this
(DIR) Post #B5CSbQ93tHFDowpKHA by azonenberg@ioc.exchange
0 likes, 0 repeats
@gsuberland @ldcd @ftg @whitequark stm32mp2 has an arc in the memory controller that you get a blob for, but you can dev for the rest of the chip (aside from the gpu and some corners of the pcie) with no ndas. So relatively open by that standard
(DIR) Post #B5CSkTJ3VTZiEOojEu by ldcd@social.treehouse.systems
0 likes, 0 repeats
@gsuberland @ftg @whitequark exactly
(DIR) Post #B5CSkTa4UDBb5AmJlI by ldcd@social.treehouse.systems
0 likes, 0 repeats
@gsuberland @ftg @whitequark This is my industry standard very normal CPU core (no you cannot look at)
(DIR) Post #B5CSkToFdUWpn9Pdrc by gsuberland@chaos.social
0 likes, 0 repeats
@ldcd @ftg @whitequark in fact most of the time it's not even a case of NDA, it's a completely custom SoC ASIC with ARC core IP inside and the only way to get docs is to work at the company. I'd say "or contract with them" but generally even then you won't get full docs for the ARC core IP without a first-party NDA with the IP vendor.AIUI there's more use of COTS ARC SoCs around in the automotive space (primarily ECUs) but the detailed documentation and SDK/BSP tends to be NDA'd there too.
(DIR) Post #B5CSkU3UioioYQXoci by whitequark@social.treehouse.systems
0 likes, 0 repeats
@gsuberland @ldcd @ftg i found an ARC in a ThindPad once
(DIR) Post #B5CSkU8SQMgwnormMK by gsuberland@chaos.social
0 likes, 0 repeats
@ldcd @ftg @whitequark definitely a weird architecture to run into in anything not hyper specialised. I'd be very surprised to stumble across it in an IoT device for example.
(DIR) Post #B5CSkUE85HEF5PWJCS by whitequark@social.treehouse.systems
0 likes, 0 repeats
@gsuberland @ldcd @ftg in the keyboard controller no less!
(DIR) Post #B5CSkUMdZe2BVnV6Se by ldcd@social.treehouse.systems
0 likes, 0 repeats
@whitequark @gsuberland @ftg excuse me thats where 8051s are supposed to live; thats an invasive species
(DIR) Post #B5CSkUUR6eGxtz9KcK by azonenberg@ioc.exchange
0 likes, 0 repeats
@ldcd @whitequark @gsuberland @ftg i wonder if anyone has done a mips based keyboard controller
(DIR) Post #B5CSprpXkq1FjsaOFU by gsuberland@chaos.social
0 likes, 0 repeats
@azonenberg @ldcd @ftg @whitequark yeah I'm more thinking about ARC as the main core rather than something buried doing a supporting task thoI know Synopsys loves shoving them in everything and anything.
(DIR) Post #B5CSqM0DZiNpJfoL3I by ftg@mastodon.radio
0 likes, 0 repeats
@azonenberg @ldcd @whitequark @gsuberland I'll mention this to a MIPS loving friend who's currently working on a keyboard project.But I think it would have to then be based on something like PIC32.
(DIR) Post #B5CSvFd0haS0zjI65I by azonenberg@ioc.exchange
0 likes, 0 repeats
@ftg @ldcd @whitequark @gsuberland I'm pretty sure i saw a digilent fpga board that had a pic32 on it in usb host mode that presented a ps/2 mouse and keyboard interface to the FPGA if you plugged in a usb one
(DIR) Post #B5CTpgUpzfxSXdNTd2 by gsuberland@chaos.social
0 likes, 0 repeats
@whitequark @ldcd @ftg hah, weird. that's an odd choice of architecture for a keyboard controller, unless it was doing audio or touchpad stuff too I suppose.
(DIR) Post #B5CTpgl9130BMD0V2u by whitequark@social.treehouse.systems
0 likes, 0 repeats
@gsuberland @ldcd @ftg no it's just the EC. from Microchip
(DIR) Post #B5CTpgzg90d05Ho6hU by azonenberg@ioc.exchange
0 likes, 0 repeats
@whitequark @gsuberland @ldcd @ftg huh I thought microchip ECs were mostly arm based
(DIR) Post #B5CTxZwOFdYKWh1sxs by azonenberg@ioc.exchange
0 likes, 0 repeats
@ftg @ldcd @whitequark @gsuberland i used to be big on mips. I remember being very disappointed when i discovered BFC00000 was not a valid license plate in my state
(DIR) Post #B5CdzR9atJoxOWjKoy by mlp@defcon.social
0 likes, 0 repeats
@azonenberg @whitequark @gsuberland @ldcd @ftg When Microchip first produced a PIC32 it was built around MIPS (I was at HI-TECH Software at the time - we had a compiler targeting it). Later they acquired Atmel and renamed the (ARM-based) SAM series "PIC32..."
(DIR) Post #B5CdzROTzxjM8hhE1o by azonenberg@ioc.exchange
0 likes, 0 repeats
@mlp @whitequark @gsuberland @ldcd @ftg yes I'm talking about their embedded controllers for laptops etc not general purposes MCUs.Real PIC32 is mips, not the rebranded SAMs sold under the pic32 brand
(DIR) Post #B5FWnWCCCeWHLtCFfc by whitequark@social.treehouse.systems
0 likes, 0 repeats
complete success
(DIR) Post #B5FWnWPfOZIM1fV0fQ by whitequark@social.treehouse.systems
0 likes, 0 repeats
contrary to everything i've seen online, this is a Winbond W25Q16JWBY part (but one person got the closest, they thought it is a W25Q16JVBY. the difference is major: one is 3.3V, the other is 1.8V)
(DIR) Post #B5FWnaV8CC2ihm5Qjw by whitequark@social.treehouse.systems
0 likes, 0 repeats
NotImplementedError: quad enablement SFDPJEDECQuadEnableRequirements.Reg2Bit1_Read35h_Write05h not implemented yetah yes. i remember why i hate SPI flashes now
(DIR) Post #B5FWnbpNGPpUoqZ6vo by whitequark@social.treehouse.systems
0 likes, 0 repeats
tried using dual mode and the SFDP tells me to transmit half a byteonce i dump it this flash is definitely going into the naughty pile (of unit tests in glasgow)
(DIR) Post #B5FWndBkCjJl2W2URE by whitequark@social.treehouse.systems
0 likes, 0 repeats
here's the flash contents https://upload.whitequark.org/1775953651-lego_brick_00F2MZ_749DF5_W25Q16JWBY.bin
(DIR) Post #B5FWneXlAMWRF5LaOO by whitequark@social.treehouse.systems
0 likes, 0 repeats
here's how the flash was mounted in its natural environment, in absence of feline predatorsthe SPI bus seems to be shared with something else & they're definitely using ViP
(DIR) Post #B5FWnfqwIXSTIrKPvU by whitequark@social.treehouse.systems
0 likes, 0 repeats
alright let's dump the ARC chip now
(DIR) Post #B5FWnh9lS26vLX8xuK by whitequark@social.treehouse.systems
0 likes, 0 repeats
not my best work but it should do the trickfeat. comically big q-tip
(DIR) Post #B5FWniV4SIkRVu7Uky by whitequark@social.treehouse.systems
0 likes, 0 repeats
unfortunately, i could not access JTAG. i think i ran out of time i have for playing with this board, good luck @ everyone elseshout out to:https://github.com/nanash1/smart_brickhttps://codeberg.org/shelfofsheelfs/SMART-Brickfor doing good work!
(DIR) Post #B5FWnjqjRFfXhNGJ9s by whitequark@social.treehouse.systems
0 likes, 0 repeats
after reading the datasheet a bit more carefully, i know why i couldn't: the JTAG port is simply not exposed unless the firmware configures the pin mux that way. i'd have to dump the firmware in some other way