asciilifeform: swiftgeek: if you end up doing it, plz consider publishing the procedure

asciilifeform: prolly would need ir preheater for the underside ?

asciilifeform: how would you go about lifting it without ending up reflowing the internals?

asciilifeform: yep looks like the same footprint

asciilifeform: ( or the plain usb3 )

asciilifeform: swiftgeek: you can infer exact dimension from the usbc jack

asciilifeform: there's no socket on the pcb

asciilifeform: swiftgeek: the wifi ? on this one ? seems to be on pci bus

asciilifeform: but in theory you can plug in usb wifi etc

asciilifeform: wifi is soldered down on these

asciilifeform: ( according to amstan , a fella from #linux-rockchip who introduced himself as one of the designers, but is rather tight-lipped )

asciilifeform: swiftgeek: here's a flatbed scan of the board, http://btcbase.org/log/2018-06-11#1822396 ☝︎

asciilifeform: the h1 is the item in the right hand side of the photo

asciilifeform: ( it's the bootloader fw, btw )

asciilifeform: ( i cannot rule out the possibility that it was built in cooperation with, or at the facility of , infineon; it is stamped 'TWN' so this is at least theoretically hinted )

asciilifeform: google baked it as a replacement for the infineon.

asciilifeform: it is not an infineon, this is more or less certain

asciilifeform: swiftgeek: to complete the picture, my initial interest in cr50 was in the debug functionality; the thing can override #WP signal and rewrite the EC and boot roms , via usb snake. so it'd be quite convenient to have access. however the factory firmware locks it.

asciilifeform: but perhaps that's just me

asciilifeform: personally, i'd consider a box with no trackpad function, to be usable ☟︎

asciilifeform: but this is for much later.

asciilifeform: thus far i know nothing about it aside from the update/reflash mechanism (it is done via the ec)

asciilifeform: c101pa also includes a trackpad with flashable blob fw

asciilifeform: swiftgeek: i actually started with attempt to port generic coreboot to c101pa, and ended up finding the cr50 by accident

asciilifeform: swiftgeek: if you are a thinkpad aficionado, there is a patched x60 bios in the logs, iirc 2015

asciilifeform: having used ~every thinkpad made.

asciilifeform: swiftgeek: i definitely noticed the change.

asciilifeform: |\n: best suspicion thus far is that it is a 'hardcopy fpga' (cheap, relatively, method for getting chip baked, they apply a custom metallization mask to a stock crystal)

asciilifeform: ( i do not yet know what is in the 201pa )

asciilifeform: not really possible to thoroughly reverse things without creating a pile of rubbish, sadly

asciilifeform: swiftgeek: if you register a gpg key with deedbot, you will be able to voice yourself

asciilifeform: swiftgeek: out of curiosity, what's your interest in this particular box ? ☟︎

asciilifeform: ( if you simply lift it, there'll be no signals, board doesn't come up )

asciilifeform: and get a trace of all of the signals

asciilifeform: what you'd want, is to solder an interposer b/w the cr50 and the pcb

asciilifeform: soldering however many balls are under it, to bodge wires, and attaching logic analyzer etc, is the headache

asciilifeform: yes anybody can lift bga ( tricky to do without cracking the board, but doable if you are patient )

asciilifeform: sticking point is to solder to the balls

asciilifeform: that's not the sticking point

asciilifeform: swiftgeek: if you'd like to take a c101pa and deball the bga and try this, and post article, i promise to read

asciilifeform: and as soon as we start doing it, they'll start pouring epoxy, and then cost goes up yet again

asciilifeform: which makes it of secondary interest to us

asciilifeform: however this approach is expensive, in manual labour, and its cost borders on that of simply making new machines from 0

asciilifeform: google's src already contains everything you need, in theory, to make a hypothetical benign replacement for cr50

asciilifeform: sure, but i want 1000+ units, rather than 1 elaborately handcrafted.

asciilifeform: swiftgeek: asciilifeform's orig plan was to sell cleansed c101pa machines. if this said cleansing requires lifting a bga, and attaching a manufactured replacement , we will be talking about considerably different cost than if the machines can be cleansed in 10min via software, via debug snake.

asciilifeform: swiftgeek: the way it is connected now, the box won't actually power up without it

asciilifeform: but conceivably you could , at some expense, come up with a pad-for-pad substitute, and lift the thing, then solder to the balls

asciilifeform: so far we know that it handles the power button signal; the reset magic combo on the kbd; and the 3.3v rail bringup. it also handles the usb debug functionality that you get with the cable linked earlier

asciilifeform: swiftgeek: see https://chromium.googlesource.com/chromiumos/platform/ec/+/master/board/cr50/gpio.inc ( what is known of the pin functions )

asciilifeform: if these are found, and found to work, it is likely to be the shortest path to proper jailbreak

asciilifeform: swiftgeek: in re cr50, i am specifically interested in whatever factory test pads exist , with which the thing may be filled up with initial fw on manufacture

asciilifeform: ( the cr50 rom is ~not~ kept in the winbond spi rom where the boot loader ( google's crippled coreboot ) lives )

asciilifeform: all i've been able to find is that 1) it is an arm cortex-m , prolly licensed 2) started life as fpga ( see google's src, comments repeatedly refer to earlier vers as 'fpga' , then , later, 'g-chip' )