Talk:Hardware

Barracuda Revisions

The Logik IR100 I own has a Barracuda board marked 'ISSUE D'. It has a number of differences from the board shown in this wiki. The ATMEL chip has been replaced by a PIC12f508. The large chip marked 32C55 is not present (though the pads still exist) and there are a handful of extra resistors/capacitors/empty pads.

I suspect that the PIC/ATMEL chips may hold the serial number and possibly take part in the encryption scheme used to talk to the Reciva server.

I would also be interested to know what HW Version numbers other radios display (from the Configure -> <Version> -> <Hardware> menu). The Logik IR100 show 1012. Rdk 16:55, 8 March 2007 (CET)

Hardware number

Each model of radio uses a specific config file (the hardware number). Swapping Barracuda boards between different radio models shows that the hardware number is not permanently stored on the board - the radio takes on the correct features. Where is the hardware number permanently held and how is it communicated to the Barracuda board? Drgeoff 15:14, 6 May 2009 (CEST)

Onboard PCM

Is the audio really onboard? The output of dmesg says there is a Wolfson wm8721 on the I2C and IIS buses. Jpr 11:50, 4 May 2007 (CEST)

On my ipdio mini, there is indeed a Wolfson WM8721 DAC for audio. So, no onboard DAC on the IRM2. Jaw 16:15, 21 March 2008 (CET)

On my Roberts WM-201 insmod lists one of the modules as esmt_ad8356a which suggests to me that it has one of ESMT AD8356A inside. Not opened the box yet to confirm. Dicko 23:54, 25 March 2008 (CET)

Basically, the original question was whether the Reciva module actually has onboard audio. No, it does not - afaik, audio is transferred via i2s to a DAC on the radio's mainboard. Different mfg's use different DACs, such as the Wolfson and ESMT ones mentioned here. This also addresses a question I placed elsewhere: no, there is no easy way to add an spdif digital output - you would have to build an i2s->spdif converter. -- 23:33, 1 April 2008 (CEST)

Atmel/PIC

Is it possible the Atmel/PIC holds the device serial number/handles the crypto associated with the reciva:// protocol? Noodles, 22 July 2007

That's exactly what I believe. The PIC must hold the serial number since I've removed the flash from mine, replaced it with another and I still have the same serial. I suspect the PIC also holds a key - possibly in a similar fashion to a GSM SIM card. A random challenge from the Reciva servers is passed to the PIC, the PIC generates a response and a ciphering key maybe? Of course the PIC could be used to perform all the encryption/decryption itself but that would seem to be an unnecessary bottleneck. --Rdk 19:30, 13 August 2007 (CEST)

When disassembling 'curl' and 'sernum' daemon, i came to the same conclusion (didn't know about your ideas before). 'curl' initalizes DES and 3DES keys using the keys provided by the PIC. Believing the crypto check code in 'sernum', the cipher in PIC is some TEA algorithm. Looking closer at the disassembly it revealed as XTEA. The reciva servers send some 8 byte challenge to 'curl', this travels over /tmp/sernum to 'sernum' daemon which sends it to the PIC. This one does some XTEA encryption and sends the reponse the whole chain back. Now 'curl' (in fact libcurl) sends that encrypted result *again* over to PIC. It does the whole story 5 times. The first answer is used in the file request, the 2nd is DEA key and the last 3 are the 3DES key. g3gg0 03:58, 01 September 2008

Test Points

I replied to Trumpton regarding the pr5/pr6/pr7 testpoints shown on the board outline picture on my internetradiohack blog, but thought I ought to mention it here too.

I was looking to identify which (if any) of the testpoints were for JTAG after removing the S3C2410 processor. At the same time I also checked out the cluster of 3 testpoints labelled pr5, pr6 and pr7 that were hoped to be a serial port. Unfortunately that doesn't seem to be the case they seem to be:

pr5 - L16/UEXTCLK/GPH8
pr6 - J11/EXTCLK
pr7 - J17/nBATT_FLT

Bearing in mind that all the useful flash chip pins appear as testpoints on the board - maybe the nBATT_FLT is used to prevent the processor from powering up and contending the pins used by the flash so that it may be programmed in situ with an external programmer. --Rdk 20:07, 13 August 2007 (CEST)

2410 Manual

It appears that Samsung has become rather restrictive with handing out their manual for the 2410, requiring registration with a business email address. Here is an alternative link http://embedded.inha.ac.kr/zbxe/?mid=pds&document_srl=264. -- Jaw 16:21, 21 March 2008 (CET)