Production tester for the dabao is ready! 100% of boards run through a test where every I/O is toggled, both buttons are pressed, serial ports tickled, and an initial OS image is loaded. Voltages and currents are also checked. The test checks for errors in soldering, and/or faulty components.
Yah, it's a crossbar that lets each of the 4 CPUs talk to 4 FIFOs for inter-CPU communication.
Just a pair of anti-stat plastic tweezers does the trick. The socket is precision milled to the shape of the chip and the chip dimensional tolerance is very tight, so it just snaps right in.
😬 I keep asking people if I should be taking off a tinfoil hat, and someone offered me a lead hat instead.
Note that this initial campaign is limited to 3,500 boards total. I don't think we're at risk of hitting that limit, but it's probably worth a mention just in case!
Interested in trying out a Baochip-1x? The 'dabao' evaluation board is now taking pre-orders on Crowd Supply: www.crowdsupply.com/baochip/dabao
The 'package' is the silicon die with some solder bumps attached to it via a redistribution layer. So the chip itself is pretty brittle.
However, the real challenge is that the solder bumps are spaced 0.4mm apart - so the spring loaded pogo pins are closer to whiskers than they are to pins.
This is what the socket looks like with the lid closed!
The socket has seen heavy use for initial device bring up and chip probe test development. However, its high cost and fragility limits its use to just the earliest bring up phases.
If you are a lucky dabao Alpha board owner, the chip on that board was tested and programmed in this very socket!
The socket mounts to the board with spring loaded contacts; the carrier board is also custom to the socket. You can see some of the chip test & measurement power supplies on the board near the socket. The socket itself is quite expensive, a couple thousand dollars and some weeks to manufacture.
Here's what a socket looks like for chip scale packages. Each one is custom made for a given chip package.
A couple samples of the 0.4mm pitch Baochip CSP devices are laid out on the lower rim of the socket for size reference.
About $2k for a socket, yes. And yes, the initial smoke tests are done in a socket but the socket is huge, expensive, and also opaque so you can't do (for example) laser fault injection attacks while still in the socket.
Behold the graveyard of Baochips!
Security testing is hard, after the chips are locked the only recourse is to desolder and replace them when a test goes wrong or an attack sensor is tripped.
On the upside, I'm getting really good at reworking CSPs.
Wanted a Dabao but couldn't get one at #39C3? Sign up here to be notified when they are ready for sale: www.crowdsupply.com/baochip/dabao
Missed our talk? If you want to learn about the OS or the chip, check out the recording at media.ccc.de/v/39c3-xous-...
one hour to our talk! cya there.
We're at the fail0verflow assembly, about 10 meters from the corner with the hardware hacking area!
A reminder that tomorrow we'll be introducing Xous & Baochip at #39C3: fahrplan.events.ccc.de/congress/202...
Day 2, 23:00 In hall 1!
Woo hoo! just in time: tape & reel packaged Dabao for #39c3. They will be at the #fail0verflow assembly with @bunnie.org .
Also come see our talk on Day 2 23:00 in Room 1: "Xous: A Pure-Rust Rethink of the Embedded Operating System", where bunnie & xobs will co-present on Xous running on Baochip!
Xobs and @bunnie.org will be presenting Xous and Baochip at our talk on Day 2, 23:00 room one: fahrplan.events.ccc.de/congress/202...
Hope to see you there!
The basic dev board is in! Meet the "Dabao", a simple breakout board for the Baochip-1x.
If you're interested in one and will be at #39C3, come find @bunnie.org at the fail0verflow assembly. He'll have a limited number of Alpha-1 release boards to give away!
Source at github.com/baochip/dabao
Nice to see someone has already tried IRIS on their Baochip sample: social.v.st/@cibomahto/1...
Apparently the previous discord link expired. Didn't even realize that they could expire...
Here's a link that should have no expiration! discord.gg/yesbcPF9Xy
The first cut of the code missed a branch delay slot, and so the two paths were different by three cycles.
Open source means you can simulate code running on your chip, and be sure you got it right!
It's nice to be able to simulate your constant-time code and prove to yourself that you got it right.
Pictured is a simulation of AES chaffing, where fake and real data are computed in a random order. The timing of fake->real and real->fake has to be identical in order to mask power side channels.
We've got a Discord now up and running. Come join if you have questions or need support!
discord.gg/5SgHvcNB
It's early days and we're still figuring out how to configure things, so thanks for your patience as we iron out the wrinkles!
Block diagram of the chip now up on the bao1x repo!
Backside IR image of the chip!
The Baochip-1x is packaged specifically to enable you to verify that you've got the correct chip, and not a fake or a substitute part (see bunnie.org/iris for how).
The final chip will have part numbering that overlaps the memory array on the lower third of the chip.
Closeup view of the back side of the chip itself!
CHIIIIIIPS!!!
12" wafer of CSP bumped chips, hot off the line (solder balls are face-up in this photo, with a couple die already removed for testing).
