Help identifying a SOT753 package chip

[poot36]

I have a Lantronix WiPort NR unit that has stopped working.  It does not respond to serial commands and I can not see it on the network either.  I have checked the voltage rails, clock, and reset line and they are all working correctly.  Without a network cable attached to the unit I just get a blinking active led on the network port )not sure if this is normal or not).   I am starting to suspect the chip with the markings of M504 or perhaps M5o4 on it.  It is a 5 pin SOT753 surface mount chip.  I have attached a picture of it.  The top right hand pin is connected to 3.3V, the top left pin is connected to ground along with the bottom middle pin.  The bottom left and right pins are pulled up to 3.3V through 2.2K ohm resistors and also go to the main chip on the board which is a DSTni-EX-R chip from Lantronix.  Not really sure what this chip does but on power up the pins with the resistors on them just follow the power supply as it turns on so I don't think that is correct unless this chip is not related to power up sequencing and is just some sort of over voltage protection device?

[fzabkar]

Could it be a PSU monitor or reset supervisor? These typically have an OC output.

Could it be a 24LC16B-I/OT?

http://www.smdmark.com/en-US/search/code?id=m5xx

24LC16B, Microchip, 16Kbit I2C Serial EEPROM, 2.5 - 5.5V, marking M5nn, SOT23-5:
https://download.datasheets.com/pdfs/2012/2/23/0/54/12/32/mcp_/manual/syst-01nhfr232.pdf

The OC pins correspond to SDA and SCL.

[poot36]

@fzabkar The pin-out of the chip you found would technically work.  But I don't see why that chip would be needed along with the M29W160ET70ZA6 flash chip that is already connected to the main chip.  Some sort of preboot config chip?  The firmware for the unit is 128Kb and that does fit into the flash chip.  I did some probing around the bottom left and right pins in diode mode and found that with my black meter lead on ground and the red lead on the right pin I get a diode drop of 0.8V and on the right pin I get no diode drop.  Not sure what to make of this.  As there is now some proof that the chip could be a eeprom chip I will check the lines on my scope at a way faster time base then I was before as I was assuming it was some sort of power monitoring chip and slowed down the time base for that.

[poot36]

@fzabkar Well I was able to confirm i2c data on the pins, the bottom right pin is data and the bottom left is clock.  It does take a second or two to start reading from the chip after power up which is interesting.  The clock frequency is around 55 to 58 khz and the time it takes to access the chip is about 3.5ms.  Have not yet attempted to decode the data yet as that requires me to setup my really old LA and I am not sure if it would tell us much anyways.

[fzabkar]

@fzabkar The pin-out of the chip you found would technically work.  But I don't see why that chip would be needed along with the M29W160ET70ZA6 flash chip that is already connected to the main chip.

https://www.lantronix.com/wp-content/uploads/pdf/WiPort-NR_DS.pdf

WiPort NR Technical Data

CPU, Memory -- Lantronix DSTni-EX 186 CPU, 256 KB zero wait state on-chip SRAM, 2048 KB Flash, 16 KB Boot ROM

[poot36]

@fzabkar I did notice that but the way it is shown in the block diagram of the main chip is that it is onboard to the chip.  Now as my chip has a -R after it it is possible that it is a reduced functionality chip that would need an external ROM to boot.  Would it be worth it to try and dump the ROM?

[fzabkar]

@fzabkar I did notice that but the way it is shown in the block diagram of the main chip is that it is onboard to the chip.  Now as my chip has a -R after it it is possible that it is a reduced functionality chip that would need an external ROM to boot.  Would it be worth it to try and dump the ROM?

I think you have already done the basic checks for any uC based PCB. The next thing I would do is to dump the firmware and test the checksums, but this only works if the algorithm is known or is easily reverse engineered. These jobs are always frustrating because one rarely sees any error codes or has access to the manufacturer's diagnostics.

[poot36]

@fzabkar I sadly can not dump the firmware chip as it is a BGA unit.  I can dump the ROM chip though.  I did read about a way to recover the firmware through the serial port but the software did not see the device to recover the firmware.  Not sure if the serial port is dead in some way or not.

[poot36]

@fzabkar I found a clear block diagram of the main chip and as far as I can tell the boot ROM is inside the chip.

[fzabkar]

I'm confused. :-?

Sometimes an OEM will store some vendor specific stuff in an EEPROM. Could that be it? A real ROM would be read-only, so an OEM couldn't reprogram it.

[poot36]

@fzabkar I have been able to dump the i2c EEPROM chip with no issues.  I have attached the dump to this post.  I have done more research and have found the datasheets for the main micro chip here: https://www.gridconnect.com/collections/lantronix/products/ex-184b-up-2xethernet-phy-usb-can-includes-rtos-tcp-ip-sw#documents-and-drivers.  In sections 1 and 2 there is mention of changing states of some of the address lines on power up to determine how the chip boots.  The only problem is that address line A22 is the one that decides to use the internal boot ROM or not and as far as I can tell I can not get to it.  I also took a further look at the integration guide for unit and found a schematic for the dev board on pages 20 to 23: https://cdn.lantronix.com/wp-content/uploads/pdf/WiPort-NR_IG.pdf.  I am starting to think that the CPLD may be looking for specific data on the serial port and then doing something with the CP5 through 7 pins on the unit.  Not sure how far I can go with this testing because of that.  Also have not found any reference to the chip being able to use a i2c chip as it's boot ROM.  There is apparently a DSTni-EX Bootstrap User Guide, 800-500-100 but I can't find it online.

[fzabkar]

The EEPROM looks like it is set aside for configuration data that is provided by the user.

"LTRX_IBSS" is a wireless network name (SSID).

"public" is the default SNMP Community Name.

https://cdn.lantronix.com/wp-content/uploads/pdf/XPress-DR-Plus_UG.pdf

The data appears to be arranged in groups of 0x80 bytes with either a byte or 16-bit word at the end. These end bytes look like checksums or CRCs, but I'm not completely convinced.

I suppose you could scope the I2C Data and Clock pins during power-up. If the SoC is alive, it should attempt to read the configuration info. In fact it would be interesting to see how the PCB behaves with a missing EEPROM.

[poot36]

@fzabkar So it seems that EEPROM chip is not very useful to us.  On the PCB under a sticker it has WiPort G printed on it and there are 2 missing chips on the PCB, possibly for the WiFi version of this unit?  In the firmware file I downloaded from the Lantronix website it mentions WiFi and Ethernet connections in it.  I suspect based on how some jumpers are set on the PCB that changes what code gets executed based on the setting of the Reset Configuration Register is jumpered to.

[fzabkar]

I'm assuming that reading the configuration EEPROM is one of the last things the SoC does, so if we see activity on the I2C bus, this would suggest that the SoC is alive and has POST-ed.

If you disable the EEPROM or remove it, the SoC should register an error condition. If there is any visual indication, eg a flashing LED, and if this differs from before, then we could assume that the EEPROM is OK.

[poot36]

@fzabkar I did scope the I2C lines and found it showed activity for about 3.5ms or so.  I can try disabling the chip by pulling one of the lines low through a 100 ohm resistor and see what happens.  I just something, as I just have the bare unit I wonder if it is able to detect that it is not connected to the Ethernet magnetics and that is causing it to go into some sort of error state.  This unit came out of a RFID door lock that is POE powered and connects to a main server over the network cable.  I was told by a coworker that when they went to upgrade the firmware on the unit that it was not showing on the network but when they connected the serial cable to the lock they were able to see the lock position status on their computer indicating that at least some of the electronics were still working.  As far as I can tell the lock electronics are separate from the network electronics and that is why it is partially working.  I think the lock electronics are communicating over serial and all the unit I have does is translate that to a network connection for longer distance connections.

The only indicator lights this unit has are the normal 2 lights on the network jack.  I know the active light blinks about once per seconds and the link light just stays lite.  This is with no network cable connected and no network megnetics as I don't have the rest of the lock electronics here.

[fzabkar]

When there are long cable runs, I have often found that the Tx/Rx transceivers fail or become weak. These runs are subject to ESD and lightning strikes. It's probably clutching at straws, but it may be worth investigating.

[poot36]

@fzabkar The unit is smart enough to not try and drive the I2C bus when either of the pins are pulled low.  It made no change in being able to talk to it over the serial port and the active light still blinks at a rate of once per second.  I also tried pulling the CP5 to 7 pins high or low through a 100 ohm resistor when powering on the unit and trying to get it to go into firmware recovery mode but no change.  I did take a look at the data that the firmware recovery program sends to put the unit into recovery mode and found out it is !DLline feed (the hex character for line feed not the word).  I don't really know where to take it from here.  I think I need to put it back into the lock electronics and see if that changes it's behavior.

[asis]

Hi,

This chip stores the MAC address for connecting to Ethernet.
Most likely it is: 0a.d5.12.7e.4c.08 (0ad5127e4c08).

The IP address is probably stored in the system's HOST profile (or whatever this LAN device is connected to).

Or PING to the IP addresses you see.

[poot36]

Well I got a chance to look at the control board that this Ethernet to serial converter plugged into and found 2 leaking super caps.  No wonder this was not working correctly.  I have removed the caps and cleaned up the electrolyte as best as I can but it is still not working and I think I have made it worse as now the control board is not turning on the 3.3V rail that feeds the converter.  I wonder if the controller has gone into some sort of lock down mode because it thinks that the lock is getting hacked?  I suspect it did not help that at one time I accidentally had my meter set on the milliamps range when I was trying to measure the voltage rails in the unit.  Not sure if this is fixable or not.  I can enable the 3.3V regulator by forcing the enable pin high but it does draw around 30ma at 3.3V when doing this indicating that the main controller chip is pulling that line low and I am fighting the internal circuit inside the controller chip.

[poot36]

Well I took a closer look at the area under the leaking caps with a microscope and found 2 broken traces that carry the main power into parts of the circuit.  I may still be able to fix this.