#StandWithUkraine

 

BM83 how-to s

Microchip made new module BM83, and finally all configuration make sort of sense :)

if you have your boards with bm83 (or you have one from me) connect module to your computer using usb cable:

download and extract https://ww1.microchip.com/downloads/en/DeviceDoc/IS2083_Turnkey_1.2.0.zip

lets update module with latest firmware

go to IS2083 Turnkey_1.2.0\Tools\isupdate fire up isupdate.exe

1) select port USB HID, baudrate 115200 number of banks: 3, memory type flash ande subtype serial flash

2) hit connect 

3) section "Flash update/dump" select upper browse and browse to IS2083 Turnkey_1.2.0\Software\IS2083 Image\MSPK2v1.3\GFP

4) select all 3 files

5) hit update

6) in popup select if you like to preserve information about paired devices, select what you like :)

7) after update in status window you will have something like "End of Write Memory! Elapsed time: blalbla second"

8) hit disconnect 

9) reset module

how-to change setting on BM83

1) go to IS2083 Turnkey_1.2.0\Tools\Config Tool

2) fire up IS208x_Config_GUI_Tool v1.3.08.exe (hit OK on 1st popup)

3) select MSPKv2_GFP(Google Fast Pair) or _PBAP -> will enable pbap profile, microchip pdf (BM83-Bluetooth-Audio-Development-Board-User-Guide-DS50002902B,pdf) suggest to load is208x_config_default_table.ini from same directory both works, hit edit 

For more info about profiles and supported features check "IS2083/BM83 Bluetooth ® Applications Design Guide/AN3118"

 

4) select host/embedded mode: host=> you are going to use mcu for controlling codec, embedded you are going to use buttons?, correct? I did not test this)

5) press next

6) [Sys Setup1] select power switch typ (mfb or power on directly, or cmd from MCU)

7) [Sys Setup2] CHANGE NAME,bt class of device, report battery status to smartphone (disable if using in some non battery project)

8) [CODEC] speaker output -> read help!, CODEC type->internal!!!! if not using i2s module, disable digital mic if you like to use analog one

9) press finish

10) setup your DSP if you like, i did not play with it :) so I simply closed pop-upped window with dsp configuration

11) hit save, select folder and type nice name for your config, you will need it in second

12) press exit and then press NO!!!

go to IS2083 Turnkey_1.2.0\Tools\isupdate fire up isupdate.exe

1) select port USB HID, baudrate 115200 number of banks: 1, memory type flash and subtype serial flash
2) hit connect
3) section "Flash update/dump" select upper browse and find your previously created config, hit Open and then hit Update
4) in popup select if you like to preserve information about paired devices, select what you like :)
5) after update in status window you will have something like "End of Write Memory! Elapsed time: blalbla second"
hit disconnect, reset module and it should works

 

Arduino library for BM83

and it works with my is2020 library!! 

Module info:BT module name: KOVOBM83

BT module addr: 34:81:F4:75:C8:DD

Paired devices:  

1. 0:0:0:0:0:0

2. 0:0:0:0:0:0

3. 0:0:0:0:0:0

 

Connected state with HP and A2DP profile connected

Disconected!

 

       UART version:  

0

        flash version: 0

          rom version: 0

    flash sub version: 0

flash control version: 0

 

      BT FW version:  

0

        flash version: 0

          rom version: 0

    flash sub version: 0

flash control version: 0

=================================

Device 0info:

A2DP profile signaling channel connected

A2DP profile stream channel connected

AVRCP profile connected

HF profile connected

 

Name: Kovo's S9

Music Status: STOP

Streaming

Battery level dev0: 0/0

current signal strength : 0/0

=================================

Device 1info:

Disconnected

 

Name:  

Music Status: STOP

No stream

Battery level dev0: 0/0

current signal strength : 0/0

Title: Eiffel 65 - Blue (Hardstyle Remix By Team Blue) [MONKEY TEMPO]

Artist: TeknoTimmy

Albun:  

Track: 1

Number of tracks: 1

Genre:  

Duration: 3:1

1:48

....

2:6

Title: Armin Van Buuren - Blah Blah Blah (MeLoX Hardstyle Bootleg)

Artist: MeLoX “MeLoX”

Albun:  

Track: 1

Number of tracks: 1

Genre:  

Duration: 3:30

0:1

......

3:30

Title: Alice Cooper - Poison (Axizz Hardstyle Bootleg) *FREE TRACK*

Artist: DJ Axizz

Albun:  

Track: 1

Number of tracks: 1

Genre:  

Duration: 5:24

0:3

....

 

EDIT: so I bricked my module, or actually uploading firmware over USB bricked it

EDIT2: ok, i fix it, here is

how-to unbrick BM83 module:

 

1) connect usb2serial adapter to pins TX and RX (I use my upload sketch  in stm32 bluepill because for some reason microchip software is detecting it as serial port, for example cp2102 is not detected as com port...), connect ground of adapter to module, connect adapter to computer

2) connect bm83 module pin P3_4 to ground

4) fire up isUpdate, select com port, select baud rate 1152000 and 3 banks, 

3) connect usb cable to module/reconnect it, reset is not working

 

5) hit connect in isUpdate utility

 

6) use browse button in update part of program and select 3 hex image files (for example IS2083 Turnkey_1.2.0\Software\IS2083 Image\MSPK2v1.3\GFP)

 

7)hit update

 

8) give yourself a beer or coffee and wait, for around 118seconds 

 

Easy 2.5" bixenon upgrade for DEPO/VALEO audi a4 b5 facelift headlights

If you like to upgrade your projector assembly in DEPO/VALEO headlights (should works for TYC also) for facelifted Audi A4 B5 for whatever reason here is a simple solution:

you need this 4TL-R 2.5" projector

https://www.aliexpress.com/item/32759121526.html

these are also available from other sources, but I did not test them and can not tell if they are same.
 

https://my.aliexpress.com/wishlist/shared.htm?groupId=100000023931021

and also here:

https://www.theretrofitsource.com/bi-xenon-4tl-r-P-M-4TLR?quantity=1

Next, you need the template for drilling which can be brought from my tindie store:

https://www.tindie.com/products/tomaskovacik/template-for-4tl-r-bixenon-audi-a4-b5-lights/

With this template also comes document with detailed instructions on how to modify the projector to fit. It requires 4holes to be drilled into projector and made few cuts into projector to clear inside of headlights.

Here are some sample pictures:

The adapter bolted to projector prior drilling new mounting holes.

Projector inside DEPO headlight.

 

 

 

Finally inside.

 

Low beams

High beams

 update:

I just use my adapter to insert projector into VALEO(OEM) projectors. Few pictures, from testing it on some broken valeo headlights:

holes are lining up, that is ok

inner parts must be addjust all way to the front glass

projector in the headlight

projector in the headlight

In document which is provided after buying adapter is more detailed process and also link to YT video how to insert the projector into headlight.

fixing wiper motor JL 52372

If your wiper motor in V.A.G. car with part number JL 52372 is continuously running (probably as result you leave it on while blade is frozen to window :) )  most probably the chip inside is fried. If so, nee chip can be sourced on aliexpress: https://www.aliexpress.com/item/32958082771.html . After soldering chip in place, everythings works as it should.

Few pictures from module:

8205 datasheet:  http://file.elecfans.com/web1/M00/89/C6/o4YBAFyLiueATEfcAAvj6BVhw28408.pdf?filename=1527231143785052751.pdf

 

 

REFLASHING BM62 to 2.1.3

https://github.com/tomaskovacik/IS2020/wiki/Upgrading-firmware-on-BM62

P2_0 and P2_4 pulled to ground

EAN pulled high directly to VDD_IO (this is required even that datasheet stated there is pullup!)

22uF cap on VDD_IO (check erata)

5V connected to 5V

gnd to gnd

rx to B10 of stm32

tx to B11 of stm32

power up the module or reset it, both leds will be blinking simultaneously

run isbtflash.exe (BM6x Software & Tools(DSPKv2.1.3)\DSPK v2.1.3 Package\Tools\FlashUpdate Tool)

select com port, speed 115200:240, banks: 16 hit connect

 

browse-> select firmware files (from BM6x Software & Tools(DSPKv2.1.3)\DSPK v2.1.3 Package\Software\Firmware Image\BM64 Firmware yes BM64 als for BM62)

BT5506_SHS_FLASH.H00

BT5506_SHS_FLASH.H01

BT5506_SHS_FLASH.H02

BT5506_SHS_FLASH.H03

BT5506_SHS_FLASH.H04

BT5506_SHS_FLASH.H05

BT5506_SHS_FLASH.H06

BT5506_SHS_FLASH.H07

BT5506_SHS_FLASH.H08

BT5506_SHS_FLASH.H09

BT5506_SHS_FLASH.H10

BT5506_SHS_FLASH.H11

BT5506_SHS_FLASH.H12

BT5506_SHS_FLASH.H13

BT5506_SHS_FLASH.H14

BT5506_SHS_FLASH.H15

hit update button

 

after the update, remove the jumper from P2_4, hit reset, both LEDs will light solid

 

EEPRom_tool.exe reports module as IS2064S_012_SPK02_V2.1_BETA which is probably ROM firmware, not one in flash, but this is not important.

 

Run isUpdate.exe, select com port, baudrate 115200:240, memory: eeprom and subtype: default, hit connect.

 

Using browse button in "Flash/EEPRom/MCU/AHB Access" find MCHP_DSPKv2.1.3_BM62_StandAlone

hit write table

 

after write  is successful, remove jumper from ENA pin and disconnect power from module, then connect it back, it will boot with both LEDs light up but

EEPRom_tool.exe will report module as IS206X_012_DUALMODESPK2.1_E1.0, now you can update eeprom with your configuration or one from my kicad-library, write new eeprom:

 

Do not forget check "Load default in into IP" on third screen of MPET.exe when generating eeprom (consult BM62 dev board datasheet from microchip website)

code for stm32:

#define BLUETOOTH_EEPROM_UPLOAD PA4 //goes to P2_0
#define BLUETOOTH_FLASH_UPLOAD PA5 //goes to P2_4
#define BLUETOOTH_EAN PA6 //goes to EAN
#define BLUETOOTH_RESET PB14

void setup() {
  Serial.begin(115200);
  Serial3.begin(115200); //Serial3 => TX = PB10, RX = PB11
//  pinMode(BLUETOOTH_EEPROM_UPLOAD, OUTPUT);
//  digitalWrite(BLUETOOTH_EEPROM_UPLOAD, LOW);
//  pinMode(BLUETOOTH_FLASH_UPLOAD, OUTPUT);
//  digitalWrite(BLUETOOTH_FLASH_UPLOAD, LOW);
//  pinMode(BLUETOOTH_RESET, OUTPUT);
//  digitalWrite(BLUETOOTH_RESET, LOW);
  delay(100);
  digitalWrite(BLUETOOTH_RESET, HIGH);
}

void loop() {
//  Serial.println("Start\nsending 0x0120fc00:");
//  delay(1000);
//  Serial3.write(0x01);
//  Serial3.write(0x20);
//  Serial3.write(0xFC);
//  Serial3.write(0x00);
//  Serial.println("responce:");
//  while (Serial3.available()) {    // If anything comes in Serial1 (pins 0 & 1)
//    Serial.write(Serial3.read());   // read it and send it out Serial (USB)
//  }
//  delay(1000);
  while (1) {
    if (Serial3.available()) {    // If anything comes in Serial1 (pins 0 & 1)
      Serial.write(Serial3.read());   // read it and send it out Serial (USB)
    }
    if  (Serial.available()) {     // If anything comes in Serial (USB),
      Serial3.write(Serial.read());   // read it and send it out Serial1 (pins 0 & 1)
    }
  }
  //delay(100);
}

Fixing AcceleDent Aura

Battery with same dimensions and same capacity for the unit can be found here: https://www.aliexpress.com/item/32820495056.html

 

If your unit stops working and the LED Indicator is flashing alternating green and orange it means that you reach some stupid hardcoded lifetime of unit. Check FAQ on https://acceledent.com/faq/:

There is only one correct response to this if you pay 1000euros for this unit:

Open it, desolder Microchip SPI EEPROM 25LC1024, then use Arduino with this sketch to dump content and then another sketch to clear the whole EEPROM. Solder it back and the unit is again working. My dump is saved here.

connecting JTAG to BK8000L

from datasheet of BK3254 bluetooth module, we know that CPU is BA22, there is posibility that cpu in bk8000L is the same, so I searched "ba22 openocd" and found this post:

https://alephsecurity.com/2019/07/15/xiaomi-zigbee-3/

from which I take jtag HW and SW part

jtag HW and SW part

JTAG HW:
 FT232H usb module: https://www.aliexpress.com/item/33052982174.html

SW: https://github.com/alephsecurity/BA2-toolchain (jtag-r34432.tar.xz)

patch for generic FT232H board

 open ftdi_driver.c

and add this line to ftdi_driver.c file

{ 0x0403, 0x6014, NULL, NULL, l_amontec_jtagkey2, 0 },

/* vendor, product, name pairs of supported devices */
struct ftdi_device_desc supported_devs[] = {
    { 0x0403, 0x6010, "Beyond", "Debug Key", l_beyond_debug_key_v1_2, 0 },          // Beyond Debug Key
    { 0x0403, 0x6010, "Beyond", "Debug Hub", l_beyond_debug_key_v1_1, 0 },          //   (eng. sample 2)
    { 0x0403, 0x6010, "Beyond", "JTAG Adapter", l_beyond_debug_key_v1_0, 0 },       //   (eng. sample 1)
    { 0x0403, 0xcff8, "Amontec", NULL, l_amontec_jtagkey2, 0 },                     // Amontec jtagkey/jtagkey2
    { 0x15ba, 0x002a, NULL, NULL, l_olimex_armusb, 0 },                             // Olimex arm-usb-tiny-h
    { 0x15ba, 0x002b, NULL, NULL, l_olimex_armusb, 0 },                             // Olimex arm-usb-ocd-h"
    { 0x15ba, 0x0004, NULL, NULL, l_olimex_armusb, 0 },                             // Olimex arm-usb-tiny"
    { 0x15ba, 0x0003, NULL, NULL, l_olimex_armusb, 0 },                             // Olimex arm-usb-ocd"
    { 0x0403, 0x6010, "Digilent", "Digilent Adept USB Device", l_digilent_hs1, 0 }, // Digilent hs1 ("adept")
    { 0x0403, 0xac09, "Atomic", NULL, l_amontec_jtagkey, 0 },                       // Atomic programming AP-114 (same layout as Amontec)
    { 0x0403, 0x8220, "DISTORTEC", "JTAG-lock-pick Tiny 2", l_lockpick2, 1 },       // JTAG-lock-pick Tiny 2
{ 0x0403, 0x6014, NULL, NULL, l_amontec_jtagkey2, 0 },
    { 0, 0 }
};

Connecting JTAG to BK8000L

AD0    TCK
AD1    TDI
AD2    TDO
AD3    TMS
AD5    /SRST

(https://www.tiaowiki.com/w/TIAO_USB_Multi_Protocol_Adapter_Lite_User%27s_Manual#20_PIN_JTAG_Connector) 

then short SCLK and SO pin on external flash, so CPU cant start up, plug FT232H adapter to USB and fire up jtag sw:

update: starting jp3 shortly after releasing RESET button does the trick also ... 

 nail@sid:~/tmp/jtag_ba22$ ./jp3 ftdi jtag://localhost:1234 -t15M
jp3: JTAG protocol via USB/parallel port for linux.
Version 1.6.3
Assuming debug_if's TAP has an IDCODE of 0x14951185.
Using 'FTDI Single RS232-HS (?)' interface.
Enabling high speed ftdi mode.
Using JTAG clock of 15 MHz
Disabling UART not supported/required on this adapter.
JTAG chain length: 1
Found device 0 (IDCODE: 14951185) to have a debug_if connected to it
  Debug interfaces(s) detected: if3
  Using debug interface 3.
Processor version: BA22 v5.2.2
  Memory interface for debuggers: yes
Remote ba debugging using jtag://localhost:1234
Press CTRL+c to exit.

OPENOCD

nail@sid:~/tmp/jtag_ba22$ openocd -f interface/ftdi/um232h.cfg -c "adapter_khz 100" -c " transport select jtag"
Open On-Chip Debugger 0.10.0+dev-00936-g0a13ca1-dirty (2019-10-07-08:06)
Licensed under GNU GPL v2
For bug reports, read
    http://openocd.org/doc/doxygen/bugs.html
adapter speed: 100 kHz

jtag
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : clock speed 100 kHz
Warn : There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
Info : JTAG tap: auto0.tap tap/device found: 0x14951185 (mfg: 0x0c2 (Flextronics (Orbit Semiconductor)), part: 0x4951, ver: 0x1)
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x14951185"
Error: IR capture error at bit 2, saw 0x3FFFFFFFFFFFFFF5 not 0x...3
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined

 small update: 


so I have few minutes while eating my lunch:


https://www.beyondsemi.com/25/beyond-ba22-de-deeply-embedded-processor/#tab3
-> GCC
https://www.beyondsemi.com/86/beyondstudio-integrated-development-environment/

• GCC 4.9.2
• Binutils 2.24
• GDB 7.8,1
  
• Newlib C library 2.1.0

so I created account and requested access to beyond studio

GCC is GPL, so it one of these applies:

 - processor supported in upstream

 - they must give as patch

Beyond Debug Key Leaflet on site: https://www.beyondsemi.com/beyond-debug-key/#tab2

give as some hints, but I do not have time to play with it

Performance
Transfer rate in excess of 600 kB/s
30MHz maximum JTAG clock

....


SW was something special for BA22:  https://github.com/alephsecurity/BA2-toolchain
there are patches for gcc and other utils .....  anyone to take look?



then I go back to original site where It all started:
https://alephsecurity.com/2019/07/15/xiaomi-zigbee-3/
and previous post:
https://alephsecurity.com/2019/07/09/xiaomi-zigbee-2/


I installed radare2 pyba2 and run ti against bk8000l.bin, but I never use it so, I only try what I find on net :)


git clone https://github.com/radareorg/radare2
cd radare2 ; sys/install.sh
r2pm init
r2pm -i lang-python

git clone https://github.com/alephsecurity/pyba2
cd pyba2

r2 -I ba2r2.py BK8000L

in radare2:

aaaa -AA
v