Thread by @KWF

One of my nice friends at @henet gave me a dead 100G-LR4 optic to tear apart for your entertainment, so... let's get entertained! 🧵

100G-LR4 is a QSFP28 optic that runs over a duplex pair of single mode fiber, so it takes 4 lanes of 25G from the switch, modulates 4 different colors of light, and combines them together over a single strand to the other end up to 10km away.

First comes off the ejection bail.

I guess we're committed now...

Two tiny screws get us into the case. The grey putty stuff is thermal gap filler, which couples each part that puts off heat to the case for cooling.

Think of it like thermal paste, but it's designed to be thick and span a gap instead of just be a thin film.

Lifting the electrical assembly out of the other half of the metal case, we can start pointing out the major points of interest.

TOSA/ROSA - transmit/recv optical sub assemblies are where the laser magic happen.

The retimers help 4x25G get to the switch via the QSFP connector

The TOSA and ROSA both need to handle four wavelengths of light moving 25G each, so they're actually connected to the PCB with two layers of ribbon cables. One of the ribbons is just for the 4x25G and the other is for power, biasing, etc, not high speed stuff to run the OSA parts

Looking on the other side of the whole assembly, the largest IC in the middle is the microcontroller that talks to the switch over an I2C bus to report telemetry and ID information, and pretty much everything else is voltage regulation.

And that microcontroller that runs the whole show is... a Cortex M3! An STM32F103C6 with 32kB of flash, 10kB of SRAM, and can run at up to 72MHz.

Meaning that this optic has more compute power than many early home computers.

The reason that some of the ICs are silver is because they save the expense of the black plastic packaging by just cutting up the wafer, flipping it over, and soldering the die directly to the PCB.

I still think flip-chip packaging is wild.

Remember how I said the rest of the parts were mostly voltage regulation?

Voltage regulators usually need some kind of inductance... so just saying... prime cute coil of wire opportunity.

While it's fun to think about malware on the ARM core in these, the data path is WAY faster than the Cortex M3 can handle.

Something something @mycoliza doesn't need to update their threat model something something.

Granted, the firmware on optics *IS* field writable. I've coordinated with an optics vendor in the past to help a customer apply a firmware patch to optics installed in Arista switches in the field by issuing write commands over the I2C bus from EOS.

So this is where things get REAL ugly... when we break out the Dremel and cut the lid off the TOSA (Transmit Optical Sub Assembly)

Remember that while there's four different waves for the four 25Gbps streams, they all need to make it out a single strand of fiber, so... PRISMS.

So a bit of a rough guess here, but all four beams of light need to get out the lens on the left!

Taking a closer look under a microscope, we can start to pick up some of the finer details in the TOSA.

For one thing, we see a tiny square and two bond wires landing on the platform holding the lasers and the first stage of the optics.

This is a silicon diode. Fun diode fact: the junction voltage of a diode changes with temperature.

The reason that you need to measure the temperature of this little platform is because the freaking platform is temperature controlled.

The platform sits on a peltier cooler, and the controller passes current through it to keep the lasers at a stable temperature to prevent drift

FYI, a peltier cooler is like a solid state heat pump. Pass current one way, and it moves heat up, move current the other way, move heat down. en.wikipedia.org/wiki/Thermoele…

The ROSA is less interesting. The right half seems to be a giant prism.

The glassy fractures on it are from me trying to pry it out.

The four receive diodes on the left are facing up, so the final stage of the ROSA optics were glued as a bridge with four little lenses and a right angle PRISM!

For good measure, here's some more close-ups of the PCB as well.

@chardane OF COURSE YOU LIKED THE TWEET WHERE I MENTIONED THE DIODES