| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <87zficu8cl.fsf@miraculix.mork.no>
Date: Sun, 23 Feb 2025 13:57:30 +0100
From: Bjørn Mork <bjorn@...k.no>
To: Shengyu Qu <wiagn233@...look.com>
Cc: netdev@...r.kernel.org
Subject: Re: Phy access methods for copper SFP+ disguised as SR
Shengyu Qu <wiagn233@...look.com> writes:
> Maybe rollball protocol?
> https://forum.banana-pi.org/t/sfp-oem-sfp-2-5g-t-kernel-phy/15872/
Thanks, but I already tried adding a sfp quirk enabling Rollball
access. It does not work unfortunately.
Manually testing RollBall still reads the same static eeprom data on
page 3, register 0x80 etc, where we expect the RollBall registers:
* 0x80 1 CMD 0x01/0x02/0x04 for write/read/done
* 0x81 1 DEV Clause 45 device
* 0x82 2 REG Clause 45 register
* 0x84 2 VAL Register value
Page 0:
root@...8cl:~# i2cdump -y 8 0x51
No size specified (using byte-data access)
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 50 00 f6 00 4b 00 fb 00 8c 9f 71 48 88 b8 75 30 P.?.K.?.??qH??u0
10: 1d 4c 01 f4 19 64 03 e8 2b d4 07 46 27 10 09 28 ?L???d??+??F'??(
20: 2b d4 02 85 27 10 03 2c 00 00 00 00 00 00 00 00 +???'??,........
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00 ....??......?...
50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 7e ?...?...?......~
60: 45 49 7f 78 0b b8 13 92 13 92 00 00 00 00 00 00 EI?x??????......
70: 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 ..........@.....
80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31 COUIA8NCAA10-241
90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6 5-03V03 ?.F....?
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa aa ..............??
c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20 SFP-10G-SR
d0: 20 20 20 20 33 32 00 00 00 00 00 00 00 00 00 35 32.........5
e0: 1e 28 2e 2e 31 34 29 36 00 00 00 00 00 00 00 00 ?(..14)6........
f0: 00 00 00 00 00 66 00 00 ff ff ff ff ff ff 29 e3 .....f........)?
Set password:
root@...8cl:~# i2cset -y 8 0x51 0x7b 0xff
root@...8cl:~# i2cset -y 8 0x51 0x7c 0xff
root@...8cl:~# i2cset -y 8 0x51 0x7d 0xff
root@...8cl:~# i2cset -y 8 0x51 0x7e 0xff
Read page 3:
root@...8cl:~# i2cset -y 8 0x51 0x7f 3
root@...8cl:~# i2cdump -y 8 0x51
No size specified (using byte-data access)
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 50 00 f6 00 4b 00 fb 00 8c 9f 71 48 88 b8 75 30 P.?.K.?.??qH??u0
10: 1d 4c 01 f4 19 64 03 e8 2b d4 07 46 27 10 09 28 ?L???d??+??F'??(
20: 2b d4 02 85 27 10 03 2c 00 00 00 00 00 00 00 00 +???'??,........
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00 ....??......?...
50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 7e ?...?...?......~
60: 45 49 80 62 0b b8 13 92 13 92 00 00 00 00 00 00 EI?b??????......
70: 00 00 00 00 00 00 00 00 00 00 40 ff ff ff ff 03 ..........@....?
80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31 COUIA8NCAA10-241
90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6 5-03V03 ?.F....?
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa aa ..............??
c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20 SFP-10G-SR
d0: 20 20 20 20 33 32 00 00 00 00 00 00 00 00 00 35 32.........5
e0: 1e 28 2e 2e 31 34 29 36 00 00 00 00 00 00 00 00 ?(..14)6........
f0: 00 00 00 00 00 66 00 00 ff ff ff ff ff ff 29 e3 .....f........)?
I have another cheap 10GBase-T SFP+ which *is* talking RollBall. I do
not have problems accessing the phy on this. Including it just for
comparison with the above. Page 0 looks similar:
root@...8cl:~# i2cdump -y 5 0x51
No size specified (using byte-data access)
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 50 00 f6 00 4b 00 fb 00 8c a0 75 30 88 b8 79 18 P.?.K.?.??u0??y?
10: 1d 4c 01 f4 19 64 03 e8 4d f0 06 30 3d e8 06 f2 ?L???d??M??0=???
20: 2b d4 00 c7 27 10 00 df 00 00 00 00 00 00 00 00 +?.?'?.?........
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00 ....??......?...
50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 23 ?...?...?......#
60: 23 f7 82 6f 00 00 00 00 00 00 00 00 00 00 82 00 #??o..........?.
70: 05 40 00 00 05 40 00 00 00 00 00 ff ff ff ff 00 ?@..?@..........
80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31 COUIA8NCAA10-241
90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6 5-03V03 ?.F....?
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa aa ..............??
c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20 SFP-10G-SR
d0: 20 20 20 20 32 36 20 20 20 20 20 20 20 20 20 58 26 X
e0: 1e 28 2e 2e 31 34 29 36 00 00 00 00 00 00 00 00 ?(..14)6........
f0: 00 00 00 00 00 66 00 00 ff ff ff ff 00 00 00 00 .....f..........
But switching to page 3 we see the RollBall registers on 0x80 etc:
root@...8cl:~# i2cset -y 5 0x51 0x7f 3
root@...8cl:~# i2cdump -y 5 0x51
No size specified (using byte-data access)
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 50 00 f6 00 4b 00 fb 00 8c a0 75 30 88 b8 79 18 P.?.K.?.??u0??y?
10: 1d 4c 01 f4 19 64 03 e8 4d f0 06 30 3d e8 06 f2 ?L???d??M??0=???
20: 2b d4 00 c7 27 10 00 df 00 00 00 00 00 00 00 00 +?.?'?.?........
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00 ....??......?...
50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 23 ?...?...?......#
60: 28 22 82 58 00 00 00 00 00 00 00 00 00 00 82 00 ("?X..........?.
70: 05 40 00 00 05 40 00 00 00 00 00 ff ff ff ff 03 ?@..?@.........?
80: 04 1e c8 31 00 00 ff ff ff ff ff ff ff ff ff ff ???1............
90: ff ff 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff ff ff ff ff ff 04 00 f0 02 0a ab ..........?.????
Bjørn
Powered by blists - more mailing lists