netdev - Re: Phy access methods for copper SFP+ disguised as SR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID:
 <TYCPR01MB843733E82C89CC35EFE7BE2E98C12@TYCPR01MB8437.jpnprd01.prod.outlook.com>
Date: Mon, 24 Feb 2025 01:53:23 +0800
From: Shengyu Qu <wiagn233@...look.com>
To: Bjørn Mork <bjorn@...k.no>
Cc: wiagn233@...look.com, netdev@...r.kernel.org
Subject: Re: Phy access methods for copper SFP+ disguised as SR

Sorry but I'm not familar with this either. I advice you to ask more
about this under the forum topic.

Best regards,
Shengyu

在 2025/2/23 20:57, Bjørn Mork 写道:
> Shengyu Qu <wiagn233@...look.com> writes:
> 
>> Maybe rollball protocol?
>> https://forum.banana-pi.org/t/sfp-oem-sfp-2-5g-t-kernel-phy/15872/
> 
> Thanks, but I already tried adding a sfp quirk enabling Rollball
> access.  It does not work unfortunately.
> 
> Manually testing RollBall still reads the same static eeprom data on
> page 3, register 0x80 etc, where we expect the RollBall registers:
> 
>   * 0x80     1     CMD       0x01/0x02/0x04 for write/read/done
>   * 0x81     1     DEV       Clause 45 device
>   * 0x82     2     REG       Clause 45 register
>   * 0x84     2     VAL       Register value
> 
> Page 0:
> 
> root@...8cl:~# i2cdump -y 8 0x51
> No size specified (using byte-data access)
>       0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f    0123456789abcdef
> 00: 50 00 f6 00 4b 00 fb 00 8c 9f 71 48 88 b8 75 30    P.?.K.?.??qH??u0
> 10: 1d 4c 01 f4 19 64 03 e8 2b d4 07 46 27 10 09 28    ?L???d??+??F'??(
> 20: 2b d4 02 85 27 10 03 2c 00 00 00 00 00 00 00 00    +???'??,........
> 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
> 40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00    ....??......?...
> 50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 7e    ?...?...?......~
> 60: 45 49 7f 78 0b b8 13 92 13 92 00 00 00 00 00 00    EI?x??????......
> 70: 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00    ..........@.....
> 80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31    COUIA8NCAA10-241
> 90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6    5-03V03 ?.F....?
> a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
> b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa aa    ..............??
> c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20    SFP-10G-SR
> d0: 20 20 20 20 33 32 00 00 00 00 00 00 00 00 00 35        32.........5
> e0: 1e 28 2e 2e 31 34 29 36 00 00 00 00 00 00 00 00    ?(..14)6........
> f0: 00 00 00 00 00 66 00 00 ff ff ff ff ff ff 29 e3    .....f........)?
> 
> 
> Set password:
> 
> root@...8cl:~# i2cset -y 8 0x51 0x7b 0xff
> root@...8cl:~# i2cset -y 8 0x51 0x7c 0xff
> root@...8cl:~# i2cset -y 8 0x51 0x7d 0xff
> root@...8cl:~# i2cset -y 8 0x51 0x7e 0xff
> 
> Read page 3:
> 
> root@...8cl:~# i2cset -y 8 0x51 0x7f 3
> root@...8cl:~# i2cdump -y 8 0x51
> No size specified (using byte-data access)
>       0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f    0123456789abcdef
> 00: 50 00 f6 00 4b 00 fb 00 8c 9f 71 48 88 b8 75 30    P.?.K.?.??qH??u0
> 10: 1d 4c 01 f4 19 64 03 e8 2b d4 07 46 27 10 09 28    ?L???d??+??F'??(
> 20: 2b d4 02 85 27 10 03 2c 00 00 00 00 00 00 00 00    +???'??,........
> 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
> 40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00    ....??......?...
> 50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 7e    ?...?...?......~
> 60: 45 49 80 62 0b b8 13 92 13 92 00 00 00 00 00 00    EI?b??????......
> 70: 00 00 00 00 00 00 00 00 00 00 40 ff ff ff ff 03    ..........@....?
> 80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31    COUIA8NCAA10-241
> 90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6    5-03V03 ?.F....?
> a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
> b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa aa    ..............??
> c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20    SFP-10G-SR
> d0: 20 20 20 20 33 32 00 00 00 00 00 00 00 00 00 35        32.........5
> e0: 1e 28 2e 2e 31 34 29 36 00 00 00 00 00 00 00 00    ?(..14)6........
> f0: 00 00 00 00 00 66 00 00 ff ff ff ff ff ff 29 e3    .....f........)?
> 
> 
> 
> I have another cheap 10GBase-T SFP+ which *is* talking RollBall. I do
> not have problems accessing the phy on this.  Including it just for
> comparison with the above. Page 0 looks similar:
> 
> root@...8cl:~# i2cdump -y 5 0x51
> No size specified (using byte-data access)
>       0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f    0123456789abcdef
> 00: 50 00 f6 00 4b 00 fb 00 8c a0 75 30 88 b8 79 18    P.?.K.?.??u0??y?
> 10: 1d 4c 01 f4 19 64 03 e8 4d f0 06 30 3d e8 06 f2    ?L???d??M??0=???
> 20: 2b d4 00 c7 27 10 00 df 00 00 00 00 00 00 00 00    +?.?'?.?........
> 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
> 40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00    ....??......?...
> 50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 23    ?...?...?......#
> 60: 23 f7 82 6f 00 00 00 00 00 00 00 00 00 00 82 00    #??o..........?.
> 70: 05 40 00 00 05 40 00 00 00 00 00 ff ff ff ff 00    ?@..?@..........
> 80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31    COUIA8NCAA10-241
> 90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6    5-03V03 ?.F....?
> a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
> b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa aa    ..............??
> c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20    SFP-10G-SR
> d0: 20 20 20 20 32 36 20 20 20 20 20 20 20 20 20 58        26         X
> e0: 1e 28 2e 2e 31 34 29 36 00 00 00 00 00 00 00 00    ?(..14)6........
> f0: 00 00 00 00 00 66 00 00 ff ff ff ff 00 00 00 00    .....f..........
> 
> 
> But switching to page 3 we see the RollBall registers on 0x80 etc:
> 
> root@...8cl:~# i2cset -y 5 0x51 0x7f 3
> root@...8cl:~# i2cdump -y 5 0x51
> No size specified (using byte-data access)
>       0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f    0123456789abcdef
> 00: 50 00 f6 00 4b 00 fb 00 8c a0 75 30 88 b8 79 18    P.?.K.?.??u0??y?
> 10: 1d 4c 01 f4 19 64 03 e8 4d f0 06 30 3d e8 06 f2    ?L???d??M??0=???
> 20: 2b d4 00 c7 27 10 00 df 00 00 00 00 00 00 00 00    +?.?'?.?........
> 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
> 40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00    ....??......?...
> 50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 23    ?...?...?......#
> 60: 28 22 82 58 00 00 00 00 00 00 00 00 00 00 82 00    ("?X..........?.
> 70: 05 40 00 00 05 40 00 00 00 00 00 ff ff ff ff 03    ?@..?@.........?
> 80: 04 1e c8 31 00 00 ff ff ff ff ff ff ff ff ff ff    ???1............
> 90: ff ff 00 00 ff ff ff ff ff ff ff ff ff ff ff ff    ................
> a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
> b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
> c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
> d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
> e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
> f0: ff ff ff ff ff ff ff ff ff ff 04 00 f0 02 0a ab    ..........?.????
> 
> 
> 
> 
> Bjørn


Download attachment "OpenPGP_0xE3520CC91929C8E7.asc" of type "application/pgp-keys" (6869 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)