netdev - bnxt_en: Invalid data read from SFP EEPROM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <ED8A7112-D31F-4C4F-94AB-0F0D0DD5DDE6@avride.ai>
Date: Fri, 25 Apr 2025 15:33:33 +0300
From: Kamil Zaripov <zaripov-kamil@...ide.ai>
To: Linux Netdev List <netdev@...r.kernel.org>
Subject: bnxt_en: Invalid data read from SFP EEPROM

Hi all,

I’m seeing corrupted EEPROM data when reading an Intel E10GSFPSRX SFP module plugged into a Broadcom BCM57502 NIC (bnxt_en driver). The same module gives correct EEPROM content when connected to Intel E810 (ice driver) or connected directly to the CPU through I2C controller. So probably the issue is specific to BCM57502 + bnxt_en + firmware combination.

Output below shows corrupted dump vs correct dump:

# BCM57502 + bnxt_en (corrupted)
$ sudo ethtool -m enP2s1f1np1 hex on
Offset		Values
------		------
0x0000:		03 00 f3 00 58 00 f8 00 90 88 71 48 8c a0 75 30
0x0010:		19 64 07 d0 18 6a 09 c4 27 10 09 d0 1f 07 0c 5a
0x0020:		27 10 00 64 1f 07 00 9e 00 00 00 00 00 00 00 00
0x0030:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0040:		00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00
0x0050:		01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 a3
0x0060:		1f 94 83 f9 0b d5 16 81 00 15 00 00 00 00 32 00
0x0070:		00 40 00 00 00 40 00 00 ff ff ff ff ff ff ff 01
0x0080:		5d 01 01 01 01 01 03 04 07 10 00 00 00 00 00 00
0x0090:		00 06 67 00 00 00 08 03 00 1e 46 49 4e 49 53 41
0x00a0:		52 20 43 4f 52 50 2e 20 20 20 00 00 90 65 46 54
0x00b0:		4c 58 38 35 37 31 44 33 42 43 4c 20 20 20 41 20
0x00c0:		00 20 03 52 00 48 00 1a 00 00 41 50 4b 31 45 48
0x00d0:		30 20 20 20 20 20 20 20 20 20 31 33 30 35 31 34
0x00e0:		20 20 68 f0 03 cd 00 00 00 00 00 00 00 00 00 00
0x00f0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

# E810 + ice (correct)
$ sudo ethtool -m ens102f0np0 hex on
Offset		Values
------		------
0x0000:		03 04 07 10 00 00 00 00 00 00 00 06 67 00 00 00
0x0010:		08 03 00 1e 49 6e 74 65 6c 20 43 6f 72 70 20 20
0x0020:		20 20 20 20 00 00 1b 21 46 54 4c 58 38 35 37 34
0x0030:		44 33 42 4e 4c 2d 49 54 41 20 20 20 03 52 00 89
0x0040:		00 1a 00 00 41 34 31 41 53 59 4b 20 20 20 20 20
0x0050:		20 20 20 20 32 30 30 37 30 36 20 20 68 f0 05 e4
0x0060:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0070:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0080:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0090:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00a0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00b0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00c0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00d0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00e0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00f0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0100:		5d 00 f3 00 58 00 f8 00 90 88 71 48 8c a0 75 30
0x0110:		19 64 07 d0 18 6a 09 c4 27 10 09 d0 1f 07 0c 5a
0x0120:		27 10 00 64 1f 07 00 9e 00 00 00 00 00 00 00 00
0x0130:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0140:		00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00
0x0150:		01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 a3
0x0160:		23 56 85 e0 10 f8 16 94 00 15 00 00 00 00 32 00
0x0170:		00 40 00 00 00 40 01 00 ff ff ff ff ff ff ff 01
0x0180:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0190:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x01a0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x01b0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x01c0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x01d0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x01e0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x01f0:		00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Problems with the BCM57502 + bnxt_en output:
- Bytes 0x14-0x23 should contain [49 6e 74 65 6c 20 43 6f 72 70 20 20 20 20 20 20] (ASCII string “Intel Corp       “), but instead contains [18 6a 09 c4 27 10 09 d0 1f 07 0c 5a 27 10 00 64] which is not valid ASCII string.
- Diagnostic part (0x0100-x01f0) is missing, probably because 0x5c byte in first part is 0x00.
- Bytes 0x001-0x05f in BCM57502 + bnxt_en output is the same as bytes 0x101-0x15f from Intel E810 + ice output.
- Other bytes look like garbage, but this garbage persists between request, different SFP modules and different ports where modules inserted.

Given all that facts probably there is an issue between bnxt_en driver and BCM57502 firmware in I2C commands propagation interface.

Is there someone who can help me to find out where is the issue? The only bug that I find in code is that bnxt_read_sfp_module_eeprom_info do not fill bank_number field of the struct hwrm_port_phy_i2c_read_input, but it is not relevant for my case.

Kamil.