Write ROM Boot State Machine Image Format Decoder / Encoder #13
Labels
No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
bug
documentation
duplicate
enhancement
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Depends on
#1 Rewrite instructions and Patch images
FM10K/rrcSmall
Reference: FM10K/Documentation#13
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
According to FM1000 Datasheet, section 9.7.5 (specifically 9.7.5.1 Image Format, and 9.7.5.3 Instruction Table) the boot image format is documented and has a defined instruction set.
A simple decoder / encoder can be written according to specifications for ease of read of any future image dumps.
1MB image was dumped using direct SPI interface when running the card, through PCIe.
Some info from the header
Seems like it also contains plaintext settings! Maybe this can be used to change boot modes like mgmtPep
FM10K only needs 1MB of the flash, there's a few bytes on the rest of the 8MB of flash after dumping it whole, will check more.
Here's fm10k-dump.c for dumping the SPI NVM without having to compile IES or using Silicom propietary tools, except it requires the FM10K kernel module with UIO enabled.
Maybe we should create a tools repository for these small utilities? @q3k
SPI NVM image of another card, the one that pictures have been taken of.
This has been achieved partially by rrcSmall, currently decoding such images.
Attached is an example of what the program outputs.
It uses a mix of static decoding/analysis and actually trying to execute the state machine partially, and finding new branches to decode.
This is due to not having a static area that contains instructions, and instead being spread across the whole image with just an entrypoint.
Flashed a new image to my FM10K, and it enabled all management system on all ports!
here's the diff applied to original
A new release of fm10k-dump was made that includes fm10k-flash, with such tool a patch made with the diff above can be applied.
I dumped the FM10420QDA2 ROM ,use my workstation with 2X4 +1X8 split options, but ip link only show one , but it can dump flash rom , so I dump it , hope it useful for you
btw ,since I lose connection to freenode time to time , could you tell me howto mod it to enable all management funciton ?
@usefulll nah don't apply the patch for the other cards. Seems like your card has custom boot config to probably make it work by default! I have attached the disassembled version and the diffe between the crads (it's a fairly large diff).
With this I can probably create a better mapping of such settings so cards can be configured to autoboot. At the moment it seems like the card will do either 40GBase-CR4 or 100GBase-CR4 on passive copper DAC only (
api.platform.config.switch.0.portIndex.1.an73Ability text 40GBase-CR4,100GBase-CR4)also @usefulll when possible can you list what it showed when dumping the image?
For example on mine
This contains information on the SPI chip used on the card.
This is considered solved with both fm10k-dump used to dump/flash images, and rrcSmall doing both decoding and encoding, after FM10K/rrcSmall#1 is finished.