EEVblog® Electronics Community Forum
Electronics => Projects, Designs, and Technical Stuff => Topic started by: pappkopp on December 11, 2013, 07:00:24 am
-
Hello!
I picked up an software bricked firewall from SonicWALL.
I opened it up and i saw that it used standard ATx Pc components, so i am wondering if it can be hacked to run custom firmware?
(http://i.imgur.com/7w2XqLNh.jpg) (http://imgur.com/a/1He14/embed)
I have the standard hacking tools: Jtag, TTL, Serial etc. Can this be done? I tried to mount the flash card to my workstation but it won't. because it has some kind of bad blocks or something, i think its locked or what?
Ive hocked it up to an videocard, please see the images!
I can provide all the information possible!!
The images are here:
http://imgur.com/a/1He14/embed (http://imgur.com/a/1He14/embed)
Kind Regards.
-
Do you have any info on the CPU and other hardware on it?
-
What happens if you swap the CompactFlash card with one that has a LiveUSB distro installed on it?
-
I will go to the store as soon as i get the time, regarding the flash card. Pick up a new one if no one got an suggestion for mounting the drive on my WorkStation (Linux or Windows tools will do)
Regarding the CPU i don't know anything. I'm gonna pop off the heat-sink if i can't get the flash card to boot.
Regards
-
It shouldn't be much trouble to get a Linux distro booting off those.
It's got hardware crypto of some sort, too.
-
If it got some kind of hardware encryption, then tell me how to get past that feature? or even explain it
Personally i only think that the BIOS has like a feature where it verify's the content of the flash card.
-
If it got some kind of hardware encryption, then tell me how to get past that feature? or even explain it
Personally i only think that the BIOS has like a feature where it verify's the content of the flash card.
Uh, as in a crypto engine..
-
Put a PCI graphics card in there with no bracket, see if you get output or POST - If you can enter the BIOS and see boot options then might be halfway there :)
What flash chip is the PLCC BIOS? Is that a AMI sticker I see on it, looks like a normal x86 686 BIOS sticker.
If the BIOS is locked out or has minimal features I can edit/add functions, if you can get a dump.
-
Hmm.. Where do i find a reader with that socket that fits? I've cleared the BIOS via using the on-board header. That did not change how the computer boot.
Regarding the PCI video card:
http://imgur.com/a/1He14/embed#11 (http://imgur.com/a/1He14/embed#11)
The only thing i get on the monitor is some FreeDOS thing.. If i remove the flash card it won't even power up the fans. I am about to buy an compact flash card and install some embedded Linux on it. But i bet there is an checksum or something in that way on the orginal flash card.
Kind Regards
-
Looks to be searching for C:\command.com.
Probably why its bricked.
Just get a compact flash card and reader and put linux on it.
I doubt you need to worry about signed images etc.
-
Just get a compact flash card and reader and put linux on it.
I doubt you need to worry about signed images etc.
Yeah, i have an compact disk reader. But when i connect it to my reader it won't mount under any circumstances, when i see the debug message on my Linux system it whines about bad sectors and I/O errors. Therefore no mounting for that card (would be fun to see the contents of it tho)
I will hook up an flash card as soon as possible,. I will keep you guys updated :):)
Kind Regards
-
The good news is that you seem to have a relatively standard x86 PC.
The bad news is that the rubbish after the "Kernel: allocated ..." line suggests the files on the CF are corrupted.
Have you tried accessing the BIOS setup? Or booting from a USB drive?
Note that the CF interface is essentially EIDE, so if you have an adapter you could try hooking up a regular hard drive to it.
-
Just get a compact flash card and reader and put linux on it.
I doubt you need to worry about signed images etc.
Yeah, i have an compact disk reader. But when i connect it to my reader it won't mount under any circumstances, when i see the debug message on my Linux system it whines about bad sectors and I/O errors. Therefore no mounting for that card (would be fun to see the contents of it tho)
I will hook up an flash card as soon as possible,. I will keep you guys updated :):)
Kind Regards
Don't mount it, try ddrescue instead.
-
Nice to see video output :D
Do you get a post screen? have you tried F1, F2, other F keys and Del when powering on to get in to a setup?
You need a PLCC to DIP adapter for your programmer, if you haven't got a programmer I love the TL866A at the moment. It's become my main programmer.
Hmm.. Where do i find a reader with that socket that fits? I've cleared the BIOS via using the on-board header. That did not change how the computer boot.
Regarding the PCI video card:
http://imgur.com/a/1He14/embed#11 (http://imgur.com/a/1He14/embed#11)
The only thing i get on the monitor is some FreeDOS thing.. If i remove the flash card it won't even power up the fans. I am about to buy an compact flash card and install some embedded Linux on it. But i bet there is an checksum or something in that way on the orginal flash card.
Kind Regards
-
Remove flash card and see if any POST Video output or try removing the battery and boot with no flash card! It might load to CMOS defaults and allow you in to setup hopefully :D it might need to be left on a while, the OS probably controls fan speed as it boots, though if you do not get POST the bios might not have code to initialise the display adaptor... A few SATA connectors there too, try removing the flash card and making a USB boot disk with Rufus?
-
I tried with an Flash card, but no boot.
There is an Via Chipset on the board, VIA VT1211
Datasheet: http://www.hardwaresecrets.com/datasheets/vt1211.pdf (http://www.hardwaresecrets.com/datasheets/vt1211.pdf)
Info: http://www.via.com.tw/en/products/peripherals/super-io/ (http://www.via.com.tw/en/products/peripherals/super-io/)
Hackable? i think so?
-
Please try with no flash card and wait for post, or keep hitting keys to get in BIOS.
Via is only Super IO chip? not the main chipset, what do you intend to do with the Via chip?
-
Update:
I have tried to boot from a FreeDOS image, but it don't want to work with me. |O :--
Also there is no BIOS button i can press ( yes i have tried all the standard ones)
Regarding the VIA chip, isn't that the Disk Controller?
Kind Regards, and keep up the good work :=)
-
Regarding the VIA chip, isn't that the Disk Controller?
No.. did you read the datasheet you posted?
-
Regarding the VIA chip, isn't that the Disk Controller?
No.. did you read the datasheet you posted?
I guess that the "Floppy disk" is under the genre of Compact flash disk?
-
Regarding the VIA chip, isn't that the Disk Controller?
No.. did you read the datasheet you posted?
I guess that the "Floppy disk" is under the genre of Compact flash disk?
Guessing won't get you very far.
-
Compact flash is IDE not a floppy controller.
-
Regarding the VIA chip, isn't that the Disk Controller?
No.. did you read the datasheet you posted?
I guess that the "Floppy disk" is under the genre of Compact flash disk?
Guessing won't get you very far.
This forum needs a like button :)
-
Just get a compact flash card and reader and put linux on it.
I doubt you need to worry about signed images etc.
Yeah, i have an compact disk reader. But when i connect it to my reader it won't mount under any circumstances, when i see the debug message on my Linux system it whines about bad sectors and I/O errors. Therefore no mounting for that card (would be fun to see the contents of it tho)
I will hook up an flash card as soon as possible,. I will keep you guys updated :):)
Kind Regards
If that flash card has bad sectors, you very likely have corruption.
-
I've just acquired one of these devices, and have spent a little time trying to reverse engineer it.
I took a slightly different approach to video output to the OP, and just soldered a VGA socket into the unpopulated spot on the MB - works fine.
Major problem is I have not been able to get into the BIOS at all, have rebooted many times and pressed all manner of keys - nada.
This is what it says on boot up:
Validating firmware CRC...
CKIMAGES v2.1
Validating files...
CRC is valid.
Booting into firmware…
LINLD v0.97
Kernel command line:
root=/dev/ram0 rw console=ttyS1,115200 ramdisk_size=163840 ide=nodma
Decompressing Linux... Parsing ELF... done .
Booting the kernel .
It appears to boot into FreeDOS, which then loads Linux. It is possible to interrupt the boot process and explore from a FreeDOS prompt, but I haven't found out much. Very limited range of FreeDOS commands available.
I have extracted the BIOS flash rom (a 39sf040) and dumped it using an Arduino lash-up, but I don’t know what to do next - what format should I save the data as, and what utilities can I use to manipulate the BIOS, if any?
All help gratefully received.
Hi-res photos of the board, BIOS dump and boot photos here:
https://drive.google.com/open?id=1WMaan81lUdivlR2-s8uoYmRYDbtQXcHQ
Cheers
Tim
-
I have extracted the BIOS flash rom (a 39sf040) and dumped it using an Arduino lash-up, but I don’t know what to do next - what format should I save the data as, and what utilities can I use to manipulate the BIOS, if any?
All help gratefully received.
Hi-res photos of the board, BIOS dump and boot photos here:
https://drive.google.com/open?id=1WMaan81lUdivlR2-s8uoYmRYDbtQXcHQ
Cheers
Tim
The ROM is probably not compressed at all but you can try running binwalk on it to see what comes up.
I tried the link but it's not open access.
-
Try this link:
https://drive.google.com/drive/folders/1WMaan81lUdivlR2-s8uoYmRYDbtQXcHQ?usp=sharing
Problem is I have no idea what the format of the rom file should be.
-
I converted it to a binary file and ran binwalk and strings on it.
Binwalk didn't detect anything except a couple of false positives of compression. I've attached the entropy graph. You can clearly see the middle section is compressed or encrypted, and there is a section to the right that is probably code.
Strings was more useful. Here's what I found:
AMIBIOSC08003
...
DIMM0
BANK0
DIMM1
BANK1
AGP
PCI1
AMIBOOT ROM
…
ROMf
000u%f
ROMf
000f
…
$$CT
BootBlock SIO Table
SIO Register
Value
` a
$@&@(
$BCS
$BTSSWCOB202
08/05/09
What I'm seeing is an AMI BIOS from 2009.
-
Yes, it looks like the file format for this type of data is just a simple 512k binary dump - I was expecting something more complicated like IntelHex or whatever, but it appears that is not the case. So happily running amibcp and mmtool now, trying to work out why the BIOS User interface does not appear :-(
-
Update: I discovered that inserting a bootable USB, and pressing F3 on boot, a selection screen appears and the bootable USB can be chosen.
This only occurs if the (working) Sonicwall CF card is inserted. If the card isn't present, the device won't boot at all.
Anyway, booting into a FreeBSD LiveCD (all I had on hand) gives the following dmsg and pciconf -lvc outputs:
---<<BOOT>>---
Copyright (c) 1992-2019 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 12.1-RELEASE r354233 GENERIC i386
FreeBSD clang version 8.0.1 (tags/RELEASE_801/final 366581) (based on LLVM 8.0.1)
VT(vga): resolution 640x480
CPU: VIA C7 Processor 1800MHz (1795.55-MHz 686-class CPU)
Origin="CentaurHauls" Id=0x6d0 Family=0x6 Model=0xd Stepping=0
Features=0xa7c9bbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,CMOV,PAT,CLFLUSH,ACPI,MMX,FXSR,SSE,SSE2,TM,PBE>
Features2=0x4181<SSE3,EST,TM2,xTPR>
AMD Features=0x100000<NX>
VIA Padlock Features=0xffcc<RNG,AES,AES-CTR,SHA1,SHA256,RSA>
real memory = 2147483648 (2048 MB)
avail memory = 2004865024 (1911 MB)
Event timer "LAPIC" quality 100
ACPI APIC Table: <080509 APIC1155>
arc4random: no preloaded entropy cache
ioapic0 <Version 0.3> irqs 0-23 on motherboard
ioapic1 <Version 0.3> irqs 24-47 on motherboard
Timecounter "TSC" frequency 1795549724 Hz quality 800
random: entropy device external interface
kbd1 at kbdmux0
[ath_hal] loaded
module_register_init: MOD_LOAD (vesa, 0x14d9fb0, 0) error 19
random: registering fast source VIA Nehemiah Padlock RNG
random: fast provider: "VIA Nehemiah Padlock RNG"
nexus0
vtvga0: <VT VGA driver> on motherboard
cryptosoft0: <software crypto> on motherboard
acpi0: <080509 RSDT1155> on motherboard
acpi0: Power Button (fixed)
cpu0: <ACPI CPU> on acpi0
attimer0: <AT timer> port 0x40-0x43 irq 0 on acpi0
Timecounter "i8254" frequency 1193182 Hz quality 0
Event timer "i8254" frequency 1193182 Hz quality 100
atrtc0: <AT realtime clock> port 0x70-0x71 irq 8 on acpi0
atrtc0: registered as a time-of-day clock, resolution 1.000000s
Event timer "RTC" frequency 32768 Hz quality 0
Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
agp0: <VIA 3364 (P4M900) host to PCI bridge> on hostb0
agp0: aperture size is 128M
device_attach: ioapic0 attach returned 6
pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
pci1: <ACPI PCI bus> on pcib1
vgapci0: <VGA-compatible display> mem 0xf8000000-0xfbffffff,0xfd000000-0xfdffffff irq 16 at device 0.0 on pci1
vgapci0: Boot video device
pcib2: <ACPI PCI-PCI bridge> irq 27 at device 2.0 on pci0
pci2: <ACPI PCI bus> on pcib2
pcib3: <ACPI PCI-PCI bridge> irq 31 at device 3.0 on pci0
pci3: <ACPI PCI bus> on pcib3
em0: <Intel(R) PRO/1000 Network Connection> port 0xcc00-0xcc3f mem 0xfcfe0000-0xfcffffff,0xfcfc0000-0xfcfdffff irq 21 at device 8.0 on pci0
em0: Invalid MAC address
em0: IFDI_ATTACH_PRE failed 5
device_attach: em0 attach returned 5
em0: <Intel(R) PRO/1000 Network Connection> port 0xc880-0xc8bf mem 0xfcf80000-0xfcf9ffff,0xfcf60000-0xfcf7ffff irq 20 at device 9.0 on pci0
em0: Invalid MAC address
em0: IFDI_ATTACH_PRE failed 5
device_attach: em0 attach returned 5
pci0: <encrypt/decrypt, network/computer crypto> at device 10.0 (no driver attached)
atapci0: <VIA ATA controller> port 0xc800-0xc807,0xbc00-0xbc03,0xb880-0xb887,0xb800-0xb803,0xb480-0xb48f mem 0xfcf3fc00-0xfcf3ffff irq 21 at device 15.0 on pci0
ata2: <ATA channel> at channel 0 on atapci0
ata3: <ATA channel> at channel 1 on atapci0
atapci1: <VIA ATA controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xfc00-0xfc0f at device 15.1 on pci0
ata0: <ATA channel> at channel 0 on atapci1
ata1: <ATA channel> at channel 1 on atapci1
uhci0: <VIA 83C572 USB controller> port 0xb000-0xb01f irq 20 at device 16.0 on pci0
uhci0: LegSup = 0xa000
usbus0 on uhci0
uhci1: <VIA 83C572 USB controller> port 0xb080-0xb09f irq 22 at device 16.1 on pci0
uhci1: LegSup = 0xa000
usbus1 on uhci1
uhci2: <VIA 83C572 USB controller> port 0xb400-0xb41f irq 21 at device 16.2 on pci0
uhci2: LegSup = 0xa000
usbus2 on uhci2
ehci0: <VIA VT6202 USB 2.0 controller> mem 0xfcf3f800-0xfcf3f8ff irq 22 at device 16.4 on pci0
usbus3: EHCI version 1.0
usbus3 on ehci0
isab0: <PCI-ISA bridge> at device 17.0 on pci0
isa0: <ISA bus> on isab0
acpi_button0: <Sleep Button> on acpi0
pcib4: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci4: <ACPI PCI bus> on pcib4
pcib5: <ACPI PCI-PCI bridge> at device 0.0 on pci4
pci5: <ACPI PCI bus> on pcib5
em0: <Intel(R) PRO/1000 Network Connection> port 0xec00-0xec1f mem 0xfebe0000-0xfebfffff irq 16 at device 0.0 on pci5
em0: Invalid MAC address
em0: IFDI_ATTACH_PRE failed 5
device_attach: em0 attach returned 5
pcib6: <ACPI PCI-PCI bridge> at device 0.1 on pci4
pci6: <ACPI PCI bus> on pcib6
em0: <Intel(R) PRO/1000 Network Connection> port 0xdc00-0xdc1f mem 0xfeae0000-0xfeafffff irq 16 at device 0.0 on pci6
em0: Invalid MAC address
em0: IFDI_ATTACH_PRE failed 5
device_attach: em0 attach returned 5
acpi_button1: <Power Button> on acpi0
uart1: <16550 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
atkbdc0: non-PNP ISA device will be removed from GENERIC in FreeBSD 12.
ppc0: parallel port not found.
est0: <Enhanced SpeedStep Frequency Control> on cpu0
Timecounters tick every 1.000 msec
usbus0: 12Mbps Full Speed USB v1.0
usbus1: 12Mbps Full Speed USB v1.0
usbus2: 12Mbps Full Speed USB v1.0
ugen0.1: <VIA UHCI root HUB> at usbus0
uhub0: <VIA UHCI root HUB, class 9/0, rev 1.00/1.00, addr 1> on usbus0
ugen1.1: <VIA UHCI root HUB> at usbus1
uhub1: <VIA UHCI root HUB, class 9/0, rev 1.00/1.00, addr 1> on usbus1
ugen2.1: <VIA UHCI root HUB> at usbus2
uhub2: <VIA UHCI root HUB, class 9/0, rev 1.00/1.00, addr 1> on usbus2
usbus3: 480Mbps High Speed USB v2.0
ugen3.1: <VIA EHCI root HUB> at usbus3
uhub3: <VIA EHCI root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus3
uhub0: 2 ports with 2 removable, self powered
uhub1: 2 ports with 2 removable, self powered
uhub2: 2 ports with 2 removable, self powered
uhub3: 6 ports with 6 removable, self powered
ugen3.2: <Generic Mass Storage> at usbus3
umass0 on uhub3
umass0: <Generic Mass Storage, class 0/0, rev 2.00/1.00, addr 2> on usbus3
umass0: SCSI over Bulk-Only; quirks = 0xc100
umass0:4:0: Attached to scbus4
(aprobe1:ata0:0:0:0): SETFEATURES SET TRANSFER MODE. ACB: ef 03 00 00 00 40 00 00 00 00 0a 00
(aprobe1:ata0:0:0:0): CAM status: ATA Status Error
(aprobe1:ata0:0:0:0): ATA status: 51 (DRDY SERV ERR), error: 04 (ABRT )
(aprobe1:ata0:0:0:0): RES: 51 04 00 00 00 00 00 00 00 0a 00
(aprobe1:ata0:0:0:0): Retrying command, 0 more tries remain
(aprobe1:ata0:0:0:0): SETFEATURES SET TRANSFER MODE. ACB: ef 03 00 00 00 40 00 00 00 00 0a 00
(aprobe1:ata0:0:0:0): CAM status: ATA Status Error
(aprobe1:ata0:0:0:0): ATA status: 51 (DRDY SERV ERR), error: 04 (ABRT )
(aprobe1:ata0:0:0:0): RES: 51 04 00 00 00 00 00 00 00 0a 00
(aprobe1:ata0:0:0:0): Error 5, Retries exhausted
Trying to mount root from ufs:/dev/ufs/FreeBSD_Install [ro,noatime]...
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <Generic Flash Disk PMAP> Removable Direct Access SPC-2 SCSI device
da0: Serial Number 19072216524200
da0: 40.000MB/s transfers
da0: 7680MB (15728640 512 byte sectors)
da0: quirks=0x2<NO_6_BYTE>
ugen3.3: <vendor 0x05e3 USB2.0 Hub> at usbus3
uhub4 on uhub3
uhub4: <vendor 0x05e3 USB2.0 Hub, class 9/0, rev 2.00/32.98, addr 3> on usbus3
uhub4: 4 ports with 4 removable, self powered
random: unblocking device.
ugen3.4: <SIGMACHIP USB Keyboard> at usbus3
ukbd0 on uhub4
ukbd0: <SIGMACHIP USB Keyboard, class 0/0, rev 1.10/1.10, addr 4> on usbus3
kbd2 at ukbd0
lo0: link state changed to UP
uhid0 on uhub4
uhid0: <SIGMACHIP USB Keyboard, class 0/0, rev 1.10/1.10, addr 4> on usbus3
hostb0@pci0:0:0:0: class=0x060000 card=0x03641106 chip=0x03641106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 Host Bridge'
class = bridge
subclass = HOST-PCI
cap 02[80] = AGP v3 8x 4x SBA disabled
cap 01[50] = powerspec 2 supports D0 D3 current D0
hostb1@pci0:0:0:1: class=0x060000 card=0x13641106 chip=0x13641106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 Host Bridge'
class = bridge
subclass = HOST-PCI
hostb2@pci0:0:0:2: class=0x060000 card=0x23641106 chip=0x23641106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 Host Bridge'
class = bridge
subclass = HOST-PCI
hostb3@pci0:0:0:3: class=0x060000 card=0x00000000 chip=0x33641106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 Host Bridge'
class = bridge
subclass = HOST-PCI
hostb4@pci0:0:0:4: class=0x060000 card=0x43641106 chip=0x43641106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 Host Bridge'
class = bridge
subclass = HOST-PCI
none0@pci0:0:0:5: class=0x080020 card=0x53641106 chip=0x53641106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 I/O APIC Interrupt Controller'
class = base peripheral
subclass = interrupt controller
hostb5@pci0:0:0:6: class=0x060000 card=0x63641106 chip=0x63641106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 Security Device'
class = bridge
subclass = HOST-PCI
hostb6@pci0:0:0:7: class=0x060000 card=0x00000000 chip=0x73641106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 Host Bridge'
class = bridge
subclass = HOST-PCI
pcib1@pci0:0:1:0: class=0x060400 card=0x00000000 chip=0xb1981106 rev=0x00 hdr=0x01
vendor = 'VIA Technologies, Inc.'
device = 'VT8237/VX700 PCI Bridge'
class = bridge
subclass = PCI-PCI
cap 01[70] = powerspec 2 supports D0 D3 current D0
pcib2@pci0:0:2:0: class=0x060400 card=0xc3231106 chip=0xa3641106 rev=0x80 hdr=0x01
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 PCI to PCI Bridge Controller'
class = bridge
subclass = PCI-PCI
cap 10[40] = PCI-Express 1 root port max data 128(256) RO NS
link x0(x16) speed 0.0(2.5) ASPM disabled(L0s/L1)
slot 0 power limit 150000 mW HotPlug(empty) surprise
cap 01[68] = powerspec 2 supports D0 D3 current D0
cap 05[70] = MSI supports 1 message, 64 bit
cap 08[88] = HT MSI fixed address window disabled at 0xfee00000
cap 0d[98] = PCI Bridge card=0xc3231106
ecap 0001[100] = AER 1 0 fatal 0 non-fatal 0 corrected
ecap 0002[140] = VC 1 max VC1
ecap 0005[180] = Root Complex Link Declaration 1
pcib3@pci0:0:3:0: class=0x060400 card=0xc3231106 chip=0xc3641106 rev=0x80 hdr=0x01
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 PCI to PCI Bridge Controller'
class = bridge
subclass = PCI-PCI
cap 10[40] = PCI-Express 1 root port max data 128(256) RO NS
link x0(x1) speed 0.0(2.5) ASPM disabled(L0s/L1)
slot 0 power limit 150000 mW HotPlug(empty) surprise
cap 01[68] = powerspec 2 supports D0 D3 current D0
cap 05[70] = MSI supports 1 message, 64 bit
cap 08[88] = HT MSI fixed address window disabled at 0xfee00000
cap 0d[98] = PCI Bridge card=0xc3231106
ecap 0001[100] = AER 1 0 fatal 0 non-fatal 0 corrected
ecap 0002[140] = VC 1 max VC1
ecap 0005[180] = Root Complex Link Declaration 1
none1@pci0:0:8:0: class=0x020000 card=0x107c8086 chip=0x107c8086 rev=0x05 hdr=0x00
vendor = 'Intel Corporation'
device = '82541PI Gigabit Ethernet Controller'
class = network
subclass = ethernet
cap 01[dc] = powerspec 2 supports D0 D3 current D0
cap 07[e4] = PCI-X supports 2048 burst read, 1 split transaction
none2@pci0:0:9:0: class=0x020000 card=0x107c8086 chip=0x107c8086 rev=0x05 hdr=0x00
vendor = 'Intel Corporation'
device = '82541PI Gigabit Ethernet Controller'
class = network
subclass = ethernet
cap 01[dc] = powerspec 2 supports D0 D3 current D0
cap 07[e4] = PCI-X supports 2048 burst read, 1 split transaction
none3@pci0:0:10:0: class=0x100000 card=0x0001177d chip=0x0003177d rev=0x00 hdr=0x00
vendor = 'Cavium, Inc.'
device = 'Nitrox XL N1 Lite'
class = encrypt/decrypt
subclass = network/computer crypto
cap 07[e0] = PCI-X 64-bit supports 133MHz, 4096 burst read, 32 split transactions
cap 01[e8] = powerspec 2 supports D0 D3 current D0
cap 05[f0] = MSI supports 1 message, 64 bit
atapci0@pci0:0:15:0: class=0x01018f card=0x52871106 chip=0x52871106 rev=0x20 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'VT8251 Serial ATA Controller'
class = mass storage
subclass = ATA
cap 01[c0] = powerspec 2 supports D0 D3 current D0
atapci1@pci0:0:15:1: class=0x01018a card=0x05711106 chip=0x05711106 rev=0x07 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'VT82C586A/B/VT82C686/A/B/VT823x/A/C PIPC Bus Master IDE'
class = mass storage
subclass = ATA
cap 01[c0] = powerspec 2 supports D0 D3 current D0
uhci0@pci0:0:16:0: class=0x0c0300 card=0x30381106 chip=0x30381106 rev=0x91 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'VT82xx/62xx UHCI USB 1.1 Controller'
class = serial bus
subclass = USB
cap 01[80] = powerspec 2 supports D0 D1 D2 D3 current D0
uhci1@pci0:0:16:1: class=0x0c0300 card=0x30381106 chip=0x30381106 rev=0x91 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'VT82xx/62xx UHCI USB 1.1 Controller'
class = serial bus
subclass = USB
cap 01[80] = powerspec 2 supports D0 D1 D2 D3 current D0
uhci2@pci0:0:16:2: class=0x0c0300 card=0x30381106 chip=0x30381106 rev=0x91 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'VT82xx/62xx UHCI USB 1.1 Controller'
class = serial bus
subclass = USB
cap 01[80] = powerspec 2 supports D0 D1 D2 D3 current D0
ehci0@pci0:0:16:4: class=0x0c0320 card=0x31041106 chip=0x31041106 rev=0x90 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'USB 2.0'
class = serial bus
subclass = USB
cap 01[80] = powerspec 2 supports D0 D1 D2 D3 current D0
cap 0a[88] = EHCI Debug Port at offset 0xa0 in map 0x14
isab0@pci0:0:17:0: class=0x060100 card=0x32871106 chip=0x32871106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'VT8251 PCI to ISA Bridge'
class = bridge
subclass = PCI-ISA
cap 01[c0] = powerspec 2 supports D0 D3 current D0
hostb7@pci0:0:17:7: class=0x060000 card=0x287e1106 chip=0x287e1106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'VT8237/8251 Ultra VLINK Controller'
class = bridge
subclass = HOST-PCI
cap 08[58] = HT interrupt
hostb8@pci0:0:19:0: class=0x060000 card=0x00000000 chip=0x287b1106 rev=0x00 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'VT8251 Host Bridge'
class = bridge
subclass = HOST-PCI
vgapci0@pci0:1:0:0: class=0x030000 card=0x19750908 chip=0x33711106 rev=0x01 hdr=0x00
vendor = 'VIA Technologies, Inc.'
device = 'CN896/VN896/P4M900 [Chrome 9 HC]'
class = display
subclass = VGA
cap 01[60] = powerspec 2 supports D0 D1 D2 D3 current D0
cap 02[70] = AGP v3 8x 4x SBA disabled
pcib5@pci0:128:0:0: class=0x060400 card=0x00000000 chip=0x287c1106 rev=0x00 hdr=0x01
vendor = 'VIA Technologies, Inc.'
device = 'VT8251 PCIE Root Port'
class = bridge
subclass = PCI-PCI
cap 10[40] = PCI-Express 1 root port max data 128(256)
link x1(x2) speed 2.5(2.5) ASPM disabled(L0s/L1)
cap 01[68] = powerspec 2 supports D0 D3 current D0
cap 05[70] = MSI supports 1 message, 64 bit, vector masks
cap 08[88] = HT MSI fixed address window disabled at 0xfee00000
cap 0d[90] = PCI Bridge card=0x00000000
ecap 0001[100] = AER 1 0 fatal 0 non-fatal 0 corrected
ecap 0002[140] = VC 1 max VC1
ecap 0005[180] = Root Complex Link Declaration 1
pcib6@pci0:128:0:1: class=0x060400 card=0x00000004 chip=0x287d1106 rev=0x00 hdr=0x01
vendor = 'VIA Technologies, Inc.'
device = 'VT8251 PCIE Root Port'
class = bridge
subclass = PCI-PCI
cap 10[40] = PCI-Express 1 root port max data 128(256)
link x1(x1) speed 2.5(2.5) ASPM disabled(L0s/L1)
cap 01[68] = powerspec 2 supports D0 D3 current D0
cap 05[70] = MSI supports 1 message, 64 bit, vector masks
cap 08[88] = HT MSI fixed address window disabled at 0xfee00000
cap 0d[90] = PCI Bridge card=0x00000004
ecap 0001[100] = AER 1 0 fatal 0 non-fatal 0 corrected
ecap 0002[140] = VC 1 max VC1
ecap 0005[180] = Root Complex Link Declaration 1
none4@pci0:130:0:0: class=0x020000 card=0x00008086 chip=0x109a8086 rev=0x00 hdr=0x00
vendor = 'Intel Corporation'
device = '82573L Gigabit Ethernet Controller'
class = network
subclass = ethernet
cap 01[c8] = powerspec 2 supports D0 D3 current D0
cap 05[d0] = MSI supports 1 message, 64 bit
cap 10[e0] = PCI-Express 1 endpoint max data 128(256) RO NS
link x1(x1) speed 2.5(2.5)
ecap 0001[100] = AER 1 0 fatal 1 non-fatal 0 corrected
ecap 0003[140] = Serial 1 000000ffff000000
none5@pci0:129:0:0: class=0x020000 card=0x00008086 chip=0x109a8086 rev=0x00 hdr=0x00
vendor = 'Intel Corporation'
device = '82573L Gigabit Ethernet Controller'
class = network
subclass = ethernet
cap 01[c8] = powerspec 2 supports D0 D3 current D0
cap 05[d0] = MSI supports 1 message, 64 bit
cap 10[e0] = PCI-Express 1 endpoint max data 128(256) RO NS
link x1(x1) speed 2.5(2.5)
ecap 0001[100] = AER 1 0 fatal 1 non-fatal 0 corrected
ecap 0003[140] = Serial 1 000000ffff000000
I am wondering if the presence of the Cavium Nitrox is going to be a problem. Obviously this chip isn't going to be supportable, but will the board be usable without it? I wonder. However, all in all, an interesting reverse engineering challenge.