terpstra/xl710-unlocker

Unlock Intel XL710 / X710 cards for use with any SFP+

xl710-unlocker

xl710-unlocker's Issues

Success And Info On X710-DA2 (maybe fatal to someone)

First, Thanks a lot for all your tools and informations.

I cannot imagine I can do this without your help.

---

1. Basic Information
   Operations are done under newest firmware up to now(fw 8.13.63341), Nic is a Genuine Intel X710-DA2. (by the way, there are really a lot of fake Intel cards on the market, some look 100% same).
   Operations are done under Synology DSM operating system (linux, of course), but to make it easier, all compile are done with Ubuntu.

2. Infos
   (1) As author concerns, the address may change with different firmware, and so it happens. In the situation of the author, the base address is on 0x6870. On firmware 6.x, I find the base address is on 0x68f6. But it changes to 0x6940 after firmware upgrade. So I really think the author did a right choice.

   (2) Little differences.
   In the situation of author, $(baseAdress) = 000b, and $(baseAdress + 0x08) = 2b0c.
   I find $(baseAdress) = 000c on firmware 6.x, and $(baseAdress) = 000d on firmware 8.13.
   And $(baseAdress + 0x08) = 6b0c, then when I try to find out what does the difference mean, however, the Intel document describes the bit as reserved... So I only changed the bit matters(bit 11, "Enable Module Qualification").

   (3) Fatal difference.
   In the situation of author, "eeprom->offset = offset + 0xci2;"
   But it modified the unrelated address on my platform, probably because firmware update.
   Now the interval of address for each port changed, It is "eeprom->offset = offset + 0xei2" in my situation.

   (4) Conclusion for potential help
   int devid = 0x1572; // 0x1572 = Intel X710-DA2
   const char ethDev = "eth4"; // check with ifconfig
   int phy0_offset = 0x6940; // Always Check Before Use !!!
   eeprom->offset = offset + 0xei*2; // 0xc in earlier firmware
   (uint16_t)(eeprom+1) = 0x630c; // In my situation

3. Advice for beginners
   Actually I am a beginner, so I accidentally modified the wrong address. Luckily I checked immediately after modify, and ran nvmupdate64e -rd to fix.
   So my personal advice is run mytool 0 0x8000 > somefile, before and after modify, and write a little helper program to check all differences, to make sure you did it all right.

4. Again, Thanks a lot !

XL710 40GbE

Do you think it is possible to unlock an XL710 40GbE with this?

I have been looking around a bit and think I've found the offsets, but it looks quite different.

root@bootstrap:~# ./mytool 0x67fa 0xc
000067fa + 00 => 000b
000067fa + 01 => 0023
000067fa + 02 => 0600
000067fa + 03 => 0700
000067fa + 04 => 0000
000067fa + 05 => 0000
000067fa + 06 => 0e0d
000067fa + 07 => 0000
000067fa + 08 => 0b10
000067fa + 09 => 0000
000067fa + 0a => 0a1e
000067fa + 0b => 0002
root@bootstrap:~# ./mytool 0x6806 0xc
00006806 + 00 => 000b
00006806 + 01 => 0023
00006806 + 02 => 0600
00006806 + 03 => 0700
00006806 + 04 => 0000
00006806 + 05 => 0000
00006806 + 06 => 0e0d
00006806 + 07 => 0000
00006806 + 08 => 0b10
00006806 + 09 => 0000
00006806 + 0a => 0a1e
00006806 + 0b => 0102
root@bootstrap:~# ./mytool 0x6812 0xc
00006812 + 00 => 000b
00006812 + 01 => 0023
00006812 + 02 => 0600
00006812 + 03 => 0700
00006812 + 04 => 0000
00006812 + 05 => 0000
00006812 + 06 => 0e0d
00006812 + 07 => 0000
00006812 + 08 => 0b10
00006812 + 09 => 0000
00006812 + 0a => 0a1e
00006812 + 0b => 0202
root@bootstrap:~# ./mytool 0x681e 0xc
0000681e + 00 => 000b
0000681e + 01 => 0023
0000681e + 02 => 0600
0000681e + 03 => 0700
0000681e + 04 => 0000
0000681e + 05 => 0000
0000681e + 06 => 0e0d
0000681e + 07 => 0000
0000681e + 08 => 0b10
0000681e + 09 => 0000
0000681e + 0a => 0a1e
0000681e + 0b => 0302

mypoke should not assume PHY capabilities struct to be 0xC long

root@nas:/home/proton/xl710-unlocker# lspci
00:00.0 Host bridge: Intel Corporation Device 591f (rev 05)
00:01.0 PCI bridge: Intel Corporation Skylake PCIe Controller (x16) (rev 05)
00:02.0 VGA compatible controller: Intel Corporation HD Graphics 630 (rev 04)
00:14.0 USB controller: Intel Corporation 200 Series PCH USB 3.0 xHCI Controller
00:16.0 Communication controller: Intel Corporation 200 Series PCH CSME HECI #1
00:17.0 SATA controller: Intel Corporation 200 Series PCH SATA controller [AHCI mode]
00:1c.0 PCI bridge: Intel Corporation 200 Series PCH PCI Express Root Port #5 (rev f0)
00:1c.6 PCI bridge: Intel Corporation 200 Series PCH PCI Express Root Port #7 (rev f0)
00:1d.0 PCI bridge: Intel Corporation 200 Series PCH PCI Express Root Port #9 (rev f0)
00:1f.0 ISA bridge: Intel Corporation 200 Series PCH LPC Controller (B250)
00:1f.2 Memory controller: Intel Corporation 200 Series PCH PMC
00:1f.3 Audio device: Intel Corporation 200 Series PCH HD Audio
00:1f.4 SMBus: Intel Corporation 200 Series PCH SMBus Controller
00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (2) I219-V
01:00.0 Ethernet controller: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 02)
01:00.1 Ethernet controller: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 02)
01:00.2 Ethernet controller: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 02)
01:00.3 Ethernet controller: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 02)
03:00.0 Network controller: Qualcomm Atheros QCA6174 802.11ac Wireless Network Adapter (rev 32)

root@nas:/home/proton/xl710-unlocker# ethtool -i enp1s0f0
driver: i40e
version: 2.1.14-k
firmware-version: 6.01 0x80003484 1.1747.0
expansion-rom-version: 
bus-info: 0000:01:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: yes

root@nas:/home/proton/xl710-unlocker# ./mytool 0 100
...
[00000044] 00000000 + 44 => 8394
[00000045] 00000000 + 45 => 0020
[00000046] 00000000 + 46 => 802a
[00000047] 00000000 + 47 => 0002
[00000048] 00000000 + 48 => 67a8  // ptr to EMP SR
[00000049] 00000000 + 49 => 7fff
[0000004a] 00000000 + 4a => 0405
[0000004b] 00000000 + 4b => ffff
...

root@nas:/home/proton/xl710-unlocker# ./mytool 0x67a8
...
[000067be] 000067a8 + 16 => 154b
[000067bf] 000067a8 + 17 => 00c5
[000067c0] 000067a8 + 18 => 00f5
[000067c1] 000067a8 + 19 => 0135  // ptr to PHY Capabilities 0
[000067c2] 000067a8 + 1a => 0141
[000067c3] 000067a8 + 1b => 014d
[000067c4] 000067a8 + 1c => 0159
[000067c5] 000067a8 + 1d => 0606
[000067c6] 000067a8 + 1e => 0606
[000067c7] 000067a8 + 1f => 0606

root@nas:/home/proton/xl710-unlocker# ./mytool $((0x67a8+0x19+0x135))
[000068f6] 000068f6 + 00 => 000c
[000068f7] 000068f6 + 01 => 0002
[000068f8] 000068f6 + 02 => 0083
[000068f9] 000068f6 + 03 => 1871
[000068fa] 000068f6 + 04 => 0000
[000068fb] 000068f6 + 05 => 0000
[000068fc] 000068f6 + 06 => 3303
[000068fd] 000068f6 + 07 => 000b
[000068fe] 000068f6 + 08 => 630c  // was 6b0c, clearing the 0x800 (1<<11) has no effect
[000068ff] 000068f6 + 09 => 0a00
[00006900] 000068f6 + 0a => 6432
[00006901] 000068f6 + 0b => 0001
[00006902] 000068f6 + 0c => 0000
[00006903] 000068f6 + 0d => 000c
[00006904] 000068f6 + 0e => 0002
[00006905] 000068f6 + 0f => 0083
[00006906] 000068f6 + 10 => 1871
[00006907] 000068f6 + 11 => 0000
[00006908] 000068f6 + 12 => 0000
[00006909] 000068f6 + 13 => 3303
[0000690a] 000068f6 + 14 => 630c  // was 6b0c, I only touched value above but this and following values changed too
[0000690b] 000068f6 + 15 => 6b0c
[0000690c] 000068f6 + 16 => 0a00
[0000690d] 000068f6 + 17 => 6432
[0000690e] 000068f6 + 18 => 0001
[0000690f] 000068f6 + 19 => 0000
[00006910] 000068f6 + 1a => 000c
[00006911] 000068f6 + 1b => 0002
[00006912] 000068f6 + 1c => 0083
[00006913] 000068f6 + 1d => 1871
[00006914] 000068f6 + 1e => 0000
[00006915] 000068f6 + 1f => 0000

[  118.826068] i40e 0000:01:00.0 enp1s0f0: the driver failed to link because an unqualified module was detected.
[  118.827588] IPv6: ADDRCONF(NETDEV_UP): enp1s0f0: link is not ready

Not an issue, but thank you for your work!

Just bought X710-DA4 and it won't bring up my EPON module, searched the Internet and run into your repo. Life saver!

DAC D-link cable

I'm unable to get my X710-DA2 work with D-Link passive copper DAC DEM-CB100S.
Do you have any suggestions about bypassing 03h module identifier (SFF-8472) to get it work?

Work with X520?

Do you think you could make this work with other Intel nics like the X520?

TIA,

There is no README - Here are some instructions for those that are confused

It took me a few hours to figure out what is going on here and how to do this. Now that I got this working with firmware 8.X, I figured I would help others save some time. Here are some instructions:

As firmware updates year after year, the only thing that seems constant with this unlock procedure is that bit 11 of "PHY Capabilities Misc0" needs to be cleared (set to 0). Where this is (which offset) is going to be different based on your card and firmware.

First we will use mytool to find the offset that we are going to change in order to flip bit 11 from "1" to "0"

Run "lspci -n" and find your devid. Fill it in, in line 33. So if you have "8086:1572", 1572 is your devid, and line 33 will look like this:
int devid = 0x1572;

Use ifconfig to determine the interface name of the SFP port of your card. Fill this in on line 34. I have a four-port card with interface names eth4, eth5, eth6, eth7, so I will use the first interface, eth4.
const char *ethDev = eth4;

Now save mytool.c, and compile it so that it is an executable. Use "gcc mytool.c mytool"

Run "sudo ./mytool 0 0x8000 > output"

Look for 000b using "cat output | grep 000b"

The last four offsets you see are likely the place where we will find the "PHY Capabilities Misc0" value. For me this is 6947, 6955, 6963, 6971.

cat output | grep 000b
<snip>
00000000 + 51fa => 000b
00000000 + 53ca => 000b
00000000 + 53d2 => 000b
00000000 + 5e00 => 000b
00000000 + 5e02 => 000b
00000000 + 5e74 => 000b
00000000 + 5e76 => 000b
00000000 + 6947 => 000b
00000000 + 6955 => 000b
00000000 + 6963 => 000b
00000000 + 6971 => 000b

However, on my card, the base address seems to be 000d instead of 000b. So I will now run "cat output | grep 000d" which gives me 6940, 694e, 695c, 696a. I only figured it out was 000d vs. 000b at the end of this process. Don't worry if this doesn't make sense yet, it will later.

Run mytool again but start at the first offset, for me it is 6940 (when using 000d instead of 000b).

"sudo ./mytool 0x6940"

The eighth offset is likely where the "PHY Capabilities Misc0" value is. For me, this value was 6b0c.

sudo ./mytool 0x6940
00006940 + 00 => 000d
00006940 + 01 => 0222
00006940 + 02 => 0083
00006940 + 03 => 1871
00006940 + 04 => 0000
00006940 + 05 => 0000
00006940 + 06 => 3303
00006940 + 07 => 000b
**00006940 + 08 => 6b0c**
00006940 + 09 => 0a00
00006940 + 0a => 0a1e
00006940 + 0b => 0003
00006940 + 0c => 0000
00006940 + 0d => 0064
00006940 + 0e => 000d
00006940 + 0f => 0222
00006940 + 10 => 0083
00006940 + 11 => 1871
00006940 + 12 => 0000
00006940 + 13 => 0000
00006940 + 14 => 3303
00006940 + 15 => 000b
**00006940 + 16 => 6b0c**
00006940 + 17 => 0a00
00006940 + 18 => 0a1e
00006940 + 19 => 0003
00006940 + 1a => 0000

If I had used 000b instead, this would be at 00006947 + 01. This gave me a lot of confusion at first, because I used 000b and the value at 08 did not have bit 11 set to 1. If you run into this issue, look carefully at all values and try to find a value that seems to have bit 11 set to 1. If it is not at 08, then try to use different base addresses besides 000b. See if there is an 000c or 000d that you can use as the base, which would make this value appear at 08.

Next, find the NEXT occurance of this value (for me 6b0c). I see this at 00006940 + 16 => 6b0c

0x16 minus 0x08 = 0xE (you can just use google for this math), which means that the offset between each SFP slot is 0xE apart. If you see the value such as 6b0c at position 00006940 + 15, then your offset is 0xD instead.

So now we have three things:

1. Our "base" or phy0_offset that we are starting at, which is 0x6940
2. The location of the value that contains the register bit 11, which is at 0x6940 + 0x8
3. The offset between SFP slots which is 0xE

Edit mypoke.c and change line 28 to the same devid you used previously in mytool.c.

Change 29 to the same interface name you used in mytool.c as well

Change line 44 to the offset where the record starts, which is 0x6940 for me.

ONLY if your location of the value with the register bit at bit 11 is NOT phy0_offset + 0x8, change line 46 to be phy0_offset + for example 0x1. If you correctly found the phy0_offset base by experimenting with for example 000b, 000c, and 000d, then you should not need to change this.

Change line 60 to the offset between SFP slots, which is 0xE for me. So line 60 now reads:
eeprom->offset = offset + 0xe*i*2;

On line 63, set "FILL_ME_IN" to the new value which sets bit 11 to "0" to unlock the card. This is your value at 00006940 + 08 but with bit 11 set from 1 to 0.

For me, my current value is:
6b0c = 0110101100001100
If I clear bit 11, I get:
0110001100001100 = 630c

Set line 63 "FILL_ME_IN" to this new value, for me it is 0x630c

Save and compile mypoke.c with "gcc mypoke.c mypoke"

Run sudo ./mypoke

Verify that the value has indeed changed by running "sudo ./mytool 0x6940" again and looking at 00006940 + 08. It should now be 630c (in my case).

Reboot the machine and the unsupported SFP should now work.

If you made a mistake and now your card isn't working, just use nvmupdate64e -rd to set everything back to the defaults, and try this process again.

Problem with XL710-QDA2

There was a problem finding data.
eeprom =
enp132s0f0.eeprom.tar.gz

Output of:
./mytool 0 0x8000
http://paste.ubuntu.com/p/MWnB6fshNr/

NIC is: XL710-QDA2 (0x1583)

I don't understand how can I find phy0_offset

Any help will be apreciated.