Difference between revisions of "BCM5719"

From RCS Wiki
Jump to navigation Jump to search
m (→‎Resources: add link to bcm5719-fw)
(14 intermediate revisions by 6 users not shown)
Line 1: Line 1:
 
==Overview==
 
==Overview==
  
The BCM5719 is the [[NIC|NIC]] integrated into the [[Talos_II|Talos™ II]] systems. It is based on the wildly popular NetXtreme architecture, and there have been efforts to document the internal operation of devices based on that architecture.
+
The BCM5719 is the [[NIC|NIC]] integrated into the [[Talos_II|Talos™ II]] and [[Blackbird|Blackbird™]] systems. It is based on the wildly popular NetXtreme architecture, and there have been efforts to document the internal operation of devices based on that architecture.
  
 
As the BCM5719 is the only on-board device on the non-SAS [[Talos_II|Talos™ II]] variants to use proprietary firmware, Raptor Computing Systems has started a contest to see who can create a truly libre replacement firmware<ref>https://www.raptorcs.com/TALOSII/nic_fw_contest.php</ref>.  Anyone with the appropriate skill set is encouraged to take up the challenge, and contributions to this page as the device is analyzed in detail are welcomed.
 
As the BCM5719 is the only on-board device on the non-SAS [[Talos_II|Talos™ II]] variants to use proprietary firmware, Raptor Computing Systems has started a contest to see who can create a truly libre replacement firmware<ref>https://www.raptorcs.com/TALOSII/nic_fw_contest.php</ref>.  Anyone with the appropriate skill set is encouraged to take up the challenge, and contributions to this page as the device is analyzed in detail are welcomed.
 +
 +
While the BCM5719 does, at least for now, execute proprietary firmware it is prevented from corrupting the operating system and/or other protected memory regions via the system IOMMU<ref>https://mail.coreboot.org/pipermail/coreboot/2017-September/085048.html</ref>.
 +
 +
The BCM5719 also connects to the BMC via RGMII NC-SI, providing network connectivity to the BMC.
  
 
==Details==
 
==Details==
Line 21: Line 25:
 
|6
 
|6
 
|MAC Address (port 1)
 
|MAC Address (port 1)
 +
|NO
 +
|-
 +
|0x20a
 +
|6
 +
|MAC Address (port 2)
 +
|NO
 +
|-
 +
|0x25a
 +
|6
 +
|MAC Address (port 3)
 
|NO
 
|NO
 
|}
 
|}
  
 
==Resources==
 
==Resources==
* [[:File:Bcm5719_talos.bin|Firmware image]] for recovery of bricked [[Talos_II|Talos™ II]] on-board NICs.  Note that the MAC addresses inside this image '''must''' be changed to match the MAC addresses on your particular [[Talos_II|Talos™ II]] system; failure to do so may violate law and could potentially cause serious network issues.
+
* [https://docs.broadcom.com/docs-and-downloads/collateral/pg/5718-PG107-R.pdf Register manual]
* [https://static.raptorcs.com/TALOSII/contest_files/10-hack.lu-nicreverse_slides.pdf Initial reverse engineering effort by Guillaume Delugré]
+
* [[:File:Bcm5719_talos.bin|Firmware image]] for recovery of bricked [[Talos_II|Talos™ II]] on-board NICs.  Note that the two MAC addresses inside this image '''must''' be changed to match the MAC addresses on your particular [[Talos_II|Talos™ II]] system; failure to do so could potentially cause serious network issues, including harm to other computers and/or users on any network(s) attached to the Broadcom network ports.
 +
* Reverse engineering work by Guillaume Delugré
 +
** [https://static.raptorcs.com/TALOSII/contest_files/10-hack.lu-nicreverse_slides.pdf Slides] from initial presentation by Guillaume Delugré at HACK.LU 2010
 +
** [https://infocon.org/cons/Hack%20In%20The%20Box/HITB%202011%20-%20Malaysia/D2T3%20-%20Guillaume%20Delugre%20-%20Reverse%20Engineering%20Broadcom%20NetExtreme%20Firmware.pdf Slides] from second presentation of Guillaume Delugré's talk at HITB Malaysia 2011
 +
** [http://esec-lab.sogeti.com/static/publications/11-recon-nicreverse_slides.pdf Slides] and [https://infocon.org/cons/REcon/REcon%202011/14_Guillaume_Delugre.mp4 Audio] from [https://recon.cx/2011/schedule/events/120.en.html followup presentation] by Guillaume Delugré for Recon 2011 (Video in file is broken)]
 +
* '''[[Project Ortega]]''' &mdash; firmware reverse engineering project
 +
* [https://github.com/meklort/bcm5719-fw/ meklort/bcm5719-fw] - firmware reimplementation (BSD licensed)
  
 
==References==
 
==References==
 +
 +
[[Category:Mainboard Components]]

Revision as of 16:02, 16 August 2019

Overview

The BCM5719 is the NIC integrated into the Talos™ II and Blackbird™ systems. It is based on the wildly popular NetXtreme architecture, and there have been efforts to document the internal operation of devices based on that architecture.

As the BCM5719 is the only on-board device on the non-SAS Talos™ II variants to use proprietary firmware, Raptor Computing Systems has started a contest to see who can create a truly libre replacement firmware[1]. Anyone with the appropriate skill set is encouraged to take up the challenge, and contributions to this page as the device is analyzed in detail are welcomed.

While the BCM5719 does, at least for now, execute proprietary firmware it is prevented from corrupting the operating system and/or other protected memory regions via the system IOMMU[2].

The BCM5719 also connects to the BMC via RGMII NC-SI, providing network connectivity to the BMC.

Details

On board EEPROM layout (note: may change as understanding of EEPROM file system evolves)

Offset Length Data CRC Protected
0x7e 6 MAC Address (port 0) NO
0xce 6 MAC Address (port 1) NO
0x20a 6 MAC Address (port 2) NO
0x25a 6 MAC Address (port 3) NO

Resources

  • Register manual
  • Firmware image for recovery of bricked Talos™ II on-board NICs. Note that the two MAC addresses inside this image must be changed to match the MAC addresses on your particular Talos™ II system; failure to do so could potentially cause serious network issues, including harm to other computers and/or users on any network(s) attached to the Broadcom network ports.
  • Reverse engineering work by Guillaume Delugré
    • Slides from initial presentation by Guillaume Delugré at HACK.LU 2010
    • Slides from second presentation of Guillaume Delugré's talk at HITB Malaysia 2011
    • Slides and Audio from followup presentation by Guillaume Delugré for Recon 2011 (Video in file is broken)]
  • Project Ortega — firmware reverse engineering project
  • meklort/bcm5719-fw - firmware reimplementation (BSD licensed)

References