ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.99k stars 733 forks source link

EEPROM can't be found #20

Closed Pepitoh closed 6 years ago

Pepitoh commented 7 years ago

Hi,

I've just bought a USB3380-EVB with PE3B Mini Card to ExpressCard Adapter (from hwtools.net), and after many tries, still not able to flash it with pcileech firmware. ExpressCard is directly connect to PCI port of my laptop.

I first try with binaries compiled from your git, it always failed at the same point :

[ 298.214156] PCILEECH FLASH: Module init called. [ 298.214173] PCILEECH FLASH: Found USB3380 not flashed as PCILeech. [ 298.214320] PCILEECH FLASH: ERROR: Firmware write/verify not successful. Error: 0xfffffffd

After some debugging, I could figure out the checks which is always ko :

// 2: check if EEPROM exists if((*(unsigned int*)(pbar0 + OFFSET_PCIREG_EEPROM_CTL) & 0x00030000) == 0) { return -3;

Program is not able to detect EEPROM, even with forcing 1 or 2-byte adressing (still not able to locate EEPROM). Note that SET_LED calls work well (I'm able to set LED on USB3380, which seems to be a good sign that I'm able to contact it through my PCIe port on laptop).

Regarding issue #14, I also tried with https://github.com/NSAPlayset/SLOTSCREAMER, and PLX Console Monitor, and I've got the a similar issue :

17 0 03 01 02 -- 0822 1180 -- -- -- SD Host Controller 18 0 0C 00 00 00 4232 8086 -- -- -- Other network controller =>19 0 0E 00 00 00 3380 10B5 3380 AB -- Avago USB controller PLX Console Monitor, v2.90 [Apr 11 2017] Copyright (c) PLX Technology, Inc. eep -- The PLX chip reports no EEPROM present -- Do you want to proceed [y/n]?

Of course, when I try a eep_load pcileech_firmware.bin :

eep_load /home/xxxxx/tools/pcileech/pcileech_files/firmware_pcileech.bin Load EEPROM file... Ok (48B) Verify option...... ENABLED (Use '-b' to disable) Program EEPROM..... ERROR: offset:00 wrote:002A005A read:00000000 -- Complete (0.43 sec) --

And no firmware written... I tried with two different PC with PCIe ports, two different distrib Linux (Ubuntu Linux xxxxxx 4.8.0-46-generic #49~16.04.1 and a debian 8), even live CD, result is the same.

Note that I have these errors when loading PlxSvc in dmesg:

[ 1721.865181] PlxSvc: <========================================================> [ 1721.865183] PlxSvc: PLX PCI Service driver v7.25 (64-bit) [ 1721.865184] PlxSvc: Supports Linux kernel v4.8.0-46-generic [ 1721.878077] PlxSvc: Error: PCI header type (2) not 0 or 1 [ 1721.878081] PlxSvc: Error: PCI header type (2) not 0 or 1 [ 1721.878483] PlxSvc: ERROR: NT detection not implemented for 3380 [ 1721.878491] PlxSvc: ...driver loaded

I don't know if it's an hardware issue or if I'm doing something wrong.. do you have any idea?

Thanks for your help.

Pepitoh.

ufrisk commented 7 years ago

Hi,

It's very hard for me to guess whats wrong, but it seems like you tried a lot of variations and that you know what you're doing.

I guess it could be that the hardware is faulty, but I never experienced it myself or know of anyone else that got a DOA.

Maybe you could try the Windows flash driver as well to see if it works better? I'm guessing not, but it might be worth a try.

Best Regards, Ulf

Pepitoh commented 7 years ago

Hi,

Thanks a lot for your quick answer. I'm not able to test it on a windows unfortunately but i think result will be the same.

I'm trying to debugging and understand, maybe you could help with few things.

From what I see on my USB3380 / PE3B, here is what i found at of pbar0 + OFFSET_PCIREG_EEPROM_CTL :

[12358.542578] pbar0 and offset EEPROM normaly: 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 1f 00 00 00 00 00 00 00 00 00 00 00

I never get the value 0x00030000 you are checking in your code.. The two other loops (commented as "Force 1-byte adresses") change the beginning of content bellow with 00 00 60 00 00 and 00 00 a0 00 00... but check with 0x00030000 failed again..

Any idea? Do you have any documentation on the subject? (why checking 0x0003000? do you think I could be able to find this value anywhere else? or if this value has changed on some hardware version?). Is there another way to detect EEPROM on my device? I want to be sure that it's a DOA before send it back far far away ... :-(

Thanks again,

See you.

ufrisk commented 7 years ago

Hi,

Can you please check what the DWORDs at bar0+0x1260 (EEPROM status register) and bar0+0x1000 (PCI VID/PID) reads as?

if((*(unsigned int*)(pbar0 + OFFSET_PCIREG_EEPROM_CTL) & 0x00030000) == 0) { basically checks if USB3380 reports EEPROM present, which your case indicates it's not reporting as present, or if there is problems with the bar0 address (why I want to you to check bar0+0x1000 also).

capture

( USB_3380-AA_AB_Data_Book_v1.3.pdf )

Pepitoh commented 7 years ago

Hi,

Here is what I found : First loop : [ 639.253574] bar0 + 0x1260 = 0x00000000 [ 639.253577] bar0 + 0x1000 tested 0x338010b5

Second loop : [ 639.253574] bar0 + 0x1260 = 0x00600000 [ 639.253577] bar0 + 0x1000 tested 0x338010b5

Last loop : [ 639.253574] bar0 + 0x1260 = 0x00a00000 [ 639.253577] bar0 + 0x1000 tested 0x338010b5

Do you see something wrong? I can't find the relative pdf (not available on some weird Chinese websites), do you have a link to download it?

Thanks again !

Pepitoh.

ufrisk commented 7 years ago

The bar0 is correct, the device reports no EEPROM present.

Are you sure that you purchased the USB3380-EVB mini-PCIe card. If you did that and you get this behaviour something is probably wrong.

This behaviour is however exactly the same behaviour as if you have the normal PCIe form factor PP3380 card without bridging the J3 jumper, that is EEPROM not present. (just asking, even tho stupid question, have to just in case, other ppl mixed up mini-PCIe with standard PCIe before...)

Pepitoh commented 7 years ago

You are right to ask it, I tried so many thing that I'm not sure of anything ...

This is exactly what I bought : http://www.hwtools.net/jpg/USB3380EVB-PE3B_1.jpg

USB3380 connected to a PE3B (mini PCI to express Card). And Express Card connected to my ExCard port on my laptop like this schema : http://www.hwtools.net/jpg/USB3380EVB-PE3B_5.jpg

I should have an EEPROM on this kind of product no?

Thanks.

signal-5 commented 7 years ago

I think you have to connect the mini-PCIe card directly to the mini-PCIe bus to be able to flash it. As stated in the readme: "The board must be connected to the system via PCIe when performing the initial flash." It can also be flashed through the normal PCIe bus like this: http://www.bplus.com.tw/jpg/USB3380-AA%20EVK_1.jpg //Sigtrap

Pepitoh commented 7 years ago

Hi @signal-5,

Thanks for the tips. I tried by plugging USB3380 directly to a mini-PCIe on my laptop, and result is exactly the same :

I think I will try to order new USB3380, I don't know if the problem could be elsewere...if you have any idea.

Pepitoh.

ufrisk commented 7 years ago

Plugging it in via the PE3B ExpressCard adapter should work equally fine, it's how I flashed my usb3380-evb's.

I don't know the error, but the device is reporting that it doesn't have an EEPROM it seems like unfortunately =\

Dantoes commented 7 years ago

Have you find a solution? My device also reports no EEPROM present.

ufrisk commented 7 years ago

I suspect hardware error if the USB3380-EVB device (the mini pci express card) reports no EEPROM and both my flash program and the Avago/PLX tools fail on multiple computers.

If using the PP3380 pci express card this is normal behaviour if the J3 jumper is not bridged correctly.

Pepitoh commented 7 years ago

Hi,

@knowbuddy : Nop, tried everything, still no EEPROM. Where did you buy your USB3380?

Pepitoh

Dantoes commented 7 years ago

I tried it with USB3380-EVB and PP3380 (J3 was set ;-)) always the same error. Also no success with Win8 / Win 10. Is this possible, that the changed something within the hardware design? USB3380-EVB and PP3380 are Rev. AB.

@Pepitoh: I bought both at http://www.bplus.com.tw, but this should be the same like http://www.hwtools.net

Dantoes commented 7 years ago

Here are some pictures of the hardware:

https://picload.org/image/rcooaodl/img_1828.jpg https://picload.org/image/rcooaodi/img_1827.jpg https://picload.org/image/rcooaodw/img_1826.jpg https://picload.org/image/rcooaoar/img_1825.jpg https://picload.org/image/rcooaoaa/img_1824.jpg

Anything wrong with it?

BR

ufrisk commented 7 years ago

I don't see anything strange with either the PCIe card or the mini PCIe card.

The PCIe card (PP3380) needs to have the J3 connector bridged by a jumper though (missing in your pictures), and it has to always be bridged, both during and after the flashing. If it's not bridged by a jumper you'll experience the no EEPROM problem.

About the USB3380-EVB it looks really normal, the only difference with mine it's that it's from a more recent batch and mbe another manufacturer. Otherwise it's all the same.

If it's not working in Windows please try the linux module as well.

Pepitoh commented 7 years ago

Hi,

Same, I bought both at http://www.hwtools.net, maybe the issue is from their product? Here is a picture of my USB3380 EVB and adapter ; https://picload.org/view/rcocgpra/img_0781-copie.jpg.html

Should be working well, I think I will try to buy a new USB3380 on another website. @ufrisk do you have any recommandation?

Thx.

Pepitoh

urknall commented 7 years ago

Same here, not able to flash the USB3380-EVB mini-PCIe card ordered from http://www.bplus.com.tw/ neither windows nor linux. Now we were three...

ufrisk commented 7 years ago

Have you tried the Avago/PLX tools as well? Also if you try to run it on another computer as well.

I haven't made any changes in the flash utilities for a while, and since it seems like even the Avago/PLX tools fail I'm inclinded to believe that there might be a hardware issue.

urknall commented 7 years ago

I also tried with the SDK under linux, no eeprom is found...

Though i haven't tried with another machine yet.

urknall commented 7 years ago

Did any of you other guys already get in contact with bplus technology about the problem?

urknall commented 7 years ago

We should all get in contact at least via email: support@bplus.com.tw and tell them about our problems... Also we can tell them that we are aware that also other people that bought the cards from them have similar problems.

ecostin commented 7 years ago

Does anybody have schematics of the bplus devices? The links on their site are dead. We could try to determine what is wrong with the EEPROM line. I've got two of the USB3380-EVB and one PP3380 that show the same error.

urknall commented 7 years ago

I don't have unfortunately further documentation. At the weekend i wrote an email to their support and waiting for response. I suggest all other people here with the same problems should write them also.

Pepitoh commented 7 years ago

You are right @urknall, I will do the same, impossible to find any documentation on any website... can't say if we are facing hardware issue or some differences in the ones used by @ufrisk .

urknall commented 7 years ago

Still waiting for an answer from bplus, i haven't asked for documentation though, only described the problem.

ufrisk commented 7 years ago

please send me an email, I might have a few old docs around, I don't think they'll help tho. It also seems like bplus sold out on the usb3380-evb again.

ecostin commented 7 years ago

I'd like to see if there are any differences at the hw level / connections between your units and the current (broken) ones. Any specifics about the PCIe and/or mini PCIe might help.

Cheers, Costin

On 26 April 2017 00:29:33 Ulf Frisk notifications@github.com wrote:

please send me an email, I might have a few old docs around

0x4d4e commented 7 years ago

Add me to the list of Error: fffffffd :(

[ 1497.501376] PCILEECH FLASH: Module init called.
[ 1497.501379] PCILEECH FLASH: Found USB3380 not flashed as PCILeech.
[ 1497.501536] PCILEECH FLASH: ERROR: Firmware write/verify not successful. Error: fffffffd

lspci

05:00.0 USB controller: PLX Technology, Inc. Device 3380 (rev ab)

USB3380-EVB mini-PCIe card with mPCIe-PCIe adapter, received it this week.

I have only tested it on one PC, but what I gathered in this issue, using other connections or PLX tools won't change anything?

ufrisk commented 7 years ago

I don't have a solution to the problem. I suspect they might have had a bad batch. Testing it on a few different computers, and with the original PLX tools might be a good idea though before asking for a replacement.

I've been thinking about ordering a new usb3380-evb myself, but it seems like they are out of stock again.

urknall commented 7 years ago

I was/am on training until next thuesday, so i have no physical access to the hardware at the moment, because it is at work. Did anyone got in contact with bplus about the problem yet or got any reaction? I wrote them an email a week ago and never got an answer...

urknall commented 7 years ago

Houston, we got a problem:

https://www.broadcom.com/products/pcie-switches-bridges/usb-pci/usb-controllers/usb3380

The product you selected is no longer available.

ufrisk commented 7 years ago

que?

to me the link says "Lifecycle Status Active" with lots of product briefs to download. maybe it was something temporary.

Hopefully I'll get my hands on a board with the flashing problems before the weekend. If there is a hardware error obviously I won't be able to do anything about it, otherwise I might be able to figure something out, or at the least test to flash it on a system I knows working.

urknall commented 7 years ago

Now the page is back as before, strange. Must have been really temporary.

Does someone send you already a device?

Pepitoh commented 7 years ago

Any updates? @urknall did you get an answer?

urknall commented 7 years ago

Three weeks passed without an answer, but i was busy and on training etc. End of last week i wrote again an email, still no answer. Today i wrote another email and tried a different email account, got immediately an answer from bplus. there must have been a problem with my other email address...

The card is on the way back to taiwan for RMA.

ufrisk commented 7 years ago

Also I've looked at an USB3380-EVB sent to me this weekend and there seems to be a hardware error related to the EEPROM on that board, which should be consistent with the problems in this thread.

As a side note I was also sent a PP3380 board, but that one worked perfectly...

steinholdo commented 7 years ago

@urknall: what address did you used?

ecostin commented 7 years ago

you may want to hold back returning the cards, I've got a guy from Bplus who asked me to "remove R37" and see if it works. I'll give it a try this weekend (not at the office now) and post the results. Probably will not work, but who knows ...

signal-5 commented 7 years ago

Can you post a detailed picture of your card? I have an old working card and I can see R37 marked on it but there is no (obvious) component close to it.

ecostin commented 7 years ago

Will do, but I'm with a client and I will only be back in the office this weekend. In the meantime this is what Bplus sent me. R37 is the blue one. default

signal-5 commented 7 years ago

We have different hardware, if your board looks like that picture. My components have similar layout, but not the same. My R36 is beneath (south) of U3 (the larger component on your picture (labeled 401 407 * 88)).

ecostin commented 7 years ago

Removed R37, same error. Guess I'm in for a RMA. If your layout is different, Bplus solution attempt will probably not apply.

image

ufrisk commented 7 years ago

They seem to have switched suppliers and re-designed the board in the latest batch. From my very limited tests it looked like they messed up read/write lines between the EEPROM and the 3380 chip and who knows what else :( Hopefully they'll restock with boards from their original supplier as soon as possible.

Meanwhile the PP3380 PCIe board might work, or old used EVB boards if they are possible to come by. Long term I hope to have support for FPGA hardware as well, but that will unfortunately take time and is likely to be bulkier than the 3380.

steinholdo commented 7 years ago

Does anybody have an email address, where the bplus support is responding?

ecostin commented 7 years ago

@steinholdo : pete@ :)

steinholdo commented 7 years ago

thank you!

LuckyPi commented 7 years ago

Great info! :(

A couple of months ago I ordered two USB3380-EVBs for work and returned them back to MFactors. They did a "impression", sent them back stating they were good. I ended returning them for a refund as they wouldn't flash. The board layout is different from my personal working one.

Error below:

eep -- The PLX chip reports no EEPROM present --

Doyou want to proceed [y/n]? y

------ 3380 EEPROM Header ------ Signature : 00 [Invalid] Load Regs : Yes Load 8051 Mem: No Start 8051 : No Registers : 0 bytes (0 regs)

Any leads on where to buy working hardware or maybe someone would be kind enough to design a working PCB and provide a BOM? I have a rework station I'm diying to test out.

ufrisk commented 7 years ago

Yea, the board layout is messed up in the most recent (now withdrawn/sold out) batch of USB3380-EVB. The PP3380 PCIe board should still work though as far as I know.

BPlus have some "schematics" on their page, the links to the pdfs are now broken, but still works if you check them out at archive.org.

bryanspaulding commented 7 years ago

Since this issue has become something of a "What's the status of the USB3380-EVB?" discussion - I thought this might be relevant.

The Broadcom Specifications page for the USB3380 chip currently lists the lifecycle as "Not Recommended for New Design."

I reached out to Broadcom today asking about the recommended Broadcom replacement and this was the reply I received.

I’m sorry, however, there is no replacement for the USB3380 device. It will run EOL soon - and we don’t have a replacement device. You should likely look into other vendor solutions for such a product. Thanks, Mark Medlin

urknall commented 7 years ago

Any updates on this, anything is known about the status of the new batch?