SonicWALL SRA 4200. Hardware hacking! - Page 1
Forum section: electronics / projects

author: pappkopp
author_rank: Contributor
timestamp: December 11, 2013, 07:00:24 am
content: Hello!I picked up an software bricked firewall from SonicWALL.I opened it up and i saw that it used standard ATx Pc components, so i am wondering if it can be hacked to run custom firmware?I have the standard hacking tools: Jtag, TTL, Serial etc. Can this be done? I tried to mount the flash card to my workstation but it won't. because it has some kind of bad blocks or something, i think its locked or what?Ive hocked it up to an videocard, please see the images!I can provide all the information possible!!The images are here:http://imgur.com/a/1He14/embedKind Regards.

author: amyk
author_rank: Super Contributor
timestamp: December 11, 2013, 11:29:13 am
content: Do you have any info on the CPU and other hardware on it?

author: NiHaoMike
author_rank: Super Contributor
timestamp: December 11, 2013, 02:47:09 pm
content: What happens if you swap the CompactFlash card with one that has a LiveUSB distro installed on it?

author: pappkopp
author_rank: Contributor
timestamp: December 11, 2013, 03:07:46 pm
content: I will go to the store as soon as i get the time, regarding the flash card. Pick up a new one if no one got an suggestion for mounting the drive on my WorkStation (Linux or Windows tools will do)Regarding the CPU i don't know anything. I'm gonna pop off the heat-sink if i can't get the flash card to boot.Regards

author: Monkeh
author_rank: Super Contributor
timestamp: December 11, 2013, 04:05:35 pm
content: It shouldn't be much trouble to get a Linux distro booting off those.It's got hardware crypto of some sort, too.

author: pappkopp
author_rank: Contributor
timestamp: December 11, 2013, 04:47:48 pm
content: If it got some kind of hardware encryption, then tell me how to get past that feature? or even explain itPersonally i only think that the BIOS has like a feature where it verify's the content of the flash card.

author: Monkeh
author_rank: Super Contributor
timestamp: December 11, 2013, 06:13:58 pm
content: Quote from: pappkopp on December 11, 2013, 04:47:48 pmUh, as in a crypto engine..

author: TheBay
author_rank: Unknown
timestamp: December 12, 2013, 12:23:53 am
content: Put a PCI graphics card in there with no bracket, see if you get output or POST - If you can enter the BIOS and see boot options then might be halfway thereWhat flash chip is the PLCC BIOS? Is that a AMI sticker I see on it, looks like a normal x86 686 BIOS sticker.If the BIOS is locked out or has minimal features I can edit/add functions, if you can get a dump.

author: pappkopp
author_rank: Contributor
timestamp: December 12, 2013, 10:38:39 am
content: Hmm.. Where do i find a reader with that socket that fits? I've cleared the BIOS via using the on-board header. That did not change how the computer boot.Regarding the PCI video card:http://imgur.com/a/1He14/embed#11The only thing i get on the monitor is some FreeDOS thing.. If i remove the flash card it won't even power up the fans. I am about to buy an compact flash card and install some embedded Linux on it. But i bet there is an checksum or something in that way on the orginal flash card.Kind Regards

author: nowlan
author_rank: Frequent Contributor
timestamp: December 12, 2013, 12:00:55 pm
content: Looks to be searching for C:\command.com.Probably why its bricked.Just get a compact flash card and reader and put linux on it.I doubt you need to worry about signed images etc.

author: pappkopp
author_rank: Contributor
timestamp: December 12, 2013, 12:20:55 pm
content: Quote from: nowlan on December 12, 2013, 12:00:55 pmYeah, i have an compact disk reader. But when i connect it to my reader it won't mount under any circumstances, when i see the debug message on my Linux system it whines about bad sectors and I/O errors. Therefore no mounting for that card (would be fun to see the contents of it tho)I will hook up an flash card as soon as possible,. I will keep you guys updatedKind Regards

author: amyk
author_rank: Super Contributor
timestamp: December 12, 2013, 12:25:38 pm
content: The good news is that you seem to have a relatively standard x86 PC.The bad news is that the rubbish after the "Kernel: allocated ..." line suggests the files on the CF are corrupted.Have you tried accessing the BIOS setup? Or booting from a USB drive?Note that the CF interface is essentially EIDE, so if you have an adapter you could try hooking up a regular hard drive to it.

author: amyk
author_rank: Super Contributor
timestamp: December 12, 2013, 12:28:04 pm
content: Quote from: pappkopp on December 12, 2013, 12:20:55 pmDon't mount it, try ddrescue instead.

author: TheBay
author_rank: Unknown
timestamp: December 12, 2013, 02:07:33 pm
content: Nice to see video outputDo you get a post screen? have you tried F1, F2, other F keys and Del when powering on to get in to a setup?You need a PLCC to DIP adapter for your programmer, if you haven't got a programmer I love the TL866A at the moment. It's become my main programmer.Quote from: pappkopp on December 12, 2013, 10:38:39 am

author: TheBay
author_rank: Unknown
timestamp: December 12, 2013, 03:17:27 pm
content: Remove flash card and see if any POST Video output or try removing the battery and boot with no flash card! It might load to CMOS defaults and allow you in to setup hopefullyit might need to be left on a while, the OS probably controls fan speed as it boots, though if you do not get POST the bios might not have code to initialise the display adaptor... A few SATA connectors there too, try removing the flash card and making a USB boot disk with Rufus?

author: pappkopp
author_rank: Contributor
timestamp: December 12, 2013, 08:21:36 pm
content: I tried with an Flash card, but no boot.There is an Via Chipset on the board, VIA VT1211Datasheet:http://www.hardwaresecrets.com/datasheets/vt1211.pdfInfo:http://www.via.com.tw/en/products/peripherals/super-io/Hackable? i think so?

author: TheBay
author_rank: Unknown
timestamp: December 12, 2013, 08:23:22 pm
content: Please try with no flash card and wait for post, or keep hitting keys to get in BIOS.Via is only Super IO chip? not the main chipset, what do you intend to do with the Via chip?

author: pappkopp
author_rank: Contributor
timestamp: December 12, 2013, 10:26:02 pm
content: Update:I have tried to boot from a FreeDOS image, but it don't want to work with me.Also there is no BIOS button i can press ( yes i have tried all the standard ones)Regarding the VIA chip, isn't that the Disk Controller?Kind Regards, and keep up the good work :=)

author: Monkeh
author_rank: Super Contributor
timestamp: December 12, 2013, 10:26:49 pm
content: Quote from: pappkopp on December 12, 2013, 10:26:02 pmNo.. did you read the datasheet you posted?

author: pappkopp
author_rank: Contributor
timestamp: December 13, 2013, 01:21:53 pm
content: Quote from: Monkeh on December 12, 2013, 10:26:49 pmI guess that the "Floppy disk" is under the genre of Compact flash disk?

author: Monkeh
author_rank: Super Contributor
timestamp: December 13, 2013, 04:37:03 pm
content: Quote from: pappkopp on December 13, 2013, 01:21:53 pmGuessing won't get you very far.

author: TheBay
author_rank: Unknown
timestamp: December 13, 2013, 04:49:52 pm
content: Compact flash is IDE not a floppy controller.

author: TheBay
author_rank: Unknown
timestamp: December 13, 2013, 07:28:24 pm
content: Quote from: Monkeh on December 13, 2013, 04:37:03 pmThis forum needs a like button

author: Tinkerer
author_rank: Frequent Contributor
timestamp: December 14, 2013, 03:50:32 am
content: Quote from: pappkopp on December 12, 2013, 12:20:55 pmIf that flash card has bad sectors, you very likely have corruption.

author: tja
author_rank: Contributor
timestamp: January 19, 2020, 07:32:54 pm
content: I've just acquired one of these devices, and have spent a little time trying to reverse engineer it.I took a slightly different approach to video output to the OP, and just soldered a VGA socket into the unpopulated spot on the MB - works fine.Major problem is I have not been able to get into the BIOS at all, have rebooted many times and pressed all manner of keys - nada.This is what it says on boot up:Validating firmware CRC...CKIMAGES v2.1Validating files...CRC is valid.Booting into firmware…LINLD v0.97Kernel command line:root=/dev/ram0 rw console=ttyS1,115200 ramdisk_size=163840 ide=nodmaDecompressing Linux... Parsing ELF... done .Booting the kernel .It appears to boot into FreeDOS, which then loads Linux. It is possible to interrupt the boot process and explore from a FreeDOS prompt, but I haven't found out much. Very limited range of FreeDOS commands available.I have extracted the BIOS flash rom (a 39sf040) and dumped it using an Arduino lash-up, but I don’t know what to do next - what format should I save the data as, and what utilities can I use to manipulate the BIOS, if any?All help gratefully received.Hi-res photos of the board, BIOS dump and boot photos here:https://drive.google.com/open?id=1WMaan81lUdivlR2-s8uoYmRYDbtQXcHQCheersTim

author: Prehistoricman
author_rank: Regular Contributor
timestamp: January 19, 2020, 11:41:31 pm
content: Quote from: tja on January 19, 2020, 07:32:54 pmThe ROM is probably not compressed at all but you can try running binwalk on it to see what comes up.I tried the link but it's not open access.

author: tja
author_rank: Contributor
timestamp: January 20, 2020, 10:03:01 am
content: Try this link:https://drive.google.com/drive/folders/1WMaan81lUdivlR2-s8uoYmRYDbtQXcHQ?usp=sharingProblem is I have no idea what the format of the rom file should be.

author: Prehistoricman
author_rank: Regular Contributor
timestamp: January 20, 2020, 02:22:49 pm
content: I converted it to a binary file and ran binwalk and strings on it.Binwalk didn't detect anything except a couple of false positives of compression. I've attached the entropy graph. You can clearly see the middle section is compressed or encrypted, and there is a section to the right that is probably code.Strings was more useful. Here's what I found:AMIBIOSC08003...DIMM0BANK0DIMM1BANK1AGPPCI1AMIBOOT ROM…ROMf000u%fROMf000f…$$CTBootBlock SIO TableSIO RegisterValue` a$@&@($BCS$BTSSWCOB20208/05/09What I'm seeing is an AMI BIOS from 2009.

author: tja
author_rank: Contributor
timestamp: January 25, 2020, 06:43:18 pm
content: Yes, it looks like the file format for this type of data is just a simple 512k binary dump - I was expecting something more complicated like IntelHex or whatever, but it appears that is not the case. So happily running amibcp and mmtool now, trying to work out why the BIOS User interface does not appear :-(

author: tja
author_rank: Contributor
timestamp: January 26, 2020, 09:24:00 pm
content: Update: I discovered that inserting a bootable USB, and pressing F3 on boot, a selection screen appears and the bootable USB can be chosen.This only occurs if the (working) Sonicwall CF card is inserted. If the card isn't present, the device won't boot at all.Anyway, booting into a FreeBSD LiveCD (all I had on hand) gives the following dmsg and pciconf -lvc outputs:Code:---<<BOOT>>---Copyright (c) 1992-2019 The FreeBSD Project.Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994The Regents of the University of California. All rights reserved.FreeBSD is a registered trademark of The FreeBSD Foundation.FreeBSD 12.1-RELEASE r354233 GENERIC i386FreeBSD clang version 8.0.1 (tags/RELEASE_801/final 366581) (based on LLVM 8.0.1)VT(vga): resolution 640x480CPU: VIA C7 Processor 1800MHz (1795.55-MHz 686-class CPU)Origin="CentaurHauls" Id=0x6d0 Family=0x6 Model=0xd Stepping=0Features=0xa7c9bbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,CMOV,PAT,CLFLUSH,ACPI,MMX,FXSR,SSE,SSE2,TM,PBE>Features2=0x4181<SSE3,EST,TM2,xTPR>AMD Features=0x100000<NX>VIA Padlock Features=0xffcc<RNG,AES,AES-CTR,SHA1,SHA256,RSA>real memory = 2147483648 (2048 MB)avail memory = 2004865024 (1911 MB)Event timer "LAPIC" quality 100ACPI APIC Table: <080509 APIC1155>arc4random: no preloaded entropy cacheioapic0 <Version 0.3> irqs 0-23 on motherboardioapic1 <Version 0.3> irqs 24-47 on motherboardTimecounter "TSC" frequency 1795549724 Hz quality 800random: entropy device external interfacekbd1 at kbdmux0 loadedmodule_register_init: MOD_LOAD (vesa, 0x14d9fb0, 0) error 19random: registering fast source VIA Nehemiah Padlock RNGrandom: fast provider: "VIA Nehemiah Padlock RNG"nexus0vtvga0: <VT VGA driver> on motherboardcryptosoft0: <software crypto> on motherboardacpi0: <080509 RSDT1155> on motherboardacpi0: Power Button (fixed)cpu0: <ACPI CPU> on acpi0attimer0: <AT timer> port 0x40-0x43 irq 0 on acpi0Timecounter "i8254" frequency 1193182 Hz quality 0Event timer "i8254" frequency 1193182 Hz quality 100atrtc0: <AT realtime clock> port 0x70-0x71 irq 8 on acpi0atrtc0: registered as a time-of-day clock, resolution 1.000000sEvent timer "RTC" frequency 32768 Hz quality 0Timecounter "ACPI-fast" frequency 3579545 Hz quality 900acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0pci0: <ACPI PCI bus> on pcib0agp0: <VIA 3364 (P4M900) host to PCI bridge> on hostb0agp0: aperture size is 128Mdevice_attach: ioapic0 attach returned 6pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0pci1: <ACPI PCI bus> on pcib1vgapci0: <VGA-compatible display> mem 0xf8000000-0xfbffffff,0xfd000000-0xfdffffff irq 16 at device 0.0 on pci1vgapci0: Boot video devicepcib2: <ACPI PCI-PCI bridge> irq 27 at device 2.0 on pci0pci2: <ACPI PCI bus> on pcib2pcib3: <ACPI PCI-PCI bridge> irq 31 at device 3.0 on pci0pci3: <ACPI PCI bus> on pcib3em0: <Intel(R) PRO/1000 Network Connection> port 0xcc00-0xcc3f mem 0xfcfe0000-0xfcffffff,0xfcfc0000-0xfcfdffff irq 21 at device 8.0 on pci0em0: Invalid MAC addressem0: IFDI_ATTACH_PRE failed 5device_attach: em0 attach returned 5em0: <Intel(R) PRO/1000 Network Connection> port 0xc880-0xc8bf mem 0xfcf80000-0xfcf9ffff,0xfcf60000-0xfcf7ffff irq 20 at device 9.0 on pci0em0: Invalid MAC addressem0: IFDI_ATTACH_PRE failed 5device_attach: em0 attach returned 5pci0: <encrypt/decrypt, network/computer crypto> at device 10.0 (no driver attached)atapci0: <VIA ATA controller> port 0xc800-0xc807,0xbc00-0xbc03,0xb880-0xb887,0xb800-0xb803,0xb480-0xb48f mem 0xfcf3fc00-0xfcf3ffff irq 21 at device 15.0 on pci0ata2: <ATA channel> at channel 0 on atapci0ata3: <ATA channel> at channel 1 on atapci0atapci1: <VIA ATA controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xfc00-0xfc0f at device 15.1 on pci0ata0: <ATA channel> at channel 0 on atapci1ata1: <ATA channel> at channel 1 on atapci1uhci0: <VIA 83C572 USB controller> port 0xb000-0xb01f irq 20 at device 16.0 on pci0uhci0: LegSup = 0xa000usbus0 on uhci0uhci1: <VIA 83C572 USB controller> port 0xb080-0xb09f irq 22 at device 16.1 on pci0uhci1: LegSup = 0xa000usbus1 on uhci1uhci2: <VIA 83C572 USB controller> port 0xb400-0xb41f irq 21 at device 16.2 on pci0uhci2: LegSup = 0xa000usbus2 on uhci2ehci0: <VIA VT6202 USB 2.0 controller> mem 0xfcf3f800-0xfcf3f8ff irq 22 at device 16.4 on pci0usbus3: EHCI version 1.0usbus3 on ehci0isab0: <PCI-ISA bridge> at device 17.0 on pci0isa0: <ISA bus> on isab0acpi_button0: <Sleep Button> on acpi0pcib4: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0pci4: <ACPI PCI bus> on pcib4pcib5: <ACPI PCI-PCI bridge> at device 0.0 on pci4pci5: <ACPI PCI bus> on pcib5em0: <Intel(R) PRO/1000 Network Connection> port 0xec00-0xec1f mem 0xfebe0000-0xfebfffff irq 16 at device 0.0 on pci5em0: Invalid MAC addressem0: IFDI_ATTACH_PRE failed 5device_attach: em0 attach returned 5pcib6: <ACPI PCI-PCI bridge> at device 0.1 on pci4pci6: <ACPI PCI bus> on pcib6em0: <Intel(R) PRO/1000 Network Connection> port 0xdc00-0xdc1f mem 0xfeae0000-0xfeafffff irq 16 at device 0.0 on pci6em0: Invalid MAC addressem0: IFDI_ATTACH_PRE failed 5device_attach: em0 attach returned 5acpi_button1: <Power Button> on acpi0uart1: <16550 or compatible> port 0x2f8-0x2ff irq 3 on acpi0uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0atkbd0: <AT Keyboard> irq 1 on atkbdc0kbd0 at atkbd0atkbd0: [GIANT-LOCKED]atkbdc0: non-PNP ISA device will be removed from GENERIC in FreeBSD 12.ppc0: parallel port not found.est0: <Enhanced SpeedStep Frequency Control> on cpu0Timecounters tick every 1.000 msecusbus0: 12Mbps Full Speed USB v1.0usbus1: 12Mbps Full Speed USB v1.0usbus2: 12Mbps Full Speed USB v1.0ugen0.1: <VIA UHCI root HUB> at usbus0uhub0: <VIA UHCI root HUB, class 9/0, rev 1.00/1.00, addr 1> on usbus0ugen1.1: <VIA UHCI root HUB> at usbus1uhub1: <VIA UHCI root HUB, class 9/0, rev 1.00/1.00, addr 1> on usbus1ugen2.1: <VIA UHCI root HUB> at usbus2uhub2: <VIA UHCI root HUB, class 9/0, rev 1.00/1.00, addr 1> on usbus2usbus3: 480Mbps High Speed USB v2.0ugen3.1: <VIA EHCI root HUB> at usbus3uhub3: <VIA EHCI root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus3uhub0: 2 ports with 2 removable, self powereduhub1: 2 ports with 2 removable, self powereduhub2: 2 ports with 2 removable, self powereduhub3: 6 ports with 6 removable, self poweredugen3.2: <Generic Mass Storage> at usbus3umass0 on uhub3umass0: <Generic Mass Storage, class 0/0, rev 2.00/1.00, addr 2> on usbus3umass0: SCSI over Bulk-Only; quirks = 0xc100umass0:4:0: Attached to scbus4(aprobe1:ata0:0:0:0): SETFEATURES SET TRANSFER MODE. ACB: ef 03 00 00 00 40 00 00 00 00 0a 00(aprobe1:ata0:0:0:0): CAM status: ATA Status Error(aprobe1:ata0:0:0:0): ATA status: 51 (DRDY SERV ERR), error: 04 (ABRT )(aprobe1:ata0:0:0:0): RES: 51 04 00 00 00 00 00 00 00 0a 00(aprobe1:ata0:0:0:0): Retrying command, 0 more tries remain(aprobe1:ata0:0:0:0): SETFEATURES SET TRANSFER MODE. ACB: ef 03 00 00 00 40 00 00 00 00 0a 00(aprobe1:ata0:0:0:0): CAM status: ATA Status Error(aprobe1:ata0:0:0:0): ATA status: 51 (DRDY SERV ERR), error: 04 (ABRT )(aprobe1:ata0:0:0:0): RES: 51 04 00 00 00 00 00 00 00 0a 00(aprobe1:ata0:0:0:0): Error 5, Retries exhaustedTrying to mount root from ufs:/dev/ufs/FreeBSD_Install [ro,noatime]...da0 at umass-sim0 bus 0 scbus4 target 0 lun 0da0: <Generic Flash Disk PMAP> Removable Direct Access SPC-2 SCSI deviceda0: Serial Number 19072216524200da0: 40.000MB/s transfersda0: 7680MB (15728640 512 byte sectors)da0: quirks=0x2<NO_6_BYTE>ugen3.3: <vendor 0x05e3 USB2.0 Hub> at usbus3uhub4 on uhub3uhub4: <vendor 0x05e3 USB2.0 Hub, class 9/0, rev 2.00/32.98, addr 3> on usbus3uhub4: 4 ports with 4 removable, self poweredrandom: unblocking device.ugen3.4: <SIGMACHIP USB Keyboard> at usbus3ukbd0 on uhub4ukbd0: <SIGMACHIP USB Keyboard, class 0/0, rev 1.10/1.10, addr 4> on usbus3kbd2 at ukbd0lo0: link state changed to UPuhid0 on uhub4uhid0: <SIGMACHIP USB Keyboard, class 0/0, rev 1.10/1.10, addr 4> on usbus3Code:hostb0@pci0:0:0:0:class=0x060000 card=0x03641106 chip=0x03641106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 Host Bridge'class = bridgesubclass = HOST-PCIcap 02 = AGP v3 8x 4x SBA disabledcap 01 = powerspec 2 supports D0 D3 current D0hostb1@pci0:0:0:1:class=0x060000 card=0x13641106 chip=0x13641106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 Host Bridge'class = bridgesubclass = HOST-PCIhostb2@pci0:0:0:2:class=0x060000 card=0x23641106 chip=0x23641106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 Host Bridge'class = bridgesubclass = HOST-PCIhostb3@pci0:0:0:3:class=0x060000 card=0x00000000 chip=0x33641106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 Host Bridge'class = bridgesubclass = HOST-PCIhostb4@pci0:0:0:4:class=0x060000 card=0x43641106 chip=0x43641106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 Host Bridge'class = bridgesubclass = HOST-PCInone0@pci0:0:0:5:class=0x080020 card=0x53641106 chip=0x53641106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 I/O APIC Interrupt Controller'class = base peripheralsubclass = interrupt controllerhostb5@pci0:0:0:6:class=0x060000 card=0x63641106 chip=0x63641106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 Security Device'class = bridgesubclass = HOST-PCIhostb6@pci0:0:0:7:class=0x060000 card=0x00000000 chip=0x73641106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 Host Bridge'class = bridgesubclass = HOST-PCIpcib1@pci0:0:1:0:class=0x060400 card=0x00000000 chip=0xb1981106 rev=0x00 hdr=0x01vendor = 'VIA Technologies, Inc.'device = 'VT8237/VX700 PCI Bridge'class = bridgesubclass = PCI-PCIcap 01 = powerspec 2 supports D0 D3 current D0pcib2@pci0:0:2:0:class=0x060400 card=0xc3231106 chip=0xa3641106 rev=0x80 hdr=0x01vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 PCI to PCI Bridge Controller'class = bridgesubclass = PCI-PCIcap 10 = PCI-Express 1 root port max data 128(256) RO NSlink x0(x16) speed 0.0(2.5) ASPM disabled(L0s/L1)slot 0 power limit 150000 mW HotPlug(empty) surprisecap 01 = powerspec 2 supports D0 D3 current D0cap 05 = MSI supports 1 message, 64 bitcap 08 = HT MSI fixed address window disabled at 0xfee00000cap 0d = PCI Bridge card=0xc3231106ecap 0001 = AER 1 0 fatal 0 non-fatal 0 correctedecap 0002 = VC 1 max VC1ecap 0005 = Root Complex Link Declaration 1pcib3@pci0:0:3:0:class=0x060400 card=0xc3231106 chip=0xc3641106 rev=0x80 hdr=0x01vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 PCI to PCI Bridge Controller'class = bridgesubclass = PCI-PCIcap 10 = PCI-Express 1 root port max data 128(256) RO NSlink x0(x1) speed 0.0(2.5) ASPM disabled(L0s/L1)slot 0 power limit 150000 mW HotPlug(empty) surprisecap 01 = powerspec 2 supports D0 D3 current D0cap 05 = MSI supports 1 message, 64 bitcap 08 = HT MSI fixed address window disabled at 0xfee00000cap 0d = PCI Bridge card=0xc3231106ecap 0001 = AER 1 0 fatal 0 non-fatal 0 correctedecap 0002 = VC 1 max VC1ecap 0005 = Root Complex Link Declaration 1none1@pci0:0:8:0:class=0x020000 card=0x107c8086 chip=0x107c8086 rev=0x05 hdr=0x00vendor = 'Intel Corporation'device = '82541PI Gigabit Ethernet Controller'class = networksubclass = ethernetcap 01 = powerspec 2 supports D0 D3 current D0cap 07 = PCI-X supports 2048 burst read, 1 split transactionnone2@pci0:0:9:0:class=0x020000 card=0x107c8086 chip=0x107c8086 rev=0x05 hdr=0x00vendor = 'Intel Corporation'device = '82541PI Gigabit Ethernet Controller'class = networksubclass = ethernetcap 01 = powerspec 2 supports D0 D3 current D0cap 07 = PCI-X supports 2048 burst read, 1 split transactionnone3@pci0:0:10:0:class=0x100000 card=0x0001177d chip=0x0003177d rev=0x00 hdr=0x00vendor = 'Cavium, Inc.'device = 'Nitrox XL N1 Lite'class = encrypt/decryptsubclass = network/computer cryptocap 07 = PCI-X 64-bit supports 133MHz, 4096 burst read, 32 split transactionscap 01 = powerspec 2 supports D0 D3 current D0cap 05 = MSI supports 1 message, 64 bitatapci0@pci0:0:15:0:class=0x01018f card=0x52871106 chip=0x52871106 rev=0x20 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'VT8251 Serial ATA Controller'class = mass storagesubclass = ATAcap 01 = powerspec 2 supports D0 D3 current D0atapci1@pci0:0:15:1:class=0x01018a card=0x05711106 chip=0x05711106 rev=0x07 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'VT82C586A/B/VT82C686/A/B/VT823x/A/C PIPC Bus Master IDE'class = mass storagesubclass = ATAcap 01 = powerspec 2 supports D0 D3 current D0uhci0@pci0:0:16:0:class=0x0c0300 card=0x30381106 chip=0x30381106 rev=0x91 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'VT82xx/62xx UHCI USB 1.1 Controller'class = serial bussubclass = USBcap 01 = powerspec 2 supports D0 D1 D2 D3 current D0uhci1@pci0:0:16:1:class=0x0c0300 card=0x30381106 chip=0x30381106 rev=0x91 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'VT82xx/62xx UHCI USB 1.1 Controller'class = serial bussubclass = USBcap 01 = powerspec 2 supports D0 D1 D2 D3 current D0uhci2@pci0:0:16:2:class=0x0c0300 card=0x30381106 chip=0x30381106 rev=0x91 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'VT82xx/62xx UHCI USB 1.1 Controller'class = serial bussubclass = USBcap 01 = powerspec 2 supports D0 D1 D2 D3 current D0ehci0@pci0:0:16:4:class=0x0c0320 card=0x31041106 chip=0x31041106 rev=0x90 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'USB 2.0'class = serial bussubclass = USBcap 01 = powerspec 2 supports D0 D1 D2 D3 current D0cap 0a = EHCI Debug Port at offset 0xa0 in map 0x14isab0@pci0:0:17:0:class=0x060100 card=0x32871106 chip=0x32871106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'VT8251 PCI to ISA Bridge'class = bridgesubclass = PCI-ISAcap 01 = powerspec 2 supports D0 D3 current D0hostb7@pci0:0:17:7:class=0x060000 card=0x287e1106 chip=0x287e1106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'VT8237/8251 Ultra VLINK Controller'class = bridgesubclass = HOST-PCIcap 08 = HT interrupthostb8@pci0:0:19:0:class=0x060000 card=0x00000000 chip=0x287b1106 rev=0x00 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'VT8251 Host Bridge'class = bridgesubclass = HOST-PCIvgapci0@pci0:1:0:0:class=0x030000 card=0x19750908 chip=0x33711106 rev=0x01 hdr=0x00vendor = 'VIA Technologies, Inc.'device = 'CN896/VN896/P4M900 [Chrome 9 HC]'class = displaysubclass = VGAcap 01 = powerspec 2 supports D0 D1 D2 D3 current D0cap 02 = AGP v3 8x 4x SBA disabledpcib5@pci0:128:0:0:class=0x060400 card=0x00000000 chip=0x287c1106 rev=0x00 hdr=0x01vendor = 'VIA Technologies, Inc.'device = 'VT8251 PCIE Root Port'class = bridgesubclass = PCI-PCIcap 10 = PCI-Express 1 root port max data 128(256)link x1(x2) speed 2.5(2.5) ASPM disabled(L0s/L1)cap 01 = powerspec 2 supports D0 D3 current D0cap 05 = MSI supports 1 message, 64 bit, vector maskscap 08 = HT MSI fixed address window disabled at 0xfee00000cap 0d = PCI Bridge card=0x00000000ecap 0001 = AER 1 0 fatal 0 non-fatal 0 correctedecap 0002 = VC 1 max VC1ecap 0005 = Root Complex Link Declaration 1pcib6@pci0:128:0:1:class=0x060400 card=0x00000004 chip=0x287d1106 rev=0x00 hdr=0x01vendor = 'VIA Technologies, Inc.'device = 'VT8251 PCIE Root Port'class = bridgesubclass = PCI-PCIcap 10 = PCI-Express 1 root port max data 128(256)link x1(x1) speed 2.5(2.5) ASPM disabled(L0s/L1)cap 01 = powerspec 2 supports D0 D3 current D0cap 05 = MSI supports 1 message, 64 bit, vector maskscap 08 = HT MSI fixed address window disabled at 0xfee00000cap 0d = PCI Bridge card=0x00000004ecap 0001 = AER 1 0 fatal 0 non-fatal 0 correctedecap 0002 = VC 1 max VC1ecap 0005 = Root Complex Link Declaration 1none4@pci0:130:0:0:class=0x020000 card=0x00008086 chip=0x109a8086 rev=0x00 hdr=0x00vendor = 'Intel Corporation'device = '82573L Gigabit Ethernet Controller'class = networksubclass = ethernetcap 01 = powerspec 2 supports D0 D3 current D0cap 05 = MSI supports 1 message, 64 bitcap 10 = PCI-Express 1 endpoint max data 128(256) RO NSlink x1(x1) speed 2.5(2.5)ecap 0001 = AER 1 0 fatal 1 non-fatal 0 correctedecap 0003 = Serial 1 000000ffff000000none5@pci0:129:0:0:class=0x020000 card=0x00008086 chip=0x109a8086 rev=0x00 hdr=0x00vendor = 'Intel Corporation'device = '82573L Gigabit Ethernet Controller'class = networksubclass = ethernetcap 01 = powerspec 2 supports D0 D3 current D0cap 05 = MSI supports 1 message, 64 bitcap 10 = PCI-Express 1 endpoint max data 128(256) RO NSlink x1(x1) speed 2.5(2.5)ecap 0001 = AER 1 0 fatal 1 non-fatal 0 correctedecap 0003 = Serial 1 000000ffff000000I am wondering if the presence of the Cavium Nitrox is going to be a problem. Obviously this chip isn't going to be supportable, but will the board be usable without it? I wonder. However, all in all, an interesting reverse engineering challenge.