[vortex] 3C905C EEPROM bogusness

[Bogdan Costescu]

Hi,

I've been looking for a method of computing a correct checksum of the
EEPROM for 3C905C cards. I haven't found in the documentation a
description of the way the first checksum is computed, but I assumed that
it should be more or less similar to the older cards.
Using vortex-diag, I was able to dump the first part of EEPROM from a
quite large number of cards (all 3C905C). What I have found is that some
of them have complete bogus data.

Offset 0x09 (RomInfo) has documented values of 0x0800, 0x1800, 0x2800 and
0x3800 (the last two being reserved), but I have found cards with 0x0001
in this register.
Offset 0x16 and 0x1a (LANWORKS Data 1 & 2) are reserved and such should be
zero; I have found cards with 0x0249 or 0x0241 and 0x0002 or 0x000a at
these locations.

By _ignoring_ such data, I was able to find a way to compute a checksum
that works with most (but not all!) of my cards. It's byte based (as
opposed to word based for older cards):

	u16 *ee;
	unsigned char sum, i;

	for (i = 0, sum = 0; i < 0x20; i++) {
		switch (i) {
			0x09:
				sum ^= 0x08;
/* this is derived from ee[0x09] = 0x0800; XOR with the LSB (0) doesn't
change anything */
				break;
			0x16, 0x1a:
/* this is derived from ee[0x16] = 0 and ee[0x1a] = 0; XOR with 0 doesn't
change anything */
				break;
			default:
				sum ^= (ee[i] & 0xff);
				sum ^= (ee[i] >> 8);
		}
	}

and should be compared as it is (without any additional XOR/shift) with
(ee[0x20] & 0xff).

Anyway, my question is: how can this strange data be in EEPROM ?
As many users reported "Invalid checksum" with their hardware, is there a
way to know more about this issue? Should we just live with hacks like
above for computing checksums or re-write our EEPROMs to be cf. specs?

And an answer to an old question from Andrew: I think that vortex-diag can
be used to restore EEPROM content if you destroy it. The important fields
in EEPROM are documented and most of them have some easy to guess values
(except PciParm* and maybe SoftwareInfo2 for 3C905C); as for the Eth.
address, you can pick one based on another card that you have - this
address should never be transmitted outside you local network...
vortex-diag already has routines for reading and writting EEPROM, so it
should be quite easy to transform it into a dump/restore tool (if it's not
already).

Sincerely,

Bogdan Costescu

IWR - Interdisziplinaeres Zentrum fuer Wissenschaftliches Rechnen
Universitaet Heidelberg, INF 368, D-69120 Heidelberg, GERMANY
Telephone: +49 6221 54 8869, Telefax: +49 6221 54 8868
E-mail: Bogdan.Costescu@IWR.Uni-Heidelberg.De