Dell VEP/VMWare Edge/Velo Cloud SD-WAN/VeraCloud VEP1400/VEP1400-X firewall units

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.

Brood

Member
Apr 15, 2023
58
9
8
Good find! The other pins (not soldered on your model) are probably either a serial port connected to the PIC or the header for the LEDs that go behind the front panel logo on SD-WAN/Velo branded boxes.

Edit: maybe this is what the jumpers are for? Disconnecting Vcc and GND from he PIC... I'll see if I can find out with a multimeter. I also know the PIC comes with a bootloader and separate runtime application, and it needs a machine reboot to switch from one mode to another, which means the startup mode is probably managed by the CPLD? In any case, this means that reading it will be easiest with either the machine off, or with the PIC in bootloader mode while it is on.

If you have the time, check the following options:

1. Disabling the PIC watchdog via I2C, a Live Linux over USB should be plenty fast in booting before the WDT kicks in

2. Flashing the BIOS backup, or checking the BIOS ID using Afu, if the ID is the same as mine it should work

As for those with a broken CPLD: the bitstream is ready to test, so hit me up if I need to write some instructions for that.

Fun fact, the MCLR pin is indeed GPIO-controlled, GPIO mapping has a specific pin for it:
I've tried centos live usb but it seems that the command line is not active. What do I need to change or which linux has commandline as default so I can just boot.

As for the I2C commands for the watchdog. Do I just send the following commands in the commandline to turn off the watchdog?

Code:
i2cset -y 1 0x22 0 0 b

i2cset -y 1 0x24 0x0 0x0 b
I presume i need to send the command on each reboot
 

oneplane

Well-Known Member
Jul 23, 2021
845
484
63
Add this to your cmdline: console=ttyS0,115200

That will enable the serial console, unless the image you're using does some weird stuff. As for i2c, that is more to test it out, if it doesn't work it means the watchdog we have to tackle is not the PIC. If it does work, it is the PIC and then we steal the contents of my PIC and put it in yours.
 
  • Like
Reactions: Brood

compuwizz

Member
Feb 25, 2017
46
45
18
40
To my surprise, most Linux-based appliance-like software distributions have DSA disabled :rolleyes: This means that while native configuration for the network ports on VEP1400 (non-X) models is available, it's just not turned on. Even nightly builds from VyOS and OpenWRT don't have it by default. OpenWRT does have it for device-specific builds, but for x86 they aren't enabling it by default.

I'm currently re-building VyOS to see how hard it would to be make a custom kernel; it essentially just needs 2 or 3 config flags turned on to make it all work.

In the meantime, the vep1400-mdio-tool or whatever it's called does work fine outside of DiagOS, so even on standard distributions this can be used to configure the switch. The LEDs are configured over I2C, but the configuration is persistent it seems, so once it's configured correctly it doesn't just randomly reset and the LEDs work. For the SFP power control I'm not entirely sure, but that's also all just standard I2C. Even BIOS chip selection is I2C based.

I have to clean the FPGA bitstream, DiagOS image and BIOS files so my personal info isn't in there, but other than the PIC we now have a complete set to turn any VEP1400 box into whatever we want.
Have you made progress with DSA? I have another appliance that has a similar Atom C3XXX, two intel 10G interfaces feeding a Marvell chip that I'd like to experiment with but haven't been able to find enough information on how to configure the switch to present individual interfaces to the OS.
 

oneplane

Well-Known Member
Jul 23, 2021
845
484
63
Have you made progress with DSA? I have another appliance that has a similar Atom C3XXX, two intel 10G interfaces feeding a Marvell chip that I'd like to experiment with but haven't been able to find enough information on how to configure the switch to present individual interfaces to the OS.
It seems there are plenty of ways to get existing linux distributions to enable DSA and DSA drivers, but on x86 there is no default method to get DSA to scan MDIO buses. On other platforms you usually get a DTB which describes the hardware addresses and buses, and that also takes care of pointing out to the kernel which PHY and MDIO bus to talk to on which SERDES or MAC.

I did get plenty of non-DSA options working, but they all sidestep the normal interfacing methods and end up just providing virtual VLAN interfaces. The downside to that is that you cannot get any actual port status information.

So far, I have VyOS, OpenWRT, Debian and Proxmox with DSA + Marvell enabled kernels and they all do the same which makes sense, it's all Linux after all). On FreeBSD (including OpnSense) you have a slightly different situation, the default etherswitch configuration utility works fine, but they don't have a DSA-like structure where the ports show up in ifconfig.

If you just want to get the ports passing traffic, I'd recommend OpnSense and an RC script which should get you running pretty easily. On Linux, you still have to use a separate MDIO tool (there are a few, including MII tool instead of MDIO), the problem is that you don't get a nice abstracted interface, but you rather have to set bytes on specific registers to change port, tagging and link configurations. Usually in the shape of ./mdio-tool eth0 phy w 0x01 0x01 0x01 0x01 where the first byte is the address of the switch chip, the second one something like the port, the third one the register you want to change and the fourth one the value you want to change it to (order might be different).

I'm trying to see who I need to get a hold of to get some better options for this; I imagine some module parameters might be the easiest way to move forward, so we can modprobe dsa or mv88eXXXXX with some address parameter where we specify what MDIO bus or ethernet card to pick, and it then does the switch chip detection and control automatically. The code is all there (for the DTB part) but just not exposed as module parameter.
 

compuwizz

Member
Feb 25, 2017
46
45
18
40
Mine does show the individual interfaces in vyos but I had to press the buttons next to the ports internally for them to appear. Maybe opening a feature request at Home with all the kernel settings you altered to get it working and the basics of getting a port to appear in the OS would be enough to help them add support.
 

oneplane

Well-Known Member
Jul 23, 2021
845
484
63
Mine does show the individual interfaces in vyos but I had to press the buttons next to the ports internally for them to appear. Maybe opening a feature request at Home with all the kernel settings you altered to get it working and the basics of getting a port to appear in the OS would be enough to help them add support.
Well, currently no ports will appear unless the ACPI tables show individual devices (8 of them in my case), or the DTB has hardcoded addresses where the switch chip can be found. I should probably try some button combinations myself to see if that alters the tables on my unit, but so far there is no code in the BIOS, CPLD or PIC that would enable that AFAICS. There is a big difference in 'ports' vs 'DSA" as well: just 'ports' doesn't give access to the switch but instead emulates multiport NICs, which means doing things like port mirroring, hardware forwarding and acceleration and having ports talk to each other but not the host etc. cannot be configured (but you might also wonder how useful that might be).

Which board do you have?
 

Brood

Member
Apr 15, 2023
58
9
8
Can someone please help me with booting a live usb to console mode...

1684996002643.png

I do not know if I'm doing it correctly but here goes... I press tab on the Debian GNU/Linux live (first line) I then add the "console=ttys0,115200" and press enter and nothing. So I must be getting it wrong somewhere.

Any help would be much appreaciated.

EDIT:

So i managed to get a basic debian to boot to console by appending the following:

Code:
vga=normal console=tty0 console=ttyS0,115200n8
Second EDIT:

Managed to boot debian in console mode and log in just to find it does not have the i2cset (bashing head against wall)

Can anyone recommend a live disk that has the I2Cset so that I can try the i2cset comands and see if it disables the watchdog?

Third EDIT:

Tried linux mint live disk aslo same issue no I2Cset installed. (ps mint needs "gfxpayload=text" instead of "VGA=normal")
 
Last edited:

oneplane

Well-Known Member
Jul 23, 2021
845
484
63
It does indeed not come with it by default, most distributions don't have I2C utilities at all.

On Debian you'll need sudo apt install i2c-tools and also issue a sudo modprobe i2c-dev to get /dev/i2c buses to appear. If you don't have internet connectivity (which would make sense -- you could use an USB Ethernet adapter to circumvent this), you can also download the .deb file and its dependencies and do 'sudo dpkg -i <file>' to install them.

As for why you may not have seen anything initially: you also need to remove 'splash' from the Command-line, as it tries to cover the boot process with a nice user-friendly splash image.
 

Brood

Member
Apr 15, 2023
58
9
8
I've continued the work on my Dell Edge 610 regarding the watchdog reboot. I've connected a logic analyser on the PIC I2C lines and my findings were as follows:

1685368942505.png

The sencond I2C bus marked by the blue lines above does not have any signals on them that represents a I2C signal.

The first I2C bus marked by the red lines on the otherhand had a treasure trove of information on it during boot.

I've done three cold boot captures which are as follows:
  1. Booted into the UEFI shell. (watch dog does not kick in this, therefore it must be disabled by the UEFI shell)
  2. Booted into VMware SD-Wan that is still on the device. (watchdog does not kick in this, therefore it must be disabled by the VMware SD-Wan software)
  3. Booted off a USB stick into Pfsense. Watchdog kicked it after 5 minutes and the machine rebooted.
I've done a comparison the data of all three boots and it is as follows:
1685369426700.png

The first 534 lines of data captured are identical... between the three boots...
It changes from there onwards... Lines 535-537 are different beween the 3 boots...

But for line 539 we have the same again between the UEFI boot and the vmware boot... and then it goes into different data between them all.

the other interesting lines are the 0xFF line with TRUE on the UEFI and VMware boot and False for the PFsense boot.

I believe the 0XFF line has something to do with the watchdog or the activation of the networks...

PS the networks are not alive in the UEFI shell. well the lights doesn't turn on. The hunt is on going to turn the watchdog off on the Dell Edge 610 that thas the VMware on it
 

oneplane

Well-Known Member
Jul 23, 2021
845
484
63
Excellent progress. So it appears the tiny switches next to the port default in OFF mode because the PIC is on the same bus (and one of the FPGA ports as well) so that makes sense.

I would love to get a disk image of the VMWare software from the Edge 610, the init and RC scripts should also contain the PIC commands.

I don't yet know how to write to I2C from UEFI (I'm sure it's possible), but considering the PIC WDT tries to get some check-ins from somewhere (either the CPLD Address -- FPGA really), it makes sense that it's written to to disable it, or not disabled but rather actually pinged periodically.

Ideally we'd use it for our own purposes, you enable the WDT and if something goes wrong it resets the box for you. Neat.

If you have a large enough USB drive lying around we can test the DiagOS image on that (first without any patches and then with manually added I2C commands). If that works, the next step would be getting a DD trump from the VeloCloud thing.
 

Brood

Member
Apr 15, 2023
58
9
8
So I've installed the diagos-recovery-x86_64-dellemc_vep1400_c3538-r0.3.43.3.81-26 onto a memory pen and so far its booted from it and stable with no watchdog resetting the system. So more forward movement. Now its figuring out how to use the dell DiagOS to create the image of the MMC.

So I believe it must be turning it off in the background
 
  • Like
Reactions: oneplane

oneplane

Well-Known Member
Jul 23, 2021
845
484
63
So I've installed the diagos-recovery-x86_64-dellemc_vep1400_c3538-r0.3.43.3.81-26 onto a memory pen and so far its booted from it and stable with no watchdog resetting the system. So more forward movement. Now its figuring out how to use the dell DiagOS to create the image of the MMC.

So I believe it must be turning it off in the background
It's probably doing that from the rc.local script, the first few lines say something like "Disable PIC Watchdog" and do a few I2C writes.
As for backups, if you have an external disk you can write to, you can use dd to read the mmcblk devices, or even use cp which works on block devices too. Both can write out to files, so that should be fine. I've also used a USB-Ethernet adapter to bypass the internal switch and use a plain interface and that works for getting stuff on and off the box as well (it has SSH and SFTP enabled).
 

Brood

Member
Apr 15, 2023
58
9
8
I have no idea what I've done... but it seems that I managed to disable the watchdog on the Dell Edge 610. I've booted and installed the diagos-recovery-x86_64-dellemc_vep1400_c3538-r0.3.43.3.81-26 onto a memory pen and was able to dump the VMware images and in the process I seem to have bricked the VMware boot.

Hey ho what can you do... So decided to just overwite the EMMC module with the diagos-recovery-x86_64-dellemc_vep1400_c3538-r0.3.43.3.81-26 so that I can reliably boot into something.

I've not had any luck installing PFsense on the EMMC... it looks like i need to wipe the DiagOS partitions fully so that I can install pfsense and it made me wonder...

1685685910077.png

Has anyone tried to install a ssd into this slot? it looks like a M key M.2 nvme slot on the Dell Edge 610 as it would make life easier if pfsense had a dedicated drive to install to and to leave the DiagOs intact on the EMMC module

Edit: something along these lines M.2 2242

Second Edit: on closer inspection, the LTE slot is a B-Keyed... so it looks like a M.2 2242 B+Mkey is what is needed

Third edit: I have a B+Mkey sata on the way so will report back once I have it...
 
Last edited:

oneplane

Well-Known Member
Jul 23, 2021
845
484
63
With the help of an Edge 610 dump from Brood we have enough information to permanently disable any PIC watchdog. I'll see if I can get some sort of write-up going, but it's pretty similar to what can be found in the VEP1440-X diagOS RC script. As a bonus, the velocloud openwrt image also contains the entire pin and device tables in /etc/dn/diag for some reason so we can also get some idea what to do if someone manages to find a device from a different revision.

It also seems to contain python libraries for switch management as well as mv88e6 mdio configuration (but smells like pre-DSA).
 
Last edited:
  • Like
Reactions: Brood

Brood

Member
Apr 15, 2023
58
9
8
Do I understand it correctly that the dell edge 610 arcitecture is something along these lines?
1685797768993.png

The reason for asking is as I was able to get the dell edge 640 to just run without any issues after I reflashed with the VEP1400-x bios and I just used the IX2 and IX3 ports as they seem to be directly connected to GE5 and GE6... But the Dell edge 610 does not seem to work... the IX2 and IX3 interfaces are seen by Opnsense but they don't seem to be connected to GE5 and GE6 like on the Edge 640.

I presume that the switch needs to be configured on the Edge 610 before it comes out to the GE ports or I need to use SFP to RJ45 modules to get the direct connection to the cpu?
 

oneplane

Well-Known Member
Jul 23, 2021
845
484
63
It is indeed different. So ethtool and some other utilities will confirm that the ports on the C3000 SoC are actually in 'backplane mode', which are internally both connected to the switch. By default, those ports also support a variation of SR-IOV which makes it look like the SoC actually has 4 ports, but it doesn't. (well, there are C3000 SKUs that allow for 4x10GbE but the 1G base units Dell makes are all the lower end C3000 I think)

The reason most operating systems will happily allocate 4 interfaces is because the C3000 came around just before mainstream DSA, but just around mainstream DPDK, so it does have the hardware, but they just assumed the OS would use some special SDK sauce to properly configure the interfaces.

In the 10G version that's automagically solved because it just uses 2x10G-KR or 4x10G-KR depending on the model, and then (IIRC) i350 PCIe NICs for the remaining ports. I don't have one turned on here right now, but I remember lspci and pciconf reporting the different NICs on the VEP1425 and up. I also have a VEP1485 here which probably does the same.

Untitled Diagram-Page-2.drawio.png

What I did forget to add in my diagram is the eth0 interface between the C3000 and the Switch is also the MDIO interface which is used to control the switch chip. The MDIO tool from Dell, and the other tools do make a distinction between setting MAC registers, and PHY registers, so I'm assuming one set of registers is used to control port and link settings, while the other one does forwarding and ethernet stuff. As per https://www.kernel.org/doc/Documentation/devicetree/bindings/net/dsa/marvell.txt there generally is a single base address and then everything else is offset from there over the MDIO bus. The GPIO line between the SoC and the Switch can be used to reset the switch, but also to receive a 'switch is ready' signal. The FPGA can also do this, so maybe it's just a simple enable/disable/reset pin on the switch that is used and not a fancy bus.

The Lattice FPGA probably also has some direct lines to the SFP+ ports, I haven't checked yet, but it controls powerup/powerdown, light power levels and for all ports it also controls the LED settings. I think there must be some sort of real-time interface between the FPGA and the switch because how else would it know whet LEDs to blink and at what speed. (or the Marvell is driving the LEDs directly, but I don't think it can?)

Edit: some random picture (from eTeknix?) shows there are two dual-port devices on the C3000 in many cases, and without any additional information, the OS does indeed not know how it is actually wired up. Ironically, this was actually standard back in the day, to have a separate MAC and PHY etc. and you'd have to tell the OS which ones you have and how you connected them. In the Dell case, I wouldn't be surprised if they have one link of each of them connected to the switch to make better use of hardware assistance, but this is just a guess.
Untitled.jpg

Edit2: Another somewhat random datasheet for a COM Express module: https://www.c-dis.net/media/images/upload/DFI-DV970-COM-Express-Basic-DataSheet.pdf it shows a bunch of stuff specific to them:

  • PHY for X557 or CS4227/CS4223 and Controller for Intel® I210AT/Intel® I210IT
  • 2 x Independent 10GbE Media Access Controller (Sku dependent)
  • Supports up to Two 10GBASE-KR Interfaces and Max up to Four 10GbE MAC Ports
    Supports Intel® X557-AT/AT2/AT4 10GbE PHY
  • Supports Inphi CS4227 (2 port)/CS4223 (4 port) (maximum bandwidth is 20Gb when 4 ports of 10G interface active at the same time)
  • 1 x Intel® I210AT (10/100/1000Mbps) (normal temp.) or
  • 1 x Intel® I210IT (10/100/1000Mbps) (wide temp.)
But it does show that 10GBASE-KR interface which is what is used (at 2.5G speeds) with that Marvell chip.

Edit3: Here is an image from Mouser, while not totally correct it does show what the acronyms mean and where in the chain they tend to be:

0537.Fig1.png-1230x0.png

The only thing we'll probably not get access to any time soon is the datasheet and specs for the Marvell switch chip, because they NDA it so hard you might as well never buy the chip.
 
Last edited:
  • Like
Reactions: Brood

Brood

Member
Apr 15, 2023
58
9
8
I just had a very off the wall thought... Does anyone still have the Dell Edge 610 that is still kicking the watchdog and has the VMware SD-Wan still on it. Something to try is to install the Dell DiagOS to a memory pen instead of the emmc, Spesificall this one: "diagos-recovery-x86_64-dellemc_vep1400_c3538-r0.3.43.3.81-26" . As I have a suspicion that it wrote something to the non volitile memory of the pic to disable the watchdog being kicked and it seems to be persistent.
 

oneplane

Well-Known Member
Jul 23, 2021
845
484
63
I just had a very off the wall thought... Does anyone still have the Dell Edge 610 that is still kicking the watchdog and has the VMware SD-Wan still on it. Something to try is to install the Dell DiagOS to a memory pen instead of the emmc, Spesificall this one: "diagos-recovery-x86_64-dellemc_vep1400_c3538-r0.3.43.3.81-26" . As I have a suspicion that it wrote something to the non volitile memory of the pic to disable the watchdog being kicked and it seems to be persistent.
I was actually thinking about getting my non-X VEP1400 and writing your PIC dump to it to see if it also transfers the watchdog settings. Alternatively, I could also use the VeloCloud code to 'enable' the watchdog and just time it to see if that does indeed do the 5-minute resets. If it does, writing the DiagOS disabling i2c flags would stop the watchdog again (this is also what I posted a few pages ago, and I think the person doing the switch config for FreeBSD also did).
 

Brood

Member
Apr 15, 2023
58
9
8
Did you make any headway with the watchdog? Also Do we need to setup the switch with each boot on the 610 or is there a way to make the settings persistant?