Who wants to live dangerously?
I gave the FI reversing roughly a 2 year hiatus, but today my ADD got the better of me and FI nostalgia took precedence over work. 2.5Gbps was still on my agenda despite the interfering hardware. A big FU to high quality engineering and the DS100DF410 tucked inside!
I couldn't bother to dust off my Ghidra script
FISeek - Pastebin.com to seek hidden commands in newer firmware, nor determine what disassembled firmware version was before me... It's dated and the hardcoded addresses within the script will not work on other versions but who cares (FYI It was 8080b and
@fohdeesha has the list buried in their guide if you're interested).
5-10 minutes into it, I had what I needed, Broadcom Shell access! Don't know why it evaded me last time, since it is deadly obvious. I knew the command was
tor
but I was oblivious to enabling it. Stare at the disassembly for too long and you lose sight of things.
Now that I have the holy grail of switch privileged access, it's a no brainer to try out 2.5G. Guess what? It doesn't work outside of the switch ASIC

Obvious, I know... Maybe the 7150 lineup isn't up to the engineering prowess of the 7250? I can only hope it's equal to that of Ubiquiti hardware

Someone, please run
dm i2c
or take pictures of your 7150 PCB.
FYI You can replace
dm
with
dd
for the commands below.
Anyway, to enable access to Broadcom Shell, run
dm device-command tor
or the cheeky
dm device-command 2762233
(It spells out BROCADE on a touch tone phone).
DANGER!!! YOU CAN ABSOLUTELY BRICK OR DAMAGE YOUR SWITCH! TREAD CAREFULLY!
Run
tor help
and get intimate with your switch.
For extra help you can view code at
src/appl/diag · bcm-6.5.7_yocto-2.5.1 · Kosta Zertsekel / bcm-sdk
Eg. My 2.5G adventure (Yes, the WarpCore phys support 2500)
[Internet] Bypassing the HH3K up to 2.5Gbps using a BCM57810S NIC - Bell Canada | DSLReports Forums
Code:
phy 1/2/1
Port xe0 (PHY addr 0xc1): WC-B1/13/0 (Warpcore PHY Driver)
0x00: 0x0000 0x01: 0x0000 0x02: 0x0000 0x03: 0x0000
0x04: 0x0000 0x05: 0x0000 0x06: 0x0000 0x07: 0x0000
...
tor phy info
xe0( 50) 143 bff0 c1 c1 WC-B1/13/0 250000
xe1( 51) 143 bff0 c1 c1 WC-B1/13/1 250000
xe2( 52) 143 bff0 c1 c1 WC-B1/13/2 250000
...
Code:
enable
dm device-command tor
tor port xe2 speed=2500
tor port xe2
ping 192.168.1.10
:(
If someone discovers something of interest please do share because I've only played for a few hours.