Memory organization in SFP, QSFP, XFP and OSFP transceivers

Interesting examples and tutorials about REVELPROG-IS features and device programming
ArT
Posts: 1497
Joined: Wed Mar 25, 2015 8:54 am
Location: Warsaw, Poland
Has thanked: 51 times
Been thanked: 160 times

Memory organization in SFP, QSFP, XFP and OSFP transceivers

Postby ArT » Thu Jan 30, 2020 10:23 am

In REVELPROG-IS you can select transceiveirs with [USER]* suffix in memory database, e.g. SFP [USER], QSFP [USER] and XFP [USER]. Using device with [USER] suffix allows you to program any area in memory map. In this tutorial I'll show you what's typical memory organization for SFP, QSFP and XFP modules based on MSA Standard. Please check latest speficiations on SNIA organization page: https://www.snia.org/technology-communi ... ifications to keep up to date (e.g. SFF-8472, SFF-8636, INF-8077i for module interface description).

*[USER] suffix it is abandoned in recent versions - you can change banks, tables & pages selecting transceiver without suffix.

SFP / SFP+ / SFP28 memory map

SFP [USER] allows read/erase/write of any block or page in memory map. Please take a look at memory organization for typical SFP & SFP+ transceivers:

sfp-memory-organization.png
SFP memory map from SFF-8472 specification
sfp-memory-organization.png (81 KiB) Viewed 15738 times

  • In block A0h (256bytes) first 128bytes (00h – 7Fh) are for serial ID and vendor information. It may be write protected (password may be required). Second 128bytes (80h-FFh) are reserved.

  • In block A2h (256bytes) first 127bytes (00h – 7Eh) are diagnostic information (alarm and warning thresholds, cal constants, real time diagnostics) and optional password entry area. 128th byte (7Fh) is page select byte (only if SFP supports pages). Next 128 bytes (80h-FFh) is page content (depends on selected page). SFP may not support A2h block (it will be communication error) or page select (it may contain only single page). Page 00h or 01h is User Writable EEPROM (120bytes) and vendor specific (8bytes). Page 0 may be write protected (password may be required). Page 02h is for control functions. Pages 03h-7Fh are reserved. Pages 80h-FFh are vendor specific.

  • In SFF-8472 specification starting from page 11 you can check exactly what information is stored in memory

QSFP / QSFP+ / QSFP28 memory map

QSFP [USER] allows to read/erase/write of any block or page in QSFP/QSFP+ memory map. The [USER] mode allows to read/write specific part of memory. Please check memory organization table for your QSFP/QSFP+ module datasheet or in MSA Standard (SFF-8636 specification):

QSFP_memory_map.jpg
QSFP memory organization table from SFF-8636 specification
QSFP_memory_map.jpg (146.05 KiB) Viewed 15738 times

  • QSFP/QSFP+ contains only block A0h (256 bytes) divided into pages (byte 7Fh in block A0h is page select byte). Pages are 128bytes length. Page 00h is required and provides static module identity and capabilities information (it may be write protected with password). Other pages may be optional.

  • Please note that Read-Only bytes can NOT be modified - it will be no effect (or verification error) if you try to change these bytes

  • In SFF-8636 specification starting from page 32 you can check exactly what information is stored in specific memory areas

With REVELPROG-IS you can select page from menu and read/write specific pages.
Please note that you do not have to change page bytes manually in buffer.
QSFP_Write_Pages.jpg
Write specific pages using REVELPROG-IS
QSFP_Write_Pages.jpg (95.45 KiB) Viewed 15738 times



XFP memory map

XFP [USER] allows to read/erase/write of any block or table in XFP memory map. Please check memory organization for your XFP module datasheet or in MSA Standard (INF-8077i specification):

XFP_memory_map.jpg
SFP memory map from INF-8077i specification
XFP_memory_map.jpg (51.23 KiB) Viewed 15738 times

  • XFP contains only block A0h (256 bytes) divided into tables (byte 7Fh in block A0h is table select byte). Tables are 128bytes length. Table 01h is default and contains Serial ID Data. Table 02h is User EEPROM. Tables may be write protected (password may be required for erase or write). Other pages may be optional.
With REVELPROG-IS you can select table from menu (you do not have to change page bytes manually in buffer) and read/write specific tables.

SFP-DD / QSFP-DD / QSFP-DD800/ OSFP and other multiple lines transceivers

This option will be available in future update - please contact me if you need it earlier.

SFP-DD / QSFP-DD / OSFP allows to read/erase/write of any block or page for all CMIS compatible transceivers. CMIS standard has been desgined largely after the QSFP Memory Map so it's quite similar to SFF-8636 - memory map has been changed in order to accomodate more electrical lanes

In CMIS 5.2 specification starting from page 118 you can check exactly what information is stored in specific memory areas
CMIS_module_memory_map.jpg
CMIS Module Memory Map from OIF-CMIS-05.2 specification
CMIS_module_memory_map.jpg (174.64 KiB) Viewed 4465 times

Memory map for OSFP / QSFP-DD / SFP-DD and other multiple lines transceivers (CMIS standad) is divided in two segments:
  • Lower Memory (128 bytes -> addresses from 00h to 7Fh)
  • Upper Memory (128 bytes -> addresses from 80h to FFh)

Lower memory is fixed. It's available in all transceivers. 2 last bytes in Lower Memory are for 3D addressing of Upper Memory. Byte 7Eh is Bank Address and byte 7Fh is Page Address. Basic modules that support only Bank 0 and Page 0 (fixed address) are called flat memory modules, whereas modules that support many banks and/or pages are called paged memory modules. Flat memory modules support only Lower Memory and Page 00h. Paged memory modules must additionaly support pages 01h, 02h and bank 0 of pages 10h and 11h.

Lower Memory Map Overwiew (00h-7Fh)
CMIS_lower_memory_map.jpg
CMIS Module Lower Memory Map from OIF-CMIS-05.2 specification
CMIS_lower_memory_map.jpg (147.78 KiB) Viewed 4465 times

As mentioned before bytes 126-127 (add 7Eh and 7Fh) are responsible for bank & page mapping. When you overwrite byte 7Eh you will select bank number. When you overwrite byte 7Fh you will select page number. For example, when you set Bank=00h and Page=00h in bytes 127-128 you can read administrative information from Upper Memory bytes 129-256 (manufacturer name, vendor name, s/n, part number, revision etc.). This area is selected by default and is supported by all transceivers.

Upper Memory - Bank 0 & Page 0
CMIS_upper_memory_page0.jpg
CMIS Module Upper Memory Map Page 0 from OIF-CMIS-05.2 specification
CMIS_upper_memory_page0.jpg (166.71 KiB) Viewed 4465 times

Page 01h is Advertising. Page 02h are configured Thresholds. Page 03h is USER EEPROM etc. Below is list of all possible pages, but as mentioned before - implementation depends on specific transceiver. It may be flat module with only support for page 0.
CMIS_pages.jpg
CMIS Module Upper Memory Map Page List from OIF-CMIS-05.2 specification
CMIS_pages.jpg (420.7 KiB) Viewed 4465 times

It's worth to mention also about lane banked modules. Bank 0 of pages 10h - 1Fh and 20h - 2Fh provides lane specific registers for the first 8 lanes, and each additional bank (Bank 1, Bank 2... etc) provides support for an additional set of 8 lines.
CMIS_lane_banked.jpg
CMIS Module Upper Memory Map Lane Banked from OIF-CMIS-05.2 specification
CMIS_lane_banked.jpg (115.24 KiB) Viewed 4465 times

Some bank & pages are read only. Some of them will be not implemented. For more information please check your transceiver datasheet which standard it supports and which bank & pages it supports. Next you can check more details in CMIS specification. With REVELPROG-IS programmer you can access to any bank or page directly from GUI:
REVELPROG-IS_Transceiver-Programming_Bank-Pages.jpg
REVELPROG-IS Transceiver Programming Bank & Pages
REVELPROG-IS_Transceiver-Programming_Bank-Pages.jpg (146.06 KiB) Viewed 4465 times

Some of pages may be write protected (you can read it without password, but you can not overwrite data without valid password).

Write protected transceivers and password entry

Some transceivers also provides an optional password entry location that may be used to protect vendor internal functions or user writable memory. Password shall not be required to read any data, but it may be used for write protection for specific areas. Nor shall passwords be required to write any controls defined in the digital diagnostics functions. Passwords may be used by manufacturers to control write access to MSA defined read only data for factory setup, or to OEMs to limit write access in the User EEPROM area. Finally, passwords may be used to control read or write access to the vendor specific pages or tables. Separate passwords value ranges will be defined to prevent accidental writing to critical module control areas. There are 2 types of passwords: manufacturer password and host password (also known as user password). You can enter password using password tool in REVEPLROG-IS application. If you do not know password, you can try to hack it using brute force password tool.

Please check this topic for more details how to password entry or how to search password for protected modules:
Writing protected SFP / QSFP / XFP and searching password (brute force method)

ArT
Posts: 1497
Joined: Wed Mar 25, 2015 8:54 am
Location: Warsaw, Poland
Has thanked: 51 times
Been thanked: 160 times

Re: Memory organization in SFP, QSFP, XFP and OSFP transceivers

Postby ArT » Thu Jan 12, 2023 5:18 pm

I updated first post with information about memory map for new CMIS standard based on OIF CMIS rev5.2 specification (from 2022). It's used mainly for multiline transceivers such as QSFP-DD SFP-DD and OSFP. REVELPROG-IS software will also be updated - new standard is already implemented and it will be available officialy in next software update - if someone need it sooner please contact with me, I can share you working version asap. There is also new adapter for SFP-DD, QSFP-DD and OSFP, it contains new type of connectors and cages (expensive as hell) but fortunately it supports also old standard for SFP/SFP+ and QSFP/QSFP+.


Return to “Tutorials and Examples”

Who is online

Users browsing this forum: No registered users and 7 guests

cron