-
Yes I was just using your readio64 tool to poke around but have no idea of what I'm doing.
I presume it's not just as simple as writing certain value to 0x2e adrress for example? with writeio I mean.I'm trying to understand this. superiotool identified the correct ITE chip at 0x2e address. Is that like an address that should be reported by pciconf but it's not (reported by pciconf)?
devinfo -vr:
isab0 pnpinfo vendor=0x8086 device=0x229c subvendor=0x1025 subdevice=0x0953 class=0x060100 at slot=31 function=0 dbsf=pci0:0:31:0 handle=\_SB_.PCI0.SBRG isa0 sc0 vga0 atkbdc0 fdc0 ppc0 uart0 Interrupt request lines: 0x4 I/O ports: 0x3f8 uart1 unknown pnpinfo vendor=0x8086 device=0x2292 subvendor=0x1025 subdevice=0x0953 class=0x0c0500 at slot=31 function=3 dbsf=pci0:0:31:3 handle=\_SB_.PCI0.SBUS I/O ports: 0xf040-0xf05f I/O memory addresses: 0x81714000-0x8171401f unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.PCI0.ISP3.ID3C unknown pnpinfo _HID=PNP0C09 _UID=1 at handle=\_SB_.PCI0.SBRG.H_EC (disabled) unknown pnpinfo _HID=PNP0C0A _UID=0 at handle=\_SB_.PCI0.SBRG.H_EC.BAT0 (disabled) unknown pnpinfo _HID=PNP0C0A _UID=1 at handle=\_SB_.PCI0.SBRG.H_EC.BAT1 (disabled) unknown pnpinfo _HID=PNP0C0A _UID=2 at handle=\_SB_.PCI0.SBRG.H_EC.BAT2 (disabled) unknown pnpinfo _HID=INT0800 _UID=0 at handle=\_SB_.PCI0.SBRG.FWHD I/O memory addresses: 0xff000000-0xffffffff unknown pnpinfo _HID=PNP0000 _UID=0 at handle=\_SB_.PCI0.SBRG.IPIC I/O ports: 0x20-0x21 0x24-0x25 0x28-0x29 0x2c-0x2d 0x30-0x31 0x34-0x35 0x38-0x39 0x3c-0x3d 0xa0-0xa1 0xa4-0xa5 0xa8-0xa9 0xac-0xad 0xb0-0xb1 0xb4-0xb5 0xb8-0xb9 0xbc-0xbd 0x4d0-0x4d1 acpi_sysresource0 pnpinfo _HID=PNP0C02 _UID=2 at handle=\_SB_.PCI0.SBRG.LDRC attimer0 pnpinfo _HID=PNP0100 _UID=0 at handle=\_SB_.PCI0.SBRG.TIMR Interrupt request lines: 0x0 I/O ports: 0x40-0x43 0x50-0x53 unknown pnpinfo _HID=MSFT0001 _UID=0 at handle=\_SB_.PCI0.SBRG.PS2K (disabled) unknown pnpinfo _HID=MSFT0003 _UID=0 at handle=\_SB_.PCI0.SBRG.PS2M (disabled) acpi_sysresource1 pnpinfo _HID=PNP0C02 _UID=0 at handle=\_SB_.PCI0.SBRG.SIO1 unknown pnpinfo _HID=PNP0C08 _UID=0 at handle=\_SB_.PCI0.SBRG.GPIO (disabled) unknown pnpinfo _HID=PNP0C08 _UID=1 at handle=\_SB_.PCI0.SBRG.SHWM (disabled) acpi_sysresource2 pnpinfo _HID=PNP0C02 _UID=44258 at handle=\_SB_.PCI0.ACE2 unknown pnpinfo _HID=80860F14 _UID=1 at handle=\_SB_.PCI0.SDHA (disabled) unknown pnpinfo _HID=INT33BB _UID=2 at handle=\_SB_.PCI0.SDHB (disabled) unknown pnpinfo _HID=BCM43241 _UID=0 at handle=\_SB_.PCI0.SDHB.BRCM (disabled) unknown pnpinfo _HID=80860F14 _UID=3 at handle=\_SB_.PCI0.SDHC (disabled) unknown pnpinfo _HID=INTL9C60 _UID=1 at handle=\_SB_.PCI0.GDM1 (disabled) unknown pnpinfo _HID=INTL9C60 _UID=2 at handle=\_SB_.PCI0.GDM3 (disabled) unknown pnpinfo _HID=80862288 _UID=1 at handle=\_SB_.PCI0.PWM1 (disabled) unknown pnpinfo _HID=80862288 _UID=2 at handle=\_SB_.PCI0.PWM2 (disabled) unknown pnpinfo _HID=8086228A _UID=1 at handle=\_SB_.PCI0.URT1 (disabled) unknown pnpinfo _HID=BCM2E1A _UID=0 at handle=\_SB_.PCI0.URT1.BTH0 (disabled) unknown pnpinfo _HID=BCM2E64 _UID=0 at handle=\_SB_.PCI0.URT1.BTH1 unknown pnpinfo _HID=8086228A _UID=2 at handle=\_SB_.PCI0.URT2 (disabled) unknown pnpinfo _HID=BCM4752 _UID=0 at handle=\_SB_.PCI0.URT2.GPS0 (disabled) unknown pnpinfo _HID=BCM4752 _UID=0 at handle=\_SB_.PCI0.URT2.GPS1 unknown pnpinfo _HID=8086228E _UID=1 at handle=\_SB_.PCI0.SPI1 (disabled) unknown pnpinfo _HID=AUTH2750 _UID=0 at handle=\_SB_.PCI0.SPI1.FPNT (disabled) unknown pnpinfo _HID=8086228E _UID=2 at handle=\_SB_.PCI0.SPI2 (disabled) unknown pnpinfo _HID=8086228E _UID=3 at handle=\_SB_.PCI0.SPI3 (disabled) unknown pnpinfo _HID=NXP1002 _UID=1 at handle=\_SB_.PCI0.NFC2 (disabled) unknown pnpinfo _HID=808622C1 _UID=1 at handle=\_SB_.PCI0.I2C1 (disabled) unknown pnpinfo _HID=SMO91D0 _UID=1 at handle=\_SB_.PCI0.I2C1.SHUB unknown pnpinfo _HID=808622C1 _UID=2 at handle=\_SB_.PCI0.I2C2 (disabled) unknown pnpinfo _HID=10EC5670 _UID=1 at handle=\_SB_.PCI0.I2C2.RTEK (disabled) unknown pnpinfo _HID=IMPJ0002 _UID=1 at handle=\_SB_.PCI0.I2C2.IMP2 (disabled) unknown pnpinfo _HID=IMPJ0003 _UID=1 at handle=\_SB_.PCI0.I2C2.IMP3 (disabled) unknown pnpinfo _HID=808622C1 _UID=3 at handle=\_SB_.PCI0.I2C3 (disabled) unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.PCI0.I2C3.CLK0 unknown pnpinfo _HID=INT33F7 _UID=1 at handle=\_SB_.PCI0.I2C3.CAMD (disabled) unknown pnpinfo _HID=808622C1 _UID=4 at handle=\_SB_.PCI0.I2C4 (disabled) unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.PCI0.I2C4.CLK0 unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.PCI0.I2C4.CLK1 unknown pnpinfo _HID=INTCF1A _UID=1 at handle=\_SB_.PCI0.I2C4.CAM1 (disabled) unknown pnpinfo _HID=INT33FB _UID=1 at handle=\_SB_.PCI0.I2C4.CAM2 (disabled) unknown pnpinfo _HID=INTCF1C _UID=1 at handle=\_SB_.PCI0.I2C4.STRA (disabled) unknown pnpinfo _HID=INT33BE _UID=1 at handle=\_SB_.PCI0.I2C4.CAM3 (disabled) unknown pnpinfo _HID=INTCF1C _UID=1 at handle=\_SB_.PCI0.I2C4.STRB unknown pnpinfo _HID=808622C1 _UID=5 at handle=\_SB_.PCI0.I2C5 (disabled) unknown pnpinfo _HID=MSFT0002 _UID=1 at handle=\_SB_.PCI0.I2C5.TPDC (disabled) unknown pnpinfo _HID=808622C1 _UID=6 at handle=\_SB_.PCI0.I2C6 (disabled) unknown pnpinfo _HID=ATML7000 _UID=0 at handle=\_SB_.PCI0.I2C6.TSC0 (disabled) unknown pnpinfo _HID=ATML1000 _UID=1 at handle=\_SB_.PCI0.I2C6.TCS1 unknown pnpinfo _HID=MSFT0002 _UID=1 at handle=\_SB_.PCI0.I2C6.TPD1 unknown pnpinfo _HID=808622C1 _UID=7 at handle=\_SB_.PCI0.I2C7 (disabled) unknown pnpinfo _HID=NXP7471 _UID=1 at handle=\_SB_.PCI0.I2C7.NFC1 (disabled) unknown pnpinfo _HID=808622D8 _UID=0 at handle=\_SB_.PCI0.IISH (disabled) unknown pnpinfo _HID=808622A8 _UID=1 at handle=\_SB_.PCI0.LPEA (disabled) unknown pnpinfo _HID=ADMA22A8 _UID=1 at handle=\_SB_.PCI0.LPEA.ADMA (disabled) unknown pnpinfo _HID=AMCR22A8 _UID=1 at handle=\_SB_.PCI0.AMCR (disabled) unknown pnpinfo _HID=HAD022A8 _UID=1 at handle=\_SB_.PCI0.HAD0 (disabled) unknown pnpinfo _HID=808622B7 _UID=0 at handle=\_SB_.PCI0.UOTG (disabled) acpi_sysresource3 pnpinfo _HID=PNP0C02 _UID=3 at handle=\_SB_.PCI0.SPRC acpi_sysresource4 pnpinfo _HID=PNP0C02 _UID=1 at handle=\_SB_.PCI0.PDRC pci_link0 pnpinfo _HID=PNP0C0F _UID=1 at handle=\_SB_.LNKA pci_link1 pnpinfo _HID=PNP0C0F _UID=2 at handle=\_SB_.LNKB pci_link2 pnpinfo _HID=PNP0C0F _UID=3 at handle=\_SB_.LNKC pci_link3 pnpinfo _HID=PNP0C0F _UID=4 at handle=\_SB_.LNKD pci_link4 pnpinfo _HID=PNP0C0F _UID=5 at handle=\_SB_.LNKE pci_link5 pnpinfo _HID=PNP0C0F _UID=6 at handle=\_SB_.LNKF pci_link6 pnpinfo _HID=PNP0C0F _UID=7 at handle=\_SB_.LNKG pci_link7 pnpinfo _HID=PNP0C0F _UID=8 at handle=\_SB_.LNKH unknown pnpinfo _HID=PNP0C0D _UID=0 at handle=\_SB_.LID0 (disabled) unknown pnpinfo _HID=PNP0C14 _UID=0 at handle=\_SB_.WMID unknown pnpinfo _HID=none _UID=0 at handle=\_SB_.USBC acpi_button0 pnpinfo _HID=PNP0C0C _UID=0 at handle=\_SB_.PWRB acpi_button1 pnpinfo _HID=PNP0C0E _UID=0 at handle=\_SB_.SLPB unknown pnpinfo _HID=INT0002 _UID=1 at handle=\_SB_.GPED (disabled) unknown pnpinfo _HID=INT33FF _UID=1 at handle=\_SB_.GPO0 (disabled) unknown pnpinfo _HID=INT33FF _UID=2 at handle=\_SB_.GPO1 (disabled) unknown pnpinfo _HID=INT33FF _UID=3 at handle=\_SB_.GPO2 (disabled) unknown pnpinfo _HID=INT33FF _UID=4 at handle=\_SB_.GPO3 (disabled) unknown pnpinfo _HID=INTCFD9 _UID=0 at handle=\_SB_.TBAD (disabled) unknown pnpinfo _HID=INT3497 _UID=0 at handle=\_SB_.PIND (disabled) unknown pnpinfo _HID=MSFT0101 _UID=1 at handle=\_SB_.TPM_ I/O memory addresses: 0x7ff00000-0x7ff00fff unknown pnpinfo _HID=none _UID=0 at handle=\_TZ_.FN00 unknown pnpinfo _HID=PNP0C0B _UID=0 at handle=\_TZ_.FAN0 acpi_tz0 pnpinfo _HID=none _UID=0 at handle=\_TZ_.TZ01 acpi_timer0 pnpinfo unknown at unknown ACPI I/O ports: 0x408-0x40b_SB_.PCI0.SBRG.GPIO (disabled)I looked in ASL file and found:
Device (GPIO) { Name (_HID, EisaId ("PNP0C08") /* ACPI Core Hardware */) // _HID: Hardware ID Name (_UID, Zero) // _UID: Unique ID Name (LDN, 0x07) Method (_STA, 0, NotSerialized) // _STA: Status { Return (Zero) } }
Datasheet states that they are writable if LDN = 07h. That seems to be the definition that's in the bios if it dumped everything.
Funnily enough I found definitions for BCM4752 which is a GPS receiver. I guess they used the bios in other embedded systems.
So does this mean they can't be accessed? -
after loading ichsmb module this:
unknown pnpinfo vendor=0x8086 device=0x2292 subvendor=0x1025 subdevice=0x0953 class=0x0c0500 at slot=31 function=3 dbsf=pci0:0:31:3 handle=\_SB_.PCI0.SBUS I/O ports: 0xf040-0xf05f I/O memory addresses: 0x81714000-0x8171401fchanged to this:
ichsmb0 pnpinfo vendor=0x8086 device=0x2292 subvendor=0x1025 subdevice=0x0953 class=0x0c0500 at slot=31 function=3 dbsf=pci0:0:31:3 handle=\_SB_.PCI0.SBUS Interrupt request lines: 0x12 I/O ports: 0xf040-0xf05f I/O memory addresses: 0x81714000-0x8171401f smbus0 smb0still no /dev/led or /dev/gpio
-
You will not find any driver existing for the GPIO pins on that chip. If it had been using the SoC GPIOs one of the existing FreeBSD drivers may have worked.
@marinaru said in GPIOs on it8772E chip:
I presume it's not just as simple as writing certain value to 0x2e adrress for example? with writeio I mean.
It pretty much is that simple. There are hoops to jump through though. Not being able to dump the registers with superiotool makes it more complex as you have to explore it manually. But you would want to do something like:
Put the chip in extended config mode (mbpnp mode for ITE).
Select logical device 7.
Check the GPIOs are set as a GPIO and are set as output.
Set the output registers.
Leave config mode.You can do all that using writeio64 initially. I haven't read the specific data sheet for that chip but I doubt it's much different to the IT8718 I was working with.
Steve
-
Ok the access sequence looks the same the same so you should be able to do this.
Be sure not to have the dashboard up or anything else that might be reading the superio chip or you will see the chip leave mbpnp mode all the time with confusing results.Be aware that messing with the superio chip that controls the cooling and can control the power is potentially risky!
Set the chip in mbpnp mode:
./writeio64 2e 87 ./writeio64 2e 01 ./writeio64 2e 55 ./writeio64 2e 55Make sure you are looking at the correct chip and it's responding as expected.
Read the Chip ID:./writeio64 2e 20 ./readio64 2f ./writeio64 2e 21 ./readio64 2fShould return
87 72Set LDN 7 so we can check the GPIOs
./writeio64 2e 07 ./writeio64 2f 07Read the config registers for GPIO set 3:
./writeio64 2e 27 ./readio64 2f ./writeio64 2e ba ./readio64 2f ./writeio64 2e ca ./readio64 2f ./writeio64 2e f8 ./readio64 2f ./writeio64 2e f9 ./readio64 2f ./writeio64 2e fa ./readio64 2f ./writeio64 2e fb ./readio64 2fCheck that output against the data sheet to make sure the GPIOs are configured correctly.
Leave mbpnp mode:
./writeio64 2e 02 ./writeio64 2f 02Steve
-
./writeio64 2e 20 ./readio64 2f ./writeio64 2e 81 ./readio64 2fI presume it's 21 not 81. it reads the correct chip.
Reading 2f :87 Reading 2f :72so basically you are writing a command (byte) to 2e, and that command makes the chip do stuff, and then serves the info in 2f?
Is this something like bit-banging? When no drivers/functions available, just directly access the memory?
-
Yup, sorry typo'd that.
Yes, there's no driver so just write directly. Since speed is not really required here it's not a problem.
Steve
-
./writeio64 2e 27 Setting 2e to 27 ./readio64 2f Reading 2f :eIndex 27 is 0x0e. That means 0000 1110? Are these 8th - 1st? If so, then GP31/32/33 are enabled as GPIO by default. Which is good, means there's another pin on board, and I suspect it's the one right next to the other two I was trying to initially control.
The other indexes are blank 00h, as per datasheet.
So far so good, and I understood what I'm doing.Where did you get the info to put the chip in mbpnp mode (and what's that?)?
*edit: got it at page 25 :
So I need CAh to 0x0E so I output on these 3 gpio, instead of input. They are always bit 1/2/3 for GP64/63/62 in each index? As in every bit 1 of each index (that's of interest in LDN 07) is always for GP64 let's say?
I don't understand Index C2h, 1 - simple I/O function, 0 - Alternate function. Isn't that defined in Index 27h?
I don't understand which Index deals with on/off 0/1 on the gpio pins.
Also, if I want to modify CAh index to set GP31-33 as output, I use let's say:./writeio64 2e ca ./writeio64 2f eOk, so I managed to get them to flash! I used the alternate function, set to 1hz rate, set as output and pulled high, otherwise it wouldn't work. Also used the location mapping table for which gpio to flash.
Now looking at using on/off. So far so good!
Got it!!!
So I'm using B2h index (LDN=07h) which is the gpio polarity, inverting/non-inverting. That way I can turn them on and off.
Going to check the second GPIO pin, and then check if I also have the third next to them.
Thank you so much for making me understand! Also your tools rock! Thank you very much for them!And here's the moneyshot:
Thing is, if I want to control them separately, I basically have to keep track of the other as I write to the memory.
So this is the shortest sequence:./writeio64 2e 87 ./writeio64 2e 01 ./writeio64 2e 55 ./writeio64 2e 55 ./writeio64 2e 07 ./writeio64 2f 07 ./writeio64 2e ba ./writeio64 2f 6 // 2 turns on GP31 and GP32 off, 4 turns GP31 off and GP32 on, 6 turns both on, 0 turns both off ./writeio64 2e 02 ./writeio64 2f 02Tried to make a bash script but if I use /bin/sh /root/script I get some errors:
#!/bin/sh /bin/sh /root/writeio64 2e 87 /bin/sh /root/writeio64 2e 01 /bin/sh /root/writeio64 2e 55 /bin/sh /root/writeio64 2e 55 /bin/sh /root/writeio64 2e 07 /bin/sh /root/writeio64 2f 07 /bin/sh /root/writeio64 2e ba /bin/sh /root/writeio64 2f 2 /bin/sh /root/writeio64 2e 02 /bin/sh /root/writeio64 2f 02: not found /root/writeio64: 1: Syntax error: word unexpected (expecting ")") /root/writeio64: 5: Syntax error: Error in command substitutionworks with ./writeio64... tho
#!/bin/sh ./writeio64 2e 87 ./writeio64 2e 01 ./writeio64 2e 55 ./writeio64 2e 55 ./writeio64 2e 07 ./writeio64 2f 07 ./writeio64 2e ba ./writeio64 2f 6 ./writeio64 2e 02 ./writeio64 2f 02As you can see in the picture, the wifi board is powered from 12V from the atx unpopulated socket. I checked the mosfets powering it and they are more than capable for the job. The PC had a 3.5" HDD, that I replaced for a 2.5" ssd. Issue is that even if I reboot the pfSense machine, the main caps from the wifi board keep it powered for the short time it takes the PC to power back on, and I can't reboot the wifi board by rebooting the pfSense machine. Also shouldn't be a problem as the wifi board is fused.
I think I'll use two relays and a timer for each board (two for wifi and two for raspberry) so I implement some kind of crude softstart with a resistor. PC's power supply is swiched and can deliver too much current. If I turn on the wifi board after the PC starts, I get a brownout and PC resets. Those wifi main caps draw large current at startup. Original power supply brick for the wifi was a linear transformer. Don't want to bust the pfSense machine. -
Nice!
Yeah the ITE chip is weird compared with Winbond and clones of that. I mean:
0: Input mode 1: Output modeWhat drugs were they on that day?!
But also it doesn't have a register to directly set the output. Instead you set the default pull up or pull down and then set the invert register. Or at least that's what I did on the one box I have with one of these.
Setting the complete register using a hex value is a hack. If you look at 'real' code what you should do is use a bit-mask so you you are only setting whatever bits you needs to and others remain unchanged. I've never had to do that in that program I wrote as it only runs at boot. I'm not sure I've seen it done in a shell script rather than in C but it probably is possible.
You should only need to use ./ in the script if you're running from the command line and in that folder. Otherwise I have used just:
#!/bin/sh /writeio64 2e 87 /writeio64 2e 01 /writeio64 2e 55 /writeio64 2e 55 ....Do you have a serial console between those boards internally?
Steve
-
Yes I was thinking at masking, just flipping the needed bit, but it works this way. With two GPIOs it's doable. More would become cumbersome.
There's only the ethernet cable linking the pfSense machine and the wifi board (it's a tplink wdr-4300 that I pulled out of it's enclosure and 3D printed some standoffs for the case) and it's running openwrt. Good enough for my needs.
I guess I could link them via USB but no need at the moment. -
Mmm, might be fun to connect the TTL serial header an the TPLink to that UART1 header on the Acer board. You'd have to check that is also TTL but it would give you much better access to OpenWRT.
Steve
-
that would be nice to explore.
I see a uart port on the wifi board:
I mean I suppose it's one as it's near the eeprom.
I need to sniff both out and see if there's any relevant info.
Is there direct access to the UART of the Acer board? From freeBSD?
-
Yes, it would probably be:
cu -l cuau1 -s 115200Assuming cuau0 is an external serial port. But you could easily change that for whatever port it is.
You can also add a line to the remotes file so you can use 'tip' instead. You have to add a one-line script to replace it at each boot but it makes it very easy:
[2.4.4-RELEASE][root@pfsense.fire.box]/root: tip switch connected General Commands: ----------------- Help/?: Get help on a group or a specific command Up : Move one command level up Logout: Exit CLI Command Groups: --------------- System : System settings and reset options IP : IP configuration and Ping Port : Port management MAC : MAC address table VLAN : Virtual LAN PVLAN : Private VLAN Security : Security management STP : Spanning Tree Protocol Aggr : Link Aggregation LACP : Link Aggregation Control Protocol LLDP : Link Layer Discovery Protocol EEE : Energy Efficient Ethernet QoS : Quality of Service Mirror : Port mirroring Config : Load/Save of configuration via TFTP Firmware : Download of firmware via TFTP Loop Protect: Loop Protection IPMC : MLD/IGMP Snooping Debug : Switch debug facilities Type '<group>' to enter command group, e.g. 'port'. Type '<group> ?' to get list of group commands, e.g. 'port ?'. Type '<command> ?' to get help on a command, e.g. 'port mode ?'. Commands may be abbreviated, e.g. 'por co' instead of 'port configuration'. >Steve
-
I'll have a look at it this weekend.
Are there standard commands for controlling the wifi board? Or maybe chipset dependent?
*edit:
I found this:
https://github.com/freebsd/freebsd-wifi-build/wiki/TPLink-TL-WDR3600
Does this mean that freeBSD knows the chips? Mine has the same hardware. I don't need NAT or firewall. All that is managed from pfSense. -
Linking the com ports would give you access to OpenWRTs command line should you ever be locked out of it's network ports for some reason. So you can do there whatever OpenWRT will allow which is pretty much everything, the webgui is optional in OpenWRT. It doesn't mean pfSense would be aware of any of the wifi hardware on the TP-Link.
It would be interesting to try running FreeBSD on the TP-Link directly but I would expect significant effort there to get anything working and less functionality than OpenWRT. I would only try that as a project.
Steve
-
Ah yes, very useful to have access to OW from serial. I did lock myself out a few times and had to reset. Would they interact with eachother when they both boot up? I figure both are loading the eeprom's contents at startup.
I could put freeBSD but at this point I'm pretty happy with the features, especially since I have those GPIOs. I'll focus on the firewall rules for now. -
That link would be for a FreeBSD image that runs on the TP-Link instread of OpenWRT. You probably don't want to do that!
I would not expect any interaction between the com lines there. There should not be any output on com2 when pfSense is booting. It's never been an issue on that device with the build in switch for example.
I would be very surprised in that header marked 'UART1' is actually connected directly to the eeprom. It's probably connected to the SuperIO chip. Accessing the eeprom would be via an SPI header almost certainly.
I have no way to know that for certain of course!
Edit: Looking again at the photo what's on that 2 pin header just next to the UART1 label? Also it looks like there is something shown as 'SPI1' which I would expect to be for accessing the eeprom.
Steve
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.