How to add a 10Gtek SFP+ RJ45 module (unknown broadcom phy)?

jpsollie1 · May 19, 2026, 4:24pm

Hello everyone,

can anybody help me develop a patch for the 10Gtek 80m SFP+ modules using the broadcom BCM84881 chipset?

It does not work when using MDIO_I2C_ROLLBALL, MDIO_I2C_MARVELL_C22 works partially (I can get a phy id), and C45 also works (but claims there's no driver for this chip).

According to 10Gtek, the phy inside the sfp+ cage is a BCM84881.

The device seems to identify itself with id 0x00828235.

According to the broadcom documentation, it seems only C45 is supported,

but i2csfp rbpassword returns a value as well.

this is the dmesg when patching (dirty hack) to force using C22 instead of Rollball_cc quirk:

[11393.112047] sfp sfp2: module OEM SFP-10G-T rev 02 sn CSY101PA6258 dc 250930
[11393.132775] sfp sfp1: module OEM SFP-10G-T rev 02 sn CSY101PA6259 dc 250930
[11393.153107] hwmon hwmon5: temp1_input not attached to any thermal zone
[11393.172091] hwmon hwmon6: temp1_input not attached to any thermal zone
[11398.223560] mtk_soc_eth 15100000.ethernet sfp-lan: PHY i2c:sfp2:16 (id 0x00828235) has no driver loaded
[11398.232976] mtk_soc_eth 15100000.ethernet sfp-lan: Drivers which handle known common cases: CONFIG_BCM84881_PHY, CONFIG_MARVELL_PHY
[11398.244867] sfp sfp2: sfp_add_phy failed: -EINVAL
[11398.291917] mtk_soc_eth 15100000.ethernet sfp-wan: PHY i2c:sfp1:16 (id 0x00828235) has no driver loaded
[11398.301344] mtk_soc_eth 15100000.ethernet sfp-wan: Drivers which handle known common cases: CONFIG_BCM84881_PHY, CONFIG_MARVELL_PHY
[11398.313250] sfp sfp1: sfp_add_phy failed: -EINVAL

so, I'm totally lost: some rollball info, some C22 functionality, according to broadcom only C45 MDIO, and none of them work (but C22 and C45 manage to get it up-and-running with no real phy control).
Any suggestions? what does this module actually need?
```

BusyBox v1.37.0 (2026-01-02 17:07:02 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.

| |.-----.-----.-----.| | | |.----.| |_

| - || _ | -| || | | || || |
|_____|| |||||___||| |____|
|| W I R E L E S S F R E E D O M

OpenWrt SNAPSHOT, r0+34492-286f377389

root@APBureau4:~# i2csfp sfp1 eepromdump
0x50:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 03 04 07 10 00 00 00 00 00 00 00 06 67 00 00 00 ............g...
10: 08 02 00 1e 4f 45 4d 20 20 20 20 20 20 20 20 20 ....OEM
20: 20 20 20 20 00 00 90 65 53 46 50 2d 31 30 47 2d ...eSFP-10G-
30: 54 20 20 20 20 20 20 20 30 32 20 20 03 52 00 3f T 02 .R.?
40: 00 1a 00 00 43 53 59 31 30 31 50 41 36 32 35 39 ....CSY101PA6259
50: 20 20 20 20 32 35 30 39 33 30 20 20 68 80 03 e0 250930 h...
60: 00 00 11 b9 60 12 02 18 29 53 70 64 c1 b1 1d 95 .......)Spd....
70: a1 2f 32 00 00 00 00 00 00 00 00 00 a4 f7 d6 06 ./2.............
80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0x51:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 5f 00 ce 00 5a 00 d3 00 8c a0 75 30 88 b8 79 18 _...Z.....u0..y.
10: 1d 4c 01 f4 19 64 03 e8 4d f0 06 30 3d e8 06 f2 .L...d..M..0=...
20: 2b d4 00 c7 27 10 00 df 00 00 00 00 00 00 00 00 +...'...........
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00 ....?...........
50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 f1 ................
60: 27 f9 82 78 00 00 00 00 00 00 00 00 00 00 82 00 '..x............
70: 05 40 00 00 05 40 00 00 00 00 00 ff ff ff ff 00 .@...@..........
0x51 PAGE 0x00:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31 COUIA8NCAA10-241
90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6 5-03V03 ..F.....
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa 36 ...............6
c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20 SFP-10G-SR
d0: 20 20 20 20 32 33 00 00 00 00 00 00 00 00 00 35 23.........5
e0: 15 1a 20 24 2a 30 20 30 00 00 00 00 00 00 00 00 .. $*0 0........
f0: 00 00 00 00 00 1d 00 00 ff ff ff ff 00 00 00 00 ................
0x51 PAGE 0x01:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31 COUIA8NCAA10-241
90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6 5-03V03 ..F.....
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa 36 ...............6
c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20 SFP-10G-SR
d0: 20 20 20 20 32 33 00 00 00 00 00 00 00 00 00 35 23.........5
e0: 15 1a 20 24 2a 30 20 30 00 00 00 00 00 00 00 00 .. $*0 0........
f0: 00 00 00 00 00 1d 00 00 ff ff ff ff 00 00 00 00 ................
0x51 PAGE 0x02:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0x51 PAGE 0x03:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
80: 04 1f 00 08 ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff 56 31 33 ff ff 02 00 63 73 77 77 .....V13....csww
# i2cdetect -y 3
0 1 2 3 4 5 6 7 8 9 a b c d e f
00: -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: 50 51 -- -- -- -- 56 -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: UU -- -- -- -- -- -- --
# i2cdump -y 3 0x56
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 20 40 00 82 35 90 50 81 60 31 00 9b c0 00 00 09 @.?5?P?1.??..?
10: 97 01 00 00 00 00 41 a4 41 a4 41 a4 00 00 00 00 ??....A?A?A?....
20: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
30: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
40: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
50: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
60: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
70: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
```

dekarl · May 19, 2026, 5:42pm

the driver is loaded? there is a comment that hints there may be issues

github.com/torvalds/linux

drivers/net/phy/bcm84881.c

master


      
          
          /* The Broadcom BCM84881 in the Methode DM7052 is unable to provide a SGMII
           * or 802.3z control word, so inband will not work.
           */
          static unsigned int bcm84881_inband_caps(struct phy_device *phydev,
          					 phy_interface_t interface)
          {
          	return LINK_INBAND_DISABLE;
          }
          
          static struct phy_driver bcm84881_drivers[] = {
          	{
          		.phy_id		= 0xae025150,
          		.phy_id_mask	= 0xfffffff0,
          		.name		= "Broadcom BCM84881",
          		.inband_caps	= bcm84881_inband_caps,
          		.config_init	= bcm84881_config_init,
          		.probe		= bcm84881_probe,
          		.get_features	= bcm84881_get_features,
          		.config_aneg	= bcm84881_config_aneg,
          		.aneg_done	= bcm84881_aneg_done,

there is a fixup that mentions reading the phy id

github.com/torvalds/linux

drivers/net/phy/sfp.c

master


      
          	 * the PHY for a sufficient amount of time.
          	 */
          	sfp->phy_t_retry = msecs_to_jiffies(1000);
          }
          
          static void sfp_fixup_rollball_wait4s(struct sfp *sfp)
          {
          	sfp_fixup_rollball(sfp);
          
          	/* The RollBall fixup is not enough for FS modules, the PHY chip inside
          	 * them does not return 0xffff for PHY ID registers in all MMDs for the
          	 * while initializing. They need a 4 second wait before accessing PHY.
          	 */
          	sfp->module_t_wait = msecs_to_jiffies(4000);
          }
          
          static void sfp_fixup_fs_10gt(struct sfp *sfp)
          {
          	sfp_fixup_10gbaset_30m(sfp);
          	sfp_fixup_rollball_wait4s(sfp);
          }

I'd try with sfp_fixup_rollball_wait4s or sfp_fixup_fs_10gt. the latter will report 10G SR / 30m with lower power consumption.

But I have no idea how to properly signal 80m
maybe something with SFP_OPTIONS_HIGH_POWER_LEVEL

github.com/torvalds/linux

drivers/net/phy/sfp.c

master


      
          }
          
          static int sfp_module_parse_power(struct sfp *sfp)
          {
          	u32 power_mW = 1000;
          	bool supports_a2;
          
          	if (sfp->id.ext.sff8472_compliance >= SFP_SFF8472_COMPLIANCE_REV10_2 &&
          	    sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_POWER_DECL))
          		power_mW = 1500;
          	/* Added in Rev 11.9, but there is no compliance code for this */
          	if (sfp->id.ext.sff8472_compliance >= SFP_SFF8472_COMPLIANCE_REV11_4 &&
          	    sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_HIGH_POWER_LEVEL))
          		power_mW = 2000;
          
          	/* Power level 1 modules (max. 1W) are always supported. */
          	if (power_mW <= 1000) {
          		sfp->module_power_mW = power_mW;
          		return 0;
          	}

there is also an open PR for modules identifying as SFP-10G-T, but it appears to be for a different issue

jpsollie1 · May 19, 2026, 8:34pm

unfortunately, I've tried different patches with many many options already.
This is the "basic" version:

--- a/drivers/net/phy/sfp.c 2026-05-19 11:21:59.561808362 +0200
+++ b/drivers/net/phy/sfp.c 2026-05-19 11:38:21.836755518 +0200
@@ -494,6 +494,19 @@
__set_bit(PHY_INTERFACE_MODE_1000BASEX, caps->interfaces);
}

+static void sfp_fixup_asf_10g_t80(struct sfp *sfp)
+{
  sfp->mdio_protocol = MDIO_I2C_C45;
  //sfp->i2c_mdio_probe_wait = 5000;
  sfp->phy_t_retry = msecs_to_jiffies(1000);
  sfp->id.base.extended_cc = SFF8024_ECC_10GBASE_T_SFI;
+}
+
#define SFP_QUIRK(_v, _p, _s, _f)
{ .vendor = _v, .part = _p, .support = _s, .fixup = _f, }
#define SFP_QUIRK_S(_v, _p, _s) SFP_QUIRK(_v, _p, _s, NULL)
@@ -579,7 +592,7 @@
// OEM SFP-GE-T is a 1000Base-T module with broken TX_FAULT indicator
SFP_QUIRK_F("OEM", "SFP-GE-T", sfp_fixup_ignore_tx_fault),
  SFP_QUIRK_F("OEM", "SFP-10G-T", sfp_fixup_rollball_cc),
  SFP_QUIRK_F("OEM", "SFP-10G-T", sfp_fixup_asf_10g_t80),
  SFP_QUIRK_S("OEM", "SFP-2.5G-T", sfp_quirk_oem_2_5g),
  SFP_QUIRK_S("OEM", "SFP-2.5G-BX10-D", sfp_quirk_2500basex),
  SFP_QUIRK_S("OEM", "SFP-2.5G-BX10-U", sfp_quirk_2500basex),
insmod ./sfp.ko
[ 9854.401466] sfp sfp1: Host maximum power 3.0W
[ 9854.406379] sfp sfp2: Host maximum power 3.0W
root@APBureau4:~# [ 9854.723866] sfp sfp1: module OEM SFP-10G-T rev 02 sn CSY101PA6259 dc 250930
[ 9854.744608] sfp sfp2: module OEM SFP-10G-T rev 02 sn CSY101PA6258 dc 250930
[ 9854.764999] hwmon hwmon5: temp1_input not attached to any thermal zone
[ 9854.793683] hwmon hwmon6: temp1_input not attached to any thermal zone
[ 9886.707619] sfp sfp1: no PHY detected
[ 9886.746904] mtk_soc_eth 15100000.ethernet sfp-wan: Link is Up - 10Gbps/Full - flow control off
[ 9886.764985] sfp sfp2: no PHY detected
[ 9886.768688] br-lan: port 5(sfp-wan) entered blocking state
[ 9886.774178] br-lan: port 5(sfp-wan) entered forwarding state
root@APBureau4:~# cat /sys/kernel/debug/sfp2/*
Module state: present
Module probe attempts: 0 0
Device state: up
Main state: wait_los
Fault recovery remaining retries: 5
PHY probe remaining retries: 0
Signalling rate: 0 kBd
Rate select threshold: 0 kBd
moddef0: 1
rx_los: 1
tx_fault: 0
tx_disable: 0
rs0: 0
rs1: 0
root@APBureau4:~# ethtool -m sfp-wan
Identifier : 0x03 (SFP)
Extended identifier : 0x04 (GBIC/SFP defined by 2-wire interface ID)
Connector : 0x07 (LC)
Transceiver codes : 0x10 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Transceiver type : 10G Ethernet: 10G Base-SR
Encoding : 0x06 (64B/66B)
BR Nominal : 10300MBd
Rate identifier : 0x00 (unspecified)
Length (SMF) : 0km
Length (OM2) : 80m
Length (OM1) : 20m
Length (Copper or Active cable) : 0m
Length (OM3) : 300m
Laser wavelength : 850nm
Vendor name : OEM
Vendor OUI : 00:90:65
Vendor PN : SFP-10G-T
Vendor rev : 02
Option values : 0x00 0x1a
Option : TX_DISABLE implemented
BR margin max : 0%
BR margin min : 0%
Vendor SN : CSY101PA6259
Date code : 250930
Optical diagnostics support : Yes
Laser bias current : 6.000 mA
Laser output power : 0.5000 mW / -3.01 dBm
Receiver signal average optical power : 0.4000 mW / -3.98 dBm
Module temperature : 61.57 degrees C / 142.83 degrees F
Module voltage : 3.3400 V
Alarm/warning flags implemented : Yes
Laser bias current high alarm : Off
Laser bias current low alarm : Off
Laser bias current high warning : Off
Laser bias current low warning : Off
Laser output power high alarm : Off
Laser output power low alarm : Off
Laser output power high warning : Off
Laser output power low warning : Off
Module temperature high alarm : Off
Module temperature low alarm : Off
Module temperature high warning : Off
Module temperature low warning : Off
Module voltage high alarm : Off
Module voltage low alarm : Off
Module voltage high warning : Off
Module voltage low warning : Off
Laser rx power high alarm : Off
Laser rx power low alarm : Off
Laser rx power high warning : Off
Laser rx power low warning : Off
Laser bias current high alarm threshold : 15.000 mA
Laser bias current low alarm threshold : 1.000 mA
Laser bias current high warning threshold : 13.000 mA
Laser bias current low warning threshold : 2.000 mA
Laser output power high alarm threshold : 1.9952 mW / 3.00 dBm
Laser output power low alarm threshold : 0.1584 mW / -8.00 dBm
Laser output power high warning threshold : 1.5848 mW / 2.00 dBm
Laser output power low warning threshold : 0.1778 mW / -7.50 dBm
Module temperature high alarm threshold : 95.00 degrees C / 203.00 degrees F
Module temperature low alarm threshold : -50.00 degrees C / -58.00 degrees F
Module temperature high warning threshold : 90.00 degrees C / 194.00 degrees F
Module temperature low warning threshold : -45.00 degrees C / -49.00 degrees F
Module voltage high alarm threshold : 3.6000 V
Module voltage low alarm threshold : 3.0000 V
Module voltage high warning threshold : 3.5000 V
Module voltage low warning threshold : 3.1000 V
Laser rx power high alarm threshold : 1.1220 mW / 0.50 dBm
Laser rx power low alarm threshold : 0.0199 mW / -17.01 dBm
Laser rx power high warning threshold : 1.0000 mW / 0.00 dBm
Laser rx power low warning threshold : 0.0223 mW / -16.52 dBm
root@APBureau4:~# ethtool sfp-wan
Settings for sfp-wan:
Supported ports: [ FIBRE ]
Supported link modes: 10000baseT/Full
10000baseSR/Full
Supported pause frame use: Symmetric Receive-only
Supports auto-negotiation: No
Supported FEC modes: Not reported
Advertised link modes: Not reported
Advertised pause frame use: No
Advertised auto-negotiation: No
Advertised FEC modes: Not reported
Speed: 10000Mb/s
Duplex: Full
Auto-negotiation: off
Port: FIBRE
PHYAD: 0
Transceiver: internal
Current message level: 0x000000ff (255)
drv probe link timer ifdown ifup rx_err tx_err
Link detected: yes

And yes, the bcm driver was loaded, but the device id is not registered. That should be fixable, But, I'm not sure what this module actually needs to let the bcm driver handle it properly? is it rollball? is it C22? or is it a C45 module (according to Broadcom specifications)?
I can i2cget and i2cdump any page I want, even with a 500 usleep in between, i2cget returns a consistent value, but I don't know what protocol the module uses :

i2csfp can find a rollball password (so it's rollball),
sfp->mdio_protocol = MDIO_I2C_MARVELL_C22 can find the device id and bring up the link (so that's very close)
sfp->mdio_protocol = MDIO_I2C_C45 is what broadcom says the phy should support
... so yeah, I'm totally lost here

jpsollie1 · May 22, 2026, 11:13am

it looks like the 10Gtek ASF-10G-T80 uses the BCM84891 (which was only added in linux 7.1, so will not work), so I cherry-picked those patches from the 7.1 mainline kernel.
I found out the module has another rollball password (according to i2csfp), so I tried different MDIO protocols, where:

Rollball with default password did not work
C22 did not work
MDIO_I2C_NONE works
MDIO_I2C_C45 works
MDIO_I2C_ROLLBALL with the Rollball password adjusted in mdio-i2c works

I'll try the netdev mailing list, hopefully someone can tell me what is possible and what is not.