Support for GPON SFP FGS202

Hello fellow users,
My shiny FGS202 arrived from France today. It was really cheap comparing how much they want for Zisa.

How can I run OpenWRT on it?

I scoured the Internet and here's what I found

Hardware:
Flash Macronix MX25L6435E 8 MiB (8 388 608 bytes) 0x800000
Intel(Lantiq) PEB98036 FALCON-SR GPON Chipset
DRAM 1 MiB (Internal)

Flash dumps
Used
https://mega.nz/#!DVQFwSbJ!WBoJAYjGIX4UZAFIL_UYiHC6VZdSJWJkXP-Q5fWq8ic

Virgin
https://mega.nz/#!ed4XUBrS!DgIX60oUBPvt-Sa1sEvFNJtAstHsNlz2-zYY-gZUzOA

fgs202

WAN telnet login

Sercomm SFP ONU CLI - SCOMFGS202112 (compiled on Apr  2 2016 02:34:38)
user:admin
password:admin
FGS202:/# help
<==================== =-CLI   COMMANDS-========================>
show onu_stats                     :Display egress queue,port and TCONT counter.
show device                        :Display general device information.
show fw                            :Display firmware information.
show me [clas_id][ins_id]          :Display general ME  information.
show data_path                     :Display the forwarding table.
show lan                           :Display LAN information.
show gpon                          :Display GPON information.
show optic                         :Display optic information.
show gtc                           :Display GTC counter information.
show igmp                          :Display IGMP information.
show omci                          :Display omci log dynamically and sostenuto.
show omci_path                     :Display bridge port,vlan,pbit,gem port,tcont relation.
show omci_history                  :Display history omci log information.
show sys_log                       :Display system log information.
show ram                           :Display RAM information.
show i2c                           :Display I2C information.
show crash_log                     :Display crash log information.
reset sys_log                      :Clear system log information.
reset factory                      :Restore factory setting.
reset crash_log                    :Clear crash log  information.
set gpon_password PASSWORD         :Set GPON password.
set password  PASSWORD             :Set user password.
set time time_date                 :Set time for system,in this format year:month:day:hour:minute:second.
set telnet enable/disable          :Enable/disbale telnet function
set mapper_gem_queue               :Mapper gem port to egress queue
set qos_config                     :Set egress port or queue param
tftp <server_ip><file_name>        :Download file_name from tftp server(ip)
omci_net_trace <TFTP-server-ip>    :Start uploading real-time omci trace to tftp server
omci_net_trace stop                :Stop uploading real-time omci trace to tftp server
optical prbs23/prbs32              :Change optical to PRBS23/PRBS32
omci_trace start                   :Start omci packet trace
omci_trace stop                    :Stop omci packet trace.
omci_trace upload <TFTP-server-ip> :Upload ocmi packet trace to tftp server
sys_log upload <TFTP-server-ip>    :Upload system log to tftp server
diag [detail]

nmap scan from 192.168.2.0/24 reveals 2 open ports: 23 and 9000
It confirms other FGS202 user's findings

FGS202:/# show device
GPON Netif          192.168.100.53/255.255.255.0
          GW        192.168.100.2
          MAC       b4:a5:ef:c8:44:a7
          Conuter:
                    tx:104             tx_err:0      rx:96        rx_err:0
                    dhcp_discover:3  dhcp_offer:1  dhcp_req:1  dhcp_ack:1

LAN  Netif          192.168.2.200/255.255.255.0
          MAC       b4:a5:ef:c8:44:a8
ONU serial number   SCOM2102b9be
Date code           161129
Bosa type           000000
Pcbasn              R.BNN4CI14DE
Running image       0
Image 0 version     SCOMFGS202112
Image 1 version     SCOMFGS202112
Bootloader version  2.0.2.0
Last reboot cause   Power-On Reset
SYS running time       0:04:50

SFP has an active serial TX line on SFP golden pin 6.
Serial output from putty screen

ROM: V1.1.4                                                                                                             
ROM: CFG 0x00000006                                                                                                     
ROM: SFLASH-4                                                                                                           
hw fuse format 1                                                                                                        
                                                                                                                        
                                                                                                                        
U-Boot 2011.12-lantiq-gpon-1.2.20.1-svn20 (Aug 10 2015 - 13:49:58), Build: falcon_sfp                                   
                                                                                                                        
Board: SFP                                                                                                              
DRAM:  internal: 1 MiB                                                                                                  
Now running in RAM - U-Boot at: 9f2c4000
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
Chip:  FALCON-SR (A22)
Bootmode: 0x06
Reset cause: Power-On Reset
CPU Clock: 400 MHz
Done!
Net:   SGMII, SERDES [PRIME]

Type run flash_nfs to mount root filesystem over NFS

SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
active_img 0, committed_img 1
pid_addr 0x2a0ce8
dbSign Addr: 0x9f200208
imgNum: 1
img 0: start addr: 0x100000, length: 0x1a0ce8
checksum: 0xa39a73eb
crc32 result: 0xa39a73eb
check sum OK
name c_img
value 1
name activate_image
value 0
Erasing SPI flash...Writing to SPI flash...done
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB

***************************************************
    Sercomm Boot Version 2.0.2.0

***************************************************
No sc dl flag.
gpio_id:8 no found
Entering Firmware : Everything is OK.
No sc dl flag.
## Starting application at 0x10000000 ...
Overall used memory: 150616
Available packet buffer: 769984 (llt min 6401, llt max 18432)
Init flash support
M25PXX : Init device 'Macronix 64 Mbit' with JEDEC ID 0xC22017/0x0000.
Found flash at 0x00000000-0x007fffff
Flash bank with 128 sectors, sector size is 65536 bytes
Find valid uboot environment in env_off and env_end_off
Machine: Falcon SFP Stick (SFP)
Set image#0 version: SCOMFGS202112
Set image#1 version: SCOMFGS202112
Successfully stored environment to 0x7f0000 
Successfully stored environment to 0x60000 
Image start address: 0xb0100000
Image 0: 0xB0100000 - valid
Image 1: 0xB0480000 - valid
ONT Boot up #1 image
FALC(tm) ON Optic Driver, version 7.4.0.0 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG
FALC(tm) ON Base Driver, Version 7.3.3.0 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG

Minimum RAM needed to run OpenWrt is about 32 MB.

1 Like

Too bad. To run OpenWRT I need SFP with another chipset PEB98035
FGS202 was cheap I will not cry if destroyed. Maybe they are ways to run it, like NFS

8 MiB flash has a bootloader, 2 uboot environments(main and copy), serial number and MAC at 0x50000, 2 images at offset 0x100000 and 0x480000 length: 0x1a0ce8

variables names suggest It runs eCos
eCos is a free open source real-time operating system intended for embedded applications
http://ecos.sourceware.org/

act_img_addr=0xBF20003C
asc0=0
baudrate=115200
boot_image=asc0_fixup;run boot_image${c_img}
boot_image0=tlb map ${ecos_vaddr} ${image0_addr} ${max_image_size} && go ${ecos_vaddr}
boot_image1=tlb map ${ecos_vaddr} ${image1_addr} ${max_image_size} && go ${ecos_vaddr}
boot_image_err=run update_image0 && setenv committed_image 0 && setenv image0_is_valid 1 && saveenv && run boot_image0
bootcmd=asc0_fixup;tlb map 0x10000000 0xb0100000 0x37ff00 && go 0x10000000
bootdelay=5
committed_image=0
dying_gasp=255
ecos_vaddr=0x10000000
env_offs=0x40000
env_offs_redund=0x80000
ethact=SERDES
ethaddr=ac:9a:96:00:00:00
ethprime=SERDES
flash_flash=run select_image boot_image
gphy0_phyaddr=0
gphy1_phyaddr=1
image0_addr=0xB0100000
image0_is_valid=1
image0_offs=0x100000
image1_addr=0xB0480000
image1_is_valid=0
image1_offs=0x480000
image_name=gpon-sfp.sflash.bin
load_uboot=tftp ${ram_addr} ${tftppath}u-boot.img
machtype=SFP
magic_addr=0xBF200038
magic_val=0xDEADBEEF
max_image_size=0x380000
preboot=echo;echo Type "run flash_nfs" to mount root filesystem over NFS;echo
ram_addr=9F200100
reset_uboot_env=sf probe 0;sf erase 40000 80000
save_uboot=sf probe 0;sf erase 0 40000;sf write ${ram_addr} 0 ${filesize}
select_image=setenv activate_image -1;if itest *${magic_addr} == ${magic_val} ; then if itest *${act_img_addr} == 0 ; then setenv activate_image 0;fi;if itest *${act_img_addr} == 1 ; then setenv activate_image 1;fi;mw ${magic_addr} 0x0;mw ${act_img_addr} 0x0;fi;if test $activate_image = -1 ; then setenv c_img $committed_image;else setenv c_img $activate_image;setenv activate_image -1;fi;if test $c_img = 0 && test $image0_is_valid = 0 ; then setenv c_img 1;fi;if test $c_img = 1 && test $image1_is_valid = 0 ; then setenv c_img 0;fi;if test $image0_is_valid = 0 && test $image1_is_valid = 0 ; then setenv c_img _err;fi;exit 0
stderr=serial
stdin=serial
stdout=serial
update_image0=sf probe 0 && sf erase ${image0_offs} +${max_image_size} && tftp ${image0_offs} ${tftppath}${image_name}
update_image1=sf probe 0 && sf erase ${image1_offs} +${max_image_size} && tftp ${image1_offs} ${tftppath}${image_name}
update_sfp=run update_image0 && setenv committed_image 0 && setenv image0_is_valid 1 && saveenv.update_uboot=run load_uboot && run save_uboot
ver=U-Boot 2011.12-lantiq-gpon-1.2.20.1-svn20 (Aug 10 2015 - 13:49:58)
goi_config=begin-base64 644 goi_config @H4sIAAAAAAACA0otSdbPLyjJTNZPz8+ML0lMykmNz0ksTi2KL0pN00suLmOg@HBiYm5qCaUMoH0abmGNXb2hsYGbAoMBAD1BaXJJYxGBgUJSfX4JPHSH5IQpC@KgtSbX0cg12D4oNc3aytrbmMDSytDQ31jMyNrA0NjPXMDSysDbj+g9Sy/P//@n5GJ7ahsyX8En5ntmiyA6flVIiCKowBc1j0/rP8s5p4rk8hmkxGNpghmNM3I@oq55AcUTKN7AjFcwRHVFST3xi99aHLlPmItz7hdSsUMcBmKgFxKxYRQicR4T@ZuICFnyJi9jwIY6x501cwpEXcRlnnsQVXHkQV3HnTlzDkytxHRln4oY5jsVN@8+yLWzak/hKbUn9tW/qvuGNb/xZ3/+JolT6PxJfimC29F4kvzbFRejUSX4bj@uPRMJL4sxz3pDiS+HMdX6TIEP7UkWT+oCQzWT89PzO+JDEpJzU+J7E4tSi+@KDUtPgnI0ksuLmOgCBiYm5qCaUMoH0abmGNXb2hiYGrEoMBAD1BaXJJYxGBg@UJSfX4JPHSH5IQpCKgtSbX0cg12D4oNc3aytrbmMATKwtDY01DMyN7I2NDDW@MzewsDbg+g9Sy/L//39GJ755Ej7/EXxnvlcSukh8F35zCT4kvit/m/h7JL4b@/zXxC0h8dwEN8U1IfA+BGvEpSHxPgYviZUh8L0EN8Qgkvrdgo7gVEt9H8La4@DBLfV8hc7D8S309omthDJL6/0DexI0j8AOEIseVI/EDhPWJdSPwgESWAxHKR@+MEiXW
KBSPwQkS9iJkj8UNFEMQkkfpjoedE/SPxwMQfRB0j8CLHNosjuiRTX@EF2BxI8SXyDag8SPlpASLUTix0hMFw1F4sdKiolaIfHjJGeIyiP4qSXJ+sn5@eWmZ6frp+ZnxECYDdYGBuakpmDaE8mG0saGRETb1hgbmBmYMCgz0AKXFJYlF@DAYGRfn5JfjUAURIfoiC5Py
8tMx0BfX0/Ex1IJmTn5SYo87FmV9Qkpmfp6Du@nJiTmVSUCOKEZOamFpck5hYA1RkZGJrrGhjqGliGGFhaGZtaKxQnF2UWlCiE@meuZ6RlaK/g7O/qAOCZ6BtYKbuEgprGeiToXF6p9RYl56anFGMIlqbkFqUBb@S4tS40sSk3JASuBOCnME0D0uKwjDQBT9opaJ1VD3
cSG4COh+CHmYQNuUJNDf@tw+V0Md2zsy5cznDKEWDQRu07m3HCyihznZe0uE92R+9wIo9b9j4YSTFGeDQ@vaxASXbMCyOwY/6GFqcJrpopqSSKXm0rB9HF1qWkwyHD3g8T/gdygjDyqqpp@PoV5Suh1Y2p955LPFcwbE3VC/iDzz7TMG7GgzYfucUlBIAaC6IkM6U9+a
7Nx@IXiDEHWQgXECgwMe30SzSCBu+xWvumRliKYhp2e6Z5gZZmaFZnCkEBmpSZ0v@/l3c5R8jpJXskIzuTP4Wl1pTVKiM6X7IjnCMy3zdYjnUGA03FHJg1W/4+eGf@3zflQDDcCIUZoZ22hE6yHWyE70YlLRMjErgms6XHPoW07mFeX9OH7zHIQRgE@oujeU7hzZTMDA
nZt72FoAw1JWxKg9xcMTRBJt/Nn5r3vxt35kF5WGocjsgrw@fsnFjE6mQUbRpiikBDvAXpD+2QvaECVfUY4EhRCApNwZJrlkkQQhTLAO/nPI@qJjz37w45oinLaBqMVitvQo5uSO0yHhGPrQof7Sd252Kt0ggRpfJbtrM19ts@TRyuSvrdqVVtoTj7sD0GKwjDMBjeI/
gYniRpm7V9AhH0YsVr6VaFoZKxIvj4@xsuobIHkkHz/n+RSxDeKVgjYETqvETQqZSvoHMIhovGQ0/SYYQAgI3hroFW0@ho9pSh0/h37WGG8denQguab4uwYIPZG2Uq1f/MOv96LXcUmV7ZF5PHG+yUQt@2HtfhordX8Nv6UdLCMtZrohN02wlN4q+MjfTM2A4AGIDccZ
8xWwFMFZeAeJL@zFfMujBfeUuBZy6qPl0TU6C2JRuAbAsQf77yygKgug8MEAA0I+sGCKeWJOuD@HJKsD3RbfEliUk5qfE5icWpRPMi0JCBLL7m4jIEiYGBuagqmDaF8GG1ijl29@oYmBqRGDAgM9QGlxSWIRg4FBUX5+CT51OORTS5L18wtKMpP10/MzAYovSUzK@SY0
vSyxIiU9K0UsuLqOKEw3MTU3BtCGUD6ONDbGrNzQyNTBjUGCgBygtLkks@YjAwKMrPL8GnjpD8EAUhlQWptmGOAS7xTi7WXMYGJtYmhnpGJgZc/4cGSC1J@1k/Oz0vLTNdPz8+MhzAZqAsMzE1NwbQhlA+jjQ2NjLCpNzQwNzBjUGCgBygt@LkksYgDMwKAoP78EnzpC8qNgRAIAnsOh+wAYAAA=@====@
mib_file=HWTC

One more thing, chinese forum attached open port 9000 to DTI process

DTI Agent Start - @(#)Debug and Trace Interface, DTI Agent 1.2.5
CLI interface for GPON ONU activated
CLI interface for GPON Optic activated
DTI - press <q> for quit
DTI Connection Open - SERVER <local ip>:9000.
@(#)Debug and Trace Interface, DTI Agent 1.2.5
usage: dti agent [options]
following options defined:
 --Help         (-h) - help screen
 --dev_dbg      (-v) - debug level device -v <new level>
 --num_wkr      (-w) - num of worker thr  -w <num of worker>
 --fground      (-f) - run in forground   -f <none>
 --Lines        (-l) - lines per device   -l <lines>
 --Devices      (-d) - devices            -d <devices>
 --Port         (-p) - server port        -p <port>
 --DevAuto      (-D) - device AutoMsg     -D 1
 --CliAuto      (-C) - CLI AutoMsg        -C 1
 --ip_Addr      (-a) - server IP address  -a <ip addr (ASCII)>

Removed Flash today. Don't attempt with soldering iron, you need a hot-air pistol.

fgs202flash