Support for GPON SFP FGS202

Hello fellow users,
My shiny FGS202 arrived from France today. It was really cheap comparing how much they want for Zisa.

How can I run OpenWRT on it?

I scoured the Internet and here's what I found

Hardware:
Flash Macronix MX25L6435E 8 MiB (8 388 608 bytes) 0x800000
Intel(Lantiq) PEB98036 FALCON-SR GPON Chipset
DRAM 1 MiB (Internal)

Flash dumps
Used
https://mega.nz/#!DVQFwSbJ!WBoJAYjGIX4UZAFIL_UYiHC6VZdSJWJkXP-Q5fWq8ic

Virgin
https://mega.nz/#!ed4XUBrS!DgIX60oUBPvt-Sa1sEvFNJtAstHsNlz2-zYY-gZUzOA

fgs202

WAN telnet login

Sercomm SFP ONU CLI - SCOMFGS202112 (compiled on Apr  2 2016 02:34:38)
user:admin
password:admin
FGS202:/# help
<==================== =-CLI   COMMANDS-========================>
show onu_stats                     :Display egress queue,port and TCONT counter.
show device                        :Display general device information.
show fw                            :Display firmware information.
show me [clas_id][ins_id]          :Display general ME  information.
show data_path                     :Display the forwarding table.
show lan                           :Display LAN information.
show gpon                          :Display GPON information.
show optic                         :Display optic information.
show gtc                           :Display GTC counter information.
show igmp                          :Display IGMP information.
show omci                          :Display omci log dynamically and sostenuto.
show omci_path                     :Display bridge port,vlan,pbit,gem port,tcont relation.
show omci_history                  :Display history omci log information.
show sys_log                       :Display system log information.
show ram                           :Display RAM information.
show i2c                           :Display I2C information.
show crash_log                     :Display crash log information.
reset sys_log                      :Clear system log information.
reset factory                      :Restore factory setting.
reset crash_log                    :Clear crash log  information.
set gpon_password PASSWORD         :Set GPON password.
set password  PASSWORD             :Set user password.
set time time_date                 :Set time for system,in this format year:month:day:hour:minute:second.
set telnet enable/disable          :Enable/disbale telnet function
set mapper_gem_queue               :Mapper gem port to egress queue
set qos_config                     :Set egress port or queue param
tftp <server_ip><file_name>        :Download file_name from tftp server(ip)
omci_net_trace <TFTP-server-ip>    :Start uploading real-time omci trace to tftp server
omci_net_trace stop                :Stop uploading real-time omci trace to tftp server
optical prbs23/prbs32              :Change optical to PRBS23/PRBS32
omci_trace start                   :Start omci packet trace
omci_trace stop                    :Stop omci packet trace.
omci_trace upload <TFTP-server-ip> :Upload ocmi packet trace to tftp server
sys_log upload <TFTP-server-ip>    :Upload system log to tftp server
diag [detail]

nmap scan from 192.168.2.0/24 reveals 2 open ports: 23 and 9000
It confirms other FGS202 user's findings

FGS202:/# show device
GPON Netif          192.168.100.53/255.255.255.0
          GW        192.168.100.2
          MAC       b4:a5:ef:c8:44:a7
          Conuter:
                    tx:104             tx_err:0      rx:96        rx_err:0
                    dhcp_discover:3  dhcp_offer:1  dhcp_req:1  dhcp_ack:1

LAN  Netif          192.168.2.200/255.255.255.0
          MAC       b4:a5:ef:c8:44:a8
ONU serial number   SCOM2102b9be
Date code           161129
Bosa type           000000
Pcbasn              R.BNN4CI14DE
Running image       0
Image 0 version     SCOMFGS202112
Image 1 version     SCOMFGS202112
Bootloader version  2.0.2.0
Last reboot cause   Power-On Reset
SYS running time       0:04:50

SFP has an active serial TX line on SFP golden pin 6.
Serial output from putty screen

ROM: V1.1.4                                                                                                             
ROM: CFG 0x00000006                                                                                                     
ROM: SFLASH-4                                                                                                           
hw fuse format 1                                                                                                        
                                                                                                                        
                                                                                                                        
U-Boot 2011.12-lantiq-gpon-1.2.20.1-svn20 (Aug 10 2015 - 13:49:58), Build: falcon_sfp                                   
                                                                                                                        
Board: SFP                                                                                                              
DRAM:  internal: 1 MiB                                                                                                  
Now running in RAM - U-Boot at: 9f2c4000
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
Chip:  FALCON-SR (A22)
Bootmode: 0x06
Reset cause: Power-On Reset
CPU Clock: 400 MHz
Done!
Net:   SGMII, SERDES [PRIME]

Type run flash_nfs to mount root filesystem over NFS

SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
active_img 0, committed_img 1
pid_addr 0x2a0ce8
dbSign Addr: 0x9f200208
imgNum: 1
img 0: start addr: 0x100000, length: 0x1a0ce8
checksum: 0xa39a73eb
crc32 result: 0xa39a73eb
check sum OK
name c_img
value 1
name activate_image
value 0
Erasing SPI flash...Writing to SPI flash...done
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB

***************************************************
    Sercomm Boot Version 2.0.2.0

***************************************************
No sc dl flag.
gpio_id:8 no found
Entering Firmware : Everything is OK.
No sc dl flag.
## Starting application at 0x10000000 ...
Overall used memory: 150616
Available packet buffer: 769984 (llt min 6401, llt max 18432)
Init flash support
M25PXX : Init device 'Macronix 64 Mbit' with JEDEC ID 0xC22017/0x0000.
Found flash at 0x00000000-0x007fffff
Flash bank with 128 sectors, sector size is 65536 bytes
Find valid uboot environment in env_off and env_end_off
Machine: Falcon SFP Stick (SFP)
Set image#0 version: SCOMFGS202112
Set image#1 version: SCOMFGS202112
Successfully stored environment to 0x7f0000 
Successfully stored environment to 0x60000 
Image start address: 0xb0100000
Image 0: 0xB0100000 - valid
Image 1: 0xB0480000 - valid
ONT Boot up #1 image
FALC(tm) ON Optic Driver, version 7.4.0.0 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG
FALC(tm) ON Base Driver, Version 7.3.3.0 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG

Minimum RAM needed to run OpenWrt is about 32 MB.

2 Likes

Too bad. To run OpenWRT I need SFP with another chipset PEB98035
FGS202 was cheap I will not cry if destroyed. Maybe they are ways to run it, like NFS

8 MiB flash has a bootloader, 2 uboot environments(main and copy), serial number and MAC at 0x50000, 2 images at offset 0x100000 and 0x480000 length: 0x1a0ce8

variables names suggest It runs eCos
eCos is a free open source real-time operating system intended for embedded applications
http://ecos.sourceware.org/

act_img_addr=0xBF20003C
asc0=0
baudrate=115200
boot_image=asc0_fixup;run boot_image${c_img}
boot_image0=tlb map ${ecos_vaddr} ${image0_addr} ${max_image_size} && go ${ecos_vaddr}
boot_image1=tlb map ${ecos_vaddr} ${image1_addr} ${max_image_size} && go ${ecos_vaddr}
boot_image_err=run update_image0 && setenv committed_image 0 && setenv image0_is_valid 1 && saveenv && run boot_image0
bootcmd=asc0_fixup;tlb map 0x10000000 0xb0100000 0x37ff00 && go 0x10000000
bootdelay=5
committed_image=0
dying_gasp=255
ecos_vaddr=0x10000000
env_offs=0x40000
env_offs_redund=0x80000
ethact=SERDES
ethaddr=ac:9a:96:00:00:00
ethprime=SERDES
flash_flash=run select_image boot_image
gphy0_phyaddr=0
gphy1_phyaddr=1
image0_addr=0xB0100000
image0_is_valid=1
image0_offs=0x100000
image1_addr=0xB0480000
image1_is_valid=0
image1_offs=0x480000
image_name=gpon-sfp.sflash.bin
load_uboot=tftp ${ram_addr} ${tftppath}u-boot.img
machtype=SFP
magic_addr=0xBF200038
magic_val=0xDEADBEEF
max_image_size=0x380000
preboot=echo;echo Type "run flash_nfs" to mount root filesystem over NFS;echo
ram_addr=9F200100
reset_uboot_env=sf probe 0;sf erase 40000 80000
save_uboot=sf probe 0;sf erase 0 40000;sf write ${ram_addr} 0 ${filesize}
select_image=setenv activate_image -1;if itest *${magic_addr} == ${magic_val} ; then if itest *${act_img_addr} == 0 ; then setenv activate_image 0;fi;if itest *${act_img_addr} == 1 ; then setenv activate_image 1;fi;mw ${magic_addr} 0x0;mw ${act_img_addr} 0x0;fi;if test $activate_image = -1 ; then setenv c_img $committed_image;else setenv c_img $activate_image;setenv activate_image -1;fi;if test $c_img = 0 && test $image0_is_valid = 0 ; then setenv c_img 1;fi;if test $c_img = 1 && test $image1_is_valid = 0 ; then setenv c_img 0;fi;if test $image0_is_valid = 0 && test $image1_is_valid = 0 ; then setenv c_img _err;fi;exit 0
stderr=serial
stdin=serial
stdout=serial
update_image0=sf probe 0 && sf erase ${image0_offs} +${max_image_size} && tftp ${image0_offs} ${tftppath}${image_name}
update_image1=sf probe 0 && sf erase ${image1_offs} +${max_image_size} && tftp ${image1_offs} ${tftppath}${image_name}
update_sfp=run update_image0 && setenv committed_image 0 && setenv image0_is_valid 1 && saveenv.update_uboot=run load_uboot && run save_uboot
ver=U-Boot 2011.12-lantiq-gpon-1.2.20.1-svn20 (Aug 10 2015 - 13:49:58)
goi_config=begin-base64 644 goi_config @H4sIAAAAAAACA0otSdbPLyjJTNZPz8+ML0lMykmNz0ksTi2KL0pN00suLmOg@HBiYm5qCaUMoH0abmGNXb2hsYGbAoMBAD1BaXJJYxGBgUJSfX4JPHSH5IQpC@KgtSbX0cg12D4oNc3aytrbmMDSytDQ31jMyNrA0NjPXMDSysDbj+g9Sy/P//@n5GJ7ahsyX8En5ntmiyA6flVIiCKowBc1j0/rP8s5p4rk8hmkxGNpghmNM3I@oq55AcUTKN7AjFcwRHVFST3xi99aHLlPmItz7hdSsUMcBmKgFxKxYRQicR4T@ZuICFnyJi9jwIY6x501cwpEXcRlnnsQVXHkQV3HnTlzDkytxHRln4oY5jsVN@8+yLWzak/hKbUn9tW/qvuGNb/xZ3/+JolT6PxJfimC29F4kvzbFRejUSX4bj@uPRMJL4sxz3pDiS+HMdX6TIEP7UkWT+oCQzWT89PzO+JDEpJzU+J7E4tSi+@KDUtPgnI0ksuLmOgCBiYm5qCaUMoH0abmGNXb2hiYGrEoMBAD1BaXJJYxGBg@UJSfX4JPHSH5IQpCKgtSbX0cg12D4oNc3aytrbmMATKwtDY01DMyN7I2NDDW@MzewsDbg+g9Sy/L//39GJ755Ej7/EXxnvlcSukh8F35zCT4kvit/m/h7JL4b@/zXxC0h8dwEN8U1IfA+BGvEpSHxPgYviZUh8L0EN8Qgkvrdgo7gVEt9H8La4@DBLfV8hc7D8S309omthDJL6/0DexI0j8AOEIseVI/EDhPWJdSPwgESWAxHKR@+MEiXW
KBSPwQkS9iJkj8UNFEMQkkfpjoedE/SPxwMQfRB0j8CLHNosjuiRTX@EF2BxI8SXyDag8SPlpASLUTix0hMFw1F4sdKiolaIfHjJGeIyiP4qSXJ+sn5@eWmZ6frp+ZnxECYDdYGBuakpmDaE8mG0saGRETb1hgbmBmYMCgz0AKXFJYlF@DAYGRfn5JfjUAURIfoiC5Py
8tMx0BfX0/Ex1IJmTn5SYo87FmV9Qkpmfp6Du@nJiTmVSUCOKEZOamFpck5hYA1RkZGJrrGhjqGliGGFhaGZtaKxQnF2UWlCiE@meuZ6RlaK/g7O/qAOCZ6BtYKbuEgprGeiToXF6p9RYl56anFGMIlqbkFqUBb@S4tS40sSk3JASuBOCnME0D0uKwjDQBT9opaJ1VD3
cSG4COh+CHmYQNuUJNDf@tw+V0Md2zsy5cznDKEWDQRu07m3HCyihznZe0uE92R+9wIo9b9j4YSTFGeDQ@vaxASXbMCyOwY/6GFqcJrpopqSSKXm0rB9HF1qWkwyHD3g8T/gdygjDyqqpp@PoV5Suh1Y2p955LPFcwbE3VC/iDzz7TMG7GgzYfucUlBIAaC6IkM6U9+a
7Nx@IXiDEHWQgXECgwMe30SzSCBu+xWvumRliKYhp2e6Z5gZZmaFZnCkEBmpSZ0v@/l3c5R8jpJXskIzuTP4Wl1pTVKiM6X7IjnCMy3zdYjnUGA03FHJg1W/4+eGf@3zflQDDcCIUZoZ22hE6yHWyE70YlLRMjErgms6XHPoW07mFeX9OH7zHIQRgE@oujeU7hzZTMDA
nZt72FoAw1JWxKg9xcMTRBJt/Nn5r3vxt35kF5WGocjsgrw@fsnFjE6mQUbRpiikBDvAXpD+2QvaECVfUY4EhRCApNwZJrlkkQQhTLAO/nPI@qJjz37w45oinLaBqMVitvQo5uSO0yHhGPrQof7Sd252Kt0ggRpfJbtrM19ts@TRyuSvrdqVVtoTj7sD0GKwjDMBjeI/
gYniRpm7V9AhH0YsVr6VaFoZKxIvj4@xsuobIHkkHz/n+RSxDeKVgjYETqvETQqZSvoHMIhovGQ0/SYYQAgI3hroFW0@ho9pSh0/h37WGG8denQguab4uwYIPZG2Uq1f/MOv96LXcUmV7ZF5PHG+yUQt@2HtfhordX8Nv6UdLCMtZrohN02wlN4q+MjfTM2A4AGIDccZ
8xWwFMFZeAeJL@zFfMujBfeUuBZy6qPl0TU6C2JRuAbAsQf77yygKgug8MEAA0I+sGCKeWJOuD@HJKsD3RbfEliUk5qfE5icWpRPMi0JCBLL7m4jIEiYGBuagqmDaF8GG1ijl29@oYmBqRGDAgM9QGlxSWIRg4FBUX5+CT51OORTS5L18wtKMpP10/MzAYovSUzK@SY0
vSyxIiU9K0UsuLqOKEw3MTU3BtCGUD6ONDbGrNzQyNTBjUGCgBygtLkks@YjAwKMrPL8GnjpD8EAUhlQWptmGOAS7xTi7WXMYGJtYmhnpGJgZc/4cGSC1J@1k/Oz0vLTNdPz8+MhzAZqAsMzE1NwbQhlA+jjQ2NjLCpNzQwNzBjUGCgBygt@LkksYgDMwKAoP78EnzpC8qNgRAIAnsOh+wAYAAA=@====@
mib_file=HWTC

One more thing, chinese forum attached open port 9000 to DTI process

DTI Agent Start - @(#)Debug and Trace Interface, DTI Agent 1.2.5
CLI interface for GPON ONU activated
CLI interface for GPON Optic activated
DTI - press <q> for quit
DTI Connection Open - SERVER <local ip>:9000.
@(#)Debug and Trace Interface, DTI Agent 1.2.5
usage: dti agent [options]
following options defined:
 --Help         (-h) - help screen
 --dev_dbg      (-v) - debug level device -v <new level>
 --num_wkr      (-w) - num of worker thr  -w <num of worker>
 --fground      (-f) - run in forground   -f <none>
 --Lines        (-l) - lines per device   -l <lines>
 --Devices      (-d) - devices            -d <devices>
 --Port         (-p) - server port        -p <port>
 --DevAuto      (-D) - device AutoMsg     -D 1
 --CliAuto      (-C) - CLI AutoMsg        -C 1
 --ip_Addr      (-a) - server IP address  -a <ip addr (ASCII)>

Removed Flash today. Don't attempt with soldering iron, you need a hot-air pistol.

fgs202flash

This is so wrong. Anyone connecting TTL/UART to golden pin 6 please pay attention!
Markings on the PC board are wrong. They are reversed.

fgs202pins1_10

@centaur I'm also experimenting with the same device, managed to get its boot messages via UART but I haven't found any way to talk to it, how did you get it connected via telnet 192.168.100.2? It doesn't seems like it have a RX pin exposed.

Which temperature of the hot air gun you've used to desolder the SPI flash? I tried to desolder it without success and I don't want to damage the laser module, attaching wires into its pins is unreadable with my programmer I suspect because it has connected to the CPU and it mess up the readings

As pointed out earlier, this is a non-starter for the Linux kernel. This device will almost certainly never run OpenWrt without enough RAM to even boot the kernel. This can’t be resolved through a stripped-down image, “extroot”, NFS, or the like. This is likely why the board runs an RTOS rather than Linux.

This SFP stick is supposed to only convert GPON to Ethernet so you can log in DHCP/PPPoE using other routers, it's not supposed to do the routing, I agree that it shouldn't run OpenWRT on this particular model, there's a similar GPON SFP having a dedicated RAM chip and it's run Linux like the Zisa Support Zisa OP151S GPON ONU Lantiq SFP module

Some items like telnet session and 1st picture I copied from French forums. FGS202 is used primarly in France in thousands of routers. 192.168.100.x is part of management network. It will vary on each ISP. IP 192.168.2.200 is fixed for LAN interface. Always the same for each FGS202. I can ping it, telnet session to port 23 is dropped, to port 9000 hangs forever. Not sure what protocol DTI process is using.

My hot-air pistol was set to 410 C, lowest air flow settings. Chip case is also soldered that's why hot air is the only option.
To read the flash, initially I used the in-circuit clip. My readings were not consistent. Improved with an external programmer.
RX pin is not working for me, either. On modules made by other companies, RX is connected to the pin 3. Ctrl-C can break the boot up routine.

Check this group of 7 pads. They look like worth probing with test needles

TPoints

@jeff
I realize now that is not likely to run OpenWRT on PEB98036. Modules with the other chipset PEB09835 (supporting OpenWRT) are 3-5 times more expensive. FGS202 it's a good board to get some hands-on experience.

One of those test probe is connected to the TX UART line, the others are not exposed to the SFP interface, maybe just for laser calibrating

@centaur, have you managed to get this module working for anything other than the Orange's livebox? Looks like it keep restarting and the link constantly go up/down on my ER-X-SFP

[ 57.458487] SFP module removed
[ 60.530534] SFP module inserted
[ 62.690415] SFP set to 1000 Mbps Full duplex
[ 89.330434] SFP module removed
[ 93.426484] SFP module inserted

People were using the module with ER-X-SFP by disabling auto-negotation on port Eth5. Is your Off?
What is your ER-X software revision? Module was working on 1.10 series, not sure about new 2.0. I don't have ER-X to test it.
On one of the pictures above, If you follow the trace from the golden PIN 6 it leads to a resistor placeholder. Put a solder bridge across it. It will provide a ground for the module detection(uart tx will be lost in the process)

@centaur I've tried both the latest 1.x and 2.x series and it still the same, I did set it to 1000Mbps only and still the same, on a French forum they said it doesn't work with the ER-X-SFP and the workaround is to use a TP-Link media converter that use a Marvell switch chip, I don't have a TP-Link media converter but I have a Chinese SFP converter using the QCA switch chip and it doesn't work, the module keep restarting and printing out the same UART everytime.

@centaur I've just asked the guy who claimed he has it working on the ER-X-SFP, he said that the router actually did read out information about the SFP stick, I don't think this is possible because this SFP don't exposing its I2C on the MOD-DEF pins?

Maybe there's 2 variant of this on the market? One is from France with the "Adaptateur Fibre" and one unknown on Aliexpress having "GPON ONT" on it

@centaur Could you tell me what's on the label of your SFP module? is it "Adaptateur Fibre" or "GPON ONT"?

On the label of my module "GPON SFP ONT Sercomm FGS202", line below MAC address then long EAN code. Last three digits 144

Mine is "Adaptateur Fibre Sercomm FGS202 GPON SFP ONT", EAN code ends with 947, the PCB on mine looks exactly as yours.

Have you tested your module with a non-Livebox router/switch? Does it work?

It was inserted into a TP-Link media conventer. Ethernet cable was connected to a Netgear router.

@centaur Can you open that TP-Link media converter and capture a high resolution PCB picture for me (both sides)? I want to see if they have a strange pull up/down pins

@minhng99
MC220L_TOP
MC220L_bottom