Support for GPON SFP FGS202

One more thing, chinese forum attached open port 9000 to DTI process

DTI Agent Start - @(#)Debug and Trace Interface, DTI Agent 1.2.5
CLI interface for GPON ONU activated
CLI interface for GPON Optic activated
DTI - press <q> for quit
DTI Connection Open - SERVER <local ip>:9000.
@(#)Debug and Trace Interface, DTI Agent 1.2.5
usage: dti agent [options]
following options defined:
 --Help         (-h) - help screen
 --dev_dbg      (-v) - debug level device -v <new level>
 --num_wkr      (-w) - num of worker thr  -w <num of worker>
 --fground      (-f) - run in forground   -f <none>
 --Lines        (-l) - lines per device   -l <lines>
 --Devices      (-d) - devices            -d <devices>
 --Port         (-p) - server port        -p <port>
 --DevAuto      (-D) - device AutoMsg     -D 1
 --CliAuto      (-C) - CLI AutoMsg        -C 1
 --ip_Addr      (-a) - server IP address  -a <ip addr (ASCII)>

Removed Flash today. Don't attempt with soldering iron, you need a hot-air pistol.

fgs202flash

This is so wrong. Anyone connecting TTL/UART to golden pin 6 please pay attention!
Markings on the PC board are wrong. They are reversed.

fgs202pins1_10

@centaur I'm also experimenting with the same device, managed to get its boot messages via UART but I haven't found any way to talk to it, how did you get it connected via telnet 192.168.100.2? It doesn't seems like it have a RX pin exposed.

Which temperature of the hot air gun you've used to desolder the SPI flash? I tried to desolder it without success and I don't want to damage the laser module, attaching wires into its pins is unreadable with my programmer I suspect because it has connected to the CPU and it mess up the readings

As pointed out earlier, this is a non-starter for the Linux kernel. This device will almost certainly never run OpenWrt without enough RAM to even boot the kernel. This can’t be resolved through a stripped-down image, “extroot”, NFS, or the like. This is likely why the board runs an RTOS rather than Linux.

This SFP stick is supposed to only convert GPON to Ethernet so you can log in DHCP/PPPoE using other routers, it's not supposed to do the routing, I agree that it shouldn't run OpenWRT on this particular model, there's a similar GPON SFP having a dedicated RAM chip and it's run Linux like the Zisa Support Zisa OP151S GPON ONU Lantiq SFP module

Some items like telnet session and 1st picture I copied from French forums. FGS202 is used primarly in France in thousands of routers. 192.168.100.x is part of management network. It will vary on each ISP. IP 192.168.2.200 is fixed for LAN interface. Always the same for each FGS202. I can ping it, telnet session to port 23 is dropped, to port 9000 hangs forever. Not sure what protocol DTI process is using.

My hot-air pistol was set to 410 C, lowest air flow settings. Chip case is also soldered that's why hot air is the only option.
To read the flash, initially I used the in-circuit clip. My readings were not consistent. Improved with an external programmer.
RX pin is not working for me, either. On modules made by other companies, RX is connected to the pin 3. Ctrl-C can break the boot up routine.

Check this group of 7 pads. They look like worth probing with test needles

TPoints

@jeff
I realize now that is not likely to run OpenWRT on PEB98036. Modules with the other chipset PEB09835 (supporting OpenWRT) are 3-5 times more expensive. FGS202 it's a good board to get some hands-on experience.

One of those test probe is connected to the TX UART line, the others are not exposed to the SFP interface, maybe just for laser calibrating

@centaur, have you managed to get this module working for anything other than the Orange's livebox? Looks like it keep restarting and the link constantly go up/down on my ER-X-SFP

[ 57.458487] SFP module removed
[ 60.530534] SFP module inserted
[ 62.690415] SFP set to 1000 Mbps Full duplex
[ 89.330434] SFP module removed
[ 93.426484] SFP module inserted

People were using the module with ER-X-SFP by disabling auto-negotation on port Eth5. Is your Off?
What is your ER-X software revision? Module was working on 1.10 series, not sure about new 2.0. I don't have ER-X to test it.
On one of the pictures above, If you follow the trace from the golden PIN 6 it leads to a resistor placeholder. Put a solder bridge across it. It will provide a ground for the module detection(uart tx will be lost in the process)

@centaur I've tried both the latest 1.x and 2.x series and it still the same, I did set it to 1000Mbps only and still the same, on a French forum they said it doesn't work with the ER-X-SFP and the workaround is to use a TP-Link media converter that use a Marvell switch chip, I don't have a TP-Link media converter but I have a Chinese SFP converter using the QCA switch chip and it doesn't work, the module keep restarting and printing out the same UART everytime.

@centaur I've just asked the guy who claimed he has it working on the ER-X-SFP, he said that the router actually did read out information about the SFP stick, I don't think this is possible because this SFP don't exposing its I2C on the MOD-DEF pins?

Maybe there's 2 variant of this on the market? One is from France with the "Adaptateur Fibre" and one unknown on Aliexpress having "GPON ONT" on it

@centaur Could you tell me what's on the label of your SFP module? is it "Adaptateur Fibre" or "GPON ONT"?

On the label of my module "GPON SFP ONT Sercomm FGS202", line below MAC address then long EAN code. Last three digits 144

Mine is "Adaptateur Fibre Sercomm FGS202 GPON SFP ONT", EAN code ends with 947, the PCB on mine looks exactly as yours.

Have you tested your module with a non-Livebox router/switch? Does it work?

It was inserted into a TP-Link media conventer. Ethernet cable was connected to a Netgear router.

@centaur Can you open that TP-Link media converter and capture a high resolution PCB picture for me (both sides)? I want to see if they have a strange pull up/down pins

@minhng99
MC220L_TOP
MC220L_bottom

Is the firmware and bootloader the same for both 144 and 947 version?
Sercomm Boot Version 2.0.2.0
image#0 version: SCOMFGS202112

Yes, my UART printouts is exactly like what you've posted, I've compared every version number, even tried to flash other people's flash dump but it still doesn't work on my ER-X-SFP

13 Sep 2019, 11:49 pm by mail@forum.openwrt.org:

Your post inspired me to try different flash dumps.

First I tried an older version SCOMFGS202110. Its length is 0x1b77a0 and checksum 0x82bda605

ROM: V1.1.4
ROM: CFG 0x00000006
ROM: SFLASH-4
hw fuse format 1


U-Boot 2011.12-lantiq-gpon-1.2.20.1-svn20 (Aug 10 2015 - 13:49:58), Build: falcon_sfp

Board: SFP
DRAM:  internal: 1 MiB
Now running in RAM - U-Boot at: 9f2c4000
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
Chip:  FALCON-SR (A22)
Bootmode: 0x06
Reset cause: Power-On Reset
CPU Clock: 400 MHz
Done!
Net:   SGMII, SERDES [PRIME]

Type run flash_nfs to mount root filesystem over NFS

SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
active_img 0, committed_img 1
pid_addr 0x2b77a0
dbSign Addr: 0x9f200208
imgNum: 1
img 0: start addr: 0x100000, length: 0x1b77a0
checksum: 0x82bda605
crc32 result: 0x82bda605
check sum OK
name c_img
value 1
name activate_image
value 0
Erasing SPI flash...Writing to SPI flash...done
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB

***************************************************
    Sercomm Boot Version 2.0.2.0

***************************************************
No sc dl flag.
gpio_id:8 no found
Entering Firmware : Everything is OK.
No sc dl flag.
## Starting application at 0x10000000 ...
Overall used memory: 199488
Available packet buffer: 704448 (llt min 7425, llt max 18432)
Init flash support
M25PXX : Init device 'Macronix 64 Mbit' with JEDEC ID 0xC22017/0x0000.
Found flash at 0x00000000-0x007fffff
Flash bank with 128 sectors, sector size is 65536 bytes
Find valid uboot environment in env_off and env_end_off
Machine: Falcon SFP Stick (SFP)
Set image#0 version: SCOMFGS202110
Set image#1 version: SCOMFGS202110
Successfully stored environment to 0x7f0000
Successfully stored environment to 0x60000
Image start address: 0xb0100000
Image 0: 0xB0100000 - valid

Image 1: 0xB0480000 - valid
ONT Boot up #1 image
FALC(tm) ON Optic Driver, version 7.4.0.0 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG
FALC(tm) ON Base Driver, Version 7.3.3.0 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG

next, I tried the "virgin" dump. My setup don't have ethernet connected thus the output is not complete.

ROM: V1.1.4
ROM: CFG 0x00000006
ROM: SFLASH-4
hw fuse format 1


U-Boot 2011.12-lantiq-gpon-1.2.20.1-svn20 (Aug 10 2015 - 13:49:58), Build: falcon_sfp

Board: SFP
DRAM:  internal: 1 MiB
Now running in RAM - U-Boot at: 9f2c4000
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
Chip:  FALCON-SR (A22)
Bootmode: 0x06
Reset cause: Power-On Reset
CPU Clock: 400 MHz
Done!
Net:   SGMII, SERDES [PRIME]

Type run flash_nfs to mount root filesystem over NFS

SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB
active_img 0, committed_img 1
pid_addr 0x2a0ce8
dbSign Addr: 0x9f200208
imgNum: 1
img 0: start addr: 0x100000, length: 0x1a0ce8
checksum: 0xa39a73eb
crc32 result: 0x856d1025
check sum error
try run another image.
pid_addr 0x620ce8
dbSign Addr: 0x9f200208
imgNum: 1
img 0: start addr: 0x480000, length: 0x1a0ce8
checksum: 0xa39a73eb
crc32 result: 0xd7cc6721
check sum error
Enter download mode, two image all error
DEBUG_INF:===================================================
DEBUG_INF:Sercomm Upgrade(Module Ver 2.14.02.24) Start!
DEBUG_INF:===================================================
SF: Detected MX25L6405D with page size 64 KiB, total 8 MiB

0x0000: 00  c0  02  12  35  88
Error: SGMII TBI not in sync!
Error: SGMII TBI not in sync!
Error: SGMII TBI not in sync!
Error: SGMII TBI not in sync!
Error: SGMII TBI not in sync!
Error: SGMII TBI not in sync!

Lastly, the regular Orange dump from the top of this page. My module serial number has changed. Opened the image in the editor to modify serial number, MAC address, date code at the offset 0x50000. Reflashed the module. It did not take my changes. Values defaulted to: sn: SCOM00000118 MAC: 00:CO:02:12:35:89 date: 150707