Support MA5671A SFP GPON

no, it's my stock image with the OCMI modded... I don't really want to flash random images because they might hardware damage the thing by pulling the wrong I/O pin

the openwrt just doesn't forward IGMP traffic, normally they have igmpproxy package for that but it require a clear LAN/WAN interface meanwhile the GPON stick doesn't really expose the L2 WAN interface to the openwrt OS so I have no idea how to make it work

with the flash chip removed I get similar output like in fgs202 thread

ROM: V1.1.4
ROM: CFG 0x00000006
ROM: SFLASH-4
ROM: CFG 0x00000006
ROM: SFLASH-4
ROM: CFG 0x00000006
ROM: SFLASH-4
ROM: Boot? (0-9A-F<CR>) 7
ROM: CFG 0x00000007
ROM: XMODEM
CCCCCCCCCCCCCCC

With the flash chip back I've tried to tape over SFP ground pins 1,9,10. No effect.

edit:
Good people from allaboutcircuits forum suggested shorting DO and GND flash pins. That did not work.
Instead I shorted momentarilly flash pin 4(GND) and pin 5 (Data In) while powering up the sfp. Got the ROM prompt. From there: xmodem, transfer modified uboot, change env, load image and enjoy full shell access.

thanks for the trick, also be able to get into ROM here after I've nuked uboot accidentally...

I've put together a uboot code here that is supposedly for this device, last time I flashed it bindly it doesn't boot (I don't know how to make UART access back then so idk if it actually executed or not) but now I'm gonna try again.

It takes time but it's also possible to load the whole image and restore bricked SFP module without removing flash.

For Windows users this excellent software has support for xmodem and Kermit transfer protocols.


XMODEM - to transfer U-Boot(extract FFDD0022-1020BF from mtd0)

At uboot prompt 'loadb' command will use Kermit protocol to transfer mtd1/mtd2 into memory. It takes around 25 minutes for 7.6MB file. Step 2, 'sf' to write from memory to flash.
I will post exact commands and offsets next week.

Edit:

Into this file I just threw bunch of rubbish. Three or four lines of xxxxx. The effect? It ignores flash uboot_env and drops to the default one.
Modified u-boot.bin to ignore locked mtd1(uboot_env) use with XMODEM

After getting access to uboot_env on flash let's set permament access to the module. UART connected to pin#2 and pin#7 is required for this step.

FALCON => setenv bootdelay 5
FALCON => setenv asc 0
FALCON => setenv preboot "gpio input 105;gpio input 106;gpio input 107;gpio input 108;gpio set 3;gpio set 109;gpio set 110;gpio clear 423; gpio clear 422; gpio clear 325; gpio clear402" gpio clear 424"
FALCON => saveenv

Recovery of bricked module. Confirmed working for MA5671A and G-010S-P modules.

#verify memstart and flashstart addresses
FALCON => bdinfo
boot_params = 0x83F37F98
memstart    = 0x80000000
memsize     = 0x04000000
flashstart  = 0xB0000000
flashsize   = 0x8A40A5C0
flashoffset = 0x00000000

#transfer desired file by Kermit into memory
FALCON => loadb
## Ready for binary (kermit) download to 0x80800000 at 115200 bps...

## Total Size      = 0x00040000 = 262144 Bytes
## Start Addr      = 0x80800000

#general syntax
#sf write "from memory address" "to flash offset" "length"

#to write mtd0(uboot)
sf probe 0
sf erase 0 40000
sf write 80800000 0 40000				 

#to write mtd1(uboot_env)
sf probe 0
sf erase 40000 80000
sf write 80800000 40000 80000 

#to write mtd2(image0)
sf probe 0
sf erase C0000 740000
sf write 80800000 C0000 740000

#to write mtd5(image1)
sf probe 0
sf erase 800000 740000
sf write 80800000 800000 740000

#example of writing mtd0(uboot)
FALCON => sf probe 0
SF: Detected W25Q128BV with page size 256 Bytes, erase size 4 KiB, total 16 MiB
FALCON => sf erase 0 40000
SF: 262144 bytes @ 0x0 Erased: OK
FALCON => sf write 80800000 0 40000
SF: 262144 bytes @ 0x0 Written: OK
FALCON =>

#display memory or flash content
md 80800000
md B0000000 (flash uboot)
md B0040000 (flash uboot_env)
md B00C0000 (flash image0)

Would you mind sharing short instructions how to compile uboot using your code. Tried make menuconfig. MAKEALL complains about missing ppc_8xx-gcc.

This is supposedly the most up to date branch, however I could't find any references to SFP
https://github.com/danielschwierzeck/u-boot-lantiq/tree/openwrt/v2014.07

Many SFP hits here.

Could not locate the source archive yet for OpenWrt 12.09 Attitude Adjustment. At least .config (config.lantiq_falcon) is posted. That's a good start.
xhttp://archive.openwrt.org/attitude_adjustment/12.09/lantiq/falcon/

From what I understand, lantiq uboot for SFP modules must be compiled for MIPS32 revision 2, board Falcon, cpu 34kc

None of the code I've found on the internet have any reference to the FALC ON board... I've managed to find a bunch of diff patch file somewhere that I don't remember but I've put together that repo and it's build-able
You need an old MIPS32 gcc here: https://github.com/minhng99/toolchain-mips_r2_gcc-4.6-linaro_uClibc-0.9.33.2
And here's the commands to compile it:

export CROSS_COMPILE='/home/user/toolchain-mips_r2_gcc-4.6-linaro_uClibc-0.9.33.2/bin/mips-openwrt-linux-uclibc-'
export ARCH=mips
make easy980x0_norflash

make

There seems to be multiple board config variant for this device, you can check the list here:

EDIT: It's alive!!! my uboot code works!

But there's no SPI Flash code for the config I've built... the "sf" command isn't exist, it might need some extra work to make it fully functional, maybe it's supposed to be easy980x0_serialflash?

with the serialflash config, it found the SPI flash and even attempted to boot the kernel image, nice!

Looks like it have a SGMII driver, we may even be able to do netconsole with this

1 Like

Thank you. Incredible! With the "make easy980x0_serialflash" I have working u-boot. The compiled binary was named u-boot.bri.
I replaced original u-boot with this one. I am able to fully boot, ping and login@192.168.1.10 to my module. Will test some more, later after work.

1 Like

I haven't tried yet but looks like we do have a Lantiq Falcon openwrt generic build, maybe it will work on the stick and we can put the proprietary blobs in /opt in later? That would be great if we managed to do that.... right now we have uboot source code, kernel code (unconfirmed if it works or not) and blobs files

I just restored by bricked stick by xmodem it with the whole flash dump in uboot then just write it back down the SPI, it's worked again now

EDIT:
I tried to boot my serialflash uboot, the kernel is up but it's panic because it can't find the "root="... dunno why...

EDIT:

Tried to install a newest snapshot openwrt and the uboot can't load the kernel... maybe we need to upgrade uboot

SF: Detected S25FL129P_64K with page size 64 KiB, total 16 MiB
## Booting kernel from Legacy Image at 80f00000 ...
   Image Name:   MIPS OpenWrt Linux-4.19.86
   Created:      2019-12-03  21:41:35 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1775673 Bytes = 1.7 MiB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!
FALCON => 

My u-boot seems to be working fine. Check my log.
Are you booting from XMODEM or from u-boot stored in flash because that makes difference.

U-Boot 2011.12-g0bcbebd22 (Dec 05 2019 - 05:02:52)

Board: EASY98000SF
Chip:  FALCON-S (A22)
Bootmode: 0x06
Reset cause: Power-On Reset
CPU Clock: 400 MHz
DRAM:  64 MiB
Now running in RAM - U-Boot at: 83fc4000
SF: Detected W25Q128 with page size 4 KiB, total 16 MiB
Net:   GPHY0, SGMII
Hit any key to stop autoboot:  0 
SF: Detected W25Q128 with page size 4 KiB, total 16 MiB
## Booting kernel from Legacy Image at 80f00000 ...
   Image Name:   SFP_7.5.3
   Created:      2016-10-25   9:24:39 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1207784 Bytes = 1.2 MiB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 3.10.49 (jack@GPON-DEV) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 14.07_ltq) ) #1 Tue Oct 25 17:24:32 CST 2016
[    0.000000] SoC: Falcon rev A22
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019556 (MIPS 34Kc)
[    0.000000] MIPS: machine is SFP - Lantiq Falcon SFP Stick
[    0.000000] e=memsize=64
[    0.000000] e=initrd_start=0xA0000000
[    0.000000] e=initrd_size=0x0
[    0.000000] e=flash_start=0xB0000000
[    0.000000] e=flash_size=0x8A48A4C0
[    0.000000] e=ethaddr=40:ee:bb:xx:xx:xx
[    0.000000] MEMSIZE = 67108864
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] debug: ignoring loglevel setting.
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 03f00000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03efffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03efffff]
[    0.000000] On node 0 totalpages: 16128
[    0.000000] free_area_init_node: node 0, pgdat 80312610, node_mem_map 81003ec0
[    0.000000]   Normal zone: 126 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16128 pages, LIFO batch:3
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16002
[    0.000000] Kernel command line: rootfstype=squashfs,jffs2 ip=192.168.1.10:192.168.1.100:192.168.2.0:255.255.255.0:::off ethaddr=40:ee:bb:xx:xx:xx machtype=SFP ignore_lot
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=000561be
[    0.000000] Readback ErrCtl register=000561be
[    0.000000] Memory: 60204k/64512k available (2587k kernel code, 4308k reserved, 664k data, 192k init, 0k highmem)
[    0.000000] NR_IRQS:328
[    0.000000] Setting up vectored interrupts
[    0.000000] CPU Clock: 400MHz
[    0.000000] Calibrating delay loop... 265.98 BogoMIPS (lpj=531968)
[    0.036000] pid_max: default: 32768 minimum: 301
[    0.040000] Mount-cache hash table entries: 512
[    0.048000] pinctrl core: initialized pinctrl subsystem
[    0.052000] NET: Registered protocol family 16
[    0.072000] pinctrl-falcon pinctrl.4: Init done
[    0.092000] bio: create slab <bio-0> at 0
[    0.096000] FALC(tm) ON GPIO Driver, (C) 2012 Lantiq Deutschland Gmbh
[    0.104000] Switching to clocksource MIPS
[    0.112000] NET: Registered protocol family 2
[    0.116000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.124000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.128000] TCP: Hash tables configured (established 512 bind 512)
[    0.136000] TCP: reno registered
[    0.140000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.144000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.152000] NET: Registered protocol family 1
[    0.156000] RPC: Registered named UNIX socket transport module.
[    0.160000] RPC: Registered udp transport module.
[    0.168000] RPC: Registered tcp transport module.
[    0.172000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.180000] EASY98000 LED driver, Version 1.0.1 (c) Copyright 2013, Lantiq Deutschland GmbH
[    0.188000] Wired TLB entries for Linux read_c0_wired() = 0
[    0.196000] config3 0x2425 MT 1
[    0.196000] MVPControl 0x2, STLB 0 VPC 1 EVP 0
[    0.196000] mvpconf0 0xb8008403, PVPE 1 PTC 3 M 1
[    0.208000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.216000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.224000] msgmni has been set to 117
[    0.232000] io scheduler noop registered
[    0.232000] io scheduler deadline registered (default)
[    0.240000] 1e100c00.serial: ttyLTQ0 at MMIO 0x1e100c00 (irq = 104) is a lantiq,asc
[    0.248000] console [ttyLTQ0] enabled, bootconsole disabled
[    0.248000] console [ttyLTQ0] enabled, bootconsole disabled
[    0.268000] m25p80 spi0.0: found w25q128, expected s25fl129p0
[    0.272000] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.276000] 4 cmdlinepart partitions found on MTD device sflash
[    0.280000] Creating 4 MTD partitions on "sflash":
[    0.284000] 0x000000000000-0x000000040000 : "uboot"
[    0.292000] 0x000000040000-0x0000000c0000 : "uboot_env"
[    0.300000] 0x0000000c0000-0x000000800000 : "linux"
[    0.304000] 0x0000001e6e28-0x000000800000 : "rootfs"
[    0.308000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.324000] mtd: device 3 (rootfs) set to be root filesystem
[    0.328000] mtd: partition "rootfs_data" created automatically, ofs=0x400000, len=0x400000
[    0.336000] 0x000000400000-0x000000800000 : "rootfs_data"
[    0.344000] 0x000000800000-0x000001000000 : "image1"
[    0.352000] wdt 1f8803f0.watchdog: Init done
[    0.356000] TCP: cubic registered
[    0.356000] NET: Registered protocol family 17
[    0.360000] 8021q: 802.1Q VLAN Support v1.8
[   12.424000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[   12.428000] Freeing unused kernel memory: 192K (80330000 - 80360000)
procd: Console is alive
procd: - watchdog -
[   15.280000] pps_core: LinuxPPS API ver. 1 registered
[   15.284000] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[   15.296000] PTP clock support registered
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is ready
jffs2 is ready
[   19.612000] jffs2: notice: (273) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 29 of xref (0 dead, 8 orphan) fo.
switching to overlay
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[   22.076000] IFXOS, Version 1.6.6 (c) Copyright 2009, Lantiq Deutschland GmbH
[   22.152000] NET: Registered protocol family 10
[   22.176000] GPON SFP I2C Slave Driver, Version 2.2.1 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG
[   22.192000] [sfp_i2c] vpe code <sfp_i2c_vpe.bin> with size <4108 bytes> loaded!
[   22.200000] VPE loader: VPE1 running successfully
[   22.296000] FALC(tm) ON Optic Driver, version 7.5.1.0 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG
[   22.716000] FALC(tm) ON Base Driver, Version 7.5.1.0 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG
[   22.736000] [onu] GPIO5 stuck detected : PPS/LOS/NTR8K features are not available
[   22.756000] FALC(tm) ON Ethernet Driver, Version 7.5.1.0 (c) Copyright 2015, Lantiq Beteiligungs-GmbH & Co. KG
[   22.780000] mod_f24s: Unknown symbol skb_complete_tx_timestamp (err 0)
[   22.796000] mod_f24s: Unknown symbol skb_complete_tx_timestamp (err 0)
MIPS: set unaligned_action to 'SHOW'
[   30.000000] i2c /dev entries driver
[   30.024000] Custom GPIO-based I2C driver version 0.1.1
[   30.036000] i2c-gpio i2c-gpio.0: using pins 37 (SDA) and 38 (SCL)
[   36.400000] [onu] serial number: HWTC88776655
[   36.724000] [onu] password: 
[   36.768000] [onu] GPHY Firmware loaded into RAM (phy11g.bin)
[   37.020000] [onu] PE[255] firmware loaded v9.90.6.0
FIO_BOSA_TX_ENABLE ioctl failed, ret=-4024
Start status monitoring for I2C EEPROM[0]@0x50 EEPROM[1]@0x51
Start status monitoring for I2C: slope 0.921100, offset 2.191600
[   42.128000] libphy: Falcon MDIO: probed
[   42.160000] IPv6: ADDRCONF(NETDEV_UP): host: link is not ready
[   42.224000] IPv6: ADDRCONF(NETDEV_UP): lct0: link is not ready
[   45.120000] IPv6: ADDRCONF(NETDEV_UP): host: link is not ready
[   45.140000] IPv6: ADDRCONF(NETDEV_UP): lct0: link is not ready
[   45.288000] IPv6: ADDRCONF(NETDEV_UP): lct0: link is not ready
[omcid] Use OMCC version 0xa0
[omcid] Use IOP option mask 0x00000000
[omcid] Use LAN 0 as LCT debug port
committed_image = 0
[omcid] Reading MIB configuration from '/etc/mibs/data_1g_8q.ini'...
[   51.208000] IPv6: ADDRCONF(NETDEV_UP): host: link is not ready
MIB reset complete, time spent 1220 ms
[   51.940000] device exc entered promiscuous mode
[omcid] OMCI daemon initialized (v7.5.1)
[omcia] 22:47:04 API: port #0 link status changed to down 
----------------------------------------------------------------------
 Lantiq GPON Evaluation System (SFP), Image Revision 7.5.3
----------------------------------------------------------------------
procd: - init complete -



BusyBox v1.22.1 (2016-10-25 17:19:46 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

 OpenWrt - (14.07_ltq) --- Lantiq Edition for GPON
 ----------------------------------------------
root@SFP:/# ps
  PID USER       VSZ STAT COMMAND
    1 root      1392 S    /sbin/procd
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [kworker/0:0]
    5 root         0 SW<  [kworker/0:0H]
    6 root         0 SW   [kworker/u2:0]
    7 root         0 SW<  [khelper]
    8 root         0 SW   [kworker/u2:1]
   92 root         0 SW<  [writeback]
   95 root         0 SW<  [bioset]
   96 root         0 SW<  [crypto]
   98 root         0 SW<  [kblockd]
  124 root         0 SW<  [rpciod]
  125 root         0 SW   [kworker/0:1]
  134 root         0 SW   [kswapd0]
  135 root         0 SW   [fsnotify_mark]
  136 root         0 SW<  [nfsiod]
  156 root         0 SW   [spi0]
  191 root         0 SW<  [deferwq]
  194 root         0 SW   [kworker/0:2]
  274 root         0 SWN  [jffs2_gcd_mtd4]
  319 root       880 S    /sbin/ubusd
  320 root      1524 S    /bin/ash --login
  501 root         0 SW   [ow/0]
  502 root         0 SW   [om/0]
  509 root         0 SW   [timer/onu-0]
  510 root         0 SW   [timer/onu-1]
  511 root         0 SW   [timer/onu-2]
  512 root         0 SW   [timer/onu-3]
  513 root         0 SW   [timer/onu-4]
  514 root         0 SW   [timer/onu-5]
  515 root         0 SW   [timer/onu-6]
  516 root         0 SW   [psm]
  554 root         0 SW   [kworker/u2:2]
  606 root      1036 S    /sbin/logd -S 16
  629 root      1512 S    /sbin/netifd
  655 root      1152 S    /usr/sbin/odhcpd
  714 root      1184 S    /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p 22 -K 300
  782 root         0 SW   [onu]
  817 root      1188 S    /opt/lantiq/bin/sfp_i2c -a
 1064 root      3204 S    ipwatchd -c /etc/ipwatchd.conf
 1066 root       772 S    /opt/lantiq/bin/omci_usock_server
 1083 root     21328 S    /opt/lantiq/bin/omcid -d3 -p/etc/mibs/data_1g_8q.ini -o160 -i0 -g1
 1089 root     10032 S    /opt/lantiq/bin/ocal
 1150 root      1556 S    {S97monitomcid} /bin/sh /etc/rc.common /etc/rc.d/S97monitomcid boot
 1187 root         0 SW   [irq/101-gtc_ds]
 1189 root         0 SW   [irq/102-gtc_us]
 1190 root         0 SW   [irq/84-tmu]
 1191 root         0 SW   [irq/86-link]
 1192 root         0 SW   [irq/92-config]
 1402 root      1512 S    sleep 5
 1403 root      1520 R    ps
root@SFP:/#

Can this patch help to show correct Board: SFP at boot instead EASY98000SF

I booted uboot from xmodem... maybe that's why, I'll try again later and will report back

Huh, I somehow managed to brick it... not even xmodem transfer works.. for some reason my compiled uboot just RESET itself while it's trying to load and I can't load my stock uboot mtd0

very weird.... worst case i'll just pull out the flash and reflash it... but it worked yesterday, why now it doesn't??

anyway, here's the ROM modes... kinda interesting

ROM: Boot? (0-9A-F<CR>) 0
ROM: CFG 

ROM: Boot? (0-9A-F<CR>) 1
ROM: CFG 0x00000001
ROM: NOR

ROM: Boot? (0-9A-F<CR>) 2
ROM: CFG 0x00000002
ROM: NAND8, no ECC

ROM: Boot? (0-9A-F<CR>) 3
ROM: CFG 0x00000003
ROM: NAND8, with ECC

ROM: Boot? (0-9A-F<CR>) 4
ROM: CFG 0x00000004
ROM: SFLASH

ROM: Boot? (0-9A-F<CR>) 5
ROM: CFG 0x00000005
ROM: SFLASH-2

ROM: Boot? (0-9A-F<CR>) 6
ROM: CFG 0x00000006
ROM: SFLASH-4

ROM: Boot? (0-9A-F<CR>) 7
ROM: CFG 0x00000007
ROM: XMODEM

ROM: Boot? (0-9A-F<CR>) 8
ROM: CFG 0x00000008
ROM������O��

ROM: Boot? (0-9A-F<CR>) 9
ROM: CFG 0x00000009
ROM: RGMII_A0

ROM: Boot? (0-9A-F<CR>) A
ROM: CFG 0x0000000A
ROM: RGMII_A1

ROM: Boot? (0-9A-F<CR>) B
ROM: CFG 0x0000000B
ROM: RGMII_A2

ROM: Boot? (0-9A-F<CR>) C
ROM: CFG 0x0000000C
ROM: RGMII_A3

ROM: Boot? (0-9A-F<CR>) D
ROM: CFG 0x0000000D
ROM: RGMII_B0
ROM: ** RETRY, 0x00000001

ROM: Boot? (0-9A-F<CR>) E
ROM: CFG 0x0000000E
ROM: RGMII_B1

ROM: Boot? (0-9A-F<CR>) F
ROM: CFG 0x0000000F
ROM: RGMII_B2

I wonder what's the mode 0 does... CFG? is this for configuring default boot flag? don't want to mess with it in case these are OTP memory...

EDIT:

Ha! I know why my uboot has skipped and RESET itself, apparently I've also corrupted the uenv and it tried to do whatever is inside the uenv of the flash which is garbage, I just short the flash while uboot is booting and it fallback to its original env

EDIT: yes! the custom uboot has booted successfully, idk why but it always get corrupted when i write it via xmodem in stock uboot and render the stick unbootable, i have to use mtd command in openwrt and it's worked fine, there's still need to work on the code because of the gpio command not found

Bootmode: 0x06
Reset cause: Power-On Reset
CPU Clock: 400 MHz
DRAM:  64 MiB
Now running in RAM - U-Boot at: 83fc4000
SF: Detected S25FL129P_64K with page size 64 KiB, total 16 MiB
Net:   GPHY0, SGMII
Unknown command 'gpio' - try 'help'
Unknown command 'gpio' - try 'help'
Unknown command 'gpio' - try 'help'
Unknown command 'gpio' - try 'help'
Unknown command 'gpio' - try 'help'
Unknown command 'gpio' - try 'help'
Hit any key to stop autoboot:  0 
SF: Detected S25FL129P_64K with page size 64 KiB, total 16 MiB
## Booting kernel from Legacy Image at 80f00000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.12
   Created:      2015-06-12   7:26:12 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1183972 Bytes = 1.1 MiB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... 

After reading this post (credit @centaur)
https://forum.openwrt.org/t/support-for-gpon-sfp-fgs202/42641/53

I decided to stop the clutter of cables and constructed a simple cable that takes up little space while allowing me access to the MA5671A
I didn't have to use an external power supply because the USB TTL adapter provides 3.3V DC

Connection diagram
USB TTL(UART) Adapter ---------- SFP 20pins Molex connector

3.3V -------red ----------------------------pin #15 and #16
TX --------orange ------------------------pin #2
RX ---------yellow ------------------------pin #7
GND ------green ------------------------ pin #10

IMPORTANT! Use GND wire as ON/OFF switch, otherwise there will be a slight delay before data is displayed on the console (putty/TeraTerm)

Dear friends. Thanks for the topic.
The module is good. It has a lot of possibilities and keeps the temperature low. I've struggled a lot to run it with my internet provider. The password, GPON serial number and MAC are encoded using base64 and stored into sfp_a2_info variable. "@" is used as a new line delimiter "\n"

PART 1. BACKUP
Before you start, save your crucial data to backup files.
root@SFP:~# fw_printenv

Save mtd1 partition
user@ubuntu:~$ nc -l -p 1234 > mtd1.bin (listen on the linux PC, port 1234@ 192.168.1.11)
root@SFP:~# cat /dev/mtd1 | nc 192.168.1.11 1234 (execute on MA5671A)

PART 2. PREPARATIONS
Existing data of my module.
Serial Number = HWTC11223344
gpon Password = 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
MAC = 48:57:02:da:be:ef

I will be changing to:
Serial Number = ZTEG87654321
gpon Password = 0xde 0xad 0x11 0x22 0x33 0x44 0x55 0x66 0xbe 0xef
MAC = 49:f2:02:33:7f:11
root@SFP:~# fw_printenv sfp_a2_info

sfp_a2_info=begin-base64 644 sfp_a2_info @XwDOAFoA0wCMoHUwiLh5GK/IAACIuAAAm4Ii0HuGK9QJzwANB8sAEAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/gAAAAAAAAAEAAAABAAAAAQAAAAEA@AAAAAABMIzZ9gwxeAAEAAf////8CAAFA//8BQAAAcAAAAAAAEGD/////////@////////////MDMwMzJDVVcAAAAAAAD+GP//////////////////////////@//////////8AAhQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAJIV1RDESIzRP///////////////////wAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAhCXp6S3bWnEE46bzNVgwCzEoIM19H2ZIJqDn@C97inzKY4ssTj9LUDzY4tOppNIJ4I1ZuuUWBOqfOL6dRnac7HCvCAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASFcC2r7vAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAD/0P/gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAA==@====@

To display sfp_a2_info in friendly format

root@SFP:/tmp# fw_printenv sfp_a2_info | sed "s/^sfp_a2_info=//" | tr '@' '\n'

begin-base64 644 sfp_a2_info 
XwDOAFoA0wCMoHUwiLh5GK/IAACIuAAAm4Ii0HuGK9QJzwANB8sAEAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/gAAAAAAAAAEAAAABAAAAAQAAAAEA
AAAAAABMIzZ9gwxeAAEAAf////8CAAFA//8BQAAAcAAAAAAAEGD/////////
////////////MDMwMzJDVVcAAAAAAAD+GP//////////////////////////
//////////8AAhQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAJIV1RDESIzRP///////////////////wAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAhCXp6S3bWnEE46bzNVgwCzEoIM19H2ZIJqDn
C97inzKY4ssTj9LUDzY4tOppNIJ4I1ZuuUWBOqfOL6dRnac7HCvCAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASFcC2r7vAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAD/0P/gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAA==
====

PART 3. MODIFICATIONS

Transfer sfp_a2_info into temporary file
root@SFP:~# fw_printenv sfp_a2_info | sed "s/^sfp_a2_info=//" > /tmp/sfp_a2.txt

Example of changing serial number (6th line) using online decoder
AAAAAAAAAAJIV1RDESIzRP///////////////////wAAAAAAAAAAAAAAAAAA
https://base64.guru/converter/decode/hex
00000000000000024857544311223344ffffffffffffffffffffffffffffff0000000000000000000000000000

change SN to ZTEG87654321 5a54454787654321
00000000000000025a54454787654321ffffffffffffffffffffffffffffff0000000000000000000000000000
https://base64.guru/converter/encode/hex
AAAAAAAAAAJaVEVHh2VDIf///////////////////wAAAAAAAAAAAAAAAAAA

replace the modified line number 6 using vi editor
root@SFP:~# vi /tmp/sfp_a2.txt

repeat these steps for password(line 5)
//////////8AAhQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ffffffffffffffff0002140000000000000000000000000000000000000000000000000000000000000000000
ffffffffffffffff000214dead112233445566beef000000000000000000000000000000000000000000000000
//////////8AAhTerREiM0RVZr7vAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

and MAC address(line 9)
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASFcC2r7vAAAAAAAAAAAAAAAAAAAA
000000000000000000000000000000000000000000000000485702dabeef000000000000000000000000000000
00000000000000000000000000000000000000000000000049F202337F11000000000000000000000000000000
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASfICM38RAAAAAAAAAAAAAAAAAAAA

Transfer modified sfp_a2.txt file back into variable sfp_a2_info
root@SFP:~# fw_setenv sfp_a2_info `cat /tmp/sfp_a2.txt`

PART 4. REVIEW AND TESTING
After reboot I check for new variables
root@SFP:~# fw_printenv sfp_a2_info

sfp_a2_info=begin-base64 644 sfp_a2_info @XwDOAFoA0wCMoHUwiLh5GK/IAACIuAAAm4Ii0HuGK9QJzwANB8sAEAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/gAAAAAAAAAEAAAABAAAAAQAAAAEA@AAAAAABMIzZ9gwxeAAEAAf////8CAAFA//8BQAAAcAAAAAAAEGD/////////@////////////MDMwMzJDVVcAAAAAAAD+GP//////////////////////////@//////////8AAhTerREiM0RVZr7vAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAJaVEVHh2VDIf///////////////////wAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAhCXp6S3bWnEE46bzNVgwCzEoIM19H2ZIJqDn@C97inzKY4ssTj9LUDzY4tOppNIJ4I1ZuuUWBOqfOL6dRnac7HCvCAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASfICM38RAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAD/0P/gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAA==@====@

root@SFP:~# fw_printenv nPassword
nPassword=0xde 0xad 0x11 0x22 0x33 0x44 0x55 0x66 0xbe 0xef
root@SFP:~# fw_printenv gSerial
gSerial=ZTEG87654321
root@SFP:~# fw_printenv ethaddr
ethaddr=49:f2:02:33:7f:11

check registration status for O5 (successful)
root@SFP:~# onu ploamsg
errorcode=0 curr_state=5 previous_state=4 elapsed_msec=243880
root@SFP:~#

4 Likes

This is my SFP breakout, it takes so long to make... worked great though

1 Like

@anon23891239
Thank you for your contribution.

@minhng99
Nice setup you have, more future proof. It's also good for taking measurements.

Welcome again. In this thread I found a lot of interesting information that I shared on the Russian forum. I also described how to unlock the bootloader in a more friendly way, step by step. I wanted to share my description with you.

Connect the USB adapter with SFP connector to the module. Start the TeraTerm program and set the serial port parameters: drivers, speed, COM port, (115200 8N1).

This is what a locked bootloader looks like.

ROM: V1.1.4
ROM: CFG 0x00000006
ROM: SFLASH-4
hw fuse format 1
 
U-Boot 2011.12-lantiq-gpon-1.2.24 (Nov 03 2014 - 22:46:28), Build: falcon_sfp_linux
 
Board: SFP
DRAM:  64 MiB
Now running in RAM - U-Boot at: 83fc8000
SF: Detected S25FL129P_64K with page size 64 KiB, total 16 MiB

Create a temporary connection between contacts 4 and 5 of the flash memory and switch the module back on.

Type 7 at the prompt and send 1224ABORT.bin file to the flash. (Modified file u-boot.bin is located a couple of posts above)
TeraTerm File->Transfer->XMODEM->Send 1224ABORT.bin

ROM: V1.1.4
ROM: CFG 0x00000006
ROM: SFLASH-4
ROM: CFG 0x00000006
ROM: SFLASH-4
ROM: CFG 0x00000006
ROM: SFLASH-4
ROM: Boot? (0-9A-F<CR>) 7
ROM: CFG 0x00000007
ROM: XMODEM
CCCCCCCCCCCCCC

When the 1224BORT.BIN file transfer is complete, press Ctrl-C to get this prompt.

FALCON =>

Enter these variables to keep the bootloader unlocked permanently.

FALCON => setenv bootdelay 5
FALCON => setenv asc 0
FALCON => setenv preboot "gpio input 105;gpio input 106;gpio input 107;gpio input 108;gpio set 3;gpio set 109;gpio set 110;gpio clear 423;gpio clear 422;gpio clear 325;gpio clear 402;gpio clear 424"
FALCON => saveenv 

Restart the module.

This is what a unlocked bootloader looks like.

ROM: V1.1.4
ROM: CFG 0x00000006
ROM: SFLASH-4
hw fuse format 1
 
U-Boot 2011.12-lantiq-gpon-1.2.24 (Nov 03 2014 - 22:46:28), Build: falcon_sfp_linux
 
Board: SFP
DRAM:  64 MiB
Now running in RAM - U-Boot at: 83fc8000
SF: Detected W25Q128 with page size 4 KiB, total 16 MiB
Chip:  FALCON-S (A22)
Bootmode: 0x06
Reset cause: Power-On Reset
CPU Clock: 400 MHz
Net:   SGMII, SERDES [PRIME]
gpio: pin 105 (gpio 105) value is 0
gpio: pin 106 (gpio 106) value is 0
gpio: pin 107 (gpio 107) value is 0
gpio: pin 108 (gpio 108) value is 1
gpio: pin 3 (gpio 3) value is 1
gpio: pin 109 (gpio 109) value is 1
gpio: pin 110 (gpio 110) value is 1
gpio: pin 423 (gpio 423) value is 0
gpio: pin 422 (gpio 422) value is 0
gpio: pin 325 (gpio 325) value is 0
gpio: pin 402 (gpio 402) value is 0
gpio: pin 424 (gpio 424) value is 0
Press SPACE to delay and Ctrl-C to abort autoboot in 5 seconds 

Now you can upload mtd2 image0 with full shell (The file is located a couple of posts above)

FALCON => loadb 0x80800000
## Ready for binary (kermit) download to 0x80800000 at 115200 bps... 

TeraTerm File->Transfer->Kermit->Send MA5671Amod.bin
File transfer will take about 25 minutes.

Last step. Move the file from memory to flash.

FALCON => sf probe 0
FALCON => sf erase C0000 740000
FALCON => sf write 80800000 C0000 740000

The module should have two images on the flash: active(0) at 0xC0000 and standby(1) at 0x800000
If standby is also present, image1_is_valid=1

FALCON => printenv image1_is_valid
image1_is_valid=1
FALCON => 

Make sure the active one is 0

FALCON => printenv committed_image
committed_image=0
FALCON => 

When finished, insert the module into the router and log in at 192.168.1.10

3 Likes

My Alcatel-Lucent SFP doesn't do GEM multicast forwarding :frowning: Couldn't use it because I need IPTV from my ISP which goes through GEM multicast

I think it have something to do with the file /etc/mibs/sfp_alu.ini because it looks like the file containing OMCI code

i try firmware MA5671Amod-mtd2.bin
root@SFP:~# onu gtcsng
errorcode=0 serial_number=HWTC12345678

but i dont know how to change SN.

ma5671a

ref:
Support for GPON SFP FGS202

Dear friends,
After surfing the Mikrotik forum I thought about trying the firmware from Chinese modules popular in Spain on the MA5671A insert. Speaking of CarlitoProxx(CPGOS03-0490) aka Hilnk(HL23446). The software is more open and has Luci web interface and many advantages compared to highly customized solutions from telecom vendors.
First of all, the optical calibration is preserved.
Furthermore, it is possible to change these OMCI parameters used during authentication with the OLT.

  • GPON SN, GPON password, Vendor id, ONT Version, ONT model, Equipment id, LOID, LOID password(checkcode), firmware version, MAC address

It is also possible to change the EEPROM parameters of the SFP module that are displayed on the router screen.

  • Vendor name, Part number, Part number revision, Serial number, Date

The entire procedure is covered here in considerable detail:
https://forum.mikrotik.com/viewtopic.php?f=3&t=116364#p751330

Image files
http://s000.tinyupload.com/index.php?file_id=39744640834338451129
CPGOS03-0490 HL23446 Image0
http://s000.tinyupload.com/index.php?file_id=51194170383576121597
CPGOS03-0490 HL23446 Image1

PROCEDURE FOR UNLOCKED MA5671A MODULE with ROOT SHELL

For a module with shell access, uploading a new firmware will not take long. To do this, login as usual to the SFP module at 192.168.1.10. Then simply move the image files from your PC to the SFP module's /tmp folder using the scp protocol. After image transfer:

root@SFP:/# cd /tmp/
root@SFP:/# cat /proc/mtd

root@SFP:/tmp# mtd -e linux write mtd2.bin linux
Unlocking linux ...
Erasing linux ...
Writing from mtd2.bin to linux ...
root@SFP:/tmp#

root@SFP:/tmp# mtd -e image1 write mtd5.bin image1

The module with the CPGOS03-0490 HL23446 firmware needs two new variables to work properly
root@SFP:/# fw_setenv ont_serial HWTC11223344
root@SFP:/# fw_setenv target oem-generic

root@SFP:/# fw_setenv committed_image 0
Restart the module for the changes to take effect.

PROCEDURE FOR NEW MA5671A MODULE WITH UNLOCKED BOOTLOADER

In case of the factory module, it must first be unlocked using the procedures described above and a small amount of soldering. After unblocking the bootloader it is enough to upload image files using kermit protocol.

FALCON => loadb 0x80800000
Ready for binary (kermit) download to 0x80800000 at 115200 bps...

TeraTerm File->Transfer->Kermit->Send mtd2.bin
File transfer will take about 13-17 minutes.

FALCON => sf probe 0
FALCON => sf erase C0000 740000
FALCON => sf write 80800000 C0000 740000

A similar approach will apply to the image1
TeraTerm File->Transfer->Kermit->Send mtd5.bin
File transfer will take about 13-17 minutes

FALCON => sf probe 0
FALCON => sf erase 800000 800000
FALCON => sf write 80800000 800000 800000

The module with CPGOS03-0490 HL23446 firmware needs two new variables to work properly
FALCON => setenv ont_serial HWTC11223344
FALCON => setenv target oem-generic

FALCON => setenv committed_image 0
FALCON => saveenv

Disconnect, insert the module into the router and log into 192.168.1.10 to complete the customization.

EXAMPLE OF CONFIGURATION

Login to the SFP module with new firmware at 192.168.1.10. Apply the desirable GPON serial number and password.

root@SFP:/# fw_setenv ont_serial ELTX11223344
root@SFP:/# uci set gpon.ploam.nPassword="0xde 0xad 0x31 0x32 0x33 0x34 0x35 0x36 0xbe 0xef"
root@SFP:/# uci commit
root@SFP:/# reboot

A selection of optional parameters
root@SFP:/# fw_setenv image0_version 9.0.0
root@SFP:/# fw_setenv image1_version 9.0.0
root@SFP:/# fw_setenv omci_loid someLOIDnumber
root@SFP:/# fw_setenv omci_lpwd LOIDpassword

root@SFP:/# uci set network.lct.macaddr="ac:9a:96:de:be:ef"
root@SFP:/# uci set network.host.macaddr="ac:9a:96:de:be:ef"
root@SFP:/# uci commit

root@SFP:/# reboot

I decided that I should also test the eprom values. Everything works well. Values like these:Vendor Name(HUWAWEI), Vendor Part Number(MA5671A), Vendor Revision(0001),Vendor Serial(ELTX11223344), Manufacturing Date(191029),MAC OUI(AC9A96) are visible on the router

Reset all eprom values(optional)
root@SFP:/# sfp_i2c -d yes

root@SFP:/# sfp_i2c -i 0 -s "HUWAWEI"
root@SFP:/# sfp_i2c -i 1 -s "MA5671A"
root@SFP:/# sfp_i2c -i 2 -s "0001"
root@SFP:/# sfp_i2c -i 3 -s "ELTX11223344"
root@SFP:/# sfp_i2c -i 4 -s "191029"
root@SFP:/# sfp_i2c -i 36 -w 0xac9a96 -4 -m 0x00FFFFFF

VERIFY GPON SN and GPON Password in real time

By using the onu command we are able to view in real time the Serial Number and Password that is sent to the OLT
onu gtcpg - onu gtc password get
onu gtcsng - onu gtc serial number get
For some reason the version of onu included in this firmware displays these values in decimal format. This is still good enough for verification.
ELTX 11223344 - 69 76 84 88 17 34 51 68
0xde 0xad 0x31 0x32 0x33 0x34 0x35 0x36 0xbe 0xef - "222 173 49 50 51 52 53 54 190 239"

root@SFP:/# onu gtcsng
errorcode=0 serial_number="69 76 84 88 17 34 51 68"
root@SFP:/# onu gtcpg
errorcode=0 password="222 173 49 50 51 52 53 54 190 239"

So to remind you that the ONU successfully connected should be in the state O5
root@SFP:/# onu ploamsg
errorcode=0 curr_state=5

4 Likes

Hello,

First of all, thank you all for the awesome work.

Trying to flash OpenWRT on MA5671A using the last images posted.

For me, the problem is that it seems in enters in a bootloop, after starting S60optic.sh (this is the last part logged before it reboots).

uboot printenv log:

https://pastebin.com/4JpGqhma

openwrt booting messages with debug=4:

https://pastebin.com/xiUMpShf

Any ideas?

Regards