Support MA5671A SFP GPON

Someone has the images to flash into the module .
i lost them and i have a new SFP to unlock .
Thank you

Bit of help to "unbrick" an SFP please team.

When I first got it I was changing the IP address in lastgood.xml with sed but missed a " and rebooted without noticing it.
Now I lost access to it, so trying to get UART to recover my access.

Based on these pictures, can someone advise if my pins are correct for this SFP (yes, the solder on the contacts was the first attempt to connect it before I had the connectors)

I'm using minicom on linux, this should work fine right, or do I need to use another software?

UART pins vary from model to model. The Huawei MA5671A uses the Lantiq chip (Intel), your module is based on Realtek SoC RTL9601C
Check this post. Apparently other users have investigated the possibility of connecting the UART adapter to GPON module from Realtek family.
https://forum.mikrotik.com/viewtopic.php?f=3&t=116364&start=300#p847411

Thanks, pasted some posts on both

Stock firmware rooted:
mtd2 MD5: 3138d2dd06a32bb92bc63610fec6fcd6
mtd5 MD5: 0e4cfdc1b96be6581869b26b48789556

Carlitoxx firmware:
mtd2 MD5: d3cb6f7efec201b37931139feb4bb23b
mtd5 MD5: 59d2dc15227d6f693a38131eca89b29e

Unlocked Bootloader:
1224abort.bin MD5: 10e94a4b4acdc82dec20c7904b69e5c0

Someone has HILink Firmware? I cannot find it anywhere

Thanks

4 Likes

Well, Hilink and Carlitoxx is the same :wink:

I'm a little excited to see you guys talking about this product. This is a product we made a few years ago. We also push XGSPON ONU(US/DS rate:10G/10G) in the last two years. But the market was not optimistic, so the team was basically disbanded.
Intel chip 98035 product include:MA5671A,G-010S-P,G-010S-A.
Questions that you might care about:

  1. SPEED test low
    Queue size(buffer) is small by default and can be manually increased.
  2. MA5671A open minishell to avoid security risk(Because Europeans and North Americans are concerned about security)
  3. Attempt to login the serial port,You may trigger watchdog crash( Some software versions enable dyinggasp function) .UART_RXD and dyinggasp MUX PIN7.So you input commands result in watchdog.
  4. You can try SPS-34-24T-HP-TDFO product(This is a standard product.There is a fully shell).

If there is time, I'll answer questions.
Thank you again for your discussion of this product.

4 Likes

thank you Kenny for the great info and taking the time to read this huge topic :smiley:

As you expect, here are a few followup questions:

  1. how can we increase the queue size? Is it a kernel parameter?
  2. I guess there's no way to workaround that minishell unless through the serial port? it would be nice to have a way to gain root access without building the serial and shorting nand pin (not exactly easy to do)
  3. that explains it! Thanks! I was scratching my head on this, some modules would just crash as soon as I wrote a single character through the serial port, and some other won't, so it depends on the firmware and the shared dyinggasp is the culprit, would it be enough to disable the dyinggasp through minishell command? I believe it's one of the few allowed commands.

bonus question for me, one that I wasn't able to explain, there are a couple of specific firmware versions, usually found on "032VRJ" modules, that allow a specific router (Power Station by a famous red logo provider) to write the ploam password to the SFP module, I literally haven't been able to understand how that is possible, it seems the firmware is slightly different and for example, the software eeprom seems to be bigger, could it be that the router writes to a specific memory address using i2c?

thanks a lot for your time!

  1. how can we increase the queue size? Is it a kernel parameter?
    [Kenny]The FALC chip works on a shared buffer basis,with a shared buffer of 18432 segments of 64 bytes each.This amount of memory is fully available for packet buffering.We can modify mib file(path:/etc/mibs/data_1g_8q.ini ) to increase the queue size.
    Attach jpg "queue_buffer_adjust", you can refer to the revision.

  2. I guess there's no way to workaround that minishell unless through the serial port? it would be nice to have a way to gain root access without building the serial and shorting nand pin (not exactly easy to do)
    [Kenny]Already in the software version of minishell,you must unlock the serial port to open the fully shell. There is another way that is not easy. I will send you a software image and you upgrade it via OLT.

  3. that explains it! Thanks! I was scratching my head on this, some modules would just crash as soon as I wrote a single character through the serial port, and some other won't, so it depends on the firmware and the shared dyinggasp is the culprit, would it be enough to disable the dyinggasp through minishell command? I believe it's one of the few allowed commands.
    [Kenny]Huawei order different ways to turn off and turn on DyingGASP for different operators.You can login minishell and input commands:

Welcome Visiting Huawei Home Gateway
Copyright by Huawei Technologies Co., Ltd.

display_version

OMCI daemon v7.5.1(Compiled on May 28 2021 11:01:28)
software_Version=V8R017C00S213T, internal_version =V800R017C00SPC213TB001, 1620-00801-04-00-213T-01

*If you version before S202,you can input "set nDyingGaspEnable disable" to close dyinggasp function.
*If you version is S202B,force open dyinggasp function.
*If you version after S207,you can input "fw_setenv i2cEnableDyingGasp 0" to close dyinggasp function.But you must get fully shell.

When you report your version, I'll see if there's something I can do.

the software eeprom seems to be bigger, could it be that the router writes to a specific memory address using i2c?
[Kenny]Yes.The SFP ONU uses GPIO to simulate I2C and can only be accessed after the system is up.The system up time is about 1min. The module part complies with SFF8472 and adopts the internal calibration method. Many registers have special uses, such as opening serial ports.

Again,tell me your used version.

1 Like

Hi I'm new with the sfp world but I have a spare mt5671a and i would like to make it work with my current isp.

I have a few questions:
How is the OpenWrt support status? Is it complete or or it just boot? I've seen a lot of dts for different sticks but I didn't find the omci tools/binaries.

I've seen some screenshots of a parched firmware with luci, is there some source available of that?

Is there more info about the partition table and the whole falcon hardware somewhere?

What would be the easiest way to flash it? Do I really need the serial, can't i just flash the partititions directly with a spi programmer?

Hi,

As I do not have access to a soldering iron and I'm not interested to buy one just for this modification, would it be possible to buy this kind of molex connector already modified from you? or anyone else? Please DM me if possible.

Thanks in advance.

@bmx29 Can you share the Full Image dump again? The previous link is broken.

hi,can you reupload the hl23446 image?the tinyupload has down for months and i get a ma5671a few days ago.

Can you share this firmware image?

1224ABORT.bin
mtd2.bin
mtd5.bin

2 Likes

could you figure out which version of the firmware you posted? Thanks.

That is Carlitoxx firmware.

Thanks. do you know if it is possible to enable 2.5G in this firmware?

Nice! Do you know about the eCOS firmware variant of this lantiq chip? I couldn't find a way to telnet into it, do you know any?

I flashed the firmware but looks it is much hotter than the stock one. Is there a way to tune setting or power of laser?