Port current OpenWrt to it as the best approach (that's a 2014 release).
If the packages you want to install don't require any kernel modules, there's a chance that the ones archived at http://archive.openwrt.org/barrier_breaker/14.07/ may be useful. If the OEM modified the build system from "official" Barrier Breaker, they may not work for you.
In the archive I find iperf and nice choice of interesting packages. If I could only escape the "walled garden" I tried every command I could think of.
Does anyone know how to obtain a fully interactive shell?
After "bombarding" the minishell with various commands for two days I decided to give up. My old roommate has this equipment to remove integrated circuits. I treat it as a failure because it is impractical and requires chip removal.
Next weekend we will attempt to retrieve data from the chip.
This is a Lantiq GPON SFP, the company made this chip has defunct and merged with Intel, the source code for the GPON driver part is nowhere to be found so the chance of having a fully working, newer version Openwrt is very slim, your PCB shot looks exactly the one I have as "Alcatel Lucent" brand, you could dump the NAND flash with CH341A SPI reader from Chinese or with a RPI because the chip is SPI, I have my own NAND dump at my repo here: https://github.com/minhng99/alcatel_lucent-lantiq_falcon
my ALCL stick does allow access to the full linux shell... currently I couldn't make it work with my ISP yet, could you give me your NAND dump when you've pulled it out?
Finally, a full interactive shell. I changed one line in /etc/passwd from /opt/lantiq/bin/minishell to /bin/ash
root:x:0:0:root:/home/ONTUSER:/opt/lantiq/bin/minishellFlash mtd layout
root@SFP:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00010000 "uboot"
mtd1: 00080000 00010000 "uboot_env"
mtd2: 00740000 00010000 "linux"
mtd3: 006191d8 00010000 "rootfs"
mtd4: 00400000 00010000 "rootfs_data"
mtd5: 00800000 00010000 "image1"command syntax used to compress squash file system.
squashfs-4.2-official/mksquashfs SQFS/ sqsh.bin -all-root -b 262144 -comp xz// sqsh.bin padded with FF's to match original squashfs size=2200024 (from mtd2) / /
I'm little dissapointed, no uhttpd.
@minhng99
I like the CH341A flash reader, just placed the order for myself. Thanks.
link to modified mtd2 image0 (full shell))
Full Image dump - uboot+uboot_env+image0+image1
The full image has uboot_env sanitized(serial number and MAC) image0 and image1 are original(restricted minishell)
Not only PCB are identical
md5 sums of mtd0=992b31a67c644aa68cf7f9caf956b1f9 for my Huawei and your Alcatel
U-Boot 2011.12-lantiq-gpon-1.2.24 (Nov 03 2014 - 22:46:28)
Wow, so Huawei just rebrand the Alcatel-Lucent and install their OS then? Very interesting...
I wanted to try to flash your image because my OS don't forwarding PPPoE frames while my GPON state is authenticated (O5)
Yours have one more electronic part next to the flash.
A fix for Mikrotik users. Same Alcatel SFP
https://forum.mikrotik.com/viewtopic.php?f=3&t=116364#p758700
OMCID_BIN=/opt/lantiq/bin/omcid
#OMCI_MGR_BIN=/opt/lantiq/bin/omciLibMgr
#OMCI_PARSER_BIN=/opt/lantiq/bin/omciLibParser
${OMCID_BIN} -d3 ${uni2lan} -p $mib_file -o$omcc_version > /dev/console 2> /dev/console &
# ${OMCI_MGR_BIN} > /dev/console 2> /dev/console &
# sleep 5
# ${OMCI_PARSER_BIN} > /dev/console 2> /dev/console &Wow, thank you very much, it's worked, PPPoE dialing successfully!!! That guy also have the same stick G-010S-P as me, it's somewhere middle between Nokia and Alcatel-Lucent
that thread also have how to enable UART also which is very nice, I've probed every pins and haven't be able to find a working UART pin, you know there's no "factory reset" button on these thing so once I messed it up I have to pull the flash out and reflash it which is very frustrating.
Positive confirmation for UART on MA5671A. Pin 2 and Pin 7. With restricted minishell only Pin 2, fast scrolling display without ability to abort autoboot.
It apparently this stick doesn't forward IGMP, my IPTV doesn't work with this stick but works with another "more dumb" lantiq-based stick (Sercomm FGS202) which doesn't use Openwrt
Did you try to flash my image? I have no clue about IPTV.
no, it's my stock image with the OCMI modded... I don't really want to flash random images because they might hardware damage the thing by pulling the wrong I/O pin
the openwrt just doesn't forward IGMP traffic, normally they have igmpproxy package for that but it require a clear LAN/WAN interface meanwhile the GPON stick doesn't really expose the L2 WAN interface to the openwrt OS so I have no idea how to make it work
with the flash chip removed I get similar output like in fgs202 thread
ROM: V1.1.4
ROM: CFG 0x00000006
ROM: SFLASH-4
ROM: CFG 0x00000006
ROM: SFLASH-4
ROM: CFG 0x00000006
ROM: SFLASH-4
ROM: Boot? (0-9A-F<CR>) 7
ROM: CFG 0x00000007
ROM: XMODEM
CCCCCCCCCCCCCCCWith the flash chip back I've tried to tape over SFP ground pins 1,9,10. No effect.
edit:
Good people from allaboutcircuits forum suggested shorting DO and GND flash pins. That did not work.
Instead I shorted momentarilly flash pin 4(GND) and pin 5 (Data In) while powering up the sfp. Got the ROM prompt. From there: xmodem, transfer modified uboot, change env, load image and enjoy full shell access.
thanks for the trick, also be able to get into ROM here after I've nuked uboot accidentally...
I've put together a uboot code here that is supposedly for this device, last time I flashed it bindly it doesn't boot (I don't know how to make UART access back then so idk if it actually executed or not) but now I'm gonna try again.
It takes time but it's also possible to load the whole image and restore bricked SFP module without removing flash.
For Windows users this excellent software has support for xmodem and Kermit transfer protocols.
XMODEM - to transfer U-Boot(extract FFDD0022-1020BF from mtd0)
At uboot prompt 'loadb' command will use Kermit protocol to transfer mtd1/mtd2 into memory. It takes around 25 minutes for 7.6MB file. Step 2, 'sf' to write from memory to flash.
I will post exact commands and offsets next week.
Edit:
The modified mtd0 (1224ABORT.bin) will ignore the locked mtd1 (uboot_env).
1224ABORT.bin md5sum: 10e94a4b4acdc82dec20c7904b69e5c0
The name comes from U-Boot version 1.22.4 in case someone is wondering.
Use it with XMODEM after shorting pins 4 and 5 on the Windbond flash to return to the default unlocked environment.
After getting access to uboot_env on flash let's set permament access to the module. UART connected to pin#2 and pin#7 is required for this step.
FALCON => setenv bootdelay 5
FALCON => setenv asc0 0
FALCON => setenv preboot "gpio input 105;gpio input 106;gpio input 107;gpio input 108;gpio set 3;gpio set 109;gpio set 110;gpio clear 423; gpio clear 422; gpio clear 325; gpio clear402; gpio clear 424"
FALCON => saveenvRecovery of bricked module. Confirmed working for MA5671A and G-010S-P modules.
#verify memstart and flashstart addresses
FALCON => bdinfo
boot_params = 0x83F37F98
memstart = 0x80000000
memsize = 0x04000000
flashstart = 0xB0000000
flashsize = 0x8A40A5C0
flashoffset = 0x00000000
#transfer desired file by Kermit into memory
FALCON => loadb
## Ready for binary (kermit) download to 0x80800000 at 115200 bps...
## Total Size = 0x00040000 = 262144 Bytes
## Start Addr = 0x80800000
#general syntax
#sf write "from memory address" "to flash offset" "length"
#to write mtd0(uboot)
sf probe 0
sf erase 0 40000
sf write 80800000 0 40000
#to write mtd1(uboot_env)
sf probe 0
sf erase 40000 80000
sf write 80800000 40000 80000
#to write mtd2(image0)
sf probe 0
sf erase C0000 740000
sf write 80800000 C0000 740000
#to write mtd5(image1)
sf probe 0
sf erase 800000 740000
sf write 80800000 800000 740000
#example of writing mtd0(uboot)
FALCON => sf probe 0
SF: Detected W25Q128BV with page size 256 Bytes, erase size 4 KiB, total 16 MiB
FALCON => sf erase 0 40000
SF: 262144 bytes @ 0x0 Erased: OK
FALCON => sf write 80800000 0 40000
SF: 262144 bytes @ 0x0 Written: OK
FALCON =>
#display memory or flash content
md 80800000
md B0000000 (flash uboot)
md B0040000 (flash uboot_env)
md B00C0000 (flash image0)Would you mind sharing short instructions how to compile uboot using your code. Tried make menuconfig. MAKEALL complains about missing ppc_8xx-gcc.
This is supposedly the most up to date branch, however I could't find any references to SFP
https://github.com/danielschwierzeck/u-boot-lantiq/tree/openwrt/v2014.07
Many SFP hits here.
Could not locate the source archive yet for OpenWrt 12.09 Attitude Adjustment. At least .config (config.lantiq_falcon) is posted. That's a good start.
xhttp://archive.openwrt.org/attitude_adjustment/12.09/lantiq/falcon/
From what I understand, lantiq uboot for SFP modules must be compiled for MIPS32 revision 2, board Falcon, cpu 34kc
None of the code I've found on the internet have any reference to the FALC ON board... I've managed to find a bunch of diff patch file somewhere that I don't remember but I've put together that repo and it's build-able
You need an old MIPS32 gcc here: https://github.com/minhng99/toolchain-mips_r2_gcc-4.6-linaro_uClibc-0.9.33.2
And here's the commands to compile it:
export CROSS_COMPILE='/home/user/toolchain-mips_r2_gcc-4.6-linaro_uClibc-0.9.33.2/bin/mips-openwrt-linux-uclibc-'
export ARCH=mips
make easy980x0_norflash
make
There seems to be multiple board config variant for this device, you can check the list here:
EDIT: It's alive!!! my uboot code works!
But there's no SPI Flash code for the config I've built... the "sf" command isn't exist, it might need some extra work to make it fully functional, maybe it's supposed to be easy980x0_serialflash?
with the serialflash config, it found the SPI flash and even attempted to boot the kernel image, nice!
Looks like it have a SGMII driver, we may even be able to do netconsole with this
Thank you. Incredible! With the "make easy980x0_serialflash" I have working u-boot. The compiled binary was named u-boot.bri.
I replaced original u-boot with this one. I am able to fully boot, ping and login@192.168.1.10 to my module. Will test some more, later after work.
I haven't tried yet but looks like we do have a Lantiq Falcon openwrt generic build, maybe it will work on the stick and we can put the proprietary blobs in /opt in later? That would be great if we managed to do that.... right now we have uboot source code, kernel code (unconfirmed if it works or not) and blobs files
I just restored by bricked stick by xmodem it with the whole flash dump in uboot then just write it back down the SPI, it's worked again now
EDIT:
I tried to boot my serialflash uboot, the kernel is up but it's panic because it can't find the "root="... dunno why...
EDIT:
Tried to install a newest snapshot openwrt and the uboot can't load the kernel... maybe we need to upgrade uboot
SF: Detected S25FL129P_64K with page size 64 KiB, total 16 MiB
## Booting kernel from Legacy Image at 80f00000 ...
Image Name: MIPS OpenWrt Linux-4.19.86
Created: 2019-12-03 21:41:35 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1775673 Bytes = 1.7 MiB
Load Address: 80002000
Entry Point: 80002000
Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!
FALCON =>