here the cpu and flash layout from original firmware
oot@SFP:/# cat /proc/cpuinfo
system type : Falcon rev A22
machine : SFP - Lantiq Falcon SFP Stick
processor : 0
cpu model : MIPS 34Kc V5.6
BogoMIPS : 265.98
wait instruction : yes
microsecond timers : yes
tlb_entries : 16
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0e38, 0x0618, 0x0640]
isa : mips1 mips2 mips32r1 mips32r2
ASEs implemented : mips16 dsp mt
shadow register sets : 1
kscratch registers : 0
core : 0
VCED exceptions : not available
VCEI exceptions : not available
root@SFP:/# cat /proc/mtd
dev: size erasesize name
mtd0: 00060000 00010000 "Boot"
mtd1: 00010000 00010000 "Env"
mtd2: 00390000 00010000 "ImageA"
mtd3: 00390000 00010000 "ImageB"
mtd4: 00060000 00010000 "Config"
mtd5: 00010000 00010000 "SECTION_EGIS"
mtd6: 00250000 00010000 "rootfs"
mtd7: 00010000 00010000 "rootfs_data"
dmesg log
root@SFP:/# dmesg
[ 0.000000] Linux version 3.10.12 (luowenbin@dev10.sh.gj.com) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #2 Wed Jul 12 12:01:33 CST 2017
[ 0.000000] SoC: Falcon rev A22
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019556 (MIPS 34Kc)
[ 0.000000] MIPS: machine is SFP - Lantiq Falcon SFP Stick
[ 0.000000] e=memsize=64
[ 0.000000] e=initrd_start=0xA0000000
[ 0.000000] e=initrd_size=0x0
[ 0.000000] e=flash_start=0xB0000000
[ 0.000000] e=flash_size=0x44D4A31E
[ 0.000000] e=ethaddr=ac:9a:96:00:00:00
[ 0.000000] MEMSIZE = 67108864
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] debug: ignoring loglevel setting.
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 03f00000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x03efffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x03efffff]
[ 0.000000] On node 0 totalpages: 16128
[ 0.000000] free_area_init_node: node 0, pgdat 8030c5f0, node_mem_map 81003460
[ 0.000000] Normal zone: 126 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 16128 pages, LIFO batch:3
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002
[ 0.000000] Kernel command line: rootfstype=squashfs,jffs2 ethaddr=8C:1A:6F:2B:73:F4 softMode=MANUFACTURE machtype=SFP ignore_loglevel vpe1_load_addr=0x81F00000 vpe1_mem=1M mem=63M ACTIVE=B mtdparts=sflash:384k(Boot),64k(Env),3648k(ImageA),3648k(ImageB),384k(Config),64k(SECTION_EGIS),2368k@5376k(rootfs) console=ttyLTQ0,115200 init=/etc/preinit
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Writing ErrCtl register=0007915b
[ 0.000000] Readback ErrCtl register=0007915b
[ 0.000000] Memory: 60212k/64512k available (2559k kernel code, 4300k reserved, 667k data, 220k init, 0k highmem)
[ 0.000000] NR_IRQS:328
[ 0.000000] Setting up vectored interrupts
[ 0.000000] CPU Clock: 400MHz
[ 0.032000] Calibrating delay loop... 265.98 BogoMIPS (lpj=531968)
[ 0.036000] pid_max: default: 32768 minimum: 301
[ 0.040000] Mount-cache hash table entries: 512
[ 0.048000] pinctrl core: initialized pinctrl subsystem
[ 0.052000] NET: Registered protocol family 16
[ 0.072000] pinctrl-falcon pinctrl.0: Init done
[ 0.076000] FALC(tm) ON clock driver
[ 0.080000] clockevent device FALCON_CLK_EVT with timer 4, irq 124
[ 0.100000] bio: create slab <bio-0> at 0
[ 0.104000] FALC(tm) ON GPIO Driver, (C) 2012 Lantiq Deutschland Gmbh
[ 0.112000] Switching to clocksource FALCON
[ 0.120000] NET: Registered protocol family 2
[ 0.124000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[ 0.132000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[ 0.136000] TCP: Hash tables configured (established 512 bind 512)
[ 0.144000] TCP: reno registered
[ 0.148000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.152000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.160000] NET: Registered protocol family 1
[ 0.164000] RPC: Registered named UNIX socket transport module.
[ 0.168000] RPC: Registered udp transport module.
[ 0.176000] RPC: Registered tcp transport module.
[ 0.180000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.188000] EASY98000 LED driver, Version 1.0.1 (c) Copyright 2013, Lantiq Deutschland GmbH
[ 0.200000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.204000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.216000] msgmni has been set to 117
[ 0.220000] io scheduler noop registered
[ 0.224000] io scheduler deadline registered (default)
[ 0.232000] 1e100c00.serial: ttyLTQ0 at MMIO 0x1e100c00 (irq = 104) is a lantiq,asc
[ 0.236000] console [ttyLTQ0] enabled, bootconsole disabled
[ 0.256000] m25p80 spi32766.0: found gd25q64, expected s25fl129p0
[ 0.260000] m25p80 spi32766.0: gd25q64 (8192 Kbytes)
[ 0.264000] 7 cmdlinepart partitions found on MTD device sflash
[ 0.272000] Creating 7 MTD partitions on "sflash":
[ 0.276000] 0x000000000000-0x000000060000 : "Boot"
[ 0.284000] 0x000000060000-0x000000070000 : "Env"
[ 0.288000] 0x000000070000-0x000000400000 : "ImageA"
[ 0.296000] 0x000000400000-0x000000790000 : "ImageB"
[ 0.300000] 0x000000790000-0x0000007f0000 : "Config"
[ 0.304000] 0x0000007f0000-0x000000800000 : "SECTION_EGIS"
[ 0.312000] 0x000000540000-0x000000790000 : "rootfs"
[ 0.316000] mtd: partition "rootfs" set to be root filesystem
[ 0.324000] mtd: partition "rootfs_data" created automatically, ofs=0x780000, len=0x10000
[ 0.332000] 0x000000780000-0x000000790000 : "rootfs_data"
[ 0.340000] wdt 1f8803f0.watchdog: Init done
[ 0.348000] TCP: cubic registered
[ 0.348000] NET: Registered protocol family 17
[ 0.352000] 8021q: 802.1Q VLAN Support v1.8
[ 0.372000] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
[ 0.376000] Freeing unused kernel memory: 220K (80329000 - 80360000)
[ 7.232000] Egis Driver, (C) 2012 T&W Co., Ltd.
[ 7.540000] jffs2: notice: (426) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 8.680000] IFXOS, Version 1.5.19 (c) Copyright 2009, Lantiq Deutschland GmbH
[ 8.728000] GPON SFP I2C Slave Driver, Version 1.5.0 (c) Copyright 2013, Lantiq Deutschland GmbH
[ 8.736000] [sfp_i2c] I2C-module id=87 revision=2
[ 9.028000] FALC(tm) ON Optic Driver, version 6.4.1 (c) Copyright 2013, Lantiq Deutschland GmbH
[ 9.704000] FALC(tm) ON Base Driver, Version 6.4.2.0 Copyright (c) 2013, Lantiq Deutschland GmbH
[ 9.712000] [onu] gpe_table[39] FIO_GPE_SCE_CONSTANTS_GET - cmd 0xc0540527 - write size 0
[ 9.736000] FALC(tm) ON Ethernet Driver, Version 0.7.0 Copyright (c) 2013, Lantiq Deutschland GmbH
[ 9.784000] Watchdog init OK!
[ 21.208000] [onu] GPHY Firmware loaded into RAM (phy11g.bin)
[ 21.424000] [onu] PE[255] firmware loaded v9.45.0.2
[ 25.592000] tardev register successful!
[ 52.988000] device exc entered promiscuous mode
i got a backup from all mtd parts . i can flash imageA via telnet