OpenWrt Forum Archive

Topic: TP-Link TX-6610 - GPON terminal

The content of this topic has been archived on 3 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi All!
I would like to describe hardware and some software of GPON terminal TP-Link TX-6610.

1/ Device opening
It is not so intuitive smile
Under sticker with SN, under device is screw located. This screw need to be removed.
There are also latches on sides of housing. After levering latches housing is opened to
two halves.


2/ Printed Circuit Board, hardware
Inside case PCB is located, and on it we can find:
- CPU MediaTek/EcoNet MT7520ST
- RAM Winbond W9725G6KB-25 -> 32MB DDR2
- Flash Winbond W25Q64FVSIG -> 8MB NOR SPI
- laser amplifier EcoNet EN7570N, something like MAX24003
- DC/DC converter AP3502EM, up to 2A, on PCB max 15V input, output 3,3V
- reverse polarity protection on SK14 diode
- laser BOSA THBD313B3N

3/ UART connector
of course exists smile -> JP1, pins:
1 - RX
2 - TX
3 - GND
4 - VCC
Speed - 115200

4/ Hardware modifications possibility:
For sure Flash can be upgraded , e .g. to Winbond W25Q128FVSIG -> 16MB.
Looking on PCB we can probability find  A13 and BA2 lines, so PCB can accept up to
256MB, e. g. W9725G6KB-25

5/ CPU description
There are likely no information. Datasheet can't be found.

6/ Bootlog over UART
Here are data, that's goes thru UART during booting :

DRAMC V2.2.0.2 (0)


MT751020 at Tue Sep 22 10:18:19 HKT 2015 version 1.1 free bootbase

Memory size 32MB

flash base: bc000000
Found SPI Flash 8MiB Winbond W25Q64 at 0xbc000000

tcPhyVer_mt7510FE
 Not found TC Phy
mtPhyVer_7510Ge
Not found TC Phy
Press any key in 3 secs to enter boot command mode.
............................................................


Invalid Power GPIO, just return and don't turn on Power LED
act_flag:0, img0[1 1 1], img1[0 0 1]
boot flag = 0
Decompress to 80002000 free_mem_ptr=80600000 free_mem_ptr_end=80780000
from main
Uncompressing [LZMA] ...  done.
Linux version 2.6.36 (root@localhost.localdomain) (gcc version 4.3.4 (GCC) ) #23 SMP Thu Sep 24 04:17:46 HKT 2015
ISPRAM0: PA=002a8000,Size=00008000,enabled
DSPRAM0: PA=1dff8000,Size=00001000,enabled
flash_init: flash_base:bc000000
flash_init: flash_base:bc000000
memsize:32MB
Ralink MT751020 SOC prom init
bootconsole [early0] enabled
CPU revision is: 00019555 (MIPS 34Kc)
Determined physical RAM map:
 memory: 01fe0000 @ 00020000 (usable)
Wasting 1024 bytes for tracking 32 unused pages
Zone PFN ranges:
  Normal   0x00000020 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000020 -> 0x00002000
3 available secondary CPU TC(s)
PERCPU: Embedded 7 pages/cpu @81043000 s7168 r8192 d13312 u65536
pcpu-alloc: s7168 r8192 d13312 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8096
Kernel command line:  es=1
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 64kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=0004884a
Readback ErrCtl register=0004884a
nmi base is 81084200
Memory: 28676k/32640k available (2744k kernel code, 3964k reserved, 570k data, 216k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:64
CPU frequency 648.00 MHz
 Using 266.000 MHz high precision timer.
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Calibrating delay loop... 430.89 BogoMIPS (lpj=2154496)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
34K sync es set to 1.
Config7: 0x80080500
Limit of 4 TCs set
TLB of 64 entry pairs shared by 2 VPEs
VPE 0: TC 0 1 2, VPE 1: TC 3
IPI buffer pool of 16 buffers
CPU revision is: 00019555 ((null))
TC 1 going on-line as CPU 1
CPU revision is: 00019555 ((null))
TC 2 going on-line as CPU 2
CPU revision is: 00019555 ((null))
TC 3 going on-line as CPU 3
Brought up 4 CPUs
NET: Registered protocol family 16
MT7510_pcie_init
check pcie link up status:
isRC0_LINKUP=0
isRC1_LINKUP=0
PCI-E RC0 & RC1 can not link up
bio: create slab <bio-0> at 0
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
TC3162 hardware watchdog module loaded.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 56
cryptomgr_test used greatest stack depth: 15360 bytes left
cryptomgr_test used greatest stack depth: 15324 bytes left
io scheduler noop registered (default)
ttyS0 at I/O 0xbfbf0003 (irq = 1) is a TC3162
brd: module loaded
tc3162 mtd init: mt6573_nand_init enter
MediaTek MT6573 Nand driver init, version v2.0
tc3162: flash device 0x01000000 at 0x1c000000
tc3162: Found SPIFLASH 8MiB Winbond W25Q64
Creating 14 MTD partitions on "tc3162":
0x000000000000-0x000000800000 : "flash"
0x000000000000-0x000000020000 : "tcboot"
0x000000020000-0x000000030000 : "romfile"
0x000000030000-0x000000040000 : "bootflag"
0x000000040000-0x000000050000 : "factoryinfo"
0x000000050000-0x000000060000 : "loid"
0x000000060000-0x000000070000 : "hwinfo"
0x000000070000-0x000000090000 : "config"
0x000000090000-0x0000000a0000 : "iot"
0x0000000a0000-0x0000001f0000 : "kernelA"
0x0000001f0000-0x000000400000 : "rootfsA"
0x000000400000-0x000000550000 : "kernelB"
0x000000550000-0x000000760000 : "rootfsB"
0x000000760000-0x000000800000 : "other"
rootfsA
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
RT3xxx EHCI/OHCI init.
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (448 buckets, 1792 max)
ctnetlink v0.93: registering with nfnetlink.
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:10.
Freeing unused kernel memory: 216k freed
busybox init and set aff
init started:  BusyBox v1.00 (2015.09.17-05:01+0000) multi-call binary
[ used greatest stack depth: 14832 bytes left
[ used greatest stack depth: 14528 bytes left
busybox used greatest stack depth: 14320 bytes left
mtd[readflash]:device=mtd used greatest stack depth: 14240 bytes left
factoryinfo tclen=160 tcoffset=22
Unlocking factoryinfo ...
Reading from factoryinfo to /tmp/7570_bob.conf ...

00000000h: 00 00 02 37 00 00 04 88 00 00 00 F0 00 00 00 B8
00000010h: 00 00 00 06 00 00 00 10 00 00 0E B3 00 00 00 14
00000020h: 00 00 00 1C 00 00 00 10 FF FF FF FF 00 00 00 01
00000030h: 00 00 00 67 00 00 0B B8 FF FF FF FF FF FF FF FF
00000040h: 00 AF 00 F3 00 63 00 E9 FF FF FF FF FF FF FF FF
00000050h: 27 6C 69 00 03 E5 10 C0 00 64 02 48 FF FF FF FF
00000060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000080h: FF FF FF FF 00 00 00 05 FF FF FF FF FF FF FF FF
00000090h: FF FF FF FF 07 05 07 00 FF FF FF FF FF FF FF FFmodule_sel: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
insmod used greatest stack depth: 13784 bytes left

tcsmux version: tcsmux V1.1.0.0 (Oct 13 2014-22:25:21).
vlantag_drv_init
TC3162 LED Manager 0.1 init

tcledctrl version: tcledctrl V1.1.0.0 (Sep 20 2015-14:57:19).
tccicmd V1.1.0.0 (Sep 20 2015-14:57:23)

SIFMaster 0.1 init

Register sifm cmd
the number of cfg node is 48
vlantag_init
autopvc_init
LanguageSwitch_init vendorCfgFile_init The number of cache node is 5
Enter into function:parser_romfile
mxml: Bad control character 0x0b not allowed by XML standard!
Romfile format is wrong, we use default romfile to replace current setting romfile!!
mtd[readflash]:device=reservearea tclen=512 tcoffset=197632
Unlocking reservearea ...
Could not open mtd device: reservearea
Unlocking romfile ...
Writing from /tmp/var/romfile.cfg to romfile ...
 [w]
Can't open /etc/Wireless/WLAN_APOn

lanHost_read: Create node LanHost !
sh: /usr/bin/ip: not found
insmod raeth driver
femac.c:v1.00-NAPI 29.Mar.2011
MAC from flash_base: 0xbc000000(offset: 0x40000):ffffffec 08 6b 2e 76 70
eth0: FE MAC Ethernet address: EC:08:6B:2E:76:70
eth0: starting interface.
EPhy debug(8): tcPhyVerLookUp() in
MT7510FE, EPhy debug(8)(15): tcPhyVerLookUp() out
PhyPart debug: tcPhyInit() in , tcphyver=15, phyaddr=8, eco=0x0
phyaddr = 8
EPhy debug(12): tcPhyVerLookUp() in
MT7510Ge,Internal check flag: fgMT7510Ge_INT=0x0, eco=0x50003
EPhy debug(12)(16): tcPhyVerLookUp() out
PhyPart debug: tcPhyInit() in , tcphyver=16, phyaddr=12, eco=0x0

 7510Ge, phyaddr= (12,12)
debug... ,phyaddr=12 ,eco=0x50003
xPON driver initialization
Alloc data struct memory successful, 34456
EN7570 found!
FLASH matrix got
Internal DDMI Enabled
TEC Enabled
RSSI_Vref = 0x215
RSSI_V = 0x29a
ERC filter set
MPD Current Offset = 0xdd
Start GPON Tx Calibration
Rx LOS is set
CDR disabled
T0/T1 delay = 0x9a
T0/T1 delay = 0x47
RGS_T0C = 0x51
RGS_T1C = 0x49
TGEN done
CDR enabled
Initial bias/mod current loaded from FLASH
MPDL/MPDH loaded
Tx SD set
APD initialization done
Rogue ONU clear
EN7570 Initialization Done!
PON PHY driver version is 111.86.66
XPON Mapping Module init OK!
Ebtables v2.0 registered
Ralink HW NAT Module Enabled
IP check use Black List
device eth0 entered promiscuous mode
done
TC3162 hardware watchdog initialized
no specific node
four ports
SIOCGIFFLAGS: No such device
interface eth0.1 does not exist!
sh: vconfig: not found
SIOCGIFFLAGS: No such device
interface eth0.2 does not exist!
sh: vconfig: not found
SIOCGIFFLAGS: No such device
interface eth0.3 does not exist!
sh: vconfig: not found
SIOCGIFFLAGS: No such device
interface eth0.4 does not exist!
sh: vconfig: not found
device eth0 is already a member of a bridge; can't enslave it to bridge br0.
MT7520S is single port!
mtd[readflash]:device=reservearea tclen=512 tcoffset=197632
Unlocking reservearea ..Start omci
.
Could not open mtd device: reservearea
00:00:11 imgr.c [71]: Initial system driver.
00:00:11 imgr.c [77]: Initial pthread parameters.
00:00:11 imgr.c [83]: Initial dispatcher.
00:00:11 dspch_init.c [23]: Create IPC trap message queue
00:00:11 dspch_init.c [36]: Create IPC trap message queue
00:00:11 imgr.c [89]: Initial database manager.
00:00:11 dbmgr_init.c [32]: Create database memory.
00:00:11 dbmgr_init.c [38]: Create the share database memory successful.
00:00:11 dbmgr_init.c [41]: The total share database size is 0.
00:00:11 imgr.c [95]: Initial config manager.
00:00:11 imgr.c [101]: Initial fault manager.
00:00:11 imgr.c [107]: Initial performance manager.
Warning: there is no router interface for voip!!
iptables v1.4.10: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.4.10: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.4.10: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.4.10: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
device nas1 entered promiscuous mode
br0: port 2(nas1) entering forwarding state
br0: port 2(nas1) entering forwarding state
br0: port 1(eth0) entering forwarding state
br0: port 1(eth0) entering forwarding state
sh: /userfs/bin/dnsmasq: not found
valid subcommands:
adsl
========================insmod iptable_filter=======================
chmod: /userfs/profile.cfg: Read-only file system
valid subcommands:
adsl
set olt type: 0
echo used greatest stack depth: 8944 bytes left
come into gpon_boot
activeImage=0, committedImage=0

Send OAM Update config!
!sendEponOamCmdMsg open message queue fail!
Unlocking romfile ...
Writing from /tmp/var/romfile.cfg to romfile ...
 [w]pon_vlan_init

Single Lan p[w]

 initilize xpon igmp module....done!
Cannot open file "/tm
sendOmciCmdMsg open message queue fail!p/upload_onu_cardholder_type"
pon_mac_filter_init

Single Lan portSIOCSIFMTU: No such device
got image index(0): V3.1.4instanceId(0), img ver buffer is V3.1.4
SIOCSIFMTU: No such device
SIOCSIFMTU: No such device
got image index(1): V3.1.4instanceId(1), img ver buffer is V3.1.4
SIOCSIFMTU: No such device
SIOCSIFMTU: No such device
*reg=00001640 value:00000000 (ext_switch:0)

Please press Enter to activate this console. got image index(0): V3.1.4instanceId(0), img ver buffer is V3.1.4
got image index(1): V3.1.4instanceId(1), img ver buffer is V3.1.4
api_set_pon_ver_info(335): -- not implemented, to do here! --
api_set_sn_auth_info(300): snIUint32[0] = 0x54504c47, snIUint32[1] = 0x6b2e7670,
vendor: 0x54504c47
echo used greatest stack depth: 8512 bytes left
api_set_sn_auth_info(308): passwd:
Password:
erase at 0x00050000 with buflen 10000
start erasing memory: 0x50000 with length: 10000
after erasing memory
Write at 0x00050000 +0x00010000 ... with first char: ff
Write end ...
api_set_vlan_mode(853): set vlanmode=0 vid=1 pri=0
api_set_sn_auth_info(300): snIUint32[0] = 0x54504c47, snIUint32[1] = 0x6b2e7670,
vendor: 0x54504c47
got image index(0): V3.1.4instanceId(0), img ver buffer is V3.1.4
got image index(1): V3.1.4instanceId(1), img ver buffer is V3.1.4
Line 778: IOT class 256, inst 0, attr id 1 value: V4.0
Line 778: IOT class 256, inst 0, attr id 0 value: TPLG
Line 778: IOT class 256, inst 0, attr id 2 value: TPLGk.vp
Line 778: IOT class 256, inst 0, attr id 3 value:
Line 778: IOT class 257, inst 0, attr id 0 value: TX-6610
Line 778: IOT class 257, inst 0, attr id 1 value: ▒
Line 778: IOT class 7, inst 0, attr id 0 value: V3.1.4
Line 778: IOT class 7, inst 1, attr id 0 value: V3.1.4
api_renegotiate(546): current mode is not gpon
api_set_onu_dhcp_status(1062): -- not implemented, to do here! --
mt7570 detected

Do somebody know what to do with

Warning! The following errors must be corrected before your message can be posted:
Too more links in message. Allowed 0 links. Reduce number of links and post it again.

It is really hard to post something..

The discussion might have continued from here.