Just analyses the rom file that you posted.

it seem like there is another operating system based on linux inside the SFP module

when you say "I changed the serial number inside EEPROM" you mean by that address 68-83 on the A0h memory ?

I know that there is some reserved address on the A2h memory used by some manufacturer for storing extra data.

console=ttyS0,115200

could you please share the SN that u see on the OLT side

and also the result of this command "/interface ethernet monitor sfp1" .

and also the result of this command "/interface ethernet monitor sfp1" .

Based on the hardware schematic and public available information, there is large chance that the module is more like a linux computer with two bridged interfaces.

Dumped my sfp flash today:

SPI flash structure:

1M@0(uboot),
3584K@0x100000(uImg),
3M@0x480000(rootFs),
512K@0x780000(vars),
3584K@0x800000(uImgB),
3M@0xB80000(rootFsB),
512K@0xE80000(varsB),

There is a Squashfs filesystem, little endian, version 4.0, 2148429 bytes, 470 inodes, blocksize: 131072 bytes, created: Wed Nov 18 10:21:54 2015 at 0x480000, which contains
/etc/xml_params/gpon_xml_cfg_file.xml:

Code: Select all

<?xml version="1.0"?>
<cnfg>
    <PON>
        <!--  PON serial number - up to 8 symbols   -->
        <PON_serial_num>MKTK00010203</PON_serial_num>
        <!--  PON serial source: 0 - xml, 1 - digit part is taken from MAC lower 4 bytes-->
        <PON_serial_src>1</PON_serial_src>
        <!--  PON password - up to 10 symbols   -->
        <PON_passwd>1234567890</PON_passwd>
        <!--  PON SN disabled: 0 = FALSE, 1 = TRUE    -->
        <PON_dis_sn>0</PON_dis_sn>
        <!--  gem reset on fiber disconnect: 0 = FALSE, 1 = TRUE    -->
        <PON_gem_reset>0</PON_gem_reset>
        <!--  tcont reset on fiber disconnect: 0 = FALSE, 1 = TRUE    -->
        <PON_tcont_reset>1</PON_tcont_reset>
        <!--  PON Dying Gasp polarity: 0 = low, 1 = high    -->
        <PON_DG_polarity>1</PON_DG_polarity>
        <!--  PON XVR Burst Enable Polarity: 0 - high; 1 - low    -->
        <PON_XVR_burst_enable_polarity>0</PON_XVR_burst_enable_polarity>
        <!--  PON XVR Polarity: 0 - high; 1 - low    -->
        <PON_XVR_polarity>1</PON_XVR_polarity>
        <!--  P2P XVR burst enable polarity: 0 - high; 1 - low    -->
        <P2P_XVR_burst_enable_polarity>1</P2P_XVR_burst_enable_polarity>
        <!--  P2P XVR Polarity: 0 - high; 1 - low    -->
        <P2P_XVR_polarity>0</P2P_XVR_polarity>
        <!--  gem ports restore after return from State 7: 0 = FALSE, 1 = TRUE -->
        <PON_gem_restore>1</PON_gem_restore>
        <!--  Psa FEC Ind Bit Hyst: number of fram 1-4 -->
        <PON_fec_hyst>1</PON_fec_hyst>
        <!--  Coupling Mode: 0 = DC, 1 = AC -->
        <PON_coupling_mode>1</PON_coupling_mode>
    </PON>


</cnfg>

Based on the hardware schematic and public available information, there is large chance that the module is more like a linux computer with two bridged interfaces.

This is fascinating, and a little bizarre. Surely running an entire OS on SFP is a massive overhead?

Based on the hardware schematic and public available information, there is large chance that the module is more like a linux computer with two bridged interfaces.

This is fascinating, and a little bizarre. Surely running an entire OS on SFP is a massive overhead?

After analyzing the embedded linux, the OS on the module is not forwarding any packets. There is a hardware switch on the SoC actually doing all data forwarding,

How did you dump it?

Dumped my sfp flash today:

SPI flash structure:

1M@0(uboot),
3584K@0x100000(uImg),
3M@0x480000(rootFs),
512K@0x780000(vars),
3584K@0x800000(uImgB),
3M@0xB80000(rootFsB),
512K@0xE80000(varsB),

There is a Squashfs filesystem, little endian, version 4.0, 2148429 bytes, 470 inodes, blocksize: 131072 bytes, created: Wed Nov 18 10:21:54 2015 at 0x480000, which contains
/etc/xml_params/gpon_xml_cfg_file.xml:

Code: Select all

<?xml version="1.0"?>
<cnfg>
    <PON>
        <!--  PON serial number - up to 8 symbols   -->
        <PON_serial_num>MKTK00010203</PON_serial_num>
        <!--  PON serial source: 0 - xml, 1 - digit part is taken from MAC lower 4 bytes-->
        <PON_serial_src>1</PON_serial_src>
        <!--  PON password - up to 10 symbols   -->
        <PON_passwd>1234567890</PON_passwd>
        <!--  PON SN disabled: 0 = FALSE, 1 = TRUE    -->
        <PON_dis_sn>0</PON_dis_sn>
        <!--  gem reset on fiber disconnect: 0 = FALSE, 1 = TRUE    -->
        <PON_gem_reset>0</PON_gem_reset>
        <!--  tcont reset on fiber disconnect: 0 = FALSE, 1 = TRUE    -->
        <PON_tcont_reset>1</PON_tcont_reset>
        <!--  PON Dying Gasp polarity: 0 = low, 1 = high    -->
        <PON_DG_polarity>1</PON_DG_polarity>
        <!--  PON XVR Burst Enable Polarity: 0 - high; 1 - low    -->
        <PON_XVR_burst_enable_polarity>0</PON_XVR_burst_enable_polarity>
        <!--  PON XVR Polarity: 0 - high; 1 - low    -->
        <PON_XVR_polarity>1</PON_XVR_polarity>
        <!--  P2P XVR burst enable polarity: 0 - high; 1 - low    -->
        <P2P_XVR_burst_enable_polarity>1</P2P_XVR_burst_enable_polarity>
        <!--  P2P XVR Polarity: 0 - high; 1 - low    -->
        <P2P_XVR_polarity>0</P2P_XVR_polarity>
        <!--  gem ports restore after return from State 7: 0 = FALSE, 1 = TRUE -->
        <PON_gem_restore>1</PON_gem_restore>
        <!--  Psa FEC Ind Bit Hyst: number of fram 1-4 -->
        <PON_fec_hyst>1</PON_fec_hyst>
        <!--  Coupling Mode: 0 = DC, 1 = AC -->
        <PON_coupling_mode>1</PON_coupling_mode>
    </PON>


</cnfg>

How did you dump it?

Dumped my sfp flash today:

SPI flash structure:

1M@0(uboot),
3584K@0x100000(uImg),
3M@0x480000(rootFs),
512K@0x780000(vars),
3584K@0x800000(uImgB),
3M@0xB80000(rootFsB),
512K@0xE80000(varsB),

There is a Squashfs filesystem, little endian, version 4.0, 2148429 bytes, 470 inodes, blocksize: 131072 bytes, created: Wed Nov 18 10:21:54 2015 at 0x480000, which contains
/etc/xml_params/gpon_xml_cfg_file.xml:

Code: Select all

<?xml version="1.0"?>
<cnfg>
    <PON>
        <!--  PON serial number - up to 8 symbols   -->
        <PON_serial_num>MKTK00010203</PON_serial_num>
        <!--  PON serial source: 0 - xml, 1 - digit part is taken from MAC lower 4 bytes-->
        <PON_serial_src>1</PON_serial_src>
        <!--  PON password - up to 10 symbols   -->
        <PON_passwd>1234567890</PON_passwd>
        <!--  PON SN disabled: 0 = FALSE, 1 = TRUE    -->
        <PON_dis_sn>0</PON_dis_sn>
        <!--  gem reset on fiber disconnect: 0 = FALSE, 1 = TRUE    -->
        <PON_gem_reset>0</PON_gem_reset>
        <!--  tcont reset on fiber disconnect: 0 = FALSE, 1 = TRUE    -->
        <PON_tcont_reset>1</PON_tcont_reset>
        <!--  PON Dying Gasp polarity: 0 = low, 1 = high    -->
        <PON_DG_polarity>1</PON_DG_polarity>
        <!--  PON XVR Burst Enable Polarity: 0 - high; 1 - low    -->
        <PON_XVR_burst_enable_polarity>0</PON_XVR_burst_enable_polarity>
        <!--  PON XVR Polarity: 0 - high; 1 - low    -->
        <PON_XVR_polarity>1</PON_XVR_polarity>
        <!--  P2P XVR burst enable polarity: 0 - high; 1 - low    -->
        <P2P_XVR_burst_enable_polarity>1</P2P_XVR_burst_enable_polarity>
        <!--  P2P XVR Polarity: 0 - high; 1 - low    -->
        <P2P_XVR_polarity>0</P2P_XVR_polarity>
        <!--  gem ports restore after return from State 7: 0 = FALSE, 1 = TRUE -->
        <PON_gem_restore>1</PON_gem_restore>
        <!--  Psa FEC Ind Bit Hyst: number of fram 1-4 -->
        <PON_fec_hyst>1</PON_fec_hyst>
        <!--  Coupling Mode: 0 = DC, 1 = AC -->
        <PON_coupling_mode>1</PON_coupling_mode>
    </PON>


</cnfg>

I removed the flash chip from board (using hot air), then dumped it by a stm32 flashrom programmer.

Here is the flash: https://cdn.lty.me/mikrotik_gpon_flash.bin

is 404 not found.

Im new in hardware debugging and it sounds very interesting, how did you get hot airflow to remove chip?

How did you dump it?

Dumped my sfp flash today:

SPI flash structure:

1M@0(uboot),
3584K@0x100000(uImg),
3M@0x480000(rootFs),
512K@0x780000(vars),
3584K@0x800000(uImgB),
3M@0xB80000(rootFsB),
512K@0xE80000(varsB),

There is a Squashfs filesystem, little endian, version 4.0, 2148429 bytes, 470 inodes, blocksize: 131072 bytes, created: Wed Nov 18 10:21:54 2015 at 0x480000, which contains
/etc/xml_params/gpon_xml_cfg_file.xml:

Code: Select all

<?xml version="1.0"?>
<cnfg>
    <PON>
        <!--  PON serial number - up to 8 symbols   -->
        <PON_serial_num>MKTK00010203</PON_serial_num>
        <!--  PON serial source: 0 - xml, 1 - digit part is taken from MAC lower 4 bytes-->
        <PON_serial_src>1</PON_serial_src>
        <!--  PON password - up to 10 symbols   -->
        <PON_passwd>1234567890</PON_passwd>
        <!--  PON SN disabled: 0 = FALSE, 1 = TRUE    -->
        <PON_dis_sn>0</PON_dis_sn>
        <!--  gem reset on fiber disconnect: 0 = FALSE, 1 = TRUE    -->
        <PON_gem_reset>0</PON_gem_reset>
        <!--  tcont reset on fiber disconnect: 0 = FALSE, 1 = TRUE    -->
        <PON_tcont_reset>1</PON_tcont_reset>
        <!--  PON Dying Gasp polarity: 0 = low, 1 = high    -->
        <PON_DG_polarity>1</PON_DG_polarity>
        <!--  PON XVR Burst Enable Polarity: 0 - high; 1 - low    -->
        <PON_XVR_burst_enable_polarity>0</PON_XVR_burst_enable_polarity>
        <!--  PON XVR Polarity: 0 - high; 1 - low    -->
        <PON_XVR_polarity>1</PON_XVR_polarity>
        <!--  P2P XVR burst enable polarity: 0 - high; 1 - low    -->
        <P2P_XVR_burst_enable_polarity>1</P2P_XVR_burst_enable_polarity>
        <!--  P2P XVR Polarity: 0 - high; 1 - low    -->
        <P2P_XVR_polarity>0</P2P_XVR_polarity>
        <!--  gem ports restore after return from State 7: 0 = FALSE, 1 = TRUE -->
        <PON_gem_restore>1</PON_gem_restore>
        <!--  Psa FEC Ind Bit Hyst: number of fram 1-4 -->
        <PON_fec_hyst>1</PON_fec_hyst>
        <!--  Coupling Mode: 0 = DC, 1 = AC -->
        <PON_coupling_mode>1</PON_coupling_mode>
    </PON>


</cnfg>

I removed the flash chip from board (using hot air), then dumped it by a stm32 flashrom programmer.

Here is the flash: https://cdn.lty.me/mikrotik_gpon_flash.bin

@ilinsky

The link has been fixed. And I do not know how to send pm in this forum.

I see

I saw it with binwalk and is huge, is it possible to repack it with canes done and flash back, any idea ? I google about hot air already

I connected my module to my hawed 5608 OLT and it does not appear in iManager U2000 auto discovery, I think it has something to do with interoperability configuration

which software do you use to actually interact with stm32 programer to download the flash ?

We fight with this topic some time ago,

to resume a little bit:

The GPON ONU is a different kind of transceiver than no have a traditional eeprom inside, instead uses a nor flash chip (8, 16, 32 mb depending on the manufacturer) and is emulated their access after the OS was loaded/booted, this kind of transceivers have a embedded linux inside with the specific onu/omci drivers and all other features than each manufacturer want to add it, like the MAC.

the GPON ONU have two versions:
1- without MAC, that means than the gpon no have a accessible network interface configured to we can configure it, comes already preconfigured and only can be provisioned via omci from OLT side.
2- with MAC (Sticks), that means than the gpon have an accessible network interface and a method to do that, like telnet, ssh, or web (linux services), there you have the possibility to configure/debug it.

in the case of Mikrotik ONU is a kind of transceiver from the first group, in their case have pre configured the basic details (SN and PLOAM Password) from factory, and that information is stored on both sites:
1- In the "EEPROM" used by the other devices where is connected this SFP for know what kind of transceiver is and for persist some changes like sn, ploam password and more
2- in the same firmware img: inside of the configuration files used by the PON, OMCI drivers. in the most of cases (with MAC transceiver) this have a default value than is updated on boot time getting the value from "EEPROM".

the problem is than the GPON ONU of mikrotik no updates the sn, ploam password, etc in the config files inside of filesystem at boot time, because was made as a pre-provisioned transceiver, in other words, you can not change this values from client side, only can be configured in the OLT side to be discovered. take in count than the filesystem is readonly when was mounted in boot.

the trick here is (the most complicated part), update the files where is stored the SN and the PLOAM Passwd (SLID), rebuild the filesystem, recalculate the CRC Checksum and rewrite the nor flash. to you can be able to complete the authentication process with the OLT. you should be update the values in both sides filesystem and EEPROM (remember is a virtualized EEPROM inside of nor Flash and only can be accessed before the SFP boot completely vía IC2 eeprom programmer or via comand_cli if the gpon have this feature available).

this is a very expensive procedure and only the peoples with a very good skill on this areas can make this change for their own.

all GPON ONU (and in general SFP) have a two wire console access to debug and configure using an EVM Board (Evaluation Module Board) than provide network access to the GPON (only for Sticks) and Serial Console access.

we speak a lot of times with mikrotik to perform a firmware update and give the MAC capabilities to their GPON ONU, but they are no interested on spend resources on make this changes, as many other manufacturers.

for this reason we develop our own GPON ONU Stick with this features and more.
more details here: https://www.facebook.com/CarlitoxxPro/p ... 1173849605 (Spanish language)

I hope than i've clarify a little bit more this topic for some people.

Kindest Regards.

Hello! Can you share the SPI Flash dump?

I can share my dump