Hardware Specifications

Possible clones

• SourcePhotonics SPS-34-24T-HP-TDFO

Firmware is interchangeable with:

• Huawei MA5671A
• Nokia G-010S-P
• Hilink HL23446
• Dasan H650SFP
• DpOptics D23446
• Photonics SPS-34-24T-HP-TDFO

Serial

The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the SFP connector.

List of software versions

• 6BA1896SPLQA13 (Dec 16 2016)
• 6BA1896SPLQA41
• 6BA1896SPLQA42 (Sep 18 2021)

List of partitions

Partition layouts change depending on which image is booted, in particular:

When booting image0:

mtd2 ---> image0 (linux)
mtd5 --> image1
mtd3 --> rootfs
mtd4 --> rootfs_data

When booting image0:

mtd2 ---> image0
mtd3 --> image1 (linux)
mtd4 --> rootfs
mtd5 --> rootfs_data

For more info XPONos partition layout.

When booting from image0

When booting from image1

List of firmwares and files

• 6BA1896SPLQA13 MTD0/U-Boot md5hash: 992b31a67c644aa68cf7f9caf956b1f9
• 6BA1896SPLQA13 MTD2/Image0 md5hash: 5d46a9acc3c5ba8710887aa32b82aeb4
• 6BA1896SPLQA42 MTD0/U-Boot md5hash: 992b31a67c644aa68cf7f9caf956b1f9
• 6BA1896SPLQA42 MTD2/Image0 md5hash: 04533554bb0c8b997697fbc048159002

Unlock the device

Bootloader unlock from shell

fw_setenv bootdelay 5
fw_setenv asc0 0
fw_setenv preboot "gpio set 3;gpio input 2;gpio input 105;gpio input 106;gpio input 107;gpio input 108"

Emergency bootloader unlock via TTL serial

If for some reason you are in the situation where you do not have a bootable firmware on your SFP stick you can do an emergency unlock via TTL serial.

To perform the emergency unlock, the following hardware is required:

• TTL-USB adapter,
• SFP adapter to connect the TTL-USB cables to the SFP stick.

The electrical connections are the same as those of the Huawei MA5671A; see the Huawei root guide for accurate details on how to connect the TTL-USB to the SFP adapter.

When you are ready with everything plugged in you need to press the button below. A window will open to execute the emergency unlock.

Start emergency unlock!

GPON ONU status

Getting the operational status of the ONU

onu ploamsg

Querying a particular OMCI ME

omci_pipe.sh meg MIB_IDX ME_IN

Where MIB_IDX is the MIB ID and the ME_IN is the ME instance number

Getting/Setting Speed LAN Mode

To get the LAN Mode:

onu lanpsg 0

The link_status variable tells the current speed

To change the default lan mode value you can use fw_setenv sgmii_mode. The firmware already has the value set to 5 by default and there should not be any need to change it.

GPON/OMCI settings

Setting ONU GPON Serial Number

set_serial_number ABCD12345678

Or:

sfp_i2c -i8 -s "ABCD12345678"

Getting ONU GPON Serial Number

fw_printenv | grep nSerial

Or:

sfp_i2c -g

Setting ONU GPON PLOAM password

sfp_i2c -i11 -s "1234567890"

Setting ONU GPON LOID and LOID password

sfp_i2c -i9 -s "1234567890"
sfp_i2c -i10 -s "password01"

Setting OMCI equipment ID (ME 257)

sfp_i2c -i6 -s "YOUR_EQUIPMENT_ID"

Setting OMCI Vendor ID (ME 256)

sfp_i2c -i7 -s "YOUR_VENDOR_ID"

Setting OMCI hardware version (ME 256)

sed 's/256 0 HWTC 0000000000000/256 0 HWTC YOUR_ONU_VERSION/' /rom/etc/mibs/data_1g_8q.ini > /etc/mibs/data_1g_8q.ini

Restoring the default ONU hardware version (ME 256)

cat /rom/etc/mibs/data_1g_8q.ini > /etc/mibs/data_1g_8q.ini

Setting OMCI software version (ME 7)

The image version normally can’t be changed because it is hard-coded into the /opt/lantiq/bin/omcid binary, so the binary has to be modified with the following hex patch which removes the hardcoded version.

< 000084c0: 9a43 931f f760 d840 9b64 f760 d864 1a00  .C...`.@.d.`.d..
< 000084d0: 1acf 6500 1a20 2268 940a 2205 b468 1a00  ..e.. "h.."..h..
---
> 000084c0: 9a43 931f f760 d840 9b64 f760 d864 6500  .C...`.@.d.`.de.
> 000084d0: 6500 6500 1a20 2268 940a 2205 b468 1a00  e.e.. "h.."..h..

This is the patch, encoded in base64

QlNESUZGNDA1AAAAAAAAAD4AAAAAAAAA2C8JAAAAAABCWmg5MUFZJlNZYqnvBwAACFBSQWAAAMAA
AAgAQCAAMQwIIwjImgDOdMvi7kinChIMVT3g4EJaaDkxQVkmU1lrJSbUAACFTAjAACAAAAiCAAAI
IABQYAFKQ01INxUgd6Soj2JURm8pUR8XckU4UJBrJSbUQlpoORdyRThQkAAAAAA=

Save it on your computer (not on the stick) as omcid_patch.base64, then run:

base64 -d omcid_patch.base64 > omcid.bspatch
bspatch <your_original_omcid> omcid omcid.bspatch

After patching the resulting patched omcid should have an md5 checksum of 525139425009c4138e92766645dad7d0. If that is also correct, continue by making a backup copy of your original omcid on the stick.

cd /opt/lantiq/bin
cp omcid omcid.original

Now, SCP has to be used to copy the modified omcid binary in /opt/lantiq/bin/omcid. Before restarting the stick and applying changes, make sure omcid has its execution bit set, then reboot the stick and change the image version with the following command:

chmod ugo+x /opt/lantiq/bin/omcid

Is also a good time to set the image0/image1_version: crashes have been reported if they are not set correctly before reboot.

fw_setenv image0_version YOUR_IMAGE0_VERSION
fw_setenv image1_version YOUR_IMAGE1_VERSION

Now the stick can be rebooted.

Advanced settings

Setting data_1g_8q_us1280_ds512.ini OMCI MIB file for 2500 Mbps profiles

The MIB file data_1g_8q_us1280_ds512.ini is very useful to avoid performance problems in situations where 2500 Mbps speed profiles are used. To enable it, run this command:

fw_setenv mib_file data_1g_8q_us1280_ds512.ini

Setting custom OMCI MIB file

Copy the MIB file to /etc/mibs, then run this command:

fw_setenv mib_file YOUR_MIB_FILENAME

Setting management MAC

uci set network.lct.macaddr=00:06:B5:07:D6:04
uci set network.host.macaddr=00:06:B5:07:D8:04
uci commit network.lct.macaddr=00:06:B5:07:D6:04
uci commit network.host.macaddr=00:06:B5:07:D8:04

Setting management IP

fw_setenv ipaddr 192.168.20.60
fw_setenv gatewayip 192.168.20.1

Rebooting the ONU

reboot

Disable RX_LOS status

Some switches/routers (e.g. Mikrotik) do not allow access to the magament interface without the fiber being connected because the SFP reports RX_LOS status It is possible to fix this by modifying the mod_optic.ko driver to spoof non RX_LOS status by setting PIN 8 (RX_LOS) to be always low.

This is the change to be made, in hex format:

< 00013740: 2404 0003 2405 0001 0c00 0000 ac43 0980  $...$........C..
---
> 00013740: 2404 0003 2405 0000 0c00 0000 ac43 0980  $...$........C..

This is the patch, encoded in base64:

QlNESUZGNDA2AAAAAAAAADYAAAAAAAAAXEEFAAAAAABCWmg5MUFZJlNZ5TTrjgAAB+ZARjAEACAA
AARAACAAMQZMQRppiFkgKGTeXi7kinChIcpp1xxCWmg5MUFZJlNZcaVLvQABOOCAwAAAAQAIAAig
ACClRgZoMhUf9JKbgIk3hdyRThQkHGlS70BCWmg5F3JFOFCQAAAAAA==

Save it on your computer (not on the stick) as mod_optic.base64, then run:

base64 -d mod_optic.base64 > mod_optic.bspatch
bspatch <your_original_mod_optic.ko> mod_optic.ko mod_optic.bspatch

After patching the resulting mod_optic.ko should have an md5 checksum of e14a5a70b023873853afe920870f076e. If that is also correct, continue by making a backup copy of your original mod_optic.ko on the stick.

cd /lib/modules/3.10.49/
cp mod_optic.ko mod_optic.ko.original

Now use SCP to copy the modified mod_optic.ko kernel module in /lib/modules/3.10.49/mod_optic.ko.

TX Fault / Serial

The stick will remain in a perpetual “TX Fault” state as the same SFP pin is used for both serial and TX Fault signaling. If this causes you issues (normally it shouldn’t), you can issue the commands below to disable it. Note that this will disable both the TX Fault signal and Serial on the stick after boot.

fw_setenv asc0 1
fw_setenv preboot "gpio set 3;gpio input 100;gpio input 105;gpio input 106;gpio input 107;gpio input 108"

In case you need to re-enable it, issue the following commands from the bootloader (FALCON)

FALCON => setenv asc0 0
FALCON => saveenv

SFP EEPROM settings

Reading all EEPROM

sfp_i2c -r

Getting Firmware version

strings /opt/lantiq/bin/omcid | grep ^software_Version | awk -F[=,] '{print $2}'

Getting Firmware build time

strings /opt/lantiq/bin/omcid | grep compiled

EEPROM (I2C slave simulated EEPROM)

The FS GPON-ONU-34-20BI stick does not have a physical EEPROM, the Falcon SOC emulates an EEPROM by exposing it on the I2C interface as required by the SFF-8472 specification.

On the I2C interface, two memories of 256 bytes each will be available at the addresses 1010000X (A0h) and 1010001X (A2h), however the actual available memory from the emulated EEPROM will be 640 bytes each, but only the first 256 bytes will be exposed in the I2C interface.

The FS stick stores the content of the emulated EEPROM in U-Boot env variables to restore it after a reboot:

• EEPROM0 (A0h) stored in U-Boot env variable sfp_a0_low_128
• EEPROM1 (A2h) stored in U-Boot env variable sfp_a2_info

EEPROM0 layout

EEPROM1 layout

Miscellaneous Links

• FS.com
• General setting of lantiq
• Usage GPON module SFP in Spain
• SourcePhotonics SPS-34-24T-HP-TDFO Datasheet

Table of contents

• FS.com Modded Firmware for Huawei MA5671A and FS.com GPON-ONU-34-20BI