stich86 commented 2 years ago

Hi @Anime4000

I saw you post on lowyat.net about TWCGPON657 that should support HSGMII on LAN side (2.5Gbit/a). Looks like that also HiSense LTE3415 reports this protocol on the data sheet. Chipset is still RTL9601C.

Do you have any info about that firmware? Here in Italy we are struggling with the various LantiQ sticks (at the moment the only one that support 2.5 also on line side) but for particulars FTTH provider we cannot achieve full speed compared to external ONT

Thanks in advance

stich86 commented 2 years ago

i think 2.5GbE is another issue.. At the moment to get that sync (in HiSGMII mode) you need particular hardware, like MacchiatoBIN, Unifi Switch or BCM Card with patched driver

let's try to see if V2801F can boot with DFP-34X-C2C kernel and V2801F rootfs, that should solve both problem :)

Anime4000 commented 2 years ago

i think 2.5GbE is another issue.. At the moment to get that sync (in HiSGMII mode) you need particular hardware, like MacchiatoBIN, Unifi Switch or BCM Card with patched driver

Yea, MacchiatoBIN too expansive, so I buy that TP-Link just for 99 USD

let's try to see if V2801F can boot with DFP-34X-C2C kernel and V2801F rootfs, that should solve both problem :)

this in my main priority!

Since we going to use original uImage, replace runlansds.sh with ODI, this way we can use 2.5GbE

UF-Instant V2801F modified

Screenshot from 2022-03-24 22-54-46

other files is same!

Anime4000 commented 2 years ago

I have modified firmware for TWCGPON657

Using original uImage (B15)
Using V2801F rootfs (V1.9.0-201104)
- Using modified Замена.rar
- Using original runlansds.sh

I also fix various stuff like, update webgui using latest HTML5 standard

XPON ONU SFP Stick — Mozilla Firefox 2

V2801F_firmware-for-TWCGPON657.zip

stich86 commented 2 years ago

where did you get the latest WebUI?

Anime4000 commented 2 years ago

where did you get the latest WebUI?

That I modified by self 😄

Here internal of TWCGPON657

winbond 25q128jvsq

I open it because...

I was trying to flash my modified rootfs, I forgot to set LAN_SDS_MODE 1 before flash
V2801F always force LAN_SDS_MODE 1, so new script runlansds.sh cause it

Internal of DFP-34X-C2C

cfeon qh64a-104hip

Either wait TP-Link TL-XDR5480 to fix or read-write NAND Flash via programmer? how to do that?

stich86 commented 2 years ago

My DFP-34X-C2C looks very similar to your TWCGP. I don't understand what you have done.

I've restore my V2810F desoldering NAND (using heat gun) and a CH341a programmer. Essentially I've done a dump and changed the "sw_commited" on uBoot to load the other image that doesn't use LAN_SDS_MODE.

DFP and TWCGP use SOIP8 format that should be more easy to read with a clip without soldering. Because you may be will read the flash soldered, it necessary to power SFP from outside source and avoid powering the NAND. This is beacause if you try to power NAND from CH341a, the current flow pass to the PCB and tries to bring up all the stick

Anime4000 commented 2 years ago

Oh, I understand

I have TWCGPON657 bin file, it should look similar?

anime4000@hitoha-vm:~/Desktop/xpon/B15 Image Dump$ binwalk vm.img 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
64            0x40            uImage header, header size: 64 bytes, header CRC: 0xB0850016, created: 2020-12-22 07:03:32, image size: 1198344 bytes, Data Address: 0x80000000, Entry Point: 0x80000000, data CRC: 0x6B27D9E8, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
128           0x80            LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 3924124 bytes
1198536       0x1249C8        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2232088 bytes, 899 inodes, blocksize: 131072 bytes, created: 2020-12-22 07:03:31

stich86 commented 2 years ago

this is a binwalk of NAND dump:


DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
104896        0x199C0         uImage header, header size: 64 bytes, header CRC: 0x4739E651, created: 2018-11-28 17:36:07, image size: 69741 bytes, Data Address: 0x81C00000, Entry Point: 0x81C00000, data CRC: 0xE36EFC01, OS: Firmware, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "U-Boot 2011.12.NA for rtl9601C"
104960        0x19A00         LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 181840 bytes
278528        0x44000         JFFS2 filesystem, big endian
438592        0x6B140         Zlib compressed data, compressed
439572        0x6B514         JFFS2 filesystem, big endian
499792        0x7A050         Zlib compressed data, compressed
500512        0x7A320         Zlib compressed data, compressed
501256        0x7A608         JFFS2 filesystem, big endian
502328        0x7AA38         Zlib compressed data, compressed
503464        0x7AEA8         Zlib compressed data, compressed
503808        0x7B000         JFFS2 filesystem, big endian
507984        0x7C050         Zlib compressed data, compressed
508336        0x7C1B0         Zlib compressed data, compressed
509472        0x7C620         Zlib compressed data, compressed
510224        0x7C910         JFFS2 filesystem, big endian
510352        0x7C990         Zlib compressed data, compressed
511304        0x7CD48         Zlib compressed data, compressed
512080        0x7D050         Zlib compressed data, compressed
512652        0x7D28C         JFFS2 filesystem, big endian
513240        0x7D4D8         Zlib compressed data, compressed
514320        0x7D910         Zlib compressed data, compressed
515140        0x7DC44         Zlib compressed data, compressed
516176        0x7E050         JFFS2 filesystem, big endian
516640        0x7E220         Zlib compressed data, compressed
517484        0x7E56C         JFFS2 filesystem, big endian
517604        0x7E5E4         Zlib compressed data, compressed
518684        0x7EA1C         Zlib compressed data, compressed
519896        0x7EED8         Zlib compressed data, compressed
520192        0x7F000         JFFS2 filesystem, big endian
524288        0x80000         uImage header, header size: 64 bytes, header CRC: 0xEE89A0DD, created: 2020-11-04 01:41:33, image size: 1199462 bytes, Data Address: 0x80000000, Entry Point: 0x80000000, data CRC: 0x4DEA4EF6, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
524352        0x80040         LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 3923728 bytes
1966080       0x1E0000        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 1880366 bytes, 623 inodes, blocksize: 131072 bytes, created: 2020-11-04 01:41:32
4456448       0x440000        uImage header, header size: 64 bytes, header CRC: 0xEE89A0DD, created: 2020-11-04 01:41:33, image size: 1199462 bytes, Data Address: 0x80000000, Entry Point: 0x80000000, data CRC: 0x4DEA4EF6, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
4456512       0x440040        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 3923728 bytes
5898240       0x5A0000        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 1876094 bytes, 623 inodes, blocksize: 131072 bytes, created: 2022-03-01 08:46:13

I can share my NAND dump (of V2801F) so you can try to bring your back. My dump is in PON_MODE 3, so the stick should no enter bootloop for VS_AUTHKEY

Here is the dump that you can write with CH341a programmer

fix_commit_1.zip

MD5 of extracted file is: 20876fe2af0242a1bbc7bed123d62a33

Anime4000 commented 2 years ago

Thanks! this help a lot!

I notice it has 3 uImage and 2 rootfs, based on k0, k1, r0, r1

Which Block/JFFS2 that store config file?

manias21 commented 2 years ago

this helps, bin https://mega.nz/file/jC4mlKDR#1PPGZsDjuuLIKgIlPCXo7NGu44aCj2RXXPkBJOr1v0Y

stich86 commented 2 years ago

this helps, bin https://mega.nz/file/jC4mlKDR#1PPGZsDjuuLIKgIlPCXo7NGu44aCj2RXXPkBJOr1v0Y

from which stick? It's a 16Mbyte dump, RTL9601C has only 8Mbyte of NAND O_o

manias21 commented 2 years ago

photo_2022-03-25_12-34-49 8mb and 16mb

manias21 commented 2 years ago

I have updated with the V2801F_firmware-for-TWCGPON657.zip, but I have lost access, I have tried 192.168.88.50, 192.168.1.1, 192.168.1.10 and I have no response. any option to help?

Anime4000 commented 2 years ago

this helps, bin https://mega.nz/file/jC4mlKDR#1PPGZsDjuuLIKgIlPCXo7NGu44aCj2RXXPkBJOr1v0Y

wow... Thanks! I extract last part rootfs and saw C00R657V00B16 This mean for TWCGPON657 right? have they fix 4-port Emulation in C00R657V00B16 like V2801F ?

this helps, bin https://mega.nz/file/jC4mlKDR#1PPGZsDjuuLIKgIlPCXo7NGu44aCj2RXXPkBJOr1v0Y

from which stick? It's a 16Mbyte dump, RTL9601C has only 8Mbyte of NAND O_o

I just notice TWCGPON657 use 128Mb Flash

I put the V2801F_firmware-for-TWCGPON657.zip, but I have lost access, I have tried 192.168.88.50, 192.168.1.1, 192.168.1.10 and I have no response. any ideas ?

Oh, this mean TWCGPON657 uImage (kernel, driver) and V2801F rootfs are not compatible... 😢 I just killed my TWCGPON657 stick...

manias21 commented 2 years ago

esto ayuda, bin https://mega.nz/file/jC4mlKDR#1PPGZsDjuuLIKgIlPCXo7NGu44aCj2RXXPkBJOr1v0Y

¡Wow gracias! Extraje la última parte rootfsy vi C00R657V00B16 Esto significa para TWCGPON657, ¿verdad? ¿ Han arreglado la emulación de 4 puertos en C00R657V00B16V2801F?

esto ayuda, bin https://mega.nz/file/jC4mlKDR#1PPGZsDjuuLIKgIlPCXo7NGu44aCj2RXXPkBJOr1v0Y

de que palo? Es un volcado de 16 Mbytes, RTL9601C tiene solo 8 Mbytes de NAND O_o

Acabo de notar que TWCGPON657 usa 128Mb Flash

Pongo el V2801F_firmware-for-TWCGPON657.zip, pero he perdido el acceso, he probado 192.168.88.50, 192.168.1.1, 192.168.1.10 y no tengo respuesta. algunas ideas ?

Oh, esto significa que TWCGPON657 uImage(núcleo, controlador) y V2801F rootfsno son compatibles...😢 Acabo de matar mi palo TWCGPON657...

I don't know if they have solved it. I'm still learning how to use this stick.

V2801F_firmware-for-TWCGPON657.zip......... I'll have to do the same thing as you, flash hardware again...

Anime4000 commented 2 years ago

@manias21

are you using CH341a Programmer on TWCGPON657? Just clip the chip or need take out chip off board?

manias21 commented 2 years ago

I prefer to extract it, it's only here 5 minutes in the whole process revelprog IS revelprog-photo_2022-03-25_13-03-07

stich86 commented 2 years ago

we need to understand if the two gold pads near RTL chip are the TTL UART, using NAND flash cannot be easy for troubleshooting...

Anime4000 commented 2 years ago

we need to understand if the two gold pads near RTL chip are the TTL UART, using NAND flash cannot be easy for troubleshooting...

you mean this?

stich86 commented 2 years ago

yep.. there is no datahseet of this damn RTL9601C :(

tdmadam commented 2 years ago

The golden pads in the above picture look more like EJTAG if they are positioned around pins 15-19.

The previous RTL9601B chip with 88 pins had UART RX on pin 30 and UART TX on pin 31. Try tracing with a multimeter to see if any test points or pads end up there.

RTL9601B

stich86 commented 2 years ago

The golden pads in the above picture look more like EJTAG if they are positioned around pins 15-19.

The previous RTL9601B chip with 88 pins had UART RX on pin 30 and UART TX on pin 31. Try tracing with a multimeter to see if any test points or pads end up there.

Nice picture. If the mapping is similar (RTL9601C has fewer pin, just 19), on the TWCGP looks like there are two traces that is going directly to the PIN on SFP connector.. may be these are RX/TX UART. I've to take apart my DFP (that's more similar to TWCGP, may be I've an old revision) and check these traces

tdmadam commented 2 years ago

Just out of curiosity, I checked the 1-port ONT I bought recently. Inside is RTL9601D, also 88 pins. On the PCB there is a place for UART connector. RX and TX traced back to pins 24 and 25.

stich86 commented 2 years ago

Just out of curiosity, I checked the 1-port ONT I bought recently. Inside is RTL9601D, also 88 pins. On the PCB there is a place for UART connector. RX and TX traced back to pins 24 and 25.

Can you share a photo of locations of Pins?

Thanks

tdmadam commented 2 years ago

RTL9601D

stich86 commented 2 years ago

looks like TWGCP and DFP use different packages. If you look at the picuture, TWCGP has 19 pins, while DFP has 22..

stich86 commented 2 years ago

this is an High-Res photo of my DFP

So starting from bottom, these two PINs are the UART? i've also two free pads..

Thx

tdmadam commented 2 years ago

Very likely, that would make sense. It looks like the pads are connected to pins 24 and 25. Need only RX and GND to quickly verify. I also got a V2801F clone. I will test it on Monday as my weekend is very busy.

Anime4000 commented 2 years ago

I buying CH341a & Hot Air Station What is the temperature to safely remove SOIC-8 chip in °C? so I didn't burn other thing...

Here comparison between VSOL V2801F, TWCGPON657, ODI DFP-34X-C2C (2022)

stich86 commented 2 years ago

I've removed the NAND at about 350C. Get also flux that will help on remove and resold ;)

stich86 commented 2 years ago

ok i've tested this morning on my DFP-32, the "square" pad is TX, the other is RX

Anime4000 commented 2 years ago

oh, RTL9601D...

GND and Power in which pin?

stich86 commented 2 years ago

oh, RTL9601D...

GND and Power in which pin?

I've powered it thru SFP slot with break board. PIN 15/16 for VCC 3.3 and and PIN 10 GND

Anime4000 commented 2 years ago

oh, alright, I try with my DFP stick,

can you try with DFP uImage & V2801F rootfs on this DFP?

stich86 commented 2 years ago

oh, alright, I try with my DFP stick,

can you try with DFP uImage & V2801F rootfs on this DFP?

I was able to reach O5 with my DFP, so I hope for tuesday to test it at 2.5GbE. In meantime i'll try to see if I can get TTL form V2801F, and i'll try your image on that stick, currently I don't want to screw up my DFP and I don't need any port emulation for my ISP :)

Anime4000 commented 2 years ago

oh, alright, I try with my DFP stick, can you try with DFP uImage & V2801F rootfs on this DFP?

I was able to reach O5 with my DFP, so I hope for tuesday to test it at 2.5GbE. In meantime i'll try to see if I can get TTL form V2801F, and i'll try your image on that stick, currently I don't want to screw up my DFP and I don't need any port emulation for my ISP :)

oh, that's sad for me... DFP only able to bridge VLAN 209 (Huawei ONU Management) but not other VLAN...

I not sure how to scan VLAN that seen by stick, I don't think double layer VLAN is exist.

I waiting CH341a to flash TWCGPON657 NAND, I saw you give me B16 version.

I just wanted V2801F Firmware on RTL960x family stick, it would fix most of people.

just now I tried UART on my ODI, I use RB3011 SFP cage for power, not working..... CP210x reading broken...

do I need connect all 4 UART pin to work?

stich86 commented 2 years ago

No, just TX/RX. If you are powering from SFP cage GND and VCC are not needed. On your version square pad should be connected to RX on CP2101 and circle to T Are you connecting in this way?

Anime4000 commented 2 years ago

Yes	DFP	CP2101
TX	RX
RX	TX

during RB3011 power on, putty spit out broken char and RB3011 stuck, the RB3011 LCD just white

stich86 commented 2 years ago

Yes

| DFP | CP2101 |

|--------|---------------|

| TX | RX |

| RX | TX |

during RB3011 power on, putty spit out broken char and RB3011 stuck, the RB3011 LCD just white

It's just a guess.. Can you try to power the stick with an SFP break board or Molex? May be when the stick is attached to an SFP port the TTL is disabled

tdmadam commented 2 years ago

I buying CH341a & Hot Air Station What is the temperature to safely remove SOIC-8 chip in °C? so I didn't burn other thing...

While shopping, don't forget to stock up on Kapton heat-resistant tape to protect nearby components and thin 36AWG 0.28 mm Teflon wire for flexible connection to tiny pins on the PCB.

tdmadam commented 2 years ago

ok i've tested this morning on my DFP-32, the "square" pad is TX, the other is RX

So DFP-32 has RTL9601D not RTL9601C?

To summarize: RTL9601B 88-pins RTL9601C 76-pins RTL9601D 88-pins

Anime4000 commented 2 years ago

I guess SFP attach to device making corrupted reading... I buy SFP breakout board

I buying CH341a & Hot Air Station What is the temperature to safely remove SOIC-8 chip in °C? so I didn't burn other thing...

While shopping, don't forget to stock up on Kapton heat-resistant tape to protect nearby components and thin 36AWG 0.28 mm Teflon wire for flexible connection to tiny pins on the PCB.

I have kapton tape, use to repair laptop motherboard 😅

ok i've tested this morning on my DFP-32, the "square" pad is TX, the other is RX

So DFP-32 has RTL9601D not RTL9601C?

To summarize:

RTL9601B 88-pins

RTL9601C 76-pins

RTL9601D 88-pins

so... firmware are not interchangeable?

I found cause V2801F restart when invalid VS_AUTH_KEY, this can be cracked right? put false in the if or delete reboot()

Screenshot from 2022-03-28 00-30-26 0

manias21 commented 2 years ago

photo_2022-03-27_18-37-27 I am going to test the tx and rx in this sfp... because there is corrupt motivation here.

tdmadam commented 2 years ago

so... firmware are not interchangeable?

I guess it depends on the firmware. If it's built as unified, it should recognize other boards. At this point I was more concerned about the placement of the UART pins

76-pins vs 88-pins

tdmadam commented 2 years ago

Chip model	Maximum LAN ports	LAN specifications	WIFI	voice	built in DDR
RTL9601B	1	1 port GPON/EPON adaptive	not support	not support	Yes
RTL9601D	1	1 port GPON/EPON adaptive (support routing)	not support	not support	Yes
RTL9602	4	4(1GE+3FE or 4FE)	not support	stand by	No
RTL9602C	2	1 port with WIFI and 2 ports (1GE+1FE) with WIFI	stand by	stand by	Yes
RTL9603	4	4 posts /w WIFI (1GE+3FE or 4FE)	stand by	stand by	No
RTL9603C	4	4 ports with WIFI (1GE+3FE or 4FE) built in DDR	stand by	stand by	Yes
RTL9606	4	4 (4GE)	not support	stand by	No
RTL9607	4	4 ports with WIFI (4GE)	Support 2/5GHz	stand by	No
RTL9607C	4	4 ports with WIFI (4GE)	Support 2/5GHz	stand by	Yes

Source: http://www.szdragon.com/html/FTTH/32.html

tdmadam commented 2 years ago

Nice :+1: Eventually we will need also a placeholder for RTL9601C and possibly another column for UART pin information.

stich86 commented 2 years ago

so... firmware are not interchangeable?

I guess it depends on the firmware. If it's built as unified, it should recognize other boards. At this point I was more concerned about the placement of the UART pins

76-pins vs 88-pins

yes, as i've said on my V2801F there is running DFP32 21-05-XX image. Laser is recognized, so the board is working as expected.

Now that we know of the 88-pins the UART localtion, is time to find the 76-pins. I can try to on my stick in the next few days

Anime4000 commented 2 years ago

so... firmware are not interchangeable?

I guess it depends on the firmware. If it's built as unified, it should recognize other boards. At this point I was more concerned about the placement of the UART pins 76-pins vs 88-pins

yes, as i've said on my V2801F there is running DFP32 21-05-XX image. Laser is recognized, so the board is working as expected.

Now that we know of the 88-pins the UART localtion, is time to find the 76-pins. I can try to on my stick in the next few days

I also tried flash ODI DFP firmware on my V2801F stick, it's get killed, stick feel cold 😢

Anime4000 commented 2 years ago

it's recommend to buy SPI NAND Flash? just in case I killed it...

should be same part number winbond 25q128jvsq or something in similar?

Anime4000 commented 2 years ago

I know why my V2801F stick dead, because of this default:

Anime4000 / RTL960x

HSGMII firmware #17

Here internal of TWCGPON657

Internal of DFP-34X-C2C