DLINK DPN-100 Ver:C1 use RTL9601C1

[tarou79]

A D-LINK DPN-100 also has an RTL9601C1, I put the pictures above and below the SFP module board for you.

I wanted to try to flash with firmware V2801F but squashfs-tools (extract / repack rootfs) and qemu-user-static (run MIPS VM) does not exist on the DLINK DPN-100 shell.

Is it possible to serial flash or the firmware is PCB dependent ?

For info the DLINK DPN-100 does not have webui, everything is in telnet ip 192.168.100.1

[Anime4000]

I afraid when you flash it, GPIO Laser not working:

V2801F Firmware to TWCGPON657 SFP = Works
TWCGPON657 Firmware to V2801F SFP = Not Working

I dont have vm.img file for V2801F firmware, But you can try, buy V2801F and dump the flash and flash back to your D-LINK DPN-100

Or, save money way...

Flash with TWCGPON657 B13 Firmware vm.img to give you WebGUI, then from there you can flash V2801F firmware and fix VS_AUTH_KEY after that.

Download TWCGPON657 Flash Image Binary

Don't forget to dump your D-LINK DPN-100 first just in-case

[tarou79]

Thank you for your comeback.
Indeed I had not thought about the laser calibration, I am going to dump the D-LINK DPN-100 and see what happens next.

The cat / proc / mtd indicates this type of partitioning

While digging through my SFP ONTs, I found one that might be able to accept your firmware as it has an interface that looks like the TWCGPON657 (closer to Hisense LTA3415-SCA + though).

Screen :

It also has "flash set" commands from telnet. The Realtek chipset is an RTL9601B however and the OMCI_FAKE_OK variable does not exist.

The cat / proc / mtd indicates this type of partitioning

Pictures :

My second SFP module seems to match the one you indicate on your github page given the partitioning in / proc / mtd.

The firmware present on my SFP is as follows:
My firmware version: V1_7_8_181123

Can you explain to me why you are downgrading the version, I couldn't find the information on your github page.
Will you downgrade to B13 with the firmware TWCGPON657 or I go directly with that of V2801F_V1.9.0-201104.tar?

[Anime4000]

TWCGPON657_B13

The reasons that you may need to downgrade firmware TWCGPON657_B13 because older firmware <= B13 can accept V2801F_V1.9.0-201104.tar firmware from WebGUI.

I have tried using B15 >=, can't accept any version of V2801F due to mismatch kernel mtd

I just had luck with B13

D-LINK DPN-100

About D-LINK DPN-100, the partition way different than standard RTL9601C1 SDK,

Yes, you need to dump and flash B13 binary file, test if D-Link stick can boot with TWCGPON657 firmware

You may try first, see Laser got working, and have RX reading.

Then use WebGUI to flash V2801F_V1.9.0-201104.tar

RTL9601B

Maybe same as RTL9601C1, since it's under RTL960x SoC Family,

I think, since both are MIPS CPU, it can boot, but Laser driver are not?

I not sure about this

[tarou79]

Ok everything is clear to me regarding the DPN-100. Whenever I have time I try this.

The other SFP GPON module with the RTL9601B (ref: afm0002tim) did not refuse the firmware update V2801F_V1.9.0-201104.tar from WebGUI, but once finished it did not restart, I think is brick now.

I still have access to U-Boot from UART

From U-Boot I was able to change the environment variables to start again on the stock image:

env set sw_active 0
env set sw_commit 0
env save

I was able to regain access on my SFP ONT and I have flash with firmware B13_20200507.tar which also fails. I observed the error from the UART and it is a kernet panic while loading. It only remains for me to find other potentially compatible firmware

It was interesting to take this test on SFP because it's costs only 10/15 € on Ebay. Too bad it doesn't work ;)

[Anime4000]

I see, it seem have different MIPS arch and driver between RTL9601B and RTL9601C1 SoC.

B13_20200507.tar is not binary file like *.bin; *.img

You cannot simply flash *.tar into NAND memory,

*.tar firmware use on WebGUI *.img image file for full NAND flash

What we know now, RTL9601C1 firmware are not interchangeable between RTL9601B

[tarou79]

Yes, well summarized.

Screen of a kernel panic with firmware V2801F_V1.9.0-191015.tar updated from the WebGUI.

And restore process :

In any case, thank you for your answers and your very inspiring Github work :)

I would have to find an LTE3415 (Hisense) firmware now.

[frezbo]

I have flashed the V2801F on an Ubiquiti Ufiber instant module. Same RTL9601C1 chip. You'd need to run flash_eraseall /dev/mtd3 or whatever the partition that contains the config as shown in cat /proc/mtd. If this is not done, the laser info is reported incorrect. The /var/config partition needs to be unmounted first. There might be some processes accessing the filesystem, kill them and unmount, then erase that partition and reboot. Laser info is then reported properly

[obenturk]

Hi,

I have UF Instant and I am trying to do the same.

How do you know that laser info is reported incorrectly?

You can also find ufinstant files under my github. https://github.com/obenturk/ufinstant

[frezbo]

@obenturk inside diag pon get transceiver <setting> seems to report everything. But I can't get to any state other than O1 with the V2801F firmware. The stock firmware goes upto O3 (it would not get to O5 since the ubiquiti omci_app seems to have the mac id hardcoded or something) As you said the laser info could be bogus. Let's keep updating this issue with future findings and see if we can get the UFiber module working.

[obenturk]

@frezbo yes I also tried TWCGPON657 and V2801F with deleting /dev/mtd3 but no success. O1 only. and original firmware is going up to O5 but due to negotiation problem dropping to O1 again.

I will re install original firmware to check if lazer will work again or not.

May be lazer settings was deleted hope not.

Additionally I could not receive current firmware from Ubiquiti even I ask it from their support.

[frezbo]

@obenturk interesting. I don't think ubiquiti would provide the firmware. I switch back to stock by setting sw_commit and sw_active to 0. The V2801F is always flashed to the 1 partition.

new update: at times the laser info is reported correctly in the UI, and after some reboots it starts reporting garbage data. Not sure why.

How did you get to O5 in stock? I meant setting the correct mac id/serial number?

[obenturk]

TWCGPON657 Firmware

`RTK.0> pon get transceiver bias-current - bias-current part-number - part-number rx-power - rx-power temperature - temperature tx-power - tx-power vendor-name - vendor-name voltage - voltage

RTK.0> pon get transceiver temperature Error (0x10): The chip is not found RTK.0> pon get transceiver part-number Error (0x10): The chip is not found RTK.0> pon get transceiver voltage Error (0x10): The chip is not found RTK.0> pon get transceiver rx-power Error (0x10): The chip is not found `

[obenturk]

@frezbo I have Ericsson T63G device and I think it uses different omci protocol due to that reason It can connect O5 but does not allow internet to pass.

I re upload original unifi firmware https://github.com/obenturk/ufinstant/blob/main/flash/ufinstant/bin/firmware.tar but this time I can not telnet with ubnt:ubnt or admin:stdONU101 or admin:system

I check the original flash all command output and realized following ;

<Value Name="SUSER_NAME" Value="ubnt"/> <Value Name="SUSER_PASSWORD" Value="$1$TW$XXieY8EAV1LpRn5izFeLo."/>

Any help to login appreciated.

[frezbo]

@obenturk I did the same thing and got logged out. Anytime before switching firmware /dev/mtd3 needs to be erased. The only way to get back is solder wires to the board (The serial ports are exposed and have pads). And when booting you can get into u-boot prompt. There we can set it to boot the existing custom firmware, boot into it and erase mtd3 and go back to stock. I'll be little busy over the weekend, but let me know if you need any help. I'll try to help. This is a brief summary. If you need more details I can help after this weekend.

[obenturk]

@frezbo Thanks for the info. I was just thinking to do this. Is there any pinout of uart pins to sfp pin side? I would like to have always connected uart pins but if the stick in sfp socket I am not able to route wirings.

[frezbo]

@obenturk The UART pins are not exposed on the SFP pin side unfortunately. Ypu'd have to di-assemble and solder wires

[obenturk]

@frezbo I returned back to original firmware you can clear config area from uboot with command sf erase ${fl_cfgfs} +${fl_cfgfs_sz}

transceiver values are ok now

RTK.0> pon get transceiver bias-current Bias Current: 10.936000 mA RTK.0> pon get transceiver part-number Part Number: RTL8290 RTK.0> pon get transceiver rx-power Rx Power: -24.559320 dBm RTK.0> pon get transceiver temperature Temperature: 85.000000 C RTK.0> pon get transceiver tx-power Tx Power: -inf dBm RTK.0> pon get transceiver vendor-name Vendor Name: REALTEK RTK.0> pon get transceiver voltage Voltage: 3.019400 V

additionally I can ask for state and onuid and they are ok !!!!! but due to different mac and serial# onuid is 65 instead of 5.

omcicli get onuid ONU ID: 65 omcicli get state ONU state: 5

for correct transceiver configuration I figureout following.

there is europa.data at hw section and configures rtl8290

RTL8290 driver version [0.2.21]

Parameter: I2C_PORT=1 INTR_PIN=0 TXDIS_PIN=13 TXPWR_PIN=15 PON_MODE=1

Open file: europa.data. Loaded data from europa.data Init Europa module. config TX_DIS pin... Config GPIO 13 to OUTPUT mode, value = 0 config TxPwr pin... Config GPIO 15 to OUTPUT mode, value = 0 Init I2C port ... rtl8290_i2c_init enable = 1 width=0 clock = 1008 disable DW ... [ init ddmi A0&A2, A4 ] Update DDMI A0...., flash_update = 1, addr = 0xc00d24a8 addr = 0 02 04 0B FF FF FF FF FF FF FF FF 03 0C 00 14 C8 addr = 16 00 00 00 00 52 45 41 4C 54 45 4B 20 20 20 20 20 addr = 32 20 20 20 20 00 00 00 00 52 54 4C 38 32 39 30 20 addr = 48 20 20 20 20 20 20 20 20 30 30 30 31 05 1E 00 FF addr = 64 00 06 00 00 76 65 6E 64 6F 72 70 61 72 74 6E 75 addr = 80 6D 62 65 72 32 30 31 34 30 31 32 33 68 80 02 FF addr = 96 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF addr = 112 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Update DDMI A2...., flash_update = 1, addr = 0xc00d25a8 addr = 0 7F FF FF FF 7F FF FF FF 8E 94 6D 60 8C A0 75 30 addr = 16 75 30 05 DC 61 A8 07 D0 00 00 0F 8D 00 0A 0C 5A addr = 32 00 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 addr = 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3F 80 addr = 64 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 addr = 80 00 00 01 00 00 00 00 00 00 FF FF FF FF FF FF FF addr = 96 FF FF FF FF 00 00 00 00 FF 00 FF 00 00 00 FF 00 addr = 112 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Update A4...., flash_update = 1, length =0x7d, addr = 0xc00d26a9 addr = 0 72 89 E1 E2 8E 32 9B 90 00 49 9F FF 23 04 78 7F addr = 16 FF 00 02 05 00 00 01 F6 CE 90 C0 00 00 38 24 40 addr = 32 40 00 01 13 BC 1E 33 10 FB 18 E4 80 E0 01 B0 44 addr = 48 40 AC 03 00 F4 00 20 40 00 7C 20 40 FC 30 10 00 addr = 64 00 00 00 00 FF FC 12 0A 8B 04 01 33 74 A5 A0 E0 addr = 80 00 00 00 00 81 30 00 15 00 FF 1F 01 00 FF 00 32 addr = 96 FF 01 FF FF 05 00 60 80 00 08 10 A0 EC B0 BF FE addr = 112 00 00 00 00 FF 00 10 00 00 00 FF A0 C0 Update P0 = 0x6e, P1 = 0xb5, Pavg = 0xa8., flash_update = 1, addr = 0xc00d29ea Read RSSI_V0 from flash... SDADC RSSI V0 = 1652670... <6>br0: port 1(eth0) entering forwarding state [ APC Enable flow ] Enable LDX prior OffK... OffK: 2 7 0 5 -12 MPD0[0] = 0x7fb72c MPD0[1] = 0x7fc40c MPD0[2] = 0x7fb8ec MPD0[3] = 0x7fb978 MPD0[4] = 0x7fb8fc MPD0[5] = 0x7fb454 MPD0[6] = 0x7fb160 MPD0[7] = 0x7fb0fc MPD0[8] = 0x7fbf78 MPD0[9] = 0x7fb75c MPD0 = 0x7fb869 [ Tx Enable flow ] [ Rx Enable flow ] [ Update APD ] [ Enable TX SD ] [xml_INFO]: Update cs configuration success. init user parameters ... [ Enable RX_SD ] [ Enable up ] Init Europa Finish. DDMI Polling Task Add Success. OffKd Task Add Success. LoopMon Task Add Success. europa_intrInit

#rcS file

mount -t jffs2 -o ro /dev/mtdblock8 /var/hw if [[ -f /var/hw/europa.data ]]; then if ! cmp /var/config/europa.data /var/hw/europa.data -s; then echo "Copy /var/hw/europa.data /var/config/europa.data" cp -f /var/hw/europa.data /var/config/europa.data fi elif [[ ! -f /var/config/europa.data ]]; then echo "Warning: File /var/hw/europa.data nor /var/config/europa.data doesn't exist!!!. Generating." /bin/europacli open default fi

[frezbo]

@obenturk glad you were able to revert to stock. So if I understand right, if I modify the the V2801F to mount mtd8 and update the rcS script, the laser will work?

[obenturk]

@frezbo I don't think it will work. Because V2801F does not have /bin/europacli and RTL8290 driver version [0.2.21] with Parameter: I2C_PORT=1 INTR_PIN=0 TXDIS_PIN=13 TXPWR_PIN=15 PON_MODE=1

I am not sure will it work or not that if we extract ufinstant firmware and add following to V2801F firmware

• /lib/modules/europa_drv.ko
• /bin/europacli

• rc32

• insmod /lib/modules/europa_drv.ko PON_MODE=1 I2C_PORT=1 INTR_PIN=0 TXDIS_PIN=13 TXPWR_PIN=15

This section is configuring lazer I believe

Update DDMI A0...., flash_update = 1, addr = 0xc00d24a8 addr = 0 02 04 0B FF FF FF FF FF FF FF FF 03 0C 00 14 C8 addr = 16 00 00 00 00 52 45 41 4C 54 45 4B 20 20 20 20 20 addr = 32 20 20 20 20 00 00 00 00 52 54 4C 38 32 39 30 20 addr = 48 20 20 20 20 20 20 20 20 30 30 30 31 05 1E 00 FF addr = 64 00 06 00 00 76 65 6E 64 6F 72 70 61 72 74 6E 75 addr = 80 6D 62 65 72 32 30 31 34 30 31 32 33 68 80 02 FF addr = 96 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF addr = 112 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF Update DDMI A2...., flash_update = 1, addr = 0xc00d25a8 addr = 0 7F FF FF FF 7F FF FF FF 8E 94 6D 60 8C A0 75 30 addr = 16 75 30 05 DC 61 A8 07 D0 00 00 0F 8D 00 0A 0C 5A addr = 32 00 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 addr = 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3F 80 addr = 64 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 addr = 80 00 00 01 00 00 00 00 00 00 FF FF FF FF FF FF FF addr = 96 FF FF FF FF 00 00 00 00 FF 00 FF 00 00 00 FF 00 addr = 112 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Update A4...., flash_update = 1, length =0x7d, addr = 0xc00d26a9 addr = 0 72 89 E1 E2 8E 32 9B 90 00 49 9F FF 23 04 78 7F addr = 16 FF 00 02 05 00 00 01 F6 CE 90 C0 00 00 38 24 40 addr = 32 40 00 01 13 BC 1E 33 10 FB 18 E4 80 E0 01 B0 44 addr = 48 40 AC 03 00 F4 00 20 40 00 7C 20 40 FC 30 10 00 addr = 64 00 00 00 00 FF FC 12 0A 8B 04 01 33 74 A5 A0 E0 addr = 80 00 00 00 00 81 30 00 15 00 FF 1F 01 00 FF 00 32 addr = 96 FF 01 FF FF 05 00 60 80 00 08 10 A0 EC B0 BF FE addr = 112 00 00 00 00 FF 00 10 00 00 00 FF A0 C0 Update P0 = 0x6e, P1 = 0xb5, Pavg = 0xa8., flash_update = 1, addr = 0xc00d29ea Read RSSI_V0 from flash... SDADC RSSI V0 = 1652670...

[frezbo]

yeh, I was thinking of adding the europa stuff to the V2801F firmrware, but I wonder if it's worth the additional time and testing. I wished the Ubiquiti ones had an option to change the serial number easily. Maybe copy over the omci_app might work

[obenturk]

I am not an expert for linux programs and kernel. Can we just drag and drop omci_app or europacli maybe busybox for vi implementation to their folders and will they work?

on the other hand how can we start from the scratch by obtaining Toolkit:rsdk-1.5.6-5281-EB-2.6.30-0.9.30.3-131105 ? I searched but I could not find realtek toolkit.

@Anime4000 Could you also comment?

[obenturk]

@frezbo

I did followings

###added files

/bin/europacli

sudo chown 1013 europacli sudo chmod 775 europacli

/lib/modules/europa_drv.ko

sudo chown 1013 europa_drv.ko sudo chmod 664 europa_drv.ko

/etc/scripts/mnt_hwfs.sh
/etc/scripts/insert_europa.sh

sudo chown 1013 mnt_hwfs.sh sudo chmod 775 mnt_hwfs.sh

sudo chown 1013 insert_europa.sh sudo chmod 775 insert_europa.sh

###changed files

####rc2

mkdir /var/hw
/etc/scripts/mnt_hwfs.sh "-t jffs2 -o ro" "hw" "/var/hw"

####rc32

insmod /lib/modules/europa_drv.ko PON_MODE=1 I2C_PORT=1 INTR_PIN=0 TXDIS_PIN=13 TXPWR_PIN=15

[frezbo]

@obenturk did replacing the files, fixed the laser issue?

[obenturk]

No I am receiving following error.

----- do_rc [/etc/init.d/rc32] ----- SFP APP europa_drv: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint europa_drv: Unknown symbol rtk_lddMapper_attach europa_drv: Unknown symbol rtk_lddMapper_deattach insmod: cannot insert '/lib/modules/europa_drv.ko': unknown symbol in module

:(

[frezbo]

@obenturk it seems the Ufiber kernel is locked down and they might have done some proprietary stuff. Regarding the Realtek toolkit you might need to be a customer to obtain that or even worse sign an NDA. That's how usually these things are. Maybe it's worth a try to reach out to realtek via email.

[obenturk]

@frezbo I tried original uImage + V2801F rootfs and omci start to work with new mac, serial + other things but there was an error like WAN not configured I did not try to configure WAN stuff. You can give a try for that.

I forgot to say you need to add missing europa, mnt_hwfs and rcS from original rootfs

If you want to look at you can try following. I am always uploading the files via u-boot with xmodem

Erase cfgs (like erasing config partition) sf erase ${fl_cfgfs} +${fl_cfgfs_sz}

Erase commands sf erase ${fl_kernel1} +${fl_kernel1_sz} sf erase ${fl_kernel2} +${fl_kernel2_sz} sf erase ${fl_rootfs1} +${fl_rootfs1_sz} sf erase ${fl_rootfs2} +${fl_rootfs2_sz}

Xmodem transfer commands xf ${fl_kernel1} xf ${fl_kernel2} xf ${fl_rootfs1} xf ${fl_rootfs2}

press CTRL+Y after upload and dont forget to boot u-boot after each upload because it is making reboot.

rootfs.zip

[frezbo]

@obenturk that's great news, I'll try to test these out over the weekend or the course of next week. Just wanted to thank you for all the time spared and tinkering you'd been able to do :muscle: :heart:

[obenturk]

@frezbo

Thanks for the good words but I did not mean that it is fully functional. What I know is, I can connect the OLT side with ONT parameters buuuuuut!! ISP kicked me out. I did not face with this kind of result previously because SFP stick was identified by OLT as different ONU ID due to different SN and MAC.

After I upload ufinstant with original kernel + V2801F rootfs with modded files I believe I triggered an alarm from OLT side and it blocked ISP ONT as well.

ISP gave me different ONT which is Sercomm FG1000E very very small footprint. Now I am afraid I will not connect ufinstant anymore may be for sometime :)

Further Question is how can I unpack uImage to a folder and look at in? File system is JFFS2 and I read some but I could not succeed yet.

[frezbo]

@obenturk with the original uImage and the modded rootfs fromV2801F. I am able to get upto O3 state. The orginal firmware also foes upto O3 state. Even after setting the right auth parameters, serial number, model number and mac id, I'm still stuck at O3. Meanwhile I have ordered a CPGOS03-0490 from Carlitoxxx Pro. I'll wait until it arrives and test again.

[obenturk]

Then I think you need LOID and password