You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Adds extensive reverse-engineering findings for the Free/Iliad F-MDCONU3A
(BCM55030 10G-EPON ONU) from static analysis of the v3.2.9 firmware binary:
- CLI permission system: pl built-in command bypasses all permission checks,
pl omega gives full manufacturing access (level 2) from default UART shell
- Complete CLI command tree at all 3 permission levels
(level 0: ~60 cmds, level 1: +20, level 2: +25)
- Firmware flash protocol (load/rx): raw binary transfer over UART at
57600 baud, TKF container format with trailing CRC32
- Hardware architecture details: Harvard ARC (ICCM/DCCM), firmware structure,
FDS personality records
- Expanded flash memory map with all 5 regions including FDS/Config
- Filled in missing hardware specs (bootloader, system, load addr, RAM, chipset rev)
All findings from Ghidra static analysis (2697 functions named).
No proprietary documentation was used.
The BCM55030's UNI (User Network Interface) side should be capable of 4xSGMII (1 GbE) or 1xXAUI (10 GbE) or 1xXFI (10 GbE SFP) or 1xRGMII, but only one SGMII lane is actually routed.
37
-
UNI link won't go up when connected to a media converter or directly to a NIC.
35
+
The BCM55030 is a 10G-EPON DPoE (DOCSIS Provisioning over EPON) ONU/ONT used by Free/Iliad (France) on their FTTH network. The PON side operates in asymmetric 10G/1G mode: downstream at 1577 nm / 10.3125 Gb/s, upstream at 1310 nm / 1.25 Gb/s burst (IEEE 802.3av).
36
+
37
+
The BCM55030's UNI (User Network Interface) side should be capable of 4xSGMII (1 GbE) or 1xXAUI (10 GbE) or 1xXFI (10 GbE SFP) or 1xRGMII, but only one SGMII lane is actually routed (1000BASE-X via soldered SFP+ male connector).
38
+
39
+
UNI link won't go up when connected to a media converter or directly to a NIC. The firmware waits for a valid 1000BASE-X partner before activating the PON side (circular dependency).
40
+
41
+
The CPU uses a Harvard architecture: ICCM (Instruction Closely-Coupled Memory) for code execution and DCCM/SRAM for data. Code in ICCM is not readable via the data bus — the `mem/rf` command can only read data memory, not firmware code.
38
42
39
43
## Serial
40
44
41
45
The serial port is easily accessible at TP5 and TP6. A prompt is available without authentication, it is structured as a tree of directories. To navigate type the subdirectory name. To go back type `/` and hit enter. To list available commands type `help`.
42
46
43
-
Available commands:
47
+
### CLI Permission Levels
48
+
49
+
The CLI has a 3-level permission system. By default, UART connects at level 0 (restricted). The **`pl`** (Print Level) built-in command switches between levels without any authentication:
|**`pl omega`**|**2**|**Full manufacturing access — unlocks ALL commands**|
56
+
57
+
The `pl` command is a framework built-in keyword (like `help` and `..`) that is processed *before* the permission-checked command tree walk. It never passes through the permission gate, so it works from any level — including the default level 0.
58
+
59
+
The permission byte is stored at a single RAM address and persists for the duration of the session. It resets to 0 on reboot. To persist a higher level across reboots, use `fds/write` (available at level 1+) to write to FDS group 4, record 7.
60
+
61
+
### Available commands
62
+
63
+
Level 0 (default — 22 root entries, ~60 total commands):
44
64
45
65
```
46
66
- mac/
47
-
- epon
48
-
- user
67
+
- epon
68
+
- user
49
69
- alm/
50
-
- info
51
-
- gpio
70
+
- info
71
+
- gpio
52
72
- debug/
53
-
- mcast
54
-
- mpcp
55
-
- nco
56
-
- rstp
57
-
- sysd
73
+
- mcast
74
+
- mpcp
75
+
- nco
76
+
- rstp
77
+
- sysd
58
78
- epon/
59
-
- eponmac
60
-
- usermac
61
-
- dom
62
-
- ponspeed
79
+
- eponmac
80
+
- usermac
81
+
- dom
82
+
- ponspeed
63
83
- fds/
64
-
- erase
84
+
- erase
65
85
- load/
66
-
- info
67
-
- commit
68
-
- setRecoveryPoint
69
-
- runRecoveryPoint
70
-
- rx
86
+
- info
87
+
- commit
88
+
- setRecoveryPoint
89
+
- runRecoveryPoint
90
+
- rx
71
91
- mcast/
72
-
- domains
73
-
- groups
74
-
- sources
75
-
- reporters
76
-
- igmpinfo
77
-
- igmpsources
92
+
- domains
93
+
- groups
94
+
- sources
95
+
- reporters
96
+
- igmpinfo
97
+
- igmpsources
78
98
- mem/
79
-
- rf
99
+
- rf
80
100
- mpcp/
81
-
- info
82
-
- failsafe
83
-
- oltmac
101
+
- info
102
+
- failsafe
103
+
- oltmac
84
104
- pers/
85
-
- read
105
+
- read
86
106
- serdes/
87
-
- sdextlptest
107
+
- sdextlptest
88
108
- stats/
89
-
- clear
90
-
- gather
91
-
- epon
92
-
- fifo
93
-
- lif
94
-
- uni
95
-
- xif
96
-
- statsmode
109
+
- clear
110
+
- gather
111
+
- epon
112
+
- fifo
113
+
- lif
114
+
- uni
115
+
- xif
116
+
- statsmode
97
117
- log/
98
-
- show
99
-
- level
118
+
- show
119
+
- level
100
120
- sysd/
101
-
- frmdmp
121
+
- frmdmp
102
122
- clionly
103
123
- clr
104
124
- ints
@@ -109,6 +129,89 @@ Available commands:
109
129
- sftver
110
130
```
111
131
132
+
Level 1 (`pl alpha` — adds these commands):
133
+
134
+
```
135
+
- access/
136
+
- read (hardware peripheral bus read — I2C/SPI)
137
+
- write (hardware peripheral bus write)
138
+
- mdio/
139
+
- read
140
+
- readlst
141
+
- write
142
+
- lue/
143
+
- lin/
144
+
- inst
145
+
- bin/
146
+
- inst
147
+
- cust/
148
+
- e (examine custom data)
149
+
- r (read custom data)
150
+
- w (write custom data)
151
+
- fds/
152
+
- write (write FDS record)
153
+
- mem/
154
+
- wm (write memory)
155
+
- wf (write flash)
156
+
- ef (erase flash)
157
+
```
158
+
159
+
Level 2 (`pl omega` — adds these commands):
160
+
161
+
```
162
+
- efuse (read eFuse OTP memory)
163
+
- efusebits (read eFuse bit-level detail)
164
+
- learn/
165
+
- inst
166
+
- tbl
167
+
- age
168
+
- limit
169
+
- gmc/
170
+
- le
171
+
- ld
172
+
- serdes/
173
+
- dump
174
+
- debug/
175
+
- fc
176
+
- epon
177
+
- learn
178
+
- eap
179
+
- fifo/
180
+
- queue
181
+
- eae/
182
+
- eap
183
+
- mka
184
+
- mtime
185
+
- klen
186
+
- xau/
187
+
- xcap
188
+
- fec/
189
+
- auto
190
+
- reglist
191
+
- regbits
192
+
```
193
+
194
+
### Useful commands
195
+
196
+
| Command | Description |
197
+
| ------- | ----------- |
198
+
|`sftver`| Print firmware version and chip ID |
199
+
|`load/info`| Show all firmware slots with versions and CRCs |
200
+
|`epon/eponmac`| Show EPON MAC address |
201
+
|`epon/ponspeed`| Show current PON link speed |
202
+
|`mpcp/info`| Show MPCP registration state |
203
+
|`mpcp/oltmac`| Show OLT MAC address |
204
+
|`pers/read`| Dump personality data (raw hex) |
205
+
|`mem/rf <addr> <len>`| Read `len` bytes of data memory starting at `addr`|
206
+
|`stats/epon`| Show EPON statistics counters |
207
+
|`reg <index>`| Read a software register by index |
208
+
|`set <index> <value>`| Write a software register |
209
+
|`pl omega`| Unlock full manufacturing access |
210
+
|`mem/wm <addr> <value>`| Write to memory (level 1+) |
211
+
|`efuse`| Dump eFuse OTP contents (level 2) |
212
+
|`load/rx`| Receive firmware image over UART |
213
+
|`load/commit`| Commit received firmware to active slot |
214
+
112
215
`load/info` output:
113
216
```
114
217
TK2000 APP 3.27 May 13 2016 02:48:05 Chip: 4701 B2110816
`mem/rf [start address] [lenght]` reads bytes from the flash memory, wraps every 512 kB.
264
+
`mem/rf [start address] [length]` reads bytes from data memory (DCCM/SRAM). Due to the Harvard architecture, this command cannot read firmware code (which resides in ICCM). The address space wraps every 512 kB.
265
+
266
+
## Firmware Flash Protocol
267
+
268
+
The `load/rx` command accepts a firmware image over UART using a raw binary transfer (no XMODEM, no handshake):
269
+
270
+
1. Wait for the `2000/>` prompt
271
+
2. Send `load/rx\r`
272
+
3. ONU responds: `Begin binary transfer...`
273
+
4. Send the TKF image as raw binary at 57600 baud (~55 seconds for 319 KB)
274
+
5. ONU responds: `Transfer complete: N bytes received`
275
+
6. Send `load/commit\r` to activate the new slot
276
+
7. Send `reset\r` to reboot
277
+
278
+
The firmware image must be wrapped in a TKF (Teknovus) container:
279
+
280
+
```
281
+
[header 39 bytes] [payload N bytes] [CRC32 4 bytes]
282
+
```
283
+
284
+
The trailing CRC32 covers the entire header+payload (standard IEEE 802.3 CRC). The ONU writes to App 0 and App 1 slots in rotation.
162
285
163
286
## List of partitions
164
287
165
-
The flash memory is not actually partitioned, upon reset the CPU loads from address 0 (reset vector) and jumps to another address ([page 74](http://me.bios.io/images/d/dd/ARCompactISA_ProgrammersReference.pdf#%5B%7B%22num%22%3A177%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%22XYZ%22%7D%2C72%2C157%2C0%5D)). Each section ends with its CRC.
288
+
The flash memory (W25Q32J, 4 MB SPI) has 5 regions. Each application section starts with a 39-byte TKF header and ends with its CRC.
App 1 and App 2 sections are located at a distance of 512 kB (0x80000) from each other. This probably means that the CPU is capable of addressing only 512 kB of flash. It can be verified also by running the `mem/rf` command, which wraps every 512 kB.
177
299
178
-
# Userful files and binaries
300
+
App slots are located at 512 KB (0x80000) intervals. The CPU can address only 512 KB of flash at a time (verified by `mem/rf` wrapping behavior). The FDS (Flash Data Storage) region between the bootloader and App 1 contains personality records, MAC addresses, SerDes configuration, and CLI config data (34 known FDS record types).
0 commit comments