* SFP/MDIO/I2C: help requested unlocking a SFP+ MCU to expose PHY
@ 2026-06-05 8:09 Janpieter Sollie
2026-06-05 16:51 ` Andrew Lunn
0 siblings, 1 reply; 7+ messages in thread
From: Janpieter Sollie @ 2026-06-05 8:09 UTC (permalink / raw)
To: netdev
Hi,
This message is a follow-up on a previous request,
I reverse-engineered a lot of stuff,
and the question has become fundamentally different.
I am trying to access the bcm84891 phy on a 10Gtek ASF-10G-T80 sfp+ transceiver.
According to 10Gtek, these modules contain a bcm84891 phy.
The MDIO commands seem te be sent to a MCU, not the phy itself.
Does anybody know how to make a MCU transparent?
Did he / she found a hack by writing a i2c register or something alike?
I have a rollball password, but initializing MDIO with rollball does not work.
with MDIO_I2C_NONE, the link comes up (and is stable), so the firmware / MCU does a lot on its own.
with MDIO_I2C_C45 (the only method bcm84891 supports) says "no phy detected"
with C22, it shows a buggy ID which isn't even close to the 84891 IDs in the 7.1 patch.
All methods (C22/C45/Rollball (with/without password) can be used to read registers with i2csfp,
but none are actually consistent (and rollball returning 0xffff at best).
Also, writing to those registers, and reading them again, shows no changed value.
Did anybody ever try + succeed making a MCU transparent?
Could he / she teach me how it was done?
Thanks,
Janpieter Sollie
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: SFP/MDIO/I2C: help requested unlocking a SFP+ MCU to expose PHY
2026-06-05 8:09 SFP/MDIO/I2C: help requested unlocking a SFP+ MCU to expose PHY Janpieter Sollie
@ 2026-06-05 16:51 ` Andrew Lunn
2026-06-05 18:16 ` Nicolai Buchwitz
2026-06-09 8:32 ` Nicolai Buchwitz
0 siblings, 2 replies; 7+ messages in thread
From: Andrew Lunn @ 2026-06-05 16:51 UTC (permalink / raw)
To: Janpieter Sollie; +Cc: netdev
On Fri, Jun 05, 2026 at 10:09:46AM +0200, Janpieter Sollie wrote:
> Hi,
>
> This message is a follow-up on a previous request,
> I reverse-engineered a lot of stuff,
> and the question has become fundamentally different.
>
> I am trying to access the bcm84891 phy on a 10Gtek ASF-10G-T80 sfp+ transceiver.
> According to 10Gtek, these modules contain a bcm84891 phy.
> The MDIO commands seem te be sent to a MCU, not the phy itself.
Do you know what MCU is in the SFP? Is there a data sheet for it? Can
you read out the EEPROM holding its code over the I2C bus? You can
then disassemble/decompile the code and see what it is actually doing.
Andrew
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: SFP/MDIO/I2C: help requested unlocking a SFP+ MCU to expose PHY
2026-06-05 16:51 ` Andrew Lunn
@ 2026-06-05 18:16 ` Nicolai Buchwitz
2026-06-05 21:34 ` Andrew Lunn
2026-06-09 8:32 ` Nicolai Buchwitz
1 sibling, 1 reply; 7+ messages in thread
From: Nicolai Buchwitz @ 2026-06-05 18:16 UTC (permalink / raw)
To: Andrew Lunn, Janpieter Sollie; +Cc: netdev
On June 5, 2026 6:51:56 PM GMT+02:00, Andrew Lunn <andrew@lunn.ch> wrote:
>On Fri, Jun 05, 2026 at 10:09:46AM +0200, Janpieter Sollie wrote:
>> Hi,
>>
>> This message is a follow-up on a previous request,
>> I reverse-engineered a lot of stuff,
>> and the question has become fundamentally different.
>>
>> I am trying to access the bcm84891 phy on a 10Gtek ASF-10G-T80 sfp+ transceiver.
>> According to 10Gtek, these modules contain a bcm84891 phy.
>> The MDIO commands seem te be sent to a MCU, not the phy itself.
>
>Do you know what MCU is in the SFP? Is there a data sheet for it? Can
>you read out the EEPROM holding its code over the I2C bus? You can
>then disassemble/decompile the code and see what it is actually doing.
https://doc.10gtek.com/file/file/20240806/d6fa28f954989f74cde42c75353b5fe6.pdf
I2c address should be A0h
Nicolai
>
> Andrew
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: SFP/MDIO/I2C: help requested unlocking a SFP+ MCU to expose PHY
2026-06-05 18:16 ` Nicolai Buchwitz
@ 2026-06-05 21:34 ` Andrew Lunn
2026-06-05 23:04 ` Nicolai Buchwitz
2026-06-08 9:20 ` Janpieter Sollie
0 siblings, 2 replies; 7+ messages in thread
From: Andrew Lunn @ 2026-06-05 21:34 UTC (permalink / raw)
To: Nicolai Buchwitz; +Cc: Janpieter Sollie, netdev
> >Do you know what MCU is in the SFP? Is there a data sheet for it? Can
> >you read out the EEPROM holding its code over the I2C bus? You can
> >then disassemble/decompile the code and see what it is actually doing.
>
> https://doc.10gtek.com/file/file/20240806/d6fa28f954989f74cde42c75353b5fe6.pdf
>
> I2c address should be A0h
That is the usual address for an SFP. However, MCUs sometime have ways
to program them, etc. That is why i asked if you know what the MCU
is. I guess you have not taken one apart to see what is actually in
it.
Andrew
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: SFP/MDIO/I2C: help requested unlocking a SFP+ MCU to expose PHY
2026-06-05 21:34 ` Andrew Lunn
@ 2026-06-05 23:04 ` Nicolai Buchwitz
2026-06-08 9:20 ` Janpieter Sollie
1 sibling, 0 replies; 7+ messages in thread
From: Nicolai Buchwitz @ 2026-06-05 23:04 UTC (permalink / raw)
To: Andrew Lunn; +Cc: Janpieter Sollie, netdev
On June 5, 2026 11:34:51 PM GMT+02:00, Andrew Lunn <andrew@lunn.ch> wrote:
>> >Do you know what MCU is in the SFP? Is there a data sheet for it? Can
>> >you read out the EEPROM holding its code over the I2C bus? You can
>> >then disassemble/decompile the code and see what it is actually doing.
>>
>> https://doc.10gtek.com/file/file/20240806/d6fa28f954989f74cde42c75353b5fe6.pdf
>>
>> I2c address should be A0h
>
>That is the usual address for an SFP. However, MCUs sometime have ways
>to program them, etc. That is why i asked if you know what the MCU
Right. If I read the sparse datasheet correctly, this is a branded wintop module. AFAIR these wintop modules do plain i2c, even with their mcu.
A while ago a friend gifted me a mixed box with copper sfp+ modules from fs and other second source vendors. If I recall it correctly there was a similar/same.
If I can find it, I will check the i2c interface next week...
>is. I guess you have not taken one apart to see what is actually in
>it.
>
> Andrew
>
Regards
Nicolai
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: SFP/MDIO/I2C: help requested unlocking a SFP+ MCU to expose PHY
2026-06-05 21:34 ` Andrew Lunn
2026-06-05 23:04 ` Nicolai Buchwitz
@ 2026-06-08 9:20 ` Janpieter Sollie
1 sibling, 0 replies; 7+ messages in thread
From: Janpieter Sollie @ 2026-06-08 9:20 UTC (permalink / raw)
To: Andrew Lunn, Nicolai Buchwitz; +Cc: netdev
Op 5/06/2026 om 23:34 schreef Andrew Lunn:
>>> Do you know what MCU is in the SFP? Is there a data sheet for it? Can
>>> you read out the EEPROM holding its code over the I2C bus? You can
>>> then disassemble/decompile the code and see what it is actually doing.
>> https://doc.10gtek.com/file/file/20240806/d6fa28f954989f74cde42c75353b5fe6.pdf
>>
>> I2c address should be A0h
> That is the usual address for an SFP. However, MCUs sometime have ways
> to program them, etc. That is why i asked if you know what the MCU
> is. I guess you have not taken one apart to see what is actually in
> it.
>
> Andrew
>
>
Thank you for your help, I was quite a bit lost in there.
I got 2 modules, so I can send a dump of both, but my guess is that only 1 will be sufficient.
Let me know whether you want the 2nd as well.
below you can see the output.
I was surprised reading OEM SFP-10G-T instead of ASF-10G-T80. but that's 10Gtek's decision , not
mine.
i2cdump and i2csfp eepromdump (but only 0x51, 0x50 is already in i2cdetect).
This is the output with IC_MDIO_NONE, so sfp.ko did not touch any config yet (I guess):
Should I really take it apart? or is there a "in between" solution?
Thank you for your suggestions,
Janpieter Sollie
i2cdetect -y 3
0 1 2 3 4 5 6 7 8 9 a b c d e f
00: -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: 50 51 -- -- -- -- 56 -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: UU -- -- -- -- -- -- --
# i2cdump -y 3 0x50
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 03 04 07 10 00 00 00 00 00 00 00 06 67 00 00 00 ????.......?g...
10: 08 02 00 1e 4f 45 4d 20 20 20 20 20 20 20 20 20 ??.?OEM
20: 20 20 20 20 00 00 90 65 53 46 50 2d 31 30 47 2d ..?eSFP-10G-
30: 54 20 20 20 20 20 20 20 30 32 20 20 03 52 00 3f T 02 ?R.?
40: 00 1a 00 00 43 53 59 31 30 31 50 41 36 32 35 39 .?..CSY101PA6259
50: 20 20 20 20 32 35 30 39 33 30 20 20 68 80 03 e0 250930 h???
60: 00 00 11 b9 60 12 02 18 29 53 70 64 c1 b1 1d 95 ..??`???)Spd????
70: a1 2f 32 00 00 00 00 00 00 00 00 00 a4 f7 d6 06 ?/2.........????
80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
# i2cdump -y 3 0x51
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 5f 00 7f 03 5a 00 d3 00 8c a0 75 30 88 b8 79 18 _.??Z.?.??u0??y?
10: 1d 4c 01 f4 19 64 03 e8 4d f0 06 30 3d e8 06 f2 ?L???d??M??0=???
20: 2b d4 00 c7 27 10 00 df 00 00 00 00 00 00 00 00 +?.?'?.?........
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00 ....??......?...
50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 a5 ?...?...?......?
60: 47 4f 82 78 0b b8 13 88 0f a0 00 00 00 00 00 00 GO?x??????......
70: 40 00 00 00 00 00 00 00 03 00 00 ff ff ff ff 00 @.......?.......
80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31 COUIA8NCAA10-241
90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6 5-03V03 ?.F....?
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa 36 ..............?6
c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20 SFP-10G-SR
d0: 20 20 20 20 32 33 00 00 00 00 00 00 00 00 00 35 23.........5
e0: 15 1a 20 24 2a 30 20 30 00 00 00 00 00 00 00 00 ?? $*0 0........
f0: 00 00 00 00 00 1d 00 00 ff ff ff ff 00 00 00 00 .....?..........
# i2cdump -y 3 0x56
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 20 40 00 06 35 90 50 81 60 31 00 9b c0 00 00 09 @.?5?P?`1.??..?
10: 93 01 00 00 00 1f 41 a4 41 a4 41 a4 00 00 00 00 ??...?A?A?A?....
20: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
30: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
40: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
50: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
60: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
70: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
i2csfp /dev/i2c-3 eepromdump
...
0x51:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 5f 00 7f 03 5a 00 d3 00 8c a0 75 30 88 b8 79 18 _...Z.....u0..y.
10: 1d 4c 01 f4 19 64 03 e8 4d f0 06 30 3d e8 06 f2 .L...d..M..0=...
20: 2b d4 00 c7 27 10 00 df 00 00 00 00 00 00 00 00 +...'...........
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40: 00 00 00 00 3f 80 00 00 00 00 00 00 01 00 00 00 ....?...........
50: 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 a5 ................
60: 46 91 82 78 0b b8 13 88 0f a0 00 00 00 00 00 00 F..x............
70: 40 00 00 00 00 00 00 00 03 00 00 ff ff ff ff 00 @...............
0x51 PAGE 0x00:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31 COUIA8NCAA10-241
90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6 5-03V03 ..F.....
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa 36 ...............6
c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20 SFP-10G-SR
d0: 20 20 20 20 32 33 00 00 00 00 00 00 00 00 00 35 23.........5
e0: 15 1a 20 24 2a 30 20 30 00 00 00 00 00 00 00 00 .. $*0 0........
f0: 00 00 00 00 00 1d 00 00 ff ff ff ff 00 00 00 00 ................
0x51 PAGE 0x01:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
80: 43 4f 55 49 41 38 4e 43 41 41 31 30 2d 32 34 31 COUIA8NCAA10-241
90: 35 2d 30 33 56 30 33 20 01 00 46 00 00 00 00 c6 5-03V03 ..F.....
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa 36 ...............6
c0: 53 46 50 2d 31 30 47 2d 53 52 20 20 20 20 20 20 SFP-10G-SR
d0: 20 20 20 20 32 33 00 00 00 00 00 00 00 00 00 35 23.........5
e0: 15 1a 20 24 2a 30 20 30 00 00 00 00 00 00 00 00 .. $*0 0........
f0: 00 00 00 00 00 1d 00 00 ff ff ff ff 00 00 00 00 ................
0x51 PAGE 0x02:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0x51 PAGE 0x03:
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
80: 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff 56 31 33 ff ff 02 00 63 73 77 77 .....V13....csww
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: SFP/MDIO/I2C: help requested unlocking a SFP+ MCU to expose PHY
2026-06-05 16:51 ` Andrew Lunn
2026-06-05 18:16 ` Nicolai Buchwitz
@ 2026-06-09 8:32 ` Nicolai Buchwitz
1 sibling, 0 replies; 7+ messages in thread
From: Nicolai Buchwitz @ 2026-06-09 8:32 UTC (permalink / raw)
To: Andrew Lunn, Janpieter Sollie; +Cc: netdev
Hi Andrew + Janpieter
On 5.6.2026 18:51, Andrew Lunn wrote:
> [...]
> Do you know what MCU is in the SFP? Is there a data sheet for it? Can
> you read out the EEPROM holding its code over the I2C bus? You can
> then disassemble/decompile the code and see what it is actually doing.
It put up a bit of a fight, but in the end I managed to take it apart.
uC seems to be a GD32E230F8 [1] [2].
[1] https://www.keil.arm.com/devices/gigadevice-gd32e230f8/boards/
[2] https://odly.de/lkml/10gtek-sfp-phy.jpg
Regards
Nicolai
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-06-09 8:32 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-05 8:09 SFP/MDIO/I2C: help requested unlocking a SFP+ MCU to expose PHY Janpieter Sollie
2026-06-05 16:51 ` Andrew Lunn
2026-06-05 18:16 ` Nicolai Buchwitz
2026-06-05 21:34 ` Andrew Lunn
2026-06-05 23:04 ` Nicolai Buchwitz
2026-06-08 9:20 ` Janpieter Sollie
2026-06-09 8:32 ` Nicolai Buchwitz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox