Faraday / Galachip chipsets

[Rondom]

Just collecting some info here in case someone wants to pick up where I left of.

I got curious about the Galachip GC1601. Googling Galachip or GC1601 has yielded not much useful really (no company website or historical record that such a company existed). Looking into some device trees, I see compatible = "faraday,gc1601";. Faraday Tech is an IP vendor, it seems.

I have had a quick peek into the firmware of TP-Link XZ000-G7. Some additional information about TP-Link XZ000-G7 in Portuguese.

• ARM 32-bit
• uses kernel 3.16
• uclibc based userspace
• /etc/config.sdk in rootfs suggests some custom Galachip specific SDK and that they use a (given the ancient kernel and user space) a surprisingly recent U-Boot version GC_UBOOT_202007rc2=y

[simonebortolin]

free to open a pull request

[collerok]

Seems like C-Data FD511G-X (new F501 model) is based on same Galachip GC1601 chipset
Vendor gave me a firmwares.bin for this ONT and a tool to mass upgrade ont from bootloader mode.

[prtj-1982]

I'm also looking for a way to update the firmware of an ONT with this same GALACHIP GC1601 chip. I bought an ONT with this chip. I'm looking for a way to modify the firmware to be compatible with TR069 and work with Nio ISP. I tried updating with the TP-Link XZ000-G7 firmware in Portuguese, but the chip didn't accept the firmware. Looking for another alternative.

[collerok]

cdata f511 (f501) has tr069 client in v3.x.x firmwares
they also gave me multicast mass upgrade tool that allows upgrade from bootloader, bypassing ont webinterface

but why would you care of this boring 1port 1g bridge ont, there nothing special in it

also take a note. cdata protected thier ont with Almost RANDOM telnet\ssh password which is generated based on ONT MAC address. password can be reqiested from thier support, and of course they wont generate pw for thirdparty ont vendor

link to files

3.x.x fw inside folder /firmare/update to 3.x

[prtj-1982]

i got this from aliex. Already paid, can't return. Now i have this SFP stick ONT with this weird system.

[vikitinho]

I have an SFP+ with this Galachip GC1601 that I'm trying to regain access to.

In some tests I ended up running the command: "gccli image switch help".

I believe this changed the image from /dev/mtdblock2 to /dev/mtdblock3. Now, when I connect the device, it immediately responds to 4 ping packets to the IP 192.168.1.1 and then stops responding.

I haven't found any pins for UART access on the board.

I'm commenting here in case anyone has any suggestions for testing to recover it!

[prtj-1982]

Try to reset, take the fiber off and put it on 5 times, Some xpon modules restores to factory defaults. To access the UART pins, you need to open the module and connect or solder the wires.

[vikitinho]

I couldn't find any pads that could be used as a UART.

I'm still running tests to try and regain access to the sfp manager.

When I connect the sfp, it responds to 4 pings and then stops responding.

Thu May 21 10:47:03 2026 kern.info kernel: [150077.540542] sfp sfp2: module XC SFP-XPON-Stick rev A-01 sn 202506160041 dc 250614
Thu May 21 10:47:03 2026 kern.info kernel: [150077.580211] hwmon hwmon3: temp1_input not attached to any thermal zone
Thu May 21 10:47:03 2026 kern.info kernel: [150077.611568] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off

Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.992ms
Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.745ms
Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.442ms
Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.200ms

Trying to plug and unplug the fiber 5 times was unsuccessful.

[collerok]

I couldn't find any pads that could be used as a UART.

I'm still running tests to try and regain access to the sfp manager.

When I connect the sfp, it responds to 4 pings and then stops responding.

Thu May 21 10:47:03 2026 kern.info kernel: [150077.540542] sfp sfp2: module XC SFP-XPON-Stick rev A-01 sn 202506160041 dc 250614 Thu May 21 10:47:03 2026 kern.info kernel: [150077.580211] hwmon hwmon3: temp1_input not attached to any thermal zone Thu May 21 10:47:03 2026 kern.info kernel: [150077.611568] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off

Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.992ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.745ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.442ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.200ms

Trying to plug and unplug the fiber 5 times was unsuccessful.

try using multicast upgrade tool to load v1.2.8 firmware
I used that to restore broken full sized cdata fd511gx (f501) with gc1601 cpu

[vikitinho]

I couldn't find any pads that could be used as a UART.

I'm still running tests to try and regain access to the sfp manager.
When I connect the sfp, it responds to 4 pings and then stops responding.
Thu May 21 10:47:03 2026 kern.info kernel: [150077.540542] sfp sfp2: module XC SFP-XPON-Stick rev A-01 sn 202506160041 dc 250614 Thu May 21 10:47:03 2026 kern.info kernel: [150077.580211] hwmon hwmon3: temp1_input not attached to any thermal zone Thu May 21 10:47:03 2026 kern.info kernel: [150077.611568] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.992ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.745ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.442ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.200ms
Trying to plug and unplug the fiber 5 times was unsuccessful.

try using multicast upgrade tool to load v1.2.8 firmware I used that to restore broken full sized cdata fd511gx (f501) with gc1601 cpu

I tried using the tool but without success. I created a Python script based on the code from the tool that simulates multicast packets to see if the ONU is in firmware upgrade mode, but I'm not getting any packet responses; I only have responses from the four pings mentioned earlier.

Using ethtool, I have an RX signal from the fiber optic connection, showing that the SFP is physically OK, however, the network connection isn't coming up, which I believe is being caused by a firmware problem!

I believe the only solution will be to somehow get UART access.

~# ethtool -m eth1
	Identifier                                : 0x03 (SFP)
	Extended identifier                       : 0x04 (GBIC/SFP defined by 2-wire interface ID)
	Connector                                 : 0x01 (SC)
	Transceiver codes                         : 0x00 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x00
	Transceiver type                          : Ethernet: 1000BASE-LX
	Encoding                                  : 0x03 (NRZ)
	BR, Nominal                               : 1200MBd
	Rate identifier                           : 0x00 (unspecified)
	Length (SMF,km)                           : 20km
	Length (SMF)                              : 20000m
	Length (50um)                             : 0m
	Length (62.5um)                           : 0m
	Length (Copper)                           : 0m
	Length (OM3)                              : 0m
	Laser wavelength                          : 1310nm
	Vendor name                               : XC
	Vendor OUI                                : 00:00:00
	Vendor PN                                 : SFP-XPON-Stick
	Vendor rev                                : A-01
	Option values                             : 0x00 0x00
	BR margin, max                            : 0%
	BR margin, min                            : 0%
	Vendor SN                                 : 202506160041
	Date code                                 : 250614
	Optical diagnostics support               : Yes
	Laser bias current                        : 0.000 mA
	Laser output power                        : 0.0001 mW / -40.00 dBm
	Receiver signal average optical power     : 0.0095 mW / -20.22 dBm
	Module temperature                        : 58.32 degrees C / 136.97 degrees F
	Module voltage                            : 3.4016 V
	Alarm/warning flags implemented           : Yes
	Laser bias current high alarm             : Off
	Laser bias current low alarm              : On
	Laser bias current high warning           : Off
	Laser bias current low warning            : On
	Laser output power high alarm             : Off
	Laser output power low alarm              : On
	Laser output power high warning           : Off
	Laser output power low warning            : On
	Module temperature high alarm             : Off
	Module temperature low alarm              : Off
	Module temperature high warning           : Off
	Module temperature low warning            : Off
	Module voltage high alarm                 : Off
	Module voltage low alarm                  : Off
	Module voltage high warning               : Off
	Module voltage low warning                : Off
	Laser rx power high alarm                 : Off
	Laser rx power low alarm                  : Off
	Laser rx power high warning               : Off
	Laser rx power low warning                : Off
	Laser bias current high alarm threshold   : 60.000 mA
	Laser bias current low alarm threshold    : 0.000 mA
	Laser bias current high warning threshold : 55.000 mA
	Laser bias current low warning threshold  : 0.000 mA
	Laser output power high alarm threshold   : 4.4688 mW / 6.50 dBm
	Laser output power low alarm threshold    : 0.7943 mW / -1.00 dBm
	Laser output power high warning threshold : 3.5500 mW / 5.50 dBm
	Laser output power low warning threshold  : 0.8912 mW / -0.50 dBm
	Module temperature high alarm threshold   : 88.00 degrees C / 190.40 degrees F
	Module temperature low alarm threshold    : -45.00 degrees C / -49.00 degrees F
	Module temperature high warning threshold : 85.00 degrees C / 185.00 degrees F
	Module temperature low warning threshold  : -40.00 degrees C / -40.00 degrees F
	Module voltage high alarm threshold       : 3.6000 V
	Module voltage low alarm threshold        : 2.8999 V
	Module voltage high warning threshold     : 3.4700 V
	Module voltage low warning threshold      : 3.0000 V
	Laser rx power high alarm threshold       : 0.1995 mW / -7.00 dBm
	Laser rx power low alarm threshold        : 0.0011 mW / -29.59 dBm
	Laser rx power high warning threshold     : 0.1584 mW / -8.00 dBm
	Laser rx power low warning threshold      : 0.0014 mW / -28.54 dBm