Difference between revisions of "SFPTotal Plus"

From SFPTotal Wiki
Jump to: navigation, search
(→‎Brute-force mode)
(→‎Command line interface)
Line 274: Line 274:
 
AUTO_WR_ADDTBL=0
 
AUTO_WR_ADDTBL=0
 
</pre>
 
</pre>
 +
 +
  
 
=== Read and write ===
 
=== Read and write ===

Revision as of 23:01, 7 June 2017

Programmer SFPTotal Plus

SFPTotal Plus - the new version of four-ports programming board, replacement for programmers PG series. Programmer SFPTotal Plus allows to reprogram the GBIC, SFP, SFP+, XFP and QSFP transceivers and direct attach cables (DAC).

The hardware platform is based on SFPTotal Mini with added extensions to transceiver ports. For working with GBIC, XFP, and QSFP transceivers included the additional power plans, as well as control elements.

The SFPTotal Plus connects to PC via USB interface through which performed control and power supply of transceiver. To connect a high-power transceivers can be used by external power adapter 5V DC.

Application

Programmers SFPTotal are used to solve next tasks:

  • Programming SFP/SFP+, XFP, QSFP, GBIC optical transceivers and twinaxial cables
  • Providing of compatibility between network equipment of different manufacturers
  • Reflashing memory of write-protected transceivers
  • Changing settings of PHY controllers
  • Branding for OEM transceivers
  • Diagnosis transceiver by reading the DDM
  • Accounting for optical transceivers

Quick start

  1. Connect SFPTotal Plus board to your PC using micro USB Type B cable
  2. Install drivers for SFPTotal Device
  3. Download application SFPTotal Wizard
  4. Start SFPTotal Wizard
  5. Insert transceiver to the programmer port
  6. Reading transceiver's memory

Elements

Listing of elements placed on circuit board of SFPTotal Plus programmer.


1. Transceiver ports

P2 - SFP, SFP+ port

P11 - QSFP, QSFP+, QSFP28 port

P9 - XFP port

P7 - GBIC port


2. Power supply plans

P1 - power supply of SFP port, a pair of 3.3 V for VccT and VccR pins.

P17, P16, P15 - power supply of QSFP port, 3.3 V for Vcc1, VccTx and VccRx pins.

P12, P14, P13, P10 - power supply of XFP port: 3.3V, -5V, 5V and 1.8 power supply plans.

P8 - power supply of GBIC port, switch between 3.3V or 5V. For default, closed in 3V3 position.


3. Jumpers

P3 - low power mode, keep closed to disable low power mode (TX enable).

P4 - RS1 (position 1-2) and RS0 (position 3-4) pins.

P18 - QSFP ModSelL 

The ModSelL is an input pin. When held low by the host, the module responds to 2-wire serial communication commands. The ModSelL allows the use of multiple QSFP modules on a single 2-wire interface bus. When the ModSelL is “High”, the module shall not respond to or acknowledge any 2-wire interface communication from the host. ModSelL signal input node must be biased to the “High” state in the module.

INF-8438

Notice: The programmer automatically switches the contact to "Low" level when performing read and write operations on the data bus.

P19 - QSFP ResetL

P20 - XFP ModDeSel 

The Mod_DeSel is an input pin. When held Low by the host, the module responds to 2-wire serial communication commands. The Mod_DeSel allows the use of multiple XFP modules on a single 2-wire interface bus.
When the Mod_DeSel pin is “High”, the module shall not respond to or acknowledge any 2-wire interface communication from the host. Mod_DeSel pin must be pulled to VCC3 in the module.

INF-8077i

Notice: The programmer automatically switches the contact to "Low" level when performing read and write operations on the data bus.

P21 - XFP PDOWN/RESET 

This is a multifunction pin for module Power Down and Reset. The P_Down/RST pin must be pulled up to VCC3 in the XFP module.

INF-8077i


4. Interfaces

P5 - USB interface for connection to PC

P22 - I2C databus, logic level 5V


5. LED indicators

POWER - should statically light when board connected to USB or to external supply adapter.

MCU - indication of power supply for microcontroller.

ERROR - should glow when unhandled errors occur on the data bus, for example: connection more than 1 transceiver.

STATUS - should blinking when transceiver is not connected and statically light when transceiver is connected.



Command line interface

The device provides access to the command line interface by connecting through a virtual serial port. You can use the programming board without SFPTotal Wizard software to get more features or to realize the opportunities that are not available in the standard software.

Use this document to get information about commands which supported by SFPTotal Plus.


Serial port settings

Serial port settings

You can access the command line interface of the programmer not only with the SFPTotal Wizard, but also with the help of utilities for working with the serial port. For example, Putty.

The boards are support a flexible baud rate, but we recommend use value 115200.

Default settings
Baud rate: 115200
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None


Configuration commands

CLI

After reset the programmer does not display in the interface characters entered from the keyboard. The command switches the echo output of command line. Default, CLI=0. 

? CLI
CLI=0

CLI=1

Set CLI=1 to turn on echo.


STATUS

Commend returns current state GPIO for each port. 

STATUS
[GBIC]: MOD_ABS=1; TX_FAULT=1; RX_LOS=1; TX_DIS=1
[SFP]:  MOD_ABS=1; TX_FAULT=1; RX_LOS=1; TX_DIS=1
[XFP]:  MOD_ABS=1; RX_LOS=1; INTERRUPT=1; MOD_SEL=1; P_DOWN/RESET=1;
[QSFP]: MOD_ABS=1; INTL=1; MOD_SEL=1; RESETL=1;


TX_DIS

Command allows to disable power supply of transmitter for switching to low power mode (LPMODE). To activate the LPMODE, it is necessary to transfer command TX_DIS setting the flag value of 1.

To disable the mode, you must set the flag equal to 0. The current state can be requested with STATUS command. 

TX_DIS=1

STATUS
MOD_ABS=0; TX_FAULT=1; RX_LOS=0; TX_DIS=1

TX_DIS=0
STATUS
MOD_ABS=0; TX_FAULT=1; RX_LOS=0; TX_DIS=0

Low power mode is activated for default. On the PCB of SFPTotal boards are placed contacts LP_MODE, which allows to switch low power mode in manual mode.


VERSION

Command returns information about device: hardware revision, software version and unique serial number of the device. 

VERSION
SFPTotal Plus (c) 2015-2016
HW: 1.1
SW: 1.0.5
SN: SFPT-P1116021001


I2CRATE

Note: Supported only on the SW versions 1.1.0 or above

This command sets the speed of I2C data bus. 

I2CRATE=12 # Set up speed rate 100 kHz
I2CRATE=40 # Set up speed 30 kHz
I2CRATE=C6 # Set up speed 10 kHz

To request a current speed use command: ? I2CRATE 

? I2CRATE
I2CRATE=C6


I2CPAUSE

Note: Supported only on the SW versions 1.2.2 or above

This command sets the interval between operation of I2C data bus. Value equal to milliseconds in Hex format. 

I2CPAUSE=20 # Set interval 32ms
I2CPAUSE=32 # Set interval 50ms (for default)
I2CPAUSE=64 # Set interval 100ms

To request a current interval use command: ? I2CPAUSE 

? I2CPAUSE
I2CPAUSE=32


BPS

The command set number bytes in block of write. Default, BPS=08 

? BPS
BPS=08

BPS=01 # Set block size in 1 byte
BPS=08 # Set block size in 8 bytes (default)
BPS=FF # Set block size in 255 bytes

By default, the recording is performed by blocks of 8 bytes. For the programming of some transceivers with protection, it may be necessary to change the block size, for example, writing by each byte (BPS=01) or writing the entire block as a whole (BPS=FF).


AUTO_WR_ADDTBL

Note: Supported only on the SW versions 1.1.0 or above

If the flag is set, the programmer will automatically change the address of the additional tables before performing reading and writing operations. 

AUTO_WR_ADDTBL=1
 
AUTO_WR_ADDTBL=0

To request a current value use command: ? AUTO_WR_ADDTBL 

? AUTO_WR_ADDTBL
AUTO_WR_ADDTBL=0


Read and write

rXYYAABBCC (RXYYAABBCC)

Command for reading memory of transceiver. 

r1A000007F
Read 128 byte(s) Table 0xA0 from 0x00

##    00  01  02  03  04  05  06  07  08  09  0A  0B  0C  0D  0E  0F

00 :  03  04  07  20  00  00  00  00  00  00  00  06  67  00  0A  64
01 :  00  00  00  00  4F  45  4D  20  20  20  20  20  20  20  20  20
02 :  00  20  20  20  00  00  00  00  31  30  47  42  2D  53  46  50
03 :  2D  4C  52  2D  45  20  20  20  31  2E  30  20  05  1E  00  F9
04 :  00  1A  00  00  45  58  50  39  36  4C  30  31  31  20  20  20
05 :  20  20  20  20  31  31  30  38  30  39  20  20  68  F0  03  02
06 :  45  58  54  52  45  4D  45  20  4C  52  00  00  00  00  00  00
07 :  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

R1A000007F  
03040720000000000000000667000A64000000004F454D202020202020202020
0020202000000000313047422D5346502D4C522D45202020312E3020051E00F9
001A000045585039364C30313120202020202020313130383039202068F00302
45585452454D45204C5200000000000000000000000000000000000000000000


wXYYAABBCC (WXYYAABBCC)

Command for writing to the memory of transceiver.

w — (1 byte) — Write command. Symbol register is responsible for the subsequent read after write. If you use uppercase (W) after the recording is complete programmer will make reading the memory area which has been overwritten. To write without return a write result of lower case (w) must be used.

X — (1 byte) — Transceiver type (1 - SFP, 2 - SFP+).

YY — (2 bytes) — The device address on the I2C bus.

AA — (2 bytes) — Address of additional table.

BB — (2 bytes) — Address table. Value in HEX. For example: A0 or A2.

СС — (2 bytes) — Write byte count. Hexadecimal value reduced by one. For example, for writing 128 bytes you should set this parameter in 7F (0x7F in HEX, 127 in decimal).

{DATA} — Write data in HEX, 2 characters for each byte of the parcel.


Examples

Write code 128 bytes in Table A0 Upper address 00 for SFP transceiver: 

W1A000007F
03040720000000000000000667000A64000000004F454D202020202020202020
0020202000000000313047422D5346502D4C522D45202020312E3020051E00F9
001A000045585039364C30313120202020202020313130383039202068F00302
45585452454D45204C5200000000000000000000000000000000000000000000

Write password 0123 (HEX: 30h 31h 32h 33h) in Table A2 address 7B for SFP+ transceiver: 

w2A2007B0330313233

Note: Write command should type without newline characters and spaces. Shifts are given for the convenience display of the material in the examples.


Brute-force mode

Starting from SW 1.2.3 firmware version has been added the function that allows searching for a password in brute mode without using the SFPTotal Wizard software. It mean that programming board can check passwords by itself in wide range of values.

How does it works?

To check the password programmer should make few operations:

  1. Enter password in password area
  2. Write a check word to Vendor name area
  3. Read vendor name area
  4. Compare a check word with vendor name.

The programmer goes through the password values sequentially within the specified range. By default, the programmer write a check word "SFPTOTAL" (8 bytes) in Table A0h with offset 14h. Then it compares the data that was read after the control word was written.

If the read data is the same as the control word, then it mean the record is successful. The programmer will stop the brute-force process and return the current password as a result of a successful search.

We are developed this function for searching passwords to MSA compliant transceivers. Anyway, you should check the documentation and standards for your module before using brute-force mode.


BFSET

The command sets the password search parameters and starts the brute-force process. 

BFSET A2 7B AAAAAAAA FFFFFFFF CCCCCCCC

A2 - address of Table, where must be entered a password. For XFP and QSFP address should be set in A0.

7B - offset for entering a password

AAAAAAAA - start of range

FFFFFFFF - end of range

CCCCCCCC - value from where should be started brute-force process

Recommended ranges for search: 

BFSET A2 7B 41414141 5A5A5A5A 41414141 # A-Z

BFSET A2 7B 61616161 7A7A7A7A 61616161 # a-z

BFSET A2 FC 30303030 39393939 30303030 # 0-9

BFSET A2 7B 20202020 7A7A7A7A 24367621 # Symbols + Numeric + Literal


BFSTOP

Use command BFSTOP to stop brute-force process. You could continue from this point using command BFSTART.


BFSTART

Use command BFSTART to continue brute-force progress from last point.


? BFPASS

Use command ? BFPASS to get know current password in brute-force progress.


BFCWADR

Set device address of entering check word. Fo example, BFCWADR=A0


BFCWOFT

Set offset parameter for entering check word. For default, BFCWOFT=14.

Note: for XFP and QSFP transceivers use BFCWOFT=94.


How to start brute-force for SFP+ transceiver? 

BFCWADR=A0
BFCWOFT=14
BFSET A2 7B 20202020 7A7A7A7A 20202020


How to start brute-force for XFP transceiver?

Set jumper on P20 contact on programming board. 

BFCWADR=A0
BFCWOFT=94
BFSET A0 7B 20202020 7A7A7A7A 20202020
Retrieved from "http://wiki.sfptotal.com/index.php?title=SFPTotal_Plus&oldid=654"