Skip to content

Faraday / Galachip chipsets #424

Closed
#505
Closed
Faraday / Galachip chipsets#424
#505
Labels
hacktoberfest

Description

@Rondom
Rondom
opened on Dec 12, 2025

Just collecting some info here in case someone wants to pick up where I left of.

I got curious about the Galachip GC1601. Googling Galachip or GC1601 has yielded not much useful really (no company website or historical record that such a company existed). Looking into some device trees, I see compatible = "faraday,gc1601";. Faraday Tech is an IP vendor, it seems.

I have had a quick peek into the firmware of TP-Link XZ000-G7. Some additional information about TP-Link XZ000-G7 in Portuguese.

  • ARM 32-bit
  • uses kernel 3.16
  • uclibc based userspace
  • /etc/config.sdk in rootfs suggests some custom Galachip specific SDK and that they use a (given the ancient kernel and user space) a surprisingly recent U-Boot version GC_UBOOT_202007rc2=y

Activity

  1. Rondom
    changed the title [-]Faraday / Galachip GC1601 / GC1602[/-] [+]Faraday / Galachip chipsets[/+] on Dec 12, 2025

  2. simonebortolin commented on Feb 7, 2026

    @simonebortolin
    simonebortolin
    on Feb 7, 2026
    Contributor

    free to open a pull request

  3. collerok commented on Feb 25, 2026

    @collerok
    collerok
    on Feb 25, 2026
    Contributor

    Seems like C-Data FD511G-X (new F501 model) is based on same Galachip GC1601 chipset
    Vendor gave me a firmwares.bin for this ONT and a tool to mass upgrade ont from bootloader mode.

  4. prtj-1982 commented on Mar 16, 2026

    @prtj-1982
    prtj-1982
    on Mar 16, 2026

    I'm also looking for a way to update the firmware of an ONT with this same GALACHIP GC1601 chip. I bought an ONT with this chip. I'm looking for a way to modify the firmware to be compatible with TR069 and work with Nio ISP. I tried updating with the TP-Link XZ000-G7 firmware in Portuguese, but the chip didn't accept the firmware. Looking for another alternative.

  5. collerok commented on Mar 17, 2026

    @collerok
    collerok
    on Mar 17, 2026
    Contributor

    cdata f511 (f501) has tr069 client in v3.x.x firmwares
    they also gave me multicast mass upgrade tool that allows upgrade from bootloader, bypassing ont webinterface

    but why would you care of this boring 1port 1g bridge ont, there nothing special in it

    also take a note. cdata protected thier ont with Almost RANDOM telnet\ssh password which is generated based on ONT MAC address. password can be reqiested from thier support, and of course they wont generate pw for thirdparty ont vendor

    link to files

    3.x.x fw inside folder /firmare/update to 3.x

  6. prtj-1982 commented on Mar 17, 2026

    @prtj-1982
    prtj-1982
    on Mar 17, 2026

    i got this from aliex. Already paid, can't return. Now i have this SFP stick ONT with this weird system.

  7. vikitinho commented on May 14, 2026

    @vikitinho
    vikitinho
    on May 14, 2026

    I have an SFP+ with this Galachip GC1601 that I'm trying to regain access to.

    In some tests I ended up running the command: "gccli image switch help".

    I believe this changed the image from /dev/mtdblock2 to /dev/mtdblock3. Now, when I connect the device, it immediately responds to 4 ping packets to the IP 192.168.1.1 and then stops responding.

    I haven't found any pins for UART access on the board.

    I'm commenting here in case anyone has any suggestions for testing to recover it!

  8. prtj-1982 commented on May 18, 2026

    @prtj-1982
    prtj-1982
    on May 18, 2026

    Try to reset, take the fiber off and put it on 5 times, Some xpon modules restores to factory defaults. To access the UART pins, you need to open the module and connect or solder the wires.

  9. vikitinho commented on May 21, 2026

    @vikitinho
    vikitinho
    on May 21, 2026

    I couldn't find any pads that could be used as a UART.

    Image Image

    I'm still running tests to try and regain access to the sfp manager.

    When I connect the sfp, it responds to 4 pings and then stops responding.

    Thu May 21 10:47:03 2026 kern.info kernel: [150077.540542] sfp sfp2: module XC SFP-XPON-Stick rev A-01 sn 202506160041 dc 250614
    Thu May 21 10:47:03 2026 kern.info kernel: [150077.580211] hwmon hwmon3: temp1_input not attached to any thermal zone
    Thu May 21 10:47:03 2026 kern.info kernel: [150077.611568] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off

    Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.992ms
    Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.745ms
    Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.442ms
    Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.200ms

    Trying to plug and unplug the fiber 5 times was unsuccessful.

  10. collerok commented on May 23, 2026

    @collerok
    collerok
    on May 23, 2026
    Contributor

    I couldn't find any pads that could be used as a UART.

    Image Image
    I'm still running tests to try and regain access to the sfp manager.

    When I connect the sfp, it responds to 4 pings and then stops responding.

    Thu May 21 10:47:03 2026 kern.info kernel: [150077.540542] sfp sfp2: module XC SFP-XPON-Stick rev A-01 sn 202506160041 dc 250614 Thu May 21 10:47:03 2026 kern.info kernel: [150077.580211] hwmon hwmon3: temp1_input not attached to any thermal zone Thu May 21 10:47:03 2026 kern.info kernel: [150077.611568] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off

    Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.992ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.745ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.442ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.200ms

    Trying to plug and unplug the fiber 5 times was unsuccessful.

    try using multicast upgrade tool to load v1.2.8 firmware
    I used that to restore broken full sized cdata fd511gx (f501) with gc1601 cpu

  11. vikitinho commented on Jun 2, 2026

    @vikitinho
    vikitinho
    on Jun 2, 2026

    I couldn't find any pads that could be used as a UART.
    Image Image
    I'm still running tests to try and regain access to the sfp manager.
    When I connect the sfp, it responds to 4 pings and then stops responding.
    Thu May 21 10:47:03 2026 kern.info kernel: [150077.540542] sfp sfp2: module XC SFP-XPON-Stick rev A-01 sn 202506160041 dc 250614 Thu May 21 10:47:03 2026 kern.info kernel: [150077.580211] hwmon hwmon3: temp1_input not attached to any thermal zone Thu May 21 10:47:03 2026 kern.info kernel: [150077.611568] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
    Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.992ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.745ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 3.442ms Unicast reply from 192.168.1.1 [00:00:0A:22:33:44] 1.200ms
    Trying to plug and unplug the fiber 5 times was unsuccessful.

    try using multicast upgrade tool to load v1.2.8 firmware I used that to restore broken full sized cdata fd511gx (f501) with gc1601 cpu

    I tried using the tool but without success. I created a Python script based on the code from the tool that simulates multicast packets to see if the ONU is in firmware upgrade mode, but I'm not getting any packet responses; I only have responses from the four pings mentioned earlier.

    Using ethtool, I have an RX signal from the fiber optic connection, showing that the SFP is physically OK, however, the network connection isn't coming up, which I believe is being caused by a firmware problem!

    I believe the only solution will be to somehow get UART access.

    ~# ethtool -m eth1
	Identifier                                : 0x03 (SFP)
	Extended identifier                       : 0x04 (GBIC/SFP defined by 2-wire interface ID)
	Connector                                 : 0x01 (SC)
	Transceiver codes                         : 0x00 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x00
	Transceiver type                          : Ethernet: 1000BASE-LX
	Encoding                                  : 0x03 (NRZ)
	BR, Nominal                               : 1200MBd
	Rate identifier                           : 0x00 (unspecified)
	Length (SMF,km)                           : 20km
	Length (SMF)                              : 20000m
	Length (50um)                             : 0m
	Length (62.5um)                           : 0m
	Length (Copper)                           : 0m
	Length (OM3)                              : 0m
	Laser wavelength                          : 1310nm
	Vendor name                               : XC
	Vendor OUI                                : 00:00:00
	Vendor PN                                 : SFP-XPON-Stick
	Vendor rev                                : A-01
	Option values                             : 0x00 0x00
	BR margin, max                            : 0%
	BR margin, min                            : 0%
	Vendor SN                                 : 202506160041
	Date code                                 : 250614
	Optical diagnostics support               : Yes
	Laser bias current                        : 0.000 mA
	Laser output power                        : 0.0001 mW / -40.00 dBm
	Receiver signal average optical power     : 0.0095 mW / -20.22 dBm
	Module temperature                        : 58.32 degrees C / 136.97 degrees F
	Module voltage                            : 3.4016 V
	Alarm/warning flags implemented           : Yes
	Laser bias current high alarm             : Off
	Laser bias current low alarm              : On
	Laser bias current high warning           : Off
	Laser bias current low warning            : On
	Laser output power high alarm             : Off
	Laser output power low alarm              : On
	Laser output power high warning           : Off
	Laser output power low warning            : On
	Module temperature high alarm             : Off
	Module temperature low alarm              : Off
	Module temperature high warning           : Off
	Module temperature low warning            : Off
	Module voltage high alarm                 : Off
	Module voltage low alarm                  : Off
	Module voltage high warning               : Off
	Module voltage low warning                : Off
	Laser rx power high alarm                 : Off
	Laser rx power low alarm                  : Off
	Laser rx power high warning               : Off
	Laser rx power low warning                : Off
	Laser bias current high alarm threshold   : 60.000 mA
	Laser bias current low alarm threshold    : 0.000 mA
	Laser bias current high warning threshold : 55.000 mA
	Laser bias current low warning threshold  : 0.000 mA
	Laser output power high alarm threshold   : 4.4688 mW / 6.50 dBm
	Laser output power low alarm threshold    : 0.7943 mW / -1.00 dBm
	Laser output power high warning threshold : 3.5500 mW / 5.50 dBm
	Laser output power low warning threshold  : 0.8912 mW / -0.50 dBm
	Module temperature high alarm threshold   : 88.00 degrees C / 190.40 degrees F
	Module temperature low alarm threshold    : -45.00 degrees C / -49.00 degrees F
	Module temperature high warning threshold : 85.00 degrees C / 185.00 degrees F
	Module temperature low warning threshold  : -40.00 degrees C / -40.00 degrees F
	Module voltage high alarm threshold       : 3.6000 V
	Module voltage low alarm threshold        : 2.8999 V
	Module voltage high warning threshold     : 3.4700 V
	Module voltage low warning threshold      : 3.0000 V
	Laser rx power high alarm threshold       : 0.1995 mW / -7.00 dBm
	Laser rx power low alarm threshold        : 0.0011 mW / -29.59 dBm
	Laser rx power high warning threshold     : 0.1584 mW / -8.00 dBm
	Laser rx power low warning threshold      : 0.0014 mW / -28.54 dBm
  12. simonebortolin
    added
    hacktoberfest
    on Oct 9, 2026
  13. simonebortolin
    added a commit that references this issue on Oct 9, 2026

    Resolve issues #428, #424, #416: FG1000B firmware, Galachip, Zyxel patch

    671254d
  14. simonebortolin
    closed this as completedon Oct 9, 2026
  15. simonebortolin
    added a commit that references this issue on Oct 9, 2026

    Resolve issues #428, #424, #416: FG1000B firmware, Galachip, Zyxel patch

    bced7a6

  16. AliLostInTheDark commented on Oct 16, 2026

    @AliLostInTheDark
    AliLostInTheDark
    on Oct 16, 2026

    https://github.com/AliLostInTheDark/openwrt-galachip (did some work with claude)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    hacktoberfest

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions