4 min read network

Flash GPON SFP-ONU sticks the easy way

Flash GPON SFP-ONU sticks the easy way

How to re-flash the FS.COM GPON ONU Stick or Huawei MA5671A with the SFP-to-TTL adapter

What this guide is about

The wildly popular FS.COM GPON ONU Stick (PN: GPON-ONU-SFP-20B) and Huawei MA5671A both hide a tiny 3 V UART console that lets you:

  • update or patch the stock firmware,
  • unlock bridge/router modes, SN/LOID tweaks, Telnet/SSH,
  • or recover a bricked stick.

Unfortunately the header is inside the SFP cage and impossible to reach with normal probes.
The ready-to-use SFP-to-TTL breaks out RX, TX, 3V3, GND to a 2 × 10 gold-pin header that eases the use with any USB-to-UART dongle. It's the quickest and safest route for hobbyists who don't want to hand-wire pogo pins.

New to these sticks? Start with the SFP module pinout reference — the full 20-pin map and a verified list of which modules expose the console on which pins.

What you'll need

QtyPartNotes
1SFP-to-TTL v1.2 adapterAvailable pre-assembled
1FS.COM GPON-ONU-SFP-20B or Huawei MA5671AOther GPON sticks often work too
1USB-to-UART (3 V logic)FTDI232, CH340C, CP2102 …
–4 × female–female DuPont leadsFor RX, TX, 3V3, GND

Power tip: both sticks draw up to 400 mA @ 3V3 during boot.
Most genuine FTDI boards supply that, but cheap clones may brown-out — if your stick keeps rebooting, that's almost always the cause: see why your SFP module keeps rebooting. In that case power the SFP from a bench supply and only share GND. (Adapter v1.2 adds two capacitors to help avoid this.)

Ready? Let's break it in 5 steps.

1 - Wiring in 30 seconds

SFP-to-TTL RX>TX ────────► USB-to-UART TX
SFP-to-TTL TX>RX ────────► USB-to-UART RX
SFP-to-TTL VCC   ────────► USB-to-UART 3V3
SFP-to-TTL GND   ────────► USB-to-UART GND
  1. Slide the SFP module into the edge connector on the adapter.
  2. Bridge the four labelled pads to your UART dongle.
  3. Plug the dongle into your computer.

Not sure which pad is which? The pinout reference maps every pin — and reminds you to swap RX/TX if you get no output.

2 - Serial console checklist (Linux and macOS)

Both systems ship with the tools we need:

# Identify your UART
ls /dev/tty.*      # macOS
ls /dev/ttyUSB*    # Linux

# Open the console (115 200 8N1)
screen /dev/ttyUSB0 115200      # or tty.usbserial-XXXX on macOS
If screen isn't installed:
macOS: brew install screen
Debian/Ubuntu: sudo apt install screen

Windows users: grab PuTTY or Tera Term, pick 115 200 baud, 8 N 1, no flow control.

What you should see at power-up

U-Boot 1.1.3 (Jan 21 2024 - 17:02:15)

DRAM:  128 MB
Boot From SPI flash
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  3  2  1
U-Boot>

No text? Swap RX↔TX or try 9 600/57 600 baud.

U-Boot> sf probe 0
U-Boot> sf read 0x81000000 0x000000 0x01000000   # read 16 MB
U-Boot> md 0x81000000 0x40                       # quick hex peek

On your host run a TFTP server in the same folder as backup.bin:

sudo python3 -m tftpy -p 69 .

Then in the bootloader:

U-Boot> tftpboot 0x81000000 backup.bin
U-Boot> saveenv

That drops the full SPI dump onto your PC so you can restore later.

4 - Flashing a new image

Below is the most common routine used by both the FS.COM stick (Realtek) and the Huawei MA5671A (Cortina). Substitute the filename for your build.

U-Boot> tftpboot 0x81000000 gpon-onu-custom.bin
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.2
Filename 'gpon-onu-custom.bin'.
Load address: 0x81000000
Loading: ########################################  1432 KiB
done
Bytes transferred = 1468006 (167996 hex)
U-Boot> sf erase 0x000000 0x00200000
U-Boot> sf write 0x81000000 0x000000 ${filesize}
... 100% complete
U-Boot> reset

Expected serial output after reset

Booting kernel from 0x9f020000 ...
## Booting image at 9f020000 ...
   Image Name:   OpenWrt 23.05 GPON-ONU
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2800000 Bytes = 2.7 MB
   Load Address: 80002000
   Entry Point:  80204100
OK

If you see the OpenWrt (or vendor) banner, the flash was successful.

5 - Post-flash sanity checks

Once the prompt comes up:

cat /etc/openwrt_release | grep DISTRIB_DESCRIPTION
# -> DISTRIB_DESCRIPTION='OpenWrt 23.05.0 r23022-4f442e6'

ifconfig pon0
# pon0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 2000
#       RX packets 42  bytes 9876  (9.6 KiB)
#       TX packets 37  bytes 9120  (8.9 KiB)

No LOS / LOS blinking?
Clean the fibre ferrules, confirm the OLT has whitelisted the SN/LOID, and verify optical power (-28 dBm max for GPON).

Troubleshooting table

SymptomQuick fix
Blank consoleSwap RX/TX, check 3V3 is really 3.3 V, try other baudrates.
Boot loopUsually under-powered — see the power-supply guide. Otherwise wrong image offset → re-flash the backup.
Overheat / smellStick pulling > 500 mA: use external PSU or heat-sink.

Where to go next

Wrap-up

With a single adapter and a handful of open-source tools you can breathe new life into the most popular GPON SFP sticks on the market. The SFP-to-TTL v1.2 makes the process trivial, so you can focus on exploring what lies beyond the vendor firmware — safely.

Questions or bricked sticks? Drop a comment below or open an issue; the community (and I) have got your back. Happy flashing!

Thomas

Thomas