Kitz Forum

Broadband Related => Broadband Hardware => Topic started by: smallal on September 14, 2018, 02:03:27 PM

Title: Inside the Huawei MT992 G.FAST modem
Post by: smallal on September 14, 2018, 02:03:27 PM
I had G.FAST installed a couple of days ago, BT sent the HH6XA router through the post but the engineer was kind enough to let me have a MT992 off his van as well.
Had a peek inside the MT992 & noticed that although it only has 1 LAN port fitted, the board is made to have 2 ports. Could this be a way to hack it as with the HG612 VDSL model I wonder.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: j0hn on September 14, 2018, 02:40:31 PM
Do you own a USB to TTL serial cable?
Would it be something you would be willing to attempt?

edit: the original MT992-10 that the OpenReach variant comes from only has a single Ethernet port.

https://e.huawei.com/en/products/fixed-network/access/ft/mt992
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: underzone on September 14, 2018, 03:20:09 PM
Very interesting. Also worth a fortune on ebay right now! They are very hard to get hold of.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: burakkucat on September 14, 2018, 04:26:05 PM
Very interesting.

Agreed.  :)

However, after close scrutiny of both images, I do not see any obvious location (for header pins) to provide access to the serial console.  :(  I suspect that it will need someone with an oscilloscope, to probe various possible locations, to identify where such connections could be made.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: DaveC on September 14, 2018, 06:26:45 PM
Out of interest, did you also get a "G.fast" faceplate fitted on your master socket?  If so, I think there would be interest to see photos of the internals of that as well.

Thanks!
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: smallal on September 14, 2018, 07:00:18 PM
I don't think there is a G.FAST plate as such.
The engineer said I already had the correct plate, its a MK4.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: DaveC on September 14, 2018, 07:29:16 PM
I don't think there is a G.FAST plate as such.
The engineer said I already had the correct plate, its a MK4.

Interesting the engineer said that - there are photos circulating (I think originally from openreach documents) of a faceplate with "g.fast" written on it, but maybe that's just cosmetic (advertising g.fast), and the internals are the same as the MK4.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: smallal on September 15, 2018, 01:26:35 AM
I did notice the engineer had a new backbox & faceplate with him, but it was the same as I already have (MK4), so perhaps the photos were early versions of this plate.
Certainly it works fine as I'm getting the full 330/50 service (I'm only 80-90m from pod)
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: dee.jay on September 15, 2018, 11:39:08 AM
I did notice the engineer had a new backbox & faceplate with him, but it was the same as I already have (MK4), so perhaps the photos were early versions of this plate.
Certainly it works fine as I'm getting the full 330/50 service (I'm only 80-90m from pod)

Very nice! It's great to know that for those who can at least get it, are seeing the full 330Mbps.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: smallal on March 24, 2019, 11:15:58 AM
Bad news, BT/Openreach are currently trialling self-install for the BT Ultrafast service.
If all goes well they intend to go live across the country by June.
So the engineers carrying the MT992 modems on their vans won't now visit.
Lets hope some of the promised 3rd party G.Fast kit hits the market soon.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: hacktrix2006 on April 09, 2019, 12:43:49 AM
Ok second image shows a dot on a chip (Normally this is done with Bios chips be it on a mainboard or GPU),

Are you able to read the writing on that chip, as this might be a good place to start, specially since that chip is surrounded by pads for NAND/NOR flash.

Also do you know what that shield is holding?
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: toxo on November 18, 2020, 05:55:12 PM
Sorry to necropost but I've got one in pieces in front of me right now. The chip on the underside with the dot marked on it is a 128mbit SPI flash chip part 25Q128A13e40

Mine has a different LAN filter chip too, it's not the MNC H4001 that's shown in the first image on here but rather a Delta LFE8731. Does the same job but from a different vendor. Interestingly the LAN filter parts are meant to be for up to 4x100MBit interfaces but I guess they still work just fine on a gigabit port. Cost cutting from Huawei no doubt.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: hushcoden on November 19, 2020, 10:11:31 AM
Sorry to necropost but I've got one in pieces in front of me right now. The chip on the underside with the dot marked on it is a 128mbit SPI flash chip part 25Q128A13e40

Mine has a different LAN filter chip too, it's not the MNC H4001 that's shown in the first image on here but rather a Delta LFE8731. Does the same job but from a different vendor. Interestingly the LAN filter parts are meant to be for up to 4x100MBit interfaces but I guess they still work just fine on a gigabit port. Cost cutting from Huawei no doubt.
And can you confirm the access to its Web GUI is locked?
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: j0hn on November 19, 2020, 12:30:04 PM
And can you confirm the access to its Web GUI is locked?

I'm yet to see any evidence 1 exists, nevermind locked.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: toxo on November 24, 2020, 12:32:17 PM
Likewise, there is no evidence that there is one. I added a 2nd RJ45 port to the blank points on the board but unsurprisingly that doesn't work, you never get a link. It likely is disabled in the firmware, and may additionally also require some combination of surface mount resistors to 'present' it to the SoC. Difficult to trace that as it is a multi layered PCB and I have no datasheet or pinout for the SoC. Packet capture on the ethernet interface that does work yields nothing, regardless of powering on holding reset, pressing and holding reset once booted, etc etc. I've not found a combination that makes any difference. The 2nd ethernet interface doesn't magically spring into life if you power on holding reset, for example.

Next step is to remove that shield and see what's underneath. I'm tempted to order a buspirate too, to lift whatever is in that SPI chip on the underside.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: toxo on November 24, 2020, 01:11:38 PM
The answer to what's under the shield is in 2 parts. Part 1 is, the RAM (Samsung in this case). Mildly interesting that it is not integral to the SoC, and not much of a surprise that this is what's under the shield, as there's not a lot else that would really need shielding. Part 2 is, I slipped removing the shield and wiped a bunch of components off the board, so this MT992 is no more. Good job I've got another one coming next week, and now no-one else needs to try this ::)

Memory part is Samsung K481G1646G-BCK0 which Google tells me is 1GB of DDR3.

Amazon SPI flash reader is on the way so hopefully I can at least read that off this board before it goes in the bin.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: toxo on November 24, 2020, 04:28:25 PM
A bit more thought on the subject. The LAN filter chip as I mentioned before is meant for 4 100MBit ethernet interfaces. 100MBit ethernet over UTP only uses 2 pairs, i.e. 4 wires. The way the LAN filter is wired up on this board, the gigabit connection (which uses 4 pairs, or all 8 wires) is routed through the LAN filter as though it is 2 100MBit interfaces. This way 4 pairs go through the filter and half the capacity of the filter is used. It could still filter 2 x 100MBit connections or 1 x gigabit connection.

If you look closely below the LAN filter chip on the first photo in this thread you can see there are a bunch of surface mount components missing. This is the 'out' side of the filter - the LAN interface connects to the top of the chip which is 'in', then 'out' comes through these components before connecting to the SoC. These components are missing for the left half of the filter's 'out' connections, so the additional RJ45 connector I soldered on was never actually connected to the SoC. For an enthusiast to add the 2nd ethernet port, at least these components would need to be present, which is well outside of the realms of most enthusiasts as I think I have proven today with my de-shielding technique ;D I do have access to a PCB shop that could do this surface mount stuff for me but it seems a little pointless - very few others will have this so it doesn't benefit the community. I will still lift the flash chip and see what's in it though.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: adslmax on August 28, 2021, 11:41:58 PM
I don't think there is a G.FAST plate as such.
The engineer said I already had the correct plate, its a MK4.

Same here. MK4 engineer told me this perfect fine. Don't need G.fast plate.
Title: Re: Inside the Huawei MT992 G.FAST modem
Post by: meritez on August 29, 2021, 10:07:12 AM
Would the ZTLink MT992 be similar?