Transceiver write protection types and programming methods

This article explains the different types of transceiver write protection in plain language and describes how to identify a module's protection method quickly and reprogram it successfully with an SFPTotal Mini or SFPTotal Plus coding board.

Unprotected transceivers

An unprotected SFP transceiver usually has an EEPROM chip on its circuit board. This chip stores the module's identification data and can be rewritten without restrictions or locks imposed by the module. Typically, only page A0h can be read, while reading page A2h returns an error. To program such a module, load the required firmware into the application and click <Write>. If writing succeeds, the application should return WRITE OK.

The main difficulty when programming these modules is choosing the correct write speed. EEPROM is relatively slow memory, so a data bus clock frequency of 1 kHz is preferable. This is ten times slower than the default SFPTotal coding board speed. You can easily change the speed in the application settings. The rest of the procedure is straightforward.

Hardware EEPROM write protection

Copper SFP RJ45 transceivers and DAC cables contain no optical components, so they have no laser driver and do not need DDM to monitor optical receiver and transmitter power. These modules are also often write protected. As with unprotected transceivers, their design is relatively simple, and a standard EEPROM chip stores the module's characteristics.

Manufacturers use various methods to block unwanted EEPROM changes and prevent unauthorized or accidental overwriting of module code. These protections serve a practical purpose: our customers have encountered accidental erasure or alteration of working module code caused by equipment faults.

Transceivers with hardware EEPROM protection use the memory chip's dedicated WP (Write Protect) pin.

When the WP pin is at a logic level equal to the supply voltage, writing is disabled and the memory is locked. To keep a module write protected during normal operation, this line is connected through a resistor to an SFP port power supply pin or to an output that defaults to a high logic level. As a result, the module's memory is read only when inserted into a switch port.

To make the module reprogrammable, a higher value resistor than the supply pull-up resistor is added to pull the WP line to ground. If the supply path is interrupted or the corresponding SFP line is forcibly connected to ground (never do this!), the memory chip's WP pin goes low and writing becomes possible.

Factories use specialized programmers that apply the required logic level to the pin controlling EEPROM write access.

SFPTotal coding boards provide dedicated controls for creating the conditions needed to reprogram modules with hardware write protection.

Password protected transceivers

Under the SFF-8472 MSA specification, transceivers with DDM support may implement password based write protection. The standard reserves seven bytes of page A2h for this purpose, although passwords are usually only four bytes long.

To program most write protected 1G and 10G transceivers successfully, enter the password before writing changes to module memory.

Modules use different hardware designs. A dedicated chip may control write access to a separate EEPROM chip or contain the memory itself. Attempting to write to such a module without a password, or with an incorrect password, returns WRITE FAIL.

In transceivers with a separate EEPROM chip, the protection circuit resembles the hardware lock described above. The difference is that a controller drives the memory chip's WP pin. It changes the control output after the correct password is written to the area starting at offset 7Bh on page A2h.

Other transceiver designs use controllers with integrated memory. Because they process data bus signals in software, these modules can be sensitive to write speed and the intervals between data blocks.

Knowing the correct password is sufficient to program these modules. If the password cannot be obtained, it may be found by trying all possible values or the most likely candidates, for example with a dictionary search.

What is a save command?

Some transceivers can be programmed successfully after entering a password but do not retain the changes after power is removed. When power is restored, the original code remains in memory.

During programming, these modules hold changes in temporary memory. They require special instructions, called a save command, to transfer the firmware from temporary memory to nonvolatile memory.

No common standard defines how to program these modules. Each manufacturer specifies its own sequence of instructions. Ideally, the manufacturer supplies the programming algorithm; otherwise, a suitable algorithm must be identified from known solutions.

Flexible scripts based on the SFPTotal command protocol are available for writing to these modules.

Combined protection

Some transceivers combine hardware locking, password entry and a save command.

For example, a module may refuse writes unless it is in low power mode, even when the correct password is used.

This approach has a practical reason: why reprogram a module while its optical transmitter is running at full power?

Combined protection is most often found in modules compliant with recent SFF-8472 revisions that support up to 256 pages in the upper memory area of page A2h, starting at offset 80h.

To program these transceivers, you must know the required sequence of operations on the available input and output pins and the manufacturer's programming algorithm in advance.

Summary

Unprotected transceivers can be programmed successfully by writing at an appropriate data bus clock frequency.

For transceivers with hardware protection, identify the line that controls the memory chip's write lock and put it into the required state before writing changes.

To program a password protected module, you need its password. Request it from your supplier or manufacturer, or look for it in official datasheets. If it is unavailable, use the password search function in the SFPTotal coding board software.

Modules that lose changes after power is removed require password entry and a save command to commit the changes to transceiver memory. This programming procedure can be implemented using scripts.

For modules with combined protection, you must know the programming procedure in advance. Companies purchasing modules in large quantities can obtain the necessary instructions from the manufacturer.

Our support team can help with questions about programming protected transceivers.