Those are not the ONT you are looking for. Try using the navigation {% if site.search_enabled != false %}or search {% endif %}to find what you're looking for or go to this site's home page.

This is not the ONT you are looking for. Try using the navigation bar {% if site.search_enabled != false %}or search {% endif %}to find what you're looking for or go to the website's home page.

diff --git a/_gpon/gpon-auth.md b/_gpon/gpon-auth.md index 4336c6ce..52a2dbd7 100644 --- a/_gpon/gpon-auth.md +++ b/_gpon/gpon-auth.md @@ -5,20 +5,20 @@ nav_order: 3 layout: default --- -The information on this page is taken from the GPON standard and information from the major vendors of GPON equipment, each individual item containing a verifiable citation in the standard. Feel free to cite this page as: `{{ page.title }}, Hack GPON. Available at: https://hack-gpon.github.io{{ page.url }}`. +The information on this page is taken from the GPON standard and information from the major vendors of GPON equipment, each individual item containing a verifiable citation in the standard. Feel free to cite this page as: `{{ page.title }}, Hack GPON. Available at: https://hack-gpon.org{{ page.url }}`. # ONU activation state: `Ox`[^huawei],[^standardgpon] -The process for an ONU to go online unconfigured involves five states: +The process for an unconfigured ONU to go online involves five states: - **`O1` Initial:** the OLT sends a message to the ONU to start the ONU, and the ONU enters the standby state; -- **`O2` Standby:** After receiving the message, the ONU extracts the delimiter value, power level, and pre-allocated compensation delay from the message, and adjusts its configurations accordingly to support subsequent information exchange. -- **`O3` Serial number:** The OLT sends a serial number (SN) request to the ONU. The ONU sends its SN to the OLT. After receiving the SN of the ONU, the OLT allocates a temporary ONU ID to the ONU. -- **`O4` Ranging:** The OLT sends a ranging request to the ONU. After receiving the ranging request from the OLT, the ONU responds with a message carrying its SN and ONU ID. The OLT calculates the compensation delay and sends it to the ONU in a message. After receiving the message, the ONU sets the compensation delay accordingly. +- **`O2` Standby:** After receiving the message, the ONU extracts the delimiter value, power level, and pre-allocated compensation delay from the message, and adjusts its configurations accordingly, to support subsequent information exchanges. +- **`O3` Serial number:** The OLT sends a serial number (SN) request to the ONU. The ONU sends its SN to the OLT. After receiving the ONU's SN, the OLT allocates a temporary ONU-ID to the ONU. +- **`O4` Ranging:** The OLT sends a ranging request to the ONU. After receiving the ranging request from the OLT, the ONU responds with a message carrying its SN and ONU-ID. The OLT calculates the compensation delay and sends it to the ONU in a message. After receiving the message, the ONU sets the compensation delay accordingly. - **`O5` Operation:** The OLT sends a password request to the ONU. The ONU returns a password to the OLT. - **`O6` Intermittent LODS state.** - **`O7` Emergency Stop state.** -The password is not configured on the OLT. If the automatic discovery function is enabled on the PON port of the OLT, the OLT reports an ONU auto-discovery alarm to the CLI or NMS. The ONU goes online normally only after being confirmed. +The password is not configured on the OLT: if the automatic discovery function is enabled on the OLT's PON port, the OLT reports an ONU auto-discovery alarm to the CLI or NMS. The ONU goes online normally only after being confirmed. ```mermaid graph TD @@ -40,7 +40,7 @@ graph TD There is a known issue with Alcatel/Nokia OLTs giving fake `O5` ONU Status, OLTs will hold OMCI Provisioning until correct OMCI Information is received. -It happens when the OLT detects that the ONT is `drunk`, so it tries to update the firmware before opening the GEM link. If this happens, the user has to try changing the software version or other data. +This happens when the OLT detects that the ONT is `drunk`, so it tries to update the firmware before opening the GEM link. If this happens, the user has to try changing the software version or other data. This is most likely to reduce logs from misconfigured ONTs and to be able to send updates automatically to ONTs. diff --git a/_gpon/mib.md b/_gpon/mib.md new file mode 100644 index 00000000..21613082 --- /dev/null +++ b/_gpon/mib.md @@ -0,0 +1,375 @@ +--- +title: GPON MIB +has_children: false +nav_order: 3 +layout: default +--- + +The OMCI standard is defined in a way such that suppliers can offer modular and incremental functionality to meet different levels of customer needs. + +The [^G_988] and [^G_984_4] standards define the protocol needed to handle all the features of the PON specifications ([^G_984_1], [^G_987], [^G_9807_1], ...), as well as a number of services and functionalities. +The standard was born with B-PON, then modified with G-PON and separated with XGS-PON. OMCI supports interoperability, yet it allows for optional components and future extensions. + +A protocol-independent MIB (Management Information Base) describes the exchange of information across OMCI [^G_988] and [^G_984_4]. This protocol is defined in terms of MEs. MEs are abstract representations of resources and services in an ONU. Only a small subset of the list of MEs is mandatory. + +The existence of other MEs depends on the architecture and feature set supported by the vendor's [^G_988] and [^G_984_4]. Major ISPs and vendors have created their own extensions for MIBs [^att_open_omci], [^verizon_open_omci]. + +Each ME consists of an entry ID and zero, one or more instances. Each instance has its own ID, usually starting at 0, but this is not always the case. Every instance has one or more attributes, each characterised by ID, size and content. + +Various MEs are often interrelated. Clause 8.2 of [^G_988] and [^G_984_4] shows the relationship graphs between the various MEs. +Clause 9 of [^G_988] and [^G_984_4] describes how the various MEs are created. There are formally 2 modes: a managed entity which is auto-instantiated by the ONT or a managed entity which is instantiated on explicit request by the OLT. +In each of the 2 cases the various MEs can be: (R), (W). Only for MEs auto-instantiated by the ONT there is also (R, W) while only for MEs auto-instantiated by the OLT there are also (R, Set-by-create), (W, Set-by-create), or (R, W, Set-by-create). + +| Mode | Description [^G_984_4] | +| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| (R) | On instantiation of the managed entity (either autonomously or on request of the OLT via a create action), the ONT sets the attribute to a default value. The OLT can only read the value of the attribute. In case of an autonomous attribute value change, the ONT will send an attribute value change notification to the OLT. | +| (W) | On instantiation of the managed entity (either autonomously or on request of the OLT via a create action), the ONT sets the attribute to a default value. The OLT can only write the value of the attribute. In case of an autonomous attribute value change, the ONT will NOT send an attribute value change notification to the OLT. | +| (R, W) | On instantiation of the managed entity (either autonomously or on request of the OLT via a create action), the ONT sets the attribute to a default value. The OLT can both read and write the value of the attribute. In case of an autonomous attribute value change, the ONT will send an attribute value change notification to the OLT. | +| (R, Set-by-create) | On instantiation of the managed entity (by necessity on request of the OLT via a create action), the ONT sets the attribute to the value specified in the create command. Subsequently, the OLT can only read the value of the attribute. In case of an autonomous attribute value change, the ONT will send an attribute value change notification to the OLT. | +| (W, Set-by-create) | On instantiation of the managed entity (by necessity on request of the OLT via a create action), the ONT sets the attribute to the value specified in the create command. Subsequently, the OLT can only write the value of the attribute. In case of an autonomous attribute value change, the ONT will NOT send an attribute value change notification to the OLT. | +| (R, W, Set-by-create) | On instantiation of the managed entity (by necessity on request of the OLT via a create action), the ONT sets the attribute to the value specified in the create command. Subsequently, the OLT can both read and write the value of the attribute. In case of an autonomous attribute value change, the ONT will send an attribute value change notification to the OLT. | + + +The following table is the result of combining the various tables in Table 8-1, Table 11-2 of [^G_984_4], Table 8-1, Table 11.2.4-1 of [^G_988], Table 1 of [^att_open_omci], Table B1 of [^verizon_open_omci]. + +The new ME introduced in G.988 [^G_988] do not have a description because G.988 abolished a summary description. In the corresponding ITU Clauses, all attrubits are described, and their purpose. + + +| Managed entity ID | Managed entity | Description G.984[^G_984_4] | Clause G.984[^G_984_4] | Clause G.988[^G_988] | AT&T Open OMCI[^att_open_omci] | Verizon Open OMCI[^verizon_open_omci] | Required/optional G.984[^G_984_4] | Mandatory G.987[^G_987], G.9807.1[^G_9807_1] | Mandatory G.989[^G_988] | Mandatory G.986[^G_988] | Mandatory IEEE 802.3, 802.3av[^G_988] | +| ----------------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------- | ------------------------------ | ------------------------------------- | --------------------------------- | -------------------------------------------- | ----------------------- | ----------------------- | ------------------------------------- | +| 1 | ONT[^B-PON] | | | | | | | | | | | +| 2 | ONU data | Used for OMCI MIB management | 9.1.3 | 9.1.3 | 5.1.3 | M | R | M | M | M | M | +| 3 | PON IF line cardholder | | | | | | | | | | | +| 4 | PON IF line card | | | | | | | | | | | +| 5 | Cardholder | Used for a circuit pack plug-in slot. Can also represent a virtual cardholder to distinguish types of ports in an integrated ONT | 9.1.5 | 9.1.5 | 5.1.5 | M | CR | M | M | | M | +| 6 | Circuit pack | Used for a plug-in circuit pack module. Can also represent a virtual circuit pack to distinguish types of ports in an integrated ONT | 9.1.6 | 9.1.6 | 5.1.6 | M | CR | | | | | +| 7 | Software image | Used for the software image of the ONT or its components that contain independently manageable software | 9.1.4 | 9.1.4 | 5.1.4 | M | R | M | M | | M | +| 8 | UNI[^B-PON] | | | | | | | | | | | +| 9 | TC Adapter[^B-PON] | | | | | | | | | | | +| 10 | Physical path termination point ATM UNI | | | | | | | | | | | +| 11 | Physical path termination point Ethernet UNI | Used for physical path termination point at the Ethernet UNI | 9.5.1 | 9.5.1 | 5.5.1 | M | CR | | | M | | +| 12 | Physical path termination point CES UNI | Used for physical path termination point at the CES UNI | 9.8.1 | 9.8.1 | | No | CR | | | | | +| 13 | Logical N × 64 kbit/s sub - port connection termination point (CTP) | Used as logical interface for structured CES | 9.8.2 | 9.8.2 | | No | CR | | | | | +| 14 | Interworking VCC termination point | Used for DSL ATM mode interworking | 9.13.4 | 9.13.4 | | No | CR | | | | | +| 15 | AAL 1 profile[^B-PON] | | | | | | | | | | | +| 16 | AAL 5 profile | Used for DSL ATM mode interworking | 9.13.5 | 9.13.5 | | No | CR | | | | N/A | +| 17 | AAL 1 protocol monitoring history data[^B-PON] | | | | | | | | | | | +| 18 | AAL 5 performance monitoring history data | Used for DSL ATM mode interworking | 9.13.6 | 9.13.6 | | No | CR | | | | N/A | +| 19 | AAL 2 profile | | | | | | | | | | | +| 20 | (Intentionally left blank) | | | | | | | | | | | +| 21 | (NOTE – In [^G_984_4] this was called CES service profile-G) | Used for CES services supported by the ONT | 9.8.3 | 9.8.3 | | No | CR | | | | | +| 22 | (Reserved) | | | | | | | | | | | +| 23 | CES physical interface performance monitoring history data | Used for CES interface performance monitoring | 9.8.4 | 9.8.4 | | No | O | | | | | +| 24 | Ethernet performance monitoring history data | Used for Ethernet interface performance monitoring | 9.5.2 | 9.5.2 | 5.5.2 | M | O | | | | | +| 25 | VP network CTP[^B-PON] | | | | | | | | | | | +| 26 | ATM VP cross-connection | | | | | | | | | | | +| 27 | Priority queue[^B-PON] | | | | | | | | | | | +| 28 | DBR/CBR traffic descriptor | | | | | | | | | | | +| 29 | UBR traffic descriptor | | | | | | | | | | | +| 30 | SBR1/VBR1 traffic descriptor | | | | | | | | | | | +| 31 | SBR2/VBR2 traffic descriptor | | | | | | | | | | | +| 32 | SBR3/VBR3 traffic descriptor | | | | | | | | | | | +| 33 | ABR traffic descriptor | | | | | | | | | | | +| 34 | GFR traffic descriptor | | | | | | | | | | | +| 35 | ABT/DT/IT traffic descriptor | | | | | | | | | | | +| 36 | UPC disagreement monitoring history data[^B-PON] | | | | | | | | | | | +| 37 | (Intentionally left blank) | | | | | | | | | | | +| 38 | ANI [^B-PON] | | | | | | | | | | | +| 39 | PON TC adapter | | | | | | | | | | | +| 40 | PON physical path termination point | | | | | | | | | | | +| 41 | TC adapter protocol monitoring history data | | | | | | | | | | | +| 42 | Threshold data[^B-PON] | | | | | | | | | | | +| 43 | Operator specific | | | | | | | | | | | +| 44 | Vendor specific | | | | | | | | | | | +| 45 | MAC bridge service profile | Used for MAC bridge supported by the ONT | 9.3.1 | 9.3.1 | 5.3.1 | M | CR | | | | | +| 46 | MAC bridge configuration data | Used for MAC bridge supported by the ONT | 9.3.2 | 9.3.2 | | M | CR | | | | | +| 47 | MAC bridge port configuration data | Used to organize and record data associated with a bridge port | 9.3.4 | 9.3.4 | 5.3.2 | M | CR | | | | | +| 48 | MAC bridge port designation data | Used for MAC bridge supported by the ONT | 9.3.5 | 9.3.5 | | No | CR | | | | | +| 49 | MAC bridge port filter table data | Used for MAC bridge supported by the ONT | 9.3.6 | 9.3.6 | | M | CR | | | | | +| 50 | MAC bridge port bridge table data | Used for MAC bridge supported by the ONT | 9.3.8 | 9.3.8 | | M | CR | | | | | +| 51 | MAC bridge performance monitoring history data | Used for MAC bridge performance monitoring | 9.3.3 | 9.3.3 | | M | O | | | | | +| 52 | MAC bridge port performance monitoring history data | Used for MAC bridge port performance monitoring | 9.3.9 | 9.3.9 | | M | O | | | | | +| 53 | Physical path termination point POTS UNI | Used for physical path trail termination point at the POTS UNI | 9.9.1 | 9.9.1 | 5.9.1 | M | CR | | | | | +| 54 | Voice CTP | | | | | | | | | | | +| 55 | Voice PM history data | | | | | | | | | | | +| 56 | AAL2 PVC profile[^B-PON] | | | | | | | | | | | +| 57 | AAL2 CPS protocol monitoring history data[^B-PON] | | | | | | | | | | | +| 58 | Voice service profile | Used for voice | 9.9.6 | 9.9.6 | 5.9.6 | No | CR | | | | | +| 59 | LES service profile | | | | | | | | | | | +| 60 | AAL2 SSCS parameter profile1 | | | | | | | | | | | +| 61 | AAL2 SSCS parameter profile2 | | | | | | | | | | | +| 62 | VP performance monitoring history data | Used for DSL ATM mode interworking | 9.13.10 | 9.13.10 | | No | CR | | | | | +| 63 | Traffic scheduler[^B-PON] | | | | | | | | | | | +| 64 | T-CONT buffer | | | | | | | | | | | +| 65 | UBR+ traffic descriptor | | | | | | | | | | | +| 66 | AAL2 SSCS protocol monitoring history data[^B-PON] | | | | | | | | | | | +| 67 | IP port configuration data | Used for IP port supported by the ONT | 9.4.3 | n/a | | M | CR | | | | | +| 68 | IP router service profile | Used for IP router supported by the ONT | 9.4.1 | n/a | | M | CR | | | | | +| 69 | IP router configuration data | Used for IP router supported by the ONT | 9.4.2 | n/a | | M | CR | | | | | +| 70 | IP router performance monitoring history data 1 | Used for IP router performance monitoring | 9.4.6 | n/a | | | O | | | | | +| 71 | IP router performance monitoring history data 2 | Used for IP router performance monitoring | 9.4.7 | n/a | | | O | | | | | +| 72 | ICMP performance monitoring history data 1 | Used for ICMP performance monitoring | 9.4.8 | n/a | | | O | | | | | +| 73 | ICMP performance monitoring history data 2 | Used for ICMP performance monitoring | 9.4.9 | n/a | | | O | | | | | +| 74 | IP route table | Used for IP router supported by the ONT | 9.4.4 | n/a | | M | CR | | | | | +| 75 | IP static routes | Used for IP router supported by the ONT | 9.4.5 | n/a | | M | CR | | | | | +| 76 | ARP service profile | Used for IP port supported by the ONT | 9.4.10 | n/a | | | CR | | | | | +| 77 | ARP configuration data | Used for IP port supported by the ONT | 9.4.11 | n/a | | | CR | | | | | +| 78 | VLAN tagging operation configuration data | | 9.3.12 | 9.3.12 | | No | | | | | | +| 79 | MAC bridge port filter pre - assign table | Used for Ethernet type filtering | 9.3.7 | 9.3.7 | | M | O | | | | | +| 80 | Physical path termination point ISDN UNI | Used for ISDN port supported by the ONT | 9.9.21 | n/a | | No | O | | | | | +| 81 | (Reserved) | | | | | | | | | | | +| 82 | Physical path termination point video UNI | Used for electrical video output port | 9.13.1 | 9.13.1 | | No | O | | | | | +| 83 | Physical path termination point LCT UNI | Used for local craft terminal port | 9.13.3 | 9.13.3 | | No | O | | | | | +| 84 | VLAN tagging filter data | Used for VLAN tagging | 9.3.11 | 9.3.11 | 5.3.4 | M | O | | | | | +| 85 | ONU[^B-PON] | | | | | | | | | | | +| 86 | ATM VC cross-connection | | | | | | | | | | | +| 87 | VC network CTP[^B-PON] | | | | | | | | | | | +| 88 | VC PM history data | | | | | | | | | | | +| 89 | Ethernet performance monitoring history data 2 | Used for Ethernet performance monitoring | 9.5.3 | 9.5.3 | | No | O | | | | | +| 90 | Physical path termination point video ANI | Used for optical RF video input port | 9.13.2 | 9.13.2 | | No | O | | | | | +| 91 | Physical path termination point IEEE 802.11 UNI | Used for 802.11 interface supported by the ONT | 9.6.1 | n/a | | | CR | | | | | +| 92 | IEEE 802.11 station management data 1 | Used for 802.11 interface supported by the ONT | 9.6.2 | n/a | | | CR | | | | | +| 93 | IEEE 802.11 station management data 2 | Used for 802.11 interface supported by the ONT | 9.6.3 | n/a | | | CR | | | | | +| 94 | IEEE 802.11 general purpose object | Used for 802.11 interface supported by the ONT | 9.6.4 | n/a | | | CR | | | | | +| 95 | IEEE 802.11 MAC and PHY operation and antenna data | Used for 802.11 interface supported by the ONT | 9.6.5 | n/a | | | CR | | | | | +| 96 | IEEE 802.11 performance monitoring history data | Used for 802.11 interface supported by the ONT | 9.6.7 | n/a | | | O | | | | | +| 97 | IEEE 802.11 PHY FHSS DSSS IR tables | Used for 802.11 interface supported by the ONT | 9.6.6 | n/a | | | CR | | | | | +| 98 | Physical path termination point xDSL UNI part 1 | Used for the physical path termination point at an xDSL CO modem | 9.7.1 | 9.7.1 | | No | CR | | | | | +| 99 | Physical path termination point xDSL UNI part 2 | Used for the physical path termination point at an xDSL CO modem | 9.7.2 | 9.7.2 | | No | CR | | | | | +| 100 | xDSL line inventory and status data part 1 | | 9.7.12 | 9.7.12 | | No | | | | | | +| 101 | xDSL line inventory and status data part 2 | Contains inventory and status information on an xDSL line | 9.7.13 | 9.7.13 | | No | CR | | | | | +| 102 | xDSL channel downstream status data | Contains status on a downstream xDSL channel | 9.7.19 | 9.7.19 | | No | CR | | | | | +| 103 | xDSL channel upstream status data | Contains status on an upstream xDSL channel | 9.7.20 | 9.7.20 | | No | CR | | | | | +| 104 | xDSL line configuration profile part 1 | Contains line parameters for an xDSL line | 9.7.3 | 9.7.3 | | No | CR | | | | | +| 105 | xDSL line configuration profile part 2 | Contains line parameters for an xDSL line | 9.7.4 | 9.7.4 | | No | CR | | | | | +| 106 | xDSL line configuration profile part 3 | Contains line parameters for an xDSL line | 9.7.5 | 9.7.5 | | No | CR | | | | | +| 107 | xDSL channel configuration profile | Contains configuration for an xDSL channel | 9.7.7 | 9.7.7 | | No | CR | | | | | +| 108 | xDSL subcarrier masking downstream profile | Contains masking information for the downstream subcarriers | 9.7.8 | 9.7.8 | | No | CR | | | | | +| 109 | xDSL subcarrier masking upstream profile | Contains masking information for the upstream subcarriers | 9.7.9 | 9.7.9 | | No | CR | | | | | +| 110 | xDSL PSD mask profile | Contains PSD masking information | 9.7.10 | 9.7.10 | | No | CR | | | | | +| 111 | xDSL downstream radio frequency interference (RFI) bands profile | Contains information on the downstream RFI bands | 9.7.11 | 9.7.11 | | No | CR | | | | | +| 112 | xDSL xTU-C performance monitoring history data | Performance monitoring data for an xDSL xTU-C modem path | 9.7.21 | 9.7.21 | | No | O | | | | | +| 113 | xDSL xTU-R performance monitoring history data | Performance monitoring data for an xDSL xTU-R modem path | 9.7.22 | 9.7.22 | | No | O | | | | | +| 114 | xDSL xTU-C channel performance monitoring history data | Performance monitoring data for an xDSL xTU-C channel | 9.7.23 | 9.7.23 | | No | O | | | | | +| 115 | xDSL xTU-R channel performance monitoring history data | Performance monitoring data for an xDSL xTU-R channel | 9.7.24 | 9.7.24 | | No | O | | | | | +| 116 | TC adaptor performance monitoring history data xDSL | Performance monitoring data for the xDSL ATM data path | 9.7.25 | 9.7.25 | | No | O | | | | | +| 117 | Physical path termination point VDSL UNI (ITU-T G.993.1 VDSL1) | | | | | | | | | | | +| 118 | VDSL VTU-O physical data | | | | | | | | | | | +| 119 | VDSL VTU-R physical data | | | | | | | | | | | +| 120 | VDSL channel data | | | | | | | | | | | +| 121 | VDSL line configuration profile | | | | | | | | | | | +| 122 | VDSL channel configuration profile | | | | | | | | | | | +| 123 | VDSL band plan configuration profile | | | | | | | | | | | +| 124 | VDSL VTU-O physical interface monitoring history data | | | | | | | | | | | +| 125 | VDSL VTU-R physical interface monitoring history data | | | | | | | | | | | +| 126 | VDSL VTU-O channel performance monitoring history data | | | | | | | | | | | +| 127 | VDSL VTU-R channel performance monitoring history data | | | | | | | | | | | +| 128 | Video return path service profile | Used for video return path management | 9.13.7 | n/a | | | CR | | | | | +| 129 | Video return path performance monitoring history data | Used for video return path management | 9.13.8 | n/a | | | CR | | | | | +| 130 | IEEE 802.1p mapper service profile | Used for 802.1p priority Ethernet UNI | 9.3.10 | 9.3.10 | 5.3.3 | M | CR | | | | | +| 131 | OLT-G | Used for OLT identification for interoperability facilitation | 9.12.2 | 9.12.2 | 5.12.2 | M | O | | | | | +| 132 | Multicast interworking VCC termination point | | | | | | | | | | | +| 133 | ONU power shedding | Used to control the power shedding service | 9.1.7 | 9.1.7 | 5.1.7 | M | CR | | | | | +| 134 | IP host config data | Used to define the Internet protocol service that may be used with a MAC bridge port. Member of IPHostData group | 9.4.12 | 9.4.1 | 5.4.1 | | CR | | | | | +| 135 | IP host performance monitoring history data | Used to hold PM counters and alarms for the IP host. Member of IPHostData group | 9.4.13 | 9.4.2 | 5.4.2 | | O | | | | | +| 136 | TCP/UDP config data | Used for the TCP or UDP configuration for a TCP/UDP service. Member of IPHostData group | 9.4.14 | 9.4.3 | 5.4.3 | | CR | | | | | +| 137 | Network address | Used to bind a network address (URI, IP address) to its associated security method. Member of IPHostData group | 9.12.3 | 9.12.3 | 5.12.3 | M | CR | | | | | +| 138 | VoIP config data | Used to discover VoIP signalling protocols supported and select a VoIP signalling to use. Also used to select a VoIP configuration method. Member of VoIPData group | 9.9.18 | 9.9.18 | 5.9.12 | M | CR | | | | | +| 139 | VoIP voice CTP | Used for VoIP voice channel termination point. Member of VoIPData group | 9.9.4 | 9.9.4 | 5.9.4 | No | CR | | | | | +| 140 | Call control performance monitoring history data | Used for call control performance monitoring history. Member of VoIPData group | 9.9.12 | 9.9.12 | | M | O | | | | | +| 141 | VoIP line status | Used for VoIP line status that relates to a POTS port. Member of VoIPData group | 9.9.11 | 9.9.11 | | M | O | | | | | +| 142 | VoIP media profile | Used to define codec and other media selection criteria. Member of VoIPData group | 9.9.5 | 9.9.5 | 5.9.5 | No | CR | | | | | +| 143 | RTP profile data | Used for RTP configuration for VoIP service | 9.9.7 | 9.9.7 | 5.9.7 | No | CR | | | | | +| 144 | RTP performance monitoring history data | Used to hold the last completed 15 minutes interval PM data for RTP. Member of VoIPData group | 9.9.13 | 9.9.13 | | M | O | | | | | +| 145 | Network dial plan table | Used to support network-defined dial plans. Member of VoIPData group | 9.9.10 | 9.9.10 | | No | O | | | | | +| 146 | VoIP application service profile | Used for VoIP calling feature services. Member of VoIPData group | 9.9.8 | 9.9.8 | | No | O | | | | | +| 147 | VoIP feature access codes | Used to define feature access codes for a POTS port. Member of VoIPData group | 9.9.9 | 9.9.9 | | No | O | | | | | +| 148 | Authentication security method | Used for the user id/password configuration to associate an IP session between the client and destination server | 9.12.4 | 9.12.4 | 5.12.4 | M | O | | | | | +| 149 | SIP config portal | Used to view SIP configuration when the IP path is being used to manage SIP. Member of SIPrelatedData group | 9.9.19 | 9.9.19 | | M | CR | | | | | +| 150 | SIP agent config data | Used to define a VoIP SIP agent configuration. Member of SIPrelatedData group | 9.9.3 | 9.9.3 | 5.9.3 | No | CR | | | | | +| 151 | SIP agent performance monitoring history data | Used for statistics for the VoIP SIP agent. Member of SIPrelatedData group | 9.9.14 | 9.9.14 | 5.9.8 | M | O | | | | | +| 152 | SIP call initiation performance monitoring history data | Used for statistics for the VoIP SIP agent. Member of SIPrelatedData group | 9.9.15 | 9.9.15 | 5.9.9 | M | O | | | | | +| 153 | SIP user data | Used for user (subscriber) specific SIP data. Member of SIPrelatedData group | 9.9.2 | 9.9.2 | 5.9.2 | No | CR | | | | | +| 154 | MGC config portal | Used to view H.248 configuration when the IP path is being used to manage H.248. Member of H248relatedData group | 9.9.20 | 9.9.20 | | M | CR | | | | | +| 155 | MGC config data | Used for configuration data associated with an MGC client. Member of H248relatedData group | 9.9.16 | 9.9.16 | 5.9.10 | M | CR | | | | | +| 156 | MGC performance monitoring history data | Used for run-time attributes and statistics associated with an active MGC client. Member of H248relatedData group | 9.9.17 | 9.9.17 | 5.9.11 | M | O | | | | | +| 157 | Large string | Used to hold a character string larger than 25 bytes and up to 375 bytes | 9.12.5 | 9.12.5 | 5.12.5 | M | CR | | | | | +| 158 | ONU remote debug | Used to allow remote debugging of an ONT | 9.1.12 | 9.1.12 | 5.1.8 | M | CR | | | | | +| 159 | Equipment protection profile | Defines equipment protection groups | 9.1.11 | 9.1.11 | | M | CR | | | | | +| 160 | Equipment extension package | Used for additional attributes that may be associated with an ONT or cardholder | 9.1.9 | 9.1.9 | | No | O | | | | | +| 161 | Port-mapping package[^B-PON] (use 297 for G-PON) | | | | | | | | | | | +| 162 | Physical path termination point MoCA UNI | Used for the physical path termination point for MoCA interfaces | 9.10.1 | 9.10.1 | | No | CR | | | | | +| 163 | MoCA Ethernet performance monitoring history data | Performance monitoring data for the Ethernet layer on the MoCA interface | 9.10.2 | 9.10.2 | | No | O | | | | | +| 164 | MoCA interface performance monitoring history data | Performance monitoring data for the physical layer on the MoCA interface | 9.10.3 | 9.10.3 | | No | O | | | | | +| 165 | VDSL2 line configuration extensions | Contains xDSL attributes unique to VDSL2 (G.993.2) | 9.7.6 | 9.7.6 | | No | CR | | | | | +| 166 | xDSL line inventory and status data part 3 | Contains additional test and status attributes for xDSL lines | 9.7.14 | 9.7.14 | | No | CR | | | | | +| 167 | xDSL line inventory and status data part 4 | Contains additional test and status attributes for xDSL lines | 9.7.15 | 9.7.15 | | No | CR | | | | | +| 168 | VDSL2 line inventory and status data part 1 | Contains additional test and status attributes for xDSL lines, specifically, extensions for VDSL2 | 9.7.16 | 9.7.16 | | No | CR | | | | | +| 169 | VDSL2 line inventory and status data part 2 | Contains additional test and status attributes for xDSL lines, specifically, extensions for VDSL2 | 9.7.17 | 9.7.17 | | No | CR | | | | | +| 170 | VDSL2 line inventory and status data part 3 | Contains additional test and status attributes for xDSL lines, specifically, extensions for VDSL2 | 9.7.18 | 9.7.18 | | No | CR | | | | | +| 171 | Extended VLAN tagging operation configuration data | Contains configuration parameters for enhanced VLAN operations, including adding, removing and changing multiple tags | 9.3.13 | 9.3.13 | 5.3.5 | M | CR | | | | | +| 172-239 | Reserved for future [^B-PON] managed entities | | | | | | | | | | | +| 240-255 | Reserved for vendor-specific managed entities | | | | | | | | | | | +| 256 | ONU-G (NOTE – In [^G_984_4] this was called ONT-G) | Used for ONT equipment management | 9.1.1 | 9.1.2 | 5.1.1 | M | R | M | M | | M | +| 257 | ONU2-G (NOTE – In [^G_984_4] this was called ONT2-G) | Used for ONT equipment management | 9.1.2 | 9.1.1 | 5.1.2 | M | R | M | M | | M | +| 258 | ONU-G (deprecated – note that the name is re-used for code point 256) | | | | | | | | | | | +| 259 | ONU2-G (deprecated – note that the name is re-used for code point 257) | | | | | | | | | | | +| 260 | PON IF line card-G | | | | | | | | | | | +| 261 | PON TC adapter-G | | | | | | | | | | | +| 262 | T-CONT | Used for DBA | 9.2.2 | 9.2.2 | 5.2.2 | M | R | M | M | | M | +| 263 | ANI-G | Used for ANI management | 9.2.1 | 9.2.1 | 5.2.1 | M | R | M | M | | M | +| 264 | UNI-G | Used for user network interface for GEM service | 9.12.1 | 9.12.1 | 5.12.1 | M | CR | | | | | +| 265 | ATM interworking VCC termination point | | | | | | | | | | | +| 266 | GEM interworking termination point | Used for non-ATM UNIs and GEM-based connections | 9.2.4 | 9.2.4 | 5.2.4 | M | CR | M | M | | M/E | +| 267 | GEM port performance monitoring history data (obsolete) | Used for GEM port performance monitoring | 9.2.6 | n/a | | | O | | | | | +| 268 | GEM port network CTP | Used for GEM port termination | 9.2.3 | 9.2.3 | 5.2.3 | M | CR | M | M | | M/E | +| 269 | VP network CTP (NOTE – In [^G_984_4] this was called VP network CTP-G) | Used for DSL ATM mode interworking | 9.13.9 | 9.13.9 | | No | CR | | | | | +| 270 | VC network CTP-G | | | | | | | | | | | +| 271 | GAL TDM profile (deprecated) | Used when the ONT supports GAL TDM | 9.2.9 | n/a | | M | O | | | | | +| 272 | GAL Ethernet profile | Used when the ONT supports GAL Ethernet | 9.2.7 | 9.2.7 | 5.2.6 | M | O | | | | N/A | +| 273 | Threshold data 1 | Used for PM threshold values | 9.12.6 | 9.12.6 | 5.12.6 | M | CR | | | | | +| 274 | Threshold data 2 | Used for PM threshold values | 9.12.7 | 9.12.7 | 5.12.7 | M | CR | | | | | +| 275 | GAL TDM performance monitoring history data (deprecated) | Used when GAL TDM layer performance monitoring is supported | 9.2.10 | n/a | | M | O | | | | | +| 276 | GAL Ethernet performance monitoring history data | Used when GAL Ethernet layer performance monitoring is supported | 9.2.8 | 9.2.8 | | M | O | | | | N/A | +| 277 | Priority queue (NOTE – In [^G_984_4] this was called Priority queue-G) | Used for ONTs that support priority queues to multiplex ATM or GEM traffic flows | 9.11.1 | 9.2.10 | 5.2.8 | | CR | | | | | +| 278 | Traffic scheduler (NOTE – In [^G_984_4] this was called Traffic scheduler-G) | Used for DBA | 9.11.2 | 9.2.11 | 5.2.9 | | CR | | | | | +| 279 | Protection data | Used for PON protection | 9.1.10 | 9.1.10 | | M | CR | | | | | +| 280 | Traffic descriptor (NOTE – In [^G_984_4] this was called GEM traffic descriptor) | Used for GEM-based connections | 9.11.3 | 9.2.12 | 5.2.10 | | CR | | | | | +| 281 | Multicast GEM interworking termination point | Used to manage multicasting support for GEM connection | 9.2.5 | 9.2.5 | 5.2.5 | M | CR | | | | | +| 282 | Pseudowire termination point | Used when the ONT supports the pseudowire function | 9.8.5 | 9.8.5 | | No | CR | | | | | +| 283 | RTP pseudowire parameters | Used when the ONT supports the pseudowire function | 9.8.6 | 9.8.6 | | No | CR | | | | | +| 284 | Pseudowire maintenance profile | Used when the ONT supports the pseudowire function | 9.8.7 | 9.8.7 | | No | CR | | | | | +| 285 | Pseudowire performance monitoring history data | Used when the ONT supports the pseudowire function | 9.8.8 | 9.8.8 | | No | CR | | | | | +| 286 | Ethernet flow termination point | Used when the ONT supports the pseudowire function over layer 2 | 9.8.9 | 9.8.9 | | No | CR | | | | | +| 287 | OMCI | Used when OMCI self-description is supported | 9.12.8 | 9.12.8 | 5.12.8 | No | CR | | | | | +| 288 | Managed entity | Used when OMCI self-description is supported | 9.12.9 | 9.12.9 | | No | CR | | | | | +| 289 | Attribute | Used when OMCI self-description is supported | 9.12.10 | 9.12.10 | | No | CR | | | | | +| 290 | Dot1X port extension package | Used for 802.1X control | 9.3.14 | 9.3.14 | 5.3.6 | No | CR | | | | | +| 291 | Dot1X configuration profile | Used for 802.1X control | 9.3.15 | 9.3.15 | | No | CR | | | | | +| 292 | Dot1X performance monitoring history data | Used for 802.1X control | 9.3.16 | 9.3.16 | | No | CR | | | | | +| 293 | Radius performance monitoring history data | Used for 802.1X radius client PM | 9.3.17 | 9.3.17 | | No | CR | | | | | +| 294 | TU CTP | Organizes data that describes the VC path adaptation processing functions of the ONT for SDH services | 9.8.10 | n/a | | | CR | | | | | +| 295 | TU performance monitoring history data | Performance monitoring data collected as a result of TU connection monitoring | 9.8.11 | n/a | | | O | | | | | +| 296 | Ethernet performance monitoring history data 3 | Used for Ethernet performance monitoring (RMON) | 9.5.4 | 9.5.4 | | No | O | | | | | +| 297 | Port-mapping package (NOTE – In [^G_984_4] this was called Port mapping package-G) | Used to map heterogeneous ports to an equipment entity | 9.1.8 | 9.1.8 | | M | O | | | | | +| 298 | Dot1 rate limiter | Provides for limiting and policing upstream traffic | 9.3.18 | 9.3.18 | | M | CR | | | | | +| 299 | Dot1ag maintenance domain | Supports 802.1ag configuration fault management | 9.3.19 | 9.3.19 | 5.3.7 | M | O | | | | | +| 300 | Dot1ag maintenance association | Supports 802.1ag configuration fault management | 9.3.20 | 9.3.20 | 5.3.8 | M | O | | | | | +| 301 | Dot1ag default MD level | Supports 802.1ag configuration fault management | 9.3.21 | 9.3.21 | | M | O | | | | | +| 302 | Dot1ag MEP | Supports 802.1ag configuration fault management | 9.3.22 | 9.3.22 | 5.3.9 | M | O | | | | | +| 303 | Dot1ag MEP status | Supports 802.1ag configuration fault management | 9.3.23 | 9.3.23 | | M | O | | | | | +| 304 | Dot1ag MEP CCM database | Supports 802.1ag configuration fault management | 9.3.24 | 9.3.24 | | M | O | | | | | +| 305 | Dot1ag CFM stack | Supports 802.1ag configuration fault management | 9.3.25 | 9.3.25 | 5.3.10 | M | O | | | | | +| 306 | Dot1ag chassis - management info | Supports 802.1ag configuration fault management | 9.3.26 | 9.3.26 | | M | O | | | | | +| 307 | Octet string | Allows for strings of up to 375 arbitrary octet values | 9.12.11 | 9.12.11 | | M | O | | | | | +| 308 | General purpose buffer | Used to return large blocks of data; structure defined with each specific application | 9.12.12 | 9.12.12 | | M | O | | | | | +| 309 | Multicast operations profile | Used to manage multicast at the ONT | 9.3.27 | 9.3.27 | 5.3.11 | M | CR | | | | | +| 310 | Multicast subscriber config info | Used to manage multicast at the ONT | 9.3.28 | 9.3.28 | 5.3.12 | M | CR | | | | | +| 311 | Multicast subscriber monitor | Used to manage multicast at the ONT | 9.3.29 | 9.3.29 | | M | O | | | | | +| 312 | FEC performance monitoring history data | Performance monitoring data for FEC on an ANI-G | 9.2.11 | 9.2.9 | 5.2.7 | M | O | | | | | +| 313 | RE ANI-G | | n/a | 9.14.1 | | | | | | | | +| 314 | Physical path termination point RE UNI | | n/a | 9.14.2 | | | | | | | | +| 315 | RE upstream amplifier | | n/a | 9.14.3 | | | | | | | | +| 316 | RE downstream amplifier | | n/a | 9.14.4 | | | | | | | | +| 317 | RE config portal | | n/a | 9.14.5 | | | | | | | | +| 318 | File transfer controller | | n/a | 9.12.13 | | | | | | | | +| 319 | CES physical interface performance monitoring history data 2 | | n/a | 9.8.12 | | | | | | | | +| 319 | CES physical interface performance monitoring history data 2 | | n/a | 9.8.12 | | | | | | | | +| 320 | CES physical interface performance monitoring history data 3 | | n/a | 9.8.13 | | | | | | | | +| 321 | Ethernet frame performance monitoring history data downstream | | n/a | 9.3.31 | 5.3.13 | | | | | | | +| 322 | Ethernet frame performance monitoring history data upstream | | n/a | 9.3.30 | 5.3.14 | | | | | | | +| 323 | VDSL2 line configuration extensions 2 | | n/a | 9.7.26 | | | | | | | | +| 324 | xDSL impulse noise monitor performance monitoring history data | | n/a | 9.7.27 | | | | | | | | +| 325 | xDSL line inventory and status data part 5 | | n/a | 9.7.28 | | | | | | | | +| 326 | xDSL line inventory and status data part 6 | | n/a | 9.7.29 | | | | | | | | +| 327 | xDSL line inventory and status data part 7 | | n/a | 9.7.30 | | | | | | | | +| 328 | RE common amplifier parameters | | n/a | 9.14.6 | | | | | | | | +| 329 | Virtual Ethernet interface point | | n/a | 9.5.5 | 5.5.3 | | | | | | | +| 330 | Generic status portal | | n/a | 9.12.14 | | | | | | | | +| 331 | ONU-E | | n/a | 9.1.13 | | | | | | M | N/A | +| 332 | Enhanced security control | | n/a | 9.13.11 | 5.13.1 | | | | | | | +| 333 | MPLS pseudowire termination point | | n/a | 9.8.14 | 5.13.1 | | | | | | | +| 334 | Ethernet frame extended PM | | n/a | 9.3.32 | | | | 9.3.34 | | | | +| 335 | Simple network management protocol (SNMP) configuration data | | n/a | 9.12.15 | 5.12.9 | | | | | | | +| 336 | ONU dynamic power management control | | n/a | 9.1.14 | 5.1.9 | | | | | | | +| 337 | PW ATM configuration data | | n/a | 9.8.15 | | | | | | | | +| 338 | PW ATM performance monitoring history data | | n/a | 9.8.16 | | | | | | | | +| 339 | PW Ethernet configuration data | | n/a | 9.8.17 | | | | | | | | +| 340 | BBF TR-069 management server | | n/a | 9.12.16 | 5.12.10 | | | | | | | +| 341 | GEM port network CTP performance monitoring history data | | n/a | 9.2.13 | 5.2.11 | | | | | | N/A | +| 342 | TCP/UDP performance monitoring history data | | n/a | 9.4.4 | | | | | | | | +| 343 | Energy consumption performance monitoring history data | | n/a | 9.2.14 | | | | | | | | +| 344 | XG-PON TC performance monitoring history data | | n/a | 9.2.15 | 5.2.12 | | | | | | | +| 345 | XG-PON downstream management performance monitoring history data | | n/a | 9.2.16 | 5.2.13 | | | | | | | +| 346 | XG-PON upstream management performance monitoring history data | | n/a | 9.2.17 | 5.2.14 | | | | | | | +| 347 | IPv6 host config data | | n/a | 9.4.5 | | | | | | | | +| 348 | MAC bridge port ICMPv6 process pre-assign table | | n/a | 9.3.33 | | | | | | | | +| 349 | Power over Ethernet (PoE) control | | n/a | 9.5.6 | 5.5.4 | | | | | | | +| 400 | Ethernet pseudowire parameters | | n/a | 9.8.18 | | | | | | | | +| 401 | Physical path termination point RS232/RS485 UNI | | n/a | 9.15.1 | | | | | | | | +| 402 | RS232/RS485 port operation configuration data | | n/a | 9.15.3 | | | | | | | | +| 403 | RS232/RS485 performance monitoring history data | | n/a | 9.15.2 | | | | | | | | +| 404 | L2 multicast GEM interworking termination point | | n/a | 9.2.18 | | | | | | | | +| 405 | ANI-E | | n/a | 9.2.19 | | | | | | | M | +| 406 | EPON downstream performance monitoring configuration | | n/a | 9.2.20 | | | | | | | | +| 407 | SIP agent config data 2 | | n/a | 9.9.21 | | | | | | | | +| 408 | xDSL xTU-C performance monitoring history data part 2 | | n/a | 9.7.31 | | | | | | | | +| 409 | PTM performance monitoring history data xDSL | | n/a | 9.7.32 | | | | | | | | +| 410 | VDSL2 line configuration extensions 3 | | n/a | 9.7.33 | | | | | | | | +| 411 | Vectoring line configuration extensions | | n/a | 9.7.34 | | | | | | | | +| 412 | xDSL channel configuration profile part 2 | | n/a | 9.7.35 | | | | | | | | +| 413 | xTU data gathering configuration | | n/a | 9.7.36 | | | | | | | | +| 414 | xDSL line inventory and status data part 8 | | n/a | 9.7.37 | | | | | | | | +| 415 | VDSL2 line inventory and status data part 4 | | n/a | 9.7.38 | | | | | | | | +| 416 | Vectoring line inventory and status data | | n/a | 9.7.39 | | | | | | | | +| 417 | Data gathering line test, diagnostic and status | | n/a | 9.7.40 | | | | | | | | +| 419 | EFM bonding group | | n/a | 9.7.41 | | | | | | | | +| 420 | EFM bonding link | | n/a | 9.7.42 | | | | | | | | +| 421 | EFM bonding group performance monitoring history data | | n/a | 9.7.43 | | | | | | | | +| 422 | EFM bonding group performance monitoring history data part 2 | | n/a | 9.7.44 | | | | | | | | +| 423 | EFM bonding link performance monitoring history data | | n/a | 9.7.45 | | | | | | | | +| 424 | EFM bonding port performance monitoring history data | | n/a | 9.7.46 | | | | | | | | +| 425 | EFM bonding port performance monitoring history data part 2 | | n/a | 9.7.47 | | | | | | | | +| 426 | Ethernet frame extended PM 64 bit | | n/a | 9.3.34 | | | | | | | | +| 427 | Physical path termination point xDSL UNI part 3 | | n/a | 9.7.48 | | | | | | | | +| 428 | FAST line configuration profile part 1 | | n/a | 9.7.49 | | | | | | | | +| 429 | FAST line configuration profile part 2 | | n/a | 9.7.50 | | | | | | | | +| 430 | FAST line configuration profile part 3 | | n/a | 9.7.51 | | | | | | | | +| 431 | FAST line configuration profile part 4 | | n/a | 9.7.52 | | | | | | | | +| 432 | FAST channel configuration profile | | n/a | 9.7.53 | | | | | | | | +| 433 | FAST data path configuration profile | | n/a | 9.7.54 | | | | | | | | +| 434 | FAST vectoring line configuration extensions | | n/a | 9.7.55 | | | | | | | | +| 435 | FAST line inventory and status data | | n/a | 9.7.56 | | | | | | | | +| 436 | FAST line inventory and status data part 2 | | n/a | 9.7.57 | | | | | | | | +| 437 | FAST xTU-C performance monitoring history data | | n/a | 9.7.58 | | | | | | | | +| 438 | FAST xTU-R performance monitoring history data | | n/a | 9.7.59 | | | | | | | | +| 439 | OpenFlow config data | | n/a | 9.12.18 | | | | | | | | +| 440 | Time Status Message | | | | | | | | | | | +| 441 | ONU3-G | | n/a | 9.1.15 | | | | | M | | | +| 442 | TWDM System Profile managed entity | | n/a | 9.16.1 | | | | | M | | | +| 443 | TWDM channel managed entity | | n/a | 9.16.2 | | | | | M | | | +| 444 | TWDM channel PHY/LODS performance monitoring history data | | n/a | 9.16.3 | | | | | | | | +| 445 | TWDM channel XGEM performance monitoring history data | | n/a | 9.16.4 | | | | | | | | +| 446 | TWDM channel PLOAM performance monitoring history data part 1 | | n/a | 9.16.5 | | | | | | | | +| 447 | TWDM channel PLOAM performance monitoring history data part 2 | | n/a | 9.16.6 | | | | | | | | +| 448 | TWDM channel PLOAM performance monitoring history data part 3 | | n/a | 9.16.7 | | | | | | | | +| 449 | TWDM channel tuning performance monitoring history data part 1 | | n/a | 9.16.8 | | | | | | | | +| 450 | TWDM channel tuning performance monitoring history data part 2 | | n/a | 9.16.9 | | | | | | | | +| 451 | TWDM channel tuning performance monitoring history data part 3 | | n/a | 9.16.10 | | | | | | | | +| 452 | TWDM channel OMCI performance monitoring history data | | n/a | 9.16.11 | | | | | | | | +| 350-399 | Reserved for vendor-specific use | | | | | | | | | | | +| 453-65279 | Reserved for future standardization | | | | | | | | | | | +| 65280-65535 | Reserved for vendor-specific use | | | | | | | | | | | + + +--- + +[^G_984_1]: *Gigabit-capable passive optical networks (GPON): General characteristics* https://www.itu.int/rec/T-REC-G.984.1 +[^G_988]: *G.988: ONU management and control interface (OMCI) specification* https://www.itu.int/rec/T-REC-G.988 +[^G_984_4]: *G.984.4: Gigabit-capable Passive Optical Networks (G-PON): ONT management and control interface specification* https://www.itu.int/rec/T-REC-G.988 +[^G_987]: *G.987: 10-Gigabit-capable passive optical network (XG-PON) systems: Definitions, abbreviations and acronyms* https://www.itu.int/rec/T-REC-G.987 +[^G_9807_1]: *G.9807.1: 10-Gigabit-capable symmetric passive optical network (XGS-PON)* https://www.itu.int/rec/T-REC-G.9807.1 +[^att_open_omci]: *AT&T Open OMCI Specification, Edition 3.0, 6/23/17* +[^verizon_open_omci]: *Verizon OpenOMCI Specification, Version 1.00 June 30, 2017* +[^B-PON]: MIB for legacy B-PON + diff --git a/_gpon/ont.md b/_gpon/ont.md index 84bb5581..2e6e0f58 100644 --- a/_gpon/ont.md +++ b/_gpon/ont.md @@ -15,7 +15,7 @@ Currently, there are only a few main GPON chipset vendors: - RTL9601B - RTL9601CI (HSGMII) - RTL9601D (HSGMII) - * RTL9602/RTL9603 series (for router with integrated PON) + * RTL9602/RTL9603 series (for routers with integrated PON) * Cortina QWCS8032E - Lantiq: * PEB98035 (HSGMII) diff --git a/_gpon/pptp_veip.md b/_gpon/pptp_veip.md new file mode 100644 index 00000000..f904abbe --- /dev/null +++ b/_gpon/pptp_veip.md @@ -0,0 +1,145 @@ +--- +title: GPON PPTP and VEIP +has_children: false +nav_order: 3 +layout: default +--- + +ONTs are the terminating elements of every PON network and play an essential role in the PON architecture. The ONT converts the optical media into an electrical interface and takes care of authenticating, monitoring, processing as well as managing all matters related to the GPON tree. Often these devices are installed directly in users' homes[^hsgp_hg_sfu]. + +Three layers can be identified in the ONT: core layer, service layer and public layer. +- The core layer provides multiplexing and the optical interface; +- the service layer refers mainly to the user port; +- the public layer provides power and maintenance management[^hsgp_hg_sfu]. + +ONTs can connect to various terminal devices, such as set-top boxes, wireless routers, TVs, etc., and perform photoelectric conversion, maintenance and monitoring functions. According to the application, ONTs can be divided into six types, namely[^hsgp_hg_sfu]: +- SFU (Single Family Unit) ONT +- HGU (Home Gateway Unit) ONT +- MDU (Multi-Dwelling Unit) ONT +- SBU (Single Business Unit) ONT +- MTU (Multi-Tenant Unit) ONT +- CBU (Cellular Backhaul Unit) ONT + +However, only SFU ONTs and HGU ONTs are used by end-users in practical application. + +HGU ONTs are a home gateway with a PON uplink interface; they're designed for use in single home units. HGU ONTs integrate the functions of ONTs and RGs to realize more complex control and management and also provide Ethernet / IP, VoIP, optional CATV services and routing mode (firewall and NAT). Usually HGU ONTs have Ethernet interfaces, but POTS, WLAN, USB and CATV RF interfaces are also available. The HGU is a Layer III device[^hsgp_hg_sfu]. + +The ONT SFU type can be understood as a simple Layer II device, like an L2 switch or media converter. It usually has a single Ethernet port and it is exclusively an optical-electric converter. It simply and transparently transports traffic from the PON interface to the Ethernet port(s) of the customer's ONT. No routing or VoIP functionality is assumed for this SFU type. For SFUs, a simple service configuration from the OLT station is used. SFU devices are usually cheaper, because additional services (routing, telephony, TV) are not implemented. + +Within the GPON OMCI standards we can find two types of interfaces: VEIP and PPTP. These virtual interfaces are the boundary between the GPON/OMCI part and the non-GPON/Ethernet part[^G_984_4],[^G_988],[^hsgp_hg_sfu]. + +ONTs will report VEIP or PPTP (Physical Path Termination Point) when MIB 11 or 329 is uploaded according to the type of the device. Only one VEIP is allowed in a HGU and VEIP is not available for SFU devices. OLTs determine the ONT type based on the ONT Type attribute in ME Capability. + +# Physical Path Termination Point (PPTP/Ethernet UNI - MIB 11) + +PPTP/EthUni, on the other hand, is designed for transparent L2 bridging, potentially each with its own VLAN. The OLT is responsible of the provisioning of VLANs and LAN Ports[^nanomad_fc],[^anime_rtl960x]. + +The SFU type ONT device is configured and controlled completely remotely by the OLT via the OMCI management interface. Generally these devices do not require special configurations and therefore access to the web interface of the client ONT device is not required, although it is possible to update the software. To configure the switching of the required VLANs, the Ethernet port profiles of the client ONT are created at the OLT. Most user-side configurations must be made in the devices connected to the SFU. + +For OMCI data flow, there is a mutually unambiguous mapping between the GEM port on the OLT side with the UNI Ethernet port on the terminal side of the ONT. All data packets can pass through without learning or forwarding the MAC address. SFU ONTs support multiple VLANs through bridge mode. + +```mermaid +flowchart LR + subgraph BRIDGE + VLAN0[VLAN untagged] --> eth0 + VLAN1[VLAN 1] --> eth0 + VLANn[VLAN n] --> eth0 + eth0 --> WAN + end + subgraph OMCI + WAN --> PPTP["PPTP Ethernet UNI"] + PPTP --> bridge((MAC BRIDGE)) + subgraph M0[" "] + direction LR + VlanFIT0[VlanFIT] -.- Port0[Port] --> 80210[802.1p Mapping] + 80210 <--> GEMIWTP0[GEM Interworking TP] + 80210 <--> GEMIWTP02[GEM Interworking TP] + + end + bridge --> M0 + subgraph M1[" "] + direction LR + VlanFIT1[VlanFIT] -.- Port1[Port] + Port1 --> 80211[802.1p Mapping] + 80211 <--> GEMIWTP1[GEM Interworking TP] + 80211 <--> GEMIWTP12[GEM Interworking TP] + end + bridge --> M1 + subgraph M2[" "] + direction LR + VlanFIT2[VlanFIT] -.- Port2[Port] + Port2 --> 80212[802.1p Mapping] + 80212 <--> GEMIWTP2[GEM Interworking TP] + end + bridge --> M2 + M0 --> GEM((GEM Port Network CTP)) + M1 --> GEM + M2 --> GEM + end +ExtVlan --> PPTP +``` +Source [^cablefax_future], [^G_988] + +# Virtual Ethernet Interface Point (VEIP - MIB 329) + +VEIP is a service profile designed to terminate the connection directly on the CPE, providing various services (voice, data, video) each with its own characteristics. It allows multiple Ethernet services to be carried over a single PON link. VEIP virtualises all interfaces of the ONU. + +Similarly, all UNI-side modules within a VEIP are invisible to and cannot be managed by OMCI or the user. They are only visible and manageable to a management domain other than OMCI. In addition, each ONT must have only one VEIP. + +In some countries, it is also used to allow quick switches between ISPs: ISP A is assigned to Ethernet port 1 of the HGU, ISP B is assigned to Ethernet port 2 of the HGU, and so on[^nanomad_fc],[^anime_rtl960x],[^huawei_veip]. + + +```mermaid +flowchart LR + subgraph RG + eth0 --> br0 --> WAN0[WAN0 VID100] + eth1 --> br1 --> WAN1[WAN1 untagged] + eth2 --> br1 + br2 --> WAN2[WAN1 VID300/P2] + eht3 --> br3 --> WAN2 + end + subgraph OMCI + WAN1 --> VEIP + WAN2 --> VEIP + WAN0 --> VEIP + VEIP --> bridge((BRIDGE)) + subgraph M0[" "] + direction LR + VlanFIT0[VlanFIT] -.- Port0[Port] --> 80210[802.1p Mapping] + 80210 <--> GEMIWTP0[GEM Interworking TP] + 80210 <--> GEMIWTP02[GEM Interworking TP] + + end + bridge --> M0 + subgraph M1[" "] + direction LR + VlanFIT1[VlanFIT] -.- Port1[Port] + Port1 --> 80211[802.1p Mapping] + 80211 <--> GEMIWTP1[GEM Interworking TP] + 80211 <--> GEMIWTP12[GEM Interworking TP] + end + bridge --> M1 + subgraph M2[" "] + direction LR + VlanFIT2[VlanFIT] -.- Port2[Port] + Port2 --> 80212[802.1p Mapping] + 80212 <--> GEMIWTP2[GEM Interworking TP] + end + bridge --> M2 + M0 --> GEM((GEM Port Network CTP)) + M1 --> GEM + M2 --> GEM + end +ExtVlan --> VEIP +``` +Source [^hsgp_hg_sfu] + +--- + +[^G_988]: *G.988: ONU management and control interface (OMCI) specification* https://www.itu.int/rec/T-REC-G.988 +[^G_984_4]: *G.984.4: Gigabit-capable Passive Optical Networks (G-PON): ONT management and control interface specification* https://www.itu.int/rec/T-REC-G.988 +[^hsgp_hg_sfu]: *Differences between HGU ONU and SFU ONU* https://hsgq.com/optical-module/296.html +[^anime_rtl960x]: *Hacking RTL960x* https://github.com/Anime4000/RTL960x +[^nanomad_fc]: *XGS-PON - ONT SFP+ su router proprietario* https://forum.fibra.click/d/39131-xgs-pon-ont-sfp-su-router-proprietario/12 +[^huawei_veip]: *VEIP knowledge* https://forum.huawei.com/enterprise/en/veip-knowledge/thread/771975-100181 +[^cablefax_future]: *PONs: Why Testing For Conformance And Interoperability Are Key To Their Future* https://www.cablefax.com/archives/pons-why-testing-for-conformance-and-interoperability-are-key-to-their-future \ No newline at end of file diff --git a/_gpon/vendor.md b/_gpon/vendor.md index f2167de9..8705c1f4 100644 --- a/_gpon/vendor.md +++ b/_gpon/vendor.md @@ -5,7 +5,7 @@ nav_order: 4 layout: default --- -> 4 ASCII character +> 4 ASCII characters Needs to be set for the OLT to authenticate your ONT; please read your original ONT's Serial Number, it can be either in HEX or ASCII: if it's codified in HEX, you need to convert the first eight HEX digits to ASCII, for example `48575443` = `HWTC`. @@ -14,28 +14,54 @@ Here is a list of the most popular Vendor IDs: | ID | HEX ID | Vendor Name | | ------ | ---------- | -------------------- | +| `ADTN` | `4144544e` | Adtran | | `ALCL` | `414c434c` | Nokia/Alcatel-Lucent | +| `ALLG` | `414c4c47` | ALLNET | +| `AVMG` | `41564d47` | AVM (FRITZ!Box) | +| `ASKY` | `41534b59` | Askey | +| `CDKT` | `43444B54` | KingType | | `CIGG` | `43494747` | Cig | +| `CXNK` | `43584e4b` | Calix | +| `DDKT` | `44444b54` | DKT | | `DLNK` | `444c4e4b` | Dlink | +| `DSNW` | `44534e57` | DASAN | +| `ELTR` | `454c5452` | Electra | | `ELTX` | `454c5458` | Eltex | -| `FHTT` | `46485454` | Fiber Home | +| `FHTT` | `46485454` | FiberHome | +| `GMTK` | `474d544b` | GemTek | | `GNXS` | `474e5853` | Genexis | +| `GPNC` | `47504E43` | NuCom | | `GPON` | `47504f4e` | Generic vendor name | +| `GTHG` | `47544847` | Alcatel-Lucent (ODM) | | `HALN` | `48414c4e` | HALNy | | `HBMT` | `48424d54` | HiSense | +| `HSGQ` | `48534751` | HSGQ | +| `HUMA` | `48554d41` | Humax | | `HWTC` | `48575443` | Huawei | +| `ICTR` | `49435452` | Icotera | | `ISKT` | `49534b54` | Iskratel | +| `KAON` | `4b414f4e` | KAONMEDIA | | `LEOX` | `4c454f58` | LEOX | | `LQDE` | `4c514445` | Lantiq | +| `NOKG` | `4e4f4b47` | Nokia (GemTek ODM) | +| `NOKW` | `4e4f4b57` | Nokia (GemTek ODM) | +| `MSTC` | `4d535443` | Mitrastar | | `PTIN` | `5054494e` | Altice/PT Inovação | | `RTKG` | `52544b47` | Realtek | | `SCOM` | `53434f4d` | Sercomm | +| `SKYW` | `534b5957` | Skyworth | | `SMBS` | `534d4253` | Sagemcom | | `SPGA` | `53504741` | SourcePhotonics | | `TMBB` | `544d4242` | Technicolor | | `TPLG` | `54504c47` | TP-Link | | `UBNT` | `55424e54` | Ubiquiti | +| `UGRD` | `55475244` | UGrid | +| `YOTC` | `594f5443` | YOTC | +| `YHTC` | `59485443` | Youhua | +| `ZNTS` | `5a4e5453` | DZS | +| `ZRMT` | `5a524d54` | Zaram | | `ZTEG` | `5a544547` | ZTE | | `ZYWN` | `5a59574e` | Zyxel | +| `ZYXE` | `5a595845` | Zyxel | -{% include alert.html content="You can also help us with the content of this site, on each page you will find a button to edit on GitHub." alert="Tip" icon="svg-info" color="green" %} +{% include alert.html content="You can also help us with adding content to this site, you can find a button to edit on GitHub on each page." alert="Tip" icon="svg-info" color="green" %} diff --git a/_includes/cig_password.html b/_includes/cig_password.html index c49e834b..5223e35c 100644 --- a/_includes/cig_password.html +++ b/_includes/cig_password.html @@ -1,7 +1,7 @@

diff --git a/_includes/root_lantiq.html b/_includes/root_lantiq.html index fd8912c7..4a0bd13a 100644 --- a/_includes/root_lantiq.html +++ b/_includes/root_lantiq.html @@ -46,6 +46,8 @@

Root status

document.getElementById('start-button').disabled = false; } else { document.getElementById('browser-error').style.display = 'block'; + document.getElementById('start-button').disabled = true; + document.getElementById('start-button').innerHTML=document.getElementById('start-button').innerText.strike(); } const acontroller = new AbortController(); const cs = acontroller.signal; diff --git a/_includes/serial_dump.html b/_includes/serial_dump.html new file mode 100644 index 00000000..61deedcd --- /dev/null +++ b/_includes/serial_dump.html @@ -0,0 +1,10 @@ +

+        
+            +                {% capture dump_content %}{% include_relative {{include.file | replace: "\", "/" | prepend: 'serial_dump/' | relative_url}} %}{% endcapture %}{{ dump_content | escape }}
+            
+        

+    

diff --git a/_includes/ymodem_lantiq.html b/_includes/ymodem_lantiq.html index dffbc32a..d8ee215a 100644 --- a/_includes/ymodem_lantiq.html +++ b/_includes/ymodem_lantiq.html @@ -44,6 +44,8 @@

Flash firmware

document.getElementById('flash-start-button').disabled = false; } else { document.getElementById('flash-browser-error').style.display = 'block'; + document.getElementById('flash-start-button').disabled = true; + document.getElementById('flash-start-button').innerHTML=document.getElementById('flash-start-button').innerText.strike() } const acontroller = new AbortController(); const cs = acontroller.signal; @@ -202,4 +204,4 @@

Flash firmware

} }); }; - \ No newline at end of file + diff --git a/_layouts/default.html b/_layouts/default.html index 2242e574..2c060d68 100644 --- a/_layouts/default.html +++ b/_layouts/default.html @@ -7,6 +7,16 @@ {% include head.html %} + {% if site.enable_rainbow == true %} + + {% endif %}

{% include title.html %} + {% if site.enable_rainbow == true %} + + 🏳️‍🌈 + + {% endif %} @@ -116,6 +131,13 @@ {% endfor %} + {% if site.enable_rainbow == true %} +

+ + 🏳️‍🌈 + +

+ {% endif %} {% if site.enable_switch_color_scheme == true %}

-{% include root_lantiq.html modelName="FS GPON ONU Stick" unlockHuaweiShell=false %} - +{% include root_lantiq.html modelName="FS GPON ONU Stick" unlockHuaweiShell=false %} +# GPON ONU status -## Setting S/N +## Getting the operational status of the ONU + +```shell +onu ploamsg +``` + +## Querying a particular OMCI ME +```sh +omci_pipe.sh meg MIB_IDX ME_IN +``` +Where `MIB_IDX` is the MIB ID and the `ME_IN` is the ME instance number + +## Getting/Setting Speed LAN Mode + +To get the LAN Mode: + +```sh +onu lanpsg 0 +``` +The `link_status` variable tells the current speed + +| Value (for `sgmii_mode` and `link_status`) | Speed | +| ------------------------------------------ | ---------------------------------- | +| 3 | 1 Gbps / SGMII with auto-neg on | +| 4 | 1 Gbps / SGMII with auto-neg off | +| 5 | 2.5 Gbps / HSGMII with auto-neg on | + +To change the default lan mode value you can use `fw_setenv sgmii_mode`. The firmware already has the value set to 5 by default and there should not be any need to change it. + +# GPON/OMCI settings + +## Setting ONU GPON Serial Number ```sh set_serial_number ABCD12345678 ``` @@ -164,7 +198,7 @@ Or: sfp_i2c -i8 -s "ABCD12345678" ``` -## Checking whether the S/N has been correctly set +## Getting ONU GPON Serial Number ```sh fw_printenv | grep nSerial ``` @@ -173,59 +207,42 @@ Or: sfp_i2c -g ``` -## Setting PLOAM Password +## Setting ONU GPON PLOAM password ```sh sfp_i2c -i11 -s "1234567890" ``` -## Setting LOID and Checkcode Password +## Setting ONU GPON LOID and LOID password ```sh sfp_i2c -i9 -s "1234567890" sfp_i2c -i10 -s "password01" ``` -## Setting Eqipment ID (ME 257) +## Setting OMCI equipment ID (ME 257) ```sh sfp_i2c -i6 -s "YOUR_EQUIPMENT_ID" ``` -## Setting Vendor ID (ME 256) +## Setting OMCI Vendor ID (ME 256) ```sh sfp_i2c -i7 -s "YOUR_VENDOR_ID" ``` -## Changing ONU hardware version (ME 256) +## Setting OMCI hardware version (ME 256) ```sh sed 's/256 0 HWTC 0000000000000/256 0 HWTC YOUR_ONU_VERSION/' /rom/etc/mibs/data_1g_8q.ini > /etc/mibs/data_1g_8q.ini ``` -## Restore the default ONU hardware version (ME 256) +## Restoring the default ONU hardware version (ME 256) ```sh cat /rom/etc/mibs/data_1g_8q.ini > /etc/mibs/data_1g_8q.ini ``` -## Enabling `data_1g_8q_us1280_ds512.ini` OMCI MIB file for 2500 Mbps profiles -{% include alert.html content="The patch below is only compatible with the firmware version `6BA1896SPLQA42`" alert="Info" icon="svg-info" color="blue" %} -{% include alert.html content="If you need to set the ONU version remember that you will have to do it using the MIB file `/etc/mibs/data_1g_8q_us1280_ds512.ini` instead of `/etc/mibs/data_1g_8q.ini`" alert="Info" icon="svg-info" color="blue" %} - -The MIB file `data_1g_8q_us1280_ds512.ini` is very useful to avoid performance problems in situations where 2500 Mbps speed profiles are used, to enable it you need to run this command: -```sh -fw_setenv mib_file data_1g_8q_us1280_ds512.ini -``` - -## Using custom OMCI MIB file -{% include alert.html content="If you need to set the ONU version remember that you will have to do it using your custom MIB file instead of `/etc/mibs/data_1g_8q.ini`" alert="Info" icon="svg-info" color="blue" %} - -You have to copy the MIB file to /etc/mibs and then run this command: -```sh -fw_setenv mib_file YOUR_MIB_FILENAME -``` - -## Changing image software version (ME 7) +## Setting OMCI software version (ME 7) {% include alert.html content="The patch below is only compatible with the firmware version `6BA1896SPLQA42`" alert="Info" icon="svg-info" color="blue" %} -The image version normally couldn't be changed because it was hard-coded into the `/opt/lantiq/bin/omcid` binary, -so you need to then modify the binary with the following hex patch which removes the hardcoded version. +The image version normally can't be changed because it is hard-coded into the `/opt/lantiq/bin/omcid` binary, +so the binary has to be modified with the following hex patch which removes the hardcoded version. ``` < 000084c0: 9a43 931f f760 d840 9b64 f760 d864 1a00 .C...`.@.d.`.d.. @@ -249,17 +266,17 @@ Save it on your computer (not on the stick) as `omcid_patch.base64`, then run: base64 -d omcid_patch.base64 > omcid.bspatch bspatch omcid omcid.bspatch ``` -{% include alert.html content="if you don't have bspatch installed, most distributions includes it in bsdiff package" alert="Info" icon="svg-info" color="blue" %} +{% include alert.html content="If you don't have bspatch installed, most distributions include it in the bsdiff package" alert="Info" icon="svg-info" color="blue" %} After patching the resulting patched `omcid` should have an md5 checksum of `525139425009c4138e92766645dad7d0`. -If that also checks, go on making a backup copy of your original `omcid` on the stick. +If that is also correct, continue by making a backup copy of your original `omcid` on the stick. ```sh cd /opt/lantiq/bin cp omcid omcid.original ``` -Now you have to use SCP to copy the modified `omcid` binary in `/opt/lantiq/bin/omcid`. +Now, SCP has to be used to copy the modified `omcid` binary in `/opt/lantiq/bin/omcid`. Before restarting the stick and applying changes, make sure `omcid` has its execution bit set, then reboot the stick and change the image version with the following command: ```sh @@ -267,42 +284,46 @@ chmod ugo+x /opt/lantiq/bin/omcid ``` -Is also a good time to set the image0/image1_version. Crash has reported if they are not set correctly before reboot. +Is also a good time to set the image0/image1_version: crashes have been reported if they are not set correctly before reboot. ```sh fw_setenv image0_version YOUR_IMAGE0_VERSION fw_setenv image1_version YOUR_IMAGE1_VERSION ``` -Now you can restart the stick. -{% include alert.html content="Be aware that sometimes `omcid` can rewrite the two variables when runs in non patched state. After reboot, double check the values you put are still there." alert="Info" icon="svg-info" color="blue" %} +Now the stick can be rebooted. +{% include alert.html content="Be aware that sometimes `omcid` can rewrite the two variables when run in its non-patched state. After reboot, double check the set values are still correct." alert="Info" icon="svg-info" color="blue" %} -## Setting Lantiq MAC address -```sh -uci set network.lct.macaddr=00:06:B5:07:D6:04 -uci set network.host.macaddr=00:06:B5:07:D8:04 -uci commit network.lct.macaddr=00:06:B5:07:D6:04 -uci commit network.host.macaddr=00:06:B5:07:D8:04 -``` +# Advanced settings + +## Setting `data_1g_8q_us1280_ds512.ini` OMCI MIB file for 2500 Mbps profiles +{% include alert.html content="The patch provided below is only compatible with the firmware version `6BA1896SPLQA42`" alert="Info" icon="svg-info" color="blue" %} +{% include alert.html content="If you need to set the ONU version remember that you will have to do it using the MIB file `/etc/mibs/data_1g_8q_us1280_ds512.ini` instead of `/etc/mibs/data_1g_8q.ini`" alert="Info" icon="svg-info" color="blue" %} -## Setting Lantiq IP address +The MIB file `data_1g_8q_us1280_ds512.ini` is very useful to avoid performance problems in situations where 2500 Mbps speed profiles are used. To enable it, run this command: ```sh -fw_setenv ipaddr 192.168.20.60 -fw_setenv gatewayip 192.168.20.1 +fw_setenv mib_file data_1g_8q_us1280_ds512.ini ``` -## Reading all EEPROM +## Setting custom OMCI MIB file +{% include alert.html content="If you need to set the ONU version, remember that you will have to do it using your custom MIB file instead of `/etc/mibs/data_1g_8q.ini`" alert="Info" icon="svg-info" color="blue" %} + +Copy the MIB file to /etc/mibs, then run this command: ```sh -sfp_i2c -r +fw_setenv mib_file YOUR_MIB_FILENAME ``` -## Getting Firmware version +## Setting management MAC ```sh -strings /opt/lantiq/bin/omcid | grep ^software_Version | awk -F[=,] '{print $2}' +uci set network.lct.macaddr=00:06:B5:07:D6:04 +uci set network.host.macaddr=00:06:B5:07:D8:04 +uci commit network.lct.macaddr=00:06:B5:07:D6:04 +uci commit network.host.macaddr=00:06:B5:07:D8:04 ``` -## Getting Firmware build time +## Setting management IP ```sh -strings /opt/lantiq/bin/omcid | grep compiled +fw_setenv ipaddr 192.168.20.60 +fw_setenv gatewayip 192.168.20.1 ``` ## Rebooting the ONU @@ -310,18 +331,12 @@ strings /opt/lantiq/bin/omcid | grep compiled reboot ``` -## Checking whether the connection with the OLT was successful (O5 state) - -```shell -onu ploamsg -``` - ## Disable RX_LOS status -{% include alert.html content="The patch below is only compatible with the firmware version `6BA1896SPLQA42`" alert="Info" icon="svg-info" color="blue" %} +{% include alert.html content="The patch provided below is only compatible with the firmware version `6BA1896SPLQA42`" alert="Info" icon="svg-info" color="blue" %} -Some switches/routers (e.g. Mikrotik) do not allow access to the magament interface without the fiber connected because the SFP reports RX_LOS status, it's possible to modify the `mod_optic.ko` driver to spoof non RX_LOS status by setting PIN 8 (RX_LOS) to be always low. +Some switches/routers (e.g. Mikrotik) do not allow access to the magament interface without the fiber being connected because the SFP reports RX_LOS status It is possible to fix this by modifying the `mod_optic.ko` driver to spoof non RX_LOS status by setting PIN 8 (RX_LOS) to be always low. -This is the change to be made in hex format: +This is the change to be made, in hex format: ``` < 00013740: 2404 0003 2405 0001 0c00 0000 ac43 0980 $...$........C.. @@ -343,63 +358,56 @@ Save it on your computer (not on the stick) as `mod_optic.base64`, then run: base64 -d mod_optic.base64 > mod_optic.bspatch bspatch mod_optic.ko mod_optic.bspatch ``` -{% include alert.html content="if you don't have bspatch installed, most distributions includes it in bsdiff package" alert="Info" icon="svg-info" color="blue" %} +{% include alert.html content="If you don't have bspatch installed, most distributions include it in the bsdiff package" alert="Info" icon="svg-info" color="blue" %} -After patching the resulting patched `mod_optic.ko` should have an md5 checksum of `e14a5a70b023873853afe920870f076e`. -If that also checks, go on making a backup copy of your original `mod_optic.ko` on the stick. +After patching the resulting `mod_optic.ko` should have an md5 checksum of `e14a5a70b023873853afe920870f076e`. +If that is also correct, continue by making a backup copy of your original `mod_optic.ko` on the stick. ```sh cd /lib/modules/3.10.49/ cp mod_optic.ko mod_optic.ko.original ``` -Now you have to use SCP to copy the modified `mod_optic.ko` kernel module in `/lib/modules/3.10.49/mod_optic.ko`. +Now use SCP to copy the modified `mod_optic.ko` kernel module in `/lib/modules/3.10.49/mod_optic.ko`. ## TX Fault / Serial -The stick stays in a perpetual "TX Fault" state since the same SFP pin is used for both serial and TX Fault signaling, if that causes you issues (normally it shouldn't) you can issue the commands below to disable it. Note that it will disable both the TX Fault signal and Serial on the stick after boot. +The stick will remain in a perpetual "TX Fault" state as the same SFP pin is used for both serial and TX Fault signaling. If this causes you issues (normally it shouldn't), you can issue the commands below to disable it. Note that this will disable both the TX Fault signal and Serial on the stick after boot. ```sh fw_setenv asc0 1 fw_setenv preboot "gpio set 3;gpio input 100;gpio input 105;gpio input 106;gpio input 107;gpio input 108" ``` -In case you need to re-enable it issue the following commands from the bootloader (FALCON) +In case you need to re-enable it, issue the following commands from the bootloader (FALCON) ```sh FALCON => setenv asc0 0 FALCON => saveenv ``` +# SFP EEPROM settings -## Getting/Setting Speed LAN Mode - -To get the LAN Mode: - +## Reading all EEPROM ```sh -onu lanpsg 0 +sfp_i2c -r ``` -The `link_status` variable tells the current speed - -| Value (for `sgmii_mode` and `link_status`) | Speed | -| ------------------------------------------ | ---------------------------------- | -| 3 | 1 Gbps / SGMII with auto-neg on | -| 4 | 1 Gbps / SGMII with auto-neg off | -| 5 | 2.5 Gbps / HSGMII with auto-neg on | -To change the default lan mode value you can use `fw_setenv sgmii_mode`. The firmware already has the value 5 by default and it is generally not necessary to change it. +## Getting Firmware version +```sh +strings /opt/lantiq/bin/omcid | grep ^software_Version | awk -F[=,] '{print $2}' +``` -## Querying a particular OMCI ME +## Getting Firmware build time ```sh -omci_pipe.sh meg MIB_IDX ME_IN +strings /opt/lantiq/bin/omcid | grep compiled ``` -Where `MIB_IDX` is the MIB ID and the `ME_IN` is the ME instance number # EEPROM (I2C slave simulated EEPROM) -The FS GPON-ONU-34-20BI does not have a physical EEPROM, the Falcon SOC emulates an EEPROM by exposing it on the I2C interface as required by the SFF-8472 specification. +The FS GPON-ONU-34-20BI stick does not have a physical EEPROM, the Falcon SOC emulates an EEPROM by exposing it on the I2C interface as required by the SFF-8472 specification. -On the I2C interface there will be two memories of 256 bytes each at the addresses `1010000X (A0h)` and `1010001X (A2h)`, however in reality the memory available from the emulated EEPROM will be 640 bytes each but only the first 256 bytes will be exposed in the I2C interface. +On the I2C interface, two memories of 256 bytes each will be available at the addresses `1010000X (A0h)` and `1010001X (A2h)`, however the actual available memory from the emulated EEPROM will be 640 bytes each, but only the first 256 bytes will be exposed in the I2C interface. -The FS GPON-ONU-34-20BI stores the content of the emulated EEPROM in U-Boot env variables to restore it after a reboot: +The FS stick stores the content of the emulated EEPROM in U-Boot env variables to restore it after a reboot: - `EEPROM0 (A0h)` stored in U-Boot env variable `sfp_a0_low_128` - `EEPROM1 (A2h)` stored in U-Boot env variable `sfp_a2_info` @@ -528,10 +536,12 @@ The FS GPON-ONU-34-20BI stores the content of the emulated EEPROM in U-Boot env # Miscellaneous Links -- [FS.com](https://www.fs.com/it/products/133619.html) +- [FS.com (no longer available)](https://www.fs.com/it/products/133619.html) - [General setting of lantiq](https://forum.fibra.click/d/23881-ma5671a-e-vodafone-25-gbps/64) - [Usage GPON module SFP in Spain](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300) - [SourcePhotonics SPS-34-24T-HP-TDFO Datasheet](https://www.sourcephotonics.com/wp-content/uploads/2017/08/DS-8085-02_SPS-34-24T-HP-TDFO.pdf) +- [FS.com GPON-SFP-ONT-MAC-I SKU 133619 Datasheet](https://resource.fs.com/mall/resource/gpon-sfp-ont-mac-i-datasheet.pdf) +- [FS.com GPON-ONU-34-20BI Configuration Guide](https://resource.fs.com/mall/doc/20230831180515egrzs6.pdf) --- diff --git a/_ont/ont-fs-com-mod.md b/_ont/ont-fs-com-mod.md index cda9de0a..a15cbbe1 100644 --- a/_ont/ont-fs-com-mod.md +++ b/_ont/ont-fs-com-mod.md @@ -1,7 +1,7 @@ --- -title: FS Modded Firmware for Huawei MA5671A and FS.com GPON-ONU-34-20BI +title: FS.com Modded Firmware for Huawei MA5671A and FS.com GPON-ONU-34-20BI has_children: false redirect_to: /ont-huawei-ma5671a-fs-mod layout: default -parent: ONT FS.com GPON ONU Stick with MAC (GPON-ONU-34-20BI) +parent: FS.com GPON ONU Stick with MAC (GPON-ONU-34-20BI) --- diff --git a/_ont/ont-fs-com-onu1710-1g.md b/_ont/ont-fs-com-onu1710-1g.md new file mode 100644 index 00000000..d7170c25 --- /dev/null +++ b/_ont/ont-fs-com-onu1710-1g.md @@ -0,0 +1,269 @@ +--- +title: FS.com ONU1710-1G +has_children: false +layout: default +parent: FS.com +--- + +# Hardware Specifications + +| | | +| ------------ | -------------------------------------------- | +| Vendor/Brand | FS.com | +| Model | ONU1710-1G | +| P/N | ONU1710-1G | +| SKU | 154796 | +| Chipset | Realtek RTL9601D | +| CPU | MIPS-I 32-bit (big-endian) | +| CPU Clock | 300 MHz | +| RAM | 32 MB (DDR2, 325 MHz) | +| Flash | 4 MB (SPI NOR, ZBIT JEDEC 5E4016) | +| Bootloader | U-Boot 2011.12.NA (Realtek-modified) | +| System | Linux 2.6.30.9 (Luna SDK / RSDK-1.5.6p2) | +| XPON Mode | GPON + EPON dual-mode adaptive | +| Optics | 1x PON (SC/UPC) | +| Power | 12V DC, 5.5mm barrel jack (center positive) | +| Ethernet | 1x GE (1000BASE-T, RJ45) | +| IP address | 192.168.123.1 | +| Web Gui | port 80, user `admin`, password `super&123` | +| SSH | no | +| Telnet | port 23, user `admin`, password `super&123` | +| Serial | 115200 8-N-1 3.3V | +| Form Factor | Desktop ONT | + + +## Specifications + +The ONU1710-1G is an XPON (GPON + EPON) dual-mode adaptive ONT with 1x GE Ethernet port. It supports 1.25 Gbps upstream and 2.5 Gbps downstream (GPON mode), complies with ITU-T G.984/G.987/G.988/G.989 standards, and supports network deployment up to 20 km. + +*Adapted from vendor's marketing material.* + +## List of software versions +- 10.0.52B.2095 (2025-03-20) + +## Default credentials + +Only the `user` account is publicly documented by FS.com. The `admin` account was discovered through firmware analysis. + +| Username | Password | Access | Notes | +| -------- | ------------- | ---------- | ------------------------------------------------------ | +| `user` | `123456` | Web/Telnet | Limited user account (publicly documented) | +| `admin` | `super&123` | Web/Telnet | Super user / administrator | +| `admin` | `bDcom@123` | Web | Hardcoded backdoor password; cannot be changed | +| (any) | `bDcom@123` | Telnet | Hardcoded backdoor password; telnet accepts this password for any username, including nonexistent ones; cannot be changed | + +## Hardware + +{% include image.html file="fs-com-onu1710-1g/pcb.jpg" alt="FS.com ONU1710-1G PCB" caption="FS.com ONU1710-1G PCB" %} + +Key components: +- SoC: Realtek RTL9601D (MIPS-I 32-bit, 88-pin) +- RAM: 32 MB DDR2 +- Flash: 4 MB SPI NOR (ZBIT JEDEC 5E4016) +- Optical transceiver: Semtech GN25L95 BOSA, SC/UPC connector +- Serial port: 4-pin 2.54mm header (unpopulated) 3.3V 115200 8-N-1 + +## U-Boot environment + +{% include serial_dump.html title="Full printenv output" file="fs-com-onu1710-1g/uboot-env.txt" %} + +Key variables: + +| Variable | Value (default) | Description | +| -------------- | --------------- | ------------------------------------------------------------------ | +| `sw_active` | `1` | Currently active image slot (0 or 1; both point to same flash) | +| `sw_commit` | `1` | Last committed image slot | +| `sw_tryactive` | `2` | Boot control: `2` = boot by `sw_commit`; `0`/`1` = first-boot try | +| `sw_valid0/1` | `1` | Image slot validity flag | +| `sw_version0/1`| `10.0.52B.2095` | Firmware version string for each slot | +| `ethaddr` | `00:E0:4C:86:70:01` | Factory MAC address | +| `bootdelay` | `2` | U-Boot countdown in seconds before autoboot | +| `serverip` | `192.168.123.100` | TFTP server address for firmware upload | + +From the running Linux shell, U-Boot environment variables can be read and written using `/bin/nv getenv ` and `/bin/nv setenv `. + +## List of partitions + +The flash uses a single-image layout — both image slots (`k0`/`k1`, `r0`/`r1`) point to the same physical offsets. + +| dev | offset | size | erasesize | name | type | +| ---- | ---------- | -------- | --------- | -------- | ------------------------------ | +| mtd0 | 0x000000 | 0x02A000 | 0x001000 | "boot" | Preloader + U-Boot (LZMA) | +| mtd1 | 0x02A000 | 0x002000 | 0x001000 | "env" | U-Boot environment (primary) | +| mtd2 | 0x02C000 | 0x002000 | 0x001000 | "env2" | U-Boot environment (backup) | +| mtd3 | 0x02E000 | 0x012000 | 0x001000 | "config" | JFFS2 configuration filesystem | +| mtd4 | 0x040000 | 0x139000 | 0x001000 | "k0" | Kernel uImage (LZMA) | +| mtd5 | 0x179000 | 0x287000 | 0x001000 | "r0" | Root filesystem (SquashFS+LZMA)| +| mtd6 | 0x040000 | 0x139000 | 0x001000 | "k1" | Kernel uImage (same as k0) | +| mtd7 | 0x179000 | 0x287000 | 0x001000 | "r1" | Root filesystem (same as r0) | + +To dump the full flash contents over serial from the U-Boot prompt, read it in 1 MB chunks using `sf read` and dump each chunk as hex with `md.b`: + +``` +sf probe +sf read 0x80000000 0x000000 0x100000 +md.b 0x80000000 0x100000 +sf read 0x80000000 0x100000 0x100000 +md.b 0x80000000 0x100000 +sf read 0x80000000 0x200000 0x100000 +md.b 0x80000000 0x100000 +sf read 0x80000000 0x300000 0x100000 +md.b 0x80000000 0x100000 +``` + +Capture the serial output with a terminal emulator, then convert the hex dump to binary. + +## Bootup + +{% include serial_dump.html title="Full boot log captured on serial port" file="fs-com-onu1710-1g/bootlog.txt" %} + + +1. **Preloader** (Bismarck 3.5) initializes DDR2 DRAM, decompresses and launches U-Boot +2. **U-Boot** (2s delay, 115200 baud) checks `sw_tryactive`: if it equals `2`, boots by `sw_commit`; otherwise it is a first-boot attempt that sets `sw_tryactive=2`, saves env, and boots the selected image +3. **Kernel** boots with `console=ttyS0,115200`, mounts SquashFS root +4. **`/etc/init.d/rcS`** runs init scripts `rc0`–`rc63` sequentially: + - `rc2`: Mounts `/proc`, ramfs, sysfs, tmpfs `/dev`; mounts JFFS2 config to `/var/config`; brings up `lo` and `nas0` + - `rc3`: Runs `configd`, loads XML config (`config_xmlconfig.sh -b`), inserts kernel modules (`insdrv.sh`), runs SDK init (`runsdk.sh`), starts OMCI (`checkomci`) + - `rc10`: Tunes kernel network parameters (conntrack timeouts, IP forwarding) + - `rc14`: Configures IPv6 sysctl settings + - `rc32`: Launches `startup` daemon and BOSA optical calibration (`rtkbosa.sh`) + - `rc34`: Enables hardware watchdog + - `rc35`: Enables PHY ports + +## Filesystem + +The root filesystem is a SquashFS image (LZMA-compressed) with 525 files and stripped binaries. Runtime state is kept on a tmpfs (`/var`) and the JFFS2 config partition (mounted at `/var/config`). + +``` +squashfs-root/ + bin/ -- BusyBox 1.12.4 + OMCI tools (omcicli, omci_app, checkomci), boa, iptables, + -- diag, ethctl, flash (aliased as nv), configd, xmlconfig, pondetect, igmpd, ... + etc/ + init.d/ -- rcS, rc2, rc3, rc10, rc14, rc32, rc34, rc35 + scripts/ -- mnt_cfgfs.sh, insdrv.sh, runsdk.sh, rtkbosa.sh, factory reset helpers + home/httpd/ + boa.conf -- Boa v0.94 web server configuration (User 0, Group 0) + web/ -- 243 ASP pages (WAN, LAN, OMCI info, VLAN, QoS, firewall, TR-069, diagnostics, ...) + lib/ + librtk.so -- Realtek SDK (~964 KB, largest userspace library) + libmib.so -- MIB management + libomci_*.so -- OMCI stack (API, FAL, GOS, MIB, voice) + libmultilang_*.so -- i18n strings (Chinese + English) + modules/ -- Kernel modules (omcidrv.ko, pf_rtk.ko, epon_drv.ko, igmp_drv.ko, + -- europa_drv.ko, rldp_drv.ko, dpbcaster.ko, ...) + omci/ -- 127 OMCI MIB handler plugins (.so), one per managed entity type + voip/ -- SIP/VoIP libraries + etc/scripts/flash -- Shell script for reading/writing MIB variables via xmlconfig +``` + +The config partition (`/var/config`) holds `lastgood.xml` (XML runtime config, persisted across reboots) and OMCI MIB state (`omci_mib.cfg`). + +Note: the `flash` MIB tool (`/etc/scripts/flash`) and the `nv` U-Boot env tool (`/bin/nv`) are separate commands for different purposes. + + +# GPON/OMCI settings + +## Via web UI + +The ONU1710-1G exposes several hidden web UI pages for GPON/OMCI configuration that are not linked in the main navigation. Log in as `admin` and access them by URL. + +### Version modification (vermod.asp) + +Accessible at `http://192.168.123.1/vermod.asp`, this page allows changing: +- Manufacturer, OUI, Product Class +- Serial Number, Provisioning Code +- Spec Version, Software Version, Hardware Version +- GPON Serial Number +- ELAN MAC Address +- **Export**: Download the current OMCI event log +- **Import**: Upload a shell script that is executed as root (see Security section) + +{% include image.html file="fs-com-onu1710-1g/vermod.png" alt="FS.com ONU1710-1G vermod.asp" caption="Version modification page (vermod.asp)" %} + +### GPON configuration (gpon.asp) + +Accessible at `http://192.168.123.1/gpon.asp`, this page allows changing: +- PLOAM Password (max 10 characters) +- LOID (max 24 characters) +- LOID Password (max 12 characters) + +### OMCI information (omci_info.asp) + +Accessible at `http://192.168.123.1/omci_info.asp`, this page allows viewing/changing: +- OMCI Software Version 1/2 +- CWMP Product Class +- CWMP Hardware Version +- OMCI Vendor ID + +### WAN configuration (waneth.asp) + +Accessible at `http://192.168.123.1/waneth.asp`, this page supports the following connection types: +- **Bridge**: Transparent L2 bridge (no NAT, no routing) +- **PPPoE**: PPP over Ethernet (typical ISP authentication) +- **IPoE**: IP over Ethernet (DHCP or static IP) + +The page also allows configuring NAPT (NAT), IGMP snooping, QoS, default route, and IPv6. + +## Via Telnet + +Configuration can be done via telnet using the `flash` command (`/etc/scripts/flash`). The user and admin passwords can also be changed through the web UI. + +```sh +# LOID and PLOAM password +flash get LOID +flash set LOID YOURLOID +flash get LOID_PASSWD +flash set LOID_PASSWD YOURLOIDPASSWORD +flash get GPON_ONU_PASSWD +flash set GPON_ONU_PASSWD 1234567890 + +# GPON serial number / vendor ID +flash get GPON_SN +flash set GPON_SN ABCD12345678 +flash get PON_VENDOR_ID +flash set PON_VENDOR_ID ABCD + +# Hardware / software version strings (reported via OMCI) +flash get HW_HWVER +flash set HW_HWVER 1.0 +flash get HW_CWMP_PRODUCTCLASS +flash set HW_CWMP_PRODUCTCLASS MyProduct + +# OMCI software version +flash get OMCI_SW_VER1 +flash set OMCI_SW_VER1 V1.9.0 +flash get OMCI_SW_VER2 +flash set OMCI_SW_VER2 V1.9.0 + +# PON mode (1=GPON, 2=EPON, 3=Ethernet) +flash get PON_MODE +flash set PON_MODE 1 + +# Bridge mode +flash get DIRECT_BRIDGE_MODE +flash set DIRECT_BRIDGE_MODE 1 + +# User and admin passwords +flash get USER_PASSWORD +flash set USER_PASSWORD newpassword +flash get SUSER_PASSWORD +flash set SUSER_PASSWORD newpassword +``` + + +# Security considerations + +{% include alert.html content="This device has extremely poor security practices and should not be used in any environment where it may be reachable by untrusted parties." alert="Warning" icon="svg-warning" color="red" %} + +- **Undocumented default credentials**: The `admin` account (`super&123`) is not mentioned in any FS.com documentation but has full administrative access. The firmware also contains references to additional accounts (`adsl`/`xponadmin`, `xponadmin`/`xponre@1t3k`) in inactive backup config files and hardcoded code paths. These were not usable but are likely leftovers from the Realtek SDK. +- **Hardcoded backdoor password**: The password `bDcom@123` is hardcoded in the firmware and cannot be changed. It grants access as `admin` to the web interface. On telnet it is accepted for **any** supplied username, including nonexistent ones, and results in a `root` shell. +- **Unencrypted management protocols**: Both the web interface (HTTP port 80) and Telnet (port 23) transmit credentials and configuration in cleartext. Both are enabled by default. +- **Arbitrary script upload and execution**: The `vermod.asp` page has an "Import" form that posts to `/boaform/formImportOMCIShell`. The handler writes the uploaded file to `/tmp/omcishell` and executes it immediately via `system("/bin/sh /tmp/omcishell")`. Likely an intentional debug feature that allows the `admin` user to execute commands as root without going through telnet. +- **Privilege escalation via auth realm mismatch**: The Boa web server maps `/` to admin credentials and `/boaform/admin` to user credentials. Admin-only handlers like `formImportOMCIShell` can be reached by the low-privilege `user` account by requesting `/boaform/admin/formImportOMCIShell` instead. This gives the unprivileged account full root access. +- **All services run as root**: The web server (Boa), telnet daemon, and OMCI stack all run with root privileges (UID 0). +- **Management services bind on all interfaces**: Boa (port 80) and telnet (port 23) bind to `::` with no iptables rules. When connected to GPON, depending on the ISP's network configuration, these services may be reachable beyond the LAN; though this has not been practically verified. + +# Miscellaneous Links + +- [FS.com ONU1710-1G Product Page](https://www.fs.com/eu-en/products/154796.html) +- [Hacking RTL960x](https://github.com/Anime4000/RTL960x) diff --git a/_ont/ont-fs-com.md b/_ont/ont-fs-com.md index 045d01cf..b7641baf 100644 --- a/_ont/ont-fs-com.md +++ b/_ont/ont-fs-com.md @@ -1,5 +1,5 @@ --- -title: ONT FS.com +title: FS.com has_children: true layout: default --- diff --git a/_ont/ont-genexis-ft-g2110c-2.5g.md b/_ont/ont-genexis-ft-g2110c-2.5g.md new file mode 100644 index 00000000..65c9cf98 --- /dev/null +++ b/_ont/ont-genexis-ft-g2110c-2.5g.md @@ -0,0 +1,179 @@ +--- +title: FiberTwist G2110C-2.5G +has_children: false +layout: default +parent: Genexis +--- + +# Hardware Specifications + +| | | +| --------------- | ------------------------------------------------------------ | +| Vendor/Brand | Genexis FiberTwist | +| Model | G2110C-2.5G | +| Chipset | Realtek RTL9601D | +| Flash | 128MB | +| RAM | 32MB | +| System | Linux 3.18 (Luna SDK 3.3) | +| LAN | 2.5GBaseT | +| Optics | SC/APC | +| IP address | 192.168.100.1/24 or 192.168.1.1/24 | +| Web Gui | Can be enabled, locked down by iptables rule and missing CSS | +| SSH | | +| Telnet | ✅ user `company`, password `amyM77yY` | +| Serial | ✅ | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | + +{% include image.html file="ft-g2110c-2.5g-front.jpg" alt="FiberTwist G2110C-2.5G Front" caption="FiberTwist G2110C-2.5G Front" %} + +{% include image.html file="ft-g2110c-2.5g-back.jpg" alt="FiberTwist G2110C-2.5G Back" caption="FiberTwist G2110C-2.5G Back" %} + +## Optical Header installation backplate +{% include image.html file="ft-g2110c-2.5g-optical-header-1.jpg" alt="FiberTwist G2110C-2.5G Optical Header installation backplate" caption="FiberTwist G2110C-2.5G Optical Header installation backplate" %} + +{% include image.html file="ft-g2110c-2.5g-optical-header-2.jpg" alt="FiberTwist G2110C-2.5G Optical Header installation backplate" caption="FiberTwist G2110C-2.5G Optical Header installation backplate" %} + +{% include image.html file="ft-g2110c-2.5g-optical-header-3.jpg" alt="FiberTwist G2110C-2.5G Optical Header installation backplate" caption="FiberTwist G2110C-2.5G Optical Header installation backplate" %} + +## Serial + +The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. To accept TX line commands, the GND of the TTL adapter should be attached to the ONT's shield: + +{% include image.html file="ft-g2110c-2.5g-internal.jpg" alt="FiberTwist G2110C-2.5G Internal" caption="FiberTwist G2110C-2.5G Internal" %} + +{% include alert.html content="Some USB TTL adapters label TX and RX pins the other way around: try swapping them if the connection doesn't work." alert="Note" icon="svg-warning" color="yellow" %} + +## List of software versions +- C-5.6.1-R +- C-5.7.0-R +- C-5.7.1-DEV3 +- C-5.7.1-EFT1 + +## List of partitions + +| dev | size | erasesize | name | +| ----- | -------- | --------- | --------------- | +| mtd0 | 00040000 | 00001000 | "boot" | +| mtd1 | 00002000 | 00001000 | "env" | +| mtd2 | 00002000 | 00001000 | "env2" | +| mtd3 | 0003c000 | 00001000 | "config" | +| mtd4 | 00300000 | 00001000 | "k0" | +| mtd5 | 004c0000 | 00001000 | "r0" | +| mtd6 | 00300000 | 00001000 | "k1" | +| mtd7 | 004c0000 | 00001000 | "r1" | +| mtd8 | 00001000 | 00001000 | "Partition_008" | +| mtd9 | 00001000 | 00001000 | "Partition_009" | +| mtd10 | 00001000 | 00001000 | "Partition_010" | +| mtd11 | 00001000 | 00001000 | "Partition_011" | +| mtd12 | 00300000 | 00001000 | "linux" | +| mtd13 | 004c0000 | 00001000 | "rootfs" | + +This ONT supports dual boot. + +`k0` and `r0` respectively contain the kernel and firmware of the first image, `k1` and `r1` the kernel and the firmware of the second one + +# GPON/OMCI settings + +{% include alert.html content="Some variables are write-protected, you need to unlock them before proceeding" alert="Info" icon="svg-info" color="blue" %} + +Use the following command to unlock write-protected variables: + +```sh +# nv setenv ProtectEnv 0 +``` + +## Getting/Setting ONU GPON Serial Number + +{% include alert.html content="If your serial number has letters after the Vendor ID (e.g. ZTEGAAA01234), put them in lower case (e.g. ZTEGaaa01234)" alert="Info" icon="svg-info" color="blue" %} + +```sh +# nv setenv GponSn ZTEGaaa01234 +``` +Reboot the ONT to apply any changes + +You can check if the serial number was correctly changed using the following command: + +```sh +# diag gpon get serialnumber +ZTEGaaa01234 +``` + +## Getting/Setting ONU GPON PLOAM password + +{% include alert.html content="The PLOAM password is stored in ASCII format" alert="Info" icon="svg-info" color="blue" %} + +```sh +# /etc/scripts/flash get GPON_PLOAM_PASSWD +GPON_PLOAM_PASSWD=AAAAAAAAAA +# /etc/scripts/flash set GPON_PLOAM_PASSWD AAAAAAAAAA +``` +It seems Genexis has also included a U-Boot variable to store the PLOAM. On currently known firmwares (5.6.1 and 5.7.0) it is not read by the `omci_app` daemon. +For future-proofing reasons, set your PLOAM also on the before-mentioned U-Boot env using the following command in the OS shell: + +```sh +# nv setenv ploampwd 1234567890 +ploampwd=1234567890 +``` +## Setting OMCI software version (ME 7) + +The stock firware does not allow changing of the primary and standby software version. +As the ONT uses the Luna SDK, the `/etc/scripts/flash` shell script can be easily modified by creating a custom firmware with the same set of patches suggested e.g. for the [Technicolor AFM0002](/ont-technicolor-afm0002) ONT. + +You can then check if the software version was changed correctly with this command (take a look at the `Version` field): + +```sh +# omcicli mib get 7 +XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +SWImage +XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +================================= +EntityID: 0x00 +Active: 0 +Committed: 0 +Valid: 1 +*Version: V6.0.10N14* +ProductCode: +ImageHash: 0x00000000000000000000000000000000 +================================= +================================= +EntityID: 0x01 +Active: 1 +Committed: 1 +Valid: 1 +*Version: V6.0.10N14* +ProductCode: +ImageHash: 0x00000000000000000000000000000000 +================================= +``` + +## Setting OMCI hardware version (ME 256) + +```sh +# nv setenv HV G2110CE2V1D0 +``` +Reboot the ONT to apply the change + +## Setting OMCI equipment ID (ME 257) + +```sh +# nv setenv ProdName FT-G2110C-2.5G +``` +Reboot the ONT to apply the change + +# Advanced settings + +## Setting management IP +```sh +# /etc/scripts/flash get LAN_IP_ADDR +LAN_IP_ADDR=192.168.1.1 +# /etc/scripts/flash set LAN_IP_ADDR 192.168.1.1 + ``` + +# Known Bugs +- The web UI can be enabled by modding the firmware, but the daemon will crash if no optical signal is received + +# Miscellaneous Links +- [FiberTwist G2110C-2.5G](https://genexis.eu/content/uploads/2020/07/FiberTwist-G2110C-2.5G-Installation-Guide-v1.0-EN.pdf) + diff --git a/_ont/ont-genexis-ft-g2110c.md b/_ont/ont-genexis-ft-g2110c.md index 7c62398f..24453e62 100644 --- a/_ont/ont-genexis-ft-g2110c.md +++ b/_ont/ont-genexis-ft-g2110c.md @@ -1,5 +1,5 @@ --- -title: FiberTwist G2110C-2.5G +title: FiberTwist G2110C has_children: false layout: default parent: Genexis @@ -7,184 +7,36 @@ parent: Genexis # Hardware Specifications -| | | -| --------------- | ------------------------------------------------------------ | -| Vendor/Brand | Genexis FiberTwist | -| Model | G2110C-2.5G | -| Chipset | Realtek RTL9601D | -| Flash | 128MB | -| RAM | 32MB | -| System | Linux 3.18 (Luna SDK 3.3) | -| 2.5GBaseT | Yes | -| Optics | SC/APC | -| IP address | 192.168.100.1/24 or 192.168.1.1/24 | -| Web Gui | Can be enabled, locked down by iptables rule and missing CSS | -| SSH | | -| Telnet | ✅ user `company`, password `amyM77yY` | -| Serial | ✅ | -| Serial baud | 115200 | -| Serial encoding | 8-N-1 | -| Form Factor | ONT | +| | | +| --------------- | ------------------ | +| Vendor/Brand | Genexis FiberTwist | +| Model | G2110C | +| Chipset | | +| Flash | | +| RAM | | +| System | | +| LAN | 1 GBaseT | +| Optics | SC/APC | +| IP address | | +| Web Gui | | +| SSH | | +| Telnet | | +| Serial | | +| Serial baud | | +| Serial encoding | | +| Form Factor | ONT | -{% include image.html file="ft-g2110c-front.jpg" alt="FiberTwist G2110C-2.5G Front" caption="FiberTwist G2110C-2.5G Front" %} +{% include image.html file="ft-g2110c-front.jpg" alt="FiberTwist G2110C Front" caption="FiberTwist G2110C Front" %} -{% include image.html file="ft-g2110c-back.jpg" alt="FiberTwist G2110C-2.5G Back" caption="FiberTwist G2110C-2.5G Back" %} +{% include image.html file="ft-g2110c-back.jpg" alt="FiberTwist G2110C Back" caption="FiberTwist G2110C Back" %} -## Optical Header installation backplate -{% include image.html file="ft-g2110c-optical-header-1.jpg" alt="FiberTwist G2110C-2.5G Optical Header installation backplate" caption="FiberTwist G2110C-2.5G Optical Header installation backplate" %} - -{% include image.html file="ft-g2110c-optical-header-2.jpg" alt="FiberTwist G2110C-2.5G Optical Header installation backplate" caption="FiberTwist G2110C-2.5G Optical Header installation backplate" %} - -{% include image.html file="ft-g2110c-optical-header-3.jpg" alt="FiberTwist G2110C-2.5G Optical Header installation backplate" caption="FiberTwist G2110C-2.5G Optical Header installation backplate" %} - -## Serial - -The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. To accept TX line commands, the GND of the TTL adapter should be attached to the ONT's shield: - -{% include image.html file="ft-g2110c-internal.jpg" alt="FiberTwist G2110C-2.5G Internal" caption="FiberTwist G2110C-2.5G Internal" %} - -{% include alert.html content="Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work." alert="Note" icon="svg-warning" color="yellow" %} - -## List of software versions -- C-5.6.1-R -- C-5.7.0-R -- C-5.7.1-DEV3 -- C-5.7.1-EFT1 - -## List of partitions - -| dev | size | erasesize | name | -| ----- | -------- | --------- | --------------- | -| mtd0 | 00040000 | 00001000 | "boot" | -| mtd1 | 00002000 | 00001000 | "env" | -| mtd2 | 00002000 | 00001000 | "env2" | -| mtd3 | 0003c000 | 00001000 | "config" | -| mtd4 | 00300000 | 00001000 | "k0" | -| mtd5 | 004c0000 | 00001000 | "r0" | -| mtd6 | 00300000 | 00001000 | "k1" | -| mtd7 | 004c0000 | 00001000 | "r1" | -| mtd8 | 00001000 | 00001000 | "Partition_008" | -| mtd9 | 00001000 | 00001000 | "Partition_009" | -| mtd10 | 00001000 | 00001000 | "Partition_010" | -| mtd11 | 00001000 | 00001000 | "Partition_011" | -| mtd12 | 00300000 | 00001000 | "linux" | -| mtd13 | 004c0000 | 00001000 | "rootfs" | - -This ONT supports dual boot. - -`k0` and `r0` respectively contain the kernel and firmware of the first image, `k1` and `r1` the kernel and the firmware of the second one - -# General Settings and Useful Commands - -{% include alert.html content="Some variables are write-protected, you need to unlock them before proceed" alert="Info" icon="svg-info" color="blue" %} - -Use the following command to unlock write-protected variables: - -```sh -# nv setenv ProtectEnv 0 -``` - -## Getting/Setting the ONT's S/N - -{% include alert.html content="If your serial number has letters after the Vendor ID (e.g. ZTEGAAA01234), put them in lower case (e.g. ZTEGaaa01234)" alert="Info" icon="svg-info" color="blue" %} +{% include image.html file="ft-g2110c-ports.jpg" alt="FiberTwist G2110C Ports" caption="FiberTwist G2110C Ports" %} -```sh -# nv setenv GponSn ZTEGaaa01234 -``` -Reboot the ONT to apply any changes -You can check if the serial number was correclty changed using the following command: - -```sh -# diag gpon get serialnumber -ZTEGaaa01234 -``` - -## Changing the Hardware Version - -```sh -# nv setenv HV G2110CE2V1D0 -``` -Reboot ONT to apply the change - -## Changing the Equipment ID - -```sh -# nv setenv ProdName FT-G2110C-2.5G -``` -Reboot ONT to apply the change - -## Changing the IP address -```sh -# /etc/scripts/flash get LAN_IP_ADDR -LAN_IP_ADDR=192.168.1.1 -# /etc/scripts/flash set LAN_IP_ADDR 192.168.1.1 - ``` - -## Getting/Setting the ONT's PLOAM password - -{% include alert.html content="The PLOAM password is stored in ASCII format" alert="Info" icon="svg-info" color="blue" %} - -```sh -# /etc/scripts/flash get GPON_PLOAM_PASSWD -GPON_PLOAM_PASSWD=AAAAAAAAAA -# /etc/scripts/flash set GPON_PLOAM_PASSWD AAAAAAAAAA -``` -Looks like Genexis has also included an U-Boot variable to store the PLOAM. On currently known firmwares (5.6.1 and 5.7.0) it is not read by the `omci_app` daemon. -If you want to be future proof, put your PLOAM also on U-Boot env using the following command in the OS shell: - -```sh -# nv setenv ploampwd 1234567890 -ploampwd=1234567890 -``` - -## Spoofing firmware version - -{% include alert.html content="To change this data you need to upload a modified firmware. Do it at your own risk!" alert="Warning" icon="svg-warning" color="red" %} - -- Download the modified firmware from [here](https://mega.nz/file/f0QGwLSb#pyxCUQmlD-KgFU595mHYUsPPUFKJGD2Ug__mCyYIdWs) md5: `2a12b2bbc0971d76fa8201a046544a44` -- Logon on the OS shell of the ONT and run this command: `iptables -F` -- Open a web browser and go to `http://192.168.1.1/upgrade.asp` or `http://192.168.100.1/upgrade.asp`, enter the same credentials used for telnet session, select the modified firmware and click on `Upgrade` -- Once the upgrade is done and you are able to reach the ONT via telnet, log back in and run these commands to change the firmware version on both banks: - -```sh -# /etc/scripts/flash set OMCI_OLT_MODE 3 -OMCI_OLT_MODE=3 -# nv setenv sw_custom_version0=V6.0.10N14 -# nv setenv sw_custom_version1=V6.0.10N14 -``` - -Reboot the ONT and check if the version was correctly applied with this command (take a look at the `Version` field): - -```sh -# omcicli mib get 7 -XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX -SWImage -XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX -================================= -EntityID: 0x00 -Active: 0 -Committed: 0 -Valid: 1 -*Version: V6.0.10N14* -ProductCode: -ImageHash: 0x00000000000000000000000000000000 -================================= -================================= -EntityID: 0x01 -Active: 1 -Committed: 1 -Valid: 1 -*Version: V6.0.10N14* -ProductCode: -ImageHash: 0x00000000000000000000000000000000 -================================= -``` +## Optical Header installation backplate +{% include image.html file="ft-g2110c-optical-header-1.jpg" alt="FiberTwist G2110C-2.5G Optical Header installation backplate" caption="FiberTwist G2110C-2.5G Optical Header installation backplate" %} -# Known Bugs -- Modified image (based on C-5.7.1-DEV3 and C-5.7.1-EFT1) has the Web UI enabled, but without an attached fiber the daemon will crash # Miscellaneous Links -- [FiberTwist G2110C-2.5G](https://genexis.eu/content/uploads/2020/07/FiberTwist-G2110C-2.5G-Installation-Guide-v1.0-EN.pdf) -- [Modded Firmware C-5.7.1-DEV3](https://mega.nz/file/yspFRTJT#JjeDS7NwLZxCzFklQGMJVIuPawo8utQRGbMGEXQv84M) -- [Modded Firmware C-5.7.1-EFT1](https://mega.nz/file/f0QGwLSb#pyxCUQmlD-KgFU595mHYUsPPUFKJGD2Ug__mCyYIdWs) +- [FiberTwist G2110C](https://genexis.eu/wp-content/uploads/2024/08/FiberTwist-G2110C-Installation-Guide-v.3.0-EN.pdf) + diff --git a/_ont/ont-halny-hl-gsfp.md b/_ont/ont-halny-hl-gsfp.md index 127c6b7f..423cdcd6 100644 --- a/_ont/ont-halny-hl-gsfp.md +++ b/_ont/ont-halny-hl-gsfp.md @@ -21,9 +21,9 @@ parent: HALNy | System | OpenWRT | | HSGMII | Yes | | Optics | SC/APC | -| IP address | | -| Web Gui | | -| SSH | | +| IP address | 192.168.77.154/30 | +| Web Gui | none | +| SSH | port 22666 | | Telnet | | | Serial | ✅ | | Serial baud | 115200 | @@ -37,7 +37,18 @@ parent: HALNy - [Zyxel PMG3000-D20B](/ont-zyxel-pmg3000-d20b) - [D-LINK DPN-100-Rev-A2](/ont-d-link-dpn-100-rev-a2) -- [Ziza OP151s](/ont-ziza-op151s) +- [Zisa OP151s](/ont-zisa-op151s) - [T&W TW2362H-CDEL](/ont-t-w-tw2362h-cdel) +## List of partitions + +| dev | size | erasesize | name | +| ---- | -------- | --------- | ------------- | +| mtd0 | 00040000 | 00010000 | "uboot" | +| mtd1 | 00020000 | 00010000 | "uboot_env" | +| mtd2 | 003d0000 | 00010000 | "image0" | +| mtd3 | 003d0000 | 00010000 | "linux" | +| mtd4 | 002a87aa | 00010000 | "rootfs" | +| mtd5 | 000a0000 | 00010000 | "rootfs_data" | + diff --git a/_ont/ont-hilink-hl23446.md b/_ont/ont-hilink-hl23446.md index c1fa1e00..fceef552 100644 --- a/_ont/ont-hilink-hl23446.md +++ b/_ont/ont-hilink-hl23446.md @@ -36,7 +36,7 @@ parent: Hilink - [Huawei MA5671A](/ont-huawei-ma5671a) - [Nokia G-010S-P](/ont-nokia-g-010s-p) -- [ONT FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](/ont-fs-com-gpon-onu-stick-with-mac) +- [FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](/ont-fs-com-gpon-onu-stick-with-mac) - {:.text-red-200 } Dasan H650SFP - {:.text-red-200 } DpOptics D23446 - {:.text-red-200 } Photonics SPS-34-24T-HP-TDFO diff --git a/_ont/ont-huawei-eg8010h.md b/_ont/ont-huawei-eg8010h.md index f5fab577..30c11ab0 100644 --- a/_ont/ont-huawei-eg8010h.md +++ b/_ont/ont-huawei-eg8010h.md @@ -19,10 +19,11 @@ parent: Huawei | System | Dopra Linux | | 2.5GBaseT | No | | Optics | SC/APC and SC/UPC | -| IP address | 192.168.100.1 | +| IP address | 192.168.100.1 or 192.168.18.1 | | Web Gui | ✅ user `root`, password `admin` or `adminHW` and user `Epadmin`, password `adminEp` | | SSH | | -| Telnet | After Enabling user `root`, password `admin` or `adminHW` | +| Telnet | After enabling, user `root`, password `admin` or `adminHW` | +| | user `Eproot`, password `adminEp` | | Serial | | | Form Factor | ONT | @@ -36,4 +37,6 @@ parent: Huawei ## List of software versions -- V5R020C10S035 \ No newline at end of file +- V5R020C10S035 + +{% include_relative ont-huawei-useful-command.md %} diff --git a/_ont/ont-huawei-hg8010h.md b/_ont/ont-huawei-hg8010h.md index c5d898ea..ee7610fe 100644 --- a/_ont/ont-huawei-hg8010h.md +++ b/_ont/ont-huawei-hg8010h.md @@ -51,6 +51,7 @@ parent: Huawei - V5R020C10S024 (V500R020C10SPC024B001) - V5R020C10S025 (V500R020C10SPC025B002) - V5R020C10S115 (V500R020C10SPC115B270) +- V3R017C10S265 ## List of partitions diff --git a/_ont/ont-huawei-hg8110h.md b/_ont/ont-huawei-hg8110h.md new file mode 100644 index 00000000..5b659091 --- /dev/null +++ b/_ont/ont-huawei-hg8110h.md @@ -0,0 +1,35 @@ +--- +title: Huawei HG8110H +has_children: false +layout: default +parent: Huawei +--- + +# Hardware Specifications + +| | | +| --------------- | -------------------------------- | +| Vendor/Brand | Huawei | +| Model | HG8110H | +| Chipset | | +| Flash | | +| RAM | | +| System | | +| 2.5GBaseT | No | +| Optics | SC/APC | +| IP address | | +| Web Gui | | +| SSH | | +| Telnet | | +| Serial | | +| Serial baud | | +| Serial encoding | | +| Form Factor | ONT | + +## List of software versions + +## List of partitions + +# Miscellaneous Links + +- [Openreach FTTP deployment](https://www.openreach.com/fibre-broadband) diff --git a/_ont/ont-huawei-hg8240h.md b/_ont/ont-huawei-hg8240h.md new file mode 100644 index 00000000..e9e4575a --- /dev/null +++ b/_ont/ont-huawei-hg8240h.md @@ -0,0 +1,35 @@ +--- +title: Huawei HG8240H +has_children: false +layout: default +parent: Huawei +--- + +# Hardware Specifications + +| | | +| --------------- | -------------------------------- | +| Vendor/Brand | Huawei | +| Model | HG8240H | +| Chipset | | +| Flash | | +| RAM | | +| System | | +| 2.5GBaseT | No | +| Optics | SC/APC | +| IP address | | +| Web Gui | | +| SSH | | +| Telnet | | +| Serial | | +| Serial baud | | +| Serial encoding | | +| Form Factor | ONT | + +## List of software versions + +## List of partitions + +# Miscellaneous Links + +- [Openreach FTTP deployment](https://www.openreach.com/fibre-broadband) diff --git a/_ont/ont-huawei-ma5671a-carlito.md b/_ont/ont-huawei-ma5671a-carlito.md index 533b1921..cc548274 100644 --- a/_ont/ont-huawei-ma5671a-carlito.md +++ b/_ont/ont-huawei-ma5671a-carlito.md @@ -5,27 +5,51 @@ parent: Huawei MA5671A layout: default --- -# General Settings and Useful Commands +{% include alert.html content="Be careful, backup goi_config from uboot before changing the firmware." alert="Info" icon="svg-info" color="blue" %} -{% include alert.html content="Be careful, back up the goi_config from uboot before changing firmware." alert="Info" icon="svg-info" color="blue" %} +# GPON ONU status -## Setting image version +## Querying a particular OMCI ME ```sh -fw_setenv image0_version V1.7.6-170626 -fw_setenv image1_version V1.7.6-170626 +omci_pipe.sh meg MIB_IDX ME_IN ``` +Where `MIB_IDX` is the MIB ID and `ME_IN` is the ME instance number + +## Getting/Setting Speed LAN Mode + +To enable the interface to sync at 2.5 Gbps / using HSGMII with auto-neg on: -## Setting S/N ```sh -fw_setenv ont_serial ABCD12345678 +fw_setenv sgmii_mode 5 ``` -or + +To revert the afore-mentioned command: ```sh -uci set gpon.ploam.nSerial="0x48 0x57 0x54 0x43 0x9D 0xAC 0xC7 0xA3" -uci commit +fw_setenv sgmii_mode +``` + +To check the set value fo the LAN Mode: + +```sh +onu lanpsg 0 +``` +The `link_status` variable tells the current speed: + +| Value (for `sgmii_mode` and `link_status`) | Speed | +| ------------------------------------------ | ---------------------------------- | +| 3 | 1 Gbps / SGMII with auto-neg on | +| 4 | 1 Gbps / SGMII with auto-neg off | +| 5 | 2.5 Gbps / HSGMII with auto-neg on | + +# GPON/OMCI settings + +## Getting/Setting OMCI software version (ME 7) +```sh +fw_setenv image0_version V1.7.6-170626 +fw_setenv image1_version V1.7.6-170626 ``` -## Setting PLOAM Password +## Setting ONU GPON PLOAM password ```sh fw_setenv nPassword "0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39" ``` @@ -35,47 +59,25 @@ uci set gpon.ploam.nPassword="0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39" uci commit ``` -## Setting LOID and Checkcode Password +## Setting ONU GPON LOID and LOID password ```sh fw_setenv omci_loid 1234567890 fw_setenv omci_lpwd password01 ``` If LOID is disabled in the firmware try alternative software. -## Setting and checking oem-generic -```sh -fw_setenv target oem-generic -fw_printenv target=oem-generic -``` - -## Getting/Setting Speed LAN Mode - -To enable the 2.5 Gbps / HSGMII with auto-neg on: - +## Setting ONU GPON Serial Number ```sh -fw_setenv sgmii_mode 5 -``` - -To remove the value (back to default): -```sh -fw_setenv sgmii_mode +fw_setenv ont_serial ABCD12345678 ``` - -To get the LAN Mode: - +or ```sh -onu lanpsg 0 +uci set gpon.ploam.nSerial="0x48 0x57 0x54 0x43 0x9D 0xAC 0xC7 0xA3" +uci commit ``` -The `link_status` variable tells the current speed - -| Value (for `sgmii_mode` and `link_status`) | Speed | -| ------------------------------------------ | ---------------------------------- | -| 3 | 1 Gbps / SGMII with auto-neg on | -| 4 | 1 Gbps / SGMII with auto-neg off | -| 5 | 2.5 Gbps / HSGMII with auto-neg on | -## Querying a particular OMCI ME +## Setting and checking oem-generic ```sh -omci_pipe.sh meg MIB_IDX ME_IN -``` -Where `MIB_IDX` is the MIB ID and the `ME_IN` is the ME instance number \ No newline at end of file +fw_setenv target oem-generic +fw_printenv target=oem-generic +``` \ No newline at end of file diff --git a/_ont/ont-huawei-ma5671a-china.md b/_ont/ont-huawei-ma5671a-china.md deleted file mode 100644 index ddbfb18b..00000000 --- a/_ont/ont-huawei-ma5671a-china.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: right.com.cn Firmware for Huawei MA5671A -has_children: false -layout: default -parent: Huawei MA5671A ---- - -# General setting - -{% include alert.html content="Be careful, use this firmware only if you have performance problems with all other firmwares." alert="Info" icon="svg-info" color="blue" %} - -{% include alert.html content="Do not use in-browser translators, use a translation app on your phone through virtual reality." alert="Danger" icon="svg-warning" color="red" %} - -1. Flash on the 0 partition - -2. Run via ssh - -```sh -jffs2reset -``` - -3. Reboot - -4. Fill in the data from left to right and from top to bottom, with save & apply on every page - -5. Reboot - -6. Edit the incorrect data, save and apply the pending changes - -7. Reboot \ No newline at end of file diff --git a/_ont/ont-huawei-ma5671a-fs-mod.md b/_ont/ont-huawei-ma5671a-fs-mod.md index 622c7435..fa2dede8 100644 --- a/_ont/ont-huawei-ma5671a-fs-mod.md +++ b/_ont/ont-huawei-ma5671a-fs-mod.md @@ -11,20 +11,20 @@ layout: default Flash the firmware image to image0 or image1 via [SSH](/ont-huawei-ma5671a/#flashing-a-new-rootfs-via-ssh) or via [TTL serial](/ont-huawei-ma5671a-ymodem) as usual. -After the flash it is absolutely necessary to connect to the SFP via telnet using the IP 192.168.1.10: +After flashing, it is absolutely necessary to connect to the SFP via telnet using the IP 192.168.1.10: ```sh telnet 192.168.1.10 ``` -Once connected via telnet to the SFP, execute the following commands, it will be necessary to wait a few minutes until the end of the automatic procedure: +Once connected via telnet to the SFP, execute the following commands. Then wait a few minutes until the end of the automatic procedure: ```sh firstboot reboot ``` -Remember that with each flash of this firmware it is always necessary to perform the procedure described above, otherwise the SFP will not work! +Performing the procedure described above is necessary after each flash of this firmware, otherwise the SFP will not work! # Login info @@ -40,17 +40,17 @@ Remember that with each flash of this firmware it is always necessary to perform # GPON ONU status -## Get the operational status of the ONU +## Getting the operational status of the ONU ```sh onu ploam_state_get ``` -## Get optical laser status +## Getting optical laser status ```sh otop -g s ``` -## Get information of the OLT +## Getting information of the OLT vendor ```sh omci_pipe.sh meg 131 0 ``` @@ -59,14 +59,14 @@ omci_pipe.sh meg 131 0 ```sh omci_pipe.sh meg MIB_IDX ME_IN ``` -Where `MIB_IDX` is the MIB ID and the `ME_IN` is the ME instance number +Where `MIB_IDX` is the MIB ID and `ME_IN` is the ME instance number. -## Get VLAN table rule +## Getting VLAN table rule ```sh gtop -g "GPE VLAN rule" ``` -## Get GEM port status table +## Getting GEM port status table ```sh gtop -g e ``` @@ -78,7 +78,7 @@ To get the LAN Mode: ```sh onu lan_port_status_get 0 ``` -The `link_status` variable tells the current speed +The `link_status` variable tells the current speed: | Value (for `sgmii_mode` and `link_status`) | Speed | | ------------------------------------------ | ---------------------------------- | @@ -90,42 +90,44 @@ To change the default lan mode value you can use `fw_setenv sgmii_mode`. The fir # GPON/OMCI settings -## Setting ONU GPON serial number +## Setting ONU GPON Serial Number ```sh fw_setenv onu_serial "YOUR_SERIAL_ASCII" ``` -## Setting ONU GPON ploam +## Setting ONU GPON PLOAM password ```sh fw_setenv onu_ploam "YOUR_PLOAM_ASCII" ``` -## Setting ONU GPON loid +{% include alert.html content="If your ploam is in HEX convert it to ASCII, any non-printable characters write them in HEX with a slash in front, such as `\0x7F`. If the PLOAM is less than 10 bytes (one printable character counts as one byte, `\0x7F` also counts as one byte) add `\0x00` to the end to get to 10 bytes." alert="Note" icon="svg-info" color="blue" %} + +## Setting ONU GPON LOID ```sh fw_setenv onu_loid "YOUR_LOID" ``` -## Setting ONU GPON loid password +## Setting ONU GPON LOID password ```sh fw_setenv onu_loid_password "YOUR_LOID_PASSWORD" ``` -## Setting OMCI vendor ID +## Setting OMCI vendor ID (ME 256) ```sh fw_setenv omci_vendor_id "YOUR_VENDOR_ID" ``` -## Setting OMCI equipment ID +## Setting OMCI equipment ID (ME 257) ```sh fw_setenv omci_equip_id "YOUR_EQUIP_ID" ``` -## Setting OMCI hardware ID +## Setting OMCI hardware version (ME 256) ```sh fw_setenv omci_hw_ver "YOUR_HW_VER" ``` -## Setting OMCI software version +## Setting OMCI software version (ME 7) ```sh fw_setenv image0_version "YOUR_SW_VERSION_0" fw_setenv image1_version "YOUR_SW_VERSION_1" @@ -133,10 +135,11 @@ fw_setenv image1_version "YOUR_SW_VERSION_1" # Advanced settings -{% include alert.html content="Normally they are not necessary and it would be better not to touch them" alert="Note" icon="svg-warning" color="red" %} +{% include alert.html content="Changing these is normally not necessary and not changing them is a good idea" alert="Note" icon="svg-warning" color="red" %} + +## Setting custom OMCI MIB file -## Setting custom mib file -You have to copy the MIB file to /etc/mibs and then run this command: +Copy the MIB file to /etc/mibs, then run this command: ```sh fw_setenv mib_file_custom "YOUR_MIB_FILENAME" @@ -155,7 +158,7 @@ reboot # SFP EEPROM settings -{% include alert.html content="Normally they are not necessary and it would be better not to touch them" alert="Note" icon="svg-warning" color="red" %} +{% include alert.html content="Changing these is normally not necessary and not changing them is a good idea" alert="Note" icon="svg-warning" color="red" %} ## Setting SFP vendor name ```sh @@ -188,6 +191,6 @@ fw_setenv sfp_vendor_data "YOUR_SFP_VENDOR_DATA" ``` # List of firmwares and files -- [6BA1896SPLQA42_MODDED_ver5.img](https://mega.nz/file/g9MTxAzR#qSU-OB6SlAVOE97ajSnEP--UcsvurPkpraJPgds3r6g){: .btn } md5hash: 63c02951d5c7ce5c83de54636368520f -- [6BA1896SPLQA42_MODDED_ver4.img](https://mega.nz/file/MgVWgBJS#L8N7kPZtSJ7FtbtxRcnxNF-W3b9wDbCeJ82YgnK7moQ){: .btn } md5hash: 63b0cc790c0087a5a1197c89b502b002 -- [6BA1896SPLQA42_MODDED_ver3.img](https://mega.nz/file/Np1gmQpI#CVUUHf3yayB9NB-2uI4MX3qCcEwMiLX6e5DqgJz4Kig){: .btn } md5hash: 90348ff0ccaad475cf14d9d0a056cf72 +- [6BA1896SPLQA42_MODDED_ver5-1.img](https://mega.nz/file/5tNwFC5A#aXOlrZgLZ6sL81CKDOoBmXotLqDTJLQzpvokYU--bz0){: .btn } md5hash: c4f1bbe1695803d3d449f911f43d78ea +- [6BA1896SPLQA42_MODDED_ver4.img](https://mega.nz/file/Q4dFTBqQ#L8N7kPZtSJ7FtbtxRcnxNF-W3b9wDbCeJ82YgnK7moQ){: .btn } md5hash: 63b0cc790c0087a5a1197c89b502b002 +- [6BA1896SPLQA42_MODDED_ver3.img](https://mega.nz/file/YkMwHSgR#7Sdk0LIBv3hLQJKQ4TBub4ABtwYyCAdP6Rl2C3RBztw){: .btn } md5hash: 90348ff0ccaad475cf14d9d0a056cf72 diff --git a/_ont/ont-huawei-ma5671a-root-web.md b/_ont/ont-huawei-ma5671a-root-web.md index 6b514f4e..6a17090a 100644 --- a/_ont/ont-huawei-ma5671a-root-web.md +++ b/_ont/ont-huawei-ma5671a-root-web.md @@ -28,9 +28,8 @@ Connect the TTL adapter to the computer, once done press the following button. A {: .text-center .fs-6 } -{% include root_lantiq.html modelName="Huawei MA5671A" unlockHuaweiShell=true %} - +{% include root_lantiq.html modelName="Huawei MA5671A" unlockHuaweiShell=true %} @@ -39,13 +38,13 @@ Connect the TTL adapter to the computer, once done press the following button. A # Connect to the stick via SSH -After this is done, reboot the stick, after connecting it to the router via an ethernet mediaconverter or directly plug it in an SFP port, with the port's IP set to whatever IP of the `192.168.1.0/24` subnet (the stick has the IP `192.168.1.10`) +After this is done, reboot the stick, after connecting it to a router via an ethernet mediaconverter or directly plugging it in an SFP port, with the port's IP set to any IP of the `192.168.1.0/24` subnet (the stick has the IP `192.168.1.10`) -{% include alert.html content="If your subnet is `192.168.1.0/24` make sure you have no ip conflicts." alert="Note" icon="svg-warning" color="yellow" %} +{% include alert.html content="If your LAN subnet is `192.168.1.0/24` make sure you have no ip conflicts." alert="Note" icon="svg-warning" color="yellow" %} {% include alert.html content="On some SFP host devices you might not be able to connect to the stick if there's no optical signal (RX loss), in that case you need to connect the fiber to make changes on the stick" alert="Note" icon="svg-warning" color="yellow" %} -Run the terminal and login to the stick with ssh +Run the terminal and login to the stick using ssh: ```shell ssh root@192.168.1.10 @@ -57,14 +56,14 @@ The password is `admin123`. # TX Fault / Serial -The stick stays in a perpetual "TX Fault" state since the same SFP pin is used for both serial and TX Fault signaling, if that causes you issues (normally it shouldn't) you can issue the commands below to disable it. Note that it will disable both the TX Fault signal and Serial on the stick after boot. +The stick stays in a perpetual "TX Fault" state since the same SFP pin is used for both serial and TX Fault signaling. If that causes you issues (normally it shouldn't), you can issue the commands below to disable it. Note that it will disable both the TX Fault signal and Serial on the stick after boot. ```sh fw_setenv asc0 1 fw_setenv preboot "gpio set 3;gpio input 100;gpio input 105;gpio input 106;gpio input 107;gpio input 108" ``` -In case you need to re-enable it issue the following commands from the bootloader (FALCON) +In case you need to re-enable it, issue the following commands from the bootloader (FALCON) ```sh FALCON => setenv asc0 0 diff --git a/_ont/ont-huawei-ma5671a-root.md b/_ont/ont-huawei-ma5671a-root.md index 0fbf987b..7e01b259 100644 --- a/_ont/ont-huawei-ma5671a-root.md +++ b/_ont/ont-huawei-ma5671a-root.md @@ -134,9 +134,9 @@ sed -i "s|/opt/lantiq/bin/minishell|/bin/ash|g" /etc/passwd {% include alert.html content="The cause of these kernel panics could be insufficient supply of power." alert="Info" icon="svg-info" color="blue" %} {:style="counter-reset:none"} -1. After this is done, reboot the stick, after connecting it to the router via an ethernet mediaconverter or directly plug it in an SFP port, with the port's IP set to whatever IP of the 192.168.1.0/24 subnet (the stick has the IP 192.168.1.10) +After this is done, reboot the stick, after connecting it to a router via an ethernet mediaconverter or directly plugging it in an SFP port, with the port's IP set to any IP of the `192.168.1.0/24` subnet (the stick has the IP `192.168.1.10`) -{% include alert.html content="If your subnet is 192.168.1.0/24 make sure you have no ip conflicts." alert="Note" icon="svg-warning" color="yellow" %} +{% include alert.html content="If your LAN subnet is `192.168.1.0/24` make sure you have no ip conflicts." alert="Note" icon="svg-warning" color="yellow" %} {% include alert.html content="On some SFP host devices you might not be able to connect to the stick if there's no optical signal (RX loss), in that case you need to connect the fiber to make changes on the stick" alert="Note" icon="svg-warning" color="yellow" %} @@ -157,7 +157,7 @@ The password is `admin123`. {% include alert.html content="This procedure requires the physical disassembly of the stick, and the use of tweezers that can burn the stick, it is highly recommended not to use it." alert="Important" icon="svg-warning" color="red" %} -1. take the SFP molex and the 4 coloured cables and solder them to the molex according to the following diagram: +1. Take the SFP molex and the 4 coloured cables and solder them to the molex according to the following diagram: | USB TTL (UART) Adapter | wire colour in picture | SFP 20pins Molex connector | | ---------------------- | ---------------------- | -------------------------- | @@ -177,14 +177,14 @@ The password is `admin123`. {% include image.html file="ma5671a-root-4.jpg" alt="Metal tabs that hold the cover in place" caption="Metal tabs that hold the cover in place" %} {:style="counter-reset:none"} -1. Once you have removed the metal casing, you are left with the half-naked stick (note that the release mechanism also comes off easily and then you don't know how to put it back together, so take a photo and memorise the positioning well). +1. Once you have removed the metal casing, you are left with the half-naked stick. Note that the release mechanism also comes off easily, so it is recommended to take a photo and to memorise the positioning to be able to put it back together in the case it does come off. -1. Before shorting the stick, connect the previously soldered cables and molex to the USB serial (photo immediately below) and to the stick (the molex, of course) and check that the jumper on the usb key is set to 3.3V +1. Before shorting the stick, connect the previously soldered cables and molex to the USB serial (photo immediately below) and to the stick (via the molex, of course) and check that the jumper on the usb key is set to 3.3V {% include image.html file="ma5671a-root-8.jpg" alt="TTL" caption="TTL" %} {:style="counter-reset:none"} -1. The disassembled stick will appear as in the photo, in which I have highlighted in red the 2 pins to be shorted. Here they use wire, but a pair of tweezers is sufficient (I used those, in fact). Be careful not to make any other contacts by possibly covering everything else with electrical tape. +1. The disassembled stick will appear as in the photo: the two pins to be shorted are highlighted in red. In the photo below a wire is used, but a pair of tweezers is sufficient (I used those, in fact). Be careful not to touch anything around the two pins by possibly covering everything else with electrical tape. {% include image.html file="ma5671a-root-4.jpg" alt="tweezers" caption="tweezers" %} {% include image.html file="ma5671a-root-6.jpg" alt="tweezers" caption="tweezers" %} @@ -192,9 +192,10 @@ The password is `admin123`. {% include image.html file="ma5671a-root-6.jpg" alt="tweezers" caption="tweezers" %} {:style="counter-reset:none"} -1. For the moment connect all cables to the usb key except the green (ground) or red (voltage), otherwise the stick will boot before you can do the following (N.B. for those who bought the uart above RX and TX are reversed). Open and configure Teratem for serial connection (select the correct com port, speed 115.200, english language, otherwise in japainise you can't read anything understandable) insert the key in the PC (I take it for granted that it has already been installed, drivers and all), short the 2 pins seen above and keeping the short connected the missing coloured cable +1. For the moment connect all cables to the usb key except the green (ground) or red (voltage), otherwise the stick will boot before you can do the following (N.B. for those who bought the uart above RX and TX are reversed). Open and configure Tera Term for serial connection by selecting the correct com port, speed 115200 bauds, english language (otherwise in japanese you can't read anything understandable), then insert the key in the PC (the adapter being already installed is taken for granted), short the 2 pins seen above and, while keeping the pins shorted, connect the missing coloured cable -1. If you have done everything correctly, you should see something similar to the picture below (if nothing happens, you have obviously done something wrong with cables, molexes, soldering irons, etc., so you will have to start from the beginning again and work out which step you did wrong): +1. If nothing happens, you have obviously done something wrong with cables, molexes, soldering irons, etc., so you will have to start from the beginning again and work out which step you did wrong. +If you have done everything correctly, you should see something similar to the picture below: {% include image.html file="ma5671a-root-9.png" alt="serial shell" caption="serial shell" %} @@ -204,12 +205,12 @@ The password is `admin123`. {% include image.html file="ma5671a-root-10.png" alt="serial shell 2" caption="serial shell 2" %} {:style="counter-reset:none"} -1. From the Teraterm menu `FILE` → `TRANSFER` → `XMODEM` → `SEND` → `[1224abort.bin]` (which is the third of the files downloaded earlier): +1. From the Tera Term menu `FILE` → `TRANSFER` → `XMODEM` → `SEND` → `[1224abort.bin]` (which is the third of the files downloaded earlier): {% include image.html file="ma5671a-root-11.png" alt="1224abort.bin" caption="1224abort.bin" %} {:style="counter-reset:none"} -1. As soon as the file transfer is complete, you have 2 seconds to press `CTRL+C`, if you have not done so, you can return to the step 6. Otherwise, you should see: +1. As soon as the file transfer is complete, you have 2 seconds to press `CTRL+C`. If you have not done so, return to step 6. Otherwise, you should see: {% include image.html file="ma5671a-root-12.png" alt="falcon shell" caption="falcon shell" %} @@ -224,10 +225,10 @@ FALCON => saveenv {% include alert.html content="Originally, this other string was used for the `setenv preboot`: `gpio input 105;gpio input 106;gpio input 107;gpio input 108;gpio set 3;gpio set 109;gpio set 110;gpio clear 423;gpio clear 422;gpio clear 325;gpio clear 402;gpio clear 424`" alert="Info" icon="svg-info" color="blue" %} -{% include alert.html content="Instead of the nexts points, it is recommended to boot and run the `sed` command documented in V2" alert="Warning" icon="svg-warning" color="red" %} +{% include alert.html content="Instead of taking the next steps, it is recommended to boot and run the `sed` command documented in V2" alert="Warning" icon="svg-warning" color="red" %} {:style="counter-reset:none"} -1. If you have done everything correctly you can reboot the stick (actually if you are convinced that everything is ok you could also close it again), disconnecting and reconnecting one of the 2 cables from before (ground or voltage), then again from the terminal you will have 5 seconds to lock the bootloader by doing a simple CTRL+C. Now upload the firmware image of the first mtd2 partition to the stick with the command +1. If you have done everything correctly you can reboot the stick (if you are convinced that everything is ok you could also close it again), disconnect and reconnect either the ground or voltage cable, then again you will have 5 seconds to lock the bootloader by doing a simple CTRL+C using the terminal. Now upload the firmware image of the first mtd2 partition to the stick with the command ``` FALCON => loadb 0x80800000 ``` @@ -236,8 +237,8 @@ At this point it will appear: {% include image.html file="ma5671a-root-13.jpg" alt="shell requiring `mtd2` upload" caption="shell requiring `mtd2` upload" %} {:style="counter-reset:none"} -1. From the teratem menu do `FILE` → `TRANSFER` → `KERMIT` → `SEND` → `[mtd2.bin]`. -It will start uploading the file at a speed of about 3-4 KBps. Now you will have to wait more than half an hour for the upload to complete. +1. From the Tera Term menu do `FILE` → `TRANSFER` → `KERMIT` → `SEND` → `[mtd2.bin]`. +It will start uploading the file at a speed of about 3-4 KBps: it should take more than half an hour for the upload to complete. 1. Once finished, the image loaded on the stick must also be saved to the corresponding system partition (the first of the 2) with the commands ``` @@ -246,11 +247,11 @@ FALCON => sf erase C0000 740000 FALCON => sf write 80800000 C0000 740000 ``` -1. check that the stick is configured to boot from partition 0 (yes I know mtd2 goes on 0 and mtd5 goes on 1, complain to Laniq) with the command +1. Check that the stick is configured to boot from partition 0 (We are aware that mtd2 goes on 0 and mtd5 goes on 1, complain to Lantiq about this) with the command: ``` FALCON => printenv committed_image ``` -1. If it is 0, fine, otherwise configure partition 0 with the commands, and check if are 0. +1. If it is 0 there's no need to do anything, otherwise configure the stick to boot from partition 0 with the following commands, then check if the settings were changed correctly. ``` FALCON => setenv committed_image 0 FALCON => saveenv diff --git a/_ont/ont-huawei-ma5671a-rooted.md b/_ont/ont-huawei-ma5671a-rooted.md index bca95123..ab608905 100644 --- a/_ont/ont-huawei-ma5671a-rooted.md +++ b/_ont/ont-huawei-ma5671a-rooted.md @@ -5,14 +5,40 @@ parent: Huawei MA5671A layout: default --- -# General Settings and Useful Commands +# Usage -{% include alert.html content="In this firmware, unlike the other ones, the data must be modified in a base64-encoded file. To simplify this, you can use the following web application." alert="Info" icon="svg-info" color="blue" %} +## Minishell + +This firmware version offers a minishell in addition to the normal sh shell. Commands offered by minishell are as follows: + +{% include serial_dump.html file="ma5671a_minishell.txt" alt="Huawei MA5671A minishell" title="Huawei MA5671A minishell" %} + +## Root + +For general use, minishell does not allow any modifications and [Web root procedure](/ont-huawei-ma5671a-root-web) is required. + +# GPON ONU status + +## Getting the operational status of the ONU + +```sh +onu ploamsg +``` + +## Querying a particular OMCI ME +```sh +omci_pipe.sh meg MIB_IDX ME_IN +``` +Where `MIB_IDX` is the MIB ID and `ME_IN` is the ME instance number + +# GPON/OMCI settings + +{% include alert.html content="In this firmware, unlike the other ones, all data must be modified in a base64-encoded file. To simplify this, you can use the following web application." alert="Info" icon="svg-info" color="blue" %} ## Web procedure -1. Get `fw_printenv sfp_a2_info` and paste into the form +1. Get `fw_printenv sfp_a2_info` and paste into the form:

@@ -21,7 +47,7 @@ layout: default -{% include alert.html content="Executing these commands requires a minimum of familiarity with `vim`. If you do not know `vim`, follow the commands precisely." alert="Danger" icon="svg-warning" color="red" %} +{% include alert.html content="Executing these commands requires familiarity with `vim`. If you are not in any way familiar with `vim`, follow these commands precisely." alert="Danger" icon="svg-warning" color="red" %} {:style="counter-reset:none"} 1. Copy the script's output to the clipboard @@ -56,7 +82,7 @@ AAAAAAAAAAJIV1RDESIzRP///////////////////wAAAAAAAAAAAAAAAAAA 00000000000000024857544311223344ffffffffffffffffffffffffffffff0000000000000000000000000000 ``` -The entire S/N, including the PON ID, is encoded first in hexadecimal and then in base64 +The entire S/N, including the PON ID, is first encoded in hexadecimal and then in base64 3. Setting PLOAM Password @@ -66,7 +92,7 @@ ffffffffffffffff00021437d77db7df7e37e77eb7ef7f37f77d0000000000000000000000000000 //////////8AAhQ31323334353637383930AAAAAAAAAAAAAAAAAAAAAAAAA ``` -The entire PLOAM, is encoded first in hexadecimal and then in base64 +The entire PLOAM, is first encoded in hexadecimal and then in base64 4. Setting MAC Address @@ -91,19 +117,6 @@ fw_printenv nPassword fw_printenv gSerial fw_printenv ethaddr ``` - -## Checking whether the connection with the OLT was successful (O5 state) - -```sh -onu ploamsg -``` - -## Disabling dying gasp - -```sh -fw_setenv nDyingGaspEnable 0 -``` - ## Getting/Setting Speed LAN Mode To get the LAN Mode: @@ -119,13 +132,15 @@ The `link_status` variable tells the current speed | 4 | 1 Gbps / SGMII with auto-neg off | | 5 | 2.5 Gbps / HSGMII with auto-neg on | -To change the default lan mode value you can use `fw_setenv sgmii_mode`. The firmware already has the value 5 by default and it is generally not necessary to change it. +To change the default lan mode value you can use `fw_setenv sgmii_mode`. The firmware is already set to 2.5G auto-negotiation, you shouldn't touch it. + +# Advanced settings + +## Disabling dying gasp -## Querying a particular OMCI ME ```sh -omci_pipe.sh meg MIB_IDX ME_IN +fw_setenv nDyingGaspEnable 0 ``` -Where `MIB_IDX` is the MIB ID and the `ME_IN` is the ME instance number # Miscellaneous Links diff --git a/_ont/ont-huawei-ma5671a-ymodem.md b/_ont/ont-huawei-ma5671a-ymodem.md index cd1339c6..9a7b5511 100644 --- a/_ont/ont-huawei-ma5671a-ymodem.md +++ b/_ont/ont-huawei-ma5671a-ymodem.md @@ -5,7 +5,7 @@ parent: Huawei MA5671A layout: default --- -This procedure flashes the firmware in the stick via serial. You have to get firmware to flash, some are listed on the [Huawei MA5671A page](/ont-huawei-ma5671a). +This procedure flashes the firmware on the stick via serial. Some of the firmwares that can be flashed are listed on the [Huawei MA5671A page](/ont-huawei-ma5671a). {: .text-center .fs-6 } diff --git a/_ont/ont-huawei-ma5671a.md b/_ont/ont-huawei-ma5671a.md index 1609d5c2..b2ef9288 100644 --- a/_ont/ont-huawei-ma5671a.md +++ b/_ont/ont-huawei-ma5671a.md @@ -35,7 +35,7 @@ parent: Huawei ## Firmware is interchangeable with: - [Nokia G-010S-P](/ont-nokia-g-010s-p) -- [ONT FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](/ont-fs-com-gpon-onu-stick-with-mac) +- [FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](/ont-fs-com-gpon-onu-stick-with-mac) - [Hilink HL23446](/ont-hilink-hl23446) - {:.text-red-200 } Dasan H650SFP - {:.text-red-200 } DpOptics D23446 @@ -119,9 +119,10 @@ For more info [XPONos partition layout](https://github.com/XPONos/linux_lantiq-f - [1224abort.bin](https://ma5671a.s3.nl-ams.scw.cloud/1224ABORT.bin){: .btn } md5hash: 10e94a4b4acdc82dec20c7904b69e5c0 - [right.com.cn (China) 19 July 2022](https://mega.nz/file/9fpSkYTb#wNyjAj1kOLWC9HozX-gTQ-TS3VFqRYg--x1rm7RSuDg){: .btn } md5hash: 6b5e7e3c659fe3f0204340fa746ac4fc - [right.com.cn (China) 29 Aug 2022](https://mega.nz/file/VHFFSBrT#2WhDPcdON5EHR01l6Ut35GC3sl55e4l09Z0NUo_7SWA){: .btn} md5hash: 3d357e2dc7b59c66fe61b4ddf1fb8dc0 -- [ONT FS.com GPON ONU Stick with MAC firmware / SourcePhotonics SPS-34-24T-HP-TDFO firmware](/ont-fs-com-gpon-onu-stick-with-mac) +- [right.com.cn (China) 20 Nov 2023](https://mega.nz/file/8vcwyJRA#yuzjyI9Y9vsA0RegGnNOy_JLv2FNRIMfI5JxHn8t0-s){: .btn} md5hash: 4901ae8e70991ca1202bc80db9c151cc +- [FS.com GPON ONU Stick with MAC firmware / SourcePhotonics SPS-34-24T-HP-TDFO firmware](/ont-fs-com-gpon-onu-stick-with-mac) -# General Settings and Useful Commands +# Usage - [Huawei Rooted Firmware General Setting](/ont-huawei-ma5671a-rooted) - [Carlito Firmware General Setting](/ont-huawei-ma5671a-carlito) @@ -129,6 +130,8 @@ For more info [XPONos partition layout](https://github.com/XPONos/linux_lantiq-f - [right.com.cn (China) Firmware General Setting](/ont--huawei-ma5671a-china) - [Nokia G-010S-P Firmware General Setting](/ont-nokia-g-010s-p) +# Advanced settings + ## Transferring files to the stick {% include alert.html content="If you use a modern OpenSSH version (e.g. >= 8.8) you will have to use the legacy protocol and enable some deprecated algorithms: scp `-oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-dss [...]`" alert="Info" icon="svg-info" color="blue" %} @@ -177,7 +180,6 @@ cat /dev/mtdX | nc 192.168.1.11 1234 ## Booting to a different image - ```sh # fw_setenv committed_image 0|1 # fw_setenv image0|1_is_valid 1 @@ -252,6 +254,13 @@ The Huawei MA5671A stores the content of the emulated EEPROM in U-Boot env varia - `EEPROM0 (A0h)` stored in U-Boot env variable `sfp_a0_low_128` - `EEPROM1 (A2h)` stored in U-Boot env variable `sfp_a2_info` +## EEPROM Editing Tool for MA5671A + +A simple tool to help edit the EEPROM of the **Huawei MA5671A**, created by **MrFreeZZ**: https://github.com/hack-gpon/MA5671A-Eeprom/releases + +✅ Automatically calculates the checksum, making the process easier and safer. + + ## EEPROM0 layout | address | size | name | default value | description | @@ -392,4 +401,4 @@ The Huawei MA5671A stores the content of the emulated EEPROM in U-Boot env varia --- -[^subunit]: The subunit are 10000 times smaller than the specified unit \ No newline at end of file +[^subunit]: The subunit are 10000 times smaller than the specified unit diff --git a/_ont/ont-huawei-useful-command.md b/_ont/ont-huawei-useful-command.md index d664b16b..9c3f6b59 100644 --- a/_ont/ont-huawei-useful-command.md +++ b/_ont/ont-huawei-useful-command.md @@ -1,19 +1,18 @@ ## Enabling telnet -We need access to a specific shell and in order to get it we have to enable telnet. On the unit, the telnet server accepts connections but doesn't read any input, nor does it send anything. +We need access to a specific shell and in order to get it enabling telnet is required. On the ONT, the telnet server accepts connections but doesn't read any input, nor does it send anything. -To enable telnet we’ll use one of the web interface’s features: the configuration backup and restore page. The configuration can be downloaded as an XML, which contains a lot more options than the web interface and a couple of them can be modified to enable telnet access: under the `X_HW_CLITelnetAccess` node, set the `Access` attribute to `1` and in `AclServices`, `TELNETLanEnable` should also be set to `1`. I had to set both but your mileage may vary. +To enable telnet the configuration backup/restore web UI page will be used. The configuration can be downloaded as an XML, which contains a lot more options than the web interface and a couple of them can be modified to enable telnet access: under the `X_HW_CLITelnetAccess` node, set the `Access` attribute to `1` and, in `AclServices`, `TELNETLanEnable` should also be set to `1`. Both might have to be set but your mileage may vary. It is possible that this won't work/has been fixed in more recent versions. Now that this is done, the modified configuration file can be uploaded via the web interface, the ONT will restart and telnet should be accessible on port 23. - -# General Settings and Useful Commands - {% include alert.html content="All results need to be converted from HEX to ASCII. You can use our [Converter](/ascii-hex), taking care to add 0x in front and remove the spaces every 8 hex digits." alert="Warning" icon="svg-info" color="blue" %} -## Getting the OLT vendor +# GPON ONU status + +## Getting information on the OLT vendor ``` WAP>omcicmd mib show meid 131 instid 0 @@ -31,7 +30,9 @@ success! ``` *0x48575443* → *HWTC* (Huawei) -## Getting the ONT SW Version 0 and 1 +# GPON/OMCI settings + +## Getting OMCI software version (ME 7) ``` WAP>omcicmd mib show meid 7 instid 0 @@ -61,7 +62,7 @@ success! ``` *0x56355230 32304331 30533131 3500* → *V5R020C10S115* -## Getting the ONT Vendor ID and HW Version: +## Getting OMCI hardware version and vendor ID (ME 256) ``` WAP>omcicmd mib show meid 256 instid 0 @@ -90,7 +91,7 @@ success! *0x48575443* → *HWTC* *0x32343046 2e41* → *240F.A* -## Getting the ONT Equipment ID +## Getting OMCI equipment ID (ME 257) ``` WAP>omcicmd mib show meid 257 instid 0 diff --git a/_ont/ont-kaon-pg1892g.md b/_ont/ont-kaon-pg1892g.md new file mode 100644 index 00000000..9664fc3a --- /dev/null +++ b/_ont/ont-kaon-pg1892g.md @@ -0,0 +1,35 @@ +--- +title: KAON PG1892G +has_children: false +layout: default +parent: KAON +--- + +# Hardware Specifications + +| | | +| --------------- | -------------------------------- | +| Vendor/Brand | KAON | +| Model | PG1892G | +| Chipset | | +| Flash | | +| RAM | | +| System | | +| 2.5GBaseT | No | +| Optics | SC/APC | +| IP address | | +| Web Gui | | +| SSH | | +| Telnet | | +| Serial | | +| Serial baud | | +| Serial encoding | | +| Form Factor | ONT | + +## List of software versions + +## List of partitions + +# Miscellaneous Links + +- [KCOM Full Fibre](https://www.kcom.com/) diff --git a/_ont/ont-ziza.md b/_ont/ont-kaon.md similarity index 77% rename from _ont/ont-ziza.md rename to _ont/ont-kaon.md index 60af7901..b683125f 100644 --- a/_ont/ont-ziza.md +++ b/_ont/ont-kaon.md @@ -1,5 +1,5 @@ --- -title: Ziza +title: KAON has_children: true layout: default --- \ No newline at end of file diff --git a/_ont/ont-leox-lxt-010g-d.md b/_ont/ont-leox-lxt-010g-d.md index 02da1894..af3fc37b 100644 --- a/_ont/ont-leox-lxt-010g-d.md +++ b/_ont/ont-leox-lxt-010g-d.md @@ -30,4 +30,9 @@ parent: LEOX The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. -{% include_relative ont-luna-sdk-useful-commands.md ploam='ascii' flash='/etc/scripts/flash' %} +{% include_relative ont-luna-sdk-useful-commands.md + ploam='ascii' + flash='/etc/scripts/flash' + customSwVersionAlert='This needs the `OMCI_OLT_MODE` value to be set to `21`. This will force the stick to use your own settings from the XML file, but this is a hack and causes sigsegv of `/bin/checkomci`.' + omciOLT21='true' +%} diff --git a/_ont/ont-leox-lxt-010h-d.md b/_ont/ont-leox-lxt-010h-d.md index 5fa1e44a..72a3703b 100644 --- a/_ont/ont-leox-lxt-010h-d.md +++ b/_ont/ont-leox-lxt-010h-d.md @@ -7,25 +7,25 @@ parent: LEOX # Hardware Specifications -| | | -| --------------- | ------------------------------------ | -| Vendor/Brand | LEOX | -| Model | LXT-010H-D | -| Chipset | Realtek RTL9601D | -| Flash | SPI NOR 16MB | -| RAM | 32MB | -| System | Linux 3.18 (Luna SDK 3.3) | -| 2.5GBaseT | Yes | -| PHY Ethernet | RTL8221B | -| Optics | SC/APC | -| IP address | 192.168.100.1/24 | -| Web Gui | yes | -| SSH | | -| Telnet | ✅ user `leox`, password `leolabs_7` | -| Serial | ✅ | -| Serial baud | 115200 | -| Serial encoding | 8-N-1 | -| Form Factor | ONT | +| | | +| --------------- | ---------------------------------------------------------------------- | +| Vendor/Brand | LEOX | +| Model | LXT-010H-D | +| Chipset | Realtek RTL9601D | +| Flash | SPI NOR 16MB | +| RAM | 32MB | +| System | Linux 3.18 (Luna SDK 3.3) | +| 2.5GBaseT | Yes | +| PHY Ethernet | RTL8221B | +| Optics | SC/APC | +| IP address | 192.168.100.1/24 | +| Web Gui | yes, same logins as Telnet | +| SSH | | +| Telnet | ✅ user `leox`, password `leolabs_7` OR user `adsl`, password `realtek` | +| Serial | ✅ | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | # External Photos @@ -61,15 +61,25 @@ The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be acc This ONT supports dual boot. -`k0` and `r0` respectively contain the kernel and firmware of the first image, while `k1` and `r1` respectively contain the kernel and the firmware of the second one. +`k0` and `r0` respectively contain kernel and firmware of the first image, while `k1` and `r1` contain kernel and firmware of the second one. ## List firmware version - V3.3.2L6 - V3.3.2L7 - -{% include alert.html content="Before proceed on any modification, make a backup of files rtl8290b.data and europa.data from /var/config folder. These files include optical calibration of your ONT's laser, if you accidentally delete or ruin them, your ONT will be unusable" alert="Note" icon="svg-warning" color="yellow" %} - -{% include_relative ont-luna-sdk-useful-commands.md ploam='ascii' flash='/etc/scripts/flash' %} +- V3.3.2L8 +- V3.3.2L8V ([Veip](/pptp_veip/) firmware) +- V3.3.2L9 +- V3.3.2L10 (Build date: 2025-02-24 15:50:43) +- V3.3.2L10V (Build date: 2025-02-24 14:54:15 [Veip](/pptp_veip/) firmware) + +{% include alert.html content="Before proceeding with any modification, make a backup of files rtl8290b.data and europa.data from /var/config folder. These files include optical calibration of your ONT's laser, if you accidentally delete or ruin them, your ONT will be unusable" alert="Note" icon="svg-warning" color="yellow" %} + +{% include_relative ont-luna-sdk-useful-commands.md + ploam='ascii' + flash='/etc/scripts/flash' + customSwVersionAlert='This needs the `OMCI_OLT_MODE` value to be set to `21`. This will force the stick to use your own settings from the XML file, but this is a hack and causes sigsegv of `/bin/checkomci`.' + omciOLT21='true' +%} diff --git a/_ont/ont-leox-lxt-010s-h.md b/_ont/ont-leox-lxt-010s-h.md index dd0f632e..b6fa4554 100644 --- a/_ont/ont-leox-lxt-010s-h.md +++ b/_ont/ont-leox-lxt-010s-h.md @@ -18,7 +18,7 @@ parent: LEOX | RAM | 32MB | | System | Linux 3.18 (Luna SDK 3.3) | | HSGMII | Yes | -| Optics | SC/UPC | +| Optics | SC/UPC or SC/APC | | IP address | 192.168.100.1/24 | | Web Gui | ✅ | | SSH | | @@ -50,7 +50,7 @@ parent: LEOX This stick supports dual boot. -`k0` and `r0` respectively contain the kernel and firmware of the first image, while `k1` and `r1` respectively contain the kernel and the firmware of the second one. +`k0` and `r0` respectively contain kernel and firmware of the first image, while `k1` and `r1` contain kernel and firmware of the second one. ## Serial @@ -62,13 +62,27 @@ The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be a ## List firmware version -{% include alert.html content="There is a new firmware avaliable from LeoLabs that fixes the 2.5GbE" alert="Note" icon="svg-info" color="blue" %} +{% include alert.html content="There is a new firmware provided by LeoLabs that fixes issues with the stick operating at 2.5GbE speeds" alert="Note" icon="svg-info" color="blue" %} - V3.3.4L3 - V3.3.4L4rc1 (Fix 2.5GbE HiSGMII) - -{% include_relative ont-luna-sdk-useful-commands.md ploam='ascii' speedLan='178' customSpeedLanAlert='You need firmware `V3.3.4L4rc1` or higher. Before editing the speed make sure your hardware supports it. If you try to use any mode not listed here, stick will default to mode 1.' flash='/etc/scripts/flash' %} +- V3.3.4L4rc5 +- V3.3.4L4 (Added failover from 2.5GbE to 1GbE, other fixes) +- V3.3.4L4V (Same as V3.3.4L4 but should be used for VEIP profiles) +- V3.3.4L5rc1 - This version adds "auto-negotiation" capability to the stick. It always prefers 1G (to keep the stick consistently accessible). When you force the link to 2.5G (disabling auto-negotiation), it takes at least 40 seconds to establish the connection. +- V3.3.4L5V (Build date: 2024-02-26 14:05:05 VEIP firmware) +- V3.3.4L6 (Build date: 2024-06-27 16:43:48) +- V3.3.4L7 (Build date: 2025-05-19 17:26:03) + +{% include_relative ont-luna-sdk-useful-commands.md + ploam='ascii' + speedLan='18' + customSpeedLanAlert='Firmware version `V3.3.4L4rc1` or higher is required. Before editing the speed make sure your hardware supports it. If you try to use any mode not listed here, the stick will default to mode 1.' + flash='/etc/scripts/flash' + customSwVersionAlert='This needs the `OMCI_OLT_MODE` value to be set to `21`. This will force the stick to use your own settings from the XML file, but this is a hack and causes sigsegv of `/bin/checkomci`.' + omciOLT21='true' %} # Known Bugs -The stock firmware doesn't work @ 2.5GbE. There is a new firmware avaliable from LeoLabs that fixes this issue. \ No newline at end of file +The stock firmware doesn't work at 2.5GbE. There is a new firmware provided by LeoLabs that fixes this issue. +Sometimes, when connecting to a Huawei OLT and cloning another ONT using GPON_SN, the Leox ONT will report O5 status but won't actually get a proper connection. Workaround - set PON_VENDOR_ID to HWTC. diff --git a/_ont/ont-leox-lxt-240g-c1.md b/_ont/ont-leox-lxt-240g-c1.md new file mode 100644 index 00000000..223cdcdd --- /dev/null +++ b/_ont/ont-leox-lxt-240g-c1.md @@ -0,0 +1,154 @@ +--- +title: LEOX LXT-240G-C1 +has_children: false +layout: default +parent: LEOX +--- + +# Hardware Specifications + +| | | +| --------------- | ---------------------------------------------------------------------- | +| Vendor/Brand | LEOX | +| Model | LXT-240G-C1 | +| Chipset | Realtek RTL9607C | +| Flash | SPI NAND 256MB | +| RAM | 196MB visible in top (256MB total?) | +| CPU | Formosa MIPS interAptiv (multi) V2.0 | +| CPU Clock | 300MHz (597.60 BogoMIPS) | +| System | Linux 4.4.140 (GCC Realtek MSDK-4.8.5p1 Build 3068) | +| Ethernet ports | 4x1G | +| POTS ports | 2xRJ11 | +| Optics | SC/APC | +| IP address | 192.168.1.1/24 | +| Web Gui | ✅ user `admin`, password `letmein` OR user `user`, password `user` | +| Telnet | ✅ user `leox`, password `leolabs_7` | +| SSH | NO | +| Form Factor | ONT | + +# External Photos + +{% include image.html file="ont-leox-lxt-240g-c1_top.jpg" alt="Leox LXT-240G-C1 Top" caption="Leox LXT-240G-C1 Top" %} +{% include image.html file="ont-leox-lxt-240g-c1_bottom.jpg" alt="Leox LXT-240G-C1 Bottom" caption="Leox LXT-240G-C1 Bottom" %} +{% include image.html file="ont-leox-lxt-240g-c1_pcb.jpg" alt="Leox LXT-240G-C1 PCB" caption="Leox LXT-240G-C1 PCB" %} + +## List of partitions (MTD) + +| dev | size | erasesize | name | +| ----- | -------- | --------- | ---------------- | +| mtd0 | 000c0000 | 00020000 | "boot" | +| mtd1 | 00020000 | 00020000 | "env" | +| mtd2 | 00020000 | 00020000 | "env2" | +| mtd3 | 00040000 | 00020000 | "static_conf" | +| mtd4 | 0f9c0000 | 00020000 | "ubi_device" | +| mtd5 | 00a89000 | 0001f000 | "ubi_Config" | +| mtd6 | 00a0d000 | 0001f000 | "ubi_k0" | +| mtd7 | 01911000 | 0001f000 | "ubi_r0" | +| mtd8 | 00a0d000 | 0001f000 | "ubi_k1" | +| mtd9 | 01911000 | 0001f000 | "ubi_r1" | +| mtd10 | 0081d000 | 0001f000 | "ubi_framework1" | +| mtd11 | 0081d000 | 0001f000 | "ubi_framework2" | +| mtd12 | 02416000 | 0001f000 | "ubi_apps" | + +Only the first 4 partitions with erasesize 0x20000 should be manipulated using mtd devices, the fifth partition `ubi_device` contains the rest of the NAND and is to be manipulated using ubi volumes + +## List of volumes (UBI) + +| dev | size | type | name | +| ------ | --------- | ------- | ---------------- | +| ubi0_0 | 11046912B | dynamic | "ubi_Config" | +| ubi0_1 | 10539008B | dynamic | "ubi_k0" | +| ubi0_2 | 26284032B | dynamic | "ubi_r0" | +| ubi0_3 | 10539008B | dynamic | "ubi_k1" | +| ubi0_4 | 26284032B | dynamic | "ubi_r1" | +| ubi0_5 | 8507392B | dynamic | "ubi_framework1" | +| ubi0_6 | 8507392B | dynamic | "ubi_framework2" | +| ubi0_7 | 37838848B | dynamic | "ubi_apps" | + +To back up a volume, `cat` or `dd` the appropriate `/dev/ubi0_X` device to a file or pipe, to restore a volume, use the `ubiupdatevol` utility (or just do it safely via the WebGUI) + +This ONT supports dual boot. + +Volumes `ubi_k0` and `ubi_r0` respectively contain kernel and rootfs of the first image, while `ubi_k1` and `ubi_r1` contain kernel and rootfs of the second one. + +## List of software versions + +- [V4.1.1L5rc2](https://mega.nz/file/YJkEGCIC#FNdE6Xt6lsFJdOnx3GGGCNi4fpMoN0QFOf5_1VjcGHo){: .btn } md5hash: 53b80abbda413e3ebc87d1730292d2fd +- [V4.1.1L5](https://mega.nz/file/VMtTkLDI#5tZ74mAAqn0PhGa4MtbEliSo4B0VwIo28K_8iV2AzQ0){: .btn } md5hash: 5426cac6eb204ec1b3a8f39bc22d9488, same as rc2 just marked final + +# GPON/OMCI settings + +## Set OMCI mode to customized so versions don't reset +``` +mib set OMCI_OLT_MODE 3 +``` + +## Setting OMCI software version (ME 7) +``` +mib set OMCI_SW_VER1 YOURSWVER +mib set OMCI_SW_VER2 YOURSWVER +``` + +## Setting OMCI vendor ID (ME 256) +``` +flash set PON_VENDOR_ID VEND +``` + +## Setting ONU GPON Serial Number +``` +flash set GPON_SN VEND1234ABCD +``` + +## Setting OMCI hardware version (ME 256) +``` +flash set HW_HWVER YOURHWVER +``` + +## Setting OMCC version (ME 257) +``` +mib set OMCC_VER 0x86 +``` + +## Setting OMCI equipment ID (ME 257) +``` +flash set GPON_ONU_MODEL YOUREQUIPMENTID +``` + +## Setting Product Code (ME 257) +``` +mib set OMCI_VENDOR_PRODUCT_CODE 0x3032 +``` + +## Setting VEIP slot ID (example for 0xe01) +``` +mib set OMCI_VEIP_SLOT_ID 0xe +``` + +# Verification commands for settings changed above (all settings take a reboot to apply) + +## Verify SwVer (ME 7) +``` +omcicli mib get 7 +``` + +## Verify Vendor ID, HwVer, and G984 Serial (ME 256) +``` +omcicli mib get 256 +``` + +## Verify OMCC version, Equipment ID and Product Code (ME 257) +``` +omcicli mib get 257 +``` + +## Verify VEIP customized slot ID (ME 329) +``` +omcicli mib get 329 +``` + +# Advanced settings + +## Setting management IP +``` +mib set LAN_IP_ADDR 192.168.102.1 +``` \ No newline at end of file diff --git a/_ont/ont-luna-sdk-useful-commands.md b/_ont/ont-luna-sdk-useful-commands.md index 535d62a1..724add3a 100644 --- a/_ont/ont-luna-sdk-useful-commands.md +++ b/_ont/ont-luna-sdk-useful-commands.md @@ -1,4 +1,4 @@ -# General Settings and Useful Commands +# Useful files and binaries ## Useful files - `/var/config/lastgood.xml` - Contains the user portion of the configuration @@ -15,18 +15,61 @@ - `omci_app` - The OMCI daemon - `diag` - Used to run low-level diagnostics commands on the stick +# GPON ONU status -## Getting/Setting the ONT's S/N +## Getting the operational status of the ONU + +```sh +diag gpon get onu-state +``` + +## Querying a particular OMCI ME +```sh +# omcicli mib get MIB_IDX +``` + + +{% if include.speedLan %} + +## Getting/Setting Speed LAN Mode +{% assign customSpeedLanAlert = include.customSpeedLanAlert | default: "Before editing the speed make sure your hardware supports it." %} +{% include alert.html content=customSpeedLanAlert alert="Note" icon="svg-info" color="blue" %} + +To change the link mode use this command: + +```sh +# {{ include.flash }} get LAN_SDS_MODE +LAN_SDS_MODE=0 +# {{ include.flash }} set LAN_SDS_MODE 1 +``` + +| Value | `cat /proc/kmsg` | Mode | Behavior | +| ----- | ------------------------------------ | -------- | --------------------------- |{% if include.speedLan contains '0' %} +| 0 | `<4>change mode to 0(GE/FE PHY)` | `TP` | 1GbaseT/100baseT |{% endif %}{% if include.speedLan contains '1' %} +| 1 | `<4>change mode to 1(Fiber 1G)` | `FIBER` | 1GbaseX with auto-neg on |{% endif %}{% if include.speedLan contains '2' %} +| 2 | `<4>change mode to 2(SGMII PHY)` | `TP MII` | 1Gb PHY |{% endif %}{% if include.speedLan contains '3' %} +| 3 | `<4>change mode to 3(SGMII MAC)` | `MII` | 1Gb MAC |{% endif %}{% if include.speedLan contains '4' %} +| 4 | `<4>change mode to 4(HiSGMII PHY)` | `TP MII` | 2.5Gb PHY |{% endif %}{% if include.speedLan contains '5' %} +| 5 | `<4>change mode to 5(HiSGMII MAC)` | `MII` | 2.5Gb MAC |{% endif %}{% if include.speedLan contains '6' %} +| 6 | `<4>change mode to 6(2500BaseX)` | `FIBER` | 2500baseX with auto-neg on |{% endif %}{% if include.speedLan contains '7' %} +| 7 | `<4>change mode to 7(SGMII Force)` | `TP` | 1GbaseT with auto-neg off |{% endif %}{% if include.speedLan contains '8' %} +| 8 | `<4>change mode to 8(HISGMII Force)` | `TP` | 2500baseT with auto-neg off |{% endif %} + +{% endif %} + +# GPON/OMCI settings + +## Getting/Setting ONU GPON Serial Number ```sh # {{ include.flash }} get GPON_SN GPON_SN=TMBB00000000 # {{ include.flash }} set GPON_SN TMBB0A1B2C3D ``` -## Getting/Setting the ONT's PLOAM password +## Getting/Setting ONU GPON PLOAM password {% if include.ploam == 'asciiAndHex' %} -{% include alert.html content="The ploam can be saved in either ASCII or HEX format, without any 0x or separators" alert="Note" icon="svg-info" color="blue" %} +{% include alert.html content="The PLOAM password can be saved in either ASCII or HEX format, without any 0x or separators" alert="Note" icon="svg-info" color="blue" %} ```sh # {{ include.flash }} get GPON_PLOAM_PASSWD @@ -55,43 +98,39 @@ GPON_PLOAM_PASSWD=AAAAAAAAAA ``` {% endif %} -## Checking the currently active image -```sh -# nv getenv sw_active -sw_active=1 -# nv getenv sw_version0 -sw_version0=V1_7_8_210412 -# nv getenv sw_version1 -sw_version1=V1_7_8_210412 -``` +## Getting/Setting OMCI software version (ME 7) -## Booting to a different image -```sh -# nv setenv sw_commit 0|1 -# reboot -``` +{% if include.customSwVersionAlert %} -## Getting/Setting the ONT Vendor ID +{% assign customSwVersionAlert = include.customSwVersionAlert %} +{% include alert.html content=customSwVersionAlert alert="Note" icon="svg-info" color="blue" %} -{% include alert.html content="This may need the OMCI_OLT_MODE value to be set to 3 to work" alert="Note" icon="svg-info" color="blue" %} +{% endif %} +{% if include.flashSwVersion %} ```sh -# flash get PON_VENDOR_ID -PON_VENDOR_ID=ZTEG -# flash set PON_VENDOR_ID HWTC +# {{ include.flash }} get OMCI_SW_VER1 +OMCI_SW_VER1=YOURFIRSTSWVER +# {{ include.flash }} set OMCI_SW_VER1 YOURFIRSTSWVER +# {{ include.flash }} get OMCI_SW_VER2 +OMCI_SW_VER1=YOURSECONDSWVER +# {{ include.flash }} set OMCI_SW_VER2 YOURSECONDSWVER ``` - -## Getting/Settng the ONT Custom software version -{% assign customSwVersionAlert = include.customSwVersionAlert | default: "This needs the OMCI_OLT_MODE value to be set to 3" %} -{% include alert.html content=customSwVersionAlert alert="Note" icon="svg-info" color="blue" %} - +{% else %} ```sh # nv setenv sw_custom_version0 YOURFIRSTSWVER # nv setenv sw_custom_version1 YOURSECONDSWVER ``` +{% endif %} + +## Getting/Setting OMCI hardware version (ME 256) -## Getting/Setting a custom HW Version -{% include alert.html content="This may need the OMCI_OLT_MODE value to be set to 3 to work" alert="Note" icon="svg-info" color="blue" %} +{% if include.customHwVersionAlert %} + +{% assign customHwVersionAlert = include.customHwVersionAlert %} +{% include alert.html content=customHwVersionAlert alert="Note" icon="svg-info" color="blue" %} + +{% endif %} ```sh # {{ include.flash }} get HW_HWVER @@ -99,8 +138,29 @@ HW_HWVER=V2.0 # {{ include.flash }} set HW_HWVER MYHWVERSION ``` -## Getting/Setting a custom ONT Equipment ID -{% include alert.html content="This may need the OMCI_OLT_MODE value to be set to 3 to work" alert="Note" icon="svg-info" color="blue" %} +## Getting/Setting OMCI vendor ID (ME 256) + +{% if include.customVendorAlert %} + +{% assign customVendorAlert = include.customVendorAlert %} +{% include alert.html content=customVendorAlert alert="Note" icon="svg-info" color="blue" %} + +{% endif %} + +```sh +# {{ include.flash }} get PON_VENDOR_ID +PON_VENDOR_ID=ZTEG +# {{ include.flash }} set PON_VENDOR_ID HWTC +``` + +## Getting/Setting OMCI equipment ID (ME 257) + +{% if include.customEquipAlert %} + +{% assign customEquipAlert = include.customEquipAlert %} +{% include alert.html content=customEquipAlert alert="Note" icon="svg-info" color="blue" %} + +{% endif %} ```sh # {{ include.flash }} get GPON_ONU_MODEL @@ -118,14 +178,15 @@ OMCI_OLT_MODE=1 # {{ include.flash }} set OMCI_OLT_MODE 2 ``` -| Value | Note | OMCI Information | -| ----- | --------------- | ---------------------------------------------- | -| 0 | Default Mode | Stock, some value are cannot be change | -| 1 | Huawei OLT Mode | Huawei MA5671a | -| 2 | ZTE OLT Mode | ZTE | -| 3 | Customized Mode | Custom Software/Hardware Version, OMCC, etc... | +| Value | Note | OMCI Information | +| ----- | --------------- | ------------------------------------------------------------------------------------------------------ | +| 0 | Default Mode | Stock setting, some values cannot be changed | +| 1 | Huawei OLT Mode | Huawei MA5671a | +| 2 | ZTE OLT Mode | ZTE | +| 3 | Customized Mode | Custom Software/Hardware Version, OMCC, etc... |{% if include.omciOLT21 %} +| 21 | Owerflow Mode | Custom Software/Hardware Version, OMCC, etc... (this is a hack and causes sigsegv of `/bin/checkomci`) |{% endif %} -Some Fiber Vendor/Wholesale/ISP have explicit LAN Port Number provisioning or proprietary OMCI that ONT Stick cant not understand, this will make ONT Stick reply OK whatever OMCI OLT throw at. +Some vendors/wholesale providers/ISPs have explicit LAN Port Number provisioning or proprietary OMCI that the stick cannot understand, this will make the stick reply OK to whatever the OLT sends it via OMCI. `0` = Disable, `1` = Enable, Default is 0 @@ -134,51 +195,15 @@ Some Fiber Vendor/Wholesale/ISP have explicit LAN Port Number provisioning or pr OMCI_FAKE_OK=0 # {{ include.flash }} set OMCI_FAKE_OK 1 ``` -{% if include.speedLan %} -## Getting/Setting Speed LAN Mode -{% assign customSpeedLanAlert = include.customSpeedLanAlert | default: "Before editing the speed make sure your hardware supports it." %} -{% include alert.html content=customSpeedLanAlert alert="Note" icon="svg-info" color="blue" %} +# Advanced settings -To change the link mode use this command: +## Setting management IP ```sh -# {{ include.flash }} get LAN_SDS_MODE -LAN_SDS_MODE=0 -# {{ include.flash }} set LAN_SDS_MODE 1 -``` - -| Value | `cat /proc/kmsg` | Mode | Behavior | -| ----- | ------------------------------------ | -------- | --------------------------- |{% if include.speedLan contains '0' %} -| 0 | `<4>change mode to 0(GE/FE PHY)` | `TP` | 1GbaseT/100baseT |{% endif %}{% if include.speedLan contains '1' %} -| 1 | `<4>change mode to 1(Fiber 1G)` | `FIBER` | 1GbaseX with auto-neg on |{% endif %}{% if include.speedLan contains '2' %} -| 2 | `<4>change mode to 2(SGMII PHY)` | `TP MII` | 1Gb PHY |{% endif %}{% if include.speedLan contains '3' %} -| 3 | `<4>change mode to 3(SGMII MAC)` | `MII` | 1Gb MAC |{% endif %}{% if include.speedLan contains '4' %} -| 4 | `<4>change mode to 4(HiSGMII PHY)` | `TP MII` | 2.5Gb PHY |{% endif %}{% if include.speedLan contains '5' %} -| 5 | `<4>change mode to 5(HiSGMII MAC)` | `MII` | 2.5Gb MAC |{% endif %}{% if include.speedLan contains '6' %} -| 6 | `<4>change mode to 6(2500BaseX)` | `FIBER` | 2500baseX with auto-neg on |{% endif %}{% if include.speedLan contains '7' %} -| 7 | `<4>change mode to 7(SGMII Force)` | `TP` | 1GbaseT with auto-neg off |{% endif %}{% if include.speedLan contains '8' %} -| 8 | `<4>change mode to 8(HISGMII Force)` | `TP` | 2500baseT with auto-neg off |{% endif %} - -{% endif %} - -## Change IP address - -```sh -# {{ flash }} get LAN_IP_ADDR +# {{ include.flash }} get LAN_IP_ADDR LAN_IP_ADDR=192.168.2.1 -# {{ flash }} set LAN_IP_ADDR 192.168.1.1 -``` - -## Checking whether the connection with the OLT was successful (O5 state) - -```sh -diag gpon get onu-state -``` - -## Querying a particular OMCI ME -```sh -# omcicli mib get MIB_IDX +# {{ include.flash }} set LAN_IP_ADDR 192.168.1.1 ``` ## Getting/Setting the L2 Bridge MTU @@ -192,4 +217,20 @@ Port Speed 0 1538 2 2031 # diag switch set max-pkt-len port all length 2000 -``` \ No newline at end of file +``` + +## Checking the currently active image +```sh +# nv getenv sw_active +sw_active=1 +# nv getenv sw_version0 +sw_version0=V1_7_8_210412 +# nv getenv sw_version1 +sw_version1=V1_7_8_210412 +``` + +## Booting to a different image +```sh +# nv setenv sw_commit 0|1 +# reboot +``` diff --git a/_ont/ont-nokia-g-010g-a.md b/_ont/ont-nokia-g-010g-a.md index 2defb2ef..0e110d1a 100644 --- a/_ont/ont-nokia-g-010g-a.md +++ b/_ont/ont-nokia-g-010g-a.md @@ -11,6 +11,7 @@ parent: Nokia | -------------- | ---------------- | | Vendor/Brand | Nokia | | Model | G-010G-A | +| ODM | ✅[^oem] | | Chipset | Broadcom BCM6838 | | Flash | | | RAM | | @@ -29,8 +30,8 @@ parent: Nokia # Curiosity -In the USA the ex BellSouth network deploys some ONTs labelled 'ALT Optics' that use a different wave length, 1310 nm for upstream and 1550 nm for downstream (instead of 1490 nm). -This was done to make a quick conversion of a network with low fibre capacity, allowing the same fibre to be reused for multiple services: FTTH and FTTC/IFITL[^att_alt_optics_1],[^att_alt_optics_2],[^att_alt_optics_3]. +In the USA, the ex-BellSouth network deploys some ONTs with a 'ALT Optics' label that use a different wave length, 1310 nm for upstream and 1550 nm for downstream (instead of 1490 nm). +This was done to be able to quickly convert a network with low fibre capacity while allowing the same fibre to be reused for multiple services contemporarily: both FTTH and FTTC/IFITL[^att_alt_optics_1],[^att_alt_optics_2],[^att_alt_optics_3]. This is one of the few ONTs that has a variant that works with this wavelength. @@ -39,3 +40,4 @@ This is one of the few ONTs that has a variant that works with this wavelength. [^att_alt_optics_1]: Alt optic box. https://forums.att.com/conversations/att-internet-equipment/alt-optic-box/5defe95abad5f2f606973d3f [^att_alt_optics_2]: Alt Optic Network Modem Question. https://forums.att.com/conversations/att-fiber-installation/alt-optic-network-modem-question/61134eaa7f0d0c5065624aea [^att_alt_optics_3]: [AT&T Fiber] Bye bye 802.1x, you will not be missed. https://www.dslreports.com/forum/r33456904-, https://www.dslreports.com/forum/r33458733- +[^oem]: The last model letter in a Nokia/Alcatel ONT indicates the variant: A-M ALu ONT Manufacturer, P-Z external Manufacturer https://hack-gpon.org/assets/img/ont-nokia-naming.jpg \ No newline at end of file diff --git a/_ont/ont-nokia-g-010g-d.md b/_ont/ont-nokia-g-010g-d.md new file mode 100644 index 00000000..7b4b61f4 --- /dev/null +++ b/_ont/ont-nokia-g-010g-d.md @@ -0,0 +1,77 @@ +--- +title: Nokia G-010G-D +has_children: false +layout: default +parent: Nokia +--- + +# Hardware Specifications + +| | | +| ---------------- | ---------------------------------------------------------------------------- | +| Vendor/Brand | Nokia | +| Model | G-010G-D | +| Chipset | RTL9607FS | +| Flash | 256MB (SPI-NAND, Winbond 25N02KVZEIE) | +| RAM | 512MB | +| System | Linux (Realtek Unified SDK 2.2.0) | +| 2.5GBaseT | Yes | +| Optics | SC/APC | +| IP address | 192.168.1.254 | +| Web Gui | ✅ user `adminadmin`, password `ALC#FGU` | +| SSH | ✅ user `adminadmin`, password `ALC#FGU`, but has access to limited shell | +| Telnet | | +| Serial | ⚠️ (U-boot is password protected, Linux kernel disabled it after boot) | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | + +## List of software versions +- 3TN00816JJLJ25 + +## List of partitions + +| dev | name | +| ---- | -------- | +| mtd0 | "boot" | +| mtd1 | "env" | +| mtd2 | "env2" | +| mtd3 | "RI" | +| mtd4 | "binfo" | +| mtd5 | "image0" | +| mtd6 | "image1" | +| mtd7 | "cfg" | +| mtd8 | "cfg_bak" | +| mtd9 | "log" | +| mtd10 | "extfs" | +| mtd11 | "mft_data" | + +## Serial + +The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. To accept TX line commands, the GND of the TTL adapter should be attached to the ONT’s shield. + +## Photos + +Front: + +{% include image.html file="g-010g-d_front.jpg" alt="Nokia G-010G-D Front" caption="Nokia G-010G-D Front" %} + + +Back: + +{% include image.html file="g-010g-d_back.jpg" alt="Nokia G-010G-D Back" caption="Nokia G-010G-D Back" %} + + +Front Internal: + +{% include image.html file="g-010g-d_internal_1.jpg" alt="Nokia G-010G-D Internal front-face with TTL Pinout" caption="Nokia G-010G-D Internal front-face with TTL Pinout" %} + +Back Internal: + +{% include image.html file="g-010g-d_internal_2.jpg" alt="Nokia G-010G-D Internal Back" caption="Nokia G-010G-D Internal Back" %} + + +# Miscellaneous Links +- [MIB file parser](https://github.com/nanomad/nokia-ont-mib-parser) for NOKIA's GPON ONTs (*helps you parsing the .mib file located in `/mnt/rwdir`*) +- [ispreview.co.uk](https://www.ispreview.co.uk/index.php/2022/09/pictured-openreachs-future-2-5gbps-ont-for-fttp-broadband.html) +- [MIB file parser](https://github.com/nanomad/nokia-ont-mib-parser) for NOKIA's GPON ONTs (*helps you parsing the .mib file located in `/mnt/rwdir`*) diff --git a/_ont/ont-nokia-g-010g-p.md b/_ont/ont-nokia-g-010g-p.md index dbeef67f..02840276 100644 --- a/_ont/ont-nokia-g-010g-p.md +++ b/_ont/ont-nokia-g-010g-p.md @@ -36,7 +36,7 @@ alias: CIG G-97C1/CIG G-97CU - 3FE45655AOCK94 - 3FE45655AOCK88 -# Use of GponSLID +# Usage of GponSLID ## Access Full Shell diff --git a/_ont/ont-nokia-g-010g-q.md b/_ont/ont-nokia-g-010g-q.md index 02b648e1..e6b42117 100644 --- a/_ont/ont-nokia-g-010g-q.md +++ b/_ont/ont-nokia-g-010g-q.md @@ -35,6 +35,7 @@ alias: CIG G-97CU ## List of software versions - 3FE49494AOCK21 +- 3FE45655BOCK55 ## List of partitions @@ -50,26 +51,26 @@ This ONT seems to support dual boot (notice partitions "ImageA" and "ImageB"), h ## Serial {% include image.html file="g-010g-q-serial-pinout.jpg" alt="G-010G-Q " caption="G-010G-Q: serial pinout" %} -You can easily communicate with the ONT using a TTL converter (for example the CH341A programmer in TTL mode) by connecting the converters' pins to the ONT following the pinout shown in the image above +You can easily communicate with the ONT using a TTL converter (for example the CH341A programmer in TTL mode) by connecting the converters' pins to the ONT following the pinout shown in the image above. *You don't actually need the two VCC pins, just use TX/RX and GND* {% include alert.html content="The ONT's serial logic is 3V3." alert="Warning" icon="svg-warning" color="red" %} -Make sure the logic of your TTL converter is 3V3 too otherwise you might damage the ONT, in my case I wasn't sure whether the CH341A programmer used 3V3 logic for the TTL part so I set up a voltage divider made of 2 resistors between the TX pin and ground as shown in the image below. +Make sure the logic of your TTL converter is 3V3 too, otherwise you might damage the ONT. To be sure 3V3 is being used, a voltage divider made of 2 resistors between the TX pin and ground as shown in the image below can be used. *Also make sure that your TTL converter RX pin voltage threshold is less than (or equal to) 3V3* {% include image.html file="g-010g-q-serial-voltage-divider.png" alt="G-010G-Q " caption="G-010G-Q: simple serial level converter" %} -Once you've done all that, you can use the TTY client you wish, such as PuTTY, set its baud rate to 115200 and open the connection, then you can start the ONT +Once everything is ok, any TTY client, such as PuTTY, can be used to open the connection with its baud rate set to 115200. At this point, the ONT can be turned on. -You'll see a shell-like prompt: +A shell-like prompt will be visible: ``` ONT> ``` -{% include_relative ont-nokia-use.md %} +{% include_relative ont-nokia-use.md username="ONTUSER" %} {% include_relative ont-nokia-useful-command.md %} diff --git a/_ont/ont-nokia-g-010g-r.md b/_ont/ont-nokia-g-010g-r.md index a417f99f..157ffad3 100644 --- a/_ont/ont-nokia-g-010g-r.md +++ b/_ont/ont-nokia-g-010g-r.md @@ -7,29 +7,30 @@ parent: Nokia # Hardware Specifications -| | | -| ---------------- | ---------------------------------------------------------------------------- | -| Vendor/Brand | Nokia | -| Model | G-010G-R | -| ODM | CIG | -| ODM Product Code | G-97C | -| Chipset | RTL9601B | -| Flash | 16MB | -| RAM | 32MB | -| System | Linux (Luna SDK 1.9.0) | -| 2.5GBaseT | No | -| Optics | SC/APC | -| IP address | 192.168.100.1 (after a factory reset the ONT uses 10.89.42.157/16) | +| | | +| ---------------- |-----------------------------------------------------------------------------| +| Vendor/Brand | Nokia | +| Model | G-010G-R | +| ODM | CIG | +| ODM Product Code | G-97C | +| Chipset | RTL9601B | +| Flash | 16MB | +| RAM | 32MB | +| System | Linux (Luna SDK 1.9.0) | +| 2.5GBaseT | No | +| Optics | SC/APC | +| IP address | 192.168.100.1 (after a factory reset the ONT uses 10.89.42.157/16) | | Web Gui | ✅ user `admin`, password `1234` | -| SSH | | +| SSH | ✅ but no login possible | | Telnet | ✅ user `admin`, password `1234`, but has access to GponSLID and not GponCLI | | Serial | ✅ | -| Serial baud | 115200 | -| Serial encoding | 8-N-1 | -| Form Factor | ONT | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | ## List of software versions - 3FE49717AOCK12 +- 3FE49717AOCK38 ## List of partitions @@ -40,14 +41,249 @@ parent: Nokia | mtd2 | 00002000 | 00001000 | "ImageA" | | mtd3 | 0003c000 | 00001000 | "ImageB" | + +## Boot log + +```text +CIG Version: 3.09.08 + +U-Boot 2011.12.NA-svn145270 (Aug 18 2021 - 15:54:14) + +Board: RTL9601D, CPU:112MHz, LX:200MHx, MEM:325MHz, Type:DDR2 +DRAM: 32 MB +SPI-F: 204018/MMIO16-1/ModeC 1x16 MB (plr_flash_info @ 81c3bcac) +*** Warning - bad CRC, using default environment + +--major = f2, minor = 1 +--major = f2, minor = 1 +*** !!! Check Result: EEPA and EEPB are all valid +Device care eqvid: 3FE49165AAAA, Init serial +Net: LUNA GMAC +Warning: eth device name has a space! + +swcore_init +************************************** +* * +* KEY -- Enter console terminal * +* * +************************************** +waiting for your select +do_jffs2_fsload offset 0x80400000 loadaddr=0xb4088000.. +get loadbit 0,bootbit 0 +Get current Image = ImageA.. + +--- jffs2_part_info: partition number 2 for device sflash0 (sflash.0) + +Loading 'uImage' from CRAMFS Partition 'imagea' to 0x80400000. + +Root Filesystem crc check successfully! + + +PRODUCT: sfu +SS : noss +DSP : nodsp +WIFI: nowifi +XDSL: nodsl +Software version: 3FE49717AOCK38 +## Booting kernel from Legacy Image at 80400000 ... + Image Name: Linux Kernel Image + Created: 2022-08-29 14:48:12 UTC + Image Type: MIPS Linux Kernel Image (lzma compressed) + Data Size: 776207 Bytes = 758 KB + Load Address: 80000000 + Entry Point: 80000000 + Verifying Checksum ... OK + Uncompressing Kernel Image ... OK + +Starting kernel ... + +Linux version 2.6.30.9-cig-sfu-1 (root@compute3) (gcc version 4.4.6 (Realtek RS] +RTL9602C PLL +CPU revision is: 0000dc02 +Determined physical RAM map: + memory: 016ff000 @ 00000000 (usable) + memory: 006ff000 @ 01800000 (usable) +Zone PFN ranges: + Normal 0x00000000 -> 0x00001eff +Movable zone start PFN for each node +early_node_map[2] active PFN ranges + 0: 0x00000000 -> 0x000016ff + 0: 0x00001800 -> 0x00001eff +Built 1 zonelists in Zone order, mobility grouping on. Total pages: 7616 +Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=sflash:1 +root_dev_setup line 180 root: /dev/mtdblock2 +icache: 64kB/32B, dcache: 32kB/32B, scache: 0kB/0B +NR_IRQS:128 +PID hash table entries: 128 (order: 7, 512 bytes) +console [ttyS0] enabled +Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) +Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) +Memory: 28056k/30712k available (1664k kernel code, 2656k reserved, 489k data, ) +Calibrating delay loop... 110.33 BogoMIPS (lpj=55168) +Mount-cache hash table entries: 512 +IMEM section size = 0x998 +net_namespace: 500 bytes +NET: Registered protocol family 16 +bio: create slab at 0 +NET: Registered protocol family 2 +IP route cache hash table entries: 1024 (order: 0, 4096 bytes) +TCP established hash table entries: 1024 (order: 1, 8192 bytes) +TCP bind hash table entries: 1024 (order: 0, 4096 bytes) +TCP: Hash tables configured (established 1024 bind 1024) +TCP reno registered +NET: Registered protocol family 1 +================================= +CONFIG_LUNA_SOC_GPIO: gpio_init() +================================= +Realtek GPIO Driver for Flash Reload Default +================================= +luna_capabilities_init +================================= +================================= +luna_wdt_init +================================= +[Kthread : watchdog ] init complete! +************ Watchdog Setting **************** +WDT_E=0, (1-enable, 0-disable) +LX(MHz)=200 +WDT_CLK_SC=3 +PH1_TO=17 +PH2_TO=0 +WDT_RESET_MODE=0 +********************************************** +************ Watchdog Setting **************** +WDT_E=1, (1-enable, 0-disable) +LX(MHz)=200 +WDT_CLK_SC=3 +PH1_TO=17 +PH2_TO=0 +WDT_RESET_MODE=0 +********************************************** +netlog: listening on port 4660 +JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. +fuse init (API version 7.11) +msgmni has been set to 54 +alg: No test for stdrng (krng) +io scheduler noop registered (default) +Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled +serial8250: ttyS0 at MMIO 0x0 (irq = 49) is a 16550A +loop: module loaded +nbd: registered device at major 43 +PPP generic driver version 2.4.2 +NET: Registered protocol family 24 +nf_conntrack version 0.5.0 (479 buckets, 1916 max) +ip_tables: (C) 2000-2006 Netfilter Core Team +TCP cubic registered +NET: Registered protocol family 17 +physmap platform flash device: 0b000000 at 14000000 +Luna SPI NOR FLASH G3 driver-204018/MMIO16-1 <5>master->name sflash +cmd: cmdlinepart +4 cmdlinepart partitions found on MTD device sflash +Creating 4 MTD partitions on "sflash": +0x000000000000-0x000000080000 : "Boot" +0x000000080000-0x000000200000 : "Config" +0x000000200000-0x000000900000 : "ImageA" +0x000000900000-0x000001000000 : "ImageB" +VFS: Mounted root (cramfs filesystem) readonly on device 31:2. +Freeing unused kernel memory: 92k freed + +# num is 10,nothing need to do +/ +ONT>Starting Application: 0x00002000, /bin/TimerMgr................Done. +Starting Application: 0x00001000, /bin/LogMgr................Done. +Mmr_trans_bosa_v40_probe() 1285 Vendor: SEMTECH, Part Number: 25L95, bosa ver =0 +Mmr_Bob40_reset() 673, laser status:80 +Starting Application: 0x00007000, /bin/MiscMgr................Done. +starting to upgrade boot +file[/bootimg/00f2_01_01] length=184320 +Flash bootload versin is 3.09.08 +Upgrading bootload versin is 3.09.08 +Upgrading boot is old +Check base image file CRC ... cal_crc (2af075a1) ori_crc (2af075a1) Success +``` + + ## Serial -The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. +The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. To accept TX line commands, the GND of the TTL adapter should be attached to the ONT’s shield like the below photo: +{% include image.html file="g-010g-r_serial_pinouts.jpg" alt="Nokia G-010G-R Ports" caption="Nokia G-010G-R Ports" %} + +Please note that some models come without a pre-soldered pin header. +{% include image.html file="g-010g-r_headerless.jpg" alt="Nokia G-010G-R w/o pin header" caption="Nokia G-010G-R w/o pin header" %} -{% include_relative ont-nokia-use.md %} +{% include_relative ont-nokia-use.md username="ONTUSER" %} {% include_relative ont-nokia-useful-command.md %} + +# SSH + +The image contains dropbear. +```text +#ONT/system/shell>dropbear -V +Dropbear v2019.78 +``` + +The SSH port (22) is blocked per default by iptables rules. +```text +#ONT/system/shell>iptables --list +Chain INPUT (policy ACCEPT) +target prot opt source destination +DROP all -- anywhere anywhere state INVALID +ACL all -- anywhere anywhere + +Chain FORWARD (policy DROP) +target prot opt source destination +ACCEPT all -- anywhere anywhere +ACCEPT all -- anywhere anywhere state RELATED,ESTAB +DROP all -- anywhere anywhere state INVALID + +Chain OUTPUT (policy ACCEPT) +target prot opt source destination +ACCEPT all -- anywhere anywhere state RELATED,ESTAB +DROP all -- anywhere anywhere state INVALID + +Chain ACL (1 references) +target prot opt source destination +DROP tcp -- anywhere anywhere tcp dpt:http +DROP tcp -- anywhere anywhere tcp dpt:telnet +DROP tcp -- anywhere anywhere tcp dpt:ssh +DROP tcp -- anywhere anywhere tcp dpt:ftp +RETURN all -- anywhere anywhere + +Chain INVALID (0 references) +target prot opt source destination +``` + +The corresponding rules can simply be deleted as the default policy allows any traffic. +```text +#ONT/system/shell>iptables -D ACL 1 +``` + +Since the root user does not have a password set and dropbear disallows logins with empty passwords for security reasons, there is no login possible. +```text +#ONT/system/shell>cat /etc/passwd +root:x:0:0:root:/root:/bin/sh +bin:x:1:1:bin:/bin:/bin/false +daemon:x:2:2:daemon:/sbin:/bin/false +adm:x:3:4:adm:/var/adm:/bin/false +lp:x:4:7:lp:/var/spool/lpd:/bin/false +sync:x:5:0:sync:/sbin:/bin/sync +shutdown:x:6:0:shutdown:/sbin:/bin/false +halt:x:7:0:halt:/sbin:/sbin/halt +mail:x:8:12:mail:/var/spool/mail:/bin/false +uucp:x:10:14:uucp:/var/spool/uucp:/bin/false +operator:x:11:0:operator:/root:/bin/false +games:x:12:100:games:/usr/games:/bin/false +gopher:x:13:30:gopher:/var/gopher:/bin/false +ftp:x:14:50:FTP User:/var/ftp:/bin/false +nobody:x:99:99:Nobody:/:/bin/false + +#ONT/system/shell>cat /etc/shadow +root::10933:0:99999:7::: +``` + + # Miscellaneous Links - [MIB file parser](https://github.com/nanomad/nokia-ont-mib-parser) for NOKIA's GPON ONTs (*helps you parsing the .mib file located in `/mnt/rwdir`*) - [ispreview.co.uk](https://www.ispreview.co.uk/index.php/2022/09/pictured-openreachs-future-2-5gbps-ont-for-fttp-broadband.html) diff --git a/_ont/ont-nokia-g-010g-t.md b/_ont/ont-nokia-g-010g-t.md index 640aea48..05724e94 100644 --- a/_ont/ont-nokia-g-010g-t.md +++ b/_ont/ont-nokia-g-010g-t.md @@ -34,18 +34,39 @@ alias: CIG G-97CP/G-97CU {% include image.html file="q-010g-t_ports.jpg" alt="Nokia G-010G-T Ports" caption="Nokia G-010G-T Ports" %} {% include image.html file="q-010g-t_internal_up.jpg" alt="Nokia G-010G-T Internal Up" caption="Nokia G-010G-T Internal Up" %} {% include image.html file="q-010g-t_internal_down.jpg" alt="Nokia G-010G-T Internal Down" caption="Nokia G-010G-T Internal Down" %} +{% include image.html file="q-010g-t_flash.jpg" alt="Nokia G-010G-T Winbond 25Q128 Flash memory" caption="Nokia G-010G-T Winbond 25Q128 Flash memory" %} +{% include image.html file="q-010g-t_laser_driver.jpg" alt="Nokia G-010G-T Semtech GN25L95 Laser Driver" caption="Nokia G-010G-T Semtech GN25L95 Laser Driver" %} +{% include image.html file="q-010g-t_rtl8221b.jpg" alt="Nokia G-010G-T Realtek RTL8221B" caption="Nokia G-010G-T Realtek RTL8221B" %} +{% include image.html file="q-010g-t_rtl9601d.jpg" alt="Nokia G-010G-T Realtek RTL9601D" caption="Nokia G-010G-T Realtek RTL9601D" %} ## List of software versions - 3FE49717AOCK12 +- 3FE49717AOCK49 ## List of partitions -| dev | size | erasesize | name | -| ---- | -------- | --------- | -------- | -| mtd0 | 00040000 | 00001000 | "Boot" | -| mtd1 | 00002000 | 00001000 | "Config" | -| mtd2 | 00002000 | 00001000 | "ImageA" | -| mtd3 | 0003c000 | 00001000 | "ImageB" | +| dev | size | erasesize | name | format | +| ---- | -------- | --------- | -------- | ----------------------------------------------- | +| mtd0 | 00040000 | 00001000 | "Boot" | Binary | +| mtd1 | 00002000 | 00001000 | "Config" | [jffs2](https://en.wikipedia.org/wiki/JFFS2) | +| mtd2 | 00002000 | 00001000 | "ImageA" | [cramfs](https://en.wikipedia.org/wiki/Cramfs) | +| mtd3 | 0003c000 | 00001000 | "ImageB" | [cramfs](https://en.wikipedia.org/wiki/Cramfs) | + +## Kernel command line arguments +``` +console=ttyS0,115200 +root=/dev/mtdblock3 +mtdparts=sflash:512K@0x0(Boot),0x180000@0x80000(Config),7M@0x200000(ImageA),7M@0x900000(ImageB) +rootfstype=cramfs +hasEeprom=0 +5srst=0 +eqvid=3FE49715ADAA01 +uboot_version=V3.9.08 +major=f4 +minor=1 +``` + +Note: When **Reset** button is held for over 5 seconds then parameter `5srst=0` is changed to `1`. ## Serial @@ -55,10 +76,15 @@ The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be acc {% include alert.html content="Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work." alert="Note" icon="svg-warning" color="yellow" %} -{% include_relative ont-nokia-use.md %} +{% include_relative ont-nokia-use.md username="ONTUSER" %} {% include_relative ont-nokia-useful-command.md %} +## Notes for Openreach ONT + +Serial speed is 9600 8n1. Serial is iactive until the reset button is held down for ~30 seconds, then it'll break into the ONT> command line. +There is no running webserver. Telnet and Dropbear are running (if you disable the firewall) but no login is configured, so not useful. + # Miscellaneous Links - [MIB file parser](https://github.com/nanomad/nokia-ont-mib-parser) for NOKIA's GPON ONTs (*helps you parsing the .mib file located in `/mnt/rwdir`*) - [ispreview.co.uk](https://www.ispreview.co.uk/index.php/2022/09/pictured-openreachs-future-2-5gbps-ont-for-fttp-broadband.html) diff --git a/_ont/ont-nokia-g-010s-a.md b/_ont/ont-nokia-g-010s-a.md index 9a8b83a4..d876c8f3 100644 --- a/_ont/ont-nokia-g-010s-a.md +++ b/_ont/ont-nokia-g-010s-a.md @@ -11,8 +11,7 @@ parent: Nokia | ---------------- | ---------------------------------------- | | Vendor/Brand | Nokia | | Model | G-010S-A | -| ODM | SourcePhotonics | -| ODM Product Code | | +| ODM | ✅[^oem] | | Chipset | Lantiq PEB98035 | | Flash | 16 MB | | RAM | 64 MB | @@ -36,7 +35,7 @@ parent: Nokia ## Modifying firmware -The Nokia G-010S-A can be flashed with the [Nokia G-010S-P](/ont-nokia-g-010s-p) firmware, provided the MTD layout has been changed beforehand to match the new one. For the full procedure, see the post on [lafibre.info](https://lafibre.info/remplacer-livebox/guide-de-connexion-fibre-directement-sur-un-routeur-voire-meme-en-2gbps/msg870551/#msg870551) +The Nokia G-010S-A can be flashed with the [Nokia G-010S-P](/ont-nokia-g-010s-p) firmware, provided the MTD layout has been changed beforehand to match the new one. For the full procedure, see this post on [lafibre.info](https://lafibre.info/remplacer-livebox/guide-de-connexion-fibre-directement-sur-un-routeur-voire-meme-en-2gbps/msg870551/#msg870551) ## List of software versions @@ -57,20 +56,240 @@ The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be a {% include alert.html content="Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work." alert="Note" icon="svg-warning" color="yellow" %} -# General Settings and Useful Commands +## List of partitions + +| dev | size | erasesize | name | +| ----- | -------- | --------- | ------------- | +| mtd0 | 00040000 | 00010000 | "uboot" | +| mtd1 | 00080000 | 00010000 | "uboot_env" | +| mtd2 | 00600000 | 00010000 | "linux" | +| mtd3 | 004d81b6 | 00010000 | "rootfs" | +| mtd4 | 000b0000 | 00010000 | "rootfs_data" | +| mtd5 | 00600000 | 00010000 | "image1" | +| mtd6 | 00100000 | 00010000 | "configfs" | +| mtd7 | 00210000 | 00010000 | "logfs" | +| mtd8 | 00010000 | 00010000 | "ri" | +| mtd9 | 00010000 | 00010000 | "sfp" | +| mtd10 | 00010000 | 00010000 | "ribackup" | + +## List of software versions + +- 3FE46398AFGA95 +- 3FE46398AFGB89 +- 3FE46398BFGA06 +- 3FE46398BFGB18 +- 3FE46398BFIB36 +- 3FE46398BGCB22 +- 3FE47111AFGB89 +- 3FE47111BFHB32 + +See more info on: [Firmwares G-010S-A](https://github.com/hwti/G-010S-A#firmwares) + +# Usage + +## Enabling serial + +```sh +fw_setenv bootdelay 5 +fw_setenv asc0 0 +fw_setenv preboot +``` + +# GPON ONU status + +## Getting the operational status of the ONU + +```sh +onu ploamsg +``` + +## Getting information on the OLT vendor + +```sh +omci_pipe.sh meg 131 0 +``` + +## Querying a particular OMCI ME + +```sh +omci_pipe.sh meg MIB_IDX ME_IN +``` +Where `MIB_IDX` is the MIB ID and `ME_IN` is the ME instance number + +## Getting/Setting Speed LAN Mode + +| Velue | Speed | +| ----- | ---------------------------------- | +| 4 | 1 Gbps / SGMII | +| 5 | 2.5 Gbps / HSGMII with auto-neg on | + +To enable the interface to sync at 2.5 Gbps speeds / using HSGMII with auto-neg on: + +```sh +fw_setenv sgmii_mode 5 +``` + +To revert the change back to default: +```sh +fw_setenv sgmii_mode +``` + +To get the (H)SGMII Mode: + +```sh +onu lanpsg 0 +``` +The `link_status` variable tells the current speed + +# GPON/OMCI settings + +## Enabling parameter modification +This setting must be set in order to perform other parameter modifications +```sh +ritool set OperatorID 0000 +``` + +## Getting/Setting ONU GPON Serial Number +To check the current serial number: +```sh +onu gtcsng +``` + +To set the current serial number: +```sh +ritool set MfrID ABCD +ritool set G984Serial 012345678 +ritool set YPSerialNum 012345678 +``` + +## Getting/Setting ONU GPON PLOAM password +To check the current password (the password field contains decimal values of ASCII characters): +```sh +onu gtccg +``` + +This value can be changed using the web interface. + +## Getting/Setting OMCI software version (ME 7) + +The software version must be changed by directly modifying firmware by using the patches found in the wiki's page about the [Nokia G-010-A](https://github.com/hwti/G-010S-A) ONT and then adding a folder `0001_swversion` that contins a file `patch.sh` with the following content: +``` +#!/bin/sh + +set -e + +ROOTFS=$1 + +echo "Changing to software version desidered" +sed -i s/3FE46398BGCB22/3FE45655BOCK99/g "$ROOTFS/usr/etc/buildinfo" +``` +Where `3FE46398BGCB22` is the current software version and `3FE45655BOCK99` the desired software version + +## Getting/Setting OMCI hardware version (ME 256) + +``` +ritool set HardwareVersion 3FE47211EGAA +ritool set ICS 01 +``` + +## Getting/Setting OMCI equipment ID (ME 257) + +This ONT is designed to save Nokia's equipment ID, specifically to set the equipment ID of a Nokia G-010G-Q the following commands are to be used: + +```sh +ritool set CleiCode __________ +ritool set Mnemonic G-010G-Q__ +``` +Where `CleiCode` is the prefix and `Mnemonic` the postfix. + +# Advanced settings + +## Transferring files to the stick + +{% include alert.html content="If you use a modern OpenSSH version (e.g. >= 8.8) you will have to use the legacy protocol and enable some deprecated algorithms: scp `-oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-dss [...]`" alert="Info" icon="svg-info" color="blue" %} + +```sh +# scp rootfs.bin root@192.168.1.10:/tmp/ +``` + +## Backup of all partition + +Make a backup of all partitions, an easy way is to run these commands: +- On the stick run: +```sh +cat /proc/mtd +``` +- For each mtdX run this command in the lantiq shell: +```sh +cp /dev/mtdX /tmp +``` + +{% include alert.html content="If you use a modern OpenSSH version (e.g. >= 8.8) you will have to use the legacy protocol and enable some deprecated algorithms: `scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-dss [...]`" alert="Info" icon="svg-info" color="blue" %} + +And in the computer shell: +```sh +scp ONTUSER@192.168.1.10:/tmp/mtdX ./ +``` + +## Checking the currently active image + +```sh +upgradestatus +``` + +## Setting management MAC + +``` +ritool set MACAddress 12:34:56:78:9A:BC +``` + +## Setting management IP + +``` +ifconfig eth0:1 192.168.1.10 netmask 255.255.255.0 +``` + +## Flashing a new rootfs via SSH + +{% include alert.html content="Only the inactive image can be flashed" alert="Info" icon="svg-info" color="blue" %} + +{% include alert.html content="It is recommended to enable serial access via TTL" alert="Info" icon="svg-info" color="blue" %} + +The following commands are used to flash a new rootfs to image1 and then boot to it: +```sh +mtd write /tmp/rootfs.bin image1 +update_env_flag 1 +reboot +``` ## Disabling Dying Gasp ```sh uci set gpon.gtc.nDyingGaspEnable='0'; uci commit gpon ``` -# HW Modding +## Rebooting the ONU +```sh +reboot +``` -- [Nokia G-010S-A Pin 6 Iusse - Rsaxvc.net](https://rsaxvc.net/blog/2020/8/15/Nokia_G-010S-A_Pin_6_Issue.html) +## Miscellaneous commands + +```sh +cat /configs/image_version +cat /usr/etc/buildinfo +ritool dump +omciMgr +``` # Miscellaneous Links - [G-010S-A](https://github.com/hwti/G-010S-A) - [Usage GPON module SFP in Spain](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300) - [Bypassing the HH3K up to 2.5Gbps using a BCM57810S NIC](https://www.dslreports.com/forum/r32230041-Internet-Bypassing-the-HH3K-up-to-2-5Gbps-using-a-BCM57810S-NIC) +- [Nokia G-010S-A Pin 6 Iusse - Rsaxvc.net](https://rsaxvc.net/blog/2020/8/15/Nokia_G-010S-A_Pin_6_Issue.html) +- [Might require solder mod in order to work with BCM57810S NIC](/broadcom-57810s#compatibility) + +

+ +[^oem]: The last model letter in a Nokia/Alcatel ONT indicates the variant: A-M ALu ONT Manufacturer, P-Z external Manufacturer https://hack-gpon.org/assets/img/ont-nokia-naming.jpg diff --git a/_ont/ont-nokia-g-010s-p.md b/_ont/ont-nokia-g-010s-p.md index 7d9b6d7a..7a97ef20 100644 --- a/_ont/ont-nokia-g-010s-p.md +++ b/_ont/ont-nokia-g-010s-p.md @@ -34,12 +34,12 @@ parent: Nokia
{% include image.html file="g-010s-p-and-ma5671a.jpg" alt="G-010S-P and MA5671A Teardown" caption="G-010S-P and MA5671A Teardown" %}
-{% include alert.html content="G-010S-P and other models will not expose an ethernet interface unless fiber cable is connected ([source](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300))" alert="Warning" icon="svg-warning" color="yellow" %} +{% include alert.html content="G-010S-P and other models will not expose an ethernet interface unless the fiber cable is connected ([source](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300))" alert="Warning" icon="svg-warning" color="yellow" %} ## Firmware is interchangeable with: - [Huawei MA5671A](/ont-huawei-ma5671a) -- [ONT FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](/ont-fs-com-gpon-onu-stick-with-mac) +- [FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](/ont-fs-com-gpon-onu-stick-with-mac) - [Hilink HL23446](/ont-hilink-hl23446) - {:.text-red-200 } Dasan H650SFP - {:.text-red-200 } DpOptics D23446 @@ -82,7 +82,7 @@ fw_setenv nDyingGaspEnable 0 ## Enabling the Web UI -To activate the web-ui you can use the following guide on [dslreport](https://www.dslreports.com/forum/r32458588-). +To activate the web-ui you can use [this guide from dslreport forum](https://web.archive.org/web/20241205080939/https://www.dslreports.com/forum/r32458588-) archived on [archive.org](https://archive.org/). # Miscellaneous Links diff --git a/_ont/ont-nokia-use.md b/_ont/ont-nokia-use.md index ac718538..5899c57a 100644 --- a/_ont/ont-nokia-use.md +++ b/_ont/ont-nokia-use.md @@ -1,21 +1,31 @@ -# Use +# Usage + +{% include alert.html content=include.alertUsage alert="Note" icon="svg-info" color="blue" %} + + +{% unless include.disableEnablePassword==true %} ## Login and enable +{% if include.alertEnablePassword %} +{% include alert.html content=include.alertEnablePassword alert="Note" icon="svg-info" color="blue" %} +{% endif %} Once you're logged in, a custom menu will be shown and you'll be able to access the linux shell by first typing `system` followed by `shell`: ```sh ONT>enable #ONT>login -User name:ONTUSER +User name:{{include.username}} Password: **** ``` The enable password can be generated using the following form: -{% include cig_password.html username="ONTUSER" %} +{% include cig_password.html username=include.username %} + +{% endunless %} -# Access Full Shell +# Accessing Full Shell To access a complete linux shell just type: ```sh diff --git a/_ont/ont-nokia-useful-command.md b/_ont/ont-nokia-useful-command.md index 996407e2..cc15cca9 100644 --- a/_ont/ont-nokia-useful-command.md +++ b/_ont/ont-nokia-useful-command.md @@ -1,4 +1,42 @@ -# General Settings and Useful Commands +# GPON ONU status + +## Getting the operational status of the ONU +```sh +#ONT>traffic +#ONT/system>pon +#ONT/system/pon>show link + + ----------------- LINK STATE ----------------- + Link State: ACTIVE + Operation State Machine: OPERATION (O5) + ----------------- STATE END ----------------- +``` + +## Querying a particular OMCI ME + +```sh +#ONT>system +#ONT/system>mib +#ONT/system/mib>show 256 +Table Ontg, Ont-g, total 1 instances + +EntityID = 0x0000 +VID = "ALCL" +Version = AA BB CC DD EE FF 11 22 33 44 55 66 00 00 +SerialNum = AA BB CC DD EE FF 11 22 +TraffMgtOpt = 0 +AtmCCOpt = 0 +BatteryBack = 1 +AdminState = 0 +OpState = 0 +OnuSurvivalTime = 0 +Loid = "" +Password = "" +AuthState = 0 +OntState = 1 +``` + +# GPON/OMCI settings ## Committing changes to the OMCI MIB tables for GPON operation ```sh @@ -7,7 +45,7 @@ #ONT/system/mib>reset ``` -## Getting/Setting the ONT's S/N +## Getting/Setting ONU GPON Serial Number ```sh #ONT>system #ONT/system>misc @@ -18,47 +56,84 @@ eqsn: ALCL00000001 ---ATECMDRESULT--- OK ``` -## Getting/Setting the ONT's Vendor +## Getting/Setting PLOAM ```sh #ONT>system #ONT/system>misc -#ONT/system/misc>vendor get -vendor: ALCL +#ONT/system/misc>pon_passwd set "123456789" ---ATECMDRESULT--- OK -#ONT/system/misc>eqsnvend get -vendor: ALCL +#ONT/system/misc>pon_passwd get +pon_passwd: 31323334353637383900 ---ATECMDRESULT--- OK -#ONT/system/misc>vendor set "ALCL" +#ONT/system/misc>register_id set "123456789" +---ATECMDRESULT--- OK +#ONT/system/misc>register_id get +pon_passwd: 31323334353637383900 ---ATECMDRESULT--- OK -#ONT/system/misc>eqsnvend set "ALCL" +``` + +## Setting OMCI software version (ME 7) +The following command must be typed into the standard linux shell: +```sh +# echo SWVER=3FE49337AOCK80 > /mnt/rwdir/sys.cfg +``` + +## Getting/Setting OMCI hardware version (ME 256) +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>eqvid get +eqvid: 3FE45458ABAA06 +hex_eqvid: 0x3346453435343538414241413036 ---ATECMDRESULT--- OK +#ONT/system/misc>eqvid set "YOUR_CUSTOM_VID" +``` +## Getting/Setting OMCI vendor ID (ME 256) +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>vendor get +vendor: ALCL +---ATECMDRESULT--- OK +#ONT/system/misc>vendor set "ALCL" +---ATECMDRESULT--- OK ``` -## Getting/Setting the ONT's Equipment ID +## Getting/Setting OMCI equipment ID (ME 257) ```sh #ONT>system #ONT/system>misc -#ONT/system/misc>eqid set "FT-G2110C-2.5G" +#ONT/system/misc>eqid set "YOUR_CUSTOM_EQUID" ---ATECMDRESULT--- OK #ONT/system/misc>eqid get -eqid: FT-G2110C-2.5G -hex_eqid: 0x46542d4732313130432d322e3547000000000000 +eqid: YOUR_CUSTOM_EQUID +hex_eqid: 0x594F55525F435553544F4D5F4551554944000000000000 ---ATECMDRESULT--- OK ``` -## Getting/Setting the ONT's Hardware Version +## Getting/Setting MAC address +`mac1` = Lower MAC ID (printed on label) + +`mac2` = Upper MAC ID (usually = `mac1`+`3`) ```sh #ONT>system #ONT/system>misc -#ONT/system/misc>eqvid get -eqvid: 3FE45458ABAA06 -hex_eqvid: 0x3346453435343538414241413036 +#ONT/system/misc>mac1 get +mac1: aa.bb.12.34.56.78 +---ATECMDRESULT--- OK +#ONT/system/misc>mac2 get +mac2: aa.bb.12.34.56.7b +---ATECMDRESULT--- OK +#ONT/system/misc>mac1 set 12:34:56:11:22:33 +---ATECMDRESULT--- OK +#ONT/system/misc>mac2 set 12:34:56:11:22:44 ---ATECMDRESULT--- OK -#ONT/system/misc>eqvid set "G2110CE2V1D0" ``` -## Getting/Setting the ONT's IP/Netmask +# Advanced settings + +## Setting management IP ```sh #ONT>system #ONT/system>misc @@ -72,43 +147,9 @@ admin_mask: 255.255.255.0 #ONT/system/misc>admin_mask set 255.255.255.0 ``` -## Getting Operational Status -```sh -#ONT>traffic -#ONT/system>pon -#ONT/system/pon>show link - - ----------------- LINK STATE ----------------- - Link State: ACTIVE - Operation State Machine: OPERATION (O5) - ----------------- STATE END ----------------- -``` - -## Querying a particular OMCI ME +## (Re-)enable webinterface ```sh #ONT>system -#ONT/system>mib -#ONT/system/mib>show 256 -Table Ontg, Ont-g, total 1 instances - -EntityID = 0x0000 -VID = "GNXS" -Version = 47 32 31 31 30 43 45 32 56 31 44 30 00 00 -SerialNum = 47 4e 58 53 05 54 6f b0 -TraffMgtOpt = 0 -AtmCCOpt = 0 -BatteryBack = 1 -AdminState = 0 -OpState = 0 -OnuSurvivalTime = 0 -Loid = "" -Password = "" -AuthState = 0 -OntState = 1 -``` - -## Setting the ONT's Software Version -The following must be typed from the standard linux shell: -```sh -# echo SWVER=C-5.6.1-R > /mnt/rwdir/sys.cfg +#ONT/system>manu +#ONT/system/manu>internal_ip_en ``` \ No newline at end of file diff --git a/_ont/ont-odi-realtek-dfp-34g-2c2.md b/_ont/ont-odi-realtek-dfp-34g-2c2.md index a3878ef8..0dbacd1c 100644 --- a/_ont/ont-odi-realtek-dfp-34g-2c2.md +++ b/_ont/ont-odi-realtek-dfp-34g-2c2.md @@ -28,23 +28,15 @@ parent: ODI {% include alert.html content="SSH uses an outdated set of algorithms/ciphers, you can connect using the following command:" alert="Note" icon="svg-info" color="blue" %} ```shell -ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oCiphers=+3des-cbc admin@192.168.1.1 +ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oCiphers=+3des-cbc -oHostKeyAlgorithms=ssh-rsa admin@192.168.1.1 ``` {% include image.html file="realtek-dfp-34g-2c2.jpg" alt="ODI Realtek DFP-34X-C2C" caption="ODI Realtek DFP-34X-C2C" %} -## List of software versions -- V1.0-220923 (hybrid by @lanseyujie and @stick86) -- V1.0-220817 -- V1.0-220530 (hybrid by @stick86) -- V1.0-220414 (vlan working) -- V1.0-220304 -- V1.0-210702 - ## List of firmwares and files - [Firmware repository by Anime4000](https://github.com/Anime4000/RTL960x/tree/main/Firmware/DFP-34X-2C2) -The reccomended version are `M114_sfp_ODI_Vlan_220414.tar`, `M114_sfp_ODI_hybrid_220527.tar` or `M114_sfp_ODI_hybrid_220916.tar` because it has working VLAN translation. +The recommended versions are `M114_sfp_ODI_Vlan_220414.tar`, `M114_sfp_ODI_hybrid_220527.tar` or `M114_sfp_ODI_hybrid_220916.tar`, as these have working VLAN translation. ## List of partitions @@ -67,18 +59,24 @@ The reccomended version are `M114_sfp_ODI_Vlan_220414.tar`, `M114_sfp_ODI_hybrid This stick supports dual boot. -`k0` and `r0` respectively contain the kernel and firmware of the first image, while `k1` and `r1` respectively contain the kernel and the firmware of the second one +`k0` and `r0` respectively contain kernel and firmware of the first image, while `k1` and `r1` contain kernel and firmware of the second one. ## Serial -The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. It's near the SFP header. TX, RX and ground pads need to be connected to a USB2TTL adapter supporting a logic level of 3.3V. +The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface: it's near the SFP header. TX, RX and ground pads need to be connected to a USB2TTL adapter supporting 3V3 logic. {% include image.html file="ont-odi-realtek-dfp-34x-2c2/ttl.jpg" alt="DFP-34X-2C2 TTL Connection" caption="DFP-34X-2C2 TTL Connection" %} {% include image.html file="ont-odi-realtek-dfp-34x-2c2/ttl-2.jpg" alt="DFP-34X-2C2 TTL Pin" caption="DFP-34X-2C2 TTL Pin" %} {% include alert.html content="Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work." alert="Note" icon="svg-warning" color="yellow" %} -{% include_relative ont-luna-sdk-useful-commands.md flash='flash' ploam='hex' customSwVersionAlert='This needs the `OMCI_OLT_MODE` value to be set to 3 and firmware 220530 or 220923 modded by @stich86' speedLan='1234567' %} +{% include_relative ont-luna-sdk-useful-commands.md + flash='flash' + ploam='hex' + customSwVersionAlert="This needs either `OMCI_OLT_MODE` to be set to 3 and firmware version 220530 or 220923 as modded by @stich86 or, if you don't want to replace the installed firmware, set `OMCI_OLT_MODE` value to `21`. This will force the stick to use your own settings from the XML file, but this is a hack and causes sigsegv of `/bin/checkomci`." + speedLan='1234567' + omciOLT21='true' +%} # Known Bugs diff --git a/_ont/ont-odi-realtek-dfp-34x-2c2.md b/_ont/ont-odi-realtek-dfp-34x-2c2.md index d1e1f46a..673c3e7d 100644 --- a/_ont/ont-odi-realtek-dfp-34x-2c2.md +++ b/_ont/ont-odi-realtek-dfp-34x-2c2.md @@ -17,7 +17,7 @@ parent: ODI | RAM | 64 MB | | System | Linux (Luna SDK 1.9) | | HSGMII | Yes | -| Optics | SC/UPC | +| Optics | SC/UPC(DFP-34X-2C2), SC/APC(DFP-34X-2C3)| | IP address | 192.168.1.1 | | Web Gui | ✅ user `admin`, password `admin` | | SSH | ✅ user `admin`, password `admin` | @@ -28,16 +28,16 @@ parent: ODI {% include alert.html content="SSH uses an outdated set of algorithms/ciphers, you can connect using the following command:" alert="Note" icon="svg-info" color="blue" %} ```shell -ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oCiphers=+3des-cbc admin@192.168.1.1 +ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oCiphers=+3des-cbc -o HostKeyAlgorithms=ssh-rsa admin@192.168.1.1 ``` {% include image.html file="realtek-dfp-34x-2c2.jpg" alt="ODI Realtek DFP-34X-C2C" caption="ODI Realtek DFP-34X-C2C" %} ## List of software versions -- V1.0-220923 (hybrid by @lanseyujie and @stick86) +- V1.0-220923 (hybrid by @lanseyujie and @stich86) - V1.0-220817 -- V1.0-220530 (hybrid by @stick86) +- V1.0-220530 (hybrid by @stich86) - V1.0-220414 (vlan working) - V1.0-220304 - V1.0-210702 @@ -45,7 +45,7 @@ ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oCiphers=+3des-cbc admin@192.16 ## List of firmwares and files - [Firmware repository by Anime4000](https://github.com/Anime4000/RTL960x/tree/main/Firmware/DFP-34X-2C2) -The reccomended version are `M114_sfp_ODI_hybrid_220527.tar` or `M114_sfp_ODI_hybrid_220916.tar` because it has working VLAN translation. +The recommended versions are `M114_sfp_ODI_hybrid_220527.tar` or `M114_sfp_ODI_hybrid_220916.tar`, as these have working VLAN translation. ## List of partitions @@ -68,18 +68,24 @@ The reccomended version are `M114_sfp_ODI_hybrid_220527.tar` or `M114_sfp_ODI_hy This stick supports dual boot. -`k0` and `r0` respectively contain the kernel and firmware of the first image, while `k1` and `r1` respectively contain the kernel and the firmware of the second one +`k0` and `r0` respectively contain kernel and firmware of the first image, while `k1` and `r1` contain kernel and firmware of the second one. ## Serial -The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. It's near the SFP header. TX, RX and ground pads need to be connected to a USB2TTL adapter supporting a logic level of 3.3V. +The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface: it's near the SFP header. TX, RX and ground pads need to be connected to a USB2TTL adapter supporting 3V3 logic. {% include image.html file="ont-odi-realtek-dfp-34x-2c2/ttl.jpg" alt="DFP-34X-2C2 TTL Connection" caption="DFP-34X-2C2 TTL Connection" %} {% include image.html file="ont-odi-realtek-dfp-34x-2c2/ttl-2.jpg" alt="DFP-34X-2C2 TTL Pin" caption="DFP-34X-2C2 TTL Pin" %} {% include alert.html content="Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work." alert="Note" icon="svg-warning" color="yellow" %} -{% include_relative ont-luna-sdk-useful-commands.md flash='flash' ploam='hex' customSwVersionAlert='This needs the `OMCI_OLT_MODE` value to be set to 3 and firmware 220530 or 220923 modded by @stich86' speedLan='1234567' %} +{% include_relative ont-luna-sdk-useful-commands.md + flash='flash' + ploam='hex' + customSwVersionAlert="This needs either `OMCI_OLT_MODE` to be set to 3 and firmware version 220530 or 220923 as modded by @stich86 or, if you don't want to replace the installed firmware, set `OMCI_OLT_MODE` value to `21`. This will force the stick to use your own settings from the XML file, but this is a hack and causes sigsegv of `/bin/checkomci`." + speedLan='1234567' + omciOLT21='true' +%} # Known Bugs @@ -89,6 +95,6 @@ The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be a - [Hacking RTL960x](https://github.com/Anime4000/RTL960x) - [Ditch ONU, use GPON SFP on Business Grade Router, Mikrotik/Ubiquiti/pfSense (Home Networking)](https://forum.lowyat.net/topic/4925452) -- [For the new model ODI ZTE DFP-34X-C2C](/ont-odi-zte-dfp-34x-2c2) +- [For the old model ODI ZTE DFP-34G-C2C](/ont-odi-zte-dfp-34g-2c2) diff --git a/_ont/ont-odi-zte-dfp-34g-2c2.md b/_ont/ont-odi-zte-dfp-34g-2c2.md index 7e426021..6c7bf032 100644 --- a/_ont/ont-odi-zte-dfp-34g-2c2.md +++ b/_ont/ont-odi-zte-dfp-34g-2c2.md @@ -52,7 +52,7 @@ alias: Usourcetech UGP-N1S This stick supports dual boot. -`kernel0` and `rootfs0` respectively contain the kernel and firmware of the first image, while `kernel1` and `rootfs1` respectively contain the kernel and the firmware of the second one +`kernel0` and `rootfs0` respectively contain kernel and firmware of the first image, while `kernel1` and `rootfs1` contain kernel and firmware of the second one # Miscellaneous Links diff --git a/_ont/ont-sercomm-fg1000b-11.md b/_ont/ont-sercomm-fg1000b-11.md new file mode 100644 index 00000000..9dbe66fc --- /dev/null +++ b/_ont/ont-sercomm-fg1000b-11.md @@ -0,0 +1,7 @@ +--- +title: Sercomm FG1000B.11s +has_children: false +redirect_to: /ont-sercomm-fg1000b +layout: default +parent: CIG +--- diff --git a/_ont/ont-sercomm-fg1000b.md b/_ont/ont-sercomm-fg1000b.md new file mode 100644 index 00000000..53aba3c4 --- /dev/null +++ b/_ont/ont-sercomm-fg1000b.md @@ -0,0 +1,349 @@ +--- +title: Sercomm FG1000B +has_children: false +layout: default +parent: Sercomm +--- + +# Hardware Specifications + +| | | +| --------------- | ------------------------------------------------------------------- | +| Vendor/Brand | Sercomm | +| Model | FG1000B | +| ODM | ✅ | +| Chipset | BCM68360_B1 | +| Flash | NAND 128 MB | +| RAM | 256 MB | +| CPU | Broadcom B53 Dual Core | +| CPU Clock | 1500MHz | +| Bootloader | CFE | +| Load addr | 0x80000 | +| 2.5GBaseT | Yes | +| PHY Ethernet | RTL8221B | +| Optics | LC/APC | +| IP address | 192.168.1.1/24 or 192.168.100.1/24 (depending on the derivate) | +| Web Gui | ✅, login may be needed (depending on the derivate) | +| SSH | No | +| Telnet | No | +| Serial | ✅, only TX | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | + + +{% include image.html file="fg1000b-11_rear.jpg" alt="Sercomm FG1000B.11" caption="Sercomm FG1000B.11 rear" %} +{% include image.html file="fg1000b-11_bottom.jpg" alt="Sercomm FG1000B.11 bottom" caption="Sercomm FG1000B.11 bottom" %} +{% include image.html file="fg1000b-11_side1.jpg" alt="Sercomm FG1000B.11 side 1" caption="Sercomm FG1000B.11 side 1" %} +{% include image.html file="fg1000b-11_side2.jpg" alt="Sercomm FG1000B.11 side 2" caption="Sercomm FG1000B.11 side 2" %} + +## Serial + +See side2 picture for pin identification, use 112500 8-N-1 +The ONT seems to only display output of the ROM CFE and flash CFE, but doesn't seem to allow interrupting the boot. + +{% include serial_dump.html file="fg1000b-11_boot_cfe.txt" alt="Sercomm FG1000B.11 CFE boot dump" title="Sercomm FG1000B.11 CFE boot dump" %} + +## Root procedure +[See the enable telnet/ssh section](/ont-sercomm-fg1000b-11/#enable-telnetsshserial) + +## List of software versions + +| Firmware version | Firmware date | used by | +| ---------------- | ------------- | ----------------------------- | +| 090122.1.0.001 | 03.11.2022 | Vodafone (FG1000B.VF) | +| 090133.1.0.003 | 11.09.2023 | o2/Telefonica (FG1000B.O2) | +| 090144.1.0.001 | | Deutsche Telekom (FG1000B.11) | +| 090144.1.0.004 | | Deutsche Telekom (FG1000B.11) | +| 090144.1.0.006 | | Deutsche Telekom (FG1000B.11) | +| 090144.1.0.009 | 23.05.2025 | Deutsche Telekom (FG1000B.11) | + + +## List of partitions +`cat /proc/mtd` + +| dev: | size | erasesize | name | +| ------ | -------- | --------- | -------------------- | +| mtd0: | 00200000 | 00020000 | "CfeROM | +| mtd1: | 00400000 | 00020000 | "CfeRAM1 | +| mtd2: | 00400000 | 00020000 | "CfeRAM2 | +| mtd3: | 000a0000 | 00020000 | "FlashMAP | +| mtd4: | 000a0000 | 00020000 | "SN | +| mtd5: | 00140000 | 00020000 | "Protect | +| mtd6: | 01b80000 | 00020000 | "Rootfs1 | +| mtd7: | 00c80000 | 00020000 | "Lib1 | +| mtd8: | 01b80000 | 00020000 | "Rootfs2 | +| mtd9: | 00c80000 | 00020000 | "Lib2 | +| mtd10: | 000a0000 | 00020000 | "Bootflg | +| mtd11: | 000a0000 | 00020000 | "Rootfs1_Info | +| mtd12: | 000a0000 | 00020000 | "Lib1_Info | +| mtd13: | 000a0000 | 00020000 | "Rootfs2_Info | +| mtd14: | 000a0000 | 00020000 | "Lib2_Info | +| mtd15: | 00280000 | 00020000 | "XMLConfig | +| mtd16: | 00280000 | 00020000 | "Erasable_XML_CFG | +| mtd17: | 00960000 | 00020000 | "AppData | +| mtd18: | 00140000 | 00020000 | "Yaffs | +| mtd19: | 010c0000 | 00020000 | "Reserve | +| mtd20: | 00930000 | 0001f000 | "rootfs_ubifs | +| mtd21: | 0029bf98 | 0001f000 | "filestruct_full.bin | +| mtd22: | 003bd000 | 0001f000 | "lib_squashfs | + +# Useful files and binaries + +{% include alert.html content="NAND MTD5 mounted as `/tmp/var_link_dir/ft` contains all serial numbers and the MAC address of the ONT, please consider backing it up before performing any hack, files are: `customer_sn,gpon_sn,hw_version,mac_addr,pcba_sn`" alert="Warning" icon="svg-warning" color="red" %} + +{% include alert.html content="Calling the `board_init` binary directly or indirectly (via init script) when the board is already booted will cause NAND mtd 5, 15, 16 & 17 to be erased! +Please back them up before any hacking! Recovery is possible if you hardware reset the device, enable the telnet and recreate the `customer_sn, gpon_sn, hw_version, mac_addr, pcba_sn` file on the `/tmp/var_link_dir/ft` volume which can be remounted as R/W `mount -o remount,rw /dev/mtdblock5 /tmp/var_link_dir/ft`." alert="Warning" icon="svg-warning" color="red" %} + +## Useful files +* `/etc/framework_init.sh` - is the main entry for the launch of the Sercomm framework by `/etc/rcS` + +## Useful binaries +* `pb_ap` - monitors the `reset button`. If the button is pushed for longer than 10s it resets the ONT to factory default, otherwise it only reboots the device - Run at startup - no args + +* `fw_image_ctl` - allows firmware upgrade, switch between `fw0` & `fw1`,reading firmware info, replicating between fw, deactivating image etc... - Options listed when called with no args + +* `cmld_client`- manipulates the configuration 'DB' stored in /dev/mtd15, its output is in the XML format. The root element is "InternetGatewayDevice". A final '.' dot is needed to list all sub-elements. Example to get the device's full XML config ```cmld_client get_node InternetGatewayDevice.```. Listed elements with `writable="1"` can be changed with `set` and the node path. Elements marked as `dynamic="1"` have their value evaluated at the time you specifically call get on that specific node, `cmld_client get InternetGatewayDevice.WANDevice.1.X_SC_GponInterfaceConfig.Status` - The daemon is run at startup - options listed when called with no args + +* `cmd_agent` - strange daemon launched at startup during `/etc/rcS` that opens a `/tmp/cmd_client` sock file that listens to commands and executes them. - No args + +* `statd` - daemon launched at boot which collects monitoring data from the ONT. - No args + +* `ubusd` - ubusd is used to send message between processes, current ubus services are `cml,network-manager,smd` + +* `smd` - daemon in charge of launching the `/opt/` plugin for each of the ONT's service like: `init, gpon, iptv, temperature, account, http, lan, network, syslog, system`. All is done in code which does not help hacking the device. + +# Usage + +## Enabling telnet/SSH/serial + +The code below can be pasted in the browser's console after opening `http://192.168.100.1` (default ONT's web UI). This will enable telnet as root with no password on the device (same can be done with `/usr/sbin/sshd` binary). The below hack uses an injection on the `eventlog_applog_download.json` page, the commands can be injected in the request body's `applog_select` parameter and they are executed as superadmin (root). +```javascript +// Fetch a non csrf protected page to get a csrf token +await fetch("http://192.168.100.1/setup.cgi?next_file=statusandsupport/status.html").then(function (response) { + return response.text(); +}).then(function (html) { + //inject the html response into a HTML DOM to parse it + var el = document.createElement( 'html' ); + el.innerHTML = html; + //The token is inserted into the first + + + +### Normal procedure + +This ONT seems to support PLOAM passwords up to 288 bits in lenghth (36 ASCII characters, 72 Hex digits). + +The PLOAM password is stored into 32 bit chunks (4 ASCII characters / 8 Hex digits), with each chunk being byte-swapped. + +So, starting from the following PLOAM in ASCII format -```sh -# vi /config/scfg.txt +``` +A1B2C3D4E5 ``` -Append the line below to the file and save it to change EQID +It gets translated into the following HEX value: ``` -CHAR-ARRAY CFG_ID_GPON_EQID = {0x46,0x49,0x42,0x45, 0x52,0x20,0x42,0x6f, 0x78,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00}; ##GPON ME ONU2G equiment id value, default is saturn +0x41314232433344344535 ``` -Reboot ONT to apply the change +Which is then split into the following blocks (the last block gets padded with 0 to reach 8 digits): -## Changing Serial Number +``` +BLOCK 0: 0x41314232 +BLOCK 1: 0x43334434 +BLOCK 2: 0x45350000 +``` + +Each block is then byte-swapped (i.e. read each sequence of two digits from right to left): + +``` +BLOCK 0: 0x32423141 +BLOCK 1: 0x34443343 +BLOCK 2: 0x00003545 +``` + +And then you can finally make the change persistent by modifying the configuration file: ```sh # vi /config/scfg.txt ``` -Append lines below to the file and save it to change Serial Number +Append the lines provided below to the file and save it to change the PLOAM password: ``` -STRING CFG_ID_PON_VENDOR_ID = SMBS; -INT CFG_ID_PON_VSSN = 0xAABBCCDD; +INT CFG_ID_PON_REGISTRATION_ID0 = 0x32423141; +INT CFG_ID_PON_REGISTRATION_ID1 = 0x34443343; +INT CFG_ID_PON_REGISTRATION_ID2 = 0x00003545; ``` -Reboot ONT to apply the change +Reboot the ONT to apply the change. + + +## Setting ONU GPON LOID and LOID password + +{% include alert.html content="The value 0x0 is null, take note of your LoID and password from the original ONT" color="red" %} -## Changing OLT Emulation Type ```sh # vi /config/scfg.txt ``` -Append lines below to the file and save it to change Serial Number +Append lines below to the file and save it to change LoID and LoID password ``` -STRING CFG_ID_PON_OLT_TYPE = ALCL; ##GPON OLT Vendor name, support ZTE,ADTRAN,ALCL,CALIX,SUMITOMO,CORTINA,HUAWEI +CHAR-ARRAY CFG_ID_LOID = {0x30,0x30,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0}; +CHAR-ARRAY CFG_ID_PASSWD = {0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0}; ``` -Reboot ONT to apply the change +Reboot ONT to apply the change. -## Changing OMCC Version +## Setting OMCI software version (ME 7) + +```sh +# fw_setenv img_version0 20220527052622 +# fw_setenv img_version1 20220527052622 +``` -{% include alert.html content="In Italy, if you are under some Huawei OLT it's mandatory to use 0xA3, while on Alcatel 0xB4, otherwise you will get O5 status but no MIBs - Note that this can be quirk of TIM Italy" alert="Warning" icon="svg-warning" color="red" %} +Reboot ONT to apply the change. +## Setting OMCI hardware version (ME 256) ```sh # vi /config/scfg.txt ``` -Append the line below to the file and save it to change Serial Number +Append the line provided below to the file and save it to change HWVER: ``` -CHAR CFG_ID_OMCC_VERSION = 0xB2; +CHAR-ARRAY CFG_ID_GPON_VERSION = {0x46,0x35,0x36,0x38, 0x34,0x53,0x5f,0x76, 0x31,0x00,0x00,0x00, 0x00,0x00}; ##GPON version string, default value is V1.0 ``` -Reboot ONT to apply the change +Reboot ONT to apply the change. -## Changing LOID Username/Password +## Setting OMCI equipment ID (ME 257) -{% include alert.html content="The value 0x0 is null, take note of your LoID and password from the original ONT" color="red" %} +```sh +# vi /config/scfg.txt +``` +Append the line providede below to the file and save it to change the EQID: + +``` +CHAR-ARRAY CFG_ID_GPON_EQID = {0x46,0x49,0x42,0x45, 0x52,0x20,0x42,0x6f, 0x78,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00}; ##GPON ME ONU2G equiment id value, default is saturn +``` + +Reboot ONT to apply the change. + +# Advanced settings + +## Changing OLT Emulation Type ```sh # vi /config/scfg.txt ``` -Append lines below to the file and save it to change LoID and LoID password +Append the lines provided below to the file and save it to change Emulation Type: ``` -CHAR-ARRAY CFG_ID_LOID = {0x30,0x30,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0}; -CHAR-ARRAY CFG_ID_PASSWD = {0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0}; +STRING CFG_ID_PON_OLT_TYPE = ALCL; ##GPON OLT Vendor name, support ZTE,ADTRAN,ALCL,CALIX,SUMITOMO,CORTINA,HUAWEI ``` -Reboot ONT to apply the change +Reboot ONT to apply the change. + +## Changing OMCC Version -## Spoofing firmware version ```sh -# fw_setenv img_version0 20220527052622 -# fw_setenv img_version0 20220527052622 +# vi /config/scfg.txt ``` -Reboot ONT to apply the change +Append the line provided below to the file and save it to change OMCC Version: + +``` +CHAR CFG_ID_OMCC_VERSION = 0xB2; +``` + +Reboot ONT to apply the change. + # Known Bugs -- `ALCL` OLT mode uses some static configurations on MIBs, so if your OLT has strict configuration checks it might not work properly -- During initial tests the only currently working mode of the stick is `PPTP EthUni` -- Stick can be configured also emulate `VEIP` mode(adding it to the scfg.txt file), but current firmware doesn't link correctly the XGBE interface, so no traffic is passing between LAN and PON interfaces +- `ALCL` OLT mode uses some static configurations on MIBs, so if your OLT has strict configuration checks it might not work properly. +- During initial tests the only currently working mode of the stick is `PPTP EthUni`. +- Stick can be configured to also emulate `VEIP` mode (adding it to the scfg.txt file), but the current firmware doesn't link correctly the XGBE interface, so no traffic is passing between LAN and PON interfaces. diff --git a/_ont_xgs/ont-huawei-hn8010ts.md b/_ont_xgs/ont-huawei-hn8010ts.md index 529fc3b0..8ec2f777 100644 --- a/_ont_xgs/ont-huawei-hn8010ts.md +++ b/_ont_xgs/ont-huawei-hn8010ts.md @@ -24,6 +24,12 @@ parent: Huawei | Serial | | | Form Factor | ONT | +{% include image.html file="huawei-hn8010ts-20/top_board_view2.jpg" alt="Huawei HN8010Ts teardown top" caption="Huawei HN8010Ts teardown top" %} +{% include image.html file="huawei-hn8010ts-20/bottom_board_view.jpg" alt="Huawei HN8010Ts teardown bottom" caption="Huawei HN8010Ts teardown bottom" %} +{% include image.html file="huawei-hn8010ts-20/broadcom_bcm84891.jpg" alt="Huawei HN8010Ts Broadcom chipset" caption="Huawei HN8010Ts Broadcom chipset" %} +{% include image.html file="huawei-hn8010ts-20/chip_sd5.82s_rfiv100__9657_cn_05.jpg" alt="Huawei HN8010Ts HiSilicon PON chipset" caption="Huawei HN8010Ts HiSilicon PON chipset" %} +{% include image.html file="huawei-hn8010ts-20/nand_ds35q1ga.jpg" alt="Huawei HN8010Ts NAND" caption="Huawei HN8010Ts NAND" %} + ## Software Version - V5R02C0C10S165 diff --git a/_ont_xgs/ont-huawei-useful-command.md b/_ont_xgs/ont-huawei-useful-command.md index d664b16b..e4030504 100644 --- a/_ont_xgs/ont-huawei-useful-command.md +++ b/_ont_xgs/ont-huawei-useful-command.md @@ -1,19 +1,18 @@ ## Enabling telnet -We need access to a specific shell and in order to get it we have to enable telnet. On the unit, the telnet server accepts connections but doesn't read any input, nor does it send anything. +We need access to a specific shell and in order to get it enabling telnet is required. On the ONT, the telnet server accepts connections but doesn't read any input, nor does it send anything. -To enable telnet we’ll use one of the web interface’s features: the configuration backup and restore page. The configuration can be downloaded as an XML, which contains a lot more options than the web interface and a couple of them can be modified to enable telnet access: under the `X_HW_CLITelnetAccess` node, set the `Access` attribute to `1` and in `AclServices`, `TELNETLanEnable` should also be set to `1`. I had to set both but your mileage may vary. +To enable telnet the configuration backup/restore web UI page will be used. The configuration can be downloaded as an XML, which contains a lot more options than the web interface and a couple of them can be modified to enable telnet access: under the `X_HW_CLITelnetAccess` node, set the `Access` attribute to `1` and, in `AclServices`, `TELNETLanEnable` should also be set to `1`. Both might have to be set but your mileage may vary. It is possible that this won't work/has been fixed in more recent versions. Now that this is done, the modified configuration file can be uploaded via the web interface, the ONT will restart and telnet should be accessible on port 23. - -# General Settings and Useful Commands - {% include alert.html content="All results need to be converted from HEX to ASCII. You can use our [Converter](/ascii-hex), taking care to add 0x in front and remove the spaces every 8 hex digits." alert="Warning" icon="svg-info" color="blue" %} -## Getting the OLT vendor +# GPON ONU status + +## Get information of the OLT vendor ``` WAP>omcicmd mib show meid 131 instid 0 @@ -31,7 +30,9 @@ success! ``` *0x48575443* → *HWTC* (Huawei) -## Getting the ONT SW Version 0 and 1 +# GPON/OMCI settings + +## Getting OMCI software version (ME 7) ``` WAP>omcicmd mib show meid 7 instid 0 @@ -61,7 +62,7 @@ success! ``` *0x56355230 32304331 30533131 3500* → *V5R020C10S115* -## Getting the ONT Vendor ID and HW Version: +## Getting OMCI hardware version and vendor ID (ME 256) ``` WAP>omcicmd mib show meid 256 instid 0 @@ -90,7 +91,7 @@ success! *0x48575443* → *HWTC* *0x32343046 2e41* → *240F.A* -## Getting the ONT Equipment ID +## Getting OMCI equipment ID (ME 257) ``` WAP>omcicmd mib show meid 257 instid 0 diff --git a/_ont_xgs/ont-nokia-use.md b/_ont_xgs/ont-nokia-use.md new file mode 100644 index 00000000..bf79767f --- /dev/null +++ b/_ont_xgs/ont-nokia-use.md @@ -0,0 +1,26 @@ +# Usage +## Login and enable + + +Once you're logged in, a custom menu will be shown and you'll be able to access the linux shell by first typing `system` followed by `shell`: + +```sh +ONT>enable +#ONT>login +User name:ONTUSER +Password: **** +``` + +The enable password can be generated using the following form: + +{% include cig_password.html username="ONTUSER" %} + +# Access Full Shell + +To access a complete linux shell just type: +```sh +#ONT>system +#ONT/system>shell +``` + +To exit the shell and reach the parent menu type `exit` or `x`, in each menu the `help` command will show how to use the shell diff --git a/_ont_xgs/ont-nokia-useful-command.md b/_ont_xgs/ont-nokia-useful-command.md new file mode 100644 index 00000000..411335d9 --- /dev/null +++ b/_ont_xgs/ont-nokia-useful-command.md @@ -0,0 +1,128 @@ +# GPON ONU status + +## Getting the operational status of the ONU +```sh +#ONT>traffic +#ONT/system>pon +#ONT/system/pon>show link + + ----------------- LINK STATE ----------------- + Link State: ACTIVE + Operation State Machine: OPERATION (O5) + ----------------- STATE END ----------------- +``` + +## Querying a particular OMCI ME + +```sh +#ONT>system +#ONT/system>mib +#ONT/system/mib>show 256 +Table Ontg, Ont-g, total 1 instances + +EntityID = 0x0000 +VID = "ALCL" +Version = AA BB CC DD EE FF 11 22 33 44 55 66 00 00 +SerialNum = AA BB CC DD EE FF 11 22 +TraffMgtOpt = 0 +AtmCCOpt = 0 +BatteryBack = 1 +AdminState = 0 +OpState = 0 +OnuSurvivalTime = 0 +Loid = "" +Password = "" +AuthState = 0 +OntState = 1 +``` + +# GPON/OMCI settings + +## Committing changes to the OMCI MIB tables for GPON operation +```sh +#ONT>system +#ONT/system>mib +#ONT/system/mib>reset +``` + +## Getting/Setting ONU GPON Serial Number +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>eqsn set "ALCL00000001" +---ATECMDRESULT--- OK +#ONT/system/misc>eqsn get +eqsn: ALCL00000001 +---ATECMDRESULT--- OK +``` + +## Getting/Setting PLOAM +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>pon_passwd set "123456789" +---ATECMDRESULT--- OK +#ONT/system/misc>pon_passwd get +pon_passwd: 31323334353637383900 +---ATECMDRESULT--- OK +#ONT/system/misc>register_id set "123456789" +---ATECMDRESULT--- OK +#ONT/system/misc>register_id get +pon_passwd: 31323334353637383900 +---ATECMDRESULT--- OK +``` + +## Setting OMCI software version (ME 7) +```sh +# echo SWVER=3FE49337AOCK80 > /mnt/rwdir/sys.cfg +``` + +## Getting/Setting OMCI hardware version (ME 256) +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>eqvid get +eqvid: 3FE45458ABAA06 +hex_eqvid: 0x3346453435343538414241413036 +---ATECMDRESULT--- OK +#ONT/system/misc>eqvid set "YOUR_CUSTOM_VID" +``` + +## Getting/Setting OMCI vendor ID (ME 256) +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>vendor get +vendor: ALCL +---ATECMDRESULT--- OK +#ONT/system/misc>vendor set "ALCL" +---ATECMDRESULT--- OK +``` + +## Getting/Setting OMCI equipment ID (ME 257) +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>eqid set "YOUR_CUSTOM_EQUID" +---ATECMDRESULT--- OK +#ONT/system/misc>eqid get +eqid: YOUR_CUSTOM_EQUID +hex_eqid: 0x594F55525F435553544F4D5F4551554944000000000000 +---ATECMDRESULT--- OK +``` + +# Advanced settings + +## Setting management IP +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>admin_ip get +admin_ip: 192.168.100.1 +---ATECMDRESULT--- OK +#ONT/system/misc>admin_ip set 192.168.1.1 +#ONT/system/misc>admin_mask get +admin_mask: 255.255.255.0 +---ATECMDRESULT--- OK +#ONT/system/misc>admin_mask set 255.255.255.0 +``` diff --git a/_ont_xgs/ont-nokia-xs-010s-q.md b/_ont_xgs/ont-nokia-xs-010s-q.md new file mode 100644 index 00000000..a95781a4 --- /dev/null +++ b/_ont_xgs/ont-nokia-xs-010s-q.md @@ -0,0 +1,56 @@ +--- +title: Nokia XS-010S-Q +has_children: false +layout: default +parent: Nokia +--- + +# Hardware Specifications + +| | | +| ---------------- | ------------------------------------------------------------------ | +| Vendor | Nokia | +| Model | XS-010S-Q | +| ODM | ? | +| ODM Product Code | ? | +| Chipset | Cortina CA8271S | +| CPU | Dual core CPU (four virtual CPUs) running at 800 MHz | +| L1 Cache | 64KB (32KB instruction, 32KB data) | +| L2 Cache | 256KB with I/O coherency | +| Manufacter | ? | +| Flash | 1GB | +| RAM | ? | +| System | ? | +| 10GBaseT | Yes | +| Optics | SC/APC | +| IP address | 192.168.100.1 | +| Web Gui | ✅ Port 80 user: `admin`, password: `1234` | +| SSH | ✅ (see Enable SSH) | +| Telnet | ✅ Port 23 user: `admin`, password: `1234` (see Telnet Full Shell) | +| Form Factor | SFP+ | + +# Module Pinout + +| | | | +| --- | --- | --- | +| PIN | Description +| 1. VeeT | Module transmitter ground | | +| 2. Tx Fault |Transmitter fault indication output | | +| 3. TX_DISABLE |Transmitter shut-off input | | +| 4. SDA | 2-wire serial interface data line (MOD-DEF2) 2: I/O | | +| 5. SCL | 2-wire serial interface clock (MOD-DEF1) 2 input | | +| 6. MOD_ABS | Module absent | connected to VeeT or VeeR in the module | +| 7. DYING GASP1 | Dying gasp message indicator input | | +| 8. LOS | Loss of signal output | | +| 9. VeeR | Module receiver ground | | +| 10. VeeR | Module receiver ground | | +| 11. VeeR | Module receiver ground | | +| 12. RXD | Receiver inverted data output | | +| 13. RXD+ | Receiver non-inverted data output | | +| 14. VeeR | Module receiver ground | | +| 15. VCCR | Module receiver 3.3V supply | | +| 16. VCCT | Module transmitter 3.3V supply | | +| 17. VeeT | Module transmitter ground | | +| 18. TXD+ | Transmitter non-inverted data input | | +| 19. TXD | Transmitter inverted data input | | +| 20. VeeT | Module transmitter ground | | diff --git a/_ont_xgs/ont-nokia-xs-010x-q.md b/_ont_xgs/ont-nokia-xs-010x-q.md index 19a4a50e..cc26ad3c 100644 --- a/_ont_xgs/ont-nokia-xs-010x-q.md +++ b/_ont_xgs/ont-nokia-xs-010x-q.md @@ -12,17 +12,110 @@ parent: Nokia | Vendor | Nokia | | Model | XS-010X-Q | | ODM | CIG | -| ODM Product Code | XG-99C | -| Chipset | | -| Manufacter | | -| Flash | | -| RAM | | -| System | | +| ODM Product Code | XG-99YF | +| Chipset | Cortina CA8271A | +| Manufacter | CIG | +| Flash | 128MB | +| RAM | 128MB | +| System | Custom Linux by Cortina (Saturn SDK) based on Kernel 4.4 | | 10GBaseT | Yes | -| Optics | | +| Optics | SC/APC | | IP address | 192.168.100.1 | -| Web Gui | ✅ Port 80 (⚠️ *only available when the PON connection **IS NOT** estabilished*)| -| SSH | No | -| Telnet | ✅ Port 23 | -| Serial | | +| Web Gui | ✅ Port 80 user: `admin`, password: `1234` | +| SSH | ✅ (see Enable SSH) | +| Telnet | ✅ Port 23 user: `admin`, password: `1234` (see Telnet Full Shell) | +| Serial | ✅ | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | | Form Factor | ONT | + + +# External/Internal Photo + +{% include image.html file="ont-nokia_xs-010x-q_front.jpg" alt="Nokia XS-010X-Q Front" caption="Nokia XS-010X-Q Front" %} + +{% include image.html file="ont-nokia_xs-010x-q_rear.jpg" alt="Nokia XS-010X-Q Rear" caption="Nokia XS-010X-Q Rear" %} + +{% include image.html file="ont-nokia_xs-010x-q_internal_1.jpg" alt="Nokia XS-010X-Q Internal 1" caption="Nokia XS-010X-Q Internal 1" %} + +{% include image.html file="ont-nokia_xs-010x-q_internal_2.jpg" alt="Nokia XS-010X-Q Internal 2" caption="Nokia XS-010X-Q Internal 2" %} + +## Serial + +The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface: it's on the top left of the board, when the Ethernet\Power\Optical ports are facing down. TX, RX and ground pads need to be connected to a USB2TTL adapter supporting 3V3 logic. + +{% include image.html file="ont-nokia_xs-010x-q_ttl.jpg" alt="Nokia XS-010X-Q TTL Pads" caption="Nokia XS-010X-Q TTL Pads" %} + +{% include alert.html content="Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work." alert="Note" icon="svg-warning" color="yellow" %} + +## List of software versions +- 3FE49337AOCK80 - (R4.4.17.063 CIG 25/06/2021) +- 3FE49337BOCK28 + +## List of partitions + +| dev | size | erasesize | name | +| ----- | -------- | --------- | --------------- | +| mtd0 | 00040000 | 00020000 | "ssb" | +| mtd1 | 00100000 | 00020000 | "uboot-env" | +| mtd2 | 00100000 | 00020000 | "dtb0" | +| mtd3 | 00600000 | 00020000 | "kernel0" | +| mtd4 | 02800000 | 00020000 | "rootfs0" | +| mtd5 | 00100000 | 00020000 | "dtb1" | +| mtd6 | 00600000 | 00020000 | "kernel1" | +| mtd7 | 02800000 | 00020000 | "rootfs1" | +| mtd8 | 01400000 | 00020000 | "userdata" | +| mtd9 | 00100000 | 00020000 | "mfginfo1" | +| mtd10 | 00100000 | 00020000 | "mfginfo2" | +| mtd11 | 00001000 | 00001000 | "uboot-env2" | +| mtd12 | 00b09000 | 0001f000 | "squashfs_ubi" | +| mtd13 | 01078000 | 0001f000 | "userdata" | +| mtd14 | 00b09000 | 0001f000 | "squashfs_ubi" | + +This ONT supports dual boot. + +`kernel0` and `rootfs0` respectively contain the kernel and firmware of the first image, `kernel1` and `rootfs1` the kernel and firmware of the second one. + +{% include_relative ont-nokia-use.md %} + +{% include_relative ont-nokia-useful-command.md %} + +## Enable SSH (not persistent) + +Port 22 is filtered by default and the SSH daemon can be only enabled in runtime. Here is the procedure but it's not persistent and will need to be done again after each reboot: + +Access UART with `ONTUSER`, then enter `system\misc`. + +Set `ssh_en` to `1` with the command: +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>ssh_en set 1 +---ATECMDRESULT--- OK +``` + +Go back to `system`, then `shell` and run this command: +```sh +#ONT/system/misc>exit +#ONT/system>shell +#ONT/system/shell>iptables -F +``` +## Enable Telnet Full Shell + +When using the default credentials to access telnet (`admin`\\`1234`), the prompt is limited to the `GponSLID` shell that only permits modifying or displaying the `PLOAM` password. +If you change the `admin_mask` to `255.255.255.255`, default credentials stop working but you can login as `ONTUSER` using the generated password to have full shell like when using UART. + +Here is the procedure to change `admin_mask`: + +Access UART with `ONTUSER`, then enter `system\misc`. + +Set `admin_mask` to `255.255.255.255` with the command: +```sh +#ONT>system +#ONT/system>misc +#ONT/system/misc>admin_mask set 255.255.255.255 +normal load eep datat +---ATECMDRESULT--- OK +``` + +Now reboot the ONT and you can access telnet with `ONTUSER` and full power :) diff --git a/_ont_xgs/ont-zte-f2801s.md b/_ont_xgs/ont-zte-f2801s.md new file mode 100644 index 00000000..83eab408 --- /dev/null +++ b/_ont_xgs/ont-zte-f2801s.md @@ -0,0 +1,273 @@ +--- +title: ZTE F2801S +has_children: false +layout: default +parent: ZTE +--- + +# Hardware Specifications + +| | | +| ------------ | --------------------------------- | +| Vendor/Brand | ZTE | +| Model | F2801Sv2 | +| ODM | ✅ | +| CPU | | +| CPU Clock | | +| Chipset | | +| Flash | | +| RAM | | +| System | | +| 10GBaseT | Yes | +| Optics | SC/APC | +| IP address | 192.168.1.1 | +| Web Gui | ✅ user `admin`, password `admin` | +| SSH | | +| Telnet | ✅ [^1] | +| Serial | ✅ | +| Form Factor | ONT | + +{% include image.html file="f2801s/front.jpg" alt="F2801S front plate" caption="F2801S front plate" %} +{% include image.html file="f2801s/internal.jpg" alt="F2801S internal" caption="F2801S internal layout" %} + + +## List of software versions +### HW V2.0 +- V2.0.10P7N1 (OpenFiber) +- V2.0.10P7N2 (OpenFiber) + +## List of partitions + +### HW V2.0 + +| dev | size | erasesize | name | +| ---- | -------- | --------- | ---------------- | +| mtd0 | 08000000 | 00020000 | "whole flash" | +| mtd1 | 00200000 | 00020000 | "u-boot" | +| mtd2 | 00400000 | 00020000 | "others" | +| mtd3 | 00400000 | 00020000 | "parameter tags" | +| mtd4 | 00400000 | 00020000 | "wlan" | +| mtd5 | 00800000 | 00020000 | "usercfg" | +| mtd6 | 00400000 | 00020000 | "middle" | +| mtd7 | 02a00000 | 00020000 | "kernel1" | +| mtd8 | 02a00000 | 00020000 | "kernel2" | +| mtd9 | 029e0000 | 00020000 | "rootfs" | + + +This ONT supports dual boot, as visible from the presence of `kernel1` and `kernel2`, which contain the rootfs. +The boot images can be swapped with the following command: + +```sh +upgradetest switchver X +``` + +Where `X` can be `0/1`, based on the image you want to boot from. + + +You can also clone the currently running image into the other slot using this command: + +```sh +syn_version +``` + +# Use +{% include alert.html content="Commands have been tested on V2 HW rev. on OpenFiber firmwares" alert="Note" icon="svg-info" color="blue" %} + +## Enable Telnet +{% include alert.html content="This is an external script ([ZTE Telnet enabler](https://github.com/douniwan5788/zte_modem_tools)), use at your own risk! Credentials don't survive at reboot!" alert="Note" icon="svg-info" color="blue" %} + +```sh +python3 zte_factroymode.py --user admin --pass admin --ip 192.168.1.1 --port 80 telnet open +``` + +You should get this output and credentials to login over telnet: + +```sh +trying user:"admin" pass:"admin" +reset facTelnetSteps: +reset OK! + +facStep 1: +OK! + +facStep 2: +OK! + +facStep 3: +OK! + +facStep 4: +OK! + +facStep 5: +OK! + +done +Username: 2W3iqFVt +Password: Eqb8X8Qt +``` + +## Enable console redirection + +To see omcidebug messages on telnet, execute this command (just the first time of each connection): + +```sh +redir printf +``` + +# GPON ONU status + +## Getting the operational status of the ONU + +To check the connection status use the following command: +``` +gpontest -gstate +``` +`[gpontest] gpon state is [O5]` for O5 state + +## Getting OLT vendor information + +```sh +sendcmd 132 omcidebug showmedata 131 +``` + +This command will print the following output: + +```sh +################################## +MIB INFO: + ME CLASS: 131 + DB NAME: olt_g, DBHandle: 32 +################################## + +<-----MeID[ 0x0000,0 ], Addr[ 0x19a2b1]-----> + Vendorid:48 57 54 43 + EquipmentID:00 00 00 00 00 00 00 00 00 00 + 00 00 00 00 00 00 00 00 00 00 + Version:31 30 00 00 00 00 00 00 00 00 + 00 00 00 00 + TimeofDay:00 00 00 00 00 00 00 00 00 00 + 00 00 00 00 +--------------------------------------------------------------------- +``` + +## Querying a particular OMCI ME + +```sh +sendcmd 132 omcidebug showmedata ID_MIB (eg. 7 for Firmware version) +``` + +This command will print the following output: + +```sh + +################################## +MIB INFO: + ME CLASS: 7 + DB NAME: soft_image, DBHandle: 14 +################################## + +<-----MeID[ 0x0000,0 ], Addr[ 0x19a011]-----> + Version:V6.0.10N41 + Is committed:01 + Is active:01 + Is valid:01 + +<-----MeID[ 0x0001,1 ], Addr[ 0x19a031]-----> + Version:V6.0.10N39 + Is committed:00 + Is active:00 + Is valid:01 +--------------------------------------------------------------------- +``` + +# GPON/OMCI settings + +## Setting ONU GPON Serial Number + +{% include alert.html content="Both S/N and VID have to be changed. 2176 is for the VID (first 4 letters of the S/N) and 2177 is for the last 8 digits of the S/N" alert="Note" icon="svg-info" color="blue" %} +```sh +setmac 1 2176 ZTEG +setmac 1 2177 AABBCCDD +``` + +## Setting ONU GPON PLOAM password + +{% include alert.html content="The PLOAM password is stored in the ASCII format." alert="Note" icon="svg-info" color="blue" %} +This can be done easily via the web UI. To do it via the shell use: +```sh +setmac 1 2181 1234567890 +setmac 1 2178 1234567890 +``` + +# Advanced settings + +## Backing up ONT Paritions for HW/SW Version Mod + +This step is suggested if you want to replace firmware on your ONT to spoof HW and SW version: + +Needed tools: + +- Linux VM or WSL with Python >3.3 +- [ZTE Telnet enabler](https://github.com/douniwan5788/zte_modem_tools) +- TFTP server + +The first step is to login over telnet with `zte_factroymode.py`, then execute ALL these commands for a full backup: + +**Go to `/tmp` folder to create tmp files** + +```sh +cd /tmp +``` + +**Dump and transfer all mtd ** + +In the following commands, 192.168.1.2 is the IP of the machine running the TFTP server, change it as needed. + +```sh +cat /dev/mtd1 > u-boot.bin && tftp -l u-boot.bin -r u-boot.bin -p 192.168.1.2 && rm u-boot.bin +cat /dev/mtd2 > others.bin && tftp -l others.bin -r others.bin -p 192.168.1.2 && rm others.bin +cat /dev/mtd3 > parameter_tags.bin && tftp -l parameter_tags.bin -r parameter_tags.bin -p 192.168.1.2 && rm parameter_tags.bin +cat /dev/mtd4 > wlan.bin && tftp -l wlan.bin -r wlan.bin -p 192.168.1.2 && rm wlan.bin +cat /dev/mtd5 > usercfg.bin && tftp -l usercfg.bin -r usercfg.bin -p 192.168.1.2 && rm usercfg.bin +cat /dev/mtd6 > middle.bin && tftp -l middle.bin -r middle.bin -p 192.168.1.2 && rm middle.bin +cat /dev/mtd7 > kernel1.bin && tftp -l kernel1.bin -r kernel1.bin -p 192.168.1.2 && rm kernel1.bin +cat /dev/mtd8 > kernel2.bin && tftp -l kernel2.bin -r kernel2.bin -p 192.168.1.2 && rm kernel2.bin +cat /dev/mtd9 > rootfs.bin && tftp -l rootfs.bin -r rootfs.bin -p 192.168.1.2 && rm rootfs.bin + +``` + +## Changing region code + +{% include alert.html content="Be aware that changing the region code may break features such as PPPoE depending on your ISP" alert="Note" icon="svg-info" color="blue" %} + +ZTE has created various region codes that load default values based on the local ISP. This configuration can be changed using this command: + +```sh +upgradetest sfactoryconf X +``` + +Where X is the number of supported regioncode into file `/etc/init.d/regioncode`, here is an example from OpenFiber `V2.0.10P7N2` firmware: + +```sh +# cat /etc/init.d/regioncode +19:Turkey +65:FTOrange +116:Tescali +139:Multilaser +188:HollandKpnSfu +198:Manufacture +2010:Cetin +``` + +# Random notes +- The F2801S reads the software version exposed through the gpon_omci deamon from each kernel partition header, so the only way to spoof this parameter is to change the version in the header and recalculate CRC, otherwise the bootloader will refuse to load the image + +# Miscellaneous Links + +- [ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools) + +--- + +[^1]: It may be possible to flash an alternative firmware to avoid running the `zte_factory.py` script each time. +[^2]: Credentials are randomly generated by zte_factroymode.py. They don't survive at reboot diff --git a/_ont_xgs/ont-zte.md b/_ont_xgs/ont-zte.md new file mode 100644 index 00000000..fff9ccbd --- /dev/null +++ b/_ont_xgs/ont-zte.md @@ -0,0 +1,5 @@ +--- +title: ZTE +has_children: true +layout: default +--- \ No newline at end of file diff --git a/_ont_xgs/ont-zyxel-pm7300-t0.md b/_ont_xgs/ont-zyxel-pm7300-t0.md new file mode 100644 index 00000000..c470dedc --- /dev/null +++ b/_ont_xgs/ont-zyxel-pm7300-t0.md @@ -0,0 +1,78 @@ +--- +title: Zyxel PM7300-T0 +has_children: false +layout: default +parent: Zyxel +--- + +# Hardware Specifications + +| | | +| ------------ | -------------------------------------- | +| Vendor/Brand | Zyxel | +| Model | PM7300-T0 | +| Chipset | MediaTek/EcoNet EN7580 | +| Flash | 128 MiB SPI NAND (Macronix MXIC35LF1G) | +| RAM | 256 MiB | +| 10GBaseT | ✅ 1 × | +| Optics | SC/APC | +| IP address | 192.168.0.1/24 | +| Web Gui | ✅ port 80/443 | +| SSH | ✅ port 22 | +| Telnet | ✅ port 23 | +| FTP | ✅ port 21 | +| Serial | ✅ (TTL 3.3V @ 115200,8n1) | +| Form Factor | ONT | + +{% include image.html file="zyxel-pm7300/ports.jpg" alt="Zyxel PM7300-T0 ports" caption="Zyxel PM7300-T0 ports" %} + + +## Tear down + +{% include image.html file="zyxel-pm7300/bottom.jpg" alt="Zyxel PM7300-T0 bottom" caption="Zyxel PM7300-T0 bottom" %} + +{% include alert.html content="The GPON-SN on the sticker is not the same as you get from [Get GPON serial number](#get-gpon-serial-number)!" alert="Hint" icon="svg-info" color="grey" %} + +Unscrew the screws beneath the two encircled rubber feet. +Then slide a plastic spudger/pry/case opening tool around to separate the top half from the bottom half of the case. +Pay attention that the board does not fall out when the case splits! + +{% include image.html file="zyxel-pm7300/board_top.jpg" alt="Zyxel PM7300-T0 board" caption="Zyxel PM7300-T0 board" %} +{% include image.html file="zyxel-pm7300/board_bottom.jpg" alt="Zyxel PM7300-T0 board (bottom side)" caption="Zyxel PM7300-T0 board (bottom side)" %} + + +## Get GPON serial number + +Connect via SSH (as admin): + +```console +ZySH> sys atsh +Firmware Version : V5.42(ABYY.1.3)C0 +Bootbase Version : V1.44 | 04/12/2023 9:18:33 +Vendor Name : Zyxel Communications Corp. +Product Model : PM7300-T0 +Serial Number : S230YNNNNNNNN +GPON Serial Number : ZYXE8CAXXXXX +... +``` + +Alternatively, the command `ATSH` in the zloader bootloader can be used. + +## SSH + +```sh +ssh -o HostKeyAlgorithms=+ssh-rsa admin@192.168.0.1 +``` + +{% include alert.html content="The device only presents SSH host keys using SHA1 which is not accepted anymore since OpenSSH 8.8. If the connection fails add `-o HostKeyAlgorithms=+ssh-rsa`. Other SSH clients may behave similarly." alert="Hint" icon="svg-info" color="grey" %} + + +## Serial + +Follow the procedure in [tear down](#tear-down) to open the case, then connect a USB-TTL adapter to the pin header: + +{% include image.html file="zyxel-pm7300/UART.jpg" alt="Zyxel PM7300-T0 UART pins" %} + +{% include alert.html content="Some USB-TTL adapters label Tx and Rx pins the other way around; try to swap them if the connection doesn't work." alert="Hint" icon="svg-warning" color="yellow" %} + +**Baudrate:** 115200 8n1 diff --git a/_ont_xgs/ont-zyxel.md b/_ont_xgs/ont-zyxel.md new file mode 100644 index 00000000..2945eac5 --- /dev/null +++ b/_ont_xgs/ont-zyxel.md @@ -0,0 +1,5 @@ +--- +title: Zyxel +has_children: true +layout: default +--- diff --git a/_ont_xgs/serial_dump/fs-XGS-ONU-25-20NI_minishell.txt b/_ont_xgs/serial_dump/fs-XGS-ONU-25-20NI_minishell.txt new file mode 100644 index 00000000..08d22d04 --- /dev/null +++ b/_ont_xgs/serial_dump/fs-XGS-ONU-25-20NI_minishell.txt @@ -0,0 +1,208 @@ ++traffic Service CLI menu + +ces CES CLI menu (empty) + +pon PON CLI menu + +debug PON debug command + rptwanstat config report wan status to MEC + tcont add/delete/flush a Tcont + flow configure the parameters of a flow + queue configure the parameters of a Tcont Queue + sendomci Send a OMCI message + prbs Enable/disable transmitting PRBS continuously + dyingGsend Enable/disable transmitting PRBS continuously + omcidbg Enable/disable kernel OMCI log + reportGemCnt Enable/disable report gem counter to MEC + throughput Enable/disable throughput test + ponmode Enable/disable qos + dump_classifier Dump classifier rule + gem_to_cpu trap gem port all packets to cpu + +hw PON Hardware level command + show Show hardware status or configurations + read_reg Read register value + write_reg Write register value + +ca PON cortina command + show Show cortina status or configurations + +app PON APP command + show Show database in PMR app + sendmsg Send Msg to PMR app + ber_interval Configure the BER interval + sf_threshold The threshold of BIP to report signal failure + sd_threshold The threshold of BIP to report signal degrade + sn Set the serial number of the ONT + password Set the password of ONT + to1_to2 Set the To1 To2 timer of ONT + show show PON information + +eth ETH CLI menu + +debug Ethernet Debug System CLI menu + pack Ethernet CLI debug function for pack driver + brdg Ethernet CLI debug function for SOC bridge + phy Ethernet CLI debug function for PHY + showconn Show ethernet connection debug info + ethdbg enable/disable the eth debug flag + show Ethernet CLI Show + +voip VoIP CLI menu (empty) + +omci omci CLI menu + +debug OMCI Debug System CLI menu + showemrcfg show the configuration of EMR from MEC + crc enable the crc check of omci message + omiterr Enable/disable omitting OMCI errors + acpower Start or stop power shedding + allocid Function call mec_AddAllocId + ponstate Function call mec_HandlePonStateChange + +voip OMCI VoIP System CLI menu + show show the configuration of VMR from MEC + +defaultxml MEC Xml List CLI menu + show show the List of default Xml from MEC + crc_commit runtime xml add crc + restore_xml runtime xml restore + show Show the information of MEC + clear Clear the runtime data + +router router CLI menu (empty) + +dmr DMR CLI menu (empty) + +hpna HPNA CLI menu (empty) ++system System CLI menu + +mib MIB CLI menu + +debug MIB Debug System CLI menu + dump Dump current mib to a file + reset Reset mib to default values + show Show the content of mib tables + +log LOG CLI menu + +kernel KERNEL LOG CLI menu (empty) + show Print out a log + dump dump the content of a log file + set Save a log to a file + clear Clear a log + collectlog Collectlog all log + +env ENV CLI menu + show Print out enviroment variables + +misc MISC CLI menu + +bob BOSA CLI menu + eep Misc CLI Show + unlock Misc CLI Show + echo Misc CLI Show + 2090 Misc CLI Show + preheat Misc CLI Show + auto Misc CLI Show + automod Misc CLI Show + restart Misc CLI Show + +debug Misc Debug System CLI menu + showwc Show write counter of mtd device + showbad Show bad blocks of mtd device + show Misc CLI Show + rf Misc CLI Show + filter Misc CLI Show + agc Misc CLI Show + ponalarm Misc CLI Show + mpcode Read or write eeprom : EEP_MFG_PRODUCTCODE + mpsn Read or write eeprom : EEP_MFG_PRODUCTSERIAL + mhwv Read or write eeprom : EEP_MFG_HWVERSION + lasersn Read or write eeprom : EEP_MFG_LASERSERIAL + mac1 Read or write eeprom : EEP_MFG_MAC1 + mac2 Read or write eeprom : EEP_MFG_MAC2 + eepver Read or write eeprom : EEP_MFG_EEPVER + burnin Read or write burnin flag : EEP_MFG_BURNIN + rfthigh Read or write rfthigh in unit of 64 ohm : EEP_MFG_RFT_HIGH + rftlow Read or write rftlow in unit of 64 ohm: EEP_MFG_RFT_LOW + rithigh Read or write rithigh in unit of 64 ohm : EEP_MFG_RIT_HIGH + ritlow Read or write ritlow in unit of 64 ohm: EEP_MFG_RIT_LOW + major Read or write eeprom : EEP_HW_FUNCTIONMAJOR + minor Read or write eeprom : EEP_HW_FUNCTIONMINOR + hwver Read or write eeprom : EEP_HW_VERSION + vendor Read or write eeprom : EEP_EQ_VENDORID + eqsn Read or write eeprom : EEP_EQ_SERIALNUMBER + eqsnvend Read or write eeprom : EEP_EQ_SNVENDOR + eqvid Read or write eeprom : EEP_EQ_VERSIONID + eqid Read or write eeprom : EEP_EQ_ID + img_name Read or write eeprom : EEP_SW_BOOTIMAGE + admin_ip Read or write eeprom : EEP_SW_IPADDR + admin_mask Read or write eeprom : EEP_SW_IPMASK + server_ip Read or write eeprom : EEP_SW_HOSTIPADDR + admin_gw Read or write eeprom : EEP_SW_GATEIPADDR + ftp_user Read or write eeprom : EEP_SW_FTPUSER + ftp_passwd Read or write eeprom : EEP_SW_FTPPASS + bootflag Read or write eeprom : EEP_SW_BOOTFLAG + admin_en Read or write eeprom : EEP_SW_BOOTREMOTEEN + xgspon_regid Read or write eeprom : XGS PON Registration ID + test_en Read or write eeprom : EEP_SW_BOOTTESTEN + notcomplete Read or write eeprom : EEP_SW_BOOTNOTCOMPLETE + act_img Read or write eeprom : EEP_SW_ACTIVEIMAGE + commit_img Read or write eeprom : EEP_SW_COMMITIMAGE + pon_passwd Read or write eeprom : EEP_APP_GPONPASSWORD + register_id Read or write eeprom : EEP_APP_GPONPASSWORD + hwerr Read or write eeprom : EEP_HW_DIAGNOSTICCODE + vdsl2_vendor Read or write eeprom : EEP_VDSL2_VENDORID + ssh_en Read or write eeprom : EEPROM_RW_CMD + i2c_r This command read i2c device in raw mode + i2c_w This command write i2c device in raw mode + write_mem This command is used to write otp + read_mem This command is used to read otp + sendevent This command is used to send led event directly + testloaden This command enable test load for manufacture + testensn This command enable test load for manufacture + eep_reset This command restore EEPROM factory default configuration + eep_r8 This command read EEPROM in raw mode + eep_w8 This command write EEPROM in raw mode + eep_crc This command update/check EEPROM crc value + exeep_r8 This command read EEPROM in raw mode + exeep_w8 This command write EEPROM in raw mode + exeep_crc This command update/check EEPROM crc value + eepinfo This command show eep info. + clearcfg This command is used to clear ONT runtime config , if full para is set, clear loid also!Usage: clearcfg [full] + final_check This command is used to show some important information for checking! + led This command is used to only turn on green leds,red leds or off all leds!Usage: led gon/ron/off + testloaden This command enable test load for manufacture + testensn This command enable test load for manufacture + get_gpio_val This command get gpio value + diswdt This command disable for manufacture + bosa This command is used to set bosa version and type + image_copy This command copy one image to another at next boot time + stopreboot Stop reboot command for debug + +manu Manufacture CLI menu + we This command write eeprom for manufacture + wep This command only write PC for manufacture + wes This command only write SN for manufacture + wem1 This command only write MAC1 for manufacture + wem2 This command only write MAC2 for manufacture + ledon This command turn on all led + ledoff This command turn off all led + final_check This command do final check + get_gpio_val This command get gpio value + trans This command show transceiver info + temp This command show system temperature + er This command enable rf + dr This command diable rf + ef This command enable filter + df This command disable filter + ten This command enable test load + wd This command disable watchdog + tensn This command enable test load, special for BL olt + ces_main This command configure ces connection for main test board + ces_back This command configure ces connection for backup test board + check_boot_status This command check boot status + check_ranging_statusThis command check ranging status + check_usb_port This command does manu test for USB device + reset_button_test This command is used for Reset Button test + factory_reset Clear all configuration and return to factory setting + load_certfile Load ACS HTTPS private Cert file into ONT + +fs File System CLI menu + show Show the content of system memory + supgrade super user Upgrade Image from Local Ftp Server + flash System Flash memory Operation command + upgrade Upgrade Image from Local Ftp Server + check check the content of system mtd + +net NET CLI menu + mirror Set mirror debug + dump Set dump frames debug + log Open/Close driver debug log + atconn Active connection debug + show Show NetMgr Data + +shell Shell + +debug System Debug CLI menu + showtimer Show timers + showtask Show task state + starttimer Start timers + stoptimer Start timers + md5 calculate MD5 value from input string + md5num calculate MD5 number string from input string + printlog Set the log level to print to console + ontver Show ONT Software Version + custom Get/Set ONT Software custom information \ No newline at end of file diff --git a/_router_pon/avm.md b/_router_pon/avm.md new file mode 100644 index 00000000..438f8566 --- /dev/null +++ b/_router_pon/avm.md @@ -0,0 +1,5 @@ +--- +title: AVM +has_children: true +layout: default +--- diff --git a/_router_pon/avm_fritzbox.md b/_router_pon/avm_fritzbox.md new file mode 100644 index 00000000..e6bb7225 --- /dev/null +++ b/_router_pon/avm_fritzbox.md @@ -0,0 +1,26 @@ +## SFP Whitelist + +- FRITZ!SFP AON (IEEE 802.3ah-2004 1000BASE-BX10, TX 1310 nm, RX 1480 to 1580 nm, LC/APC 8°, 10 km)[^aon] +- FRITZ!SFP AON TV Filter (IEEE 802.3ah-2004 1000BASE-BX10) +- FRITZ!SFP GPON (GPON ITU-T G.984.2/984.5, TX 1310 nm, RX 1490 nm, LC/UPC 8°, 20 km) +- FRITZ!SFP XGS-PON (XGS-PON ITU-T G.9807 TX 1270 nm, RX 1577 nm, è l’unico che usa un SC/UPC, 20 km) + + +# GPON/OMCI settings + +## Setting ONU GPON Serial Number + +It is possible to change the serial number ("Modem ID") by editing it in the http://fritz.box/support.lua, in the ASCII format (ZTEG012345678). +If the Fritz!OS Version is => 7.50 and the device is set up to be in Germany, the field "GPON PLOAM GPON serial number" is missing. + +{% include image.html file="avm/avm_serial.jpg" alt="Serial number form" caption="Serial number form" %} + + +## Setting ONU GPON PLOAM password + +It is possible to change the GPON PLOAM passowrd by editing it in the logon data, in the ASCII format (PLOAM) + +{% include image.html file="avm/avm_ploam.png" alt="PLOAM Password form" caption="PLOAM Password form" %} + +-- +[^aon] [EWE AON Anschluss SFP Transceiver](https://www.glasfaserforum.de/forum/thread/984-ewe-aon-anschluss-sfp-transceiver/) diff --git a/_router_pon/avm_fritzbox_5530.md b/_router_pon/avm_fritzbox_5530.md new file mode 100644 index 00000000..38c1093f --- /dev/null +++ b/_router_pon/avm_fritzbox_5530.md @@ -0,0 +1,35 @@ +--- +title: AVM FRITZ!Box 5530 +has_children: false +layout: default +parent: AVM +--- + +# Hardware Specifications + +| | | +| --------------- | ------------------------------------------------------------------------ | +| Vendor/Brand | AVM FRITZ!Box 5530 | +| Model | FRITZ!Box 5530 | +| ODM | ✅ | +| Chipset | MaxLinear Falcon PRX321B1BI-S-LNEV MIPS32 | +| Flash | 128 MB | +| RAM | 1024 MB | +| Chipset | MaxLinear Falcon PRX321B1BI-S-LNEV MIPS32 | +| CPU Clock | 800 MHz | +| Bootloader | | +| System | | +| Load addr | | +| SFP | 1GBASE-BX10 (only FRITZ!SFP AON), PON equivalent symbol GPON and XGS-PON | +| Ethernet | 4 1GbE, 1 2.5GbE LAN/WAN | +| Optics | SC/UPC | +| IP address | 192.168.1.254 | +| Web Gui | ✅ | +| SSH | | +| Telnet | | +| Serial | | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | CPE with SFP w/o MAC support | + +{% include_relative avm_fritzbox.md %} diff --git a/_router_pon/avm_fritzbox_5590.md b/_router_pon/avm_fritzbox_5590.md new file mode 100644 index 00000000..3af6f5d9 --- /dev/null +++ b/_router_pon/avm_fritzbox_5590.md @@ -0,0 +1,35 @@ +--- +title: AVM FRITZ!Box 5590 +has_children: false +layout: default +parent: AVM +--- + +# Hardware Specifications + +| | | +| --------------- | ------------------------------------------------------------------------ | +| Vendor/Brand | AVM FRITZ!Box 5590 | +| Model | FRITZ!Box 5590 | +| ODM | ✅ | +| Chipset | MaxLinear Falcon PRX321B1BI-S-LNEV MIPS32 | +| Flash | 4 GB | +| RAM | 2048 MB | +| Chipset | MaxLinear Falcon PRX321B1BI-S-LNEV MIPS32 | +| CPU Clock | 800 MHz | +| Bootloader | | +| System | | +| Load addr | | +| SFP | 1GBASE-BX10 (only FRITZ!SFP AON), PON equivalent symbol GPON and XGS-PON | +| Ethernet | 4 1GbE, 1 2.5GbE LAN/WAN | +| Optics | SC/UPC | +| IP address | 192.168.1.254 | +| Web Gui | ✅ | +| SSH | | +| Telnet | | +| Serial | | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | CPE with SFP w/o MAC support | + +{% include_relative avm_fritzbox.md %} diff --git a/_router_pon/free_iliad.md b/_router_pon/free_iliad.md new file mode 100644 index 00000000..39727b85 --- /dev/null +++ b/_router_pon/free_iliad.md @@ -0,0 +1,13 @@ +--- +title: Free/Iliad +has_children: true +layout: default +--- + +# Free/Iliad network + +Iliad's (Italy) PON network is delivered through two types of technology: GPON or EPON where available. The latter is not actually pure 10G-EPON but DPoE (DOCSIS Provisioning over EPON), confirmed by analyzing the physical layer signals. + +Using a Xilinx Kintex 7 FPGA with an integrated logic analyzer, an optical module has been connected to the FPGA's transceiver. The transceiver synchronized successfully and the sync header sequence was the one expected for 10G-EPON: a FEC codeword is a sequence of 31 words. Those words have a sync header binary value of `10` or `01` repeated 27 times corresponding to the original message plus `00, 11, 11, 00` corresponding to the FEC parity information. Discarding the latter part and descrambling the remaining data, the packets have been retrieved. + +As an example, a packet starts with `55 d5 55 1b 3c 07 5f` in hex, which corresponds to a DPoE (10G) preamble (actually it's missing one starting `0x55` byte but the CRC8 at the end is correct nonetheless). diff --git a/_router_pon/free_iliad_box_pop.md b/_router_pon/free_iliad_box_pop.md new file mode 100644 index 00000000..fc486982 --- /dev/null +++ b/_router_pon/free_iliad_box_pop.md @@ -0,0 +1,53 @@ +--- +title: FreeBox Pop/IliadBox +has_children: false +layout: default +parent: Free/Iliad +--- + +# Hardware Specifications + +| | | +| ---------------- | ---------------------------------------------------------------------------------- | +| Vendor/Brand | Free/Iliad | +| Model | | +| ODM | | +| ODM Product Code | | +| Chipset | BCM63153 | +| Flash | 4GB eMMC 5.1 KLM4G1FETE-B041 | +| RAM | 2x 512MB DDR3L-1866 NT5CC128M16JR-EK | +| CPU | | +| CPU Clock | | +| Bootloader | | +| System | | +| Load addr | | +| SFP | 1G-BASEX, 10G-BASESR-LR, HSGMII (only AFM0003ILD), PON equivalent symbol EPON 10/1 | +| Ethernet | 2 1GbE, 1 2.5GbE LAN/WAN | +| Optics | SC/UPC | +| IP address | 192.168.1.254 | +| Web Gui | ✅ | +| SSH | | +| Telnet | | +| Serial | | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | CPE with SFP w/o MAC support | + + + +## Serial + +The serial port is routed through the USB-C port used for power (which is PD compliant, tested with a notebook power supply). The pins are SBU1 and SBU2, reversal is handled using an open drain buffer (SN74LVC2G07) so a pull-up resistor on RX is needed. On the power daughter board TP7 is TX and TP8 is RX. There is also a USB differential pair routed through the USB-C connector but there is no use for it yet. +At the moment nothing more than a boot log is available. [^bcm61650hack] [^freeboxhack] + +## SFP Whitelist +- WTD RTXM166-401-C13 (EPON w/o MAC) +- WTD RTXM166-401-C11 (EPON w/o MAC) +- Hisense LTF7215-BH+ (EPON w/o MAC) +- [Technicolor AFM0003](/ont-technicolor-afm0003) (GPON with MAC) +- SFP Copper 10Gtek (1 and 10 Gbps) + +# Miscellaneous Links + +[^bcm61650hack]: *Pwning the bcm61650* https://blog.xilokar.info/pwning-the-bcm61650.html +[^freeboxhack]: *Firmware key extraction by gaining EL3* https://blog.xilokar.info/firmware-key-extraction-by-gaining-el3.html diff --git a/_router_pon/ont-zte-f6645p.md b/_router_pon/ont-zte-f6645p.md new file mode 100644 index 00000000..9a412fad --- /dev/null +++ b/_router_pon/ont-zte-f6645p.md @@ -0,0 +1,199 @@ +--- +title: ZTE F6645P +has_children: false +layout: default +parent: ZTE +--- + +# Hardware Specifications + +| | | +| ------------ | ----------------------------- | +| Vendor/Brand | ZTE | +| Model | F6645P | +| ODM | ✅ | +| CPU | ZTE | +| CPU Clock | 266 MHz | +| Chipset | ZTE | +| Flash | 130 MB Kioxia TC58BVG0S3HTAI0 | +| RAM | 315 MB | +| System | | +| 2.5GBaseT | Yes | +| Optics | SC/APC or SC/UPC | +| IP address | 192.168.1.1 | +| Web Gui | Random password | +| SSH | | +| Telnet | ✅ [^1] | +| Serial | Only RX | +| Form Factor | ONT | + +## List of partitions + +| dev | size | erasesize | name | +| ---- | -------- | --------- | ---------------- | +| mtd0 | 08000000 | 00020000 | "whole flash" | +| mtd1 | 00200000 | 00020000 | "u-boot" | +| mtd2 | 00400000 | 00020000 | "others" | +| mtd3 | 00400000 | 00020000 | "parameter tags" | +| mtd4 | 00400000 | 00020000 | "wlan" | +| mtd5 | 00800000 | 00020000 | "usercfg" | +| mtd6 | 00400000 | 00020000 | "Plugin" | +| mtd7 | 02a00000 | 00020000 | "kernel1" | +| mtd8 | 02a00000 | 00020000 | "kernel2" | +| mtd9 | 029e0000 | 00020000 | "rootfs" | + + + +This ONT supports dual boot, as visible from the presence of `kernel0` and `kernel1`, which contain the rootfs. +The boot images can be swapped with the following command: + +```sh +upgradetest switchver X +``` + +Where `X` can be `0/1`, based on the image you want to boot from. + + +You can also clone the currently running image into the other slot using this command: + +```sh +syn_version +``` + +# Use + +## Enable Telnet +{% include alert.html content="This is an external script ([ZTE Telnet enabler](https://github.com/douniwan5788/zte_modem_tools)), use at your own risk! Credentials don't survive at reboot!" alert="Note" icon="svg-info" color="blue" %} + +```sh +python3 zte_factroymode.py --user admin --pass admin --ip 192.168.1.1 --port 80 telnet open +``` + +You should get this output and credentials to login over telnet: + +```sh +trying user:"admin" pass:"admin" +reset facTelnetSteps: +reset OK! + +facStep 1: +OK! + +facStep 2: +OK! + +facStep 3: +OK! + +facStep 4: +OK! + +facStep 5: +OK! + +done +Username: 2W3iqFVt +Password: Eqb8X8Qt +``` + +## Enable console redirection + +To see omcidebug messages on telnet, execute this command (just the first time of each connection): + +```sh +redir printf +``` + +# GPON ONU status + +## Getting the operational status of the ONU + +To check the connection status, use the following command: +``` +gpontest -gstate +``` +`[gpontest] gpon state is [O5]` for O5 state + +## Getting OLT vendor information + +```sh +sendcmd 132 omcidebug showmedata 131 +``` + +This command will print the following output: + +```sh +################################## +MIB INFO: + ME CLASS: 131 + DB NAME: olt_g, DBHandle: 32 +################################## + +<-----MeID[ 0x0000,0 ], Addr[ 0x19a2b1]-----> + Vendorid:48 57 54 43 + EquipmentID:00 00 00 00 00 00 00 00 00 00 + 00 00 00 00 00 00 00 00 00 00 + Version:31 30 00 00 00 00 00 00 00 00 + 00 00 00 00 + TimeofDay:00 00 00 00 00 00 00 00 00 00 + 00 00 00 00 +--------------------------------------------------------------------- +``` + +## Querying a particular OMCI ME + +```sh +sendcmd 132 omcidebug showmedata ID_MIB (eg. 7 for Firmware version) +``` + +This command will print the following output: + +```sh + +################################## +MIB INFO: + ME CLASS: 7 + DB NAME: soft_image, DBHandle: 14 +################################## + +<-----MeID[ 0x0000,0 ], Addr[ 0x19a011]-----> + Version:V6.0.10N41 + Is committed:01 + Is active:01 + Is valid:01 + +<-----MeID[ 0x0001,1 ], Addr[ 0x19a031]-----> + Version:V6.0.10N39 + Is committed:00 + Is active:00 + Is valid:01 +--------------------------------------------------------------------- +``` + +# GPON/OMCI settings + +## Setting ONU GPON Serial Number + +{% include alert.html content="Both S/N and VID have to be changed. 2176 is for the VID (first 4 letters of the S/N) and 2177 is for the last 8 digits of the S/N" alert="Note" icon="svg-info" color="blue" %} +```sh +setmac 1 2176 ZTEG +setmac 1 2177 AABBCCDD +``` + +## Setting ONU GPON PLOAM password + +{% include alert.html content="The PLOAM password is stored in the ASCII format." alert="Note" icon="svg-info" color="blue" %} +This can be done easily via the web UI. To do it via the shell use: +```sh +setmac 1 2181 1234567890 +setmac 1 2178 1234567890 +``` + + +# Miscellaneous Links + +- [ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools) + +--- + +[^2]: Credentials are randomly generated by zte_factroymode.py, they are not persistent and will change at reboot. \ No newline at end of file diff --git a/_router_pon/ont-zte.md b/_router_pon/ont-zte.md new file mode 100644 index 00000000..fff9ccbd --- /dev/null +++ b/_router_pon/ont-zte.md @@ -0,0 +1,5 @@ +--- +title: ZTE +has_children: true +layout: default +--- \ No newline at end of file diff --git a/_router_pon/tp_link.md b/_router_pon/tp_link.md new file mode 100644 index 00000000..ac169ed8 --- /dev/null +++ b/_router_pon/tp_link.md @@ -0,0 +1,5 @@ +--- +title: TP-Link +has_children: true +layout: default +--- diff --git a/_router_pon/tp_link_xb432v.md b/_router_pon/tp_link_xb432v.md new file mode 100644 index 00000000..f242ab81 --- /dev/null +++ b/_router_pon/tp_link_xb432v.md @@ -0,0 +1,46 @@ +--- +title: TP-Link XB432V +has_children: false +layout: default +parent: TP-Link +--- + +# Hardware Specifications + +| | | +| ------------ | ----------------------------- | +| Vendor/Brand | TP-Link | +| Model | XB432V | +| ODM | | +| CPU | | +| CPU Clock | | +| Chipset | | +| Flash | | +| RAM | | +| System | | +| Ethernet | 2 1GbE LAN, 1 2.5GbE LAN, 1 2.5GbE WAN | +| Optics | SC/APC | +| IP address | 192.168.1.1 | +| Web Gui | ✅ | +| SSH | | +| Telnet | | +| Serial | Only RX | +| Form Factor | CPE with ONT | + + +# GPON/OMCI settings + +## Setting ONU GPON Serial Number + +In the "Rete -> Impostazioni GPON" page, GPON SN field is disabled and not editable. It can be enabled via the browser’s developer console by editing the HTML code and setting HTML `disabled` attribute to `enabled`. + +{% include image.html file="tp-link/xb432v-change-sn.jpg" alt="XB432V procedure for changing GPON SN" caption="XB432V procedure for changing GPON SN" %} + +## Setting ONU GPON PLOAM password + +This can be easily done via the Web UI from the same "Rete -> Impostazioni GPON" page. The password field is already editable. + + +# Miscellaneous Links + +- [User manual](https://www.windtre.it/Document/manuali/modem/Manuale_XB432v-ITWIND3-1-0_UG_IT.pdf.docview.pdf) diff --git a/_router_pon/tp_link_xx800v.md b/_router_pon/tp_link_xx800v.md new file mode 100644 index 00000000..08cd335a --- /dev/null +++ b/_router_pon/tp_link_xx800v.md @@ -0,0 +1,46 @@ +--- +title: TP-Link XX800V +has_children: false +layout: default +parent: TP-Link +--- + +# Hardware Specifications + +| | | +| ------------ | ----------------------------- | +| Vendor/Brand | TP-Link | +| Model | XX800V | +| ODM | | +| CPU | | +| CPU Clock | | +| Chipset | | +| Flash | | +| RAM | | +| System | | +| Ethernet | 3 1GbE LAN, 1 2.5GbE WAN | +| Optics | SC/APC | +| IP address | 192.168.1.1 | +| Web Gui | ✅ | +| SSH | | +| Telnet | | +| Serial | Only RX | +| Form Factor | CPE with ONT | + + +# GPON/OMCI settings + +## Setting ONU GPON Serial Number + +In the "Rete -> Impostazioni GPON" page, GPON SN field is disabled and not editable. It can be enabled via the browser’s developer console by editing the HTML code and setting HTML `disabled` attribute to `enabled`. + +{% include image.html file="tp-link/xb432v-change-sn.jpg" alt="XB432V procedure for changing GPON SN" caption="XB432V procedure for changing GPON SN" %} + +## Setting ONU GPON PLOAM password + +This can be easily done via the Web UI from the same "Rete -> Impostazioni GPON" page. The password field is already editable. + + +# Miscellaneous Links + +- [User manual](https://www.windtre.it/Document/manuali/modem/XX800v-ITWIND3_UG_REV1-0-0_Italian.pdf.docview.pdf) diff --git a/_sfp/bosa-tosa-rosa.md b/_sfp/bosa-tosa-rosa.md index a893170b..25586033 100644 --- a/_sfp/bosa-tosa-rosa.md +++ b/_sfp/bosa-tosa-rosa.md @@ -5,8 +5,8 @@ nav_order: 3 layout: default --- -In optical-electrical conversion, special components called TOSA (Transmitter Optical Sub Assembly) and ROSA (Receiver Optical Sub Assembly) are used to convert the signal. -They are responsible for translating the optical signal into a corresponding electrical signal or vice versa, which inputs or outputs symbols corresponding to the optical values. These values, which we refer to as unprocessed or RAW values for simplicity, are not standard signals and must be converted into standard signals[^huawei]. +In optical-electrical conversions, special components called TOSA (Transmitter Optical Sub Assembly) and ROSA (Receiver Optical Sub Assembly) are used to convert the signal. +They are responsible for translating the optical signal into a corresponding electrical signal and viceversa, which inputs or outputs symbols corresponding to the optical values. These values, which we refer to as unprocessed or RAW values for simplicity, are not standard signals and must be converted into standard signals[^huawei]. TOSA and ROSA are essential components in the uni-directional transceivers which transmit on one fiber optic strand and receive on the other fiber optic strand. diff --git a/_sfp/ont-wo-mac.md b/_sfp/ont-wo-mac.md index b1e6faf0..717822ea 100644 --- a/_sfp/ont-wo-mac.md +++ b/_sfp/ont-wo-mac.md @@ -5,22 +5,22 @@ nav_order: 2 layout: default --- -PON technologies unlike Ethernet are not P2P but one-to-many with two device types: ONU (Optical Network Unit)/ONT (Optical Network Terminal) and OLT (Optical Line Terminal). Both devices can be manufactured using the SFP form factor[^tibit]. +PON technologies, unlike Ethernet, are not P2P but one-to-many with two device types: ONU (Optical Network Unit)/ONT (Optical Network Terminal) and OLT (Optical Line Terminal). Both devices can be manufactured using the SFP form factor[^tibit]. -The OLT provides an integrated access box for Passive Optical Networks. OLTs are typically chassis with one or more line cards inside, and on each line card there is one or more PON transceiver, usually in SFP form factor. Each line card is connected to a secondary switch that provides line card aggregation to the Ethernet uplinks. OLTs are often a mixture of Layer 2 and Layer 3 switching with traffic shaping on a per-customer, per-service basis[^tibit]. +The OLT provides an integrated access box for Passive Optical Networks. OLTs are typically chassis with one or more line cards inside, and on each line card there is one or more PON transceiver, usually in the SFP form factor. Each line card is connected to a secondary switch that provides line card aggregation to the Ethernet uplinks. OLTs are often a mixture of Layer 2 and Layer 3 switching with traffic shaping on a per-customer, per-service basis[^tibit]. -The communication within the SFP PON transceiver is neither MMI nor Ethernet, outside [SFP standards](/sfp-standard.md), but rather it is an *equivalent electrical symbols of optical transmission* (which is simply the input/output of the [BOSA](/bosa-tosa-rosa.md)) that for simplicity's sake we call **PON RAW communication** (also referred to as SFP w/o PON MAC). All the PON management part is left to the line card itself. Each equivalent electrical symbol of optical transmission is a separate dialect, distinct from other dialects. Furthermore, as one can easily guess, this communication is not standard and is not within the signalling standards ([^sfprate],[^sfprate2],[^sfpplusstandard]) but it is compliant with some portions of the MSA [^sfpstandard],[^sfpplusstandard],[^sfpplusmi]. This requires extreme compatibility between ONT and transreciver. This design choice is made for several reasons: -- *size*: the size of an OLT w/o PON MAC is very similar to that of an MMI or Ethernet transceiver, and the size of an OLT with the integrated PON MAC far exceeds that of the standard SFP form factor -- *dissipative heating capacity*: the dissipative heating capacity of an OLT with PON MAC is higher than a normal transceiver, such as a 1 or 10 Gbps Ethernet link. -- *duplication*: there is a double `MAC` → `MMI` conversion (`MMI` → `MAC` → `PHY` → `MAC` → `OLT CPU`) -- *repairability*: since lasers often have a shorter lifetime than other ICs, it is good to be able to change only the transceiver +The communication within the SFP PON transceiver is neither MII nor Ethernet, outside [SFP standards](/sfp-standard.md), but rather it is an *equivalent electrical symbols of optical transmission* (which is simply the input/output of the [BOSA](/bosa-tosa-rosa.md)) that for simplicity's sake we call **PON RAW communication** (also referred to as SFP w/o PON MAC). All the PON management part is left to the line card itself. Each equivalent electrical symbol of optical transmission is a separate dialect, distinct from other dialects. Furthermore, as one can easily guess, this communication is not standard and is not within the signalling standards ([^sfprate],[^sfprate2],[^sfpplusstandard]) but it is compliant with some portions of the MSA [^sfpstandard],[^sfpplusstandard],[^sfpplusmi]. This requires extreme compatibility between ONT and transceiver. This design choice is made for several reasons: +- *size*: the size of an OLT w/o PON MAC is very similar to that of an MII or Ethernet transceiver, and the size of an OLT with the integrated PON MAC far exceeds that of the standard SFP form factor; +- *dissipative heating capacity*: the dissipative heating capacity of an OLT with PON MAC is higher than a normal transceiver, such as a 1 or 10 Gbps Ethernet link; +- *duplication*: there is a double `MAC` → `MII` conversion (`MII` → `MAC` → `PHY` → `MAC` → `OLT CPU`); +- *repairability*: since lasers often have a shorter lifetime than other ICs, it is good to be able to only change the transceiver. -Despite this, there is a vendor that sells OLT SFP with PON MAC[^tibit]. The following pictures show an OLT SFP with PON MAC part and a transreciver without PON MAC. It is interesting to see that the latter is much longer and requires an additional heatsink. +Despite this, there is a vendor that sells OLT SFPs with PON MAC[^tibit]. The following pictures show an OLT SFP with PON MAC part and a transreciver without PON MAC. It is interesting to see that the latter is much longer and requires an additional heatsink. {% include image.html file="ont-wo-mac/tibit.png" alt="PON OLT with MAC" caption="PON OLT with MAC" %} {% include image.html file="ont-wo-mac/huawei.png" alt="PON transceiver for OLT w/o MAC" caption="PON transceiver for OLT w/o MAC" %} -Similarly, the same argument can be made for OLT SFPs, especially in 10E-PON and XGS-PON there are a lot of transreceivers w/o PON MAC and few ONTs with PON MAC. In this case the reasons are similar to the previous ones. It is also clear that ONTs w/o PON MAC require a PON MAC part within the end device that supports the relevant communication protocol. +Similarly, the same argument can be made for ONT SFPs, especially in 10E-PON and XGS-PON there are a lot of transceivers w/o PON MAC and few ONTs with PON MAC. In this case, the reasons are similar to the OLT SFPs'. It is also clear that ONTs w/o PON MAC require a PON MAC part within the end device that supports the relevant communication protocol. The following pictures show some operating diagrams of some ONT with PON MAC and ONT w/o PON MAC[^SFPP-XGS-ONU-MAC-ASC-I-C],[^SFPP-XGS-ONU-N1-I-C],[^MSOG22-xD6C-xxT1]. @@ -40,7 +40,7 @@ graph TD end; subgraph CS[Cage SFP] E --> |I2C| Controller; - C --> |MMI on Tx - Rx| MAC; + C --> |MII on Tx - Rx| MAC; Controller[Controller I2C] --> Switch; MAC --> Switch; end; @@ -65,14 +65,16 @@ graph TD end; ``` -# Why are there no ONT w/o MAC on Hack GPON? +# Why are there no ONTs w/o MAC on Hack GPON? -For utility reasons all SFPs w/o PON MAC are not illustrated on Hack GPON as they are not modifiable like ONT with MAC (they require two inter-compatible devices). +For usefulness reasons, all SFPs w/o PON MAC are not illustrated on Hack GPON as they are not modifiable like ONTs with MAC (they require two inter-compatible devices). -In particular, the SFP ONU of the AVM Fritz!Box 5530/5590 belongs in this category, and that the above-mentioned devices are not compatible with any other SFP using MMI/Ethernet/Fibre Channel, while for example the FreeBox or IliadBox supports both ONU w/o PON MAC and some SFP with MAC. +In particular, the SFP ONU of the AVM Fritz!Box 5530/5590 belongs in this category, and that the above-mentioned devices are not compatible with any other SFP using MII/Ethernet/Fibre Channel, while for example the FreeBox or IliadBox supports both ONU w/o PON MAC and some SFP with MAC. In general, these devices do not have enough customisation to allow the required parameters to be changed other than the GPON Serial Number and GPON Ploam Password. This means that in most scenarios these devices with ONT w/o MAC are not flexible enough to be used as a replacement for an ISP-provided ONT. +Nevertheless, on Hack-GPON routers supporting SFP w/o MAC will arrive, with at least the modification of GPON Serial Number and GPON Ploam Password. + --- [^sfpstandard]: *Specification for SFP (Small Formfactor Pluggable) Transceiver* INF-8074 diff --git a/_sfp/sfp-standard.md b/_sfp/sfp-standard.md index 66efc482..892f7728 100644 --- a/_sfp/sfp-standard.md +++ b/_sfp/sfp-standard.md @@ -7,18 +7,22 @@ layout: default The organisation that developed SFPs (MSA SFP) has always been very cautious about defining a hardened list of admissible signals for SFPs, their first standard only providing pinout, form-factor and dissipative capacity specifications. It is up to the manufacturer to decide which communication to use in the Tx and Rx pins[^sfpstandard]. -After the SFP standard entered the market, in the early 2000s Ethernet and Fibre Channel, the MSA SFP also started to standardise signalling, starting with [^sfprate] and [^sfprate2] which define a list of admissible standard signalling limited to the capabilities of the current form factor SFP. -With the need to increase the heat dissipation characteristics of the modules (in order to increase speeds) and to allow some additions to the EEPROM, an additional standard, called SFP+[^sfpplusstandard],[^sfpplusmi], was developed, which contains all the aforementioned improvements. The 16GFC, 20GFC signalling for Fibre Channel and the 10 Gbps and 2.5 signalling for Ethernet were also included in the updated [^sfprate] and [^sfprate2] standard. Some of these are also included in [^sfpplusstandard] locking the SFP+ standard to a tenth of signalling, all other signals should fall under the SFP standard[^sfpstandard], but they can use the extended SFP+ management interface[^sfpplusmi]. +After the SFP standard entered the market, in the early 2000s with Ethernet and Fibre Channel, the MSA SFP also started standardising signalling, starting with [^sfprate] and [^sfprate2] which define a list of admissible standard signalling limited to the capabilities of the current form factor SFP. +With the need to increase the heat dissipation characteristics of the modules (in order to increase speeds) and to allow some additions to the EEPROM, an additional standard, called SFP+[^sfpplusstandard],[^sfpplusmi],[^xenpak_xfp], was developed, which contains all the aforementioned improvements. The 16GFC, 20GFC signalling for Fibre Channel and the 10 Gbps and 2.5 signalling for Ethernet were also included in the updated [^sfprate] and [^sfprate2] standard. Some of these are also included in [^sfpplusstandard] locking the SFP+ standard to a tenth of signalling, all other signals should fall under the SFP standard[^sfpstandard], but they can use the extended SFP+ management interface[^sfpplusmi]. -The Ethernet signals are all very similar, but there are some differences between BaseX and MMI. The media-independent interface (MMI) was defined in the IEEE 802.11u standard, was originally defined as a standard interface to connect a Fast Ethernet MAC block (i.e. CPU, switch) to a PHY chip (i.e. twisted pair, fiber optic, etc.) in a standardised way. The main advantage is that the MMI can be used without redesigning or replacing the MAC hardware. Thus any MAC may be used with any PHY, independent of the network signal transmission media[^ethernet]. -The MII can be used to connect a MAC to an external PHY using a pluggable connector, or directly to a PHY chip on the same PCB. In the first case it is also used in SFP connectors, for example to allow connections between two MAC blocks without passing through a PHY (i.e. passive DAC). -This technology, and in particular its evolutions such as RGMII[^rgmii], SGMII[^sgmii], HSGMII, QSGMII[^qsgmii], XGMII, XSGMII, is widely used as a communication bus over SFP, and is the current standard replacing IEEE BaseX[^ethernet]. +The Ethernet signals are all very similar, but there are some differences between Base-X and MII. The media-independent interface (MII) was defined in the IEEE 802.11u standard. It was originally defined as a standard interface to connect a Fast Ethernet MAC block (i.e. CPU, switch) to a PHY chip (i.e. twisted pair, fiber optic, etc.) in a standardised way. The main advantage is that MII can be used without redesigning or replacing the MAC hardware. Thus any MAC may be used with any PHY, independent of the network signal transmission media[^ethernet]. -RGMII, SGMII, GBaseX standards allow a speed of 1 Gbps, 2.5BaseX and HSGMII standards of 2.5 Gbps, the XGMII, XSGMII and 10GBaseT of 10 Gbps. +The main difference is the physical media over which the frames are: +- *Base-X* is based on the Ethernet PHYsical Layer (layer 1) and this standard uses the 8B/10B coding (or other encodings as specified in the EEPROM), and *MII* is based on the Ethernet MAC Device (layer 2, the device that actually makes and receives Ethernet frames)[^ethernet]. +- In *Base-X*, auto-negotiation is limited to flow-control (and duplex, which is not really used since it's always full-duplex), and in *MII*, auto-negotiation (AN) also allows the PHY to indicate to the MAC the post-PHY link speed. Even though the MAC-to-PHY SGMII link is always 1000Mbps, it supports 10, 100 and 1000Mbps past the PHY and the MAC needs to know this to space out the bits properly (e. g. if the external link is 100Mbps, each bit on the SGMII link is sent 10 times)[^ethernet]. +MII can be used to connect a MAC to an external PHY using a pluggable connector, or directly to a PHY chip on the same PCB. In the first case it is also used in SFP connectors, for example to allow connections between two MAC blocks without passing through a PHY (i.e. passive DAC). +This technology, and in particular its evolutions such as RGMII[^rgmii], SGMII[^sgmii], QSGMII[^qsgmii], XGMII[^intel], USXGMII[^xilinx], is widely used as a communication bus over SFP, in addition to IEEE BaseX[^ethernet]. The 2.5G-SGMII or HSGMII[^altium] and 10G-SGMII or XSGMII[^aquantia] standards are specifics that increase the clock speed of the SGMII standard without redefining it. ---- +RGMII, SGMII, 1000BaseX standards allow a speed of 1 Gbps, 2.5BaseX and HSGMII standards of 2.5 Gbps, the XGMII, XSGMII, USXGMII and 10GBaseT of 10 Gbps. +--- +[^xenpak_xfp]: With the advent of higher speeds MSA has developed several new interfaces, such as XENPAK, X2, XPAK, XFP, but the newest standard is the transceiver is called SFP+. Based on the same form factor as SFP, it is smaller than its predecessors and has lower power than XFP. SFP+ has become the most popular socket on 10GbE systems because it shares a common physical form factor with legacy SFP modules, allowing higher port density than XFP and the reuse of existing designs for 24 or 48 ports in a 19-inch rack width blade. [^sfpstandard]: *Specification for SFP (Small Formfactor Pluggable) Transceiver* INF-8074 [^sfprate]: *SFP Rate and Application Selection* SFF-8079 [^sfprate2]: *SFP (Small Formfactor Pluggable) Rate and Application Codes* SFF-8089 @@ -27,5 +31,11 @@ RGMII, SGMII, GBaseX standards allow a speed of 1 Gbps, 2.5BaseX and HSGMII stan [^fibrechannel]: *FC-PH Fibre Channel Physical Interface* INCITS 230-1994 [^ethernet]: *Ethernet Specification* IEEE-802.3 [^rgmii]: *Reduced Gigabit Media Independent Interface (RGMII) standard* https://web.archive.org/web/20160303212629/http://www.hp.com/rnd/pdfs/RGMIIv1_3.pdf -[^qsgmii]: *QSGMII Specification* https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/powerquicc/3546/1/qsgmii%20specification.pdf -[^sgmii]: *CISCO ENG-46158 Serial-GMII Specification* https://archive.org/details/sgmii/page/n5/mode/2up \ No newline at end of file +[^qsgmii]: *CISCO EDCS-540123 QSGMII Specification* https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/powerquicc/3546/1/qsgmii%20specification.pdf +[^sgmii]: *CISCO ENG-46158 Serial-GMII Specification* https://archive.org/details/sgmii/page/n5/mode/2up +[^altium]: Peterson Z. *Decoding Media Independent Interface (MII) in Ethernet Links*, Altium Limited https://resources.altium.com/p/decoding-media-independent-interface-mii-ethernet-links +[^continental]: Hopf D. *High-Speed Interfaces for High-Performance Computing*, Continental AG https://standards.ieee.org/wp-content/uploads/import/documents/other/eipatd-presentations/2020/D1-02-Hopf-HighSpeed-Interfaces-for-HighPerformance-Computing.pdf +[^intel]: *L- and H-Tile Transceiver PHY User Guide*, Intel https://www.intel.com/content/www/us/en/docs/programmable/683621/current/the-xgmii-interface-scheme-in-10gbase-r.html +[^10gbasecx4]: *Physical Coding Sublayer (PCS) and Physical Medium Attachment (PMA) sublayer, type 10GBASE-X* https://www.ieee802.org/3/ak/public/jan03/WPcls48_1_0.pdf +[^aquantia]: *AQR405 10GBASE-T Ethernet PHY Transceiver* https://www.verical.com/datasheet/aquantia-corp.-phy-aqr405-b1-eg-y-3825278.pdf +[^xilinx]: *USXGMII Ethernet Subsystem v1.2* https://www.xilinx.com/content/dam/xilinx/support/documents/ip_documentation/usxgmii/v1_2/pg251-usxgmii.pdf diff --git a/_sfp_cage/banana-pi.md b/_sfp_cage/banana-pi.md new file mode 100644 index 00000000..75c115c3 --- /dev/null +++ b/_sfp_cage/banana-pi.md @@ -0,0 +1,34 @@ +--- +title: Banana Pi +has_children: false +layout: default +--- + +# Hardware Specifications + +| | BPI-R3 | BPI-R4 | BPI-R4 var | +| ------------ | -------------------- | -------------------- | -------------------- | +| Vendor | Banana Pi | Banana Pi | | +| Model | BPI-R3 | BPI-R4 | | +| SoC | MT7986 (filogic 830) | MT7988 (filogic 880) | MT7988 (filogic 880) | +| SFP | 2x SFP 2.5 GbE | 2x SFP 10 GbE | 1x SFP 10 GbE | +| Ethernet | 5x GbE | 4x GbE | 4x GbE + 1 2.5 GbE | +| USXGMII | No | ✅ | ✅ | +| 2500Base-X | ✅ | ✅ | ✅ | +| SGMII | ✅ | ✅ | ✅ | +| Type | Router | Router | Router | + +# Notes +## SFP power behavior on the Banana Pi R4 +Unlike some devices, the Banana Pi R4 does not apply 3.3 V to the SFP cage immediately when a module is inserted. +Instead, the board uses a load-switch MOSFET which only enables power once the module asserts the MOD_DEF0 pin (the presence/ID signal defined in the SFP specification). +This design can cause problems with “smart” GPON sticks such as the Zyxel PMG3000-D20B. +The stick’s internal SoC requires a long time to boot before, and only then it pulls MOD_DEF0 low. +Because the R4 waits for MOD_DEF0 before supplying power, the stick never receives power at all, resulting in a deadlock where the module stays unpowered. + +Some users in the BPI-R4 forums discussed a [workaround](https://forum.banana-pi.org/t/bpi-r4-zyxel-pmg3000-d20b-sfp-module-not-detected/18413/2) which bypasses the load-switch and feeds 3.3 V directly to the cage. +This allows modules like the PMG3000-D20B to start, but at the cost of losing proper hot-plug behavior. + +FS.com also offers GPON ONU sticks advertised as “with MAC,” which reportedly assert MOD_DEF0 early and may therefore avoid the issue without hardware modification. +However, evaluation of these modules on the R4 is still outstanding. + diff --git a/_sfp_cage/broadcom-57810s.md b/_sfp_cage/broadcom-57810s.md index be8cd409..44c8eed9 100644 --- a/_sfp_cage/broadcom-57810s.md +++ b/_sfp_cage/broadcom-57810s.md @@ -17,20 +17,32 @@ layout: default | SGMII | ✅ | | Type | PCI express SFP card | -In order to be able to set 2.5G speed you will have to patch your kernel's bnx2x module. The easiest way to do so is via DKMS which rebuilds only that module: +In order for the card to be able to sync at 2.5G speeds, the kernel's bnx2x module has to be patched. The easiest way to do so is via DKMS which rebuilds that module only: - [DKMS for Linux 6.0.y](https://github.com/darkbasic/bnx2x-2_5g-dkms/tree/6.0.y) -It also adds a module option that can be set to disable SFP TX fault detection, otherwise you won't be able to access your SFP mini-ONT if serial output to SFP is enabled (you can alternatively disable the serial in the SFP module). +It also adds a module option that can be set to disable SFP TX fault detection, otherwise the SFP mini-ONT will not be accessible if serial output to SFP is enabled. Alternatively the serial interface can be disabled on the SFP module. -Unfortunately, despite the patches, you will still have to use UEFI eDiag to unlock 2.5G capabilities: +Unfortunately, despite the patches, UEFI eDiag still has to be used to unlock 2.5G capabilities: - [How-to enable 2.5G capability via UEFI eDiag](https://www.dslreports.com/forum/r32230041-Internet-Bypassing-the-HH3K-up-to-2-5Gbps-using-a-BCM57810S-NIC) -At this point you will be able to use the following command to set the speed to 2.5G: +At this point, use the following command to set the speed to 2.5G: ``` sudo ethtool -s your_network_interface autoneg off speed 2500 duplex full ``` +# Compatibility + +{% include alert.html content="This card requires a solder mod in order to work with some SFP ONTs." alert="Note" icon="svg-warning" color="yellow" %} + +According to a [blog post](https://rsaxvc.net/blog/2020/8/15/Nokia_G-010S-A_Pin_6_Issue.html), some manufacturers designed their SFP ONTs in a way that doesn't 100% comply with the SFF specification. A solder mod like described in a [dslreports thread](https://www.dslreports.com/forum/r32529545-) might be required to get certain SFP modules to work with this card. This mod grounds `MOD_ABS PIN (6)`, which signals to the card that a module is inserted in the slot. This signals the card to send power to the SFP module. + +## Affected SFP Modules + +- [Zyxel PMG3000-D20B](/ont-zyxel-pmg3000-d20b) (see Github issue discussion linked below) +- [Nokia G-010S-A](/ont-nokia-g-010s-a) + # Miscellaneous Links - [Come avere i 2.5 Gbps su un unico dispositivo senza il Fastgate](https://forum.fibra.click/d/17836-come-avere-i-25-gbps-su-un-unico-dispositivo-senza-il-fastgate) +- [Solder mod required to make some SFP ONTs work with this card](https://github.com/xvzf/zyxel-gpon-sfp/issues/10) diff --git a/_sfp_cage/macchiatobin.md b/_sfp_cage/macchiatobin.md index 544c156f..a42c603c 100644 --- a/_sfp_cage/macchiatobin.md +++ b/_sfp_cage/macchiatobin.md @@ -7,17 +7,22 @@ layout: default # Hardware Specifications -| | | -| -------- | ---------------------------------------------- | -| Vendor | MACCHIATObin | -| Model | Single Slot, Dual Shot | -| SFP | 2 SFP+, 1 SFP 2.5 | -| Ethernet | 2 10GbE Multigig, 1 2.5GbE (only on Dual Shot) | -| XGMII | ✅ | -| HSGMII | ✅ | -| SGMII | ✅ | -| Type | Router | +| | | +| -------- | ----------------------------------------------------- | +| Vendor | MACCHIATObin | +| Model | Single Slot, Dual Shot | +| SoC | Marvell ARMADA 8040 | +| SFP | 2 SFP+, 1 SFP 2.5 [^xor] | +| Ethernet | 2 10GbE Multigig, 1 2.5GbE (only on Dual Shot [^xor]) | +| XGMII | ✅ | +| HSGMII | ✅ | +| SGMII | ✅ | +| Type | Router | - [Come avere i 2.5 Gbps su un unico dispositivo senza il Fastgate](https://forum.fibra.click/d/17836-come-avere-i-25-gbps-su-un-unico-dispositivo-senza-il-fastgate) -- [MACCHIATObin](http://macchiatobin.net/) \ No newline at end of file +- [MACCHIATObin](http://macchiatobin.net/) + +

+ +[^xor]: In the Dual Shot model the RJ45 and the SFP are in XOR, i.e. either one or the other is usable, not both at the same time. \ No newline at end of file diff --git a/_sfp_cage/mikrotik-ccr-2004.md b/_sfp_cage/mikrotik-ccr-2004.md deleted file mode 100644 index 242e51a8..00000000 --- a/_sfp_cage/mikrotik-ccr-2004.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: MikroTik Router CCR2004-1G-12S+2XS -has_children: false -layout: default -redirect_to: /mikrotik -nav_exclude: true ---- \ No newline at end of file diff --git a/_sfp_cage/mikrotik-crs-305.md b/_sfp_cage/mikrotik-crs-305.md deleted file mode 100644 index cabca452..00000000 --- a/_sfp_cage/mikrotik-crs-305.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: MikroTik CRS305-1G-4S+IN -has_children: false -layout: default -redirect_to: /mikrotik -nav_exclude: true ---- \ No newline at end of file diff --git a/_sfp_cage/mikrotik.md b/_sfp_cage/mikrotik.md index f07db802..845187c6 100644 --- a/_sfp_cage/mikrotik.md +++ b/_sfp_cage/mikrotik.md @@ -1,5 +1,5 @@ --- -title: MikroTik Router & Switch +title: MikroTik has_children: false layout: default --- @@ -17,11 +17,15 @@ layout: default | SGMII | ✅ | ✅ | ✅ | ✅ | | Type | Router | Switch | Router | Router | +Note that Mikrotik RouterOS before 7.15beta4 requires the fiber to be plugged before allowing ping/telnet/webGUI to the xPON SFP. +This will trigger an alarm on the OLT at least on the first config. +It is suggested upgrade to 7.15 and activate "Interface/SFP/Ignore Rx LOS", or use a media converter for the first config. + # CRS305-1G-4S+IN ## Bridge Mode -Bridge mode allows full HSGMII speed without any major issues and seems to work in a mixed mode too. +Bridge mode allows full HSGMII speed without any major issues and seems to work in mixed mode too. Positive results in mixed mode with the following hardware: @@ -36,7 +40,7 @@ In any case, the use of a DAC or MikroTik S+RJ10 is always recommended. Unfortunately the CPU will have a major impact on end performance with resulting downlink speed topping at ~700Mbps. -Note that when using **Huawei MA5671A with right.com.cn firmware** on a Fastweb Italy IPoE connection you may run into some issues since no VLANs are used. The ONT responds to DHCP requests with **a 802.1Q tag for VLAN 0**, which should be properly handled by bridging properly the WAN as well. Other providers that do rely on VLANs such as 835 won't probably need to resort to the this workaround. +Note that when using **Huawei MA5671A with right.com.cn firmware** on a Fastweb Italy IPoE connection you may run into some issues since no VLANs are used. The ONT responds to DHCP requests with **a 802.1Q tag for VLAN 0**, which should be handled by properly bridging the WAN as well. Other providers that do rely on VLANs such as 835 won't probably need to resort to the this workaround. - [2.5Gb Compatibility](https://github.com/Anime4000/RTL960x/blob/main/Docs/2.5Gb.md) - [CRS305 Fastweb Italy SFP Router Mode](https://pastebin.com/zRaidTx4) diff --git a/_sfp_cage/tp-link.md b/_sfp_cage/tp-link.md index ca0eec3e..795d73cc 100644 --- a/_sfp_cage/tp-link.md +++ b/_sfp_cage/tp-link.md @@ -1,5 +1,5 @@ --- -title: TP-Link Router +title: TP-Link has_children: false layout: default --- diff --git a/_sfp_cage/turris.md b/_sfp_cage/turris.md new file mode 100644 index 00000000..44a4644f --- /dev/null +++ b/_sfp_cage/turris.md @@ -0,0 +1,38 @@ +--- +title: Turris +has_children: false +layout: default +--- + +# Hardware Specifications + +| | Omnia | Mox | +| -------- | ------------- | ----------------------------------- | +| Vendor | Turris | Turris | +| Model | Omnia | Mox | +| SFP | 1 SFP 2.5 GbE | 1 SFP 2.5 GbE (need Mox D) | +| Ethernet | 5 GbE | 1 + (4 × #Mox B) + (8 × #Mox E) GbE | +| XGMII | No | No | +| HSGMII | ✅ | ✅ | +| SGMII | ✅ | ✅ | +| Type | Router | Router | + + +As the (Turris Forum)[https://forum.turris.cz/t/ma5671a-sfp-issues-on-turris-os-5-0-3/13443] reports, the following SFPs are known to work: +- Huawei MA5671A (Original Firmware) +- Nokia Alcatel G-010S-A (2.5 Gbps) +- ODI ZTE DFP-34G-2C2 (1 Gbps) +- ODI Realtek DFP-34G-2C2 +- ODI Realtek DFP-34X-2C2 +- Technicolor AFM0002 (1 Gbps) +- HALNy HL-GSFP[^2min] +- Zisa OP151S[^2min] +- Zyxel PMG3000-D20B[^2min] + +In ONTs that expose the serial port on SFP it must be activated, otherwise the Turris sees a TX Fault. + + +

+ +[^2min]: Turris doesnt recognize it and doesn't change to SFP interface cold boot issue you need to wait 2 min and the reboot Turris. + diff --git a/_sfp_cage/ubiquiti-switch.md b/_sfp_cage/ubiquiti-switch.md deleted file mode 100644 index 981988e8..00000000 --- a/_sfp_cage/ubiquiti-switch.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -title: Ubiquiti UniFi Switch -has_children: false -alias: EdgeSwitch ES-16-XG, UniFi US-16-XG, UniFi US-XG-6POE -layout: default -redirect_to: /ubiquiti -nav_exclude: true ---- \ No newline at end of file diff --git a/_sfp_cage/ubiquiti.md b/_sfp_cage/ubiquiti.md index 9818f67e..f0feb551 100644 --- a/_sfp_cage/ubiquiti.md +++ b/_sfp_cage/ubiquiti.md @@ -1,5 +1,5 @@ --- -title: Ubiquiti Switch +title: Ubiquiti has_children: false alias: EdgeSwitch ES-16-XG, UniFi US-16-XG, UniFi US-XG-6POE layout: default diff --git a/_sfp_cage/zte.md b/_sfp_cage/zte.md new file mode 100644 index 00000000..15e7a682 --- /dev/null +++ b/_sfp_cage/zte.md @@ -0,0 +1,24 @@ +--- +title: ZTE +has_children: false +layout: default +--- + +# Hardware Specifications + +| | H6645P | +| -------- | -------------------------------------------------- | +| Vendor | ZTE | +| Model | H6645P | +| SoC | ZXIC ZX279132C | +| SFP | 1 2.5 GbE [^xor] | +| Ethernet | 3 1GbE, 1 2.5GbE LAN port, 1 2.5GbE WAN port[^xor] | +| XGMII | No | +| HSGMII | | +| SGMII | ✅ | +| Type | Router | + + +

+ +[^xor]: the WAN Eth and WAN SFP ports are in XOR, i.e. either one or the other. diff --git a/_sfp_cage/zyxel.md b/_sfp_cage/zyxel.md index ee08f911..ed100c32 100644 --- a/_sfp_cage/zyxel.md +++ b/_sfp_cage/zyxel.md @@ -1,5 +1,5 @@ --- -title: Zyxel Router +title: Zyxel has_children: false alias: EX5601-T0 layout: default @@ -7,23 +7,234 @@ layout: default # Hardware Specifications -| | EX5601-T0 | -| -------- | ---------------------- | -| Vendor | Zyxel | -| Model | EX5601-T0 | -| SFP | 1[^xor] | -| Ethernet | 4 1GbE, 2 2.5GbE[^xor] | -| XGMII | No | -| HSGMII | ✅ | -| SGMII | ✅ | -| Type | Router | +| | EX5601-T0 | +| -------- | ---------------------------------------- | +| Vendor | Zyxel | +| Model | EX5601-T0 | +| SoC | MT7986a (filogic 830) | +| Ram | 1G | +| SFP | 1 2.5 GbE [^xor] | +| Ethernet | 3 1GbE, 1 2.5GbE LAN, 1 2.5GbE WAN[^xor] | +| XGMII | No | +| HSGMII | ✅ | +| SGMII | ✅ | +| Type | Router | +# Zyxel EX5601-T0 +## List of partitions + +| dev | size | erasesize | name | +| ---- | -------- | --------- | ------------ | +| mtd0 | 20000000 | 00040000 | "spi0.1" | +| mtd1 | 00100000 | 00040000 | "BL2" | +| mtd2 | 00080000 | 00040000 | "u-boot-env" | +| mtd3 | 00200000 | 00040000 | "Factory" | +| mtd4 | 001c0000 | 00040000 | "FIP" | +| mtd5 | 00040000 | 00040000 | "zloader" | +| mtd6 | 04000000 | 00040000 | "ubi" | +| mtd7 | 04000000 | 00040000 | "ubi2" | +| mtd8 | 15a80000 | 00040000 | "zyubi" | + +This router supports dual boot, and has two partitions for the firmware, `ubi` and `ubi2`. + +To check the current active partition you can use the following command: +```sh +cat /proc/cmdline +``` +The result will be something like the following: +``` +console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 rootubi=ubi +``` +If `rootubi=ubi`, the active partition is `mtd6`. + +If `rootubi=ubi2`, the active partition is `mtd7`. + +{% include alert.html content="When you flash a new firmware via the web interface the router will automatically write the new firmware in the inactive partition, hence if the firmware upgrade is successfull it will automatically swap the boot partition at next reboot. If everything is ok you don't have to manually swap partitions" alert="Info" icon="svg-info" color="blue" %} + +## Serial interface + +This router has the serial interface pins directly accessible on the board: + +{% include image.html file="zyxel-ex5601t0\zyxel_ex5601t0_serial.jpg" alt="EX5601T0 Serial interface" caption="EX5601T0 Serial interface" %} + +The serial console speed is 115200 bauds. + +## ZHAL (Zloader) access + +The boot process of this router has multiple stages, long story short we have both u-boot and zloader (ZHAL). + +When the router is powered-up u-boot is loaded and it will load zloader, the Zyxel proprietary boot manager. + +Zloader allows to manually swap boot partitions (`ubi` and `ubi2`), recover the supervisor password and many additional useful (and dangerous) things. + +By default zloader access is blocked. + +### Unlocking zloader + +{% include alert.html content="The following procedure is provided as-is, if you damage the device this community is not responsibile for any damage in any way." alert="Warning" icon="svg-warning" color="red" %} + +1. Open the router case and connect your usb-ttl adapter to the router as show in the picture. +2. Open putty or any other serial capable software and configure it to use your COMX port with 115200 speed. +3. Power up the router. +4. While the router is booting at some point you will read the following: `Please press Enter to activate this console.` +5. As soon as you read that press enter, type root and than press enter again (just do it, don't care about the logs scrolling). +6. Most likely the router is still printing the boot log, leave it boot until it stops. +7. If everything went ok you should have full root access: +``` +root@EX5601-T0:/# +``` +8. type the following command and press enter: +``` +fw_setenv EngDebugFlag 0x1 +``` +9. Reboot the router. +10. As soon as you read `Hit any key to stop autoboot:` press Enter. +11. If everything went ok you should have the following prompt: +``` +ZHAL> +``` +You have successfully unlocked zloader access, this procedure must be done only once. + +{% include alert.html content="There is an alternative procedure to achieve the same end result. Flashing the firmware which gives you root access via ssh and you give the same fw_setenv command from point 8. The USB to serial adapter is still needed to access ZHAL" alert="Info" icon="svg-info" color="blue" %} + + +### Dumping supervisor password +{% include alert.html content="The following procedure is provided as-is, if you damage the device this community is not responsibile for any damage in any way." alert="Warning" icon="svg-warning" color="red" %} + +{% include alert.html content="The supervisor user is the most powerful user that can be used from the web interface. The supervisor password is written in the nand and it's encrypted. To dump the password you must first complete the **Unlocking zloader** procedure" alert="Info" icon="svg-info" color="blue" %} + +1. Open the router case and connect your usb to serial adapter. +2. Open putty or any other serial capable software and configure it to use your COMX port with 115200 speed. +3. Power up the router. +4. As soon as you read `Hit any key to stop autoboot:` press Enter. +5. Type the following command and press enter to read the supervisor password: +``` +atck +``` +6. The supervisor password will be printed in clear text and can be used on the zyxel webgui. +7. You can reboot the router by typing the following command and press Enter: +``` +atsr +``` + +### Manually swapping the boot partition + +{% include alert.html content="The following procedure is provided as-is, if you damage the device this community is not responsibile for any damage in any way." alert="Warning" icon="svg-warning" color="red" %} + +{% include alert.html content="To swap the boot partition you first have to complete the **Unlocking zloader** procedure" alert="Info" icon="svg-info" color="blue" %} + +1. Open the router case and connect your usb to serial adapter. +2. Open putty or any other serial capable software and configure it to use your COMX port with 115200 speed. +3. Power up the router. +4. As soon as you read `Hit any key to stop autoboot:` press Enter. +5. Type the following command sequence to swap the boot partition. +```sh +atbt 1 # unlock zhal write +atsw # swap boot partition +atsr # reboot the router +``` +6. The router will boot from the new active partition (ubi or ubi2 depending on the previous active partition). +7. Check if the active partition has changed with the following command: +```sh +cat /proc/cmdline +``` + +## Unlocking u-boot access +{% include alert.html content="The following procedure is provided as-is, if you damage the device this community is not responsibile for any damage in any way." alert="Warning" icon="svg-warning" color="red" %} + +{% include alert.html content="To unlock u-boot access you first have to complete the **Unlocking zloader** procedure" alert="Info" icon="svg-info" color="blue" %} + +{% include alert.html content="Having full u-boot access can be very dangerous, with great power comes great responsibility." alert="Warning" icon="svg-warning" color="red" %} + +Up to today a strange combination of actions must be completed in a special sequence to access the u-boot CLI: + +1. Open the router case and connect your usb to serial adapter. +2. Open putty or any other serial capable software and configure it to use your COMX port with 115200 speed. +3. Power up the router. +4. As soon as you read `Hit any key to stop autoboot:` press Enter to access the ZHAL command line. +5. Type the following command and press enter: +``` +atgu +``` +6. Apparently that command doesn't do anything and the router will reboot itself. +7. Again for the second time you will read `Hit any key to stop autoboot:`, press Enter again to access ZHAL again. +8. Type the following command again and press enter: +``` +atgu +``` +9. You should now have entered the u-boot command line interface: +``` +MT7986> +``` + +## Flashing a firmware or downgrading firmware + +{% include alert.html content="The following procedure is provided as-is and if anything goes wrong you will likely need to open the router case and attach a USB serial adapter to the router to recover it. +This community is not responsible of any damage you cause by following these procedures." alert="Warning" icon="svg-warning" color="red" %} + +1. Access the router via ssh or telnet with admin user (admin password is printed on the back of the router). +2. Disable firmware version check and model check by running the following commands. +``` +zycli fwidcheck off +zycli modelcheck off +``` +3. You can close the ssh console, do not reboot the router. +4. Open the router web interface and in the maintenance/firmware upgrade section select the "Restore Default Settings After Firmware Upgrade" option. +5. Select "Choose file" to select the firmware file you want to upload and click Upload. +6. The router will automatically reboot and should get back up on 192.168.1.1 + +## Firmware Version V5.70(ACDZ.0)C0 no-brand + +Here is a no-brand firmware compiled starting from Zyxel provided OpenSource package under GPL license (link at the bottom of this page) plus the following modifications that you can track on the following repo: +https://github.com/pameruoso/zyxel-ex5601t0 + +1. Added start-up script to reset and enable root access via ssh. +The script reads the device serial number and resets the root password with that. Do not try to reset the root password because that will last until next reboot. +2. the `/bin` path contains `sfp_wan.sh_wind` and `check_sfp_link.sh_wind` scripts which are very similar to the standard `sfp_wan.sh` and `check_sfp_link.sh` scripts. If everything works with the original ones do not swap them. If you want to allow 2.5gbit HSGMII with the Technicolor AFM0003 SFP stick you need to swap and enable the `_wind` scripts. +3. Additional packages installed: `mtr`, `htop`, `openvpn`, `wireguard`. + +{% include alert.html content="The OpenVPN and Wireguard functionalities will not be directly usable in the Zyxel web interface, they are not supported. If you want to setup a VPN with either protocol you must know how to use the command-line and do your own setup" alert="Info" icon="svg-info" color="blue" %} + +{% include alert.html content="Do not try to install packages directly from the internet with opkg update/install, the default repositories are not working and, if you edit them, you'll most likely end up breaking the partition overlay" alert="Warning" icon="svg-warning" color="red" %} + +- [Firmware Version V5.70(ACDZ.0)C0_no-brand_pa_0.1](https://mega.nz/file/OJxBCKqR#z31OiJwY6_iaDtj_yrOTrx1oKnFEdnm4Rh0pi3wRtoE) + +## OpenWrt firmware +This router has native OpenWrt support starting from the following [git commit](https://github.com/openwrt/openwrt/pull/12580/commits/1c05388ab04c934ec240e8362321908f91381a90) + +You are free to clone the git code and build your own OpenWrt firmware or use the OpenWrt firmware builder. + +{% include alert.html content="Carefully read the installation instructions from the git commit link above!" alert="Warning" icon="svg-warning" color="red" %} + +The OpenWrt firmware has the following working features out of the box: +- 3 Gbit LAN ports +- Wi-Fi AX6000: 5Ghz 4x4 ax + 2.4GHz 4x4 ax +- Zyxel partitioning for coexistance with Zloader and dual boot +- Leds +- Reset button +- Serial interface +- USB port +- LAN RJ45 2.5 Gbit port +- WAN RJ45 2.5 Gbit port +- WAN SFP port only works after exporting pins 57 and 10 (`gpiobase411`). There must also be a cable with a link active on the WAN 2.5 Gbe port to make the SFP work. This is due to missing support into the phy-link code of the Mediatek ethernet SoC. + +To workaround the missing phy-link support, some modifications to the DTS are needed. Setting the `gmac1` node to fixed link 2500Base-X gives the possibility to hot-swap the SFP/RJ45 port. + +The following repo contains a proper example: [EX5601-T0 fixed SFP link git repo](https://github.com/pameruoso/openwrt-ex5601t0-porting/tree/ex5601-t0-fixedlink) you can apply the [patch](https://github.com/openwrt/openwrt/compare/main...pameruoso:openwrt-ex5601t0-porting:ex5601-t0-fixedlink.patch) to the official OpenWrt repo. + +{% include alert.html content="It is highly recommended to use the OpenWrt official builds instead of this fork because the latter is not updated that often, still if you want to use the SFP you can insert it into a media converter and use the 2.5Gbe RJ45 port with the official build." alert="Info" icon="svg-info" color="blue" %} + +Here is a flashable bin file based on OpenWrt v23.05.0 Stable with the mod to swap SFP/RJ45. This `sysupgrade.bin` already contains the zyfwinfo file for flashing with zloader. + +[EX5601-T0_Openwrt-v23.05.0-stable_fixedlink](https://mega.nz/file/acgy1I7b#oZ4twW1lN7ujGh0lp4bk68I8zczCscJq0vSSVcv5cXQ) # Miscellaneous Links +- [Zyxel EX5601-T0 source GPL package V5.70(ACDZ.0)C0](https://github.com/ErnyTech/zyxel-ex5601t0) + - [Rollback SFP Zyxel con il W3 HUB per risolvere il problema dell'upload cappato](https://forum.fibra.click/d/36541-rollback-sfp-zyxel-con-il-w3-hub-per-risolvere-il-problema-dellupload-cappato) ---- +

-[^xor]: it is possible that the WAN Eth and WAN SFP ports are in XOR, i.e. either one or the other. +[^xor]: the Ethernet and SFP WAN ports are in XOR, i.e. either one or the other is usable, not both at the same time. diff --git a/_tools/ascii-hex.md b/_tools/ascii-hex.md index 6c550bcb..a47484c8 100644 --- a/_tools/ascii-hex.md +++ b/_tools/ascii-hex.md @@ -2,7 +2,7 @@ title: ASCII and Hex converter has_children: false nav_order: 1 -description: Tool for converter ASCII and Hex +description: Tool for converting between ASCII and Hex layout: default --- @@ -12,7 +12,7 @@ layout: default ASCII

- Please provide a valid input text. + Please provide a valid text input.

@@ -33,7 +33,7 @@ layout: default HEX

- Please provide a valid input text. + Please provide a valid text input.

diff --git a/_tools/gpon-omci-vlan-parser.md b/_tools/gpon-omci-vlan-parser.md index 77c5b6b7..be1159df 100644 --- a/_tools/gpon-omci-vlan-parser.md +++ b/_tools/gpon-omci-vlan-parser.md @@ -1,7 +1,7 @@ --- title: GPON OMCI VLAN Table parser has_children: false -description: Tool for parse the GPON OMCI VLAN Table (ME 171) +description: Tool for parsing the GPON OMCI VLAN Table (ME 171) layout: default --- @@ -11,7 +11,7 @@ layout: default VLAN TABLE in HEX

- Please provide a valid input text. + Please provide a valid text input.

diff --git a/_tools/molex-ont.md b/_tools/molex-ont.md index 151de662..0b37440e 100644 --- a/_tools/molex-ont.md +++ b/_tools/molex-ont.md @@ -5,20 +5,21 @@ nav_order: 3 layout: default --- -In some sticks, such as those based on Lantiq chipsets, the serial is exposed in the upper pins of the ONT, in order to read them there are two possibilities: -- the use of an SFP molex ([farnell](https://it.farnell.com/en-IT/molex/74441-0001/connector-sfp-rcpt-20pos-smt/dp/2112385)) to which you solder four wires and remove the other pins, this makes the adapter compatible for a single serial combination -- the use of a board to which the SFP molex is soldered, exposing the main SFP pins +In some sticks, such as those based on Lantiq chipsets, the serial interface is exposed in the upper pins of the ONT, in order to read them there are two possibilities: +- the use of an SFP molex ([farnell](https://it.farnell.com/en-IT/molex/74441-0001/connector-sfp-rcpt-20pos-smt/dp/2112385)) to which four wires are to be soldered and the other pins removed. This makes the adapter compatible with a single serial combination. +- the use of a board to which the SFP molex is soldered, exposing the main SFP pins. -{% include image.html file="ma5671a-root-1.jpg" alt="Example of how the sfp-ttl adapter" caption="Example of how the sfp-ttl adapter" %} +{% include image.html file="ma5671a-root-1.jpg" alt="Example of how the SFP-TTL adapter is to be connected" caption="Example of how the SFP-TTL adapter is to be connected" %} -{% include image.html file="new-root-procedure/board-molex-arduino.jpg" alt="Example of how the sfp-ttl adapter with a custom board" caption="Example of how the sfp-ttl adapter with a custom board" %} +{% include image.html file="new-root-procedure/board-molex-arduino.jpg" alt="Example of how the SFP-TTL adapter is to be used with a custom board" caption="Example of how the SFP-TTL adapter is to be used with a custom board" %} -if you want to make your own board, here are some ideas: +If you want to make your own board, here are some ideas: - -{% include image.html file="board-dupont/top.svg" alt="Example of how the sfp-ttl custom board" caption="Example of how the sfp-ttl custom board" %} -{% include image.html file="board-dupont/bottom.svg" alt="Example of how the sfp-ttl custom board" caption="Example of how the sfp-ttl custom board" %} +{% include image.html file="board-dupont/top.svg" alt="Example of an SFP-TTL custom board" caption="Example of an SFP-TTL custom board" %} +{% include image.html file="board-dupont/bottom.svg" alt="Example of an SFP-TTL custom board" caption="Example of an SFP-TTL custom board" %} the components to be soldered are instead: - 1x MOLEX SFP (like Molex-744410001 [lcsc](https://www.lcsc.com/product-detail/Card-Edge-Connectors_MOLEX-744410001_C277615.html), [farnell](https://it.farnell.com/en-IT/molex/74441-0001/connector-sfp-rcpt-20pos-smt/dp/2112385)) -- 2x pinout 2x10 (like [MINTRON MTP125-1210S1](https://www.lcsc.com/product-detail/Pin-Header-Female-Header_MINTRON-MTP125-1210S1_C358699.html)) \ No newline at end of file +- 2x pinout 2x10 (like [MINTRON MTP125-1210S1](https://www.lcsc.com/product-detail/Pin-Header-Female-Header_MINTRON-MTP125-1210S1_C358699.html)) + +[Example of the final board](https://oshwlab.com/user4091049/sfp-to-ttl-v1) with these components on the EasyEDA platform. diff --git a/_tools/ont-ethtool-print-eeprom.md b/_tools/ont-ethtool-print-eeprom.md new file mode 100644 index 00000000..cf16ba86 --- /dev/null +++ b/_tools/ont-ethtool-print-eeprom.md @@ -0,0 +1,14 @@ +--- +title: Ethtool Print EEPROM +has_children: false +layout: default +--- + +1. Get `ethtool -m` or `ethtool -e` and paste into the form + +

+ +

+ + + \ No newline at end of file diff --git a/_tools/ont-lantiq-print-eeprom.md b/_tools/ont-lantiq-print-eeprom.md index 6d95ebf9..486d7a01 100644 --- a/_tools/ont-lantiq-print-eeprom.md +++ b/_tools/ont-lantiq-print-eeprom.md @@ -8,10 +8,8 @@ layout: default

- +

- - -{% include alert.html content="For more information, see the SFF-8472 Rev 10.2 specification." alert="Info" icon="svg-info" color="blue" %} \ No newline at end of file + \ No newline at end of file diff --git a/_tools/ttl-uart-adapter.md b/_tools/ttl-uart-adapter.md index 62bfe114..e5598dec 100644 --- a/_tools/ttl-uart-adapter.md +++ b/_tools/ttl-uart-adapter.md @@ -5,9 +5,9 @@ nav_order: 2 layout: default --- -A TTL UART adapter makes it possible to connect the stick's serial to a computer via a USB interface, which makes it easy to send commands on modern computers through serial emulation, just like the serial ports of the 1990s. +A TTL UART adapter makes it possible to connect the stick's serial interface to a computer via a USB interface. This makes it easy to send commands on modern computers through serial emulation, just like the serial ports of the 1990s. -Is widely used in the modding of SFPs, and in general of most embedded devices, since a serial port is always present in all of them and is also used to de-brick devices. +These adapters are widely used in the modding of SFPs, and in general of most embedded devices, since a serial port is always present in all of them and is also used to de-brick such devices. TTL adapters can be easily found on Amazon, the most recommended one being: diff --git a/assets/img/ALL-BM410-XGSPON-GBIC/bottom.jpg b/assets/img/ALL-BM410-XGSPON-GBIC/bottom.jpg new file mode 100644 index 00000000..b7dcba1b Binary files /dev/null and b/assets/img/ALL-BM410-XGSPON-GBIC/bottom.jpg differ diff --git a/assets/img/ALL-BM410-XGSPON-GBIC/top.jpg b/assets/img/ALL-BM410-XGSPON-GBIC/top.jpg new file mode 100644 index 00000000..54d7fd88 Binary files /dev/null and b/assets/img/ALL-BM410-XGSPON-GBIC/top.jpg differ diff --git a/assets/img/XGS-ONU-25-20NI/Stick_Rep.png b/assets/img/XGS-ONU-25-20NI/Stick_Rep.png new file mode 100644 index 00000000..c8f323f7 Binary files /dev/null and b/assets/img/XGS-ONU-25-20NI/Stick_Rep.png differ diff --git a/assets/img/XGS-ONU-25-20NI/UART_SFP.png b/assets/img/XGS-ONU-25-20NI/UART_SFP.png new file mode 100644 index 00000000..611c7cee Binary files /dev/null and b/assets/img/XGS-ONU-25-20NI/UART_SFP.png differ diff --git a/assets/img/XGS-ONU-25-20NI/UART_bridge.png b/assets/img/XGS-ONU-25-20NI/UART_bridge.png new file mode 100644 index 00000000..4e2b78ca Binary files /dev/null and b/assets/img/XGS-ONU-25-20NI/UART_bridge.png differ diff --git a/assets/img/XGS-ONU-25-20NI/UART_needle.png b/assets/img/XGS-ONU-25-20NI/UART_needle.png new file mode 100644 index 00000000..90526ccc Binary files /dev/null and b/assets/img/XGS-ONU-25-20NI/UART_needle.png differ diff --git a/assets/img/XGS-ONU-25-20NI/front.jpg b/assets/img/XGS-ONU-25-20NI/front.jpg new file mode 100644 index 00000000..2df01f88 Binary files /dev/null and b/assets/img/XGS-ONU-25-20NI/front.jpg differ diff --git a/assets/img/XGS-ONU-25-20NI/internal.jpg b/assets/img/XGS-ONU-25-20NI/internal.jpg new file mode 100644 index 00000000..be452fcb Binary files /dev/null and b/assets/img/XGS-ONU-25-20NI/internal.jpg differ diff --git a/assets/img/avm/avm_ploam.png b/assets/img/avm/avm_ploam.png new file mode 100644 index 00000000..3c33493a Binary files /dev/null and b/assets/img/avm/avm_ploam.png differ diff --git a/assets/img/avm/avm_serial.jpg b/assets/img/avm/avm_serial.jpg new file mode 100644 index 00000000..7ff4de28 Binary files /dev/null and b/assets/img/avm/avm_serial.jpg differ diff --git a/assets/img/bt-g711ax-serial.jpg b/assets/img/bt-g711ax-serial.jpg new file mode 100644 index 00000000..603532aa Binary files /dev/null and b/assets/img/bt-g711ax-serial.jpg differ diff --git a/assets/img/bt-g711ax-teardown-1.jpg b/assets/img/bt-g711ax-teardown-1.jpg new file mode 100644 index 00000000..8dd290f6 Binary files /dev/null and b/assets/img/bt-g711ax-teardown-1.jpg differ diff --git a/assets/img/bt-g711ax-teardown-2.jpg b/assets/img/bt-g711ax-teardown-2.jpg new file mode 100644 index 00000000..464ada3f Binary files /dev/null and b/assets/img/bt-g711ax-teardown-2.jpg differ diff --git a/assets/img/f2801s/front.jpg b/assets/img/f2801s/front.jpg new file mode 100644 index 00000000..ce67883d Binary files /dev/null and b/assets/img/f2801s/front.jpg differ diff --git a/assets/img/f2801s/internal.jpg b/assets/img/f2801s/internal.jpg new file mode 100644 index 00000000..552d060c Binary files /dev/null and b/assets/img/f2801s/internal.jpg differ diff --git a/assets/img/f6005/f6005_of_change_ploam.png b/assets/img/f6005/f6005_of_change_ploam.png new file mode 100644 index 00000000..19dbe2a1 Binary files /dev/null and b/assets/img/f6005/f6005_of_change_ploam.png differ diff --git a/assets/img/f6005v3/f6005v3_ploam_change.jpg b/assets/img/f6005v3/f6005v3_ploam_change.jpg new file mode 100644 index 00000000..b1f9ef9a Binary files /dev/null and b/assets/img/f6005v3/f6005v3_ploam_change.jpg differ diff --git a/assets/img/f6005v3_2.jpg b/assets/img/f6005v3_2.jpg new file mode 100644 index 00000000..ee2c7d58 Binary files /dev/null and b/assets/img/f6005v3_2.jpg differ diff --git a/assets/img/f6005v3_3.jpg b/assets/img/f6005v3_3.jpg new file mode 100644 index 00000000..9ec3cc95 Binary files /dev/null and b/assets/img/f6005v3_3.jpg differ diff --git a/assets/img/f6005v3_of_1.jpg b/assets/img/f6005v3_of_1.jpg new file mode 100644 index 00000000..f3aec268 Binary files /dev/null and b/assets/img/f6005v3_of_1.jpg differ diff --git a/assets/img/f6005v3_tim_1.jpg b/assets/img/f6005v3_tim_1.jpg new file mode 100644 index 00000000..a3fac5ce Binary files /dev/null and b/assets/img/f6005v3_tim_1.jpg differ diff --git a/assets/img/fg1000b-11_bottom.jpg b/assets/img/fg1000b-11_bottom.jpg new file mode 100644 index 00000000..06501cd0 Binary files /dev/null and b/assets/img/fg1000b-11_bottom.jpg differ diff --git a/assets/img/fg1000b-11_rear.jpg b/assets/img/fg1000b-11_rear.jpg new file mode 100644 index 00000000..8943ff5e Binary files /dev/null and b/assets/img/fg1000b-11_rear.jpg differ diff --git a/assets/img/fg1000b-11_side1.jpg b/assets/img/fg1000b-11_side1.jpg new file mode 100644 index 00000000..4f9d17b0 Binary files /dev/null and b/assets/img/fg1000b-11_side1.jpg differ diff --git a/assets/img/fg1000b-11_side2.jpg b/assets/img/fg1000b-11_side2.jpg new file mode 100644 index 00000000..f0d1b999 Binary files /dev/null and b/assets/img/fg1000b-11_side2.jpg differ diff --git a/assets/img/fg1000r_device.jpg b/assets/img/fg1000r_device.jpg new file mode 100644 index 00000000..218c2072 Binary files /dev/null and b/assets/img/fg1000r_device.jpg differ diff --git a/assets/img/fg1000r_front.jpg b/assets/img/fg1000r_front.jpg new file mode 100644 index 00000000..33aa1a34 Binary files /dev/null and b/assets/img/fg1000r_front.jpg differ diff --git a/assets/img/fg1000r_inside.jpg b/assets/img/fg1000r_inside.jpg new file mode 100644 index 00000000..6bdb0fc2 Binary files /dev/null and b/assets/img/fg1000r_inside.jpg differ diff --git a/assets/img/fg1000r_pon.jpg b/assets/img/fg1000r_pon.jpg new file mode 100644 index 00000000..cfb3e5e7 Binary files /dev/null and b/assets/img/fg1000r_pon.jpg differ diff --git a/assets/img/fg1000r_rear.jpg b/assets/img/fg1000r_rear.jpg new file mode 100644 index 00000000..e477d97e Binary files /dev/null and b/assets/img/fg1000r_rear.jpg differ diff --git a/assets/img/fs-com-onu1710-1g/pcb.jpg b/assets/img/fs-com-onu1710-1g/pcb.jpg new file mode 100644 index 00000000..ea2919ca Binary files /dev/null and b/assets/img/fs-com-onu1710-1g/pcb.jpg differ diff --git a/assets/img/fs-com-onu1710-1g/vermod.png b/assets/img/fs-com-onu1710-1g/vermod.png new file mode 100644 index 00000000..d8f90b69 Binary files /dev/null and b/assets/img/fs-com-onu1710-1g/vermod.png differ diff --git a/assets/img/ft-g2110c-2.5g-back.jpg b/assets/img/ft-g2110c-2.5g-back.jpg new file mode 100644 index 00000000..aba5e55c Binary files /dev/null and b/assets/img/ft-g2110c-2.5g-back.jpg differ diff --git a/assets/img/ft-g2110c-2.5g-front.jpg b/assets/img/ft-g2110c-2.5g-front.jpg new file mode 100644 index 00000000..20e6abc2 Binary files /dev/null and b/assets/img/ft-g2110c-2.5g-front.jpg differ diff --git a/assets/img/ft-g2110c-internal.jpg b/assets/img/ft-g2110c-2.5g-internal.jpg similarity index 100% rename from assets/img/ft-g2110c-internal.jpg rename to assets/img/ft-g2110c-2.5g-internal.jpg diff --git a/assets/img/ft-g2110c-2.5g-optical-header-1.jpg b/assets/img/ft-g2110c-2.5g-optical-header-1.jpg new file mode 100644 index 00000000..abd2f44d Binary files /dev/null and b/assets/img/ft-g2110c-2.5g-optical-header-1.jpg differ diff --git a/assets/img/ft-g2110c-optical-header-2.jpg b/assets/img/ft-g2110c-2.5g-optical-header-2.jpg similarity index 100% rename from assets/img/ft-g2110c-optical-header-2.jpg rename to assets/img/ft-g2110c-2.5g-optical-header-2.jpg diff --git a/assets/img/ft-g2110c-optical-header-3.jpg b/assets/img/ft-g2110c-2.5g-optical-header-3.jpg similarity index 100% rename from assets/img/ft-g2110c-optical-header-3.jpg rename to assets/img/ft-g2110c-2.5g-optical-header-3.jpg diff --git a/assets/img/ft-g2110c-back.jpg b/assets/img/ft-g2110c-back.jpg index aba5e55c..70712f33 100644 Binary files a/assets/img/ft-g2110c-back.jpg and b/assets/img/ft-g2110c-back.jpg differ diff --git a/assets/img/ft-g2110c-front.jpg b/assets/img/ft-g2110c-front.jpg index 20e6abc2..7f095888 100644 Binary files a/assets/img/ft-g2110c-front.jpg and b/assets/img/ft-g2110c-front.jpg differ diff --git a/assets/img/ft-g2110c-optical-header-1.jpg b/assets/img/ft-g2110c-optical-header-1.jpg index abd2f44d..565052b7 100644 Binary files a/assets/img/ft-g2110c-optical-header-1.jpg and b/assets/img/ft-g2110c-optical-header-1.jpg differ diff --git a/assets/img/ft-g2110c-ports.jpg b/assets/img/ft-g2110c-ports.jpg new file mode 100644 index 00000000..ce703cde Binary files /dev/null and b/assets/img/ft-g2110c-ports.jpg differ diff --git a/assets/img/g-010g-d_back.jpg b/assets/img/g-010g-d_back.jpg new file mode 100644 index 00000000..0862b5bd Binary files /dev/null and b/assets/img/g-010g-d_back.jpg differ diff --git a/assets/img/g-010g-d_front.jpg b/assets/img/g-010g-d_front.jpg new file mode 100644 index 00000000..0790a078 Binary files /dev/null and b/assets/img/g-010g-d_front.jpg differ diff --git a/assets/img/g-010g-d_internal_1.jpg b/assets/img/g-010g-d_internal_1.jpg new file mode 100644 index 00000000..76530916 Binary files /dev/null and b/assets/img/g-010g-d_internal_1.jpg differ diff --git a/assets/img/g-010g-d_internal_2.jpg b/assets/img/g-010g-d_internal_2.jpg new file mode 100644 index 00000000..c994719c Binary files /dev/null and b/assets/img/g-010g-d_internal_2.jpg differ diff --git a/assets/img/g-010g-r_headerless.jpg b/assets/img/g-010g-r_headerless.jpg new file mode 100644 index 00000000..144d697a Binary files /dev/null and b/assets/img/g-010g-r_headerless.jpg differ diff --git a/assets/img/g-010g-r_serial_pinouts.jpg b/assets/img/g-010g-r_serial_pinouts.jpg new file mode 100644 index 00000000..f28d9ea5 Binary files /dev/null and b/assets/img/g-010g-r_serial_pinouts.jpg differ diff --git a/assets/img/huawei-hn8010ts-20/bottom_board_view.jpg b/assets/img/huawei-hn8010ts-20/bottom_board_view.jpg new file mode 100644 index 00000000..762c2598 Binary files /dev/null and b/assets/img/huawei-hn8010ts-20/bottom_board_view.jpg differ diff --git a/assets/img/huawei-hn8010ts-20/broadcom_bcm84891.jpg b/assets/img/huawei-hn8010ts-20/broadcom_bcm84891.jpg new file mode 100644 index 00000000..4c2f6b91 Binary files /dev/null and b/assets/img/huawei-hn8010ts-20/broadcom_bcm84891.jpg differ diff --git a/assets/img/huawei-hn8010ts-20/broadcom_heatsink.jpg b/assets/img/huawei-hn8010ts-20/broadcom_heatsink.jpg new file mode 100644 index 00000000..5f00d5b2 Binary files /dev/null and b/assets/img/huawei-hn8010ts-20/broadcom_heatsink.jpg differ diff --git a/assets/img/huawei-hn8010ts-20/chip_sd5.82s_rfiv100__9657_cn_05.jpg b/assets/img/huawei-hn8010ts-20/chip_sd5.82s_rfiv100__9657_cn_05.jpg new file mode 100644 index 00000000..87582cd5 Binary files /dev/null and b/assets/img/huawei-hn8010ts-20/chip_sd5.82s_rfiv100__9657_cn_05.jpg differ diff --git a/assets/img/huawei-hn8010ts-20/nand_ds35q1ga.jpg b/assets/img/huawei-hn8010ts-20/nand_ds35q1ga.jpg new file mode 100644 index 00000000..1f3faf87 Binary files /dev/null and b/assets/img/huawei-hn8010ts-20/nand_ds35q1ga.jpg differ diff --git a/assets/img/huawei-hn8010ts-20/top_board_view.jpg b/assets/img/huawei-hn8010ts-20/top_board_view.jpg new file mode 100644 index 00000000..beef1225 Binary files /dev/null and b/assets/img/huawei-hn8010ts-20/top_board_view.jpg differ diff --git a/assets/img/huawei-hn8010ts-20/top_board_view2.jpg b/assets/img/huawei-hn8010ts-20/top_board_view2.jpg new file mode 100644 index 00000000..a5096dce Binary files /dev/null and b/assets/img/huawei-hn8010ts-20/top_board_view2.jpg differ diff --git a/assets/img/ont-leox-lxt-240g-c1_bottom.jpg b/assets/img/ont-leox-lxt-240g-c1_bottom.jpg new file mode 100644 index 00000000..3e6ddd0f Binary files /dev/null and b/assets/img/ont-leox-lxt-240g-c1_bottom.jpg differ diff --git a/assets/img/ont-leox-lxt-240g-c1_pcb.jpg b/assets/img/ont-leox-lxt-240g-c1_pcb.jpg new file mode 100644 index 00000000..3f9bf327 Binary files /dev/null and b/assets/img/ont-leox-lxt-240g-c1_pcb.jpg differ diff --git a/assets/img/ont-leox-lxt-240g-c1_top.jpg b/assets/img/ont-leox-lxt-240g-c1_top.jpg new file mode 100644 index 00000000..1a7defce Binary files /dev/null and b/assets/img/ont-leox-lxt-240g-c1_top.jpg differ diff --git a/assets/img/ont-nokia-naming.jpg b/assets/img/ont-nokia-naming.jpg new file mode 100644 index 00000000..fbdd942f Binary files /dev/null and b/assets/img/ont-nokia-naming.jpg differ diff --git a/assets/img/ont-nokia_xs-010x-q_front.jpg b/assets/img/ont-nokia_xs-010x-q_front.jpg new file mode 100644 index 00000000..3b075403 Binary files /dev/null and b/assets/img/ont-nokia_xs-010x-q_front.jpg differ diff --git a/assets/img/ont-nokia_xs-010x-q_internal_1.jpg b/assets/img/ont-nokia_xs-010x-q_internal_1.jpg new file mode 100644 index 00000000..9d160bd9 Binary files /dev/null and b/assets/img/ont-nokia_xs-010x-q_internal_1.jpg differ diff --git a/assets/img/ont-nokia_xs-010x-q_internal_2.jpg b/assets/img/ont-nokia_xs-010x-q_internal_2.jpg new file mode 100644 index 00000000..98e5629a Binary files /dev/null and b/assets/img/ont-nokia_xs-010x-q_internal_2.jpg differ diff --git a/assets/img/ont-nokia_xs-010x-q_rear.jpg b/assets/img/ont-nokia_xs-010x-q_rear.jpg new file mode 100644 index 00000000..263e576f Binary files /dev/null and b/assets/img/ont-nokia_xs-010x-q_rear.jpg differ diff --git a/assets/img/ont-nokia_xs-010x-q_ttl.jpg b/assets/img/ont-nokia_xs-010x-q_ttl.jpg new file mode 100644 index 00000000..f52ca767 Binary files /dev/null and b/assets/img/ont-nokia_xs-010x-q_ttl.jpg differ diff --git a/assets/img/pmg3000-d20b_modulediff.jpg b/assets/img/pmg3000-d20b_modulediff.jpg new file mode 100644 index 00000000..1638e0cc Binary files /dev/null and b/assets/img/pmg3000-d20b_modulediff.jpg differ diff --git a/assets/img/q-010g-t_flash.jpg b/assets/img/q-010g-t_flash.jpg new file mode 100644 index 00000000..36d0aee7 Binary files /dev/null and b/assets/img/q-010g-t_flash.jpg differ diff --git a/assets/img/q-010g-t_laser_driver.jpg b/assets/img/q-010g-t_laser_driver.jpg new file mode 100644 index 00000000..d1ca80b3 Binary files /dev/null and b/assets/img/q-010g-t_laser_driver.jpg differ diff --git a/assets/img/q-010g-t_rtl8221b.jpg b/assets/img/q-010g-t_rtl8221b.jpg new file mode 100644 index 00000000..cad612b0 Binary files /dev/null and b/assets/img/q-010g-t_rtl8221b.jpg differ diff --git a/assets/img/q-010g-t_rtl9601d.jpg b/assets/img/q-010g-t_rtl9601d.jpg new file mode 100644 index 00000000..14b22177 Binary files /dev/null and b/assets/img/q-010g-t_rtl9601d.jpg differ diff --git a/assets/img/sdx611-board-rev.jpg b/assets/img/sdx611-board-rev.jpg new file mode 100644 index 00000000..1d217fd9 Binary files /dev/null and b/assets/img/sdx611-board-rev.jpg differ diff --git a/assets/img/sdx611-rtl9601d.jpg b/assets/img/sdx611-rtl9601d.jpg new file mode 100644 index 00000000..d27a5e97 Binary files /dev/null and b/assets/img/sdx611-rtl9601d.jpg differ diff --git a/assets/img/sdx611-teardown-1.jpg b/assets/img/sdx611-teardown-1.jpg new file mode 100644 index 00000000..c1b29f03 Binary files /dev/null and b/assets/img/sdx611-teardown-1.jpg differ diff --git a/assets/img/sdx611-teardown-2.jpg b/assets/img/sdx611-teardown-2.jpg new file mode 100644 index 00000000..5d129e2e Binary files /dev/null and b/assets/img/sdx611-teardown-2.jpg differ diff --git a/assets/img/sdx611-utg24p05.jpg b/assets/img/sdx611-utg24p05.jpg new file mode 100644 index 00000000..f20c730c Binary files /dev/null and b/assets/img/sdx611-utg24p05.jpg differ diff --git a/assets/img/sdx611-w25q128jvsq.jpg b/assets/img/sdx611-w25q128jvsq.jpg new file mode 100644 index 00000000..27e5ef65 Binary files /dev/null and b/assets/img/sdx611-w25q128jvsq.jpg differ diff --git a/assets/img/tp-link/xb432v-change-sn.jpg b/assets/img/tp-link/xb432v-change-sn.jpg new file mode 100644 index 00000000..4c63d85c Binary files /dev/null and b/assets/img/tp-link/xb432v-change-sn.jpg differ diff --git a/assets/img/tw236h-cdel-serial.jpg b/assets/img/tw236h-cdel-serial.jpg index 574c3358..e3f0978f 100644 Binary files a/assets/img/tw236h-cdel-serial.jpg and b/assets/img/tw236h-cdel-serial.jpg differ diff --git a/assets/img/yotc-m2-2050-g40-bottom.jpg b/assets/img/yotc-m2-2050-g40-bottom.jpg new file mode 100644 index 00000000..a885f173 Binary files /dev/null and b/assets/img/yotc-m2-2050-g40-bottom.jpg differ diff --git a/assets/img/yotc-m2-2050-g40-pcb-b21.jpg b/assets/img/yotc-m2-2050-g40-pcb-b21.jpg new file mode 100644 index 00000000..a453cd3e Binary files /dev/null and b/assets/img/yotc-m2-2050-g40-pcb-b21.jpg differ diff --git a/assets/img/yotc-m2-2050-g40-pcb-top-b21.jpg b/assets/img/yotc-m2-2050-g40-pcb-top-b21.jpg new file mode 100644 index 00000000..a953ab5e Binary files /dev/null and b/assets/img/yotc-m2-2050-g40-pcb-top-b21.jpg differ diff --git a/assets/img/yotc-m2-2050-g40-pcb-top.jpg b/assets/img/yotc-m2-2050-g40-pcb-top.jpg new file mode 100644 index 00000000..bdf4c620 Binary files /dev/null and b/assets/img/yotc-m2-2050-g40-pcb-top.jpg differ diff --git a/assets/img/yotc-m2-2050-g40-pcb.jpg b/assets/img/yotc-m2-2050-g40-pcb.jpg new file mode 100644 index 00000000..3b0c6934 Binary files /dev/null and b/assets/img/yotc-m2-2050-g40-pcb.jpg differ diff --git a/assets/img/yotc-m2-2050-g40-top.jpg b/assets/img/yotc-m2-2050-g40-top.jpg new file mode 100644 index 00000000..6e0d5642 Binary files /dev/null and b/assets/img/yotc-m2-2050-g40-top.jpg differ diff --git a/assets/img/yotc-m2-2050-g40-ttl.jpg b/assets/img/yotc-m2-2050-g40-ttl.jpg new file mode 100644 index 00000000..d411077a Binary files /dev/null and b/assets/img/yotc-m2-2050-g40-ttl.jpg differ diff --git a/assets/img/zyxel-ex5601t0/zyxel_ex5601t0_serial.jpg b/assets/img/zyxel-ex5601t0/zyxel_ex5601t0_serial.jpg new file mode 100644 index 00000000..7afc05aa Binary files /dev/null and b/assets/img/zyxel-ex5601t0/zyxel_ex5601t0_serial.jpg differ diff --git a/assets/img/zyxel-pm7300/UART.jpg b/assets/img/zyxel-pm7300/UART.jpg new file mode 100644 index 00000000..4194b3cb Binary files /dev/null and b/assets/img/zyxel-pm7300/UART.jpg differ diff --git a/assets/img/zyxel-pm7300/board_bottom.jpg b/assets/img/zyxel-pm7300/board_bottom.jpg new file mode 100644 index 00000000..4d54444d Binary files /dev/null and b/assets/img/zyxel-pm7300/board_bottom.jpg differ diff --git a/assets/img/zyxel-pm7300/board_top.jpg b/assets/img/zyxel-pm7300/board_top.jpg new file mode 100644 index 00000000..1c515de0 Binary files /dev/null and b/assets/img/zyxel-pm7300/board_top.jpg differ diff --git a/assets/img/zyxel-pm7300/bottom.jpg b/assets/img/zyxel-pm7300/bottom.jpg new file mode 100644 index 00000000..03af600f Binary files /dev/null and b/assets/img/zyxel-pm7300/bottom.jpg differ diff --git a/assets/img/zyxel-pm7300/ports.jpg b/assets/img/zyxel-pm7300/ports.jpg new file mode 100644 index 00000000..5d718e5f Binary files /dev/null and b/assets/img/zyxel-pm7300/ports.jpg differ diff --git a/assets/img/zyxel-pmg5100t1/back-board.jpg b/assets/img/zyxel-pmg5100t1/back-board.jpg new file mode 100644 index 00000000..df3201d8 Binary files /dev/null and b/assets/img/zyxel-pmg5100t1/back-board.jpg differ diff --git a/assets/img/zyxel-pmg5100t1/back.jpg b/assets/img/zyxel-pmg5100t1/back.jpg new file mode 100644 index 00000000..24bcbee6 Binary files /dev/null and b/assets/img/zyxel-pmg5100t1/back.jpg differ diff --git a/assets/img/zyxel-pmg5100t1/front-board.jpg b/assets/img/zyxel-pmg5100t1/front-board.jpg new file mode 100644 index 00000000..1c23ffd3 Binary files /dev/null and b/assets/img/zyxel-pmg5100t1/front-board.jpg differ diff --git a/assets/img/zyxel-pmg5100t1/front.jpg b/assets/img/zyxel-pmg5100t1/front.jpg new file mode 100644 index 00000000..9b8e7eba Binary files /dev/null and b/assets/img/zyxel-pmg5100t1/front.jpg differ diff --git a/assets/img/zyxel-pmg5100t1/port.jpg b/assets/img/zyxel-pmg5100t1/port.jpg new file mode 100644 index 00000000..05ddf6ed Binary files /dev/null and b/assets/img/zyxel-pmg5100t1/port.jpg differ diff --git a/assets/js/cigpassword.js b/assets/js/cigpassword.js new file mode 100644 index 00000000..df866964 --- /dev/null +++ b/assets/js/cigpassword.js @@ -0,0 +1,46 @@ +function hexToBytes(hex) { + let bytes = new Uint8Array(hex.length / 2); + for (let i = 0; i < hex.length; i += 2) { + bytes[i / 2] = parseInt(hex.substr(i, 2), 16); + } + return bytes; +} + +function cigpassword_gpon(ont_serial, ont_user, length = 0, xgspon = false) { + const hardcoded_key = '01030a1013051764c8061419b49d0500'; + const hardcoded_seed = '2345679abcdefghijkmnpqrstuvwxyzACDEFGHJKLMNPQRSTUVWXYZ'; + + let ont_vendor = ont_serial.substring(0, 4).toUpperCase(); + let ont_id = ont_serial.substring(4).toLowerCase(); + + if (xgspon) { + ont_id = ont_id.toUpperCase(); + } + + let formatted_serial = `${ont_vendor}${ont_id}`; + + let key_bytes = new Uint8Array(hardcoded_key.match(/.{1,2}/g).map(byte => parseInt(byte, 16))); + if (length > 0) { + key_bytes[15] = length; + } + + let formatted_serial_user = formatted_serial; + if (ont_user) { + formatted_serial_user += `-${ont_user}`; + } + + let hmac = CryptoJS.HmacMD5(formatted_serial_user, CryptoJS.lib.WordArray.create(key_bytes)); + let pw_md5_hmac = hexToBytes(hmac.toString(CryptoJS.enc.Hex)); + + let output = Array(pw_md5_hmac.length); + + for (let i = 0; i < pw_md5_hmac.length; i++) { + output[i] = hardcoded_seed[pw_md5_hmac[i] % 0x36]; + } + + if (length > 0) { + return output.slice(0, length).join(''); + } else { + return output.join(''); + } +} diff --git a/assets/js/omci-vlan.js b/assets/js/omci-vlan.js index e28642cd..97964317 100644 --- a/assets/js/omci-vlan.js +++ b/assets/js/omci-vlan.js @@ -1,4 +1,4 @@ -/* Copyright (C) Ernesto Castellotti +/* Copyright (C) Erny * SPDX-License-Identifier: MPL-2.0-no-copyleft-exception */ diff --git a/assets/js/rootLantiq.js b/assets/js/rootLantiq.js index 317a4388..a3e60b18 100644 --- a/assets/js/rootLantiq.js +++ b/assets/js/rootLantiq.js @@ -2,253 +2,218 @@ const LOAD_ADDR = "80800000" const IMAGE0_ADDR = "C0000 740000"; const IMAGE1_ADDR = "800000 800000"; -async function detectUboot(reader) { - while (true) { - const { value, done } = await reader.read(); - - if (value.startsWith('U-Boot')) { - return; +async function detectUboot(serial) { + await serial.readLine((line) => { + if (line.startsWith('U-Boot')) { + return true; } - } + }); } -async function waitUbootStop(writer, reader, sfpModel, outputMsgCallback) { +async function waitUbootStop(serial, sfpModel, outputMsgCallback) { + const interruptChar = String.fromCharCode(3); + const interval = setInterval(function() { - writer.write(String.fromCharCode(3)); + serial.writeString(interruptChar); }, 10); - await detectUboot(reader); + await detectUboot(serial); outputMsgCallback(`Root in progress: Trigger characters received. DO NOT TOUCH THE ${sfpModel} UNTIL THE PROCEDURE IS COMPLETED!`); await delay(5000); clearInterval(interval); } -async function checkUbootUnlocked(reader) { - while (true) { - try { - const { value, done } = await Promise.race([ - reader.read(), - new Promise((_, reject) => setTimeout(reject, 2000, new Error("timeout"))) - ]); +async function checkUbootUnlocked(serial) { + let unlocked = false; - if (value.startsWith('Press SPACE to delay and Ctrl-C to abort autoboot')) { - return true; - } - } catch (err) { - return false; + await serial.readLine((line) => { + if (line.startsWith('Press SPACE to delay and Ctrl-C to abort autoboot')) { + unlocked = true; + return true } - } -} - -async function waitFailbackShell(writer, reader, outputMsgCallback) { - while (true) { - const { value, done } = await reader.read(); + }, 2000); - if (value.startsWith('Press the [f] key and hit [enter] to enter failsafe mode')) { - const interval = setInterval(function() { - writer.write('f\n'); - }, 10); + return unlocked; +} - outputMsgCallback("Root in progress: Trigger characters received. Waiting for boot to end..."); - await delay(3000); - clearInterval(interval); - break; +async function waitFailbackShell(serial, outputMsgCallback) { + await serial.readLine((line) => { + if (line.startsWith('Press the [f] key and hit [enter] to enter failsafe mode')) { + return true; } - } + }); - const interval = setInterval(function() { - writer.write(String.fromCharCode(10)); + let interval = setInterval(function() { + serial.writeString('f\n'); }, 10); - while (true) { - const { value, done } = await reader.read(); + outputMsgCallback("Root in progress: Trigger characters received. Waiting for boot to end..."); + await delay(3000); + clearInterval(interval); - if (value.includes('root@(none)')) { - await delay(1000); - clearInterval(interval); - break; + interval = setInterval(function() { + serial.writeString(String.fromCharCode(10)); + }, 10); + + await serial.readLine((line) => { + if (line.includes('root@(none)')) { + return true; } - } + }); + + await delay(1000); + clearInterval(interval); } async function lantiqRootUboot(port, sfpModel, outputMsgCallback, outputErrorCallback, baudRate = 115200) { - let reader,writer, readableStreamClosed, writerStreamClosed; + const serial = new SerialReadWrite(port, baudRate); try { outputMsgCallback(`Please disconnect the ${sfpModel} from the SFP adapter if it is currently plugged in!`); - ({ reader, writer, readableStreamClosed, writerStreamClosed } = await openPortLineBreak(port, baudRate)); - await delay(10000); outputMsgCallback(`Now you need to insert the ${sfpModel} into the SFP adapter, if the procedure does not go ahead, check the connections and then remove and reconnect the ${sfpModel} again`); while(true) { - await waitUbootStop(writer, reader, sfpModel, outputMsgCallback); - const ubootUnlocked = await checkUbootUnlocked(reader); + await waitUbootStop(serial, sfpModel, outputMsgCallback); + const ubootUnlocked = await checkUbootUnlocked(serial); if (ubootUnlocked == true) { break; } outputMsgCallback("Root in progress: Set U-Boot bootdelay to 5..."); - writer.write('setenv bootdelay 5\n'); + await serial.writeString('setenv bootdelay 5\n'); await delay(1000); outputMsgCallback("Root in progress: Enable ASC serial..."); - writer.write('setenv asc0 0\n'); + await serial.writeString('setenv asc0 0\n'); await delay(1000); outputMsgCallback("Root in progress: Set GPIO to unlock serial..."); - writer.write('setenv preboot "gpio set 3;gpio input 2;gpio input 105;gpio input 106;gpio input 107;gpio input 108"\n'); + await serial.writeString('setenv preboot "gpio set 3;gpio input 2;gpio input 105;gpio input 106;gpio input 107;gpio input 108"\n'); await delay(1000); outputMsgCallback("Root in progress: Save changes..."); - writer.write('saveenv\n'); + await serial.writeString('saveenv\n'); await delay(1000); outputMsgCallback("Root in progress: Rebooting..."); - writer.write('reset\n'); + await serial.writeString('reset\n'); await delay(1000); } - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); return true; } catch (err) { outputErrorCallback(`Error: ${err.message}`); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); return false; + } finally { + await serial.closePort(); } } async function unlockHuaweiShell(port, outputMsgCallback, outputErrorCallback, baudRate = 115200) { - let reader,writer, readableStreamClosed, writerStreamClosed; + const serial = new SerialReadWrite(port, baudRate); try { - ({ reader, writer, readableStreamClosed, writerStreamClosed } = await openPortLineBreak(port, baudRate)); outputMsgCallback("Root in progress: Rebooting..."); - writer.write('reset\n'); + await serial.writeString('reset\n'); await delay(1000); outputMsgCallback("Waiting for reboot"); - await waitFailbackShell(writer, reader, outputMsgCallback); + await waitFailbackShell(serial, outputMsgCallback); outputMsgCallback("Root in progress: Enable full Linux shell..."); - writer.write('mount_root && mkdir -p /overlay/etc && sed "s|/opt/lantiq/bin/minishell|/bin/ash|g" /rom/etc/passwd > /overlay/etc/passwd\n'); + await serial.writeString('mount_root && mkdir -p /overlay/etc && sed "s|/opt/lantiq/bin/minishell|/bin/ash|g" /rom/etc/passwd > /overlay/etc/passwd\n'); await delay(1000); outputMsgCallback("Root in progress: Umount rootfs partitions..."); - writer.write('umount /overlay && umount -a\n'); + await serial.writeString('umount /overlay && umount -a\n'); await delay(1000); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); return true; } catch (err) { outputErrorCallback(`Error: ${err.message}`); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); return false; + } finally { + await serial.closePort(); } } async function changeBaudrate(port, newBaudrate, currBaudrate, outputErrorCallback) { - let reader,writer, readableStreamClosed, writerStreamClosed; + let serial = new SerialReadWrite(port, currBaudrate); try { - ({ reader, writer, readableStreamClosed, writerStreamClosed } = await openPortLineBreak(port, currBaudrate)); - await writer.write(`setenv baudrate ${newBaudrate}\n`); + await serial.writeString(`setenv baudrate ${newBaudrate}\n`); await delay(1000); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); - ({ reader, writer, readableStreamClosed, writerStreamClosed } = await openPortLineBreak(port, newBaudrate)); + await serial.closePort(); + serial = new SerialReadWrite(port, newBaudrate); const interval = setInterval(function() { - writer.write(String.fromCharCode(13)); + serial.writeString(String.fromCharCode(13)); }, 10); - while (true) { - const { value, done } = await reader.read(); - - if (value.startsWith('FALCON')) { + await serial.readLine((line) => { + if (line.startsWith('FALCON')) { clearInterval(interval); - break; + return true; } - } + }); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); return true; } catch (err) { outputErrorCallback(`Error: ${err.message}`); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); return false; + } finally { + await serial.closePort(); } } async function sendImageMtd(port, data, baudRate, outputErrorCallback, progressCallback) { - let reader,writer, readableStreamClosed, writerStreamClosed; + const serial = new SerialReadWrite(port, baudRate); try { - ({ reader, writer, readableStreamClosed, writerStreamClosed } = await openPortLineBreak(port, baudRate)); - await writer.write(`loady 0x${LOAD_ADDR}\n`); + await serial.writeString(`loady 0x${LOAD_ADDR}\n`); await delay(1000); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); /* XYMini needs reopen the port */ - } catch (err) { - outputErrorCallback(`Error: ${err.message}`); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); - return false; - } - - try { - await port.open({ baudRate: baudRate }); - reader = port.readable.getReader(); - writer = port.writable.getWriter(); - - await sendXYMini(reader, writer, data, baudRate, progressCallback); - await reader.cancel(); - await writer.close(); - await port.close(); + await sendXYMini(serial, data, progressCallback); return true; } catch (err) { - await reader.cancel(); - await writer.close(); - await port.close(); outputErrorCallback(`Error: ${err.message}`); return false; + } finally { + await serial.closePort(); } } async function waitEndImageLoad(port, baudRate, outputErrorCallback) { - let reader, writer, readableStreamClosed, writerStreamClosed; + const serial = new SerialReadWrite(port, baudRate); try { - ({ reader, writer, readableStreamClosed, writerStreamClosed } = await openPortLineBreak(port, baudRate)); - - while (true) { - const { value, done } = await reader.read(); - - if (value.includes('Total Size')) { - break; + await serial.readLine((line) => { + if (line.includes('Total Size')) { + return true; } - } + }); - await(1000); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); + await delay(1000); return true; } catch (err) { outputErrorCallback(`Error: ${err.message}`); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); return false; + } finally { + await serial.closePort(); } } async function flashImageMtd(port, image, baudRate, outputErrorCallback) { - let reader, writer, readableStreamClosed, writerStreamClosed; + const serial = new SerialReadWrite(port, baudRate); try { - ({ reader, writer, readableStreamClosed, writerStreamClosed } = await openPortLineBreak(port, baudRate)); if (image == "image0") { - await writer.write(`sf probe 0 && sf erase ${IMAGE0_ADDR} && sf write ${LOAD_ADDR} ${IMAGE0_ADDR} && setenv committed_image 0 && setenv image0_is_valid 1 && saveenv && reset\n`); + await serial.writeString(`sf probe 0 && sf erase ${IMAGE0_ADDR} && sf write ${LOAD_ADDR} ${IMAGE0_ADDR} && setenv committed_image 0 && setenv image0_is_valid 1 && saveenv && reset\n`); } else { - await writer.write(`sf probe 0 && sf erase ${IMAGE1_ADDR} && sf write ${LOAD_ADDR} ${IMAGE1_ADDR} && setenv committed_image 1 && setenv image1_is_valid 1 && saveenv && reset\n`); + await serial.writeString(`sf probe 0 && sf erase ${IMAGE1_ADDR} && sf write ${LOAD_ADDR} ${IMAGE1_ADDR} && setenv committed_image 1 && setenv image1_is_valid 1 && saveenv && reset\n`); } - await delay(1000); - /* Wait to avoid the user from disconnecting the SFP while the image is being flashed */ - await detectUboot(reader); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); + await delay(1000); + await detectUboot(serial); return true; } catch (err) { outputErrorCallback(`Error: ${err.message}`); - await closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed); return false; + } finally { + await serial.closePort(); } } diff --git a/assets/js/serialUtil.js b/assets/js/serialUtil.js index 96246198..779bd4a0 100644 --- a/assets/js/serialUtil.js +++ b/assets/js/serialUtil.js @@ -2,53 +2,141 @@ function delay(ms) { return new Promise(resolve => setTimeout(resolve, ms)); } -class LineBreakTransformer { - constructor() { - this.chunks = ""; +class SerialReadWrite { + constructor(port, baudrate) { + this.port = port; + this.baudRate = baudrate; + this.isPortOpen = false; + this.textDecoder = new TextDecoder(); + this.textEncoder = new TextEncoder(); } - transform(chunk, controller) { - this.chunks += chunk; - const lines = this.chunks.split("\n"); - this.chunks = lines.pop(); - lines.forEach((line) => controller.enqueue(line)); + async openPort() { + await this.port.open({ baudRate: this.baudRate }); } - flush(controller) { - controller.enqueue(this.chunks); + async closePort() { + await this.port.close(); } -} -async function openPortLineBreak(port, baudRate) { - await port.open({ baudRate: baudRate }); - const textDecoder = new TextDecoderStream(); - const readableStreamClosed = port.readable.pipeTo(textDecoder.writable); - const reader = await textDecoder.readable.pipeThrough(new TransformStream(new LineBreakTransformer())).getReader(); - const textEncoderStream = new TextEncoderStream(); - const writerStreamClosed = textEncoderStream.readable.pipeTo(port.writable); - const writer = await textEncoderStream.writable.getWriter(); + async readBytes(retryError = 5, errorNum = 0) { + let reader = undefined; - return { reader, writer, readableStreamClosed, writerStreamClosed }; -} + if (this.isPortOpen === false) { + await this.openPort(); + this.isPortOpen = true; + } -async function closePortLineBreak(port, reader, writer, readableStreamClosed, writerStreamClosed) { - if (reader) { - reader.cancel(); - } + try { + if (reader === undefined) { + reader = this.port.readable.getReader(); + } + + const promiseResult = await reader.read(); - if (readableStreamClosed) { - await readableStreamClosed.catch(() => { /* Ignore the error */ }); + if (promiseResult === undefined) { + return undefined; + } + + return promiseResult.value; + } catch (e) { + if (e instanceof DOMException && + (e.name === "BreakError" || e.name === "FramingError" || e.name === "ParityError")) { + console.log(e); + + if (errorNum > retryError) { + throw e; + } + + return await this.readBytes(retryError, errorNum++); + } else { + throw e; + } + } finally { + if (reader) { + reader.releaseLock(); + reader = undefined; + } + } } - if (writer) { - writer.close(); + async readLine(readCallback, timeout = undefined) { + let reader = undefined; + let extraChunk = ""; + + if (this.isPortOpen === false) { + await this.openPort(); + this.isPortOpen = true; + } + + while (true) { + try { + if (reader === undefined) { + reader = this.port.readable.getReader(); + } + + let serialValue; + if (timeout === undefined) { + const { value, done } = await reader.read(); + serialValue = value; + } else { + const { value, done } = await Promise.race([ + reader.read(), + new Promise((_, reject) => setTimeout(reject, timeout, new Error("timeout"))) + ]); + serialValue = value; + } + + const linesValue = this.textDecoder.decode(serialValue).split('\n'); + linesValue[0] = extraChunk + linesValue[0]; + extraChunk = linesValue[linesValue.length - 1]; + + for (const line of linesValue) { + if (readCallback(line) === true) { + return; + } + } + } catch (e) { + if (e instanceof DOMException && + (e.name === "BreakError" || e.name === "FramingError" || e.name === "ParityError")) { + console.log(e); + } else if (e instanceof Error && e.message === "timeout") { + return; + } else { + throw e; + } + } finally { + if (reader) { + reader.releaseLock(); + reader = undefined; + } + } + } } - if (writerStreamClosed) { - await writerStreamClosed; + async writeBytes(bytes) { + let writer = undefined; + + if (this.isPortOpen === false) { + await this.openPort(); + this.isPortOpen = true; + } + + try { + if (writer === undefined) { + writer = this.port.writable.getWriter(); + } + + writer.write(bytes); + } finally { + if (writer) { + writer.releaseLock(); + writer = undefined; + } + } } - if (port) { - await port.close(); + async writeString(str) { + await this.writeBytes(this.textEncoder.encode(str)); } } diff --git a/assets/js/vue/vue-lantiq-eeprom.vue b/assets/js/vue/vue-lantiq-eeprom.vue index 94c3db7f..098cca69 100644 --- a/assets/js/vue/vue-lantiq-eeprom.vue +++ b/assets/js/vue/vue-lantiq-eeprom.vue @@ -1,37 +1,79 @@