summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorYuukiJapanTech (MyukiPON) <78184495+YuukiJapanTech@users.noreply.github.com>2023-08-21 13:11:43 +0200
committerGitHub <noreply@github.com>2023-08-21 13:11:43 +0200
commitb953ce12f8f4d2fed3a63c2c7ca2977b0170c86a (patch)
tree198bcfbe0def0dca5f6ec5b1cb3018c6f6fc9ce4
parentadd cig xgspon password form (#264) (diff)
downloadhack-gpon.github.io-b953ce12f8f4d2fed3a63c2c7ca2977b0170c86a.tar
hack-gpon.github.io-b953ce12f8f4d2fed3a63c2c7ca2977b0170c86a.tar.gz
hack-gpon.github.io-b953ce12f8f4d2fed3a63c2c7ca2977b0170c86a.tar.bz2
hack-gpon.github.io-b953ce12f8f4d2fed3a63c2c7ca2977b0170c86a.tar.lz
hack-gpon.github.io-b953ce12f8f4d2fed3a63c2c7ca2977b0170c86a.tar.xz
hack-gpon.github.io-b953ce12f8f4d2fed3a63c2c7ca2977b0170c86a.tar.zst
hack-gpon.github.io-b953ce12f8f4d2fed3a63c2c7ca2977b0170c86a.zip
-rw-r--r--_ont_xgs/ont-ECIN-EN-XGSFPP-OMAC-v1.md7
-rw-r--r--_ont_xgs/ont-cig-XG-99S.md7
-rw-r--r--_ont_xgs/ont-cig.md5
-rw-r--r--_ont_xgs/ont-ecin.md5
-rw-r--r--_ont_xgs/ont-fs-XGS-ONU-25-20NI-cli.md16
-rw-r--r--_ont_xgs/ont-fs-XGS-ONU-25-20NI.md540
-rw-r--r--_ont_xgs/ont-fs-com.md5
-rw-r--r--_ont_xgs/serial_dump/fs-XGS-ONU-25-20NI_minishell.txt208
-rw-r--r--assets/img/XGS-ONU-25-20NI/Stick_Rep.pngbin0 -> 30008 bytes
-rw-r--r--assets/img/XGS-ONU-25-20NI/UART_SFP.pngbin0 -> 1159389 bytes
-rw-r--r--assets/img/XGS-ONU-25-20NI/UART_bridge.pngbin0 -> 1200669 bytes
-rw-r--r--assets/img/XGS-ONU-25-20NI/UART_needle.pngbin0 -> 1432845 bytes
-rw-r--r--assets/img/XGS-ONU-25-20NI/front.jpgbin0 -> 2486274 bytes
-rw-r--r--assets/img/XGS-ONU-25-20NI/internal.jpgbin0 -> 3109637 bytes
14 files changed, 793 insertions, 0 deletions
diff --git a/_ont_xgs/ont-ECIN-EN-XGSFPP-OMAC-v1.md b/_ont_xgs/ont-ECIN-EN-XGSFPP-OMAC-v1.md
new file mode 100644
index 0000000..40a5dde
--- /dev/null
+++ b/_ont_xgs/ont-ECIN-EN-XGSFPP-OMAC-v1.md
@@ -0,0 +1,7 @@
+---
+title: E.C.I. Networks EN-XGSFPP-OMAC v1
+has_children: false
+redirect_to: /xgs/ont-fs-XGS-ONU-25-20NI
+layout: default
+parent: E.C.I. Networks
+--- \ No newline at end of file
diff --git a/_ont_xgs/ont-cig-XG-99S.md b/_ont_xgs/ont-cig-XG-99S.md
new file mode 100644
index 0000000..b8b0cd7
--- /dev/null
+++ b/_ont_xgs/ont-cig-XG-99S.md
@@ -0,0 +1,7 @@
+---
+title: CIG XG-99S
+has_children: false
+redirect_to: /xgs/ont-fs-XGS-ONU-25-20NI
+layout: default
+parent: CIG
+--- \ No newline at end of file
diff --git a/_ont_xgs/ont-cig.md b/_ont_xgs/ont-cig.md
new file mode 100644
index 0000000..b4f181e
--- /dev/null
+++ b/_ont_xgs/ont-cig.md
@@ -0,0 +1,5 @@
+---
+title: CIG
+has_children: true
+layout: default
+---
diff --git a/_ont_xgs/ont-ecin.md b/_ont_xgs/ont-ecin.md
new file mode 100644
index 0000000..82827b4
--- /dev/null
+++ b/_ont_xgs/ont-ecin.md
@@ -0,0 +1,5 @@
+---
+title: E.C.I. Networks
+has_children: true
+layout: default
+---
diff --git a/_ont_xgs/ont-fs-XGS-ONU-25-20NI-cli.md b/_ont_xgs/ont-fs-XGS-ONU-25-20NI-cli.md
new file mode 100644
index 0000000..8d7d366
--- /dev/null
+++ b/_ont_xgs/ont-fs-XGS-ONU-25-20NI-cli.md
@@ -0,0 +1,16 @@
+---
+title: CLI command tree (XGS-ONU-25-20NI)
+has_children: false
+layout: default
+parent: ONT FS.com Generic Compatible XGSPON Stick ONU with MAC SFP+ (XGS-ONU-25-20NI)
+---
+
+# Command tree
+This stick offers a MiniShell in addition to the normal linux shell.
+
+Available after `ONT>enable`.
+
+## Version R4.4.20.022
+Commands offered by this firmware version MiniShell are as follows:
+
+{% include serial_dump.html file="fs-XGS-ONU-25-20NI_minishell.txt" alt="FS.com XGS-ONU-25-20NI minishell" title="FS.com XGS-ONU-25-20NI minishell" %}
diff --git a/_ont_xgs/ont-fs-XGS-ONU-25-20NI.md b/_ont_xgs/ont-fs-XGS-ONU-25-20NI.md
new file mode 100644
index 0000000..692cfa4
--- /dev/null
+++ b/_ont_xgs/ont-fs-XGS-ONU-25-20NI.md
@@ -0,0 +1,540 @@
+---
+title: ONT FS.com Generic Compatible XGSPON Stick ONU with MAC SFP+ (XGS-ONU-25-20NI)
+has_children: true
+layout: default
+parent: ONT FS.com
+---
+
+# Hardware Specifications
+
+| | |
+| ---------------- | -------------------------------------------------------------------------- |
+| Vendor/Brand | FS |
+| Model | XGS-ONU-25-20NI |
+| ODM | CIG |
+| ODM Product Code | XG-99S |
+| Chipset | Cortina CA8271A |
+| Flash | MX35LF1GE4AB 128MB |
+| RAM | 128MB |
+| CPU | Taroko V0.2 (MIPS) |
+| CPU Clock | 500MHz |
+| Bootloader | SATURN uboot |
+| System | Custom Linux by Cortina (Saturn SDK) based on Kernel 4.4 Saturn-sfpplus-r1 |
+| 2.5GBaseX | Yes |
+| XGMII/XSGMII | Yes |
+| Optics | SC/APC |
+| IP address | 192.168.100.1 |
+| Web Gui | |
+| SSH | No |
+| Telnet | ✅ |
+| Serial | ✅ |
+| Serial baud | 115200 |
+| Serial encoding | 8-N-1 |
+| Form Factor | miniONT SFP |
+
+{% include image.html file="XGS-ONU-25-20NI/front.jpg" alt="XGS-ONU-25-20NI front plate" caption="XGS-ONU-25-20NI front plate" %}
+{% include image.html file="XGS-ONU-25-20NI/internal.jpg" alt="XGS-ONU-25-20NI internal" caption="XGS-ONU-25-20NI internal layout" %}
+
+## Serial
+
+The stick has a TTL 3.3V UART console (configured as 115200 8-N-1) that can be accessed from the SFP connector, but no components are mounted.
+
+The UART can be accessed by any of the following methods.
+- Touch the needle to a specific point
+- Shorting a specific pad to access from SFP
+
+### Access from PCB
+The UART can be accessed by connecting a wire or touching a needle to the following points.
+
+{% include image.html file="XGS-ONU-25-20NI/UART_needle.png" alt="XGS-ONU-25-20NI UART Touch point" caption="XGS-ONU-25-20NI UART Touch point" %}
+
+### Access from SFP
+By shorting these two points with solder, you can access the UART from SFP pins 2 and 7.
+
+| USB - TTL Adapter | SFP Connector (Molex, etc) |
+| --------------------- | -------------------------- |
+| Vcc (3.3V) | pin #15 , #16 |
+| TX | pin #7 |
+| RX | pin #2 |
+| GND | pin #10 |
+
+{% include alert.html content="USB TTL adapter may not work due to insufficient power supply. If possible, obtain 3.3V from the power supply device instead of the USB TTL adapter." alert="Note" icon="svg-info" color="blue" %}
+
+{% include image.html file="XGS-ONU-25-20NI/UART_SFP.png" alt="XGS-ONU-25-20NI UART Short point" caption="XGS-ONU-25-20NI UART Short point" %}
+
+{% include image.html file="XGS-ONU-25-20NI/UART_bridge.png" alt="XGS-ONU-25-20NI UART solder bridge" caption="XGS-ONU-25-20NI UART solder bridge" %}
+
+## Firmware is interchangeable with
+The firmware is compatible with the following.
+- CIG XG-99S
+- CIG XE-99S (10G-EPON mode)
+- ECIN EN-XGSFPP-OMAC v1
+
+## List of software versions
+Available from `#ONT/system>ontver build` and `#ONT/system/shell>cat /etc/version`.
+- R4.4.20.016 (from FS.com docs)
+- R4.4.20.018 - 20230426061821
+- R4.4.20.022 - 20230612033149
+
+## List of partitions
+
+| dev | size | erasesize | name |
+| ------ | -------- | --------- | ----------------- |
+| mtd0 | 00040000 | 00020000 | "ssb" |
+| mtd1 | 00002000 | 00020000 | "uboot-env" |
+| mtd2 | 00002000 | 00020000 | "dtb0" |
+| mtd3 | 0003c000 | 00020000 | "kernel0" |
+| mtd4 | 00300000 | 00020000 | "rootfs0" |
+| mtd5 | 004c0000 | 00020000 | "dtb1" |
+| mtd6 | 00300000 | 00020000 | "kernel1" |
+| mtd7 | 004c0000 | 00020000 | "rootfs1" |
+| mtd8 | 00001000 | 00020000 | "userdata" |
+| mtd9 | 00001000 | 00020000 | "mfginfo1" |
+| mtd10 | 00001000 | 00020000 | "mfginfo2" |
+| mtd11 | 00001000 | 00020000 | "uboot-env2" |
+
+This ONT supports dual boot.
+
+`kernel0` and `rootfs0` respectively contain the kernel and firmware of the first image, `kernel1` and `rootfs1` the kernel and the firmware of the second one.
+
+# Useful files and binaries
+
+## scfg.txt
+In the XGS-ONU-25-20NI ONT, the settings are loaded by four `scfg.txt` files.
+For rewriting settings, `/userdata/scfg.txt` and `/tmp/scfg.txt` are used.
+
+- `/config/default_scfg.txt` (read only): Contains the manufacturer's default settings, which are read first at ONT startup and are the lowest priority settings.
+- `/config/scfg.txt` (read only): Contains settings set by the firmware creator, which have higher priority than `default_scfg.txt` and will overwrite the settings if there is a conflict.
+- `/userdata/scfg.txt` (read/write): Contains settings set by the user or ISP. It has a higher priority than `/config/scfg.txt` and will overwrite the settings if there is a conflict. Can be edited and saved.
+- `/tmp/scfg.txt` (temp): It contains dynamically generated settings based on values stored on its custom ROM (mtd9, mtd10). Since they are generated on tmpfs and cannot be saved directly, they are rewritten via the `#ONT> system/misc` command on the ONT.
+
+The settings are overwritten and loaded at startup with the following priority:
+
+***(High)*** `/tmp/scfg.txt` > `/userdata/scfg.txt` > `/config/scfg.txt` > `/config/default_scfg.txt` ***(Low)***
+
+## Misc Command
+To configure settings using the MISC command, execute the following command:
+```
+#ONT> system/misc
+#ONT/system/misc>
+```
+
+
+# Usage
+
+## Login and Enable
+
+This stick does not have a web GUI.
+To configure it, you must log in via `UART` or `Telnet`.
+
+{% include alert.html content="FS.com Stick XGS-ONU-25-20NI does not have PON S/N on the label. (The S/N field stamped on the label is FS.com internal S/N, not PON S/N). In order to get it, you can either ask an FS.com sales representative or check the boot log from the UART!" alert="Note" icon="svg-info" color="blue" %}
+
+| User | Password (Enable Password) |
+| ------------------------ | ----------------------------------------------------------- |
+| ONU GPON Serial Number | 8 digit HMAC-MD5 based on Uppercase ONU GPON Serial Number |
+
+You can use the following form to generate login credentials:
+
+{% include cig_password_xgspon.html password_len="8" %}
+
+Or you can follow this external documentation on how to [emulate the ONT in QEMU](https://github.com/YuukiJapanTech/CA8271x), so use it at your own risk.
+
+UART does not ask for a login, it is possible to get a root shell without knowing the password.
+
+## Root procedure
+After logging in via `telnet` or `UART`, you will first get the MiniShell with user privileges.
+```
+ONT>
+```
+
+The root MiniShell can be obtained by executing the `enable` command on this MiniShell.
+```
+ONT> enable
+#ONT>
+```
+
+You can then switch to the Linux root shell by executing the following command:
+
+```
+#ONT> system/shell
+#ONT/system/Shell> sh
+#
+```
+
+
+# GPON ONU status
+
+## Get the operational status of the ONU
+Check the ONU Registration State with the following command:
+
+```
+#ONT> traffic/pon/show onu
+
+------------------------- ONU INFO --------------------------
+
+Onu id 65535
+sdThreshold: 0
+sfThreshold: 0
+TO1: 80000
+TO2: 1
+eqd: 0
+Serial Number(vendor code): GPON
+Serial Number(sn): abcd1234
+Password: 30 31 32 33 34 353 36 37 38 39
+Registration ID: 0x44454641554c540000000000000000000000000000000000000000000000000000000000
+------------------------- INFO END --------------------------
+
+#ONT>
+```
+
+Check the ONU operation state with the following command:
+
+```
+#ONT>traffic/pon/show link
+
+ ----------------- LINK STATE -----------------
+ Operation State Machine: INIT (O1)
+ ----------------- STATE END -----------------
+
+#ONT>
+```
+
+## Get information of the OLT vendor
+OLT information can be extracted from the MIB with the following command:
+
+```
+#ONT>system/mib/show 131
+Table Oltg, Olt-g, total 1 instances
+
+EntityID = 0x0000
+VendorId = ""
+EquipmentId = ""
+Version = 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+TimeOfDay = 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+
+#ONT>
+```
+
+## Querying a particular OMCI ME
+You can browse the MIB with the following command:
+```
+#ONT> system/mib
+#ONT/system/mib>
+```
+
+### Show a list of MIBs supported by ONT
+
+```
+#ONT/system/mib> show
+This command prints out the content of a mib table.
+Usage: show CLASSID
+CLASSID:
+ the class ID of the ME, defined in 983.2/984.4, currently
+the following MEs are supported:
+ClassID Name Desc
+256 Ontg Ont-g
+etc...
+```
+
+### Show a specific MIB
+For example, to display MIB 256 (Ont-g):
+
+```
+#ONT/system/mib>show 256
+Table Ontg, Ont-g, total 1 instances
+
+EntityID = 0x0000
+VID = "GPON"
+Version = 58 47 2d 39 39 53 00 00 00 00 00 00 00 00
+SerialNum = 47 50 4f 4e ab cd 12 34
+TraffMgtOpt = 2
+AtmCCOpt = 0
+BatteryBack = 1
+AdminState = 0
+OpState = 0
+OnuSurvivalTime = 0
+Loid = ""
+Password = ""
+AuthState = 0
+OntState = 1
+
+#ONT/system/mib>
+```
+
+### Dump of a MIB
+Output a dump of mib to `/tmp/mibdump.txt`
+```
+#ONT/system/mib> dump
+MIB is saved to the file /tmp/mibdump.txt.
+#ONT/system/mib>
+```
+
+## Getting Speed LAN Mode
+LAN Speed Mode can be verified from the `Status` column displayed by the following command:
+
+```
+#ONT>traffic/eth/show pack
+
+build time Apr 26 2023: 06:23:15
+
+-------------------- Line Pack -- PWR 0X0 --
+Line Slot 10, NumOfPorts 1, type 49, subtype 75, state 2
+-------------------- Configuration -------------------
+port | enable | loop | Mode | RL Type | RL Us Rate| RL Ds Rate|
+1 Yes No Auto 0 0 0
+
+-------------------- Status -------------------
+1) link state: Up, link mode: 2.5G Full
+
+-------------------- Bridge Pack -------------------
+Type: 75
+State: 2
+MAC Table: 0
+MAC Aging: 0
+MTU: 0
+-------------------- Chip Data -------------------
+eth Fd: 7
+port Mask: 0x0018
+type 28
+
+********** DEBUG INFO **********
+ EmrLogId : 5
+ EmrAdminEn : 0
+ EmrbeInited : 1
+ EmrDumpConn : 0
+ EmrPwrShedEn : 0x0
+ EmrConnItemNum : 0
+ EmrUsDsReverseEn : 1
+ EmrConnAllVidCheck : 0
+ EmrMcastGemVlanOpEn : 1
+ gEmrSaveConnItemEn : 1
+ gEmrMcastCrossVlanEn : 1
+ EmrUniExtractPriMatch : 1
+ EMR_DRV_PACK_DUMP_ITEM_EN : 0
+********************************
+#ONT>
+```
+
+
+# GPON/OMCI settings
+XGS-ONU-25-20NI ONT uses `scfg.txt` file and misc command for configuration.
+
+## Getting/Setting ONU GPON Serial Number
+This setting must be changed with the `misc` CLI option and the `eqsn set "<serialnumber>"` command.
+For example, if the SN is like `GPONabcd1234` (`47504f4eabcd1234`):
+```
+#ONT/system/misc> eqsn set "GPONabcd1234"
+```
+
+The get command can also be used to retrieve the configured PON S/N.
+```
+#ONT/system/misc> eqsn get
+eqsn: GPONabcd1234
+```
+
+## Getting/Setting ONU GPON PLOAM password
+This setting must be changed with the `misc` CLI option and the `exeep_w8 "<password>"` command.
+For example, if the PLOAM password is like `0123456789`:
+```
+#ONT/system/misc> exeep_w8 "0123456789"
+```
+
+The `exeep_r8` command can also be used to retrieve the configured PLOAM password.
+
+```
+#ONT/system/misc> exeep_r8
+[00, 000] 44 45 46 41 55 4c 54 00 - 00 00 00 00 00 00 00 00 | DEFAULT......
+[10, 016] 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | .............
+[20, 032] 00 00 00 00 ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[30, 048] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[40, 064] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[50, 080] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[60, 096] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[70, 112] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[80, 128] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[90, 144] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[a0, 160] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[b0, 176] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[c0, 192] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[d0, 208] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[e0, 224] ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff | .............
+[f0, 240] ff ff ff ff ff ff ff ff - ff ff ff ff 15 91 f3 9f | ............k
+```
+
+## Getting/Setting ONU GPON LOID
+This setting must be changed in `scfg.txt`, using the key `CHAR-ARRAY CFG_ID_LOID`.
+To modify LOID username we add the following line to `/userdata/scfg.txt`:
+```
+CHAR-ARRAY CFG_ID_LOID = { 0xXX,0xXX,0xXX,0xXX, 0xXX,0xXX,0xXX,0xXX, 0xXX,0xXX,0xXX,0xXX, 0xXX,0xXX,0xXX,0xXX, 0xXX,0xXX,0xXX,0xXX, 0xXX,0xXX,0xXX,0xXX };
+```
+
+For example, if the LOID is like `0123456`:
+```
+CHAR-ARRAY CFG_ID_LOID = { 0x30,0x31,0x32,0x33, 0x34,0x35,0x36,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00 };
+```
+
+## Getting/Setting ONU GPON LOID password
+This setting must be changed with the `misc` CLI option and the `pon_passwd set <password>` command.
+For example, if the LOID password is like `0123456789`:
+```
+#ONT/system/misc> pon_passwd set 0123456789
+```
+
+The `get` option can also be used to retrieve the configured LOID password:
+```
+#ONT/system/misc> pon_passwd get
+eqsn: 01234567890000000000
+```
+
+## Getting/Setting OMCI hardware version (ME 256)
+This setting must be changed with the `misc` CLI option and the `eqvid set "<hwver>"` command.
+For example, if the hardware version is like `abc123`:
+```
+#ONT/system/misc> eqvid set "abc123"
+```
+
+The `get` option can also be used to retrieve the configured hardware version.
+```
+#ONT/system/misc> eqvid get
+eqvid: abc123
+```
+
+## Getting/Setting OMCI vendor ID (ME 256)
+This setting must be changed with the `misc` CLI option and the `vendor set "<vendor>"` command.
+For example, if the vendor is like `GPON`:
+```
+#ONT/system/misc> vendor set "GPON"
+```
+
+The `get` option can also be used to retrieve the configured PON S/N vendor field:
+```
+#ONT/system/misc> vendor get
+vendor: GPON
+```
+
+In this ONT, the MIB OntG Vendor can be set to a value different from the S/N vendor value:
+```
+#ONT/system/misc> eqsn get
+eqsn: GPONabcd1234
+#ONT/system/misc> vendor get
+vendor: ZTEG
+```
+
+
+# Advanced settings
+See the link below for other MiniShell commands.
+- [MiniShell command tree](/xgs/ont-fs-XGS-ONU-25-20NI-cli)
+
+## Transferring files to the stick
+Stick's busybox (Linux shell) supports netcat and TFTP, which allow to send and receive files:
+```
+# tar cf - localfile | nc remotehost-ip 10000
+```
+
+```
+# tftp -r remotefile.bin -g remotehost-ip
+```
+
+## Backup of all partition
+To obtain a backup, use the `dd` command to save it on `/tmp`,
+or use the `cat` command to transfer it via netcat.
+```
+# dd if=/dev/mtdX of=/tmp/mtdX.bin
+# tftp -l /tmp/mtdX.bin -r remotehost-ip
+```
+
+```
+# cat /dev/mtdX | nc remotehost-ip 10000
+```
+
+When partition writing to the stick, use the flash command set.
+(Do not write with the `dd` command because ECC is enabled).
+```
+# flash_eraseall /dev/mtdX
+# flashcp -v targetfile /dev/mtdX
+```
+
+## Setting management IP
+To change the management IP, set it with the `misc` CLI option and the `admin_ip set <ip>` command.
+For example, if the management IP is like `192.168.1.1`:
+```
+#ONT/system/misc> admin_ip set 192.168.1.1
+```
+
+To change the management IP netmask, set it with the `misc` CLI option and the `admin_mask set <netmask>` command.
+For example, if the management IP mask is like `255.255.255.0`:
+```
+#ONT/system/misc> admin_mask set 255.255.255.0
+```
+
+
+# Random notes
+
+## Bricked stick Repair
+{% include alert.html content="This is an external file ([mtd dump](https://github.com/YuukiJapanTech/CA8271x)), so use it at your own risk!" alert="Note" icon="svg-info" color="blue" %}
+
+If the stick is bricked, it can be repaired by accessing uboot from the UART.
+
+If stick fails to boot, uboot will enable text input.
+```
+ERROR: can't get kernel image!
+SATURN#
+```
+
+Download stick's mtd dump from [mtd dump.](https://github.com/YuukiJapanTech/CA8271x/tree/main/mtd)
+
+Enable NAND with the following command:
+```
+SATURN# spi_nand probe 0
+SPI_NAND ID: 0x12c200
+SPI-NAND: MX35LF1GE4AB is found.
+MX35LF1GE4AB
+spinand_oob_size:0x40
+spinand_page_size:0x800
+spinand_blk_size:0x20000
+spinand_size:0x8000000
+SATURN#
+```
+
+Receive the file with the `loadb` command.
+```
+SATURN# loadb 0x80000000
+## Ready for binary (kermit) download to 0x80000000 at 115200 bps...
+```
+
+Using Tera Term, send the Kernel image (mtd3 or mtd6) by kermit transfer.
+{% include image.html file="XGS-ONU-25-20NI/Stick_Rep.png" alt="XGS-ONU-25-20NI Repair" caption="XGS-ONU-25-20NI Repair" %}
+
+Erase NAND and write the transferred kernel.
+```
+SATURN# spi_nand erase 0x000000600000 0x600000
+SATURN# spi_nand erase 0x000003500000 0x600000
+SATURN# spi_nand write 0x80000000 0x000000600000 0x600000
+SATURN# spi_nand write 0x80000000 0x000003500000 0x600000
+```
+
+Receive the file with the `loadb` command.
+and Using Tera Term, send the rootfs image (mtd4 or mtd7) by kermit transfer.
+```
+SATURN# loadb 0x81000000
+## Ready for binary (kermit) download to 0x81000000 at 115200 bps...
+```
+
+Erase NAND and write the transferred rootfs.
+```
+SATURN# spi_nand erase 0x000000c00000 0x2800000
+SATURN# spi_nand erase 0x000003b00000 0x2800000
+SATURN# spi_nand write 0x81000000 0x000000c00000 0x2800000
+SATURN# spi_nand write 0x81000000 0x000003b00000 0x2800000
+```
+
+When the stick is turned back on, it will boot with the transferred kernel and rootfs.
+
+
+# Known Bugs
+- There is a bug in the `register_id` command in the `misc` CLI option that changes the value of `pon_passwd` (LOID Password) instead of `register_id` (PLOAM).
+
+
+# Miscellaneous Links
+- [GitHub - CA8271x](https://github.com/YuukiJapanTech/CA8271x)
+
diff --git a/_ont_xgs/ont-fs-com.md b/_ont_xgs/ont-fs-com.md
new file mode 100644
index 0000000..54a1e05
--- /dev/null
+++ b/_ont_xgs/ont-fs-com.md
@@ -0,0 +1,5 @@
+---
+title: ONT FS.com
+has_children: true
+layout: default
+---
diff --git a/_ont_xgs/serial_dump/fs-XGS-ONU-25-20NI_minishell.txt b/_ont_xgs/serial_dump/fs-XGS-ONU-25-20NI_minishell.txt
new file mode 100644
index 0000000..08d22d0
--- /dev/null
+++ b/_ont_xgs/serial_dump/fs-XGS-ONU-25-20NI_minishell.txt
@@ -0,0 +1,208 @@
++traffic Service CLI menu
+ +ces CES CLI menu (empty)
+ +pon PON CLI menu
+ +debug PON debug command
+ rptwanstat config report wan status to MEC
+ tcont add/delete/flush a Tcont
+ flow configure the parameters of a flow
+ queue configure the parameters of a Tcont Queue
+ sendomci Send a OMCI message
+ prbs Enable/disable transmitting PRBS continuously
+ dyingGsend Enable/disable transmitting PRBS continuously
+ omcidbg Enable/disable kernel OMCI log
+ reportGemCnt Enable/disable report gem counter to MEC
+ throughput Enable/disable throughput test
+ ponmode Enable/disable qos
+ dump_classifier Dump classifier rule
+ gem_to_cpu trap gem port all packets to cpu
+ +hw PON Hardware level command
+ show Show hardware status or configurations
+ read_reg Read register value
+ write_reg Write register value
+ +ca PON cortina command
+ show Show cortina status or configurations
+ +app PON APP command
+ show Show database in PMR app
+ sendmsg Send Msg to PMR app
+ ber_interval Configure the BER interval
+ sf_threshold The threshold of BIP to report signal failure
+ sd_threshold The threshold of BIP to report signal degrade
+ sn Set the serial number of the ONT
+ password Set the password of ONT
+ to1_to2 Set the To1 To2 timer of ONT
+ show show PON information
+ +eth ETH CLI menu
+ +debug Ethernet Debug System CLI menu
+ pack Ethernet CLI debug function for pack driver
+ brdg Ethernet CLI debug function for SOC bridge
+ phy Ethernet CLI debug function for PHY
+ showconn Show ethernet connection debug info
+ ethdbg enable/disable the eth debug flag
+ show Ethernet CLI Show
+ +voip VoIP CLI menu (empty)
+ +omci omci CLI menu
+ +debug OMCI Debug System CLI menu
+ showemrcfg show the configuration of EMR from MEC
+ crc enable the crc check of omci message
+ omiterr Enable/disable omitting OMCI errors
+ acpower Start or stop power shedding
+ allocid Function call mec_AddAllocId
+ ponstate Function call mec_HandlePonStateChange
+ +voip OMCI VoIP System CLI menu
+ show show the configuration of VMR from MEC
+ +defaultxml MEC Xml List CLI menu
+ show show the List of default Xml from MEC
+ crc_commit runtime xml add crc
+ restore_xml runtime xml restore
+ show Show the information of MEC
+ clear Clear the runtime data
+ +router router CLI menu (empty)
+ +dmr DMR CLI menu (empty)
+ +hpna HPNA CLI menu (empty)
++system System CLI menu
+ +mib MIB CLI menu
+ +debug MIB Debug System CLI menu
+ dump Dump current mib to a file
+ reset Reset mib to default values
+ show Show the content of mib tables
+ +log LOG CLI menu
+ +kernel KERNEL LOG CLI menu (empty)
+ show Print out a log
+ dump dump the content of a log file
+ set Save a log to a file
+ clear Clear a log
+ collectlog Collectlog all log
+ +env ENV CLI menu
+ show Print out enviroment variables
+ +misc MISC CLI menu
+ +bob BOSA CLI menu
+ eep Misc CLI Show
+ unlock Misc CLI Show
+ echo Misc CLI Show
+ 2090 Misc CLI Show
+ preheat Misc CLI Show
+ auto Misc CLI Show
+ automod Misc CLI Show
+ restart Misc CLI Show
+ +debug Misc Debug System CLI menu
+ showwc Show write counter of mtd device
+ showbad Show bad blocks of mtd device
+ show Misc CLI Show
+ rf Misc CLI Show
+ filter Misc CLI Show
+ agc Misc CLI Show
+ ponalarm Misc CLI Show
+ mpcode Read or write eeprom : EEP_MFG_PRODUCTCODE
+ mpsn Read or write eeprom : EEP_MFG_PRODUCTSERIAL
+ mhwv Read or write eeprom : EEP_MFG_HWVERSION
+ lasersn Read or write eeprom : EEP_MFG_LASERSERIAL
+ mac1 Read or write eeprom : EEP_MFG_MAC1
+ mac2 Read or write eeprom : EEP_MFG_MAC2
+ eepver Read or write eeprom : EEP_MFG_EEPVER
+ burnin Read or write burnin flag : EEP_MFG_BURNIN
+ rfthigh Read or write rfthigh in unit of 64 ohm : EEP_MFG_RFT_HIGH
+ rftlow Read or write rftlow in unit of 64 ohm: EEP_MFG_RFT_LOW
+ rithigh Read or write rithigh in unit of 64 ohm : EEP_MFG_RIT_HIGH
+ ritlow Read or write ritlow in unit of 64 ohm: EEP_MFG_RIT_LOW
+ major Read or write eeprom : EEP_HW_FUNCTIONMAJOR
+ minor Read or write eeprom : EEP_HW_FUNCTIONMINOR
+ hwver Read or write eeprom : EEP_HW_VERSION
+ vendor Read or write eeprom : EEP_EQ_VENDORID
+ eqsn Read or write eeprom : EEP_EQ_SERIALNUMBER
+ eqsnvend Read or write eeprom : EEP_EQ_SNVENDOR
+ eqvid Read or write eeprom : EEP_EQ_VERSIONID
+ eqid Read or write eeprom : EEP_EQ_ID
+ img_name Read or write eeprom : EEP_SW_BOOTIMAGE
+ admin_ip Read or write eeprom : EEP_SW_IPADDR
+ admin_mask Read or write eeprom : EEP_SW_IPMASK
+ server_ip Read or write eeprom : EEP_SW_HOSTIPADDR
+ admin_gw Read or write eeprom : EEP_SW_GATEIPADDR
+ ftp_user Read or write eeprom : EEP_SW_FTPUSER
+ ftp_passwd Read or write eeprom : EEP_SW_FTPPASS
+ bootflag Read or write eeprom : EEP_SW_BOOTFLAG
+ admin_en Read or write eeprom : EEP_SW_BOOTREMOTEEN
+ xgspon_regid Read or write eeprom : XGS PON Registration ID
+ test_en Read or write eeprom : EEP_SW_BOOTTESTEN
+ notcomplete Read or write eeprom : EEP_SW_BOOTNOTCOMPLETE
+ act_img Read or write eeprom : EEP_SW_ACTIVEIMAGE
+ commit_img Read or write eeprom : EEP_SW_COMMITIMAGE
+ pon_passwd Read or write eeprom : EEP_APP_GPONPASSWORD
+ register_id Read or write eeprom : EEP_APP_GPONPASSWORD
+ hwerr Read or write eeprom : EEP_HW_DIAGNOSTICCODE
+ vdsl2_vendor Read or write eeprom : EEP_VDSL2_VENDORID
+ ssh_en Read or write eeprom : EEPROM_RW_CMD
+ i2c_r This command read i2c device in raw mode
+ i2c_w This command write i2c device in raw mode
+ write_mem This command is used to write otp
+ read_mem This command is used to read otp
+ sendevent This command is used to send led event directly
+ testloaden This command enable test load for manufacture
+ testensn This command enable test load for manufacture
+ eep_reset This command restore EEPROM factory default configuration
+ eep_r8 This command read EEPROM in raw mode
+ eep_w8 This command write EEPROM in raw mode
+ eep_crc This command update/check EEPROM crc value
+ exeep_r8 This command read EEPROM in raw mode
+ exeep_w8 This command write EEPROM in raw mode
+ exeep_crc This command update/check EEPROM crc value
+ eepinfo This command show eep info.
+ clearcfg This command is used to clear ONT runtime config , if full para is set, clear loid also!Usage: clearcfg [full]
+ final_check This command is used to show some important information for checking!
+ led This command is used to only turn on green leds,red leds or off all leds!Usage: led gon/ron/off
+ testloaden This command enable test load for manufacture
+ testensn This command enable test load for manufacture
+ get_gpio_val This command get gpio value
+ diswdt This command disable for manufacture
+ bosa This command is used to set bosa version and type
+ image_copy This command copy one image to another at next boot time
+ stopreboot Stop reboot command for debug
+ +manu Manufacture CLI menu
+ we This command write eeprom for manufacture
+ wep This command only write PC for manufacture
+ wes This command only write SN for manufacture
+ wem1 This command only write MAC1 for manufacture
+ wem2 This command only write MAC2 for manufacture
+ ledon This command turn on all led
+ ledoff This command turn off all led
+ final_check This command do final check
+ get_gpio_val This command get gpio value
+ trans This command show transceiver info
+ temp This command show system temperature
+ er This command enable rf
+ dr This command diable rf
+ ef This command enable filter
+ df This command disable filter
+ ten This command enable test load
+ wd This command disable watchdog
+ tensn This command enable test load, special for BL olt
+ ces_main This command configure ces connection for main test board
+ ces_back This command configure ces connection for backup test board
+ check_boot_status This command check boot status
+ check_ranging_statusThis command check ranging status
+ check_usb_port This command does manu test for USB device
+ reset_button_test This command is used for Reset Button test
+ factory_reset Clear all configuration and return to factory setting
+ load_certfile Load ACS HTTPS private Cert file into ONT
+ +fs File System CLI menu
+ show Show the content of system memory
+ supgrade super user Upgrade Image from Local Ftp Server
+ flash System Flash memory Operation command
+ upgrade Upgrade Image from Local Ftp Server
+ check check the content of system mtd
+ +net NET CLI menu
+ mirror Set mirror debug
+ dump Set dump frames debug
+ log Open/Close driver debug log
+ atconn Active connection debug
+ show Show NetMgr Data
+ +shell Shell
+ +debug System Debug CLI menu
+ showtimer Show timers
+ showtask Show task state
+ starttimer Start timers
+ stoptimer Start timers
+ md5 calculate MD5 value from input string
+ md5num calculate MD5 number string from input string
+ printlog Set the log level to print to console
+ ontver Show ONT Software Version
+ custom Get/Set ONT Software custom information \ No newline at end of file
diff --git a/assets/img/XGS-ONU-25-20NI/Stick_Rep.png b/assets/img/XGS-ONU-25-20NI/Stick_Rep.png
new file mode 100644
index 0000000..c8f323f
--- /dev/null
+++ b/assets/img/XGS-ONU-25-20NI/Stick_Rep.png
Binary files differ
diff --git a/assets/img/XGS-ONU-25-20NI/UART_SFP.png b/assets/img/XGS-ONU-25-20NI/UART_SFP.png
new file mode 100644
index 0000000..611c7ce
--- /dev/null
+++ b/assets/img/XGS-ONU-25-20NI/UART_SFP.png
Binary files differ
diff --git a/assets/img/XGS-ONU-25-20NI/UART_bridge.png b/assets/img/XGS-ONU-25-20NI/UART_bridge.png
new file mode 100644
index 0000000..4e2b78c
--- /dev/null
+++ b/assets/img/XGS-ONU-25-20NI/UART_bridge.png
Binary files differ
diff --git a/assets/img/XGS-ONU-25-20NI/UART_needle.png b/assets/img/XGS-ONU-25-20NI/UART_needle.png
new file mode 100644
index 0000000..90526cc
--- /dev/null
+++ b/assets/img/XGS-ONU-25-20NI/UART_needle.png
Binary files differ
diff --git a/assets/img/XGS-ONU-25-20NI/front.jpg b/assets/img/XGS-ONU-25-20NI/front.jpg
new file mode 100644
index 0000000..2df01f8
--- /dev/null
+++ b/assets/img/XGS-ONU-25-20NI/front.jpg
Binary files differ
diff --git a/assets/img/XGS-ONU-25-20NI/internal.jpg b/assets/img/XGS-ONU-25-20NI/internal.jpg
new file mode 100644
index 0000000..be452fc
--- /dev/null
+++ b/assets/img/XGS-ONU-25-20NI/internal.jpg
Binary files differ