diff options
Diffstat (limited to '_ont')
28 files changed, 1966 insertions, 0 deletions
diff --git a/_ont/ont-carlitoxxpro-cpgos03-0490-v1.md b/_ont/ont-carlitoxxpro-cpgos03-0490-v1.md new file mode 100644 index 0000000..baa581e --- /dev/null +++ b/_ont/ont-carlitoxxpro-cpgos03-0490-v1.md @@ -0,0 +1,6 @@ +--- +title: CarlitoxxPro CPGOS03-0490 v1 +has_children: false +redirect_to: ont-hilink-hl23446 +layout: default +---
\ No newline at end of file diff --git a/_ont/ont-carlitoxxpro-cpgos03-0490-v2.md b/_ont/ont-carlitoxxpro-cpgos03-0490-v2.md new file mode 100644 index 0000000..daacb51 --- /dev/null +++ b/_ont/ont-carlitoxxpro-cpgos03-0490-v2.md @@ -0,0 +1,38 @@ +--- +title: CarlitoxxPro CPGOS03-0490 v2 +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------------- | +| Vendor | CarlitoxxPro | +| Model | CPGOS03-0490 v2 | +| Chipset | Realtek RTL9601CI | +| Flash | 8 MB | +| RAM | 64 MB | +| System | Linux (Luna SDK) | +| HSGMII | No | +| Optics | SC/APC | +| IP address | | +| Web Gui | ✅ | +| SSH | ✅ | +| Form Factor | miniONT SFP | + +## List of software versions +## List of partitions +## List of firmwares and files + +# Known Bugs + +VLAN swap issue (MEID 171), auto-sensing mode to switch between SGMII/HiSGMII + +You should use the VID/VLAN shown by executing the command "omcicli mib get 84" via telnet to bring up PPPoE + +# Miscellaneous Links + +- [Hacking RTL960x](https://github.com/Anime4000/RTL960x) + + diff --git a/_ont/ont-d-link-dpn-100-rev-a2.md b/_ont/ont-d-link-dpn-100-rev-a2.md new file mode 100644 index 0000000..743bb71 --- /dev/null +++ b/_ont/ont-d-link-dpn-100-rev-a2.md @@ -0,0 +1,86 @@ +--- +title: D-LINK DPN-100 Rev A2 +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | --------------- | +| Vendor | D-LINK | +| Model | DPN-100 Rev A2 | +| Chipset | Lantiq PEB98035 | +| Flash | 8 MB | +| RAM | 64 MB | +| System | | +| HSGMII | | +| Optics | | +| IP address | | +| Web Gui | | +| SSH | | +| Form Factor | miniONT SFP | + +{% include image.html file="dpn-100-rev-a2.jpg" alt="DPN-100 Rev A2" caption="DPN-100 Rev A2" %} + + +Once you access the stick via ssh you will be presented with a second tier login. The credentials to access the dell shell are: username: `twmanu` , password: `twmanu`. + + +## Firmware is interchangeable with: + +- [Zyxel PMG3000-D20B](ont-Zyxel-PMG3000-D20B) +- [Halny HL-GSFP](ont-Halny-HL-GSFP) +- [D-LINK DPN-100-Rev-A2](ont-D-LINK-DPN-100-Rev-A2) +- [Ziza OP151s](ont-ziza-op151s) +- [T&W TW2362H-CDEL](ont-T-W-TW2362H-CDEL) + +## List of software versions +## List of partitions +## List of firmwares and files + +# Useful Commands + +{% include alert.html content="all commands start from the twmanu shell." alert="Note" icon="svg-info" color="blue" %} + +## Changing the ONT's S/N +{% include alert.html content="the S/N is stored in the ASCII format." alert="Note" icon="svg-info" color="blue" %} + +```sh +manufactory +set sn ALCLf0f0f0f0 +exit +hal +set sn ALCLf0f0f0f0 +``` + +## Changing the ONT's PLOAM password + +{% include alert.html content="the PLOAM is stored in the ASCII format." alert="Note" icon="svg-info" color="blue" %} + +This can be done easily via web ui. If you prefer to do it via the shell use: +```sh +manufactory +set password 1234567899 +``` + +or in hex format without any 0x or separator: +```sh +manufactory +set password hex 31323334353637383939 +``` + + + +## Show ONT info +```sh +show info +``` + +# Known Bugs +# Miscellaneous Links + +- [Dlink DPN 100 Change of Serial Number and PLOAM Password](https://www.youtube.com/watch?v=5hpMPJCpUaQ) + + + diff --git a/_ont/ont-d-link-dpn-100-rev-c1.md b/_ont/ont-d-link-dpn-100-rev-c1.md new file mode 100644 index 0000000..bc322e5 --- /dev/null +++ b/_ont/ont-d-link-dpn-100-rev-c1.md @@ -0,0 +1,34 @@ +--- +title: D-LINK DPN-100 Rev C1 +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------------- | +| Vendor | D-LINK | +| Model | DPN-100 Rev C1 | +| Chipset | Realtek RTL9601CI | +| Flash | | +| RAM | B | +| System | | +| HSGMII | | +| Optics | SC/APC | +| IP address | 192.168.100.1 | +| Web Gui | | +| SSH | | +| Telnet | ✅ | +| Form Factor | miniONT SFP | + +{% include image.html file="dpn-100-rev-c1.png" alt="DPN-100 Rev C1" caption="DPN-100 Rev C1" %} + + +## List of software versions +## List of partitions +## List of firmwares and files +# Known Bugs +# Miscellaneous Links + +- [DLINK DPN-100 Ver:C1 uses RTL9601CI](https://github.com/Anime4000/RTL960x/issues/2) diff --git a/_ont/ont-fs-com-gpon-onu-stick-with-mac.md b/_ont/ont-fs-com-gpon-onu-stick-with-mac.md new file mode 100644 index 0000000..1c36c31 --- /dev/null +++ b/_ont/ont-fs-com-gpon-onu-stick-with-mac.md @@ -0,0 +1,107 @@ +--- +title: ONT FS.com GPON ONU Stick with MAC +has_children: false +alias: SourcePhotonics SPS-34-24T-HP-TDFO +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ------------------------------------------ | +| Vendor | SourcePhotonics | +| Model | SPS-34-24T-HP-TDFO | +| Chipset | Lantiq PEB98035 | +| Flash | 16 MB | +| RAM | 64 MB | +| System | OpenWRT | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | 192.168.1.10 | +| Web Gui | | +| SSH | ✅ user `ONTUSER`, password `7sp!lwUBz1.` | +| Form Factor | miniONT SFP | + +## Possible clones + +- SourcePhotonics SPS-34-24T-HP-TDFO + +## Firmware is interchangeable with: + +- [Huawei MA5671A](ont-huawei-ma5671a) +- [Nokia G-010S-P](ont-nokia-g-010s-p) +- [ONT FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](ont-SourcePhotonics-SPS-34-24T-HP-TDFO) +- [Hilink HL23446](ont-Hilink-HL23446) +- {:.text-red-200 } Dasan H650SFP +- {:.text-red-200 } DpOptics D23446 + +# General setting + + +## Setting S/N +```sh +set_serial_number ABCD12345678 +``` + +## Setting PLOAM Password +Software 6BA1896SPLQA41 and before: +```sh +fw_setenv nPassword "0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39" +``` + +Software 6BA1896SPLQA41 and after: +```sh +sfp_i2c -i11 -s "0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39" +``` + +## Setting LOID and Checkcode Password +Software 6BA1896SPLQA41 and before: +```sh +fw_setenv omci_loid 1234567890 +fw_setenv omci_lpwd password01 +``` + +Software 6BA1896SPLQA41 and after: +```sh +sfp_i2c -i9 -s "1234567890" +sfp_i2c -i10 -s "password01" +``` + +## Setting eqipment id +```sh +sfp_i2c -i6 -s "22133912P" +``` + +## Setting vendor id +```sh +sfp_i2c -i7 -s "SPGA" +``` + +## Setting Lantiq MAC address +```sh +uci set network.Ict.macaddr=00:06:B5:07:D6:04 +uci set network.host.macaddr=00:06:B5:07:D8:04 +uci commit network.lct.macaddr=00:06:B5:07:D6:04 +uci commit network.host.macaddr=00:06:B5:07:D8:04 +``` + +## Setting Lantiq IP address +```sh +fw_setenv ipaddr 192.168.20.60 +fw_setenv gatewayip 192.168.20.1 +``` + +## Setting Onu reboot +```sh +reboot +``` + + +## List of software versions +## List of partitions +## List of firmwares and files +# Known Bugs +# Miscellaneous Links + +- [FS.com](https://www.fs.com/it/products/133619.html) +- [General setting of lantiq](https://forum.fibra.click/d/23881-ma5671a-e-vodafone-25-gbps/64)
\ No newline at end of file diff --git a/_ont/ont-halny-hl-gsfp.md b/_ont/ont-halny-hl-gsfp.md new file mode 100644 index 0000000..8f5ae9a --- /dev/null +++ b/_ont/ont-halny-hl-gsfp.md @@ -0,0 +1,31 @@ +--- +title: Halny HL-GSFP +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | --------------- | +| Vendor | Halny | +| Model | HL-GSFP | +| Chipset | Lantiq PEB98035 | +| Flash | 8 MB | +| RAM | 64 MB | +| System | OpenWRT | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | | +| Web Gui | | +| SSH | | +| Form Factor | miniONT SFP | + +{% include image.html file="hl-gsfp-1.png" alt="Halny HL-GSFP top" caption="Halny HL-GSFP top" %} +{% include image.html file="hl-gsfp-2.png" alt="Halny HL-GSFP bottom" caption="Halny HL-GSFP bottom" %} + +## List of software versions +## List of partitions +## List of firmwares and files +# Known Bugs +# Miscellaneous Links
\ No newline at end of file diff --git a/_ont/ont-hilink-hl23446.md b/_ont/ont-hilink-hl23446.md new file mode 100644 index 0000000..c734708 --- /dev/null +++ b/_ont/ont-hilink-hl23446.md @@ -0,0 +1,45 @@ +--- +title: Hilink HL23446 +has_children: false +alias: CarlitoxxPro CPGOS03-0490 v1 +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ---------------------------- | +| Vendor | Hilink | +| Model | HL23446 | +| Chipset | Lantiq PEB98035 | +| Flash | 16 MB | +| RAM | 64 MB | +| System | OpenWRT | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | | +| Web Gui | ✅ | +| SSH | | +| Form Factor | miniONT SFP | + +{% include image.html file="hl23446.png" alt="Hilink HL23446" caption="Hilink HL23446" %} + +## Possible Clones +- CarlitoxxPro CPGOS03-0490 **v1** + +## Firmware is interchangeable with: + +- [Huawei MA5671A](ont-huawei-ma5671a) +- [Nokia G-010S-P](ont-nokia-g-010s-p) +- [ONT FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](ont-SourcePhotonics-SPS-34-24T-HP-TDFO) +- [Hilink HL23446](ont-Hilink-HL23446) +- {:.text-red-200 } Dasan H650SFP +- {:.text-red-200 } DpOptics D23446 + +## List of software versions +## List of partitions +## List of firmwares and files +# Known Bugs +# Miscellaneous Links + + diff --git a/_ont/ont-huawei-hg8010h.md b/_ont/ont-huawei-hg8010h.md new file mode 100644 index 0000000..abcdd30 --- /dev/null +++ b/_ont/ont-huawei-hg8010h.md @@ -0,0 +1,200 @@ +--- +title: Huawei HG8010H +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ---------------------------------------------------------------------------------------------- | +| Vendor | Huawei | +| Model | HG8010H | +| Chipset | Hisilicon | +| Flash | 128MiB SLC NAND (DS35Q1GA-IB) | +| RAM | 256MiB | +| CPU | Hisilicon A9 dual core (ARMv7) | +| System | Dopra Linux | +| HSGMII | No | +| Optics | SC/APC and SC/UPC | +| IP address | 192.168.100.1 | +| Web Gui | ✅ user `root`, password `admin` or `adminHW` and user `telecomadmin`, password `admintelecom` | +| Telnet | After Enabling user `root`, password `admin` or `adminHW` | +| SSH | | +| Form Factor | ONT | + + +{% include image.html file="hg8010h.jpg" alt="HG8010H" caption="HG8010H: Horizontal PON port (left, middle); vertical PON port (right)" %} +{% include image.html file="hg8010hvorr.jpg" alt="HG8010Hv3/4/5" caption="Bottom of the HG8010Hv3/4/5" %} +{% include image.html file="hg8010hv6.jpg" alt="HG8010Hv6" caption="Bottom of the HG8010Hv6" %} + +## Enabling telnet + +We need access to a specific shell and in order to get it we have to enable telnet. On the unit, the telnet server accepts connections but doesn't read any input, nor does it send anything. + +To enable telnet we’ll use one of the web interface’s feature: the configuration backup and restore page. The configuration can be downloaded as XML, an XML file that contains a lot more options than the web interface and a couple of them can be modified to enable telnet access: under the `X_HW_CLITelnetAccess` node, set the `Access` attribute to `1` and in `AclServices`, `TELNETLanEnable` should also be set to `1`. I had to set both but your mileage may vary. + +It is possible that in more recent versions this won't work/has been fixed. + +Now that this is done, the modified configuration file can be uploaded via the web interface, the ONT will restart and telnet should be accessible on port 23. + +## Hardware revisions +- v1: Horizontal PON port +- v2: Horizontal PON port +- v3: Vertical PON port +- v4: Vertical PON port +- v5: Vertical PON port +- v6: Vertical PON port + +## List of software versions + +- HWTCA31610003 +- V3R013C10S112 +- V3R015C10S106 +- V3R016C10S003 (V300R016C10SPC003B010) +- V3R017C00S100 +- V3R017C10S201 +- V5R020C10S020 (V500R020C10SPC020B014 - V500R020C10SPC020A2011020049) +- V5R020C10S024 (V500R020C10SPC024B001) +- V5R020C10S025 (V500R020C10SPC025B002) +- V5R020C10S115 (V500R020C10SPC115B270) + +## List of partitions + +0x000000000000-0x000000100000 : "bootcode" (1MiB) +0x000000100000-0x000008000000 : "ubilayer_v5" (127MiB) + +## List of firmwares and files +## List of useful commands + +> **Warning** +> All results need to be converted from Hex to Ascii +> [Converter](ascii-hex) + +- Get OLT information: + +``` +WAP>omcicmd mib show meid 131 instid 0 + + ------------------------------------------------------- + Me(OLT-G), instance(0x0), instance size is 54 + ------------------------------------------------------- + Att1, AttSize = 0x4, AttContent: 48575443 + Att2, AttSize = 0x14, AttContent: 00000000 00000000 00000000 00000000 00000000 + Att3, AttSize = 0xe, AttContent: 31300000 00000000 00000000 0000 + Att4, AttSize = 0xe, AttContent: 00000000 00000000 00000000 0000 + ------------------------------------------------------- + +success! +``` +*0x48575443* → *HWTC* (Huawei) + +- Get SW Version 0 and 1: + +``` +WAP>omcicmd mib show meid 7 instid 0 + + ------------------------------------------------------- + Me(Software Image), instance(0x0), instance size is 19 + ------------------------------------------------------- + Att1, AttSize = 0xe, AttContent: 56355230 32304331 30533131 3500 + Att2, AttSize = 0x1, AttContent: 00 + Att3, AttSize = 0x1, AttContent: 00 + Att4, AttSize = 0x1, AttContent: 01 + ------------------------------------------------------- + +success! +WAP>omcicmd mib show meid 7 instid 1 + + ------------------------------------------------------- + Me(Software Image), instance(0x1), instance size is 19 + ------------------------------------------------------- + Att1, AttSize = 0xe, AttContent: 56355230 32304331 30533131 3500 + Att2, AttSize = 0x1, AttContent: 01 + Att3, AttSize = 0x1, AttContent: 01 + Att4, AttSize = 0x1, AttContent: 01 + ------------------------------------------------------- + +success! +``` +*0x56355230 32304331 30533131 3500* → *V5R020C10S115* + +- Get ONT Vendor ID and HW Version: + +``` +WAP>omcicmd mib show meid 256 instid 0 + + ------------------------------------------------------- + Me(ONT-G), instance(0x0), instance size is 73 + ------------------------------------------------------- + Att1, AttSize = 0x4, AttContent: 48575443 + Att2, AttSize = 0xe, AttContent: 32343046 2e410000 00000000 0000 + Att3, AttSize = 0x8, AttContent: 2a2a2a2a 2a2a2a2a + Att4, AttSize = 0x1, AttContent: 00 + Att5, AttSize = 0x1, AttContent: 00 + Att6, AttSize = 0x1, AttContent: 00 + Att7, AttSize = 0x1, AttContent: 00 + Att8, AttSize = 0x1, AttContent: 00 + Att9, AttSize = 0x1, AttContent: 00 + Att10, AttSize = 0x18, AttContent: 2a2a2a2a 2a2a2a2a 2a2a2a2a 2a2a2a2a 2a2a2a2a 2a2a2a2a + Att11, AttSize = 0xc, AttContent: 2a2a2a2a 2a2a2a2a 2a2a2a2a + Att12, AttSize = 0x1, AttContent: 00 + Att13, AttSize = 0x2, AttContent: 0001 + ------------------------------------------------------- + +success! +``` + +*0x48575443* → *HWTC* +*0x32343046 2e41* → *240F.A* + +- Get ONT Equipment ID: + +``` +WAP>omcicmd mib show meid 257 instid 0 + + ------------------------------------------------------- + Me(ONT2-G), instance(0x0), instance size is 44 + ------------------------------------------------------- + Att1, AttSize = 0x14, AttContent: 48473830 31304876 36000000 00000000 00000000 + Att2, AttSize = 0x1, AttContent: b0 + Att3, AttSize = 0x2, AttContent: 0240 + Att4, AttSize = 0x1, AttContent: 01 + Att5, AttSize = 0x1, AttContent: 01 + Att6, AttSize = 0x2, AttContent: 0040 + Att7, AttSize = 0x1, AttContent: 02 + Att8, AttSize = 0x1, AttContent: 01 + Att9, AttSize = 0x2, AttContent: 0020 + Att10, AttSize = 0x4, AttContent: 00000000 + Att11, AttSize = 0x2, AttContent: 007d + Att12, AttSize = 0x1, AttContent: 00 + Att13, AttSize = 0x2, AttContent: 0018 + Att14, AttSize = 0x2, AttContent: 0001 + ------------------------------------------------------- + +success! +``` + +*0x48473830 31304876 36* → *HG8010Hv6* + +# Known Bugs +# Miscellaneous Links + +- [Exploring the Huawei HG8010H GPON ONT](https://www.linux.it/~md/text/gpon-sha2017.pdf) +- [Unlock HG8010Hv3 softmode](https://lafibre.info/orange-installation/unlock-hg8010gv3-softmode/) +- [Notes on a Huawei HG810H (N.B. SSL error)](https://umbriel.fr/blog/Notes_on_a_Huawei_HG8010H.html) + + +# Teardown and other photos + +## v1-2 + +{% include image.html file="HG8010H_Teardown_1.jpg" alt="HG8010Hv1/2 Teardown" caption="HG8010Hv1/2: Teardown" %} +{% include image.html file="HG8010H_Teardown_2.jpg" alt="HG8010Hv1/2 Teardown" caption="HG8010Hv1/2: Teardown" %} + +## v6 + +{% include image.html file="HG8010H_Teardown_1_v6.jpg" alt="HG8010Hv6 Teardown" caption="HG8010Hv6: Teardown" %} +{% include image.html file="HG8010H_Teardown_2_v6.jpg" alt="HG8010Hv6 Teardown" caption="HG8010Hv6: Teardown" %} + + diff --git a/_ont/ont-huawei-ma5671a-root.md b/_ont/ont-huawei-ma5671a-root.md new file mode 100644 index 0000000..3161371 --- /dev/null +++ b/_ont/ont-huawei-ma5671a-root.md @@ -0,0 +1,115 @@ +--- +title: Root Huawei MA5671A +has_children: false +parent: Huawei MA5671A +layout: default +--- + +1. take the SFP molex and the 4 coloured cables and solder them to the molex according to the following diagram: + +``` +USB TTL(UART) Adapter ------- SFP 20pins Molex connector +3.3V ---red ------------------pin #15 and #16 +TX -----orange ---------------pin #2 +RX -----yellow ---------------pin #7 +GND ----green --------------- pin #10 +``` + +{% include alert.html content="Use GND wire as ON/OFF switch, otherwise there will be a slight delay before data is displayed on the console (putty/TeraTerm)." alert="Important" icon="svg-warning" color="yellow" %} + +{% include image.html file="ma5671a-root-1.jpg" alt="Example of how the sfp-ttl connection should look like" caption="Example of how the sfp-ttl connection should look like" %} +{% include image.html file="ma5671a-root-2.jpg" alt="Molex SFP" caption="Molex SFP" %} + +2. Disassemble the stick by releasing the metal tabs that hold the cover in place. There are two tabs, one on each side, inside these holes: + +{% include image.html file="ma5671a-root-4.jpg" alt="Metal tabs that hold the cover in place" caption="Metal tabs that hold the cover in place" %} + +3. Once you have removed the metal casing, you are left with the half-naked stick (note that the release mechanism also comes off easily and then you don't know how to put it back together, so take a photo and memorise the positioning well). + +4. Before shorting the stick, connect the previously soldered cables and molex to the USB serial (photo immediately below) and to the stick (the molex, of course) and check that the jumper on the usb key is set to 3.3V + +{% include image.html file="ma5671a-root-8.jpg" alt="TTL" caption="TTL" %} + +5. The disassembled stick will appear as in the photo, in which I have highlighted in red the 2 pins to be shorted. Here they use wire, but a pair of tweezers is sufficient (I used those, in fact). Be careful not to make any other contacts by possibly covering everything else with electrical tape. + +{% include image.html file="ma5671a-root-4.jpg" alt="tweezers" caption="tweezers" %} +{% include image.html file="ma5671a-root-6.jpg" alt="tweezers" caption="tweezers" %} +{% include image.html file="ma5671a-root-5.jpg" alt="tweezers and eletrical tape" caption="tweezers and eletrical tape" %} +{% include image.html file="ma5671a-root-6.jpg" alt="tweezers" caption="tweezers" %} + +6. for the moment connect all cables to the usb key except the green (ground) or red (voltage), otherwise the stick will boot before you can do the following (N.B. for those who bought the uart above RX and TX are reversed). Open and configure Teratem for serial connection (select the correct com port, speed 115.200, english language, otherwise in japainise you can't read anything understandable) insert the key in the PC (I take it for granted that it has already been installed, drivers and all), short the 2 pins seen above and keeping the short connected the missing coloured cable + +7. if you have done everything correctly, you should see something similar to the picture below (if nothing happens, you have obviously done something wrong with cables, molexes, soldering irons, etc., so you will have to start from the beginning again and work out which step you did wrong): + +{% include image.html file="ma5671a-root-9.png" alt="serial shell" caption="serial shell" %} + +8. Remove the short (tweezers or whatever you used), then type 7 and enter. You should see this: + +{% include image.html file="ma5671a-root-10.png" alt="serial shell 2" caption="serial shell 2" %} + +9. from the Teraterm menu `FILE` → `TRANSFER` → `XMODEM` → `SEND` → `[1224abort.bin]` (which is the third of the files downloaded earlier): + +{% include image.html file="ma5671a-root-11.png" alt="1224abort.bin" caption="1224abort.bin" %} + +10. as soon as the file transfer is complete, you have 2 seconds to press `CTRL+C`, if you have not done so, you can return to the step 6. Otherwise, you should see: + +{% include image.html file="ma5671a-root-12.png" alt="falcon shell" caption="falcon shell" %} + +11. To permanently unlock the bootloader, without having to repeat the previous steps, you must give the following commands: +``` +FALCON => setenv bootdelay 5 +FALCON => setenv asc 0 +FALCON => setenv preboot "gpio input 105;gpio input 106;gpio input 107;gpio input 108;gpio set 3;gpio set 109;gpio set 110;gpio clear 423;gpio clear 422;gpio clear 325;gpio clear 402;gpio clear 424" +FALCON => saveenv +``` + +12. if you have done everything correctly you can reboot the stick (actually if you are convinced that everything is ok you could also close it again), disconnecting and reconnecting one of the 2 cables from before (ground or voltage), then again from the terminal you will have 5 seconds to lock the bootloader by doing a simple CTRL+C. Now upload the firmware image of the first mtd2 partition to the stick with the command +``` +FALCON => loadb 0x80800000 +``` +At this point it will appear: + +{% include image.html file="ma5671a-root-13.jpg" alt="shell requiring mt2 upload" caption="shell requiring mt2 upload" %} + +13. From the teratem menu do `FILE` → `TRANSFER` → `KERMIT` → `SEND` → `[mtd2.bin]`. +It will start uploading the file at a speed of about 3-4 KBbs. Now you will have to wait more than half an hour for the upload to complete. + +14. Once finished, the image loaded on the stick must also be saved to the corresponding system partition (the first of the 2) with the commands +``` +FALCON => sf probe 0 +FALCON => sf erase C0000 740000 +FALCON => sf write 80800000 C0000 740000 +``` + +15. check that the stick is configured to boot from partition 0 (yes I know mtd2 goes on 0 and mtd5 goes on 1, complain to Laniq) with the command +``` +FALCON => printenv committed_image +``` +16. if it is 0, fine, otherwise configure partition 0 with the commands, and check if are 0. +``` +FALCON => setenv committed_image 0 +FALCON => saveenv +FALCON => printenv committed_image +``` +17. Reboot it this time connected to the router with cage or mediaconverter, with the port set to an IP on the 192.168.1.0/24 subnet (the stick has the IP 192.168.1.10) + +18. log in via the web, it makes you configure the password when you first log in with a root user. These credentials are the same as those used in ssh + +19. set the password access the sitck in SCP, upload the mtd5 image in `/tmp` whit the command +``` +scp mtd5.bin root@192.168.1.10:/tmp/ +``` +then write it into the second partition (the 1) with the command: +``` +mtd -e image1 write mtd5.bin image1 +``` + +{% include alert.html content="You could also have done it as a serial, but from here it is much quicker +" alert="Info" icon="svg-info" color="blue" %} + +# Miscellaneous Links +- [Come avere i 2.5 Gbps su un unico dispositivo senza il Fastgate](https://forum.fibra.click/d/17836-come-avere-i-25-gbps-su-un-unico-dispositivo-senza-il-fastgate) +- [Support MA5671A SFP GPON](https://forum.openwrt.org/t/support-ma5671a-sfp-gpon/48042) +- [La fibre Orange à 2Gbps, sur un routeur MikroTik 10Gbps CCR2004, via un ONT SFP+](https://lafibre.info/remplacer-livebox/guide-de-connexion-fibre-directement-sur-un-routeur-voire-meme-en-2gbps/msg832904/#msg832904) +- [Bypassing the HH3K up to 2.5Gbps using a BCM57810S NIC](https://www.dslreports.com/forum/r32230041-Internet-Bypassing-the-HH3K-up-to-2-5Gbps-using-a-BCM57810S-NIC) + diff --git a/_ont/ont-huawei-ma5671a.md b/_ont/ont-huawei-ma5671a.md new file mode 100644 index 0000000..2ad0218 --- /dev/null +++ b/_ont/ont-huawei-ma5671a.md @@ -0,0 +1,122 @@ +--- +title: Huawei MA5671A +has_children: true +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------------------------------- | +| Vendor | Huawei | +| Model | MA5671A | +| Chipset | Lantiq PEB98035 | +| Flash | 16 MB | +| RAM | 64 MB | +| System | OpenWRT | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | 192.168.1.10 | +| Web Gui | After root | +| SSH | ✅ user `root`, password `admin123` | +| Form Factor | miniONT SFP | + +{% include image.html file="g-010s-p-and-ma5671a.jpg" alt="G-010S-P and MA5671A Teardown" caption="G-010S-P and MA5671A Teardown" %} + + +## Firmware is interchangeable with: + +- [Huawei MA5671A](ont-huawei-ma5671a) +- [Nokia G-010S-P](ont-nokia-g-010s-p) +- [ONT FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](ont-SourcePhotonics-SPS-34-24T-HP-TDFO) +- [Hilink HL23446](ont-Hilink-HL23446) +- {:.text-red-200 } Dasan H650SFP +- {:.text-red-200 } DpOptics D23446 + +## Serial + +``` +USB TTL(UART) Adapter ------- SFP 20pins Molex connector +3.3V ---red ------------------pin #15 and #16 +TX -----orange ---------------pin #2 +RX -----yellow ---------------pin #7 +GND ----green --------------- pin #10 +``` +Configuration: asc0=0 115200 8-N-1 + +## Root procedure + +- [Root](ont-huawei-ma5671a-root) + +## Disabling Dying Gasp +```sh +set nDyingGaspEnable disable +``` + +## List of software versions + +## List of partitions + +- mtd2 +- mtd5 + +## List of firmwares and files + +- [Carlito MTD2](https://ma5671a.s3.nl-ams.scw.cloud/mtd2.bin){: .btn } md5hash: d3cb6f7efec201b37931139feb4bb23b +- [Huawei Rooted MTD2](https://ma5671a.s3.nl-ams.scw.cloud/mA5671a_root_mtd2.img){: .btn } md5hash: 3138d2dd06a32bb92bc63610fec6fcd6 +- [Carlito MTD5](https://ma5671a.s3.nl-ams.scw.cloud/mtd5.bin){: .btn } md5hash > 59d2dc15227d6f693a38131eca89b29e +- [Huawei Rooted MTD5](https://ma5671a.s3.nl-ams.scw.cloud/mA5671a_root_mtd5.img){: .btn } md5hash: 0e4cfdc1b96be6581869b26b48789556 +- [1224abort.bin](https://ma5671a.s3.nl-ams.scw.cloud/1224ABORT.bin){: .btn } md5hash: 10e94a4b4acdc82dec20c7904b69e5c0 + +# General setting + +## Setting image version +```sh +fw_setenv image0_version V1.7.6-170626 +fw_setenv image1_version V1.7.6-170626 +``` + +## Setting S/N +```sh +fw_setenv ont_serial ABCD12345678 +``` +or +```sh +uci set gpon.ploam.nSerial="0x48 0x57 0x54 0x43 0x9D 0xAC 0xC7 0xA3" +uci commit +``` + +## Setting PLOAM Password +```sh +fw_setenv nPassword "0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39" +``` +or +```sh +uci set gpon.ploam.nPassword="0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39" +uci commit +``` + +## Setting and check oem-generic +```sh +fw_setenv target oem-generic +fw_printenv target=oem-generic +``` + +## Setting HSMIII +```sh +fw_setenv sgmii_mode 5 +``` +# Known Bugs + +# Miscellaneous Links + +- [Support MA5671A SFP GPON - OpenWRT forum](https://forum.openwrt.org/t/support-ma5671a-sfp-gpon/48042) +- [u boot lantiq falcon - GitHub](https://github.com/minhng99/u-boot_lantiq_falcon) +- [Custom Firmware - right.com.cn](https://www.right.com.cn/forum/thread-8220173-1-1.html) +- [Come avere i 2.5 Gbps su un unico dispositivo senza il Fastgate - fibra.click Forum](https://forum.fibra.click/d/17836-come-avere-i-25-gbps-su-un-unico-dispositivo-senza-il-fastgate) +- [GPON SFP Tools](https://github.com/MokkaSchnalle/GPON-SFP-Tools) +- [Come avere i 2.5 Gbps su un unico dispositivo senza il Fastgate](https://forum.fibra.click/d/17836-come-avere-i-25-gbps-su-un-unico-dispositivo-senza-il-fastgate) +- [La fibre Orange à 2Gbps, sur un routeur MikroTik 10Gbps CCR2004, via un ONT SFP+](https://lafibre.info/remplacer-livebox/guide-de-connexion-fibre-directement-sur-un-routeur-voire-meme-en-2gbps/msg832904/#msg832904) +- [Bypassing the HH3K up to 2.5Gbps using a BCM57810S NIC](https://www.dslreports.com/forum/r32230041-Internet-Bypassing-the-HH3K-up-to-2-5Gbps-using-a-BCM57810S-NIC) +- [General setting of lantiq](https://forum.fibra.click/d/23881-ma5671a-e-vodafone-25-gbps/64) +- [Manual and firmware for reflashing of HUAWEI MA5671A SFP module](https://github.com/nikbyte/huawei_ma5671a) diff --git a/_ont/ont-nokia-g-010g-p.md b/_ont/ont-nokia-g-010g-p.md new file mode 100644 index 0000000..d181b9a --- /dev/null +++ b/_ont/ont-nokia-g-010g-p.md @@ -0,0 +1,31 @@ +--- +title: Nokia G-010G-P +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | -------- | +| Vendor | Nokia | +| Model | G-010G-P | +| Chipset | | +| Flash | | +| RAM | | +| System | | +| HSGMII | No | +| Optics | SC/APC | +| IP address | | +| Web Gui | | +| SSH | | +| Form Factor | ONT | + +{% include image.html file="g-010g-p.jpg" alt="G-010G-P" caption="Nokia G-010G-P" %} + + + +# Miscellaneous Links +- <a href="https://github.com/nanomad/nokia-ont-mib-parser">MIB file parser</a> for NOKIA's GPON ONTs (*helps you parsing the .mib file located in `/mnt/rwdir`*) + + diff --git a/_ont/ont-nokia-g-010g-q.md b/_ont/ont-nokia-g-010g-q.md new file mode 100644 index 0000000..6be1d8c --- /dev/null +++ b/_ont/ont-nokia-g-010g-q.md @@ -0,0 +1,74 @@ +--- +title: Nokia G-010G-Q +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| --------------------- | ------------------------------------------------------------------------------------------------------------------ | +| Vendor | Nokia | +| Model | G-010G-Q | +| Chipset | Realtek RTL9601B | +| Flash | Winbond [W25Q128JV](https://www.winbond.com/resource-files/w25q128jv%20revf%2003272018%20plus.pdf) 3V 128M-BIT SPI | +| RAM | DDR2 325MHz | +| System | Linux (Luna SDK) | +| HSGMII | No | +| Optics | SC/APC | +| IP address | 192.168.100.1 | +| Web Gui (HTTP) | ✅ Port 80 (⚠️ *only available when the PON connection **IS NOT** estabilished*) | +| Web Gui (HTTPS) | ✅ Port 443 **NO SSL SUPPORT** | +| Web Gui Default Login | user `admin` password `1234` | +| SSH | | +| Form Factor | ONT | + +## Hardware revisions + +{% include image.html file="g-010g-q.png" alt="G-010G-Q " caption="Nokia G-010G-Q" %} + +## List of software versions +## List of partitions + +| dev | size | erasesize | name | +| ---- | -------- | --------- | -------- | +| mtd0 | 00080000 | 00010000 | "Boot" | +| mtd1 | 00180000 | 00010000 | "Config" | +| mtd2 | 00700000 | 00010000 | "ImageA" | +| mtd3 | 00700000 | 00010000 | "ImageB" | + +This ont seems to support dual boot (notice partitions "ImageA" and "ImageB"), however this has not been tested. +## List of firmwares and files + +# Serial +{% include image.html file="g-010g-q-serial-pinout.jpg" alt="G-010G-Q " caption="G-010G-Q: serial pinout" %} +You can easily communicate with the ONT using a TTL converter (for example the CH341A programmer in TTL mode) by connecting the converters' pins to the ONT following the pinout shown in the image above + +*You don't actually need the two VCC pins, just use TX/RX and GND* + +{% include alert.html content="The ONT's serial logic is 3V3." alert="Warning" icon="svg-warning" color="red" %} + +Make sure the logic of your TTL converter is 3V3 too otherwise you might damage the ONT, in my case I wasn't sure the CH341A had a 3V3 logic for the TTL part so I set up a voltage divider made of 2 resistors between the TX pin and ground as shown in the image below. + +*Also make sure that your TTL converter RX pin voltage threshold is less than (or equal to) 3V3* + +{% include image.html file="g-010g-q-serial-voltage-divider.png" alt="G-010G-Q " caption="G-010G-Q: simple serial level converter" %} + +Once you've done all that, you can use the TTY client you wish, such as PuTTY, set its baud rate to 115200 and open the connection, then you can start the ONT + +You'll see a shell-like prompt: +``` +ONT> +``` +Here you'll have to type `enable` and then `login`, unfortunately there is no default username and password + +Once you're logged in, a custom menu will be shown, and you'll be able to access the linux shell by first typing `system` and finally `shell` + +To exit the shell and reach the parent menu type `exit` or `x`, in each menu the `help` command will show how to use the shell + +# Known Bugs + +# Miscellaneous Links +- <a href="https://github.com/nanomad/nokia-ont-mib-parser">MIB file parser</a> for NOKIA's GPON ONTs (*helps you parsing the .mib file located in `/mnt/rwdir`*) + + diff --git a/_ont/ont-nokia-g-010s-a.md b/_ont/ont-nokia-g-010s-a.md new file mode 100644 index 0000000..e6669a9 --- /dev/null +++ b/_ont/ont-nokia-g-010s-a.md @@ -0,0 +1,64 @@ +--- +title: Nokia G-010S-A +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ---------------------------------------- | +| Vendor | Nokia | +| Model | G-010S-A | +| Chipset | Lantiq PEB98035 | +| Flash | 16 MB | +| RAM | 64 MB | +| System | OpenWRT | +| HSGMII | Yes | +| Optics | SC/UPC | +| IP address | 192.168.1.10 | +| Web Gui | ✅ user `adminadmin`, password `ALC#FGU` | +| SSH | ✅ user `ONTUSER`, password `SUGAR2A041` | +| Form Factor | miniONT SFP | + +{% include image.html file="g-010s-a.png" alt="G-010S-A" caption="G-010S-A" %} +{% include image.html file="g-010s-a-teardown.jpg" alt="G-010S-A Teardown" caption="G-010S-A Teardown" %} + + +## Modifying firmware + +Turning a [Nokia G-010S-P](ont-nokia-g-010s-p) into a [Nokia G-010S-A](ont-nokia-g-010s-a) is possible by changing layout from mtd + +## List of software versions + +- [https://github.com/hwti/G-010S-A/tree/main/firmwares](https://github.com/hwti/G-010S-A/tree/main/firmwares) + +## List of partitions +## List of firmwares and files + +## Serial + +``` +USB TTL(UART) Adapter ------- SFP 20pins Molex connector +3.3V ---red ------------------pin #15 and #16 +TX -----orange ---------------pin #3 +RX -----yellow ---------------pin #6 +GND ----green --------------- pin #10 +``` +Configuration: asc0=0 115200 8-N-1 + +## Disabling Dying Gasp +```sh +uci set gpon.gtc.nDyingGaspEnable='0'; uci commit gpon +``` + +# HW Modding + +- [Nokia G-010S-A Pin 6 Iusse - Rsaxvc.net](https://rsaxvc.net/blog/2020/8/15/Nokia_G-010S-A_Pin_6_Issue.html) + +# Known Bugs + +# Miscellaneous Links + +- [G-010S-A](https://github.com/hwti/G-010S-A) + diff --git a/_ont/ont-nokia-g-010s-p.md b/_ont/ont-nokia-g-010s-p.md new file mode 100644 index 0000000..d8ee2c6 --- /dev/null +++ b/_ont/ont-nokia-g-010s-p.md @@ -0,0 +1,76 @@ +--- +title: Nokia G-010S-P +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ---------------------------------------------------------------- | +| Vendor | Nokia | +| Model | G-010S-P | +| Chipset | Lantiq PEB98035 | +| Flash | 16 MB | +| RAM | 64 MB | +| System | OpenWRT | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | | +| Web Gui | ✅ [after enabling](https://www.dslreports.com/forum/r32458588-) | +| SSH | ✅ user `ONTUSER`, password `SUGAR2A041` | +| Form Factor | miniONT SFP | + +{% include image.html file="g-010s-p.jpg" alt="G-010S-P" caption="G-010S-P" %} +<br/> +{% include image.html file="g-010s-p-and-ma5671a.jpg" alt="G-010S-P and MA5671A Teardown" caption="G-010S-P and MA5671A Teardown" %} +<br/> +{% include alert.html content="G-010S-P and other models will not expose ethernet interface unless fiber cable is connected ([source](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300))" alert="Warning" icon="svg-warning" color="yellow" %} + +## Firmware is interchangeable with: +- [Huawei MA5671A](ont-huawei-ma5671a) +- [Nokia G-010S-P](ont-nokia-g-010s-p) +- [ONT FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](ont-SourcePhotonics-SPS-34-24T-HP-TDFO) +- [Hilink HL23446](ont-Hilink-HL23446) +- {:.text-red-200 } Dasan H650SFP +- {:.text-red-200 } DpOptics D23446 + +Turning a [Nokia G-010S-P](ont-nokia-g-010s-p) into a [Nokia G-010S-A](ont-nokia-g-010s-a) is possible by changing layout from mtd + +## Serial + +``` +USB TTL(UART) Adapter ------- SFP 20pins Molex connector +3.3V ---red ------------------pin #15 and #16 +TX -----orange ---------------pin #2 +RX -----yellow ---------------pin #7 +GND ----green --------------- pin #10 +``` +Configuration: asc0=0 115200 8-N-1 + +## List of software versions +## List of partitions + +| dev | size | erasesize | name | +| ---- | -------- | --------- | -------- | +|mtd0 | 00040000 | 00010000 | "uboot" | +|mtd1 | 00080000 | 00010000 | "uboot_env" | +|mtd2 | 00740000 | 00010000 | "linux" | +|mtd3 | 0061eedc | 00010000 | "rootfs" | +|mtd4 | 00370000 | 00010000 | "rootfs_data" | +|mtd5 | 00800000 | 00010000 | "image1" | + +## List of firmwares and files + +## Disabling Dying Gasp +```sh +fw_setenv nDyingGaspEnable 0 +``` + +# Known Bugs +# Miscellaneous Links + +- [alcatel_lucent-lantiq_falcon](https://github.com/minhng99/alcatel_lucent-lantiq_falcon) +- [uboot lantiq falcon](https://github.com/minhng99/u-boot_lantiq_falcon) + + diff --git a/_ont/ont-nokia-g-010s-q.md b/_ont/ont-nokia-g-010s-q.md new file mode 100644 index 0000000..53d9dad --- /dev/null +++ b/_ont/ont-nokia-g-010s-q.md @@ -0,0 +1,31 @@ +--- +title: Nokia G-010S-Q +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------- | +| Vendor | Nokia | +| Model | RTL9601CI | +| Chipset | | +| Flash | | +| RAM | | +| System | | +| HSGMII | | +| Optics | | +| IP address | | +| Web Gui | | +| SSH | | +| Form Factor | miniONT SFP | + + +## List of software versions +## List of partitions +## List of firmwares and files +# Known Bugs +# Miscellaneous Links + + diff --git a/_ont/ont-odi-realtek-dfp-34x-2c2.md b/_ont/ont-odi-realtek-dfp-34x-2c2.md new file mode 100644 index 0000000..ebf4019 --- /dev/null +++ b/_ont/ont-odi-realtek-dfp-34x-2c2.md @@ -0,0 +1,151 @@ +--- +title: ODI Realtek DFP-34X-C2C (XPON) +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | --------------------------------- | +| Vendor | ODI | +| Model | DFP-34X-C2C | +| Chipset | Realtek RTL9601D | +| Flash | 8 MB | +| RAM | 64 MB | +| System | Linux (Luna SDK) | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | 192.168.1.1 | +| Web Gui | ✅ user `admin`, password `admin` | +| SSH | ✅ user `admin`, password `admin` | +| Form Factor | miniONT SFP | + +{% include alert.html content="SSH uses an outdated set of algorithm/ciphers, you can connect using the following command:" alert="Note" icon="svg-info" color="blue" %} + +```shell +ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oCiphers=+3des-cbc admin@192.168.1.1 +``` + +{% include image.html file="odi.jpg" alt="ODI DFP-34X-C2C" caption="ODI DFP-34X-C2C" %} + + +## Firmware is interchangeable with: + +- [ODI DFP-34X-C2C](ont-ODI-DFP-34X-C2C) +- [VSOL V2801F](ont-vsol-V2801F) +- [TWCGPON657](ont-TWCGPON657) +- [UFiber UF-Instant](ont-UFiber-UF-Instant) +- [DFP-34X-2C2](ont-DFP-34X-2C2) +- [CarlitoxxPro CPGOS03-0490 v2](ont-CarlitoxxPro-CPGOS03-0490-v2) + +## List of software versions +- V1.0-220530 Modded by [stich86](https://github.com/stich86) **SUGGESTED** since it has working VLAN translation. Download link: [github.com](https://github.com/Anime4000/RTL960x/files/8821809/M114_sfp_ODI_hybrid_220527_stich86_220530.tar.zip) +- V1.0-220414 +- V1.0-220304 + +## List of partitions + +| dev | size | erasesize | name | +| ----- | -------- | --------- | --------------- | +| mtd0 | 00040000 | 00001000 | "boot" | +| mtd1 | 00002000 | 00001000 | "env" | +| mtd2 | 00002000 | 00001000 | "env2" | +| mtd3 | 0003c000 | 00001000 | "config" | +| mtd4 | 0014c000 | 00001000 | "k0" | +| mtd5 | 00274000 | 00001000 | "r0" | +| mtd6 | 0014c000 | 00001000 | "k1" | +| mtd7 | 00274000 | 00001000 | "r1" | +| mtd8 | 00001000 | 00001000 | "Partition_008" | +| mtd9 | 00001000 | 00001000 | "Partition_009" | +| mtd10 | 00001000 | 00001000 | "Partition_010" | +| mtd11 | 00001000 | 00001000 | "Partition_011" | +| mtd12 | 0014c000 | 00001000 | "linux" | +| mtd13 | 00274000 | 00001000 | "rootfs" | + +This stick supports dual boot. + +`k0` and `r0` respectively contain the kernel and firmware of the first image, `k1` and `r1` the kernel and the firmware of the second one + +# Useful Commands + +## Getting/Setting the ONT's S/N +```sh +# flash get GPON_SN +GPON_SN=TMBB00000000 +# flash set GPON_SN TMBB0A1B2C3D +``` + +## Getting/Setting the ONT's PLOAM password + +{% include alert.html content="The PLOAM password is stored in HEX format, with no 0x or separator" alert="Note" icon="svg-info" color="blue" %} + +```sh +# flash get GPON_PLOAM_PASSWD +GPON_PLOAM_PASSWD=41414141414141414141 +# flash set GPON_PLOAM_PASSWD 41414141414141414141 +``` + +## Getting/Setting the ONT Vendor ID + +{% include alert.html content="this may need OMCI_OLT_MODE set to 3 to work" alert="Note" icon="svg-info" color="blue" %} + +```sh +# flash get PON_VENDOR_ID +PON_VENDOR_ID=ZTEG +# flash set PON_VENDOR_ID HWTC +``` + +## Getting/Settng the ONT Custom software version +{% include alert.html content="this needs OMCI_OLT_MODE set to 3 and firmware 220530 modded by stich86" alert="Note" icon="svg-info" color="blue" %} + +```sh +# nv setenv sw_custom_version0 YOURFIRSTSWVER +# nv setenv sw_custom_version1 YOURSECONDSWVER +``` + +## Getting/Setting a custom HW Version +{% include alert.html content="this probably needs OMCI_OLT_MODE set to 3" alert="Note" icon="svg-info" color="blue" %} + + +```sh +# flash get HW_HWVER +HW_HWVER=V2.0 +# flash set HW_HWVER MYHWVERSION +``` + +## Getting/Setting a custom ONT Equipment ID +{% include alert.html content="this probably needs OMCI_OLT_MODE set to 3" alert="Note" icon="svg-info" color="blue" %} +```sh +# flash get GPON_ONU_MODEL +GPON_ONU_MODEL=DFP-34X-2C2 +# flash set GPON_ONU_MODEL DFP-34X-XXX +``` + +## Checking the currently active image +```sh +# nv getenv sw_active +sw_active=1 +``` + +## Booting to a different image +```sh +# nv setenv sw_commit 0|1 +# reboot +``` + +## Querying a particular OMCI ME +```sh +# omcicli mib get MIB_IDX +``` + +# Known Bugs + +- Auto-sensing mode to switch between SGMII/HiSGMII + +# Miscellaneous Links + +- [Hacking RTL960x](https://github.com/Anime4000/RTL960x) +- [Ditch ONU, use GPON SFP on Business Grade Router, Mikrotik/Ubiquiti/pfSense (Home Networking)](https://forum.lowyat.net/topic/4925452) + + diff --git a/_ont/ont-odi-zte-dfp-34x-2c2.md b/_ont/ont-odi-zte-dfp-34x-2c2.md new file mode 100644 index 0000000..a64ff4e --- /dev/null +++ b/_ont/ont-odi-zte-dfp-34x-2c2.md @@ -0,0 +1,28 @@ +--- +title: ODI ZTE DFP-34X-C2C (GPON) +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | --------------------------------- | +| Vendor | ODI | +| Model | DFP-34X-C2C | +| CPU | ZTE ZX279125 600Mhz | +| Flash | 64 MB | +| RAM | 256 MB | +| System | | +| HSGMII | | +| Optics | | +| IP address | | +| Web Gui | | +| SSH | | +| Form Factor | miniONT SFP | + + +# Miscellaneous Links + +- [GPON module Dfp-34g-2c2 sfp](https://forum.openwrt.org/t/gpon-module-dfp-34g-2c2-sfp/51641) +- [Ditch ONU, use GPON SFP on Business Grade Router, Mikrotik/Ubiquiti/pfSense (Home Networking)](https://forum.lowyat.net/topic/4925452) diff --git a/_ont/ont-sercomm-fgs202.md b/_ont/ont-sercomm-fgs202.md new file mode 100644 index 0000000..7eb77e7 --- /dev/null +++ b/_ont/ont-sercomm-fgs202.md @@ -0,0 +1,47 @@ +--- +title: Sercomm FGS202 +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | --------------- | +| Vendor | Sercomm | +| Model | FGS202 | +| Chipset | Lantiq PEB98036 | +| Flash | 8 MB | +| RAM | 32 MB | +| System | eCos | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | | +| Web Gui | NO | +| SSH | NO | +| Form Factor | miniONT SFP | + + + +{% include image.html file="fgs202.jpg" alt="Sercomm FGS202" caption="Sercomm FGS202" %} +{% include image.html file="fgs202_teardown.jpg" alt="Sercomm FGS202 teardown" caption="Sercomm FGS202 teardown" %} + +## List of software versions +## List of partitions +## List of firmwares and files + +# HW Modding + +- Pin 7 GND → VCC [Fibra.Click - FAQ: 2.5Gbps su singolo dispositivo su Tim, Vodafone, Fastweb/JustSpeed](https://forum.fibra.click/d/27574-faq-25gbps-su-singolo-dispositivo-su-timvodafonefastwebjustspeed/18) +- Only for Ubiquiti [OpenWRT Forum - Support for GPON SFP](https://forum.openwrt.org/t/support-for-gpon-sfp-fgs202/42641/47) + +# Known Bugs + +# Miscellaneous Links + +- [Support for GPON SFP FGS202](https://forum.openwrt.org/t/support-for-gpon-sfp-fgs202/42641/60) +- [SerComm FGS202](https://wikidevi.wi-cat.ru/SerComm_FGS202) + + + + diff --git a/_ont/ont-sourcephotonics-sps-34-24t-hp-tdfo.md b/_ont/ont-sourcephotonics-sps-34-24t-hp-tdfo.md new file mode 100644 index 0000000..483fcc6 --- /dev/null +++ b/_ont/ont-sourcephotonics-sps-34-24t-hp-tdfo.md @@ -0,0 +1,6 @@ +--- +title: SourcePhotonics SPS-34-24T-HP-TDFO +has_children: false +redirect_to: ont-fs-com-gpon-onu-stick-with-mac +layout: default +---
\ No newline at end of file diff --git a/_ont/ont-t-w-tw2362h-cdel.md b/_ont/ont-t-w-tw2362h-cdel.md new file mode 100644 index 0000000..a0ad2ae --- /dev/null +++ b/_ont/ont-t-w-tw2362h-cdel.md @@ -0,0 +1,6 @@ +--- +title: T&W TW2362H-CDEL +has_children: false +redirect_to: ont-zyxel-pmg3000-d20b +layout: default +---
\ No newline at end of file diff --git a/_ont/ont-technicolor-afm0002.md b/_ont/ont-technicolor-afm0002.md new file mode 100644 index 0000000..9328dab --- /dev/null +++ b/_ont/ont-technicolor-afm0002.md @@ -0,0 +1,243 @@ +--- +title: Technicolor AFM0002 +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------------------------------------------- | +| Vendor | Technicolor | +| Model | AFM0002TIM/FWB/WND | +| Chipset | Realtek RTL9601B | +| Flash | | +| RAM | | +| System | Linux (Luna SDK) | +| HSGMII | NO | +| Optics | | +| IP address | 192.168.2.1 / 169.0.0.1 | +| Web Gui | Can be enabled, user `admin`, password `system` | +| SSH | ✅ user `admin`, password `system` | +| Form Factor | miniONT SFP | + +{% include image.html file="afm0002tim.jpg" alt="AFM0002TIM" caption="AFM0002TIM" %} +{% include image.html file="afm0002fwb.jpg" alt="AFM0002FWB" caption="AFM0002FWB" %} + +## Serial + +Configuration: asc0=0 115200 8-N-1 + +# Hardware Revisions + +- AFM0002TIM (IP address: 192.168.2.1) +- AFM0002FWB (IP address: 169.0.0.1) +- AFM0002WND (IP address: 169.0.0.1) + +{% include alert.html content="The version used to obtain the info shown on this page is the AFM0002TIM" alert="Info" icon="svg-info" color="blue" %} +{% include alert.html content="The AFM0002FWB can be transformed into AFM0002TIM. The AFM0002FWB has an older software version." alert="Warning" icon="svg-warning" color="red" %} + + +# List of software versions +- V1_7_8_180122 +- V1_7_8_180725 +- V1_7_8_181123 +- V1_7_8_210412 +- V1_7_8_210928 + +# List of partitions + +| dev | size | erasesize | name | +| ----- | -------- | --------- | --------------- | +| mtd0 | 00040000 | 00001000 | "boot" | +| mtd1 | 00002000 | 00001000 | "env" | +| mtd2 | 00002000 | 00001000 | "env2" | +| mtd3 | 0003c000 | 00001000 | "config" | +| mtd4 | 00300000 | 00001000 | "k0" | +| mtd5 | 004c0000 | 00001000 | "r0" | +| mtd6 | 00300000 | 00001000 | "k1" | +| mtd7 | 004c0000 | 00001000 | "r1" | +| mtd8 | 00001000 | 00001000 | "Partition_008" | +| mtd9 | 00001000 | 00001000 | "Partition_009" | +| mtd10 | 00001000 | 00001000 | "Partition_010" | +| mtd11 | 00001000 | 00001000 | "Partition_011" | +| mtd12 | 00300000 | 00001000 | "linux" | +| mtd13 | 004c0000 | 00001000 | "rootfs" | + +This stick supports dual boot. + +`k0` and `r0` respectively contain the kernel and firmware of the first image, `k1` and `r1` the kernel and the firmware of the second one + +# List of firmwares and files +## Useful files +- `/var/config/lastgood.xml` - Contains the user portion of the configuration +- `/var/config/lastgood-hs.xml` - Contains the "hardware" configuration (i.e. that _should_ not be changed) +- `/tmp/omcilog` - OMCI messages logs (must be enabeled, see below) + +## Useful binaries +- `/etc/scripts/flash` - Used to manipulate the config files in a samewhat safe manner +- `xmlconfig` - Used to low-level manipulate the XML config files. Called by `flash` +- `nv` - Used to manipulate the nvram storage, including persistent config entries via `nv setenv`/`nv getenv` +- `omcicli` - Used to interact with the running OMCI daemon +- `omci_app` - The OMCI daemon +- `diag` - Used to run low-level diagnostics commands on the stick + +# Useful Commands + +## Getting/Setting the ONT's S/N +```sh +# /etc/scripts/bin flash get GPON_SN +GPON_SN=TMBB00000000 +# /etc/scripts/bin flash set GPON_SN TMBB0A1B2C3D +``` + +## Getting/Setting the ONT's PLOAM password + +{% include alert.html content="The PLOAM password is stored in ASCII format" alert="Info" icon="svg-info" color="blue" %} + +```sh +# /etc/scripts/bin flash get GPON_PLOAM_PASSWD +GPON_PLOAM_PASSWD=AAAAAAAAAA +# /etc/scripts/bin flash set GPON_PLOAM_PASSWD AAAAAAAAAA +``` + +## Enabling the Web UI +```sh +# /bin/iptables -D INPUT -p tcp --dport 80 -j DROP +``` + +## Checking the currently active image +```sh +# nv getenv sw_active +sw_active=1 +# nv getenv sw_version0 +sw_version0=V1_7_8_210412 +# nv getenv sw_version1 +sw_version1=V1_7_8_210412 +``` + +## Booting to a different image +```sh +# nv setenv sw_commit 0|1 +# reboot +``` + +## Querying a particular OMCI ME +```sh +# omcicli mib get MIB_IDX +``` + +# Low Level Modding + +{% include alert.html content="This section is based on `V1_7_8_210412` firmware version of the stick" alert="Info" icon="svg-info" color="blue" %} + + +## Transfering files from/to the stick +Works with binary files too, just run md5sum on source and destination to make sure you are not corrupting anything... +From the stick to the PC: +```sh +# ssh admin@192.168.2.1 "cat /tmp/omcilog" > omcilog.log +``` +From the PC to the stick +```sh +# cat lastgood.xml | ssh admin@192.168.2.1 "cat > /var/config/lastgood.xml" +``` + +{% include alert.html content="If a Windows system is used replace type with cat and run the commands from cmd (not Powershell)" alert="Info" icon="svg-info" color="blue" %} + +## Extracting and repacking the rootfs +{% include alert.html content="Make sure you run both commands as root, otherwise you might get a damaged rootfs image" alert="Warning" icon="svg-warning" color="red" %} + +```sh +# unsquashfs mtd5.bin +# mksquashfs squashfs-root rootfs -b 131072 -comp lzma -no-recovery +``` +## Flashing a new rootfs + +{% include alert.html content="Only the inactive image can be flashed" alert="Info" icon="svg-info" color="blue" %} + +So mtd4/5 if you are on image1, mtd6/7 if you are on image0. + +The follwing examples flashes a new rootfs to image1 and boots to it +```sh +# flash_eraseall /dev/mtd7 +# cat /tmp/rootfs.new > /dev/mtd7 +# nv setenv sw_commit=1 +# reboot +``` +## Adding support to configurable SW and HW versions, VENDOR ID and much more +`/etc/scripts/flash` can be flashed in order to add support for some variables implemented in `omci_app` but removed from `xmlconfig`. The patch is below (change the values to suit your needs) +```patch +--- squashfs-root/etc/scripts/flash 2021-09-28 10:38:52.000000000 +0200 ++++ squashfs-root.new/etc/scripts/flash 2022-08-04 00:00:29.769605000 +0200 +@@ -62,7 +62,26 @@ + if [ `echo $para | egrep $specific_mib_patten` ]; then + /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g" | sed -r "s/,+//g" + else +- /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g" ++ case "$para" in ++ "OMCI_EQID") ++ echo "$para=MY_EQID" ++ ;; ++ "OMCI_VENDOR_ID") ++ echo "$para=MY_VENDOR" ++ ;; ++ "OMCI_SW_VER1") ++ echo "$para=MY_SW_VER1" ++ ;; ++ "OMCI_SW_VER2") ++ echo "$para=MY_SW_VER2" ++ ;; ++ "OMCI_ONT_VER") ++ echo "$para=MY_HW_VER" ++ ;; ++ *) ++ /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g" ++ ;; ++ esac + fi + if [ "$?" = "0" ]; then + exit 0 +``` +## Increasing the length of the software version from 13 to 14 characters +`omci_app` has an hard-coded limit of 13 characters for the software version, which is too low. We can binary patch it to increase it to 14 (or more, if you dare/need) +``` +JVhEWjAwNCUAAAAIAAgACAAAAAAAAAAAAAAAAAAAAABvbWNpX2FwcG9tY2lfYXBwH4sIAAAAAAAA +AwMAAAAAAAAAAAAfiwgAAAAAAAADY2BoYGZgYFjh9Uq/aNcZQdXsOh3R5ktr/fd0sTEwcuTnJmfG +JxYUYJVlZGAA0gCHsMK2QQAAAAAAAEQlWERaMDA0JQ== +``` +Save it as `omci_app.xdelta.base64`, then run: +```sh +# base64 -d omci_app.xdelta.base64 > omci_app.xdelta +# xdelta patch omci_app.xdelta bin/omci_app bin/omci_app.new +# mv bin/omci_app.new bin/omci_app +``` +For reference, the patch changes the follwing section of the omci_app: +```diff +-00408c24 24 05 00 0e li a1,0xe ++00408c24 24 05 00 0f li a1,0xf +-00408cf0 24 05 00 0f li a1,0xe ++00408cf0 24 05 00 0f li a1,0xf +``` +(It's inside the function referecing the string `OMCI_SW_VER1`) + +The original file md5sum is: `4aea2f72bacc11256b7e2c1583d2ad4f` +The patched file md5sum is: `da20327c4c002e4c27f82f6ee63dbc1a` +## Enabling PLOAM logging +```sh +/etc/scripts/bin flash set OMCI_DBGLVL 1 +/etc/scripts/bin flash set OMCI_DBGLOGFILE 1 +reboot +/bin/omcicli set logfile 1 ffffffff +``` +1. The binary log will be placed inside: `/tmp/omcilog` +2. You can convert it into .pcap using [omcilog2pcap](https://github.com/ADeltaX/omcilog2pcap) +3. You can then open it with Wireshark by installing the OMCI plugin from [wireshark](https://wiki.wireshark.org/Contrib.md) + +If you want to log everything since the stick boots, you can create a custom rootfs. Place the last command inside `etc/runomci.sh` as the last line of the file + +# Known Bugs + +# Miscellaneous Links + +- [omcilog2pcap](https://github.com/ADeltaX/omcilog2pcap) diff --git a/_ont/ont-twcgpon657.md b/_ont/ont-twcgpon657.md new file mode 100644 index 0000000..2250a9c --- /dev/null +++ b/_ont/ont-twcgpon657.md @@ -0,0 +1,45 @@ +--- +title: TWCGPON657 +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------------- | +| Vendor | | +| Model | TWCGPON657 | +| Chipset | Realtek RTL9601CI | +| Flash | 16 MB | +| RAM | 64 MB | +| System | Linux (Luna SDK) | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | | +| Web Gui | ✅ | +| SSH | ✅ | +| Form Factor | miniONT SFP | + +## Firmware is interchangeable with: + +- [VSOL V2801F](ont-vsol-v2801f) +- [TWCGPON657](ont-twcgpon657) +- [UFiber UF-Instant](ont-ufiber-uf-instant) + +## List of software versions +## List of partitions +## List of firmwares and files + +# Known Bugs + +VLAN swap issue (MEID 171), auto-sensing mode to switch between SGMII/HiSGMII + +You should use the VID/VLAN shown by executing the command "omcicli mib get 84" via telnet to bring up PPPoE + + +# Miscellaneous Links + +- [Hacking RTL960x](https://github.com/Anime4000/RTL960x) + + diff --git a/_ont/ont-ufiber-uf-instant.md b/_ont/ont-ufiber-uf-instant.md new file mode 100644 index 0000000..4d2180c --- /dev/null +++ b/_ont/ont-ufiber-uf-instant.md @@ -0,0 +1,50 @@ +--- +title: UFiber UF-Instant +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------------- | +| Vendor | UFiber | +| Model | UFiber UF-Instant | +| Chipset | Realtek RTL9601CI | +| Flash | 16 MB | +| RAM | 64 MB | +| System | Linux (Luna SDK) | +| HSGMII | No | +| Optics | SC/APC | +| IP address | | +| Web Gui | ✅ | +| SSH | ✅ | +| Form Factor | miniONT SFP | + +## Firmware is interchangeable with: + +{% include alert.html content="The UFiber UF-Instant can be used as universal GPON stick with V2801F rootfs, but only with stock UF kernel (4.3.1/4.4.2): needed for Laser controller." alert="Info" icon="svg-info" color="blue" %} + + +- [VSOL V2801F](ont-vsol-v2801f) +- [TWCGPON657](ont-twcgpon657) +- [UFiber UF-Instant](ont-ufiber-uf-instant) + + +## List of software versions +## List of partitions +## List of firmwares and files + +# Know Bugs + +VLAN swap issue (MEID 171), auto-sensing mode to switch between SGMII/HiSGMII + +You should use the VID/VLAN shown by executing the command "omcicli mib get 84" via telnet to bring up PPPoE + + +# Miscellaneous Links + +- [Hacking RTL960x](https://github.com/Anime4000/RTL960x) +- [UF INstant Mod](https://github.com/stich86/UF-Instant-Mod) +- [SFP GPON ONU](https://github.com/zry98/SFP-GPON-ONU) +- [UFiber.Configurator](https://github.com/Unifi-Tools/UFiber.Configurator) diff --git a/_ont/ont-vsol-v2801f.md b/_ont/ont-vsol-v2801f.md new file mode 100644 index 0000000..761e86d --- /dev/null +++ b/_ont/ont-vsol-v2801f.md @@ -0,0 +1,43 @@ +--- +title: VSOL V2801F +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------------- | +| Vendor | VSOL | +| Model | V2801F | +| Chipset | Realtek RTL9601CI | +| Flash | 8 MB | +| RAM | 64 MB | +| System | Linux (Luna SDK) | +| HSGMII | No | +| Optics | SC/APC | +| IP address | | +| Web Gui | ✅ | +| SSH | ✅ | +| Form Factor | miniONT SFP | + +## Firmware is interchangeable with: + +- [VSOL V2801F](ont-vsol-v2801f) +- [TWCGPON657](ont-twcgpon657) +- [UFiber UF-Instant](ont-ufiber-uf-instant) + +## List of software versions +## List of partitions +## List of firmwares and files + +# Known Bugs + +VLAN swap issue (MEID 171), auto-sensing mode to switch between SGMII/HiSGMII + +You should use the VID/VLAN shown by executing the command "omcicli mib get 84" via telnet to bring up PPPoE + +# Miscellaneous Links + +- [Hacking RTL960x](https://github.com/Anime4000/RTL960x) +- [SFP GPON ONU](https://github.com/zry98/SFP-GPON-ONU) diff --git a/_ont/ont-ziza-op151s.md b/_ont/ont-ziza-op151s.md new file mode 100644 index 0000000..7099805 --- /dev/null +++ b/_ont/ont-ziza-op151s.md @@ -0,0 +1,6 @@ +--- +title: Ziza OP151S +has_children: false +redirect_to: ont-zyxel-pmg3000-d20b +layout: default +---
\ No newline at end of file diff --git a/_ont/ont-zte-f6005.md b/_ont/ont-zte-f6005.md new file mode 100644 index 0000000..e9ea670 --- /dev/null +++ b/_ont/ont-zte-f6005.md @@ -0,0 +1,42 @@ +--- +title: ZTE F6005 +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | --------------------------------- | +| Vendor | ZTE | +| Model | F6005 | +| Chipset | Realtek RTL9601D | +| Flash | | +| RAM | | +| System | Linux (ZTE custom SDK) | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | 192.168.1.1 | +| Web Gui | ✅ user `admin`, password `admin` | +| SSH | | +| Form Factor | ONT | + +{% include image.html file="f6005_of.jpg" alt="F6005 Open Fiber" caption="F6005 with Open Fiber branding <a href='https://forum.fibra.click/u/mirko991'>@mirko991</a>" %} +{% include image.html file="f6005_tim.jpg" alt="F6005 TIM" caption="F6005 with ZTE branding, like the ones used by TIM" %} +{% include image.html file="f6005_teardown.jpg" alt="F6005 teardown" caption="F6005 teardown" %} + + +## List of software versions +- V6.0.10N14 +- V6.0.10P2N02 + +## List of partitions +## List of firmwares and files + +# Known Bugs + +Buffer size is suboptimal, because of this the ONT can't keep up working at full speed during uploads if the server is geographically, and so latency-wise, far. There are no known problems with multiple connections. + +# Miscellaneous Links + + diff --git a/_ont/ont-zte-f601.md b/_ont/ont-zte-f601.md new file mode 100644 index 0000000..f72ae7f --- /dev/null +++ b/_ont/ont-zte-f601.md @@ -0,0 +1,79 @@ +--- +title: ZTE F601 +has_children: false +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------------------------------------------------------------- | +| Vendor | ZTE | +| Model | F601 | +| SoC/CPU | v6: ZTE FA626TE 266 MHz, v7: ZTE ZX279125@A9,600MHZ | +| Chipset | | +| Flash | v6, v7: 16 MB | +| RAM | v6: 64 MB, v7: 32 MB | +| System | | +| HSGMII | No | +| Optics | SC/APC | +| IP address | 192.168.1.1 | +| Web Gui | ✅ user `admin`, password `admin` or user `user`, password `user` | +| SSH | | +| Form Factor | ONT | + +{% include image.html file="f601_v6_1.jpg" alt="F601 v6" caption="F601 v6" %} +{% include image.html file="f601_v7.jpg" alt="F601 v7" caption="A wall made out of broken F601 v7s" %} +{% include image.html file="f601_v8.jpg" alt="F601 v9" caption="F601 v9 <a href='https://forum.fibra.click/u/ftthless'>@ftthless</a>" %} + + +## Hardware revisions +- v6: big +* CPU: ZTE FA626TE 266 MHz +* RAM: 64 MiB +* ROM: SPI Flash w25q128 16 MiB +- v7: small, Huawei HG8010H-like exterior, some production batches have self-destruction functionality +* CPU: ZTE ZX279125@A9,600MHZ +* RAM: 32 MiB +* ROM: SPI Flash mx25l12805d 16 MiB +- v8: small, Huawei HG8010H-like exterior + +## List of software versions +### HW V6.0 +- V6.0.10P6T1 +- V6.0.10P6T4 +- V6.0.10P6N7 + +### HW V7.0 +- V7.0.10P6N7 + +### HW V9.0 +- V9.0.10P2N1 + +## List of partitions +## List of firmwares and files +# Known Bugs +# Random notes +- the F601v7 is mounted 'upside down' to save on waveguides, the LEDs would be on the bottom of the PCB, so it would have to be turned upside down to make it cooler... +- the F601v6 turns on and runs even with 9 V input +- F601v7 turns on and runs even with 5 V input +# Miscellaneous Links + + +# Theardown and other photos + +## HW V6.0 + +{% include image.html file="f601_v6_2.jpg" alt="Bottom of the F601 v6" caption="Bottom of the F601 v6 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} +{% include image.html file="f601_v6_Teardown_1.jpg" alt="Teardown of the F601 v6" caption="Teardown of the F601 v6 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} +{% include image.html file="f601_v6_Teardown_2.jpg" alt="Teardown of the F601 v6" caption="Teardown of the F601 v6 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} +{% include image.html file="f601_v6_Teardown_3.jpg" alt="Teardown of the F601 v6" caption="Teardown of the F601 v6 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} + +## HW V7.0 + +{% include image.html file="f601_v7_1.jpg" alt="Bottom of the F601 v7" caption="Bottom of the F601 v6 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} +{% include image.html file="f601_v7_Teardown.jpg" alt="Bottom of the F601 v7" caption="Teardown of the F601 v7 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} +{% include image.html file="f601_v7_Teardown_1.jpg" alt="Teardown of the F601 v7" caption="Teardown of the F601 v7 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} +{% include image.html file="f601_v7_Teardown_2.jpg" alt="Teardown of the F601 v7" caption="Teardown of the F601 v7 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} +{% include image.html file="f601_v7_Teardown_3.jpg" alt="Teardown of the F601 v7" caption="Teardown of the F601 v7 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} +{% include image.html file="f601_v7_Teardown_4.jpg" alt="Teardown of the F601 v7" caption="Teardown of the F601 v7 <a href='https://forum.fibra.click/u/LATIITAY'>@LATIITAY</a>" %} diff --git a/_ont/ont-zyxel-pmg3000-d20b.md b/_ont/ont-zyxel-pmg3000-d20b.md new file mode 100644 index 0000000..ed41642 --- /dev/null +++ b/_ont/ont-zyxel-pmg3000-d20b.md @@ -0,0 +1,160 @@ +--- +title: Zyxel PMG3000-D20B +has_children: false +alias: Ziza OP151S, T&W TW2362H-CDEL +layout: default +--- + +# Hardware Specifications + +| | | +| ----------- | ----------------------------------------------- | +| Vendor | Zyxel | +| Model | PMG3000-D20B | +| Chipset | Lantiq PEB98035 | +| Flash | 8 MB | +| RAM | 64 MB | +| System | OpenWRT | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | 10.10.1.1 | +| Web Gui | ✅ username `admin`, password `admin` or `1234` | +| SSH | ✅ username `admin`, password `admin` or `1234` | +| Form Factor | miniONT SFP | + +{% include image.html file="pmg3000-d20b.png" alt="PMG3000-D20B" caption="PMG3000-D20B" %} +{% include image.html file="op151s.png" alt="Ziza OP151S" caption="Ziza OP151S" %} + +Once you access the stick via ssh you will be presented with a second tier login. The credentials to access the zyxel shell are: username: `twmanu` , password: `twmanu`. +From the zyxel shell you can move to a standard linux shell via the `linuxshell` command + +## Firmware is interchangeable with: + +- [Zyxel PMG3000-D20B](ont-Zyxel-PMG3000-D20B) +- [Halny HL-GSFP](ont-Halny-HL-GSFP) +- [D-LINK DPN-100-Rev-A2](ont-D-LINK-DPN-100-Rev-A2) +- [Ziza OP151s](ont-ziza-op151s) +- [T&W TW2362H-CDEL](ont-T-W-TW2362H-CDEL) + +# List of software versions + +# List of partitions + +| dev | size | erasesize | name | +| ---- | -------- | --------- | -------------- | +| mtd0 | 00060000 | 00010000 | "Boot" | +| mtd1 | 00010000 | 00010000 | "Env" | +| mtd2 | 00390000 | 00010000 | "ImageA" | +| mtd3 | 00390000 | 00010000 | "ImageB" | +| mtd4 | 00060000 | 00010000 | "Config" | +| mtd5 | 00010000 | 00010000 | "SECTION_EGIS" | +| mtd6 | 00250000 | 00010000 | "rootfs" | +| mtd7 | 00020000 | 00010000 | "rootfs_data" | + + +This stick supports dual boot, as visible from the presence of `ImageA` and `ImageB`, which contain the rootfs. + + +# List of firmwares and files +## Useful files +- `/var/config/ont.sys` used to customize various settings on the stick. If you don't have it you can copy the stock one from /ont.sys + +# Useful Commands +*Note: all commands start from the twmanu shell* + +## Changing the ONT's S/N +*Note the S/N is stored in the ASCII format* +```sh +manufactory +set sn ALCLf0f0f0f0 +exit +hal +set sn ALCLf0f0f0f0 +``` + +## Changing the ONT's PLOAM password +*Note: the PLOAM is stored in the ASCII format* +This can be done easily via web ui. If you prefer to do it via the shell use: +```sh +manufactory +set password PLOAMPASS +``` + +## Changing the ONT's equipment ID +*Note: model number must be 20 no more than chars total* +```sh +manufactory +set equipment id MYEQUIPMENTID +exit +omci +equipment id MYEQUIPMENTID +``` + +## Changing the ONT's hardware version +```sh +manufactory +set hardware version 3FE49165BFAA01 +``` + +## Changing the software version +Edit the /var/config/ont.sys via vi directly on the stick itself. The file is CRLF terminated, one entry per line. +The entries for the software version are: +``` +SW_VER0:0xabcdef +SW_VER1:0xabcedf +``` +*Note: it's better to enter the software version in hex format, all lowercase precedeed by 0x.* + +## Querying a particular OMCI ME +Query via OMCI ME Class Name +```sh +omci +show me classname OmciClassName (e.g Ont2g) +``` + +Query via OMCI ME ID +```sh +omci +show me classid OmciClassId (e.g 7) +``` + + +# Low Level Modding + +## Creating a new rootfs +The stick has a tricky image packing method, fortunately it has been reverse engineered. A script to help you create a custom rootfs can be found here: [https://github.com/nanomad/zyxel-pmg-3000-mod-kit](https://github.com/nanomad/zyxel-pmg-3000-mod-kit) + +## Flashing a new rootfs +*Note: all commands start from the twmanu shell* + +- Transfer the new mtd on the stick via tftp +``` +linuxshell +tftp -gr mtd2.mod.bin TFTP_SERVER_IP +``` +- Flash it on the standby partition. +You can use `system` and then `show actimage` to get the current active image. Check `/proc/mtd` for the right mtds. Usually: +- if the currect active image is A the mtd in use is mtd2 +- If the current active image is B the mtd in use is mtd3 +``` +linuxshell +mtd -e /dev/mtd2 write /tmp/mtd2.mod.bin /dev/mtd2 +``` +- Switch to the new image +``` +system +set actimage a +``` +- Reboot the ONT +``` +system +reboot +``` + +# Known Bugs +- [Not working with Broadcom BCM57810S](https://github.com/xvzf/zyxel-gpon-sfp/issues/10) + +# Miscellaneous Links + +- [zyxel gpon- sfp](https://github.com/xvzf/zyxel-gpon-sfp) +- [zyxel pmg-3000 mod kit](https://github.com/nanomad/zyxel-pmg-3000-mod-kit) |