[
{
"path": ".github/workflows/notify-telegram-pr.yml",
"content": "name: notify-telegram-pr\n\non:\n pull_request_target:\n types: [opened, reopened]\n issues:\n types: [opened, reopened]\njobs:\n build:\n name: Notify Telegram\n runs-on: ubuntu-latest\n steps:\n - name: send telegram message on PR opened\n if: github.event.pull_request\n uses: appleboy/telegram-action@master\n with:\n to: ${{ secrets.TELEGRAM_TO }}\n token: ${{ secrets.TELEGRAM_TOKEN }}\n if: github.event.issue\n message: |\n ${{ github.actor }} created PR ${{ github.event.pull_request.title }}\n See changes: ${{ github.event.pull_request.html_url }}\n - name: send telegram message on issue opened\n if: github.event.issue\n uses: appleboy/telegram-action@master\n with:\n to: ${{ secrets.TELEGRAM_TO }}\n token: ${{ secrets.TELEGRAM_TOKEN }}\n if: github.event.issue\n message: |\n ${{ github.actor }} created issue ${{ github.event.issue.title }}\n See issue: ${{ github.event.issue.html_url }}\n"
},
{
"path": ".github/workflows/pages.yml",
"content": "# Sample workflow for building and deploying a Jekyll site to GitHub Pages\nname: Deploy Jekyll site to Pages\n\non:\n # Runs on pushes targeting the default branch\n push:\n branches: [\"main\"]\n\n # Allows you to run this workflow manually from the Actions tab\n workflow_dispatch:\n\n# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages\npermissions:\n contents: read\n pages: write\n id-token: write\n\n# Allow one concurrent deployment\nconcurrency:\n group: \"pages\"\n cancel-in-progress: true\n\njobs:\n # Build job and deploy\n build:\n runs-on: ubuntu-latest\n environment:\n name: github-pages\n url: ${{ steps.deployment.outputs.page_url }}\n steps:\n - name: Checkout\n uses: actions/checkout@v3\n - name: Setup node\n uses: actions/setup-node@v3\n with:\n node-version: 20\n - name: Install Node deps\n run: npm ci\n - name: Compile typescript\n run: npm run build\n - name: Setup Ruby\n uses: ruby/setup-ruby@v1\n with:\n ruby-version: '3.0' # Not needed with a .ruby-version file\n bundler-cache: true # runs 'bundle install' and caches installed gems automatically\n cache-version: 0 # Increment this number if you need to re-download cached gems\n - name: Setup Pages\n id: pages\n uses: actions/configure-pages@v5\n - run: bundle exec jekyll build --baseurl \"${{ steps.pages.outputs.base_path }}\" # defaults output to '/_site'\n env:\n JEKYLL_ENV: production\n - name: Upload artifact\n uses: actions/upload-pages-artifact@v3 # This will automatically upload an artifact from the '/_site' directory\n - name: Deploy to GitHub Pages\n id: deployment\n uses: actions/deploy-pages@v4\n"
},
{
"path": ".github/workflows/preview-pr.yaml",
"content": "name: preview-pr\n\non:\n pull_request_target:\n types: [opened, reopened, synchronize]\n \npermissions:\n pull-requests: write \n \njobs:\n authorize:\n environment:\n ${{ github.event_name == 'pull_request_target' &&\n github.event.pull_request.head.repo.full_name != github.repository &&\n 'external' || 'internal' }}\n runs-on: ubuntu-latest\n steps:\n - run: \"true\"\n \n build:\n needs: authorize\n runs-on: ubuntu-latest\n steps:\n - name: Checkout\n uses: actions/checkout@v3\n with:\n ref: ${{ github.event.pull_request.head.sha }}\n - name: Setup Ruby\n uses: ruby/setup-ruby@v1\n with:\n ruby-version: '3.0'\n bundler-cache: true\n - run: bundle exec jekyll build --baseurl \"\"\n - name: Publish to Cloudflare Pages\n id: preview-pages\n uses: cloudflare/pages-action@v1\n with:\n apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n accountId: ${{ secrets.CLOUDFLARE_ACCOUNT }}\n projectName: hack-gpon-preview\n directory: _site\n branch: preview\n - uses: thollander/actions-comment-pull-request@v2\n with:\n message: |\n Preview of the website obtained from the PR: ${{ steps.preview-pages.outputs.url }}\n\n"
},
{
"path": ".gitignore",
"content": "### Jekyll ###\n_site/\n.sass-cache/\n.jekyll-cache/\n.jekyll-metadata\nGemfile.lock\nassets/js/zzzz-search-data.json\nnode_modules/\nassets/js/generated\n"
},
{
"path": "404.md",
"content": "---\nlayout: default\ntitle: Page not found\npermalink: /404\nnav_exclude: true\nsearch_exclude: true\ndescription: Opps. The page you are looking for got lost.\n\n---\n\n
This is not the ONT you are looking for. Try using the navigation bar {% if site.search_enabled != false %}or search {% endif %}to find what you're looking for or go to the website's home page.
\n\n {%if site.last_edit_timestamp_script and site.gh_owner_name and site.gh_repository_name and page.path %}\n \n {% endif %}\n {% if site.mermaid %}\n \n {% endif %}\n\n\n"
},
{
"path": "_ont/ont-adtran-sdx-611.md",
"content": "---\ntitle: Adtran SDX 611\nhas_children: false\nlayout: default\nparent: Adtran\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | ---------------------------------------- |\n| Vendor/Brand | Adtran |\n| Model | SDX 611 (Adtran-611-V2 REV1.0) |\n| Chipset | Realtek RTL9601D |\n| Flash | 16 MB (Winbond W25Q128JVSQ) |\n| RAM | |\n| System | |\n| Optics | SC/APC (U&T UTG24P05) |\n| 2.5GbaseT | No |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | ✅ |\n| Serial baud | 115200 |\n| Serial encoding | 8-N-1 |\n| Form Factor | ONT |\n\n## Disassembly\n\n1. Remove the two screws hidden under the rubber feet on the back of the unit\n2. Use a plastic pry tool to separate the rear cover, as it is held in place by a snap fit\n\n{% include alert.html content=\"Be careful when prying the rear cover off, the snap fit clips can break easily.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{% include image.html file=\"sdx611-teardown-1.jpg\" alt=\"Adtran SDX 611 Teardown\" caption=\"Adtran SDX 611: Teardown\" %}\n{% include image.html file=\"sdx611-teardown-2.jpg\" alt=\"Adtran SDX 611 Board\" caption=\"Adtran SDX 611: Board\" %}\n{% include image.html file=\"sdx611-board-rev.jpg\" alt=\"Adtran SDX 611 Board Revision\" caption=\"Adtran SDX 611: Board revision (Adtran-611-V2 REV1.0)\" %}\n\n## Serial\n\nThe board has GND, TX and RX headers already soldered. A USB UART adapter such as a CH340G can be used to access the serial console.\n\n| USB TTL(UART) Adapter | Board header |\n| --------------------- | ------------ |\n| GND | GND |\n| TX | RX |\n| RX | TX |\n\n{% include alert.html content=\"Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n## Chip identification\n\n| Chip | Function |\n| ---------------------- | ------------------ |\n| Realtek RTL9601D | GPON SoC |\n| U&T UTG24P05 | Optical transceiver (BOSA) |\n| Winbond W25Q128JVSQ | 128Mbit (16MB) SPI NOR Flash |\n\n{% include image.html file=\"sdx611-rtl9601d.jpg\" alt=\"Realtek RTL9601D\" caption=\"Realtek RTL9601D GPON SoC\" %}\n{% include image.html file=\"sdx611-utg24p05.jpg\" alt=\"U&T UTG24P05\" caption=\"U&T UTG24P05 Optical Transceiver\" %}\n{% include image.html file=\"sdx611-w25q128jvsq.jpg\" alt=\"Winbond W25Q128JVSQ\" caption=\"Winbond W25Q128JVSQ 16MB SPI NOR Flash\" %}\n\n# Miscellaneous Links\n\n* [ispreview.co.uk](https://www.ispreview.co.uk/index.php/2022/09/pictured-openreachs-future-2-5gbps-ont-for-fttp-broadband.html)\n* [Adtran SDX 611](https://www.adtran.com/solutions/by-segment/products/by-category/fiber-access/optical-network-terminals-ont/611.html)\n\n\n"
},
{
"path": "_ont/ont-adtran-sdx-611q.md",
"content": "---\ntitle: Adtran SDX 611Q\nhas_children: false\nlayout: default\nparent: Adtran\n---\n\n# Hardware Specifications\n\n| | |\n| ------------ | -------- |\n| Vendor/Brand | Adtran |\n| Model | SDX 611Q |\n| Chipset | |\n| Flash | |\n| RAM | |\n| System | |\n| 2.5GbaseT | Yes |\n| Optics | |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Form Factor | ONT |\n\n# Miscellaneous Links\n\n* [ispreview.co.uk](https://www.ispreview.co.uk/index.php/2022/09/pictured-openreachs-future-2-5gbps-ont-for-fttp-broadband.html)\n\n\n"
},
{
"path": "_ont/ont-adtran-sdx-621i.md",
"content": "---\ntitle: Adtran SDX 621i\nhas_children: false\nlayout: default\nparent: Adtran\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | -------------------------------- |\n| Vendor/Brand | Adtran |\n| Model | SDX 621i |\n| Chipset | |\n| Flash | |\n| RAM | |\n| System | |\n| 2.5GBaseT | No |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Serial baud | |\n| Serial encoding | |\n| Form Factor | ONT |\n\n## List of software versions\n\n## List of partitions\n\n# Miscellaneous Links\n\n- [Adtran SDX series](https://www.adtran.com/solutions/by-segment/products/by-category/fiber-access/optical-network-terminals-ont)\n"
},
{
"path": "_ont/ont-adtran.md",
"content": "---\ntitle: Adtran\nhas_children: true\nlayout: default\n---"
},
{
"path": "_ont/ont-bt-pon-bt-g711ax.md",
"content": "---\r\ntitle: BT-PON BT-G711AX\r\nhas_children: false\r\nlayout: default\r\nparent: BT-PON\r\n---\r\n\r\n# Hardware Specifications\r\n\r\n| | |\r\n| --------------- | -------------------------------------------------------------------------- |\r\n| Vendor/Brand | BT-PON |\r\n| Model | BT-G711AX |\r\n| Chipset | Realtek RTL9607Cv2 (Realtek RTL8198D is mentioned too in boot log???) |\r\n| Flash | SPI NAND 128MiB (Winbond W25N01GVZEIG) |\r\n| RAM | DDR3 256MiB |\r\n| CPU | Formosa MIPS interAptiv (multi) V2.0 |\r\n| CPU Clock | 1150MHz |\r\n| Wireless | RTL8192XBR 2x2 2.4Ghz (bgn+ax), RTL8832BR 2x2 5Ghz (an+ac+ax) |\r\n| Bootloader | U-Boot 2020.01 |\r\n| System | Linux 4.4.140 (Realtek MSDK-4.8.5p1 Build 3068) |\r\n| Load addr | 80010000 |\r\n| Ethernet ports | 4x1G |\r\n| POTS ports | 1xRJ11 (Si32192) |\r\n| Optics | SC/UPC (SEMTECH GN25L95) |\r\n| IP address | 192.168.1.1/24 |\r\n| Web Gui | ✅ user `admin`, password `YnQtcG9u` OR user `useradmin`, password `123456` |\r\n| SSH | NO |\r\n| Telnet | ✅ user `supertelnet`, password `supertelnet` |\r\n| FTP | ✅ port 21 |\r\n| Serial | ✅ |\r\n| Serial baud | 115200 |\r\n| Serial encoding | 8-N-1 | \r\n| Form Factor | ONT |\r\n\r\n## Serial\r\n{% include image.html file=\"bt-g711ax-serial.jpg\" alt=\"BT-G711AX\" caption=\"BT-G711AX: serial pinout\" %}\r\nYou can easily communicate with the ONT using a TTL converter (for example the CH341A programmer in TTL mode) by connecting the converters’ pins to the ONT following the pinout shown in the image above.\r\n\r\nOnce everything is ok, any TTY client, such as PuTTY, can be used to open the connection with its baud rate set to 115200. At this point, the ONT can be turned on.\r\n\r\nPress any key once you see `Hit any key to stop autoboot` (You only have 1 second to do this so be quick) after which you get access to bootloader console which looks like this:\r\n```sh\r\nPhoebus#\r\n```\r\n\r\n## List of partitions\r\n`cat /proc/mtd`\r\n\r\n| dev | size | erasesize | name |\r\n| ----- | -------- | --------- | ---------------- |\r\n| mtd0 | 000e0000 | 00020000 | \"boot\" |\r\n| mtd1 | 00020000 | 00020000 | \"env\" |\r\n| mtd2 | 00020000 | 00020000 | \"env2\" |\r\n| mtd3 | 00020000 | 00020000 | \"static_conf\" |\r\n| mtd4 | 07c40000 | 00020000 | \"ubi_device\" |\r\n| mtd5 | 00a89000 | 0001f000 | \"ubi_Config\" |\r\n| mtd6 | 00a0d000 | 0001f000 | \"ubi_k0\" |\r\n| mtd7 | 01911000 | 0001f000 | \"ubi_r0\" |\r\n| mtd8 | 00a0d000 | 0001f000 | \"ubi_k1\" |\r\n| mtd9 | 01911000 | 0001f000 | \"ubi_r1\" |\r\n\r\nOnly the first 4 partitions with erasesize 0x20000 should be manipulated using mtd devices, the fifth partition `ubi_device` contains the rest of the NAND and is to be manipulated using ubi volumes\r\n\r\n## List of volumes (UBI)\r\n`ubinfo -a`\r\n\r\n| dev | size | type | name |\r\n| ------ | --------- | ------- | ---------------- |\r\n| ubi0_0 | 11046912B | dynamic | \"ubi_Config\" |\r\n| ubi0_1 | 10539008B | dynamic | \"ubi_k0\" |\r\n| ubi0_2 | 26284032B | dynamic | \"ubi_r0\" |\r\n| ubi0_3 | 10539008B | dynamic | \"ubi_k1\" |\r\n| ubi0_4 | 26284032B | dynamic | \"ubi_r1\" |\r\n\r\nTo back up a volume, `cat` or `dd` the appropriate `/dev/ubi0_X` device to a file or pipe, to restore a volume, use the `ubiupdatevol` utility (or just do it safely via the WebGUI)\r\n\r\nThis ONT supports dual boot.\r\n\r\nVolumes `ubi_k0` and `ubi_r0` respectively contain kernel and rootfs of the first image, while `ubi_k1` and `ubi_r1` contain kernel and rootfs of the second one.\r\n\r\n# Useful files and binaries\r\n\r\n## Useful files\r\n- `/var/config/config.xml` - Contains the user portion of the configuration\r\n- `/var/config/config_hs.xml` - Contains the \"hardware\" configuration (which _should not_ be changed)\r\n- `/tmp/omcilog` - OMCI messages logs (must be enabeled, see below)\r\n\r\n## Useful binaries\r\n- `flash` - Used to manipulate the config files in a somewhat safe manner\r\n- `nv` - Used to manipulate nvram storage, including persistent config entries via `nv setenv`/`nv getenv`\r\n- `omcicli` - Used to interact with the running OMCI daemon\r\n- `omci_app` - The OMCI daemon\r\n- `diag` - Used to run low-level diagnostics commands on the stick\r\n\r\n# Usage\r\n\r\n## Enable telnet\r\nTelnet should be enabled by default but if that is not the case, you can enable it by editing configuration file you get in the Web UI. Go to `Admin -> Backup and Restore Settings -> Backup Settings to File` to get the config file in xml format and find `MIB_TELNET_ENABLE` and its value to 1. There is also `telnet` and `telnet_port` under `ACL_IP_TBL`, you should set these to 2 and 23 respectively.\r\n\r\n{% include alert.html content=\"Curiously, there is also `ssh` and `ssh_port` in there but changing these doesn't do anything for enabling SSH, most likely due to lack of ssh capability of this ONT\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\r\n\r\nAfter logining in using the credentials in the table above, use the `su` command to gain root access to the shell.\r\n```sh\r\n$ su\r\n# \r\n```\r\n\r\n# GPON ONU status\r\n\r\n## Getting the operational status of the ONU\r\n\r\n```sh\r\ndiag gpon get onu-state\r\n```\r\n\r\n## Getting OLT vendor information\r\n```sh\r\n# omcicli mib get 131\r\n```\r\n\r\n## Querying a particular OMCI ME\r\n```sh\r\n# omcicli mib get MIB_IDX\r\n```\r\n\r\n# GPON/OMCI settings\r\n\r\n## Getting/Setting ONU GPON Serial Number\r\n```sh\r\n# flash get GPON_SN\r\nGPON_SN=TMBB00000000\r\n# flash set GPON_SN TMBB0A1B2C3D\r\n```\r\n\r\n## Getting/Setting ONU GPON PLOAM password\r\n{% include alert.html content=\"The PLOAM password is stored in ASCII format\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\r\n\r\n```sh\r\n# flash get GPON_PLOAM_PASSWD\r\nGPON_PLOAM_PASSWD=AAAAAAAAAA\r\n# flash set GPON_PLOAM_PASSWD AAAAAAAAAA\r\n```\r\n\r\n## Getting/Setting ONU GPON LOID and LOID password\r\n```sh\r\n# flash get LOID\r\nLOID=user\r\n# flash set LOID user\r\n# flash get LOID_PASSWD\r\nLOID_PASSWD=user\r\n# flash set LOID_PASSWD user\r\n```\r\n\r\n## Getting/Setting OMCI software version (ME 7)\r\n```sh\r\n# flash get OMCI_SW_VER1\r\nOMCI_SW_VER1=YOURFIRSTSWVER\r\n# flash set OMCI_SW_VER1 YOURFIRSTSWVER\r\n# flash get OMCI_SW_VER2\r\nOMCI_SW_VER2=YOURSECONDSWVER\r\n# flash set OMCI_SW_VER2 YOURSECONDSWVER\r\n```\r\n\r\n## Getting/Setting OMCI hardware version (ME 256)\r\n```sh\r\n# flash get HW_HWVER\r\nHW_HWVER=V2.0\r\n# flash set HW_HWVER MYHWVERSION\r\n```\r\n\r\n## Getting/Setting OMCI vendor ID (ME 256)\r\n```sh\r\n# flash get PON_VENDOR_ID \r\nPON_VENDOR_ID=ZTEG\r\n# flash set PON_VENDOR_ID HWTC\r\n```\r\n\r\n## Getting/Setting OMCI equipment ID (ME 257)\r\n```sh\r\n# flash get GPON_ONU_MODEL\r\nGPON_ONU_MODEL=DFP-34X-2C2\r\n# flash set GPON_ONU_MODEL DFP-34X-XXX\r\n```\r\n\r\n## Getting/Setting OMCI OLT Mode and Fake OMCI\r\n\r\nConfigure how ONT Stick handle OMCI from OLT:\r\n\r\n```sh\r\n# flash get OMCI_OLT_MODE\r\nOMCI_OLT_MODE=1\r\n# flash set OMCI_OLT_MODE 2\r\n```\r\n\r\n| Value | Note | OMCI Information |\r\n| ----- | --------------- | ------------------------------------------------------------------------------------------------------ |\r\n| 0 | Default Mode | Stock setting, some values cannot be changed |\r\n| 1 | Huawei OLT Mode | Huawei MA5671a |\r\n| 2 | ZTE OLT Mode | ZTE |\r\n| 3 | Customized Mode | Custom Software/Hardware Version, OMCC, etc... |\r\n\r\nSome vendors/wholesale providers/ISPs have explicit LAN Port Number provisioning or proprietary OMCI that the stick cannot understand, this will make the stick reply OK to whatever the OLT sends it via OMCI. \r\n\r\n`0` = Disable, `1` = Enable, Default is 0\r\n\r\n```sh\r\n# flash get OMCI_FAKE_OK\r\nOMCI_FAKE_OK=0\r\n# flash set OMCI_FAKE_OK 1\r\n```\r\n\r\n# Advanced settings\r\n\r\n## Transferring files to/from the router\r\n\r\nThis router has a capability of sharing files using ftp, tftp and netcat.\r\n\r\n## Setting management MAC\r\n```sh\r\n# flash get ELAN_MAC_ADDR\r\nELAN_MAC_ADDR=xxxxxxxxxxxx\r\n# flash set ELAN_MAC_ADDR xxxxxxxxxxxx\r\n```\r\n\r\n## Setting management IP\r\n```sh\r\n# flash get LAN_IP_ADDR\r\nLAN_IP_ADDR=192.168.2.1\r\n# flash set LAN_IP_ADDR 192.168.1.1\r\n```\r\n\r\n## Rebooting the ONU\r\n```sh\r\nreboot\r\n```\r\n\r\n## Getting/Setting the MTU of the L2 bridge\r\n{% include alert.html content=\"Settings given via diag are not permanent after reboot\" alert=\"Note\" icon=\"svg-info\" color=\"blue\" %}\r\n\r\n```sh\r\n# diag switch get max-pkt-len port all \r\nPort Speed \r\n---------- \r\n0 1538 \r\n2 2031 \r\n# diag switch set max-pkt-len port all length 2000\r\n```\r\n\r\n## Checking the currently active image\r\n```sh\r\n# nv getenv sw_active\r\nsw_active=1\r\n# nv getenv sw_version0\r\nsw_version0=V1_7_8_210412\r\n# nv getenv sw_version1\r\nsw_version1=V1_7_8_210412\r\n```\r\n\r\n## Booting to a different image\r\n```sh\r\n# nv setenv sw_commit 0|1\r\n# reboot\r\n```\r\n\r\n# Miscellaneous Links\r\n\r\n- [Configuration Manual which explains the Web UI of this ONT](https://www.bt-pon.com/download/Configuration_Manual/BT-7xx_and_BT-3xx_series_xPON_ONU_Configuration_Manual.pdf)\r\n- [Datasheet](https://www.bt-pon.com/download/Datasheet/BT-PON_BT-G711AX_XPON_ONU_ONT_Datasheet.pdf)\r\n\r\n\r\n# Theardown and other photos\r\n\r\n{% include image.html file=\"bt-g711ax-teardown-1.jpg\" alt=\"BT-PON BT-G711AX Board\" caption=\"BT-PON BT-G711AX Board\" %}\r\n{% include image.html file=\"bt-g711ax-teardown-2.jpg\" alt=\"BT-PON BT-G711AX Board (bottom side)\" caption=\"BT-PON BT-G711AX Board (bottom side)\" %}"
},
{
"path": "_ont/ont-bt-pon.md",
"content": "---\ntitle: BT-PON\nhas_children: true\nlayout: default\n---"
},
{
"path": "_ont/ont-calix-801gt.md",
"content": "---\ntitle: Calix 801GT\nhas_children: false\nlayout: default\nparent: Calix\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | -------------------------------- |\n| Vendor/Brand | Calix |\n| Model | 801GT |\n| Chipset | |\n| Flash | |\n| RAM | |\n| System | |\n| 2.5GBaseT | No |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Serial baud | |\n| Serial encoding | |\n| Form Factor | ONT |\n\n## List of software versions\n\n## List of partitions\n\n# Miscellaneous Links\n\n- [Calix GigaPoint ONTs](https://www.calix.com/platforms/premises-systems.html)\n"
},
{
"path": "_ont/ont-calix-801gv2.md",
"content": "---\ntitle: Calix GigaPoint 801Gv2\nhas_children: false\nlayout: default\nparent: Calix\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | -------------------------------- |\n| Vendor/Brand | Calix |\n| Model | GigaPoint 801Gv2 |\n| Chipset | |\n| Flash | |\n| RAM | |\n| System | |\n| 2.5GBaseT | No |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Serial baud | |\n| Serial encoding | |\n| Form Factor | ONT |\n\n## List of software versions\n\n## List of partitions\n\n# Miscellaneous Links\n\n- [Calix GigaPoint ONTs](https://www.calix.com/platforms/premises-systems.html)\n"
},
{
"path": "_ont/ont-calix-gp1000g.md",
"content": "---\ntitle: Calix GP1000g\nhas_children: false\nlayout: default\nparent: Calix\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | -------------------------------- |\n| Vendor/Brand | Calix |\n| Model | GP1000g |\n| Chipset | |\n| Flash | |\n| RAM | |\n| System | |\n| 2.5GBaseT | No |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Serial baud | |\n| Serial encoding | |\n| Form Factor | ONT |\n\n## List of software versions\n\n## List of partitions\n\n# Miscellaneous Links\n\n- [Calix GigaPoint ONTs](https://www.calix.com/platforms/premises-systems.html)\n"
},
{
"path": "_ont/ont-calix-gp1100g.md",
"content": "---\ntitle: Calix GP1100G\nhas_children: false\nlayout: default\nparent: Calix\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | -------------------------------- |\n| Vendor/Brand | Calix |\n| Model | GP1100G |\n| Chipset | |\n| Flash | |\n| RAM | |\n| System | |\n| 2.5GBaseT | No |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Serial baud | |\n| Serial encoding | |\n| Form Factor | ONT |\n\n## List of software versions\n\n## List of partitions\n\n# Miscellaneous Links\n\n- [Calix GigaPoint ONTs](https://www.calix.com/platforms/premises-systems.html)\n"
},
{
"path": "_ont/ont-calix.md",
"content": "---\ntitle: Calix\nhas_children: true\nlayout: default\n---"
},
{
"path": "_ont/ont-carlitoxxpro-cpgos03-0490-v1.md",
"content": "---\ntitle: CarlitoxxPro CPGOS03-0490 v1\nhas_children: false\nredirect_to: /ont-hilink-hl23446\nlayout: default\nparent: CarlitoxxPro\n---"
},
{
"path": "_ont/ont-carlitoxxpro-cpgos03-0490-v2.md",
"content": "---\ntitle: CarlitoxxPro CPGOS03-0490 v2\nhas_children: false\nlayout: default\nparent: CarlitoxxPro\n---\n\n# Hardware Specifications\n\n| | |\n| ------------ | ------------------------------------- |\n| Vendor/Brand | CarlitoxxPro |\n| Model | CPGOS03-0490 v2 |\n| Chipset | Realtek RTL9601CI |\n| Flash | 8 MB |\n| RAM | 64 MB |\n| System | Linux (Luna SDK) |\n| HSGMII | No |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | ✅ user `cpAdmin`, password `cpAdmin` |\n| SSH | |\n| Telnet | ✅ |\n| Serial | |\n| Form Factor | miniONT SFP |\n\n# Known Bugs\n\n- VLAN swap issue (MEID 171), auto-sensing mode to switch between SGMII/HiSGMII\n\n- You should use the VID/VLAN shown by executing the command `omcicli mib get 84` via telnet to bring up PPPoE\n\n{% include_relative ont-luna-sdk-useful-commands.md \n flash='flash' \n ploam='asciiAndHex' \n%}\n\n\n# Miscellaneous Links\n\n- [Hacking RTL960x](https://github.com/Anime4000/RTL960x)\n- [GPON ONU SFP - CPGOS03-0490 v2.0: Configuration Manual 1.0](https://wiki.rockstable.it/FTTH?action=AttachFile&do=get&target=CPGOS03-0490v2_Configuration-Manual.pdf)\n\n"
},
{
"path": "_ont/ont-carlitoxxpro.md",
"content": "---\ntitle: CarlitoxxPro\nhas_children: true\nlayout: default\n---"
},
{
"path": "_ont/ont-cig-g-97c1.md",
"content": "---\ntitle: CIG G-97C1\nhas_children: false\nredirect_to: /ont-nokia-g-010g-p\nlayout: default\nparent: CIG\n---"
},
{
"path": "_ont/ont-cig-g-97cm.md",
"content": "---\ntitle: CIG G-97CM\nhas_children: false\nlayout: default\nparent: CIG\n---\n\n# Hardware Specifications\n\n| | |\n| ---------------- | ---------------- |\n| Vendor/Brand | CIG |\n| Model | G-97CM |\n| ODM | ✅ |\n| Chipset | Realtek RTL9601B |\n| Flash | |\n| RAM | |\n| System | Linux |\n| 2.5GbaseT | No |\n| Optics | SC/APC |\n| IP address | 192.168.1.1 |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | ✅ |\n| Serial baud | 115200 |\n| Serial encoding | 8-N-1 |\n| Form Factor | ONT |\n\n# Miscellaneous Links\n\n- [CUG G-97CM DataSheet](https://www.cigtech.com/wp-content/uploads/2018/02/G-97CM_DataSheet_V3.pdf)\n\n\n\n\n\n\n"
},
{
"path": "_ont/ont-cig-g-97cp.md",
"content": "---\ntitle: CIG G-97CP\nhas_children: false\nlayout: default\nparent: CIG\n---\n\n# Hardware Specifications\n\n| | |\n| ---------------- | ------------------------------------------------------------------------ |\n| Vendor/Brand | CIG |\n| Model | G-97CP |\n| ODM | ✅ |\n| Chipset | Realtek RTL9601D |\n| Flash | |\n| RAM | |\n| System | Linux (Luna SDK 1.9.0) |\n| 2.5GbaseT | Yes |\n| Optics | SC/APC |\n| IP address | 192.168.100.1 |\n| Web Gui | |\n| SSH | ✅ user ```root```, password same as [enable](#enable-password) password |\n| Telnet | |\n| Serial | ✅ |\n| Form Factor | ONT |\n\n{% include image.html file=\"cig/cig-1.jpg\" alt=\"CIG G-97CP Unidata\" caption=\"CIG G-97CP Unidata @papin\" %} \n{% include image.html file=\"cig/cig-2.jpg\" alt=\"CIG G-97CP Unidata\" caption=\"CIG G-97CP Unidata @papin\" %}\n\n{% include_relative ont-nokia-use.md username=\"ont\" alertEnablePassword=\"The following enable password is used to enter GponCLI via serial connection in in firmware where it is not disabled.\" %}\n\n{% include_relative ont-nokia-useful-command.md %}\n\n# Note\n\nThis ONT has the same internal hardware as the [Nokia G-010G-T](/ont-nokia-g-010g-t) and even the same plastic shell of the [ZTE F6005](/ont-zte-f6005).\n\n\n"
},
{
"path": "_ont/ont-cig-g-97s.md",
"content": "---\ntitle: CIG G-97S\nhas_children: false\nredirect_to: /ont-nokia-g-010s-q\nlayout: default\nparent: CIG\n---"
},
{
"path": "_ont/ont-cig-g-97sp.md",
"content": "---\ntitle: CIG G-97SP\nhas_children: false\nlayout: default\nparent: CIG\n---\n\n# Hardware Specifications\n\n| | |\n| ---------------- | --------------- |\n| Vendor/Brand | CIG |\n| Model | G-97SP |\n| ODM | ✅ |\n| Chipset | Lantiq PEB98035 |\n| CPU | |\n| CPU Clock | |\n| Flash | |\n| RAM | |\n| HSGMII | |\n| Optics | SC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Form Factor | miniONT SFP |\n\n# Miscellaneous Links\n\n- [GPON ONT G-95SP Platform Briefing](https://www.cigtech.com/wp-content/uploads/2018/03/G-95SP_DataSheet_V2.pdf)\n- [Tech Info Depot Wiki](http://en.techinfodepot.shoutwiki.com/wiki/Cigtech_G-95SP)\n- [OpenWrt Forum](https://forum.openwrt.org/t/cigtech-g-95sp-sfp-gpon/63352)\n"
},
{
"path": "_ont/ont-cig.md",
"content": "---\ntitle: CIG\nhas_children: true\nlayout: default\n---\n\n\n\n\n\n"
},
{
"path": "_ont/ont-d-link-dpn-100-rev-a2.md",
"content": "---\ntitle: D-LINK DPN-100 Rev A2\nhas_children: false\nlayout: default\nparent: D-LINK\n---\n\n# Hardware Specifications\n\n| | |\n| ---------------- | --------------- |\n| Vendor/Brand | D-LINK |\n| Model | DPN-100 Rev A2 |\n| Chipset | Lantiq PEB98035 |\n| ODM | T&W |\n| ODM Product Code | TW2362H-CDEL |\n| Flash | 8 MB |\n| RAM | 64 MB |\n| System | |\n| HSGMII | |\n| Optics | |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Form Factor | miniONT SFP |\n\n{% include image.html file=\"dpn-100-rev-a2.jpg\" alt=\"DPN-100 Rev A2\" caption=\"DPN-100 Rev A2\" %}\n\n\nOnce you access the stick via ssh you will be presented with a second tier login. The credentials to access the dell shell are: username: `twmanu` , password: `twmanu`.\n\n\n## Firmware is interchangeable with:\n\n- [Zyxel PMG3000-D20B](/ont-zyxel-pmg3000-d20b)\n- [Halny HL-GSFP](/ont-halny-hl-gsfp)\n- [Zisa OP151s](/ont-zisa-op151s)\n- [T&W TW2362H-CDEL](/ont-t-w-tw2362h-cdel)\n\n# GPON/OMCI settings\n\n{% include alert.html content=\"All commands start from the twmanu shell.\" alert=\"Note\" icon=\"svg-info\" color=\"blue\" %}\n\n## Setting ONU GPON Serial Number\n{% include alert.html content=\"The S/N is stored in the ASCII format.\" alert=\"Note\" icon=\"svg-info\" color=\"blue\" %}\n\n```sh\nmanufactory\nset sn ALCLf0f0f0f0\nexit\nhal\nset sn ALCLf0f0f0f0\n```\n\n## Setting ONU GPON PLOAM password\n\n{% include alert.html content=\"The PLOAM password is stored in the ASCII format.\" alert=\"Note\" icon=\"svg-info\" color=\"blue\" %}\n\nThis can be done easily via the web UI. If you prefer to do it via the shell use:\n```sh\nmanufactory\nset password 1234567899\n```\n\nor in hex format without any 0x or separator:\n```sh\nmanufactory\nset password hex 31323334353637383939\n```\n\n## Show ONU GPON info\n```sh\nshow info\n```\n\n# Miscellaneous Links\n\n- [Dlink DPN 100 Change of Serial Number and PLOAM Password](https://www.youtube.com/watch?v=5hpMPJCpUaQ)\n\n\n\n"
},
{
"path": "_ont/ont-d-link-dpn-100-rev-c1.md",
"content": "---\ntitle: D-LINK DPN-100 Rev C1\nhas_children: false\nlayout: default\nparent: D-LINK\n---\n\n# Hardware Specifications\n\n| | |\n| ---------------- | -------------------------------------------------------- |\n| Vendor/Brand | D-LINK |\n| Model | DPN-100 Rev C1 |\n| ODM | CIG |\n| ODM Product Code | [G-97S](/ont-cig-g-97s) |\n| Chipset | Realtek RTL9601CI |\n| Flash | 16MB |\n| RAM | 32MB |\n| System | Linux (Luna SDK 1.9.0) |\n| HSGMII | ✅ |\n| Optics | SC/APC |\n| IP address | 192.168.100.1 |\n| Web Gui | |\n| SSH | |\n| Telnet | ✅ user `root`, password `admin` (only on R4.2.104.033e) |\n| Serial | |\n| Form Factor | miniONT SFP |\n\n{% include image.html file=\"dpn-100-rev-c1.png\" alt=\"DPN-100 Rev C1\" caption=\"DPN-100 Rev C1\" %}\n\n## List of software versions\n- R4.2.104.033e (Wind - has telnet enabled)\n- R4.2.104.039 (Wind - no telnet access)\n\n## List of partitions\n\n| dev | size | erasesize | name |\n| ---- | -------- | --------- | -------- |\n| mtd0 | 00080000 | 00010000 | \"Boot\" |\n| mtd1 | 00180000 | 00010000 | \"Config\" |\n| mtd2 | 00700000 | 00010000 | \"ImageA\" |\n| mtd3 | 00700000 | 00010000 | \"ImageB\" |\n\n\n{% include_relative ont-nokia-useful-command.md %}\n\n# Miscellaneous Links\n\n- [DLINK DPN-100 Ver:C1 uses RTL9601CI](https://github.com/Anime4000/RTL960x/issues/2)\n"
},
{
"path": "_ont/ont-d-link.md",
"content": "---\ntitle: D-LINK\nhas_children: true\nlayout: default\n---"
},
{
"path": "_ont/ont-fibermall-gpon-onu-clb+.md",
"content": "---\ntitle: FiberMall GPON-ONU-CLB+\nhas_children: false\nlayout: default\nparent: FiberMall\n---\n\n{% include alert.html content=\"This is a raw GPON ONU SFP transceiver without MAC function. It requires an external PON MAC to operate. For the ONU Stick with integrated MAC, see FiberMall GPON-ONU-STB+. See also SFP Standard and SFP with PON MAC and w/o PON MAC for background.\" alert=\"Warning\" icon=\"svg-warning\" color=\"yellow\" %}\n\n# Hardware Specifications\n\n| | |\n| --------------------- | --------------------------------------------------------------------- |\n| Vendor/Brand | FiberMall |\n| Model | GPON-ONU-CLB+ |\n| Chipset | |\n| Optics | SC/UPC |\n| Form Factor | SFP |\n| PON MAC | ❌ None (raw transceiver, requires external PON MAC) |\n\n## Product Variants\n\n| Part Number | TX Enable | Temperature | Price |\n| ---------------- | --------- | ------------ | ------ |\n| GPON-ONU-CLB+ | Low level | -5 to 70°C | $15.00 |\n| GPON-ONU-ILB+ | Low level | -40 to 85°C | |\n| GPON-ONU-CHB+ | High level| -5 to 70°C | |\n| GPON-ONU-IHB+ | High level| -40 to 85°C | |\n\nAll variants: SFP, TX-1.244G/RX-2.488G, T1310nm/R1490nm, GPON Class B+, no MAC, DDM.\n\n## Datasheet Specifications\n\n### General\n\n| | |\n| ---------------------------- | ------------------------------------------ |\n| TX Data Rate | 1.244 Gbps (burst mode) |\n| RX Data Rate | 2.488 Gbps (continuous mode) |\n| Max Distance | 20 km |\n| Fiber Type | Single Mode 9/125 µm |\n| Class | B+ |\n| Power Supply | 3.3V ± 5% (3.135–3.465V) |\n| Supply Current | 300 mA max |\n| Power Consumption | 1 W |\n| Operating Temperature | -5 to 70°C (C-Temp) / -40 to 85°C (I-Temp)|\n| DDM | ✅ SFF-8472 |\n\n### Transmitter Optical Characteristics\n\n| Parameter | Min | Typical | Max | Unit |\n| ---------------------------------- | ------ | ------- | ------ | ------ |\n| Launched Power (avg.) | +0.5 | | +5.0 | dBm |\n| Operating Wavelength Range | 1260 | | 1360 | nm |\n| Output Spectrum Width (RMS) | | | 1.0 | nm |\n| Side Mode Suppression Ratio | 30 | | | dB |\n| Extinction Ratio | 9 | | | dB |\n| Optical Rise Time | | | 260 | ps |\n| Optical Fall Time | | | 260 | ps |\n| Output Power After TX Disable | | | -50 | dBm |\n| Burst Turn-On Time | | | 12.8 | ns |\n| Burst Turn-Off Time | | | 12.8 | ns |\n| TX Reflectance | | | -15 | dB |\n\n### Receiver Optical Characteristics\n\n| Parameter | Min | Typical | Max | Unit |\n| ---------------------------------- | ------ | ------- | ------ | ------ |\n| Wavelength Range | 1480 | | 1500 | nm |\n| Sensitivity (BER ≤ 10⁻¹²) | | | -28 | dBm |\n| Saturation Optical Power | -8 | | | dBm |\n| SD Assert Level | | | -29 | dBm |\n| SD Deassert Level | -45 | | | dBm |\n| SD Hysteresis | 0.5 | | 6 | dB |\n| Receiver Reflectance | | | -12 | dB |\n\n### Electrical Characteristics\n\n| Parameter | Min | Typical | Max | Unit |\n| ---------------------------------- | ------ | ------- | ------ | ------ |\n| TX Differential Input Voltage | 300 | | 2400 | mV |\n| RX Differential Output Voltage | 500 | | 1200 | mV |\n| TX Common-Mode Input Voltage | 1.6 | | 2.4 | V |\n| Input Differential Impedance | 90 | 100 | 110 | Ω |\n| TX Fault Output (Normal) | 0 | | 0.4 | V |\n| TX Fault Output (Fault) | 2.4 | | VCC+0.3| V |\n| SD Assert Time | | | 100 | µs |\n| SD Deassert Time | | | 100 | µs |\n\nTransmitter: 1310 nm DFB laser, LVPECL input (DC coupled). Receiver: 1490 nm Super-TIA, CML output (AC coupled).\n\n### DDM Accuracy\n\n| Parameter | Accuracy |\n| ------------ | -------- |\n| Temperature | ±3°C |\n| Voltage | ±3% |\n| Bias Current | ±10 mA |\n| TX Power | ±3 dB |\n| RX Power | ±3 dB |\n\n## Pin Definition\n\n| Pin | Name | Description |\n| --- | ---------- | ---------------------------------------------------------------------------- |\n| 1 | VeeT | Transmitter Ground |\n| 2 | TX_Fault | Transmitter Fault Indication (LVTTL output: low = normal, high = abnormal) |\n| 3 | TX_Burst | **Transmitter Burst Enable Input** (LVTTL) |\n| 4 | MOD-DEF(2) | I²C Data (SDA), LVTTL |\n| 5 | MOD-DEF(1) | I²C Clock (SCL), LVTTL |\n| 6 | MOD-DEF(0) | Module Definition 0, grounded within module |\n| 7 | TX_SD | **Transmitter Signal Detect** (LVTTL output, active high) |\n| 8 | RX_SD | **Receiver Signal Detect** (LVTTL output: high = signal, low = loss) |\n| 9 | VeeR | Receiver Ground |\n| 10 | VeeR | Receiver Ground |\n| 11 | VeeR | Receiver Ground |\n| 12 | RD- | Inverted Receiver Data Out (CML, AC coupled) |\n| 13 | RD+ | Receiver Data Out (CML, AC coupled) |\n| 14 | VeeR | Receiver Ground |\n| 15 | VccR | Receiver Power |\n| 16 | VccT | Transmitter Power |\n| 17 | VeeT | Transmitter Ground |\n| 18 | TD+ | Transmit Data In (LVPECL, DC coupled) |\n| 19 | TD- | Inverted Transmit Data In (LVPECL, DC coupled) |\n| 20 | VeeT | Transmitter Ground |\n\n{% include alert.html content=\"Note the key Pin differences vs the STB+ (with MAC): Pin 3 is TX_Burst (burst enable) instead of TX_Disable, Pin 7 is TX_SD (transmitter signal detect) instead of Dying Gasp, and Pin 8 is RX_SD instead of LOS.\" alert=\"Note\" icon=\"svg-info\" color=\"blue\" %}\n\n### EEPROM (A0h) Key Fields\n\n| Address | Field | Value | Description |\n| ------- | --------------- | ------------ | ----------------------------------- |\n| 00 | Identifier | 03 | SFP |\n| 01 | Ext. Identifier | 04 | Module soldered to motherboard |\n| 02 | Connector | 01 | Optical Pigtail |\n| 11 | Encoding | 03 | NRZ |\n| 12 | BR, Nominal | 0C | 1.2 Gbps |\n| 14 | Length (9µm km) | 14 | 20 km |\n| 40–55 | Vendor P/N | GPON-ONU-xxB+| ASCII |\n| 60–61 | Laser Wavelength| 051E | 1310 nm |\n| 92 | Diag. Mon. Type | 68 | Internal calibration, avg. power RX |\n\n## Standards Compliance\n\n- ITU-T G.984.2 (GPON)\n- SFP MSA (SFF-8074i)\n- SFF-8472 (DDM)\n- FCC 47 CFR Part 15, Class B\n- FDA 21 CFR 1040.10 and 1040.11 (Laser Notice No. 50)\n- IEC-60825 (Class 1 laser safety)\n- Telcordia GR-468-CORE\n- TR-NWT-000870 ESD Class 2\n\n## Key Differences vs STB+ (with MAC)\n\n| Feature | CLB+ (no MAC) | STB+ (with MAC) |\n| -------------------- | ---------------------------- | ------------------------------------ |\n| PON MAC | ❌ None | ✅ Integrated |\n| Receiver Type | Super-TIA | APD-TIA |\n| Power Consumption | 1 W | 2.48 W |\n| GPON/EPON Dual-Mode | ❌ GPON only | ✅ Auto-detect GPON/EPON |\n| OMCI (G.988) | ❌ | ✅ |\n| Pin 3 | TX_Burst (burst enable) | TX_Disable |\n| Pin 7 | TX_SD (TX signal detect) | Dying Gasp detect |\n| Pin 8 | RX_SD (RX signal detect) | LOS |\n| Price | $15.00 | $45.00 |\n\n{% include alert.html content=\"This page has been created from the vendor datasheet and product listing. Contributions with hands-on information are welcome.\" alert=\"Note\" icon=\"svg-info\" color=\"blue\" %}\n\n# Miscellaneous Links\n\n- [FiberMall GPON-ONU-CLB+ product page](https://www.fibermall.com/sale-437481-gpon-onu-sfp-tx1310nm-class-b.htm)\n- [Datasheet (PDF)](https://www.fibermall.com/file/datasheet/gpon-onu-xxb%2B.pdf)\n"
},
{
"path": "_ont/ont-fibermall-gpon-onu-stb+.md",
"content": "---\ntitle: FiberMall GPON-ONU-STB+\nhas_children: false\nlayout: default\nparent: FiberMall\n---\n\n{% include alert.html content=\"This is an ONU Stick SFP with integrated GPON MAC. For the raw SFP transceiver without MAC, see [FiberMall GPON-ONU-CLB+](/ont-fibermall-gpon-onu-clb+).\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n# Hardware Specifications\n\n| | |\n| --------------------- | --------------------------------------------------------------------- |\n| Vendor/Brand | FiberMall |\n| Model | GPON-ONU-STB+ (SC/UPC) / GPON-ONU-STAB+ (SC/APC) |\n| Chipset | Unknown |\n| Flash | |\n| RAM | |\n| System | |\n| HSGMII | |\n| Optics | SC/UPC or SC/APC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Form Factor | miniONT SFP |\n\n## Product Variants\n\n| Part Number | Connector | Temperature | Price |\n| ---------------- | --------- | ------------ | ------ |\n| GPON-ONU-STB+ | SC/UPC | 0 to 70°C | $45.00 |\n| GPON-ONU-ISTB+ | SC/UPC | -40 to 85°C | |\n| GPON-ONU-STAB+ | SC/APC | 0 to 70°C | $45.00 |\n| GPON-ONU-ISTAB+ | SC/APC | -40 to 85°C | |\n\nAll variants: SFP, TX-1.244G/RX-2.488G, T1310nm/R1490nm, GPON Class B+, MAC inside, RoHS 6, DDM.\n\n## Datasheet Specifications\n\n### General\n\n| | |\n| ---------------------------- | ------------------------------------------ |\n| TX Data Rate | 1.244 Gbps (burst mode) |\n| RX Data Rate | 2.488 Gbps (continuous mode) |\n| Max Distance | 20 km |\n| Fiber Type | Single Mode 9/125 µm |\n| Class | B+ |\n| Power Supply | 3.3V ± 5% (3.13–3.47V) |\n| Power Dissipation | 2.48 W typical |\n| Operating Temperature | 0 to 70°C (C-Temp) / -40 to 85°C (I-Temp) |\n| DDM | ✅ SFF-8472 v9.5 |\n\n### Transmitter Optical Characteristics\n\n| Parameter | Min | Typical | Max | Unit |\n| ---------------------------------- | ------ | ------- | ------ | ------ |\n| Centre Wavelength | 1290 | | 1330 | nm |\n| Side Mode Suppression Ratio | 30 | | | dB |\n| Optical Spectrum Width (RMS) | | | 1 | nm |\n| Average Launch Power | +0.5 | | +5.0 | dBm |\n| Power-OFF TX Optical Power | | | -45 | dBm |\n| Extinction Ratio | 9 | | | dB |\n| Rise/Fall Time (20%-80%) | | | 260 | ps |\n| Burst Turn-On Time | | | 12.8 | ns |\n| Burst Turn-Off Time | | | 12.8 | ns |\n| RIN15 OMA | | | -115 | dB/Hz |\n| Optical Return Loss Tolerance | 15 | | | dB |\n| TX Reflectance | | | -6 | dB |\n| TX and Dispersion Penalty | | | 2 | dB |\n\n### Receiver Optical Characteristics\n\n| Parameter | Min | Typical | Max | Unit |\n| ---------------------------------- | ------ | ------- | ------ | ------ |\n| Operating Wavelength | 1480 | 1490 | 1500 | nm |\n| Sensitivity (BER 10⁻¹²) | | | -28 | dBm |\n| Saturation Optical Power | -8 | | | dBm |\n| LOS Deassert Level | | | -29 | dBm |\n| LOS Assert Level | -40 | | | dBm |\n| LOS Hysteresis | 0.5 | | 5 | dB |\n| Receiver Reflectance | | | -20 | dB |\n| WDM Filter Isolation (1550 nm) | 38 | | | dB |\n| WDM Filter Isolation (1650 nm) | 35 | | | dB |\n\n### Electrical Characteristics\n\n| Parameter | Min | Typical | Max | Unit |\n| ---------------------------------- | ------ | ------- | ------ | ------ |\n| Data Input Differential Swing | 300 | | 1600 | mV |\n| Data Output Differential Swing | 300 | | 1200 | mV |\n| Input Differential Impedance | 90 | 100 | 110 | Ω |\n| TX Disable Voltage (Enable) | 0 | | 0.8 | V |\n| TX Disable Voltage (Disable) | 2.0 | | VCC | V |\n\nTransmitter: 1310 nm DFB laser. Receiver: 1490 nm APD-TIA, CML output (AC coupled).\n\n## Pin Definition\n\n| Pin | Name | Description |\n| --- | ---------- | ---------------------------------------------------------------------- |\n| 1 | VeeT | Transmitter Ground |\n| 2 | TX Fault | Transmitter Fault Indication (LVTTL output: low = normal, high = fault)|\n| 3 | TX Disable | Transmitter Disable; turns off transmitter laser output |\n| 4 | MOD-DEF(2) | SDA I²C Data line |\n| 5 | MOD-DEF(1) | SCL I²C Clock line |\n| 6 | MOD-DEF(0) | Module Absent, connected to VeeR |\n| 7 | RateSelect | **Dying Gasp detect** (input, active low) |\n| 8 | LOS | Loss of Signal |\n| 9 | VeeR | Receiver Ground |\n| 10 | VeeR | Receiver Ground |\n| 11 | VeeR | Receiver Ground |\n| 12 | RD- | Inverted Received Data Output |\n| 13 | RD+ | Received Data Output |\n| 14 | VeeR | Receiver Ground |\n| 15 | VccR | Receiver Power |\n| 16 | VccT | Transmitter Power |\n| 17 | VeeT | Transmitter Ground |\n| 18 | TD+ | Transmit Data In |\n| 19 | TD- | Inverted Transmit Data In |\n| 20 | VeeT | Transmitter Ground |\n\n## Standards Compliance\n\n- ITU-T G.984.2 / G.984.2 Amendment 1 (GPON)\n- ITU-T G.988 (OMCI)\n- SFP MSA (SFF-8074i)\n- SFF-8472 v9.5 (DDM)\n- FCC 47 CFR Part 15, Class B\n- FDA 21 CFR 1040.10 and 1040.11\n- IEC-60825 (Class 1 laser safety)\n\n## Notes\n\n- The GPON-ONU-STB+ is described as a **dual-mode ONU stick**: it supports both GPON and EPON ONU OAM and will automatically establish a link with either a GPON OLT or EPON OLT.\n- Pin 7 (RateSelect) is repurposed for **Dying Gasp detection** (input, active low).\n- Data input is LVPECL compatible, DC coupled internally.\n- Receiver is APD-TIA based, providing higher sensitivity than the [non-MAC CLB+ variant](/ont-fibermall-gpon-onu-clb+) which uses Super-TIA.\n- This is a complete \"PON on a Stick\" — an entire FTTH ONU in a slightly oversized SFP that can be plugged into networking equipment (switch, router, PBX, etc.).\n\n{% include alert.html content=\"This page has been created from the vendor datasheet and product listing. Contributions with hands-on information (chipset identification, firmware details, serial/SSH access, IP address, web GUI, etc.) are very welcome.\" alert=\"Note\" icon=\"svg-info\" color=\"blue\" %}\n\n# Miscellaneous Links\n\n- [FiberMall GPON-ONU-STAB+ product page (SC/APC)](https://www.fibermall.com/sale-462750-gpon-onu-sticak-sfp-class-b-apc.htm)\n- [FiberMall GPON-ONU-STB+ product page (SC/UPC)](https://www.fibermall.com/sale-437801-gpon-onu-sticak-sfp-class-b.htm)\n- [Datasheet (PDF)](https://www.fibermall.com/file/datasheet/gpon-onu-stb%2B.pdf)\n"
},
{
"path": "_ont/ont-fibermall.md",
"content": "---\ntitle: FiberMall\nhas_children: true\nlayout: default\n---\n"
},
{
"path": "_ont/ont-fs-com-gpon-onu-stick-with-mac.md",
"content": "---\ntitle: FS.com GPON ONU Stick with MAC (GPON-ONU-34-20BI)\nhas_children: true\nalias: SourcePhotonics SPS-34-24T-HP-TDFO\nparent: FS.com\nlayout: default\n---\n\n# Hardware Specifications\n\n| | |\n| ---------------- | ---------------------------------------- |\n| Vendor/Brand | FS.com |\n| Model | GPON-ONU-34-20BI |\n| ODM | SourcePhotonics |\n| ODM Product Code | SPS-34-24T-HP-TDFO |\n| Chipset | Lantiq PEB98035 |\n| CPU | MIPS 34Kc interAptiv |\n| CPU Clock | 400MHz |\n| Flash | 16 MB |\n| RAM | 64 MB |\n| Bootloader | U-Boot 2011.12-lantiq-gpon-1.2.24 |\n| System | OpenWRT 14.07_ltq (Kernel 3.10.49) |\n| Load addr | 0x80800000 |\n| HSGMII | Yes |\n| Optics | SC/APC |\n| IP address | 192.168.1.10 |\n| Web Gui | |\n| SSH | ✅ user `ONTUSER`, password `7sp!lwUBz1` |\n| Telnet | |\n| Serial | ✅ on SFP |\n| Serial baud | 115200 |\n| Serial encoding | 8-N-1 |\n| Form Factor | miniONT SFP |\n\n{% include image.html file=\"ont-fs.jpg\" alt=\"FS.com GPON ONU\" caption=\"FS.com GPON ONU\" %}\n{% include image.html file=\"ont-fs-box.jpg\" alt=\"FS.com GPON ONU in the box\" caption=\"FS.com GPON ONU in the box\" %}\n\n## Possible clones\n\n- SourcePhotonics SPS-34-24T-HP-TDFO\n\n## Firmware is interchangeable with:\n\n- [Huawei MA5671A](/ont-huawei-ma5671a)\n- [Nokia G-010S-P](/ont-nokia-g-010s-p)\n- [Hilink HL23446](/ont-hilink-hl23446)\n- {:.text-red-200 } Dasan H650SFP \n- {:.text-red-200 } DpOptics D23446 \n- {:.text-red-200 } Photonics SPS-34-24T-HP-TDFO\n\n## Serial\n\nThe stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the SFP connector.\n\n| USB TTL(UART) Adapter | SFP 20pins Molex connector |\n| --------------------- | -------------------------- |\n| 3.3V | pin #15 and #16 |\n| TX | pin #2 |\n| RX | pin #7 |\n| GND | pin #14 |\n\n\n{% include alert.html content=\"Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n\n## List of software versions\n- 6BA1896SPLQA13 (Dec 16 2016)\n- 6BA1896SPLQA41\n- 6BA1896SPLQA42 (Sep 18 2021)\n\n## List of partitions\n\nPartition layouts change depending on which image is booted, in particular:\n\nWhen booting image0:\n```\nmtd2 ---> image0 (linux)\nmtd5 --> image1\nmtd3 --> rootfs\nmtd4 --> rootfs_data\n```\nWhen booting image0:\n```\nmtd2 ---> image0\nmtd3 --> image1 (linux)\nmtd4 --> rootfs\nmtd5 --> rootfs_data\n```\n\nFor more info [XPONos partition layout](https://github.com/XPONos/linux_lantiq-falcon/commit/456f68f69a84c846a542a9f0ea47c37476535dcb).\n\n### When booting from image0\n\n| dev | size | erasesize | name |\n| ---- | -------- | --------- | ------------- |\n| mtd0 | 00040000 | 00010000 | \"uboot\" |\n| mtd1 | 00080000 | 00010000 | \"uboot_env\" |\n| mtd2 | 00740000 | 00010000 | \"linux\" |\n| mtd3 | 0061eedc | 00010000 | \"rootfs\" |\n| mtd4 | 00370000 | 00010000 | \"rootfs_data\" |\n| mtd5 | 00800000 | 00010000 | \"image1\" |\n\n### When booting from image1\n\n| dev | size | erasesize | name |\n| ---- | -------- | --------- | ------------- |\n| mtd0 | 00040000 | 00010000 | \"uboot\" |\n| mtd1 | 00080000 | 00010000 | \"uboot_env\" |\n| mtd2 | 00740000 | 00010000 | \"image0\" |\n| mtd3 | 00800000 | 00010000 | \"linux\" |\n| mtd4 | 006d8077 | 00010000 | \"rootfs\" |\n| mtd5 | 00410000 | 00010000 | \"rootfs_data\" |\n\n## List of firmwares and files\n- [6BA1896SPLQA13 MTD0/U-Boot](https://mega.nz/file/wptjyYiS#Xj3cijX2bN0FexsZr1Wn7iRG0Wy4Z8vX0NyNBd1kBWo){: .btn } md5hash: 992b31a67c644aa68cf7f9caf956b1f9\n- [6BA1896SPLQA13 MTD2/Image0](https://mega.nz/file/1kUlUbgQ#ANS9qH6wCggYshsQ3STD6gxmR_3TL-5MXfdCl5s50Nk){: .btn } md5hash: 5d46a9acc3c5ba8710887aa32b82aeb4\n- [6BA1896SPLQA42 MTD0/U-Boot](https://mega.nz/file/FkswHbgL#s7-vaH65EPQ2O5vKeD3bU1_RPwzaKPOJdrCWvPQqDvc){: .btn } md5hash: 992b31a67c644aa68cf7f9caf956b1f9\n- [6BA1896SPLQA42 MTD2/Image0](https://mega.nz/file/AgshDICC#md1vLN14JBF3iaNoZBqQH_zwALHmEaOk3_rDm1FfOic){: .btn } md5hash: 04533554bb0c8b997697fbc048159002\n\n# Unlock the device\n\n{% include alert.html content=\"The following commands are to be used on version 6BA1896SPLQA42, to get the commands for version 6BA1896SPLQA41 please check the following page: [Carlito Firmware](/ont-huawei-ma5671a-carlito).\" alert=\"Note\" icon=\"svg-info\" color=\"blu\" %}\n\n\n## Bootloader unlock from shell\n{% include alert.html content=\"It is strongly recommended that you unlock the bootloader before making any major changes to the firmware.\" alert=\"Warning\" icon=\"svg-warning\" color=\"yellow\" %}\n```sh\nfw_setenv bootdelay 5\nfw_setenv asc0 0\nfw_setenv preboot \"gpio set 3;gpio input 2;gpio input 105;gpio input 106;gpio input 107;gpio input 108\"\n```\n\n## Emergency bootloader unlock via TTL serial\n\n{% include alert.html content=\"This is not necessary if you have already unlocked the bootloader from the shell as specified above.\" alert=\"Warning\" icon=\"svg-warning\" color=\"yellow\" %}\n\nIf for some reason you are in the situation where you do not have a bootable firmware on your SFP stick you can do an emergency unlock via TTL serial.\n\nTo perform the emergency unlock, the following hardware is required:\n- TTL-USB adapter,\n- SFP adapter to connect the TTL-USB cables to the SFP stick.\n\nThe electrical connections are the same as those of the Huawei MA5671A; see the [Huawei root guide](/ont-huawei-ma5671a-root-web) for accurate details on how to connect the TTL-USB to the SFP adapter.\n\nWhen you are ready with everything plugged in you need to press the button below. A window will open to execute the emergency unlock.\n\n{: .text-center .fs-6 }\n\n
{% include alert.html content=\"This browser is not compatible with the emergency unlock procedure. See the Browser compatibility\" alert=\"Note\" icon=\"svg-warning\" color=\"red\" %}
\n{% include root_lantiq.html modelName=\"FS GPON ONU Stick\" unlockHuaweiShell=false %}\n\n\n# GPON ONU status\n\n## Getting the operational status of the ONU\n\n```shell\nonu ploamsg\n```\n\n## Querying a particular OMCI ME\n```sh\nomci_pipe.sh meg MIB_IDX ME_IN\n```\nWhere `MIB_IDX` is the MIB ID and the `ME_IN` is the ME instance number\n\n## Getting/Setting Speed LAN Mode\n\nTo get the LAN Mode:\n\n```sh\nonu lanpsg 0\n```\nThe `link_status` variable tells the current speed\n\n| Value (for `sgmii_mode` and `link_status`) | Speed |\n| ------------------------------------------ | ---------------------------------- |\n| 3 | 1 Gbps / SGMII with auto-neg on |\n| 4 | 1 Gbps / SGMII with auto-neg off |\n| 5 | 2.5 Gbps / HSGMII with auto-neg on |\n\nTo change the default lan mode value you can use `fw_setenv sgmii_mode`. The firmware already has the value set to 5 by default and there should not be any need to change it.\n\n# GPON/OMCI settings\n\n## Setting ONU GPON Serial Number\n```sh\nset_serial_number ABCD12345678\n```\nOr:\n```sh\nsfp_i2c -i8 -s \"ABCD12345678\"\n```\n\n## Getting ONU GPON Serial Number\n```sh\nfw_printenv | grep nSerial\n```\nOr:\n```sh\nsfp_i2c -g\n```\n\n## Setting ONU GPON PLOAM password\n```sh\nsfp_i2c -i11 -s \"1234567890\"\n```\n\n## Setting ONU GPON LOID and LOID password\n```sh\nsfp_i2c -i9 -s \"1234567890\"\nsfp_i2c -i10 -s \"password01\"\n```\n\n## Setting OMCI equipment ID (ME 257)\n```sh\nsfp_i2c -i6 -s \"YOUR_EQUIPMENT_ID\"\n```\n\n## Setting OMCI Vendor ID (ME 256)\n```sh\nsfp_i2c -i7 -s \"YOUR_VENDOR_ID\"\n```\n\n## Setting OMCI hardware version (ME 256)\n```sh\nsed 's/256 0 HWTC 0000000000000/256 0 HWTC YOUR_ONU_VERSION/' /rom/etc/mibs/data_1g_8q.ini > /etc/mibs/data_1g_8q.ini\n```\n\n## Restoring the default ONU hardware version (ME 256)\n```sh\ncat /rom/etc/mibs/data_1g_8q.ini > /etc/mibs/data_1g_8q.ini\n```\n\n## Setting OMCI software version (ME 7)\n{% include alert.html content=\"The patch below is only compatible with the firmware version `6BA1896SPLQA42`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\nThe image version normally can't be changed because it is hard-coded into the `/opt/lantiq/bin/omcid` binary, \nso the binary has to be modified with the following hex patch which removes the hardcoded version.\n\n```\n< 000084c0: 9a43 931f f760 d840 9b64 f760 d864 1a00 .C...`.@.d.`.d..\n< 000084d0: 1acf 6500 1a20 2268 940a 2205 b468 1a00 ..e.. \"h..\"..h..\n---\n> 000084c0: 9a43 931f f760 d840 9b64 f760 d864 6500 .C...`.@.d.`.de.\n> 000084d0: 6500 6500 1a20 2268 940a 2205 b468 1a00 e.e.. \"h..\"..h..\n\n```\n\n{% include alert.html content=\"Proceed only if your `md5sum /opt/lantiq/bin/omcid` has the correct checksum `7e97163e24c9cb39439589c65b438168`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\nThis is the patch, encoded in base64\n```\nQlNESUZGNDA1AAAAAAAAAD4AAAAAAAAA2C8JAAAAAABCWmg5MUFZJlNZYqnvBwAACFBSQWAAAMAA\nAAgAQCAAMQwIIwjImgDOdMvi7kinChIMVT3g4EJaaDkxQVkmU1lrJSbUAACFTAjAACAAAAiCAAAI\nIABQYAFKQ01INxUgd6Soj2JURm8pUR8XckU4UJBrJSbUQlpoORdyRThQkAAAAAA=\n```\nSave it on your computer (not on the stick) as `omcid_patch.base64`, then run:\n```sh\nbase64 -d omcid_patch.base64 > omcid.bspatch\nbspatch omcid omcid.bspatch\n```\n{% include alert.html content=\"If you don't have bspatch installed, most distributions include it in the bsdiff package\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\nAfter patching the resulting patched `omcid` should have an md5 checksum of `525139425009c4138e92766645dad7d0`.\nIf that is also correct, continue by making a backup copy of your original `omcid` on the stick.\n\n```sh\ncd /opt/lantiq/bin\ncp omcid omcid.original\n```\n\nNow, SCP has to be used to copy the modified `omcid` binary in `/opt/lantiq/bin/omcid`.\nBefore restarting the stick and applying changes, make sure `omcid` has its execution bit set, then reboot the stick and change the image version with the following command:\n\n```sh\nchmod ugo+x /opt/lantiq/bin/omcid\n```\n\n\nIs also a good time to set the image0/image1_version: crashes have been reported if they are not set correctly before reboot.\n```sh\nfw_setenv image0_version YOUR_IMAGE0_VERSION\nfw_setenv image1_version YOUR_IMAGE1_VERSION\n```\n\nNow the stick can be rebooted.\n{% include alert.html content=\"Be aware that sometimes `omcid` can rewrite the two variables when run in its non-patched state. After reboot, double check the set values are still correct.\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n# Advanced settings\n\n## Setting `data_1g_8q_us1280_ds512.ini` OMCI MIB file for 2500 Mbps profiles\n{% include alert.html content=\"The patch provided below is only compatible with the firmware version `6BA1896SPLQA42`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n{% include alert.html content=\"If you need to set the ONU version remember that you will have to do it using the MIB file `/etc/mibs/data_1g_8q_us1280_ds512.ini` instead of `/etc/mibs/data_1g_8q.ini`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\nThe MIB file `data_1g_8q_us1280_ds512.ini` is very useful to avoid performance problems in situations where 2500 Mbps speed profiles are used. To enable it, run this command:\n```sh\nfw_setenv mib_file data_1g_8q_us1280_ds512.ini\n```\n\n## Setting custom OMCI MIB file\n{% include alert.html content=\"If you need to set the ONU version, remember that you will have to do it using your custom MIB file instead of `/etc/mibs/data_1g_8q.ini`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\nCopy the MIB file to /etc/mibs, then run this command:\n```sh\nfw_setenv mib_file YOUR_MIB_FILENAME\n```\n\n## Setting management MAC\n```sh\nuci set network.lct.macaddr=00:06:B5:07:D6:04\nuci set network.host.macaddr=00:06:B5:07:D8:04\nuci commit network.lct.macaddr=00:06:B5:07:D6:04\nuci commit network.host.macaddr=00:06:B5:07:D8:04\n```\n\n## Setting management IP\n```sh\nfw_setenv ipaddr 192.168.20.60\nfw_setenv gatewayip 192.168.20.1\n```\n\n## Rebooting the ONU\n```sh\nreboot\n```\n\n## Disable RX_LOS status\n{% include alert.html content=\"The patch provided below is only compatible with the firmware version `6BA1896SPLQA42`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\nSome switches/routers (e.g. Mikrotik) do not allow access to the magament interface without the fiber being connected because the SFP reports RX_LOS status It is possible to fix this by modifying the `mod_optic.ko` driver to spoof non RX_LOS status by setting PIN 8 (RX_LOS) to be always low.\n\nThis is the change to be made, in hex format:\n\n```\n< 00013740: 2404 0003 2405 0001 0c00 0000 ac43 0980 $...$........C..\n---\n> 00013740: 2404 0003 2405 0000 0c00 0000 ac43 0980 $...$........C..\n```\n\n{% include alert.html content=\"Proceed only if your `md5sum /lib/modules/3.10.49/mod_optic.ko` has the correct checksum `7c718c3410c4120fe98fa7a9a5c6c407`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\nThis is the patch, encoded in base64:\n```\nQlNESUZGNDA2AAAAAAAAADYAAAAAAAAAXEEFAAAAAABCWmg5MUFZJlNZ5TTrjgAAB+ZARjAEACAA\nAARAACAAMQZMQRppiFkgKGTeXi7kinChIcpp1xxCWmg5MUFZJlNZcaVLvQABOOCAwAAAAQAIAAig\nACClRgZoMhUf9JKbgIk3hdyRThQkHGlS70BCWmg5F3JFOFCQAAAAAA==\n```\n\nSave it on your computer (not on the stick) as `mod_optic.base64`, then run:\n```sh\nbase64 -d mod_optic.base64 > mod_optic.bspatch\nbspatch mod_optic.ko mod_optic.bspatch\n```\n{% include alert.html content=\"If you don't have bspatch installed, most distributions include it in the bsdiff package\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\nAfter patching the resulting `mod_optic.ko` should have an md5 checksum of `e14a5a70b023873853afe920870f076e`.\nIf that is also correct, continue by making a backup copy of your original `mod_optic.ko` on the stick.\n\n```sh\ncd /lib/modules/3.10.49/\ncp mod_optic.ko mod_optic.ko.original\n```\n\nNow use SCP to copy the modified `mod_optic.ko` kernel module in `/lib/modules/3.10.49/mod_optic.ko`.\n\n## TX Fault / Serial\n\nThe stick will remain in a perpetual \"TX Fault\" state as the same SFP pin is used for both serial and TX Fault signaling. If this causes you issues (normally it shouldn't), you can issue the commands below to disable it. Note that this will disable both the TX Fault signal and Serial on the stick after boot.\n\n```sh\nfw_setenv asc0 1\nfw_setenv preboot \"gpio set 3;gpio input 100;gpio input 105;gpio input 106;gpio input 107;gpio input 108\"\n```\n\nIn case you need to re-enable it, issue the following commands from the bootloader (FALCON)\n\n```sh\nFALCON => setenv asc0 0\nFALCON => saveenv\n```\n# SFP EEPROM settings\n\n## Reading all EEPROM\n```sh\nsfp_i2c -r\n```\n\n## Getting Firmware version\n```sh\nstrings /opt/lantiq/bin/omcid | grep ^software_Version | awk -F[=,] '{print $2}'\n```\n\n## Getting Firmware build time\n```sh\nstrings /opt/lantiq/bin/omcid | grep compiled\n```\n\n# EEPROM (I2C slave simulated EEPROM)\nThe FS GPON-ONU-34-20BI stick does not have a physical EEPROM, the Falcon SOC emulates an EEPROM by exposing it on the I2C interface as required by the SFF-8472 specification.\n\nOn the I2C interface, two memories of 256 bytes each will be available at the addresses `1010000X (A0h)` and `1010001X (A2h)`, however the actual available memory from the emulated EEPROM will be 640 bytes each, but only the first 256 bytes will be exposed in the I2C interface.\n\nThe FS stick stores the content of the emulated EEPROM in U-Boot env variables to restore it after a reboot:\n\n- `EEPROM0 (A0h)` stored in U-Boot env variable `sfp_a0_low_128`\n- `EEPROM1 (A2h)` stored in U-Boot env variable `sfp_a2_info`\n\n## EEPROM0 layout\n\n| address | size | name | default value | description |\n| ------- | ---- | --------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |\n| | | **BASE ID FIELDS (SFF-8472)** | | |\n| 0 | 1 | Identifier | `0x03` (SFP) | Type of transceiver |\n| 1 | 1 | Ext identifier | `0x04` (MOD_DEF 4) | Additional information about the transceiver |\n| 2 | 1 | Connector | `0x01` (SC) | Type of media connector |\n| 3-10 | 8 | Transceiver | `0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00` | Code for optical compatibility |\n| 11 | 1 | Encoding | `0x03` (NRZ) | High speed serial encoding algorithm |\n| 12 | 1 | Signaling Rate, Nominal | `0x0C` (1.244Gbps) | Nominal signaling rate |\n| 13 | 1 | Rate Identifier | `0x00` (Not used) | Type of rate select functionality |\n| 14 | 1 | Length (SMF,km) | `0x14` (20 km) | Link length supported for single-mode fiber, units of km |\n| 15 | 1 | Length (SMF) | `0xC8` (200 x 100m) | Link length supported for single-mode fiber, units of 100 m |\n| 16 | 1 | Length (50 um, OM2) | `0x00` (No support) | Link length supported for 50 um OM2 fiber, units of 10 m |\n| 17 | 1 | Length (62.5 um, OM1) | `0x00` (No support) | Link length supported for 62.5 um OM1 fiber, units of 10 m |\n| 18 | 1 | Length copper cable | `0x00` (No support) | Link length supported for copper or direct attach cable, units of m |\n| 19 | 1 | Length (50 um, OM3) | `0x00` (No support) | Link length supported for 50 um OM3 fiber, units of 10 m |\n| 20-35 | 16 | Vendor name | `0x46 0x53 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20` (FS) | SFP vendor name (ASCII) |\n| 36 | 1 | Transceiver | `0x00` (No support) | Code for optical compatibility |\n| 37-39 | 3 | Vendor OUI | `0x00 0x00 0x00` (No specified) | SFP vendor IEEE company ID |\n| 40-55 | 16 | Vendor PN | `0x47 0x50 0x4F 0x4E 0x2D 0x4F 0x4E 0x55 0x2D 0x33 0x34 0x2D 0x32 0x30 0x42 0x49` (GPON-ONU-34-20BI) | Part number provided by SFP vendor (ASCII) |\n| 56-59 | 4 | Vendor rev | `0x30 0x31 0x20 0x20` (01) | Revision level for part number provided by vendor (ASCII) |\n| 60-61 | 2 | Wavelength | `0x05 0x1E` (1310nm TX) | Laser wavelength |\n| 62 | 1 | Fibre Channel Speed 2 | `0x00` (No support) | Transceiver's Fibre Channel speed capabilities |\n| 63 | 1 | CC_BASE | | Check code for Base ID Fields (addresses 0 to 62) |\n| | | **EXTENDED ID FIELDS (SFF-8472)** | | |\n| 64-65 | 2 | Options | `0x00 0x1A` (TX DISABLE, TX FAULT, RX LOS) | Indicates which optional transceiver signals are implemented |\n| 66 | 1 | Signaling Rate, max | `0x00` (No specified) | Upper signaling rate margin, units of % |\n| 67 | 1 | Signaling Rate, min | `0x00` (No specified) | Lower signaling rate margin, units of % |\n| 68-83 | 16 | Vendor SN | Unique in each SFP | Serial number provided by vendor (ASCII) |\n| 84-91 | 8 | Date code | Unique in each SFP | Vendor's manufacturing date code |\n| 92 | 1 | Diagnostic Monitoring Type | `0x68` (Digital diagnostic, Internally calibrated, Received average power type) | Indicates which type of diagnostic monitoring is implemented |\n| 93 | 1 | Enhanced Options | `0xF0` (Alarm/warning flags, soft TX_DISABLE control, soft TX_FAULT monitoring, soft RX_LOS monitoring) | Indicates which optional enhanced features are implemented |\n| 94 | 1 | SFF-8472 Compliance | `0x05` (Rev 11.0 of SFF-8472) | Indicates which revision of SFF-8472 the transceiver complies with |\n| 95 | 1 | CC_EXT | | Check code for the Extended ID Fields (addresses 64 to 94) |\n| | | **VENDOR SPECIFIC FIELDS** | | |\n| 96-127 | 32 | Vendor data | `0x20 0x20 0x20...` (Not used) | Vendor specifc data (ASCII) |\n| 128-255 | 128 | Reserved | `0x00 0x00 0x00...` | Reserved |\n| | | **EXTRA EEPROM FIELDS** | | **Not exposed to I2C interface** |\n| 256-639 | 384 | Reserved | `0x00 0x00 0x00...` | Reserved |\n\n\n## EEPROM1 layout\n\n| address | size | name | default value | description |\n| ------- | ---- | --------------------------------- | ------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |\n| | | **DIAGNOSTIC AND CONTROL FIELDS** | | |\n| 0-1 | 2 | Temp High Alarm | `0x5F 0x00` (95℃) | Value expressed in two's complement |\n| 2-3 | 2 | Temp Low Alarm | `0xCE 0x00` (-50℃) | Value expressed in two's complement |\n| 4-5 | 2 | Temp High Warning | `0x5A 0x00` (90℃) | Value expressed in two's complement |\n| 6-7 | 2 | Temp Low Warning | `0xD3 0x00` (-45℃) | Value expressed in two's complement |\n| 8-9 | 2 | Voltage High Alarm | `0x8C 0xA0` (3.6V) | Value expressed in volt subunits[^subunit] |\n| 10-11 | 2 | Voltage Low Alarm | `0x75 0x30` (3.0V) | Value expressed in volt subunits[^subunit] |\n| 12-13 | 2 | Voltage High Warning | `0x88 0xB8` (3.5V) | Value expressed in volt subunits[^subunit] |\n| 14-15 | 2 | Voltage Low Warning | `0x79 0x18` (3.1V) | Value expressed in milliampere subunits[^subunit] |\n| 16-17 | 2 | Bias High Alarm | `0xAF 0xC8` (90mA) | Value expressed in milliampere subunits[^subunit] |\n| 18-19 | 2 | Bias Low Alarm | `0x00 0x00` (0mA) | Value expressed in milliampere subunits[^subunit] |\n| 20-21 | 2 | Bias High Warning | `0x88 0xB8` (70mA) | Value expressed in milliampere subunits[^subunit] |\n| 22-23 | 2 | Bias Low Warning | `0x00 0x00` (0mA) | Value expressed in milliampere subunits[^subunit] |\n| 24-25 | 2 | TX Power High Alarm | `0xF6 0x77` (8dBm) | Value expressed in watts subunits[^subunit] |\n| 26-27 | 2 | TX Power Low Alarm | `0x15 0xF7` (-2.5dBm) | Value expressed in watts subunits[^subunit] |\n| 28-29 | 2 | TX Power High Warning | `0xC3 0xC6` (7dBm) | Value expressed in watts subunits[^subunit] |\n| 30-31 | 2 | TX Power Low Warning | `0x1B 0xA7` (-1.5dBm) | Value expressed in watts subunits[^subunit] |\n| 32-33 | 2 | RX Power High Alarm | `0x0C 0x5A` (-5dBm) | Value expressed in watts subunits[^subunit] |\n| 34-35 | 2 | RX Power Low Alarm | `0x00 0x08` (-31dBm) | Value expressed in watts subunits[^subunit] |\n| 36-37 | 2 | RX Power High Warning | `0x09 0xCF` (-6dBm) | Value expressed in watts subunits[^subunit] |\n| 38-39 | 2 | RX Power Low Warning | `0x00 0x0A` (-30dBm) | Value expressed in watts subunits[^subunit] |\n| 40-45 | 6 | MAC address | Unique in each SFP | Contains the mac address of the SFP, it could also be empty |\n| 46-55 | 10 | Reserved | `0x00 0x00 0x00...` | Reserved |\n| 56-59 | 4 | RX_PWR(4) Calibration | `0x00 0x00 0x00 0x00` | 4th order RSSI calibration coefficient |\n| 60-63 | 4 | RX_PWR(3) Calibration | `0x00 0x00 0x00 0x00` | 3rd order RSSI calibration coefficient |\n| 64-67 | 4 | RX_PWR(2) Calibration | `0x00 0x00 0x00 0x00` | 2nd order RSSI calibration coefficient |\n| 68-71 | 4 | RX_PWR(1) Calibration | `0x3F 0x80 0x00 0x00` | 1st order RSSI calibration coefficient |\n| 72-75 | 4 | RX_PWR(0) Calibration | `0x00 0x00 0x00 0x00` | 0th order RSSI calibration coefficient |\n| 76-77 | 2 | TX_I(Slope) Calibration | `0x01 0x00` | Slope for Bias calibration |\n| 78-79 | 2 | TX_I(Offset) Calibration | `0x00 0x00` | Offset for Bias calibration |\n| 80-81 | 2 | TX_PWR(Slope) Calibration | `0x01 0x00` | Slope for TX Power calibration |\n| 82-83 | 2 | TX_PWR(Offset) Calibration | `0x00 0x00` | Offset for TX Power calibration |\n| 84-85 | 2 | T(Slope) Calibration | `0x01 0x00` | Slope for Temperature calibration |\n| 86-87 | 2 | T(Offset) Calibration | `0x00 0x00` | Offset for Temperature calibration, in units of 256ths °C |\n| 88-89 | 2 | V(Slope) Calibration | `0x01 0x00` | Slope for VCC calibration |\n| 90-91 | 2 | V(Offset) Calibration | `0x00 0x00` | Offset for VCC calibration |\n| 92-94 | 3 | Reserved | `0x00 0x00 0x00` | Reserved |\n| 95 | 1 | CC_DMI | | Check code for Base Diagnostic Fields (addresses 0 to 94) |\n| 96 | 1 | Temperature MSB | | Internally measured module temperature |\n| 97 | 1 | Temperature LSB | | |\n| 98 | 1 | Vcc MSB | | Internally measured supply voltage in transceiver |\n| 99 | 1 | Vcc LSB | | |\n| 100 | 1 | TX Bias MSB | | Internally measured TX Bias Current |\n| 101 | 1 | TX Bias LSB | | |\n| 102 | 1 | TX Power MSB | | Measured TX output power |\n| 103 | 1 | TX Power LSB | | |\n| 104 | 1 | RX Power MSB | | Measured RX input power |\n| 105 | 1 | RX Power LSB | | |\n| 106-109 | 4 | Optional Diagnostics | `0xFF 0xFF 0xFF 0xFF` (No support) | Monitor Data for Optional Laser temperature and TEC current |\n| 110 | 1 | Status/Control | `0x82` (Soft TX disable, disable laser, digital TX fault, digital RX LOS, power&data ready) | Optional Status and Control Bits |\n| 111 | 1 | Reserved | `0x00` | Reserved |\n| 112-113 | 2 | Alarm Flags | Supported | Diagnostic Alarm Flag Status Bits |\n| 114 | 1 | Tx Input EQ control | `0xFF` (No support) | Tx Input equalization level control |\n| 115 | 1 | Rx Out Emphasis control | `0xFF` (No support) | Rx Output emphasis level control |\n| 116-117 | 2 | Warning Flags | Supported | Diagnostic Warning Flag Status Bits |\n| 118-119 | 2 | Ext Status/Control | `0x00 0x00` (No support) | Extended module control and status bytes |\n| | | **GENERAL USE FIELDS** | | |\n| 120-126 | 7 | Vendor Specific | `0x70 0x00 0x00 0x00 0x00 0x00 0x00` | Vendor specific memory addresses |\n| 127 | 1 | Table Select | `0x00` | Optional Page Select |\n| | | **USER WRITABLE EEPROM** | | |\n| 128-190 | 63 | Reserved | `0xFF 0xFF 0xFF...` | Reserved |\n| 191-214 | 24 | GPON LOID or PLOAM | Depends on the configuration of the SFP | GPON Logical ONU ID or PLOAM, depends on `GPON LOID/PLOAM switch` |\n| 215-231 | 17 | GPON LPWD | Depends on the configuration of the SFP | GPON Logical Password |\n| 232 | 1 | GPON LOID/PLOAM switch | Depends on the configuration of the SFP | `0x01` to enable LOID, `0x02` to enable PLOAM |\n| 233-240 | 8 | GPON SN | Unique in each SFP | GPON Serial Number (ME 256) |\n| 241-247 | 7 | Reserved | `0xFF 0xFF 0xFF...` | Reserved |\n| 248-255 | 8 | Vendor Control | `0xFF 0xFF 0xFF...` (Not used) | Vendor specific control functions |\n| | | **EXTRA EEPROM FIELDS** | | **Not exposed to I2C interface** |\n| 256-511 | 256 | Unknown vendor specific | | Probably not used in current SFPs |\n| 512-531 | 20 | GPON Equipment ID | | GPON Equipment ID (ME 257), may not work in some firmwares |\n| 532-535 | 4 | GPON Vendor ID | | GPON Vendor ID (ME 256 and more), may not work in some firmware |\n| 536-639 | 104 | Reserved | | Reserved |\n\n{% include alert.html content=\"For more information, see the SFF-8472 Rev 11.0 specification.\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n# Miscellaneous Links\n\n- [FS.com](https://www.fs.com/it/products/133619.html)\n- [General setting of lantiq](https://forum.fibra.click/d/23881-ma5671a-e-vodafone-25-gbps/64)\n- [Usage GPON module SFP in Spain](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300)\n- [SourcePhotonics SPS-34-24T-HP-TDFO Datasheet](https://www.sourcephotonics.com/wp-content/uploads/2017/08/DS-8085-02_SPS-34-24T-HP-TDFO.pdf)\n- [FS.com GPON-ONU-34-20BI Configuration Guide](https://resource.fs.com/mall/doc/20230831180515egrzs6.pdf)\n\n---\n\n[^subunit]: The subunit are 10000 times smaller than the specified unit\n"
},
{
"path": "_ont/ont-fs-com-mod.md",
"content": "---\ntitle: FS.com Modded Firmware for Huawei MA5671A and FS.com GPON-ONU-34-20BI\nhas_children: false\nredirect_to: /ont-huawei-ma5671a-fs-mod\nlayout: default\nparent: FS.com GPON ONU Stick with MAC (GPON-ONU-34-20BI)\n---\n"
},
{
"path": "_ont/ont-fs-com-onu1710-1g.md",
"content": "---\ntitle: FS.com ONU1710-1G\nhas_children: false\nlayout: default\nparent: FS.com\n---\n\n# Hardware Specifications\n\n| | |\n| ------------ | -------------------------------------------- |\n| Vendor/Brand | FS.com |\n| Model | ONU1710-1G |\n| P/N | ONU1710-1G |\n| SKU | 154796 |\n| Chipset | Realtek RTL9601D |\n| CPU | MIPS-I 32-bit (big-endian) |\n| CPU Clock | 300 MHz |\n| RAM | 32 MB (DDR2, 325 MHz) |\n| Flash | 4 MB (SPI NOR, ZBIT JEDEC 5E4016) |\n| Bootloader | U-Boot 2011.12.NA (Realtek-modified) |\n| System | Linux 2.6.30.9 (Luna SDK / RSDK-1.5.6p2) |\n| XPON Mode | GPON + EPON dual-mode adaptive |\n| Optics | 1x PON (SC/UPC) |\n| Power | 12V DC, 5.5mm barrel jack (center positive) |\n| Ethernet | 1x GE (1000BASE-T, RJ45) |\n| IP address | 192.168.123.1 |\n| Web Gui | port 80, user `admin`, password `super&123` |\n| SSH | no |\n| Telnet | port 23, user `admin`, password `super&123` |\n| Serial | 115200 8-N-1 3.3V |\n| Form Factor | Desktop ONT |\n\n\n## Specifications\n\nThe ONU1710-1G is an XPON (GPON + EPON) dual-mode adaptive ONT with 1x GE Ethernet port. It supports 1.25 Gbps upstream and 2.5 Gbps downstream (GPON mode), complies with ITU-T G.984/G.987/G.988/G.989 standards, and supports network deployment up to 20 km.\n\n*Adapted from vendor's marketing material.*\n\n## List of software versions\n- 10.0.52B.2095 (2025-03-20)\n\n## Default credentials\n\nOnly the `user` account is publicly documented by FS.com. The `admin` account was discovered through firmware analysis.\n\n| Username | Password | Access | Notes |\n| -------- | ------------- | ---------- | ------------------------------------------------------ |\n| `user` | `123456` | Web/Telnet | Limited user account (publicly documented) |\n| `admin` | `super&123` | Web/Telnet | Super user / administrator |\n\n## Hardware\n\n{% include image.html file=\"fs-com-onu1710-1g/pcb.jpg\" alt=\"FS.com ONU1710-1G PCB\" caption=\"FS.com ONU1710-1G PCB\" %}\n\nKey components:\n- SoC: Realtek RTL9601D (MIPS-I 32-bit, 88-pin)\n- RAM: 32 MB DDR2\n- Flash: 4 MB SPI NOR (ZBIT JEDEC 5E4016)\n- Optical transceiver: Semtech GN25L95 BOSA, SC/UPC connector\n- Serial port: 4-pin 2.54mm header (unpopulated) 3.3V 115200 8-N-1\n\n## U-Boot environment\n\n{% include serial_dump.html title=\"Full printenv output\" file=\"fs-com-onu1710-1g/uboot-env.txt\" %}\n\nKey variables:\n\n| Variable | Value (default) | Description |\n| -------------- | --------------- | ------------------------------------------------------------------ |\n| `sw_active` | `1` | Currently active image slot (0 or 1; both point to same flash) |\n| `sw_commit` | `1` | Last committed image slot |\n| `sw_tryactive` | `2` | Boot control: `2` = boot by `sw_commit`; `0`/`1` = first-boot try |\n| `sw_valid0/1` | `1` | Image slot validity flag |\n| `sw_version0/1`| `10.0.52B.2095` | Firmware version string for each slot |\n| `ethaddr` | `00:E0:4C:86:70:01` | Factory MAC address |\n| `bootdelay` | `2` | U-Boot countdown in seconds before autoboot |\n| `serverip` | `192.168.123.100` | TFTP server address for firmware upload |\n\nFrom the running Linux shell, U-Boot environment variables can be read and written using `/bin/nv getenv ` and `/bin/nv setenv `.\n\n## List of partitions\n\nThe flash uses a single-image layout — both image slots (`k0`/`k1`, `r0`/`r1`) point to the same physical offsets.\n\n| dev | offset | size | erasesize | name | type |\n| ---- | ---------- | -------- | --------- | -------- | ------------------------------ |\n| mtd0 | 0x000000 | 0x02A000 | 0x001000 | \"boot\" | Preloader + U-Boot (LZMA) |\n| mtd1 | 0x02A000 | 0x002000 | 0x001000 | \"env\" | U-Boot environment (primary) |\n| mtd2 | 0x02C000 | 0x002000 | 0x001000 | \"env2\" | U-Boot environment (backup) |\n| mtd3 | 0x02E000 | 0x012000 | 0x001000 | \"config\" | JFFS2 configuration filesystem |\n| mtd4 | 0x040000 | 0x139000 | 0x001000 | \"k0\" | Kernel uImage (LZMA) |\n| mtd5 | 0x179000 | 0x287000 | 0x001000 | \"r0\" | Root filesystem (SquashFS+LZMA)|\n| mtd6 | 0x040000 | 0x139000 | 0x001000 | \"k1\" | Kernel uImage (same as k0) |\n| mtd7 | 0x179000 | 0x287000 | 0x001000 | \"r1\" | Root filesystem (same as r0) |\n\nTo dump the full flash contents over serial from the U-Boot prompt, read it in 1 MB chunks using `sf read` and dump each chunk as hex with `md.b`:\n\n```\nsf probe\nsf read 0x80000000 0x000000 0x100000\nmd.b 0x80000000 0x100000\nsf read 0x80000000 0x100000 0x100000\nmd.b 0x80000000 0x100000\nsf read 0x80000000 0x200000 0x100000\nmd.b 0x80000000 0x100000\nsf read 0x80000000 0x300000 0x100000\nmd.b 0x80000000 0x100000\n```\n\nCapture the serial output with a terminal emulator, then convert the hex dump to binary.\n\n## Bootup\n\n{% include serial_dump.html title=\"Full boot log captured on serial port\" file=\"fs-com-onu1710-1g/bootlog.txt\" %}\n\n\n1. **Preloader** (Bismarck 3.5) initializes DDR2 DRAM, decompresses and launches U-Boot\n2. **U-Boot** (2s delay, 115200 baud) checks `sw_tryactive`: if it equals `2`, boots by `sw_commit`; otherwise it is a first-boot attempt that sets `sw_tryactive=2`, saves env, and boots the selected image\n3. **Kernel** boots with `console=ttyS0,115200`, mounts SquashFS root\n4. **`/etc/init.d/rcS`** runs init scripts `rc0`–`rc63` sequentially:\n - `rc2`: Mounts `/proc`, ramfs, sysfs, tmpfs `/dev`; mounts JFFS2 config to `/var/config`; brings up `lo` and `nas0`\n - `rc3`: Runs `configd`, loads XML config (`config_xmlconfig.sh -b`), inserts kernel modules (`insdrv.sh`), runs SDK init (`runsdk.sh`), starts OMCI (`checkomci`)\n - `rc10`: Tunes kernel network parameters (conntrack timeouts, IP forwarding)\n - `rc14`: Configures IPv6 sysctl settings\n - `rc32`: Launches `startup` daemon and BOSA optical calibration (`rtkbosa.sh`)\n - `rc34`: Enables hardware watchdog\n - `rc35`: Enables PHY ports\n\n## Filesystem\n\nThe root filesystem is a SquashFS image (LZMA-compressed) with 525 files and stripped binaries. Runtime state is kept on a tmpfs (`/var`) and the JFFS2 config partition (mounted at `/var/config`).\n\n```\nsquashfs-root/\n bin/ -- BusyBox 1.12.4 + OMCI tools (omcicli, omci_app, checkomci), boa, iptables,\n -- diag, ethctl, flash (aliased as nv), configd, xmlconfig, pondetect, igmpd, ...\n etc/\n init.d/ -- rcS, rc2, rc3, rc10, rc14, rc32, rc34, rc35\n scripts/ -- mnt_cfgfs.sh, insdrv.sh, runsdk.sh, rtkbosa.sh, factory reset helpers\n home/httpd/\n boa.conf -- Boa v0.94 web server configuration (User 0, Group 0)\n web/ -- 243 ASP pages (WAN, LAN, OMCI info, VLAN, QoS, firewall, TR-069, diagnostics, ...)\n lib/\n librtk.so -- Realtek SDK (~964 KB, largest userspace library)\n libmib.so -- MIB management\n libomci_*.so -- OMCI stack (API, FAL, GOS, MIB, voice)\n libmultilang_*.so -- i18n strings (Chinese + English)\n modules/ -- Kernel modules (omcidrv.ko, pf_rtk.ko, epon_drv.ko, igmp_drv.ko,\n -- europa_drv.ko, rldp_drv.ko, dpbcaster.ko, ...)\n omci/ -- 127 OMCI MIB handler plugins (.so), one per managed entity type\n voip/ -- SIP/VoIP libraries\n etc/scripts/flash -- Shell script for reading/writing MIB variables via xmlconfig\n```\n\nThe config partition (`/var/config`) holds `lastgood.xml` (XML runtime config, persisted across reboots) and OMCI MIB state (`omci_mib.cfg`).\n\nNote: the `flash` MIB tool (`/etc/scripts/flash`) and the `nv` U-Boot env tool (`/bin/nv`) are separate commands for different purposes.\n\n\n# GPON/OMCI settings\n\n## Via web UI\n\nThe ONU1710-1G exposes several hidden web UI pages for GPON/OMCI configuration that are not linked in the main navigation. Log in as `admin` and access them by URL.\n\n### Version modification (vermod.asp)\n\nAccessible at `http://192.168.123.1/vermod.asp`, this page allows changing:\n- Manufacturer, OUI, Product Class\n- Serial Number, Provisioning Code\n- Spec Version, Software Version, Hardware Version\n- GPON Serial Number\n- ELAN MAC Address\n- **Export**: Download the current OMCI event log\n- **Import**: Upload a shell script that is executed as root (see Security section)\n\n{% include image.html file=\"fs-com-onu1710-1g/vermod.png\" alt=\"FS.com ONU1710-1G vermod.asp\" caption=\"Version modification page (vermod.asp)\" %}\n\n### GPON configuration (gpon.asp)\n\nAccessible at `http://192.168.123.1/gpon.asp`, this page allows changing:\n- PLOAM Password (max 10 characters)\n- LOID (max 24 characters)\n- LOID Password (max 12 characters)\n\n### OMCI information (omci_info.asp)\n\nAccessible at `http://192.168.123.1/omci_info.asp`, this page allows viewing/changing:\n- OMCI Software Version 1/2\n- CWMP Product Class\n- CWMP Hardware Version\n- OMCI Vendor ID\n\n### WAN configuration (waneth.asp)\n\nAccessible at `http://192.168.123.1/waneth.asp`, this page supports the following connection types:\n- **Bridge**: Transparent L2 bridge (no NAT, no routing)\n- **PPPoE**: PPP over Ethernet (typical ISP authentication)\n- **IPoE**: IP over Ethernet (DHCP or static IP)\n\nThe page also allows configuring NAPT (NAT), IGMP snooping, QoS, default route, and IPv6.\n\n## Via Telnet\n\nConfiguration can be done via telnet using the `flash` command (`/etc/scripts/flash`). The user and admin passwords can also be changed through the web UI.\n\n```sh\n# LOID and PLOAM password\nflash get LOID\nflash set LOID YOURLOID\nflash get LOID_PASSWD\nflash set LOID_PASSWD YOURLOIDPASSWORD\nflash get GPON_ONU_PASSWD\nflash set GPON_ONU_PASSWD 1234567890\n\n# GPON serial number / vendor ID\nflash get GPON_SN\nflash set GPON_SN ABCD12345678\nflash get PON_VENDOR_ID\nflash set PON_VENDOR_ID ABCD\n\n# Hardware / software version strings (reported via OMCI)\nflash get HW_HWVER\nflash set HW_HWVER 1.0\nflash get HW_CWMP_PRODUCTCLASS\nflash set HW_CWMP_PRODUCTCLASS MyProduct\n\n# OMCI software version\nflash get OMCI_SW_VER1\nflash set OMCI_SW_VER1 V1.9.0\nflash get OMCI_SW_VER2\nflash set OMCI_SW_VER2 V1.9.0\n\n# PON mode (1=GPON, 2=EPON, 3=Ethernet)\nflash get PON_MODE\nflash set PON_MODE 1\n\n# Bridge mode\nflash get DIRECT_BRIDGE_MODE\nflash set DIRECT_BRIDGE_MODE 1\n\n# User and admin passwords\nflash get USER_PASSWORD\nflash set USER_PASSWORD newpassword\nflash get SUSER_PASSWORD\nflash set SUSER_PASSWORD newpassword\n```\n\n\n# Security considerations\n\n{% include alert.html content=\"This device has extremely poor security practices and should not be used in any environment where it may be reachable by untrusted parties.\" alert=\"Warning\" icon=\"svg-warning\" color=\"red\" %}\n\n- **Undocumented default credentials**: The `admin` account (`super&123`) is not mentioned in any FS.com documentation but has full administrative access. The firmware also contains references to additional accounts (`adsl`/`xponadmin`, `xponadmin`/`xponre@1t3k`) in inactive backup config files and hardcoded code paths. These were not usable but are likely leftovers from the Realtek SDK.\n- **Unencrypted management protocols**: Both the web interface (HTTP port 80) and Telnet (port 23) transmit credentials and configuration in cleartext. Both are enabled by default.\n- **Arbitrary script upload and execution**: The `vermod.asp` page has an \"Import\" form that posts to `/boaform/formImportOMCIShell`. The handler writes the uploaded file to `/tmp/omcishell` and executes it immediately via `system(\"/bin/sh /tmp/omcishell\")`. Likely an intentional debug feature that allows the `admin` user to execute commands as root without going through telnet.\n- **Privilege escalation via auth realm mismatch**: The Boa web server maps `/` to admin credentials and `/boaform/admin` to user credentials. Admin-only handlers like `formImportOMCIShell` can be reached by the low-privilege `user` account by requesting `/boaform/admin/formImportOMCIShell` instead. This gives the unprivileged account full root access.\n- **All services run as root**: The web server (Boa), telnet daemon, and OMCI stack all run with root privileges (UID 0).\n- **Management services bind on all interfaces**: Boa (port 80) and telnet (port 23) bind to `::` with no iptables rules. When connected to GPON, depending on the ISP's network configuration, these services may be reachable beyond the LAN; though this has not been practically verified.\n\n# Miscellaneous Links\n\n- [FS.com ONU1710-1G Product Page](https://www.fs.com/eu-en/products/154796.html)\n- [Hacking RTL960x](https://github.com/Anime4000/RTL960x)\n"
},
{
"path": "_ont/ont-fs-com.md",
"content": "---\ntitle: FS.com \nhas_children: true\nlayout: default\n---\n"
},
{
"path": "_ont/ont-genexis-ft-g2110c-2.5g.md",
"content": "---\ntitle: FiberTwist G2110C-2.5G\nhas_children: false\nlayout: default\nparent: Genexis\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | ------------------------------------------------------------ |\n| Vendor/Brand | Genexis FiberTwist |\n| Model | G2110C-2.5G |\n| Chipset | Realtek RTL9601D |\n| Flash | 128MB |\n| RAM | 32MB |\n| System | Linux 3.18 (Luna SDK 3.3) |\n| LAN | 2.5GBaseT |\n| Optics | SC/APC |\n| IP address | 192.168.100.1/24 or 192.168.1.1/24 |\n| Web Gui | Can be enabled, locked down by iptables rule and missing CSS |\n| SSH | |\n| Telnet | ✅ user `company`, password `amyM77yY` |\n| Serial | ✅ |\n| Serial baud | 115200 |\n| Serial encoding | 8-N-1 |\n| Form Factor | ONT |\n\n{% include image.html file=\"ft-g2110c-2.5g-front.jpg\" alt=\"FiberTwist G2110C-2.5G Front\" caption=\"FiberTwist G2110C-2.5G Front\" %}\n\n{% include image.html file=\"ft-g2110c-2.5g-back.jpg\" alt=\"FiberTwist G2110C-2.5G Back\" caption=\"FiberTwist G2110C-2.5G Back\" %}\n\n## Optical Header installation backplate\n{% include image.html file=\"ft-g2110c-2.5g-optical-header-1.jpg\" alt=\"FiberTwist G2110C-2.5G Optical Header installation backplate\" caption=\"FiberTwist G2110C-2.5G Optical Header installation backplate\" %}\n\n{% include image.html file=\"ft-g2110c-2.5g-optical-header-2.jpg\" alt=\"FiberTwist G2110C-2.5G Optical Header installation backplate\" caption=\"FiberTwist G2110C-2.5G Optical Header installation backplate\" %}\n\n{% include image.html file=\"ft-g2110c-2.5g-optical-header-3.jpg\" alt=\"FiberTwist G2110C-2.5G Optical Header installation backplate\" caption=\"FiberTwist G2110C-2.5G Optical Header installation backplate\" %}\n\n## Serial\n\nThe ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. To accept TX line commands, the GND of the TTL adapter should be attached to the ONT's shield:\n\n{% include image.html file=\"ft-g2110c-2.5g-internal.jpg\" alt=\"FiberTwist G2110C-2.5G Internal\" caption=\"FiberTwist G2110C-2.5G Internal\" %}\n\n{% include alert.html content=\"Some USB TTL adapters label TX and RX pins the other way around: try swapping them if the connection doesn't work.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n## List of software versions\n- C-5.6.1-R\n- C-5.7.0-R\n- C-5.7.1-DEV3\n- C-5.7.1-EFT1\n\n## List of partitions\n\n| dev | size | erasesize | name |\n| ----- | -------- | --------- | --------------- |\n| mtd0 | 00040000 | 00001000 | \"boot\" |\n| mtd1 | 00002000 | 00001000 | \"env\" |\n| mtd2 | 00002000 | 00001000 | \"env2\" |\n| mtd3 | 0003c000 | 00001000 | \"config\" |\n| mtd4 | 00300000 | 00001000 | \"k0\" |\n| mtd5 | 004c0000 | 00001000 | \"r0\" |\n| mtd6 | 00300000 | 00001000 | \"k1\" |\n| mtd7 | 004c0000 | 00001000 | \"r1\" |\n| mtd8 | 00001000 | 00001000 | \"Partition_008\" |\n| mtd9 | 00001000 | 00001000 | \"Partition_009\" |\n| mtd10 | 00001000 | 00001000 | \"Partition_010\" |\n| mtd11 | 00001000 | 00001000 | \"Partition_011\" |\n| mtd12 | 00300000 | 00001000 | \"linux\" |\n| mtd13 | 004c0000 | 00001000 | \"rootfs\" |\n\nThis ONT supports dual boot. \n\n`k0` and `r0` respectively contain the kernel and firmware of the first image, `k1` and `r1` the kernel and the firmware of the second one\n\n# GPON/OMCI settings\n\n{% include alert.html content=\"Some variables are write-protected, you need to unlock them before proceeding\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\nUse the following command to unlock write-protected variables:\n\n```sh\n# nv setenv ProtectEnv 0\n```\n\n## Getting/Setting ONU GPON Serial Number\n\n{% include alert.html content=\"If your serial number has letters after the Vendor ID (e.g. ZTEGAAA01234), put them in lower case (e.g. ZTEGaaa01234)\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n```sh\n# nv setenv GponSn ZTEGaaa01234\n```\nReboot the ONT to apply any changes\n\nYou can check if the serial number was correctly changed using the following command:\n\n```sh\n# diag gpon get serialnumber\nZTEGaaa01234\n```\n\n## Getting/Setting ONU GPON PLOAM password\n\n{% include alert.html content=\"The PLOAM password is stored in ASCII format\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n```sh\n# /etc/scripts/flash get GPON_PLOAM_PASSWD\nGPON_PLOAM_PASSWD=AAAAAAAAAA\n# /etc/scripts/flash set GPON_PLOAM_PASSWD AAAAAAAAAA\n```\nIt seems Genexis has also included a U-Boot variable to store the PLOAM. On currently known firmwares (5.6.1 and 5.7.0) it is not read by the `omci_app` daemon.\nFor future-proofing reasons, set your PLOAM also on the before-mentioned U-Boot env using the following command in the OS shell:\n\n```sh\n# nv setenv ploampwd 1234567890\nploampwd=1234567890\n```\n## Setting OMCI software version (ME 7)\n\nThe stock firware does not allow changing of the primary and standby software version. \nAs the ONT uses the Luna SDK, the `/etc/scripts/flash` shell script can be easily modified by creating a custom firmware with the same set of patches suggested e.g. for the [Technicolor AFM0002](/ont-technicolor-afm0002) ONT.\n\nYou can then check if the software version was changed correctly with this command (take a look at the `Version` field):\n\n```sh\n# omcicli mib get 7\nXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\nSWImage\nXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n=================================\nEntityID: 0x00\nActive: 0\nCommitted: 0\nValid: 1\n*Version: V6.0.10N14*\nProductCode:\nImageHash: 0x00000000000000000000000000000000\n=================================\n=================================\nEntityID: 0x01\nActive: 1\nCommitted: 1\nValid: 1\n*Version: V6.0.10N14*\nProductCode:\nImageHash: 0x00000000000000000000000000000000\n=================================\n```\n\n## Setting OMCI hardware version (ME 256)\n\n```sh\n# nv setenv HV G2110CE2V1D0\n```\nReboot the ONT to apply the change\n\n## Setting OMCI equipment ID (ME 257)\n\n```sh\n# nv setenv ProdName FT-G2110C-2.5G\n```\nReboot the ONT to apply the change\n\n# Advanced settings\n\n## Setting management IP\n```sh\n# /etc/scripts/flash get LAN_IP_ADDR\nLAN_IP_ADDR=192.168.1.1\n# /etc/scripts/flash set LAN_IP_ADDR 192.168.1.1\n ```\n\n# Known Bugs\n- The web UI can be enabled by modding the firmware, but the daemon will crash if no optical signal is received\n\n# Miscellaneous Links\n- [FiberTwist G2110C-2.5G](https://genexis.eu/content/uploads/2020/07/FiberTwist-G2110C-2.5G-Installation-Guide-v1.0-EN.pdf)\n\n"
},
{
"path": "_ont/ont-genexis-ft-g2110c.md",
"content": "---\ntitle: FiberTwist G2110C\nhas_children: false\nlayout: default\nparent: Genexis\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | ------------------ |\n| Vendor/Brand | Genexis FiberTwist |\n| Model | G2110C |\n| Chipset | |\n| Flash | |\n| RAM | |\n| System | |\n| LAN | 1 GBaseT |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Serial baud | |\n| Serial encoding | |\n| Form Factor | ONT |\n\n{% include image.html file=\"ft-g2110c-front.jpg\" alt=\"FiberTwist G2110C Front\" caption=\"FiberTwist G2110C Front\" %}\n\n{% include image.html file=\"ft-g2110c-back.jpg\" alt=\"FiberTwist G2110C Back\" caption=\"FiberTwist G2110C Back\" %}\n\n{% include image.html file=\"ft-g2110c-ports.jpg\" alt=\"FiberTwist G2110C Ports\" caption=\"FiberTwist G2110C Ports\" %}\n\n\n## Optical Header installation backplate\n{% include image.html file=\"ft-g2110c-optical-header-1.jpg\" alt=\"FiberTwist G2110C-2.5G Optical Header installation backplate\" caption=\"FiberTwist G2110C-2.5G Optical Header installation backplate\" %}\n\n\n# Miscellaneous Links\n- [FiberTwist G2110C](https://genexis.eu/wp-content/uploads/2024/08/FiberTwist-G2110C-Installation-Guide-v.3.0-EN.pdf)\n\n"
},
{
"path": "_ont/ont-genexis.md",
"content": "---\ntitle: Genexis\nhas_children: true\nlayout: default\n---\n"
},
{
"path": "_ont/ont-halny-hl-gsfp.md",
"content": "---\ntitle: HALNy HL-GSFP\nhas_children: false\nlayout: default\nparent: HALNy\n---\n\n# Hardware Specifications\n\n| | |\n| ---------------- | -------------------- |\n| Vendor/Brand | HALNy |\n| Model | HL-GSFP |\n| ODM | T&W |\n| ODM Product Code | TW2362H-CDEL |\n| Chipset | Lantiq PEB98035 |\n| Flash | 8 MB |\n| RAM | 64 MB |\n| CPU | MIPS 34Kc interAptiv |\n| CPU Clock | 400MHz |\n| System | OpenWRT |\n| HSGMII | Yes |\n| Optics | SC/APC |\n| IP address | 192.168.77.154/30 |\n| Web Gui | none |\n| SSH | port 22666 |\n| Telnet | |\n| Serial | ✅ |\n| Serial baud | 115200 |\n| Serial encoding | 8-N-1 |\n| Form Factor | miniONT SFP |\n\n{% include image.html file=\"hl-gsfp-1.png\" alt=\"HALNy HL-GSFP top\" caption=\"HALNy HL-GSFP top\" %}\n{% include image.html file=\"hl-gsfp-2.png\" alt=\"HALNy HL-GSFP bottom\" caption=\"HALNy HL-GSFP bottom\" %}\n\n## Firmware is interchangeable with:\n\n- [Zyxel PMG3000-D20B](/ont-zyxel-pmg3000-d20b)\n- [D-LINK DPN-100-Rev-A2](/ont-d-link-dpn-100-rev-a2)\n- [Zisa OP151s](/ont-zisa-op151s)\n- [T&W TW2362H-CDEL](/ont-t-w-tw2362h-cdel)\n\n## List of partitions\n\n| dev | size | erasesize | name |\n| ---- | -------- | --------- | ------------- |\n| mtd0 | 00040000 | 00010000 | \"uboot\" |\n| mtd1 | 00020000 | 00010000 | \"uboot_env\" |\n| mtd2 | 003d0000 | 00010000 | \"image0\" |\n| mtd3 | 003d0000 | 00010000 | \"linux\" |\n| mtd4 | 002a87aa | 00010000 | \"rootfs\" |\n| mtd5 | 000a0000 | 00010000 | \"rootfs_data\" |\n\n\n"
},
{
"path": "_ont/ont-halny.md",
"content": "---\ntitle: HALNy\nhas_children: true\nlayout: default\n---"
},
{
"path": "_ont/ont-hilink-hl23446.md",
"content": "---\ntitle: Hilink HL23446\nhas_children: false\nalias: CarlitoxxPro CPGOS03-0490 v1\nlayout: default\nparent: Hilink\n---\n\n# Hardware Specifications\n\n| | |\n| ------------ | -------------------- |\n| Vendor/Brand | Hilink |\n| Model | HL23446 |\n| Chipset | Lantiq PEB98035 |\n| Flash | 16 MB |\n| RAM | 64 MB |\n| CPU | MIPS 34Kc interAptiv |\n| CPU Clock | 400MHz |\n| System | OpenWRT |\n| HSGMII | Yes |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | ✅ |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Form Factor | miniONT SFP |\n\n{% include image.html file=\"hl23446.png\" alt=\"Hilink HL23446\" caption=\"Hilink HL23446\" %}\n\n## Possible Clones\n- CarlitoxxPro CPGOS03-0490 **v1**\n\n## Firmware is interchangeable with:\n\n- [Huawei MA5671A](/ont-huawei-ma5671a)\n- [Nokia G-010S-P](/ont-nokia-g-010s-p)\n- [FS.com GPON ONU Stick with MAC / SourcePhotonics SPS-34-24T-HP-TDFO](/ont-fs-com-gpon-onu-stick-with-mac)\n- {:.text-red-200 } Dasan H650SFP \n- {:.text-red-200 } DpOptics D23446 \n- {:.text-red-200 } Photonics SPS-34-24T-HP-TDFO\n\n## List of partitions\n\n| dev | size | erasesize | name |\n| ---- | -------- | --------- | ------------- |\n| mtd0 | 00040000 | 00010000 | \"uboot\" |\n| mtd1 | 00080000 | 00010000 | \"uboot_env\" |\n| mtd2 | 00740000 | 00010000 | \"linux\" |\n| mtd3 | 0061eedc | 00010000 | \"rootfs\" |\n| mtd4 | 00370000 | 00010000 | \"rootfs_data\" |\n| mtd5 | 00800000 | 00010000 | \"image1\" |\n\n\n# Miscellaneous Links\n\n- [Usage GPON module SFP in Spain](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300)\n\n"
},
{
"path": "_ont/ont-hilink.md",
"content": "---\ntitle: Hilink\nhas_children: true\nlayout: default\n---"
},
{
"path": "_ont/ont-hisense-lte3415-sca+.md",
"content": "---\ntitle: HiSense LTE3415-SCA+\nhas_children: false\nredirect_to: /ont-technicolor-afm0002\nlayout: default\nparent: HiSense\n---"
},
{
"path": "_ont/ont-hisense-lte3415-sh+.md",
"content": "---\ntitle: HiSense LTE3415-SH+\nhas_children: false\nredirect_to: /ont-technicolor-afm0003\nlayout: default\nparent: HiSense\n---"
},
{
"path": "_ont/ont-hisense.md",
"content": "---\ntitle: HiSense\nhas_children: true\nlayout: default\n---"
},
{
"path": "_ont/ont-huawei-eg8010h.md",
"content": "---\ntitle: Huawei EG8010H \nhas_children: false\nlayout: default\nparent: Huawei\n---\n\n# Hardware Specifications\n\n| | |\n| ------------ | ------------------------------------------------------------------------------------ |\n| Vendor/Brand | Huawei |\n| Model | EG8010H |\n| ODM | ✅ |\n| Chipset | HiSilicon |\n| Flash | 128MiB SLC NAND (DS35Q1GA-IB) |\n| RAM | 256MiB |\n| CPU | HiSilicon A9 dual core (ARMv7) |\n| System | Dopra Linux |\n| 2.5GBaseT | No |\n| Optics | SC/APC and SC/UPC |\n| IP address | 192.168.100.1 or 192.168.18.1 |\n| Web Gui | ✅ user `root`, password `admin` or `adminHW` and user `Epadmin`, password `adminEp` |\n| SSH | |\n| Telnet | After enabling, user `root`, password `admin` or `adminHW` |\n| | user `Eproot`, password `adminEp` |\n| Serial | |\n| Form Factor | ONT |\n\n## Hardware revisions\n- v1: Horizontal PON port \n- v2: Horizontal PON port \n- v3: Vertical PON port\n- v4: Vertical PON port\n- v5: Vertical PON port\n- v6: Vertical PON port\n\n## List of software versions\n\n- V5R020C10S035\n\n{% include_relative ont-huawei-useful-command.md %}\n"
},
{
"path": "_ont/ont-huawei-eg8010n.md",
"content": "---\ntitle: Huawei EG8010N \nhas_children: false\nlayout: default\nparent: Huawei\n---\n\n# Hardware Specifications\n\n| | |\n| ------------ | ------- |\n| Vendor/Brand | Huawei |\n| Model | EG8010N |\n| Chipset | |\n| Flash | |\n| RAM | |\n| CPU | |\n| System | |\n| 2.5GBaseT | Yes |\n| Optics | |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Form Factor | ONT |\n\n\n"
},
{
"path": "_ont/ont-huawei-hg8010h.md",
"content": "---\ntitle: Huawei HG8010H \nhas_children: false\nlayout: default\nparent: Huawei\n---\n\n# Hardware Specifications\n\n| | |\n| ------------ | ---------------------------------------------------------------------------------------------- |\n| Vendor/Brand | Huawei |\n| Model | HG8010H |\n| ODM | ✅ |\n| Chipset | HiSilicon SD5116 |\n| Flash | 128MiB (SLC NAND DS35Q1GA-IB) |\n| RAM | 256MiB |\n| CPU | Hisilicon A9 dual core (ARMv7) |\n| System | Dopra Linux |\n| 2.5GBaseT | No |\n| Optics | SC/APC and SC/UPC |\n| IP address | 192.168.100.1 |\n| Web Gui | ✅ user `root`, password `admin` or `adminHW` and user `telecomadmin`, password `admintelecom` |\n| SSH | |\n| Telnet | After Enabling user `root`, password `admin` or `adminHW` |\n| Serial | |\n| Form Factor | ONT |\n\n\n{% include image.html file=\"hg8010h.jpg\" alt=\"HG8010H\" caption=\"HG8010H: Horizontal PON port (left, middle); vertical PON port (right)\" %}\n{% include image.html file=\"hg8010hvorr.jpg\" alt=\"HG8010Hv3/4/5\" caption=\"Bottom of the HG8010Hv3/4/5\" %}\n{% include image.html file=\"hg8010hv6.jpg\" alt=\"HG8010Hv6\" caption=\"Bottom of the HG8010Hv6\" %}\n\n## Hardware revisions\n- v1: Horizontal PON port \n- v2: Horizontal PON port \n- v3: Vertical PON port\n- v4: Vertical PON port\n- v5: Vertical PON port\n- v6: Vertical PON port\n\n## List of software versions\n\n- HWTCA31610003\n- V3R013C10S112\n- V3R015C10S106\n- V3R016C10S003 (V300R016C10SPC003B010)\n- V3R017C00S100\n- V3R017C10S201 (V300R017C10SPC201B255) \n- V5R020C10S020 (V500R020C10SPC020B014 - V500R020C10SPC020A2011020049)\n- V5R020C10S024 (V500R020C10SPC024B001)\n- V5R020C10S025 (V500R020C10SPC025B002)\n- V5R020C10S115 (V500R020C10SPC115B270)\n- V3R017C10S265\n\n## List of partitions\n\n0x000000000000-0x000000100000 : \"bootcode\" (1MiB) \n0x000000100000-0x000008000000 : \"ubilayer_v5\" (127MiB) \n\n{% include_relative ont-huawei-useful-command.md %}\n\n# Miscellaneous Links\n\n- [Exploring the Huawei HG8010H GPON ONT](https://www.linux.it/~md/text/gpon-sha2017.pdf)\n- [Unlock HG8010Hv3 softmode](https://lafibre.info/orange-installation/unlock-hg8010gv3-softmode/)\n- [Notes on a Huawei HG810H (N.B. SSL error)](https://umbriel.fr/blog/Notes_on_a_Huawei_HG8010H.html)\n- [Encrypt/Decrypt configuration file of most HuaWei HG routers](https://github.com/clippit/huawei-hg)\n\n\n# Teardown and other photos\n\n## v1-2\n\n{% include image.html file=\"hg8010h_teardown_1.jpg\" alt=\"HG8010Hv1/2 Teardown\" caption=\"HG8010Hv1/2: Teardown\" %}\n{% include image.html file=\"hg8010h_teardown_2.jpg\" alt=\"HG8010Hv1/2 Teardown\" caption=\"HG8010Hv1/2: Teardown\" %}\n\n## v6\n\n{% include image.html file=\"hg8010h_teardown_1_v6.jpg\" alt=\"HG8010Hv6 Teardown\" caption=\"HG8010Hv6: Teardown\" %}\n{% include image.html file=\"hg8010h_teardown_2_v6.jpg\" alt=\"HG8010Hv6 Teardown\" caption=\"HG8010Hv6: Teardown\" %}\n"
},
{
"path": "_ont/ont-huawei-hg8110h.md",
"content": "---\ntitle: Huawei HG8110H\nhas_children: false\nlayout: default\nparent: Huawei\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | -------------------------------- |\n| Vendor/Brand | Huawei |\n| Model | HG8110H |\n| Chipset | |\n| Flash | |\n| RAM | |\n| System | |\n| 2.5GBaseT | No |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Serial baud | |\n| Serial encoding | |\n| Form Factor | ONT |\n\n## List of software versions\n\n## List of partitions\n\n# Miscellaneous Links\n\n- [Openreach FTTP deployment](https://www.openreach.com/fibre-broadband)\n"
},
{
"path": "_ont/ont-huawei-hg8240h.md",
"content": "---\ntitle: Huawei HG8240H\nhas_children: false\nlayout: default\nparent: Huawei\n---\n\n# Hardware Specifications\n\n| | |\n| --------------- | -------------------------------- |\n| Vendor/Brand | Huawei |\n| Model | HG8240H |\n| Chipset | |\n| Flash | |\n| RAM | |\n| System | |\n| 2.5GBaseT | No |\n| Optics | SC/APC |\n| IP address | |\n| Web Gui | |\n| SSH | |\n| Telnet | |\n| Serial | |\n| Serial baud | |\n| Serial encoding | |\n| Form Factor | ONT |\n\n## List of software versions\n\n## List of partitions\n\n# Miscellaneous Links\n\n- [Openreach FTTP deployment](https://www.openreach.com/fibre-broadband)\n"
},
{
"path": "_ont/ont-huawei-ma5671a-carlito.md",
"content": "---\ntitle: Carlito Firmware for Huawei MA5671A\nhas_children: false\nparent: Huawei MA5671A\nlayout: default\n---\n\n{% include alert.html content=\"Be careful, backup goi_config from uboot before changing the firmware.\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n# GPON ONU status\n\n## Querying a particular OMCI ME\n```sh\nomci_pipe.sh meg MIB_IDX ME_IN\n```\nWhere `MIB_IDX` is the MIB ID and `ME_IN` is the ME instance number\n\n## Getting/Setting Speed LAN Mode\n\nTo enable the interface to sync at 2.5 Gbps / using HSGMII with auto-neg on:\n\n```sh\nfw_setenv sgmii_mode 5\n```\n\nTo revert the afore-mentioned command:\n```sh\nfw_setenv sgmii_mode\n```\n\nTo check the set value fo the LAN Mode:\n\n```sh\nonu lanpsg 0\n```\nThe `link_status` variable tells the current speed:\n\n| Value (for `sgmii_mode` and `link_status`) | Speed |\n| ------------------------------------------ | ---------------------------------- |\n| 3 | 1 Gbps / SGMII with auto-neg on |\n| 4 | 1 Gbps / SGMII with auto-neg off |\n| 5 | 2.5 Gbps / HSGMII with auto-neg on |\n\n# GPON/OMCI settings\n\n## Getting/Setting OMCI software version (ME 7)\n```sh\nfw_setenv image0_version V1.7.6-170626\nfw_setenv image1_version V1.7.6-170626\n```\n\n## Setting ONU GPON PLOAM password\n```sh\nfw_setenv nPassword \"0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39\"\n```\nor\n```sh\nuci set gpon.ploam.nPassword=\"0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39\"\nuci commit \n```\n\n## Setting ONU GPON LOID and LOID password\n```sh\nfw_setenv omci_loid 1234567890\nfw_setenv omci_lpwd password01\n```\nIf LOID is disabled in the firmware try alternative software.\n\n## Setting ONU GPON Serial Number\n```sh\nfw_setenv ont_serial ABCD12345678\n```\nor\n```sh\nuci set gpon.ploam.nSerial=\"0x48 0x57 0x54 0x43 0x9D 0xAC 0xC7 0xA3\"\nuci commit \n```\n\n## Setting and checking oem-generic\n```sh\nfw_setenv target oem-generic\nfw_printenv target=oem-generic\n```"
},
{
"path": "_ont/ont-huawei-ma5671a-fs-mod.md",
"content": "---\ntitle: FS Modded Firmware for Huawei MA5671A and FS.com GPON-ONU-34-20BI\nhas_children: false\nparent: Huawei MA5671A\nlayout: default\n---\n\n{% include alert.html content=\"The following wiki is only compatible with version 5 or later!\" alert=\"Note\" icon=\"svg-warning\" color=\"red\" %}\n\n# Flashing the firmware\n\nFlash the firmware image to image0 or image1 via [SSH](/ont-huawei-ma5671a/#flashing-a-new-rootfs-via-ssh) or via [TTL serial](/ont-huawei-ma5671a-ymodem) as usual.\n\nAfter flashing, it is absolutely necessary to connect to the SFP via telnet using the IP 192.168.1.10:\n\n```sh\ntelnet 192.168.1.10\n```\n\nOnce connected via telnet to the SFP, execute the following commands. Then wait a few minutes until the end of the automatic procedure:\n\n```sh\nfirstboot\nreboot\n```\n\nPerforming the procedure described above is necessary after each flash of this firmware, otherwise the SFP will not work!\n\n# Login info\n\n| | |\n| ------------------ | ---------------------------------------------- |\n| Username | root |\n| Password | root |\n| IP address\t | 192.168.1.10 |\n| Telnet \t | Always available |\n| TTL Serial \t | Always available |\n| SSH \t | Only after the first configuration (firstboot) |\n| Web \t | NO |\n\n# GPON ONU status\n\n## Getting the operational status of the ONU\n```sh\nonu ploam_state_get\n```\n\n## Getting optical laser status\n```sh\notop -g s\n```\n\n## Getting information of the OLT vendor\n```sh\nomci_pipe.sh meg 131 0\n```\n\n## Querying a particular OMCI ME\n```sh\nomci_pipe.sh meg MIB_IDX ME_IN\n```\nWhere `MIB_IDX` is the MIB ID and `ME_IN` is the ME instance number.\n\n## Getting VLAN table rule\n```sh\ngtop -g \"GPE VLAN rule\"\n```\n\n## Getting GEM port status table\n```sh\ngtop -g e\n```\n\n## Getting/Setting Speed LAN Mode\n\nTo get the LAN Mode:\n\n```sh\nonu lan_port_status_get 0\n```\nThe `link_status` variable tells the current speed:\n\n| Value (for `sgmii_mode` and `link_status`) | Speed |\n| ------------------------------------------ | ---------------------------------- |\n| 3 | 1 Gbps / SGMII with auto-neg on |\n| 4 | 1 Gbps / SGMII with auto-neg off |\n| 5 | 2.5 Gbps / HSGMII with auto-neg on |\n\nTo change the default lan mode value you can use `fw_setenv sgmii_mode`. The firmware is already set to 2.5G auto-negotiation, you shouldn't touch it.\n\n# GPON/OMCI settings\n\n## Setting ONU GPON Serial Number\n```sh\nfw_setenv onu_serial \"YOUR_SERIAL_ASCII\"\n```\n\n## Setting ONU GPON PLOAM password\n```sh\nfw_setenv onu_ploam \"YOUR_PLOAM_ASCII\"\n```\n\n{% include alert.html content=\"If your ploam is in HEX convert it to ASCII, any non-printable characters write them in HEX with a slash in front, such as `\\0x7F`. If the PLOAM is less than 10 bytes (one printable character counts as one byte, `\\0x7F` also counts as one byte) add `\\0x00` to the end to get to 10 bytes.\" alert=\"Note\" icon=\"svg-info\" color=\"blue\" %}\n\n## Setting ONU GPON LOID\n```sh\nfw_setenv onu_loid \"YOUR_LOID\"\n```\n\n## Setting ONU GPON LOID password\n```sh\nfw_setenv onu_loid_password \"YOUR_LOID_PASSWORD\"\n```\n\n## Setting OMCI vendor ID (ME 256)\n```sh\nfw_setenv omci_vendor_id \"YOUR_VENDOR_ID\"\n```\n\n## Setting OMCI equipment ID (ME 257)\n```sh\nfw_setenv omci_equip_id \"YOUR_EQUIP_ID\"\n```\n\n## Setting OMCI hardware version (ME 256)\n```sh\nfw_setenv omci_hw_ver \"YOUR_HW_VER\"\n```\n\n## Setting OMCI software version (ME 7)\n```sh\nfw_setenv image0_version \"YOUR_SW_VERSION_0\"\nfw_setenv image1_version \"YOUR_SW_VERSION_1\"\n```\n\n# Advanced settings\n\n{% include alert.html content=\"Changing these is normally not necessary and not changing them is a good idea\" alert=\"Note\" icon=\"svg-warning\" color=\"red\" %}\n\n## Setting custom OMCI MIB file\n\nCopy the MIB file to /etc/mibs, then run this command:\n\n```sh\nfw_setenv mib_file_custom \"YOUR_MIB_FILENAME\"\n```\n\n## Setting management IP\n```sh\nfw_setenv ipaddr www.xxx.yyy.zzz\n```\n\n## Restore SFP to default config\n```sh\nfirstboot\nreboot\n```\n\n# SFP EEPROM settings\n\n{% include alert.html content=\"Changing these is normally not necessary and not changing them is a good idea\" alert=\"Note\" icon=\"svg-warning\" color=\"red\" %}\n\n## Setting SFP vendor name\n```sh\nfw_setenv sfp_vendor_name \"YOUR_SFP_VENDOR_NAME\"\n```\n\n## Setting SFP part name\n```sh\nfw_setenv sfp_part_name \"YOUR_SFP_PART_NAME\"\n```\n\n## Setting SFP vendor revision\n```sh\nfw_setenv sfp_vendor_rev \"YOUR_SFP_VENDOR_REV\"\n```\n\n## Setting SFP part serial\n```sh\nfw_setenv sfp_part_serial \"YOUR_SFP_PART_SERIAL\"\n```\n\n## Setting SFP manufacturing date code\n```sh\nfw_setenv sfp_date_code \"YOUR_SFP_DATE_CODE\"\n```\n\n## Setting SFP vendor data\n```sh\nfw_setenv sfp_vendor_data \"YOUR_SFP_VENDOR_DATA\"\n```\n\n# List of firmwares and files\n- [6BA1896SPLQA42_MODDED_ver5-1.img](https://mega.nz/file/5tNwFC5A#aXOlrZgLZ6sL81CKDOoBmXotLqDTJLQzpvokYU--bz0){: .btn } md5hash: c4f1bbe1695803d3d449f911f43d78ea\n- [6BA1896SPLQA42_MODDED_ver4.img](https://mega.nz/file/Q4dFTBqQ#L8N7kPZtSJ7FtbtxRcnxNF-W3b9wDbCeJ82YgnK7moQ){: .btn } md5hash: 63b0cc790c0087a5a1197c89b502b002\n- [6BA1896SPLQA42_MODDED_ver3.img](https://mega.nz/file/YkMwHSgR#7Sdk0LIBv3hLQJKQ4TBub4ABtwYyCAdP6Rl2C3RBztw){: .btn } md5hash: 90348ff0ccaad475cf14d9d0a056cf72\n"
},
{
"path": "_ont/ont-huawei-ma5671a-root-web.md",
"content": "---\ntitle: Root Procedure for Huawei MA5671A (V3)\nhas_children: false\nparent: Huawei MA5671A\nlayout: default\n---\n\n# Root the stick\n\nConnect the SFP adapter to the TTL adapter according to the following diagram:\n\n| USB TTL (UART) Adapter | wire colour in picture | SFP 20pins Molex connector |\n| ---------------------- | ---------------------- | -------------------------- |\n| 3.3V | red | 3.3 (pin #15 and #16) |\n| TX | green | RX (pin #2) |\n| RX | blue | TX (pin #7) |\n| GND | black | GND (pin #14) |\n\n{% include image.html file=\"web-root-procedure/ttl-sfp.jpg\" alt=\"Example of how the molex SFP - TTL connection should look like\" caption=\"Example of how the molex SFP - TTL connection should look like\" %}\n\n{% include image.html file=\"web-root-procedure/sfp-sfp.jpg\" alt=\"Example of how the SFP - molex SFP connection should look like\" caption=\"Example of how the SFP - molex SFP connection should look like\" %}\n\n{% include alert.html content=\"Try PIN 10 or other GND PINs if the connection doesn't work with PIN 14.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{% include alert.html content=\"Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\nConnect the TTL adapter to the computer, once done press the following button. A window will open that will execute the root.\n\n{: .text-center .fs-6 }\n\n
{% include alert.html content=\"This browser is not compatible with the web-root procedure. See the Browser compatibility\" alert=\"Note\" icon=\"svg-warning\" color=\"red\" %}
\n{% include root_lantiq.html modelName=\"Huawei MA5671A\" unlockHuaweiShell=true %}\n\n\n{% include alert.html content=\"If this procedure does not work, you can use this [alternative procedure](/ont-huawei-ma5671a-ymodem)\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n# Connect to the stick via SSH\n\nAfter this is done, reboot the stick, after connecting it to a router via an ethernet mediaconverter or directly plugging it in an SFP port, with the port's IP set to any IP of the `192.168.1.0/24` subnet (the stick has the IP `192.168.1.10`)\n\n{% include alert.html content=\"If your LAN subnet is `192.168.1.0/24` make sure you have no ip conflicts.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{% include alert.html content=\"On some SFP host devices you might not be able to connect to the stick if there's no optical signal (RX loss), in that case you need to connect the fiber to make changes on the stick\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\nRun the terminal and login to the stick using ssh:\n\n```shell\nssh root@192.168.1.10\n```\n\nThe password is `admin123`.\n\n{% include alert.html content=\"If you use a modern OpenSSH version (e.g. >= 8.8) you will have to enable some deprecated algorithms: `ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-dss root@192.168.1.10`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n# TX Fault / Serial\n\nThe stick stays in a perpetual \"TX Fault\" state since the same SFP pin is used for both serial and TX Fault signaling. If that causes you issues (normally it shouldn't), you can issue the commands below to disable it. Note that it will disable both the TX Fault signal and Serial on the stick after boot.\n\n```sh\nfw_setenv asc0 1\nfw_setenv preboot \"gpio set 3;gpio input 100;gpio input 105;gpio input 106;gpio input 107;gpio input 108\"\n```\n\nIn case you need to re-enable it, issue the following commands from the bootloader (FALCON)\n\n```sh\nFALCON => setenv asc0 0\nFALCON => saveenv\n```\n\n# Miscellaneous Links\n- [List of root procedure for Huawei MA5671A](/ont-huawei-ma5671a-root)\n"
},
{
"path": "_ont/ont-huawei-ma5671a-root.md",
"content": "---\ntitle: List of Root Procedure for Huawei MA5671A\ndescription: For documentation purposes only. This page contains the history of root procedures for the Huawei MA5671A stick. \nhas_children: false\nparent: Huawei MA5671A\nlayout: default\nnav_exclude: true\nsearch_exclude: true\n---\n\n{% include alert.html content=\"It is strongly recommended that you only ever use the latest version ([Web root procedure](/ont-huawei-ma5671a-root-web)).\n\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n# Root Procedure for Huawei MA5671A (V3 - Web serial)\n\nCan be accessed via the link [Web root procedure](/ont-huawei-ma5671a-root-web)\n\n{% include alert.html content=\"If this procedure does not work, you can use this [alternative procedure](/ont-huawei-ma5671a-ymodem). Do not use the V2 and V1 versions under any circumstances.\" alert=\"Info\" icon=\"svg-warning\" color=\"red\" %}\n\n# Root Procedure for Huawei MA5671A (V2 - Python)\n\n{% include alert.html content=\"This version remains for documentation purposes only. Please use the latest procedure: [Web root procedure](/ont-huawei-ma5671a-root-web)\" alert=\"Important\" icon=\"svg-warning\" color=\"red\" %}\n\n{% include alert.html content=\"It is strongly recommended that you only ever use the latest version ([Web root procedure](/ont-huawei-ma5671a-root-web)).\n\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n1. Take the SFP molex and four coloured cables and solder them to the molex according to the following diagram:\n\n| USB TTL (UART) Adapter | wire colour in picture | SFP 20pins Molex connector |\n| ---------------------- | ---------------------- | -------------------------- |\n| 3.3V | red | pin #15 and #16 |\n| TX | orange | pin #2 |\n| RX | yellow | pin #7 |\n| GND | green | pin #14 |\n\n{% include alert.html content=\"Use the GND wire as an ON/OFF switch, otherwise there will be a slight delay before data is displayed on the console (putty/TeraTerm).\" alert=\"Important\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{% include alert.html content=\"Try PIN 10 or other GND PINs if the connection doesn't work with PIN 14.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{% include alert.html content=\"Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{:style=\"counter-reset:none\"}\n1. Install python and `pyserial` with `pip`\n```shell\npip install pyserial\n```\n1. Make the connections as shown to a TTL adapter except for GND (which should remain detached as it is used as a switch)\n\n{% include image.html file=\"ma5671a-root-1.jpg\" alt=\"Example of how the sfp-ttl connection should look like\" caption=\"Example of how the sfp-ttl connection should look like\" %}\n{% include image.html file=\"new-root-procedure/board-molex-arduino.jpg\" alt=\"Example of how the sfp-ttl connection should look like with a custom board\" caption=\"Example of how the sfp-ttl connection should look like with a custom board\" %}\n{% include image.html file=\"ma5671a-root-2.jpg\" alt=\"SFP Molex\" caption=\"SFP Molex\" %}\n\n{:style=\"counter-reset:none\"}\n1. Open Tera Term (or other serial terminal emulators), find the correct serial port of the TTL adapter, change the port on the script on line 7 instead of `COM8`.\n1. After this, run the following python script and connect the GND pin:\n\n```py\nimport sys\nimport time\n\nimport serial.tools\n\ntry:\n ser = serial.Serial(\"COM8\", 115200, parity=serial.PARITY_NONE, stopbits=serial.STOPBITS_ONE, bytesize=serial.EIGHTBITS)\n print('[+] Use serial port device:', ser.name)\n print('[+] Waiting for trigger characters...')\n while True:\n try:\n recv = ser.readline().decode()\n except Exception as x:\n print(\"Decode errore\", x)\n continue\n if recv.startswith('U-Boot'):\n print('[+] Received! transfer enable command...')\n print('[+] Transfer command sequence 1')\n t_end = time.time() + 3\n while time.time() < t_end:\n ser.write(chr(3).encode())\n time.sleep(1)\n print('[+] Transfer command sequence 2')\n ser.write('setenv bootdelay 3\\n'.encode())\n time.sleep(1)\n print('[+] Transfer command sequence 3')\n ser.write('setenv asc0 0\\n'.encode())\n time.sleep(1)\n print('[+] Transfer command sequence 4')\n ser.write('setenv preboot \"gpio set 3;gpio input 2;gpio input 105;gpio input 106;gpio input 107;gpio input 108\"\\n'.encode())\n time.sleep(1)\n print('[+] Transfer command sequence 5')\n ser.write('saveenv\\n'.encode())\n time.sleep(3)\n print('[+] Transfer command sequence 6')\n ser.write('reset\\n'.encode())\n print('[+] Enable command transfer complete! rebooting...')\n break\n else:\n print(recv)\nexcept Exception as e:\n try:\n print('[!] Error:', e)\n sys.exit(1)\n finally:\n e = None\n del e\n\nexcept (KeyboardInterrupt, SystemExit):\n ser.close()\n sys.exit(1)\n```\n{% include alert.html content=\"Originally, this other string was used for the `setenv preboot`: `gpio input 105;gpio input 106;gpio input 107;gpio input 108;gpio set 3;gpio set 109;gpio set 110;gpio clear 423;gpio clear 422;gpio clear 325;gpio clear 402;gpio clear 424`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n{:style=\"counter-reset:none\"}\n1. Reboot the stick\n1. Open Tera Term (or other serial terminal emulators), after it has loaded press `enter` to activate the console\n\n{% include image.html file=\"new-root-procedure/press-enter.jpg\" alt=\"Press enter to activate the console\" caption=\"Press enter to activate the console\" %}\n\n{:style=\"counter-reset:none\"}\n1. With `sed` change the default shell from `/opt/lantiq/bin/minishell` to `/bin/ash` by editing the file `/etc/passwd`:\n\n```shell\nsed -i \"s|/opt/lantiq/bin/minishell|/bin/ash|g\" /etc/passwd\n```\n{% include alert.html content=\"Do not use `vim`!\" alert=\"Important\" icon=\"svg-warning\" color=\"red\" %}\n\n{% include alert.html content=\"Be aware that kernel panics happen often! If a kernel panic happens wait for the reboot and quickly try again.\" alert=\"Important\" icon=\"svg-warning\" color=\"yellow\" %}\n\n\n```shell\n[ 34.612000] Kernel panic - not syncing: Fatal exception in interrupt\n[ 34.612000] Rebooting in 3 seconds..\n```\n\n{% include alert.html content=\"The cause of these kernel panics could be insufficient supply of power.\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n{:style=\"counter-reset:none\"}\nAfter this is done, reboot the stick, after connecting it to a router via an ethernet mediaconverter or directly plugging it in an SFP port, with the port's IP set to any IP of the `192.168.1.0/24` subnet (the stick has the IP `192.168.1.10`)\n\n{% include alert.html content=\"If your LAN subnet is `192.168.1.0/24` make sure you have no ip conflicts.\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{% include alert.html content=\"On some SFP host devices you might not be able to connect to the stick if there's no optical signal (RX loss), in that case you need to connect the fiber to make changes on the stick\" alert=\"Note\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{:style=\"counter-reset:none\"}\n1. Run the terminal and login to the stick with ssh\n\n```shell\nssh root@192.168.1.10\n```\n\nThe password is `admin123`.\n\n{% include alert.html content=\"If you use a modern OpenSSH version (e.g. >= 8.8) you will have to enable some deprecated algorithms: `ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-dss [...]`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n# Root Procedure for Huawei MA5671A (V1 - Tweezers)\n\n{% include alert.html content=\"This version remains for documentation purposes only. Please use the latest procedure: [Web root procedure](/ont-huawei-ma5671a-root-web)\" alert=\"Important\" icon=\"svg-warning\" color=\"red\" %}\n\n{% include alert.html content=\"This procedure requires the physical disassembly of the stick, and the use of tweezers that can burn the stick, it is highly recommended not to use it.\" alert=\"Important\" icon=\"svg-warning\" color=\"red\" %}\n\n1. Take the SFP molex and the 4 coloured cables and solder them to the molex according to the following diagram:\n\n| USB TTL (UART) Adapter | wire colour in picture | SFP 20pins Molex connector |\n| ---------------------- | ---------------------- | -------------------------- |\n| 3.3V | red | pin #15 and #16 |\n| TX | orange | pin #2 |\n| RX | yellow | pin #7 |\n| GND | green | pin #10 |\n\n{% include alert.html content=\"Use GND wire as ON/OFF switch, otherwise there will be a slight delay before data is displayed on the console (putty/TeraTerm).\" alert=\"Important\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{% include image.html file=\"ma5671a-root-1.jpg\" alt=\"Example of how the sfp-ttl connection should look like\" caption=\"Example of how the sfp-ttl connection should look like\" %}\n{% include image.html file=\"ma5671a-root-2.jpg\" alt=\"Molex SFP\" caption=\"Molex SFP\" %}\n\n{:style=\"counter-reset:none\"}\n1. Disassemble the stick by releasing the metal tabs that hold the cover in place. There are two tabs, one on each side, inside these holes:\n\n{% include image.html file=\"ma5671a-root-4.jpg\" alt=\"Metal tabs that hold the cover in place\" caption=\"Metal tabs that hold the cover in place\" %}\n\n{:style=\"counter-reset:none\"}\n1. Once you have removed the metal casing, you are left with the half-naked stick. Note that the release mechanism also comes off easily, so it is recommended to take a photo and to memorise the positioning to be able to put it back together in the case it does come off.\n\n1. Before shorting the stick, connect the previously soldered cables and molex to the USB serial (photo immediately below) and to the stick (via the molex, of course) and check that the jumper on the usb key is set to 3.3V\n\n{% include image.html file=\"ma5671a-root-8.jpg\" alt=\"TTL\" caption=\"TTL\" %}\n\n{:style=\"counter-reset:none\"}\n1. The disassembled stick will appear as in the photo: the two pins to be shorted are highlighted in red. In the photo below a wire is used, but a pair of tweezers is sufficient (I used those, in fact). Be careful not to touch anything around the two pins by possibly covering everything else with electrical tape.\n\n{% include image.html file=\"ma5671a-root-4.jpg\" alt=\"tweezers\" caption=\"tweezers\" %}\n{% include image.html file=\"ma5671a-root-6.jpg\" alt=\"tweezers\" caption=\"tweezers\" %}\n{% include image.html file=\"ma5671a-root-5.jpg\" alt=\"tweezers and eletrical tape\" caption=\"tweezers and eletrical tape\" %}\n{% include image.html file=\"ma5671a-root-6.jpg\" alt=\"tweezers\" caption=\"tweezers\" %}\n\n{:style=\"counter-reset:none\"}\n1. For the moment connect all cables to the usb key except the green (ground) or red (voltage), otherwise the stick will boot before you can do the following (N.B. for those who bought the uart above RX and TX are reversed). Open and configure Tera Term for serial connection by selecting the correct com port, speed 115200 bauds, english language (otherwise in japanese you can't read anything understandable), then insert the key in the PC (the adapter being already installed is taken for granted), short the 2 pins seen above and, while keeping the pins shorted, connect the missing coloured cable\n\n1. If nothing happens, you have obviously done something wrong with cables, molexes, soldering irons, etc., so you will have to start from the beginning again and work out which step you did wrong. \nIf you have done everything correctly, you should see something similar to the picture below:\n\n{% include image.html file=\"ma5671a-root-9.png\" alt=\"serial shell\" caption=\"serial shell\" %}\n\n{:style=\"counter-reset:none\"}\n1. Remove the short (tweezers or whatever you used), then type 7 and enter. You should see this:\n\n{% include image.html file=\"ma5671a-root-10.png\" alt=\"serial shell 2\" caption=\"serial shell 2\" %}\n\n{:style=\"counter-reset:none\"}\n1. From the Tera Term menu `FILE` → `TRANSFER` → `XMODEM` → `SEND` → `[1224abort.bin]` (which is the third of the files downloaded earlier):\n\n{% include image.html file=\"ma5671a-root-11.png\" alt=\"1224abort.bin\" caption=\"1224abort.bin\" %}\n\n{:style=\"counter-reset:none\"}\n1. As soon as the file transfer is complete, you have 2 seconds to press `CTRL+C`. If you have not done so, return to step 6. Otherwise, you should see:\n\n{% include image.html file=\"ma5671a-root-12.png\" alt=\"falcon shell\" caption=\"falcon shell\" %}\n\n{:style=\"counter-reset:none\"}\n1. To permanently unlock the bootloader, without having to repeat the previous steps, you must give the following commands:\n```\nFALCON => setenv bootdelay 5\nFALCON => setenv asc0 0\nFALCON => setenv preboot \"gpio set 3;gpio input 100;gpio input 105;gpio input 106;gpio input 107;gpio input 108\"\nFALCON => saveenv\n```\n\n{% include alert.html content=\"Originally, this other string was used for the `setenv preboot`: `gpio input 105;gpio input 106;gpio input 107;gpio input 108;gpio set 3;gpio set 109;gpio set 110;gpio clear 423;gpio clear 422;gpio clear 325;gpio clear 402;gpio clear 424`\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n{% include alert.html content=\"Instead of taking the next steps, it is recommended to boot and run the `sed` command documented in V2\" alert=\"Warning\" icon=\"svg-warning\" color=\"red\" %}\n\n{:style=\"counter-reset:none\"}\n1. If you have done everything correctly you can reboot the stick (if you are convinced that everything is ok you could also close it again), disconnect and reconnect either the ground or voltage cable, then again you will have 5 seconds to lock the bootloader by doing a simple CTRL+C using the terminal. Now upload the firmware image of the first mtd2 partition to the stick with the command\n```\nFALCON => loadb 0x80800000\n```\nAt this point it will appear:\n\n{% include image.html file=\"ma5671a-root-13.jpg\" alt=\"shell requiring `mtd2` upload\" caption=\"shell requiring `mtd2` upload\" %}\n\n{:style=\"counter-reset:none\"}\n1. From the Tera Term menu do `FILE` → `TRANSFER` → `KERMIT` → `SEND` → `[mtd2.bin]`.\nIt will start uploading the file at a speed of about 3-4 KBps: it should take more than half an hour for the upload to complete.\n\n1. Once finished, the image loaded on the stick must also be saved to the corresponding system partition (the first of the 2) with the commands\n```\nFALCON => sf probe 0\nFALCON => sf erase C0000 740000\nFALCON => sf write 80800000 C0000 740000\n```\n\n1. Check that the stick is configured to boot from partition 0 (We are aware that mtd2 goes on 0 and mtd5 goes on 1, complain to Lantiq about this) with the command:\n```\nFALCON => printenv committed_image\n```\n1. If it is 0 there's no need to do anything, otherwise configure the stick to boot from partition 0 with the following commands, then check if the settings were changed correctly.\n```\nFALCON => setenv committed_image 0\nFALCON => saveenv\nFALCON => printenv committed_image\n```\n\n# Miscellaneous Links\n- [Come avere i 2.5 Gbps su un unico dispositivo senza il Fastgate](https://forum.fibra.click/d/17836-come-avere-i-25-gbps-su-un-unico-dispositivo-senza-il-fastgate)\n- [Support MA5671A SFP GPON](https://forum.openwrt.org/t/support-ma5671a-sfp-gpon/48042)\n- [La fibre Orange à 2Gbps, sur un routeur MikroTik 10Gbps CCR2004, via un ONT SFP+](https://lafibre.info/remplacer-livebox/guide-de-connexion-fibre-directement-sur-un-routeur-voire-meme-en-2gbps/msg832904/#msg832904)\n- [Bypassing the HH3K up to 2.5Gbps using a BCM57810S NIC](https://www.dslreports.com/forum/r32230041-Internet-Bypassing-the-HH3K-up-to-2-5Gbps-using-a-BCM57810S-NIC)\n"
},
{
"path": "_ont/ont-huawei-ma5671a-rooted.md",
"content": "---\ntitle: Huawei Rooted Firmware for Huawei MA5671A\nhas_children: false\nparent: Huawei MA5671A\nlayout: default\n---\n\n# Usage\n\n## Minishell\n\nThis firmware version offers a minishell in addition to the normal sh shell. Commands offered by minishell are as follows:\n\n{% include serial_dump.html file=\"ma5671a_minishell.txt\" alt=\"Huawei MA5671A minishell\" title=\"Huawei MA5671A minishell\" %}\n\n## Root\n\nFor general use, minishell does not allow any modifications and [Web root procedure](/ont-huawei-ma5671a-root-web) is required.\n\n# GPON ONU status\n\n## Getting the operational status of the ONU\n\n```sh\nonu ploamsg\n```\n\n## Querying a particular OMCI ME\n```sh\nomci_pipe.sh meg MIB_IDX ME_IN\n```\nWhere `MIB_IDX` is the MIB ID and `ME_IN` is the ME instance number\n\n# GPON/OMCI settings\n\n{% include alert.html content=\"In this firmware, unlike the other ones, all data must be modified in a base64-encoded file. To simplify this, you can use the following web application.\" alert=\"Info\" icon=\"svg-info\" color=\"blue\" %}\n\n## Web procedure\n\n\n1. Get `fw_printenv sfp_a2_info` and paste into the form:\n\n
\n \n
\n\n\n\n\n{% include alert.html content=\"Executing these commands requires familiarity with `vim`. If you are not in any way familiar with `vim`, follow these commands precisely.\" alert=\"Danger\" icon=\"svg-warning\" color=\"red\" %}\n\n{:style=\"counter-reset:none\"}\n1. Copy the script's output to the clipboard \n1. Run the comman `vim /tmp/sfp_a2.txt` in the stick\n1. Press the right mouse button in the terminal or `CTRL`+`V`\n1. Press `ESC` command from keyboard\n1. Type `:wq`\n1. Run:\n\n\n```shell\nfw_setenv sfp_a2_info $(cat /tmp/sfp_a2.txt)\n```\n\n## Temporary file procedure\n\n1. Save `sfp_a2_info` in a temporary file\n\n```sh\nfw_printenv sfp_a2_info | sed \"s/^sfp_a2_info=//\" > /tmp/sfp_a2.txt\n```\nAnd print a pretty version:\n```sh\nfw_printenv sfp_a2_info | sed \"s/^sfp_a2_info=//\" | tr '@' '\\n'\n```\n\n2. Setting S/N\n\nThe S/N is stored on the 6th line, for example `4857544311223344` (where `48575443` is the HEX encoding of `HWTC`):\n```\nAAAAAAAAAAJIV1RDESIzRP///////////////////wAAAAAAAAAAAAAAAAAA\n00000000000000024857544311223344ffffffffffffffffffffffffffffff0000000000000000000000000000\n```\n\nThe entire S/N, including the PON ID, is first encoded in hexadecimal and then in base64\n\n3. Setting PLOAM Password\n\nThe PLOAM Password is stored on the 5th line, for example (`1234567890`):\n```\nffffffffffffffff00021437d77db7df7e37e77eb7ef7f37f77d00000000000000000000000000000000000000\n//////////8AAhQ31323334353637383930AAAAAAAAAAAAAAAAAAAAAAAAA\n```\n\nThe entire PLOAM, is first encoded in hexadecimal and then in base64\n\n4. Setting MAC Address\n\nThe MAC Address is stored on the 9th line, for example (`48:57:02:da:be:ef`):\n```\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASFcC2r7vAAAAAAAAAAAAAAAAAAAA\n000000000000000000000000000000000000000000000000485702dabeef000000000000000000000000000000\n```\n\n5. Transfer the modified file back into variable `sfp_a2_info`\n\n```sh\nfw_setenv sfp_a2_info $(cat /tmp/sfp_a2.txt)\n```\n\n## Reviewing and testing\n\nAfter rebooting, check whether the new variables have been saved correctly:\n\n```sh\nfw_printenv nPassword\nfw_printenv gSerial\nfw_printenv ethaddr\n```\n## Getting/Setting Speed LAN Mode\n\nTo get the LAN Mode:\n\n```sh\nonu lanpsg 0\n```\nThe `link_status` variable tells the current speed\n\n| Value (for `sgmii_mode` and `link_status`) | Speed |\n| ------------------------------------------ | ---------------------------------- |\n| 3 | 1 Gbps / SGMII with auto-neg on |\n| 4 | 1 Gbps / SGMII with auto-neg off |\n| 5 | 2.5 Gbps / HSGMII with auto-neg on |\n\nTo change the default lan mode value you can use `fw_setenv sgmii_mode`. The firmware is already set to 2.5G auto-negotiation, you shouldn't touch it.\n\n# Advanced settings\n\n## Disabling dying gasp\n\n```sh\nfw_setenv nDyingGaspEnable 0 \n```\n\n# Miscellaneous Links\n\n- [Edit sfp_a2_info file](https://forum.openwrt.org/t/support-ma5671a-sfp-gpon/48042/25)\n"
},
{
"path": "_ont/ont-huawei-ma5671a-sf.md",
"content": "---\ntitle: SourcePhotonics Firmware for Huawei MA5671A\nhas_children: false\nredirect_to: /ont-fs-com-gpon-onu-stick-with-mac\nlayout: default\nparent: Huawei MA5671A\n---"
},
{
"path": "_ont/ont-huawei-ma5671a-ymodem.md",
"content": "---\ntitle: Root Procedure for Huawei MA5671A (flash firmware)\nhas_children: false\nparent: Huawei MA5671A\nlayout: default\n---\n\nThis procedure flashes the firmware on the stick via serial. Some of the firmwares that can be flashed are listed on the [Huawei MA5671A page](/ont-huawei-ma5671a).\n\n{: .text-center .fs-6 }\n\n\n
{% include alert.html content=\"This browser is not compatible with the web-root procedure. See the Browser compatibility\" alert=\"Note\" icon=\"svg-warning\" color=\"red\" %}
\n\n\n\n\n"
},
{
"path": "_tools/molex-ont.md",
"content": "---\ntitle: Molex ONT\nhas_children: false\nnav_order: 3\nlayout: default\n---\n\nIn some sticks, such as those based on Lantiq chipsets, the serial interface is exposed in the upper pins of the ONT, in order to read them there are two possibilities:\n- the use of an SFP molex ([farnell](https://it.farnell.com/en-IT/molex/74441-0001/connector-sfp-rcpt-20pos-smt/dp/2112385)) to which four wires are to be soldered and the other pins removed. This makes the adapter compatible with a single serial combination.\n- the use of a board to which the SFP molex is soldered, exposing the main SFP pins.\n\n{% include image.html file=\"ma5671a-root-1.jpg\" alt=\"Example of how the SFP-TTL adapter is to be connected\" caption=\"Example of how the SFP-TTL adapter is to be connected\" %}\n\n{% include image.html file=\"new-root-procedure/board-molex-arduino.jpg\" alt=\"Example of how the SFP-TTL adapter is to be used with a custom board\" caption=\"Example of how the SFP-TTL adapter is to be used with a custom board\" %}\n\nIf you want to make your own board, here are some ideas:\n\n{% include image.html file=\"board-dupont/top.svg\" alt=\"Example of an SFP-TTL custom board\" caption=\"Example of an SFP-TTL custom board\" %}\n{% include image.html file=\"board-dupont/bottom.svg\" alt=\"Example of an SFP-TTL custom board\" caption=\"Example of an SFP-TTL custom board\" %}\n\nthe components to be soldered are instead:\n- 1x MOLEX SFP (like Molex-744410001 [lcsc](https://www.lcsc.com/product-detail/Card-Edge-Connectors_MOLEX-744410001_C277615.html), [farnell](https://it.farnell.com/en-IT/molex/74441-0001/connector-sfp-rcpt-20pos-smt/dp/2112385))\n- 2x pinout 2x10 (like [MINTRON MTP125-1210S1](https://www.lcsc.com/product-detail/Pin-Header-Female-Header_MINTRON-MTP125-1210S1_C358699.html))\n\n[Example of the final board](https://oshwlab.com/user4091049/sfp-to-ttl-v1) with these components on the EasyEDA platform.\n"
},
{
"path": "_tools/ont-ethtool-print-eeprom.md",
"content": "---\ntitle: Ethtool Print EEPROM\nhas_children: false\nlayout: default\n---\n\n1. Get `ethtool -m` or `ethtool -e` and paste into the form\n\n
\n \n
\n\n\n"
},
{
"path": "_tools/ont-lantiq-print-eeprom.md",
"content": "---\ntitle: Lantiq Print EEPROM\nhas_children: false\nlayout: default\n---\n\n1. Get `sfp_a0_low_128` or `sfp_a2_info` and paste into the form\n\n\n
\n \n
\n\n\n"
},
{
"path": "_tools/speed-gpon-eth.md",
"content": "---\ntitle: Theoretical maximum speed calculator\nhas_children: false\nnav_order: 4\ndescription: Tool for calculating maximum speeds\nlayout: default\n---\n\n\n
Ethernet calculator
\n\n
XG(S)-PON/GPON calculator
\n\n \n\n"
},
{
"path": "_tools/ttl-uart-adapter.md",
"content": "---\ntitle: TTL UART Adapter\nhas_children: false\nnav_order: 2\nlayout: default\n---\n\nA TTL UART adapter makes it possible to connect the stick's serial interface to a computer via a USB interface. This makes it easy to send commands on modern computers through serial emulation, just like the serial ports of the 1990s.\n\nThese adapters are widely used in the modding of SFPs, and in general of most embedded devices, since a serial port is always present in all of them and is also used to de-brick such devices.\n\nTTL adapters can be easily found on Amazon, the most recommended one being:\n\n- DSD TECH USB to TTL Serial Adapter with FTDI FT232RL Chip [Amazon.com](https://www.amazon.com/dp/B07BBPX8B8) [Amazon.it](https://www.amazon.it/dp/B07BBPX8B8)\n\nAlternatively, an [Arduino can be used to emulate a TTL adapter](https://create.arduino.cc/projecthub/PatelDarshil/ways-to-use-arduino-as-usb-to-ttl-converter-475533)"
},
{
"path": "assets/css/just-the-docs-dark.scss",
"content": "{% include css/just-the-docs.scss.liquid color_scheme=\"dark\" primary_color=\"blue\" %}\n"
},
{
"path": "assets/css/just-the-docs-default.scss",
"content": "{% if site.color_scheme and site.color_scheme != \"nil\" %}\n {% assign color_scheme = site.color_scheme %}\n{% else %}\n {% assign color_scheme = \"light\" %}\n{% endif %}\n{% include css/just-the-docs.scss.liquid color_scheme=color_scheme primary_color=\"blue\" %}"
},
{
"path": "assets/css/just-the-docs-light.scss",
"content": "{% include css/just-the-docs.scss.liquid color_scheme=\"light\" primary_color=\"blue\" %}"
},
{
"path": "assets/js/cigpassword.js",
"content": "function hexToBytes(hex) {\n let bytes = new Uint8Array(hex.length / 2);\n for (let i = 0; i < hex.length; i += 2) {\n bytes[i / 2] = parseInt(hex.substr(i, 2), 16);\n }\n return bytes;\n}\n\nfunction cigpassword_gpon(ont_serial, ont_user, length = 0, xgspon = false) {\n const hardcoded_key = '01030a1013051764c8061419b49d0500';\n const hardcoded_seed = '2345679abcdefghijkmnpqrstuvwxyzACDEFGHJKLMNPQRSTUVWXYZ';\n\n let ont_vendor = ont_serial.substring(0, 4).toUpperCase();\n let ont_id = ont_serial.substring(4).toLowerCase();\n\n if (xgspon) {\n ont_id = ont_id.toUpperCase();\n }\n\n let formatted_serial = `${ont_vendor}${ont_id}`;\n\n let key_bytes = new Uint8Array(hardcoded_key.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));\n if (length > 0) {\n key_bytes[15] = length;\n }\n\n let formatted_serial_user = formatted_serial;\n if (ont_user) {\n formatted_serial_user += `-${ont_user}`;\n }\n\n let hmac = CryptoJS.HmacMD5(formatted_serial_user, CryptoJS.lib.WordArray.create(key_bytes));\n let pw_md5_hmac = hexToBytes(hmac.toString(CryptoJS.enc.Hex));\n\n let output = Array(pw_md5_hmac.length);\n\n for (let i = 0; i < pw_md5_hmac.length; i++) {\n output[i] = hardcoded_seed[pw_md5_hmac[i] % 0x36];\n }\n\n if (length > 0) {\n return output.slice(0, length).join('');\n } else {\n return output.join('');\n }\n}\n"
},
{
"path": "assets/js/omci-vlan.js",
"content": "/* Copyright (C) Erny \n * SPDX-License-Identifier: MPL-2.0-no-copyleft-exception\n*/\n\n// Convert hex string to binary representation\nfunction hex2bin(hexString){\n var result = \"\";\n hexString = hexString.replace(/0x/g, \"\").replace(/ /g, '').toLowerCase();\n \n for(const hexChr of hexString) {\n const bin = parseInt(hexChr, 16).toString(2).padStart(4, '0');\n \n if (!bin.isNaN) {\n result += bin;\n } else {\n throw new Error(\"The hex string is not valid!\");\n }\n }\n\n return result;\n}\n\n// Helper function to splice binary array and convert to decimal\nfunction binSpliceToDec(binArray, len) {\n const result = binArray.splice(0, len);\n return parseInt(result.join(\"\"), 2);\n}\n\n// GPON OMCI VLAN Table parser\nfunction vlanTableParse(hexString) {\n const binaryArray = hex2bin(hexString).split('');\n var result = new Array();\n \n while(binaryArray.length > 0) {\n var vlanRule = new Array();\n \n vlanRule.push(binSpliceToDec(binaryArray, 4));\n vlanRule.push(binSpliceToDec(binaryArray, 13));\n vlanRule.push(binSpliceToDec(binaryArray, 3));\n binaryArray.splice(0, 12); // Padding\n vlanRule.push( binSpliceToDec(binaryArray, 4));\n vlanRule.push(binSpliceToDec(binaryArray, 13));\n vlanRule.push(binSpliceToDec(binaryArray, 3));\n binaryArray.splice(0, 8); // Padding\n vlanRule.push(binSpliceToDec(binaryArray, 4));\n vlanRule.push(binSpliceToDec(binaryArray, 2));\n binaryArray.splice(0, 10); // Padding\n vlanRule.push(binSpliceToDec(binaryArray, 4));\n vlanRule.push(binSpliceToDec(binaryArray, 13));\n vlanRule.push(binSpliceToDec(binaryArray, 3));\n binaryArray.splice(0, 12); // Padding\n vlanRule.push(binSpliceToDec(binaryArray, 4));\n vlanRule.push(binSpliceToDec(binaryArray, 13));\n vlanRule.push(binSpliceToDec(binaryArray, 3));\n \n result.push(vlanRule);\n }\n \n return result;\n}\n"
},
{
"path": "assets/js/rootLantiq.js",
"content": "const LOAD_ADDR = \"80800000\"\nconst IMAGE0_ADDR = \"C0000 740000\";\nconst IMAGE1_ADDR = \"800000 800000\";\n\nasync function detectUboot(serial) {\n await serial.readLine((line) => {\n if (line.startsWith('U-Boot')) {\n return true;\n }\n });\n}\n\nasync function waitUbootStop(serial, sfpModel, outputMsgCallback) {\n const interruptChar = String.fromCharCode(3);\n\n const interval = setInterval(function() {\n serial.writeString(interruptChar);\n }, 10);\n\n await detectUboot(serial);\n outputMsgCallback(`Root in progress: Trigger characters received. DO NOT TOUCH THE ${sfpModel} UNTIL THE PROCEDURE IS COMPLETED!`);\n await delay(5000);\n clearInterval(interval);\n}\n\nasync function checkUbootUnlocked(serial) {\n let unlocked = false;\n\n await serial.readLine((line) => {\n if (line.startsWith('Press SPACE to delay and Ctrl-C to abort autoboot')) {\n unlocked = true;\n return true\n }\n }, 2000);\n\n return unlocked;\n}\n\nasync function waitFailbackShell(serial, outputMsgCallback) {\n await serial.readLine((line) => {\n if (line.startsWith('Press the [f] key and hit [enter] to enter failsafe mode')) {\n return true;\n }\n });\n\n let interval = setInterval(function() {\n serial.writeString('f\\n');\n }, 10);\n\n outputMsgCallback(\"Root in progress: Trigger characters received. Waiting for boot to end...\");\n await delay(3000);\n clearInterval(interval);\n\n interval = setInterval(function() {\n serial.writeString(String.fromCharCode(10));\n }, 10);\n\n await serial.readLine((line) => {\n if (line.includes('root@(none)')) {\n return true;\n }\n });\n\n await delay(1000);\n clearInterval(interval);\n}\n\nasync function lantiqRootUboot(port, sfpModel, outputMsgCallback, outputErrorCallback, baudRate = 115200) {\n const serial = new SerialReadWrite(port, baudRate);\n\n try {\n outputMsgCallback(`Please disconnect the ${sfpModel} from the SFP adapter if it is currently plugged in!`);\n await delay(10000);\n outputMsgCallback(`Now you need to insert the ${sfpModel} into the SFP adapter, if the procedure does not go ahead, check the connections and then remove and reconnect the ${sfpModel} again`);\n\n while(true) {\n await waitUbootStop(serial, sfpModel, outputMsgCallback);\n const ubootUnlocked = await checkUbootUnlocked(serial);\n\n if (ubootUnlocked == true) {\n break;\n }\n\n outputMsgCallback(\"Root in progress: Set U-Boot bootdelay to 5...\");\n await serial.writeString('setenv bootdelay 5\\n');\n await delay(1000);\n outputMsgCallback(\"Root in progress: Enable ASC serial...\");\n await serial.writeString('setenv asc0 0\\n');\n await delay(1000);\n outputMsgCallback(\"Root in progress: Set GPIO to unlock serial...\");\n await serial.writeString('setenv preboot \"gpio set 3;gpio input 2;gpio input 105;gpio input 106;gpio input 107;gpio input 108\"\\n');\n await delay(1000);\n outputMsgCallback(\"Root in progress: Save changes...\");\n await serial.writeString('saveenv\\n');\n await delay(1000);\n outputMsgCallback(\"Root in progress: Rebooting...\");\n await serial.writeString('reset\\n');\n await delay(1000);\n }\n\n return true;\n } catch (err) {\n outputErrorCallback(`Error: ${err.message}`);\n return false;\n } finally {\n await serial.closePort();\n }\n}\n\nasync function unlockHuaweiShell(port, outputMsgCallback, outputErrorCallback, baudRate = 115200) {\n const serial = new SerialReadWrite(port, baudRate);\n\n try {\n outputMsgCallback(\"Root in progress: Rebooting...\");\n await serial.writeString('reset\\n');\n await delay(1000);\n outputMsgCallback(\"Waiting for reboot\");\n await waitFailbackShell(serial, outputMsgCallback);\n outputMsgCallback(\"Root in progress: Enable full Linux shell...\");\n await serial.writeString('mount_root && mkdir -p /overlay/etc && sed \"s|/opt/lantiq/bin/minishell|/bin/ash|g\" /rom/etc/passwd > /overlay/etc/passwd\\n');\n await delay(1000);\n outputMsgCallback(\"Root in progress: Umount rootfs partitions...\");\n await serial.writeString('umount /overlay && umount -a\\n');\n await delay(1000);\n return true;\n } catch (err) {\n outputErrorCallback(`Error: ${err.message}`);\n return false;\n } finally {\n await serial.closePort();\n }\n}\n\nasync function changeBaudrate(port, newBaudrate, currBaudrate, outputErrorCallback) {\n let serial = new SerialReadWrite(port, currBaudrate);\n\n try {\n await serial.writeString(`setenv baudrate ${newBaudrate}\\n`);\n await delay(1000);\n await serial.closePort();\n serial = new SerialReadWrite(port, newBaudrate);\n\n const interval = setInterval(function() {\n serial.writeString(String.fromCharCode(13));\n }, 10);\n\n await serial.readLine((line) => {\n if (line.startsWith('FALCON')) {\n clearInterval(interval);\n return true;\n }\n });\n\n return true;\n } catch (err) {\n outputErrorCallback(`Error: ${err.message}`);\n return false;\n } finally {\n await serial.closePort();\n }\n}\n\nasync function sendImageMtd(port, data, baudRate, outputErrorCallback, progressCallback) {\n const serial = new SerialReadWrite(port, baudRate);\n\n try {\n await serial.writeString(`loady 0x${LOAD_ADDR}\\n`);\n await delay(1000);\n await sendXYMini(serial, data, progressCallback);\n return true;\n } catch (err) {\n outputErrorCallback(`Error: ${err.message}`);\n return false;\n } finally {\n await serial.closePort();\n }\n}\n\nasync function waitEndImageLoad(port, baudRate, outputErrorCallback) {\n const serial = new SerialReadWrite(port, baudRate);\n\n try {\n await serial.readLine((line) => {\n if (line.includes('Total Size')) {\n return true;\n }\n });\n\n await delay(1000);\n return true;\n } catch (err) {\n outputErrorCallback(`Error: ${err.message}`);\n return false;\n } finally {\n await serial.closePort();\n }\n}\n\nasync function flashImageMtd(port, image, baudRate, outputErrorCallback) {\n const serial = new SerialReadWrite(port, baudRate);\n\n try {\n if (image == \"image0\") {\n await serial.writeString(`sf probe 0 && sf erase ${IMAGE0_ADDR} && sf write ${LOAD_ADDR} ${IMAGE0_ADDR} && setenv committed_image 0 && setenv image0_is_valid 1 && saveenv && reset\\n`);\n } else {\n await serial.writeString(`sf probe 0 && sf erase ${IMAGE1_ADDR} && sf write ${LOAD_ADDR} ${IMAGE1_ADDR} && setenv committed_image 1 && setenv image1_is_valid 1 && saveenv && reset\\n`);\n }\n\n /* Wait to avoid the user from disconnecting the SFP while the image is being flashed */\n await delay(1000);\n await detectUboot(serial);\n return true;\n } catch (err) {\n outputErrorCallback(`Error: ${err.message}`);\n return false;\n } finally {\n await serial.closePort();\n }\n}\n"
},
{
"path": "assets/js/serialUtil.js",
"content": "function delay(ms) {\n return new Promise(resolve => setTimeout(resolve, ms));\n}\n\nclass SerialReadWrite {\n constructor(port, baudrate) {\n this.port = port;\n this.baudRate = baudrate;\n this.isPortOpen = false;\n this.textDecoder = new TextDecoder();\n this.textEncoder = new TextEncoder();\n }\n\n async openPort() {\n await this.port.open({ baudRate: this.baudRate });\n }\n\n async closePort() {\n await this.port.close();\n }\n\n async readBytes(retryError = 5, errorNum = 0) {\n let reader = undefined;\n\n if (this.isPortOpen === false) {\n await this.openPort();\n this.isPortOpen = true;\n }\n\n try {\n if (reader === undefined) {\n reader = this.port.readable.getReader();\n }\n\n const promiseResult = await reader.read();\n\n if (promiseResult === undefined) {\n return undefined;\n }\n\n return promiseResult.value;\n } catch (e) {\n if (e instanceof DOMException &&\n (e.name === \"BreakError\" || e.name === \"FramingError\" || e.name === \"ParityError\")) {\n console.log(e);\n\n if (errorNum > retryError) {\n throw e;\n }\n\n return await this.readBytes(retryError, errorNum++);\n } else {\n throw e;\n }\n } finally {\n if (reader) {\n reader.releaseLock();\n reader = undefined;\n }\n }\n }\n\n async readLine(readCallback, timeout = undefined) {\n let reader = undefined;\n let extraChunk = \"\";\n\n if (this.isPortOpen === false) {\n await this.openPort();\n this.isPortOpen = true;\n }\n\n while (true) {\n try {\n if (reader === undefined) {\n reader = this.port.readable.getReader();\n }\n\n let serialValue;\n if (timeout === undefined) {\n const { value, done } = await reader.read();\n serialValue = value;\n } else {\n const { value, done } = await Promise.race([\n reader.read(),\n new Promise((_, reject) => setTimeout(reject, timeout, new Error(\"timeout\")))\n ]);\n serialValue = value;\n }\n\n const linesValue = this.textDecoder.decode(serialValue).split('\\n');\n linesValue[0] = extraChunk + linesValue[0];\n extraChunk = linesValue[linesValue.length - 1];\n\n for (const line of linesValue) {\n if (readCallback(line) === true) {\n return;\n }\n }\n } catch (e) {\n if (e instanceof DOMException &&\n (e.name === \"BreakError\" || e.name === \"FramingError\" || e.name === \"ParityError\")) {\n console.log(e);\n } else if (e instanceof Error && e.message === \"timeout\") {\n return;\n } else {\n throw e;\n }\n } finally {\n if (reader) {\n reader.releaseLock();\n reader = undefined;\n }\n }\n }\n }\n\n async writeBytes(bytes) {\n let writer = undefined;\n\n if (this.isPortOpen === false) {\n await this.openPort();\n this.isPortOpen = true;\n }\n\n try {\n if (writer === undefined) {\n writer = this.port.writable.getWriter();\n }\n\n writer.write(bytes);\n } finally {\n if (writer) {\n writer.releaseLock();\n writer = undefined;\n }\n }\n }\n\n async writeString(str) {\n await this.writeBytes(this.textEncoder.encode(str));\n }\n}\n"
},
{
"path": "assets/js/vue/vue-lantiq-eeprom.vue",
"content": "\n
\n \n Info For more information, see the {{ revision }} specification.\n
\n \n \n
\n \n \n \n
\n
\n \n \n
\n
\n \n \n \n
\n
\n \n \n \n
\n
\n \n \n \n
\n
\n \n \n
\n
\n \n \n
\n \n
\n\n\n"
},
{
"path": "assets/js/vue-eeprom.js",
"content": "const { createApp } = Vue;\nconst { loadModule } = window['vue3-sfc-loader'];\nconst options = {\n moduleCache: {\n vue: Vue,\n },\n getFile(url) {\n return fetch(url).then((resp) =>\n resp.ok ? resp.text() : Promise.reject(resp)\n );\n },\n addStyle(styleStr) {\n const style = document.createElement('style');\n style.textContent = styleStr;\n const ref = document.head.getElementsByTagName('style')[0] || null;\n document.head.insertBefore(style, ref);\n },\n log(type, ...args) {\n console.log(type, ...args);\n },\n};\nconst app = createApp({\n components: {\n VueLantiqEeprom: Vue.defineAsyncComponent(() =>\n loadModule('/assets/js/vue/vue-lantiq-eeprom.vue', options)\n ),\n },\n}).mount('#app');"
},
{
"path": "assets/js/xymini.js",
"content": "/* XYMini Sender - Minimal implementation of file transfer through serial\n * Copyright (C) Erny \n * SPDX-License-Identifier: MPL-2.0-no-copyleft-exception\n *\n * Warning: This does not comply with XMODEM and YMODEM standards\n*/\n\nconst STX = 0x02;\nconst ACK = 0x06;\nconst NAK = 0x15;\nconst EOF = 0x04;\nconst XYMINI_1K_MAGIC = 0x43;\nconst PAYLOAD_LEN = 1024;\nconst BLOCK_LEN = PAYLOAD_LEN + 5;\nconst CRC_POLY = 0x1021;\n\nfunction uint16 (n) {\n return n & 0xFFFF;\n}\n\nfunction updateCrc(crcIn, incr) {\n const xor = uint16(crcIn >> 15);\n let result = uint16(crcIn << 1);\n\n if (incr) {\n result = uint16(result + 1);\n }\n\n if (xor) {\n result = uint16(result ^= CRC_POLY);\n }\n\n return result;\n}\n\nfunction crc16(data) {\n let crc;\n\n for (let i = 0; i < data.length; i++) {\n for (let j = 0x80; j; j >>= 1) {\n crc = updateCrc(crc, data[i] & j);\n }\n }\n\n for (let n = 0; n < 16; n++) {\n crc = updateCrc(crc, 0);\n }\n\n return crc;\n}\n\nasync function detectXYMini(serial) {\n const textDecoder = new TextDecoder();\n\n while (true) {\n const value = await serial.readBytes();\n\n if (value[0] == XYMINI_1K_MAGIC) {\n console.log(\"XYMini: detected\");\n break;\n }\n }\n}\n\nfunction generateXYMiniBlock(blockId, payload) {\n let buf = new Uint8Array(BLOCK_LEN);\n let i = 0;\n\n buf[i++] = STX;\n buf[i++] = blockId;\n buf[i++] = 0xFF - blockId;\n\n if (payload.length > PAYLOAD_LEN) {\n throw new Error(\"Payload too large to be transmitted in one block\");\n }\n\n for (let j = 0; j < payload.length; j++) {\n buf[i++] = payload[j];\n }\n\n while (i < BLOCK_LEN - 2) {\n buf[i++] = 0xFF;\n }\n\n let crcBuf = buf.slice(3, PAYLOAD_LEN + 3)\n let crc = crc16(crcBuf);\n\n buf[i++] = (crc >> 8) & 0xFF;\n buf[i++] = crc & 0xFF;\n\n return buf;\n}\n\nasync function sendXYMini(serial, data, progressCallback) {\n let blockId = 1;\n let size = data.length;\n let i = 0;\n let nakN = 0;\n let wrongCharN = 0;\n\n await detectXYMini(serial);\n\n while(true) {\n const payloadSize = Math.min(PAYLOAD_LEN, size);\n\n if (size) {\n const payload = data.slice(i, payloadSize + i);\n\n const block = generateXYMiniBlock(blockId, payload);\n await serial.writeBytes(block);\n } else {\n serial.writeBytes(new Uint8Array([EOF]));\n }\n\n const value = await serial.readBytes();\n\n if (value[0] == ACK) {\n if (!size) {\n console.log(\"XYMini: End of transmission\");\n\n return;\n }\n\n blockId++;\n size -= payloadSize;\n i += payloadSize;\n nakN = 0;\n wrongCharN = 0;\n progressCallback(data.length - size);\n } else if (value[0] == NAK) {\n if (nakN >= 10) {\n throw new Error(\"Received 10 NAK, receiver is rejecting file transmission\");\n }\n\n console.log(\"XYMini: NAK\");\n nakN++;\n } else {\n if (wrongCharN >= 30) {\n throw new Error(\"Received 30 wrong characters, the receiver is rejecting the transmission or the connection is too noisy\");\n }\n\n console.log(\"XYMini: wrong character\");\n console.log(value);\n wrongCharN++;\n }\n }\n}\n"
},
{
"path": "assets/ts/LTF7267-BHA-ploam.ts",
"content": "function hexEncode(str: String): String {\n\n var result = \"\";\n for (let i = 0; i < str.length; i++) {\n const hex = str.charCodeAt(i).toString(16);\n result += hex.padStart(2, \"0\");\n }\n\n return result;\n}\n\nfunction hisensePloam(ascii_ploam: String): String {\n const hex_ploam = hexEncode(ascii_ploam);\n const hex_padded_ploam = hex_ploam.padEnd(72, \"0\");\n let array: String[] = [];\n for (let i = 0; i < 9; i++) {\n const ploam_segment = hex_padded_ploam.slice(i * 8, (i + 1) * 8);\n let new_ploam_segment = \"\";\n for (let j = 4; j > 0; j--) {\n new_ploam_segment = new_ploam_segment + ploam_segment.slice((j - 1) * 2, j * 2);\n }\n if (new_ploam_segment !== \"00000000\") {\n array.push(\"INT CFG_ID_PON_REGISTRATION_ID\" + i + \" = 0x\" + new_ploam_segment + \";\");\n }\n }\n return array.join(\"\\n\");\n}\n\n(window as any).hisensePloam = hisensePloam;"
},
{
"path": "bin/just-the-docs",
"content": "#!/usr/bin/env ruby\r\n\r\ngem_dir = File.expand_path(\"..\",File.dirname(__FILE__))\r\n$LOAD_PATH.unshift gem_dir # Look in gem directory for resources first.\r\nexec_type = ARGV[0]\r\n\r\nif exec_type == 'rake' then\r\n require 'rake'\r\n require 'pp'\r\n pwd=Dir.pwd\r\n Dir.chdir(gem_dir) # We'll load rakefile from the gem's dir.\r\n Rake.application.init\r\n Rake.application.load_rakefile\r\n Dir.chdir(pwd) # Revert to original pwd for any path args passed to task.\r\n Rake.application.invoke_task(ARGV[1])\r\nend"
},
{
"path": "browserconfig.xml",
"content": "\n\n \n \n \n #27262b\n \n \n\n"
},
{
"path": "docker-compose.yml",
"content": "version: \"3.3\"\n\nservices:\n typescript:\n image: node:20\n command: sh -c \"cd /mnt && npm ci && npm run build\"\n restart: on-failure\n volumes:\n - ./tsup.config.ts:/mnt/tsup.config.ts\n - ./package.json:/mnt/package.json\n - ./package-lock.json:/mnt/package-lock.json\n - ./assets:/mnt/assets\n site:\n image: jekyll/jekyll:latest \n command: jekyll serve --verbose --incremental --force_polling --config _config.yml,_config.docker.yml\n environment:\n - JEKYLL_ENV=docker\n volumes:\n - .:/srv/jekyll\n ports:\n - 4000:4000\n depends_on:\n typescript:\n condition: service_completed_successfully\n \n"
},
{
"path": "faq.md",
"content": "---\ntitle: FAQs & Troubleshooting\nhas_children: false\nnav_order: 2\ndescription: \nlayout: default\n---\n\n{% include alert.html content=\"Playing with ONTs can cause your serial number/PLOAM password to be banned and faults to the optics, ONTs and OLTs. Always pay close attention to the calibration of the laser, under no circumstances should the calibration be changed.\" alert=\"Warning\" icon=\"svg-warning\" color=\"red\" %}\n"
},
{
"path": "index.md",
"content": "---\ntitle: Hack GPON\nhas_children: false\nnav_order: 1\ndescription: Worldwide wiki on how to access, change and edit ONTs\n---\n\nMost ONTs run customized firmware which implement vendor and ISP-specific integrations and are locked down in functionality to match service requirements.\nONTs often perform differently depending on the OLT and the settings applied by the ISP; for convenience it is often desirable to switch from an external ONT to an SFP or vice-versa, but most OLTs perform so many checks on the ONT that a simple replacement is almost impossible.\n\n{% include alert.html content=\"Playing with ONTs can cause your serial number/PLOAM password to be banned and faults to the optics, ONTs and OLTs. Always pay close attention to the calibration of the laser, under no circumstances should the calibration be changed.\" alert=\"Warning\" icon=\"svg-warning\" color=\"red\" %}\n\n{% include alert.html content=\"The material and information contained on this website is for general information purposes only. You should not rely upon the material or information on the website as a basis for making any business, legal or any other decisions. Whilst we endeavour to keep the information up to date and correct, hack-gpon.org makes no representations or warranties of any kind, expressed or implied about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services or related graphics contained on the website for any purpose. Any reliance you place on such material is therefore strictly at your own risk. We do not take responsibility for broken, bricked, unusable devices. To the extent not prohibited by law, in no circumstances shall hack-gpon.org be liable to you or any other third parties for any loss or damage (including, without limitation, damage for loss of business or loss of profits) arising directly or indirectly from your use of or inability to use this site or any of the material contained in it.\" alert=\"Warning\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{% include alert.html content=\"Certain links in this website will lead to websites which are not under the control of hack-gpon.org. When you visit these, you will leave the hack-gpon.org website. hack-gpon.org has no control over and accepts no liability in respect of materials, products or services available on any website which is not under the control of hack-gpon.org.\" alert=\"Warning\" icon=\"svg-warning\" color=\"red\" %}\n\n{% include alert.html content=\"This site is maintained and updated by a community of enthusiasts, and therefore in no way replaces or replaces official vendor and provider guides. Use of this content is at your own risk.\" alert=\"Warning\" icon=\"svg-warning\" color=\"yellow\" %}\n\n{% include alert.html content=\"You can also help us with the content of this site, on each page you will find a button to edit on GitHub.\" alert=\"Tip\" icon=\"svg-info\" color=\"green\" %}\n\n{% include alert.html content=\"This project and its documentation relate *exclusively to the Passive Optical Network (PON) layer* of optical network devices. \nWe *do not access, modify, or interact with any radio components, wireless interfaces, or transmitters*. As such, the activities described here are *not intended to fall under the scope* of the EU Radio Equipment Directive (RED) (*Directive 2014/53/EU) or the associated **Delegated Regulation (EU) 2022/30* on cybersecurity for internet-connected radio devices. However, any modification involving radio hardware *may trigger RED applicability*. Users are advised to assess regulatory obligations accordingly.\" alert=\"Warning\" icon=\"svg-warning\" color=\"yellow\" %}\n\nThis wiki contains links, codes, tutorials on how to access, edit and modify ONTs.\nAre you ready?\n\n\n[Yes](ont){: .btn .btn-green } [Quick start](quick-start){: .btn .btn-blue }\n"
},
{
"path": "package.json",
"content": "{\n \"scripts\": {\n \"build\": \"tsup\",\n \"watch\": \"tsup --watch\",\n \"clean\": \"rimraf assets/js/generated\"\n },\n \"devDependencies\": {\n \"rimraf\": \"^5.0.1\",\n \"tsup\": \"^6.7.0\"\n }\n}\n"
},
{
"path": "privacy-policy.md",
"content": "---\nlayout: default\ntitle: Privacy Policy\npermalink: /privacy-policy\nnav_exclude: true\nsearch_exclude: true\n---\n\n# Privacy Policy for hack-gpon.org\n\nAt hack-gpon.org, accessible from hack-gpon.org, one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collected and recorded by hack-gpon.org and how we use it.\n\nIf you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us.\n\nThis Privacy Policy applies only to our online activities and is valid for visitors to our website with regards to the information that they shared and/or collect in hack-gpon.org. This policy is not applicable to any information collected offline or via channels other than this website.\n\n# Consent\n\nBy using our website, you hereby consent to our Privacy Policy and agree to its terms.\n\n# Information we collect\n\nNo personal information is stored in hack-gpon.org, hack-gpon.org exclusively uses the information, personal or otherwise, in the GitHub repository [github.com/hack-gpon/hack-gpon.github.io](https://github.com/hack-gpon/hack-gpon.github.io)\n\nIf you make changes, PRs, commits to the git repository your personal information may be displayed on hack-gpon.org.\n\n# How we use your information\n\nWe use the information we collect in various ways, including to:\n\n- Provide, operate, and maintain our website\n- Improve, personalize, and expand our website\n- Understand and analyze how you use our website\n- Develop new products, services, features, and functionality\n- Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the website, and for marketing and promotional purposes\n- Send you emails\n- Find and prevent fraud\n\n# Log Files\n\nhack-gpon.org follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this and a part of hosting services’ analytics. The information collected by log files include internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any information that is personally identifiable. The purpose of the information is for analyzing trends, administering the site, tracking users’ movement on the website, and gathering demographic information.\n\n\n# Advertising Partners Privacy Policies\n\nThere are no Advertising Partners\n\n# Third Party Privacy Policies\n\nhack-gpon.org’s Privacy Policy does not apply to other advertisers or websites. Thus, we are advising you to consult the respective Privacy Policies of these third-party ad servers for more detailed information. It may include their practices and instructions about how to opt-out of certain options.\n\nYou can choose to disable cookies through your individual browser options. To know more detailed information about cookie management with specific web browsers, it can be found at the browsers’ respective websites.\n\n- [GitHub Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement)\n\n\n# CCPA Privacy Rights (Do Not Sell My Personal Information)\nUnder the CCPA, among other rights, California consumers have the right to: Request that a business that collects a consumer’s personal data disclose the categories and specific pieces of personal data that a business has collected about consumers. Request that a business delete any personal data about the consumer that a business has collected. Request that a business that sells a consumer’s personal data, not sell the consumer’s personal data. If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.\n\n# GDPR Data Protection Rights\nWe would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following: The right to access – You have the right to request copies of your personal data. We may charge you a small fee for this service. The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you believe is incomplete. The right to erasure – You have the right to request that we erase your personal data, under certain conditions. The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions. The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions. The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions. If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.\n\n# Children’s Information\nAnother part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity.\n\nhack-gpon.org does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.\n\n\n\n"
},
{
"path": "quick-start.md",
"content": "---\ntitle: Quick Start\nhas_children: false\nnav_order: 2\ndescription: \nlayout: default\n---\n{% include alert.html content=\"Playing with ONTs can cause your serial number/PLOAM password to be banned and faults to the optics, ONTs and OLTs. Always pay close attention to the calibration of the laser, under no circumstances should the calibration be changed.\" alert=\"Warning\" icon=\"svg-warning\" color=\"red\" %}\n\nThe information on this page is taken from the GPON/EPON standard and information from the major vendors of GPON/EPON equipment, each individual item containing a verifiable citation in the standard. Feel free to cite this page as: `{{ page.title }}, Hack GPON. Available at: https://hack-gpon.org{{ page.url }}`.\n\n# Fiber Optic Connectors\n\nNumerous connectors, both standard and proprietary, are used in the field of telecommunications equipment, data lines, television and cable, and other industrial fields. \n\n{% include image.html file=\"quick-start/optic-fiber-connectors.jpg\" alt=\"Some of the most common connectors\" caption=\"Some of the most common connectors\" %}\n\nThe main connectors are:\n- Bionic Connector\n- Standard Connector (SC)\n- Ferrule Core Connector (FC)\n- ST Connector (ST)\n- SMA Connector\n- Lucent Connector (LC)\n- Enterprise Systems Connection Connector (ESCON)\n- Fiber Distributed Data Interface Connector (FDDI)\n- Opti-Jack Connector\n- LX-5 Connector\n- Volition Connector\n- MT-RJ Connector\n- MU Connector\n- MT Connector\n- E2000 Connector\n\n## Polishing of Fiber Optic Connectors\n\nAPC and UPC use different polishing methodologies of fiber optic ferrules, and they define types of fiber patch cable connectors. These determine the quality of the fiber optic lightwave transmission, mostly calculated in optical return loss and insertion loss[^wolon].\n\n{% include image.html file=\"quick-start/apc-upc.jpg\" alt=\"Picture of APC and UPC connections\" caption=\"Picture of APC and UPC\" %}\n\nAngled physical connectors are used on the ONT's side to reduce back-reflections. In case RF signals (1550nm) are introduced, there will be two signals traveling in the downstream direction (1490nm + 1550nm); as RF systems are highly sensitive to reflections the APC connectors reduce the return loss value[^zyxel] and are preferred over UPC.\n\nNext generation systems are planned to operate in wavelengths over 1500nm, making APC connectors on the ONT's side something that will be more commonplace in the future[^zyxel].\n\n# PON Networks[^huawei]\n\n- PON is a kind of passive optical network featuring point-to-multiple-point architecture;\n- PON is short for Passive Optical Network;\n- PON consists of Optical Line Terminal (OLT), Optical Network Unit (ONU) and Passive Optical Splitter.\n\n- APON: ATM Passive Optical Networks;\n- EPON: Ethernet Passive Optical Networks;\n- GPON: Gigabit-capable Passive Optical Networks;\n- XG(S)-GPON: 10 Gigabit-capable Passive Optical Networks[^standardxgpon];\n\nEPON and GPON are complementary and compete against each other under some aspects. So in the following contents, we'd like to render the EPON and GPON comparison more clear[^fs].\n\n## Why GPON?\n\n- GPON is defined by ITU, International Telecomunication Union[^standardgpon].\n- GPON supports Triple-play services, providing a competitive full-service solution[^huawei].\n- GPON supports high-bandwidth transmission to break down the bandwidth bottleneck of the access over twisted pair cables, so as to satisfy the requirements of high-bandwidth services, such as IPTV and live TV broadcasts[^huawei].\n- GPON supports long-reach (up to 20 km) service coverage to overcome the obstacle of the access technology over twisted pair cables and reduce the network nodes[^huawei].\n- With complete standards and high technical requirements, GPON supports integrated services in a good way[^huawei].\n- GPON is the choice of large carriers in the international market[^huawei].\n- GPON is high broadband efficiency, around 92%[^huawei].\n- GPON has integrated QoS handling that makes it better than EPON, because QoS on EPON is higher cost relative to GPON[^fs].\n- GPON supports splitting up to 1:128, XG(S)-PON up to 1:256[^fs],[^standardxgpon].\n- Security: the data transmitted to ONUs/ONTs is encrypted using the AES mechanism[^telecom].\n\n\n## Why EPON?\n- EPON is defined by IEEE 802.3 standard, ratified as 802.3ah-2004 for 1.25 Gbps (1.0 Gbps prior to 8B/10B coding) and IEEE 802.3av standard for 10Gbps (10G-EPON)[^standard1epon],[^standard10epon].\n- 1/1-EPON supports splitting up to 1:32, 10/*-EPON up to 1:128[^fs],[^standard10epon].\n- In EPON, both downstream and upstream line rates are 1.25 Gbps, but due to the 8B/10B line encoding, the bit rate for data transmission is 1 Gbps[^medium].\n- The use of EPON allows carriers to eliminate complex and expensive ATM and Sonet elements and to simplify their networks, thereby lowering costs to subscribers. Currently, GPON equipment costs are approximately 1.5 to 2 times higher than an EPON[^medium],[^fs].\n\n## Layering model \n\nLayering model and the associated management services are all mapped over Ethernet (directly or via IP). \n\n- GPON supports the encapsulation of other protocols besides Ethernet, such as ATM[^cisco],[^huawei],[^fs].\n- XG(S)-PON removes the support of ATM encapsulation[^telecom].\n- GPON uses two layers of encapsulation. First, TDM and Ethernet frames are wrapped into GTC Encapsulation Method (GEM) frames, which have a GFP-like format (derived from Generic Frame Procedure ITU G.7401). Secondly, ATM and GEM frames are both encapsulated into GTC frames that are finally transported over the PON[^medium],[^fs].\n- The main purpose of GEM frames is to provide a frame-oriented service, as an alternative to ATM, in order to efficiently accommodate Ethernet and TDM frames. With GEM, all traffic is mapped across the GPON network using a variant of SONET/SDH GFP. GEM supports a native transport of voice, video, and data without an added ATM or IP encapsulation layer. That's why GPON supports downstream rates as high as 2.5 Gbps and upstream rates from 155 Mbps to 2.5 Gbps. It is much faster than EPON[^medium]. \n- However, EPON clearly offers a much simpler and more straightforward solution than GPON. The support of ATM and the double encapsulation of GPON serve no real benefit over a pure Ethernet transport scheme[^medium].\n- In EPON, Ethernet frames are carried in their native format over the PON, which greatly simplifies the layering model and the associated management. EPON employs a single layer that uses IP (Internet Protocol) to carry data, voice, and video[^medium],[^fs].\n\n{% include image.html file=\"epon_gpon.jpg\" alt=\"EPON vs GPON Layers\" caption=\"EPON vs GPON Layer\" %}\n\n## Comunication between ONTs and OLT[^fs]\n\n- EPON utilizes IEEE 802.3ah OAM messages for provisioning, fault isolation and performance monitoring in conjunction with SNMP (Simple Network Management Protocol) sets and gets through IETF (Internet Engineering Task Force) and MIBs (Management Information Bases). Additional control messages are MPCP GATEs/REPORTs for bandwidth granting.\n- In GPON there are three different types of control messages: OMCI (ONT Management and Control Interface), OAM, and PLOAM (Physical Layer OAM). Their roles are shown in the table below.\n\n| Control channel | Format | Used for |\n| --------------- | --------------- | ------------------------------------------------------------------------------------------------------------------ |\n| OMCI | Ethernet or ATM | Provisioning of ONT service defining layers above the GTC |\n| Embedded OAM | Header overhead | BW granting, encryption key switching, and DBA |\n| PLOAM | ATM | Auto discovery and all other PMD and GTC management info. PLOAM messages are directed to ONTs or FF for broadcasts |\n\n\n## Wavelength[^huaweimultiplexing]\n\nPON adopts Wavelength Division Multiplexing (WDM) technology, facilitating bidirectional communication over a single fiber.\n\nTo separate upstream/downstream signals of multiple users over a single fiber, PON adopts two multiplexing mechanism:\n- In downstream direction, data packets are transmitted in a broadcast manner;\n- In upstream direction, data packets are transmitted using TDMA.\n\n{% include image.html file=\"quick-start/optical-fiber-transmission-windows.svg\" alt=\"Fiber Optic Operation Wavelength and Window\" caption=\"Fiber Optic Operation Wavelength and Window\" %}\n\n\n| | GPON | 1/1-EPON | XG(S)-GPON | 10/1-EPON | 10/10-EPON |\n| ---------- | ------------------------- | ------------------------- | --------------------------- | --------------------------- | --------------------------- |\n| Upstream | 1310 nm (1260 nm-1360 nm) | 1310 nm (1260 nm-1360 nm) | 1270 nm (1260 nm-1280 nm) | 1310 nm (1260 nm-1360 nm) | 1270 nm (1260 nm-1280 nm) |\n| Downstream | 1490 nm (1480 nm-1500 nm) | 1490 nm (1480 nm-1500 nm) | 1577.5 nm (1575 nm-1580 nm) | 1577.5 nm (1575 nm-1580 nm) | 1577.5 nm (1575 nm-1580 nm) |\n| RF-Overlay | 1550 nm (1550 nm-1560 nm) | 1550 nm (1550 nm-1560 nm) | 1550 nm (1550 nm-1560 nm) | 1550 nm (1550 nm-1560 nm) | 1550 nm (1550 nm-1560 nm) |\n\n# Power Budget[^zyxel],[^cisco]\n\n- Splitter attenuation\n\n| Splitter Type | Attenuation |\n| ------------- | ----------- |\n| 1:2 | ≤ 3.5 dB |\n| 1:4 | ≤ 7.0 dB |\n| 1:8 | ≤ 10.5 dB |\n| 1:16 | ≤ 14.0 dB |\n| 1:32 | ≤ 17.5 dB |\n| 1:64 | ≤ 20.5 dB |\n| 1:128 | ≤ 24.0 dB |\n\n- Loop attenuation: ≤ 0.5 dB (Per Km)\n\n- Connector attenuation: ≤ 0.3 dB (Per Connector)\n\n# Classes for laser[^cisco]\n\n| | Class A | Class B | Class B+ | Class C |\n| ------------ | ------- | ------- | -------- | ------- |\n| Minimum loss | 5 dB | 10 dB | 13 dB | 15 dB |\n| Maximun loss | 20 dB | 25 dB | 28 dB | 30 dB |\n\nThe requirements of a particular class may be more stringent for one system type than for another.\n\n\n\n[^standardgpon]: *G.984.1: Gigabit-capable passive optical networks (GPON): General characteristics* https://www.itu.int/rec/T-REC-G.984.1\n[^standardxgpon]: *G.987.1: 10-Gigabit-capable passive optical networks (XG-PON): General requirements* https://www.itu.int/rec/T-REC-G.987.1\n[^standard1epon]: *IEEE 802.3ah-2004: IEEE Standard for Information technology-- Local and metropolitan area networks-- Part 3: CSMA/CD Access Method and Physical Layer Specifications Amendment: Media Access Control Parameters, Physical Layers, and Management Parameters for Subscriber Access Networks* https://standards.ieee.org/ieee/802.3ah/3179/\n[^standard10epon]: *IEEE 802.3av-2009: IEEE Standard for Information technology-- Local and metropolitan area networks-- Specific requirements-- Part 3: CSMA/CD Access Method and Physical Layer Specifications Amendment 1: Physical Layer Specifications and Management Parameters for 10 Gb/s Passive Optical Networks* https://standards.ieee.org/ieee/802.3av/4060/\n[^fs]: *Comparison of EPON and GPON* https://community.fs.com/blog/comparison-of-epon-and-gpon.html\n[^zyxel]: *GPON E2E Fundamentals*, Zyxel 2018\n[^huawei]: *GPON Fundamentals*, Huawei 2010 http://jm.telecoms.free.fr/QCM_Fibre/GPON-Fundamentals_Huawei.pdf\n[^broadbandforum]: *GPON in FTTx Broadband Deployments*, Broadband Forum 2010 https://www.broadband-forum.org/download/MR-246.pdf\n[^wolon]: *Fiber SFP Module Compatibility with APC, UPC, PC* https://www.wolonte.com/news.asp?id=599\n[^cisco]: *Understand GPON Technology* https://www.cisco.com/c/en/us/support/docs/switches/catalyst-pon-series/216230-understand-gpon-technology.html\n[^medium]: *HTFuture: EPON vs GPON Standard* https://medium.com/@ivyhtfuture/epon-vs-gpon-standard-b8ec20c55bb3\n[^telecom]: *Fifty Years of Fixed Optical Networks Evolution: A Survey of Architectural and Technological Developments in a Layered Approach* https://doi.org/10.3390/telecom3040035\n[^huaweimultiplexing]: *GPON Principle---Data Multiplexing* https://forum.huawei.com/enterprise/en/gpon-principle-data-multiplexing/thread/458243-100181\n\n"
},
{
"path": "rakefile",
"content": "Dir.glob('lib/tasks/*.rake').each {|r| import r}\r\n"
},
{
"path": "site.webmanifest",
"content": "{\n \"name\": \"Hack GPON\",\n \"short_name\": \"Hack GPON\",\n \"icons\": [\n {\n \"src\": \"/android-chrome-192x192.png\",\n \"sizes\": \"192x192\",\n \"type\": \"image/png\"\n },\n {\n \"src\": \"/android-chrome-512x512.png\",\n \"sizes\": \"512x512\",\n \"type\": \"image/png\"\n }\n ],\n \"theme_color\": \"#27262b\",\n \"background_color\": \"#27262b\",\n \"start_url\": \"https://hack-gpon.org/\",\n \"display\": \"standalone\"\n}\n"
},
{
"path": "tsup.config.ts",
"content": "import { defineConfig } from 'tsup'\n\nexport default defineConfig({\n entry: ['assets/ts/'],\n splitting: false,\n sourcemap: true,\n clean: true,\n outDir: 'assets/js/generated'\n})\n"
}
]