From d1ccee5cd7b67f8bad07067b5625a70e7e7560d3 Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:08:29 +0200 Subject: [PATCH 01/10] Document FS.com gtop debug menu and HG8010H ISP passwords (#204, #247) - FS.com GPON ONU Stick (#204): Add gtop debug menu documentation with VLAN table and GEM port commands, composite key instructions, and onu gtcsng serial number command - Huawei HG8010H (#247): Document ISP-specific passwords (8-char random string printed on device label) used by some deployments, and note that telecomadmin works with the sticker password Co-Authored-By: Claude Opus 4.6 --- ont/ont-fs-com-gpon-onu-stick-with-mac.md | 24 +++++++++++++++++++++++ ont/ont-huawei-hg8010h.md | 12 ++++++++++-- 2 files changed, 34 insertions(+), 2 deletions(-) diff --git a/ont/ont-fs-com-gpon-onu-stick-with-mac.md b/ont/ont-fs-com-gpon-onu-stick-with-mac.md index f1b172ef..63cb6ac7 100644 --- a/ont/ont-fs-com-gpon-onu-stick-with-mac.md +++ b/ont/ont-fs-com-gpon-onu-stick-with-mac.md @@ -172,6 +172,30 @@ omci_pipe.sh meg MIB_IDX ME_IN ``` Where `MIB_IDX` is the MIB ID and the `ME_IN` is the ME instance number +## Debug menu (gtop) + +The `gtop` command provides an interactive debug menu for monitoring and diagnostics. To access it, run: +```sh +gtop +``` + +Inside the debug menu, composite key commands can be used by pressing two keys simultaneously (e.g. `c` + `a`). + +### Getting VLAN table rule +```sh +gtop -g "GPE VLAN rule" +``` + +### Getting GEM port status table +```sh +gtop -g e +``` + +## Getting ONU GPON Serial Number (alternative) +```sh +onu gtcsng +``` + ## Getting/Setting Speed LAN Mode To get the LAN Mode: diff --git a/ont/ont-huawei-hg8010h.md b/ont/ont-huawei-hg8010h.md index f5ef5a8d..06773e37 100644 --- a/ont/ont-huawei-hg8010h.md +++ b/ont/ont-huawei-hg8010h.md @@ -19,13 +19,21 @@ parent: Huawei | 2.5GBaseT | No | | Optics | SC/APC and SC/UPC | | IP address | 192.168.100.1 | -| Web Gui | ✅ user `root`, password `admin` or `adminHW` and user `telecomadmin`, password `admintelecom` | +| Web Gui | ✅ user `root`, password `admin` or `adminHW` and user `telecomadmin`, password `admintelecom` (see [Default credentials](#default-credentials)) | | SSH | | -| Telnet | After Enabling user `root`, password `admin` or `adminHW` | +| Telnet | After Enabling user `root`, password `admin` or `adminHW` (see [Default credentials](#default-credentials)) | | Serial | | | Form Factor | ONT | +## Default credentials + +The default credentials are `root`/`admin` or `root`/`adminHW`, and `telecomadmin`/`admintelecom`. + +::: warning ISP-specific passwords +Some ISP deployments (e.g. certain Turkish ISPs) use a custom password instead of the defaults above. In this case, the password is an 8-character seemingly random string (mixed uppercase/lowercase letters and numbers) printed on the back of the ONT, in the same location as shown in the sticker photo below. The `telecomadmin` username also works with this ISP-specific password. +::: + From 3fdc402a377116a575c3e85b8eddc418548afb91 Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:13:55 +0200 Subject: [PATCH 02/10] Resolve issues #486, #469, #444: XS-010X-R CRC, ODI/HSGQ links, G-010G-R variants - Nokia XS-010X-R (#486): Document mfginfo CRC algorithm as CRC-32/BZIP2 over first 236 bytes, add Python verification script and CA8271x links - ODI/HSGQ (#469): Add HSGQ alias and rebrand note, add Asenheim firmware repository link to all ODI pages, Huawei MA5671A, and Nokia G-010S-P - Nokia G-010G-R (#444): Document 9600 baud variant (G-97CL PCB with 25L95 laser driver), add note about enable password generator limitations Co-Authored-By: Claude Opus 4.6 --- ont-xgs/ont-nokia-xs-010x-r.md | 37 ++++++++++++++++++++++++++---- ont/ont-huawei-ma5671a.md | 1 + ont/ont-nokia-g-010g-r.md | 10 +++++++- ont/ont-nokia-g-010s-p.md | 1 + ont/ont-odi-realtek-dfp-34g-2c2.md | 1 + ont/ont-odi-realtek-dfp-34x-2c2.md | 1 + ont/ont-odi-zte-dfp-34g-2c2.md | 1 + ont/ont-odi.md | 5 ++++ 8 files changed, 51 insertions(+), 6 deletions(-) diff --git a/ont-xgs/ont-nokia-xs-010x-r.md b/ont-xgs/ont-nokia-xs-010x-r.md index 341441b8..f9ddede5 100644 --- a/ont-xgs/ont-nokia-xs-010x-r.md +++ b/ont-xgs/ont-nokia-xs-010x-r.md @@ -83,11 +83,33 @@ This ONT supports dual boot. `kernel0` and `rootfs0` respectively contain the kernel and firmware of the first image, `kernel1` and `rootfs1` the kernel and firmware of the second one. -`mfginfo0` and `mfginfo1` (in the first 256bytes) contain the MAC-addresses and the serial (at offset 0x68). The last 4 byte seem to be a UNKNOWN checksum.
-The third 256 byte block (offsets 0x7800200 and 0x7900200) contains the user configurable PON-ID. Here the 4byte checksum at the end is CRC-32/BZIP2 in BIG-endian (Polynom: 0x04C11DB7). - - I really would be interested what the checksum is / how the checksum of the first block is calculated.
-Even the relevant kernel modules "ca_ne.ko" (authored by Aaron ans Raymond Tseng) claims to be GPL - the cortina team didn't respond to my mails asking for source code / details. +`mfginfo0` and `mfginfo1` (in the first 256 bytes) contain the MAC-addresses and the serial (at offset 0x68). The last 4 bytes are a CRC-32/BZIP2 checksum (Polynom: 0x04C11DB7, Init: 0xFFFFFFFF, XorOut: 0xFFFFFFFF) calculated over the first 236 bytes of the block.
+The third 256 byte block (offsets 0x7800200 and 0x7900200) contains the user configurable PON-ID. Here the 4-byte checksum at the end is also CRC-32/BZIP2 in BIG-endian (Polynom: 0x04C11DB7). + +The CRC algorithm is implemented in the `cig-misc.ko` kernel module (function `nvram_nand_eeprom_valid_check()`), which prints the correct length needed for the CRC calculation (236 bytes). + +::: details Python script to verify the mfginfo CRC +```python +import struct + +def crc32_bzip2(data, poly=0x04C11DB7, init=0xFFFFFFFF, xorout=0xFFFFFFFF): + crc = init & 0xFFFFFFFF + for byte in data: + crc ^= (byte << 24) & 0xFFFFFFFF + for _ in range(8): + if crc & 0x80000000: + crc = ((crc << 1) ^ poly) & 0xFFFFFFFF + else: + crc = (crc << 1) & 0xFFFFFFFF + return crc ^ xorout + +# Read 256 bytes from mfginfo partition +# mfginfo_256 = open("mtd10.bin", "rb").read(256) +# crc_expected = struct.unpack("I", mfginfo_256[252:])[0] +# crc_calculated = crc32_bzip2(mfginfo_256[0:236]) +# print(f"Expected: {crc_expected:#010x} | Calculated: {crc_calculated:#010x} | Match: {crc_expected == crc_calculated}") +``` +::: @@ -103,3 +125,8 @@ After loggin in as "admin". the telnetd hands over to "/usr/bin/GponSLID". With the possiblility to unsolder and clone the NAND (I wrote my own C-Tool using spidev) it might be possible to modify the `rootfs0`.
This could be a practical way to enable full telnet by replacing "/usr/bin/GponSLID" with "/usr/bin/GponCLI" - or even better "/bin/sh"... + +# Miscellaneous Links + +- [CA8271x documentation and tools](https://github.com/YuukiJapanTech/CA8271x) - includes mtd dumps, root shell methods, and CIG backdoor packet info +- [pon.wiki: Nokia XS-010X-R](https://pon.wiki/xgs-pon/ont/nokia/xs-010x-r/) diff --git a/ont/ont-huawei-ma5671a.md b/ont/ont-huawei-ma5671a.md index e25eb827..c9bce610 100644 --- a/ont/ont-huawei-ma5671a.md +++ b/ont/ont-huawei-ma5671a.md @@ -406,6 +406,7 @@ For more information, see the SFF-8472 Rev 10.2 specification. # Miscellaneous Links +- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules - [Huawei MA5671B / OptiXstar S600E (successor)](/ont-huawei-optixstar-s600e) - [Support MA5671A SFP GPON - OpenWRT forum](https://forum.openwrt.org/t/support-ma5671a-sfp-gpon/48042) - [u boot lantiq falcon - GitHub](https://github.com/minhng99/u-boot_lantiq_falcon) diff --git a/ont/ont-nokia-g-010g-r.md b/ont/ont-nokia-g-010g-r.md index aab77476..b8ac2f84 100644 --- a/ont/ont-nokia-g-010g-r.md +++ b/ont/ont-nokia-g-010g-r.md @@ -23,10 +23,18 @@ parent: Nokia | SSH | ✅ but no login possible | | Telnet | ✅ user `admin`, password `1234`, but has access to GponSLID and not GponCLI | | Serial | ✅ | -| Serial baud | 115200 | +| Serial baud | 115200 (some models use 9600 for the `ONT>` console) | | Serial encoding | 8-N-1 | | Form Factor | ONT | +## Hardware variants + +Some G-010G-R models use a G-97CL PCB with a SEMTECH 25L95 laser driver. On these models, the `ONT>` console may only be accessible at 9600 baud rate instead of the standard 115200. + +::: warning Note +The enable password generator may not work on all variants. If the `ONT>` console is accessible but commands are limited, a flash dump and analysis may be needed to change the serial number. +::: + ## List of software versions - 3FE49717AOCK12 - 3FE49717AOCK38 diff --git a/ont/ont-nokia-g-010s-p.md b/ont/ont-nokia-g-010s-p.md index 4a1c3545..41a3e453 100644 --- a/ont/ont-nokia-g-010s-p.md +++ b/ont/ont-nokia-g-010s-p.md @@ -302,6 +302,7 @@ FALCON => saveenv # Miscellaneous Links +- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules - [alcatel_lucent-lantiq_falcon](https://github.com/minhng99/alcatel_lucent-lantiq_falcon) - [uboot lantiq falcon](https://github.com/minhng99/u-boot_lantiq_falcon) - [Usage GPON module SFP in Spain](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300) diff --git a/ont/ont-odi-realtek-dfp-34g-2c2.md b/ont/ont-odi-realtek-dfp-34g-2c2.md index 47766cfa..d8fbda0c 100644 --- a/ont/ont-odi-realtek-dfp-34g-2c2.md +++ b/ont/ont-odi-realtek-dfp-34g-2c2.md @@ -88,6 +88,7 @@ omciOLT21: "true" # Miscellaneous Links - [Hacking RTL960x](https://github.com/Anime4000/RTL960x) +- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules - [Ditch ONU, use GPON SFP on Business Grade Router, Mikrotik/Ubiquiti/pfSense (Home Networking)](https://forum.lowyat.net/topic/4925452) - [For the new model ODI ZTE DFP-34X-C2C](/ont-odi-zte-dfp-34x-2c2) diff --git a/ont/ont-odi-realtek-dfp-34x-2c2.md b/ont/ont-odi-realtek-dfp-34x-2c2.md index 1e73b465..8fb6f5f7 100644 --- a/ont/ont-odi-realtek-dfp-34x-2c2.md +++ b/ont/ont-odi-realtek-dfp-34x-2c2.md @@ -97,6 +97,7 @@ omciOLT21: "true" # Miscellaneous Links - [Hacking RTL960x](https://github.com/Anime4000/RTL960x) +- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules - [Ditch ONU, use GPON SFP on Business Grade Router, Mikrotik/Ubiquiti/pfSense (Home Networking)](https://forum.lowyat.net/topic/4925452) - [For the old model ODI ZTE DFP-34G-C2C](/ont-odi-zte-dfp-34g-2c2) diff --git a/ont/ont-odi-zte-dfp-34g-2c2.md b/ont/ont-odi-zte-dfp-34g-2c2.md index 98bc4549..ccfe4e25 100644 --- a/ont/ont-odi-zte-dfp-34g-2c2.md +++ b/ont/ont-odi-zte-dfp-34g-2c2.md @@ -55,6 +55,7 @@ This stick supports dual boot. # Miscellaneous Links +- [Asenheim firmware repository](https://cloud.asenheim.org/s/tqGTgBDSZgoKFyg) - alternative firmware collection for ODI/HSGQ, Alcatel/Nokia and Huawei modules - [GPON module Dfp-34g-2c2 sfp](https://forum.openwrt.org/t/gpon-module-dfp-34g-2c2-sfp/51641) - [Ditch ONU, use GPON SFP on Business Grade Router, Mikrotik/Ubiquiti/pfSense (Home Networking)](https://forum.lowyat.net/topic/4925452) - [Usage GPON module SFP in Spain](https://forum.mikrotik.com/viewtopic.php?t=116364&start=300) diff --git a/ont/ont-odi.md b/ont/ont-odi.md index eb3a4ff0..bcbf5191 100644 --- a/ont/ont-odi.md +++ b/ont/ont-odi.md @@ -1,4 +1,9 @@ --- title: ODI has_children: true +alias: HSGQ --- + +::: info Note +ODI has rebranded as HSGQ. The devices are the same; only the company name has changed. +::: From bced7a6fa2e3d5c83cf3b7efa7eab2e4dc4390a3 Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:15:16 +0200 Subject: [PATCH 03/10] Resolve issues #428, #424, #416: FG1000B firmware, Galachip, Zyxel patch - Sercomm FG1000B (#428): Add firmware version 090165.1.0.009 and Telekom firmware download link with note about encrypted format - Galachip GC1601 (#424): Add Faraday/Galachip to the chipset list, create TP-Link XZ000-G7 page as the known device using GC1601 - Zyxel EX5601-T0 (#416): Document that firmware v34.0 (May 2025) patches the EngDebugFlag security flaw used for zloader unlock Co-Authored-By: Claude Opus 4.6 --- gpon/ont.md | 2 ++ ont/ont-sercomm-fg1000b.md | 4 ++++ ont/ont-tplink-xz000-g7.md | 34 ++++++++++++++++++++++++++++++++++ sfp-cage/zyxel.md | 4 ++++ 4 files changed, 44 insertions(+) create mode 100644 ont/ont-tplink-xz000-g7.md diff --git a/gpon/ont.md b/gpon/ont.md index a05f7a00..9810fce3 100644 --- a/gpon/ont.md +++ b/gpon/ont.md @@ -69,6 +69,8 @@ Currently, there are only a few main PON chipset vendors: - Airoha (continuation of EcoNet) * AN7581 * AN7583/AN7553 +- Faraday Technology (Galachip) + * GC1601 ## Realtek Chipsets HSGMII chipsets are relatively recent, they became more common starting in 2020, and are used in many ONTs. Realtek offers an official SDK, Luna SDK, which offers very good performance in queue management, unfortunately it is not used by all devices based on these chipsets. diff --git a/ont/ont-sercomm-fg1000b.md b/ont/ont-sercomm-fg1000b.md index eac62416..e6126946 100644 --- a/ont/ont-sercomm-fg1000b.md +++ b/ont/ont-sercomm-fg1000b.md @@ -60,7 +60,11 @@ The ONT seems to only display output of the ROM CFE and flash CFE, but doesn't s | 090144.1.0.004 | | Deutsche Telekom (FG1000B.11) | | 090144.1.0.006 | | Deutsche Telekom (FG1000B.11) | | 090144.1.0.009 | 23.05.2025 | Deutsche Telekom (FG1000B.11) | +| 090165.1.0.009 | | Deutsche Telekom (FG1000B.11) | +::: info Firmware downloads +Deutsche Telekom makes firmware update files available on their website: [Glasfaser-Modem firmware](https://www.telekom.de/hilfe/geraete/router/zubehoer/glasfaser-modem). Note that the firmware files appear to be encrypted/obfuscated (Sercomm proprietary format). +::: ## List of partitions `cat /proc/mtd` diff --git a/ont/ont-tplink-xz000-g7.md b/ont/ont-tplink-xz000-g7.md new file mode 100644 index 00000000..e2c59b4e --- /dev/null +++ b/ont/ont-tplink-xz000-g7.md @@ -0,0 +1,34 @@ +--- +title: TP-Link XZ000-G7 +has_children: false +parent: TP-Link +--- + +# Hardware Specifications + +| | | +| ------------ | ------------------------------------- | +| Vendor/Brand | TP-Link | +| Model | XZ000-G7 | +| Chipset | Faraday/Galachip GC1601 | +| CPU | ARM 32-bit | +| Flash | | +| RAM | | +| System | Linux (Kernel 3.16, uClibc) | +| HSGMII | | +| Optics | SC/APC | +| IP address | | +| Web Gui | | +| SSH | | +| Telnet | | +| Serial | | +| Form Factor | ONT | + +::: info Note +This ONT uses the Faraday/Galachip GC1601 chipset, which is relatively uncommon. The device uses a custom Galachip-specific SDK. Very little public documentation exists about this chipset. +::: + +# Miscellaneous Links + +- [TP-Link XZ000-G7 product page](https://www.tp-link.com/nordic/service-provider/gpon/xz000-g7/) +- [XZ000-G7 additional info (Portuguese)](https://www.tripleoxygen.net/wiki/ont/tplink/xz000-g7-br-v1) diff --git a/sfp-cage/zyxel.md b/sfp-cage/zyxel.md index ad43cf03..d9298cac 100644 --- a/sfp-cage/zyxel.md +++ b/sfp-cage/zyxel.md @@ -72,6 +72,10 @@ By default zloader access is blocked. ### Unlocking zloader +::: danger Warning +Starting from firmware version 34.0 (released 9th May 2025), Zyxel has patched the `EngDebugFlag` security flaw. The procedure below to unlock zloader via `fw_setenv EngDebugFlag 0x1` no longer works on firmware 34.0 and newer. If your device has been updated to this firmware, the root/zloader access methods described here are not available. +::: + ::: danger Warning The following procedure is provided as-is, if you damage the device this community is not responsibile for any damage in any way. ::: From f885d8c23ab5cb2acfd66d504caa72196d5a5c77 Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:28:54 +0200 Subject: [PATCH 04/10] Resolve issues #378, #239, #381: XS-010X-Q subnet access, PMG3000-D20B root password, LTF7267-BHA+ USXGMII - Add Web GUI access instructions for Nokia XS-010X-Q (direct connection or router NAT) - Document remote_account_pwd bootloader variable for PMG3000-D20B V2.50 firmware - Add LTF7267-BH+ variant note and USXGMII auto-negotiation known bug on LTF7267-BHA+ Co-Authored-By: Claude Opus 4.6 --- ont-xgs/ont-hisense-ltf7267-bha+.md | 5 +++++ ont-xgs/ont-nokia-xs-010x-q.md | 7 +++++++ ont/ont-zyxel-pmg3000-d20b.md | 11 +++++++++++ 3 files changed, 23 insertions(+) diff --git a/ont-xgs/ont-hisense-ltf7267-bha+.md b/ont-xgs/ont-hisense-ltf7267-bha+.md index 17ba706e..e770fd3c 100644 --- a/ont-xgs/ont-hisense-ltf7267-bha+.md +++ b/ont-xgs/ont-hisense-ltf7267-bha+.md @@ -455,7 +455,12 @@ CHAR CFG_ID_OMCC_VERSION = 0xB2; Reboot ONT to apply the change. +## Variants + +The LTF7267-BH+ is a variant of the LTF7267-BHA+ with the same Cortina CA8271A chipset. The information on this page applies to both models. + # Known Bugs - `ALCL` OLT mode uses some static configurations on MIBs, so if your OLT has strict configuration checks it might not work properly. - During initial tests the only currently working mode of the stick is `PPTP EthUni`. - Stick can be configured to also emulate `VEIP` mode (adding it to the scfg.txt file), but the current firmware doesn't link correctly the XGBE interface, so no traffic is passing between LAN and PON interfaces. +- On some SFP+ cages that do not support USXGMII, the kernel may log `Warning!!! port 6 isnt USXGMII and can't do AN` during activation. This can cause repeated ONU deactivation/reactivation cycles (`DEACTIVE_ONUID_REQ`). Ensure your host device's SFP+ cage supports 10GBase-R or USXGMII auto-negotiation. diff --git a/ont-xgs/ont-nokia-xs-010x-q.md b/ont-xgs/ont-nokia-xs-010x-q.md index 63904de5..f2ad0067 100644 --- a/ont-xgs/ont-nokia-xs-010x-q.md +++ b/ont-xgs/ont-nokia-xs-010x-q.md @@ -29,6 +29,13 @@ parent: Nokia | Form Factor | ONT | +## Accessing the Web GUI + +The ONT's web GUI is available at `192.168.100.1` on port 80. To access it, your device must be on the same subnet (`192.168.100.0/24`). If your router uses a different subnet (e.g. `10.0.0.0/20`), you have two options: + +- **Direct connection**: connect your PC directly to the ONT's Ethernet port and set a static IP address (e.g. `192.168.100.2`, netmask `255.255.255.0`) +- **Via router**: add a virtual IP in the `192.168.100.0/24` range to your router's WAN interface and create the appropriate routing/NAT rules + # External/Internal Photo diff --git a/ont/ont-zyxel-pmg3000-d20b.md b/ont/ont-zyxel-pmg3000-d20b.md index b4d01b5f..14a69e9c 100644 --- a/ont/ont-zyxel-pmg3000-d20b.md +++ b/ont/ont-zyxel-pmg3000-d20b.md @@ -208,6 +208,17 @@ The equipment id must be encoded in hex format and right padded to 39 characters # Advanced settings +## Setting root password via bootloader (V2.50 only) + +On firmware V2.50(ABVJ.1), the root password can be set via the bootloader environment variable `remote_account_pwd`: + +```sh +setenv remote_account_pwd thepassword +saveenv +``` + +After rebooting, the password set here can be used for root access. + ## Resetting Web GUI admin credentials Under certain circumstances, the Web GUI admin credentials might get changed from the default `admin`/`1234` combination. From a54fae77623b7544add22b11703dbaeac0970697 Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:31:08 +0200 Subject: [PATCH 05/10] Resolve issues #420, #471: TTL media converters, FS.com GalaChip SKU warning - Add 2.5G SFP media converters with built-in TTL pins to FiberEthernet page - Add warning about newer FS.com GPON-SFP-ONT-MAC-I SKUs (351553, 351565) using GalaChip GC1601 instead of Lantiq Co-Authored-By: Claude Opus 4.6 --- ont/ont-fs-com-gpon-onu-stick-with-mac.md | 4 ++++ sfp-cage/fiberethernet-media-converter-2.5.md | 9 +++++++++ 2 files changed, 13 insertions(+) diff --git a/ont/ont-fs-com-gpon-onu-stick-with-mac.md b/ont/ont-fs-com-gpon-onu-stick-with-mac.md index 63cb6ac7..9e6acceb 100644 --- a/ont/ont-fs-com-gpon-onu-stick-with-mac.md +++ b/ont/ont-fs-com-gpon-onu-stick-with-mac.md @@ -44,6 +44,10 @@ parent: FS.com The GPON-SFP-ONT-MAC-I is sold as multiple SKUs; the 133619 SKU is identical to the GPON-ONU-34-20BI, but other SKUs are not the same hardware. The 133619 SKU is now no longer sold. ::: +::: danger Warning +Newer FS.com GPON-SFP-ONT-MAC-I SKUs (e.g. 351553, 351565) use a **Faraday/Galachip GC1601** chipset instead of the Lantiq PEB98035. These are completely different hardware and the firmware, commands, and patches on this page do **not** apply to them. The GalaChip-based sticks use `gccli` commands instead of the Lantiq shell. +::: + ## Firmware is interchangeable with: - [Huawei MA5671A](/ont-huawei-ma5671a) diff --git a/sfp-cage/fiberethernet-media-converter-2.5.md b/sfp-cage/fiberethernet-media-converter-2.5.md index 5cd19446..8c85f3ac 100644 --- a/sfp-cage/fiberethernet-media-converter-2.5.md +++ b/sfp-cage/fiberethernet-media-converter-2.5.md @@ -22,4 +22,13 @@ has_children: false +## Variants with TTL serial pins + +Some 2.5G SFP media converters include built-in TTL serial pins, eliminating the need for a separate SFP-to-TTL adapter: + +- [2.5G SFP Media Converter with TTL pins (variant 1)](https://aliexpress.com/item/1005010123324704.html) +- [2.5G SFP Media Converter with TTL pins (variant 2)](https://aliexpress.com/item/1005010111907029.html) + +# Miscellaneous Links + - [2.5G Fiber Optic Media Converter Gigabit SFP Transceiver 1000Mbps Compatible With Common E/GPON](https://aliexpress.com/item/1005004340369253.html) From cd62d1f8f5f5ce88d4c83c230dd6c2a0724d955d Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:32:28 +0200 Subject: [PATCH 06/10] Replace Python CRC verification script with JavaScript on XS-010X-R page Co-Authored-By: Claude Opus 4.6 --- ont-xgs/ont-nokia-xs-010x-r.md | 37 ++++++++++++++++------------------ 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/ont-xgs/ont-nokia-xs-010x-r.md b/ont-xgs/ont-nokia-xs-010x-r.md index f9ddede5..8eb81c5f 100644 --- a/ont-xgs/ont-nokia-xs-010x-r.md +++ b/ont-xgs/ont-nokia-xs-010x-r.md @@ -88,26 +88,23 @@ The third 256 byte block (offsets 0x7800200 and 0x7900200) contains the user con The CRC algorithm is implemented in the `cig-misc.ko` kernel module (function `nvram_nand_eeprom_valid_check()`), which prints the correct length needed for the CRC calculation (236 bytes). -::: details Python script to verify the mfginfo CRC -```python -import struct - -def crc32_bzip2(data, poly=0x04C11DB7, init=0xFFFFFFFF, xorout=0xFFFFFFFF): - crc = init & 0xFFFFFFFF - for byte in data: - crc ^= (byte << 24) & 0xFFFFFFFF - for _ in range(8): - if crc & 0x80000000: - crc = ((crc << 1) ^ poly) & 0xFFFFFFFF - else: - crc = (crc << 1) & 0xFFFFFFFF - return crc ^ xorout - -# Read 256 bytes from mfginfo partition -# mfginfo_256 = open("mtd10.bin", "rb").read(256) -# crc_expected = struct.unpack("I", mfginfo_256[252:])[0] -# crc_calculated = crc32_bzip2(mfginfo_256[0:236]) -# print(f"Expected: {crc_expected:#010x} | Calculated: {crc_calculated:#010x} | Match: {crc_expected == crc_calculated}") +::: details JavaScript snippet to verify the mfginfo CRC +```js +function crc32Bzip2(data, poly = 0x04C11DB7, init = 0xFFFFFFFF, xorout = 0xFFFFFFFF) { + let crc = init >>> 0; + for (const byte of data) { + crc ^= (byte << 24) >>> 0; + for (let i = 0; i < 8; i++) { + crc = crc & 0x80000000 ? ((crc << 1) ^ poly) >>> 0 : (crc << 1) >>> 0; + } + } + return (crc ^ xorout) >>> 0; +} + +// const buf = new Uint8Array(await fetch("mtd10.bin").then(r => r.arrayBuffer())); +// const expected = new DataView(buf.buffer).getUint32(252, true); +// const calculated = crc32Bzip2(buf.slice(0, 236)); +// console.log(`Expected: 0x${expected.toString(16).padStart(8,"0")} | Calculated: 0x${calculated.toString(16).padStart(8,"0")} | Match: ${expected === calculated}`); ``` ::: From 0fb6d045fe779f4dd6af978b75c29284e55a379b Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:33:01 +0200 Subject: [PATCH 07/10] Add Technicolor alias and rebrand note to Vantiva page Co-Authored-By: Claude Opus 4.6 --- ont/ont-technicolor.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ont/ont-technicolor.md b/ont/ont-technicolor.md index 32cb65cb..600dddbf 100644 --- a/ont/ont-technicolor.md +++ b/ont/ont-technicolor.md @@ -1,4 +1,9 @@ --- title: Vantiva (formerly Technicolor) has_children: true +alias: Technicolor --- + +::: info Note +Technicolor has rebranded as Vantiva. The devices are the same; only the company name has changed. +::: From 0347f1fb6a28dd06c6eda971c96e923c819941db Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:33:48 +0200 Subject: [PATCH 08/10] Add 2022 date to Technicolor/Vantiva rebrand note Co-Authored-By: Claude Opus 4.6 --- ont/ont-technicolor.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ont/ont-technicolor.md b/ont/ont-technicolor.md index 600dddbf..37941cbb 100644 --- a/ont/ont-technicolor.md +++ b/ont/ont-technicolor.md @@ -5,5 +5,5 @@ alias: Technicolor --- ::: info Note -Technicolor has rebranded as Vantiva. The devices are the same; only the company name has changed. +Technicolor rebranded as Vantiva in 2022. The devices are the same; only the company name has changed. ::: From f35e72683ae05805506c4f04e9b67ac605568f88 Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:38:04 +0200 Subject: [PATCH 09/10] Add interactive CRC verifier, rename ODI to HSGQ (formerly ODI) - Replace static JS snippet with interactive CrcVerifier Vue component for mfginfo CRC verification on XS-010X-R page - Rename ODI parent page to "HSGQ (formerly ODI)" with alias ODI - Update parent references in all ODI child pages Co-Authored-By: Claude Opus 4.6 --- .vitepress/theme/components/CrcVerifier.vue | 138 ++++++++++++++++++++ .vitepress/theme/index.ts | 2 + ont-xgs/ont-nokia-xs-010x-r.md | 24 +--- ont/ont-odi-realtek-dfp-34g-2c2.md | 2 +- ont/ont-odi-realtek-dfp-34x-2c2.md | 2 +- ont/ont-odi-zte-dfp-34g-2c2.md | 2 +- ont/ont-odi-zte-dfp-34x-2c2.md | 2 +- ont/ont-odi.md | 4 +- 8 files changed, 151 insertions(+), 25 deletions(-) create mode 100644 .vitepress/theme/components/CrcVerifier.vue diff --git a/.vitepress/theme/components/CrcVerifier.vue b/.vitepress/theme/components/CrcVerifier.vue new file mode 100644 index 00000000..74eab023 --- /dev/null +++ b/.vitepress/theme/components/CrcVerifier.vue @@ -0,0 +1,138 @@ + + + + + diff --git a/.vitepress/theme/index.ts b/.vitepress/theme/index.ts index 36cada2e..6b8ee811 100644 --- a/.vitepress/theme/index.ts +++ b/.vitepress/theme/index.ts @@ -3,6 +3,7 @@ import DefaultTheme from 'vitepress/theme' import Layout from './Layout.vue' import AsciiHex from './components/AsciiHex.vue' import CigPassword from './components/CigPassword.vue' +import CrcVerifier from './components/CrcVerifier.vue' import CiteAs from './components/CiteAs.vue' import HisensePloam from './components/HisensePloam.vue' import ImageFigure from './components/ImageFigure.vue' @@ -20,6 +21,7 @@ export default { enhanceApp({ app, router }) { app.component('AsciiHex', AsciiHex) app.component('CigPassword', CigPassword) + app.component('CrcVerifier', CrcVerifier) app.component('CiteAs', CiteAs) app.component('HisensePloam', HisensePloam) app.component('ImageFigure', ImageFigure) diff --git a/ont-xgs/ont-nokia-xs-010x-r.md b/ont-xgs/ont-nokia-xs-010x-r.md index 8eb81c5f..d50ffcf4 100644 --- a/ont-xgs/ont-nokia-xs-010x-r.md +++ b/ont-xgs/ont-nokia-xs-010x-r.md @@ -88,25 +88,11 @@ The third 256 byte block (offsets 0x7800200 and 0x7900200) contains the user con The CRC algorithm is implemented in the `cig-misc.ko` kernel module (function `nvram_nand_eeprom_valid_check()`), which prints the correct length needed for the CRC calculation (236 bytes). -::: details JavaScript snippet to verify the mfginfo CRC -```js -function crc32Bzip2(data, poly = 0x04C11DB7, init = 0xFFFFFFFF, xorout = 0xFFFFFFFF) { - let crc = init >>> 0; - for (const byte of data) { - crc ^= (byte << 24) >>> 0; - for (let i = 0; i < 8; i++) { - crc = crc & 0x80000000 ? ((crc << 1) ^ poly) >>> 0 : (crc << 1) >>> 0; - } - } - return (crc ^ xorout) >>> 0; -} - -// const buf = new Uint8Array(await fetch("mtd10.bin").then(r => r.arrayBuffer())); -// const expected = new DataView(buf.buffer).getUint32(252, true); -// const calculated = crc32Bzip2(buf.slice(0, 236)); -// console.log(`Expected: 0x${expected.toString(16).padStart(8,"0")} | Calculated: 0x${calculated.toString(16).padStart(8,"0")} | Match: ${expected === calculated}`); -``` -::: +### Verify mfginfo CRC + +Upload your mfginfo partition dump (at least 256 bytes) to verify the CRC-32/BZIP2 checksum: + + diff --git a/ont/ont-odi-realtek-dfp-34g-2c2.md b/ont/ont-odi-realtek-dfp-34g-2c2.md index d8fbda0c..1a8e6b83 100644 --- a/ont/ont-odi-realtek-dfp-34g-2c2.md +++ b/ont/ont-odi-realtek-dfp-34g-2c2.md @@ -2,7 +2,7 @@ title: ODI Realtek DFP-34G-2C2 description: New model 2022 - v05 has_children: false -parent: ODI +parent: HSGQ (formerly ODI) --- # Hardware Specifications diff --git a/ont/ont-odi-realtek-dfp-34x-2c2.md b/ont/ont-odi-realtek-dfp-34x-2c2.md index 8fb6f5f7..5582cf1a 100644 --- a/ont/ont-odi-realtek-dfp-34x-2c2.md +++ b/ont/ont-odi-realtek-dfp-34x-2c2.md @@ -2,7 +2,7 @@ title: ODI Realtek DFP-34X-2C2 description: New model 2022 - v05 has_children: false -parent: ODI +parent: HSGQ (formerly ODI) --- # Hardware Specifications diff --git a/ont/ont-odi-zte-dfp-34g-2c2.md b/ont/ont-odi-zte-dfp-34g-2c2.md index ccfe4e25..afc39373 100644 --- a/ont/ont-odi-zte-dfp-34g-2c2.md +++ b/ont/ont-odi-zte-dfp-34g-2c2.md @@ -2,7 +2,7 @@ title: ODI ZTE DFP-34G-2C2 description: Old model 2020 - v04 has_children: false -parent: ODI +parent: HSGQ (formerly ODI) alias: Usourcetech UGP-N1S --- diff --git a/ont/ont-odi-zte-dfp-34x-2c2.md b/ont/ont-odi-zte-dfp-34x-2c2.md index cf26cacf..1620a88b 100644 --- a/ont/ont-odi-zte-dfp-34x-2c2.md +++ b/ont/ont-odi-zte-dfp-34x-2c2.md @@ -2,7 +2,7 @@ title: ODI ZTE DFP-34G-2C2 description: Old model 2020 - v04 has_children: false -parent: ODI +parent: HSGQ (formerly ODI) nav_exclude: true redirect_to: /ont-odi-zte-dfp-34g-2c2 --- diff --git a/ont/ont-odi.md b/ont/ont-odi.md index bcbf5191..926e5647 100644 --- a/ont/ont-odi.md +++ b/ont/ont-odi.md @@ -1,7 +1,7 @@ --- -title: ODI +title: HSGQ (formerly ODI) has_children: true -alias: HSGQ +alias: ODI --- ::: info Note From ab89544649154330904c898b36b81a2acc08c87c Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:39:34 +0200 Subject: [PATCH 10/10] Add E.C.I. Networks EN-XGSPP-OMAC V2 page (MaxLinear PRX126) Resolves #340: creates a dedicated page for the V2 stick which uses MaxLinear PRX126 chipset with its own web UI and CLI, distinct from the Cortina-based V1 that redirects to the FS.com XGS-ONU-25-20NI page. Co-Authored-By: Claude Opus 4.6 --- ont-xgs/ont-ECIN-EN-XGSFPP-OMAC-v2.md | 58 +++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 ont-xgs/ont-ECIN-EN-XGSFPP-OMAC-v2.md diff --git a/ont-xgs/ont-ECIN-EN-XGSFPP-OMAC-v2.md b/ont-xgs/ont-ECIN-EN-XGSFPP-OMAC-v2.md new file mode 100644 index 00000000..06eff132 --- /dev/null +++ b/ont-xgs/ont-ECIN-EN-XGSFPP-OMAC-v2.md @@ -0,0 +1,58 @@ +--- +title: E.C.I. Networks EN-XGSPP-OMAC V2 +has_children: false +parent: E.C.I. Networks +--- + +# Hardware Specifications + +| | | +| ---------------- | ---------------------------------------- | +| Vendor/Brand | E.C.I. Networks | +| Model | EN-XGSPP-OMAC-V2 | +| Chipset | MaxLinear PRX126 | +| Flash | | +| RAM | | +| System | Linux (PRX126 SDK) | +| SFP interfaces | 10GBASE-R | +| Optics | SC/APC | +| IP address | | +| Web Gui | ✅ | +| SSH | | +| Telnet | | +| Serial | | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | miniONT SFP+ | + +::: warning Note +This is the V2 version of the E.C.I. Networks stick, based on the MaxLinear PRX126 chipset. It is **not** the same hardware as the [V1](/xgs/ont-ECIN-EN-XGSFPP-OMAC-v1), which is a Cortina CA8271A-based stick identical to the [FS.com XGS-ONU-25-20NI](/xgs/ont-fs-XGS-ONU-25-20NI). The firmware, commands, and configuration procedures are completely different between V1 and V2. +::: + +The V2 has a web-based GUI for configuration, including PON status, LAN settings, and ONU authentication. It also supports a CLI interface. + +## Web GUI + +The web GUI provides pages for: +- Device information and PON state +- LAN settings +- ONU authentication (Serial Number, Registration ID/LOID) + +The web interface enforces a Registration ID field, which corresponds to the LOID. + +## VEIP support + +This stick supports VEIP (HGU) mode, but requires the [8311 community firmware](https://github.com/djGrrr/8311-was-110-firmware-builder) to function universally. + +## PLOAM debugging + +PLOAM messages can be captured from the Linux shell using the `pond` command: + +```sh +pond -v +``` + +# Miscellaneous Links + +- [E.C.I. Networks product page](https://ecin.ca/custom-xgs-pon-sfp-stick-module-xgspon-ont-w-t-mac-function-mounted-on-sfp-package/) +- [MaxLinear 10G PON Chipset Solution](https://maxlinear-assets.azureedge.net/web/documents/10g%20pon%20chipset%20solution%20flyer_006flr01.pdf)