Skip to content

Commit 6eb4cf7

Browse files
binguybinguy
committed
Added the BT-PON BT-G711AX ONT
1 parent 8a2401d commit 6eb4cf7

File tree

4 files changed

+279
-0
lines changed

4 files changed

+279
-0
lines changed

‎_ont/ont-bt-pon-bt-g711ax.md‎

Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
---
2+
title: BT-PON BT-G711AX
3+
has_children: false
4+
layout: default
5+
parent: BT-PON
6+
---
7+
8+
# Hardware Specifications
9+
10+
| | |
11+
| --------------- | -------------------------------------------------------------------------- |
12+
| Vendor/Brand | BT-PON |
13+
| Model | BT-G711AX |
14+
| Chipset | Realtek RTL9607Cv2 (Realtek RTL8198D is mentioned too in boot log???) |
15+
| Flash | SPI NAND 128MiB (Winbond W25N01GVZEIG) |
16+
| RAM | DDR3 256MiB |
17+
| CPU | Formosa MIPS interAptiv (multi) V2.0 |
18+
| CPU Clock | 1150MHz |
19+
| Wireless | RTL8192XBR 2x2 2.4Ghz (bgn+ax), RTL8832BR 2x2 5Ghz (an+ac+ax) |
20+
| Bootloader | U-Boot 2020.01 |
21+
| System | Linux 4.4.140 (Realtek MSDK-4.8.5p1 Build 3068) |
22+
| Load addr | 80010000 |
23+
| Ethernet ports | 4x1G |
24+
| POTS ports | 1xRJ11 (Si32192) |
25+
| Optics | SC/UPC (SEMTECH GN25L95) |
26+
| IP address | 192.168.1.1/24 |
27+
| Web Gui | ✅ user `admin`, password `YnQtcG9u` OR user `useradmin`, password `123456` |
28+
| SSH | NO |
29+
| Telnet | ✅ user `supertelnet`, password `supertelnet` |
30+
| FTP | ✅ port 21 |
31+
| Serial | ✅ |
32+
| Serial baud | 115200 |
33+
| Serial encoding | 8-N-1 |
34+
| Form Factor | ONT |
35+
36+
## Serial
37+
{% include image.html file="bt-g711ax-serial.jpg" alt="BT-G711AX" caption="BT-G711AX: serial pinout" %}
38+
You can easily communicate with the ONT using a TTL converter (for example the CH341A programmer in TTL mode) by connecting the converters’ pins to the ONT following the pinout shown in the image above.
39+
40+
Once everything is ok, any TTY client, such as PuTTY, can be used to open the connection with its baud rate set to 115200. At this point, the ONT can be turned on.
41+
42+
Press any key once you see `Hit any key to stop autoboot` (You only have 1 second to do this so be quick) after which you get access to bootloader console which looks like this:
43+
```sh
44+
Phoebus#
45+
```
46+
47+
## List of partitions
48+
`cat /proc/mtd`
49+
50+
| dev | size | erasesize | name |
51+
| ----- | -------- | --------- | ---------------- |
52+
| mtd0 | 000e0000 | 00020000 | "boot" |
53+
| mtd1 | 00020000 | 00020000 | "env" |
54+
| mtd2 | 00020000 | 00020000 | "env2" |
55+
| mtd3 | 00020000 | 00020000 | "static_conf" |
56+
| mtd4 | 07c40000 | 00020000 | "ubi_device" |
57+
| mtd5 | 00a89000 | 0001f000 | "ubi_Config" |
58+
| mtd6 | 00a0d000 | 0001f000 | "ubi_k0" |
59+
| mtd7 | 01911000 | 0001f000 | "ubi_r0" |
60+
| mtd8 | 00a0d000 | 0001f000 | "ubi_k1" |
61+
| mtd9 | 01911000 | 0001f000 | "ubi_r1" |
62+
63+
Only the first 4 partitions with erasesize 0x20000 should be manipulated using mtd devices, the fifth partition `ubi_device` contains the rest of the NAND and is to be manipulated using ubi volumes
64+
65+
## List of volumes (UBI)
66+
`ubinfo -a`
67+
68+
| dev | size | type | name |
69+
| ------ | --------- | ------- | ---------------- |
70+
| ubi0_0 | 11046912B | dynamic | "ubi_Config" |
71+
| ubi0_1 | 10539008B | dynamic | "ubi_k0" |
72+
| ubi0_2 | 26284032B | dynamic | "ubi_r0" |
73+
| ubi0_3 | 10539008B | dynamic | "ubi_k1" |
74+
| ubi0_4 | 26284032B | dynamic | "ubi_r1" |
75+
76+
To back up a volume, `cat` or `dd` the appropriate `/dev/ubi0_X` device to a file or pipe, to restore a volume, use the `ubiupdatevol` utility (or just do it safely via the WebGUI)
77+
78+
This ONT supports dual boot.
79+
80+
Volumes `ubi_k0` and `ubi_r0` respectively contain kernel and rootfs of the first image, while `ubi_k1` and `ubi_r1` contain kernel and rootfs of the second one.
81+
82+
# Useful files and binaries
83+
84+
## Useful files
85+
- `/var/config/config.xml` - Contains the user portion of the configuration
86+
- `/var/config/config_hs.xml` - Contains the "hardware" configuration (which _should not_ be changed)
87+
- `/tmp/omcilog` - OMCI messages logs (must be enabeled, see below)
88+
89+
## Useful binaries
90+
- `flash` - Used to manipulate the config files in a somewhat safe manner
91+
- `nv` - Used to manipulate nvram storage, including persistent config entries via `nv setenv`/`nv getenv`
92+
- `omcicli` - Used to interact with the running OMCI daemon
93+
- `omci_app` - The OMCI daemon
94+
- `diag` - Used to run low-level diagnostics commands on the stick
95+
96+
# Usage
97+
98+
## Enable telnet
99+
Telnet should be enabled by default but if that is not the case, you can enable it by editing configuration file you get in the Web UI. Go to `Admin -> Backup and Restore Settings -> Backup Settings to File` to get the config file in xml format and find `MIB_TELNET_ENABLE` and its value to 1. There is also `telnet` and `telnet_port` under `ACL_IP_TBL`, you should set these to 2 and 23 respectively.
100+
101+
{% include alert.html content="Curiously, there is also `ssh` and `ssh_port` in there but changing these doesn't do anything for enabling SSH, most likely due to lack of ssh capability of this ONT" alert="Info" icon="svg-info" color="blue" %}
102+
103+
After logining in using the credentials in the table above, use the `su` command to gain root access to the shell.
104+
```sh
105+
$ su
106+
#
107+
```
108+
109+
# GPON ONU status
110+
111+
## Getting the operational status of the ONU
112+
113+
```sh
114+
diag gpon get onu-state
115+
```
116+
117+
## Getting OLT vendor information
118+
```sh
119+
# omcicli mib get 131
120+
```
121+
122+
## Querying a particular OMCI ME
123+
```sh
124+
# omcicli mib get MIB_IDX
125+
```
126+
127+
# GPON/OMCI settings
128+
129+
## Getting/Setting ONU GPON Serial Number
130+
```sh
131+
# flash get GPON_SN
132+
GPON_SN=TMBB00000000
133+
# flash set GPON_SN TMBB0A1B2C3D
134+
```
135+
136+
## Getting/Setting ONU GPON PLOAM password
137+
{% include alert.html content="The PLOAM password is stored in ASCII format" alert="Info" icon="svg-info" color="blue" %}
138+
139+
```sh
140+
# flash get GPON_PLOAM_PASSWD
141+
GPON_PLOAM_PASSWD=AAAAAAAAAA
142+
# flash set GPON_PLOAM_PASSWD AAAAAAAAAA
143+
```
144+
145+
## Getting/Setting ONU GPON LOID and LOID password
146+
```sh
147+
# flash get LOID
148+
LOID=user
149+
# flash set LOID user
150+
# flash get LOID_PASSWD
151+
LOID_PASSWD=user
152+
# flash set LOID_PASSWD user
153+
```
154+
155+
## Getting/Setting OMCI software version (ME 7)
156+
```sh
157+
# flash get OMCI_SW_VER1
158+
OMCI_SW_VER1=YOURFIRSTSWVER
159+
# flash set OMCI_SW_VER1 YOURFIRSTSWVER
160+
# flash get OMCI_SW_VER2
161+
OMCI_SW_VER2=YOURSECONDSWVER
162+
# flash set OMCI_SW_VER2 YOURSECONDSWVER
163+
```
164+
165+
## Getting/Setting OMCI hardware version (ME 256)
166+
```sh
167+
# flash get HW_HWVER
168+
HW_HWVER=V2.0
169+
# flash set HW_HWVER MYHWVERSION
170+
```
171+
172+
## Getting/Setting OMCI vendor ID (ME 256)
173+
```sh
174+
# flash get PON_VENDOR_ID
175+
PON_VENDOR_ID=ZTEG
176+
# flash set PON_VENDOR_ID HWTC
177+
```
178+
179+
## Getting/Setting OMCI equipment ID (ME 257)
180+
```sh
181+
# flash get GPON_ONU_MODEL
182+
GPON_ONU_MODEL=DFP-34X-2C2
183+
# flash set GPON_ONU_MODEL DFP-34X-XXX
184+
```
185+
186+
## Getting/Setting OMCI OLT Mode and Fake OMCI
187+
188+
Configure how ONT Stick handle OMCI from OLT:
189+
190+
```sh
191+
# flash get OMCI_OLT_MODE
192+
OMCI_OLT_MODE=1
193+
# flash set OMCI_OLT_MODE 2
194+
```
195+
196+
| Value | Note | OMCI Information |
197+
| ----- | --------------- | ------------------------------------------------------------------------------------------------------ |
198+
| 0 | Default Mode | Stock setting, some values cannot be changed |
199+
| 1 | Huawei OLT Mode | Huawei MA5671a |
200+
| 2 | ZTE OLT Mode | ZTE |
201+
| 3 | Customized Mode | Custom Software/Hardware Version, OMCC, etc... |
202+
203+
Some vendors/wholesale providers/ISPs have explicit LAN Port Number provisioning or proprietary OMCI that the stick cannot understand, this will make the stick reply OK to whatever the OLT sends it via OMCI.
204+
205+
`0` = Disable, `1` = Enable, Default is 0
206+
207+
```sh
208+
# flash get OMCI_FAKE_OK
209+
OMCI_FAKE_OK=0
210+
# flash set OMCI_FAKE_OK 1
211+
```
212+
213+
# Advanced settings
214+
215+
## Transferring files to/from the router
216+
217+
This router has a capability of sharing files using ftp, tftp and netcat.
218+
219+
## Backing up all partitions
220+
221+
## Setting management MAC
222+
```sh
223+
# flash get ELAN_MAC_ADDR
224+
ELAN_MAC_ADDR=xxxxxxxxxxxx
225+
# flash set ELAN_MAC_ADDR xxxxxxxxxxxx
226+
```
227+
228+
## Setting management IP
229+
```sh
230+
# flash get LAN_IP_ADDR
231+
LAN_IP_ADDR=192.168.2.1
232+
# flash set LAN_IP_ADDR 192.168.1.1
233+
```
234+
235+
## Rebooting the ONU
236+
```sh
237+
reboot
238+
```
239+
240+
## Getting/Setting the MTU of the L2 bridge
241+
{% include alert.html content="Settings given via diag are not permanent after reboot" alert="Note" icon="svg-info" color="blue" %}
242+
243+
```sh
244+
# diag switch get max-pkt-len port all
245+
Port Speed
246+
----------
247+
0 1538
248+
2 2031
249+
# diag switch set max-pkt-len port all length 2000
250+
```
251+
252+
## Checking the currently active image
253+
```sh
254+
# nv getenv sw_active
255+
sw_active=1
256+
# nv getenv sw_version0
257+
sw_version0=V1_7_8_210412
258+
# nv getenv sw_version1
259+
sw_version1=V1_7_8_210412
260+
```
261+
262+
## Booting to a different image
263+
```sh
264+
# nv setenv sw_commit 0|1
265+
# reboot
266+
```
267+
# Random notes
268+
269+
270+
# Miscellaneous Links
271+
272+
- [Configuration Manual which explains the Web UI of this ONT](https://www.bt-pon.com/download/Configuration_Manual/BT-7xx_and_BT-3xx_series_xPON_ONU_Configuration_Manual.pdf)
273+
- [Datasheet] (https://www.bt-pon.com/download/Datasheet/BT-PON_BT-G711AX_XPON_ONU_ONT_Datasheet.pdf)
274+
275+
276+
# Theardown and other photos
277+
278+
{% include image.html file="bt-g711ax-teardown-1.jpg" alt="BT-PON BT-G711AX Board" caption="BT-PON BT-G711AX Board" %}
279+
{% include image.html file="bt-g711ax-teardown-2.jpg" alt="BT-PON BT-G711AX Board (bottom side)" caption="BT-PON BT-G711AX Board (bottom side)" %}

‎assets/img/bt-g711ax-serial.jpg.jpg‎

1.84 MB
Loading

‎assets/img/bt-g711ax-teardown-1.jpg.jpg‎

2.47 MB
Loading

‎assets/img/bt-g711ax-teardown-2.jpg.jpg‎

2.1 MB
Loading

0 commit comments

Comments
 (0)