YuukiJapanTech / CA8271x

Hacking EN-XGSFPP-OMAC, XG-99S, LTF-7263-BH+LTF-7267-BH+
GNU General Public License v3.0
100 stars 5 forks source link

Adding default scfg of FS XGS-ONU-25-20NI #3

Closed helixzz closed 7 months ago

helixzz commented 8 months ago

I've bought a PON Stick from FS. Model: XGS-ONU-25-20NI. Tested with 10G SFP+ ports Huawei switches, the link didn't come up. Tested with Intel X722 adapters and works fine.

Let me upload some information gathered from its telnet later.

helixzz commented 8 months ago

default_scfg.txt

helixzz commented 8 months ago
#ONT/system/misc>eepinfo
EepMfgProductCode=1DP-00042-61
EepMfgProductSerial=082390256697
EepMfgHwVersion=01
EepMfgLaserSerial=HF3218800902Q
EepMfgMac1=fcb2d6b7d952
EepMfgMac2=fcb2d6b7d953
EepMfgEepver=0003
EepHwFunctionMajor=00d9
EepHwFunctionMinor=01
EepHwVersion=01
EepSwProvinceId=ffff
EepEqVendorID=GPON
EepEqSerialNumber=GPON23a00070
EepVDSL2SystemVendorID=        
EepVDSL2SerialNumber=        VDSLSerialNumberGPON23a00070
EepEqVersionID=XG-99S
EepEqID=XG-99S
EepSwBootImage=
EepSwIpAddr=192.168.100.1
EepSwIpMask=255.255.255.0
EepSwHostIpAddr=192.168.100.253
EepSwGWIpAddr=0.0.0.0
EepSwFtpUser=ont
EepSwFtpPass=ont
EepSwBootFlag=0002
EepSwBootParameter=00
EepSwActiveImage=01
EepSwCommitImage=01
EepSwImageCopy=00
EepAppGponPassword=00000000000000000000
EepHwDiagnosticCode=00000000000000000000000000000000
EepChecksum=0d63dc7d
SavePonPwdActive=0
SystemResetMode=0
helixzz commented 8 months ago
#ONT/system>ontver build
OntSwVer  : R4.4.20.022
Build Date: 2023-06-12 11:41:10
Major     : 0x00d9
Minor     : 0x01
HwVer     : 0x01
Customer  : CIG
PRODUCT Type = sfpplus
helixzz commented 8 months ago
#ONT>traffic/eth/show pack

build time Jun 12 2023: 03:36:56

-------------------- Line Pack -- PWR 0X0      --
Line Slot 10, NumOfPorts 1, type 49, subtype 75, state 2
-------------------- Configuration -------------------
port | enable | loop | Mode | RL Type | RL Us Rate| RL Ds Rate|
1   Yes No  Auto        0   0   0

-------------------- Status -------------------
1) link state: Up, link mode: 10G Full 

-------------------- Bridge Pack -------------------
Type:       75
State:      2
MAC Table:  0
MAC Aging:  0
MTU:        0
-------------------- Chip Data -------------------
eth Fd:     7
port Mask:  0x0018
type        28

********** DEBUG INFO **********
                 EmrLogId  : 5 
               EmrAdminEn  : 0 
              EmrbeInited  : 1 
              EmrDumpConn  : 0 
             EmrPwrShedEn  : 0x0 
           EmrConnItemNum  : 0 
         EmrUsDsReverseEn  : 1 
       EmrConnAllVidCheck  : 0 
      EmrMcastGemVlanOpEn  : 1 
       gEmrSaveConnItemEn  : 1 
      gEmrMcastCrossVlanEn : 1 
    EmrUniExtractPriMatch  : 1 
 EMR_DRV_PACK_DUMP_ITEM_EN : 0 
********************************
#ONT>
YuukiJapanTech commented 7 months ago

Added default_scfg and scfg of XGS-ONU-25-20NI.

What happens when I run "traffic/eth/show pack" from Stick's UART while connected to a Huawei switches?

Possibly the Huawei switches has refused to link up based on the SFP i2c EPROM vendor and module type information. If the EPROM is the cause, the EPROM needs to be rewritten to disguise it as a 10G-SR or similar, but unfortunately we do not yet know how to rewrite it.

helixzz commented 7 months ago

Added default_scfg and scfg of XGS-ONU-25-20NI.

What happens when I run "traffic/eth/show pack" from Stick's UART while connected to a Huawei switches?

Possibly the Huawei switches has refused to link up based on the SFP i2c EPROM vendor and module type information. If the EPROM is the cause, the EPROM needs to be rewritten to disguise it as a 10G-SR or similar, but unfortunately we do not yet know how to rewrite it.

Hi @YuukiJapanTech , I did more tests and found that the PON side fiber has to be plugged in for the PON stick shows link up on Huawei switches. The diagnose information is displayed correctly on the switch, however, there will be a 'Tx power too low' warning in the log buffer and the link status continously showing as DOWN.

This requirement is not happening on Intel X520-DA2/X520-SR2 NICs, but did happened on Huawei switches and Intel X710-DA4 NIC as well. Despite the tricky little problem, I think the PON module should be usable on Huawei switches.

FYI, I'm using Huawei S628X-PWR-E which was very likely a variant of S5720-28X-LI-PWR-AC.

Here's a console output for FS PON stick on Huawei switch that seems works correctly.

<redacted>dis transceiver int xg0/0/2 v

XGigabitEthernet0/0/2 transceiver information:
-------------------------------------------------------------
Common information:
  Transceiver Type               :10GBASE_LR_SFP
  Connector Type                 :SC
  Wavelength(nm)                 :1270
  Transfer Distance(m)           :20000(9um)
  Digital Diagnostic Monitoring  :YES
  Vendor Name                    :FS              
  Vendor Part Number             :XGS-ONU-25-20NI 
  Ordering Name                  :
-------------------------------------------------------------
Manufacture information:
  Manu. Serial Number            :G2340038701     
  Manufacturing Date             :2023-10-30
  Vendor Name                    :FS              
-------------------------------------------------------------
Diagnostic information:
  Temperature(¡⁩              :47.75
  Temp High Threshold(¡⁩      :100.00
  Temp Low  Threshold(¡⁩      :-40.00
  Voltage(V)                    :3.47
  Volt High Threshold(V)        :3.70
  Volt Low  Threshold(V)        :2.89
  Bias Current(mA)              :0.00
  Bias High Threshold(mA)       :95.00
  Bias Low  Threshold(mA)       :1.00     
  RX Power(dBM)                 :-28.54
  RX Power High Warning(dBM)    :-8.00
  RX Power Low  Warning(dBM)    :-29.21
  RX Power High Threshold(dBM)  :-7.00
  RX Power Low  Threshold(dBM)  :-30.00
  TX Power(dBM)                 :-40.00
  TX Power High Warning(dBM)    :8.10
  TX Power Low  Warning(dBM)    :4.00
  TX Power High Threshold(dBM)  :8.10
  TX Power Low  Threshold(dBM)  :3.00
-------------------------------------------------------------

BTW, I'm currently working on switching it to 10G EPON mode (instead of the factory default XGSPON mode). I think I've made a correct modification by setting CFG_ID_PON_MAC_MODE in /userdata/scfg.txt (as other directories are not writable), but sadly I haven't got any approach to check if the settings have been applied. The command shell seems didn't provide a status output containing PON mode.

The link state stucks at O1 (init) for now. I have no idea whether it's because the relatively low Rx power (I'm using a APC-UPC converter flange) or it's to blame with incorrect config.

YuukiJapanTech commented 7 months ago

I added it in the section "Switch Dependence". This is due to the fact that the LOS pin of SFP is High.

FS Stick cannot be changed to 10GE-PON only by changing CFG_ID_PON_MAC_MODE. (Stuck before OLT registration). Changing to 10GE-PON requires a firmware change. The current PON mode can be checked in dmesg or messages log.

I added these information as "Switch between XGS and 10GE".

Also, in EPON, the authentication status is checked in messages log.

[  318.507600] ca-mpcp: activate mpcp registration for llid_idx(00)
[  318.603310] ca-mpcp: ONU-REG, llid(14362)--llid_idx(00)--MAC(cc-cf-83-xx-xx-xx) was registered to OLT(xx-xx-xx-xx-xx-xx)
oam_llid_mac_get_adapt SCFG: MAC is 0xcc:0xcf:0x83:0xxx:0xxx:0xxx
oam_llid_mac_get_adapt: MAC is 0xcc:0xcf:0x83:0xxx:0xxx:0xxx
LED: PON register set 0
LED_RX_PWR_LEVEL_G_27
10G registered
helixzz commented 7 months ago

I added it in the section "Switch Dependence". This is due to the fact that the LOS pin of SFP is High.

FS Stick cannot be changed to 10GE-PON only by changing CFG_ID_PON_MAC_MODE. (Stuck before OLT registration). Changing to 10GE-PON requires a firmware change. The current PON mode can be checked in dmesg or messages log.

I added these information as "Switch between XGS and 10GE".

Also, in EPON, the authentication status is checked in messages log.

[  318.507600] ca-mpcp: activate mpcp registration for llid_idx(00)
[  318.603310] ca-mpcp: ONU-REG, llid(14362)--llid_idx(00)--MAC(cc-cf-83-xx-xx-xx) was registered to OLT(xx-xx-xx-xx-xx-xx)
oam_llid_mac_get_adapt SCFG: MAC is 0xcc:0xcf:0x83:0xxx:0xxx:0xxx
oam_llid_mac_get_adapt: MAC is 0xcc:0xcf:0x83:0xxx:0xxx:0xxx
LED: PON register set 0
LED_RX_PWR_LEVEL_G_27
10G registered

Thanks very much @YuukiJapanTech for the detailed information. Is there a way to flash the firmware in-band (e.g. without using JTAG-ish things)? I have a XE-99S PON Stick bought from Taobao (Seems it had a modified firmware with writable root partition and a "user-friendly configuration script" bundled. And it works well on 10G EPON broadband connections. It will be awesome to dump the firmware and flash into FS stick.

helixzz commented 7 months ago

I added it in the section "Switch Dependence". This is due to the fact that the LOS pin of SFP is High. FS Stick cannot be changed to 10GE-PON only by changing CFG_ID_PON_MAC_MODE. (Stuck before OLT registration). Changing to 10GE-PON requires a firmware change. The current PON mode can be checked in dmesg or messages log. I added these information as "Switch between XGS and 10GE". Also, in EPON, the authentication status is checked in messages log.

[  318.507600] ca-mpcp: activate mpcp registration for llid_idx(00)
[  318.603310] ca-mpcp: ONU-REG, llid(14362)--llid_idx(00)--MAC(cc-cf-83-xx-xx-xx) was registered to OLT(xx-xx-xx-xx-xx-xx)
oam_llid_mac_get_adapt SCFG: MAC is 0xcc:0xcf:0x83:0xxx:0xxx:0xxx
oam_llid_mac_get_adapt: MAC is 0xcc:0xcf:0x83:0xxx:0xxx:0xxx
LED: PON register set 0
LED_RX_PWR_LEVEL_G_27
10G registered

Thanks very much @YuukiJapanTech for the detailed information. Is there a way to flash the firmware in-band (e.g. without using JTAG-ish things)? I have a XE-99S PON Stick bought from Taobao (Seems it had a modified firmware with writable root partition and a "user-friendly configuration script" bundled. And it works well on 10G EPON broadband connections. It will be awesome to dump the firmware and flash into FS stick.

Oh. I've overlooked the updated document at https://github.com/YuukiJapanTech/CA8271x/tree/main/XG-XE_Switch. It seems very helpful.

helixzz commented 7 months ago

I added it in the section "Switch Dependence". This is due to the fact that the LOS pin of SFP is High. FS Stick cannot be changed to 10GE-PON only by changing CFG_ID_PON_MAC_MODE. (Stuck before OLT registration). Changing to 10GE-PON requires a firmware change. The current PON mode can be checked in dmesg or messages log. I added these information as "Switch between XGS and 10GE". Also, in EPON, the authentication status is checked in messages log.

[  318.507600] ca-mpcp: activate mpcp registration for llid_idx(00)
[  318.603310] ca-mpcp: ONU-REG, llid(14362)--llid_idx(00)--MAC(cc-cf-83-xx-xx-xx) was registered to OLT(xx-xx-xx-xx-xx-xx)
oam_llid_mac_get_adapt SCFG: MAC is 0xcc:0xcf:0x83:0xxx:0xxx:0xxx
oam_llid_mac_get_adapt: MAC is 0xcc:0xcf:0x83:0xxx:0xxx:0xxx
LED: PON register set 0
LED_RX_PWR_LEVEL_G_27
10G registered

Thanks very much @YuukiJapanTech for the detailed information. Is there a way to flash the firmware in-band (e.g. without using JTAG-ish things)? I have a XE-99S PON Stick bought from Taobao (Seems it had a modified firmware with writable root partition and a "user-friendly configuration script" bundled. And it works well on 10G EPON broadband connections. It will be awesome to dump the firmware and flash into FS stick.

Oh. I've overlooked the updated document at https://github.com/YuukiJapanTech/CA8271x/tree/main/XG-XE_Switch. It seems very helpful.

Tried switching FS stick to XE-99S firmware. Works like a charm!

YuukiJapanTech commented 7 months ago

XE-99S has overlayfs enabled, so the root partition can be rewritten. (Squashfs, so the actual changes are stored in userdata(overlay))

I'm glad that there doesn't seem to be any problem. Is it okay to close this issue? @helixzz

helixzz commented 7 months ago

XE-99S has overlayfs enabled, so the root partition can be rewritten. (Squashfs, so the actual changes are stored in userdata(overlay))

I'm glad that there doesn't seem to be any problem. Is it okay to close this issue? @helixzz

Yep. Thanks very much for your kind help.