Auteur Sujet: Mise en route LEOX LXT-010H-D  (Lu 74206 fois)

0 Membres et 1 Invité sur ce sujet

marcinkuczera

  • Abonné FAI autre
  • *
  • Messages: 68
  • Pologne
Mise en route LEOX LXT-010H-D
« Réponse #108 le: 16 septembre 2022 à 11:14:10 »
No really I-010G-Q : https://twitter.com/pierre80remy/status/1111563839957536769/photo/1
There is a huge size difference with the "more recent" Altice Labs (Lantiq PEB98021 with old SDK 7.4.4)

Ok, so it looks like I-010G-Q is quite old model I have not seen before.
What is chipset inside ?
As far as I have seen, ALU/Nokia uses Lantiq, MediaTek and Realtek chipsets in their 1 port SFU ONTs. Historically.
No it is RTL9601D only, or with RTL8221B to provide 2.5GBaseT interface.
And in fact, it is not ALU/Nokia a vendor of their SFU ONTs, different factories do it.

About Alice Labs - well, size is just a size. Maybe they just use common enclosure design. But with such large enclosure logistics is more expansive (both transport and storage, later on distribution).

Citer
Not sure, there is no difference between the LAN ports, and there is Wifi too.

please read TR-142
https://www.broadband-forum.org/technical/download/TR-142_Issue-1.pdf

This will help understanding difference between VEIP and EthernetUni.
And if it is broadcom, I would say - 95% it uses VEIP.

Citer
You look at products from other manufacturers  ;D
Sure I do. I have full storage of different boxes from different vendors.
It is necessary to override some interoperability issues.

marcinkuczera

  • Abonné FAI autre
  • *
  • Messages: 68
  • Pologne
Mise en route LEOX LXT-010H-D
« Réponse #109 le: 16 septembre 2022 à 11:23:31 »
here it is : https://justpaste.it/4vjql

Ok, it seems to be provisioned, vlan 101 and 102, however, other Entities than 0x5 look strange.
Btw, you can see how DSCP point codes are to be used to map point-code to pbit.

Please dump OMCI log:
flash set OMCI_LOGFILE 3
reboot

and after is it providioned by OLT:

cat /var/tmp/omcilog.par

Remember to restore this after this operation.
flash set OMCI_LOGFILE 0

Marcin

rooot

  • Abonné RED by SFR fibre FttH
  • *
  • Messages: 1 744
  • 🔵🔵🔵🔵⚪⚪⚪⚪🔴🔴🔴🔴
Mise en route LEOX LXT-010H-D
« Réponse #110 le: 16 septembre 2022 à 12:13:36 »
Ok, it seems to be provisioned, vlan 101 and 102, however, other Entities than 0x5 look strange.
Btw, you can see how DSCP point codes are to be used to map point-code to pbit.

Please dump OMCI log:
flash set OMCI_LOGFILE 3
reboot

and after is it providioned by OLT:

cat /var/tmp/omcilog.par

Remember to restore this after this operation.
flash set OMCI_LOGFILE 0

Marcin
Thanks ! i will do it asap, i hope the limited shell in which we are let me do this...

about the the chipset of the original SFR ONT, it is Lantiq

hwti

  • Abonné Orange Fibre
  • *
  • Messages: 2 237
  • Chambly (60)
Mise en route LEOX LXT-010H-D
« Réponse #111 le: 16 septembre 2022 à 12:24:09 »
Ok, so it looks like I-010G-Q is quite old model I have not seen before.
What is chipset inside ?
From https://lafibre.info/sfr-la-fibre/paris-17-photos-dune-installation-sfr-fibre-optique-gpon-sur-un-pm-orange/msg113618/#msg113618, it's a BroadLight BL2348 (very old).
There are also images from the web interface : https://lafibre.info/remplacer-sfr/captures-de-linterface-du-mini-ont-sfr/
Due to its small size for the time, this ONT was quite hot.

cat /var/tmp/omcilog.par
The V2802RH doesn't run Linux, so there is only the RTK shell, and probably no filesystem.
There is probably a way to get the OMCI log, I would have to search in the disassembly.

rooot

  • Abonné RED by SFR fibre FttH
  • *
  • Messages: 1 744
  • 🔵🔵🔵🔵⚪⚪⚪⚪🔴🔴🔴🔴
Mise en route LEOX LXT-010H-D
« Réponse #112 le: 16 septembre 2022 à 13:12:55 »
yes...
i receive an error message if i do : flash set OMCI_LOGFILE 3
but i can do cfgmib set OMCI_LOGFILE 3
but anyway i don't have the cat command so i don't know how to see the result

cyayon

  • Abonné Orange Fibre
  • *
  • Messages: 648
  • Cordon 74 - Orange Fibre Pro
Mise en route LEOX LXT-010H-D
« Réponse #113 le: 16 septembre 2022 à 16:53:05 »
Hello,

Je dois recevoir mon LEOX LXT-010H-D la semaine prochaine.

J'ai actuellement un ONT Huawei fournit par Orange. J'ai bien sûr relevé son serial et vendor.

N'ayant jamais fais la manip de remplacer mon ONT, j'ai quelques questions (de débutant) à ce sujet.

1. telnet sur l'ip192.168.1.1 login:leox password:leolabs_7
2. les 2 commandes que j'ai prévu d'executer sont :
     - flash set GPON_SN HWTC3XXXXXX
     - flash set PON_VENDOR_ID HWTC
3. dans certains cas, il semble qu'il faille passer la commande :
    - flash set HW_HWVER HWTCXXXX (dans mon cas HWTCA240FA)
    est-ce nécessaire ?

Je dois valider d'autres choses pour vérifier que tout fonctionne ?

Merci d'avance.

marcinkuczera

  • Abonné FAI autre
  • *
  • Messages: 68
  • Pologne
Mise en route LEOX LXT-010H-D
« Réponse #114 le: 16 septembre 2022 à 17:02:17 »
yes...
i receive an error message if i do : flash set OMCI_LOGFILE 3
but i can do cfgmib set OMCI_LOGFILE 3
but anyway i don't have the cat command so i don't know how to see the result

You are right about that it is different but look here:
https://elinux.org/OSK
The Angstrom distribution provides a replacement kernel and root file system for the OSK, based on the 2.6 kernel.

So it seems to be modified linux version.
Must be, as some modules used by realtek are deliverd as binaries (like for bosa driver).
There must be some real world under the hood ;)

hwti

  • Abonné Orange Fibre
  • *
  • Messages: 2 237
  • Chambly (60)
Mise en route LEOX LXT-010H-D
« Réponse #115 le: 16 septembre 2022 à 18:08:45 »
You are right about that it is different but look here:
https://elinux.org/OSK
The Angstrom distribution provides a replacement kernel and root file system for the OSK, based on the 2.6 kernel.

So it seems to be modified linux version.
Must be, as some modules used by realtek are deliverd as binaries (like for bosa driver).
There must be some real world under the hood ;)
I don't see the link with this, on this page "OSK" is for "OMAP Starter Kit".

Here it's probably something like "OS Kernel".
I didn't see anything in it which suggests it would be related to Linux, except a few leftover strings like .ko or .so names (but not enough).
The entry point is near the end of the whole image, and there is no rootfs.
Since it's a single binary, this would be a huge GPL violation (but they probably wouldn't care).

In uboot : "Booting kernel from OSK Image".

There are "OSK1FS" partitions for the settings.

In the image, there are strings showing specific "osk" support in the SDK :
 - "Diag shell for osk"
 - "rtkbosa for osk"
 - "oskFatal", "oskError", "oskRechedule"
 - "../../swbase/kernel/SWITCH/osksub.c"
 - "../../swbase/csp/rtl86900/sdk/src/app/diag_rtk/src/parser/cparser_io_osk.c"
 - "../../swbase/csp/rtl86900/sdk/src/app/omci_v1/omci_osk_main.c"
 - "../../swbase/application/feature/rg_func_osk.c"
 - various omci_osk_* function names
 - "/CN/cnsd5/trunk/adsl/branches/osk_multiwan"

The advantage over a Linux system would be the size, the V2802RH only has a 4MB SPI NOR (while other known RTL9601 devices have either 8MB or 16MB).
The image itself it about 2MB, and is 13MB once uncompressed.

marcinkuczera

  • Abonné FAI autre
  • *
  • Messages: 68
  • Pologne
Mise en route LEOX LXT-010H-D
« Réponse #116 le: 16 septembre 2022 à 23:05:11 »
I could see, there is some /proc reference in bootlog.
Besides, as mentioned - chipset responsible for BOSA is also realtek, code name - europa.
It requires kernel driver that comes as binary. (the only part I noticed for now).

It might be some modified linux-like system. Renaming of kernel - I guess it is possible.

And about one file - I have seen vendors using Ccmpressed ROM FS - first kernel, with rootfs at defined offset.

Do you have an upgrade image file for this device ?

rooot

  • Abonné RED by SFR fibre FttH
  • *
  • Messages: 1 744
  • 🔵🔵🔵🔵⚪⚪⚪⚪🔴🔴🔴🔴
Mise en route LEOX LXT-010H-D
« Réponse #117 le: 16 septembre 2022 à 23:10:04 »
Do you have an upgrade image file for this device ?
yes, look your messages

marcinkuczera

  • Abonné FAI autre
  • *
  • Messages: 68
  • Pologne
Mise en route LEOX LXT-010H-D
« Réponse #118 le: 18 septembre 2022 à 15:48:45 »
ok, thanks.
In general this file has some over 4k header, but even after removal it is not recognized.
binwalk is blind, so I'am guessing it is encrypted by some xxtea or something.

However, this must be some stripped linux as there is a lot of /proc references in bootlog, as well as references to filesystem.
And some OSK1FS filesystem type ?

Looks like some modified by vsol. All to make it harder for reversing.

And flash - it is 4MB as you mentioned, very small.

I will check tomorrow from bootloader level if it is possible to boot something in paralell and see what is there on flash.

hwti

  • Abonné Orange Fibre
  • *
  • Messages: 2 237
  • Chambly (60)
Mise en route LEOX LXT-010H-D
« Réponse #119 le: 18 septembre 2022 à 22:08:25 »
binwalk is blind, so I'am guessing it is encrypted by some xxtea or something.
See how I extracted it : https://lafibre.info/remplacer-bbox/onu-externe-2-5gbe/msg971591/#msg971591.
Binwalk doesn't recognize the lzma compression due to unusual parameters, but 7z and LZMA Utils (old package, lzmp tool on Ubuntu) are able to extract it.

I will check tomorrow from bootloader level if it is possible to boot something in paralell and see what is there on flash.
@Fluor dumped the flash contents with a SPI programmer.