====== V-SOL V2801Q ====== {{description>Informações sobre a V-SOL V2801Q XPON ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}} ===== Disclaimer ===== Todas as informações, métodos, procedimentos, firmwares, aplicativos e material sobre modificações e configurações postadas neste wiki foram criados pelo O3 Labs (salvo menção em contrário) e disponibilizadas **GRATUITAMENTE** desde o dia de sua elaboração. Denuncie quando possível quaisquer tentativas de venda destes material. ===== Hardware ===== {{:ont:vsol:vsol-v2801q-front.jpg?direct&400 |}} {{ :ont:vsol:vsol-v2801q-back.jpg?direct&400|}} ---- ^ SoC | Realtek RTL9601D | ^ RAM | 32 MB (embedded) | ^ Flash | 4 MB - ZB25VQ32BSIG - Zbit Semi 32 Mbit SPI NOR Flash | ^ LAN | 1 x 2,5 Gbit/s via RTL8221B | ^ USB | - | ^ Wireless 2.4 GHz| - | ^ Wireless 5 GHz| - | ^ Laser Driver/Transceiver | Semtech GN25L95 | ^ Acoplamento fibra | SC/UPC | ^ FXS | - | ^ HPNA | - | ^ Serial | Sim | ^ JTAG | - | ^ Alimentação | DC 12 V / 500 mA | ^ Credenciais padrão | user / user | ^ Credenciais padrão | admin / stdONUi0i | ^ IP LAN padrão | 192.168.1.1 | ==== GPON ==== ^ Tipo | SFU (Ethernet UNI: 1 \ VEIP: 0) ou HGU (Ethernet UNI: 1 \ VEIP: 1) | ^ Vendor ID | VSOL | ^ Version | V1.0 | ^ Equipment ID | VSOLV891 | ^ Product code | 0 | ^ OMCC Version | 128 (0x80) | ^ Software Version (Main, example) | V1.1.8 | ^ Software Version (Standby, example) | V1.1.8 | ===== Bootlog ===== ++++ Clique aqui para visualizar| 9601D PRELOADER Bismarck 3.5 II: PLR:573d, Build_date:23051716, Toolkit:rsdk-4.8.5-5281-EB-2.6.30-u0.9.33-m32utb-150924 II: Disable OCP Timeout Monitor II: Disable LX Timeout Monitor II: Enable Triple Synchronizer II:cg_cpu_clk_init doneII:cg_spif_clk_init doneII: CPU 300MHz (600/2/0), MEM 325MHz, LX 200MHz, SPIF 25MHz II: NOR SPI-F... 5E4016/MMIO16-1/ModeC done AK: DRAM AUTO CALIBRATION(20210202) AK: ZQ Calibration PassedAK: ZQ Calibration PassedAK: ZQ Calibration PassedAK: ZQ Calibration PassedAK: MR0: 0x00100952 AK: MR1: 0x00110040 AK: MR2: 0x00120000 AK: MR3: 0x00130000 AK: clear dwdqor AK: Bit/max_r_s/max_r_l/max_w_s/max_w_l Bit/max_r_s/max_r_l/max_w_s/max_w_l(Hex) [ 0] 0 1f 0 17 [16] 0 1f 0 17 [ 1] 0 1f 0 17 [17] 0 1f 0 17 [ 2] 0 1f 0 17 [18] 0 1f 0 15 [ 3] 0 1f 0 17 [19] 0 1f 0 15 [ 4] 0 1f 0 17 [20] 0 1f 0 17 [ 5] 0 1f 0 17 [21] 0 1f 0 17 [ 6] 0 1f 0 19 [22] 0 1f 0 17 [ 7] 0 1f 0 17 [23] 0 1f 0 17 [ 8] 0 1f 0 19 [24] 0 1f 0 19 [ 9] 0 1f 0 1b [25] 0 1f 0 1b [10] 0 1f 0 19 [26] 0 1f 0 19 [11] 0 1f 0 19 [27] 0 1f 0 19 [12] 0 1f 0 1b [28] 0 1f 0 19 [13] 0 1f 0 19 [29] 0 1f 0 19 [14] 0 1f 0 1b [30] 0 1f 0 1b [15] 0 1f 0 19 [31] 0 1f 0 19 AK: DQ enable delay sync with DQ delay tap. 0xb80015D0=0x07070707, 0xb80015D4=0x07080707, 0xb80015D8=0x08080908, 0xb80015DC=0x08090809 AK: DRAM size = 0x2000000 AK: Disable read after write function AK: Support tREFI divided by 4 AK: dram auto calibrtaion is done II: MEM_PROBE_OK II: MEM_XLAT_OK II: MEM_TO_REG_OK II: MEM_CAL_OK II: Change Stack from 0x9f007ff8 to 0x80efffe0 II: Decompressing U-Boot (0x80d80000 <- 0x9fc0f3a0)... (184 KB <- 69 KB) OK II: Starting U-boot... U-Boot 2011.12.NA-svn573 (May 17 2023 - 16:08:39) Board: RTL9601D, CPU:300MHz, LX:200MHx, MEM:325MHz, Type:DDR2 DRAM: 32 MB SPI-F: 5E4016/MMIO16-1/ModeC 1x4 MB (plr_flash_info @ 80dacbc0) Loading 8192B env. variables from offset 0x21000 Loading 8192B env. variables from offset 0x23000 Loaded 8192B env. variables from offset 0x23000 Error: Cannot find rootfs partition Net: LUNA GMAC Warning: eth device name has a space! Hit any key to stop autoboot: 0 swcore_init LUNA GMAC Warning: eth device name has a space! multicast_start Using LUNA GMAC device mcast upgrade timeout. ## Booting kernel from OSK Image at 9fc27000 ... Image Name: router. Created: Fri Dec 6 09:13:24 2024 Image Type: 0x05 Image Length: 0x22713c Page Size: 0x39c40 Load Address: 0x80000000 Entry Point: 0x80c02274 Verifying Checksum ... OK Uncompressing OSK image ... OK Starting kernel ... create memory pool: start at 0x80c05d98, size 4170344 spi_init(2100) c2/20 spi_init(2100) ef/30 spi_init(2100) 1/2 spi_init(2100) 1/20 spi_init(2100) 1c/31 spi_init(2100) 8c/20 spi_init(2100) 1f/46 spi_init(2100) bf/25 spi_init(2100) c8/40 spi_init(2100) ef/40 spi_init(2100) 1c/30 SPI flash: id 5e/40 not registered, using default api 8 wired tlb entry, 8 pages for pgt mib chain:ATM_VC_TBL descpritor's size don't match its recordSize, please check it! mib chain:DHCP_NORMAL_POOL descpritor's size don't match its recordSize, please check it! mib chain:DHCP_SERVING_POOL descpritor's size don't match its recordSize, please check it! mib chain:USERNAME_PASSWORD descpritor's size don't match its recordSize, please check it! mib chain:WIZARDTECH_USERNAME_PASSWORD descpritor's size don't match its recordSize, please check it! mib chain:STATIC_IP_ROUTE descpritor's size don't match its recordSize, please check it! mib chain:URL_STR descpritor's size don't match its recordSize, please check it! mib chain:KEYWORD_STR descpritor's size don't match its recordSize, please check it! mib chain:DOMAIN_STR descpritor's size don't match its recordSize, please check it! mib chain:NATRULE_INSRC descpritor's size don't match its recordSize, please check it! mib chain:NATRULE_INSRC_STATIC descpritor's size don't match its recordSize, please check it! mib chain:NATRULE_INSRC_FROM descpritor's size don't match its recordSize, please check it! mib chain:IP_ACL_STD_ENTRY descpritor's size don't match its recordSize, please check it! mib chain:IP_ACL_EXT_ENTRY descpritor's size don't match its recordSize, please check it! mib chain:QOS_RULE descpritor's size don't match its recordSize, please check it! mib chain:NAT_PRIORITY_RULES descpritor's size don't match its recordSize, please check it! mib chain:IPV6_STATIC_ROUTE descpritor's size don't match its recordSize, please check it! mib chain:RA_ENTRY descpritor's size don't match its recordSize, please check it! mib chain:RA_PREFIX descpritor's size don't match its recordSize, please check it! mib chain:RA_ULA_PREFIX descpritor's size don't match its recordSize, please check it! mib chain:IPV6_FILTER descpritor's size don't match its recordSize, please check it! mib chain:IPV6_ACL descpritor's size don't match its recordSize, please check it! mib chain:DHCPV6S_INTERFACE descpritor's size don't match its recordSize, please check it! mib chain:DHCPV6C_INTERFACE descpritor's size don't match its recordSize, please check it! mib chain:DHCPV6_UUID descpritor's size don't match its recordSize, please check it! mib chain:CWMP_DOWNLOAD_QUEUE descpritor's size don't match its recordSize, please check it! retrieve_settings:1012 flag 0 flash hw config addr:0xb4025000 size:8192 uncompress: preLen:1019, unPreLen:1997 retrieve_settings:1012 flag 3 flash sw extra default mib config addr:0xb43ae000 size:32768 sw extra default mib setting is empty! retrieve_settings:1012 flag 2 flash sw default config addr:0xb43bb000 size:32768 sw default setting is empty! retrieve_settings:1012 flag 0 flash sw config addr:0xb43f8000 size:32768 uncompress: preLen:9056, unPreLen:39784 system config initial finsihed. SE:33.SE:34.SE:35.SE:36.V1.1.8,lan_type:2 rtkbosa: Version 1.0 (Dec 6 2024 - 09:12:46) rtkbosa: Detecting RTL8290B ... rtkbosa: Error (0x10): The chip is not found rtkbosa: Detecting UX3320_Serise ... rtkbosa: Detecting Semtech Series (GN2xL9x) ... rtkbosa: Read 0x51.0x7B(0x00): 0x00 rtkbosa: Read 0x51.0x7C(0x00): 0x00 rtkbosa: Read 0x51.0x7D(0x00): 0x00 rtkbosa: Read 0x51.0x7E(0x00): 0x00 rtkbosa: Detecting Semtech Bosa ID ... rtkbosa: A2 Table ff: 0x80 = 0xab ; 0x85 = 0x4a ; 0x86 = 0x90 rtkbosa: A2 Table 2: 0xD1 = 0xa4 rtkbosa: SEMTECH GN25L95 is Found rtkbosa: A2 Table 2: 0xC0 = 0x02 rtkbosa: none EEPROM exists. Firmware version:V1.1.8,Build Date:Dec 6 2024 09:12:42 registerTask stackp=[0x5005d000-0x5000c000], size 331776, name=CFGTASK registerTask stackp=[0x500b2000-0x50061000], size 331776, name=CLITASK registerTask stackp=[0x50106000-0x500b6000], size 327680, name=GENTSK registerTask stackp=[0x5015a000-0x5010a000], size 327680, name=XTCPIP registerTask stackp=[0x501ae000-0x5015e000], size 327680, name=EWSTSK registerTask stackp=[0x50201000-0x501b2000], size 323584, name=FEATTASK registerTask stackp=[0x50253000-0x50205000], size 319488, name=PPPoE registerTask stackp=[0x502a5000-0x50257000], size 319488, name=ppp registerTask stackp=[0x502f7000-0x502a9000], size 319488, name=TFTP registerTask stackp=[0x50349000-0x502fb000], size 319488, name=DNS registerTask stackp=[0x5039c000-0x5034d000], size 323584, name=Telnet registerTask stackp=[0x503ee000-0x503a0000], size 319488, name=DHCP registerTask stackp=[0x50440000-0x503f2000], size 319488, name=NTP registerTask stackp=[0x50493000-0x50444000], size 323584, name=UPNP registerTask stackp=[0x504e7000-0x50497000], size 327680, name=CWMPSRV registerTask stackp=[0x50546000-0x504eb000], size 372736, name=CWMPCLT registerTask stackp=[0x5059a000-0x5054a000], size 327680, name=CWMPDL registerTask stackp=[0x505ee000-0x5059e000], size 327680, name=CWMPDLD registerTask stackp=[0x50641000-0x505f2000], size 323584, name=CWMPUE registerTask stackp=[0x508f7000-0x50645000], size 2826240, name=rtl8670 registerTask stackp=[0x50949000-0x508fb000], size 319488, name=dhcpv6d registerTask stackp=[0x5099b000-0x5094d000], size 319488, name=dhcpv6c registerTask stackp=[0x509ed000-0x5099f000], size 319488, name=work registerTask stackp=[0x50a42000-0x509f1000], size 331776, name=LBDTASK registerTask stackp=[0x50aa1000-0x50a46000], size 372736, name=OMCIAPP registerTask stackp=[0x50af5000-0x50aa5000], size 327680, name=OMCICLI registerTask stackp=[0x50b49000-0x50af9000], size 327680, name=FIRMWARE registerTask stackp=[0x50ba0000-0x50b4d000], size 339968, name=IDLETSK eraseUnusedFlash erase the flash sector 0xb43a0000 remain=0xe000 SE:928.SE:929.SE:930.SE:931.SE:932.SE:933.SE:934.SE:935.SE:936.SE:937.SE:938.SE:939.SE:940.SE:941. ~~~~bufsize = 2224,datapool->start = 0x80c501dc,datapool->end = 0x80c959dc~~~~ Calibrating delay loop... 299.82 BogoMIPS Init RTK Driver Module....OK registerTask stackp=[0x50bf3000-0x50ba4000], size 323584, name=INTBCST registerTask stackp=[0x50c46000-0x50bf7000], size 323584, name=INTBCST_1 ret=0x0 chipId = 0x96030002, rev=0x2 subType=0x6 RTL8686 GMAC Probing.. 8686 Ethernet driver v0.0.1 (Feb 17, 2012)[Dual Band Disable] TX[256,64,64,64,64] , RX[256,32,32,32,32,64] first entry: 0, portmask 127, rx: 800076b4 mld_snp_pool_init 1132 mld_snp_pool_init 1147 wanportmask=4,lanportmask=3 RTL8686 GMAC Probing Success!!! Init RTK liteRomeDriver....OK Init RTK RG fwdEngine....priority: 0, portmask 127, rx: 800076b4 insert here, priority: 1, portmask 127, rx: 80338bd9 OK Init RTK RG Driver....OK Port ifindex range Br 1 Wan 2-9 PPP 10-17 Switch 18-21 GIF 30-33 SE:35.SE:36.SE:33.SE:34.SE:33.SE:34.SE:35.SE:36.addV6FastpathEntryCache 717 i=64 max=64 count=64 init mac based tag des Turn on. ===============================CAUTION=============================== This functionality should configure BEFORE romeDriver initialization. Otherwise may cause unpredictable problem. Init RG with GPON mode. =============Init_rg_api SUCESS!!================== Init_rg_api 825: do system (echo 1 > /proc/rg/proc_to_pipe ) 0 to disable stag_enable rg echo 0 igmp_general_query_fromPon_direct_txRealtek TR-142 Module initialized. err = 0, max_ponq_id=65 [vs_product_init:1417] link up for port 3 link down for port 0 ####initial default route table! ####initial cwmp route table! ####initial local route table! ####inital 4 port mapping route tables! ####inital 5 port mapping tables! alloc 9k bytes for route table registerPacket hash=24 registerPacket hash=27 registerPacket hash=26 registerPacket hash=6 registerPacket hash=29 registerPacket hash=3 registerPacket hash=4 dnsInit:pRelayInfo=80da0884,pNsCCB=80da18a0 dns wait time is 2 secs TR111: try to clear all dhcpv6dmain start.............................. loopback: LoopEnable = 1 loopback: LoopExistPeriod = 5 loopback: LoopCancelPeriod = 300 loopback: EthernetType = 0xFFFA registerPacket hash=26 registerPacket hash=27 loopback: vid = untagged total 1 vlan values fffa lbd_rg_init-256 cmd:rg echo 0xfffa keep_ps_eth reset_loop_intf-723 veip, create proc failed! vgf, create proc failed! dmMode, create proc failed! l2, create proc failed! devmode, create proc failed! usage, create proc failed! wanInfo, create proc failed! macFilter, create proc failed! f2dq, create proc failed! uniQos, create proc failed! debugInfo, create proc failed! omciMirror, create proc failed! @platform_db_init(10342) macBasedTagDecision=[1], ivlMacast=[0], fwdVLAN_CPU=[1], fwdVLAN_CPU_SVLAN=[2] omci platform attached! register_gpon_evt_state: register gpon event state Successfully ! flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000 load default certificate files flashfile_init>got OSK1FS, size=8480, cksum=40177 flashfile_copy2ram>create new file(omci_mib.cfg), size=7922 flashfile_copy2ram>create new file(omci_custom_opt.conf), size=435 flashfile_copy2ram>create new file(omci_raw_data), size=0 loid pwd.....: 123456 link up for port 2 rtkbosa: Init GN25L95 ...Open file [rtl-25l95-backup.bin] flashfile_init(3146)>flag[2]! flashp=0xb43e3000 max_size=0x4000 load default certificate files flashfile_init>got OSK1FS, size=1056, cksum=52712 flashfile_copy2ram>create new file(rtl-25l95-backup.bin), size=1024 {Vs_lan_sds_monitor_thread:416} rtkbosa: (0) Dump A0 rtkbosa: 1b) Dump LUTs4 Data rtkbosa: 2b) Dump LUTs5 Data rtkbosa: 3b) Dump LUTs6 Data rtkbosa: 4b) Dump A2.table2 rtkbosa: (5) Dump all slope and offsets - A2_TABLE2 rtkbosa: (6) Dump all alarms and warnings levels A2-Lower rtkbosa: (7) Set PON_CONTROL rtkbosa: Read PON_CONTROL reg (A2T2.182): 04 rtkbosa: Write PON_CONTROL reg (A2T2.182): 04 rtkbosa: 7a) Dump A2.lower rtkbosa: (8) Enable all alarms and warnings rtkbosa: Read reg (A2T1.249): 00 rtkbosa: Write reg (A2T1.249): c0 rtkbosa: Read reg (A2T1.253): 00 rtkbosa: Write reg (A2T1.253): c0 rtkbosa: (9) Soft TX disable reset rtkbosa: Step 9) Soft TX reg (0): 80 rtkbosa: Set Soft TX reg (1): c0 rtkbosa: Set Soft TX reg (2): 80 rtkbosa: (10) Set Safe Mode Start Up rtkbosa: (11) Set up the password level rtkbosa: Init done ... init_rtsp_ssrc 39 nat entry's size is 148 bytes Nat Entry Maxinum: 4096 gNatCachePoolp=0x80aea424 gNatCachePoolp->qcnt=512 natRuleAdd 3093 flags=0x00000009 sip=0.0.0.0 eip=0.0.0.0 priority rule total 0 ! priority rule total 0 ! handleIGMPandMLD: isIGMPenable:1, isMLDenable:1 Both IGMP and MLD. Both IGMP and MLD snooping are enabled! setIpRouteStaticDetail iproute->itf=1 gateway=0x00000000 cmd=config cmd=ip access-list extended lan2local cmd=permit mark 242 acl_id = 4 listid = 4 PERMIT prot:ip s=0/0 d=0/0 acl_id = 3 acl_id = 2 acl_id = 1 cmd=permit udp any any eq 53 local enable cmd=permit udp any any eq 1900 local enable cmd=permit tcp any any eq 5431 local enable localServer[1].protocolName=tcp,localServer[1].port=80 cmd=deny tcp any any eq 80 local enable localServer[2].protocolName=tcp,localServer[2].port=23 cmd=deny tcp any any eq 23 local enable localServer[3].protocolName=tcp,localServer[3].port=22 cmd=deny tcp any any eq 22 local enable localServer[4].protocolName=udp,localServer[4].port=69 cmd=deny udp any any eq 69 local enable localServer[5].protocolName=udp,localServer[5].port=161 cmd=deny udp any any eq 161 local enable localServer[6].protocolName=icmp,localServer[6].port=0 cmd=deny icmp any any local enable localServer[7].protocolName=tcp,localServer[7].port=21 cmd=deny tcp any any eq 21 local enable localServer[8].protocolName=udp,localServer[8].port=520 cmd=deny udp any any eq 520 local enable cmd=exit cmd=exit cmd=config cmd= ip mark interface any tcp src 0.0.0.0 0.0.0.0 0 dst 0.0.0.0 0.0.0.0 7547 241 cwmp wan cmd=ip access-list extended wan2local cmd=permit mark 241 acl_id = 4 listid = 4 PERMIT prot:ip s=0/0 d=0/0 listid = 4 PERMIT prot:udp sport=0-0 eq dport=53-53 s=0/0 d=0/0 listid = 4 PERMIT prot:udp sport=0-0 eq dport=1900-1900 s=0/0 d=0/0 listid = 4 PERMIT prot:tcp(0) sport=0-0 eq dport=5431-5431 s=0/0 d=0/0 listid = 4 DENY prot:tcp(0) sport=0-0 eq dport=80-80 s=0/0 d=0/0 listid = 4 DENY prot:tcp(0) sport=0-0 eq dport=23-23 s=0/0 d=0/0 listid = 4 DENY prot:tcp(0) sport=0-0 eq dport=22-22 s=0/0 d=0/0 listid = 4 DENY prot:udp sport=0-0 eq dport=69-69 s=0/0 d=0/0 listid = 4 DENY prot:udp sport=0-0 eq dport=161-161 s=0/0 d=0/0 listid = 4 DENY prot:icmp type(255) code(255) s=0/0 d=0/0 listid = 4 DENY prot:tcp(0) sport=0-0 eq dport=21-21 s=0/0 d=0/0 listid = 4 DENY prot:udp sport=0-0 eq dport=520-520 s=0/0 d=0/0 acl_id = 3 acl_id = 2 listid = 2 PERMIT prot:ip s=0/0 d=0/0 acl_id = 1 cmd=exit cmd=exit cmd=cfg set WAN_ACL_DEFAULT_ACTION 1 flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created flash read - access list not created cfgSetIgmpProxyAnyItf isDisable=1 *******ipv6Init() Start******* *****Ipv6 Lib Version Is 8.0.0***** ipfw2 (+ipv6) initialized, divert loadable, nat loadable, rule-based forwarding disabled, default to accept, logging ####ipfw2 dynamic entry size: 92 bytes,pre malloc 64 entries disabled Enter SetupFWRule! do_firewall_cmd:command=flush Flushed all rules. do_firewall_cmd() execute successfully! do_firewall_cmd:command=add check-state do_firewall_cmd() execute successfully! do_firewall_cmd:command=add skipto 1000 icmp6 from any to any icmp6types 128,129 do_firewall_cmd() execute successfully! do_firewall_cmd:command=add allow icmp6 from any to me6 do_firewall_cmd() execute successfully! do_firewall_cmd:command=add 1000 skipto 5000 ip6 from any to me6 in via e1 do_firewall_cmd() execute successfully! do_firewall_cmd:command=add skipto 5000 ip6 from me6 to any out via e1 do_firewall_cmd() execute successfully! do_firewall_cmd:command=add skipto 10000 ip6 from any to me6 in via wan do_firewall_cmd() execute successfully! do_firewall_cmd:command=add skipto 10000 ip6 from me6 to any out via wan do_firewall_cmd() execute successfully! do_firewall_cmd:command=add skipto 15000 ip6 from any to any do_firewall_cmd() execute successfully! Enter SetupLanAclRule! do_firewall_cmd:command=set 1 flush Flushed all rules. do_firewall_cmd() execute successfully! do_firewall_cmd:command=add 9980 set 1 allow ip6 from any to any out keep-state do_firewall_cmd() execute successfully! do_firewall_cmd:command=add 9990 set 1 allow ip6 from any to any in keep-state do_firewall_cmd() execute successfully! Enter SetupWanAclRule! do_firewall_cmd:command=set 2 flush Flushed all rules. do_firewall_cmd() execute successfully! do_firewall_cmd:command=add 10010 set 2 allow icmp6 from any to any in keep-state icmp6types 128,129 do_firewall_cmd:command=add 14980 set 2 allow ip6 from any to any out keep-state do_firewall_cmd() execute successfully! do_firewall_cmd:command=add 14990 set 2 deny ip6 from any to any in do_firewall_cmd() execute successfully! Enter SetupWanAclRule! do_firewall_cmd:command=set 3 flush Flushed all rules. do_firewall_cmd() execute successfully! do_firewall_cmd:command=add 19980 set 3 allow ip6 from any to any out recv e1 xmit wan keep-state do_firewall_cmd() execute successfully! do_firewall_cmd:command=add 19990 set 3 allow ip6 from any to any out recv wan xmit e1 keep-state do_firewall_cmd() execute successfully! Restart IPv6 Filter! *******ipv6Init() End******* registerPacket hash=3 getCommonDivisorfromArray 1091 len=4 (40 30 20 10) getCommonDivisorfromArray 1102 g=10 wfqScale[0]=4 wfqScale[1]=3 wfqScale[2]=2 wfqScale[3]=1 Reset RG QoS total bandwidth to unlimit. setupIPQ 2554 Config RG QoS total bandwidth 0 Kbps RTK_RG_Sync_OMCI_WAN_INFO-1720 Can't find the wan interface idx:1!handleIGMPandMLD: isIGMPenable:1, isMLDenable:1 Both IGMP and MLD. Both IGMP and MLD snooping are enabled! registerPacket hash=1 captive portal redirect url string: registerPacket hash=18 registerPacket hash=21 registerPacket hash=29 registerPacket hash=17 Restart cwmp server! cwmpwanport=7547 pset:interface=,srcip=0.0.0.0,port=0> registerPacket hash=15 registerPacket hash=14 wanadsl_dhcpv6c_check ifindex=2 itfname=a0 $$$$$$$$$$$$$$$$$$$$$$$$$[Enable_all_lan,418]disable lan port! lanSdsSetLanStatusCommand set configData=0 flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000 eSet No Debug Message[1] Set Delay[30] <../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gDisplaypassword[1] <../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gDisplayNotificationPara[0] <../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gTr143DownloadExpress[1] <../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gTransferQueue[1] <../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gConfigTR098[1] <../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gWanAppType[1] flashfile_init(3146)>flag[0]! flashp=0xb43ec000 max_size=0x4000 load default certificate files flashfile_init>no flashfile connecting to (80af68d8) brgForwardInit handleIGMPandMLD: isIGMPenable:1, isMLDenable:1 Both IGMP and MLD. Both IGMP and MLD snooping are enabled! *******ipv6Init2() Start******* ipv6_IfInit:ifport=l0, adminStatus=0 Not Global or Unicast IPv6 address Not Global or Unicast IPv6 address ipv6_IfInit:ifport=e1, adminStatus=1 Not Global or Unicast IPv6 address getconfig:ifp=e1 gifConfigSet()! total=0 dsliteConfigSet()! g_prefix_filter=0 *******ipv6Init2() End******** nabcommand string: clear counter "clear" command: No change mode command string: help "help" command: No change mode command string: show command "show" command: No change mode command string: show web "show" command: No change mode command string: capture "capture" command: No change mode command string: dump "dump" command: No change mode le loopback deteccwmp_webserver_init() successful: master socket = 1 cwmp_server(434):cwmp is disable t telnetLoginCliType 0 telnetLoginCliDiag diagshell flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000 load moduleInitFunc uModule libtr142 is inited load moduleInitFunc uModule libvs_omciapi is inited load moduleOptInitFunc with Opt=3 uModule bdp_00000080 is inited load moduleInitFunc uModule me_00040000 is inited #### pf_rtl96xx_GetDevCapabilities() 8378 fePortNum=0, gePortNum=1, port0_type=2 port1_type=0 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr= #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=0 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=0 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=V1.1.8 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=1 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=V1.1.8 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr= < omci_setup_mgmt_interface 10232 > : vlanPara 65535 [libtr142] omci_cfg_set is called omci_PonResetOnuType.1671 excCode = 0x5 load/store un-alignment: bad code:do_ade(809) epc=0x802edc09 excCode = 0x5 excCode = 0x5 excCode = 0x5 excCode = 0x5 excCode = 0x5 Resetting MIB: me65305 Me65305 --> action no found flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000 omci_wrapper_msgHandler: devMode 1,receiveState 1,usrLogLvl 0, drvLogLvl 0,sn VSOL [libtr142] tid 131073 starts, op = 1 [libtr142] [libtr142] omci_op_set_if 0 is called. [get_wan_by_if_id(51)----debug] omci_configured = 0------------- [libtr142] if_is_ip_stack_B = 1,idx -1 [libtr142] if_tci = 65535 [libtr142] tid 131073 unlock flash logo config addr:0xb43cb000 size:98304 realtronLogoTable 813 rm inside logo! realtronLogoTable 869 register logo! flash login logo config addr:0xb43b6000 size:20480 realtronLoginLogoTable 907 rm login logo! realtronLoginLogoTable 941 login logo is empty! 4684 command string: disable "disable" command: No change mode command string: show mib "show" command: No change mode Username: rtl8226b: VERID = 0x6720 (MDIO set 0 , PHY Addr 7) lanSdsSetLanStatusCommand set configData=0 Lansds_Rtk_Mac0_Phy_8221b_Detect-1230 get lan global ipv6 address error! rtk_pon_led_SpecType_set 0 omci_PonResetVsMib.1364 omci_PonResetVsOntCode.166 omci_PonResetVsFirewallLevel.992 omci_PonResetVsLogin.1007 omci_PonResetVsAccessControl.1030 omci_LanBindModeReset.1068 omci_PonResetDhcpOption82Data.798 omci_PonResetDhcpCircuitId.811 omci_PonResetDhcpRemoteId.824 [omci_PonResetPriAuth(1298)] [omci_PonResetMacAcl1(1310)] [omci_PonResetMacAcl2(1322)] priority: 1, portmask 127, rx: 80338bd9 insert here, priority: 4, portmask 4, rx: 801519d9 rg echo 1 strange_packet_dropeuropacli get flash check_1453diag "debug gpio set pin 13 state enablecommand:debug gpio set pin 13 state enable set gpio 13 to enable! RTK.0> OMCI_Init 770!!!!!!!!!!!!!!!! up:chno=-1 port 1 is up rtl8226b: Timeout (dev=1f addr=0xa420 mask=0x03 timeout=0) get lan global ipv6 address error! RG_reset_static_route-1981 DONE ! [WARNING] type ACL_FWD_TYPE_DIR_INGRESS_ALL_PACKET for Egress Intf Index error! @ _rtk_rg_aclSWEntry_not_support(4341) _rtk_rg_apollo_aclFilterAndQos_add(4498): func_return=0x10007 expect_return=0x0, fail, so abort! [WARNING] type ACL_FWD_TYPE_DIR_INGRESS_ALL_PACKET for Egress Intf Index error! @ _rtk_rg_aclSWEntry_not_support(4341) [RG_add_default_Acl_Qos:3197]rtk_rg_aclFilterAndQos_add QoS rule failed! (ret = 65543) RG_del_PPPoE_Acl 2889: do system (echo 0 > /proc/rg/pppoe_bc_passthrought_to_bindingWan) RG Limit IPv6 MC! ethWanConfigInit:3129 pEntry=0x80c9c6c0 getCTReserveMACIndexFromIfindex:ifindex=2 entry.ifindex=2,4 getCTReserveMACIndexFromIfindex:find entry 1 setIfPortRfc ifindex=2,rfc=5 ethWanConfigInit:3129 pEntry=0x0 ethWanConfigInit:3129 pEntry=0x0 ethWanConfigInit:3129 pEntry=0x0 ethWanConfigInit:3129 pEntry=0x0 ethWanConfigInit:3129 pEntry=0x0 ethWanConfigInit:3129 pEntry=0x0 ethWanConfigInit:3129 pEntry=0x0 ethWanGroup[0]:ifindex 2,vid_flag 1,vlanid 20,enabled 1,wanmode 0 ethWanGroup[0].ethwantype=1,igmpenable=0 ethWanGroup[0].mac=4c:d7:c8:xx:xx:xx ethWanGroup[0]:fgrp 0 setCfgIntfNat 2069 itf=2 mdoe=2 setCfgIntfNat 2088 itf=2 mdoe=2 [startWan@1163] Enable MLD Proxy! Disable DMAC to CVID !! Disable dmac2cvid of wan portmask=0x4 [startConnection@444] pEntry->ifindex = 2, pEntry->cmode = 1 startConnection 453 1483 MER Adding RG DHCP info: rg_index=1 handleIGMPandMLD: isIGMPenable:1, isMLDenable:1 Both IGMP and MLD. Both IGMP and MLD snooping are enabled! [startWanServiceDependency@663] [Add_deny_vlan@8976]10 dmz rule total 0 ! #######ipCircCreate type=1 if_id=1 rcid=0 ipCircSetIPA id_pyhport=1 c->rc_id=1 phyport=1 xipCreateVif................... ipCircEnable 1194............... ####add 0xc0a80101/0xffffffff in route table 0x80d993cc! owner=5, cid=1 src=0xc0a80101 set network direct route, phyport=1 itf e1. ####add 0xc0a80100/0xffffff00 in route table 0x80d993cc! owner=6, cid=1 src=0xc0a80101 ipCircEnable 1194............... setCfgIntfNat 2069 itf=2 mdoe=2 setCfgIntfNat 2088 itf=2 mdoe=2 [webmain:1011] Change Hybrid Mode to HGU rtl8226b: Timeout (dev=1f addr=0xa420 mask=0x03 timeout=0) cmd=omcicli set devmode router cmd=omcicli mib reset priority: 1, portmask 127, rx: 80338bd9 insert here, priority: 4, portmask 4, rx: 801519d9 cmd=rg echo 0 stag_enable to disable stag_enable cmd=config service dhcp 2 config ip6 ra startE[libtr142] omci_cfg_set is called #### omci_sw_dl_uboot_env_get() 2539 pReturnStr= #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=0 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=0 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=V1.1.8 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=1 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr=V1.1.8 #### omci_sw_dl_uboot_env_get() 2539 pReturnStr= < omci_setup_mgmt_interface 10232 > : vlanPara 65535 [libtr142] omci_cfg_set is called omci_PonResetOnuType.1671 excCode = 0x5 excCode = 0x5 excCode = 0x5 excCode = 0x5 excCode = 0x5 excCode = 0x5 Resetting MIB: me65305 Me65305 --> action no found flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000 [libtr142] tid 262146 starts, op = 1 [libtr142] [libtr142] omci_op_set_if 0 is called. [get_wan_by_if_id(51)----debug] omci_configured = 0------------- [libtr142] if_is_ip_stack_B = 1,idx -1 [libtr142] if_tci = 65535 [libtr142] tid 262146 unlock [libtr142] tid 327683 starts, op = 1 [libtr142] [libtr142] omci_op_set_if 0 is called. [get_wan_by_if_id(51)----debug] omci_configured = 0------------- [libtr142] if_is_ip_stack_B = 1,idx -1 [libtr142] if_tci = 65535 [libtr142] tid 327683 unlock nable Router Advertisement Success! config ip6 dhcpv6 server startdhcp6 server on e1 is running rg echo 0 igmp_general_query_fromPon_direct_txReset RG QoS total bandwidth to unlimit. setupIPQ 2554 Config RG QoS total bandwidth 0 Kbps {vs_lansds_thread:726} rtl8226b: rtk_rtl8226b_moudle_init1 1328 rtl8226b: set 8226b set gpio to output mode rtl8226b: set 8226b set gpio to databit omci_PonResetVsMib.1364 omci_PonResetVsOntCode.166 omci_PonResetVsFirewallLevel.992 omci_PonResetVsLogin.1007 omci_PonResetVsAccessControl.1030 omci_LanBindModeReset.1068 omci_PonResetDhcpOption82Data.798 omci_PonResetDhcpCircuitId.811 omci_PonResetDhcpRemoteId.824 [omci_PonResetPriAuth(1298)] [omci_PonResetMacAcl1(1310)] [omci_PonResetMacAcl2(1322)] rtl8226b: Init Device 0 (mdio set: 0, phyad: 7) diag "port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-controlcommand:port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-control RTK.0> NULL exist for MIB_TABLE_MAP8021PSERVPROF_INDEX Entry,so up lan! Enable_all_lan_with1 465!!!!!!!!!!!!!!!! $$$$$$$$$$$$$$$$$$$$$$$$$enable lan port! lanSdsSetLanStatusCommand set configData=1 diag "port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-controlcommand:port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-control RTK.0> Enable_all_lan_with1 485!!!!!!!!!!!!!!!! link up for port 0 [Set_Route_for_StaticWan@3817] --------******start ending ****----- compress: unPreLen:39784, preLen:9056 start write config mib to flash addr:b43f8000, write size:9064 ... SE:1016.SE:1017.SE:1018.SE:1019.SE:1020.SE:1021.SE:1022.SE:1023.write backup config... start write config mib to flash addr:b43f0000, write size:9064 ... SE:1008.SE:1009.SE:1010.SE:1011.SE:1012.SE:1013.SE:1014.SE:1015.write mib to flash end ret=0x0 chipId = 0x96030002, rev=0x2 subType=0x6 rtl8226b: rtk_rtl8226b_moudle_init1 1328 rtl8226b: set 8226b set gpio to output mode rtl8226b: set 8226b set gpio to databit link up for port 0 [ASSERT_FAIL]'rtk_port_speedDuplex_get(port, &linkSpeed, &linkDuplex)=0xffffffff' @rtk_rg_apollo_portStatus_get:29071 rtl8226b: Init Device 0 (mdio set: 0, phyad: 7) diag "port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-controlcommand:port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-control RTK.0> link down for port 0 link up for port 0 InformIntevalCnt is set to 300(s) create memory pool: start at 0x80c02080, size 15640 Init memory freed, start:80c02080, len:15640 ++++ ===== Configurações ===== É de sua total responsabilidade o uso e implicações que utilizar equipamentos não fornecidos ou homologados pelo ISP podem causar. ===== Bugs, dicas e notas ===== * O aparelho tem hardware idêntico ao [[ont:vsol:v2802rh|V2802RH]] - exceto pela ausência da porta LAN de 1 Gbit/s -, portanto visite a página deste para mais detalhes e dicas; tudo deve ser aplicável, **exceto os firmwares**. * **As imagens de firmware do V2802RH não foram testadas neste aparelho, portanto não tente fazer flash de imagens de um modelo no outro (stock ou custom), sob risco de //brick//.** * Note que este é o **V2801Q**, já o **V2801SG** (não listado no Wiki) utiliza SoC ZTE, portanto incompatível com quaisquer informações listadas aqui. * Na versão original V1.1.8, o aparelho: * já suporta os MEs proprietários da Huawei e de outros fabricantes * suporta reportar versões de software com 14 caracteres, conforme especificação GPON (era um bug conhecido em versões antigas da V2802RH, onde só era aceito 10 caracteres) * contém o mesmo bug da V2802RH onde ao configurar as informações OMCI pela web, o parâmetro "OMCI_TM_OPT" (ou "Traffic Managament option" (sic)) é salvo com um valor inválido, sendo necessário defini-lo via telnet para corrigir. * Tabela de entidades gerenciadas OMCI suportadas pelo firmware V1.1.8: ++++ Mostrar lista| TableId [1] Name: OntData! TableId [2] Name: Cardholder! TableId [3] Name: CircuitPack! TableId [4] Name: SWImage! TableId [5] Name: EthUni! TableId [6] Name: EthPmHistoryData! TableId [7] Name: MacBriServProf! TableId [8] Name: MacBriPortCfgData! TableId [9] Name: MacBridgePortFilterTable! TableId [10] Name: MacBriPortBriTblData! TableId [12] Name: MacBridgePmMonitorHistoryData! TableId [11] Name: MacBridgePortPmMonitorHistoryData! TableId [13] Name: VlanTagOpCfgData! TableId [14] Name: MacBridgePortFilterPreassign! TableId [15] Name: LctUni! TableId [16] Name: VlanTagFilterData! TableId [17] Name: EthPmData2! TableId [18] Name: Map8021pServProf! TableId [19] Name: OltG! TableId [20] Name: IpHostCfgData! TableId [21] Name: TcpUdpCfgData! TableId [22] Name: NetworkAddress! TableId [23] Name: AuthSecMethod! TableId [24] Name: LargeString! TableId [25] Name: ExtVlanTagOperCfgData! TableId [26] Name: HW ME247! TableId [27] Name: ExtIpHostCfgData! TableId [28] Name: LoopDetect! TableId [29] Name: Ontg! TableId [30] Name: Ont2g! TableId [31] Name: Tcont! TableId [32] Name: Anig! TableId [33] Name: Unig! TableId [34] Name: GemIwTp! TableId [35] Name: GemPortPmhd! TableId [36] Name: GemPortCtp! TableId [37] Name: GalEthProf! TableId [38] Name: ThresholdData1! TableId [39] Name: ThresholdData2! TableId [40] Name: PriQ! TableId [41] Name: Scheduler! TableId [42] Name: TrafficDescriptor! TableId [43] Name: MultiGemIwTp! TableId [44] Name: Omci! TableId [45] Name: EthPmData3! TableId [46] Name: Dot1RateLimiter! TableId [47] Name: LargeString! TableId [48] Name: GeneralPurposeBuffer! TableId [49] Name: McastOperProf! TableId [50] Name: McastSubConfInfo! TableId [51] Name: McastSubMonitor! TableId [52] Name: FecPmhd! TableId [53] Name: EthPmDataDs! TableId [54] Name: EthPmDataUs! TableId [55] Name: VEIP! TableId [56] Name: GenericStatusPortal! TableId [57] Name: EnhancedSecCtl! TableId [58] Name: EthExtPmData! TableId [59] Name: TR069ManageServer! TableId [60] Name: GpncPmhd! TableId [61] Name: HW ME350! TableId [62] Name: VoipImage! TableId [63] Name: HW ME370! TableId [64] Name: HW ME373! TableId [65] Name: EthExtPmData64Bit! TableId [72] Name: ONTCode! TableId [73] Name: VsWanNumber! TableId [74] Name: VsWanCfgData! TableId [75] Name: VsWanCfgPppoe! TableId [76] Name: VsWanCfgPortBind! TableId [77] Name: VsWanCfgStaticIp! TableId [78] Name: LanBindMode! TableId [79] Name: VsWanCfgStaticIpV6! TableId [80] Name: VsWanCfgDhcpIpV6! TableId [81] Name: VsWanCfgDsLite! TableId [82] Name: VsWanCfg6RD! TableId [83] Name: VsWanCfgVlanMode! TableId [84] Name: VsTr069Config! TableId [85] Name: VsAcsServerData! TableId [86] Name: VsTr069ReverseConnectionData! TableId [87] Name: VsStunConf! TableId [88] Name: VsDhcpServer! TableId [89] Name: VsFactoryReset! TableId [90] Name: MacAgingTime! TableId [91] Name: MacLimitConfiguration! TableId [92] Name: VsPortIsolate! TableId [93] Name: VsLoopCheckConfig! TableId [94] Name: VsDhcpOption82! TableId [95] Name: VsCircuitIdFormat! TableId [96] Name: VsRemoteIdFormat! TableId [97] Name: VsDhcpServer1! TableId [98] Name: VsDhcpServer2! TableId [99] Name: VsLoginConfiguration! TableId [100] Name: VsFirewallLevel! TableId [101] Name: VsAccessControlConfig! TableId [102] Name: VsPriAuth! TableId [103] Name: VsPriCap1! TableId [104] Name: VsMacAcl1! TableId [105] Name: VsMacAcl2! TableId [69] Name: ZteMcastTag! TableId [106] Name: Me65305! TableId [107] Name: HW ME65320! TableId [110] Name: FH_WAN_PORFILE! TableId [111] Name: WAN_CONFIG! TableId [112] Name: WAN_PPPOE_CONFIG! TableId [113] Name: FH_WAN_PORT_BIND! TableId [114] Name: FH_WAN_IP_HOST_CONFIG! TableId [115] Name: FHTT_PON_SWITCHPORT! TableId [116] Name: FH_WAN_EXTEND_VLAN! TableId [117] Name: FHOmciMode! TableId [118] Name: OPTWanCfgData! TableId [119] Name: OPTWanDspData! TableId [66] Name: HW ExtendedOnuG! TableId [109] Name: HW ME65414! TableId [67] Name: HWPROPRIETARY! TableId [108] Name: HW ME65523! TableId [68] Name: CTCOnuOnuLoopDetection! TableId [70] Name: OnuCapability! TableId [71] Name: LoIdAuth! ++++ ===== Firmwares ===== ==== Stock ==== Versões oficiais e não modificadas para o aparelho. São de propriedade do fabricante - que detém todos os direitos sobre elas - e mantidas aqui apenas em caráter de arquivamento e espelhamento, podendo ser removidas caso solicitado pelos representantes oficiais da empresa. ==== Custom ==== Todas as versões custom são testadas localmente ao máximo possível, porém seu uso e possíveis implicações são de total responsabilidade do proprietário do aparelho. Não atualize o aparelho sem necessidade; só atualize o aparelho para as versões custom se confirmado que precise das alterações listadas. Os arquivos produzidos pelo O3 Labs são assinados para garantir sua integridade e procedência. Para instruções de como validar as assinaturas, [[about:signing|acesse aqui]]. Versões modificadas com correções e/ou melhorias, baseadas em //releases// oficiais/stock. As versões são cumulativas, ou seja, a mais recente sempre contém também todas as modificações das versões anteriores. É possível atualizar entre versões custom ou stock sem nenhum problema. Note que saltos na versão base podem incluir ou remover parâmetros de configuração, portanto é aconselhável um //factory reset// após realizar tais atualizações. Adicionalmente, efetue estes procedimentos com a fibra **desconectada** do aparelho. Caso a versão base continue a mesma de uma versão custom para a outra, não é necessário o //factory reset//, salvo se solicitado explicitamente na descrição. ===== Agradecimentos ===== Pessoas envolvidas em arquivos, discussões, dicas, doações ou bate papo em geral. Lista em ordem alfabética.