V-SOL V2801Q

Informações sobre a V-SOL V2801Q XPON ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.

Disclaimer

Todas as informações, métodos, procedimentos, firmwares, aplicativos e material sobre modificações e configurações postadas neste wiki foram criados pelo O3 Labs (salvo menção em contrário) e disponibilizadas GRATUITAMENTE desde o dia de sua elaboração. Denuncie quando possível quaisquer tentativas de venda destes material.

Hardware

SoC	Realtek RTL9601D
RAM	32 MB (embedded)
Flash	4 MB - ZB25VQ32BSIG - Zbit Semi 32 Mbit SPI NOR Flash
LAN	1 x 2,5 Gbit/s via RTL8221B
USB	-
Wireless 2.4 GHz	-
Wireless 5 GHz	-
Laser Driver/Transceiver	Semtech GN25L95
Acoplamento fibra	SC/UPC
FXS	-
HPNA	-
Serial	Sim
JTAG	-
Alimentação	DC 12 V / 500 mA
Credenciais padrão	user / user
Credenciais padrão	admin / stdONUi0i
IP LAN padrão	192.168.1.1

GPON

Tipo	SFU (Ethernet UNI: 1 \ VEIP: 0) ou HGU (Ethernet UNI: 0 \ VEIP: 1)
Vendor ID	VSOL
Version	V1.0
Equipment ID	VSOLV891
Product code	0
OMCC Version	128 (0x80)
Software Version (Main, example)	V1.1.8
Software Version (Standby, example)	V1.1.8

Bootlog

Clique aqui para visualizar

9601D
PRELOADER Bismarck 3.5
II: PLR:573d, Build_date:23051716, Toolkit:rsdk-4.8.5-5281-EB-2.6.30-u0.9.33-m32utb-150924
II: Disable OCP Timeout Monitor
II: Disable LX Timeout Monitor
II: Enable Triple Synchronizer
II:cg_cpu_clk_init doneII:cg_spif_clk_init doneII: CPU 300MHz (600/2/0), MEM 325MHz, LX 200MHz, SPIF 25MHz
II: NOR SPI-F... 5E4016/MMIO16-1/ModeC done
AK: DRAM AUTO CALIBRATION(20210202)
AK: ZQ Calibration PassedAK: ZQ Calibration PassedAK: ZQ Calibration PassedAK: ZQ Calibration PassedAK: MR0: 0x00100952
AK: MR1: 0x00110040
AK: MR2: 0x00120000
AK: MR3: 0x00130000
AK: clear dwdqor
AK: Bit/max_r_s/max_r_l/max_w_s/max_w_l    Bit/max_r_s/max_r_l/max_w_s/max_w_l(Hex)
   [ 0]       0      1f       0      17   [16]       0      1f       0      17
   [ 1]       0      1f       0      17   [17]       0      1f       0      17
   [ 2]       0      1f       0      17   [18]       0      1f       0      15
   [ 3]       0      1f       0      17   [19]       0      1f       0      15
   [ 4]       0      1f       0      17   [20]       0      1f       0      17
   [ 5]       0      1f       0      17   [21]       0      1f       0      17
   [ 6]       0      1f       0      19   [22]       0      1f       0      17
   [ 7]       0      1f       0      17   [23]       0      1f       0      17
   [ 8]       0      1f       0      19   [24]       0      1f       0      19
   [ 9]       0      1f       0      1b   [25]       0      1f       0      1b
   [10]       0      1f       0      19   [26]       0      1f       0      19
   [11]       0      1f       0      19   [27]       0      1f       0      19
   [12]       0      1f       0      1b   [28]       0      1f       0      19
   [13]       0      1f       0      19   [29]       0      1f       0      19
   [14]       0      1f       0      1b   [30]       0      1f       0      1b
   [15]       0      1f       0      19   [31]       0      1f       0      19
AK: DQ enable delay sync with DQ delay tap.
    0xb80015D0=0x07070707, 0xb80015D4=0x07080707, 0xb80015D8=0x08080908, 0xb80015DC=0x08090809
AK: DRAM size = 0x2000000
AK: Disable read after write function
AK: Support tREFI divided by 4
AK: dram auto calibrtaion is done
II: MEM_PROBE_OK
II: MEM_XLAT_OK
II: MEM_TO_REG_OK
II: MEM_CAL_OK
II: Change Stack from 0x9f007ff8 to 0x80efffe0
II: Decompressing U-Boot (0x80d80000 <- 0x9fc0f3a0)... (184 KB <- 69 KB) OK
II: Starting U-boot...


U-Boot 2011.12.NA-svn573 (May 17 2023 - 16:08:39)

Board: RTL9601D, CPU:300MHz, LX:200MHx, MEM:325MHz, Type:DDR2
DRAM: 32 MB
SPI-F: 5E4016/MMIO16-1/ModeC 1x4 MB (plr_flash_info @ 80dacbc0)
Loading 8192B env. variables from offset 0x21000
Loading 8192B env. variables from offset 0x23000
Loaded 8192B env. variables from offset 0x23000
Error: Cannot find rootfs partition
Net:   LUNA GMAC
Warning: eth device name has a space!

Hit any key to stop autoboot:  0
swcore_init
LUNA GMAC
Warning: eth device name has a space!

multicast_start Using LUNA GMAC  device
mcast upgrade timeout.
## Booting kernel from OSK Image at 9fc27000 ...
   Image Name:   router.
   Created:      Fri Dec  6 09:13:24 2024
   Image Type:   0x05
   Image Length: 0x22713c
   Page Size:    0x39c40
   Load Address: 0x80000000
   Entry Point:  0x80c02274
   Verifying Checksum ... OK
   Uncompressing OSK image ... OK
Starting kernel ...

create memory pool: start at 0x80c05d98, size 4170344
spi_init(2100) c2/20
spi_init(2100) ef/30
spi_init(2100) 1/2
spi_init(2100) 1/20
spi_init(2100) 1c/31
spi_init(2100) 8c/20
spi_init(2100) 1f/46
spi_init(2100) bf/25
spi_init(2100) c8/40
spi_init(2100) ef/40
spi_init(2100) 1c/30
SPI flash: id 5e/40 not registered, using default api
8 wired tlb entry, 8 pages for pgt
 mib chain:ATM_VC_TBL descpritor's size don't match its recordSize, please check it!
 mib chain:DHCP_NORMAL_POOL descpritor's size don't match its recordSize, please check it!
 mib chain:DHCP_SERVING_POOL descpritor's size don't match its recordSize, please check it!
 mib chain:USERNAME_PASSWORD descpritor's size don't match its recordSize, please check it!
 mib chain:WIZARDTECH_USERNAME_PASSWORD descpritor's size don't match its recordSize, please check it!
 mib chain:STATIC_IP_ROUTE descpritor's size don't match its recordSize, please check it!
 mib chain:URL_STR descpritor's size don't match its recordSize, please check it!
 mib chain:KEYWORD_STR descpritor's size don't match its recordSize, please check it!
 mib chain:DOMAIN_STR descpritor's size don't match its recordSize, please check it!
 mib chain:NATRULE_INSRC descpritor's size don't match its recordSize, please check it!
 mib chain:NATRULE_INSRC_STATIC descpritor's size don't match its recordSize, please check it!
 mib chain:NATRULE_INSRC_FROM descpritor's size don't match its recordSize, please check it!
 mib chain:IP_ACL_STD_ENTRY descpritor's size don't match its recordSize, please check it!
 mib chain:IP_ACL_EXT_ENTRY descpritor's size don't match its recordSize, please check it!
 mib chain:QOS_RULE descpritor's size don't match its recordSize, please check it!
 mib chain:NAT_PRIORITY_RULES descpritor's size don't match its recordSize, please check it!
 mib chain:IPV6_STATIC_ROUTE descpritor's size don't match its recordSize, please check it!
 mib chain:RA_ENTRY descpritor's size don't match its recordSize, please check it!
 mib chain:RA_PREFIX descpritor's size don't match its recordSize, please check it!
 mib chain:RA_ULA_PREFIX descpritor's size don't match its recordSize, please check it!
 mib chain:IPV6_FILTER descpritor's size don't match its recordSize, please check it!
 mib chain:IPV6_ACL descpritor's size don't match its recordSize, please check it!
 mib chain:DHCPV6S_INTERFACE descpritor's size don't match its recordSize, please check it!
 mib chain:DHCPV6C_INTERFACE descpritor's size don't match its recordSize, please check it!
 mib chain:DHCPV6_UUID descpritor's size don't match its recordSize, please check it!
 mib chain:CWMP_DOWNLOAD_QUEUE descpritor's size don't match its recordSize, please check it!
retrieve_settings:1012 flag 0
flash hw  config addr:0xb4025000 size:8192
uncompress: preLen:1019, unPreLen:1997
retrieve_settings:1012 flag 3
flash sw extra default mib config addr:0xb43ae000 size:32768
sw extra default mib setting is empty!
retrieve_settings:1012 flag 2
flash sw default config addr:0xb43bb000 size:32768
sw default setting is empty!
retrieve_settings:1012 flag 0
flash sw  config addr:0xb43f8000 size:32768
uncompress: preLen:9056, unPreLen:39784
system config initial finsihed.
SE:33.SE:34.SE:35.SE:36.V1.1.8,lan_type:2
rtkbosa: Version 1.0 (Dec  6 2024 - 09:12:46)
rtkbosa: Detecting RTL8290B ...
rtkbosa: Error (0x10): The chip is not found
rtkbosa: Detecting UX3320_Serise ...
rtkbosa: Detecting Semtech Series (GN2xL9x) ...
rtkbosa: Read 0x51.0x7B(0x00): 0x00
rtkbosa: Read 0x51.0x7C(0x00): 0x00
rtkbosa: Read 0x51.0x7D(0x00): 0x00
rtkbosa: Read 0x51.0x7E(0x00): 0x00
rtkbosa: Detecting Semtech Bosa ID ...
rtkbosa: A2 Table ff: 0x80 = 0xab ; 0x85 = 0x4a ; 0x86 = 0x90
rtkbosa: A2 Table 2: 0xD1 = 0xa4
rtkbosa: SEMTECH GN25L95 is Found
rtkbosa: A2 Table 2: 0xC0 = 0x02
rtkbosa: none EEPROM exists.
Firmware version:V1.1.8,Build Date:Dec  6 2024 09:12:42
registerTask stackp=[0x5005d000-0x5000c000], size 331776, name=CFGTASK
registerTask stackp=[0x500b2000-0x50061000], size 331776, name=CLITASK
registerTask stackp=[0x50106000-0x500b6000], size 327680, name=GENTSK
registerTask stackp=[0x5015a000-0x5010a000], size 327680, name=XTCPIP
registerTask stackp=[0x501ae000-0x5015e000], size 327680, name=EWSTSK
registerTask stackp=[0x50201000-0x501b2000], size 323584, name=FEATTASK
registerTask stackp=[0x50253000-0x50205000], size 319488, name=PPPoE
registerTask stackp=[0x502a5000-0x50257000], size 319488, name=ppp
registerTask stackp=[0x502f7000-0x502a9000], size 319488, name=TFTP
registerTask stackp=[0x50349000-0x502fb000], size 319488, name=DNS
registerTask stackp=[0x5039c000-0x5034d000], size 323584, name=Telnet
registerTask stackp=[0x503ee000-0x503a0000], size 319488, name=DHCP
registerTask stackp=[0x50440000-0x503f2000], size 319488, name=NTP
registerTask stackp=[0x50493000-0x50444000], size 323584, name=UPNP
registerTask stackp=[0x504e7000-0x50497000], size 327680, name=CWMPSRV
registerTask stackp=[0x50546000-0x504eb000], size 372736, name=CWMPCLT
registerTask stackp=[0x5059a000-0x5054a000], size 327680, name=CWMPDL
registerTask stackp=[0x505ee000-0x5059e000], size 327680, name=CWMPDLD
registerTask stackp=[0x50641000-0x505f2000], size 323584, name=CWMPUE
registerTask stackp=[0x508f7000-0x50645000], size 2826240, name=rtl8670
registerTask stackp=[0x50949000-0x508fb000], size 319488, name=dhcpv6d
registerTask stackp=[0x5099b000-0x5094d000], size 319488, name=dhcpv6c
registerTask stackp=[0x509ed000-0x5099f000], size 319488, name=work
registerTask stackp=[0x50a42000-0x509f1000], size 331776, name=LBDTASK
registerTask stackp=[0x50aa1000-0x50a46000], size 372736, name=OMCIAPP
registerTask stackp=[0x50af5000-0x50aa5000], size 327680, name=OMCICLI
registerTask stackp=[0x50b49000-0x50af9000], size 327680, name=FIRMWARE
registerTask stackp=[0x50ba0000-0x50b4d000], size 339968, name=IDLETSK
eraseUnusedFlash erase the flash sector 0xb43a0000 remain=0xe000
SE:928.SE:929.SE:930.SE:931.SE:932.SE:933.SE:934.SE:935.SE:936.SE:937.SE:938.SE:939.SE:940.SE:941.
~~~~bufsize = 2224,datapool->start = 0x80c501dc,datapool->end = 0x80c959dc~~~~
Calibrating delay loop... 299.82 BogoMIPS
Init RTK Driver Module....OK
registerTask stackp=[0x50bf3000-0x50ba4000], size 323584, name=INTBCST
registerTask stackp=[0x50c46000-0x50bf7000], size 323584, name=INTBCST_1
ret=0x0 chipId = 0x96030002, rev=0x2 subType=0x6
RTL8686 GMAC Probing..
8686 Ethernet driver v0.0.1 (Feb 17, 2012)[Dual Band Disable]
TX[256,64,64,64,64] , RX[256,32,32,32,32,64]
first entry: 0, portmask 127, rx: 800076b4
mld_snp_pool_init 1132
mld_snp_pool_init 1147
wanportmask=4,lanportmask=3
RTL8686 GMAC Probing Success!!!
Init RTK liteRomeDriver....OK
Init RTK RG fwdEngine....priority: 0, portmask 127, rx: 800076b4
insert here, priority: 1, portmask 127, rx: 80338bd9
OK
Init RTK RG Driver....OK

Port		ifindex range
Br		1
Wan		2-9
PPP		10-17
Switch		18-21
GIF		30-33
SE:35.SE:36.SE:33.SE:34.SE:33.SE:34.SE:35.SE:36.addV6FastpathEntryCache 717 i=64 max=64 count=64
init mac based tag des
Turn on.
===============================CAUTION===============================
This functionality should configure BEFORE romeDriver initialization.
Otherwise may cause unpredictable problem.
Init RG with GPON mode.
=============Init_rg_api SUCESS!!==================
Init_rg_api 825: do system (echo 1 > /proc/rg/proc_to_pipe
)
0
to disable stag_enable
rg echo 0 igmp_general_query_fromPon_direct_txRealtek TR-142 Module initialized. err = 0, max_ponq_id=65
[vs_product_init:1417]
link up for port 3
link down for port 0
####initial default route table!
####initial cwmp route table!
####initial local route table!
####inital 4 port mapping route tables!
####inital 5 port mapping tables!
alloc 9k bytes for route table
registerPacket  hash=24
registerPacket  hash=27
registerPacket  hash=26
registerPacket  hash=6
registerPacket  hash=29
registerPacket  hash=3
registerPacket  hash=4
dnsInit:pRelayInfo=80da0884,pNsCCB=80da18a0
dns wait time is 2 secs
TR111: try to clear all
dhcpv6dmain start..............................
loopback: LoopEnable = 1
loopback: LoopExistPeriod = 5
loopback: LoopCancelPeriod = 300
loopback: EthernetType = 0xFFFA
registerPacket  hash=26
registerPacket  hash=27
loopback: vid = untagged
total 1 vlan values
fffa
lbd_rg_init-256 cmd:rg echo 0xfffa keep_ps_eth
reset_loop_intf-723
veip, create proc failed!
vgf, create proc failed!
dmMode, create proc failed!
l2, create proc failed!
devmode, create proc failed!
usage, create proc failed!
wanInfo, create proc failed!
macFilter, create proc failed!
f2dq, create proc failed!
uniQos, create proc failed!
debugInfo, create proc failed!
omciMirror, create proc failed!


 @platform_db_init(10342) macBasedTagDecision=[1], ivlMacast=[0], fwdVLAN_CPU=[1], fwdVLAN_CPU_SVLAN=[2]

omci platform attached!
register_gpon_evt_state: register gpon event state Successfully !
flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000
load default certificate files
flashfile_init>got OSK1FS, size=8480, cksum=40177
flashfile_copy2ram>create new file(omci_mib.cfg), size=7922
flashfile_copy2ram>create new file(omci_custom_opt.conf), size=435
flashfile_copy2ram>create new file(omci_raw_data), size=0
loid pwd.....: 123456
link up for port 2
rtkbosa: Init GN25L95 ...Open file [rtl-25l95-backup.bin]
flashfile_init(3146)>flag[2]! flashp=0xb43e3000 max_size=0x4000
load default certificate files
flashfile_init>got OSK1FS, size=1056, cksum=52712
flashfile_copy2ram>create new file(rtl-25l95-backup.bin), size=1024
{Vs_lan_sds_monitor_thread:416}
rtkbosa: (0) Dump A0
rtkbosa: 1b) Dump LUTs4 Data
rtkbosa: 2b) Dump LUTs5 Data
rtkbosa: 3b) Dump LUTs6 Data
rtkbosa: 4b) Dump A2.table2
rtkbosa: (5) Dump all slope and offsets - A2_TABLE2
rtkbosa: (6) Dump all alarms and warnings levels A2-Lower
rtkbosa: (7) Set PON_CONTROL
rtkbosa:   Read  PON_CONTROL reg (A2T2.182): 04
rtkbosa:   Write PON_CONTROL reg (A2T2.182): 04
rtkbosa: 7a) Dump A2.lower
rtkbosa: (8) Enable all alarms and warnings
rtkbosa:   Read  reg (A2T1.249): 00
rtkbosa:   Write reg (A2T1.249): c0
rtkbosa:   Read  reg (A2T1.253): 00
rtkbosa:   Write reg (A2T1.253): c0
rtkbosa: (9) Soft TX disable reset
rtkbosa: Step 9) Soft TX reg (0): 80
rtkbosa: Set Soft TX reg (1): c0
rtkbosa: Set Soft TX reg (2): 80
rtkbosa: (10) Set Safe Mode Start Up
rtkbosa: (11) Set up the password level
rtkbosa: Init done ...
init_rtsp_ssrc 39
nat entry's size is 148 bytes
Nat Entry Maxinum:	4096
gNatCachePoolp=0x80aea424 gNatCachePoolp->qcnt=512
natRuleAdd 3093 flags=0x00000009 sip=0.0.0.0 eip=0.0.0.0
priority rule total 0 !
priority rule total 0 !
handleIGMPandMLD: isIGMPenable:1, isMLDenable:1
Both IGMP and MLD.
Both IGMP and MLD snooping are enabled!
setIpRouteStaticDetail iproute->itf=1 gateway=0x00000000

cmd=config

cmd=ip access-list extended lan2local

cmd=permit mark 242
acl_id = 4
	listid = 4
	PERMIT prot:ip s=0/0 d=0/0
acl_id = 3
acl_id = 2
acl_id = 1

cmd=permit  udp any any  eq 53 local enable

cmd=permit  udp any any  eq 1900 local enable

cmd=permit  tcp any any  eq 5431 local enable
localServer[1].protocolName=tcp,localServer[1].port=80

cmd=deny  tcp any any  eq 80 local enable
localServer[2].protocolName=tcp,localServer[2].port=23

cmd=deny  tcp any any  eq 23 local enable
localServer[3].protocolName=tcp,localServer[3].port=22

cmd=deny  tcp any any  eq 22 local enable
localServer[4].protocolName=udp,localServer[4].port=69

cmd=deny  udp any any  eq 69 local enable
localServer[5].protocolName=udp,localServer[5].port=161

cmd=deny  udp any any  eq 161 local enable
localServer[6].protocolName=icmp,localServer[6].port=0

cmd=deny  icmp any any  local enable
localServer[7].protocolName=tcp,localServer[7].port=21

cmd=deny  tcp any any  eq 21 local enable
localServer[8].protocolName=udp,localServer[8].port=520

cmd=deny  udp any any  eq 520 local enable

cmd=exit

cmd=exit

cmd=config

cmd= ip  mark interface any  tcp src 0.0.0.0 0.0.0.0 0 dst 0.0.0.0 0.0.0.0 7547 241 cwmp wan

cmd=ip access-list extended wan2local

cmd=permit mark 241
acl_id = 4
	listid = 4
	PERMIT prot:ip s=0/0 d=0/0
	listid = 4
	PERMIT prot:udp  sport=0-0 eq dport=53-53 s=0/0 d=0/0
	listid = 4
	PERMIT prot:udp  sport=0-0 eq dport=1900-1900 s=0/0 d=0/0
	listid = 4
	PERMIT prot:tcp(0)  sport=0-0 eq dport=5431-5431 s=0/0 d=0/0
	listid = 4
	DENY prot:tcp(0)  sport=0-0 eq dport=80-80 s=0/0 d=0/0
	listid = 4
	DENY prot:tcp(0)  sport=0-0 eq dport=23-23 s=0/0 d=0/0
	listid = 4
	DENY prot:tcp(0)  sport=0-0 eq dport=22-22 s=0/0 d=0/0
	listid = 4
	DENY prot:udp  sport=0-0 eq dport=69-69 s=0/0 d=0/0
	listid = 4
	DENY prot:udp  sport=0-0 eq dport=161-161 s=0/0 d=0/0
	listid = 4
	DENY prot:icmp type(255) code(255) s=0/0 d=0/0
	listid = 4
	DENY prot:tcp(0)  sport=0-0 eq dport=21-21 s=0/0 d=0/0
	listid = 4
	DENY prot:udp  sport=0-0 eq dport=520-520 s=0/0 d=0/0
acl_id = 3
acl_id = 2
	listid = 2
	PERMIT prot:ip s=0/0 d=0/0
acl_id = 1

cmd=exit

cmd=exit

cmd=cfg set WAN_ACL_DEFAULT_ACTION  1
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
flash read - access list not created
cfgSetIgmpProxyAnyItf  isDisable=1
*******ipv6Init() Start*******
*****Ipv6 Lib Version Is 8.0.0*****
ipfw2 (+ipv6) initialized, divert loadable, nat loadable, rule-based forwarding disabled, default to accept, logging
####ipfw2 dynamic entry size: 92 bytes,pre malloc 64 entries
disabled
Enter SetupFWRule!
do_firewall_cmd:command=flush
Flushed all rules.
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add check-state
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 1000 icmp6 from any to any icmp6types 128,129
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add allow icmp6 from any to me6
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 1000 skipto 5000 ip6 from any to me6 in via e1
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 5000 ip6 from me6 to any out via e1
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 10000 ip6 from any to me6 in via wan
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 10000 ip6 from me6 to any out via wan
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 15000 ip6 from any to any
do_firewall_cmd() execute successfully!
Enter SetupLanAclRule!
do_firewall_cmd:command=set 1 flush
Flushed all rules.
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 9980 set 1 allow ip6 from any to any out keep-state
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 9990 set 1 allow ip6 from any to any in keep-state
do_firewall_cmd() execute successfully!
Enter SetupWanAclRule!
do_firewall_cmd:command=set 2 flush
Flushed all rules.
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 10010 set 2 allow icmp6 from any to any in keep-state icmp6types 128,129
do_firewall_cmd:command=add 14980 set 2 allow ip6 from any to any out keep-state
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 14990 set 2 deny ip6 from any to any in
do_firewall_cmd() execute successfully!
Enter SetupWanAclRule!
do_firewall_cmd:command=set 3 flush
Flushed all rules.
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 19980 set 3 allow ip6 from any to any out recv e1 xmit wan keep-state
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 19990 set 3 allow ip6 from any to any out recv wan xmit e1 keep-state
do_firewall_cmd() execute successfully!
Restart IPv6 Filter!
*******ipv6Init() End*******
registerPacket  hash=3
getCommonDivisorfromArray 1091 len=4 (40 30 20 10)
getCommonDivisorfromArray 1102 g=10
wfqScale[0]=4
wfqScale[1]=3
wfqScale[2]=2
wfqScale[3]=1
Reset RG QoS total bandwidth to unlimit.
setupIPQ 2554 Config RG QoS total bandwidth 0 Kbps
RTK_RG_Sync_OMCI_WAN_INFO-1720 Can't find the wan interface idx:1!handleIGMPandMLD: isIGMPenable:1, isMLDenable:1
Both IGMP and MLD.
Both IGMP and MLD snooping are enabled!
registerPacket  hash=1
captive portal redirect url string:
registerPacket  hash=18
registerPacket  hash=21
registerPacket  hash=29
registerPacket  hash=17
Restart cwmp server!
cwmpwanport=7547
<cwmp_udpecho_server_loop:82> pset:interface=,srcip=0.0.0.0,port=0>
registerPacket  hash=15
registerPacket  hash=14
wanadsl_dhcpv6c_check ifindex=2 itfname=a0
$$$$$$$$$$$$$$$$$$$$$$$$$[Enable_all_lan,418]disable lan port!
lanSdsSetLanStatusCommand set configData=0
flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000
e<cwmpinit_NoDebugMsg>Set No Debug Message[1]
<cwmpinit_DelayStart>Set Delay[30]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gDisplaypassword[1]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gDisplayNotificationPara[0]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gTr143DownloadExpress[1]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gTransferQueue[1]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gConfigTR098[1]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gWanAppType[1]
flashfile_init(3146)>flag[0]! flashp=0xb43ec000 max_size=0x4000
load default certificate files
flashfile_init>no flashfile
connecting to (80af68d8)
brgForwardInit
handleIGMPandMLD: isIGMPenable:1, isMLDenable:1
Both IGMP and MLD.
Both IGMP and MLD snooping are enabled!
*******ipv6Init2() Start*******
ipv6_IfInit:ifport=l0, adminStatus=0
Not Global or Unicast IPv6 address
Not Global or Unicast IPv6 address
ipv6_IfInit:ifport=e1, adminStatus=1
Not Global or Unicast IPv6 address
getconfig:ifp=e1
gifConfigSet()!
total=0
dsliteConfigSet()!
g_prefix_filter=0
*******ipv6Init2() End********
nabcommand string: clear counter
"clear" command: No change mode
command string: help
"help" command: No change mode
command string: show command
"show" command: No change mode
command string: show web
"show" command: No change mode
command string: capture
"capture" command: No change mode
command string: dump
"dump" command: No change mode
le loopback deteccwmp_webserver_init() successful: master socket = 1
cwmp_server(434):cwmp is disable
t telnetLoginCliType 0
telnetLoginCliDiag diagshell

flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000
load moduleInitFunc
uModule libtr142 is inited
load moduleInitFunc
uModule libvs_omciapi is inited
load moduleOptInitFunc with Opt=3
uModule bdp_00000080 is inited
load moduleInitFunc
uModule me_00040000 is inited
#### pf_rtl96xx_GetDevCapabilities() 8378 fePortNum=0, gePortNum=1, port0_type=2 port1_type=0
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=0
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=0
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=V1.1.8
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=1
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=V1.1.8
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=
< omci_setup_mgmt_interface 10232 > : vlanPara 65535
[libtr142] omci_cfg_set is called
omci_PonResetOnuType.1671

excCode = 0x5
load/store un-alignment: bad code:do_ade(809)  epc=0x802edc09
excCode = 0x5
excCode = 0x5
excCode = 0x5
excCode = 0x5
excCode = 0x5
Resetting MIB: me65305
Me65305 --> action no found

flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000
omci_wrapper_msgHandler: devMode 1,receiveState 1,usrLogLvl 0, drvLogLvl 0,sn VSOL
[libtr142] tid 131073 starts, op = 1
[libtr142] [libtr142] omci_op_set_if 0 is called.
[get_wan_by_if_id(51)----debug]  omci_configured = 0-------------
[libtr142] if_is_ip_stack_B = 1,idx -1
[libtr142] if_tci = 65535
[libtr142] tid 131073 unlock
flash logo config addr:0xb43cb000 size:98304
realtronLogoTable 813 rm inside logo!
realtronLogoTable 869 register logo!
flash login logo config addr:0xb43b6000 size:20480
realtronLoginLogoTable 907 rm login logo!
realtronLoginLogoTable 941 login logo is empty!
4684
command string: disable
"disable" command: No change mode
command string: show mib
"show" command: No change mode

Username: rtl8226b: VERID = 0x6720 (MDIO set 0 , PHY Addr 7)
lanSdsSetLanStatusCommand set configData=0
Lansds_Rtk_Mac0_Phy_8221b_Detect-1230
get lan global ipv6 address error!
rtk_pon_led_SpecType_set 0
omci_PonResetVsMib.1364
omci_PonResetVsOntCode.166
omci_PonResetVsFirewallLevel.992
omci_PonResetVsLogin.1007
omci_PonResetVsAccessControl.1030
omci_LanBindModeReset.1068
omci_PonResetDhcpOption82Data.798
omci_PonResetDhcpCircuitId.811
omci_PonResetDhcpRemoteId.824
[omci_PonResetPriAuth(1298)]
[omci_PonResetMacAcl1(1310)]
[omci_PonResetMacAcl2(1322)]
priority: 1, portmask 127, rx: 80338bd9
insert here, priority: 4, portmask 4, rx: 801519d9
rg echo 1 strange_packet_dropeuropacli get flash check_1453diag "debug gpio set pin 13 state enablecommand:debug gpio set pin 13 state enable
set gpio 13 to enable!
RTK.0> OMCI_Init 770!!!!!!!!!!!!!!!!
up:chno=-1
port 1 is up
rtl8226b: Timeout (dev=1f addr=0xa420 mask=0x03 timeout=0)

get lan global ipv6 address error!
RG_reset_static_route-1981 DONE !
[WARNING] type ACL_FWD_TYPE_DIR_INGRESS_ALL_PACKET for Egress Intf Index error! @ _rtk_rg_aclSWEntry_not_support(4341)
_rtk_rg_apollo_aclFilterAndQos_add(4498): func_return=0x10007 expect_return=0x0, fail, so abort!

[WARNING] type ACL_FWD_TYPE_DIR_INGRESS_ALL_PACKET for Egress Intf Index error! @ _rtk_rg_aclSWEntry_not_support(4341)
[RG_add_default_Acl_Qos:3197]rtk_rg_aclFilterAndQos_add QoS rule failed! (ret = 65543)
RG_del_PPPoE_Acl 2889: do system (echo 0 > /proc/rg/pppoe_bc_passthrought_to_bindingWan)
RG Limit IPv6 MC!
ethWanConfigInit:3129 pEntry=0x80c9c6c0
getCTReserveMACIndexFromIfindex:ifindex=2
entry.ifindex=2,4
getCTReserveMACIndexFromIfindex:find entry 1
setIfPortRfc ifindex=2,rfc=5
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanGroup[0]:ifindex 2,vid_flag 1,vlanid 20,enabled 1,wanmode 0
ethWanGroup[0].ethwantype=1,igmpenable=0
ethWanGroup[0].mac=4c:d7:c8:xx:xx:xx
ethWanGroup[0]:fgrp 0
setCfgIntfNat 2069 itf=2 mdoe=2
setCfgIntfNat 2088 itf=2 mdoe=2
[startWan@1163]
Enable MLD Proxy!
Disable DMAC to CVID !!
Disable dmac2cvid of wan portmask=0x4
[startConnection@444] pEntry->ifindex = 2, pEntry->cmode = 1
startConnection 453 1483 MER
Adding RG DHCP info: rg_index=1
handleIGMPandMLD: isIGMPenable:1, isMLDenable:1
Both IGMP and MLD.
Both IGMP and MLD snooping are enabled!
[startWanServiceDependency@663]
[Add_deny_vlan@8976]10
dmz rule total 0 !
#######ipCircCreate type=1 if_id=1 rcid=0
ipCircSetIPA id_pyhport=1 c->rc_id=1 phyport=1
xipCreateVif...................
ipCircEnable  1194...............
####add 0xc0a80101/0xffffffff in route table 0x80d993cc! owner=5, cid=1 src=0xc0a80101
set network direct route, phyport=1 itf e1.
####add 0xc0a80100/0xffffff00 in route table 0x80d993cc! owner=6, cid=1 src=0xc0a80101
ipCircEnable  1194...............
setCfgIntfNat 2069 itf=2 mdoe=2
setCfgIntfNat 2088 itf=2 mdoe=2
[webmain:1011] Change Hybrid Mode to HGU
rtl8226b: Timeout (dev=1f addr=0xa420 mask=0x03 timeout=0)


cmd=omcicli set devmode router

cmd=omcicli mib reset
priority: 1, portmask 127, rx: 80338bd9
insert here, priority: 4, portmask 4, rx: 801519d9

cmd=rg echo 0 stag_enable
to disable stag_enable

cmd=config service dhcp 2
config ip6 ra startE[libtr142] omci_cfg_set is called
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=0
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=0
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=V1.1.8
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=1
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=V1.1.8
#### omci_sw_dl_uboot_env_get() 2539 pReturnStr=
< omci_setup_mgmt_interface 10232 > : vlanPara 65535
[libtr142] omci_cfg_set is called
omci_PonResetOnuType.1671

excCode = 0x5
excCode = 0x5
excCode = 0x5
excCode = 0x5
excCode = 0x5
excCode = 0x5
Resetting MIB: me65305
Me65305 --> action no found

flashfile_init(3146)>flag[1]! flashp=0xb43e7000 max_size=0x4000
[libtr142] tid 262146 starts, op = 1
[libtr142] [libtr142] omci_op_set_if 0 is called.
[get_wan_by_if_id(51)----debug]  omci_configured = 0-------------
[libtr142] if_is_ip_stack_B = 1,idx -1
[libtr142] if_tci = 65535
[libtr142] tid 262146 unlock
[libtr142] tid 327683 starts, op = 1
[libtr142] [libtr142] omci_op_set_if 0 is called.
[get_wan_by_if_id(51)----debug]  omci_configured = 0-------------
[libtr142] if_is_ip_stack_B = 1,idx -1
[libtr142] if_tci = 65535
[libtr142] tid 327683 unlock
nable Router Advertisement Success!
config ip6 dhcpv6 server startdhcp6 server on e1 is running
rg echo 0 igmp_general_query_fromPon_direct_txReset RG QoS total bandwidth to unlimit.
setupIPQ 2554 Config RG QoS total bandwidth 0 Kbps
{vs_lansds_thread:726}
rtl8226b: rtk_rtl8226b_moudle_init1 1328
rtl8226b: set 8226b set gpio to output mode

rtl8226b: set 8226b set gpio to databit

omci_PonResetVsMib.1364
omci_PonResetVsOntCode.166
omci_PonResetVsFirewallLevel.992
omci_PonResetVsLogin.1007
omci_PonResetVsAccessControl.1030
omci_LanBindModeReset.1068
omci_PonResetDhcpOption82Data.798
omci_PonResetDhcpCircuitId.811
omci_PonResetDhcpRemoteId.824
[omci_PonResetPriAuth(1298)]
[omci_PonResetMacAcl1(1310)]
[omci_PonResetMacAcl2(1322)]
rtl8226b: Init Device 0 (mdio set: 0, phyad: 7)
diag "port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-controlcommand:port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-control
RTK.0> NULL exist for MIB_TABLE_MAP8021PSERVPROF_INDEX Entry,so up lan!
Enable_all_lan_with1 465!!!!!!!!!!!!!!!!
$$$$$$$$$$$$$$$$$$$$$$$$$enable lan port!
lanSdsSetLanStatusCommand set configData=1
diag "port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-controlcommand:port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-control
RTK.0> Enable_all_lan_with1 485!!!!!!!!!!!!!!!!
link up for port 0
[Set_Route_for_StaticWan@3817]
--------******start ending ****-----
compress: unPreLen:39784, preLen:9056
start write config mib to flash addr:b43f8000, write size:9064 ...
SE:1016.SE:1017.SE:1018.SE:1019.SE:1020.SE:1021.SE:1022.SE:1023.write backup config...
start write config mib to flash addr:b43f0000, write size:9064 ...
SE:1008.SE:1009.SE:1010.SE:1011.SE:1012.SE:1013.SE:1014.SE:1015.write mib to flash end
ret=0x0 chipId = 0x96030002, rev=0x2 subType=0x6
rtl8226b: rtk_rtl8226b_moudle_init1 1328
rtl8226b: set 8226b set gpio to output mode

rtl8226b: set 8226b set gpio to databit

link up for port 0
[ASSERT_FAIL]'rtk_port_speedDuplex_get(port, &linkSpeed, &linkDuplex)=0xffffffff' @rtk_rg_apollo_portStatus_get:29071
rtl8226b: Init Device 0 (mdio set: 0, phyad: 7)
diag "port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-controlcommand:port set auto-nego port 0 ability 10h 10f 100h 100f 1000f 2500f 10000f flow-control asy-flow-control
RTK.0> link down for port 0
link up for port 0
InformIntevalCnt is set to 300(s)
create memory pool: start at 0x80c02080, size 15640
Init memory freed, start:80c02080, len:15640

Configurações

É de sua total responsabilidade o uso e implicações que utilizar equipamentos não fornecidos ou homologados pelo ISP podem causar.

Bugs, dicas e notas

O aparelho tem hardware idêntico ao V2802RH - exceto pela ausência da porta LAN de 1 Gbit/s -, portanto visite a página deste para mais detalhes e dicas; tudo deve ser aplicável, exceto os firmwares.
- As imagens de firmware do V2802RH não foram testadas neste aparelho, portanto não tente fazer flash de imagens de um modelo no outro, sob risco de brick.
Note que este é o V2801Q, já o V2801SG (não listado no Wiki) utiliza SoC ZTE, portanto incompatível com quaisquer informações listadas aqui.
Na versão original V1.1.8 o aparelho já suporta os MEs proprietários da Huawei e de outros fabricantes;
Tabela de entidades gerenciadas OMCI suportadas pelo firmware V1.1.8:

Mostrar lista

TableId [1] Name: OntData!
TableId [2] Name: Cardholder!
TableId [3] Name: CircuitPack!
TableId [4] Name: SWImage!
TableId [5] Name: EthUni!
TableId [6] Name: EthPmHistoryData!
TableId [7] Name: MacBriServProf!
TableId [8] Name: MacBriPortCfgData!
TableId [9] Name: MacBridgePortFilterTable!
TableId [10] Name: MacBriPortBriTblData!
TableId [12] Name: MacBridgePmMonitorHistoryData!
TableId [11] Name: MacBridgePortPmMonitorHistoryData!
TableId [13] Name: VlanTagOpCfgData!
TableId [14] Name: MacBridgePortFilterPreassign!
TableId [15] Name: LctUni!
TableId [16] Name: VlanTagFilterData!
TableId [17] Name: EthPmData2!
TableId [18] Name: Map8021pServProf!
TableId [19] Name: OltG!
TableId [20] Name: IpHostCfgData!
TableId [21] Name: TcpUdpCfgData!
TableId [22] Name: NetworkAddress!
TableId [23] Name: AuthSecMethod!
TableId [24] Name: LargeString!
TableId [25] Name: ExtVlanTagOperCfgData!
TableId [26] Name: HW ME247!
TableId [27] Name: ExtIpHostCfgData!
TableId [28] Name: LoopDetect!
TableId [29] Name: Ontg!
TableId [30] Name: Ont2g!
TableId [31] Name: Tcont!
TableId [32] Name: Anig!
TableId [33] Name: Unig!
TableId [34] Name: GemIwTp!
TableId [35] Name: GemPortPmhd!
TableId [36] Name: GemPortCtp!
TableId [37] Name: GalEthProf!
TableId [38] Name: ThresholdData1!
TableId [39] Name: ThresholdData2!
TableId [40] Name: PriQ!
TableId [41] Name: Scheduler!
TableId [42] Name: TrafficDescriptor!
TableId [43] Name: MultiGemIwTp!
TableId [44] Name: Omci!
TableId [45] Name: EthPmData3!
TableId [46] Name: Dot1RateLimiter!
TableId [47] Name: LargeString!
TableId [48] Name: GeneralPurposeBuffer!
TableId [49] Name: McastOperProf!
TableId [50] Name: McastSubConfInfo!
TableId [51] Name: McastSubMonitor!
TableId [52] Name: FecPmhd!
TableId [53] Name: EthPmDataDs!
TableId [54] Name: EthPmDataUs!
TableId [55] Name: VEIP!
TableId [56] Name: GenericStatusPortal!
TableId [57] Name: EnhancedSecCtl!
TableId [58] Name: EthExtPmData!
TableId [59] Name: TR069ManageServer!
TableId [60] Name: GpncPmhd!
TableId [61] Name: HW ME350!
TableId [62] Name: VoipImage!
TableId [63] Name: HW ME370!
TableId [64] Name: HW ME373!
TableId [65] Name: EthExtPmData64Bit!
TableId [72] Name: ONTCode!
TableId [73] Name: VsWanNumber!
TableId [74] Name: VsWanCfgData!
TableId [75] Name: VsWanCfgPppoe!
TableId [76] Name: VsWanCfgPortBind!
TableId [77] Name: VsWanCfgStaticIp!
TableId [78] Name: LanBindMode!
TableId [79] Name: VsWanCfgStaticIpV6!
TableId [80] Name: VsWanCfgDhcpIpV6!
TableId [81] Name: VsWanCfgDsLite!
TableId [82] Name: VsWanCfg6RD!
TableId [83] Name: VsWanCfgVlanMode!
TableId [84] Name: VsTr069Config!
TableId [85] Name: VsAcsServerData!
TableId [86] Name: VsTr069ReverseConnectionData!
TableId [87] Name: VsStunConf!
TableId [88] Name: VsDhcpServer!
TableId [89] Name: VsFactoryReset!
TableId [90] Name: MacAgingTime!
TableId [91] Name: MacLimitConfiguration!
TableId [92] Name: VsPortIsolate!
TableId [93] Name: VsLoopCheckConfig!
TableId [94] Name: VsDhcpOption82!
TableId [95] Name: VsCircuitIdFormat!
TableId [96] Name: VsRemoteIdFormat!
TableId [97] Name: VsDhcpServer1!
TableId [98] Name: VsDhcpServer2!
TableId [99] Name: VsLoginConfiguration!
TableId [100] Name: VsFirewallLevel!
TableId [101] Name: VsAccessControlConfig!
TableId [102] Name: VsPriAuth!
TableId [103] Name: VsPriCap1!
TableId [104] Name: VsMacAcl1!
TableId [105] Name: VsMacAcl2!
TableId [69] Name: ZteMcastTag!
TableId [106] Name: Me65305!
TableId [107] Name: HW ME65320!
TableId [110] Name: FH_WAN_PORFILE!
TableId [111] Name: WAN_CONFIG!
TableId [112] Name: WAN_PPPOE_CONFIG!
TableId [113] Name: FH_WAN_PORT_BIND!
TableId [114] Name: FH_WAN_IP_HOST_CONFIG!
TableId [115] Name: FHTT_PON_SWITCHPORT!
TableId [116] Name: FH_WAN_EXTEND_VLAN!
TableId [117] Name: FHOmciMode!
TableId [118] Name: OPTWanCfgData!
TableId [119] Name: OPTWanDspData!
TableId [66] Name: HW ExtendedOnuG!
TableId [109] Name: HW ME65414!
TableId [67] Name: HWPROPRIETARY!
TableId [108] Name: HW ME65523!
TableId [68] Name: CTCOnuOnuLoopDetection!
TableId [70] Name: OnuCapability!
TableId [71] Name: LoIdAuth!

Firmwares

Stock

Versões oficiais e não modificadas para o aparelho. São de propriedade do fabricante - que detém todos os direitos sobre elas - e mantidas aqui apenas em caráter de arquivamento e espelhamento, podendo ser removidas caso solicitado pelos representantes oficiais da empresa.

Custom

Todas as versões custom são testadas localmente ao máximo possível, porém seu uso e possíveis implicações são de total responsabilidade do proprietário do aparelho. Não atualize o aparelho sem necessidade; só atualize o aparelho para as versões custom se confirmado que precise das alterações listadas.

Os arquivos produzidos pelo O3 Labs são assinados para garantir sua integridade e procedência. Para instruções de como validar as assinaturas, acesse aqui.

Versões modificadas com correções e/ou melhorias, baseadas em releases oficiais/stock. As versões são cumulativas, ou seja, a mais recente sempre contém também todas as modificações das versões anteriores.

É possível atualizar entre versões custom ou stock sem nenhum problema. Note que saltos na versão base podem incluir ou remover parâmetros de configuração, portanto é aconselhável um factory reset após realizar tais atualizações. Adicionalmente, efetue estes procedimentos com a fibra desconectada do aparelho.

Caso a versão base continue a mesma de uma versão custom para a outra, não é necessário o factory reset, salvo se solicitado explicitamente na descrição.

Agradecimentos

Pessoas envolvidas em arquivos, discussões, dicas, doações ou bate papo em geral. Lista em ordem alfabética.