YOTC M2-2050-G40
Hardware Specifications
| Vendor/Brand | YOTC |
| Model | M2-2050-G40 |
| Chipset | Realtek RTL9607C / RTL9607Cv2 |
| Flash | SPI NAND 128MB |
| RAM | 256MB |
| CPU | Formosa MIPS interAptiv (multi) V2.0 |
| CPU Clock | 900MHz / 1150MHz |
| BogoMIPS | 597.60MHz / 766.77MHz |
| System | Linux 4.4.140 (GCC Realtek MSDK-4.8.5p1 Build 3068) |
| Ethernet ports | 2x1G |
| Optics | SC/APC |
| IP address | 192.168.1.1 or 192.168.8.1 |
| Web Gui | ✅ user super, password opticalink OR user User, password User |
| Telnet | ✅ user super, password opticalink OR user User, password User |
| SSH | NO |
| Serial baud | 115200 |
| Serial encoding | 8-N-1 |
| Form Factor | ONT |
Serial
M2-2050-G40 boot dump
Bismarck Preloader 3.7
II: LPLR:11267 PLR:5cb134c9 BD:24031315 TK:msdk-4.8.5-1004k-EB-3.18-u0.9.33-m32t-150818
II: TLB initial done:
.ro section works!
.text and .ro sections work!
II: cg_cpu_pll_init done
II: cg_sram_pll_init done
II: CPU0 900MHz, CPU1 500MHz, DDR3 600MHz, LX 200MHz, SRAM 500MHz, SPIF 100MHz
AK: ******* DRAM calibration version: v5.6 *******
AK: MEMPLL[31/63/95/127/159/191/223]=407f, c0000210, 2ea23980, 2d0f0030, fff, 0, 0
AK: TP=3, VD=1, CC=3, OT=2, EP=0, EB=0
ZQ: Clock: ODT/OCD=60/48, zq_zctrl_prog=0x c08033e, zq_zctrl_status=0x28a154
ZQ: Address: ODT/OCD=60/80, zq_zctrl_prog=0x1c080332, zq_zctrl_status=0x28a111
ZQ: DQ: ODT/OCD=60/60, zq_zctrl_prog=0x2c080338, zq_zctrl_status=0x28a132
ZQ: DQS: ODT/OCD=60/60, zq_zctrl_prog=0x3c080338, zq_zctrl_status=0x28a132
ZQ: INTERAL DDR3, ZQCL done, ZQCS Enable
AK: MRS: mr[0]=0x101a50, mr[1]=0x110004, mr[2]=0x120010, mr[3]=0x130000
AK: Start DDR_Calibration
AK: Bit/max_r_s/max_r_l/max_w_s/max_w_l Bit/max_r_s/max_r_l/max_w_s/max_w_l
[ 0] 0 1f 0 1f [16] 0 1f 0 1f
[ 1] 0 1f 0 1f [17] 0 1f 0 1f
[ 2] 0 1f 0 1f [18] 0 1f 0 1f
[ 3] 0 1f 0 1f [19] 0 1f 0 1f
[ 4] 0 1f 0 1f [20] 0 1f 0 1f
[ 5] 0 1f 0 1f [21] 0 1f 0 1f
[ 6] 0 1f 0 1f [22] 0 1f 0 1f
[ 7] 0 1f 0 1f [23] 0 1f 0 1f
[ 8] 0 1f 0 1f [24] 0 1f 0 1f
[ 9] 0 1f 0 1f [25] 0 1f 0 1f
[10] 0 1f 0 1f [26] 0 1f 0 1f
[11] 0 1f 0 1f [27] 0 1f 0 1f
[12] 0 1f 0 1f [28] 0 1f 0 1f
[13] 0 1f 0 1f [29] 0 1f 0 1f
[14] 0 1f 0 1f [30] 0 1f 0 1f
[15] 0 1f 0 1f [31] 0 1f 0 1f
AK: Finish DDR_Calibration
AK: DRAM size=0x10000000, tRFC[2]=0x165(nS), tREF=1920(nS)
AK: DCR=0x21321003, DTR[0:2]=0x99644828, 0x808051f, 0x6516000
II: Change Stack from 0x9f002edc to 0x806fffe0
II: U-boot Magic Number is 0x27051956
II: Inflating U-Boot (0x80700040 -> 0x83c00000)... OK
II: Starting U-boot...
U-Boot 2020.01-svn25833 (Mar 13 2024 - 15:43:16 -0400)
Board: RTL9607C, MIPS interAptiv:900MHz RLX5281:500MHz LX:200MHz DDR3:600MHz SCLK:100MHz
ICACHE: 64KB (32-byte/4-way/512-set)
DCACHE: 32KB (32-byte/4-way/256-set)
DRAM: Physical 256 MiB, uboot useable size 256 MiB
NAND:
SPI NAND: 0xEFAA21, Mode(111/111)
Create bbt:
NAND: 128 MiB
Loading Environment from NAND... OK
In: serial
Out: serial
Err: serial
II: Init Software Patch!
II: sw_test
II: Configurate otto_flash_layout
Saving Environment to NAND... Erasing redundant NAND...
Erasing at 0xe0000 -- 100% complete.
Writing to redundant NAND... OK
OK
NAND read: device 0 offset 0x0, size 0xc0000
786432 bytes read: OK
CRC32 for 81c80000 ... 81d3ffff ==> a03ba268
Net: LUNA GMAC
Warning: eth device name has a space!
Hit ctrl + b to stop autoboot: 1 0
swcore_init
multicast_start Using LUNA GMAC device
mcast upgrade timeout.
ubi0: attaching mtd5
ubi0: scanning is finished
ubi0: attached mtd5 (name "ubi_device", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 995, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 23/11, WL threshold: 4096, image sequence number: 1263745346
ubi0: available PEBs: 488, total reserved PEBs: 507, PEBs reserved for bad PEB handling: 20
No size specified -> Using max size (5332992)
Read 5332992 bytes from volume ubi_k0 to 83000000
## Booting kernel from Legacy Image at 83000000 ...
Image Name: Linux-4.4.140
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 4103265 Bytes = 3.9 MiB
Load Address: 80010000
Entry Point: 80936a40
Verifying Checksum ... OK
Uncompressing Kernel Image
M2-2050-G40 boot dump (newer revision)
PCIE0 reset pin is set to GPIO 40
PCIE1 reset pin is set to GPIO 39
[wlan0]TXDMA Error TxDMAStatus =eeeeeeee
RXDMA Error RxDMAStatus =ee
[wlan0]TXDMA Error TxDMAStatus =eeeeeeee
RXDMA Error RxDMAStatus
Bismarck Preloader 3.7
II: LPLR:11261 PLR:5cb134c9 BD:24092617 TK:msdk-4.8.5-1004k-EB-3.18-u0.9.33-m32t-150818
II: TLB initial done:
.ro section works!
.text and .ro sections work!
II: cg_cpu_pll_init done
II: cg_sram_pll_init done
II: CPU0 1150MHz, CPU1 600MHz, DDR3 666MHz, LX 200MHz, SRAM 500MHz, SPIF 100MHz
II: apro_otp_setup_fcn(fc)
AK: ******* DRAM calibration version: v5.6 *******
AK: MEMPLL[31/63/95/127/159/191/223]=907f, c0000210, 64237c0, 320f0030, fff, a7f, 0
AK: TP=3, VD=1, CC=3, OT=2, EP=0, EB=0
ZQ: Clock: ODT/OCD=60/48, zq_zctrl_prog=0x c08033e, zq_zctrl_status=0x30b155
ZQ: Address: ODT/OCD=60/80, zq_zctrl_prog=0x1c080332, zq_zctrl_status=0x30b111
ZQ: DQ: ODT/OCD=60/60, zq_zctrl_prog=0x2c080338, zq_zctrl_status=0x30b133
ZQ: DQS: ODT/OCD=60/60, zq_zctrl_prog=0x3c080338, zq_zctrl_status=0x30b133
ZQ: INTERAL DDR3, ZQCL done, ZQCS Enable
AK: MRS: mr[0]=0x101a50, mr[1]=0x110004, mr[2]=0x120010, mr[3]=0x130000
AK: Start DDR_Calibration
AK: Bit/max_r_s/max_r_l/max_w_s/max_w_l Bit/max_r_s/max_r_l/max_w_s/max_w_l
[ 0] 0 1f 0 1f [16] 0 1f 0 1f
[ 1] 0 1f 0 1f [17] 0 1f 0 1f
[ 2] 0 1f 0 1f [18] 0 1f 0 1f
[ 3] 0 1f 0 1f [19] 0 1f 0 1f
[ 4] 0 1f 0 1f [20] 0 1f 0 1f
[ 5] 0 1f 0 1f [21] 0 1f 0 1f
[ 6] 0 1f 0 1f [22] 0 1f 0 1f
[ 7] 0 1f 0 1f [23] 0 1f 0 1f
[ 8] 0 1f 0 1f [24] 0 1f 0 1f
[ 9] 0 1f 0 1f [25] 0 1f 0 1f
[10] 0 1f 0 1f [26] 0 1f 0 1f
[11] 0 1f 0 1f [27] 0 1f 0 1f
[12] 0 1f 0 1f [28] 0 1f 0 1f
[13] 0 1f 0 1f [29] 0 1f 0 1f
[14] 0 1f 0 1f [30] 0 1f 0 1f
[15] 0 1f 0 1f [31] 0 1f 0 1f
AK: Finish DDR_Calibration
AK: DRAM size=0x10000000, tRFC[2]=0x165(nS), tREF=1729(nS)
AK: DCR=0x21321003, DTR[0:2]=0x99655828, 0x909061f, 0x6f19000
II: Change Stack from 0x9f002edc to 0x806fffe0
II: U-boot Magic Number is 0x27051956
II: Inflating U-Boot (0x80700040 -> 0x83c00000)... OK
II: Starting U-boot...
U-Boot 2020.01-svn25833 (Sep 26 2024 - 17:28:49 +0800)
Board: RTL9607Cv2, MIPS interAptiv:1150MHz RLX5281:600MHz LX:200MHz DDR3:666MHz SCLK:100MHz
ICACHE: 64KB (32-byte/4-way/512-set)
DCACHE: 32KB (32-byte/4-way/256-set)
DRAM: Physical 256 MiB, uboot useable size 256 MiB
NAND:
SPI NAND: 0xCD71, Mode(111/111)
Create bbt:
NAND: 128 MiB
Loading Environment from NAND... OK
In: serial
Out: serial
Err: serial
II: Init Software Patch!
II: sw_test
II: Configurate otto_flash_layout
Saving Environment to NAND... Erasing redundant NAND...
Erasing at 0xe0000 -- 100% complete.
Writing to redundant NAND... OK
OK
NAND read: device 0 offset 0x0, size 0xc0000
ECC error in block page addr 8
ECC error in block page addr 45
786432 bytes read: OK
CRC32 for 81c80000 ... 81d3ffff ==> 8860858b
Net: LUNA GMAC
Warning: eth device name has a space!
Hit ctrl + b to stop autoboot: 1 0
swcore_init
multicast_start Using LUNA GMAC device
mcast upgrade timeout.
ubi0: attaching mtd5
ubi0: scanning is finished
ubi0: attached mtd5 (name "ubi_device", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 995, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 5/3, WL threshold: 4096, image sequence number: 1197784227
ubi0: available PEBs: 488, total reserved PEBs: 507, PEBs reserved for bad PEB handling: 20
No size specified -> Using max size (5332992)
Read 5332992 bytes from volume ubi_k0 to 83000000
## Booting kernel from Legacy Image at 83000000 ...
Image Name: Linux-4.4.140
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 4103928 Bytes = 3.9 MiB
Load Address: 80010000
Entry Point: 80935680
Verifying Checksum ... OK
Uncompressing Kernel Image
List of Software versions
- 518_V300R02B15 (doesn’t have upg_app, wget, wget_manage)
- 518_V300R02B21
- 518_V300R02B22
- 518_V300R02B25
- 518_V300R02B31
List of partitions (MTD)
| dev | size | erasesize | name |
|---|---|---|---|
| mtd0 | 000c0000 | 00020000 | “boot” |
| mtd1 | 00020000 | 00020000 | “env” |
| mtd2 | 00020000 | 00020000 | “env2” |
| mtd3 | 00020000 | 00020000 | “static_conf” |
| mtd4 | 07c60000 | 00020000 | “ubi_device” |
| mtd5 | 0081d000 | 0001f000 | “ubi_Config” |
| mtd6 | 00516000 | 0001f000 | “ubi_k0” |
| mtd7 | 0141a000 | 0001f000 | “ubi_r0” |
| mtd8 | 00516000 | 0001f000 | “ubi_k1” |
| mtd9 | 0141a000 | 0001f000 | “ubi_r1” |
List of volumes (UBI)
| dev | size | type | name |
|---|---|---|---|
| ubi0_0 | 8507392B | dynamic | “ubi_Config” |
| ubi0_1 | 5332992B | dynamic | “ubi_k0” |
| ubi0_2 | 21078016B | dynamic | “ubi_r0” |
| ubi0_3 | 5332992B | dynamic | “ubi_k1” |
| ubi0_4 | 21078016B | dynamic | “ubi_r1” |
To back up a volume, cat the appropriate /dev/ubi0_X device to a file or pipe, to restore a volume, use the ubiupdatevol utility.
This ONT supports dual boot.
Volumes ubi_k0 and ubi_r0 respectively contain kernel and rootfs of the first image, while ubi_k1 and ubi_r1 contain kernel and rootfs of the second one.
Useful files and binaries
Useful files
User Configuration:
/var/config/config.xml
Custom Default Configuration:
/var/config/config_custom_default.xml
Custom Configuration (on reset):
/var/config/custom_config.sh
Hardware Configuration:
/var/config/config_hs.xml
GPON/OMCI settings
Set OMCI mode to customized so versions don’t reset
mib set OMCI_OLT_MODE 3
Setting OMCI software version (ME 7)
mib set OMCI_SW_VER1 YOURSWVER
mib set OMCI_SW_VER2 YOURSWVER
Setting OMCI vendor ID (ME 256)
mib set PON_VENDOR_ID VEND
Setting ONU GPON Serial Number
mib set GPON_SN VEND1234ABCD
Setting OMCI hardware version (ME 256)
mib set HW_HWVER YOURHWVER
Setting OMCC version (ME 257), only accepts decimal values.
mib set OMCC_VER 128
Setting Product Code (ME 257), only accepts decimal values.
mib set OMCI_VENDOR_PRODUCT_CODE 0
Setting OMCI equipment ID (ME 257)
mib set GPON_ONU_MODEL YOUREQUIPMENTID
Setting VEIP slot ID (example for 255), only accepts decimal values.
mib set OMCI_VEIP_SLOT_ID 255
Commit Changes.
mib commit
Verification commands for settings changed above (all settings take a reboot to apply)
Verify SwVer (ME 7)
omcicli mib get 7
Verify Vendor ID, HwVer, and G984 Serial (ME 256)
omcicli mib get 256
Verify OMCC version, Equipment ID and Product Code (ME 257)
omcicli mib get 257
Verify VEIP customized slot ID (ME 329)
omcicli mib get 329
Advanced Settings
Setting management MAC
mib set ELAN_MAC_ADDR 1A2B3C4D5E6F
Setting management IP
mib set LAN_IP_ADDR 192.168.8.1
Checking the currently active image
nv getenv sw_active
Booting to a different image
# Switch to image 0
nv setenv sw_commit 0
nv setenv sw_tryactive 0
# Switch to image 1
nv setenv sw_commit 1
nv setenv sw_tryactive 1
Cloning of image 0 into image 1
cp /dev/ubi0_1 /tmp/
cp /dev/ubi0_2 /tmp/
ubiupdatevol /dev/ubi0_3 /tmp/ubi0_1
ubiupdatevol /dev/ubi0_4 /tmp/ubi0_2
Rebooting the ONU
reboot
Enable Ethernet Ports
mib set SW_PORT_TBL.0.Enable 1
mib set SW_PORT_TBL.1.Enable 1
mib set SW_PORT_TBL.2.Enable 1
mib set SW_PORT_TBL.3.Enable 1
Enable 5GHz WiFi
mib set WLAN_MBSSIB_TBL.0.wlanDisabled 0
Teardown and other photos
