Hardware Specifications

Vendor/Brand	LEOX
Model	LXT-010S-H
ODM	HiSense
ODM Product Code	LTE3415-SH+
Chipset	Realtek RTL9601CI
Flash	128MB
RAM	32MB
System	Linux 3.18 (Luna SDK 3.3)
SFP interfaces	HSGMII
Optics	SC/UPC or SC/APC
IP address	192.168.100.1/24
Web Gui	✅
SSH
Telnet	✅ user leox, password leolabs_7
Serial	✅
Serial baud	115200
Serial encoding	8-N-1
Form Factor	miniONT SFP

List of partitions

dev	size	erasesize	name
mtd0	00040000	00001000	"boot"
mtd1	00002000	00001000	"env"
mtd2	00002000	00001000	"env2"
mtd3	0003c000	00001000	"config"
mtd4	00300000	00001000	"k0"
mtd5	004c0000	00001000	"r0"
mtd6	00300000	00001000	"k1"
mtd7	004c0000	00001000	"r1"
mtd8	00001000	00001000	"Partition_008"
mtd9	00001000	00001000	"Partition_009"
mtd10	00001000	00001000	"Partition_010"
mtd11	00001000	00001000	"Partition_011"
mtd12	00300000	00001000	"linux"
mtd13	004c0000	00001000	"rootfs"

This stick supports dual boot.

k0 and r0 respectively contain kernel and firmware of the first image, while k1 and r1 contain kernel and firmware of the second one.

Serial

The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. To accept TX line commands, the GND of the TTL adapter should be attached to the stick's shield:

Leox LXT-010S-H TTL Pinout

Note

Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work.

List firmware version

Note

There is a new firmware provided by LeoLabs that fixes issues with the stick operating at 2.5GbE speeds

• V3.3.4L3
• V3.3.4L4rc1 (Fix 2.5GbE HiSGMII)
• V3.3.4L4rc5
• V3.3.4L4 (Added failover from 2.5GbE to 1GbE, other fixes)
• V3.3.4L4V (Same as V3.3.4L4 but should be used for VEIP profiles)
• V3.3.4L5rc1 - This version adds "auto-negotiation" capability to the stick. It always prefers 1G (to keep the stick consistently accessible). When you force the link to 2.5G (disabling auto-negotiation), it takes at least 40 seconds to establish the connection.
• V3.3.4L5V (Build date: 2024-02-26 14:05:05 VEIP firmware)
• V3.3.4L6 (Build date: 2024-06-27 16:43:48)
• V3.3.4L7 (Build date: 2025-05-19 17:26:03)

Useful files and binaries

Useful files

• /var/config/lastgood.xml - Contains the user portion of the configuration

• /tmp/omcilog - OMCI messages logs (must be enabeled, see below)

Useful binaries

• /etc/scripts/flash - Used to manipulate the config files in a somewhat safe manner
• xmlconfig - Used for low-level manipulation of the XML config files. Called by /etc/scripts/flash
• nv - Used to manipulate nvram storage, including persistent config entries via nv setenv/nv getenv
• omcicli - Used to interact with the running OMCI daemon
• omci_app - The OMCI daemon
• diag - Used to run low-level diagnostics commands on the stick

GPON ONU status

Getting the operational status of the ONU

diag gpon get onu-state

Querying a particular OMCI ME

# omcicli mib get MIB_IDX

The list of the MEs is in GPON MIB, and the most useful ones to check the provisioning received from the OLT are in Most useful MEs to check the provisioning.

To dump all the MEs at once^[1]:

for ME in 2 5 6 7 11 24 45 47 49 50 52 78 79 83 84 89 130 131 133 134 136 137 148 157 158 171 240 244 245 248 249 250 253 255 256 257 262 263 264 266 267 268 272 273 274 277 278 280 281 284 287 296 298 307 308 309 310 311 312 321 322 329 330 334 340 341 65282 65294 65408 65527 65528 65529 65530 65531; do echo "MIB: $ME"; omcicli mib get $ME; done

To dump the most useful MEs at once:

for ME in 6 7 11 84 131 171 256 257 262 263 264 277 309 329; do echo "MIB: $ME"; omcicli mib get $ME; done

Getting the GEM ports and the flows

# diag gpon show us-flow
============================================================
    GPON ONU MAC U/S Flow Status
Flow ID | GEM Port | Type | TCont
      0 |      263 |  ETH |     0
      1 |      264 |  ETH |     1
     64 |        2 | OMCI |    16
============================================================
# diag gpon show ds-flow

Getting the VLANs bridged by the stick

The L2 table shows the learned MAC addresses with their VLAN (Vid): if the internet traffic arrives untagged on the router, this is a way to find which VLAN is used on the PON side^[2].

# diag l2-table get entry address valid

On the RTL9601D (e.g. ODI DFP-34X-2C2) the valid parameter is not available, the table has to be read entry by entry:

i=0
while [ $i -lt 2047 ]; do
    diag l2-table get entry address $i | grep -q "LUT" && diag l2-table get entry address $i
    i=$((i+1))
done

Getting the port status and the bandwidth limits

# diag port get status port all
Port Status Speed    Duplex TX_FC RX_FC
---- ------ -----    ------ ----- -----
0    Up     1000M    Full   Dis   Dis
2    Up     1000M    Full   Dis   Dis
# diag bandwidth get egress port all
# diag bandwidth get ingress port all

Getting/Setting Speed LAN Mode

Note

Firmware version V3.3.4L4rc1 or higher is required. Before editing the speed make sure your hardware supports it. If you try to use any mode not listed here, the stick will default to mode 1.

To change the link mode use this command:

# /etc/scripts/flash get LAN_SDS_MODE
LAN_SDS_MODE=0
# /etc/scripts/flash set LAN_SDS_MODE 1

Value	cat /proc/kmsg	Mode	Behavior
1	<4>change mode to 1(Fiber 1G)	FIBER	1GbaseX with auto-neg on
8	<4>change mode to 8(HISGMII Force)	TP	2500baseT with auto-neg off

WARNING

A LAN_SDS_MODE not supported by the host makes the stick unreachable: the only way to restore it is the serial console.

GPON/OMCI settings

Getting/Setting ONU GPON Serial Number

# /etc/scripts/flash get GPON_SN
GPON_SN=TMBB00000000
# /etc/scripts/flash set GPON_SN TMBB0A1B2C3D

Getting/Setting ONU GPON PLOAM password

Info

The PLOAM password is stored in ASCII format

# /etc/scripts/flash get GPON_PLOAM_PASSWD
GPON_PLOAM_PASSWD=AAAAAAAAAA
# /etc/scripts/flash set GPON_PLOAM_PASSWD AAAAAAAAAA

Getting/Setting OMCI software version (ME 7)

Note

This needs the OMCI_OLT_MODE value to be set to 21. This will force the stick to use your own settings from the XML file, but this is a hack and causes sigsegv of /bin/checkomci.

# nv setenv sw_custom_version0 YOURFIRSTSWVER
# nv setenv sw_custom_version1 YOURSECONDSWVER

Getting/Setting OMCI hardware version (ME 256)

# /etc/scripts/flash get HW_HWVER
HW_HWVER=V2.0
# /etc/scripts/flash set HW_HWVER MYHWVERSION

Getting/Setting OMCI vendor ID (ME 256)

# /etc/scripts/flash get PON_VENDOR_ID  
PON_VENDOR_ID=ZTEG
# /etc/scripts/flash set PON_VENDOR_ID HWTC

Getting/Setting OMCI equipment ID (ME 257)

# /etc/scripts/flash get GPON_ONU_MODEL
GPON_ONU_MODEL=DFP-34X-2C2
# /etc/scripts/flash set GPON_ONU_MODEL DFP-34X-XXX

Getting/Setting OMCI OLT Mode and Fake OMCI

Configure how ONT Stick handle OMCI from OLT:

# /etc/scripts/flash get OMCI_OLT_MODE
OMCI_OLT_MODE=1
# /etc/scripts/flash set OMCI_OLT_MODE 2

Value	Note	OMCI Information
0	Default Mode	Stock setting, some values cannot be changed
1	Huawei OLT Mode	Huawei MA5671a
2	ZTE OLT Mode	ZTE
3	Customized Mode	Custom Software/Hardware Version, OMCC, etc...
21	Owerflow Mode	Custom Software/Hardware Version, OMCC, etc... (this is a hack and causes sigsegv of /bin/checkomci)

Some vendors/wholesale providers/ISPs have explicit LAN Port Number provisioning or proprietary OMCI that the stick cannot understand, this will make the stick reply OK to whatever the OLT sends it via OMCI.

0 = Disable, 1 = Enable, Default is 0

# /etc/scripts/flash get OMCI_FAKE_OK
OMCI_FAKE_OK=0
# /etc/scripts/flash set OMCI_FAKE_OK 1

Advanced settings

Setting management IP

# /etc/scripts/flash get LAN_IP_ADDR
LAN_IP_ADDR=192.168.2.1
# /etc/scripts/flash set LAN_IP_ADDR 192.168.1.1

Getting/Setting the L2 Bridge MTU

Note

Settings given via diag are not permanent after reboot

Getting/Setting the MTU of the L2 bridge

# diag switch get max-pkt-len port all 
Port Speed 
---------- 
0 1538 
2 2031 
# diag switch set max-pkt-len port all length 2000

Checking the currently active image

# nv getenv sw_active
sw_active=1
# nv getenv sw_version0
sw_version0=V1_7_8_210412
# nv getenv sw_version1
sw_version1=V1_7_8_210412

Booting to a different image

The firmware upgrade always writes the inactive image, so it is possible to go back to the previous firmware^[3]:

# nv setenv sw_commit 0|1
# nv setenv sw_active 0|1
# reboot

Modifying the firmware

Warning

A wrong rootfs makes the image unbootable: always flash the inactive image, so that the stick can still boot the other one, and keep a backup of all the partitions.

Transferring files from/to the stick

Run md5sum on the source and on the destination to make sure that the file has not been corrupted.

Via SSH, from the stick to the PC and vice versa:

ssh admin@192.168.1.1 "cat /dev/mtd5" > mtd5.bin
cat rootfs.new | ssh admin@192.168.1.1 "cat > /tmp/rootfs.new"

Via TFTP (a TFTP server must be running on the PC):

# tftp <PC IP>
tftp> get rootfs.new
tftp> put <filename> <directory>
tftp> q

Via netcat (nc on the stick does not exit at the end of the transfer: stop it with CTRL+C)^[4]:

# on the stick
nc -l -p 12345 > /tmp/rootfs.new
# on the PC
nc 192.168.1.1 12345 < rootfs.new

Info

On Windows run the commands from cmd (not PowerShell) and replace cat with type.

Extracting and repacking the rootfs

The rootfs is a SquashFS (LZMA) image: on the stick it is in r0 (/dev/mtd5) for the image 0 and in r1 (/dev/mtd7) for the image 1, while the kernel is in k0 (/dev/mtd4) and k1 (/dev/mtd6).

Warning

Run both commands as root, otherwise the rootfs image might be damaged.

# unsquashfs mtd5.bin
# mksquashfs squashfs-root rootfs.new -b 131072 -comp lzma -no-recovery

The RTL960x emulator runs the extracted firmware in QEMU (qemu-user-static) to modify and test it before flashing it: any file in its custom folder is copied over squashfs-root when leaving the chroot, and the custom startup scripts go in /etc/init.d/rc35.

Flashing a new rootfs

Check which image is running (nv getenv sw_active): flash mtd6/mtd7 if the image 0 is running, mtd4/mtd5 if the image 1 is running. The following commands flash a new rootfs to the image 1 and boot it:

# flash_eraseall /dev/mtd7
# cat /tmp/rootfs.new > /dev/mtd7
# nv setenv sw_version1 NEW_SOFTWARE_VERSION
# nv setenv sw_commit 1
# reboot

If cat fails with cat: write error: Invalid Argument, write the image to the block device instead:

# flash_eraseall /dev/mtd7
# cat /tmp/rootfs.new > /dev/mtdblock7

Repacking a firmware upgrade file

The firmware upgrade files of the ODM firmwares (e.g. V-SOL, T&W, ODI) are a tar containing the kernel (uImage), the rootfs, the fwu.sh upgrade script, the fwu_ver version file and the md5.txt checksums: after replacing the rootfs, update the checksums and repack it, then upload it from the Web GUI firmware upgrade page^[4:1]:

tar -xf firmware.tar
mv rootfs.new rootfs
md5sum fwu.sh rootfs uImage fwu_ver > md5.txt
tar -cvf ../firmware-mod.tar *

The Firmware_Mod folder of the RTL960x repository contains the community patches for the ODI DFP-34X-2C2, V-SOL V2801F and T&W TWCGPON657 (Bootstrap Web GUI, VLAN, speed and software version fixes).

Known Bugs

The stock firmware doesn't work at 2.5GbE. There is a new firmware provided by LeoLabs that fixes this issue. Sometimes, when connecting to a Huawei OLT and cloning another ONT using GPON_SN, the Leox ONT will report O5 status but won't actually get a proper connection. Workaround - set PON_VENDOR_ID to HWTC.

---

1. OMCI MIB, Anime4000/RTL960x https://github.com/Anime4000/RTL960x/blob/main/Docs/OMCI_CLI.md ↩︎

2. Diag, Anime4000/RTL960x https://github.com/Anime4000/RTL960x/blob/main/Docs/DIAG.md ↩︎

3. Firmware Partition, Anime4000/RTL960x https://github.com/Anime4000/RTL960x/blob/main/Docs/fw_part.md ↩︎

4. Modify firmware, Anime4000/RTL960x https://github.com/Anime4000/RTL960x/blob/main/Docs/Modify_Firmware.md ↩︎ ↩︎