[Jaylouisw]

Summary

Documents the firmware of the Adtran SDX 611 from a verified full-chip read of its 16 MB SPI NOR
(CH341A + SOIC-8 clip, ONT unpowered, programmer verify pass).

Firmware analysed: GRO100_ADTRAN611V2 V2.2.9.11 (V1.0.0(V2.2.9.11)), rootfs built 2022-11-12.

Same page, same file, one commit — it adds a # Firmware section to ont/ont-adtran-sdx-611.md.

What's added

• Recovered mtdparts — the layout is not in the environment; it is compiled into the compressed
  U-Boot stage (LZMA uImage at 0x15F40, decompressed to 0x81C00000):

  mtdparts=rtk_spi_nor_mtd:%dk(Boot),%dk(Env),%dk(ImageA),%dk(ImageB),%dk(Config),%dk(SECTION_EGIS),%dk@%dk(rootfs)
  rootfstype=squashfs console=ttyS0,115200 softMode=%s ACTIVE=%c chiptype=RTL9601D
  

• Flash map table (offset / size / mtd / content) with in-region offsets for the vendor header,
  the kernel uImage and both squashfs images. The named sizes tile exactly to 0xF40000 of the
  16 MiB, which is what makes those boundaries measured rather than guessed.

• Bootloader environment verbatim, with the reference placeholder ethaddr=00:11:22:33:44:66
  called out — unit identity lives in SECTION_EGIS, not in the environment.

• Boot chain, and the U-Boot console commands that rewrite the flash (bootdelay=3, tw_boot,
  update kernel and rootfs by tar|vmimg).

• Root filesystem notes: root shell on serial with no login prompt; S50telnetd is an empty stub
  (this is what lets the Telnet row above be filled in as unavailable); S02mountconfig erases and
  remounts the Config partition if the mount fails; S95startssp takes the password from
  /etc/default/passwd; S04boardinfoinit/S40network select the 1G/2.5G port map from the egis
  product code; the dropbear host keys are baked into the read-only squashfs, so they are identical
  across every unit of this build.

• Config partition contents (JFFS2, 4 KiB erase blocks) and the MIBT / adtran_6010 OMCI MIB
  layout.

• Anomalies: the redundant U-Boot environment sector reads back 0x00 rather than 0xFF, and the
  flash tail is a mix of erased and zeroed sectors.

• # Credits — this page is credited in full to its author.

Notes for reviewers

• The credit block is intentional, not noise. The file started as an empty template (4c6e00e,
  2022) and every substantive revision is the contributor's own work — a5214f4 (2026-01-19) and
  1c0c8ef ("Add Adtran SDX 611 hardware specifications and teardown photos", PR Add Adtran SDX 611 hardware specifications and teardown photos #448,
  2026-04-08), which is where the specifications, teardown, photos, chip identification and serial
  pinout came from. The # Credits section therefore credits the whole page, following the precedent
  of the # Credits block on ont/ont-sercomm-fg1000b.md.
• No unit identifiers. The GPON serial and MAC are not published: the page documents the field
  layout and offsets in SECTION_EGIS / omcimib.conf and leaves the values out, since they belong to
  one subscriber's line. Nothing sensitive is in the diff, the commit message or this PR text.
• One inferred value, flagged on the page. The SECTION_EGIS extent (0xF40000 + 768 KiB) comes
  from the JFFS2 cleanmarker boundary at that offset, because the mtdparts sizes are substituted at
  runtime (%dk). The page says so.
• Only proven cells changed. The Telnet row was filled in because the empty S50telnetd init stub
  proves the service is not started; SSH / Web GUI / RAM were left blank because the dump does not
  settle whether they are enabled on a provisioned line.
• ImageA and ImageB are byte-identical in this build (same kernel SHA-256, same squashfs
  bytes_used), so the second bank is a recovery copy, not an A/B firmware pair — noted on the page so
  nobody goes looking for a difference.
• Commit message follows the repo's plain-imperative style rather than a type(scope): prefix, since
  the history has no conventional-commit convention. Content is original work on the contributor's own
  hardware and is contributed under the project license, per the legal notice in CONTRIBUTING.md.

Testing

Renders as markdown in the site's dialect (VitePress): ::: warning Note containers, plain markdown
tables and a fenced text block, all constructs already in use on this page and elsewhere in the repo.
Front matter untouched; the new section is an H1 inserted before # Miscellaneous Links.

[Copilot]

Note

Copilot was unable to complete this review at the selected tier due to model policy or plan restrictions.

🟢 Approval recommended

The changes add comprehensive firmware/flash/boot-chain documentation based on a verified SPI NOR dump, and the only feedback noted is minor consistency nits with no active issues raised.

No open issues 🎉

What changed in this PR

This pull request enhances the Adtran SDX 611 ONT documentation with a new Firmware section derived from a verified 16 MiB SPI NOR dump, detailing the device’s flash layout, boot chain, U-Boot environment, and filesystem/config-partition observations for reproducible analysis and recovery work.

Changes:

• Adds recovered mtdparts, a flash map (offset/size/content), and boot chain/U-Boot console notes.
• Documents rootfs and config partition behavior/contents, plus observed flash/env anomalies.
• Updates access-method notes (e.g., Telnet marked unavailable due to stubbed service) and adds contributor credits.

File	Summary
ont/​ont-adtran-sdx-611.md	Adds comprehensive firmware/flash/boot-chain documentation, rootfs/config notes, anomalies, and credits; includes minor consistency nits (paths/terminology/units/table units).

This pull request is ready to be approved.

_{Review effort: Balanced}