Secrets of the JDSU (Now Viavi) HST-3000

[kc7gr-15]

This post is aimed mainly at those who are into telephony (both POTS and digital) and other telecommunications modes, such as T1/T3, though it will also cover some of the network-testing capabilities of the HST3K. JDSU, according to the unit's data sheet, described it as a "Triple-Play Network Access Tester" and it certainly seems to live up to that. Even its product name contains a hint (HST = Handheld Services Tester).

It's my hope the info offered here will help keep the instruments useful (at least to hobbyists) far beyond its 2018 discontinuance.

SO WHAT IS IT?

In short: This is a multifunction test set designed to handle, depending on which module's plugged in and which software options are enabled, just about any kind of standard testing for copper POTS lines, SIP-based VoIP, T1/T3 circuits, DSL/ADSL/VDSL, Ethernet (fiber and copper), BERT (Bit Error Rate Testing) and TIMS (Transmission Impairment Measuring Set).

THE GUTS AND THE OPTIONS

Viavi does still support these units as of the date of this post, at least for calibration and best-effort repairs, but they never published any publicly-available data on what goes on in the guts of the thing. So, after having been (somewhat rudely) told, "Oh, we don't allow our end users command-line access" I decided to do a little digging of my own.

The unit (at least for the only hardware revision worth messing with, the ACE-II) runs on an Intel PXA270 series CPU clocked at around 500MHz. It uses a Spansion 29GL01GP13 FLASH memory chip to hold its firmware, and a Dallas/AD DS2433 One-Wire EEPROM (8-pin SOIC) to hold version and option info (which is preserved across firmware updates).

It's OS is a shrunken-down Linux core, using Busybox to conserve memory space. All HST-3000's come with a base unit Ethernet port which shares duties between circuit testing and remote access. See page 14 in the Base Unit User's Guide (attached).

The Linux CLI in the unit can be easily accessed by:

• Assigning an IP address to the base unit's Ethernet port, either manually or through DHCP.
• Establish a standard Telnet connection to whatever IP the unit got assigned on your network.
• At the login prompt, give it the user name root and the password is phantom4
• Explore to your heart's content, but, if you value your unit, be bloody careful about changing anything! I have no idea what will happen if you damage the base OS, nor do I have any idea how to recover it -- outside of unsoldering the BGA FLASH chip from a known-working unit, reading it, copying that load into another chip and re-soldering it to the target unit's board!

As far as digging into the hardware goes, have a look at the photos SplitView and 1-wire. In SplitView, you can see there are six machine screws which need to be removed (from the back) to get the thing open. You may have to do some gentle prying, along the perimeter, since the units are weatherproofed with silicone sealant at the factory, but they separate pretty easily once the stuff gives.

SplitView shows the front cover and display assembly on the left, CPU and mezzanine boards in the base unit on the right. Note the unused socket on the backside of the keypad PCB. I'm told this was to accommodate an optional 802.11 WiFi card, though darned if I've ever seen one in that form factor. There's also another version of the front assembly (see the photo bt) which has Bluetooth hardware. Note that it was either one or the other with these sets. I've never heard of, or seen, one with both WiFi and Bluetooth.

Take a closer look at the base unit on the right. Specifically, the photo 1-wire zooms in on the Dallas 2433 chip. To enable all available options, it's best to desolder this one from the board and manipulate its contents with a device programmer (I made use of the Reveltronics Revelprog IS).

Here's the best news: To enable everything, you only have to change ONE byte in the EEPROM. Specifically, at address 0x2C, you'll usually find the hex byte 0D. Change this to anything you want, from 00 to FF (I prefer 42, just to be silly), reprogram the chip and solder it back in. You're good to go!

There is, however, a caveat: Enabling all the software options does not magically make the test set do things it doesn't have the hardware to do. As one example, they don't all come with copper testing capability. While you can certainly turn on options like 'Copper Expert' in software, it won't change a thing if the proper mezzanine board (to actually execute those tests) isn't installed.

Another example is the 802.11 WiFi. I've yet to see a unit which is equipped with the radio module to handle that. It won't hurt anything if the option's enabled in the software, but neither will it start trying to use the nearest WiFi access point if the radio's missing.

I welcome questions or comments. I have a lot more information on these units than I had room to post here.

Happy tweaking.

[BTO]

Hi mate,
I realize its been a while since you posted this topic

Now, you and me seem to have a lot in common

1. Both interested in Electronics
2. Both Liney's  (Difference being, You're in the U.S.A. , I'm in Australia)
3. However, i think it is JUST that advantage that we need when dealing with JDSU and VIAVI

I understand why no one has replied to you, i mean how often do you get a Telecomm's linesman showing up HERE of all places.
then, How many of them actually give a stuff to know this stuff?   Not often i can tell you that.

Now, a bit of background on me
I'm 50,  Been in electronics since i was 6 and it all went from there.
I'm a Telstra Linesman (ISGM) From back in the day before Dial Up came in.
Back when we were working with the LTS-2 , Aegis CZ-3000 MkII and then III , the P.E.T. 's and all that.

Here in Australia, we have the P.O.T.S network as well, we had the C.A.N. (Customer Access Network) and the I.E.N. (Inter Exchange Network), not sure if you called them the same thing in the states. although it looks like we both carried over the POTS thing.
all those acronyms come from the P.M.G (Post Master General) Days,  but again... PMG is an Australian thing to my knowledge.

so mate...
Are you still into this JDSU HST-3000 Unlocking thingy ?
I don't have a HST-3000   ALTHOUGH
i do have ONX-580's
And  ONX-620

Now.. I'm wondering if... All the options get unlocked in the same way that they do on the HST-3000
i have a ONX-580 that was purchased from the states (Kentucky) i think it was
from a pawn broker that wanted to get rid of it ,
Later it was revealed by the company that owned the meter (and i found this out by contacting viavi) that the meter was ISSUED by not given
to an employee of that company

it seems he left the platform and took the meter with him and sold it to a pawn shop.
the company then locked the meter from Strata sync
I'm told from viavi that this lock cannot be removed unless the strata sync account holder removes it

NOW... i also have a strata sync account
and... i know that if i'm able to sync it with my strata sync i can unlock it, TAKE OWNERSHIP in strata sync and it's done

Now i did contact the company , to be fair
spoke to this bloke, can't remember his name, we were in contact and then he left the company, they haven't answered since.

for what i figure.. the meter is mine
and it'd be nice if they unlocked it since i paid for it

now they did say , they'd buy the meter off me for the price that i paid for it.. which is fine.
but then they didn't answer the calls anymore,
i told them
either i give the meter back to you and you reimburse me
or
i keep the meter and you unlock it from your end

they did neither.
so... i figure we can have fun unlocking this thing
and i have several ONX-620

so.. Are you still interested in all this.
I've pulled them all apart, i have photo's
I've looked into JTAG  (However my dad passed and that got put on hold)

I repair Telecomm's electronics for the tech's so i'm very familiar with the inner workings of these things.
it's funny, even calibration is all done in software,   there aren't even POTS that you can adjust to do a CAL

i'd be really interested to do a few things
the first thing would be ,   you know when it boots up with the viavi logo,
i would like to put a  METALLICA - MASTER OF PUPPETS ALBUM Photo on that screen     LOL
or perhaps a business logo   i imagine it'd be a matter of changing the jpeg currently in their

so what are your thoughts mate ?
Also i think it's good having someone in the states that knows this stuff as well, God knows like i feel like i'm the only one here in Australia that knows this stuff.

[kc7gr-15]

Actually, I've done a bit of experimenting with the ONX580 myself. The 'yank the EEPROM' trick does NOT work with it, which tells me Viavi became aware of the bug in the HST's and took steps to correct it in the new instruments.

With that said -- I have discovered, by comparing the two ONX580's I've been able to get hold of so far, that the only difference in their EEPROM contents is a 12-byte long hex string. Since they have different options enabled, I have assumed this string controls said options. I don't think it has anything to do with the instrument's serial number, since I also think Viavi started using the MAC address for that.

I'm hoping to pick back up with it either later this year or May of next year (when I finally retire from my day job).

I'm very much surprised by what you experienced, though. I had no idea it was even possible to lock an instrument up remotely. That's disturbing, and I will make it a point to make sure never to connect to anything other than my own equipment if I decide to play with StrataSync.

I would be very curious to see the contents of the EEPROM in your unit. Do you have the capability to safely unsolder the EEPROM and read it in a device programmer? I could also try sending you the BIN file of my known-working EEPROM to try programming into yours, see if it'll kill the lockout.

No matter what happens, rest assured you're not alone in this. I firmly believe in the first-sale doctrine of 'you bought it, you own it, you can do whatever you bloody well want to with it.'

Happy tweaking.

[johnmosborneuk]

Thank-you for this, I've finally got the VoIP features on my HST-3000 and deleted all the custom scripts from the previous telco which were no good to me

I did have an issue with mine; after I changed the magic byte to FF and reassembled the unit, it all booted fine with the features enabled however after I shut it down it wouldn't start up again (it looked dead, power switch didn't work at all).  I thought that it must by a dodgy solder joint on the EEPROM as that was the only thing I'd touched so reflowed it but still dead

Out of desperation I briefly shorted the onboard backup battery to clear the NVRAM and the unit booted up again...but just the once, again after a shutdown the unit was dead.

I tried shorting the battery again, this time after boot up I done a factory reset and the unit has been fine since then.

I also got the 802.11 WiFi working but with one big caveat that it only supports a handful of USB WiFi dongles and they're all 802.11G

The Base manual states "To use the wireless features, you must have an external 802.11 adapter (“dongle”)." after poking through the file system I found modules.alias and noticed all the USB vendor strings for the "rt73usb" driver.

I got hold of a Linksys WUSB54GC which works perfectly.

Here is a list of the USB WiFi devices listed in the modules.alias, I hope it helps someone else:

It's also worth mentioning that some manufacturers (Linksys, D-Link and Belkin come to mind) often use the same model numbers but use different chipsets so the version numbers are important too.

Code: [Select]

VID_0586&PID_3415 ZyXEL Communications Corp. G-210H
VID_0CDE&PID_001C Z-Com 802.11b/g Wireless Network Adapter
VID_2019&PID_AB50 GW-US54Mini2
VID_2019&PID_AB01 GW-US54HP
VID_0471&PID_200A Philips (or NXP) Wireless Network Adapter
VID_6933&PID_5001 (Vendor name unknown) (Device name unknown)
VID_0769&PID_31F3 Surecom Technology Corp. RT2573
VID_0DF6&PID_9712 Sitecom Europe B.V. WL-113 rev 2 Wireless Network USB Adapter
VID_0DF6&PID_90AC Sitecom Europe B.V. WL-172 Wireless Network USB Adapter 54g Turbo
VID_0DF6&PID_002F Sitecom Europe B.V. (Device name unknown)
VID_0DF6&PID_0027 Sitecom Europe B.V. (Device name unknown)
VID_0DF6&PID_0024 Sitecom Europe B.V. (Device name unknown)
VID_1740&PID_7100 Senao (Device name unknown)
VID_04E8&PID_4471 Samsung Electronics Co., Ltd (Device name unknown)
VID_18E8&PID_6238 Qcom (Device name unknown)
VID_18E8&PID_6229 Qcom RT2573
VID_18E8&PID_6196 Qcom RT2573
VID_148F&PID_2671 Ralink Technology, Corp. RT2601/RT2671 Wireless Adapter
VID_148F&PID_2573 Ralink Technology, Corp. RT2501/RT2573 Wireless Adapter
VID_04BB&PID_093D I-O Data Device, Inc. (Device name unknown)
VID_0DB0&PID_A874 Micro Star International RT2573
VID_0DB0&PID_A861 Micro Star International RT2573
VID_0DB0&PID_6874 Micro Star International RT2573
VID_0DB0&PID_6877 Micro Star International RT2573
VID_13B1&PID_0028 Linksys WUSB200 802.11g Adapter [Ralink RT2671]
VID_13B1&PID_0023 Linksys WUSB54GR
VID_13B1&PID_0020 Linksys WUSB54GC v1 802.11g Adapter [Ralink RT73]
VID_06F8&PID_E020 Guillemot Corp. (Device name unknown)
VID_06F8&PID_E010 Guillemot Corp. HWGUSB2-54-LB
VID_1472&PID_0009 Huawei-3Com Aolynk WUB320g
VID_1044&PID_800A Chu Yuen Enterprise Co., Ltd GN-WI05GS
VID_1044&PID_8008 Chu Yuen Enterprise Co., Ltd GN-WB01GS
VID_15A9&PID_0004 Gemtek WUBR-177G [Ralink RT2571W]
VID_1740&PID_3701 Senao EUB-3701 EXT 802.11g Wireless Adapter [Ralink RT2571W]
VID_7392&PID_7618 Edimax Technology Co., Ltd (Device name unknown)
VID_7392&PID_7318 Edimax Technology Co., Ltd (Device name unknown)
VID_07D1&PID_3C07 D-Link System DWA-110 Wireless G Adapter(rev.A1) [Ralink RT2571W]
VID_07D1&PID_3C06 D-Link System DWA-111 802.11bg Wireless Adapter [Ralink RT2571W]
VID_07D1&PID_3C04 D-Link System WUA-1340
VID_07D1&PID_3C03 D-Link System AirPlus G DWL-G122 Wireless Adapter(rev.C1) [Ralink RT2571W]
VID_07AA&PID_002E Corega K.K. CG-WLUSB2GPX [Ralink RT2571W]
VID_14B2&PID_3C22 Ralink Technology, Corp. Conceptronic C54RU v3 802.11bg Wireless Adapter [Ralink RT2571W]
VID_1371&PID_9032 CNet Technology Inc. CWD-854 rev F
VID_1371&PID_9022 CNet Technology Inc. CWD-854 [RT2573]
VID_0411&PID_0119 BUFFALO INC. (formerly MelCo., Inc.) (Device name unknown)
VID_0411&PID_0116 BUFFALO INC. (formerly MelCo., Inc.) (Device name unknown)
VID_0411&PID_00F4 BUFFALO INC. (formerly MelCo., Inc.) (Device name unknown)
VID_0411&PID_00D8 BUFFALO INC. (formerly MelCo., Inc.) WLI-U2-SG54HP
VID_08DD&PID_0120 Billionton Systems, Inc. (Device name unknown)
VID_1631&PID_C019 Good Way Technology RT2573
VID_050D&PID_905C Belkin Components F5D9050 Wireless G+ MIMO Network Adapter v4000 [Ralink RT2573]
VID_050D&PID_905B Belkin Components F5D9050 Wireless G+ MIMO Network Adapter v3000 [Ralink RT2573]
VID_050D&PID_705A Belkin Components F5D7050 Wireless G Adapter v3000 [Ralink RT2571W]
VID_050D&PID_7050 Belkin Components F5D7050 Wireless G Adapter v1000/v2000 [Intersil ISL3887]
VID_0B05&PID_1724 ASUSTek Computer, Inc. RT2573
VID_0B05&PID_1723 ASUSTek Computer, Inc. WL-167G v2 802.11g Adapter [Ralink RT2571W]
VID_1690&PID_0722 Askey Computer Corp. [hex] RT2573
VID_18C5&PID_0002 AMIT Technology, Inc. CG-WLUSB2GO
VID_0EB0&PID_9021 NovaTech RT2573
VID_148F&PID_9021 Ralink Technology, Corp. RT2501USB Wireless Adapter
VID_14B2&PID_3C10 Ralink Technology, Corp. (Device name unknown)
VID_07B8&PID_B21F AboCom Systems Inc WUG2700
VID_07B8&PID_B21E AboCom Systems Inc RT2573
VID_07B8&PID_B21D AboCom Systems Inc RT2573
VID_07B8&PID_B21C AboCom Systems Inc RT2573
VID_07B8&PID_B21B AboCom Systems Inc HWU54DM