Hardware Specifications

Once you access the stick via ssh you will be presented with a second tier login. The credentials to access the zyxel shell are: username: twmanu , password: twmanu. From the Zyxel shell you can move to a standard Linux shell using the linuxshell command

Serial

The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. It’s near the SFP header. TX, RX and ground pads need to be connected to a USB2TTL adapter supporting 3V3 logic.

Firmware is interchangeable with:

• Halny HL-GSFP
• D-LINK DPN-100-Rev-A2
• Ziza OP151s
• T&W TW2362H-CDEL

List of software versions

• V1.00(ABVJ.0)b3s (2020)
• V1.00(ABVJ.0)b3i (2020)
• V1.00(ABVJ.0)b3v
• V2.50(ABVJ.0)b1b (2022)
• V2.50(ABVJ.1)b1d (2023)

List of partitions

This stick supports dual boot, as visible from the presence of ImageA and ImageB, which contain the rootfs.

Useful files and binaries

Useful files

• /var/config/ont.sys - Used to customize various settings on the stick. If you don’t have it you can copy the stock one from /ont.sys

General Settings and Useful Commands

GPON ONU status

Getting the operational status of the ONU

To check the connection status, use the following command:

linuxshell
onu ploamsg

curr_state=5 for O5 state, curr_state=1 for all other operational states.

Getting Speed LAN Mode

This SFP has HSGMII enabled by default: link_status=5 for HSGMII 2.5Gbit, link_status=4 for SGMII 1Gbit:

linuxshell
onu lanpsg 0

Setting Speed LAN Mode

hal
set speed 2.5g mode full

Querying a particular OMCI ME

Query via OMCI ME Class Name:

omci
show me classname OmciClassName (e.g Ont2g)

Query via OMCI ME ID:

omci
show me classid OmciClassId (e.g 7)

GPON/OMCI settings

Setting ONU GPON Serial Number

manufactory
set sn ALCLf0f0f0f0
exit
hal
set sn ALCLf0f0f0f0

Do not worry if one of the two commands results missing, the change is still applied with just one of them.

Setting ONU GPON PLOAM password

This can be done easily via the web UI. To do it via the shell use:

hal
set password PLOAMPASS

Setting OMCI software version (ME 7)

Edit /var/config/ont.sys via vi directly on the stick itself. The file is CRLF terminated, one entry per line. The entries for the software version are:

SW_VER0:0xabcdef
SW_VER1:0xabcedf

Setting OMCI hardware version (ME 256)

manufactory
set hardware version 3FE49165BFAA01

If the above command is missing you can edit /var/config/ont.sys via vi directly on the stick itself. The file is CRLF terminated, one entry per line. The entry for the hardware version is:

ONTG_VER:0x463630303556362e300000000000

The hardware version must be encoded in hex format and right padded to 28 characters with 0 (excluding the starting 0x) to avoid any spurious values.

Setting OMCI equipment ID (ME 257)

manufactory
set equipment id MYEQUIPMENTID
exit
omci
equipment id MYEQUIPMENTID

If any of the above commands is missing you can edit /var/config/ont.sys via vi directly on the stick itself. The file is CRLF terminated, one entry per line. The entry for the equipment id is:

ONTG_EQID:0x463630303556362E30000000000000000000000

The equipment id must be encoded in hex format and right padded to 39 characters with 0 (excluding the starting 0x) to avoid any spurious values.

Advanced settings

Resetting Web GUI admin credentials

Under certain circumstances, the Web GUI admin credentials might get changed from the default admin/1234 combination. To restore the default combination try following this method.

Creating a new rootfs

The stick has a tricky image packing method, fortunately it has been reverse engineered. A script to help you create a custom rootfs can be found here: https://github.com/hack-gpon/zyxel-pmg-3000-mod-kit

Flashing a new rootfs

• Transfer the new mtd on the stick via tftp:

  linuxshell
  tftp -gr mtd2.mod.bin TFTP_SERVER_IP
  

• Flash it on the standby partition. You can use system and then show actimage to get the current active image. Check /proc/mtd for the right mtds. Usually:
• if the currect active image is A, mtd2 is in use
• If the current active image is B, mtd3 is in use

  linuxshell
  mtd -e /dev/mtd2 write /tmp/mtd2.mod.bin /dev/mtd2
  

• Switch to the new image:

  system
  set actimage a
  

• Reboot the ONT:

  system
  reboot
  

EEPROM (I2C slave simulated EEPROM)

The Zyxel PMG3000-D20B does not have a physical EEPROM, the Falcon SOC emulates an EEPROM by exposing it on the I2C interface as required by the SFF-8472 specification.

On the I2C interface, two memories of 256 bytes each will be available at the addresses 1010000X (A0h) and 1010001X (A2h).

The Zyxel PMG3000-D20B stores the content of the emulated EEPROM1 (A2h) in /tmp/config/sfp_eeprom1 to restore it after a reboot.

EEPROM0 layout

EEPROM1 layout

Known Bugs

• Works with Broadcom BCM57810S only after solder mod
• Issue on IPv6 discovery. Not certain whether it is a edge case of a particular ISP or not
• Some sticks have a custom password
• On V2.5 the Lantiq SDK has been updated from 6.4.2 to 7.5.1, breaking upload performance

Miscellaneous Links

• Zyxel gpon-sfp
• Zyxel PMG-3000 mod kit
• Rollback SFP Zyxel con il W3 HUB per risolvere il problema dell’upload cappato