Hardware Specifications

Once you access the stick via ssh you will be presented with a second tier login. The credentials to access the zyxel shell are: username: twmanu , password: twmanu. From the Zyxel shell you can move to a standard Linux shell using the linuxshell command

Serial

The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. It’s near the SFP header. TX, RX and ground pads need to be connected to a USB2TTL adapter supporting a logic level of 3.3V.

Firmware is interchangeable with:

• Halny HL-GSFP
• D-LINK DPN-100-Rev-A2
• Ziza OP151s
• T&W TW2362H-CDEL

List of software versions

• V1.00(ABVJ.0)b3s (2020)
• V1.00(ABVJ.0)b3i (2020)
• V2.50(ABVJ.0)b1b (2022)
• V2.50(ABVJ.1)b1d (2023)

List of partitions

This stick supports dual boot, as visible from the presence of ImageA and ImageB, which contain the rootfs.

Useful files and binaries

Useful files

• /var/config/ont.sys - Used to customize various settings on the stick. If you don’t have it you can copy the stock one from /ont.sys

General Settings and Useful Commands

GPON ONU status

Get the operational status of the ONU

To see the connection state use the following command:

linuxshell
onu ploamsg

curr_state=5 for O5 state, curr_state=1 for all other operational states.

Getting Speed LAN Mode

This SFP has HSGMII enabled by default: link_status=5 for HSGMII 2.5Gbit, link_status=4 for SGMII 1Gbit:

linuxshell
onu lanpsg 0

Setting Speed LAN Mode

hal
set speed 2.5g mode full

Querying a particular OMCI ME

Query via OMCI ME Class Name

omci
show me classname OmciClassName (e.g Ont2g)

Query via OMCI ME ID

omci
show me classid OmciClassId (e.g 7)

GPON/OMCI settings

Setting ONU GPON Serial Number

manufactory
set sn ALCLf0f0f0f0
exit
hal
set sn ALCLf0f0f0f0

Do not worry if you’re missing one of the two commands, the change is still applied with just one of them.

Setting ONU GPON PLOAM password

This can be done easily via web ui. If you prefer to do it via the shell use:

hal
set password PLOAMPASS

Setting OMCI software version (ME 7)

Edit /var/config/ont.sys via vi directly on the stick itself. The file is CRLF terminated, one entry per line. The entries for the software version are:

SW_VER0:0xabcdef
SW_VER1:0xabcedf

Setting OMCI hardware version (ME 256)

manufactory
set hardware version 3FE49165BFAA01

If the above command is missing you can edit /var/config/ont.sys via vi directly on the stick itself. The file is CRLF terminated, one entry per line. The entry for the hardware version is:

ONTG_VER:0x463630303556362e300000000000

The hardware version must be encoded in hex format and right padded to 28 characters with 0 (excluding the starting 0x) to avoid any spurious values.

Setting OMCI equipment ID (ME 257)

manufactory
set equipment id MYEQUIPMENTID
exit
omci
equipment id MYEQUIPMENTID

If any of the above commands is missing you can edit /var/config/ont.sys via vi directly on the stick itself. The file is CRLF terminated, one entry per line. The entry for the equipment id is:

ONTG_EQID:0x463630303556362E30000000000000000000000

The equipment id must be encoded in hex format and right padded to 39 characters with 0 (excluding the starting 0x) to avoid any spurious values.

Advanced settings

Reset Web Gui admin credentials

Sometimes, under certain circumstances, the Web Gui admin credentials might get changed from the default admin/1234 combination. To restore the default combination you can try following this method.

Creating a new rootfs

The stick has a tricky image packing method, fortunately it has been reverse engineered. A script to help you create a custom rootfs can be found here: https://github.com/nanomad/zyxel-pmg-3000-mod-kit

Flashing a new rootfs

• Transfer the new mtd on the stick via tftp

  linuxshell
  tftp -gr mtd2.mod.bin TFTP_SERVER_IP
  

• Flash it on the standby partition. You can use system and then show actimage to get the current active image. Check /proc/mtd for the right mtds. Usually:
• if the currect active image is A the mtd in use is mtd2
• If the current active image is B the mtd in use is mtd3

  linuxshell
  mtd -e /dev/mtd2 write /tmp/mtd2.mod.bin /dev/mtd2
  

• Switch to the new image

  system
  set actimage a
  

• Reboot the ONT

  system
  reboot
  

EEPROM (I2C slave simulated EEPROM)

The Zyxel PMG3000-D20B does not have a physical EEPROM, the Falcon SOC emulates an EEPROM by exposing it on the I2C interface as required by the SFF-8472 specification.

On the I2C interface there will be two memories of 256 bytes each at the addresses 1010000X (A0h) and 1010001X (A2h).

The Zyxel PMG3000-D20B stores the content of the emulated EEPROM1 (A2h) in /tmp/config/sfp_eeprom1 to restore it after a reboot.

EEPROM0 layout

EEPROM1 layout

Known Bugs

• Not working with Broadcom BCM57810S
• Issue on IPv6 discovery. But we are not sure if is a edge case of a particular ISP or not
• Some sticks have a custom password
• On V2.5 the Lantiq SDK has been updated from 6.4.2 to 7.5.1, but breaking upload performance

Miscellaneous Links

• Zyxel gpon-sfp
• Zyxel PMG-3000 mod kit
• Rollback SFP Zyxel con il W3 HUB per risolvere il problema dell’upload cappato