1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
|
---
title: Zyxel PMG3000-D20B
has_children: false
layout: default
parent: Zyxel
---
# Hardware Specifications
| | |
| ---------------- | ---------------------------------------------------------- |
| Vendor/Brand | Zyxel |
| Model | PMG3000-D20B |
| ODM | T&W |
| ODM Product Code | TW2362H-CDEL |
| Chipset | Lantiq PEB98035 |
| Flash | 8 MB |
| RAM | 64 MB |
| CPU | MIPS 34Kc interAptiv |
| CPU Clock | 400MHz |
| System | eCoS |
| HSGMII | Yes |
| Optics | SC/APC |
| IP address | 10.10.1.1 |
| Web Gui | ✅ username `admin` or `guest`, password `1234` or `guest` |
| SSH | ✅ username `admin`, password `admin` |
| Telnet | |
| Serial | ✅ |
| Serial baud | 115200 |
| Serial encoding | 8-N-1 |
| Form Factor | miniONT SFP |
{% include image.html file="pmg3000-d20b.png" alt="PMG3000-D20B" caption="PMG3000-D20B" %}
{% include image.html file="tw236h-cdel-th.jpg" alt="PMG3000-D20B Teardown" caption="PMG3000-D20B Teardown" %}
{% include image.html file="tw236h-cdel-th-back.jpg" alt="PMG3000-D20B Teardown" caption="PMG3000-D20B Teardown" %}
Once you access the stick via ssh you will be presented with a second tier login. The credentials to access the zyxel shell are: username: `twmanu` , password: `twmanu`.
From the Zyxel shell you can move to a standard Linux shell using the `linuxshell` command
## Serial
The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the top surface. It's near the SFP header. TX, RX and ground pads need to be connected to a USB2TTL adapter supporting 3V3 logic.
{% include image.html file="tw236h-cdel-serial.jpg" alt="PMG3000-D20B Serial Pinout" caption="PMG3000-D20B Serial Pinout" %}
{% include alert.html content="Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work." alert="Note" icon="svg-warning" color="yellow" %}
## Firmware is interchangeable with:
- [Halny HL-GSFP](/ont-halny-hl-gsfp)
- [D-LINK DPN-100-Rev-A2](/ont-d-link-dpn-100-rev-a2)
- [Zisa OP151s](/ont-zisa-op151s)
- [T&W TW2362H-CDEL](/ont-t-w-tw2362h-cdel)
## List of software versions
- V1.00(ABVJ.0)b3s (2020)
- V1.00(ABVJ.0)b3i (2020)
- V1.00(ABVJ.0)b3v
- V2.50(ABVJ.0)b1b (2022)
- V2.50(ABVJ.1)b1d (2023)
## List of partitions
| dev | size | erasesize | name |
| ---- | -------- | --------- | -------------- |
| mtd0 | 00060000 | 00010000 | "Boot" |
| mtd1 | 00010000 | 00010000 | "Env" |
| mtd2 | 00390000 | 00010000 | "ImageA" |
| mtd3 | 00390000 | 00010000 | "ImageB" |
| mtd4 | 00060000 | 00010000 | "Config" |
| mtd5 | 00010000 | 00010000 | "SECTION_EGIS" |
| mtd6 | 00250000 | 00010000 | "rootfs" |
| mtd7 | 00020000 | 00010000 | "rootfs_data" |
This stick supports dual boot, as visible from the presence of `ImageA` and `ImageB`, which contain the rootfs.
# Useful files and binaries
## Useful files
- `/var/config/ont.sys` - Used to customize various settings on the stick. If you don't have it you can copy the stock one from /ont.sys
# General Settings and Useful Commands
{% include alert.html content="All commands start from the twmanu shell." alert="Note" icon="svg-info" color="blue" %}
# GPON ONU status
## Getting the operational status of the ONU
To check the connection status, use the following command:
```
linuxshell
onu ploamsg
```
`curr_state=5` for O5 state, `curr_state=1` for all other operational states.
## Getting Speed LAN Mode
This SFP has HSGMII enabled by default: `link_status=5` for HSGMII 2.5Gbit, `link_status=4` for SGMII 1Gbit:
```
linuxshell
onu lanpsg 0
```
## Setting Speed LAN Mode
{% include alert.html content="This command forces the speed to 2.5 and is instantaneous and permanent, use it only if your hardware supports HSGMII and is compatible (e.g. modified Broadcom 57810s NIC)" alert="Note" icon="svg-warning" color="red" %}
```sh
hal
set speed 2.5g mode full
```
## Querying a particular OMCI ME
Query via OMCI ME Class Name:
```sh
omci
show me classname OmciClassName (e.g Ont2g)
```
Query via OMCI ME ID:
```sh
omci
show me classid OmciClassId (e.g 7)
```
# GPON/OMCI settings
## Setting ONU GPON Serial Number
{% include alert.html content="The S/N is stored in the ASCII format." alert="Note" icon="svg-info" color="blue" %}
```sh
manufactory
set sn ALCLf0f0f0f0
exit
hal
set sn ALCLf0f0f0f0
```
Do not worry if one of the two commands results missing, the change is still applied with just one of them.
## Setting ONU GPON PLOAM password
{% include alert.html content="The PLOAM password is stored in the ASCII format." alert="Note" icon="svg-info" color="blue" %}
This can be done easily via the web UI. To do it via the shell use:
```sh
hal
set password PLOAMPASS
```
## Setting OMCI software version (ME 7)
Edit `/var/config/ont.sys` via vi directly on the stick itself. The file is CRLF terminated, one entry per line.
The entries for the software version are:
```
SW_VER0:0xabcdef
SW_VER1:0xabcedf
```
{% include alert.html content="It's better to enter the software version in hex format, all lowercase precedeed by 0x." alert="Note" icon="svg-info" color="blue" %}
## Setting OMCI hardware version (ME 256)
```sh
manufactory
set hardware version 3FE49165BFAA01
```
If the above command is missing you can edit `/var/config/ont.sys` via vi directly on the stick itself. The file is CRLF terminated, one entry per line.
The entry for the hardware version is:
```
ONTG_VER:0x463630303556362e300000000000
```
The hardware version must be encoded in hex format and right padded to 28 characters with 0 (excluding the starting 0x) to avoid any spurious values.
## Setting OMCI equipment ID (ME 257)
{% include alert.html content="Model number must not be longer than 20 characters in total." alert="Note" icon="svg-info" color="blue" %}
```sh
manufactory
set equipment id MYEQUIPMENTID
exit
omci
equipment id MYEQUIPMENTID
```
If any of the above commands is missing you can edit `/var/config/ont.sys` via vi directly on the stick itself. The file is CRLF terminated, one entry per line.
The entry for the equipment id is:
```
ONTG_EQID:0x463630303556362E30000000000000000000000
```
The equipment id must be encoded in hex format and right padded to 39 characters with 0 (excluding the starting 0x) to avoid any spurious values.
# Advanced settings
## Resetting Web GUI admin credentials
Under certain circumstances, the Web GUI admin credentials might get changed from the default `admin`/`1234` combination.
To restore the default combination try following [this method](https://github.com/xvzf/zyxel-gpon-sfp/issues/6#issuecomment-1065864650).
## Creating a new rootfs
The stick has a tricky image packing method, fortunately it has been reverse engineered. A script to help you create a custom rootfs can be found here: [https://github.com/hack-gpon/zyxel-pmg-3000-mod-kit](https://github.com/hack-gpon/zyxel-pmg-3000-mod-kit)
## Flashing a new rootfs
{% include alert.html content="All commands start from the twmanu shell." alert="Note" icon="svg-info" color="blue" %}
- Transfer the new mtd on the stick via tftp:
```
linuxshell
tftp -gr mtd2.mod.bin TFTP_SERVER_IP
```
- Flash it on the standby partition.
You can use `system` and then `show actimage` to get the current active image. Check `/proc/mtd` for the right mtds. Usually:
- if the currect active image is A, mtd2 is in use
- If the current active image is B, mtd3 is in use
```
linuxshell
mtd -e /dev/mtd2 write /tmp/mtd2.mod.bin /dev/mtd2
```
- Switch to the new image:
```
system
set actimage a
```
- Reboot the ONT:
```
system
reboot
```
# EEPROM (I2C slave simulated EEPROM)
The Zyxel PMG3000-D20B does not have a physical EEPROM, the Falcon SOC emulates an EEPROM by exposing it on the I2C interface as required by the SFF-8472 specification.
On the I2C interface, two memories of 256 bytes each will be available at the addresses `1010000X (A0h)` and `1010001X (A2h)`.
The Zyxel PMG3000-D20B stores the content of the emulated EEPROM1 (A2h) in `/tmp/config/sfp_eeprom1` to restore it after a reboot.
{% include alert.html content="The contents of EEPROM0 (A0h) are not stored anywhere and they're regenerated at each boot" alert="Info" icon="svg-info" color="blue" %}
## EEPROM0 layout
| address | size | name | default value | description |
| ------- | ---- | --------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| | | **BASE ID FIELDS (SFF-8472)** | | |
| 0 | 1 | Identifier | `0x03` (SFP) | Type of transceiver |
| 1 | 1 | Ext identifier | `0x04` (MOD_DEF 4) | Additional information about the transceiver |
| 2 | 1 | Connector | `0x01` (SC) | Type of media connector |
| 3-10 | 8 | Transceiver | `0x04 0x40 0x00 0x02 0x12 0x10 0x00 0x80` (1X LX, 1310TX SMF, 1000BASE-LX, 1200 Mbps) | Code for optical compatibility |
| 11 | 1 | Encoding | `0x03` (8B/10B) | High speed serial encoding algorithm |
| 12 | 1 | Signaling Rate, Nominal | `0x0C` (1Gbps) | Nominal signaling rate |
| 13 | 1 | Rate Identifier | `0x00` (Not used) | Type of rate select functionality |
| 14 | 1 | Length (SMF,km) | `0x14` (20 km) | Link length supported for single-mode fiber, units of km |
| 15 | 1 | Length (SMF) | `0xC8` (200 x 100m) | Link length supported for single-mode fiber, units of 100 m |
| 16 | 1 | Length (50 um, OM2) | `0xFF` (No support) | Link length supported for 50 um OM2 fiber, units of 10 m |
| 17 | 1 | Length (62.5 um, OM1) | `0xFF` (No support) | Link length supported for 62.5 um OM1 fiber, units of 10 m |
| 18 | 1 | Length copper cable | `0x00` (No support) | Link length supported for copper or direct attach cable, units of m |
| 19 | 1 | Length (50 um, OM3) | `0xFF` (No support) | Link length supported for 50 um OM3 fiber, units of 10 m |
| 20-35 | 16 | Vendor name | `0x4C 0x61 0x6E 0x74 0x69 0x71 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20` (Lantiq) | SFP vendor name (ASCII) |
| 36 | 1 | Transceiver | `0x00` (No support) | Code for optical compatibility |
| 37-39 | 3 | Vendor OUI | `0x00 0x1C 0xAD` | SFP vendor IEEE company ID |
| 40-55 | 16 | Vendor PN | `0x50 0x61 0x72 0x74 0x20 0x4E 0x75 0x6D 0x62 0x65 0x72 0x20 0x20 0x20 0x20 0x20` (Part Number) | Part number provided by SFP vendor (ASCII) |
| 56-59 | 4 | Vendor rev | `0x30 0x30 0x30 0x30` (0000) | Revision level for part number provided by vendor (ASCII) |
| 60-61 | 2 | Wavelength | `0x05 0x1E` (1310nm TX) | Laser wavelength |
| 62 | 1 | Fibre Channel Speed 2 | `0xFF` (No support) | Transceiver's Fibre Channel speed capabilities |
| 63 | 1 | CC_BASE | | Check code for Base ID Fields (addresses 0 to 62) |
| | | **EXTENDED ID FIELDS (SFF-8472)** | | |
| 64-65 | 2 | Options | `0x00 0x1A` (TX DISABLE, TX FAULT, RX LOS) | Indicates which optional transceiver signals are implemented |
| 66 | 1 | Signaling Rate, max | `0x00` (No specified) | Upper signaling rate margin, units of % |
| 67 | 1 | Signaling Rate, min | `0x00` (No specified) | Lower signaling rate margin, units of % |
| 68-83 | 16 | Vendor SN | `0x6E 0x6F 0x20 0x73 0x65 0x72 0x69 0x61 0x6C 0x20 0x6E 0x75 0x6D 0x62 0x65 0x72` (no serial number) | Serial number provided by vendor (ASCII) |
| 84-91 | 8 | Date code | `0x31 0x33 0x30 0x31 0x30 0x31 0x20 0x20` (130101) | Vendor's manufacturing date code |
| 92 | 1 | Diagnostic Monitoring Type | `0x6C` (Digital diagnostic, Internally calibrated, Received average power type, address change) | Indicates which type of diagnostic monitoring is implemented |
| 93 | 1 | Enhanced Options | `0xF0` (Alarm/warning flags, soft TX_DISABLE control, soft TX_FAULT monitoring, soft RX_LOS monitoring) | Indicates which optional enhanced features are implemented |
| 94 | 1 | SFF-8472 Compliance | `0x05` (Rev 11.0 of SFF-8472) | Indicates which revision of SFF-8472 the transceiver complies with |
| 95 | 1 | CC_EXT | | Check code for the Extended ID Fields (addresses 64 to 94) |
| | | **VENDOR SPECIFIC FIELDS** | | |
| 96-127 | 32 | Vendor data | `0x20 0x20 0x20...` (Not used) | Vendor specifc data (ASCII) |
| 128-255 | 128 | Reserved | `0x00 0x00 0x00...` | Reserved |
## EEPROM1 layout
| address | size | name | default value | description |
| ------- | ---- | --------------------------------- | ------------------------------------ | ----------------------------------------------------------- |
| | | **DIAGNOSTIC AND CONTROL FIELDS** | | |
| 0-1 | 2 | Temp High Alarm | `0x64 0x00` (100℃) | Value expressed in two's complement |
| 2-3 | 2 | Temp Low Alarm | `0xCE 0x00` (-50℃) | Value expressed in two's complement |
| 4-5 | 2 | Temp High Warning | `0x55 0x00` (85℃) | Value expressed in two's complement |
| 6-7 | 2 | Temp Low Warning | `0xD8 0x00` (-40℃) | Value expressed in two's complement |
| 8-9 | 2 | Voltage High Alarm | `0x8C 0xA0` (3.6V) | Value expressed in volt subunits[^subunit] |
| 10-11 | 2 | Voltage Low Alarm | `0x75 0x30` (3.0V) | Value expressed in volt subunits[^subunit] |
| 12-13 | 2 | Voltage High Warning | `0x88 0xB8` (3.5V) | Value expressed in volt subunits[^subunit] |
| 14-15 | 2 | Voltage Low Warning | `0x79 0x18` (3.1V) | Value expressed in volt subunits[^subunit] |
| 16-17 | 2 | Bias High Alarm | `0xAF 0xC8` (90mA) | Value expressed in milliampere subunits[^subunit] |
| 18-19 | 2 | Bias Low Alarm | `0x00 0x00` (0mA) | Value expressed in milliampere subunits[^subunit] |
| 20-21 | 2 | Bias High Warning | `0x88 0xB8` (70mA) | Value expressed in milliampere subunits[^subunit] |
| 22-23 | 2 | Bias Low Warning | `0x00 0x00` (0mA) | Value expressed in milliampere subunits[^subunit] |
| 24-25 | 2 | TX Power High Alarm | `0x7B 0x86` (5dBm) | Value expressed in watts subunits[^subunit] |
| 26-27 | 2 | TX Power Low Alarm | `0x27 0x10` (0dBm) | Value expressed in watts subunits[^subunit] |
| 28-29 | 2 | TX Power High Warning | `0x6E 0x17` (4dBm) | Value expressed in watts subunits[^subunit] |
| 30-31 | 2 | TX Power Low Warning | `0x2B 0xD4` (0.1dBm) | Value expressed in watts subunits[^subunit] |
| 32-33 | 2 | RX Power High Alarm | `0x07 0xCB` (-7dBm) | Value expressed in watts subunits[^subunit] |
| 34-35 | 2 | RX Power Low Alarm | `0x00 0x0F` (-28dBm) | Value expressed in watts subunits[^subunit] |
| 36-37 | 2 | RX Power High Warning | `0x06 0x30` (-8dBm) | Value expressed in watts subunits[^subunit] |
| 38-39 | 2 | RX Power Low Warning | `0x00 0x14` (-27dBm) | Value expressed in watts subunits[^subunit] |
| 40-55 | 16 | Reserved | `0x00 0x00 0x00...` | Contains the mac address of the SFP, it could also be empty |
| 56-59 | 4 | RX_PWR(4) Calibration | `0x00 0x00 0x00 0x00` | 4th order RSSI calibration coefficient |
| 60-63 | 4 | RX_PWR(3) Calibration | `0x00 0x00 0x00 0x00` | 3rd order RSSI calibration coefficient |
| 64-67 | 4 | RX_PWR(2) Calibration | `0x00 0x00 0x00 0x00` | 2nd order RSSI calibration coefficient |
| 68-71 | 4 | RX_PWR(1) Calibration | `0x00 0x00 0x00 0x00` | 1st order RSSI calibration coefficient |
| 72-75 | 4 | RX_PWR(0) Calibration | `0x00 0x00 0x00 0x00` | 0th order RSSI calibration coefficient |
| 76-77 | 2 | TX_I(Slope) Calibration | `0x00 0x00` | Slope for Bias calibration |
| 78-79 | 2 | TX_I(Offset) Calibration | `0x00 0x00` | Offset for Bias calibration |
| 80-81 | 2 | TX_PWR(Slope) Calibration | `0x00 0x00` | Slope for TX Power calibration |
| 82-83 | 2 | TX_PWR(Offset) Calibration | `0x00 0x00` | Offset for TX Power calibration |
| 84-85 | 2 | T(Slope) Calibration | `0x00 0x00` | Slope for Temperature calibration |
| 86-87 | 2 | T(Offset) Calibration | `0x00 0x00` | Offset for Temperature calibration, in units of 256ths °C |
| 88-89 | 2 | V(Slope) Calibration | `0x00 0x00` | Slope for VCC calibration |
| 90-91 | 2 | V(Offset) Calibration | `0x00 0x00` | Offset for VCC calibration |
| 92-94 | 3 | Reserved | `0x00 0x00 0x00` | Reserved |
| 95 | 1 | CC_DMI | | Check code for Base Diagnostic Fields (addresses 0 to 94) |
| 96 | 1 | Temperature MSB | | Internally measured module temperature |
| 97 | 1 | Temperature LSB | | |
| 98 | 1 | Vcc MSB | | Internally measured supply voltage in transceiver |
| 99 | 1 | Vcc LSB | | |
| 100 | 1 | TX Bias MSB | | Internally measured TX Bias Current |
| 101 | 1 | TX Bias LSB | | |
| 102 | 1 | TX Power MSB | | Measured TX output power |
| 103 | 1 | TX Power LSB | | |
| 104 | 1 | RX Power MSB | | Measured RX input power |
| 105 | 1 | RX Power LSB | | |
| 106-109 | 4 | Optional Diagnostics | `0x00 0x00 0x00 0x00` (No support) | Monitor Data for Optional Laser temperature and TEC current |
| 110 | 1 | Status/Control | `0x02` (Digital RX LOS) | Optional Status and Control Bits |
| 111 | 1 | Reserved | `0x00` | Reserved |
| 112-113 | 2 | Alarm Flags | Supported | Diagnostic Alarm Flag Status Bits |
| 114 | 1 | Tx Input EQ control | `0x00` (No support) | Tx Input equalization level control |
| 115 | 1 | Rx Out Emphasis control | `0x00` (No support) | Rx Output emphasis level control |
| 116-117 | 2 | Warning Flags | Supported | Diagnostic Warning Flag Status Bits |
| 118-119 | 2 | Ext Status/Control | `0x00 0x00` (No support) | Extended module control and status bytes |
| | | **GENERAL USE FIELDS** | | |
| 120-126 | 7 | Vendor Specific | `0x00 0x00 0x00 0x00 0x00 0x00 0x00` | Vendor specific memory addresses |
| 127 | 1 | Table Select | `0x00` | Optional Page Select |
| | | **USER WRITABLE EEPROM** | | |
| 128-232 | 105 | Reserved | `0x00 0x00 0x00...` | Reserved |
| 233-240 | 8 | GPON SN | Unique in each SFP | GPON Serial Number (ME 256) |
| 241-247 | 7 | Reserved | `0x00 0x00 0x00...` | Reserved |
| 248-255 | 8 | Vendor Control | `0x00 0x00 0x00...` (Not used) | Vendor specific control functions |
{% include alert.html content="For more information, see the SFF-8472 Rev 11.0 specification." alert="Info" icon="svg-info" color="blue" %}
# Known Bugs
- [Works with Broadcom BCM57810S only after solder mod](https://github.com/xvzf/zyxel-gpon-sfp/issues/10)
- Issue on IPv6 discovery. Not certain whether it is a edge case of a particular ISP or not
- [Some sticks have a custom password](https://github.com/xvzf/zyxel-gpon-sfp/issues/6)
- On V2.5 the Lantiq SDK has been updated from 6.4.2 to 7.5.1, breaking upload performance
# Miscellaneous Links
- [Zyxel gpon-sfp](https://github.com/xvzf/zyxel-gpon-sfp)
- [Zyxel PMG-3000 mod kit](https://github.com/hack-gpon/zyxel-pmg-3000-mod-kit)
- [Rollback SFP Zyxel con il W3 HUB per risolvere il problema dell'upload cappato](https://forum.fibra.click/d/36541-rollback-sfp-zyxel-con-il-w3-hub-per-risolvere-il-problema-dellupload-cappato)
|
