OpenWrt support for Zyxel PMG5617GA, first GPON support !?

Currently postponed on my side as I have some private things to sort first but a good chunk is done thanks to @cjd . As for the Ethernet, I have confirmation that is indeed a MT7530 with some "specialities" as Daniel Danzberger puts it. Still needs some work to do.

1 Like

I have the GPON controller. But from the TP-Link XN020-G3v that uses the same chip

Seems to be the same SOC with different packaging. Once this project succeeds, porting over to your router should be a breeze.

I managed to get this out

Connecting to 172.20.20.1 port 23, please wait...

password:

Welcome To Use TP-LINK COMMAND-LINE Interface Model.

TP-LINK(conf)#inter
Command not found:inter
TP-LINK(conf)#help
normal mode commands:
clear --- clear screen
exit --- leave to the privious mode
help --- help info
history --- show histroy commands
logout --- logout cli model
config mode commands:
config --- enter config mode
igmp --- igmp config
wan --- wan config
wlctl --- wireless config
voip --- voip config
lan --- lan config
dev --- device control
i2c --- i2c config
reg --- reg config
txctl --- txctl config

TP-LINK(conf)#reg
TP-LINK(conf)#wan

      wan add interface atm 
      --linktype 

      wan delete interface pon 

      wan add service  
      [--linktype ]
      [--encap ]
      --protocol 

      wan set defaultgw 

      wan set service  --protocol 

      wan delete service 

      wan show defaultgw

      wan show interface []

      wan show service [] []

      wan show connection info []

cmd:SUCC

TP-LINK(conf)#wan show interface
cmd:SUCC

TP-LINK(conf)#printf()
Command not found:printf()
TP-LINK(conf)#exit
TP-LINK#help
normal mode commands:
clear --- clear screen
exit --- leave to the privious mode
help --- help info
history --- show histroy commands
logout --- logout cli model
config mode commands:
config --- enter config mode
igmp --- igmp config
wan --- wan config
wlctl --- wireless config
voip --- voip config
lan --- lan config
dev --- device control
i2c --- i2c config
reg --- reg config
txctl --- txctl config

TP-LINK#config
TP-LINK(conf)#lan

      lan show status

      lan show info

cmd:SUCC

TP-LINK(conf)#lan show status

INDEX=1
{
DHCPServerEnable=1
DHCPRelay=0
X_TP_DhcpRelayServer=
minAddress=172.20.20.3
maxAddress=172.20.20.254
enable=1
IPInterfaceIPAddress=172.20.20.1
IPInterfaceSubnetMask=255.255.255.0
IPInterfaceAddressingType=Static
X_TP_MACAddress=10:27:F5:6E:93:30
__ifName=br0
}
cmd:SUCC

TP-LINK(conf)#lan show info

INDEX=1
{
DHCPServerEnable=1
DHCPRelay=0
X_TP_DhcpRelayServer=
minAddress=172.20.20.3
maxAddress=172.20.20.254
subnetMask=255.255.255.0
DNSServers=1.0.0.1,8.8.8.8
domainName=
IPRouters=172.20.20.1
DHCPLeaseTime=86400
IPInterfaceNumberOfEntries=1
DHCPStaticAddressNumberOfEntries=0
DHCPConditionalPoolNumberOfEntries=0
enable=1
IPInterfaceIPAddress=172.20.20.1
IPInterfaceSubnetMask=255.255.255.0
IPInterfaceAddressingType=Static
X_TP_MACAddress=10:27:F5:6E:93:30
__ifName=br0
}
cmd:SUCC

TP-LINK(conf)#dev
valid sub cmd:
reset
reboot
version
serial
show

TP-LINK(conf)#dev serial
valid sub cmd:
show

TP-LINK(conf)#dev serial show
cmd:SUCC:serialNumber=1027F56E9330

TP-LINK(conf)#dev versi󛛰mn show
Command not found:versión
TP-LINK(conf)#dev version
cmd:SUCC:softwareVersion=1.1.0 0.8.0 v6037.0 Build 210520 Rel.36145n

TP-LINK(conf)#dev show
valid sub cmd:
prodName
prodVer

TP-LINK(conf)#dev show prodVer
cmd:SUCC:X_TP_DevModelVersion=1.0

TP-LINK(conf)#dev show prodName
cmd:SUCC:modelName=XN020-G3v

TP-LINK(conf)#


and this is the GPON

Yeah, pretty much every vendor out there (Zyxel, Nokia, TPLink...) has their own custom shell interface so it will become useful when it's time to flash the mtd. For now we're still trying to put all drivers together (Ethernet, PON, Wifi, SLIC) in the SOC support. Also, it will be useful if you could pop open the shield to see what laser driver you use.

I don't have a heat gun to remove the protector

I can see the little notches so I have a feeling you can just pop it out with a flat screwdriver.

ok i already have it

I already took it out and sent the photo there

Can barely see the chip markings but it doesn't matter much as we can see is another Econet LD/BOSA Driver. Just wonder if is initialised via a binary blob or kernel driver (we need full dump for that). Another thing I've noticed with those is that OMCI implementation is vendor dependent and so far I've only got access to Realtek Source code. Might be worth writing a whole OMCI stack to unify those LD Drivers across OpenWrt (like how Lantiq did with DSL) but that's a whole other can of worms.

The chip that is inside the metal casing is: Econet EN7570N 2116AWAL

Cool. So it seems to be very similar to Zyxel's EN7571N. Might be just slight differences in temperature range. So at least we know for sure the LD Driver isn't tied to the SoC since Nokia G-240G-E uses the same SoC but totally different LD Driver.

The first GPon router for OpenWRT is not it, at least the Turris Omnia, and probably others with SFP, should already handle it.

DFB Laser this Is pon transmisor AND APD-TIA Receiver pon

Great work don so far. Are there any chances that we can see an openwrt version for Zyxel VMG3625-T50B with Mediatek Econet EN7516GT chipset?

That would be great, because its QOS system is not very stable and efficient.

Not anytime soon, if ever. In the best of all cases you'd look at a double digit number of months++, but 'never' is more likely.

Okay, I've managed to painstakingly dump the nand in here https://drive.google.com/file/d/1-8rUqof-ErmkD_bSkDOjPjXyOOUKzIzb/view?usp=sharing so now I need to know how to browse its contents. By the looks of it it may be encrypted, LZMA compressed or TRX header encrypted? Any idea how to move on with this file?

1 Like

the file is .bin the firmware

Heyo, owner of Zyxel VMG3625-T20A. This might be the wrong place to discuss a different router, but I reversed enough from the firmware files that it seems to be running an en7512 CPU and this place seems to be the only one that has done some work that CPU/architecture. I am currently on a holiday so I don't have access to the router, so reading and preparing code is pretty much everything I can do.

Would be willing to contribute, but I have zero knowledge now regarding where to start so pointing to some existing work would be awesome.
I'll start reading up on whatever resources are in here and in OpenWRT wiki.

EDIT:
Decompressed the files with binwalk and I have more or less access to everything the firmware files have. The system is running Linux kernel version 2.6.36. Seems like our routers might be compatible. I'll check around with ghidra later this or next week how things function and see if making a fake firmware file to flash a different kernel is possible. I'll also have to read up on what is compatible with OpenWRT.