The design has changed hands a few times, from Texas Instruments to Infineon to Lantiq and perhaps now to Intel.
ar7is a distinct platform in OpenWrt.
xwayonly includes the DANUBE- and AR9-based models, not AMAZON
xrx200includes the VR9-based models
|ADSL2+||AR7||AR7||4Kc + C62x|| D-Link DSL-502T (gen. 2)
Linksys RTP300 and WRTP54G
FRITZ!Box Fon WLAN 7112
|AMAZON "AR8"||AMAZON-ME (PSB 50505)||4KEc|| Speedport W 700V
D-Link "HorstBox" DVA-G3342SD
|AMAZON-SE-lite (PSB 50600)|
|AMAZON-SE (PSB 50601)|| ADB 1000g
ZTE ZXV10 H108L
|AMAZON-S (PSB 50610)||vigor2830_series|
|DANUBE||DANUBE (PSB 50702)||2x 24KEc|| Airties WAV-281
Arcadyan ARV4518PW (SMC-7908-ISP)
Arcadyan ARV7506PW11 (Alice IAD 4421 / o2 Box 4421)
Astoria Networks ARV7518PW
Arcadyan ARV752DPW (Vodafone EasyBox 802)
Astoria Networks ARV752DPW22 (Arcor/Vodafone DSL-EasyBox 803A)
SIEMENS / SAGEM Gigaset SX762 / SX763
Speedport W 502V
Speedport W 503V Typ C
Speedport W 504V
Speedport W 722V Typ B
|DANUBE-S (PSB 50712)||2x 24KEc|| Siemens Gigaset 604 IL
BT HomeHub 2.0 Type B
|ARX100 "AR9"||ARX168||34Kc|| Buffalo WBMR-HP-G300H
BT HomeHub 3.0a
FRITZ!Box Fon WLAN 7320
FRITZ!Box Fon WLAN 7330
|VINAX-D/-A||ALLNET ALL126Ax2 ?|
|VRX200 "VR9"||VRX288 / VRX208||34Kc|| AVM FRITZ!Box WLAN 3370
FRITZ!Box WLAN 3390
FRITZ!Box Fon WLAN 7360
FRITZ!Box 6840 LTE
Astoria Networks ARV7519RW22 (Livebox 2.1)
Astoria Networks VGV7519KW (KPN Experia Box v8)
Arcadyan VGV7510KW22 (o2 Box 6431)
Draytek Vigor 2760(Vn)/(Delight)
TP-Link Archer VR200v
|VRX268 / VRX208|| TP-Link TD-W8970
BT Home Hub 5 Type A
BT OpenReach VG3503J
|VRX208||–||AFE and Line driver|
|ADSL2+||ARX300||ARX388||34Kc||ADSL2+/Ethernet SoC with integrated high-performance WLAN, GbitE LAN/WAN, 2-4 Ch FxS and CATiq support|
|ARX382||ADSL2+/Ethernet SoC with integrated cost-effective WLAN, FastE LAN/WAN, 2-4 Ch FxS and CATiq support|
|ARX368||ADSL2+/Ethernet SoC with integrated high performance WLAN and GbitE LAN/WAN|
|ARX362||ADSL2+/Ethernet SoC with integrated cost-effective WLAN and FastE LAN/WAN|
|none||GRX300||GRX388||Gigabit Ethernet Router/Gateway SoC with integrated 3x3 Wi-Fi|
|GRX387||Gigabit Ethernet Router/Gateway SoC with integrated 2x2 Wi-Fi|
|VDSL2||?||VRX318||–||ADSL2/2+/VDSL Transceiver and Line Driver for GRX388/GRX387|
 Infineon called Amazon "AR8" in at least one product brochure. It probably applied to Danube too.
Judging mostly by age and wiki pages:
ADSL and VDSL are generally supported (probably through a combination of GPL dumps for some units and contributions directly from Lantiq; there may still be some blobs?). Some people report that AR9-/VR9-based routers achieve better synchronization than Danube-based boards.
Annex A,B,J,L,M should be supported. see package/network/config/ltq-vdsl-app/files/dsl_control
Danube/Danube-S: They have two MIPS 24kec CPUs, but the second core has few differences that make SMP support impossible. The second core is used for VoIP.
AR9/VR9: Their cores have multithreading support, but it does not work properly with these SoCs without some hacks seen in the source dumps of some boards. For now multithreading is not supported without specific patches for the AR9 and VR9.
A Lantiq WiFi chip. See https://forum.openwrt.org/viewtopic.php?id=45047.
Lantiq SoCs have small mask ROMs capable of booting from various sources, selected by a combination the
boot_selN pins. This mask ROM is what emits "
ROM VER x.yy … CFG 0x" over serial on these devices. Finding those pins on a given device can be tricky, but on several Lantiq-based devices it's the primary mechanism for installation or recovery. Consult the pages for a specific device for details on
boot_selN access discovered so far (if any); since pins have only been found for BGA-packaged chips so far, access probably involves soldering to small surface mount resistor pads.
boot_selN pins select UART mode (or on some SoCs such as the 50601, when the SPI flash can't be read or appears invalid), the mask ROM routine waits for data in hex. The format, which seems to have originated on the Motorola MMC2107, is:
33333333: data is address/value pairs for writing individual words
11111111: data is a 32-bit checksum, followed by 120 0s of padding
99999999: data is a 32-bit start address, again padded
U-Boot is often the payload, as in this example.
The Motorola toolchain included a Perl script called
sikadown.pl which converted traditional S-record files into this format. OpenWrt's
boot package contains (within Lantiq patches) a newer version,
gct.pl, that is very similar to the one from the DGN1000 Netgear GPL release and does the same with the addition of RAM initialisation.
This is taken from a patent application and the specific example of the the PSB 50601 (Amazon SE), but other variants are likely very similar. What seems to vary between implementations is:
boot_selNpin is set, and the structure of the flash can mean the set pins are ignored. The PSB 50601 behaves this way.
boot_selNpins can't be located then another approach may be to inhibit flash reads, e.g. pull
/CEhigh on a serial flash chip.
boot_selNpins before consulting the flash (the VRX268 seems to do this).
On an example PSB 50601-based unit the start of SPI, dictated by the mask ROM, is:
AA 55 FF FF 03 02 01 00 0C 00 05 04
This is interpreted as:
0xAA55(signifies valid flash)
0xFF); unclear what is expected to interpret this, or how
0xFF); unclear what is expected to interpret this, or how
00:01:02:03:04:05), oddly laid out to straddle…
0x0C) in bytes of this header and reserved area (in this case there's no extra reserved space beyond this header)
If there were any reserved space, it would appear next.
A list of entries then follows. Similar to UART mode, addresses can indicate word writes, block writes or transfer of control:
0b00) is followed by a single word to be written there
0b01is followed by a length (in 32-bit words) and a block of data to write; should be possible to initialise multiple non-contiguous regions just by concatenating multiple entries of this type
0b11low bits terminates the list:
0xFFFFFFFF: treat the following uint32 as the entry address, jumping to it
0x00000003: attempt to boot from whatever
boot_selNindicates (the next word isn't consulted)
The documentation outlines this, and transfers would be quicker than serial. Documentation/tooling welcomed.
On PSB 50601 the JTAG pins are:
SPI pins are: