User Tools

Site Tools


doc:hardware:soc:soc.lantiq

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
doc:hardware:soc:soc.lantiq [2012/10/11 18:57]
taeuber
doc:hardware:soc:soc.lantiq [2016/05/23 00:14] (current)
zx82 [Lantiq xDSL] AR8 was Amazon
Line 1: Line 1:
 +====== Lantiq SoCs ======
 +
 +The design has changed hands a few times, from Texas Instruments to Infineon to [[wp>​Lantiq]] and perhaps now to Intel.
 +
 +Terminology:​
 +  * The AR7 is included here for historical context but ''​ar7''​ is a distinct platform in OpenWrt.
 +  * Lantiq applied the XWAY trademark to various parts (see [[https://​web.archive.org/​web/​20160408093506/​http://​downloads.codico.com/​misc/​Lantiq/​20140216_Lantiq_Product_Overview_for_Distribution.pdf |product brochures]]/​[[https://​archive.is/​o2CBw |listings]]) but in BB, CC and trunk (as of 2016-05):
 +    * OpenWrt'​s ''​xway''​ only includes the DANUBE- and AR9-based models, not AMAZON
 +    * OpenWrt'​s ''​xrx200''​ includes the VR9-based models
 +  * but see [[#​openwrt_support |OpenWrt Support]] for details
 +
 +===== Lantiq xDSL =====
 +^ DSL-Version ^  SoC-Family ​ ^  SoC         ​^ ​ [[doc:​hardware:​CPU]] ​ ^ Devices ^
 +| ADSL2+ | AR7              | AR7             | 4Kc + [[http://​www.wehavemorefun.de/​fritzbox/​index.php/​C62x|C62x]] | [[toh/​d-link/​dsl-502t-genii|D-Link DSL-502T (gen. 2)]]\\ [[toh/​d-link/​dsl-504t|D-Link DSL-504T]]\\ [[toh:​d-link:​dsl-524t|D-Link DSL-524T]]\\ [[toh:​d-link:​dsl-584t|D-Link DSL-584T]]\\ [[toh:​d-link:​dsl-624t|D-Link DSL-G624T]]\\ [[toh/​linksys/​ag241|Linksys AG241]]\\ [[toh/​linksys/​rtp300_and_wrtp54g|Linksys RTP300 and WRTP54G]]\\ [[oldwiki/​openwrtdocs/​hardware/​linksys/​ag310|Linksys AG310]]\\ [[toh/​linksys/​wag54g|Linksys WAG54GP]]\\ [[toh/​avm/​fritz.box.wlan.7112|FRITZ!Box Fon WLAN 7112]]\\ [[toh/​zyxel/​zyxel_p2602hwn|ZyXEL P-2602HWN-D7A]] ​ |
 +| :::    | AMAZON "​AR8"<​sup>​[1]</​sup> ​    | AMAZON-ME (PSB 50505) | 4KEc  | [[toh/​t-com/​spw700v|Speedport W 700V]]\\ [[toh/​d-link/​dva-g3342sd|D-Link "​HorstBox"​ DVA-G3342SD]] |
 +| :::    | :::              | AMAZON-SE-lite (PSB 50600) | :::  |  |
 +| :::    | :::              | AMAZON-SE (PSB 50601) | :::  | [[toh/​adb/​1000g|ADB 1000g]]\\ [[toh/​netgear/​dgn1000b|Netgear DGN1000]]\\ [[toh/​samsung/​smt-g3xx0|Samsung SMT-G3000]]\\ [[https://​wikidevi.com/​wiki/​Thomson_TG585v8 | Thomson TG585v8]]\\ [[toh/​zte/​zxv10h108l|ZTE ZXV10 H108L]] ​ |
 +| :::    | :::              | AMAZON-S (PSB 50610) | :::  | [[toh/​draytek/​vigor2830_series]] |
 +| :::    | DANUBE ​          | DANUBE (PSB 50702) | 2x 24KEc | [[inbox/​airties-wav281|Airties WAV-281]]\\ [[toh/​arcadyan/​arv4518pw|Arcadyan ARV4518PW (SMC-7908-ISP)]]\\ [[toh/​arcadyan/​arv7506|Arcadyan ARV7506PW11 (Alice IAD 4421 / o2 Box 4421)]]\\ [[toh/​arcadyan/​arv7510pw|Arcadyan ARV7510PW]]\\ [[toh/​astoria/​arv7518pw|Astoria Networks ARV7518PW]]\\ [[toh/​arcadyan/​arv7519pw|Arcadyan ARV7519PW]]\\ [[toh/​arcadyan/​arv752dpw|Arcadyan ARV752DPW (Vodafone EasyBox 802)]]\\ ​ [[toh/​astoria/​arv752dpw22|Astoria Networks ARV752DPW22 (Arcor/​Vodafone DSL-EasyBox 803A)]]\\ [[toh/​belkin/​f5d8635-4v1_danube|Belkin F5D8635-4v1]]\\ [[toh/​audiocodes/​mp252|MediaPack MP-252]]\\ [[toh/​gigaset/​sx76x|SIEMENS / SAGEM Gigaset SX762 / SX763]]\\ ​ [[toh/​t-com/​spw502v|Speedport W 502V]]\\ [[toh/​t-com/​spw503vtypc|Speedport W 503V Typ C]]\\ [[toh/​t-com/​spw504v|Speedport W 504V]]\\ [[toh/​t-com/​spw722vtypb|Speedport W 722V Typ B]]|
 +| :::    | :::              | DANUBE-S (PSB 50712) | 2x 24KEc | [[toh/​siemens/​gigaset604il|Siemens Gigaset 604 IL]]\\ [[toh/​bt/​homehub_v2b|BT HomeHub 2.0 Type B]] |
 +| :::    | ARX100 **"​AR9"​** | ARX168 ​         | 34Kc | [[toh/​buffalo/​wbmr-hp-g300h|Buffalo WBMR-HP-G300H]]\\ [[toh/​netgear/​dgn3500b|Netgear DGN3500]]\\ [[toh/​aztech/​gr7000|Aztech GR7000]] \\ [[toh:​zyxel:​zyxel_p661hnuf3|ZyXEL P-661HNU-F3]]\\ [[toh:​bt:​homehub_v3a|BT HomeHub 3.0a]]\\ [[toh/​avm/​fritz.box.wlan.7320|FRITZ!Box Fon WLAN 7320]]\\ [[toh/​avm/​fritz.box.wlan.7330|FRITZ!Box Fon WLAN 7330]]\\ [[toh/​vtech/​netiaspot|VTECH NetiaSpot]] ​ |
 +| :::    | :::              | ARX182 ​         | :::  | [[toh/​zte/​zxv10h201l|ZTE ZXV10-H201L]] |
 +| :::    | :::              | ARX188 ​         | :::  | [[toh/​avm/​fritz.box.wlan.7312|FRITZ!Box 7312]] |
 +| VDSL2  | VINAX            | VINAX-VE/​-A ​    | 2× 24KEc |  |
 +| :::    | :::              | VINAX-E/​-A ​     | ::: |  |
 +| :::    | :::              | VINAX-D/​-A ​     | ::: | ALLNET ALL126Ax2 ? | 
 +| :::    | VRX200 **"​VR9"​** | VRX288 / VRX208 | 34Kc | [[toh/​avm/​fritz.box.wlan.3370|AVM FRITZ!Box WLAN 3370]]\\ [[[[toh/​avm/​fritz.box.wlan.3390|FRITZ!Box WLAN 3390]]\\ [[toh/​avm/​fritz.box.wlan.7360|FRITZ!Box Fon WLAN 7360]]\\ [[toh/​avm/​fritz.box.wlan.6840.lte|FRITZ!Box 6840 LTE]]\\ [[toh:​arcadyan:​arv7519|Astoria Networks ARV7519RW22 (Livebox 2.1)]]\\ [[toh:​arcadyan:​vgv7519|Astoria Networks VGV7519KW (KPN Experia Box v8)]]\\ [[toh/​arcadyan/​vgv7510kw22|Arcadyan VGV7510KW22 (o2 Box 6431)]]\\ [[toh/​draytek/​vigor2760|Draytek Vigor 2760(Vn)/​(Delight)]]\\ [[toh/​zyxel/​p2812hnu-f1|ZyXEL P-2812HNU-F1]]\\ [[toh/​zyxel/​p2812hnu-f3|ZyXEL P-2812HNU-F3]] |
 +| :::    | :::              | VRX268 / VRX208 | :::  | [[toh/​tp-link/​td-w8970|TP-Link TD-W8970]]\\ [[toh/​tp-link/​td-w8980|TP-Link TD-W8980]]\\ [[toh/​tp-link/​td-w9980|TP-Link TD-W9980]]\\ [[toh/​netgear/​vevg2500|Netgear VEVG2500]]\\ [[toh/​bt/​homehub_v5a|BT Home Hub 5 Type A]]\\ [[toh/​bt/​vg3503j|BT OpenReach VG3503J]] |
 +| :::    | :::              | VRX208 ​         | --   | AFE and Line driver ​ |
 +| ADSL2+ | ARX300 ​          | ARX388 ​         | 34Kc | ADSL2+/​Ethernet SoC with integrated high-performance WLAN, GbitE LAN/WAN, 2-4 Ch FxS and CATiq support ​ |
 +| :::    | :::              | ARX382 ​         | :::  | ADSL2+/​Ethernet SoC with integrated cost-effective WLAN, FastE LAN/WAN, 2-4 Ch FxS and CATiq support ​ |
 +| :::    | :::              | ARX368 ​         | :::  | ADSL2+/​Ethernet SoC with integrated high performance WLAN and GbitE LAN/​WAN ​ |
 +| :::    | :::              | ARX362 ​         | :::  | ADSL2+/​Ethernet SoC with integrated cost-effective WLAN and FastE LAN/​WAN ​ |
 +| none   | GRX300 ​          | GRX388 ​         |      | Gigabit Ethernet Router/​Gateway SoC with integrated 3x3 Wi-Fi  |
 +| :::    | :::              | GRX387 ​         |      | Gigabit Ethernet Router/​Gateway SoC with integrated 2x2 Wi-Fi  |
 +| VDSL2  | ?                | VRX318 ​         | --   | ADSL2/​2+/​VDSL Transceiver and Line Driver for GRX388/​GRX387 ​   |
 +
 +[1] Infineon called Amazon "​AR8"​ in at least one [[http://​www.infineon.com/​dgdl/​IFX_CPE_Brochure_final.pdf?​folderId=db3a304312dc768d0112e132874e0280&​fileId=db3a30431add1d95011ae886288656ae |product brochure]]. ​ It probably applied to Danube too.
 +===== OpenWrt Support =====
 +
 +Judging mostly by age and wiki pages:
 +  * DANUBE devices: look pretty well supported, with builds for many devices having been in the system for years.
 +  * xRX2xx devices: seem to work fine (speaking from experience of the BTHH5A, and the healthy wiki pages of the [[toh/​zyxel/​p2812hnu-fx |ZyXEL P2812HNU-Fx]]).
 +  * AR9 devices: the [[toh/​buffalo/​wbmr-hp-g300h |Buffalo WBMR-HP-G300H]] and [[toh/​netgear/​dgn3500b |Netgear DGN3500B]] wiki pages look healthy.
 +  * AMAZON-SE devices: platform support has been around since 2011 and remains, but timing was unkind; support consolidated shortly after the Attitude Adjustment freeze, but as few devices/​user reports existed, build support got dropped again before Barrier Breaker. ​ There has been [[https://​forum.openwrt.org/​viewtopic.php?​id=39319 |some success]] building trunk (2016-05) for the [[toh/​netgear/​dgn1000b |DGN1000]].
 +  * AMAZON-ME: no data; anecdotally:​ "we tried booting OpenWrt on [one]: we never got a single response from it (even after hacking around in some linux early-boot code...)"​
 +  * VINAX, other AMAZON variants: no data
 +==== Lantiq DSL IP block support in Linux ====
 +
 +ADSL and VDSL are generally supported (probably through a combination of GPL dumps for [[toh/​netgear/​vevg2500 |some units]] and contributions directly from Lantiq; there may still be some blobs?​). ​ Some people report that AR9-/​VR9-based routers achieve better synchronization than Danube-based boards.
 +
 +Note: some people reported that AR9 and VR9 based routers usually has better synchronization than Danube based boards.
 +
 +==== SMP/​Multithreading ====
 +
 +**Danube/​Danube-S:​** They have two MIPS 24kec CPUs, but the second core has few differences that make SMP support impossible. The second core is used for VoIP.
 +
 +**AR9/​VR9:​** Their cores have multithreading support, but it does not work properly with these SoCs without some hacks seen in the source dumps of some boards. ​ For now multithreading is not supported without specific patches for the AR9 and VR9.
 +
 +==== WAVE300 ====
 +
 +A Lantiq WiFi chip.  See https://​forum.openwrt.org/​viewtopic.php?​id=45047.
 +
 +===== Boot =====
 +
 +Lantiq SoCs have small mask ROMs capable of booting from [[http://​lxr.free-electrons.com/​source/​arch/​mips/​include/​asm/​mach-lantiq/​xway/​lantiq_soc.h#​L61 |various sources]], selected by a combination the ''​boot_selN''​ pins.  This mask ROM is what emits "''​ROM VER x.yy ... CFG 0x''"​ over serial on these devices. ​ Finding those pins on a given device [[https://​forum.openwrt.org/​viewtopic.php?​pid=252818#​p252818 |can be tricky]], but on several Lantiq-based devices it's the primary mechanism for installation or recovery. ​ Consult the pages for a specific device for details on ''​boot_selN''​ access discovered so far (if any); since pins have only been found for BGA-packaged chips so far, access probably involves soldering to small surface mount resistor pads.
 +
 +The bootloader is typically [[doc/​techref/​bootloader/​uboot |U-Boot]], sometimes [[doc/​techref/​bootloader/​brnboot |brnboot]].
 +
 +==== UART mode ====
 +
 +When the ''​boot_selN''​ pins select UART mode (or on some SoCs such as the 50601, when the SPI flash can't be read or appears invalid), the mask ROM routine waits for data in hex.  The format, which seems to have originated on the [[http://​www.camelforth.com/​e107_files/​downloads/​newmicros/​product_manual/​NMIN-2107.pdf |Motorola MMC2107]], is:
 +  * lines start with addresses (8 hex digits, encoding a 32-bit address)
 +  * addresses are followed by data (128 hex digits, encoding 64 bytes)
 +  * aligned addresses simply denote 64-byte writes at the corresponding locations
 +  * selected unaligned addresses cause data to be interpreted differently:​
 +    * ''​33333333'':​ data is address/​value pairs for writing individual words
 +      * this is typically used first, to configure some RAM access (SRAM? SDRAM? cache-as-RAM?​) so there'​s somewhere to store the image
 +      * unused pairs seem to use all zeros for address/​value
 +    * ''​11111111'':​ data is a 32-bit checksum, followed by 120 0s of padding
 +    * ''​99999999'':​ data is a 32-bit start address, again padded
 +
 +U-Boot is often the payload, as in [[https://​raw.githubusercontent.com/​seanchann/​sx76x-openwrt-danube/​master/​u-boot.asc |this example]].
 +
 +The Motorola toolchain included a Perl script called ''​sikadown.pl''​ which converted traditional S-record files into this format. ​ OpenWrt'​s ''​boot''​ package contains (within [[https://​dev.openwrt.org/​browser/​trunk/​package/​boot/​uboot-lantiq/​patches/​0017-tools-add-some-helper-tools-for-Lantiq-SoCs.patch?​rev=40482 |Lantiq patches]]) a newer version, ''​gct.pl'',​ that is very similar to the one from the DGN1000 Netgear GPL release and does the same with the addition of RAM initialisation.
 +
 +==== Booting from flash ====
 +
 +This is taken from [[https://​www.google.com/​patents/​US8260968 |a patent application]] and the specific example of the the PSB 50601 (Amazon SE), but other variants are likely very similar. ​ What seems to vary between implementations is:
 +  * Ease of influencing the boot via ''​boot_selN''​ pins:
 +    * Some might load and run code from any valid-looking flash if any ''​boot_selN''​ pin is set, and **the structure of the flash can mean the set pins are ignored**. ​ The PSB 50601 behaves this way.
 +      * On these, if the ''​boot_selN''​ pins can't be located then another approach may be to inhibit flash reads, e.g. pull ''/​CE''​ high on a serial flash chip.
 +    * Others might honour the ''​boot_selN''​ pins before consulting the flash (the VRX268 seems to do this).
 +  * Fallback mechanism; some may default to UART if other methods fail, some may not.
 +
 +On an example PSB 50601-based unit the start of SPI, dictated by the mask ROM, is:
 +  AA 55 FF FF  03 02 01 00  0C 00 05 04
 +  ​
 +This is interpreted as:
 +  * the signature/​magic ''​0xAA55''​ (signifies valid flash)
 +  * a PHY0 address (''​0xFF''​);​ unclear what is expected to interpret this, or how
 +  * a PHY1 address (''​0xFF''​);​ unclear what is expected to interpret this, or how
 +  * a MAC (here ''​00:​01:​02:​03:​04:​05''​),​ oddly laid out to straddle...
 +  * the size (''​0x0C''​) in bytes of this header and reserved area (in this case there'​s no extra reserved space beyond this header)
 +  * a validity flag for the MAC address (''​0x00''​ means valid)
 +
 +If there were any reserved space, it would appear next.
 +
 +A list of entries then follows. ​ Similar to UART mode, addresses can indicate word writes, block writes or transfer of control:
 +  * a plain address with clear low bits (''​0b00''​) is followed by a single word to be written there
 +  * an address ORed with ''​0b01''​ is followed by a length (in 32-bit words) and a block of data to write; should be possible to initialise multiple non-contiguous regions just by concatenating multiple entries of this type
 +  * a uint32 with ''​0b11''​ low bits terminates the list:
 +    * ''​0xFFFFFFFF'':​ treat the following uint32 as the entry address, jumping to it
 +    * ''​0x00000003'':​ attempt to boot from whatever ''​boot_selN''​ indicates (the next word isn't consulted)
 +
 +==== MII (network) boot ====
 +
 +The documentation outlines this, and transfers would be quicker than serial. ​ Documentation/​tooling welcomed.
 +
 +===== JTAG =====
 +
 +On PSB 50601 the JTAG pins are:
 +  * 49: TDO
 +  * 50: TMS
 +  * 51: nTRST
 +  * 52: TDI
 +  * 53: TCK
 +
 +SPI pins are:
 +  * 44: CLK
 +  * 45: MOSI
 +  * (46 unknown)
 +  * 47: MISO
 +  * 48: Slave select (probably the first of several)
 +
 +===== Tags =====
 +
 +{{tag>​lantiq ar7 amazon danube ar9 vinax vr9 adsl adsl2 adsl2+ vdsl vdsl2}}