Xavi 7968 uses SoC of Conexant CX 94610-11Z which is in use for other routers, some of them already exploiting linux as OS. However, the vast majority of CX 94610-11Z routers use ATMOS/ISOS firmware developed by GlobespanVirata.

• Linksys WAG54G2. GPL sources here

• Huawei HG522. No GPL sources available although a very interesting project, based on this router, is Ezbox

• Netgear DG834Gv5. GPL sources here

• Netgear MBR624GU. GPL sources here

• Level One WBR-3600. GPL sources here

Xavi 7968, ZTE ZXV10 h608b, Billion Bipac routers, Belkin F5D7634nt4A v1000, Zoom X6 5590c, Pirelli DRG A124G, AtlantisLand A02-RAU244-W300N, Intertex SurfinBird IX78

WiP

First let's have a quick view at the Flash Layout with the original firmware:

Use "Firmware Upgrade" from the original firmware which can be found at the web interface.

Latest firmware known is

Using a serial comm device on the pins described in serial, the log is:

FSB v0.06 PLL w ln p08 zi

Solos 461x PP boot v1.5

SDRAM size = 0x1000000
Processor clock speed 264.0MHz
Finding flashfs partition...done.

Found Uncompress/Self extract image:
UnComp.Length 0x3feb10   Comp.Length 0x130380
Calling Configure_NVS_FromFile.

LZMA 4.05

Quantum v1.01
Phys region /region/stung-sdram start @ 0xc00000, end @ 0x1000000, alignment 0x100000
Allocatable memory starts @ 0x52cd00, end @ 0xc00000
No, or invalid, configuration information in EEPROM - trying FLASH
Valid configuration (size 64)
DSL gateway version 10.0.1.56 (19th April 2007)
BSP: Solos 4610 RD
CSP: Solos 461x CSP v1.0
Copyright (c) 2004 Conexant Systems Ltd.
Entering crypto process.
Base address of STUNG memory -> '0xc00000'
Base address of STUNG memory -> '0xc00000'

                ,vvvdP9P???^   ,,,
              vvd###P^`^         vvvvv v
         vv#####?^                  ????####vv,
      vv####??     ,vvvdP???^  ,,,        ??##^
     v#####?    ,vvd##P?^        #?#v#vvv
   v#####?    v###P^    ,vvv,        '?#?,
  ######?   ####?^ ,vd#P?^     `???##
  #####?   v####  ,d##P^           ''
 ######   v####  ]###L                   _   _          _                  ___
 #####?   v####  ]##L                   /   / \  |\ |  |_  \/   /\   |\ |   |
 ######    ####  ]###L                  \_  \_/  | \|  |_  /\  /--\  | \|   |
 ?#####v   ####v  ]##h,            ,,
  ?#####    ?###h,  `9#hv,     ,vv###
    ######    #####L    ]###L        ,v#v'
    ?#####vv    ?9##hv,        ,,vvvv###'
       ?#####vv     `??9P\vv,   ^         vv##,
          ######                       #######L
            ??###hvv,          ,vvv#?##?????
                `????9hdhvv,

Login:

The booting firmware is called PP-Boot release 1.5.

During first seconds of booting, hitting <space> bar will enter into PP-Boot console mode with access to its commands.

However, Edimax released some code with an uboot for Solos chipset. Inside the gpl released for the AR-7284WnB router we can find the TBSBOOT which is just a crippled u-boot compatible with Conexant SolosW among others. Another source with incomplete u-boot sources for the Solos is in the ezbox project.

http://www.edimax.com/images/Image/OpenSourceCode/Wireless/Router/AR-7284WnA/AR-7284WnA&B_SDK_6222.tar.zip

http://code.google.com/p/ezbox/source/browse/sub-projects/porting/huawei/hg522c-cnxt/build/open-src/bootloader/

Command "?" or "help" will show you the following list:

Commands to the console are:
 configeeprom             display EEPROM configuration information
 configflash              display FLASH configuration information
        mac <address>               set MAC address
        networkboot {yes | auto}    boot auto-select Ethernet, USB or PCI
        networkboot ethernet        boot from Ethernet only
        networkboot usb             boot from USB only
        networkboot pci             boot from PCI only
        networkboot no              boot from FLASH
        networkboot ask             always prompt user for boot source
        copyimages {yes | no}       copy network booted image files
        flashfs {auto | emergency}  use automatic FLASHFS selection or
                                    force boot from emergency FLASHFS
        flashnetboot {yes | no}     flash boots auto network boots
        autolanrecover {yes | no}   attempt LAN recovery if flash corrupt
        initialise                  initialise configuration information
        listenv                     list environment variables
        setenv <key> <value>        set environment variable
        unsetenv <key>              unset environment variable
        pda read                    read PDA information
 configpci                          display EEPROM PCI configuration
 configpci set <idx> <addr> <data>  set PCI pair
 dw <address> [<length>]  dump words (hex/ascii)
 enter <address>          enter an image
 erw <wrdaddress>         read a single word from EEPROM
 eww <wrdaddress> <value> write a single word to EEPROM
 fdw <address> [<length>] dump flash words (hex/ascii)
 flash config             print flash configuration
 help                     print this text
 netboot [recover]        perform immediate network boot [in recovery mode]
 quit                     leave the console
 reset                    reset system
 rw <address>             read a single word
 why                      reason for console entry
 ww <address> <value>     write a single word
 xmodem [fast]            download mkflash image using X-Modem

All commands related to the eeprom i.e. configeeprom, configpci, erw and eww are disabled since no eeprom is present.

This is the output of this command:

Flash configuration: 1 chips
Chip 0 auto-sizing, actual size 4096k on EPB @ 0x38000000
Chip 0 ID is 17e: (AMD AM29LV320MB 4096k bytes), unlocked (0)
Chip 0 using multi-byte write with a 32 byte buffer
Flash start offset: 0x00030000
Space for all FLASHFS partitions: 0x003d0000
found partition at 0x003e0000 ... 0x00400000, size 128kbytes
found partition at 0x000c0000 ... 0x003e0000, size 3200kbytes
found partition at 0x00030000 ... 0x000c0000, size 576kbytes
Found 3 valid flashfs partitions

One can dump the values of the whole flash by utilizing command fwd.

1. Enter PP-Boot console (via serial comm and hit <space>)
2. Enable log file of the current session and write down the path where the file will be
3. Type in the following command:

fdw 0 400000

1. Wait until end of dumping (approx 1h 20min)
2. Close session.

Explanation: The command will dump on screen the values of flash memory starting from 0x0 for a lenght of 0x400000 (4Mbytes), which is the full length of the flash memory.

Now the contents of the flash are dumped in ascii format, stored in the log file. Maybe you will need some tidy up in order to isolate just the dump.

Finally, one can convert the ascii dump file (.log) into bin with linux command: xxd -r dump_file.log dump_file.bin

There's no proper information about this SoC. The only official release of Solos/Conexant is a simple brochure with no deep technical data.

The Solos is a 208 PQFP SoC, which means that the pins are accesible.

The main source of information is the GPL code provided by the vendors, in which are the definitions of the SoC, drivers, internal registers, gpios, …

Although the Solos has not PCI bus, there are some interesting peripherals:

• SPI: for flash, VoIP slics or any other peripheral.
• Hardware crypto engine for DES, 3DES, MD5 and SHA1.
• USB 1.1/2.0 with gadget support (needs a ULPI interface for EHCI support).
• 802.11 a/b/g MAC. The CX50221 and CX50321 are simple RF chips.

Hereafter goes an schematic of known pinout:

The CPU contains a minimalistic boot ROM that tries SPI first (the empty socket on the board), then NOR, and if this fails, it falls back to a simple serial monitor that can be used to read/write memory locations and jump to a certain address.

A likely problem is, if the data in NOR flash is not totally invalid, it would still boot from there.

1. Soc CX 94610-11Z
2. Flash memory Spansion S29GL032 (AMD AM29LV320MB)
3. SDRAM memory Etrontech EM638165TS-6G
4. Wireless RF (CX50221 or CX50321)
5. Marvell switch 88E6060
6. Ports for debugging
7. SPI EEPROM socket
8. Wifi on/off button and beneath restore-to-defaults button
9. Bay for USB

Note: This will void your warranty! The case of the Xavi 7968 is composed of 2 pieces:

• Top cover
• Bottom cover

There are only two screws at the bottom of the device. The rest of the case is kept together by two latches at the middle of the device.

Once the screws are out, push away top and bottom pieces firmly without fear. The parts will separate with no damage.

- Clip top and bottom cover
- Screw in the 2 screws at the bottom

→ port.serial general information about the serial port, serial port cable, etc. How to connect to Serial Port:

Solder a header as shown in the picture or wires with a connector directly.

The device uses TTL @ 3.3V and not a standard RS-232 Serial that operates between 3 and 15V, so do not try to connect it to a common serial adapter: you will certainly fry the serial circuit or even the whole board. There are plenty of USB to TTL and RS-232 to TTL available on the market, just be careful with the voltage: the standard is 5V and it may also damage your board. Look for the ones with 3.3V or with both voltages and a way to switch between them.

Don’t forget that the Tx pin of the serial port must linked to the Tx pin of the router and the Rx to Rx!

The config of the serial console is: 38400 bauds 8N1 no-flow control.

Note: Rx and Tx are fully enable. However, it seems that the Tx pin ,i.e. typing commands into the console, is reluctant to be driven to zero voltage. This depends entirely on the PC to TTL 3.3V serial device used. If it happends that the device used is not capable, we can help it by soldering a PNP transistor like 2N3906 onto Tx and GND pins.

Serial interface can be accessed trought the LAN port 1 using a DB9 (Serial) to RJ45 cable, like the one supplied with the Xavi 7768r.

The configuration is 38400,8N1.

→ port.JTAG general information about the JTAG port, JTAG cable, etc.

No JTAG port is reachable. However, JTAG pins in the SoC are:

→ port.GPIO WIP

How to configure LEDs in general, see the LED section in the system.

WIP

→ hardware.buttons The Xavi 7968 has two buttons:

The Reset button is located at the back and cannot be pressed with a finger, you need a small diameter item (like a clip) to push it in. Wifi button is perfectly accessible at the back.