User Tools

Site Tools


toh:xavi:xavi_7968

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
toh:xavi:xavi_7968 [2012/10/13 13:59]
toh:xavi:xavi_7968 [2015/11/30 21:48] (current)
tmomas [[meta:tags]] -> [[meta:tags|How to add tags]]
Line 1: Line 1:
 +====== Xavi 7968 ======
 +===== Supported Versions =====
 +^ Version/​Model ​  ^ S/N          ^ Release Date   ^ OpenWrt Version Supported ​  ^ Model Specific Notes   ^
 +| v1.0            | 2006.10.25 ​  ​| ​               | Yet UNKOWN ​                 |                        |
  
 +===== Hardware Highlights =====
 +^ CPU                    ^ Ram    ^ Flash   ^ Network ​  ^ Gigabit ​  ^ USB   ^ Serial ​  ^ JTag   ^
 +| Conexant CX94610-11Z ​  | 16MB   | 4MB     | 4x1       | No        | No    | Yes      | No     |
 +
 +===== Introduction =====
 +Xavi 7968 uses SoC of Conexant CX 94610-11Z which is in use for other routers, some of them already exploiting linux as OS. However, the vast majority of CX 94610-11Z routers use ATMOS/ISOS firmware developed by GlobespanVirata.
 +
 +{{:​media:​datasheets:​cx94610.jpg?​500|}}
 +
 +The CX94610 CPU probably uses the ARM1026EJ core. You can see the datasheet.[[http://​www.datasheets.org.uk/​dl/​Datasheets-29/​DSA-563138.pdf|here]]
 +
 +==== Routers with Linux embedded ====
 +  * [[:​oldwiki:​openwrtdocs:​hardware:​linksys/​wag54g2|Linksys WAG54G2]]. GPL sources [[ftp://​ftp.linksys.com/​opensourcecode/​wag54g2/​1.00.10 WAG54G2_GPL_v1.00.10_AnnexA.tgz|here]]
 +  * Huawei HG522. No GPL sources available although a very interesting ​ project, based on this router, is [[https://​code.google.com/​p/​ezbox/​|Ezbox]]
 +  * Netgear DG834Gv5. GPL sources [[ftp://​downloads.netgear.com/​files/​GPL/​|here]]
 +  * Netgear MBR624GU. GPL sources [[ftp://​downloads.netgear.com/​files/​GPL/​|here]]
 +  * Level One WBR-3600. GPL sources [[http://​global.level1.com/​downloads.php?​modelstr1=WBR&​modelstr2=3600&​sendtype=0|here]]
 +
 +==== Routers with ATMOS/ISOS ====
 +Xavi 7968, ZTE ZXV10 h608b, Billion Bipac routers, Belkin F5D7634nt4A v1000, Zoom X6 5590c, Pirelli DRG A124G, AtlantisLand A02-RAU244-W300N,​ Intertex SurfinBird IX78
 +
 +===== Installation =====
 +WiP
 +
 +==== Flash Layout ====
 +First let's have a quick view at the [[doc:​techref:​Flash.Layout]] with the original firmware:
 +
 +^                     Xavi 7968  Flash Layout stock firmware ​                  ^^^^
 +^ Layer0 ​       |        Spansion S29GL032 (AMD AM29LV320MB) ​     4096KiB ​      |||
 +^ Layer1 ​       |       ​mtd0 ​       |        mtd1        |          mtd3          |
 +^ Size in KiB   ​| ​     128KiB ​      ​| ​     3200KiB ​      ​| ​        ​576KiB ​        |
 +^ Name          |  **//​pp-boot//​** ​ |  **//​firmware//​** ​ |  **//config files//​** ​ |
 +^ mountpoints ​  ​| ​      ​none ​       |        ???         ​| ​         none          |
 +^ file system ​  ​| ​      ​none ​       |         ?? ​        ​| ​         none          |
 +
 +==== OEM easy installation ====
 +
 +Use "​Firmware Upgrade"​ from the original firmware which can be found at the web interface.
 +
 +===== Software =====
 +==== Serial log ====
 +Using a serial comm device on the pins described in [[#​serial]],​ the log is:
 +<​code>​
 +FSB v0.06 PLL w ln p08 zi
 +
 +Solos 461x PP boot v1.5
 +
 +SDRAM size = 0x1000000
 +Processor clock speed 264.0MHz
 +Finding flashfs partition...done.
 +
 +Found Uncompress/​Self extract image:
 +UnComp.Length 0x3feb10 ​  ​Comp.Length 0x130380
 +Calling Configure_NVS_FromFile.
 +
 +LZMA 4.05
 +
 +Quantum v1.01
 +Phys region /​region/​stung-sdram start @ 0xc00000, end @ 0x1000000, alignment 0x100000
 +Allocatable memory starts @ 0x52cd00, end @ 0xc00000
 +No, or invalid, configuration information in EEPROM - trying FLASH
 +Valid configuration (size 64)
 +DSL gateway version 10.0.1.56 (19th April 2007)
 +BSP: Solos 4610 RD
 +CSP: Solos 461x CSP v1.0
 +Copyright (c) 2004 Conexant Systems Ltd.
 +Entering crypto process.
 +Base address of STUNG memory -> '​0xc00000'​
 +Base address of STUNG memory -> '​0xc00000'​
 +
 +                ,​vvvdP9P???​^ ​  ,,,
 +              vvd###​P^`^ ​        vvvvv v
 +         ​vv#####?​^ ​                 ????####vv,
 +      vv####?? ​    ,​vvvdP???​^ ​ ,,,        ??##^
 +     ​v#####? ​   ,​vvd##​P?​^ ​       #?#v#vvv
 +   ​v#####? ​   v###​P^ ​   ,vvv,        '?#?,
 +  ######? ​  ####?​^ ,​vd#​P?​^ ​    ​`???##​
 +  #####? ​  ​v#### ​ ,​d##​P^ ​          ''​
 + ###### ​  ​v#### ​ ]###L                   ​_ ​  ​_ ​         _                  ___
 + #####? ​  ​v#### ​ ]##L                   / ​  / \  |\ |  |_  \/   /​\ ​  |\ |   |
 + ###### ​   ####  ]###L                  \_  \_/  | \|  |_  /\  /--\  | \|   |
 + ?#####​v ​  ####​v ​ ]##h,            ,,
 +  ?##### ​   ?###​h, ​ `9#​hv, ​    ,​vv###​
 +    ###### ​   #####​L ​   ]###L        ,v#v'
 +    ?#####​vv ​   ?​9##​hv, ​       ,,​vvvv###'​
 +       ?#####​vv ​    ​`??​9P\vv, ​  ​^ ​        vv##,
 +          ###### ​                      #######​L
 +            ??###​hvv, ​         ,​vvv#?##?????​
 +                `????​9hdhvv,​
 +
 +Login:
 +
 +</​code>​
 +
 +==== PP-Boot ====
 +The booting firmware is called [[:​doc:​techref:​bootloader:​pp_boot|PP-Boot]] release 1.5.
 +
 +During first seconds of booting, hitting <​space>​ bar will enter into PP-Boot console mode with access to its commands.
 +
 +Note: Although it's not the case by default, it seems that Xavi 7968 could accept [[:​doc:​techref:​bootloader:​uboot|U-Boot]] as bootloader. There are evidences that it has been done for other routers with same SoC:
 +  * Edimax released some code with an uboot for Solos chipset. Inside the gpl released for the AR-7284WnB router we can find the TBSBOOT which is just a **crippled** u-boot compatible with Conexant SolosW among others.
 +[[http://​www.edimax.com/​images/​Image/​OpenSourceCode/​Wireless/​Router/​AR-7284WnA/​AR-7284WnA&​B_SDK_6222.tar.zip]]
 +
 +  * Another source with incomplete u-boot sources for the Solos is in the ezbox project.
 +[[http://​code.google.com/​p/​ezbox/​source/​browse/​sub-projects/​porting/​huawei/​hg522c-cnxt/​build/​open-src/​bootloader/​]]
 +
 +The u-boot project [[http://​www.denx.de/​wiki/​U-Boot/​WebHome|U_BOOT]] support for the arm1026ejs on version 2009.08 or later
 +
 +=== Commands ===
 +Command "?"​ or "​help"​ will show you the following list:
 +<​code>​Commands to the console are:
 + ​configeeprom ​            ​display EEPROM configuration information
 + ​configflash ​             display FLASH configuration information
 +        mac <​address> ​              set MAC address
 +        networkboot {yes | auto}    boot auto-select Ethernet, USB or PCI
 +        networkboot ethernet ​       boot from Ethernet only
 +        networkboot usb             boot from USB only
 +        networkboot pci             boot from PCI only
 +        networkboot no              boot from FLASH
 +        networkboot ask             ​always prompt user for boot source
 +        copyimages {yes | no}       copy network booted image files
 +        flashfs {auto | emergency} ​ use automatic FLASHFS selection or
 +                                    force boot from emergency FLASHFS
 +        flashnetboot {yes | no}     flash boots auto network boots
 +        autolanrecover {yes | no}   ​attempt LAN recovery if flash corrupt
 +        initialise ​                 initialise configuration information
 +        listenv ​                    list environment variables
 +        setenv <key> <​value> ​       set environment variable
 +        unsetenv <​key> ​             unset environment variable
 +        pda read                    read PDA information
 + ​configpci ​                         display EEPROM PCI configuration
 + ​configpci set <idx> <​addr>​ <​data> ​ set PCI pair
 + dw <​address>​ [<​length>​] ​ dump words (hex/ascii)
 + enter <​address> ​         enter an image
 + erw <​wrdaddress> ​        read a single word from EEPROM
 + eww <​wrdaddress>​ <​value>​ write a single word to EEPROM
 + fdw <​address>​ [<​length>​] dump flash words (hex/ascii)
 + flash config ​            print flash configuration
 + ​help ​                    print this text
 + ​netboot [recover] ​       perform immediate network boot [in recovery mode]
 + ​quit ​                    leave the console
 + ​reset ​                   reset system
 + rw <​address> ​            read a single word
 + ​why ​                     reason for console entry
 + ww <​address>​ <​value> ​    write a single word
 + ​xmodem [fast] ​           download mkflash image using X-Modem
 +</​code>​
 +
 +All commands related to the eeprom i.e. configeeprom,​ configpci, erw and eww are disabled since no eeprom is present.
 +
 +=== Log of "flash config"​ ===
 +This is the output of this command:
 +<​code>​
 +Flash configuration:​ 1 chips
 +Chip 0 auto-sizing,​ actual size 4096k on EPB @ 0x38000000
 +Chip 0 ID is 17e: (AMD AM29LV320MB 4096k bytes), unlocked (0)
 +Chip 0 using multi-byte write with a 32 byte buffer
 +Flash start offset: 0x00030000
 +Space for all FLASHFS partitions: 0x003d0000
 +found partition at 0x003e0000 ... 0x00400000, size 128kbytes
 +found partition at 0x000c0000 ... 0x003e0000, size 3200kbytes
 +found partition at 0x00030000 ... 0x000c0000, size 576kbytes
 +Found 3 valid flashfs partitions
 +</​code>​
 +
 +=== Dumping flash memory ===
 +One can dump the values of the whole flash by utilizing command ''​fwd''​.
 +
 +  - Enter PP-Boot console (via serial comm and hit <​space>​)
 +  - Enable log file of the current session and write down the path where the file will be
 +  - Type in the following command:
 +<​code>​
 +fdw 0 400000
 +</​code>​
 +  - Wait until end of dumping (approx 1h 20min)
 +  - Close session.
 +
 +Explanation:​ The command will dump on screen the values of flash memory starting from 0x0 for a lenght of 0x400000 (4Mbytes), which is the full length of the flash memory.
 +
 +Now the contents of the flash are dumped in ascii format, stored in the log file. Maybe you will need some tidy up in order to isolate just the dump.
 +
 +Finally, one can convert the ascii dump file (.log) into bin with linux command:
 +''​xxd -r dump_file.log dump_file.bin''​
 +
 +===== Hardware =====
 +==== Info ====
 +| **Architecture:​** | ARM | 
 +| **Vendor:** | Conexant/​Ikanos | 
 +| **Bootloader:​** | PP Boot | 
 +| **System-On-Chip:​** | CX94610-11Z (ARM1026EJ-S) Little endian| ​
 +| **CPU Speed:** | 264 Mhz | 
 +| **Flash-Chip:​** | Spansion S29GL032 ([[http://​www.farnell.com/​datasheets/​50369.pdf|AMD AM29LV320MB]]) | 
 +| **Flash size:** | 4096 KiB | 
 +| **RAM-Chip:​** | Etrontech EM638165TS-6G | 
 +| **RAM:** | 16 MiB | 
 +| **Wireless:​** | Conexant CX50221 or CX50321 a/b/g | 
 +| **Ethernet:​** | Marvell 88E6060 (configured through MII bus) |
 +| **USB:** | Yes 1 x 2.0 (some soldering needed) | 
 +| **Serial:** | [[#​Serial|Yes]] | 
 +| **JTAG:** | Possible |
 +
 +==== About CX 94610-11Z ====
 +There'​s no proper information about this SoC. The only official release of Solos/​Conexant is a simple [[http://​www.alldatasheet.com/​datasheet-pdf/​pdf/​216803/​CONEXANT/​CX94610.html|brochure]] with no deep technical data.
 +
 +The Solos is a 208 PQFP SoC, which means that the pins are accessible. ​
 +
 +The main source of information is the GPL code provided by the vendors, in which are the definitions of the SoC, drivers, internal registers, gpios, ... 
 +
 +Although the Solos has no PCI bus, there are some interesting peripherals:​
 +
 +  * SPI: For flash, VoIP slics or any other peripheral.
 +  * Hardware crypto engine for DES, 3DES, MD5 and SHA1.
 +  * USB 1.1/2.0 with gadget support (needs a ULPI interface for EHCI support).
 +  * 802.11 a/b/g MAC. The CX50221 and CX50321 are simple RF chips.
 +
 +=== Known pinout ===
 +Hereafter goes an schematic of known pinout:
 +
 +{{:​media:​datasheets:​cx94610-11z_pinout.png?​400|}}
 +
 +=== Booting ===
 +The CPU contains a minimalistic boot ROM that tries SPI first (the empty socket on the board), then NOR, and if this fails, it falls back to a simple serial monitor that can be used to read/write memory locations and jump to a certain address.
 +
 +A likely problem is, if the data in NOR flash is not totally invalid, it would still boot from there.
 +
 +
 +==== Board layout ====
 +<​columns>​
 +{{:​media:​xavi:​xavi_7968_board_layout.png?​400|}}
 +
 +<​newcolumn>​
 +  - Soc CX 94610-11Z
 +  - Flash memory Spansion S29GL032 (AMD AM29LV320MB)
 +  - SDRAM memory Etrontech EM638165TS-6G
 +  - Wireless RF (CX50221 or CX50321)
 +  - Marvell switch 88E6060
 +  - Ports for debugging
 +  - SPI EEPROM socket
 +  - Wifi on/off button and beneath restore-to-defaults button
 +  - Bay for USB
 +</​columns>​
 +
 +==== Opening/​closing the case ====
 +**Note:** This will void your warranty!
 +
 +The case of the Xavi 7968 is composed of 2 pieces:
 +
 +  * Top cover 
 +  * Bottom cover
 +
 +There are only two screws at the bottom of the device. The rest of the case is kept together by two latches at the middle of the device. Once the screws are out, push away top and bottom pieces firmly without fear. The parts will separate with no damage.
 +  ​
 +=== Putting it back together ===
 +
 +  - Clip top and bottom cover
 +  - Screw in the 2 screws at the bottom
 +
 +==== Serial ====
 +-> [[doc:​hardware:​port.serial]] general information about the serial port, serial port cable, etc.
 +
 +== Connecting through the pins ==
 +Solder a header as shown in the picture or wires with a connector directly.
 +
 +The device uses TTL @ 3.3V and not a standard RS-232 Serial that operates between 3 and 15V, so do not try to connect it to a common serial adapter: you will certainly fry the serial circuit or even the whole board. There are plenty of USB to TTL and RS-232 to TTL available on the market, just be careful with the voltage: the standard is 5V and it may also damage your board. Look for the ones with 3.3V or with both voltages and a way to switch between them.
 +
 +Don’t forget that the **Tx pin** of the serial port must linked to the **Tx pin** of the router and the Rx to Rx!
 +
 +The config of the serial console is: 38400 bauds 8N1 no-flow control.
 +
 +**Note**: Rx and Tx are fully enable. However, it seems that the Tx pin ,i.e. typing commands into the console, is reluctant to be driven to zero voltage. This depends entirely on the PC to TTL 3.3V serial device used. If it happends that the device used is not capable, we can help it by soldering a PNP transistor like 2N3906 onto Tx and GND pins.
 +^ PNP   ^ Board pin   ^ Serial ​  ^
 +| B     | -           | Tx       |
 +| E     | Tx          | -        |
 +| C     | GND         | GND      |
 +
 +{{:​media:​xavi:​xavi_7968_serial_port.png?​400|}}
 +
 +== Connecting trough a DB9 to RJ45 cable ==
 +Serial interface can be accessed trought the LAN port 1 using a DB9 (Serial) to RJ45 cable, like the one supplied with the Xavi 7768r.
 +
 +^ DB9   ^ Use   ^ RJ45   ^
 +| 2     | RX    | 8      |
 +| 3     | TX    | 7      |
 +| 5     | GND   | 5      |
 +
 +The configuration is 38400, 8N1.
 +
 +==== JTAG ====
 +-> [[doc:​hardware:​port.JTAG]] general information about the JTAG port, JTAG cable, etc.
 +
 +No JTAG port is reachable. However, JTAG pins in the SoC are:
 +^ PIN No   ^ Description ​  ^
 +| 149      | JTAG_N_TRST ​  |
 +| 150      | JTAG_TCLK ​    |
 +| 151      | JTAG_TDI ​     |
 +| 152      | JTAG_MODE ​    |
 +| 154      | JTAG_TMS ​     |
 +| 155      | JTAG_TDO ​     |
 +
 +==== GPIOs ====
 +-> [[doc:​hardware:​port.GPIO]]
 +WIP
 +
 +==== LEDs ====
 +How to configure LEDs in general, see the LED section in the [[doc/​uci/​system]].
 +
 +WIP
 +
 +==== Buttons ====
 +-> [[doc:​howto:​hardware.button]]
 +The Xavi 7968 has two buttons:
 +^ BUTTON ​  ^ Event         ^
 +| Reset    | reset         |
 +| Wifi     | Wifi on/​off ​  |
 +
 +The Reset button is located at the back and cannot be pressed with a finger, you need a small diameter item (like a clip) to push it in. Wifi button is perfectly accessible at the back.
 +
 +===== Debricking =====
 +
 +===== Information =====
 +Mandrake published patches for kernel 2.6.28. Can be found here:
 +[[http://​sourceforge.net/​projects/​openwag/​files/​WAG54G2/​]]
 +
 +===== Tags =====
 +[[meta:​tags|How to add tags]]
 +{{tag>​FastEthernet 1NIC 1WNIC 4Port ARM ARMv5 16RAM 4Flash adsl2+ wip}}