The design has changed hands a few times, from Texas Instruments to Infineon to Lantiq and perhaps now to Intel.
Terminology:
ar7
is a distinct platform in OpenWrt.xway
only includes the DANUBE- and AR9-based models, not AMAZONxrx200
includes the VR9-based models[1] Infineon called Amazon “AR8” in at least one product brochure. It probably applied to Danube too.
Judging mostly by age and wiki pages:
ADSL and VDSL are generally supported (probably through a combination of GPL dumps for some units and contributions directly from Lantiq; there may still be some blobs?). Some people report that AR9-/VR9-based routers achieve better synchronization than Danube-based boards.
Annex A,B,J,L,M should be supported. see package/network/config/ltq-vdsl-app/files/dsl_control
Danube/Danube-S: They have two MIPS 24kec CPUs, but the second core has few differences that make SMP support impossible. The second core is used for VoIP.
AR9/VR9: Their cores have multithreading support, but it does not work properly with these SoCs without some hacks seen in the source dumps of some boards. For now multithreading is not supported without specific patches for the AR9 and VR9.
A Lantiq WiFi chip. See https://forum.openwrt.org/viewtopic.php?id=45047.
Lantiq SoCs have small mask ROMs capable of booting from various sources, selected by a combination the boot_selN
pins. This mask ROM is what emits “ROM VER x.yy … CFG 0x
” over serial on these devices. Finding those pins on a given device can be tricky, but on several Lantiq-based devices it's the primary mechanism for installation or recovery. Consult the pages for a specific device for details on boot_selN
access discovered so far (if any); since pins have only been found for BGA-packaged chips so far, access probably involves soldering to small surface mount resistor pads.
When the boot_selN
pins select UART mode (or on some SoCs such as the 50601, when the SPI flash can't be read or appears invalid), the mask ROM routine waits for data in hex. The format, which seems to have originated on the Motorola MMC2107, is:
33333333
: data is address/value pairs for writing individual words11111111
: data is a 32-bit checksum, followed by 120 0s of padding99999999
: data is a 32-bit start address, again paddedU-Boot is often the payload, as in this example.
The Motorola toolchain included a Perl script called sikadown.pl
which converted traditional S-record files into this format. OpenWrt's boot
package contains (within Lantiq patches) a newer version, gct.pl
, that is very similar to the one from the DGN1000 Netgear GPL release and does the same with the addition of RAM initialisation.
This is taken from a patent application and the specific example of the the PSB 50601 (Amazon SE), but other variants are likely very similar. What seems to vary between implementations is:
boot_selN
pins:boot_selN
pin is set, and the structure of the flash can mean the set pins are ignored. The PSB 50601 behaves this way.boot_selN
pins can't be located then another approach may be to inhibit flash reads, e.g. pull /CE
high on a serial flash chip.boot_selN
pins before consulting the flash (the VRX268 seems to do this).On an example PSB 50601-based unit the start of SPI, dictated by the mask ROM, is:
AA 55 FF FF 03 02 01 00 0C 00 05 04
This is interpreted as:
0xAA55
(signifies valid flash)0xFF
); unclear what is expected to interpret this, or how0xFF
); unclear what is expected to interpret this, or how00:01:02:03:04:05
), oddly laid out to straddle…0x0C
) in bytes of this header and reserved area (in this case there's no extra reserved space beyond this header)0x00
means valid)If there were any reserved space, it would appear next.
A list of entries then follows. Similar to UART mode, addresses can indicate word writes, block writes or transfer of control:
0b00
) is followed by a single word to be written there0b01
is followed by a length (in 32-bit words) and a block of data to write; should be possible to initialise multiple non-contiguous regions just by concatenating multiple entries of this type0b11
low bits terminates the list:0xFFFFFFFF
: treat the following uint32 as the entry address, jumping to it0x00000003
: attempt to boot from whatever boot_selN
indicates (the next word isn't consulted)The documentation outlines this, and transfers would be quicker than serial. Documentation/tooling welcomed.
On PSB 50601 the JTAG pins are:
SPI pins are:
EXIN = External Interrupt
Lantiq XWAY Danube (gpiochip label = gpio-xway) | ||||
---|---|---|---|---|
GPIO pin | f0 | f1 | f2 | f3 |
GPIO0 | GPIO | EXIN 0 | SDIO | TDM |
GPIO1 | GPIO | EXIN 1 | CBUS | MII |
GPIO2 | GPIO | CGU | EXIN 2 | MII |
GPIO3 | GPIO | CGU | SDIO | PCI REQ3 |
GPIO4 | GPIO | STP | DFE | ASC |
GPIO5 | GPIO | STP | MII | DFE |
GPIO6 | GPIO | STP | GPT | ASC |
GPIO7 | GPIO | CGU | CBUS | MII |
GPIO8 | GPIO | CGU | NMI | MII |
GPIO9 | GPIO | ASC | SPI CS5 | MII |
GPIO10 | GPIO | ASC | SPI CS4 | MII |
GPIO11 | GPIO | ASC | CBUS | SPI CS6 |
GPIO12 | GPIO | ASC | CBUS | MCD |
GPIO13 | GPIO | EBU | SPI CS3 | MII |
GPIO14 | GPIO | CGU | CBUS | MII |
GPIO15 | GPIO | SPI CS1 | SDIO | JTAG |
GPIO16 | GPIO | SPI DI | SDIO | JTAG |
GPIO17 | GPIO | SPI DO | SDIO | JTAG |
GPIO18 | GPIO | SPI CLK | SDIO | JTAG |
GPIO19 | GPIO | PCI GNT3 | SDIO | MII |
GPIO20 | GPIO | JTAG | SDIO | MII |
GPIO21 | GPIO | PCI | EBU | GPT |
GPIO22 | GPIO | SPI CS2 | MCD | MII |
GPIO23 | GPIO | EBU | PCI GNT2 | STP |
GPIO24 | GPIO | EBU | TDM | PCI |
GPIO25 | GPIO | TDM | SDIO | ASC |
GPIO26 | GPIO | EBU | TDM | SDIO |
GPIO27 | GPIO | TDM | SDIO | ASC |
GPIO28 | GPIO | GPT | MII | SDIO |
GPIO29 | GPIO | PCI REQ1 | CBUS | MII |
GPIO30 | GPIO | PCI GNT1 | CBUS | MII |
GPIO31 | GPIO | EBU | PCI REQ2 | MII |
Lantiq XWAY xrx200 (gpiochip label = gpio-xway) | ||||
---|---|---|---|---|
GPIO pin | f0 | f1 | f2 | f3 |
GPIO0 | GPIO | EXIN | SDIO | TDM |
GPIO1 | GPIO | EXIN | CBUS | SIN |
GPIO2 | GPIO | CGU | EXIN | GPHY |
GPIO3 | GPIO | CGU | SDIO | PCI |
GPIO4 | GPIO | STP | DFE | USIF |
GPIO5 | GPIO | STP | GPHY | DFE |
GPIO6 | GPIO | STP | GPT | USIF |
GPIO7 | GPIO | CGU | CBUS | GPHY |
GPIO8 | GPIO | CGU | NMI | NONE |
GPIO9 | GPIO | USIF | SPI | EXIN |
GPIO10 | GPIO | USIF | SPI | EXIN |
GPIO11 | GPIO | USIF | CBUS | SPI |
GPIO12 | GPIO | USIF | CBUS | MCD |
GPIO13 | GPIO | EBU | SPI | NONE |
GPIO14 | GPIO | CGU | CBUS | USIF |
GPIO15 | GPIO | SPI | SDIO | MCD |
GPIO16 | GPIO | SPI | SDIO | NONE |
GPIO17 | GPIO | SPI | SDIO | NONE |
GPIO18 | GPIO | SPI | SDIO | NONE |
GPIO19 | GPIO | PCI | SDIO | CGU |
GPIO20 | GPIO | NONE | SDIO | EBU |
GPIO21 | GPIO | PCI | EBU | GPT |
GPIO22 | GPIO | SPI | CGU | EBU |
GPIO23 | GPIO | EBU | PCI | STP |
GPIO24 | GPIO | EBU | TDM | PCI |
GPIO25 | GPIO | TDM | SDIO | USIF |
GPIO26 | GPIO | EBU | TDM | SDIO |
GPIO27 | GPIO | TDM | SDIO | USIF |
GPIO28 | GPIO | GPT | PCI | SDIO |
GPIO29 | GPIO | PCI | CBUS | EXIN |
GPIO30 | GPIO | PCI | CBUS | NONE |
GPIO31 | GPIO | EBU | PCI | NONE |
GPIO32 | GPIO | MII | NONE | EBU |
GPIO33 | GPIO | MII | NONE | EBU |
GPIO34 | GPIO | SIN | SSI | NONE |
GPIO35 | GPIO | SIN | SSI | NONE |
GPIO36 | GPIO | SIN | SSI | EXIN |
GPIO37 | GPIO | USIF | NONE | PCI |
GPIO38 | GPIO | PCI | USIF | NONE |
GPIO39 | GPIO | USIF | EXIN | NONE |
GPIO40 | GPIO | MII | TDM | NONE |
GPIO41 | GPIO | MII | TDM | NONE |
GPIO42 | GPIO | MDIO | NONE | NONE |
GPIO43 | GPIO | MDIO | NONE | NONE |
GPIO44 | GPIO | MII | SIN | GPHY |
GPIO45 | GPIO | MII | GPHY | SIN |
GPIO46 | GPIO | MII | NONE | EXIN |
GPIO47 | GPIO | MII | GPHY | SIN |
GPIO48 | GPIO | EBU | NONE | NONE |
GPIO49 | GPIO | EBU | NONE | NONE |
The list of related devices: adsl, adsl2+, adsl2, amazon, ar7, ar9, danube, lantiq, vdsl, vdsl2, vinax, vr9