Lantiq SoCs

The design has changed hands a few times, from Texas Instruments to Infineon to Lantiq, then to Intel and perhaps now to MaxLinear.

Terminology:

  • The AR7 is included here for historical context but ar7 is a distinct platform in OpenWrt.
  • Lantiq applied the XWAY trademark to various parts (see product brochures/listings) but in BB, CC and trunk (as of 2016-05):
    • OpenWrt's xway only includes the DANUBE- and AR9-based models, not AMAZON
    • OpenWrt's xrx200 includes the VR9-based models
  • but see OpenWrt Support for details
DSL-Version SoC-Family SoC cpu Devices
ADSL2+ AR7 AR7 4Kc + C62x D-Link DSL-502T (gen. 2)
D-Link DSL-504T
D-Link DSL-524T
D-Link DSL-584T
D-Link DSL-G624T
Linksys AG241
Linksys RTP300 and WRTP54G
Linksys AG310
Linksys WAG54GP
FRITZ!Box Fon WLAN 7112
ZyXEL P-2602HWN-D7A
AMAZON “AR8”[1] AMAZON-ME (PSB 50505) 4KEc Speedport W 700V
D-Link "HorstBox" DVA-G3342SD
AMAZON-SE-lite (PSB 50600)
AMAZON-SE (PSB 50601) ADB 1000g
Netgear DGN1000
Samsung SMT-G3000
Thomson TG585v8
ZTE ZXV10 H108L
AMAZON-S (PSB 50610) vigor2830_series
DANUBE DANUBE (PSB 50702) 2x 24KEc Airties WAV-281
Arcadyan ARV4518PW (SMC-7908-ISP)
Arcadyan ARV7506PW11 (Alice IAD 4421 / o2 Box 4421)
Arcadyan ARV7510PW
Astoria Networks ARV7518PW
Arcadyan ARV7519PW
Arcadyan ARV752DPW (Vodafone EasyBox 802)
Astoria Networks ARV752DPW22 (Arcor/Vodafone DSL-EasyBox 803A)
Belkin F5D8635-4v1
MediaPack MP-252
SIEMENS / SAGEM Gigaset SX762 / SX763
Speedport W 502V
Speedport W 503V Typ C
Speedport W 504V
Speedport W 722V Typ B
DANUBE-S (PSB 50712) 2x 24KEc Siemens Gigaset 604 IL
BT HomeHub 2.0 Type B
ARX100 “AR9” ARX168 34Kc Buffalo WBMR-HP-G300H
Netgear DGN3500
Aztech GR7000
ZyXEL P-661HNU-F3
BT HomeHub 3.0a
FRITZ!Box Fon WLAN 7320
FRITZ!Box Fon WLAN 7330
VTECH NetiaSpot
ARX182 ZTE ZXV10-H201L
ZyXEL P-2601HN-Fx
ARX188 FRITZ!Box 7312
VDSL2 VINAX VINAX-VE/-A 2× 24KEc
VINAX-E/-A
VINAX-D/-A ALLNET ALL126Ax2 ?
VRX200 “VR9” VRX220 34Kc Netgear DM200
AVM FRITZ!Box 7412
VRX288 / VRX208 AVM FRITZ!Box WLAN 3370
FRITZ!Box WLAN 3390
FRITZ!Box Fon WLAN 7360
FRITZ!Box Fon WLAN 7490
FRITZ!Box 6840 LTE
Astoria Networks ARV7519RW22 (Livebox 2.1)
Astoria Networks VGV7519KW (KPN Experia Box v8)
Arcadyan VGV7510KW22 (o2 Box 6431)
Draytek Vigor 2760(Vn)/(Delight)
TP-Link Archer VR200v
ZyXEL P-2812HNU-F1
ZyXEL P-2812HNU-F3
VRX268 / VRX208 TP-Link TD-W8970
TP-Link TD-W8980
TP-Link TD-W9980
Netgear VEVG2500
BT Home Hub 5 Type A
BT OpenReach VG3503J
VRX208 -- AFE and Line driver
ADSL2+ ARX300 ARX388 34Kc ADSL2+/Ethernet SoC with integrated high-performance WLAN, GbitE LAN/WAN, 2-4 Ch FxS and CATiq support
ARX382 ADSL2+/Ethernet SoC with integrated cost-effective WLAN, FastE LAN/WAN, 2-4 Ch FxS and CATiq support
ARX368 ADSL2+/Ethernet SoC with integrated high performance WLAN and GbitE LAN/WAN
TP-Link Archer D2 AC750
ARX362 ADSL2+/Ethernet SoC with integrated cost-effective WLAN and FastE LAN/WAN
none GRX300 GRX388 Gigabit Ethernet Router/Gateway SoC with integrated 3×3 Wi-Fi
GRX387 Gigabit Ethernet Router/Gateway SoC with integrated 2×2 Wi-Fi
none GRX350 PXB4395 interAptiv Gigabit Ethernet Router/Gateway Soc with USB, PCIe 2
PXB3395EL1600
GRX550 PXB4583EL
VDSL2 ? VRX318 -- ADSL2/2+/VDSL Transceiver and Line Driver for GRX388/GRX387
VDSL2 ? VRX518 -- ADSL/VDSL2(35b) Transceiver and Line Driver for GRX350 / GRX550
AVM FRITZ!Box 7520 / 7530

[1] Infineon called Amazon “AR8” in at least one product brochure. It probably applied to Danube too.

Intel/MaxLinear product name Lantiq product name Lantiq marking
SLC110 SLIC110 PEF41068
SLC120 SLIC120 PEF42068
SLC121 SLIC121 PEF42168
SLC210 SLIC210 PEF41078
SLC220 SLIC220 PEF42078

Judging mostly by age and wiki pages:

  • DANUBE devices: look pretty well supported, with builds for many devices having been in the system for years.
  • xRX2xx devices: seem to work fine (speaking from experience of the BTHH5A, and the healthy wiki pages of the ZyXEL P2812HNU-Fx).
  • AR9 devices: the Buffalo WBMR-HP-G300H and Netgear DGN3500B wiki pages look healthy.
  • AMAZON-SE devices: platform support has been around since 2011 and remains, but timing was unkind; support consolidated shortly after the Attitude Adjustment freeze, but as few devices/user reports existed, build support got dropped again before Barrier Breaker. There has been some success building trunk (2016-05) for the DGN1000.
  • AMAZON-ME: no data; anecdotally: “we tried booting OpenWrt on [one]: we never got a single response from it (even after hacking around in some linux early-boot code...)”
  • VINAX, other AMAZON variants: no data

ADSL and VDSL are generally supported (probably through a combination of GPL dumps for some units and contributions directly from Lantiq; there may still be some blobs?). Some people report that AR9-/VR9-based routers achieve better synchronization than Danube-based boards.

:!: Annex A,B,J,L,M should be supported. see package/network/config/ltq-vdsl-app/files/dsl_control

Danube/Danube-S: They have two MIPS 24kec CPUs, but the second core has few differences that make SMP support impossible. The second core is used for VoIP.

AR9/VR9: Their cores have multithreading support, but it does not work properly with these SoCs without some hacks seen in the source dumps of some boards. For now multithreading is not supported without specific patches for the AR9 and VR9.

Lantiq SoCs have small mask ROMs capable of booting from various sources, selected by a combination the boot_selN pins. This mask ROM is what emits “ROM VER x.yy ... CFG 0x” over serial on these devices. Finding those pins on a given device can be tricky, but on several Lantiq-based devices it's the primary mechanism for installation or recovery. Consult the pages for a specific device for details on boot_selN access discovered so far (if any); since pins have only been found for BGA-packaged chips so far, access probably involves soldering to small surface mount resistor pads. Be careful, if you short the pins too long it is possible to create a loop. In this case the SoC tries always to boot e.g. from CFG 04 (UART). In this case your SoC is bricked!

The bootloader is typically U-Boot, sometimes brnboot.

When the boot_selN pins select UART mode (or on some SoCs such as the 50601, when the SPI flash can't be read or appears invalid), the mask ROM routine waits for data in hex. The format, which seems to have originated on the Motorola MMC2107, is:

  • lines start with addresses (8 hex digits, encoding a 32-bit address)
  • addresses are followed by data (128 hex digits, encoding 64 bytes)
  • aligned addresses simply denote 64-byte writes at the corresponding locations
  • selected unaligned addresses cause data to be interpreted differently:
    • 33333333: data is address/value pairs for writing individual words
      • this is typically used first, to configure some RAM access (SRAM? SDRAM? cache-as-RAM?) so there's somewhere to store the image
      • unused pairs seem to use all zeros for address/value
    • 11111111: data is a 32-bit checksum, followed by 120 0s of padding
    • 99999999: data is a 32-bit start address, again padded

U-Boot is often the payload, as in this example.

The Motorola toolchain included a Perl script called sikadown.pl which converted traditional S-record files into this format. OpenWrt's boot package contains (within Lantiq patches) a newer version, gct.pl, that is very similar to the one from the DGN1000 Netgear GPL release and does the same with the addition of RAM initialisation.

This is taken from a patent application and the specific example of the the PSB 50601 (Amazon SE), but other variants are likely very similar. What seems to vary between implementations is:

  • Ease of influencing the boot via boot_selN pins:
    • Some might load and run code from any valid-looking flash if any boot_selN pin is set, and the structure of the flash can mean the set pins are ignored. The PSB 50601 behaves this way.
      • On these, if the boot_selN pins can't be located then another approach may be to inhibit flash reads, e.g. pull /CE high on a serial flash chip.
    • Others might honour the boot_selN pins before consulting the flash (the VRX268 seems to do this).
  • Fallback mechanism; some may default to UART if other methods fail, some may not.

On an example PSB 50601-based unit the start of SPI, dictated by the mask ROM, is:

AA 55 FF FF  03 02 01 00  0C 00 05 04

This is interpreted as:

  • the signature/magic 0xAA55 (signifies valid flash)
  • a PHY0 address (0xFF); unclear what is expected to interpret this, or how
  • a PHY1 address (0xFF); unclear what is expected to interpret this, or how
  • a MAC (here 00:01:02:03:04:05), oddly laid out to straddle...
  • the size (0x0C) in bytes of this header and reserved area (in this case there's no extra reserved space beyond this header)
  • a validity flag for the MAC address (0x00 means valid)

If there were any reserved space, it would appear next.

A list of entries then follows. Similar to UART mode, addresses can indicate word writes, block writes or transfer of control:

  • a plain address with clear low bits (0b00) is followed by a single word to be written there
  • an address ORed with 0b01 is followed by a length (in 32-bit words) and a block of data to write; should be possible to initialise multiple non-contiguous regions just by concatenating multiple entries of this type
  • a uint32 with 0b11 low bits terminates the list:
    • 0xFFFFFFFF: treat the following uint32 as the entry address, jumping to it
    • 0x00000003: attempt to boot from whatever boot_selN indicates (the next word isn't consulted)

The documentation outlines this, and transfers would be quicker than serial. Documentation/tooling welcomed.

On PSB 50601 the JTAG pins are:

  • 49: TDO
  • 50: TMS
  • 51: nTRST
  • 52: TDI
  • 53: TCK

SPI pins are:

  • 44: CLK
  • 45: MOSI
  • (46 unknown)
  • 47: MISO
  • 48: Slave select (probably the first of several)

EXIN = External Interrupt

Lantiq XWAY Danube (gpiochip label = gpio-xway)
GPIO pin f0 f1 f2 f3
GPIO0 GPIO EXIN 0 SDIO TDM
GPIO1 GPIO EXIN 1 CBUS MII
GPIO2 GPIO CGU EXIN 2 MII
GPIO3 GPIO CGU SDIO PCI REQ3
GPIO4 GPIO STP DFE ASC
GPIO5 GPIO STP MII DFE
GPIO6 GPIO STP GPT ASC
GPIO7 GPIO CGU CBUS MII
GPIO8 GPIO CGU NMI MII
GPIO9 GPIO ASC SPI CS5 MII
GPIO10 GPIO ASC SPI CS4 MII
GPIO11 GPIO ASC CBUS SPI CS6
GPIO12 GPIO ASC CBUS MCD
GPIO13 GPIO EBU SPI CS3 MII
GPIO14 GPIO CGU CBUS MII
GPIO15 GPIO SPI CS1 SDIO JTAG
GPIO16 GPIO SPI DI SDIO JTAG
GPIO17 GPIO SPI DO SDIO JTAG
GPIO18 GPIO SPI CLK SDIO JTAG
GPIO19 GPIO PCI GNT3 SDIO MII
GPIO20 GPIO JTAG SDIO MII
GPIO21 GPIO PCI EBU GPT
GPIO22 GPIO SPI CS2 MCD MII
GPIO23 GPIO EBU PCI GNT2 STP
GPIO24 GPIO EBU TDM PCI
GPIO25 GPIO TDM SDIO ASC
GPIO26 GPIO EBU TDM SDIO
GPIO27 GPIO TDM SDIO ASC
GPIO28 GPIO GPT MII SDIO
GPIO29 GPIO PCI REQ1 CBUS MII
GPIO30 GPIO PCI GNT1 CBUS MII
GPIO31 GPIO EBU PCI REQ2 MII
Lantiq XWAY xrx200 (gpiochip label = gpio-xway)
GPIO pin f0 f1 f2 f3
GPIO0 GPIO EXIN SDIO TDM
GPIO1 GPIO EXIN CBUS SIN
GPIO2 GPIO CGU EXIN GPHY
GPIO3 GPIO CGU SDIO PCI
GPIO4 GPIO STP DFE USIF
GPIO5 GPIO STP GPHY DFE
GPIO6 GPIO STP GPT USIF
GPIO7 GPIO CGU CBUS GPHY
GPIO8 GPIO CGU NMI NONE
GPIO9 GPIO USIF SPI EXIN
GPIO10 GPIO USIF SPI EXIN
GPIO11 GPIO USIF CBUS SPI
GPIO12 GPIO USIF CBUS MCD
GPIO13 GPIO EBU SPI NONE
GPIO14 GPIO CGU CBUS USIF
GPIO15 GPIO SPI SDIO MCD
GPIO16 GPIO SPI SDIO NONE
GPIO17 GPIO SPI SDIO NONE
GPIO18 GPIO SPI SDIO NONE
GPIO19 GPIO PCI SDIO CGU
GPIO20 GPIO NONE SDIO EBU
GPIO21 GPIO PCI EBU GPT
GPIO22 GPIO SPI CGU EBU
GPIO23 GPIO EBU PCI STP
GPIO24 GPIO EBU TDM PCI
GPIO25 GPIO TDM SDIO USIF
GPIO26 GPIO EBU TDM SDIO
GPIO27 GPIO TDM SDIO USIF
GPIO28 GPIO GPT PCI SDIO
GPIO29 GPIO PCI CBUS EXIN
GPIO30 GPIO PCI CBUS NONE
GPIO31 GPIO EBU PCI NONE
GPIO32 GPIO MII NONE EBU
GPIO33 GPIO MII NONE EBU
GPIO34 GPIO SIN SSI NONE
GPIO35 GPIO SIN SSI NONE
GPIO36 GPIO SIN SSI EXIN
GPIO37 GPIO USIF NONE PCI
GPIO38 GPIO PCI USIF NONE
GPIO39 GPIO USIF EXIN NONE
GPIO40 GPIO MII TDM NONE
GPIO41 GPIO MII TDM NONE
GPIO42 GPIO MDIO NONE NONE
GPIO43 GPIO MDIO NONE NONE
GPIO44 GPIO MII SIN GPHY
GPIO45 GPIO MII GPHY SIN
GPIO46 GPIO MII NONE EXIN
GPIO47 GPIO MII GPHY SIN
GPIO48 GPIO EBU NONE NONE
GPIO49 GPIO EBU NONE NONE
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/18 11:38
  • by ferenc