Credits: infos presented here - were collected from different web sites, see reference list - were obtained from feedback, e.g. Email, OpenWrt forums, and mailing lists - are findings and deductions by me from exploring the EasyBox 904 xDSL Disclaimer: some infos here are somehow speculative. Suggestions, corrections, additions sent to arnysch at gmx dot net are welcome. WLAN ---- - wlan is implemented by own subsystem called "RT3883 iNIC" - Main subsystem chips are from Mediatek/Ralink: * RT3883F. "802.11n 2.4/5GHz 3T3R (450/450Mbps) Single Chip AP/Router SoC" * RT5392L. For 2.4GHz only. Almost no infos found on web - RT3883 contains i.a. a CPU core MIPS32 74Kc and wlan logic - Many wireless functions are implemented via proprietary firmware in SoC RT3883. - Firmware uses uC/OS, see https://en.wikipedia.org/wiki/Micro-Controller_Operating_Systems_(MicroC/OS) - At boot time firmware is loaded from /etc/Wireless/RT3883/iNIC_ap.bin (size 576kB). Initial config data is loaded from files in /etc/Wireless/RT3883/ and from /dev/mtd7 (part. "fwdiag") - RT3883 is connected via ethernet to either Lantiq xrx200 internal switch or to extra RTL8367RB switch - Control communication and firmware loading is done via proprietary linux driver rt3883_iNIC.ko possibly using ethernet connection between main system and RT3883 SoC - Driver rt3883_iNIC.ko reads some configuration parameters from files (eg. iNIC_ap.dat, iNIC_e2p.bin) - Driver provides regular linux wlan network interfaces, so wlan can be set up by normal userspace wlan utilities (eg. iwconfig, iwpriv). - 2.4 GHz band is covered by RT5392L, 5 GHz band covered by RT3883F - RT5392L probably connected to and driven by RT3883 - Possibly wlan traffic to ext. ethernet connectors bridged via switches, so main cpu is not involved (?) Problem: - No documentation found about interface and protocols for communicating with RT3883 iNIC subsystem. - Existing driver rt3883_iNIC.ko is proprietary. No source code found. Ethernet Switches ----------------- - There seem to be two ethernet switches in the EasyBox 904 xDSL: * Lantiq VR9 chip (or is this a chipset?) internal switch * Realtek RTL8367RB external switch - Internal switch: driver is in current kernel mainline (drivers/net/ethernet/lantiq_xrx200.c). Apart from that I couldn't find enough infos, so I cannot tell much about it. - Current OpenWrt trunk (2015-06-20) supports RTL8367RB controlling via an SMI bus. This is implemented by bitbanging two gpio lines for the two SMI signals "CLK" and "SDA". This does not work for the Easybox 904 xDSL, however. Here the RTL8367B's MDIO instead of the SMI interface is used. VR9 lines io42 and io43 are operated in MDIO mode and connected to the switch. - There is one switch hw reset line (io41). Pin io42 and io43 are setup once (AltSel1/0:=1/0; no open drain; Dir:=output for io43) by the proprietary driver rtl8367rb.ko. They are then left to the VR9's mdio logic responding to driver read/writes from/to 0xBE10B120~128. - For an example how RTL8367B's registers are accessed via MDIO, see * disass_rtl8367rb.ko_mdio-smi.txt (some disassembled code from Arcadian's proprietary driver rtl8367rb.ko) * rt-n56u.googlecode.excerpt/trunk/linux-3.4.x/drivers/net/rtl8367/ralink_mdio.c (published code for RT-N56U from ASUS). WLAN driver rt3883_iNIC.ko details ---------------------------------- /usr/sbin/mem -u -s 0x1e10b200 -w 0x4024 # MII_CFG_5 /usr/sbin/mem -u -s 0x1e10b204 -w 0xc003 # PCDU_5 /usr/sbin/mem -u -s 0x1e10a40c -w 0x0180 # MAC_CTRL_0 /usr/sbin/mem -u -s 0x1e10b140 -w 0x3205 # PHY_ADDR_5 mac=`getmacaddr.sh wlan 0` # The getmacaddr.sh script derives MAC addresses mac2=`getmacaddr.sh wlan 2` # from the u-boot environment variable 'ethaddr' insmod rt3883_iNIC.ko mode=ap miimaster=eth0 mac=$mac mac2=$mac2 GPIO 21 (/etc/config.sh: CONFIG_GPIO_WIFI_RESET=21) used by rt3883_iNIC.ko in funcion sub_D2B4/mii_open References ---------- rt-n56u.googlecode.excerpt.tar.xz Excerpt from Source code for ASUS RT-N56U (incomplete) at: * https://code.google.com/p/rt-n56u/ * https://github.com/moonman/rt-n56u (branch of code from previous link to Google code) This device uses the RT3662 SoC and a RTL8367M switch. Contains some source code from Ralink. http://nbg5715.shy.cz/GPL/ file NBG5715_100AAAG2_open_code.tar.bz2 Source code for Zyxel NBG5715 (incomplete). This device uses the Mindspeed Comcerto 1000 SoC and a RT3883 iNIC subsystem. Here interesting code also is binary only (e.g. kernel modules). http://gplsource.draytek.com/Vigor2760/v2760_v1212_GPL_release.tar.bz2 GPL sources for Draytek's Vigor2760 Probably currently (2015-06-16) most complete kernel source for Lantiq XRX200. Original EasyBox 904 xDSL firmware source (incomplete): http://www.astorianetworks.com/ http://www.astorianetworks.com/astoria/source/AT904X-03.10_source_20140310.tar.gz http://www.vodafone.de/business/hilfe-support/support-firmware-easybox-904-xdsl.html Firmware images from Vodafone. http://www.randomprojects.org/wiki/Vodafone_EasyBox_904_xDSL Some infos and pictures of board and chips. http://wiki.openwrt.org/toh/arcadyan/easybox_904_lte Some infos about the EasyBox 904 LTE, which is similar to the 904 xDSL. https://forum.openwrt.org/viewtopic.php?id=44676 OpenWrt forum thread about both (!) Easybox 904 LTE and 904 xDSL.