Analog SOC

From LinuxMIPS
Revision as of 22:10, 26 July 2007 by P2 (talk | contribs)
Jump to: navigation, search

Analog Fusiv is a family of the Home Gateway processors from the Analog Device(ADI). It was bought by Ikanos communication beginning of 2006.

Fusiv AT

Fusiv AT100/200/300 (AD6501/AD6502/AD6503)

Fusiv NP

Fusiv NP210/220/230 (AD6843/AD6844/AD6846)

Fusiv VOX 150

Fusiv VOX 150 (AD6833)

Fusiv VOX 200

Fusiv VX 200 (AD6834)


Hardware

According to Jonah Probell most of them runs on Lexra MIPS clones.

From AD6503 diagram and others diagram found in pdf of each chips, the fusiv platform can support :

  • 2 or 3 MII with accelerator processor
  • interface for ADSL/ADSL2+ with accelerator processor
  • USB (slave and master)
  • mini-pci or pcmcia
  • voice engine DSP and SPI for VoIP
  • Security engine processor (vox 200)
  • Buffer manager processor
  • RNG (random number generator)
  • 2 UART (1 for bluetooth ?)

Devices based on the ADi Fusiv

Linux support

According to Analog, the AD6833/AD6834 could be run under Vxwork or Linux.

Sagem is currently providing box with VxWork and Linux running under a home made Hypervisor, but they are planning to migrate to full Linux 2.6 kernel.

Some rescue softwares use root telnet to check the box version firmware. People discovered the password with ethereal and were able to login on Vxwork. 


[root @ home]$ ps
    Name           Id      Priority  Status StackSize StackHigh  StackMargin    Error        Delay
           CLI 0x80fb4e40    171       READY    16368     1688      14680      0x3d0002         0
       SntpRst 0x80fb5460    171      PEND+T     1008      280        728      0x0        42606978
    tLinuxPool 0x80fb6730    135       DELAY     3264     2376        888      0x0              33
      tLinuxKe 0x80fb7950    180       READY     3936      900       3036      0x0               0
      tLinuxIf 0x80fb8b70    130      PEND+T     3936     1312       2624      0x3d0004        187
          acfT 0x80fbcda0    171       DELAY    16384      940      15444      0x0             523
         wpost 0x80fc0fd0    171       DELAY    16384     1736      14648      0x0             467
        dhcp-s 0x80fda030    171        PEND    32080     3848      28232      0x0               0
           rtp 0x81067aa0    129      PEND+T     7504     4680       2824      0x3d0002          1
       h245Tsk 0x8106e0c0    129      PEND+T    24912     2104      22808      0x3d0002          1
       q931Tsk 0x810778e0    129      PEND+T    37712     2056      35656      0x3d0002          1
         cmTsk 0x81082100    129      PEND+T    41808     2168      39640      0x3d0002         17
         monIf 0x810866b0    171        PEND     4080     1408       2672      0x0               0
          dnsr 0x8108aa70    171      PEND+T     7504     2020       5484      0xb               1
          teld 0x8108cc90    171      PEND+T     7504     3268       4236      0x3d0002          1
          CnsD 0x8108deb0    172       READY     4080     1968       2112      0x3d0002          0
          serd 0x8108e8d0    171        PEND     2032      332       1700      0x0               0
        Logger 0x81090af0    171        PEND     8176     2544       5632      0x0               0
        dynDns 0x80fa4300    171       DELAY    16368     1260      15108      0x0            4114
          http 0x80fa8520    171        PEND    15696     1872      13824      0x0               0
          iTsk 0x810bcb60    129        PEND    15712     1712      14000      0x0               0
          ftpd 0x810c0230    171        PEND     7504     2300       5204      0x0               0
          wpet 0x81164f70    128       DELAY    16368     1000      15368      0x0               1
          usbd 0x8116a190    141      PEND+T    20464      456      20008      0x3d0002          1
  OI_TXIP_TASK 0x8116c3b0    161        PEND     8176      256       7920      0x0               0
  OI_RXIP_TASK 0x81172640    161        PEND     8176     2612       5564      0x0               0
      OIRXTASK 0x81178980    142        PEND     8176     1440       6736      0x0               0
     StackLoop 0x8117aba0    161      PEND+T     8176      904       7272      0x3d0004     582539
     CheckWlan 0x8117e030    141       DELAY     4064      540       3524      0x0             298
          tskt 0x81194950    141        PEND    16368     1204      15164      0x0               0
          osif 0x811b7080    141        PEND    16368     1640      14728      0x0               0
    AtmHostTsk 0x811bb4e0    128        PEND    16368      212      16156      0x0               0
     BmHostTsk 0x815b85a0    131        PEND    16368      384      15984      0x0               0
 apDumpInfoTsk 0x815c2d60    171       DELAY    16368      252      16116      0x0               8
      PstnTask 0x816233c0    161        PEND     8176      396       7780      0x0               0
     RelayTask 0x816255e0    161        PEND     8176      348       7828      0x0               0
  PppResetTask 0x81627800    161        PEND     8176      280       7896      0x0               0
          tmrs 0x817fdd40    128        PEND     7520     1512       6008      0x2a              0
      tExcTask 0x817f4cb0      0        PEND     7984      536       7448      0x3006b           0


Rsh was open, and people were able to run commands and dump the files of the Linux part. 


[root @ home]$ rsh -o -u root 192.168.70.2 dmesg
Loading LX4189 MMU routines.
CPU revision is: 0000c401
Primary instruction cache 16kb, linesize 32 bytes
Primary data cache 16kb, linesize 32 bytes
Linux version 2.4.18 (delizy@VZY08001) (gcc version 2.95.3 20010315 (release/MontaVista)) #93 Mon Jun 6 13:42:05 CEST 2005
Detected 16MB of memory
System clock is 100 MHz
Determined physical RAM map:
memory: 01800000 @ 00000000 (reserved)
memory: 00002000 @ 01800000 (reserved)
memory: 007fe000 @ 01802000 (usable)
memory: 00800000 @ 1f800000 (ROM data)
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: auto debug rw root=/dev/mtdblock2
Timers are getting initalized
Calibrating delay loop... 75.36 BogoMIPS
Memory: 5916k/8184k available (1446k kernel code, 2268k reserved, 137k data, 44k init)
Dentry-cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode-cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
Starting idle task
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
block: 64 slots per queue, batch=16
RAMDISK driver initialized: 16 RAM disks of 512K size 1024 blocksize
loop: loaded (max 8 devices)
ethvl: net device ethvl0 registered.
physmap flash device: 800000 at 1f800000
Amd/Fujitsu Extended Query Table v1.3 at 0x0040
number of CFI chips: 1
AD6843 Residential Gateway flash probe(0x1f800000,8388608,2): 800000 at 1f800000
Amd/Fujitsu Extended Query Table v1.3 at 0x0040
number of CFI chips: 1
Creating 8 MTD partitions on "Analog Devices AD6843 Residential Gateway":
0x00000000-0x00030000 : "Base"
0x00030000-0x00130000 : "App1Rescue"
0x00130000-0x00130100 : "Header"
0x00130100-0x00380000 : "Root"
0x00380000-0x00430000 : "DSL1"
0x00430000-0x00700000 : "App2"
0x00700000-0x00780000 : "Jffs2"
0x00780000-0x00800000 : "DSL2"
ad6843_mtd_init Root partition found at : mtd->index(5)
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 2048)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
VFS: Mounted root (cramfs filesystem).
Freeing unused kernel memory: 44k freed
Sagem init : /etc/sagem_release present, root filesystem seems ok ...
Sagem Release is : Sagem RG1V1 raynaud@VZY08001 17062005_16H54
Warning: unable to open an initial console.
Running /sbin/init

[root @ home]$ rsh -o -u root 192.168.70.2 ps
PID TTY Uid Size State Command
1 root 1112 S init
2 root 0 S [keventd]
3 root 0 S [ksoftirqd_CPU0]
4 root 0 S [kswapd]
5 root 0 S [bdflush]
6 root 0 S [kupdated]
7 root 0 S [mtdblockd]
13 root 0 S [jffs2_gcd_mtd8]
26 root 1116 S /bin/sh /etc/init.d/rc.d/S20telnetd start
36 root 1116 S /bin/sh /etc/init.d/rc.d/S40inetd start
37 root 1312 S inetd -R 1000 --debug
19676 root 1100 S telnetd -debug


Unfortunately, there is no Linux sources for this SoC in the public access at the present time, nor know people that have a Livebox and ask for the sources.

Retrieved from "http://www.linux-mips.org/wiki?title=Analog_SOC&oldid=9247"