Analog SOC
Analog Fusiv is a family of the Home Gateway processors from the Analog Device(ADI). It was bought by Ikanos communication beginning of 2006.
Contents
Fusiv AT
Fusiv AT100/200/300 (AD6501/AD6502/AD6503)
Fusiv NP
Fusiv NP210/220/230 (AD6843/AD6844/AD6846)
Fusiv VOX 150
Fusiv VOX 200
Hardware
According to Jonah Probell most of them runs on Lexra MIPS clones.
From AD6503 diagram and others diagram found in pdf of each chips, the fusiv platform can support :
- 2 or 3 MII with accelerator processor
- interface for ADSL/ADSL2+ with accelerator processor
- USB (slave and master)
- mini-pci or pcmcia
- voice engine DSP and SPI for VoIP
- Security engine processor (vox 200)
- Buffer manager processor
- RNG (random number generator)
- 2 UART (1 for bluetooth ?)
Devices based on the ADi Fusiv
- Sagem Fast 3202/Livebox. This router is sold by lot's french ISP : Wanado, Cegetel, and others.
- Sagem 3302/3303 (TO CHECK)
- Comtrend NexusLink
- Netopia MiAVo
Linux support
According to Analog, the AD6833/AD6834 could be run under Vxwork or Linux.
Sagem is currently providing box with VxWork and Linux running under a home made Hypervisor, but they are planning to migrate to full Linux 2.6 kernel.
Some rescue softwares use root telnet to check the box version firmware. People discovered the password with ethereal and were able to login on Vxwork.
[root @ home]$ ps Name Id Priority Status StackSize StackHigh StackMargin Error Delay CLI 0x80fb4e40 171 READY 16368 1688 14680 0x3d0002 0 SntpRst 0x80fb5460 171 PEND+T 1008 280 728 0x0 42606978 tLinuxPool 0x80fb6730 135 DELAY 3264 2376 888 0x0 33 tLinuxKe 0x80fb7950 180 READY 3936 900 3036 0x0 0 tLinuxIf 0x80fb8b70 130 PEND+T 3936 1312 2624 0x3d0004 187 acfT 0x80fbcda0 171 DELAY 16384 940 15444 0x0 523 wpost 0x80fc0fd0 171 DELAY 16384 1736 14648 0x0 467 dhcp-s 0x80fda030 171 PEND 32080 3848 28232 0x0 0 rtp 0x81067aa0 129 PEND+T 7504 4680 2824 0x3d0002 1 h245Tsk 0x8106e0c0 129 PEND+T 24912 2104 22808 0x3d0002 1 q931Tsk 0x810778e0 129 PEND+T 37712 2056 35656 0x3d0002 1 cmTsk 0x81082100 129 PEND+T 41808 2168 39640 0x3d0002 17 monIf 0x810866b0 171 PEND 4080 1408 2672 0x0 0 dnsr 0x8108aa70 171 PEND+T 7504 2020 5484 0xb 1 teld 0x8108cc90 171 PEND+T 7504 3268 4236 0x3d0002 1 CnsD 0x8108deb0 172 READY 4080 1968 2112 0x3d0002 0 serd 0x8108e8d0 171 PEND 2032 332 1700 0x0 0 Logger 0x81090af0 171 PEND 8176 2544 5632 0x0 0 dynDns 0x80fa4300 171 DELAY 16368 1260 15108 0x0 4114 http 0x80fa8520 171 PEND 15696 1872 13824 0x0 0 iTsk 0x810bcb60 129 PEND 15712 1712 14000 0x0 0 ftpd 0x810c0230 171 PEND 7504 2300 5204 0x0 0 wpet 0x81164f70 128 DELAY 16368 1000 15368 0x0 1 usbd 0x8116a190 141 PEND+T 20464 456 20008 0x3d0002 1 OI_TXIP_TASK 0x8116c3b0 161 PEND 8176 256 7920 0x0 0 OI_RXIP_TASK 0x81172640 161 PEND 8176 2612 5564 0x0 0 OIRXTASK 0x81178980 142 PEND 8176 1440 6736 0x0 0 StackLoop 0x8117aba0 161 PEND+T 8176 904 7272 0x3d0004 582539 CheckWlan 0x8117e030 141 DELAY 4064 540 3524 0x0 298 tskt 0x81194950 141 PEND 16368 1204 15164 0x0 0 osif 0x811b7080 141 PEND 16368 1640 14728 0x0 0 AtmHostTsk 0x811bb4e0 128 PEND 16368 212 16156 0x0 0 BmHostTsk 0x815b85a0 131 PEND 16368 384 15984 0x0 0 apDumpInfoTsk 0x815c2d60 171 DELAY 16368 252 16116 0x0 8 PstnTask 0x816233c0 161 PEND 8176 396 7780 0x0 0 RelayTask 0x816255e0 161 PEND 8176 348 7828 0x0 0 PppResetTask 0x81627800 161 PEND 8176 280 7896 0x0 0 tmrs 0x817fdd40 128 PEND 7520 1512 6008 0x2a 0 tExcTask 0x817f4cb0 0 PEND 7984 536 7448 0x3006b 0
Rsh was open, and people were able to run commands and dump the files of the Linux part.
[root @ home]$ rsh -o -u root 192.168.70.2 dmesg Loading LX4189 MMU routines. CPU revision is: 0000c401 Primary instruction cache 16kb, linesize 32 bytes Primary data cache 16kb, linesize 32 bytes Linux version 2.4.18 (delizy@VZY08001) (gcc version 2.95.3 20010315 (release/MontaVista)) #93 Mon Jun 6 13:42:05 CEST 2005 Detected 16MB of memory System clock is 100 MHz Determined physical RAM map: memory: 01800000 @ 00000000 (reserved) memory: 00002000 @ 01800000 (reserved) memory: 007fe000 @ 01802000 (usable) memory: 00800000 @ 1f800000 (ROM data) On node 0 totalpages: 8192 zone(0): 8192 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: auto debug rw root=/dev/mtdblock2 Timers are getting initalized Calibrating delay loop... 75.36 BogoMIPS Memory: 5916k/8184k available (1446k kernel code, 2268k reserved, 137k data, 44k init) Dentry-cache hash table entries: 4096 (order: 3, 32768 bytes) Inode-cache hash table entries: 2048 (order: 2, 16384 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 8192 (order: 3, 32768 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX Starting idle task Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB. block: 64 slots per queue, batch=16 RAMDISK driver initialized: 16 RAM disks of 512K size 1024 blocksize loop: loaded (max 8 devices) ethvl: net device ethvl0 registered. physmap flash device: 800000 at 1f800000 Amd/Fujitsu Extended Query Table v1.3 at 0x0040 number of CFI chips: 1 AD6843 Residential Gateway flash probe(0x1f800000,8388608,2): 800000 at 1f800000 Amd/Fujitsu Extended Query Table v1.3 at 0x0040 number of CFI chips: 1 Creating 8 MTD partitions on "Analog Devices AD6843 Residential Gateway": 0x00000000-0x00030000 : "Base" 0x00030000-0x00130000 : "App1Rescue" 0x00130000-0x00130100 : "Header" 0x00130100-0x00380000 : "Root" 0x00380000-0x00430000 : "DSL1" 0x00430000-0x00700000 : "App2" 0x00700000-0x00780000 : "Jffs2" 0x00780000-0x00800000 : "DSL2" ad6843_mtd_init Root partition found at : mtd->index(5) NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 2048 bind 2048) NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. VFS: Mounted root (cramfs filesystem). Freeing unused kernel memory: 44k freed Sagem init : /etc/sagem_release present, root filesystem seems ok ... Sagem Release is : Sagem RG1V1 raynaud@VZY08001 17062005_16H54 Warning: unable to open an initial console. Running /sbin/init
[root @ home]$ rsh -o -u root 192.168.70.2 ps PID TTY Uid Size State Command 1 root 1112 S init 2 root 0 S [keventd] 3 root 0 S [ksoftirqd_CPU0] 4 root 0 S [kswapd] 5 root 0 S [bdflush] 6 root 0 S [kupdated] 7 root 0 S [mtdblockd] 13 root 0 S [jffs2_gcd_mtd8] 26 root 1116 S /bin/sh /etc/init.d/rc.d/S20telnetd start 36 root 1116 S /bin/sh /etc/init.d/rc.d/S40inetd start 37 root 1312 S inetd -R 1000 --debug 19676 root 1100 S telnetd -debug
Unfortunately, there is no Linux sources for this SoC in the public access at the present time, nor know people that have a Livebox and ask for the sources.