[OpenWrt-Devel] Lantiq xrx200 - switch rtl8367rb controlled via builtin mdio (not gpio sck/sda!) in EasyBox 904xDSL

Arnold Schulz arnysch at gmx.net
Sun Jun 14 17:10:46 EDT 2015

Hi everyone,

for fun I have put efforts to solve some mysteries of the EasyBox 904xDSL.
(here thank you Sylwester and Martin B. for feedback).

Currently code in driver/net/phy/rtl8366_smi.c is used to control rtl836x
chips via bitbanging two gpio lines. This does not work for the 904 xDSL.

Disassembling code from the rtl8367rb.ko (oem firmware) shows that the
rtl8367rb is controlled via mdio registers at 0xBE10B120~128.

I'm pretty sure I identified all gpio usage in rt8367rb.ko. There is
one switch hw reset line (io41). Pin io42 and io43 are setup once
(AltSel1/0:=1/0; no open drain; Dir:=output for io43) and then left alone,
I guess to be driven by internal mdio logic responding to 0xBE10B120~128.

Access to the switch' registers looks somehow cumbersome, e.g.

u32  RTL83XX_SMI_READ(u32 addr)
	ifx_vr9_mdio_write(0, 0x1D, 0xFFFF);
	ifx_vr9_mdio_write(0, 0x1F, 0xE);
	ifx_vr9_mdio_write(0, 0x1D, 0xFFFF);
	ifx_vr9_mdio_write(0, 0x17, addr & 0xFFFF)

	ifx_vr9_mdio_write(0, 0x1D, 0xFFFF);
	ifx_vr9_mdio_write(0, 0x15, 1);

	ifx_vr9_mdio_write(0, 0x1D, 0xFFFF);
	return  ifx_vr9_mdio_read(0, 0x19);

So many more bits are banged over the bus as the code in rtl8366_smi.c
does. Me wondering: there must be a chip between, which relays control
info to the rtl8367rb?

Some more laboriously disassembled and pretty formatted functions are
listed in file  disass_rtl8367rb.ko_mdio-smi.txt  here:

Of course ifx_vr9_mdio_read/write() looks similar to xrx200_mdio_rd/wr()
in drivers/net/ethernet/lantiq_xrx200.c of current OpenWrt kernel code.

Guess I won't be able to provide a patch which utilizes these finding.
If this is of use for anyone, I would be glad to hear about it.

openwrt-devel mailing list
openwrt-devel at lists.openwrt.org

More information about the openwrt-devel mailing list