[Solved] Speedport W504V - Initialization of ADSL Modem

Hi,

I am evaluating if I could use LEDE/OpenWrt on my Speedport W504V. Because I am afraid to flash a firmware before being sure that it'll work as expected I am testing with initramfs images. The images need to be loaded to 0x80002000 so I rebuilt U-Boot to be loadable to an address somewhere at the and of the RAM (0x83f02000). This way I can tftp the images to the router and boot them.

However I am now struggeling to get the ADSL modem to work. I see that dsl_cpe_control is used to control the modem, but documentation of this tool seems scarce and my knowledge about DSL is not enough to really understand the problem.
Maybe someone can help me by answering a few questions:

  • Is it correct that, without supplying any PPPoE credentials, it should be possible to initialize the modem and a device node should appear somewhere under `/dev'? Where would that be?
  • Is anything else needed for initializing the modem apart from using the correct firmware + Annex (xtu string)? For the W504V do I have to change to Annex B instead of (the default) Annex A?
  • How are the kernel drivers ltq_atm_danube, ltq_mei_danube and drv_dsl_cpe_api involved in operating the modem, do I need all of them?
  • How can I further diagnose what the problem might be (I used dsl_cpe_control to see the line state - 0xff)?

Please see also the bootlog of a LEDE 17.01.4 initramfs image. The obivious problematic lines are the IFX_MEI_RunAdslMode errors.

Hopefully somebody can give me an explanation of what might be going wrong - thanks!

In general, ADSL on danube devices should work. Without having tested such a device myself, everything except for DECT (and probably ISDN FXO/ FXS) should be working - but that doesn't necessarily mean that the ramdisk images contain all necessary packages (at least for xrx200, they appear to be much smaller than the sysupgrade images).

On my xrx200 devices, I see /dev/dsl_cpe_api0 and /dev/mei_cpe/0 - but "/etc/init.d/dsl_control status" should give you the link status.

While you do need to configure the annex, the correct firmware will be included (at least in the sysupgrade image).

Hi slh,

yes the ramdisk image does not contain everything, that is why I rebuilt it, in this case the sysupgrade and ramdisk images both contain the same packages. I don’t know why the official ramdisk images differ.

As the rebuild did not work either I now also extracted the contents of the squash-fs from the official images to the root before recreating the ramdisk image – Same result.
The firmware is included in both cases.

I am going to have a look if I also see both /dev/dsl_cpe_api0 and /dev/mei_cpe/0.

When using `/etc/init.d/dsl_control status‘ for example the ATU-C is never available and the line state keeps staying at 0xff. Is my understanding correct that up to this point I do not need PPPoE credentials?
Any way to use /sbin/dsl_cpe_control to further diagnose what is wrong with the modem?

The only idea I currently have is to kprintf-debug the ltq-adsl-mei Module for the cause of the error messages from the bootlog.

I have never tried to get online with a ramdisk image so far. Given that the device in question is supposed to work, I'd suggest to just flash LEDE and to give it a try with a full featured image.

If the Speedport W504V is your only means of connecting to the internet, I'd probably suggest to get a second device for playing around. Used lantiq/ danube devices already start at 3.95 EUR from larger stores, but even more powerful and VDSL2 capable used devices can be found between 5 and 10 EUR.

Hi,

I have now a spare device as you suggested. And while I was impressed with the performance (the boot is now much faster when compared to the ramfs variant which I have no explanation for) I still have problems with the DSL modem.

I now disabled the dsl_control init script to be able to manually start the daemon. This is what I see:

root@OpenWrt:~# dsl_cpe_control -f /lib/firmware/ltq-dsl-fw-b-danube.bin -i 10_00_10_00_00_04_00_00 -c -m
DSL_CPE: Using message dump (debug level: 0x80)
DSL_CPE: using 1st firmware file - /lib/firmware/ltq-dsl-fw-b-danube.bin
DSL_CPE: Device /dev/dsl_cpe_api opened successfully
DSL_CPE: Welcome to the CLI interface of DSL CPE API
DSL_CPE: Enter 'help all' for a list of built-in commands.
DSL_CPE: failed to set message dump debug level for device 0!
DSL_CPE: ADSL Firmware WHAT String 2.4.1.7.0.2
sEventType=DSL_EVENT_S_AUTOBOOT_STATUS nStatus=3 nFirmwareRequestType=1

DSL_CPE#>sEventType=DSL_EVENT_S_INIT_READY
sEventType=DSL_EVENT_S_FIRMWARE_REQUEST nFirmwareRequestType=DSL_FW_REQUEST_ADSL
sEventType=DSL_EVENT_S_LINE_STATE nLineState=000000FF
sEventType=DSL_EVENT_S_FIRMWARE_DOWNLOAD_STATUS nError=0 nFwType=1
sEventType=DSL_EVENT_S_AUTOBOOT_STATUS nStatus=1 nFirmwareRequestType=0
sEventType=DSL_EVENT_S_AUTOBOOT_STATUS nStatus=2 nFirmwareRequestType=0
sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000100
sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000200

# (connecting cable to DSL modem)

sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000300
sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000001
sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000000
sEventType=DSL_EVENT_S_AUTOBOOT_STATUS nStatus=3 nFirmwareRequestType=1
sEventType=DSL_EVENT_S_FIRMWARE_REQUEST nFirmwareRequestType=DSL_FW_REQUEST_ADSL
sEventType=DSL_EVENT_S_LINE_STATE nLineState=000000FF
sEventType=DSL_EVENT_S_FIRMWARE_DOWNLOAD_STATUS nError=0 nFwType=1
sEventType=DSL_EVENT_S_AUTOBOOT_STATUS nStatus=2 nFirmwareRequestType=0
sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000100
sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000200
sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000300
sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000001
sEventType=DSL_EVENT_S_LINE_STATE nLineState=00000000
sEventType=DSL_EVENT_S_AUTOBOOT_STATUS nStatus=3 nFirmwareRequestType=1

As you can see at least connecting the cable is changing the line state, however it does not get further then LineState=00000300 which I found means handshake, and nLineState=00000001 (exception).
I am on a DSL connection from German Telekom with an All-IP setup, does anyone know what could be the reason?

Thanks!

Is no one able to give any advice? I was able to reflash the OEM Firmware to the device and now used the replacement device for LEDE - same result. So I think the hardware is not to blame.

Does this connection require another XTU Init String?
Could I somehow get the DSL Modem firmware and XTU Init from the modem after it was initialized by the OEM firmware? dsl_cpe_control cli allows you to see the "XTUSystemEnabling" via g997xtusecg, but I found that after reboot the DSL modem lost this information.

Desparately in the need of help ;-(

To close on this, I now managed to get it working: One needs an Annex J Firmware for the German Telekom lines, it seems.

I was able to extract the firmware from a ROM dump. The firmware is accepted by the Modem and now the line state reaches showtime. The connection is stable.

Excerpt of output from /etc/init.d/dsl_control status

ATU-C Vendor ID:                          Infineon 130.182
ATU-C System Vendor ID:                   00,00,00,00,00,00,00,00
Chipset:                                  Ifx-Danube
Firmware Version:                         2.4.6.7.1.2
API Version:                              3.24.4.4
XTSE Capabilities:                        0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0
Annex:                                    J
Line Mode:                                G.992.5 (ADSL2+)
Profile:                                  
Line State:                               UP [0x801: showtime_tc_sync]

Firmware extraction from OEM firmware can be done with the following steps (given an 8MiB ROM dump):

binwalk ARV8539PW22_orig.bin
dd if=ARV8539PW22_orig.bin of=ltq-dsl-fw-j-danube.bin.lzma bs=1 skip=3031040 count=164864
xz -v --format=lzma -d <ltq-dsl-fw-j-danube.bin.lzma >ltq-dsl-fw-j-danube.bin

xz reports a corruption error, but the firmware looks similiar to the ltq-dsl-fw-b-danube.bin and seems to work perfectly.

In combination with https://github.com/Ntalton/danube-voip its also possible to use IP telephony.
With OpenWrt I do now have the most wonderful router I could ever image :wink:

Posting the relevant sections for German Telekom (DTAG) provider for reference:

/etc/config/network

config dsl 'dsl'
        option annex 'j'
        option firmware '/lib/firmware/adsl.bin' # softlink to annex j firmware
...

config interface 'wan'
        option ifname 'dsl0'
        option proto 'pppoe'
        option username '0123456789012345678901230001@t-online.de'
        option password 'password'
        option ipv6 'auto'

/etc/config/svd

config main
        option log_level '5'
        option rtp_port_first '6000'
        option rtp_port_last '6100'
        option sip_tos '0x10'
        option rtp_tos '0x10'

config account 'tonline'
        option disabled 'off'
        option user '+491234567890'
        option password 'password'	# same password as for pppoe connection above
        option domain 'tel.t-online.de'
        option auth_name '123456789012' # T-Online Number (Zugangsnummer)
        option outbound_proxy 'tel.t-online.de'

config channel '1'
        option hpf 'off'

config channel '2'
        option hpf 'off'

I could create a pull request for trunk. If anyone is interested in the changes - please tell me. Right now I am not sure if it is allowed to post the firmware file.

1 Like