Trying to make VL805 USB3 xHCI working

dabyd64 · October 11, 2022, 3:56pm

Long story short: I don't use 2.4G for anything, so I thought on disconnecting the wlan controller and repurpose the pcie interface to connect a USB 3.0 board.

Before risking breaking the real hw, I used a useless comtrend ar-5315u.
Lifted the pcie pairs capacitors, breaking the connection with the wlan chip, then soldered the pcie lanes using shielded twisted pairs from an old HDMI cable, with same lengths to reduce skew:

RefClk+, RefClk- (Reference clock)
Tx+, Tx- (Transmit pair)
Rx+, Rx- (Receive pair)
PERST# (Reset signal)
3.3v, gnd etc

Ran:

opkg install kmod-usb-core kmod-usb-storage kmod-usb3 usbutils pciutils

Then the controller was detected, but gave error -145:

[   18.006880] kmodloader: loading kernel modules from /etc/modules.d/*
[   18.778222] xhci_hcd 0000:01:00.0: xHCI Host Controller
[   18.783637] xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 3
[   28.791435] xhci_hcd 0000:01:00.0: can't setup: -145
[   28.796526] xhci_hcd 0000:01:00.0: USB bus 3 deregistered
[   28.802092] xhci_hcd 0000:01:00.0: init 0000:01:00.0 fail, -145
[   28.808203] xhci_hcd: probe of 0000:01:00.0 failed with error -145

pciutils output shows the controller:

root@OpenWrt:# lspci
00:00.0 PCI bridge: Broadcom Inc. and subsidiaries Device 6318 (rev b0)
01:00.0 USB controller: VIA Technologies, Inc. VL805/806 xHCI USB 3.0 Controller (rev 01)

Memory dump:

root@OpenWrt:/# lspci -d 1106:3483 -xxx
01:00.0 USB controller: VIA Technologies, Inc. VL805/806 xHCI USB 3.0 Controller (rev 01)
00: 06 11 83 34 02 00 10 10 01 30 03 0c 04 00 00 00
10: 04 00 20 10 00 00 00 00 00 00 00 00 00 00 00 00
20: 00 00 00 00 00 00 00 00 00 00 00 00 06 11 83 34
30: 00 00 00 00 80 00 00 00 00 00 00 00 1f 01 00 00
40: 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00
50: 00 36 01 00 00 00 00 00 00 00 00 00 06 11 83 34
60: 30 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
80: 01 90 c3 f9 00 00 00 00 00 00 00 00 00 00 00 00
90: 05 c4 84 00 00 00 00 00 00 00 00 00 00 00 00 00
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
c0: 00 20 00 00 10 00 02 00 01 80 00 00 10 28 11 00
d0: 12 5c 06 00 00 00 11 10 00 00 00 00 00 00 00 00
e0: 00 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00
f0: 00 00 00 00 22 00 01 00 00 00 00 00 00 00 00 00

Firmware revision:

root@OpenWrt:/# lspci -d 1106:3483 -xxx | awk '/^50:/ { print "VL805 FW version: " $5 $4 $3 $2 }'
VL805 FW version: 00013600

More info:

root@OpenWrt:/# lspci -d 1106:3483 -vvv
01:00.0 USB controller: VIA Technologies, Inc. VL805/806 xHCI USB 3.0 Controller (rev 01) (prog-if 30 [XHCI])
        Subsystem: VIA Technologies, Inc. VL805/806 xHCI USB 3.0 Controller
        Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
        Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort+ <MAbort- >SERR- <PERR- INTx-
        Interrupt: pin A routed to IRQ 31
        Region 0: Memory at 10200000 (64-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3
                Flags: PMEClk- DSI- D1- D2- AuxCurrent=375mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
                Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
        Capabilities: [90] MSI: Enable- Count=1/4 Maskable- 64bit+
                Address: 0000000000000000  Data: 0000
        Capabilities: [c4] Express (v2) Endpoint, MSI 00
                DevCap: MaxPayload 256 bytes, PhantFunc 0, Latency L0s <64ns, L1 <1us
                        ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset- SlotPowerLimit 0W
                DevCtl: CorrErr- NonFatalErr- FatalErr- UnsupReq-
                        RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+
                        MaxPayload 128 bytes, MaxReadReq 512 bytes
                DevSta: CorrErr+ NonFatalErr- FatalErr- UnsupReq- AuxPwr+ TransPend-
                LnkCap: Port #0, Speed 5GT/s, Width x1, ASPM L0s L1, Exit Latency L0s <2us, L1 <16us
                        ClockPM+ Surprise- LLActRep- BwNot- ASPMOptComp-
                LnkCtl: ASPM Disabled; RCB 64 bytes, Disabled- CommClk-
                        ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
                LnkSta: Speed 2.5GT/s (downgraded), Width x1
                        TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
                DevCap2: Completion Timeout: Range B, TimeoutDis+ NROPrPrP- LTR-
                         10BitTagComp- 10BitTagReq- OBFF Not Supported, ExtFmt- EETLPPrefix-
                         EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
                         FRS- TPHComp- ExtTPHComp-
                         AtomicOpsCap: 32bit- 64bit- 128bitCAS-
                DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR- 10BitTagReq- OBFF Disabled,
                         AtomicOpsCtl: ReqEn-
                LnkCtl2: Target Link Speed: 5GT/s, EnterCompliance- SpeedDis+
                         Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
                         Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
                LnkSta2: Current De-emphasis Level: -3.5dB, EqualizationComplete- EqualizationPhase1-
                         EqualizationPhase2- EqualizationPhase3- LinkEqualizationRequest-
                         Retimer- 2Retimers- CrosslinkRes: unsupported
        Capabilities: [100 v1] Advanced Error Reporting
                UESta:  DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt+ UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
                UEMsk:  DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
                UESvrt: DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
                CESta:  RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
                CEMsk:  RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
                AERCap: First Error Pointer: 0f, ECRCGenCap- ECRCGenEn- ECRCChkCap- ECRCChkEn-
                        MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
                HeaderLog: 00000000 01000a00 00008040 0a000000
lspci: Unable to load libkmod resources: error -12

It seems the pci connection is correct, found same error happening for other routers (renesas-bases xhci controller), requiring a kernel patch and loading the firmware,but found nothing for VL805.

I'm planning to implement this on a WDR4900, has a powerful CPU, USB3 should give a huge boost in tranbsfer speeds, should work nicely as a NFS server.

dabyd64 · October 11, 2022, 4:46pm

Pictures. As you see, the pairs length are fully lenght-matched and well shielded.

Pcie specs allow 8ns interlane skew, a lot more than the possible error induced here.
Same pair wiring error is <1mm, enough for PCIe spec, less than 20ps.

dabyd64 · October 11, 2022, 5:41pm

There's a difference when cycling the power, yet still failing.

[   18.179587] kmodloader: loading kernel modules from /etc/modules.d/*
[   18.516875] xhci_hcd 0000:01:00.0: xHCI Host Controller
[   18.522289] xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 3
[   18.533472] xhci_hcd 0000:01:00.0: hcc params 0x002841eb hci version 0x100 quirks 0x0000040000000890
[   18.549915] hub 3-0:1.0: USB hub found
[   18.557144] hub 3-0:1.0: 1 port detected
[   18.562757] xhci_hcd 0000:01:00.0: xHCI Host Controller
[   18.568259] xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 4
[   18.575912] xhci_hcd 0000:01:00.0: Host supports USB 3.0 SuperSpeed
[   18.590126] hub 4-0:1.0: USB hub found
[   18.597133] hub 4-0:1.0: 4 ports detected
[   18.606606] xhci_hcd 0000:01:00.0: WARNING: Host System Error
[   18.695932] usb usb3-port1: couldn't allocate usb_device

danitool · October 19, 2022, 12:48pm

Hi, how did you guess the pinout at the AR-5315u board?

dabyd64 · October 19, 2022, 1:12pm

That's easy, those 3 pairs are differential signals, so they are routed together in a very characteristic manner.

PCIe data pairs have capacitors in series, always at the TX side.
So if your see the capacitors near the CPU, you know it's the TX, same for the wifi driver.
Then just join TX/RX pairs from CPU/wifi.

The reference clock is also differential, but it's usually slightly different, using series resistors or different capacitors.

In any case, the combinations are really small and you can simply use trial and error, you don't need to match the polarities (mixing positive and negative signals) as the PCIe standard allows this.

Finally the PCIe reset Signal is pretty easy to find, it usually has a pullup resistor near the wlan driver.

I already tested with few other routers, it's pretty easy.
But as the kernel is not supporting it, or probably needs some patching and I have no idea where to look at, I dropped the idea at the end

dabyd64 · October 19, 2022, 1:24pm