Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Author Topic: Lantiq DSL obscure commands  (Read 3522 times)

ejs

  • Kitizen
  • ****
  • Posts: 2078
Lantiq DSL obscure commands
« on: September 17, 2016, 06:41:38 PM »

I found an interesting script in the Netgear DM200 firmware, /lib/cfgmgr/dsl.sh which appears to contain commands to configure the Lantiq DSL components appropriately for different countries and their ISPs and equipment.

It says what some of the commands are for, but it doesn't say what the UK VDSL2 ones do.

Code: [Select]
print_interop_bits_adjustment() # $1: country, $2: isp, $3: vdsl/adsl
{
#for NBN adjustment
echo -e "\tlfcs 0 1 1 1 1 -1"
echo -e "\tlfcs 1 1 1 1 1 -1"

if [ "$3" = "vdsl" ]; then
case "$1/$2" in
UK/*)
echo -e "\tdms 1562 0 1 8" # All UK ISPs need these commands
echo -e "\tdms 549 0 2 240B 0000"
echo -e "\tdmms 1C44 0 1 BFFF 4000"
;;
Sweden/Telia)
echo -e "\tdms 0x1562 0x0 0x1 0x6"             # TELIASONERA Fixes
echo -e "\tdms 0xE843 0x2 0x1 0x1"             # TELIASONERA Fixes
;;
esac
else
case "$1/$2" in
France/Orange)
echo -e "\tdmms 0x6743 0x1C 0x1 0x200 0x200"   # Improve downstream performance & stability under REIN/Impulse noise
echo -e "\tdmms 0x6743 0x1C 0x1 0x100 0x0"     # Improve downstream performance & stability for fixed RFI disturber
echo -e "\tdmms 0x6743 0x1 0x1 0x80 0x80"      # FT bit
echo -e "\tdmms 0x6743 0x14 0x1 0x40 0x40"     # Favour DS SNRM over DS INP
echo -e "\tdmms 0x6743 0x17 0x1 0x20 0x20"     # Eanble the REIN adaptation in training phase.
echo -e "\tdmms 0x6743 0x1A 0x1 0x10 0x10"     # DS performance at mid-long loops with BRCM DSLAM in ADSL2+ mode.
echo -e "\tdmms 0x549 0x0 0x1 0x49 0x49"       # Reboot Criteria (1) for FT (LOS, LOM & LCD)
echo -e "\tdmms 0x549 0x1 0x1 0x3 0x3"         # Reboot Criteria (2) for FT (SES30 & ES90)
echo -e "\tdmms 0x6743 0x1D 0x1 0x8000 0x8000" # Avoid declaring LOM from CPE side, in particular when no NearEnd CRCs are observed by removing the ceiling on the 15 bit loaded tones. This is required to avoid second retrain in FT evoultive test cases as well unnecessary LOM reboot
;;
Spain/Telefonica*)
echo -e "\tdmms 0x6743 0x17 0x1 0x8000 0x8000" # DS LATN reporting gap in Anx-A/M as compared to AR7
echo -e "\tdmms 0x6743 0x14 0x1 0x40 0x40"     # Favour DS SNRM over DS INP
echo -e "\tdmms 0x6743 0x14 0x1 0x2000 0x2000" # Inproved US performance against GSPN DSLAMs
echo -e "\tdmms 0x6743 0x1A 0x1 0x20 0x20"     # Telefonica bit 1
echo -e "\tdmms 0x6743 0x17 0x1 0x8000 0x8000" # Telefonica bit 3
echo -e "\tdmms 0x6743 0x1C 0x1 0x4000 0x4000" # Telefonica bit 4
echo -e "\tdmms 0x6743 0x1A 0x1 0x10 0x10"     # DS performance at mid-long loops with BRCM DSLAM in ADSL2+ mode.
;;
Greece/OTE)
echo -e "\tdmms 0x6743 0x14 0x1 0x2000 0x2000" # Inproved US performance against GSPN DSLAMs
;;
Norway/Comlabs)
echo -e "\tdmms 0x6743 0x0 0x1 0x100 0x100"   # Comlabs (Norway) bit
;;
UK/*)
echo -e "\tdms 549 0 2 204B 0000" # All UK ISPs need this command
;;
esac
fi
}

So the 3 commands for UK VDSL2 are:
dms 1562 0 1 8
dms 549 0 2 240B 0000
dmms 1C44 0 1 BFFF 4000

This one is listed for UK ADSL:
dms 549 0 2 204B 0000

The dms and dmms commands themselves don't really tell you anything, they stand for DeviceMessageSend and DeviceMessageModifySend.
But it may be possible to work out what the commands do from the Lantiq source code.
dms and dmms are similar commands that send low level messages to the device, but dmms adds a "mask" that "makes it possible to write single bits or bit groups instead of the complete data word".

The first clue is the comments for the France/Orange dmms 0x549 ... commands. It says they are "Reboot Criteria", which should be for adjusting the conditions under which the modem will re-sync. There are alternative rccg/rccs commands, RebootCriteriaConfigGet/RebootCriteriaConfigSet, which have the same settings for LOM, LOF, LOS, ES90, SES30 and others, and so appear to be for controlling the same thing, I'm not sure why they aren't used.

Searching the Lantiq drv_dsl_cpe_api for 549, I found
Code: [Select]
/** Message ID for CMD_ReInitNE_Configure */
#define CMD_REINITNE_CONFIGURE 0x0549

which the source code then says it "Configures re-initialization triggers for near-end failure conditions".

Searching the source code for 1562
Code: [Select]
/** Message ID for CMD_OperatorSelect */
#define CMD_OPERATORSELECT 0x1562

/**
   The message selects a DSL operator. The information is used to configure
   operator specific settings inside the DSL firmware.
*/

So presumably the dms 1562 0 1 8 command activates BT specific behaviour contained within the dsl firmware .bin file.

1C44 then is for:
Code: [Select]
/** Message ID for CMD_TestOptionsSet */
#define CMD_TESTOPTIONSSET 0x1C44

/**
   The messages configures settings for test modes.
*/

Not so sure what this is for, but perhaps something to do with "fine gain control", whatever that is.



Summary: There are a lot of low-level settings to configure the device optimally or properly for specific countries and their ISPs.
« Last Edit: September 25, 2016, 07:12:13 PM by ejs »
Logged

ejs

  • Kitizen
  • ****
  • Posts: 2078
Re: Lantiq DSL obscure commands
« Reply #1 on: September 25, 2016, 08:01:17 PM »

As I was attempting to decode the dms 549 ... commands, I noticed they were actually different for UK VDSL2 and UK ADSL. I had initially misread them as being the same.

I think I found the data structure that the "240B 0000" values go into, which is:
Code: [Select]
   /** Reserved */
   DSL_uint16_t Res0 : 1;
   /** Excess DS CRCs (ADSL only) */
   DSL_uint16_t E14 : 1;
   /** ESE */
   DSL_uint16_t E13 : 1;
   /** Reserved */
   DSL_uint16_t Res1 : 2;
   /** OOS BC0 */
   DSL_uint16_t E10 : 1;
   /** Reserved */
   DSL_uint16_t Res2 : 1;
   /** NCD BC0 */
   DSL_uint16_t E8 : 1;
   /** Reserved */
   DSL_uint16_t Res3 : 1;
   /** LCD BC0 */
   DSL_uint16_t E6 : 1;
   /** Reserved */
   DSL_uint16_t Res4 : 2;
   /** LOM */
   DSL_uint16_t E3 : 1;
   /** Reserved */
   DSL_uint16_t Res5 : 1;
   /** LOF */
   DSL_uint16_t E1 : 1;
   /** LOS */
   DSL_uint16_t E0 : 1;

   /** Reserved */
   DSL_uint16_t Res6 : 14;
   /** ESx */
   DSL_uint16_t F1 : 1;
   /** SESx */
   DSL_uint16_t F0 : 1;

For VDSL2:
dms 549 0 2 240B 0000
0x240B = 0010010000001011 = ESE, OOS BC0, LOM, LOF, LOS

For ADSL:
dms 549 0 2 204B 0000
0x204B = 0010000001001011 = ESE, LCD BC0, LOM, LOF, LOS

OOS applies to PTM (used with VDSL2), and LCD applies to ATM (used with ADSL), so the difference does make sense.

I couldn't find the definition of ESE in G.997.1 or the ITU VDSL2 or ADSL documents. Searching the source code for ESE, it says it's "Excessive Severe Errors (ESE) Failure, (10 seconds SES)", although in another place it says 10 seconds of ES, but I suppose from the name, it's probably supposed to be 10 SES. The source code also says ESE is only used in VDSL2 mode, and the ES90 and SES30 settings would only be applicable for ADSL mode.
Logged

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 33883
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: Lantiq DSL obscure commands
« Reply #2 on: September 26, 2016, 10:38:12 PM »

I've not looked in any detail, but in the further code I see things like LCD, LoF and LoS.   These are all error states. 
Im wondering if its a specific requirement that the modems should report (or make available) certain errors to the DSLAM (for say DLM purposes).

Is there any mention in the SIN/MCT about error reporting requirements?

Excessive Severe Errors
ESE is declared  when 10 consecutive SES (severely errored seconds) result in UAS (Unavailable Seconds).
The modem still synchronized, but have risks of synch loss. This case might occur just before a synch loss.


So 10 seconds of SES ... or to put it another way....
10 consecutive seconds of Err/Secs with either >30% of errored blocks or four consecutive invalid frame words
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 33883
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: Lantiq DSL obscure commands
« Reply #3 on: September 26, 2016, 11:00:40 PM »

Quote
Not so sure what this is for, but perhaps something to do with "fine gain control", whatever that is.

Auto Gain Control.   We sometimes see this in evidence during high levels of bitswap where the modem may increase gain to give a lil bit more SNR.

TBH Im not quite following your outputs, but another possibility is perhaps increasing the gain if a resync has occurred due to ESE state?
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

ejs

  • Kitizen
  • ****
  • Posts: 2078
Re: Lantiq DSL obscure commands
« Reply #4 on: September 27, 2016, 08:49:19 PM »

R.VDSL2.17 lists the stats the modem is supposed to report accurately back to the DSLAM.

I was trying to work out what the commands do. As far as I can tell, the dms 549 0 2 240B 0000 command configures under what situations the modem will re-sync.

Lets look at the settings using the other command, from the TD-W9980:
Code: [Select]
# /firmware/dsl_cpe_pipe.sh rccg
nReturn=0 nRebootCriteria=0x0000004F

nRebootCriteria=0x0000004F = LOM, LOF, LOS, ESE, NEGATIVE_MARGIN - but the code also says that the negative margin criteria is "only used for ADSL only platforms".

I was expecting the output of the rccg command to change to 0x0000008F after entering dms 549 0 2 240B 0000, but it was unchanged.

Still, it might be an interesting experiment to re-configure the modem, disable all the criteria, both ways, and see if it stays connected for longer. Although all that might happen is that it loses the connection and doesn't automatically reconnect.



I think the 3 commands each configure unrelated functionality. dmms 1C44 0 1 BFFF 4000 seems to only affect some sort of test mode. The lantiq devices can actually report the gain values per tone, I don't know about other devices. The online reconfiguration (bitswapping) messages can adjust the transmitted power levels of particular tones. The old AR7 also has a "fine gain control" setting that can be enabled/disabled, but it also has a "fine gain value", so I assumed it was something to manually override or adjust some gain level. After reading a little more of G.992.3 (ADSL2), I think the fine gain values are the numbers used to adjust the power levels.
Logged
 

anything