AR150 hardware/software hacking - system timing reference

sfx2000 · 2019-05-25T03:46:42.259Z

Looking for the PN/Vendor for the 25MHz on the AR150. XO just has a sticker that says “25MHZ”, and with the supply chain being what it is…

Long story, but it would be nice to get this info - looking at a more precise reference there, just want to make sure we can swap the part out.

@alzhao - understood that this would violate warranty, so feel free to PM me directly

sfx2000 · 2019-06-22T20:50:02.660Z

Just wanted to follow up on this one.

The timing reference on the board is a 25MHz Crystal, and it’s not very precise (+/- 20ppm perhaps), and after reviewing the AP121 reference schematic, we found a test point that we could bluewire out to a freq counter locked to a rubidium time reference, and confirmed that the XTAL does wander a bit.

Looking at the 2.4GHz radio, we discovered that drift was quite a bit less and didn’t match up with the timing reference from the XTAL. Additionally, and this is weird, is that we didn’t see any timing adjustment - looking at adjtimex values which were steady, but drift against a stratum 1 NTP server showed that time would drift slightly and then correct, but busybox’s NTP server client was disabled, so something was adjusting, and it wasn’t software.

SW is a custom OpenWRT build off master with some 4G modem support.

Digging into the AR9331 docs, discovered that there is a VCO on board the chipset, so it uses either a 25MHz or 40MHz crystal as an input (for AR150 it’s 25MHz), and the chip uses the XTAL as input into the VCO, which then drives the rest of the timing for WiFi, Ethernet, USB, CPU, DDR, SPI for Flash, i2c, etc…

Which was interesting - and how to calibrate was even more cool - one uses the WiFi compared to a Golden Reference with the Atheros Radio Test v2 tool, and there, one sets the spectral mask and center freq, and nudge it left or right in 100Hz steps - so once the WiFi radio is set, this sets all the other clocks inside the chip.

It’s clever, as it simplifies cal at the factory during assembly and test, and keeps BOM cost very low - and the internal VCO accounts for time/temp drift, along with XTAL aging (they’ll drift over the long term, because crystals do)

As a side note - we did remove the XTAL, and deadbugged a very high precision single chip MEMS device (+/- 50 ppb) in place, and didn’t see any difference, which drove the exploration into the AP121 schematic and AR9331 docs.

Was a fun little project - learned quite a bit for the internals of the 9331 (and this would apply to 9531 as well, along with other Atheros devices built around the same architecture).

@alzhao
@jeffsf

jeffsf · 2019-06-23T02:05:34.406Z

Very clever! I had known that the specs were ±20 ppm for the 5 GHz band and had based my “free-run” time-error estimates on that. I just assumed a 20 ppm crystal was deemed sufficient by the regulatory bodies, without any by-unit calibration.

sfx2000 · 2019-06-23T16:44:28.522Z

I mentioned 100Hz steps, it’s actually 10Hz steps - typo there…

Anyways, this is why it’s always important to keep a backup on the ART partition when doing OpenWRT development, as the ART contains the RF cal along with other items that are unique to that particular board.

I’m sure other chipset vendors are similar where a baseline cal is done - for AP’s it’s really important for them to be close as possible to spec, client stations perhaps a bit less so, as they’ll track to the AP for timing purposes.

alzhao · 2019-06-24T09:04:53.691Z

@sfx2000, do you still need the vendor of the crystal? Seems you got everything.

sfx2000 · 2019-06-25T04:07:16.893Z

We’re good…

Anyways - was nice to see how close AR150 was to the AP121 reference, which made work easy enough.

Hoping that AR150 becomes an LTS platform for GL.iNet - as it’s well documented and understood on both a hardware and SW base.

sfx2000 · 2019-09-07T03:38:49.128Z

sfx2000:

As a side note - we did remove the XTAL, and deadbugged a very high precision single chip MEMS device (+/- 50 ppb) in place, and didn’t see any difference, which drove the exploration into the AP121 schematic and AR9331 docs.

Pic below - those with access to the layout files (aka gerbers) likely can tell what we did for this little experiment.

deadbug1024×1024 317 KB