Netopia 4652 is the successor to their earlier R-series models for SDSL and IDSL. It is not UMB3 with a WAN module, it's a single board instead. The plastic enclosure is the same but the rear panel is different. The router appears to be a currently made and sold product and is the standard CPE installed by Covad at the time of this writing (early 2008).
The full non-hobbled version of the 4652 appears to support all flavors of
SDSL/2B1Q and IDSL that were supported by the earlier R-series routers.
These are Copper Mountain SDSL, a few flavors of
SDSL/ATM like on R7200 and IDSL like on R3100.
The first-order WAN type selection menu gives 4 choices: SDSL/ATM, SDSL/HDLC,
generic
IDSL and CM-flavored IDSL.
Selecting SDSL/ATM gives a selection of flavors like on R7200, but their
Flavor B (SDSL/HDLC) support
is for CM only: no manual data rate configuration is offered and no
quat orientation setting.
The generic IDSL
setting allows one to select the channel configuration
(B1, B2, B1+B2 or B1+B2+D), but the CM-flavored IDSL mode removes this choice
(must rely on CM's proprietary EOC message for this purpose).
The 4652-T units installed by Covad are hobbled in that the SDSL/HDLC (CM SDSL)
and CM-flavored IDSL modes are disabled.
The 4652 does not use the new M289xx chipset and does not support SHDSL, instead it has a traditional SDSL/2B1Q WAN interface and a traditional ISDN/IDSL WAN interface laid out on the same board. The former uses the RS8973 bitpump, the latter uses MC145572. They are two completely separate hardware circuits each with its own line transformer (Midcom 50772 and Pulse PE-68628, respectively); they share a single DSL jack on the rear panel by means of a relay. You can hear the relay click when you switch between SDSL and IDSL modes in the configuration menu.
The 4652's hardware design is a bit more modern compared to UMB3. The MC68MH360 CPU has given way to an MPC855T (the software look and feel is exactly the same though, so it must have been a direct port), the Ethernet interface is now a 4-port 10/100 Mbps switch (BCM5325) and a Hifn 7902 hardware cryptographic processor has been added, pandering to the VPN craze.
The SDSL WAN interface circuit on the 4652 most closely resembles Netopia's
old SDSL/ATM WAN module used on the R7200.
It seems to use the same FPGA and CPLD on the hardware side
(the parts populated on the 4652 board are exactly the same as on the old
wanlet, can't tell anything about the soft hardware
inside though),
but on the
firmware side it must be a new re-implementation given that they no longer
have an MC68LC302 or a Virata Helium processor on the wanlet; the job of
managing the bitpump now falls on their main PowerPC CPU.
They have also incorporated support for the CM flavor, but that's just software
to decode their pulse train and talk
CMCP, for the hardware it's trivial
Flavor B.
The 4652's implementation of the classic SDSL/ATM flavors supported by the
older R7200 seems a bit more lousy than the original, particularly the ASM
(activation state machine) design.
On our unit these include
Nokia, a few
Flavor A profiles exactly
the same as on R7200 plus a rather mysterious Newbridge
profile
described further below.
Connecting a Hack-o-Rocket acting as HTU-C to our 4652 configured for Flavor A has revealed that unlike the R7200, the new box does not immediately start transmitting the ATM-formatted bit stream. Instead it keeps transmitting 4-level scrambled 1s apparently indefinitely, apparently waiting for the HTU-C to start transmitting ATM cells first. There doesn't seem to be any timeout.
When configured for the Nokia flavor, the 4652 does have a reasonable timeout after which its ASM proceeds to teardown if no Nokia frames are received, but the HTU-R is still transmitting 4-level scrambled 1s during this interval.
The 4652's SDSL ASM is even more lousy when it comes to handling the link going bad after successful startup. The ASM does not seem to check the cell/frame delineation status like the R7200, other CPE devices and the Nokia DSLAM do, instead it seems to be based on the bitpump LOS indication. On top of this the 4652 seems to have a suboptimal echo-cancelling hybrid and when the other end shuts its transmitter off, the 4652 keeps receiving its own echo thinking that it's the far end signal. Of course it's receiving garbage since the LFSR scrambler polynomials are different in the two directions, but since its dumb ASM doesn't check for anything except the LOS indication which it never gets, the box keeps thinking that the link is still up long after the test HTU-C has shut off!
This flavor is present in the configuration menu on our 4652 but not on our
older R7200. It is a mystery.
We haven't been able to reverse-engineer it because the ASM implemented for
this flavor on the 4652 is very unforgiving.
It is the direct opposite of the lousy ASM implemented for Flavor A
— LOS ON
appears immediately after the
Normal operation
line
without any apparent delay at all.
Attempting to capture the bit stream before libzw reaches
Normal operation
caught only all 1s, nothing informative.
The fact that it uses an obviously different ASM clearly indicates that the Newbridge flavor is not just another minor variation on the generic Flavor A, but something a bit different. It's definitely a flavor of SDSL/ATM as the rest of Netopia's configuration menus still revolve around ATM when this flavor is selected, but what? Is it Flavor A with DSS? Is it Flavor HA? Is it Flavor AOC? We can only guess. The list of speeds given in Netopia's configuration menu for this flavor is 208, 400, 784, 1168, 1552 and 2320 kbps.
We thus have a completely unknown SDSL/2B1Q/ATM flavor on our hands. Whether or not this is something we need to shed tears about depends on the prevalence of this flavor in the real world, something this hacker has no knowledge of.
If this flavor does occur in the real world and one wants to reverse-engineer it for open source connectivity, doing so would probably require taking a real line of this flavor, connecting a 4652 to it and sniffing the bit stream off the RS8973 RDAT and TDAT pins in the running 4652. Not for the faint of heart, but should be very doable for a determined hacker.
I wonder why they have built a whole separate hardware circuit on the board to support IDSL switched to the same jack via a relay if they could have implemented it with the RS8973. They already have an FPGA for the SDSL/ATM flavors, so they could have implemented an ISDN framer in there as well. Implementing the ISDN activation sequence would have been painful, but certainly should have been within the means of a company like Netopia.
Is it an indication of the boutique nature of SDSL in general that the savings in per-unit cost didn't justify the extra NRE cost even for a dominant CPE manufacturer like Netopia?
The 4652 takes 12 VDC in just like the older R-series and has the same power input connector. The power supply included in the box is much newer and slimmer, but the older one works just as well.