Looking Under Hood : SMC7004 WiFi Broadband Router

Hardware Information

Vendor: SMC
Device name: SMC70004VWBR - 2.4Ghz Wireless Cable/DSL Broadband Router
P/N: 720.638 FCC ID: HEDWG3005B1-17
OEM vendor: Accton WG3005B1
The Barricade? 2.4GHz 11Mbps Wireless Cable/DSL Broadband Router (SMC7004VWBR) combines a 4-port 10/100 Mbps dual-speed switch with Automatic MDI-MDIX feature, a high speed 11Mbps wireless access point, Stateful Packet Inspection (SPI) firewall security, network management, and Virtual Private Network (VPN) passthrough support into one convenient device.

Internals Photo:

smc7004_internal_photos.pdf

Internal Components

CPU CX84200 by Conexant (ADM5106 by ADMtek)
The ADM5106 SoC have and ARM7TDMI core integrated with seven-port switch engine, five-port physical layer (PHY), two UARTs, USB.
Flash memory Intel TE28F800 B3BA90
3 Volt Fast Boot Block Flash Memory (512Kbit x 16)
Total : 1 Mbyte
Specification
SDRAM memory Winbond W986432DH-6
512k x 4 banks x 32 bits SDRAM
Total: 8 Mbyte
Specification
PLD Lattice iM4A3-32 (ispMACH 4A3) programmable logic
Specification

Connectors

J2 : a standard 14-pin ARM7TDMI JTAG connector
1 vddh ( positive 3.3) 2 vss (ground)
3 nTRST 4 vss (ground)
5 TDI (pin 161) 6 vss (ground)
7 TMS (pin 164) 8 vss (ground)
9 TCK (pin 165) 10 vss (ground)
11 TDO (pin 162) 12 nRESET ( not implemented ??)
13 vddh (positive 3.3) 14 vss (ground)



J3 : 10-pin UART connector
1 udcd# (pin 150) 2.5v 2 udsr# (pin 152) 2.5v
3 udi0 (pin 154) 0v 4 -------
5 udo0 (pin 155) 3.3v 6 ucts# (pin 153) 2.5v
7 ----------- 8 -----------
9 vss (ground) 10 vddh (positive 3.3v)



JP1 : a 8-pin JTAG connector for PLD programming
1 vddh (positive 3.3v)
2 TDO (pin 35)
3 TDI (pin 10)
4 ??? nTRST (pin ???) / not connected ??
5 --------
6 TMS (pin 32)
7 vss (ground)
8 TCK (pin 13)

Software Information

Original Firmware

Firmware upgrade for P/N 720.638 is available from SMC website
Latest Firmware version is 121a
Firmware packaged using PKZIP compression and could be downloaded using web interface (or TFTP protocol - not yet tested).

Reverse Engineering

Registers memory map.
Flash details (bootloader, initialisation and so on)

Reflash factory default procedure
Reflash linux procedure (Booting log)

Old running linux procedure (Booting log)

Open Questions

Click here....


$Id: index.html,v 1.7 2004/02/19 20:57:25 bcabral Exp $