Looking Under Hood : SMC7004 WiFi Broadband Router

Hardware Information

Vendor: SMC
Device name: SMC70004VWBR - 2.4Ghz Wireless Cable/DSL Broadband Router
FCC ID : HEDWG3005B1-17
OEM vendor: Accton WG3005B1

Internals Photo:

smc7004_internal_photos.pdf

Internal Components

CPU CX84200 by Conexant (ADM5106 by ADMtek )
The ADM5106 SoC have and ARM7TDMI core integrated with seven-port switch engine, five-port physical layer (PHY), two UARTs, USB.
Flash memory Intel TE28F800 B3BA90
3 Volt Fast Boot Block Flash Memory (512Kbit x 16)
Total : 1 Mbyte
Specification
SDRAM memory Winbond W986432DH-6
512k x 4 banks x 32 bits SDRAM
Total: 8 Mbyte
Specification
PLD Lattice iM4A3-32 (ispMACH 4A3) programmable logic
Specification

Connectors

J2 : a standard 14-pin ARM7TDMI JTAG connector
1 vddh ( positive 3.3) 2 vss (ground)
3 nTRST 4 vss (ground)
5 TDI (pin 161) 6 vss (ground)
7 TMS (pin 164) 8 vss (ground)
9 TCK (pin 165) 10 vss (ground)
11 TDO (pin 162) 12 nRESET ( not implemented ??)
13 vddh (positive 3.3) 14 vss (ground)



J3 : 10-pin UART connector
1 udcd# (pin 150) 2.5v 2 udsr# (pin 152) 2.5v
3 udi0 (pin 154) 0v 4 -------
5 udo0 (pin 155) 3.3v 6 ucts# (pin 153) 2.5v
7 ----------- 8 -----------
9 vss (ground) 10 vddh (positive 3.3v)



JP1 : a 8-pin JTAG connector for PLD programming
1 vddh (positive 3.3v)
2 TDO (pin 35)
3 TDI (pin 10)
4 ??? nTRST (pin ???) / not connected ??
5 --------
6 TMS (pin 32)
7 vss (ground)
8 TCK (pin 13)

Software Information

Original Firmware

Firmware upgrade is available from SMC website Latest Firmware version is 121a
Firmware packaged using PKZIP compression and could be downloaded using web interface or TFTP protocol (not yet tested).

Booting Sequence

Normal boot sequence may be interrupted :

===========================================================
 LAN Router BRN Loader V1.06 build Jun 04 2002 16:57:22
                 Broad Net Technology, INC.
===========================================================
INTEL TE28F800B3-B bottom boot 16-bit mode found

Copying boot params.....DONE

Press any key to enter command mode ...

[BRN Boot]:h				 (Press ! for supervisor mode) 

======================
 [U] Upload to Flash
 [E] Erase Flash
 [G] Run Runtime Code
 [A] Set MAC Address
 [#] Set Serial Number
 [V] Set Board Version
 [S] Serial Test
 [I] Parallel Test
 [P] Print Boot Params
======================

Additional BootLoader commands - not yet fully tested

a - arp table
c - wireless on/off
b - routing table
k- 
g - dns debug
y- autoscan

r - reset
i - store configuration

Reverse Engineering

Registers memory map.
Flash details (bootloader, initialisation and so on)

Open Questions


Stas Khirman (staskh@attbi.com)
Last Update: 2/27/03