Here’s one of the old modems from my spares bin, a Vodafone Mobile WiFi R207. This is just a rebranded Huawei E5330. This unit includes a 3G modem, and a WiFi chipset, running firmware that makes this a mini-router, with NAT.
Specs
The back has the batter compartment & the SIM slot, with a large label showing all the important details.
Cover Removed
A couple of small Torx screws later & the shell splits in half. All the electronics are covered by shields here, but luckily they are the clip-on type, and aren’t soldered direct to the PCB.
Chipset
Once the shield has been removed, the main chipset is visible underneath. There’s a large Spansion MS01G200BHI00 1GBit flash, which is holding the firmware. Next to that is the Hi6758M baseband processor. This has all the hardware required to implement a 3G modem. Just to the right is a Hi6521 power management IC, which is dealing with all the power supplies needed by the CPU.
The RF section is above the baseband processor, some of which is hiding under the bits of the shield that aren’t removable.
SIM Socket
There’s a socket onboard for a standard Mini-SIM, just to the left of that is a Hi6561 4-phase buck converter. I would imagine this is providing the power supplies for the RF section & amplifier.
Unpopulated Parts
Not sure what this section is for, all the parts are unpopulated. Maybe a bluetooth option?
PCB Reverse
The other side of the PCB is pretty sparse, holding just the indicator LEDS, button & the WiFi Chipset.
Realtek WiFi Chipset
The chipset here is a Realtek part, but it’s number is hidden by some of the shield. The antenna connection is routed to the edge of the board, where a spring terminal on the plastic case mounted antenna makes contact.
I recently got the latest upgrade from Virgin Media, 200Mbit DL / 20Mbit UL, and to get this I was informed I’d have to buy their latest hardware, since my existing CPE wouldn’t be able to handle the extra 5Mbit/s upload speed. (My bullshit detector went off pretty hard at that point, as the SuperHub 2 hardware is definitely capable of working fine with 20Mbit/s upload rates). Instead of having to return the old router, I was asked to simply recycle it, so of course the recycling gets done in my pretty unique way!
Mainboard
The casing of these units is held together by a single screw & a metric fuckton of plastic clips, disassembly is somewhat hindered by the radio antennas being positioned all over both sides of the casing. Once the side is off, the mainboard is visible. The DOCSIS frontend is lower left, centre is the Intel PUMA 5 Cable Modem SoC with it’s RAM just to the lower right. The right side of the board is taken up by both of the WiFi radio frontends, the 5GHz band being covered by a Mini PCIe card.
Atheros Gigabit Switch
The 4 gigabit Ethernet ports on the back are serviced by an Atheros AR8327 Managed Layer 3 switch IC, which seems to be a pretty powerful device:
The AR8327 is the latest in high performance small network switching. It is ultra low power, has extensive routing and data management functions and includes hardware NAT functionality (AR8327N). The AR8327/AR8327N is a highly integrated seven-port Gigabit Ethernet switch with a fully non-blocking switch fabric, a high-performance lookup unit supporting 2048 MAC addresses, and a four-traffic class Quality of Service (QoS) engine. The AR8327 has the flexibility to support various networking applications. The AR8327/AR8327N is designed for cost-sensitive switch applications in wireless AP routers, home gateways, and xDSL/cable modem platforms.
Unfortunately most of the features of this router are locked out by VM’s extremely restrictive firmware. With any of their devices, sticking the VM supplied unit into modem mode & using a proper router after is definitely advised!
Intel Puma 5 CM CPU
The cable modem side of things is taken care of by the Intel PUMA 5 DNCE2530GU SoC. This appears to communicate with the rest of the system via the Ethernet switch & PCI Express for the 5GHz radio.
Atheros WiFi SoC
The 2.4GHz radio functionality is supplied by an Atheros AR9344 SoC, it’s RAM is to the left. This is probably handling all the router functions of this unit, but I can’t be certain.
Atheros LAN PHY
A separate Ethernet PHY is located between the SoC & the switch IC.
5GHz Radio Card
The 5GHz band is served by a totally separate radio module, in Mini PCIe format, although it’s a bit wider than standard. This module will probably be kept for reuse in another application.
Power Supplies
All down the edge of the board are the multiple DC-DC converters to generate the required voltage rails.
MaxLinear MXL261 Frontend
The DOCSIS frontend is handled by a MaxLinar MXL261 Tuner/Demodulator. More on this IC in my decapping post 🙂
The Unknown One
I’ve honestly no idea what on earth this Maxim component is doing. It’s clearly connected via an impedance matched pair, and that track above the IC looks like an antenna, but nothing I search for brings up a workable part number.
2.4GHz Frontend
The RF switching & TX amplifiers are under a shield, these PA chips are SiGe parts.
Atheros 5GHz Radio
Pretty much the same for the 5GHz radio, but with 3 radio channels.
Tip Jar
If you’ve found my content useful, please consider leaving a donation by clicking the Tip Jar below!
All collected funds go towards new content & the costs of keeping the server online.
