User Tools

Site Tools


3Com 3CRWDR100A-72

The device is based on Texas Instrument AR7, so you need the target.ar7 in OpenWrt trunk.

Similar devices

SMC sells this router as ADSL² barricade g SMC7904WBRA. (absolutely identical) Philips sells it as Philips SNA6600. Belgacom has branded it "Belgacom ADSL wireless". See

The Siemens SX541 and SE555 share a lot of hardware and software with this device. With the SX541 there has been some OpenWrt progression using NFS, see and

RouterTech firmware is not supported on these devices due to their bootloader. (See )

There used to be a German project that got OpenWrt running on the SX541, Sinus 154 DSL SE, Sinus 154 DSL Basic SE and Sinus 154 DSL Basic 3 - all of which have the same AR7 CPU and Broad Net Inc bootloader. See and

OpenWrt status

Untested, probably unsupportable due to limited flash storage.

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
AR7 TNETD7300AGDW 16MB 2MiB 4 x 1 No Yes Yes

Basic hardware info

The device has the following connectors on the rear (left to right).

  • Auxiliary antenna.
  • ADSL input connector.
  • Power connector (12V 1.2A).
  • Reset button.
  • Large On/Off button.
  • 4 numbered RJ45 10/100 MBit connectors.
  • Main antenna.


Main processor

The main processor is a Texas Instruments TNETD7300AGDW Processor, an AR7 that should work with the target.ar7 of OpenWrt (yet untested).


Onboard is a PSC A2V28S40BTP 8M x 16 (128 MBit)SDRAM Memory chip.


The flash chip is an Intel TE28F160C3-B 16Mbit (2MiB) 3.0V Flash memory.

Switch chip

The internal switch is a Marvell 88E6060-RCJ 6-port (4 external, 1 to the router itself, 1 unused) 10/100 switch with autosensing.

Wireless card

The wireless chip in mini-pci card is a Texas Instruments TNETW1130GVF, also known as ACX111 chipset.




A serial console can be connected to J4.

The serial signals are at a 3.3V level, so you need to use a level convertor, see serial.console

The serial signal itself is 115200 baud, 8 databits, 1 stopbit, no parity (8N1).

The pinout for the serial is

pin signal
1 Not Connected
2 Not Connected
3 RX
4 Not Connected
5 TX
6 Not Connected
7 Not Connected
8 Not Connected
10 VCC +3.3V

Disposition on the board:

9 7 5 3 1
10 8 6 4 2


 TI ADSL AR7300 Loader 0.67.3 build Jul 27 2004 14:46:05                                                                                                                                                                                              
                 Broad Net Technology, INC.                                                                                                                                                                                                           
INTEL TE28F160C3-B bottom boot 16-bit mode found                                                                                                                                                                                                      
Copying boot params.....DONE                                                                                                                                                                                                                          
Press any key to enter command mode ...                                                                                                                                                                                                               
Flash Checking  Passed.                                                                                                                                                                                                                               

Unzipping  web at 0x94f00000 ... done                                                                                                                                                                                                                 
Unzipping code at 0x94000000 ... done                                                                                                                                                                                                                 
In C_Entry() function ...                                                                                                                                                                                                                             
sys_irq_init() ...                                                                                                                                                                                                                                    
##### _ftext      = 0x94000000                                                                                                                                                                                                                        
##### _fdata      = 0x94183640                                                                                                                                                                                                                        
##### __bss_start = 0x941C2604                                                                                                                                                                                                                        
##### end         = 0x94BFC6C0                                                                                                                                                                                                                        
##### Backup Data from 0x94183640 to 0x94C7C6C0~0x94CBB684 len 257988                                                                                                                                                                                 
##### Backup Data completed                                                                                                                                                                                                                           
##### Backup Data verified                                                                                                                                                                                                                            
[INIT] System Log Pool startup ...                                                                                                                                                                                                                    
[INIT] MTinitialize ..                                                                                                                                                                                                                                
userclk_init() ...                                                                                                                                                                                                                                    
Runtime code version: 2.06                                                                                                                                                                                                                            
System startup...                                                                                                                                                                                                                                     
[INIT] Memory COLOR 0, 800000 bytes ..                                                                                                                                                                                                                
[INIT] Memory COLOR 1, 300000 bytes ..                                                                                                                                                                                                                
[INIT] Memory COLOR 2, 1594336 bytes ..                                                                                                                                                                                                               
DSL HAL Version:                                                                                                                                                                                                                          
Sangam detected, rev 0x25                                                                                                                                                                                                                             
set dspfreq 250Mhz                                                                                                                                                                                                                                    
SAR_FREQUNCY = 62500000Hz                                                                                                                                                                                                                             

manu_id=0089 chip_id=88C3                                                                                                                                                                                                                             
INTEL TE28F160C3-B bottom boot 16-bit mode found                                                                                                                                                                                                      
Set flash memory layout to Boot Parameters found !!!                                                                                                                                                                                                  
Bootcode version: 0.67.3                                                                                                                                                                                                                              
Serial number: MF8A5VE43D650                                                                                                                                                                                                                          
Hardware version: 01                                                                                                                                                                                                                                  
sizeof(struct III_Config_t) is 85108                                                                                                                                                                                                                  

manu_id=0089 chip_id=88C3                                                                                                                                                                                                                             
INTEL TE28F160C3-B bottom boot 16-bit mode found                                                                                                                                                                                                      
!!! Invalid wireless channel range 0 ~ 0                                                                                                                                                                                                              
!!! Use default value 1 ~ 11                                                                                                                                                                                                                          
default ADSL_ANNEX_A in etcpip_init_config                                                                                                                                                                                                            
default route:                                                                                                                                                                                                                                
BUF_HDR_SZ=48 BUF_ALIGN_SZ=4 BUFFER_OFFSET=112                                                                                                                                                                                                        
BUF_BUFSZ0=384 BUF_BUFSZ1=1872                                                                                                                                                                                                                        
NUM_OF_B0=0 NUM_OF_B1=1000                                                                                                                                                                                                                            
BUF_POOL0_SZ=0 BUF_POOL1_SZ=1920000                                                                                                                                                                                                                   
*BUF0=0x94722450 *BUF1=0x9454d840                                                                                                                                                                                                                     
Altgn *BUF0=0x94722450 *BUF1=0x9454d840                                                                                                                                                                                                               
End at BUF0:0x94722450, BUF1:0x94722440                                                                                                                                                                                                               

BUF0[0]=0x94722450 BUF1[0]=0x9454d840                                                                                                                                                                                                                 

buffer0 pointer init OK!                                                                                                                                                                                                                              
buffer1 pointer init OK!                                                                                                                                                                                                                              
time = 08/01/2003, 00:00:00                                                                                                                                                                                                                           
TRAP(linkUp) : send ok!                                                                                                                                                                                                                               
Interface 0 ip =                                                                                                                                                                                                                            

MAC Address: 00:14:7c:43:d6:50                                                                                                                                                                                                                        
Memory request 2072 left 297928 ptr 94245568                                                                                                                                                                                                          
Call tn7sar_malloc_dma_xfer() addr:B4245568 size:2072                                                                                                                                                                                                 
before Call ResetMarvellPhy                                                                                                                                                                                                                           
after Call ResetMarvellPhy                                                                                                                                                                                                                            
MAC1 [RX=128 TX=1]: TI External PHY                                                                                                                                                                                                                   
time = 08/01/2003, 00:00:00                                                                                                                                                                                                                           
TRAP(linkUp) : send ok!                                                                                                                                                                                                                               
Interface 1 ip =                                                                                                                                                                                                                          

hwlan_init : ifno 2 TIWLANifno = 2                                                                                                                                                                                                                    
Country code is not assigned !!!                                                                                                                                                                                                                      
[HWLAN] MAC Address: 00:14:7c:43:d6:52                                                                                                                                                                                                                
time = 08/01/2003, 00:00:00                                                                                                                                                                                                                           
TRAP(linkUp) : send ok!                                                                                                                                                                                                                               
Interface 2 ip =                                                                                                                                                                                                                          

Init SAR ifno:3 chan:0 VPI/VCI:0/38                                                                                                                                                                                                                   
Init PDSP ...                                                                                                                                                                                                                                         
Init PDSP done.
Memory request 552 left 297376 ptr 94245D80
Call tn7sar_malloc() addr:B4245D80 size:552
[aal5->os]2.IsrRegister(OsDev:941c2a00, halIsr:940d7f08, Interrupt:15)
[aal5]halControl(HalDev:94b8a384, Key:OamMode, Action:Set, Value:94c7c57c)
[aal5]halChannelSetup(HalDev:94b8a384, HalCh:94c7c4c0, OsSetup:00000000)
  [aal5 Inst 0, Ch 0] Config Dump:
    TxNumBuffers  :00000128, TxNumQueues :00000002
    RxNumBuffers  :00000128, RxBufSize   :00001582
    TxServiceMax  :00000032, RxServiceMax:00000016
    RxBufferOffset:00000000, DaMask      :00000000
    CpcsUU        :00000005, Gfc         :00000000
    Clp           :00000000, Pti         :00000000
    Priority      :00000002, PktType     :00000000
    Vci           :00000038, Vpi         :00000000
    TxVc_CellRate :00015625, TxVc_QosType:00000002
    TxVc_Mbs      :00004000, TxVc_Pcr    :00015625
InitTcb(CH:0): tcbsize:48 allsize:6160 num:128
Memory request 6160 left 291216 ptr 94245FA8
Call tn7sar_malloc_dma_xfer() addr:B4245FA8 size:6160
Memory request 6160 left 285056 ptr 942477B8
Call tn7sar_malloc_dma_xfer() addr:B42477B8 size:6160
InitRcb(CH:0): rcbsize:64 allsize:8208 num:128
Memory request 8208 left 276848 ptr 94248FC8
Call tn7sar_malloc_dma_xfer() addr:B4248FC8 size:8208
Call halChannelSetup(), Ch:0
Install SAR handler ...
MAC Address: 00:14:7c:43:d6:51
Interface 3 ip =

IFLNK_PPPOE init : (Linkp)ifno = 11 idx = 2
IFLNK_PPPOE init : (Driverp)ifno = 11 idx = 3
Interface 11 ip =

ruleCheck()> Group: 0,  Error: Useless rule index will be truncated
ruleCheck()> Group: 1,  Error: Useless rule index will be truncated
ruleCheck()> Group: 2,  Error: Useless rule index will be truncated
CBAC rule format check succeed !!
reqCBACBuf()> init match pool, Have: 1000
Memory Address: 0x94babbbc ~ 0x94bb2938
reqCBACBuf()> init timeGap pool, Have: 10000
Memory Address: 0x94bb2938 ~ 0x94be368c
reqCBACBuf()> init sameHost pool, Have: 2000
Memory Address: 0x94be368c ~ 0x94bf30ac
CBAC rule pool initialized !!
Init NAT data structure
RUNTASK id=1 if_task if0...
RUNTASK id=2 if_task if1...
RUNTASK id=3 if_task if2...
RUNTASK id=4 if_task if3...
RUNTASK id=5 timer_task...
RUNTASK id=6 conn_mgr...
RUNTASK id=7 main_8021x...
RUNTASK id=8 period_task...

========== ADSL Modem initialization OK ! ======

RUNTASK id=9 dhcp_daemon...
httpd: listen at
RUNTASK httpd...
RUNTASK id=12 dnsproxy...
RUNTASK id=13 rip...
RUNTASK id=14 ripout...
RUNTASK id=15 dhcpd_mgmt_task...
UPnP is disabled
RUNTASK id=16 surfcon_task...
Starting Multitask...
wlan_timer_init() ...
Wireless Init Success



To enable JTAG functionality, you must short-circuit SHORT pins or put 100R resistor. (At your own risk)

I couldn't write (nor read properly) my flash because I suspect it was broken. But not sure.

But AR7 prom's was read properly.

The AR7 chip has a small memory banks on the chip : 4Kb PROM (@0xBFC00000) and 4Kb RAM (@0x80000000)

The FLASH is located at 0x90000000 (CS0) and RAM is located at 0x94000000 (CS1)

These address extracted from map

See port.jtag and JTAG tools for more JTAG details.


toh/3com/3crwdr100a-72.txt · Last modified: 2015/03/12 21:55 by Arnie