User Tools

Site Tools


3Com 3CRWDR100A-72

The device is based on Texas Instrument AR7, so you need the target.ar7 in OpenWrt trunk.

SMC sells this router as ADSL² barricade g SMC7904WBRA. (absolutely identical)

OpenWrt status

Untested, probably unsupportable due to limited RAM.

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
AR7 TNETD7300AGDW 16MB 2MiB 4 x 1 No Yes Yes

Basic hardware info

The device has the following connectors on the rear (left to right).

  • Auxiliary antenna.
  • ADSL input connector.
  • Power connector (12V 1.2A).
  • Reset button.
  • Large On/Off button.
  • 4 numbered RJ45 10/100 MBit connectors.
  • Main antenna.


Main processor

The main processor is a Texas Instruments TNETD7300AGDW Processor, an AR7 that should work with the target.ar7 of OpenWrt (yet untested).


Onboard is a PSC A2V28S40BTP 8M x 16 (128 MBit)SDRAM Memory chip.


The flash chip is an Intel TE28F160C3-B 16Mbit (2MiB) 3.0V Flash memory.

Switch chip

The internal switch is a Marvell 88E6060-RCJ 6-port (4 external, 1 to the router itself, 1 unused) 10/100 switch with autosensing.

Wireless card

The wireless chip in mini-pci card is a Texas Instruments TNETW1130GVF, also known as ACX111 chipset.




A serial console can be connected to J4.

The serial signals are at a 3.3V level, so you need to use a level convertor, see serial.console

The serial signal itself is 115200 baud, 8 databits, 1 stopbit, no parity (8N1).

The pinout for the serial is

pin signal
1 Not Connected
2 Not Connected
3 RX
4 Not Connected
5 TX
6 Not Connected
7 Not Connected
8 Not Connected
10 VCC +3.3V

Disposition on the board:

9 7 5 3 1
10 8 6 4 2


 TI ADSL AR7300 Loader 0.67.3 build Jul 27 2004 14:46:05                                                                                                                                                                                              
                 Broad Net Technology, INC.                                                                                                                                                                                                           
INTEL TE28F160C3-B bottom boot 16-bit mode found                                                                                                                                                                                                      
Copying boot params.....DONE                                                                                                                                                                                                                          
Press any key to enter command mode ...                                                                                                                                                                                                               
Flash Checking  Passed.                                                                                                                                                                                                                               

Unzipping  web at 0x94f00000 ... done                                                                                                                                                                                                                 
Unzipping code at 0x94000000 ... done                                                                                                                                                                                                                 
In C_Entry() function ...                                                                                                                                                                                                                             
sys_irq_init() ...                                                                                                                                                                                                                                    
##### _ftext      = 0x94000000                                                                                                                                                                                                                        
##### _fdata      = 0x94183640                                                                                                                                                                                                                        
##### __bss_start = 0x941C2604                                                                                                                                                                                                                        
##### end         = 0x94BFC6C0                                                                                                                                                                                                                        
##### Backup Data from 0x94183640 to 0x94C7C6C0~0x94CBB684 len 257988                                                                                                                                                                                 
##### Backup Data completed                                                                                                                                                                                                                           
##### Backup Data verified                                                                                                                                                                                                                            
[INIT] System Log Pool startup ...                                                                                                                                                                                                                    
[INIT] MTinitialize ..                                                                                                                                                                                                                                
userclk_init() ...                                                                                                                                                                                                                                    
Runtime code version: 2.06                                                                                                                                                                                                                            
System startup...                                                                                                                                                                                                                                     
[INIT] Memory COLOR 0, 800000 bytes ..                                                                                                                                                                                                                
[INIT] Memory COLOR 1, 300000 bytes ..                                                                                                                                                                                                                
[INIT] Memory COLOR 2, 1594336 bytes ..                                                                                                                                                                                                               
DSL HAL Version:                                                                                                                                                                                                                          
Sangam detected, rev 0x25                                                                                                                                                                                                                             
set dspfreq 250Mhz                                                                                                                                                                                                                                    
SAR_FREQUNCY = 62500000Hz                                                                                                                                                                                                                             

manu_id=0089 chip_id=88C3                                                                                                                                                                                                                             
INTEL TE28F160C3-B bottom boot 16-bit mode found                                                                                                                                                                                                      
Set flash memory layout to Boot Parameters found !!!                                                                                                                                                                                                  
Bootcode version: 0.67.3                                                                                                                                                                                                                              
Serial number: MF8A5VE43D650                                                                                                                                                                                                                          
Hardware version: 01                                                                                                                                                                                                                                  
sizeof(struct III_Config_t) is 85108                                                                                                                                                                                                                  

manu_id=0089 chip_id=88C3                                                                                                                                                                                                                             
INTEL TE28F160C3-B bottom boot 16-bit mode found                                                                                                                                                                                                      
!!! Invalid wireless channel range 0 ~ 0                                                                                                                                                                                                              
!!! Use default value 1 ~ 11                                                                                                                                                                                                                          
default ADSL_ANNEX_A in etcpip_init_config                                                                                                                                                                                                            
default route:                                                                                                                                                                                                                                
BUF_HDR_SZ=48 BUF_ALIGN_SZ=4 BUFFER_OFFSET=112                                                                                                                                                                                                        
BUF_BUFSZ0=384 BUF_BUFSZ1=1872                                                                                                                                                                                                                        
NUM_OF_B0=0 NUM_OF_B1=1000                                                                                                                                                                                                                            
BUF_POOL0_SZ=0 BUF_POOL1_SZ=1920000                                                                                                                                                                                                                   
*BUF0=0x94722450 *BUF1=0x9454d840                                                                                                                                                                                                                     
Altgn *BUF0=0x94722450 *BUF1=0x9454d840                                                                                                                                                                                                               
End at BUF0:0x94722450, BUF1:0x94722440                                                                                                                                                                                                               

BUF0[0]=0x94722450 BUF1[0]=0x9454d840                                                                                                                                                                                                                 

buffer0 pointer init OK!                                                                                                                                                                                                                              
buffer1 pointer init OK!                                                                                                                                                                                                                              
time = 08/01/2003, 00:00:00                                                                                                                                                                                                                           
TRAP(linkUp) : send ok!                                                                                                                                                                                                                               
Interface 0 ip =                                                                                                                                                                                                                            

MAC Address: 00:14:7c:43:d6:50                                                                                                                                                                                                                        
Memory request 2072 left 297928 ptr 94245568                                                                                                                                                                                                          
Call tn7sar_malloc_dma_xfer() addr:B4245568 size:2072                                                                                                                                                                                                 
before Call ResetMarvellPhy                                                                                                                                                                                                                           
after Call ResetMarvellPhy                                                                                                                                                                                                                            
MAC1 [RX=128 TX=1]: TI External PHY                                                                                                                                                                                                                   
time = 08/01/2003, 00:00:00                                                                                                                                                                                                                           
TRAP(linkUp) : send ok!                                                                                                                                                                                                                               
Interface 1 ip =                                                                                                                                                                                                                          

hwlan_init : ifno 2 TIWLANifno = 2                                                                                                                                                                                                                    
Country code is not assigned !!!                                                                                                                                                                                                                      
[HWLAN] MAC Address: 00:14:7c:43:d6:52                                                                                                                                                                                                                
time = 08/01/2003, 00:00:00                                                                                                                                                                                                                           
TRAP(linkUp) : send ok!                                                                                                                                                                                                                               
Interface 2 ip =                                                                                                                                                                                                                          

Init SAR ifno:3 chan:0 VPI/VCI:0/38                                                                                                                                                                                                                   
Init PDSP ...                                                                                                                                                                                                                                         
Init PDSP done.
Memory request 552 left 297376 ptr 94245D80
Call tn7sar_malloc() addr:B4245D80 size:552
[aal5->os]2.IsrRegister(OsDev:941c2a00, halIsr:940d7f08, Interrupt:15)
[aal5]halControl(HalDev:94b8a384, Key:OamMode, Action:Set, Value:94c7c57c)
[aal5]halChannelSetup(HalDev:94b8a384, HalCh:94c7c4c0, OsSetup:00000000)
  [aal5 Inst 0, Ch 0] Config Dump:
    TxNumBuffers  :00000128, TxNumQueues :00000002
    RxNumBuffers  :00000128, RxBufSize   :00001582
    TxServiceMax  :00000032, RxServiceMax:00000016
    RxBufferOffset:00000000, DaMask      :00000000
    CpcsUU        :00000005, Gfc         :00000000
    Clp           :00000000, Pti         :00000000
    Priority      :00000002, PktType     :00000000
    Vci           :00000038, Vpi         :00000000
    TxVc_CellRate :00015625, TxVc_QosType:00000002
    TxVc_Mbs      :00004000, TxVc_Pcr    :00015625
InitTcb(CH:0): tcbsize:48 allsize:6160 num:128
Memory request 6160 left 291216 ptr 94245FA8
Call tn7sar_malloc_dma_xfer() addr:B4245FA8 size:6160
Memory request 6160 left 285056 ptr 942477B8
Call tn7sar_malloc_dma_xfer() addr:B42477B8 size:6160
InitRcb(CH:0): rcbsize:64 allsize:8208 num:128
Memory request 8208 left 276848 ptr 94248FC8
Call tn7sar_malloc_dma_xfer() addr:B4248FC8 size:8208
Call halChannelSetup(), Ch:0
Install SAR handler ...
MAC Address: 00:14:7c:43:d6:51
Interface 3 ip =

IFLNK_PPPOE init : (Linkp)ifno = 11 idx = 2
IFLNK_PPPOE init : (Driverp)ifno = 11 idx = 3
Interface 11 ip =

ruleCheck()> Group: 0,  Error: Useless rule index will be truncated
ruleCheck()> Group: 1,  Error: Useless rule index will be truncated
ruleCheck()> Group: 2,  Error: Useless rule index will be truncated
CBAC rule format check succeed !!
reqCBACBuf()> init match pool, Have: 1000
Memory Address: 0x94babbbc ~ 0x94bb2938
reqCBACBuf()> init timeGap pool, Have: 10000
Memory Address: 0x94bb2938 ~ 0x94be368c
reqCBACBuf()> init sameHost pool, Have: 2000
Memory Address: 0x94be368c ~ 0x94bf30ac
CBAC rule pool initialized !!
Init NAT data structure
RUNTASK id=1 if_task if0...
RUNTASK id=2 if_task if1...
RUNTASK id=3 if_task if2...
RUNTASK id=4 if_task if3...
RUNTASK id=5 timer_task...
RUNTASK id=6 conn_mgr...
RUNTASK id=7 main_8021x...
RUNTASK id=8 period_task...

========== ADSL Modem initialization OK ! ======

RUNTASK id=9 dhcp_daemon...
httpd: listen at
RUNTASK httpd...
RUNTASK id=12 dnsproxy...
RUNTASK id=13 rip...
RUNTASK id=14 ripout...
RUNTASK id=15 dhcpd_mgmt_task...
UPnP is disabled
RUNTASK id=16 surfcon_task...
Starting Multitask...
wlan_timer_init() ...
Wireless Init Success



To enable JTAG functionality, you must short-circuit SHORT pins or put 100R resistor. (At your own risk)

I couldn't write (nor read properly) my flash because I suspect it was broken. But not sure.

But AR7 prom's was read properly.

The AR7 chip has a small memory banks on the chip : 4Kb PROM (@0xBFC00000) and 4Kb RAM (@0x80000000)

The FLASH is located at 0x90000000 (CS0) and RAM is located at 0x94000000 (CS1)

These address extracted from map

See port.jtag and JTAG tools for more JTAG details.


toh/3com/3crwdr100a-72.txt · Last modified: 2014/03/02 01:21 (external edit)