Figuring out the no-cost route

Last month, EDN dissected a $20-on-clearance (previously $50) USB audio peripheral (see "Sonic surprises"). This month, we continue our fiscally focused analyses by tearing into ABS's NW-203-RT, an 802.11g- and four-port-switch-inclusive router that recently sold for $0-after-rebate. What's inside the purple-tinted plastic, and is ABS turning a profit at $20?

More significantly, did the manufacturer do any design work of its own or simply wrap its own plastic around a semiconductor vendor's reference design? We strongly suspected the latter, and ended up being right.

Research, using both the model number and MQ4ARM914FCC ID found on the unit's , suggests that the system is based on Marvell's ARM914 reference design. Numerous other vendors employ that same design foundation, some choosing a dual-antenna configuration. Visit this discussion thread at the BroadbandReports site for more details.

The trend, of course, is not limited to routers; it's standard operating procedure for a multitude of high-volume products such as cell phones, digital still and video cameras, media adapters, DVD players/recorders, and PCs.

A group of hackers called the Airlink Wireless Hacking Project announced, in mid-August of last year, that it was going to attempt to devise an improved Linux firmware build for the AR315W (a clone of ABS's NW-203-RT sold by AirLink+, a company also known as AirLink101). The hackers' site is dead, at least at the moment, but Google's cache still houses the hacker group's writeup (minus, unfortunately, the images and resource files).

Marvell's Libertas chipset comprises the 88W8000 RF transceiver (located underneath an EMI-suppressing Faraday Cage), 88W8510 ARM-based SoC and 88E6060 6-port switch (of which the NW-203-RT only implements four LAN ports). The PCB contains signal traces on both sides, along with embedded power and ground planes. The backside of the PCB contains no circuitry, only through-hole solder points, test points, and traces.

The memory subsystem consists of a Fujitsu (aka Spansion) 29LV800 8 Mbit 90ns flash memory with a hardware-selectable 8- or 16-bit data bus and its hardware-lockable boot block located at the top of its memory map, and two Winbond W981616BH (link is to a PDF file) 16 Mbit SDRAMs with 16-bit data buses. Enterprising end users have been able to correct some of the router's DHCP and DNS functional glitches, along with adding features such as WPA2 support, by figuring out which other vendors' products are based on identical hardware (along with, if necessary, altering the vendor ID embedded within a firmware image file).

A Texas Instruments SN74LVC14 Hex Schmitt-trigger inverter drives LEDs that indicate active power, as well as WAN and wired-and-wireless LAN activity. Back panel components include a power jack, LAN and WAN ports, a reset switch and the antenna connection.

Author information

You can reach Senior Technical Editor Brian Dipert at 1-916-760-0159, bdipert@edn.com, and www.bdipert.com.

Editor's note

The above is an extended version of an article that appeared in shorter form in the print edition of EDN. This PDF file shows the printed version.