Exposing a router’s Achilles’ heel

Article By : Brian Dipert

Read on as the author actualises his aspiration to pick apart WD's My Net N900 router.

Around April last year, I wrapped up a brief and frustrating set of experiments with WD's now-obsolete My Net N900 router, which began in a promising manner but rapidly degraded. At the time I figured, "The WD router is now on the teardown pile." Now's the time to actualise that particular aspiration. I'll begin with a few exterior overview shots, the second showing off its unique and desirable-to-me integrated seven-port GbE LAN switch:

[EDNAOL 2016MAY30 TA 01Fig1]
[EDNAOL 2016MAY30 TA 01Fig2]
This one shows off the system fan that I (and others) never succeeded in seeing spin:

[EDNAOL 2016MAY30 TA 01Fig3]
And here’s a closeup of the product sticker:

[EDNAOL 2016MAY30 TA 01Fig4]
Now to dive inside. Four screws were immediately visible in the corners of the underside panel:

[EDNAOL 2016MAY30 TA 01Fig5]
But removing them didn’t enable me to pull apart the two halves. After fruitlessly trying for a few minutes to find and detach a plastic retaining clip or other similar assemblage inside the device, I realised there must be a fifth screw somewhere. In pressing my thumb down on various portions of the product sticker, I initially thought I’d found it in the centre, but it ended up being a moulding “dimple.” The fifth screw ended up being underneath one corner of the sticker:

[EDNAOL 2016MAY30 TA 01Fig6]

Removing it enabled easy lift-off of the router's topside:

[EDNAOL 2016MAY30 TA 01Fig7]

Look at that clean, well-organised layout. Once again I find myself eminently impressed with WD's hardware design chops. Unfortunately, the software portion of the project apparently wasn't similarly up to the task.
Speaking of software, whereas the My Net N900 is not yet open-source firmware-compatible, its N750 counterpart does have OpenWrt support. Pragmatically, the My Net N900 probably never will be an open-source candidate, due to its Ubicom QoS processor foundation. Holding out hope, however, I've decided to not do a full disassembly. But don't fear; thanks to online documentation and photos found elsewhere, I'll still be able to tell you what's underneath those three Faraday shields.
Let's first look at the one at the centre of the board.

[EDNAOL 2016MAY30 TA 01Fig8]
If the heat sink on top of it led you to suspect the system processor might be inside, you’d be right. It’s a Ubicom (now Qualcomm) IP8260U running at 600MHz; alongside it are two Samsung K4B1G1646G-BCH9 1 Gbit DDR3 SDRAMs, together comprising 256 MBytes of system RAM.
The module above it implements the system’s 5GHz 802.11a/n sub-system, housed on a mini PCI Express add-in module.

[EDNAOL 2016MAY30 TA 01Fig9]

It's based on an Atheros (again now Qualcomm) AR9380 controller, and befitting the router's 3×3:3 MIMO configuration, mates up with three antenna scattered around the system's perimeter:

[EDNAOL 2016MAY30 TA 01Fig10]
[EDNAOL 2016MAY30 TA 01Fig11]
[EDNAOL 2016MAY30 TA 01Fig12]

Its mini PCIe wireless module companion, below and to the right of it (and above the system fan), is derived from the 2.4GHz-only AR9381 and handles 802.11b/g/n functions. Again, it connects to three distinct antenna:

[EDNAOL 2016MAY30 TA 01Fig13]
[EDNAOL 2016MAY30 TA 01Fig14]
[EDNAOL 2016MAY30 TA 01Fig15]
Two other notable ICs on the PCB, between the processor module and the four transformers associated with the single WAN and seven LAN ports, are a pair of Atheros AR8327N five-PHY GigE switch chips.

[EDNAOL 2016MAY30 TA 01Fig16]
The final item of digital note is the nonvolatile companion to the Samsung DRAMs, a Macronix MX25L12835EMI-10G flash memory in the upper left corner of the processor module.
Last but not least, let’s see what the underside of the PCB looks like:

[EDNAOL 2016MAY30 TA 01Fig17]
As usual, it’s unremarkable, comprised of through-hole solder joints, traces, and a few passives. I’ll close with a closeup of the power supply sticker:

[EDNAOL 2016MAY30 TA 01Fig18]
As previously mentioned, the My Net N900’s Achilles’ heel seemingly is its software, not its hardware. Hopefully, someday the open source community will (as usual, but not always) come through with a firmware fix; if so, I’ll report back. Until then, I welcome your comments here.

About the author
Brian Dipert is Editor-in-Chief of the Embedded Vision Alliance. He is also a Senior Analyst at BDTI and Editor-in-Chief of InsideDSP, the company’s online newsletter. And he’s an off-hours freelancer as the Principal at Sierra Media, where he contributes to (among other things) the Brian’s Brain blog at EDN Magazine. Brian has a BSEE from Purdue University in West Lafayette, IN. His professional career began at Magnavox Electronics Systems in Fort Wayne, IN, where he worked for an aggregate 2.5 years as a co-op engineer. Brian subsequently spent eight years at Intel Corporation in Folsom, CA, holding a variety of roles in the company’s nonvolatile memory group.

Leave a comment