Yesterday, I posted a few pictures of the opened Fonera, with a few initial views on the device. When I tried to plug it in, it failed to work, only the power LED lighting up. Neither the WiFi signal was coming up, nor the ethernet port was tickling the switch.
The only course of action? To open it up even more. So, the aluminium chassis came off, and that’s when I realized I had seen this before. The WiFi section, which includes the Atheros AR2315, crystal, filters, power amplifiers and ancilliary circuitry are housed inside this casing, and correspond to a reference design provided most likely by Atheros themselves. Check out the Meraki Mini router. For reference, I provide a side-by-side picture below (click for large image).
This is further confirmed by looking closely at the Atheros website section on the AR2315, where we find the following picture:
There is nothing wrong with using reference designs per se, as it is the fastest and easiest way to bring a product to market. If you don’t need to customize your design much, simply use what the manufacturer suggests, and you will be playing on the safe side. A perfect example is Bluetooth headsets, where CSR dominates the market. Virtually all headsets in the market use their reference design, with very little changes between them, other than physical placement of LEDs and buttons.
Block-by-block, here is an overview of the Fonera.
Power
Power is supplied to the Fonera via jack SK1, and is fed through a rapid fuse (Polychem type) to a simple drop-down regulator, which drops voltage from around 5V (4.85V as measured on the wall power supply, using a Fluke 179 multimeter) to 3.3V. The regulator appears to be an AME1117 (though the package markings read AME117), in its CCCT configuration, TO-252 form factor. The regulator is stabilized using three electrolyic capacitors. In these types of regulators, ESR (equivalent series resistance) of the input decoupling capacitors is very important, and this can usually be controlled nicely with tantalum capacitors. These are very expensive compared to electrolytic, however.
There is a second stage of regulation, this time done by an Anpec APL1117, which further drops the voltage to 2.5V. This supply appears to be used by the wireless subsection. Two ceramic capacitors stabilize the regulator.
Without the Atheros chip in place, the PCB drew 90mA at 5V, or 450mW. Since the device was not functioning, the total supply current with WiFi active could not be determined.
Memory
Two memory ICs are available on the Fonera, the first is an ST M25P64 serial flash, with a 50MHz SPI bus and 64Mbit capacity (8MB), in 300mil SO16 format. The fact that SPI has been chosen has the advantage that extra memory devices could be attached to the bus, but it has the caveat that it is slower than a parallel bus. Thus, flashing a new firmware could take a rather long time. Interestingly, there are two footprints on the PCB, presumably to fit a different size and format memory IC, one SO16 and one SO8.
The second memory IC is a Hynix HY57V281620E synchronous DRAM, with a capacity of 128Mbit organized in 16bit blocks. In practice, this results in 16MB of RAM available to the processor.
Ethernet
At the heart of the wired ethernet subsystem is an Altima AC101 ethernet transceiver, capable of 10/100 full duplex operation. The IC is placed on the bottom layer of the PCB, and runs off a 25MHz crystal, strangely placed next to the main power regulator, where it could absorb electrical noise. Usually, crystals are placed well away from sources of interference. Nothing else too exciting here, the transceiver is connected to a standard RJ45 socket, TP1.
Wireless
The wireless section is the most interesting. This is where the Atheros AR2315 single-chip WiFi processor lives. Little public information is available about this or any other Atheros chipset, so it is hard to figure out exactly how it is put in place, but a few details are clear.
First, the chip gets hot. This is why a double heat-conductive adhesive tape bonds the surface to the metal cover, and in turn to the heatsink placed on top. The processor runs from a 40MHz clock source. After the Atheros core, come a couple of filters, and a power amplifier stage. This then runs off to the two antenna tracks. The first antenna exits the aluminium cage and runs up to a test connector. This connector breaks the antenna track when the right mating plug is inserted, which is then fed into a dedicated RF analyzer, which validates that the device is within constraints.
After the antenna test point, there is a split, which can be configured using a zero-ohm resistor, to run to an internal solder pad, or to a PCB-mounted right-angle SMA connector. It is unclear why they chose to use the solder pad, as an in-place soldered connector needs less handling than soldering a pigtail by hand. Besides, my intuition tells me the losses would be lower – I will test this when I get a working Fonera. Both tracks run through an impedance matching network, consisting of two capacitors to ground from the RF track, and an inductor between the capacitors . The purpose if this small circuit is to get the impedance of the PCB track as close to 50 ohms as possible. If the track impedance is mismatched to the antenna, losses take place.
The second antenna runs straight to a PCB pad, where a pigtail may be soldered, also passing a matching network. Below is a picture showing the details of this subsection.
Interfaces
There are two IDC-style connectors on the PCB, one 2×5, and one 2×7 but unpopulated. The 2×5 looks like a serial connector, as only power, ground and two tracks lead out from it. The layout has to be studied in more detail to confirm this assumption.
It can be speculated that this is in fact a serial port, but without the AR2315 pinout, this cannot be determined for sure. The 2×7 header seems to be a JTAG interface, possibly compliant with MIPS EJTAG 2.6. The mapping of the header pins to the AR2315 BGA balls is shown below (thanks for adding a row/column silkscreen for the Atheros chip, and thanks to the OpenWRT project wiki for the JTAG information!):
Between the Ethernet jack and the empty SMA footprint, there is a footprint of 6-way header, which needs a bit more study to determine where it leads internally [I will update the post when I find out --Mike].
Conclusion
This is a very compact and simple WiFi router, designed not for being easy to hack, but for lowest cost. The cheap power regulator, use of large SMDs and choice of pigtail rather than board-mounted SMA connector point in this direction. There is only one port which could be used for something useful, if it is indeed a serial port, the only two GPIOs available being the WLAN and Ethernet LEDs – as long as the Ethernet LED is not controlled by the Altima but by the Atheros. The power LED is on as long as there is power applied to the device, so there is no control over this by the Atheros processor. Power consumption is a bit high, considering the wireless device was not present. The PCB layout is very professional, except in a few particular cases such as the large crystal, but overall, quite nice.
In all, a very small device which could have a lot of potential, had it not been for its lack of I/O. It is unclear whether the router will accept custom firmware, as there are rumors that an encryption & signature system is used. The Fonera is probably OK for regular use by Foneros, but it does not have the hackable edge of the Linksys WRT54Gx. The only suprise could come from the edge connector, as of yet of unknown usefulness.
References
Atheros AR2315 chipset website section and product brief.
Altima AC101 ethernet transceiver.
Nice authopsy – but serious, what s your business with fon? You bored?
What is your business with FON? Why do you post anonymous? Maybe I’m just a troll trying to provoke people like you, who knows.
I am finishing a similar analysis on a Hipi GSM/WiFi VoIP phone, and the write-up of my WaRThog, so this just came as we were given a Fonera…by FON’s Managing Director at FON’s offices. Is the review so bad? I think it’s a nice router in some aspects, just not the hackable device Martin announced.
Mike there is no stopping you. It seem people split their mind if you are biased or not.
To me, continuing to anaylise anything from FON or Martin is just crazy.
You are obsesive. Why not let other people do this all for you?
All these analisise must take you time. Even if your data is good or not, this all takes time.
I say you are biased and bored!
Hi Juan Carlos,
I am not analyzing everything from FON or Martin, otherwise I would not have a job. Other blogs review and post a LOT more about the subject, and they are also supposedly unbiased, and their owners also have blogs.
FYI, this review took less than a couple of hours, spread over a few days, to complete. Thus, the impact on the rest of my activities is minimal. I have been doing a review of some other bits of hardware I will be posting, which also take my time – but hey, if you want to go to the cinema in your free time, well, I may prefer to open things up and study them.
Believe me, this will probably be the last post about FON in a long time, as honestly, there isn’t really that much to it. They have released this router, which is OK in some ways, but that’s it. Nothing has changed, nothing is new, so there is nothing to write about. FON has been a bump in my blogging, as I posted the statistics, received a rather nasty response from Martin, replied, and he never got back. Thus, as far as I am concerned, I could be writing about FON daily, as his ethics have gone down the drain (if he ever had any). But I have other more interesting things to do.
In this case, I just wanted to see if the Fonera was really what Martin claimed it would be. Make up your own mind.
Regards,
Mike
Hi Mike
These comment here are almost as interesting, if less informative, than your posts.
I posted elsewhere that I thought your estimate of active APs was too low as I believe your method was flawed – you mustn’t believe everything that a FON computer tells you
Nevertheless I’m nearer you then Martin on the real number of accessible APs. Back to here – do you have access to a working Fonera? It would be interesting to have a view of the software – is it at all configurable? If not is that going to restrict its use in business networks (static/dynamic IPs & ranges). Control of the ‘MyPlace’ environment etc.
Please don’t give up on FON. Your analysis is interesting and useful even if only to elicit clarifications from FON!
Hi Bizzy,
As for my method, I never said it was perfect, and I openly challenged Martin to prove me wrong and provide real figures, which he didn’t do – only ones that confirmed my part of the analysis.
Right now I have no working Fonera, the one we were given was not working. I suspect it was a problem on the soldering of the Atheros chip, but I cannot be sure. From what I know, it is quite closed as it stands, not even allowing port forwarding, something required for P2P, for example. I believe that the flash can be reprogrammed using the SPI interface, but I probably burned mine when I removed it, so I cannot confirm this as yet – I have a Presto USB programmer I use for my PIC work, which also supports the M25P64.
When the venture I am involved with launches, I expect people to analyze and criticise it, this helps and is a natural process of improvement. There is nothing worse than being surrounded by a chorus of ass-kissers and not listening to those who have different views.
Regards,
Mike
Again, a comment was posted by some obviously mentally deficient individual, who used this:
viagra online | my@viag.ra | http://www.via.gra | IP: 84.147.67.145
to post. It landed (obviously, duuuh!) in the spam bin, where it has been promptly deleted from. It basically said I should do an analysis of some old iron he had in his home…whatever.
This guy will probably end up here one day:
http://www.darwinawards.com
Hi Mike
From the flash chip datasheet, and seeing the unpopulated header has Vcc GND and 4 other pins i suspect it to be a interface for programming the SPI Flash in-system. You may trace the pins back to the chip.
Greets
Heya FonLamer,
Thanks for the tip, I will trace them to see if they do indeed end up at the flash…was thinking of using a SOIC test clip while keeping the Atheros in reset, otherwise it could “fight” the programmer for control of the lines.
Regards,
Mike
[...] un autre site ou l’on peut trouver des infos techniques c’est ici [...]
Hi
I got a serial link setup the last day.
La Fonera runs still openwrt with kernel 2.4.32.
There are some changes, but the overall systemdesign is the same, including cron+heartbeat script…
The bootloader of this thing is a dream
.
Hi FonLamer,
Thanks for the info! Have you managed to flash it at all with any thing other than ‘official’ firmware?
You seem very enthusiastic about the bootloader, what are the hidden goodies?
Regards,
Mike
It was hacked yet via JTAG ( max232 )
http://www.art-xtreme.com/blog/20061017/activar-ssh-en-la-fonera/
Hi Mike
The RedBoot loader is a sort of complete startup bios, very powerfull
.
At the moment i try to compile a new freebsd port to the atheros SoC. But the sources for the used openwrt fork would be more of interrest.
Regards
Get ssh access to La FOnera:
http://pobletewireless.blogspot.com/2006/11/consigue-acceso-ssh-la-fonera.html
http://www.box.net/public/htsthehdmt (PDF manual)
Thanks for your good work guys, next step, reflashing the thing with something useful!
I was over on #openwrt in freenode the other night, and it seems like the OpenWRT crew are rather sold on FON…not surprising since I believe Martin pays them to develop FON’s firmware. One remarkable comment from [mbm] was along the lines of “if FON wants to protect their devices with signed firmware, why should we tell anyone how to get around it?”…
Regards
[...] http://tech.am/2006/10/06/autopsy-of-a-fonera/ [...]
HY!
related to this
http://litch.eu/blog/meraki_inside
New hack!! Add a serial RS-232 to your la fonera router:
http://pobletewireless.blogspot.com/2006/12/aade-un-puerto-serie-la-fonera.html
[...] AR5006 OpenWRT Hacking de la Fonera Por si se os escacharra Alguien que a trasteado con ella Un buen destripe del chisme La receta de Int-0 sobre MadWifi y Atheros El toolchain para openWRT Sobre las fuentes del firmware [...]
[...] http://fon.freddy.eu.org/fonera/ http://tech.am/2006/10/06/autopsy-of-a-fonera/ http://www.pablin.com.ar/electron/circuito/mc/ttl232/ [...]
To Mike Puchol
thanks for the Othero information: I don’t know why people who do not have a life feel that they must analyze and advise other people who are active and productive… like you ! I refer to folks leaving replies and advice for you. Sheesh !
Keep up the good work
Best Regards
Cedric
[...] most publicized, hardware based WiFi sharing solution today is Fon, which sells a small router with a customized firmware based on open-source OpenWRT, and which creates two SSIDs, one encrypted, for use by the owner of the [...]
[...] the following webpage Autopsy of a Fonera, you can [...]