Examining the Zyxel P2602H-D1A ADSL router

I found an old Zyxel ADSL modem in my junk pile and was going to throw it away. However, curiousity got the better of me and I cracked open the enclosure so I could see inside.

The interesting components are:
* Infineon ADM6996I 10M/100M ethernet switch/processor
* TI TNETV9-1PAG DC66ACTHW G4 chip near the telephone jacks
* 2x Silicon Labs Si3215-FM programmable CODEC with ringing
* Altera EPM3032A MAX3000 CPLD
* Eorex EM48AM1684VTA-75F 4MByte * 4 banks * 16 bits Synchronous DRAM
* EN29LV320B-70TCP 4 Megabit 256K x 16-bit Flash ROM (bottom of PCB)
* TI TNETD 7200ZZDW AR7W ADSL processor

On first glance, there doesn’t seem to be a lot of information on this line of processors. According to wikipedia https://en.wikipedia.org/wiki/TI-AR7 ,the processor is based on the MIPS 4KEc 32-Bit RISC processor core. Texas instruments sold the product line to Infineon. It was sold again to Lantiq.

There is little information about the booting process of the AR7, except for this tidbit: 4Kb PROM (0xBFC00000) and 4Kb RAM (0x80000000) on the chip for boot purposes.

I assume the PROM contains minimal code to boot the processor from the external flash chip. More info on the booting process: http://www.nulltrace.org/2013/04/mips-bootstrapping.html

On the PCB, there are a few populated headers that look suspiciously like JTAG or a serial console. More on that later…