Posted on 8 Comments

Virgin Media Superhub 2 Teardown

I recently got the latest upgrade from Virgin Media, 200Mbit DL / 20Mbit UL, and to get this I was informed I’d have to buy their latest hardware, since my existing CPE wouldn’t be able to handle the extra 5Mbit/s upload speed. (My bullshit detector went off pretty hard at that point, as the SuperHub 2 hardware is definitely capable of working fine with 20Mbit/s upload rates). Instead of having to return the old router, I was asked to simply recycle it, so of course the recycling gets done in my pretty unique way!

Mainboard
Mainboard

The casing of these units is held together by a single screw & a metric fuckton of plastic clips, disassembly is somewhat hindered by the radio antennas being positioned all over both sides of the casing. Once the side is off, the mainboard is visible. The DOCSIS frontend is lower left, centre is the Intel PUMA 5 Cable Modem SoC with it’s RAM just to the lower right. The right side of the board is taken up by both of the WiFi radio frontends, the 5GHz band being covered by a Mini PCIe card.

Atheros Gigabit Switch
Atheros Gigabit Switch

The 4 gigabit Ethernet ports on the back are serviced by an Atheros AR8327 Managed Layer 3 switch IC, which seems to be a pretty powerful device:

The AR8327 is the latest in high performance small network switching. It is ultra low power, has extensive routing and data management functions and includes hardware NAT functionality (AR8327N). The AR8327/AR8327N is a highly integrated seven-port Gigabit Ethernet switch with a fully non-blocking switch fabric, a high-performance lookup unit supporting 2048 MAC addresses, and a four-traffic  class Quality of Service (QoS) engine. The AR8327 has the flexibility to support various networking applications. The AR8327/AR8327N is designed for cost-sensitive switch applications in wireless AP routers, home gateways, and xDSL/cable modem platforms.

Unfortunately most of the features of this router are locked out by VM’s extremely restrictive firmware. With any of their devices, sticking the VM supplied unit into modem mode & using a proper router after is definitely advised!

Intel Puma 5 CM CPU
Intel Puma 5 CM CPU

The cable modem side of things is taken care of by the Intel PUMA 5 DNCE2530GU SoC. This appears to communicate with the rest of the system via the Ethernet switch & PCI Express for the 5GHz radio.

Atheros WiFi SoC
Atheros WiFi SoC

The 2.4GHz radio functionality is supplied by an Atheros AR9344 SoC, it’s RAM is to the left. This is probably handling all the router functions of this unit, but I can’t be certain.

Atheros LAN PHY
Atheros LAN PHY

A separate Ethernet PHY is located between the SoC & the switch IC.

 

5GHz Radio Card
5GHz Radio Card

The 5GHz band is served by a totally separate radio module, in Mini PCIe format, although it’s a bit wider than standard. This module will probably be kept for reuse in another application.

Power Supplies
Power Supplies

All down the edge of the board are the multiple DC-DC converters to generate the required voltage rails.

MaxLinear MXL261 Frontend
MaxLinear MXL261 Frontend

The DOCSIS frontend is handled by a MaxLinar MXL261 Tuner/Demodulator. More on this IC in my decapping post 🙂

The Unknown One
The Unknown One

I’ve honestly no idea what on earth this Maxim component is doing. It’s clearly connected via an impedance matched pair, and that track above the IC looks like an antenna, but nothing I search for brings up a workable part number.

2.4GHz Frontend
2.4GHz Frontend

The RF switching & TX amplifiers are under a shield, these PA chips are SiGe parts.

Atheros 5GHz Radio
Atheros 5GHz Radio

Pretty much the same for the 5GHz radio, but with 3 radio channels.

8 thoughts on “Virgin Media Superhub 2 Teardown

  1. That mystery Maxim Chip is an RF Amplifier Docsis 3 Cable Upstream Amplifier (Maxim 3520+T)

    1. Hi LV426, (love the Alien reference ;))

      Thanks for the info, I’ll update the post to add this.

      de 2E0GXE

  2. Could you also share photo of back of the PCB?
    I’m wondering about flash chip used in this device.

    1. Hi John,

      Unfortunately I don’t have the PCB anymore, so I can’t share a photo of the back side, but the main flash with the firmware is a Spansion S70FL256P0XMFI00 256Mb NOR device.

      Thanks for reading!
      de 2E0GXE

      1. The Engineer, thanks!

  3. Did you (the Engineer) find a use for the 5GHz band radio module, found in the Mini PCIe slot? Inrerested because I have a sh2ac and considering alternative uses. if i can’t come up with something i might just rip it apart for the 5GHz band radio module.

  4. Lat time i tried using the pci-e card it fried it (wiring sligtly change like what apple did). had same thought to get my single band laptop to dual ban. The MAC 5320E is a 4/8 DaC chip. This modem has so many features that Netgear / VM have turned off. just wish i coulbe be bothered to decrypt the U-Boot Uart and rebuild the modules to allow a more enterprice level router…

    1. Hi,

      I’m not surprised they’ve done such a thing with the PCIe radio – although it does seem like a massive expense to have custom boards built. I’m now on VM’s commercial service, which comes with a better Arris CM, I’ve not looked into the new one though!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.