April 6, 2017

The DPH153-AT Femtocell

A friend gave me one of these. Probably because it is the 3G model and he upgraded to 4G. The marking say "Cisco, made in China, ATT, 3G MicroCell. It has a place for an antenna, two RJ-45 jacks, a reset button in a hole, and a place for a 12 volt wall wart to supply power to it.

Date codes on the chips indicate this was manufactured in 2010.

The concept is that this is a mini cell tower. If you have bad cell reception, and a decent internet connection, this routes your phone traffic onto your internet link.

Inside of it is a lot of interesting electronics. There are two Soc, one by RaLink (the RT2010F), which presumably handles WiFi and may have a 360 Mhz MIPS processor inside. The other Soc is by PicoChip, the PC202 with an ARM926EJ inside. There is also a GPS module, for reasons you might not expect. It runs linux, a 2.6.24 kernel more or less.

The GPS module is "provided" to ensure that this device is not (and cannot) be used in areas where some legal policy prohibits it. Along with a GPS module to tell the device where it is located, it also has some clever anti-tamper hardware. Notice that the external antenna seems to be for the GPS receiver.

There was also a famous vulnerability involving something called "the wizard" which ought not to have been shipped to the public with its wide open configuration. Apparently the root password for the Vodaphone was "newsys".

Some of the chips:

WiFi? - Ralink RT2150F
GPS - RoyalTek REB-1315LPNX
FPGA - Xilinx XC3S400A
SDRAM - Winbond W9812G6IH
Flash - MX 29LV320DBTI-70G
Baseband+ARM9 Processor - picoChip PC202, based on ARM926EJ-S processor
SDRAM - Samsung DDR2 K4T51163QG-HCE6
Flash - Spansion GL512P10FFCR2
Ethernet Transceiver - SMSC LAN 8700c-aecz
The PicoChip PC202 is perhaps the most interesting part on the board. This is an English company making unique mulicore DSP devices. Interestingly there is an ARM logo on the part as well. The ARM 926EJ is an older ARM (arm v5) with an 8-bit "Jazelle" mode. This is from the 1998-2006 era and is pretty long in the tooth these days. On many units, the PC202 has a heatsink mounted on it.

The only thing I might consider doing with the unit I have is to extract the GPS receiver from it. Rumor has it that it talks serial with standard NMEA sentences inside the unit.

Have any comments? Questions? Drop me a line!

Tom's Auto repair pages / tom@mmto.org