Platform ALT3800 as good target?

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/qc-linux-modems@lists.osmocom.org/.

Shinjo Park pshinjo at sect.tu-berlin.de
Thu Feb 6 09:43:48 UTC 2020


Hi all,

I didn't knew that MikroTik is also doing LTE these days, and seems that there 
are more interesting products from them.

They also have additional modems:
 * R11e-LTE: https://mikrotik.com/product/r11e_lte
 * R11e-LTE-US: https://mikrotik.com/product/r11e_lte_us
 * R11e-LTE6: https://mikrotik.com/product/r11e_lte6

According to internal photos for FCC ID [1], R11e-LTE6 seems to have... ASR 
Micro LTE modems. Never heard about that company before, but seems that they 
have acquired Marvell's baseband business and their chipset is used in mobile 
routers. R11e-LTE-US [2] and probablyt also R11e-LTE seems to use Qualcomm 
MDM9207, nothing seems so special here.

[1] https://fcc.report/FCC-ID/TV711ELTE6/4191387
[2] https://fccid.io/TV7R11ELTE/Internal-Photos/Internal-Photos-3591471

Best regards,
Shinjo

2020년 2월 5일 수요일 오후 1시 43분 17초 CET에 Harald Welte 님이 쓴 글:
> Hi Elias,
> 
> thanks for reaching out.
> 
> On Wed, Jan 29, 2020 at 12:28:37AM +0100, Elias Devoldere wrote:
> > I was playing with LTE modem R11e-4G based on ALT3800-B0 chipset.
> 
> I've read about Altair (now part of sony) based modems, but never had any
> actual contact with them.
> 
> It seems that one HL78 NB-IoT modem from Sierra Wireless as well as the L866
> from Telit seems to be based on Altair, but I wasn't aware that Mikrotik is
> also using Altair.
> 
> > I was amazed when I got a U-Boot console after command at+cfun=1,1 and
> > sending several random characters. I assume it's not news for seasoned
> > wolves who hunt here.
> 
> This is highly unexpected, of course.
> 
> > Is this behavior generally known?
> 
> I've never heard of it, certainly it was not a topic in Osmocom so far.
> 
> > Can this be a one-piece property (I have only one piece)?
> 
> possibly, but more likely it relates to the specific firmware build.
> 
> > Could it be useful for interesting research?
> 
> of course.
> 
> > Is there anyone who cares about it?
> 
> I do.
> 
> > I will try to extract parts of the memory using U-boot.
> 
> good luck!
> 
> > U-Boot 2012.10 (Aug 09 2018 - 10:17:38)
> > mips-fourgee3100-linux-uclibc-gcc (0.1) 4.5.3
> 
> ok, so we know it's a MIPS architecture, and we know it's the fourgee3100
> (Altair 3100) for whihc it was originally written.  The 3800 is likely
> bcakwards compatible then.
> 
> > 'GUESS MODE - NO BOOT ALLOWED !!!'; fi
> 
> whatever a GUESS MODE is
> 
> > dtb_file=alt3802.dtb
> 
> 3802 is even a more specific part number
> 
> > lte_fw=PS100_RealPHY.elf
> 
> also interesting that the PHY firmware comes as ELF file, would be
> interesting to see what ELF architecture it is for.
> 
> > ver=U-Boot 2012.10 (Aug 09 2018 - 10:17:38)
> 
> always surprising what kind of stone age versions are in use :)
> 
> Please do keep us posed.  I odered one of those modems myself, too.


-- 
Shinjo Park <pshinjo at sect.tu-berlin.de>
Security in Telecommunications <sect.tu-berlin.de>
TU Berlin / Telekom Innovation Laboratories
Ernst-Reuter-Platz 7, Sekr TEL 16 / D - 10587 Berlin, Germany
Phone: +49 30 8353 58272





More information about the qc-linux-modems mailing list