AT&T 3G MicroCell: A Comprehensive Exploration

So we now know there's relatively little to be learned about the device on the software side. What about the hardware itself? Again, our semiconductor-possessed sensibilities wouldn't be happy unless we got to see what's at this thing's core. I was eager to tear open the box and void some warranties like nobody's business, until I discovered something while doing my homework online that made me stop. Several users on the AT&T Forums reported that they were called by tech support because their MicroCell's tamper switch had been triggered. You read that right, the MicroCell has a built in physical tamper switch. They're that serious about you not getting into this thing. Rather than render the box useless before I even got to use it, I decided on another route.

Instead, I got the FCC ID off the bottom of the box (it's MXF-3GFP980217) and found the FCC filing online. Luckily, the internal photos of the device are freely available and of marginally passable quality. The most important photo is this one, of the board's topside with the heatsink removed:

That's some horrendous barrel distortion, FCC cameraman

 

I've tried locating the physical tamper switch and can't quite find it, though I'm certain it's there somewhere. Starting from the left, we can see the GPS chipset (RoyalTek) and the external connector just above it. There's also a trace to the Cirocomm internal GPS antenna which is the white square protruding from the board at far left. Running along the top of the board are the two ethernet connectors, reset pin, and DC power in. On the left we can also see two relatively thick traces for the antenna, likely Rx and Tx for the air interface. Interestingly, there are some connector headers also visible at the base of where those traces emerge from the amplifiers. Just south of the GPS RoyalTek chip is a flash TSOP, a Ralink RT2150F chip, and some DRAM up top. Searching for that particular Ralink chip revealed nothing. Given that Ralink traditionally makes wireless access point SoCs and wireless adapters, it's possible this is the device's radio. It's also possible that this is handling routing and ethernet for that "priority mode" configuration mentioned earlier.

 

 

Moving right, there's something we don't see every day - except in the domain of high speed signal processing - a Xilinx Spartan 3A FPGA sitting right alongside the platform's SoC. If you squint, you can make out picoChip under that thermal paste, along with 302. It's highly likely this board is using the picoChip PC302 SoC. Remember that 4 simultaneous phone limitation earlier? The PC302 is the only 3GPP Release 7 WCDMA (HSPA) SoC baseband picoChip makes with that implicit restriction, so it's very likely this is what we're seeing here. There's some RAM alongside at right, but it's impossibly hard to make out the markings.