Another Huawei RRU3928 teardown but the 900MHz model this time

[Da_Stier]

Hi all,

first of all, Mads did a great job, showing the 1800MHz model of this Remote radio unit, so go check it out:
https://highvoltageforum.net/index.php?topic=517.0


Now for my story, a few days ago, I had a day off so I went to the scrapyard and checked what they had.
As I was about to leave, I came acrosss a complete (!) Huawei basestation installation.
The 19 inch rack with all the server and baseband stuff was pretty much smashed to dust. The 48V supplies were either missing or so smashed up, that I didn't want to spend any amount of money on them.
The only thing left were some fiber breakout panels, some pretty messed up ethernet switches and a few remains of the baseband stuff, with the main BBU missing. The only thing interesting to me, was this plugin card, so I got it for 4€.





Unfortunately I can't find any information on what exactly this card does but it atleast has some nice SMA connectors to salvage.

Other than that I got two RRU3928 remote radio units for 30€ each.
Both are the 900MHz version with two channels, being full duplex each.
One of the units is pretty smashed to pieces, the other one looks brand new apart from a few scratches on the handle.
So I decided to take apart the damaged one and keep the good one for now.
Both units were made in 2013 so they were 9 years in service before being scrapped.









Since Mads already did a very nice teardown, I try to focus on some of the differences between the 1800MHz and the 900MHz version.
The units both came with both SFD(+) modules populated.



The duplexer unit is similar to the one on the 1800MHz version, with one channel on each side of the casting.
Both sides are fully symmetrical.
Other than the 1800MHz version, the 900MHz one also has some ceramic resonator elements.
These are pretty interesting, they are non magnetic so I guess they are made from some kind of ceramics and not of ferrite.
However both sides are silver plated which I find interesting, since the elements themself are not conductive.
(Maybe for "forcing" them to have a very precise length if the elements wouldn't sit flush with the casing?  )



The ceramic elements are only clamped in by the lid and a small "springwasher".



The power amplifier is of course also different to the 1800MHz version.
The LDMOS transistors use black plastic packages, which seems to be more common for the sub 1GHz FETs.
(That is atleast what I found when looking at the examples I have)
Intersting is the use of two different FETs for each amplifier.
This makes it pretty obvious that they use a Doherty configuration with the higher power FET handling the main part and the lower power FET handling the peaking amp.





The mainboard is basically identical to the one Mads showed.
I guess some filtering etc. is different but the architecture and main components are identical.

Since I have both a really nice looking complete unit and the bare boards from this unit, I might try to see how far I can get with reverse engineering it.
If someone has some CPRI knowledge to share, feel free to cantact me, I'm very interested. 





Greetings,
Michael

PS: The glue used on the heatsinks of the plugin card deserves some kind of price.
It was strong enough to rip of the BGAs from the board and then to rip the BGA apart....

[Mads Barnkob]

I have found out by now, that companies very seldom smashes up stuff before throwing it out, it is usually the crane operators at the scrap yards that enjoy picking up stuff and let it fall to be smashed in pieces. If its something going away again in "whole sale" iron scrap category, they dont really give a fuck

Those cylindrical resonators are kind of special, never saw those types before. Its always been mushroom or hollow tubes.

Strong glue or bad solder.... that is the question

[Da_Stier]

I have found out by now, that companies very seldom smashes up stuff before throwing it out, it is usually the crane operators at the scrap yards that enjoy picking up stuff and let it fall to be smashed in pieces.

Good point, I once saw the scrapyard team "taking apart" a Kuka arm .... they literally smashed it with a hammer in order to "get out all the plastic, since the aluminium is worth more that way"
... well I guess that's one way of doing it

Those cylindrical resonators are kind of special, never saw those types before. Its always been mushroom or hollow tubes.

I haven't seen these all that often either.
Also I stand to be corrected, they are actually conductive from silvered end to silvered end with pretty accurate 500kOhms.

Strong glue or bad solder.... that is the question

Lets hope for the first thing. 

[Da_Stier]

I also have some news to share.
I found a serial terminal on the mainboard from the unit I took apart.
It isn't protected and you are the admin by default.

Code: [Select]

Board name ..........................HisiCortexA9

Now The <Second> Bootrom is Running............OK

BootRom Version ...........................SECOND
HDF DDRC Init..................................OK
HDF ECC Init...................................OK
HDF BootBus Init...............................OK
HDF HardWare Init..............................OK
This is only a string for loop test............OK

BSP Normal Mode RamExam begin!

RamExam: execute simple exam:
BSP HDF Driver Init............................OK
BSP HDF Version is Main Ver address at 0x80080000
BSP HDF Version is ignore algorithm at first time

RomInit Has Initiated All Parts................OK

Ram Cleaned And Uncompressed...................OK

Move HDF To Ram................................OK
Root Task Spawned..............................OK
Init System MMU................................OK
Init Boot Device...............................OK
Device Tffs: is mounted OK!!


                                                                                                                       
dosChkLib : CLOCK_REALTIME is being reset to WED OCT 26 08:22:36 2022
Value obtained from file system volume descriptor pointer: 0x5461820
The old setting was THU JAN 01 00:00:00 1970
Accepted system dates are greater than THU DEC 27 00:00:00 1990

Tffs:/  - Volume is OK
Target Name: vxTarget

Adding 8819 symbols for standalone.






                          VxWorks System Boot


Copyright 1984-2008  Wind River Systems, Inc.





CPU: HISILICON - CortexA9 (ARM)
Version: VxWorks 6.8
BSP version: 2.0/0
Creation date: Feb  9 2012, 17:18:02



 

 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
      ]]]]]]]]]]]  ]]]]     ]]]]]]]]]]       ]]              ]]]]         (R)
 ]     ]]]]]]]]]  ]]]]]]     ]]]]]]]]       ]]               ]]]]           
 ]]     ]]]]]]]  ]]]]]]]]     ]]]]]] ]     ]]                ]]]]           
 ]]]     ]]]]] ]    ]]]  ]     ]]]] ]]]   ]]]]]]]]]  ]]]] ]] ]]]]  ]]   ]]]]]
 ]]]]     ]]]  ]]    ]  ]]]     ]] ]]]]] ]]]]]]   ]] ]]]]]]] ]]]] ]]   ]]]] 
 ]]]]]     ]  ]]]]     ]]]]]      ]]]]]]]] ]]]]   ]] ]]]]    ]]]]]]]    ]]]]
 ]]]]]]      ]]]]]     ]]]]]]    ]  ]]]]]  ]]]]   ]] ]]]]    ]]]]]]]]    ]]]]
 ]]]]]]]    ]]]]]  ]    ]]]]]]  ]    ]]]   ]]]]   ]] ]]]]    ]]]] ]]]]    ]]]]
 ]]]]]]]]  ]]]]]  ]]]    ]]]]]]]      ]     ]]]]]]]  ]]]]    ]]]]  ]]]] ]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]       Development System
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]
 ]]]]]]]]]]]]]]]]]]]]]]]]]]]       VxWorks 6.8
 ]]]]]]]]]]]]]]]]]]]]]]]]]]       KERNEL: WIND version 2.13
 ]]]]]]]]]]]]]]]]]]]]]]]]]       Copyright Wind River Systems, Inc., 1984-2009

 CPU: HISILICON - CortexA9 (ARM).  Processor #0.
 Memory Size: 0xb000000.  BSP version 2.0/0.
 Created: Feb  9 2012, 17:18:02
 ED&R Policy Mode: Deployed

C0->tool: inflate, unzipped 10858305 bytes, used 0 seconds

[BoardType] XRRU 2T2R

Start over 3, BootRomEntry Starting.......

One interesting detail is, that it will only fully boot beyond this point, if a SFP module is inserted.
After it booted, you need to unplug it again, since it will be stuck in a "trying to get a CPRI connection" loop otherwise.
The classic help command gives you a nice overview of what you can do in this shell.

Code: [Select]

help                           Print this list
dbgHelp                        Print debugger help info
edrHelp                        Print ED&R help info
ioHelp                         Print I/O utilities help info
nfsHelp                        Print nfs help info
netHelp                        Print network help info
rtpHelp                        Print process help info
spyHelp                        Print task histogrammer help info
timexHelp                      Print execution timer help info
h         [n]                  Print (or set) shell history
i         [task]               Summary of tasks' TCBs
ti        task                 Complete info on TCB for task
sp        adr,args...          Spawn a task, pri=100, opt=0x19, stk=20000
taskSpawn name,pri,opt,stk,adr,args... Spawn a task
tip       "dev=device1#tag=tagStr1", "dev=device2#tag=tagStr2", ...
                               Connect to one or multiple serial lines
td        task                 Delete a task
ts        task                 Suspend a task
tr        task                 Resume a task

Type <CR> to continue, Q<CR> or q<CR> to stop: edrHelp


tw        task                 Print pending task detailed info
w         [task]               Print pending task info
d         [adr[,nunits[,width]]] Display memory
m         adr[,width]          Modify memory
mRegs     [reg[,task]]         Modify a task's registers interactively
pc        [task]               Return task's program counter
iam       "user"[,"passwd"]    Set user name and passwd
whoami                         Print user name
devs                           List devices
ld        [syms[,noAbort][,"name"]] Load stdin, or file, into memory
                               (syms = add symbols to table:
                               -1 = none, 0 = globals, 1 = all)
lkup      ["substr"]           List symbols in system symbol table
lkAddr    address              List symbol table entries near address
checkStack  [task]             List task stack sizes and usage
printErrno  value              Print the name of a status value
period    secs,adr,args...     Spawn task to call function periodically
repeat    n,adr,args...        Spawn task to call function n times (0=forever)
version                        Print VxWorks version info, and boot line
shConfig  ["config"]           Display or set shell configuration variables

Type <CR> to continue, Q<CR> or q<CR> to stop:
strFree   [address]            Free strings allocated within the shell (-1=all)

NOTE:  Arguments specifying 'task' can be either task ID or name.

This got me pretty hyped to see what else I can do and I might or might not have bought a complete Baseband unit for it. 



Greetings,
Michael

[davekni]

VxWorks provides lots of capability.  "lkup" command lists all routine names in symbol table.  Routines can be executed just by typing in name and parameters in "," separated list.  If you have a cross-compiler, new routines can be added (and executed by typing routine name and parameters) by downloading .obj files.  We used it here at Xerox within printers for many years, but not now.  So I no longer have access to try anything out.

[Da_Stier]

Thanks David,

very interesting insight.
I knew VXWorks as a real time OS, I have seen it used on some data logging / automotive measurement boxes before.

I tried the "lkup" command, there are only 8451 routines 

Code: [Select]

C0->lkup
Number of Symbols   : 8451     
Symbol Mutex Id     : 0x54d49b4   
Symbol Hash Id      : 0x54de554   
Symbol memPartId    : 0x5416628   
Name Clash Policy   : Allowed   
value = 0 = 0x0

The serial output is divided in blocks of 22 lines each, to prevent you from spamming your terminal for forever.
This is one of the many 22 line blocks:

Code: [Select]

_func_rtpSigtimedwait     0x05429098 bss     
_func_kernelRoundRobinHook 0x053f1bf4 bss     
_func_IntLvlDisableRtn    0x052c47c0 data     
VOS_Bind                  0x051e2af8 text     
Shell_Char                0x05000374 text     
NrmLinkAlm                0x05203000 text     
FPGA_8bitReg_ReadU16      0x051e1408 text     
FLASH_WriteMemByIndex     0x05072f98 text     
FLASH_WriteDataToBtrm     0x0503bc9c text     
FLASH_BlockErase          0x0505b440 text     
DBGSHELL_FM_RcvHandleStub 0x050a6a68 text     
CPRI_GetLocalTopoModeInCbb 0x05099500 text     
CLKGENERATOR_CheckChipIndexValidity 0x05041a98 text     
BSP_InstallResetFunc      0x050235d0 text     
tExcTaskExcStk            0x053e8638 bss     
system                    0x050db520 text     
sysctl_node               0x052c63e0 data     
sysExcMsg                 0x052b70ec data     
strcpy                    0x050dba34 text     
sigEvtRtn                 0x053ea630 bss     
shellInternalStrToInt     0x0516ee08 text     

Type <CR> to continue, Q<CR> to stop: semEvStop 

Do you know what the hex value means?
Is it like an routine ID or an actual starting address on the memory stack?





Thanks and greetings,
Michael

[davekni]

Do you know what the hex value means?
Is it like an routine ID or an actual starting address on the memory stack?

Yes, the hex values are addresses of the code block in memory.  (Not in stack, just in memory image.)  When you type in a routine name, that is were it starts execution after interpreting parameters and pushing parameter values on the stack.  Decimal or hex parameter values are interpreted as int/long/pointer (32 bits).  Parameters with a decimal point are interpreted as double floats.  I forget how to specify single precision float parameters, perhaps with "(float)" in front as in C syntax.  Some expression evaluation is allowed in parameters.  New entries can be added to symbol table and assigned with values with "new_name = 33".  Then "new_name" can be used as a parameter value when invoking a routine.

Output can be redirected to a file with ">file_name".  I used to run:
lkup "" > list_file
then hold the enter key down until it finishes.  All routines are now in file_name, which can be viewed with an editor.
Oh, just realized that above presumes some network file system is mapped, through NFS or RSH.  There is a syntax to specify local flash storage for files, but that wouldn't do much good unless you have a way to access such files.

BTW, indirection works as in C.  You could type &new_name to see what address this new variable was allocated.  If the new variable is a pointer, *new_name provides the value pointed to.

In general vxWorks command line is much like typing into a C interpreter.  Try something as you would a line of C and it may work.

[Da_Stier]

Hi all,

sorry for not giving any updates lately, I was pretty busy.
I managed to get hold of a BBU3900, which is Huaweis baseband unit that is compatible with quite a few of their remote radio heads.
It also is pretty modern and while I'm not a 100% certain, that they still sell this exact model, it is still in use in a lot of cellsites.

The unit is a single 2U 19" rackmount enclosure, that takes plugin cards to configure it the way you want / need it for the cellsite.
This is the outside view of the complete unit:







There is a very interesting thread on the Huawei support forum, that shows the purpose of each of the cards.
You can check it out right there, if you want to:
https://forum.huawei.com/enterprise/en/an-anatomy-of-huawei-bbu3900/thread/873125-100305

These are the cards that I got:

GTMU:

Functions (taken from the Huawei link)
1- Controls and manages the base station
2- Supports fault management system, configuration management system, performance
management system, and security management system
3- Monitors the fans and power modules
4- Provides and manages the clock source of the base station in centralized mode
5- Provides the clock output for test
6- Provides the ETH port for maintenance on the OM system
7- Supports transmission through four E1s
8- Provides CPRI ports for communication between the BBU and the RFUs
9- The GTMUb supports interconnected BBUs.
10- Four IDX2 ports on the backplane of the GTMUb can achieve the function of baseband

resource pool backup.










UMPT: ( Universal Main Processing and Transmission)

Function (taken from the Huawei link)
1- Monitors Performance
2- Signals Processors
3- it has A USB flash drive can be inserted into the port for software upgrade and basestation commissioning.
4-The GPS port on the UMPTa6 orUMPTb2 is used for transmitting radio frequency(RF) signals received from the antenna to the satellite card.
5-  It Performs OM (Operation and Maintenance) functions. Further it also do configuration management, equipment management, performance monitoring, signaling processing, and active/standby switch over.
6- It Provides clock reference,transmission ports,and the maintenance link connecting to the OMC. Here, OMC can be the LMT or M2000 client.








UBBP: (universal baseband processing unit)

Functions: (taken from the Huawei link)
1-  Multiplexes baseband resources among different modes, thereby supporting multimode concurrency.
2- Provides CPRI ports for communication with RF modules and processes uplink and downlink baseband signals.








UPEU: (Universal Power and Environment Interface Unit)

Functions: (taken from the Huawei link)
The Universal Power and Environment Interface Unit (UPEU) is a mandatory board
of the BBU3900. It converts -48 V or +24 V DC power to +12 V DC power. The
UPEU is classified into the Universal Power and Environment Interface Unit Type
A(UPEUA) and the Universal Power and Environment Interface Unit Type B
(UPEUB). The UPEUA converts -48 V DC to +12 V DC and the UPEUB converts +24 V
DC to +12 V DC.

1- Converts -48 V or +24 V DC to +12 V DC that is applicable to the boards
2- Provides four ports with two ports transmitting two RS485 inputs and the other
two ports transmitting eight Boolean signals
3- Provides reverse connection protection for power cable connectors.









Interestingly Huawei uses the same power and data connector on this Power supply module as they use on their RF power amplifier pallets.


I also managed to get a copy of all the manuals (the installation manual, the setup guide, both for hard- and software, etc.)
I also thought that I found a copy of the configuration software, called "Site Maintenance Terminal System", however it turned out to be a loose end.
So currently I got the whole system - atleast hardware wise - but miss the software to set it up.
I will still be looking, maybe I can get my hands on the software at some point but without it, it looks like this is about it.
.... on the other hand it is a good thing that the software controlling infrastructure isn't just available to everyone, I guess.


Greetings,
Michael