Re-use an lte modem from an isp router with turris omnia

Omnia hardware Omnia HW tweaks
#1

Hi,
I have an LTE router from my isp which is this model:
https://avxav.com/product/fdd-lte-cat4-fqt-144-series/

It’s of course it is locked to my isp, after disassembling the router I was able to identify the UART pins and used them to collect info about the device internals:
1- the login shell reads “root@mdm9607:” and I was able to log in using the credentials from osmocom.
2-/proc/cpuinfo:

processor	: 0
model name	: ARMv7 Processor rev 5 (v7l)
BogoMIPS	: 38.40
Features	: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x0
CPU part	: 0xc07
CPU revision	: 5

Hardware	: Qualcomm Technologies, Inc MDM9207
Revision	: 0000
Serial		: 0000000000000000
Processor	: ARMv7 Processor rev 5 (v7l)

From the above information, I believe that this uses a Quectel ec25 module( how can I be sure?)
I removed the model from the router but the router doesn’t boot if the module is removed, so the router doesn’t have a CPU on its own! Does the module run the entire Linux kernel?

photo_2022-07-20 21.19.14
photo_2022-07-20 21.19.14720×1280 179 KB

photo_2022-07-20 21.19.20
photo_2022-07-20 21.19.201280×960 325 KB

photo_2022-07-20 21.19.23
photo_2022-07-20 21.19.23960×1280 286 KB

photo_2022-07-20 21.19.24
photo_2022-07-20 21.19.24958×1280 136 KB

photo_2022-07-20 21.19.31
photo_2022-07-20 21.19.31720×1280 192 KB

So my question is: can I just remove this module and plug it in Turris Omnia and it should work?
I’m a bit afraid because of how the module runs an entire os, so I’m not sure if this really uses a standard mini PCIe port or just uses the mini PCIe connector but not compatible pins!

Regards

#2

When removing it leads to a not booting machine that does normally mean there is some restriction in the firmware that refuses to boot the machine if a component is missing/removed/dead.
What is interesting is that this removed card has 4 connectors for antennas. The original Quectel EC25 has only two.

1 Like
#3

Two of the antenna connectors go into external antennas and the other two go into internal PCB antennas, and this is configurable in the webui( you chose either internal or external antennas)

BTW, when i said i believe it is Quectel EC25 i meant a clone of it (i.e it uses the same configuration i think).

#4

Are you saying that the os is still in the main board and my assumption that the entire os runs on that module is wrong?
I have two things that to me confirm my theory:
1- if i remove the module and boot the device while having my UART hooked up, then i see nothing gets executed, if the OS in in the mainboard and it simply refuses to boot if i removed the module, then i would guess that at least the bootloader gets executed and it has some code to check for the existence if the module, but no output in the UART means no code at all gets executed.
2- The mainboard is practically empty, I can see no CPU chip in the mainboard that can run the OS, only passive components and some shift register IC, the only chip that i found in the mainboard that looks like a CPU is a chip with the model (qca8337-al3c) but according to a datasheet found online this is just a gigabit switch IC