- OpenBSC - lists.osmocom.org

eNodeB to offer
by tsaitgaist 26 Nov '22

26 Nov '22

I have a complete eNodeB (LTE base station) to offer, with following components: - 1x Ericsson DUL 20 01 (the base station) - 1x Ericsson RUS 01 B4 (80W RF fronted for LTE band B4) - 1x Mean Well RS-150-48 (48V 3.3A power supply for both above) - 2x power input cable (for DUL and RSU, based on RPM 777 193/00315 R1B cable connector) - 1x spare power 20A cable (RPM 77 193/00315 R1B) - 1x mini SPF cable (to interconnect DUL and RSU, RPM 777 211/00900) - 2x coaxial cable to inter-connect RSU to its cavity block (RPM 777 701/00050, 1x on RSU, 1x spare) - 3x coaxial to SMA cable (RPM 777 227/00080, for RSU RXA I/O, RXA OUT, RXB I/O ports) - 1x USB to RS232 adapter, for DUL terminal port - 1x RS-232 to RJ45 adapter, for DUL terminal port - 2x 26mm RF connector to N connector adapters (for RUS RF A and B port) - 2x N to SMA adapters - 1x N termination (10W) - 1x SMA termination (<1W) - 1x alternative OS (on compact flash card, with different configuration/licenses) - 1x N-connector antenna (antenna size is 35 cm, 698-960 + 1700-2700 MHz) - 1x SMA cable antenna (antenna size is 30 cm, 688-960 + 1700-2700 MHz) - 1x N-connector cable antenna (antenna size is 10 cm, flat PCB antenna, 700-2600 MHz) you can have all of that for free, as long as you take care of the shipping (12 kg, from Germany). if you are interested, just let me know.

1 0

linking local libs in C tests
by Neels Hofmeyr 21 Nov '22

21 Nov '22

Hi all, I am having an automake / libtool problem and don't know how to solve it. In libosmo-pfcp, there is the pfcp_test binary, which obviously requires linking libosmo-pfcp.so -- more precisely, it should NOT link the system installed libosmo-pfcp.so, but the locally built one, libosmo-pfcp.a. I try to accomplish this by: pfcp_test_LDADD = \ $(LIBOSMOCORE_LIBS) \ $(top_builddir)/src/libosmo-pfcp/libosmo-pfcp.la \ $(top_builddir)/src/libosmo-gtlv/libosmo-gtlv.la \ $(NULL) https://cgit.osmocom.org/libosmo-pfcp/tree/tests/libosmo-pfcp/Makefile.am I am now adding a new optional IE to libosmo-pfcp, and I found that this does not work as expected! The pfcp_test binary is linked to the previously installed libosmo-pfcp.so in /usr/local/lib, instead of the proper, new version from the build tree. I found out by getting an obscure ABI corruption error, verified it by: ~/osmo-dev/make/libosmo-pfcp/tests/libosmo-pfcp $ ldd .libs/pfcp_test [...] libosmo-pfcp.so.0 => /usr/local/lib/libosmo-pfcp.so.0 (0x00007f1b6bc00000) libosmo-gtlv.so.0 => /usr/local/lib/libosmo-gtlv.so.0 (0x00007f1b6cc0a000) [...] As soon as I 'make uninstall' in libosmo-pfcp.git's root dir, this changes to: ▶ ldd .libs/pfcp_test [...] libosmo-pfcp.so.0 => not found libosmo-gtlv.so.0 => not found [...] and then the test succeeds (because './pfcp_test' is actually a shell script generated by libtool with linker magic referencing the libs built within the libosmo-pfcp.git tree). Now I am at a loss: How do I tell automake (libtool) to keep out the system installed .so and prioritize the libs in the build tree? I can work around this for me by doing 'make uninstall' every time the libosmo-pfcp ABI changes, but I would much rather fix this, so that users rebuilding a newer version pulled from git don't run into this obscure problem. I suspect that we may have a similar pitfall in many other osmo source trees, because the Makefile.am *looks* like it takes care of this problem, but actually doesn't. Any ideas? I am using: automake (GNU automake) 1.16.5 autoconf (GNU Autoconf) 2.71 libtoolize (GNU libtool) 2.4.7 (Debian Unstable) Thanks! ~N

3 4

java applet loading on sysmo-isim-sja2
by Philipp Maier 21 Nov '22

21 Nov '22

Hello Folks. I am trying to get my head around on how java applet loading works for sysmo-isim-sja2. At first I used the following, updated example to compile a HelloSTK2.cap: https://github.com/mrlnc/HelloSTK2.git This works fine and it also loads fine on sysmo-usim-sjs2 using shadysim.py Now I want to load the exact same file to a sysmo-isim-sja2. I tried with shadysim_isim.py from https://github.com/herlesupreeth/sim-tools: ---------------8<--------------- $ python shadysim_isim.py --pcsc 2 -l /home/owner/work/simcard_applet_loading/HelloSTK2.cap -i /home/owner/work/simcard_applet_loading/HelloSTK2.cap --enable-sim-toolkit --module-aid d07002ca44900101 --instance-aid d07002CA44900101 --nonvolatile-memory-required 0100 --volatile-memory-for-install 0100 --max-menu-entry-text 15 --max-menu-entries 05 --kic 56B6B26346DEF2A74BC8DFAF3BEA71D6 --kid 8EFE5A4B60C751FD18F33A24886967E7 Traceback (most recent call last): File "shadysim_isim.py", line 494, in <module> ac.load_app(args.load_app) File "shadysim_isim.py", line 369, in load_app self.load_aid_raw(aid, data, len(data) / 2) File "shadysim_isim.py", line 271, in load_aid_raw self.send_wrapped_apdu_checksw('80e60200' + ('%02x' % (len(data) / 2)) + data + '00c0000000') File "shadysim_isim.py", line 246, in send_wrapped_apdu_checksw raise RuntimeError("SW match failed! Expected %s and got %s." % (sw.lower(), response[1])) RuntimeError: SW match failed! Expected 9000 and got 6985. ---------------8<--------------- And I also tried with gp.jar from https://github.com/mrlnc/HelloSTK2.git ---------------8<--------------- $ java -jar ./gp.jar --key-enc 56B6B26346DEF2A74BC8DFAF3BEA71D6 --key-mac 8EFE5A4B60C751FD18F33A24886967E7 --key-dek 3BA47E883FE2462B5D43B85C4CCDF0AC --install /home/owner/work/simcard_applet_loading/HelloSTK2.cap [main] WARN pro.javacard.gp.PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02 [main] WARN pro.javacard.gp.PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02 [main] WARN pro.javacard.gp.PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02 [main] INFO pro.javacard.gp.GPSession - Using card master keys: ENC=56B6B26346DEF2A74BC8DFAF3BEA71D6 (KCV: 1ADB2F) MAC=8EFE5A4B60C751FD18F33A24886967E7 (KCV: 174546) DEK=3BA47E883FE2462B5D43B85C4CCDF0AC (KCV: D7011A) for null [main] INFO pro.javacard.gp.GPSession - Diversified card keys: ENC=56B6B26346DEF2A74BC8DFAF3BEA71D6 (KCV: 1ADB2F) MAC=8EFE5A4B60C751FD18F33A24886967E7 (KCV: 174546) DEK=3BA47E883FE2462B5D43B85C4CCDF0AC (KCV: D7011A) for SCP02 [main] INFO pro.javacard.gp.GPSession - Session keys: ENC=76900ED8B816F1822A29D7DC81F1B843 MAC=02D74CFFA5F85F1F999F23F60C22AF02 RMAC=87AFE7F26DDE69307EA35AE567AC8F26, card keys=ENC=56B6B26346DEF2A74BC8DFAF3BEA71D6 (KCV: 1ADB2F) MAC=8EFE5A4B60C751FD18F33A24886967E7 (KCV: 174546) DEK=3BA47E883FE2462B5D43B85C4CCDF0AC (KCV: D7011A) for SCP02 CAP loaded Error: INSTALL [for install and make selectable] failed: 0x6A80 (Wrong data/incorrect values in data) ---------------8<--------------- As it seems gp.jar seems to work better than shadysim_isim.py. Unfortunately I have no experience in java card programming yet, so its difficult for me to tell where the error could be. (When I run gp.jar once more it tells me "Error: STRICT WARNING: Package with AID D07002CA44 is already present on card", I can also delete the applet again, so apparently its kind of loaded...) Is there anyone here who managed to load an applet to a sysmo-isim-sja2 and how? best regards. Philipp -- Philipp Maier <pmaier(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Director: Harald Welte

1 0

femtocell collection gift
by tsaitgaist 18 Nov '22

18 Nov '22

I have a plethora of femtocells (small base stations) I want to get rid of. If you want it, it's yours, for free. You just need to cover the shipping costs. Else it will become the property of Trash Inc. Here the list of 3G femtocells: - Cisco residential signal box USC3331, model 74-12584-01, PID USC3331-EE-K9. The flash (TSSOP) is desoldered but in the box (just is case you need to dump it). Just resolder it and it should work fine. - 2x Vodafone (Greece) Access Gateway UAP2105. One is open, but nothing is missing. 5 pair of board to board connectors are included. This is the one first model that has been hacked. - Vodafone Sure Signal AP 2820V. A cute plug style 3G femtocell. modded for serial output and external power supply (so the serial is not mains referenced). I have doc on how to root and flash it. Sadly it misses little effort for interfacing it with osmocom, but is the best candidate for such a project. - Vodafone Sure Signal AP 2820V. not modded. - Ubiquisys ZP-000-05EU, aka SerComm. Flash is desoldered and in the packages. Serial output is available. - SFR Home 3G G2, Ubiquisys ZP-004-01FR. serial is available. This is the one I hacked and reflashed for a MitM attack back in 2011 - yet another Vodafone (Greece) Access Gateway UAP2105. already open. should work, but else perfect donor board. - SFR Home 3G G3, FEM-SER-r0. flash is desoldered and in package. Here the list of 4G femtocells: - Samsung Verizon 4G LTE Network Extender, model SLS-BU103 - 3x T-Mobile (USA) Personal 4G LTE CellSpot, 9961 Home Cell V1. one is open and has plenty of test points soldered. just let me know if you are interested.

1 0

NanoBTS unable to connect to BSC
by Matthew H 16 Nov '22

16 Nov '22

Hi all, I have an ip.access NanoBTS 139U (Part No 139U V 139U V351800). I believe it is operating on the 1800 MHz although admittedly that's a guess from the part number. I've not found a definitive way of confirming the supported band via Telnet or otherwise. I can see the BTS attempting to connect to the BSC, but after the "Set Radio Carrier Attributes" request from the BSC, the BTS sends a NACK and the OML link is dropped. <0004> abis_nm.c:984 OC=RADIO-CARRIER(02) INST=(00,00,ff): SET RADIO ATTRIBUTE NACK CAUSE=Message cannot be performed <0004> osmo_bsc_main.c:226 Got SET RADIO ATTRIBUTE NACK going to drop the OML links. I've grabbed some debug info, note that in the PCAP the packets are wrapped in TZSP as I used a Mikrotik to stream them to Wireshark. Log from BSC - https://s3.eu-west-2.amazonaws.com/cdn.marrold.co.uk/files/osmocom/osmobsc_… PCAP - https://s3.eu-west-2.amazonaws.com/cdn.marrold.co.uk/files/osmocom/NanoBTS.… It's worth noting that ipaccess-config tool also has an issue parsing the frequency which may well be related: ipaccess-config -G 10.0.130.101 ipaccess-config (C) 2009-2010 by Harald Welte and others This is FREE SOFTWARE with ABSOLUTELY NO WARRANTY Trying to connect to ip.access BTS 10.0.130.101... OML link established using TRX 0 getting Attributes (3): 88 91 86 rc"" 0 <0004> abis_nm.c:652 OC=BASEBAND-TRANSCEIVER(04) INST=(00,00,ff): Get Attributes Response: Primary OML IP is 10.0.130.111:0 <0004> abis_nm.c:658 OC=BASEBAND-TRANSCEIVER(04) INST=(00,00,ff): Get Attributes Response: Unit ID is 1800/0/0 <0004> bts.c:497 (bts=0) Unsupported frequency band. <0007> abis_nm.c:725 (bts=0) BTS config invalid, dropping BTS! <0007> bts_ipaccess_nanobts.c:624 (bts=0) Deferring Drop of OML link. <0007> input/ipaccess.c:431 Bad signalling message, sign_link returned error: Invalid argument. <0007> bts_ipaccess_nanobts.c:557 (bts=0) Dropping OML link: Deferred link drop Thanks in advance Matthew / marrold

2 3

Running Osmocom GSM stack in Docker
by Matthew H 14 Nov '22

14 Nov '22

Hello, In the next couple of days I plan on getting started on configuring a simple Osmocom based GSM stack with all the key components, to use with a single 1800 MHz Nano BTS. Before I get too stuck in, I wanted to check if running in Docker (Straight Docker, no kubernetes etc) was feasible, and if the various packages behave when NAT etc is involved? Thanks Matthew / marrold

3 4

OsmoDevCall on Nov 16, 2022: MS/BS power control in OsmoBSC/OsmoBTS
by Harald Welte 14 Nov '22

14 Nov '22

Dear Osmocom community, we're happy to announce the next incarnation of OsmoDevCall]]. when: November 16, 2022 at 20:00 CET where: https://meeting5.franken.de/b/har-xbc-bsx-wvs This time, @fixeria will be presenting on MS/BS power control support in OsmoBSC/OsmoBTS For those not entirely 3gpp-acronym-savyy: That's how the uplink (phone -> network) and downlink (network -> phone) transmit RF power level is adjusted during an active call in GSM. This meeting will have the following schedule: 20:00 meet + greet 20:10 presentation as outlined above 21:00 unstructured supplementary social event [*] Attendance is free of charge and open to anyone with an interest in Osmocom or open source cellular technologies. More information about OsmoDevCall, including the schedule for further upcoming events can be found at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCall Looking forward to meeting you soon! Best regards, Harald [*] this is how we started to call the "unstructured" part of osmocom developer conferences in the past, basically where anyone can talk about anything, no formal schedule or structure. -- - Harald Welte <laforge(a)osmocom.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Two presentation proposals for OsmoDevCall
by Mychaela Falconia 09 Nov '22

09 Nov '22

Hello Osmocom community, Vadim (fixeria) invited me to give a presentation on some of my topics of expertise on OsmoDevCall; I have given some thought to which topics I could present on, and I have two proposals: Presentation 1: Themyscira Wireless: GSM network in sunny California. In this presentation I will describe the community GSM network I am building in my corner of the world, using Osmocom CNI software and whatever BTS hardware fits the bill, currently just one sysmoBTS. Whereas most well-known community GSM networks such as Rhizomatica have been built in areas with no commercial cellular coverage of any kind, my use case is very different: I live in an area where every square mm is blasted with super-strong 4G and 5G signals from 3 major carriers, but a community GSM network is needed in order to provide service specifically to *vintage* mobile phones, which require 2G. I will cover this unusual telos and the different design choices that stem from it, I will cover my own software that interfaces to OsmoMSC via MNCC, and I will cover my interface to USA PSTN via SIP with G.711 voice, including my own implementation of transcoding MGW. Presentation 2: Calypso chipset history and development boards, from TI to FreeCalypso. In this presentation I will cover the history of TI Calypso chipset itself (silicon and DSP revisions, ABB and RF chips), the history of TI's original support for these chips (reference fw and development boards), how various commercial Calypso device vendors changed things (very small changes in the case of Openmoko, huge changes in the case of Compal), how I entered the scene with my FreeCalypso brand, and the impact of two most recently discovered modem modules: Huawei GTM900 and iWOW TR-800. I will cover my motivations and upcoming new hardware plans, and at the end I would like to engage in a discussion on how to make FreeCalypso-suitable hw (meaning hw suitable for running full FC solution) more readily and less expensively available to interested players. I have added both of the above talk proposals to the wiki page: https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCall but of course nothing is scheduled yet. Given that the schedule is booked many months in advance these days, it is now up to the community to decide what y'all are interested in, and if there is interest in both topics, which should be scheduled first. Sincerely, Lady Mychaela N. Falconia, Mother of FreeCalypso, Dame of the Order of 2G, Champion of Published Source Code

1 0

Osmo-BTS tx-attenuation
by Justin Mark Repollo 25 Oct '22

25 Oct '22

Hi Osmocom Community, May I ask your help on this. We have a test setup with UmTrx 2.3.2 SDR. We are trying to set the tx-attenuation and measure the power output but it seems it doesn't reflect based on the defined configurations. We tried to set 0, 5, 10 as values and below are the results. [image: 0-02-03-588e9973ceef2e018e29c0b2eb576f5b7d26972bbb779b44f79c97408d360299_1c6daee34bf8ee.jpg] [image: 0-02-06-99d6d7ce8551b10be62ea130c638b19c5475b5b4140bf2843b92a5b55d36c67c_1c6daee34bfeec.jpg] Please see attached files for osmo configurations and logs. Thanks! Regards, Justin

2 7

Osmocom binary package repository URLs have changed
by Oliver Smith 25 Oct '22

25 Oct '22

Hello various Osmocom mailing lists, as previously announced (https://osmocom.org/news/191) * The binary packages are being built on Osmocom's own OBS server now. * We will stop pushing packages to the openSUSE OBS server at the end of October (in one week). If you are using Osmocom binary packages, please make sure that you have configured the new repository URLs. See the wiki for details: https://osmocom.org/projects/cellular-infrastructure/wiki/Binary_Packages Best, Oliver -- - Oliver Smith <osmith(a)sysmocom.de> https://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Director: Harald Welte

1 0