Osmo-Operator v0.1-7

osmo-operator-desktop.iso

the pmOS phone password is 147147, the live ISO is osmo

Download

Google Drive link

Four Part Github desktop ISO :
Github link Desktop Part 00
Github link Desktop Part 01
Github link Desktop Part 02
Github link Desktop Part 03
Github link Sha256

Important

Download every .part-NN file, not just the first one. GitHub caps release
files at 2 GiB, so the image ships in pieces.

cat osmo-operator-desktop.iso.part-* > osmo-operator-desktop.iso
sha256sum -c --ignore-missing SHA256SUMS

What's inside

2G/GSM — Osmocom

• Full core: osmo-stp (M3UA, SCTP :2905), osmo-bsc, osmo-msc, osmo-hlr, osmo-sgsn, osmo-ggsn (GTPv1-C/U), osmo-pcu, osmo-mgw (MGCP :2427).
• Two DCS1800 cells in LAC 1 — BTS 0 (Cell ID 6001, BSIC 7) and BTS 1 (Cell ID 6012, BSIC 8) — each on its own osmo-bts-trx.
• Layer 1: a real emulated Calypso. qemu-system-arm -M calypso -cpu arm946 (qosmo) runs layer1.highram.elf, loaded by osmocon exactly as on a C123. pont.py converts the bursts to I/Q for fake_trx.py, then trxcon and two mobile (osmocom-bb) instances on the terminal side. Two demodulators to choose from at launch: gr-gsm (the default) or the Calypso's own DSP (see below).
• Working GPRS/EDGE: BSSGP/NS to the PCU, PDP contexts through osmo-ggsn.
• Voice: external MNCC → Asterisk (SIP :5060, FR/HR codecs) via osmo-sip-connector.
• SMS: SMS-over-GSUP → proto-smsc-daemon, SMPP (:2775) with a test ESME, inter-operator relay (:7890).
• A3A8 authentication with deterministic RAND (*-force-rand-toy patches): the bench is reproducible from one boot to the next.
• Live GSMTAP capture, ready to open directly in Wireshark.

The DSP — the Calypso's TMS320C54x, running TI's real mask ROM

• By default the handset's layer 1 is demodulated by gr-gsm (grgsm_exe). With ./start-direct.sh --dsp, it is done instead by the baseband's own DSP: a TMS320C54x core emulated outside QEMU (c54x_exe), executing the mask ROM dumped from a real Calypso (PROM0-3, DROM, PDROM, /opt/GSM/calypso_dsp.*.bin).
• The ARM (QEMU) and the DSP share the API RAM through /dev/shm/calypso_api_ram and run in lockstep, one TDMA frame at a time, over /tmp/calypso_dsp.sock; downlink bursts from osmo-bts-trx reach the DSP's serial port (BSP) over UDP 6702 via pont_dsp.py. The rest of the stack (core, BTS, second mobile) is unchanged.
• What the ROM does by itself (bench runs of 2026-09-23): FCCH/SCH acquisition, BCCH decoding (SI1-4), camping, location update, SMS MO and MT, MO and MT calls with A5/1 and speech audible both ways (TCH/F channel decoding by the ROM, FR codec on the host).
• Still a work bench, not the demo path: every TCH/F frame is flagged bad (BFI) by the ROM even though the speech stays intelligible, the SACCH occasionally drops a call (LOS), the SB window is rarely armed by the ROM, and the DSP needs 4.3–4.6 ms of host time for a 4.62 ms frame. Details in the c54x_exe README.

4G/LTE — open5gs + srsRAN

• open5gs core (MME, SGW-C/U, SMF, UPF, PCRF, HSS…) on dedicated loopbacks, Prometheus metrics (:9090), WebUI (:9999), MongoDB behind the HSS.
• PLMN 001/01, TAC 7. NAS security with null ciphering (EIA2/EIA1 + EEA0), on purpose: this is an analysis bench, the NAS reads in clear text in Wireshark.
• srsRAN RAN over ZMQ: srsENB (10 MHz, EARFCN 3350, band 7) and srsUE linked by a socket, no SDR. Milenage test subscriber (IMSI 001010001000001). The UE gets an IP in a netns and reaches the Internet through NAT.

CSFB — the piece that ties the two together

• SGs interface between osmo-msc and the MME (:29118), with the TAI (001-01, TAC 7) → LAI (001-01, LAC 1) mapping: the VLR files the subscriber under LAC 1 while it is physically on LTE.
• Combined EPS+IMSI attach, radio presence on the GSM side: an incoming call is paged by the MME and the UE drops back to the BTS.
• Two provisioned subscribers (100101 and 100102, one per cell): the bench is wired for an inter-cell call with fallback.

postmarketOS — the phone

• An x86_64 pmOS VM with a patched kernel: upstream linux-postmarketos-stable doesn't enable CONFIG_PPP, without which an AT modem can't carry IP. The prebuilt kernel (Git LFS) is provided in /opt/user_interface/kernel/pmos/.
• 4G data: NetworkManager → pppd (ATD*99***1#) → virtio-console osmo.data → osmo-phonesim-banc.py → UE netns → srsUE → srsENB → UPF → Internet.
• 2G voice and SMS: a second virtio-console osmo.modem, where osmo-phonesim-banc.py plays the 27.007 AT modem (state read from the osmo-bsc, osmo-msc and mobile VTYs) and oFono drives it. No dongle.
• Audio: two duplex PulseAudio chains (intel-hda) — a bridge to the osmocom-bb mobile via GAPK, and a chain with echo cancellation.
• Result: data on 4G, voice and SMS on 2G, under the same identity. The behaviour of a real CSFB handset, at the modem level.
• pmOS password: 147147

Running the image

In every case: x86_64, 8 GB of RAM and 4 cores minimum. The live root is a tmpfs (~6 GB in toram mode); logs and captures are bounded there, and purged at every boot. The bench itself runs two QEMUs (the Calypso and the postmarketOS VM): in a virtual machine, enable nested virtualization, otherwise the pmOS VM falls back to software emulation and becomes very slow.

QEMU

qemu-system-x86_64 -cdrom osmo-operator-desktop.iso -m 8G -enable-kvm \
  -cpu host -smp 4 -nic user,hostfwd=tcp::8080-:8080

VirtualBox

• New VM, type Linux / Ubuntu (64-bit), 8 GB of RAM, 4 processors, 3D disabled.
• System → Processor: tick Nested VT-x/AMD-V (if the box is greyed out: VBoxManage modifyvm "<name>" --nested-hw-virt on).
• Storage: attach the ISO to the optical drive. No disk needed, it's a live image.
• NAT network: add a port forwarding rule host 8080 → guest 8080 to reach the bench from the host machine.

VMware (Workstation / Player / Fusion)

• New VM from the ISO, Linux / Ubuntu 64-bit, 8 GB, 4 cores.
• Processors: tick Virtualize Intel VT-x/EPT or AMD-V/RVI.
• Skip Easy Install: it's a live image, it boots from the ISO.

USB stick (the ISO is hybrid, it can be copied raw)

sudo dd if=osmo-operator-desktop.iso of=/dev/sdX bs=4M status=progress conv=fsync

On Windows, Rufus: select the ISO and, if Rufus offers the choice, write in DD Image mode rather than ISO. Then boot from the stick, in UEFI or BIOS, either works. On real hardware, KVM is available directly: this is the most comfortable setup.

Getting started

Everything launches from the dock, where three launchers are pinned as favourites. 2G and 4G are independent and can be started in any order; the smartphone is launched last, once both networks are up.

	Launcher	What it starts
	2G — the red handset	The GSM core and the emulated radio: osmo-stp / bsc / msc / hlr / sgsn / ggsn / pcu, the Calypso under QEMU, the two BTS and the two osmocom-bb mobiles, Asterisk, the SMSC.
	4G — the signal bars	open5gs, srsENB and srsUE over ZMQ, and the SGs interface to the MSC (the CSFB).
📱	Smartphone — the Adwaita theme's phone icon	The postmarketOS VM: oFono on the virtual modem, data on 4G, voice and SMS on 2G. Launch it last.

The 2G and 4G icons are SVGs from the repo (data/), hand-drawn rather than taken from the theme: call-start is green in Adwaita with no red variant, and a missing theme icon is silently replaced by a grey rectangle. An embedded SVG can't go missing.

To ...

Osmo-Operator v0.1-6

osmo-operator-desktop.iso

A complete GSM + LTE operator on a single live image, with a GNOME desktop for everything that can't be driven from the VTY. No SDR and no physical phone: the radio is emulated end to end, all the way down to the baseband.

IMAGE_VERSION="OSMO_EGPRS_V2" · OSMO_ROLE=operator · OSMO_LITE=0

Passwords: live ISO osmo · postmarketOS phone 147147

Download

Download every .part-NN file, not just the first one. GitHub caps release files at 2 GiB, so the image ships in pieces. Reassemble, then verify:

wget https://github.com/bbaranoff/osmo-operator/releases/download/v0.1-6/osmo-operator-desktop.iso.part-00
wget https://github.com/bbaranoff/osmo-operator/releases/download/v0.1-6/osmo-operator-desktop.iso.part-01
wget https://github.com/bbaranoff/osmo-operator/releases/download/v0.1-6/osmo-operator-desktop.iso.part-02
wget https://github.com/bbaranoff/osmo-operator/releases/download/v0.1-6/osmo-operator-desktop.iso.part-03
cat osmo-operator-desktop.iso.part-* > osmo-operator-desktop.iso
sha256sum -c SHA256SUMS

What's inside

2G / GSM — Osmocom

• Full core: osmo-stp (M3UA, SCTP :2905), osmo-bsc, osmo-msc, osmo-hlr, osmo-sgsn, osmo-ggsn (GTPv1-C/U), osmo-pcu, osmo-mgw (MGCP :2427).
• Two DCS1800 cells in LAC 1: BTS 0 (Cell ID 6001, BSIC 7) and BTS 1 (Cell ID 6012, BSIC 8), each on its own osmo-bts-trx.
• A real emulated Calypso as layer 1: qemu-system-arm -M calypso -cpu arm946 (qosmo) runs layer1.highram.elf, loaded by osmocon exactly as on a C123. pont.py turns bursts into I/Q for fake_trx.py, then trxcon and two osmocom-bb mobile instances on the terminal side.
• GPRS/EDGE: BSSGP/NS to the PCU, PDP contexts through osmo-ggsn.
• Voice: external MNCC → Asterisk (SIP :5060, FR/HR) via osmo-sip-connector.
• SMS: SMS-over-GSUP → proto-smsc-daemon, SMPP :2775 with a test ESME, inter-operator relay :7890.
• A3A8 with deterministic RAND (*-force-rand-toy patches): the bench is reproducible from one boot to the next.
• Live GSMTAP capture, ready for Wireshark.

The DSP — the Calypso's TMS320C54x on TI's real mask ROM

• Default demodulator: gr-gsm (grgsm_exe). With ./start-direct.sh --dsp, the baseband's own DSP takes over: a C54x core emulated outside QEMU (c54x_exe), running the mask ROM dumped from a real Calypso (PROM0-3, DROM, PDROM).
• ARM (QEMU) and DSP share the API RAM through /dev/shm/calypso_api_ram and run in lockstep, one TDMA frame at a time, over /tmp/calypso_dsp.sock. Downlink bursts reach the DSP's serial port (BSP) over UDP 6702 via pont_dsp.py.
• What the ROM does by itself (bench runs of 2026-09-23): FCCH/SCH acquisition, BCCH decoding (SI1-4), camping, location update, SMS MO/MT, MO/MT calls with A5/1 and speech audible both ways.
• Still a work bench, not the demo path: every TCH/F frame is flagged BFI even though speech stays intelligible, SACCH occasionally drops a call, the SB window is rarely armed, and the DSP needs 4.3–4.6 ms of host time per 4.62 ms frame. Details in the c54x_exe README.

4G / LTE — open5gs + srsRAN

• open5gs core (MME, SGW-C/U, SMF, UPF, PCRF, HSS…) on dedicated loopbacks, Prometheus :9090, WebUI :9999, MongoDB behind the HSS.
• PLMN 001/01, TAC 7. NAS null ciphering (EIA2/EIA1 + EEA0) on purpose: it's an analysis bench, NAS reads in clear in Wireshark.
• srsENB (10 MHz, EARFCN 3350, band 7) and srsUE over ZMQ, no SDR. Milenage test subscriber IMSI 001010001000001; the UE gets an IP in a netns and reaches the Internet through NAT.

CSFB — tying 2G and 4G together

• SGs between osmo-msc and the MME (:29118), mapping TAI (001-01, TAC 7) → LAI (001-01, LAC 1).
• Combined EPS+IMSI attach: an incoming call is paged by the MME and the UE falls back to the BTS.
• Two subscribers (100101, 100102), one per cell, wired for an inter-cell call with fallback.

postmarketOS — the phone

• x86_64 pmOS VM with a patched kernel (CONFIG_PPP enabled, missing upstream); prebuilt kernel in /opt/user_interface/kernel/pmos/.
• 4G data: NetworkManager → pppd (ATD*99***1#) → virtio-console osmo.data → osmo-phonesim-banc.py → UE netns → srsUE → srsENB → UPF → Internet.
• 2G voice and SMS: virtio-console osmo.modem, where osmo-phonesim-banc.py plays a 27.007 AT modem driven by oFono. No dongle.
• Audio: two duplex PulseAudio chains (GAPK bridge to the osmocom-bb mobile, and an echo-cancelled chain).
• Result: data on 4G, voice and SMS on 2G, same identity — a real CSFB handset's behaviour at modem level.

Requirements

x86_64, 8 GB RAM and 4 cores minimum. The live root is a tmpfs (~6 GB in toram mode); logs and captures are bounded and purged at every boot. The bench runs two QEMUs (Calypso + pmOS): in a VM, enable nested virtualization or the phone VM falls back to software emulation.

Running the image

QEMU

qemu-system-x86_64 -cdrom osmo-operator-desktop.iso -m 8G -enable-kvm \
  -cpu host -smp 4 -nic user,hostfwd=tcp::8080-:8080

VirtualBox — Linux / Ubuntu 64-bit, 8 GB, 4 CPUs, 3D off. System → Processor: tick Nested VT-x/AMD-V (if greyed out: VBoxManage modifyvm "<name>" --nested-hw-virt on). ISO on the optical drive, no disk needed. NAT port forward host 8080 → guest 8080.

VMware — new VM from the ISO, Linux / Ubuntu 64-bit, 8 GB, 4 cores, tick Virtualize Intel VT-x/EPT or AMD-V/RVI, skip Easy Install.

USB stick (hybrid ISO)

sudo dd if=osmo-operator-desktop.iso of=/dev/sdX bs=4M status=progress conv=fsync

On Windows, use Rufus in DD Image mode. Boots UEFI or BIOS. On real hardware KVM is available directly — the most comfortable setup.

Getting started

Three launchers are pinned in the dock. 2G and 4G are independent and can start in any order; launch the smartphone last, once both networks are up.

	Launcher	What it starts
	2G — the red handset	The GSM core and the emulated radio: osmo-stp / bsc / msc / hlr / sgsn / ggsn / pcu, the Calypso under QEMU, the two BTS and the two osmocom-bb mobiles, Asterisk, the SMSC.
	4G — the signal bars	open5gs, srsENB and srsUE over ZMQ, and the SGs interface to the MSC (the CSFB).
📱	Smartphone — the Adwaita theme's phone icon	The postmarketOS VM: oFono on the virtual modem, data on 4G, voice and SMS on 2G. Launch it last.

Run the 2G handset on the DSP :

cd /opt/GSM/osmo-operator && sudo ./start-direct.sh --dsp

(--menu asks interactively: layer 1 grgsm_exe or c54x_exe.)

Check everything is in place: checks/diag-stp-operator.sh

Osmo-Operator v0.1-4

osmo-operator-desktop.iso

the pmOS phone password is 147147, the live ISO is osmo

Download

Download every .part-NN file, not just the first one.

GitHub caps release files at 2 GiB: the image ships in pieces. Reassemble, then verify:

cat osmo-operator-desktop.iso.part-* > osmo-operator-desktop.iso
sha256sum -c SHA256SUMS

A complete GSM + LTE operator on a single live image, with a GNOME desktop (Wireshark in a window, linphone-desktop, GSM LAB wallpaper) for everything that can't be driven from the VTY. No SDR and no physical phone: the radio is emulated end to end, all the way down to the baseband.

/etc/os-release: IMAGE_VERSION="OSMO_EGPRS_V2" — /etc/osmo-role: OSMO_ROLE=operator, OSMO_LITE=0.

What's inside

2G/GSM — Osmocom

• Full core: osmo-stp (M3UA, SCTP :2905), osmo-bsc, osmo-msc, osmo-hlr, osmo-sgsn, osmo-ggsn (GTPv1-C/U), osmo-pcu, osmo-mgw (MGCP :2427).
• Two DCS1800 cells in LAC 1 — BTS 0 (Cell ID 6001, BSIC 7) and BTS 1 (Cell ID 6012, BSIC 8) — each on its own osmo-bts-trx.
• Layer 1: a real emulated Calypso. qemu-system-arm -M calypso -cpu arm946 (qosmo) runs layer1.highram.elf, loaded by osmocon exactly as on a C123. pont.py converts the bursts to I/Q for fake_trx.py, then trxcon and two mobile (osmocom-bb) instances on the terminal side. Two demodulators to choose from at launch: gr-gsm (the default) or the Calypso's own DSP (see below).
• Working GPRS/EDGE: BSSGP/NS to the PCU, PDP contexts through osmo-ggsn.
• Voice: external MNCC → Asterisk (SIP :5060, FR/HR codecs) via osmo-sip-connector.
• SMS: SMS-over-GSUP → proto-smsc-daemon, SMPP (:2775) with a test ESME, inter-operator relay (:7890).
• A3A8 authentication with deterministic RAND (*-force-rand-toy patches): the bench is reproducible from one boot to the next.
• Live GSMTAP capture, ready to open directly in Wireshark.

The DSP — the Calypso's TMS320C54x, running TI's real mask ROM

• By default the handset's layer 1 is demodulated by gr-gsm (grgsm_exe). With ./start-direct.sh --dsp, it is done instead by the baseband's own DSP: a TMS320C54x core emulated outside QEMU (c54x_exe), executing the mask ROM dumped from a real Calypso (PROM0-3, DROM, PDROM, /opt/GSM/calypso_dsp.*.bin).
• The ARM (QEMU) and the DSP share the API RAM through /dev/shm/calypso_api_ram and run in lockstep, one TDMA frame at a time, over /tmp/calypso_dsp.sock; downlink bursts from osmo-bts-trx reach the DSP's serial port (BSP) over UDP 6702 via pont_dsp.py. The rest of the stack (core, BTS, second mobile) is unchanged.
• What the ROM does by itself (bench runs of 2026-09-23): FCCH/SCH acquisition, BCCH decoding (SI1-4), camping, location update, SMS MO and MT, MO and MT calls with A5/1 and speech audible both ways (TCH/F channel decoding by the ROM, FR codec on the host).
• Still a work bench, not the demo path: every TCH/F frame is flagged bad (BFI) by the ROM even though the speech stays intelligible, the SACCH occasionally drops a call (LOS), the SB window is rarely armed by the ROM, and the DSP needs 4.3–4.6 ms of host time for a 4.62 ms frame. Details in the c54x_exe README.

4G/LTE — open5gs + srsRAN

• open5gs core (MME, SGW-C/U, SMF, UPF, PCRF, HSS…) on dedicated loopbacks, Prometheus metrics (:9090), WebUI (:9999), MongoDB behind the HSS.
• PLMN 001/01, TAC 7. NAS security with null ciphering (EIA2/EIA1 + EEA0), on purpose: this is an analysis bench, the NAS reads in clear text in Wireshark.
• srsRAN RAN over ZMQ: srsENB (10 MHz, EARFCN 3350, band 7) and srsUE linked by a socket, no SDR. Milenage test subscriber (IMSI 001010001000001). The UE gets an IP in a netns and reaches the Internet through NAT.

CSFB — the piece that ties the two together

• SGs interface between osmo-msc and the MME (:29118), with the TAI (001-01, TAC 7) → LAI (001-01, LAC 1) mapping: the VLR files the subscriber under LAC 1 while it is physically on LTE.
• Combined EPS+IMSI attach, radio presence on the GSM side: an incoming call is paged by the MME and the UE drops back to the BTS.
• Two provisioned subscribers (100101 and 100102, one per cell): the bench is wired for an inter-cell call with fallback.

postmarketOS — the phone

• An x86_64 pmOS VM with a patched kernel: upstream linux-postmarketos-stable doesn't enable CONFIG_PPP, without which an AT modem can't carry IP. The prebuilt kernel (Git LFS) is provided in /opt/user_interface/kernel/pmos/.
• 4G data: NetworkManager → pppd (ATD*99***1#) → virtio-console osmo.data → osmo-phonesim-banc.py → UE netns → srsUE → srsENB → UPF → Internet.
• 2G voice and SMS: a second virtio-console osmo.modem, where osmo-phonesim-banc.py plays the 27.007 AT modem (state read from the osmo-bsc, osmo-msc and mobile VTYs) and oFono drives it. No dongle.
• Audio: two duplex PulseAudio chains (intel-hda) — a bridge to the osmocom-bb mobile via GAPK, and a chain with echo cancellation.
• Result: data on 4G, voice and SMS on 2G, under the same identity. The behaviour of a real CSFB handset, at the modem level.
• pmOS password: 147147

Running the image

In every case: x86_64, 8 GB of RAM and 4 cores minimum. The live root is a tmpfs (~6 GB in toram mode); logs and captures are bounded there, and purged at every boot. The bench itself runs two QEMUs (the Calypso and the postmarketOS VM): in a virtual machine, enable nested virtualization, otherwise the pmOS VM falls back to software emulation and becomes very slow.

QEMU

qemu-system-x86_64 -cdrom osmo-operator-desktop.iso -m 8G -enable-kvm \
  -cpu host -smp 4 -nic user,hostfwd=tcp::8080-:8080

VirtualBox

• New VM, type Linux / Ubuntu (64-bit), 8 GB of RAM, 4 processors, 3D disabled.
• System → Processor: tick Nested VT-x/AMD-V (if the box is greyed out: VBoxManage modifyvm "<name>" --nested-hw-virt on).
• Storage: attach the ISO to the optical drive. No disk needed, it's a live image.
• NAT network: add a port forwarding rule host 8080 → guest 8080 to reach the bench from the host machine.

VMware (Workstation / Player / Fusion)

• New VM from the ISO, Linux / Ubuntu 64-bit, 8 GB, 4 cores.
• Processors: tick Virtualize Intel VT-x/EPT or AMD-V/RVI.
• Skip Easy Install: it's a live image, it boots from the ISO.

USB stick (the ISO is hybrid, it can be copied raw)

sudo dd if=osmo-operator-desktop.iso of=/dev/sdX bs=4M status=progress conv=fsync

On Windows, Rufus: select the ISO and, if Rufus offers the choice, write in DD Image mode rather than ISO. Then boot from the stick, in UEFI or BIOS, either works. On real hardware, KVM is available directly: this is the most comfortable setup.

Getting started

Everything launches from the dock, where three launchers are pinned as favourites. 2G and 4G are independent and can be started in any order; the smartphone is launched last, once both networks are up.

	Launcher	What it starts
	2G — the red handset	The GSM core and the emulated radio: osmo-stp / bsc / msc / hlr / sgsn / ggsn / pcu, the Calypso under QEMU, the two BTS and the two osmocom-bb mobiles, Asterisk, the SMSC.
	4G — the signal bars	open5gs, srsENB and srsUE over ZMQ, and the SGs interface to the MSC (the CSFB).
📱	Smartphone — the Adwaita theme's phone icon	The postmarketOS VM: oFono on the virtual modem, data on 4G, voice and SMS on 2G. Launch it last.

The 2G and 4G icons are SVGs from the repo (data/), hand-drawn rather than taken from the theme: call-start is green in Adwaita with no red variant, and a missing theme icon is silently replaced by a grey rectangle. An embedded SVG can't go missing.

To run the 2G handset on the DSP instead of gr-gsm, from a terminal: cd /opt/GSM/osmo-operator && sudo ./start-direct.sh --dsp (the --menu option asks the same question interactively: layer 1 grgsm_exe or c54x_exe).

Check that everything is in place: checks...

Osmo-Operator v0.1-3

osmo-operator-desktop.iso

the pmOS phone password is 147147, the live ISO is osmo

Download

DOWNLOAD ALL FOUR IMAGES!!!

GitHub caps release files at 2 GiB: the image ships in pieces. Reassemble, then verify:

cat osmo-operator-desktop.iso.part-* > osmo-operator-desktop.iso
sha256sum -c SHA256SUMS

)

A complete GSM + LTE operator on a single live image, with a GNOME desktop (Wireshark in a window, linphone-desktop, GSM LAB wallpaper) for everything that can't be driven from the VTY. No SDR and no physical phone: the radio is emulated end to end, all the way down to the baseband.

/etc/os-release: IMAGE_VERSION="OSMO_EGPRS_V2" — /etc/osmo-role: OSMO_ROLE=operator, OSMO_LITE=0.

What's inside

2G/GSM — Osmocom

• Full core: osmo-stp (M3UA, SCTP :2905), osmo-bsc, osmo-msc, osmo-hlr, osmo-sgsn, osmo-ggsn (GTPv1-C/U), osmo-pcu, osmo-mgw (MGCP :2427).
• Two DCS1800 cells in LAC 1 — BTS 0 (Cell ID 6001, BSIC 7) and BTS 1 (Cell ID 6012, BSIC 8) — each on its own osmo-bts-trx.
• Layer 1: a real emulated Calypso. qemu-system-arm -M calypso -cpu arm946 runs layer1.highram.elf, loaded by osmocon exactly as on a C123. pont.py converts the bursts to I/Q for fake_trx.py, then trxcon and two mobile (osmocom-bb) instances on the terminal side.
• Working GPRS/EDGE: BSSGP/NS to the PCU, PDP contexts through osmo-ggsn.
• Voice: external MNCC → Asterisk (SIP :5060, FR/HR codecs) via osmo-sip-connector.
• SMS: SMS-over-GSUP → proto-smsc-daemon, SMPP (:2775) with a test ESME, inter-operator relay (:7890).
• A3A8 authentication with deterministic RAND (*-force-rand-toy patches): the bench is reproducible from one boot to the next.
• Live GSMTAP capture, ready to open directly in Wireshark.

4G/LTE — open5gs + srsRAN

• open5gs core (MME, SGW-C/U, SMF, UPF, PCRF, HSS…) on dedicated loopbacks, Prometheus metrics (:9090), WebUI (:9999), MongoDB behind the HSS.
• PLMN 001/01, TAC 7. NAS security with null ciphering (EIA2/EIA1 + EEA0), on purpose: this is an analysis bench, the NAS reads in clear text in Wireshark.
• srsRAN RAN over ZMQ: srsENB (10 MHz, EARFCN 3350, band 7) and srsUE linked by a socket, no SDR. Milenage test subscriber (IMSI 001010001000001). The UE gets an IP in a netns and reaches the Internet through NAT.

CSFB — the piece that ties the two together

• SGs interface between osmo-msc and the MME (:29118), with the TAI (001-01, TAC 7) → LAI (001-01, LAC 1) mapping: the VLR files the subscriber under LAC 1 while it is physically on LTE.
• Combined EPS+IMSI attach, radio presence on the GSM side: an incoming call is paged by the MME and the UE drops back to the BTS.
• Two provisioned subscribers (100101 and 100102, one per cell): the bench is wired for an inter-cell call with fallback.

postmarketOS — the phone

• An x86_64 pmOS VM with a patched kernel: upstream linux-postmarketos-stable doesn't enable CONFIG_PPP, without which an AT modem can't carry IP. The prebuilt kernel (Git LFS) is provided in /opt/user_interface/kernel/pmos/.
• 4G data: NetworkManager → pppd (ATD*99***1#) → virtio-console osmo.data → osmo-phonesim-banc.py → UE netns → srsUE → srsENB → UPF → Internet.
• 2G voice and SMS: a second virtio-console osmo.modem, where osmo-phonesim-banc.py plays the 27.007 AT modem (state read from the osmo-bsc, osmo-msc and mobile VTYs) and oFono drives it. No dongle.
• Audio: two duplex PulseAudio chains (intel-hda) — a bridge to the osmocom-bb mobile via GAPK, and a chain with echo cancellation.
• Result: data on 4G, voice and SMS on 2G, under the same identity. The behaviour of a real CSFB handset, at the modem level.
• pmOS password: 147147

Running the image

In every case: x86_64, 8 GB of RAM and 4 cores minimum. The live root is a tmpfs (~6 GB in toram mode); logs and captures are bounded there, and purged at every boot. The bench itself runs two QEMUs (the Calypso and the postmarketOS VM): in a virtual machine, enable nested virtualization, otherwise the pmOS VM falls back to software emulation and becomes very slow.

QEMU

qemu-system-x86_64 -cdrom osmo-operator-desktop.iso -m 8G -enable-kvm \
  -cpu host -smp 4 -nic user,hostfwd=tcp::8080-:8080

VirtualBox

• New VM, type Linux / Ubuntu (64-bit), 8 GB of RAM, 4 processors, 3D disabled.
• System → Processor: tick Nested VT-x/AMD-V (if the box is greyed out: VBoxManage modifyvm "<name>" --nested-hw-virt on).
• Storage: attach the ISO to the optical drive. No disk needed, it's a live image.
• NAT network: add a port forwarding rule host 8080 → guest 8080 to reach the bench from the host machine.

VMware (Workstation / Player / Fusion)

• New VM from the ISO, Linux / Ubuntu 64-bit, 8 GB, 4 cores.
• Processors: tick Virtualize Intel VT-x/EPT or AMD-V/RVI.
• Skip Easy Install: it's a live image, it boots from the ISO.

USB stick (the ISO is hybrid, it can be copied raw)

sudo dd if=osmo-operator-desktop.iso of=/dev/sdX bs=4M status=progress conv=fsync

On Windows, Rufus: select the ISO and, if Rufus offers the choice, write in DD Image mode rather than ISO. Then boot from the stick, in UEFI or BIOS, either works. On real hardware, KVM is available directly: this is the most comfortable setup.

Getting started

Everything launches from the dock, where three launchers are pinned as favourites. 2G and 4G are independent and can be started in any order; the smartphone is launched last, once both networks are up.

	Launcher	What it starts
	2G — the red handset	The GSM core and the emulated radio: osmo-stp / bsc / msc / hlr / sgsn / ggsn / pcu, the Calypso under QEMU, the two BTS and the two osmocom-bb mobiles, Asterisk, the SMSC.
	4G — the signal bars	open5gs, srsENB and srsUE over ZMQ, and the SGs interface to the MSC (the CSFB).
📱	Smartphone — the Adwaita theme's phone icon	The postmarketOS VM: oFono on the virtual modem, data on 4G, voice and SMS on 2G. Launch it last.

The 2G and 4G icons are SVGs from the repo (data/), hand-drawn rather than taken from the theme: call-start is green in Adwaita with no red variant, and a missing theme icon is silently replaced by a grey rectangle. An embedded SVG can't go missing.

Check that everything is in place: checks/diag-stp-operator.sh.

postmarketOS — VM de reference (noyau PPP)

Image qemu-amd64 du telephone du banc, noyau linux-postmarketos-stable+PPP. Decompressee par osmo-pmos-build, embarquee dans l'ISO par 88-lte-pmos.sh.