Skip to content

Osmo-Operator v0.1-7

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Oct 18:20
· 46 commits to main since this release
v0.1-7
6905b62

Build ISO

osmo-operator-desktop.iso

the pmOS phone password is 147147, the live ISO is osmo

Download

Google Drive link

Four Part Github desktop ISO :
Github link Desktop Part 00
Github link Desktop Part 01
Github link Desktop Part 02
Github link Desktop Part 03
Github link Sha256

Important

Download every .part-NN file, not just the first one. GitHub caps release
files at 2 GiB, so the image ships in pieces.

cat osmo-operator-desktop.iso.part-* > osmo-operator-desktop.iso
sha256sum -c --ignore-missing SHA256SUMS

The bench in action: CSFB call, I/Q spectra, srsUE, Wireshark, Linphone

What's inside

2G/GSM — Osmocom

  • Full core: osmo-stp (M3UA, SCTP :2905), osmo-bsc, osmo-msc, osmo-hlr, osmo-sgsn, osmo-ggsn (GTPv1-C/U), osmo-pcu, osmo-mgw (MGCP :2427).
  • Two DCS1800 cells in LAC 1 — BTS 0 (Cell ID 6001, BSIC 7) and BTS 1 (Cell ID 6012, BSIC 8) — each on its own osmo-bts-trx.
  • Layer 1: a real emulated Calypso. qemu-system-arm -M calypso -cpu arm946 (qosmo) runs layer1.highram.elf, loaded by osmocon exactly as on a C123. pont.py converts the bursts to I/Q for fake_trx.py, then trxcon and two mobile (osmocom-bb) instances on the terminal side. Two demodulators to choose from at launch: gr-gsm (the default) or the Calypso's own DSP (see below).
  • Working GPRS/EDGE: BSSGP/NS to the PCU, PDP contexts through osmo-ggsn.
  • Voice: external MNCC → Asterisk (SIP :5060, FR/HR codecs) via osmo-sip-connector.
  • SMS: SMS-over-GSUP → proto-smsc-daemon, SMPP (:2775) with a test ESME, inter-operator relay (:7890).
  • A3A8 authentication with deterministic RAND (*-force-rand-toy patches): the bench is reproducible from one boot to the next.
  • Live GSMTAP capture, ready to open directly in Wireshark.

The DSP — the Calypso's TMS320C54x, running TI's real mask ROM

  • By default the handset's layer 1 is demodulated by gr-gsm (grgsm_exe). With ./start-direct.sh --dsp, it is done instead by the baseband's own DSP: a TMS320C54x core emulated outside QEMU (c54x_exe), executing the mask ROM dumped from a real Calypso (PROM0-3, DROM, PDROM, /opt/GSM/calypso_dsp.*.bin).
  • The ARM (QEMU) and the DSP share the API RAM through /dev/shm/calypso_api_ram and run in lockstep, one TDMA frame at a time, over /tmp/calypso_dsp.sock; downlink bursts from osmo-bts-trx reach the DSP's serial port (BSP) over UDP 6702 via pont_dsp.py. The rest of the stack (core, BTS, second mobile) is unchanged.
  • What the ROM does by itself (bench runs of 2026-09-23): FCCH/SCH acquisition, BCCH decoding (SI1-4), camping, location update, SMS MO and MT, MO and MT calls with A5/1 and speech audible both ways (TCH/F channel decoding by the ROM, FR codec on the host).
  • Still a work bench, not the demo path: every TCH/F frame is flagged bad (BFI) by the ROM even though the speech stays intelligible, the SACCH occasionally drops a call (LOS), the SB window is rarely armed by the ROM, and the DSP needs 4.3–4.6 ms of host time for a 4.62 ms frame. Details in the c54x_exe README.

4G/LTE — open5gs + srsRAN

  • open5gs core (MME, SGW-C/U, SMF, UPF, PCRF, HSS…) on dedicated loopbacks, Prometheus metrics (:9090), WebUI (:9999), MongoDB behind the HSS.
  • PLMN 001/01, TAC 7. NAS security with null ciphering (EIA2/EIA1 + EEA0), on purpose: this is an analysis bench, the NAS reads in clear text in Wireshark.
  • srsRAN RAN over ZMQ: srsENB (10 MHz, EARFCN 3350, band 7) and srsUE linked by a socket, no SDR. Milenage test subscriber (IMSI 001010001000001). The UE gets an IP in a netns and reaches the Internet through NAT.

CSFB — the piece that ties the two together

  • SGs interface between osmo-msc and the MME (:29118), with the TAI (001-01, TAC 7) → LAI (001-01, LAC 1) mapping: the VLR files the subscriber under LAC 1 while it is physically on LTE.
  • Combined EPS+IMSI attach, radio presence on the GSM side: an incoming call is paged by the MME and the UE drops back to the BTS.
  • Two provisioned subscribers (100101 and 100102, one per cell): the bench is wired for an inter-cell call with fallback.

postmarketOS — the phone

  • An x86_64 pmOS VM with a patched kernel: upstream linux-postmarketos-stable doesn't enable CONFIG_PPP, without which an AT modem can't carry IP. The prebuilt kernel (Git LFS) is provided in /opt/user_interface/kernel/pmos/.
  • 4G data: NetworkManager → pppd (ATD*99***1#) → virtio-console osmo.data → osmo-phonesim-banc.py → UE netns → srsUE → srsENB → UPF → Internet.
  • 2G voice and SMS: a second virtio-console osmo.modem, where osmo-phonesim-banc.py plays the 27.007 AT modem (state read from the osmo-bsc, osmo-msc and mobile VTYs) and oFono drives it. No dongle.
  • Audio: two duplex PulseAudio chains (intel-hda) — a bridge to the osmocom-bb mobile via GAPK, and a chain with echo cancellation.
  • Result: data on 4G, voice and SMS on 2G, under the same identity. The behaviour of a real CSFB handset, at the modem level.
  • pmOS password: 147147

Running the image

In every case: x86_64, 8 GB of RAM and 4 cores minimum. The live root is a tmpfs (~6 GB in toram mode); logs and captures are bounded there, and purged at every boot. The bench itself runs two QEMUs (the Calypso and the postmarketOS VM): in a virtual machine, enable nested virtualization, otherwise the pmOS VM falls back to software emulation and becomes very slow.

QEMU

qemu-system-x86_64 -cdrom osmo-operator-desktop.iso -m 8G -enable-kvm \
  -cpu host -smp 4 -nic user,hostfwd=tcp::8080-:8080

VirtualBox

  • New VM, type Linux / Ubuntu (64-bit), 8 GB of RAM, 4 processors, 3D disabled.
  • System → Processor: tick Nested VT-x/AMD-V (if the box is greyed out: VBoxManage modifyvm "<name>" --nested-hw-virt on).
  • Storage: attach the ISO to the optical drive. No disk needed, it's a live image.
  • NAT network: add a port forwarding rule host 8080 → guest 8080 to reach the bench from the host machine.

VMware (Workstation / Player / Fusion)

  • New VM from the ISO, Linux / Ubuntu 64-bit, 8 GB, 4 cores.
  • Processors: tick Virtualize Intel VT-x/EPT or AMD-V/RVI.
  • Skip Easy Install: it's a live image, it boots from the ISO.

USB stick (the ISO is hybrid, it can be copied raw)

sudo dd if=osmo-operator-desktop.iso of=/dev/sdX bs=4M status=progress conv=fsync

On Windows, Rufus: select the ISO and, if Rufus offers the choice, write in DD Image mode rather than ISO. Then boot from the stick, in UEFI or BIOS, either works. On real hardware, KVM is available directly: this is the most comfortable setup.

Getting started

Everything launches from the dock, where three launchers are pinned as favourites. 2G and 4G are independent and can be started in any order; the smartphone is launched last, once both networks are up.

  Launcher What it starts
2G — the red handset The GSM core and the emulated radio: osmo-stp / bsc / msc / hlr / sgsn / ggsn / pcu, the Calypso under QEMU, the two BTS and the two osmocom-bb mobiles, Asterisk, the SMSC.
4G — the signal bars open5gs, srsENB and srsUE over ZMQ, and the SGs interface to the MSC (the CSFB).
📱 Smartphone — the Adwaita theme's phone icon The postmarketOS VM: oFono on the virtual modem, data on 4G, voice and SMS on 2G. Launch it last.

The 2G and 4G icons are SVGs from the repo (data/), hand-drawn rather than taken from the theme: call-start is green in Adwaita with no red variant, and a missing theme icon is silently replaced by a grey rectangle. An embedded SVG can't go missing.

To run the 2G handset on the DSP instead of gr-gsm, from a terminal: cd /opt/GSM/osmo-operator && sudo ./start-direct.sh --dsp (the --menu option asks the same question interactively: layer 1 grgsm_exe or c54x_exe).

Check that everything is in place: checks/diag-stp-operator.sh.

Assets 17
Loading