Project

General

Profile

Actions

Feature #4882

open

HSPA+ Picocell availiable in U.S

Added by copslock over 3 years ago. Updated 19 days ago.

Status:
New
Priority:
Low
Assignee:
-
Target version:
-
Start date:
12/01/2020
Due date:
% Done:

0%

Spec Reference:

Description

The Ericsson RBS6402 WCDMA Picocell can be obtained from ebay recently at a very good price.It runs on Texas Instrument Keystone SoC,and have a good capacity compared to other femtocells


Multi standard: WCDMA, LTE and Wi-Fi (optional)
● Up to 10 bands in three modules available:2-4 LTE/WCDMA bands per module
● 2 3GPP bands operate simultaneously and 1 Wi-Fi module operates in 2 bands
● LTE 2 Carrier Aggregation up to 300/50 Mbps DL/UL
● LTE 2 Carrier and LAA/LTE-U 5GHz unlicensed band
LTE: Carrier bandwidth 5,10 and 20 MHz
2x2 MIMO
WCDMA: 21/5.76 Mbps DL/UL, HW prepared for Dual Carrier 42 Mbps DL
RNC connected, Full mobility
Wi-Fi 2.4 GHz 802.11 b/g/n, 3x3 MIMO, 23 dBm (EIRP, 18 dBm per chain)
Wi-Fi 5 GHz: 802.11 a/n/ac, 3x3 MIMO, 23 dBm (EIRP, 18 dBm per chain)
RF Power 3GPP: Up to 2x250 mW per module (total 4x250 mW)
Antenna: Integrated omni-directional antennas for LTE/WCDMA and Wi-Fi
Support for external antennas for LTE/WCDMA
Typical coverage: 800 - 2 500 m² depending on building type
Active users: Up to 64 for WCDMA and up to 128 for LTE
TRANSMISSION^
Interfaces: 1 Gbps Electrical Ethernet, Optical as an option
SFP and transmission module options
Features Internet-grade Backhaul support, TWAMP
Security: IPsec for untrusted networks
Signed SW and secure O&M access for untrusted locations
Synchronization: GPS, NTP, IEEE 1588v
MECHANICAL SPECIFICATIONS
HxW xD: 280x167x62mm (excluding connector field)
Volume: 2.8 liters
Weight: 2.5 kg
Mounting: Flexible mounting on walls and ceilings
INTERFACE SPECIFICATIONS^
Power supply: Power over Ethernet line, Power over Ethernet injector or External AC/DC adapter
LED indication: Total 8 LED for 3GPP, Backhaul & Wi-Fi
GPS: Support for external GPS (optional)
ENVIRONMENTAL SPECIFICATIONS
Environment: ETSI 3.1, IP
Normal operating temp.: 0 - +50º C with fan, 0 - +40º C with passive cooling
OSS support: Integrated to OSS-RC/Ericsson Network Manager


Files

RBS6401_top.JPG View RBS6401_top.JPG 916 KB Jarobar, 10/01/2021 11:58 PM
RBS6401_bot.JPG View RBS6401_bot.JPG 859 KB Jarobar, 10/01/2021 11:58 PM
Actions #1

Updated by laforge over 3 years ago

FYI: the RBS6402 for LTE is what was used by Osmocom to operate a LTE network at the CCC Camp 2019 as well as at the CCC Congress 2019 (together with open5gs).

There are two important topics:

  1. it's relatively difficult to get them into a working/configured scenario. This information is not publicly known or documented.
  2. the supported feature set hugely depends on the software version installed on the device. All the units that "we" so far have managed to obtain during the last years contain LTE-only software builds, and hence are not an option for HSPA+
Actions #2

Updated by copslock over 3 years ago

laforge wrote:

FYI: the RBS6402 for LTE is what was used by Osmocom to operate a LTE network at the CCC Camp 2019 as well as at the CCC Congress 2019 (together with open5gs).

There are two important topics:

  1. it's relatively difficult to get them into a working/configured scenario. This information is not publicly known or documented.
  2. the supported feature set hugely depends on the software version installed on the device. All the units that "we" so far have managed to obtain during the last years contain LTE-only software builds, and hence are not an option for HSPA+

I knew those problem for Ericsson,but the sub-varaint available at this time is different from the one you guys used previously,and FCC showed it supports WCDMA on this variant.Besides,It's worthy to have some fun with just couples of bucks.Anyway the major goal is getting more devices to work with osmocom infrastructure

Actions #3

Updated by lynxis over 3 years ago

I'm working in my free time to get those devices up and running with open5gs.
However I'm unsure if it's possible to get WCDMA out of these, because the correct firwmare with wcdma support might be missing.

Atm I'm looking into the automatic configuration using an AIWS server.
AIWS = Automatic Integration Web Server

The rbs6402 request via dhcp for an AIWS server (dhcp option 72) or try to connect to aiws.ai.ericsson port 2497, which must be an https webserver.
the rbs6402 ignores certificate errors and request "/autobind/<serial>". Serial is shown on top of the rbs6402.

I'ven't yet tested any files, but I hope and expect it has to be a "RBS Auto Integration Summary file (xml)" behind the url.

Actions #4

Updated by copslock over 3 years ago

lynxis wrote:

I'm working in my free time to get those devices up and running with open5gs.

..........
You have to get into the onboard system,rather than making the Auto Integration works,the parameters nor structure were known for ericsson devices,but seem like you can possiblely find command injection through this?but the filesystem dump is needed to do some analyse ahead,otherwise no way to get inside.About the WCDMA,at least the RF test shows it supports that,but who knows if its related to configuration or not.Refer to the information from here https://osmocom.org/projects/ericsson-rbs-6xxx/wiki/RBS6402_Software
It also seems like the operation mode is controlled by some kind of magic stuff

[   94.693546] MWA-API: HW:          304
[   94.698895] MWA-API: POWER1:      UCD9090:R1D
[   94.705112] MWA-API: U-BOOT:      U-Boot_2013.01_(Nov_08_2018_-_17:33:13)
[   94.710459] MWA-API: OPMODE:      LTE_HC
[   94.717913] MWA-API: SW DATE:     Thu Nov 16 15:28:11 2017
[   94.723755] MWA-API: SW TYPE:     RND
[   94.732294] MWA-API: SW RELEASE:  R1AF01
[   94.742862] MWA-API: SW R-STATE:  R1AF01
[   94.749749] MWA-API: SW BRANCH:   17Q2
[   94.756510] MWA-API: SW EOAM:     
[   94.764139] MWA-API: SW COM:      37c272b8357352cffb88b9b9e59329dd5dafc137
[   94.769215] MWA-API: SW BOAM:     
[   94.775080] MWA-API: WCDMA:       WWPM_1641.4
[   94.781898] MWA-API: WCDMA L1:    65db0c6 (Wed, 5 Jul 2017 11:51:09 -0400)
[   94.787114] MWA-API: WCDMA L2:    439a61e (Wed, 20 Sep 2017 08:32:38 -0400)
[   94.793286] MWA-API: LTE PHY:     LWP_1606_PHY
[   94.802059] MWA-API: LTE STACK:   ELG_v1.2
[   94.807698] grsec: mount of none to /dev/mqueue by /bin/busybox.nosuid[mount:2637] uid/euid:0/0 gid/egid:0/0, parent /usr/bin/eoam_msmm_startup.sh[eoam_msmm_start:2533] uid/euid:0/0 gid/egid:0/0
[   94.808766] MWA-API: LTE L1:      DEV.SC-LTE-PHY-05.01.LWP1606-31-gb85eab7
[   94.818564] MWA-API: LTE L2:      ELG_v1.2-4175-gfcc3f8a
[   94.824518] MWA-API: LTE L3_OAM:  ELG_v1.2-2694-ga23242c
[   94.943482] MWA-API: FPGA SW:     3.1 1.67
[   95.068095] MWA-API: FPGA2 SW:     3.1 1.67
[   95.075127] MWA-API: SW MCSDK:    03.01.04.07A6
[   95.079701] MWA-API: SW SYSLIB:   4.00.03.00 0252de4
[   95.085471] MWA-API: SW AIF2:     1.2.0.00 51c1e7e
[   95.091022] MWA-API: KERNEL:      Linux epic2_0 3.10.104-grsec-rt117 #1 SMP PREEMPT RT Thu Nov 16 15:38:48 UTC 2017 armv7l GNU/Linux
[   96.264531] locking fs.
[   96.264554] Filesystem locked.

Actions #5

Updated by lynxis over 2 years ago

copslock i'ven't opened one of them. I need to do it.

Anyhow here is an example file for the autobind service. It's not yet working. But I think the Format revision is still wrong. Next task is to "bruteforce" at least 3 letters and numbers with a remote controlled power supply.

<?xml version="1.0" encoding="UTF-8"?>
<RbsSiteInstallationFile>
    <Format revision="L"/>
    <InstallationData logicalName="somename" dhcpClientIdentifier="abcdlient" vlanId="123">
        <OamIpConfigurationData ipAddress="10.0.11.197" subnetMask="255.255.255.0" 
            defaultRouter0="10.0.11.1" defDomainName="enodeb.example.com">
        <DnsServer ipAddress="10.0.11.1"/>
    </OamIpConfigurationData>
    <SmrsData userName="foo" password="bar" address="10.23.0.1" summaryFilePath="/FOO/AutoIntegrationRbsSummaryFile.xml" />
</InstallationData>
</RbsSiteInstallationFile>

<pre>
<?xml version="1.0" encoding="UTF-8"?>
<RbsSiteInstallationFile>
    <Format revision="L"/>
    <InstallationData logicalName="somename" dhcpClientIdentifier="abcdlient" vlanId="123">
        <OamIpConfigurationData ipAddress="10.0.11.197" subnetMask="255.255.255.0" 
            defaultRouter0="10.0.11.1" defDomainName="enodeb.example.com">
        <DnsServer ipAddress="10.0.11.1"/>
    </OamIpConfigurationData>
    <SmrsData userName="foo" password="bar" address="10.23.0.1" summaryFilePath="/FOO/AutoIntegrationRbsSummaryFile.xml" />
</InstallationData>
</RbsSiteInstallationFile>
</pre>

Actions #6

Updated by Jarobar over 2 years ago

Two images for RBS6401.

Main chip 2x TMS320TCI6614SXCMS, FPGA Xilinx KINTEX-7 XC7K325T-FBG900ACX1425, flash MT29F16G08ABCBBH1-12IT, DDR MT41K256M16HA-125, ?? Marvell 88e1340s-bam2, switch Marvell 98DX-LKJ1, clock AD9547, 2x AD9523-1, ADC 2x AZ42B49I, VGA 2x AD8376-ACPZ, ?? 2x 43701-1332, DAC DAC3484I, modulator 2x ADRF6703-ACPZ, ?? 4x SKY73209-11, PWR UCD90124A, UCD9246E, etc.

Actions #7

Updated by lynxis over 2 years ago

i've managed to get a 6402 provisioning up to the point it ask s1ap for the lte configuration. i'ven't looked into wcdma configuration yet.

if wcdma is supported by firmware the rbs6402 want's to connect via Iub to a RNC instead of a hnodeb/iuh.

Actions #8

Updated by lynxis over 2 years ago

So it's not usuable as WCDMA nodeb because we don't have a RNC for Iub. But it's usuable as LTE enodeb with open5gs.
I'll write some documentation how to configure it into the wiki in the next week or days.

copslock can we close this ticket or do like to discuss more about the 6402 more in here?

Actions #9

Updated by copslock over 2 years ago

lynxis wrote in #note-8:

So it's not usuable as WCDMA nodeb because we don't have a RNC for Iub. But it's usuable as LTE enodeb with open5gs.

Iub is kinda another topic,I saw some rusky provided a mini-RNC implementation,but dunno if we could get those code.
https://nickvsnetworking.com/my-used-huawei-bbu3900-lte-ran-adventure-part-1-the-impulse-purchase/
In fact,the most difficult part of Iub support is actually the NBAP procedures,the other part of work were already done by the OpenBTS-UMTS,like the RRC/RLC layers,while the lower FP transport layer is the biggest barrier of Iub support.I don't expect anyone to implement this recently in short term,but it's a good target to put some effort on it

I'll write some documentation how to configure it into the wiki in the next week or days.

copslock can we close this ticket or do like to discuss more about the 6402 more in here?

I just use this ticket to give people some directioin in finding proper devices,feel free to talk here.Anyway,wiki is pretty static way to exchange information and not work as good as conversation way.

Actions #11

Updated by copslock over 2 years ago

Jarobar wrote in #note-10:

Here are some links to Spaar's blog.
http://www.mirider.com/weblog/2012/02/02/#20120202-running_your_own_node_b
http://www.mirider.com/weblog/2012/04/16/#20120416-3G_user_plane
http://www.mirider.com/weblog/2012/04/24/#20120424-A_bit_of_3G_Layer_1

He seems to have snippets of RNC.
It would be nice to share it with the community.

Even not think about it,its almost 10yrs ago and the author seems not have interest in sharing the code at all.If we want RNC support,we have to build it upon the OpenBTS-UMTS codebase

Actions #12

Updated by paulmataruso almost 2 years ago

copslock wrote in #note-9:

lynxis wrote in #note-8:

So it's not usuable as WCDMA nodeb because we don't have a RNC for Iub. But it's usuable as LTE enodeb with open5gs.

Iub is kinda another topic,I saw some rusky provided a mini-RNC implementation,but dunno if we could get those code.
https://nickvsnetworking.com/my-used-huawei-bbu3900-lte-ran-adventure-part-1-the-impulse-purchase/
In fact,the most difficult part of Iub support is actually the NBAP procedures,the other part of work were already done by the OpenBTS-UMTS,like the RRC/RLC layers,while the lower FP transport layer is the biggest barrier of Iub support.I don't expect anyone to implement this recently in short term,but it's a good target to put some effort on it

I'll write some documentation how to configure it into the wiki in the next week or days.

copslock can we close this ticket or do like to discuss more about the 6402 more in here?

I just use this ticket to give people some directioin in finding proper devices,feel free to talk here.Anyway,wiki is pretty static way to exchange information and not work as good as conversation way.

lynxis Would you be willing to share more on how you where able to get the RBS6402 to interface to Open5GS? Been struggling with my unit for a while now.

Actions #13

Updated by Tom453 8 months ago

Any update? Someone have good exmaple xml file to pass autointegration in standalone mode?

Actions #14

Updated by laforge 19 days ago

would be great to get all this content converted into a wiki page below Femtocell-specific_information

Actions

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)