Project

General

Profile

Feature #4882

HSPA+ Picocell availiable in U.S

Added by copslock about 2 months ago. Updated about 2 months ago.

Status:
New
Priority:
Low
Assignee:
-
Target version:
-
Start date:
12/01/2020
Due date:
% Done:

0%

Spec Reference:

Description

The Ericsson RBS6402 WCDMA Picocell can be obtained from ebay recently at a very good price.It runs on Texas Instrument Keystone SoC,and have a good capacity compared to other femtocells


Multi standard: WCDMA, LTE and Wi-Fi (optional)
● Up to 10 bands in three modules available:2-4 LTE/WCDMA bands per module
● 2 3GPP bands operate simultaneously and 1 Wi-Fi module operates in 2 bands
● LTE 2 Carrier Aggregation up to 300/50 Mbps DL/UL
● LTE 2 Carrier and LAA/LTE-U 5GHz unlicensed band
LTE: Carrier bandwidth 5,10 and 20 MHz
2x2 MIMO
WCDMA: 21/5.76 Mbps DL/UL, HW prepared for Dual Carrier 42 Mbps DL
RNC connected, Full mobility
Wi-Fi 2.4 GHz 802.11 b/g/n, 3x3 MIMO, 23 dBm (EIRP, 18 dBm per chain)
Wi-Fi 5 GHz: 802.11 a/n/ac, 3x3 MIMO, 23 dBm (EIRP, 18 dBm per chain)
RF Power 3GPP: Up to 2x250 mW per module (total 4x250 mW)
Antenna: Integrated omni-directional antennas for LTE/WCDMA and Wi-Fi
Support for external antennas for LTE/WCDMA
Typical coverage: 800 - 2 500 m² depending on building type
Active users: Up to 64 for WCDMA and up to 128 for LTE
TRANSMISSION^
Interfaces: 1 Gbps Electrical Ethernet, Optical as an option
SFP and transmission module options
Features Internet-grade Backhaul support, TWAMP
Security: IPsec for untrusted networks
Signed SW and secure O&M access for untrusted locations
Synchronization: GPS, NTP, IEEE 1588v
MECHANICAL SPECIFICATIONS
HxW xD: 280x167x62mm (excluding connector field)
Volume: 2.8 liters
Weight: 2.5 kg
Mounting: Flexible mounting on walls and ceilings
INTERFACE SPECIFICATIONS^
Power supply: Power over Ethernet line, Power over Ethernet injector or External AC/DC adapter
LED indication: Total 8 LED for 3GPP, Backhaul & Wi-Fi
GPS: Support for external GPS (optional)
ENVIRONMENTAL SPECIFICATIONS
Environment: ETSI 3.1, IP
Normal operating temp.: 0 - +50º C with fan, 0 - +40º C with passive cooling
OSS support: Integrated to OSS-RC/Ericsson Network Manager

History

#1 Updated by laforge about 2 months ago

FYI: the RBS6402 for LTE is what was used by Osmocom to operate a LTE network at the CCC Camp 2019 as well as at the CCC Congress 2019 (together with open5gs).

There are two important topics:

  1. it's relatively difficult to get them into a working/configured scenario. This information is not publicly known or documented.
  2. the supported feature set hugely depends on the software version installed on the device. All the units that "we" so far have managed to obtain during the last years contain LTE-only software builds, and hence are not an option for HSPA+

#2 Updated by copslock about 2 months ago

laforge wrote:

FYI: the RBS6402 for LTE is what was used by Osmocom to operate a LTE network at the CCC Camp 2019 as well as at the CCC Congress 2019 (together with open5gs).

There are two important topics:

  1. it's relatively difficult to get them into a working/configured scenario. This information is not publicly known or documented.
  2. the supported feature set hugely depends on the software version installed on the device. All the units that "we" so far have managed to obtain during the last years contain LTE-only software builds, and hence are not an option for HSPA+

I knew those problem for Ericsson,but the sub-varaint available at this time is different from the one you guys used previously,and FCC showed it supports WCDMA on this variant.Besides,It's worthy to have some fun with just couples of bucks.Anyway the major goal is getting more devices to work with osmocom infrastructure

#3 Updated by lynxis about 2 months ago

I'm working in my free time to get those devices up and running with open5gs.
However I'm unsure if it's possible to get WCDMA out of these, because the correct firwmare with wcdma support might be missing.

Atm I'm looking into the automatic configuration using an AIWS server.
AIWS = Automatic Integration Web Server

The rbs6402 request via dhcp for an AIWS server (dhcp option 72) or try to connect to aiws.ai.ericsson port 2497, which must be an https webserver.
the rbs6402 ignores certificate errors and request "/autobind/<serial>". Serial is shown on top of the rbs6402.

I'ven't yet tested any files, but I hope and expect it has to be a "RBS Auto Integration Summary file (xml)" behind the url.

#4 Updated by copslock about 2 months ago

lynxis wrote:

I'm working in my free time to get those devices up and running with open5gs.

..........
You have to get into the onboard system,rather than making the Auto Integration works,the parameters nor structure were known for ericsson devices,but seem like you can possiblely find command injection through this?but the filesystem dump is needed to do some analyse ahead,otherwise no way to get inside.About the WCDMA,at least the RF test shows it supports that,but who knows if its related to configuration or not.Refer to the information from here https://osmocom.org/projects/ericsson-rbs-6xxx/wiki/RBS6402_Software
It also seems like the operation mode is controlled by some kind of magic stuff

[   94.693546] MWA-API: HW:          304
[   94.698895] MWA-API: POWER1:      UCD9090:R1D
[   94.705112] MWA-API: U-BOOT:      U-Boot_2013.01_(Nov_08_2018_-_17:33:13)
[   94.710459] MWA-API: OPMODE:      LTE_HC
[   94.717913] MWA-API: SW DATE:     Thu Nov 16 15:28:11 2017
[   94.723755] MWA-API: SW TYPE:     RND
[   94.732294] MWA-API: SW RELEASE:  R1AF01
[   94.742862] MWA-API: SW R-STATE:  R1AF01
[   94.749749] MWA-API: SW BRANCH:   17Q2
[   94.756510] MWA-API: SW EOAM:     
[   94.764139] MWA-API: SW COM:      37c272b8357352cffb88b9b9e59329dd5dafc137
[   94.769215] MWA-API: SW BOAM:     
[   94.775080] MWA-API: WCDMA:       WWPM_1641.4
[   94.781898] MWA-API: WCDMA L1:    65db0c6 (Wed, 5 Jul 2017 11:51:09 -0400)
[   94.787114] MWA-API: WCDMA L2:    439a61e (Wed, 20 Sep 2017 08:32:38 -0400)
[   94.793286] MWA-API: LTE PHY:     LWP_1606_PHY
[   94.802059] MWA-API: LTE STACK:   ELG_v1.2
[   94.807698] grsec: mount of none to /dev/mqueue by /bin/busybox.nosuid[mount:2637] uid/euid:0/0 gid/egid:0/0, parent /usr/bin/eoam_msmm_startup.sh[eoam_msmm_start:2533] uid/euid:0/0 gid/egid:0/0
[   94.808766] MWA-API: LTE L1:      DEV.SC-LTE-PHY-05.01.LWP1606-31-gb85eab7
[   94.818564] MWA-API: LTE L2:      ELG_v1.2-4175-gfcc3f8a
[   94.824518] MWA-API: LTE L3_OAM:  ELG_v1.2-2694-ga23242c
[   94.943482] MWA-API: FPGA SW:     3.1 1.67
[   95.068095] MWA-API: FPGA2 SW:     3.1 1.67
[   95.075127] MWA-API: SW MCSDK:    03.01.04.07A6
[   95.079701] MWA-API: SW SYSLIB:   4.00.03.00 0252de4
[   95.085471] MWA-API: SW AIF2:     1.2.0.00 51c1e7e
[   95.091022] MWA-API: KERNEL:      Linux epic2_0 3.10.104-grsec-rt117 #1 SMP PREEMPT RT Thu Nov 16 15:38:48 UTC 2017 armv7l GNU/Linux
[   96.264531] locking fs.
[   96.264554] Filesystem locked.

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)