September 2013 - OpenBSC - lists.osmocom.org

GPRS - local and foreign TLLIs
by Luca Melette 04 Feb '26

04 Feb '26

Hello everybody, after setting up a nanoBTS with OpenBSC/SGSN/GGSN, I had some troubles trying to connect my smartphone to the GPRS cell. Investigating the BTS-to-SGSN traffic, I saw that the frames sent by the SGSN were all marked with the same N(U) value (at LLC layer), the value was 0. With some debug, I found that the there was a mismatch in the TLLI storage, used to keep the status of attached terminals. The mentioned code is contained in gprs_llc.c, involving LL Entity functions and gprs_llc_tx_ui(). /* look-up or create the LL Entity for this (TLLI, SAPI) tuple */ lle = lle_by_tlli_sapi(msgb_tlli(msg), sapi); if (!lle) { struct gprs_llc_llme *llme; LOGP(DLLC, LOGL_ERROR, "LLC TX: unknown TLLI 0x%08x, " "creating LLME on the fly\n", msgb_tlli(msg)); llme = llme_alloc(msgb_tlli(msg)); lle = &llme->lle[sapi]; } The TX function uses the previously received TLLI to lookup for the LLE. The lle_by_tlli_sapi() performs the search, but preliminary it applies a foreign2local TLLI conversion to ensure to have a local one. Since no valid entry for the searched TLLI is found, a new one is created. And the problem is here. The new entry has the foreign TLLI. Next time the lookup fails again, and a new entry is created. This way, the counter N(U) is always reset, and the mobile do not recognize the message sequence and no attach is possible. My question is about foreign and local TLLIs. I patched the lookup, avoiding the conversion, so that the LLE is found and everything works fine... but... What is the sense of the conversion? Should the TLLI be always stored as a local one? Can this problem be solved with another foreign2local while allocating new entries? Actually, my problem has been solved with that workaround. But I'm curious to know what is the right way. Hope somebody can answer :) Thanks. Cheers, LM

5 6

Pysim error: SW match failed
by Martin Nagy 16 Aug '25

16 Aug '25

Hi all, After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error: /pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto Insert card now (or CTRL-C to cancel) Autodetected card type fakemagicsim Generated card parameters : > Name : 26C3 > SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000 > ICCID : 8949262427518313026 > MCC/MNC : 262/42 > IMSI : 262422461512085 > Ki : 7b74741a1ee14337ec23f9ab92a13648 > OPC : ccd867d60797d8d45354a51b3ef568ff Programming ... Traceback (most recent call last): File "./pySim-prog.py", line 530, in <module> card.program(cp) File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3)) File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary return self._tp.send_apdu_checksw(pdu) File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1])) RuntimeError: SW match failed ! Expected 9000 and got 9804. I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code. Thanks a lot and best regards Martin

3 3

Re: Help with sccp library
by mosbah abdelkader 07 Jul '25

07 Jul '25

> I don't understand. This callback will be called with data you need to write > to the network. In case of MTP Level3 you will need to wrap that around the > msgb you got. I means: is the interaction with mtp3 layer implemented (is sending sccp data by mtp3 implemented by the library?)? Also, what about the reception of data from mtp3 layer. is that implemented in the sccp lib. I am asking these questions because I see the code of mtp3 in the lib but no significant call is present in the sccp part of the lib. Thank you for your help.

4 3

Unbounded AGCH queue in OsmoBTS
by Alexander Chemeris 13 Feb '14

13 Feb '14

Hi all, We're moving this discussion to the mailing list, as it seems it is more generic and complex than we've thought initially. The issue arose when I started doing load testing of the OsmoTRX transceiver and disabled all gating in it. As a result, all incoming noise was processed as valid Normal Bursts and Access Bursts and sent up to OsmoBTS. This leads to a situation, similar to a RACH flood, when there are more RACH requests coming, than a BTS could reasonably process. And this leads to an unbounded increase of the AGCH queue in the BTS - it consumes a few Mb per minute. I think that this is the root cause of the issue we've seen at a Netherlands festival installation, when 20K phones suddenly started connecting to our station after official networks went down. When the amount of RACH requests exceeded available CCCH capacity (took <5 seconds), mobile phones stopped answering out IMM.ASS messages. Hypothesis is that the AGCH queue became so long, requests were sent too late for a phone to receive it. And thus no phones answered to our IMM.ASS messages. Unfortunately, I wasn't able to collect enough data to check this hypothesis during that time and we don't have another big festival on hands atm. An attached is a quick fix for the unbounded queue growth. It uses a hardcoded value for the maximum queue length, which is fine for our load testing, but not flexible enough for the real life usage. We should make the AGCH queue long enough to keep high performance. At the same time, it must not exceed MS timeout or _all_ IMM.ASS messages will miss their target MS's. We could make this parameter user-configurable on a BTS side, but it seems more reasonable to automatically calculate it, depending on the channel combination and timeout values. But this should be done on the BSC side. So the questions are: 1) what is a good way to calculate it? 2) should we configure this queue length over OML, or move the queue from BTS to BSC? -- Regards, Alexander Chemeris. CEO, Fairwaves LLC / ООО УмРадио http://fairwaves.ru

5 23

Hard reset NanoBTS after forgetting static IP
by Luca Bongiorni 22 Nov '13

22 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey there, I have come across a nanoBTS 165AU but since is used and not tested from the previous owner, I guess it has set a static IP. After turned on is booting (RED light) and then remains (ORANGE not flashing) even if the eth is connected to the router. At the moment I am trying with ipaccess-find and BtsInstaller to find in on my LAN . Unfortunately it is not answering and is not even getting an IP from the router by the DHCP daemon. Two possibilities, I have thought: - - an hw/sw issue; - - a Static IP is set. Supposing that is the 2nd possibility, I was thinking: - - to change private class of my LAN, to see if it changes something; - - to make an hard reset of the bts. Do you know if it possible to reset in someway? Ever happened this issue to you guys? Suggestions or insults are welcome. Thanks in advance. Cheers, Luca P.S.: I don't recall exactly, but one time I heard that is possible to reset by short-circuiting some pins of the LAN/48VDC eth connector. Is it right?! -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJSE682AAoJEPLE1Qsi6ZiTuKkQAJaYGFTgMF5XlWuZuCI1eSvU lVCvpdB+fDRY7o6iut3y0fGlS1ZOIS8X93c7/T0XKUvSJaZ2ARIGjqi81A4XlkAK pdFvBNPKixYATYZYhP3nIggC1QGK9fuWQSUKVEGgnswsXt0VaJKdEwgn0CX7ttku uoh6FM3vtp30drB4t9oe0bW9M9qzGz6yyw+8asaqQBs8bafOHm4+S4kJsN6lYmPU wY/s8ctzqZerNI0MwBVASZCFldsyWe0NuduquYZlwg4god996srFNkVQL+o9nrmF vmPb896DTsCdivwqs+UyaZOgp1mKxjtfco275pVATG4qSAgz/JYQBxWK6fWQr+Zv PIzQvFLME1kh/29nUihxw93mzju5Rz1naTosx5+Fs7jPjCFocqD5Var3hkU4iu78 kNALJNx6UGOdfbqcInO30ltSm21HH1QBJnIoZf6MblELvHcvHbBNyPB8zM13suoS y3/oD/wcXefQaMaSa5HFc30ydJHBWS+adNlVp3fdYYArZaVkFxaVjJx8fW1juPVx 54aco5j7/tZD5tfg9FCOTHqmAiOVDqjs7nZrOpsRdkdPJHq2uHbGmHGqyhZlVWNv B+9/eiOdQyKZ5R+3vvRrmhBe9g2a28xtRI7N8KxwCov0wbA6R0h8l2UtGza6NTcn EUdW3ptIWP216tSFdVTs =9Ctc -----END PGP SIGNATURE-----

8 12

[PATCH 01/20] sysmo-bts: Use correct boundaries of L1 msg when forwarding to L1 proxy
by Andreas Eversberg 06 Oct '13

06 Oct '13

In case of a headroom in a message, the 'head' pointer will not point to the actual data. --- src/osmo-bts-sysmo/l1_transp_fwd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/osmo-bts-sysmo/l1_transp_fwd.c b/src/osmo-bts-sysmo/l1_transp_fwd.c index 5050705..87c230b 100644 --- a/src/osmo-bts-sysmo/l1_transp_fwd.c +++ b/src/osmo-bts-sysmo/l1_transp_fwd.c @@ -95,7 +95,7 @@ static int fwd_read_cb(struct osmo_fd *ofd) static int prim_write_cb(struct osmo_fd *ofd, struct msgb *msg) { /* write to the fd */ - return write(ofd->fd, msg->head, msg->len); + return write(ofd->fd, msg->l1h, msgb_l1len(msg)); } int l1if_transport_open(int q, struct femtol1_hdl *fl1h) -- 1.8.1.5

4 11

[PATCH] Menu App to select highram images from phone's flash memory
by Andreas Eversberg 29 Sep '13

29 Sep '13

--- src/target/firmware/Makefile | 3 +- src/target/firmware/apps/menu/main.c | 353 ++++++++++++++++++++++++++++++++++ 2 files changed, 355 insertions(+), 1 deletions(-) create mode 100644 src/target/firmware/apps/menu/main.c diff --git a/src/target/firmware/Makefile b/src/target/firmware/Makefile index 42f7ad4..0f4120f 100644 --- a/src/target/firmware/Makefile +++ b/src/target/firmware/Makefile @@ -84,11 +84,12 @@ BOARD_se_j100_ENVIRONMENTS=$(compal_COMMON_ENVIRONMENTS) # # List of all applications (meant to be overridden on command line) -APPLICATIONS?=hello_world compal_dsp_dump layer1 loader rssi +APPLICATIONS?=hello_world compal_dsp_dump layer1 loader rssi menu # Applications specific env requirements APP_loader_ENVIRONMENTS=compalram highram APP_rssi_ENVIRONMENTS=* -compalram +APP_menu_ENVIRONMENTS=* -highram # Various objects that are currently linked into all applications FLASH_OBJS=flash/cfi_flash.o diff --git a/src/target/firmware/apps/menu/main.c b/src/target/firmware/apps/menu/main.c new file mode 100644 index 0000000..47aadc4 --- /dev/null +++ b/src/target/firmware/apps/menu/main.c @@ -0,0 +1,353 @@ +/* Menu for Calypso Phone to load applicatios from flash */ + +/* (C) 2013 by Andreas Eversberg <jolly(a)eversberg.eu> + * + * All Rights Reserved + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + */ + +#include <stdint.h> +#include <stdio.h> +#include <string.h> +#include <errno.h> + +#include <debug.h> +#include <memory.h> +#include <delay.h> +#include <byteorder.h> +#include <rffe.h> +#include <keypad.h> +#include <board.h> +#include <abb/twl3025.h> +#include <rf/trf6151.h> +#include <calypso/clock.h> +#include <calypso/tpu.h> +#include <calypso/tsp.h> +#include <calypso/dsp.h> +#include <calypso/irq.h> +#include <calypso/misc.h> +#include <calypso/timer.h> +#include <comm/sercomm.h> +#include <comm/timer.h> +#include <uart.h> +#include <fb/framebuffer.h> +#include <battery/battery.h> +#include <asm/system.h> + +#define RAM 0x00820000 +#define MAGIC 0x0083ff00 + +enum key_codes key_code = KEY_INV; +static volatile enum key_states key_state; + +int cursor = 0, scroll_apps = 0; + +struct apps { + char name[16]; + void *start; + int len; +} apps[32]; + +int _memcmp(char *s1, char *s2, int size) +{ + int i; + + for (i = 0; i < size; i++) { + if (*s1 < *s2) + return -1; + if (*s1 > *s2) + return 1; + s1++; + s2++; + } + + return 0; +} + +static void locate_apps(void) +{ + int i, j, k; + char *p; + + memset(apps, 0, sizeof(apps)); + + for (j = 0, i = 0x010000; i < 0x200000; i += 0x10000) { + p = (char *)i; + /* check for highram header: "highram:" */ + if (!!_memcmp(p, "highram:", 8)) + continue; + p += 8; + /* check for app name after header: "highram:<name>\n" */ + printf("found highram image at flash mem address 0x%p\n", + (char *)i); + for (k = 0; k < (int)sizeof(apps[j].name) - 1; k++) { + if (p[k] == '\n') + break; + } + if (k == sizeof(apps[j].name) - 3) { + printf("skipping: corrupt highram header, no '\\n' " + "after image name or name more larger than %d " + "digits\n", (int)sizeof(apps[j].name) - 3); + continue; + } + if (j < 9) + apps[j].name[0] = '1' + j; + else if (j == 9) + apps[j].name[0] = '0'; + else + apps[j].name[0] = ' '; + apps[j].name[1] = ' '; + memcpy(apps[j].name + 2, p, k); + apps[j].len = 0x20000; + p += k + 1; + /* p points to highram image after header */ + apps[j].start = p; + j++; + } +} + +static void wait_key_release(void) +{ + /* wait for key release */ + while (key_state == PRESSED) { + delay_ms(10); + keypad_poll(); + } +} + +static void load_app(void) +{ + static int i; + static void (*f) (void) = (void (*)(void))RAM; + + wait_key_release(); + + local_irq_disable(); + + for (i = 0; i < apps[cursor].len; i++) + ((unsigned char *)RAM)[i] = ((unsigned char *)apps[cursor].start)[i]; + f(); +} + +/* UI */ + +static void refresh_display(void) +{ +#if 0 + char text[16]; + int bat = battery_info.battery_percent; +#endif + int i; + + fb_clear(); + + /* header */ + fb_setbg(FB_COLOR_WHITE); + if (1) { + fb_setfg(FB_COLOR_BLUE); + fb_setfont(FB_FONT_HELVR08); + fb_gotoxy(0, 7); + fb_putstr("Osmocom Menu", -1); + fb_setfg(FB_COLOR_RGB(0xc0, 0xc0, 0x00)); + fb_setfont(FB_FONT_SYMBOLS); +#if 0 + fb_gotoxy(framebuffer->width - 15, 8); + if (bat >= 100 && (battery_info.flags & BATTERY_CHG_ENABLED) + && !(battery_info.flags & BATTERY_CHARGING)) + fb_putstr("@HHBC", framebuffer->width); + else { + sprintf(text, "@%c%c%cC", (bat >= 30) ? 'B':'A', + (bat >= 60) ? 'B':'A', (bat >= 90) ? 'B':'A'); + fb_putstr(text, framebuffer->width); + } +#endif + fb_gotoxy(0, 8); + fb_putstr("GGEGG", framebuffer->width); + fb_setfg(FB_COLOR_GREEN); + fb_gotoxy(0, 10); + fb_boxto(framebuffer->width - 1, 10); + } + fb_setfg(FB_COLOR_BLACK); + fb_setfont(FB_FONT_C64); + + + for (i = 0; i < 5; i++) { + if (!apps[scroll_apps + i].name) + break; + if (scroll_apps + i == cursor) { + fb_setfg(FB_COLOR_WHITE); + fb_setbg(FB_COLOR_BLUE); + } + fb_gotoxy(0, 20 + i * 10); + fb_putstr(apps[scroll_apps + i].name, + framebuffer->width); + if (scroll_apps + i == cursor) { + fb_setfg(FB_COLOR_BLACK); + fb_setbg(FB_COLOR_WHITE); + } + } + if (i == 0) { + fb_gotoxy(0, 50); + fb_putstr("No apps!", -1); + } + + fb_flush(); +} + +static void handle_key_code() +{ + if (key_code == KEY_INV) + return; + + switch (key_code) { + case KEY_1: + case KEY_2: + case KEY_3: + case KEY_4: + case KEY_5: + case KEY_6: + case KEY_7: + case KEY_8: + case KEY_9: + if (apps[key_code - KEY_1].len) { + cursor = key_code - KEY_1; + load_app(); + } + break; + case KEY_0: + if (apps[9].len) { + cursor = 9; + load_app(); + } + break; + case KEY_UP: + if (cursor == 0) + return; + cursor--; + if (cursor < scroll_apps) + scroll_apps = cursor; + refresh_display(); + break; + case KEY_DOWN: + if (!apps[cursor + 1].name[0]) + return; + cursor++; + if (cursor >= scroll_apps + 5) + scroll_apps = cursor - 4; + refresh_display(); + break; + case KEY_OK: + if (apps[cursor].len) + load_app(); + break; + case KEY_POWER: + wait_key_release(); + twl3025_power_off(); + break; + default: + break; + } + + key_code = KEY_INV; +} + +/* Main Program */ +const char *hr = "======================================================================\n"; + +static void key_handler(enum key_codes code, enum key_states state) +{ + key_state = state; + + if (state != PRESSED) + return; + + key_code = code; +} + +extern void putchar_asm(uint32_t c); + +static const uint8_t phone_ack[] = { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x03, 0x42 }; + +int main(void) +{ + int i; + + /* Simulate a compal loader saying "ACK" */ + for (i = 0; i < (int)sizeof(phone_ack); i++) { + putchar_asm(phone_ack[i]); + } + + board_init(0); + + puts("\n\nOsmocomBB Menu (revision " GIT_REVISION ")\n"); + puts(hr); + + fb_clear(); + + fb_setfg(FB_COLOR_BLACK); + fb_setbg(FB_COLOR_WHITE); + fb_setfont(FB_FONT_HELVB14); + + fb_gotoxy(2,20); + fb_putstr("menu",framebuffer->width-4); + + fb_setfg(FB_COLOR_RED); + fb_setbg(FB_COLOR_BLUE); + + fb_gotoxy(2,25); + fb_boxto(framebuffer->width-3,38); + + fb_setfg(FB_COLOR_WHITE); + fb_setfont(FB_FONT_HELVR08); + fb_gotoxy(8,33); + fb_putstr("osmocom-bb",framebuffer->width-4); + + fb_flush(); + + /* Dump device identification */ + dump_dev_id(); + puts(hr); + + /* Dump clock config before PLL set */ + calypso_clk_dump(); + puts(hr); + + keypad_set_handler(&key_handler); + + /* Dump clock config after PLL set */ + calypso_clk_dump(); + puts(hr); + +// display_unset_attr(DISP_ATTR_INVERT); + + locate_apps(); + + while (1) { + for (i = 0; i < 50; i++) { + keypad_poll(); + delay_ms(10); + osmo_timers_update(); + handle_key_code(); + } + refresh_display(); + } + + /* NOT REACHED */ + + twl3025_power_off(); +} + -- 1.7.3.4

2 1

Added patch to USSD iteration. Need help to continue.
by Maicon Kist 26 Sep '13

26 Sep '13

Hi list, I managed to add interaction to the USSD implemented in the OpenBSC. I attached a patch with the changes realized.The most important changes made are in the ussd.{c, h} files. I implemented the gsm0480_send_ussd_facility. Basically, I copied the gsm0480_send_response, change the GSM0480_OPERATION_CODE field value to GSM0480_OP_CODE_USS_REQUEST, removed the 2 bytes before this field and replaced the GSM0480_MTYPE_RELEASE_COMPLETE byte by GSM0480_MTYPE_FACILITY. Now, I don't know how to proceed. More precisely, I don't know what function is called in the OpenBSC when the user send the response in the mobile phone. Do you guys know the entry point function in this case ? Best Regards

1 0

Sms via SMPP - Questions
by Ludovic Rateau 25 Sep '13

25 Sep '13

Hi all, I'm working on OsmoNITB software and i am very interested in SMPP features. I have read some posts about SMPP in OSMONITB and i have some question about how to make it works. I have compiled openbsc ( based on http://openbsc.osmocom.org/trac/wiki/network_from_scratch ) with libsmpp34. All is good. When i start my OSMONITB, my netstat show listening port 2775. But how to connect and send a SMS via SMPP? I tried a little PHP script on github : https://github.com/onlinecity/php-smpp But i couldn't connect : INVALID SERVER ID Error 0xf Do i need to put a USERNAME and PASSWORD ? When i looked the code : in accept-all mode, all username and password are corrects. My BTS is in accept-all mode but i couldn't connect. So I tried an another program in C. And same error. Have you fixed this problem ? Is it working for you ? Second, Is there a mechanism to pass SMS from OSMONITB to an another server via SMPP ? Thanks for your help. -- *Ludovic RATEAU* R&D Engineer BJT PARTNERS -- -- *Ludovic RATEAU *Mobile : +33 6 04 10 5000

1 0

how gprs is called in openbsc, where to find the libgtb?
by Dai H. Tran 23 Sep '13

23 Sep '13

Hello everyone, I just recently learn about openbsc, and still in the phase of compiling and try to run the osmo-nitb app. 1st problem The problem is one of my teammate said the osmo-nitb will also started/call the osmo-sgsn program, but after examine the code, I still don't know how the osmo-sgsn is called from osmp-nitb, may be I was wrong, anyone can help me with this, how can I activate osmo-sgsn from osmo-nitb, with extra arguments? 2nd problem Another question, when I try to compile osmo-sgsn, the gtp lib is missing, as define in the makefile: *if HAVE_LIBGTP* *bin_PROGRAMS = osmo-gbproxy osmo-sgsn* *else* *bin_PROGRAMS = osmo-gbproxy* *endif* I don't know where to get this lib, so I modified by adding osmo-sgsn to the *else clause* as-well to have osmo-sgsn compiled. I still can run osmo-sgsn, but it show error about the gtp socket, i think the configuration is not correct, but not because of missing gtp lib, should this be a problem? Best regards, Dai

2 1