June 2014 - OpenBSC - lists.osmocom.org

GPRS - local and foreign TLLIs
by Luca Melette 04 Feb '26

04 Feb '26

Hello everybody, after setting up a nanoBTS with OpenBSC/SGSN/GGSN, I had some troubles trying to connect my smartphone to the GPRS cell. Investigating the BTS-to-SGSN traffic, I saw that the frames sent by the SGSN were all marked with the same N(U) value (at LLC layer), the value was 0. With some debug, I found that the there was a mismatch in the TLLI storage, used to keep the status of attached terminals. The mentioned code is contained in gprs_llc.c, involving LL Entity functions and gprs_llc_tx_ui(). /* look-up or create the LL Entity for this (TLLI, SAPI) tuple */ lle = lle_by_tlli_sapi(msgb_tlli(msg), sapi); if (!lle) { struct gprs_llc_llme *llme; LOGP(DLLC, LOGL_ERROR, "LLC TX: unknown TLLI 0x%08x, " "creating LLME on the fly\n", msgb_tlli(msg)); llme = llme_alloc(msgb_tlli(msg)); lle = &llme->lle[sapi]; } The TX function uses the previously received TLLI to lookup for the LLE. The lle_by_tlli_sapi() performs the search, but preliminary it applies a foreign2local TLLI conversion to ensure to have a local one. Since no valid entry for the searched TLLI is found, a new one is created. And the problem is here. The new entry has the foreign TLLI. Next time the lookup fails again, and a new entry is created. This way, the counter N(U) is always reset, and the mobile do not recognize the message sequence and no attach is possible. My question is about foreign and local TLLIs. I patched the lookup, avoiding the conversion, so that the LLE is found and everything works fine... but... What is the sense of the conversion? Should the TLLI be always stored as a local one? Can this problem be solved with another foreign2local while allocating new entries? Actually, my problem has been solved with that workaround. But I'm curious to know what is the right way. Hope somebody can answer :) Thanks. Cheers, LM

5 6

Pysim error: SW match failed
by Martin Nagy 16 Aug '25

16 Aug '25

Hi all, After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error: /pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto Insert card now (or CTRL-C to cancel) Autodetected card type fakemagicsim Generated card parameters : > Name : 26C3 > SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000 > ICCID : 8949262427518313026 > MCC/MNC : 262/42 > IMSI : 262422461512085 > Ki : 7b74741a1ee14337ec23f9ab92a13648 > OPC : ccd867d60797d8d45354a51b3ef568ff Programming ... Traceback (most recent call last): File "./pySim-prog.py", line 530, in <module> card.program(cp) File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3)) File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary return self._tp.send_apdu_checksw(pdu) File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1])) RuntimeError: SW match failed ! Expected 9000 and got 9804. I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code. Thanks a lot and best regards Martin

3 3

Re: Help with sccp library
by mosbah abdelkader 07 Jul '25

07 Jul '25

> I don't understand. This callback will be called with data you need to write > to the network. In case of MTP Level3 you will need to wrap that around the > msgb you got. I means: is the interaction with mtp3 layer implemented (is sending sccp data by mtp3 implemented by the library?)? Also, what about the reception of data from mtp3 layer. is that implemented in the sccp lib. I am asking these questions because I see the code of mtp3 in the lib but no significant call is present in the sccp part of the lib. Thank you for your help.

4 3

[PATCH 0/4] core/conv: Fast Viterbi decoding
by Thomas Tsou 26 Apr '16

26 Apr '16

Hi all, This patch set adds to libosmocore an optimized Viterbi decodeer for architecture specific (Intel SSE) and non-specific cases. The implementation covers codes with constraint lengths of K=5 and K=7 and rates 1/4 to 3/4, which make up the majority of GSM use cases. Speedup from the current implementation is in the range of 5 to 20 depending on the processor and code type. API is unchanged. Tested on Haswell (i7-4770K) and Atom (D2550). Additional test codes from osmo-bts are included. Further tests for AWGN bit-error-rate and benchmarks can be found in the following repository. https://github.com/ttsou/osmo-conv-test Here are some examples. Bit error test for GPRS CS2 with SNR of 5 dB and 100000 bursts. $ ./conv_test -c 2 -e -r 5 -i 100000 ================================================= [+] Testing: GPRS CS2 [.] Specs: (N=2, K=5, non-recursive, flushed, not punctured) [.] Input length : ret = 290 exp = 290 -> OK [.] Output length : ret = 588 exp = 588 -> OK [.] BER tests: [..] Testing base: [..] Input BER.......................... 0.042443 [..] Output BER......................... 0.000006 [..] Output FER......................... 0.001350 (135) [..] Testing SIMD: [..] Input BER.......................... 0.042460 [..] Output BER......................... 0.000005 [..] Output FER......................... 0.001240 (124) Timed AFS benchmark with 8 threads and 100000 bursts per thread. $ ./conv_test -b -c 10 -j 8 -i 100000 ================================================= [+] Testing: GSM TCH/AFS 6.7 [.] Specs: (N=4, K=5, recursive, flushed, punctured) [.] Input length : ret = 140 exp = 140 -> OK [.] Output length : ret = 448 exp = 448 -> OK [.] Performance benchmark: [..] Encoding / Decoding 800000 bursts on 8 thread(s): [..] Testing base: [..] Elapsed time....................... 4.320001 secs [..] Rate............................... 25.925920 Mbps [..] Testing SIMD: [..] Elapsed time....................... 0.458272 secs [..] Rate............................... 244.396341 Mbps [..] Speedup............................ 9.426718 -TT

5 13

OsmoSGSN [PATCH], Network Service
by Michal Grznár 05 Aug '14

05 Aug '14

Hi, I am using OsmoSGSN in topology with OpenGGSN and proprietary simulator of BSS. There was a problem with an implementation of Network service, cause Network Service implementation in the simulator of BSS is based on different release of 3GPP standard (3GPP TS 48. 016 v7. 4. 0 (2008-04)/Network service (Release 7))...and the problem is that in IP-subnetwork, which I am using there is no use for RESET or UNBLOCK procedure, so I had to do a PATCH in gprs_ns.c, which was needed to complete succesful connection between sim-bss and OsmoSGSN: switch (nsh->pdu_type) { case NS_PDUT_ALIVE: +++ LOGP(DNS, LOGL_INFO, "Rx NS ALIVE\n"); +++ /*mark NS-VC as alive*/ +++ (*nsvc)->state = NSE_S_ALIVE; +++ (*nsvc)->remote_state = NSE_S_ALIVE; +++ /*initiate TEST procedure: Send ALIVE_ACK and start timer*/ +++ rc = gprs_ns_tx_simple((*nsvc), NS_PDUT_ALIVE_ACK); +++ nsvc_start_timer((*nsvc), NSVC_TIMER_TNS_TEST); +++ break; . . . } another PATCH I needed to do was to change a little bit procedure for allocation of P-TMSI in procedure uint32_t sgsn_alloc_ptmsi(void) in gprs_sgsn.c uint32_t sgsn_alloc_ptmsi(void) { struct sgsn_mm_ctx *mm; uint32_t ptmsi; restart: +++ ptmsi = rand() | 0xc0000000; /*because of GPRS IMSI ATTACH*/ llist_for_each_entry(mm, &sgsn_mm_ctxts, list) { if (mm->p_tmsi == ptmsi) goto restart; } return ptmsi; } because in GPRS IMSI ATTACH in message ATTACH COMPLETE (3GPP 24.008, 23.003, 48.018) there is new TLLI==new allocated P-TMSI and I need local TLLI, so I had to do it this way regards Michal

3 6

[PATCH] use osmocom auth API instead of direct calls
by Max Suraev 22 Jul '14

22 Jul '14

--- openbsc/src/libmsc/auth.c | 68 +++++++++++++++++++---------------------------- 1 file changed, 28 insertions(+), 40 deletions(-) diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c index 10d8edf..ab84975 100644 --- a/openbsc/src/libmsc/auth.c +++ b/openbsc/src/libmsc/auth.c @@ -25,46 +25,11 @@ #include <openbsc/auth.h> #include <openbsc/gsm_data.h> -#include <osmocom/gsm/comp128.h> +#include <osmocom/crypt/auth.h> #include <stdlib.h> -static int -_use_xor(struct gsm_auth_info *ainfo, struct gsm_auth_tuple *atuple) -{ - int i, l = ainfo->a3a8_ki_len; - - if ((l > A38_XOR_MAX_KEY_LEN) || (l < A38_XOR_MIN_KEY_LEN)) { - LOGP(DMM, LOGL_ERROR, "Invalid XOR key (len=%d) %s\n", - ainfo->a3a8_ki_len, - osmo_hexdump(ainfo->a3a8_ki, ainfo->a3a8_ki_len)); - return -1; - } - - for (i=0; i<4; i++) - atuple->sres[i] = atuple->rand[i] ^ ainfo->a3a8_ki[i]; - for (i=4; i<12; i++) - atuple->kc[i-4] = atuple->rand[i] ^ ainfo->a3a8_ki[i]; - - return 0; -} - -static int -_use_comp128_v1(struct gsm_auth_info *ainfo, struct gsm_auth_tuple *atuple) -{ - if (ainfo->a3a8_ki_len != A38_COMP128_KEY_LEN) { - LOGP(DMM, LOGL_ERROR, "Invalid COMP128v1 key (len=%d) %s\n", - ainfo->a3a8_ki_len, - osmo_hexdump(ainfo->a3a8_ki, ainfo->a3a8_ki_len)); - return -1; - } - - comp128(ainfo->a3a8_ki, atuple->rand, atuple->sres, atuple->kc); - - return 0; -} - /* Return values * -1 -> Internal error * 0 -> Not available @@ -76,6 +41,11 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple, { struct gsm_auth_info ainfo; int i, rc; + static struct osmo_sub_auth_data auth = { + .type = OSMO_AUTH_TYPE_GSM + }; + struct osmo_auth_vector _vec; + struct osmo_auth_vector *vec = &_vec; /* Get subscriber info (if any) */ rc = db_get_authinfo_for_subscr(&ainfo, subscr); @@ -109,13 +79,23 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple, return 0; case AUTH_ALGO_XOR: - if (_use_xor(&ainfo, atuple)) - return 0; + auth.algo = OSMO_AUTH_ALG_XOR; + if ((ainfo.a3a8_ki_len > A38_XOR_MAX_KEY_LEN) || (ainfo.a3a8_ki_len < A38_XOR_MIN_KEY_LEN)) { + LOGP(DMM, LOGL_ERROR, "Invalid XOR key (len=%d) %s\n", + ainfo.a3a8_ki_len, + osmo_hexdump(ainfo.a3a8_ki, ainfo.a3a8_ki_len)); + return -1; + } break; case AUTH_ALGO_COMP128v1: - if (_use_comp128_v1(&ainfo, atuple)) - return 0; + auth.algo = OSMO_AUTH_ALG_COMP128v1; + if (ainfo.a3a8_ki_len != A38_COMP128_KEY_LEN) { + LOGP(DMM, LOGL_ERROR, "Invalid COMP128v1 key (len=%d) %s\n", + ainfo.a3a8_ki_len, + osmo_hexdump(ainfo.a3a8_ki, ainfo.a3a8_ki_len)); + return -1; + } break; default: @@ -124,6 +104,14 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple, return 0; } + memcpy(auth.u.gsm.ki, ainfo.a3a8_ki, sizeof(auth.u.gsm.ki)); + + if (osmo_auth_gen_vec(vec, &auth, atuple->rand) < 0) + return -1; + + memcpy(atuple->sres, vec->sres, 4); + memcpy(atuple->kc, vec->kc, 8); + db_sync_lastauthtuple_for_subscr(atuple, subscr); DEBUGP(DMM, "Need to do authentication and ciphering\n"); -- 1.9.1

3 3

Nokia UltraSite
by Sipos Csaba 28 Jun '14

28 Jun '14

Hi, I wonder if anybody was ever able to start a Nokia UltraSite with OpenBSC? In a nut shell: OML link is up and running, TRX1 is successfully loaded software, configured, and now it is stuck in "Waiting for LAPD..." state. The problem is that OpenBSC initiates the RSLSIG link for this TRX, but it seems the BTS is never answering to that: Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:159 LAPD state change on TEI 1: NONE -> ASSIGNED Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:212 LAPD Allocating SAP for SAPI=0 / TEI=1 Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:223 k=2 N200=3 N201=260 T200=1.0 T203=10.0 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:288 Init DL layer: sequence range = 128, k = 2, history range = 4 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:227 new state LAPD_STATE_NULL -> LAPD_STATE_IDLE Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:485 LAPD DL-ESTABLISH request TEI=1 SAPI=0 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:2180 Message DL-ESTABLISH-REQUEST received in state LAPD_STATE_IDLE Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:1694 perform normal establishm. (SABM) Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:227 new state LAPD_STATE_IDLE -> LAPD_STATE_SABM_SENT Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:600 TX: 02 03 7f Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:196 start T200 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:1779 lapd_send_i() called from line 1609 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:1618 we are not busy and have no pending data, send RR Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:600 TX: f8 03 01 08 Sat Jun 28 14:33:28 2014 <0018> lapd_core.c:545 Timeout T200 (0x993ad40) state=5 Sat Jun 28 14:33:28 2014 <0018> input/lapd.c:600 TX: 02 03 7f Sat Jun 28 14:33:28 2014 <0018> lapd_core.c:196 start T200 Sat Jun 28 14:33:29 2014 <0018> lapd_core.c:545 Timeout T200 (0x993ad40) state=5 Sat Jun 28 14:33:29 2014 <0018> input/lapd.c:600 TX: 02 03 7f Sat Jun 28 14:33:29 2014 <0018> lapd_core.c:196 start T200 Sat Jun 28 14:33:30 2014 <0018> lapd_core.c:545 Timeout T200 (0x993ad40) state=5 Sat Jun 28 14:33:30 2014 <0018> input/lapd.c:600 TX: 02 03 7f Sat Jun 28 14:33:30 2014 <0018> lapd_core.c:196 start T200 Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:545 Timeout T200 (0x993ad40) state=5 Sat Jun 28 14:33:31 2014 <0018> input/lapd.c:628 LAPD DL-RELEASE indication TEI=1 SAPI=0 Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:303 Resetting LAPDm instance Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:227 new state LAPD_STATE_SABM_SENT -> LAPD_STATE_IDLE Sat Jun 28 14:33:31 2014 <001b> bsc_init.c:318 Lost some E1 TEI link: 2 0x991b8f0 Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:378 sending MDL-ERROR-IND cause 1 Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:227 new state LAPD_STATE_IDLE -> LAPD_STATE_IDLE I set the correct E1 TS for TRX1 RSLSIG in Traffic manager, and double checked the RSLSIG config parameters on both end (OpenBSC config file and the BTS manager). Nokia Insite and MetroSite uses RSL TEI = 1 for the first TRX. Maybe Ultra uses other TEI number for the first TRX, this is something I will try, but otherwise I don't know how it is possible that not even the LAPD connection is being established... Any help is appreciated. Thanks, Csaba

1 0

Bounce action notification
by mailman＠lists.osmocom.org 27 Jun '14

27 Jun '14

This is a Mailman mailing list bounce action notice: List: OpenBSC Member: devinechristophe(a)gmail.com Action: Subscription disabled. Reason: Excessive or fatal bounces. The triggering bounce notice is attached below. Questions? Contact the Mailman site administrator at mailman(a)lists.osmocom.org.

1 0

[openbsc 1/3] libbsc, osmo-bsc{, _nat}: Prevent unaligned access when casting TLVP_VAL
by Daniel Willmann 27 Jun '14

27 Jun '14

foo = *((uintXX_t *) TLVP_VAL(...) can lead to unaligned access. To prevent that use tlvp_valXX_unal() to get the values. --- openbsc/src/libbsc/abis_rsl.c | 10 +++++----- openbsc/src/osmo-bsc/osmo_bsc_bssap.c | 2 +- openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/openbsc/src/libbsc/abis_rsl.c b/openbsc/src/libbsc/abis_rsl.c index 748ab7e..d193078 100644 --- a/openbsc/src/libbsc/abis_rsl.c +++ b/openbsc/src/libbsc/abis_rsl.c @@ -1804,20 +1804,20 @@ static void ipac_parse_rtp(struct gsm_lchan *lchan, struct tlv_parsed *tv) uint16_t port, conn_id; if (TLVP_PRESENT(tv, RSL_IE_IPAC_LOCAL_IP)) { - ip.s_addr = *((uint32_t *) TLVP_VAL(tv, RSL_IE_IPAC_LOCAL_IP)); + ip.s_addr = tlvp_val32_unal(tv, RSL_IE_IPAC_LOCAL_IP); DEBUGPC(DRSL, "LOCAL_IP=%s ", inet_ntoa(ip)); lchan->abis_ip.bound_ip = ntohl(ip.s_addr); } if (TLVP_PRESENT(tv, RSL_IE_IPAC_LOCAL_PORT)) { - port = *((uint16_t *) TLVP_VAL(tv, RSL_IE_IPAC_LOCAL_PORT)); + port = tlvp_val16_unal(tv, RSL_IE_IPAC_LOCAL_PORT); port = ntohs(port); DEBUGPC(DRSL, "LOCAL_PORT=%u ", port); lchan->abis_ip.bound_port = port; } if (TLVP_PRESENT(tv, RSL_IE_IPAC_CONN_ID)) { - conn_id = *((uint16_t *) TLVP_VAL(tv, RSL_IE_IPAC_CONN_ID)); + conn_id = tlvp_val16_unal(tv, RSL_IE_IPAC_CONN_ID); conn_id = ntohs(conn_id); DEBUGPC(DRSL, "CON_ID=%u ", conn_id); lchan->abis_ip.conn_id = conn_id; @@ -1838,13 +1838,13 @@ static void ipac_parse_rtp(struct gsm_lchan *lchan, struct tlv_parsed *tv) } if (TLVP_PRESENT(tv, RSL_IE_IPAC_REMOTE_IP)) { - ip.s_addr = *((uint32_t *) TLVP_VAL(tv, RSL_IE_IPAC_REMOTE_IP)); + ip.s_addr = tlvp_val32_unal(tv, RSL_IE_IPAC_REMOTE_IP); DEBUGPC(DRSL, "REMOTE_IP=%s ", inet_ntoa(ip)); lchan->abis_ip.connect_ip = ntohl(ip.s_addr); } if (TLVP_PRESENT(tv, RSL_IE_IPAC_REMOTE_PORT)) { - port = *((uint16_t *) TLVP_VAL(tv, RSL_IE_IPAC_REMOTE_PORT)); + port = tlvp_val16_unal(tv, RSL_IE_IPAC_REMOTE_PORT); port = ntohs(port); DEBUGPC(DRSL, "REMOTE_PORT=%u ", port); lchan->abis_ip.connect_port = port; diff --git a/openbsc/src/osmo-bsc/osmo_bsc_bssap.c b/openbsc/src/osmo-bsc/osmo_bsc_bssap.c index c2c2417..f58d96f 100644 --- a/openbsc/src/osmo-bsc/osmo_bsc_bssap.c +++ b/openbsc/src/osmo-bsc/osmo_bsc_bssap.c @@ -135,7 +135,7 @@ static int bssmap_handle_paging(struct osmo_msc_data *msc, if (TLVP_PRESENT(&tp, GSM0808_IE_TMSI) && TLVP_LEN(&tp, GSM0808_IE_TMSI) == 4) { - tmsi = ntohl(*(uint32_t *) TLVP_VAL(&tp, GSM0808_IE_TMSI)); + tmsi = ntohl(tlvp_val32_unal(&tp, GSM0808_IE_TMSI)); } /* diff --git a/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c b/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c index 22b8a35..e13827b 100644 --- a/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c +++ b/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c @@ -191,7 +191,7 @@ int bsc_mgcp_assign_patch(struct nat_sccp_connection *con, struct msgb *msg) return -1; } - cic = ntohs(*(uint16_t *)TLVP_VAL(&tp, GSM0808_IE_CIRCUIT_IDENTITY_CODE)); + cic = ntohs(tlvp_val16_unal(&tp, GSM0808_IE_CIRCUIT_IDENTITY_CODE)); timeslot = cic & 0x1f; multiplex = (cic & ~0x1f) >> 5; -- 1.8.4.2

1 2

new buzzword for HLR
by ☎ 26 Jun '14

26 Jun '14

Hi all. I recall talks about sqlite-backed HLR being bottleneck and that it should be replaced with something more decent. As far as I recall that idea is not materialized yet so I'd like to bring new db buzz-word I've stumbled upon recently: http://www.aerospike.com/press-releases/aerospike-open-sources-visionary-da… If you remove all the marketing junk it's essentially greatly revamped AlchemyDB with AGPL license for server (various language bindings for client library under apache license), transactions and claim for very-small latencies (approx 5 ms!) which grabbed my attention. It's unlikely that I'll be able to allocate time to work on that ATM but maybe it'll spark interest in someone else :) -- best regards, Max, http://fairwaves.co

2 1