June 2015 - OpenBSC - lists.osmocom.org

GPRS - local and foreign TLLIs
by Luca Melette 04 Feb '26

04 Feb '26

Hello everybody, after setting up a nanoBTS with OpenBSC/SGSN/GGSN, I had some troubles trying to connect my smartphone to the GPRS cell. Investigating the BTS-to-SGSN traffic, I saw that the frames sent by the SGSN were all marked with the same N(U) value (at LLC layer), the value was 0. With some debug, I found that the there was a mismatch in the TLLI storage, used to keep the status of attached terminals. The mentioned code is contained in gprs_llc.c, involving LL Entity functions and gprs_llc_tx_ui(). /* look-up or create the LL Entity for this (TLLI, SAPI) tuple */ lle = lle_by_tlli_sapi(msgb_tlli(msg), sapi); if (!lle) { struct gprs_llc_llme *llme; LOGP(DLLC, LOGL_ERROR, "LLC TX: unknown TLLI 0x%08x, " "creating LLME on the fly\n", msgb_tlli(msg)); llme = llme_alloc(msgb_tlli(msg)); lle = &llme->lle[sapi]; } The TX function uses the previously received TLLI to lookup for the LLE. The lle_by_tlli_sapi() performs the search, but preliminary it applies a foreign2local TLLI conversion to ensure to have a local one. Since no valid entry for the searched TLLI is found, a new one is created. And the problem is here. The new entry has the foreign TLLI. Next time the lookup fails again, and a new entry is created. This way, the counter N(U) is always reset, and the mobile do not recognize the message sequence and no attach is possible. My question is about foreign and local TLLIs. I patched the lookup, avoiding the conversion, so that the LLE is found and everything works fine... but... What is the sense of the conversion? Should the TLLI be always stored as a local one? Can this problem be solved with another foreign2local while allocating new entries? Actually, my problem has been solved with that workaround. But I'm curious to know what is the right way. Hope somebody can answer :) Thanks. Cheers, LM

5 6

Pysim error: SW match failed
by Martin Nagy 16 Aug '25

16 Aug '25

Hi all, After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error: /pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto Insert card now (or CTRL-C to cancel) Autodetected card type fakemagicsim Generated card parameters : > Name : 26C3 > SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000 > ICCID : 8949262427518313026 > MCC/MNC : 262/42 > IMSI : 262422461512085 > Ki : 7b74741a1ee14337ec23f9ab92a13648 > OPC : ccd867d60797d8d45354a51b3ef568ff Programming ... Traceback (most recent call last): File "./pySim-prog.py", line 530, in <module> card.program(cp) File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3)) File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary return self._tp.send_apdu_checksw(pdu) File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1])) RuntimeError: SW match failed ! Expected 9000 and got 9804. I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code. Thanks a lot and best regards Martin

3 3

Re: Help with sccp library
by mosbah abdelkader 07 Jul '25

07 Jul '25

> I don't understand. This callback will be called with data you need to write > to the network. In case of MTP Level3 you will need to wrap that around the > msgb you got. I means: is the interaction with mtp3 layer implemented (is sending sccp data by mtp3 implemented by the library?)? Also, what about the reception of data from mtp3 layer. is that implemented in the sccp lib. I am asking these questions because I see the code of mtp3 in the lib but no significant call is present in the sccp part of the lib. Thank you for your help.

4 3

[PATCH 0/4] core/conv: Fast Viterbi decoding
by Thomas Tsou 26 Apr '16

26 Apr '16

Hi all, This patch set adds to libosmocore an optimized Viterbi decodeer for architecture specific (Intel SSE) and non-specific cases. The implementation covers codes with constraint lengths of K=5 and K=7 and rates 1/4 to 3/4, which make up the majority of GSM use cases. Speedup from the current implementation is in the range of 5 to 20 depending on the processor and code type. API is unchanged. Tested on Haswell (i7-4770K) and Atom (D2550). Additional test codes from osmo-bts are included. Further tests for AWGN bit-error-rate and benchmarks can be found in the following repository. https://github.com/ttsou/osmo-conv-test Here are some examples. Bit error test for GPRS CS2 with SNR of 5 dB and 100000 bursts. $ ./conv_test -c 2 -e -r 5 -i 100000 ================================================= [+] Testing: GPRS CS2 [.] Specs: (N=2, K=5, non-recursive, flushed, not punctured) [.] Input length : ret = 290 exp = 290 -> OK [.] Output length : ret = 588 exp = 588 -> OK [.] BER tests: [..] Testing base: [..] Input BER.......................... 0.042443 [..] Output BER......................... 0.000006 [..] Output FER......................... 0.001350 (135) [..] Testing SIMD: [..] Input BER.......................... 0.042460 [..] Output BER......................... 0.000005 [..] Output FER......................... 0.001240 (124) Timed AFS benchmark with 8 threads and 100000 bursts per thread. $ ./conv_test -b -c 10 -j 8 -i 100000 ================================================= [+] Testing: GSM TCH/AFS 6.7 [.] Specs: (N=4, K=5, recursive, flushed, punctured) [.] Input length : ret = 140 exp = 140 -> OK [.] Output length : ret = 448 exp = 448 -> OK [.] Performance benchmark: [..] Encoding / Decoding 800000 bursts on 8 thread(s): [..] Testing base: [..] Elapsed time....................... 4.320001 secs [..] Rate............................... 25.925920 Mbps [..] Testing SIMD: [..] Elapsed time....................... 0.458272 secs [..] Rate............................... 244.396341 Mbps [..] Speedup............................ 9.426718 -TT

5 13

OpenBSC + Huawei BTS 3900B
by Роман Жогов 04 Aug '15

04 Aug '15

Hi all. I'm working on probation on mobile operator as a student. Currently, I'm trying to create site for testing, using Huawei BTS 3900B and OpenBSC software. But I can't set up it. I have a several questions: 1) Huawei BTS uses Abis over IP, how can I connect this BTS to OpenBSC. 2) Are there any examples of configuration in this case? Thanks.

2 1

osmo-nitb hangs with large hlr.sqlite3 file
by F Abdu 04 Aug '15

04 Aug '15

Dear Experts, Hello, I am running a gsm system with followings: OpenBSC version: 0.13.0.319-30e0e LCR version 1.14 astersik version 1.8.10.1 The system is sited is a busy area. The system works fine for few days but hangs once the hlr.sqlite3 file size reaches near 12 MB and that causes the osmo-nitb to take 99% of the cpu usage. I used "./osmo-nitb -m -P -C" to run the system. The hlr.sqlite3 file increases @2MB/Day. The 'Subscriber' table of the hlr.sqlite3 file adds a large number of IMSI with authorized=0. Tables like Counters, Eqipment and EquipmentWatch are filling up with lots of data. Now the only solution to this problem is to manually delete the data from the tables. May I get some light to solve the issue form the experts like you all? With regards. [ Content from the openbsc.cfg file is as following: ! ! OpenBSC configuration saved from vty ! ! password foo ! line vty no login ! e1_input e1_line 0 driver ipa network network country code XXX mobile network code XX short name Test long name Test auth policy closed location updating reject cause 13 encryption a5 0 neci 1 rrlp mode none mm info 0 handover 0 handover window rxlev averaging 10 handover window rxqual averaging 1 handover window rxlev neighbor averaging 10 handover power budget interval 6 handover power budget hysteresis 3 handover maximum distance 9999 timer t3101 10 timer t3103 0 timer t3105 0 timer t3107 0 timer t3109 4 timer t3111 1 timer t3113 60 timer t3115 0 timer t3117 0 timer t3119 0 timer t3141 0 bts 0 type sysmobts band GSMXXX cell_identity X location_area_code X training_sequence_code 7 base_station_id_code 63 ms max power 30 cell reselection hysteresis 4 rxlev access min 0 periodic location update 100 channel allocator ascending rach tx integer 9 rach max transmission 7 ip.access unit_id XXXX 0 oml ip.access stream_id 255 line 0 gprs mode none trx 0 rf_locked 0 arfcn XXX nominal power 23 max_power_red XX rsl e1 tei 0 timeslot 0 phys_chan_config CCCH+SDCCH4 timeslot 1 phys_chan_config SDCCH8 timeslot 2 phys_chan_config TCH/F timeslot 3 phys_chan_config TCH/F timeslot 4 phys_chan_config TCH/F timeslot 5 phys_chan_config TCH/F timeslot 6 phys_chan_config TCH/F timeslot 7 phys_chan_config TCH/F

2 1

[PATCH 1/1] openbsc: Rename core_ncc to core_mnc
by Mike McTernan (wavemobile) 13 Jul '15

13 Jul '15

Hi Folks, Struct osmo_msc_data contains int core_ncc, which is actually the MNC part of the PLMN, not to be confused with the Network Colour Code. The following patch renames this field for clarity and consistency with the standards. Please consider it for inclusion. Signed-off-by: Michael McTernan <Michael.McTernan(a)wavemobile.com> diff -Nrup openbsc.orig/openbsc/include/openbsc/osmo_msc_data.h openbsc/openbsc/include/openbsc/osmo_msc_data.h --- openbsc.orig/openbsc/include/openbsc/osmo_msc_data.h 2015-06-02 12:45:13.682136307 +0100 +++ openbsc/openbsc/include/openbsc/osmo_msc_data.h 2015-06-02 12:45:28.661356866 +0100 @@ -65,7 +65,7 @@ struct osmo_msc_data { struct osmo_timer_list pong_timer; int advanced_ping; struct bsc_msc_connection *msc_con; - int core_ncc; + int core_mnc; int core_mcc; int core_lac; int core_ci; diff -Nrup openbsc.orig/openbsc/src/osmo-bsc/osmo_bsc_api.c openbsc/openbsc/src/osmo-bsc/osmo_bsc_api.c --- openbsc.orig/openbsc/src/osmo-bsc/osmo_bsc_api.c 2015-06-02 12:45:13.679136263 +0100 +++ openbsc/openbsc/src/osmo-bsc/osmo_bsc_api.c 2015-06-02 12:45:28.664356910 +0100 @@ -53,8 +53,8 @@ static int complete_layer3(struct gsm_su static uint16_t get_network_code_for_msc(struct osmo_msc_data *msc) { - if (msc->core_ncc != -1) - return msc->core_ncc; + if (msc->core_mnc != -1) + return msc->core_mnc; return msc->network->network_code; } diff -Nrup openbsc.orig/openbsc/src/osmo-bsc/osmo_bsc_filter.c openbsc/openbsc/src/osmo-bsc/osmo_bsc_filter.c --- openbsc.orig/openbsc/src/osmo-bsc/osmo_bsc_filter.c 2015-06-02 12:45:13.679136263 +0100 +++ openbsc/openbsc/src/osmo-bsc/osmo_bsc_filter.c 2015-06-02 12:46:00.653828021 +0100 @@ -313,7 +313,7 @@ static int bsc_patch_mm_info(struct gsm_ static int has_core_identity(struct osmo_msc_data *msc) { - if (msc->core_ncc != -1) + if (msc->core_mnc != -1) return 1; if (msc->core_mcc != -1) return 1; diff -Nrup openbsc.orig/openbsc/src/osmo-bsc/osmo_bsc_msc.c openbsc/openbsc/src/osmo-bsc/osmo_bsc_msc.c --- openbsc.orig/openbsc/src/osmo-bsc/osmo_bsc_msc.c 2015-06-02 12:45:13.679136263 +0100 +++ openbsc/openbsc/src/osmo-bsc/osmo_bsc_msc.c 2015-06-02 12:45:28.664356910 +0100 @@ -522,7 +522,7 @@ struct osmo_msc_data *osmo_msc_data_allo INIT_LLIST_HEAD(&msc_data->dests); msc_data->ping_timeout = 20; msc_data->pong_timeout = 5; - msc_data->core_ncc = -1; + msc_data->core_mnc = -1; msc_data->core_mcc = -1; msc_data->core_ci = -1; msc_data->core_lac = -1; diff -Nrup openbsc.orig/openbsc/src/osmo-bsc/osmo_bsc_vty.c openbsc/openbsc/src/osmo-bsc/osmo_bsc_vty.c --- openbsc.orig/openbsc/src/osmo-bsc/osmo_bsc_vty.c 2015-06-02 12:45:13.679136263 +0100 +++ openbsc/openbsc/src/osmo-bsc/osmo_bsc_vty.c 2015-06-02 12:45:28.664356910 +0100 @@ -107,9 +107,9 @@ static void write_msc(struct vty *vty, s vty_out(vty, "msc %d%s", msc->nr, VTY_NEWLINE); if (msc->bsc_token) vty_out(vty, " token %s%s", msc->bsc_token, VTY_NEWLINE); - if (msc->core_ncc != -1) + if (msc->core_mnc != -1) vty_out(vty, " core-mobile-network-code %d%s", - msc->core_ncc, VTY_NEWLINE); + msc->core_mnc, VTY_NEWLINE); if (msc->core_mcc != -1) vty_out(vty, " core-mobile-country-code %d%s", msc->core_mcc, VTY_NEWLINE); @@ -234,10 +234,10 @@ DEFUN(cfg_net_bsc_token, DEFUN(cfg_net_bsc_ncc, cfg_net_bsc_ncc_cmd, "core-mobile-network-code <1-999>", - "Use this network code for the core network\n" "NCC value\n") + "Use this network code for the core network\n" "MNC value\n") { struct osmo_msc_data *data = osmo_msc_data(vty); - data->core_ncc = atoi(argv[0]); + data->core_mnc = atoi(argv[0]); return CMD_SUCCESS; } The same patch is attached, md5sum 2082d6b4b174236fcf3b84e548dcf2ad (in case it gets mangled by the mailer). Kind Regards, Mike

2 1

Re: bssgp test
by Jacob Erlbeck 08 Jul '15

08 Jul '15

Hi On 05.06.2015 15:15, ☎ wrote: > Could you perhaps summarize what's happening around tests/gb/gprs_bssgp_test.c:229? The line before the failing test is rc = bssgp_tx_fc_bvc(&bctx, tag, bmax, rate, bmax_ms, rate_ms, NULL, NULL); The bssgp_tx_fc_bvc function will in general call gprs_ns_sendmsg -> gprs_ns_tx -> nsip_sendmsg -> sendto. The sendto function had been "replaced" by redefining it locally which worked at least with the default ld up to ubuntu 14.04. (see Holger's replies). The system's sendto will fail in the test, since the UDP socket has not been configured. The local replacement (see gprs_bbsgp_test.c:37) will call fprintf(stderr, "MESSAGE to 0x%08x, msg length %d\n%s\n", dest_host, len, osmo_hexdump(buf, len)); so you just need to look into the stderr output to see, whether this is a linker issue. If yes, the issue will appear in more test programs, since that pattern has been used many times. If there is no way to trick the linker to use the "old" behaviour, those test programs will have to be changed to use another mocking mechanism, e.g. by using the --wrap feature (if it is supported by the linker), see openbsc:openbsc/tests/sgsn/sgsn_test.c. HTH Jacob > > The test fails for me (and another person with ubuntu 15.04 x86_64) on OSMO_ASSERT(rc >> = 0); > > This is 100% reproducible but I don't know much about Gb part so I'm not sure how to > track this down properly. Any ideas/advices? > -- - Jacob Erlbeck <jerlbeck(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Directors: Holger Freyther, Harald Welte

3 4

Re: segfault on bssgp test
by ☎ 06 Jul '15

06 Jul '15

Pardon for multiple copies, but this is really curious: gbprocy test also fails for me during OpenBSC build at gbproxy_test.c:1922 which also contains following misterious comment: /* TODO: The following breaks with the current libosmocore, enable it * again (and remove the plain expect_msg), when the msgb_bssgph patch * is integrated */ What is the status of this "msgb_bssgph patch" patch? Is there patchwork link available? I suspect it's still unmerged because swapping the lines as instructed in comment still results in crash with the latest libosmocore from git. Commenting out both lines produce sane-looking output but the test expectedly fails due to mismatch with expected output. I wonder if should comment out the 2nd line until the libosmocore patch is merged or perhaps consider merging the necessary patch? 22.05.2015 15:38, ☎ пишет: > Hi. > > Anyone else experienced this with latest libosmocore from git? > > ./testsuite.at:124: $abs_top_builddir/tests/gb/gprs_bssgp_test > stderr: > MESSAGE to 0x7f0000ff, msg length 12 > 02 00 81 01 01 82 0b 56 04 82 0b 55 > All NS-VCs for NSEI 2901 are either dead or blocked! > All NS-VCs for NSEI 2901 are either dead or blocked! > BSSGP BVCI=0 Rx BVC STATUS, cause=Protocol error - unspecified > BSSGP BVCI=1234 Rx BVC STATUS, cause=Unknown BVCI > NSEI=2901/BVCI=2989 Cannot handle PDU type 34 for unknown BVCI, NS BVCI 2989 > Unable to resolve NSEI 4660 to NS-VC! > Assert failed rc >= 0 gb/gprs_bssgp_test.c:229 > /home/user/source/libosmocore/tests/testsuite.dir/at-groups/19/test-source: line 25: > 8497 Aborted (core dumped) $abs_top_builddir/tests/gb/gprs_ > bssgp_test > -- best regards, Max, http://fairwaves.co

2 6

Random nanoBTS reboot
by Pierre Kim 28 Jun '15

28 Jun '15

Hello, I've been experiencing this bug ever since I started experimenting with OpenBSC. At first I thought it as a problem with unstable connection, but it continued to happen even after I connected to the nanoBTS directly through a switch. I used Wireshark to track down the cause and discovered that OpenBSC was responding too late to PING message from the nanoBTS. I am attaching the pcap file of the moment. This happens as soon as 1 hour from the first connection, sometimes it runs okay for 18 hours but I've never seen my nanoBTS running straight for more than 24hrs Please take a look into the log. Any help will be greatly appreciated. Tell me in case if you need more information Regards, Pierre Following is the log from openbsc console. Sat Jun 27 03:24:43 2015 <0004> bsc_init.c:286 bootstrapping RSL for BTS/TRX (0/0) on ARFCN 520 using MCC=450 MNC=9 LAC=1 CID=0 BSIC=63 TSC=7 Sat Jun 27 08:17:39 2015 <001a> ipa.c:246 Cannot send PING message. Reason: Broken pipe Sat Jun 27 08:17:39 2015 <001a> input/ipaccess.c:110 Unexpected return from ipa_ccm_rcvmsg_base (ret=-32) Sat Jun 27 08:17:39 2015 <001a> input/ipaccess.c:236 Sign link vanished, dead socket Sat Jun 27 08:17:39 2015 <001a> input/ipaccess.c:69 Forcing socket shutdown with no signal link set Sat Jun 27 08:20:51 2015 <001a> input/ipa.c:265 accept()ed new link from 192.168.28.31 to port 3002 Sat Jun 27 08:21:08 2015 <001a> input/ipa.c:265 accept()ed new link from 192.168.28.31 to port 3003 Sat Jun 27 08:21:11 2015 <0004> bsc_init.c:286 bootstrapping RSL for BTS/TRX (0/0) on ARFCN 520 using MCC=450 MNC=9 LAC=1 CID=0 BSIC=63 TSC=7 and sometimes without the error from ipa_ccm_rcvmsg_base Sun Jun 28 09:17:40 2015 <001a> input/ipaccess.c:236 Sign link vanished, dead socket Sun Jun 28 09:17:40 2015 <001a> input/ipaccess.c:69 Forcing socket shutdown with no signal link set Sun Jun 28 09:20:39 2015 <001a> input/ipa.c:265 accept()ed new link from 192.168.28.31 to port 3002 Sun Jun 28 09:20:56 2015 <001a> input/ipa.c:265 accept()ed new link from 192.168.28.31 to port 3003 Sun Jun 28 09:20:59 2015 <0004> bsc_init.c:286 bootstrapping RSL for BTS/TRX (0/0) on ARFCN 520 using MCC=450 MNC=9 LAC=1 CID=0 BSIC=63 TSC=7

1 0