OpenBSC April 2017

openbsc@lists.osmocom.org

26 participants
30 discussions

Video Recordings of OsmoCon 2017
by Harald Welte 22 Dec '25

22 Dec '25

Hi all, the Osmocom Conference 2017 last week was an overwhelming success. We received lots of positive feedback from all sides. Thanks to all the speakers, to the attendees as well as to the anonymous sponsor of the travel grant funds. It is my great pleasure that due to the great support by C3VOC (The CCC Video Operation Center), we have full recordings of all talks given at OsmoCon 2017. You can find the videos on the C3VOC site at https://media.ccc.de/search/?q=osmocon They are also linked individually from the OsmoCon 2017 homepage at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoCon2017 I hope the video recordings will be of help for everyone who could not make it to the event in person. We will also be collecting the slides and put them up on the wiki during the next few days. Please don't hesitate to raise any feedback and/or questions. Technical feedback/questions regarding Osmocom software / projects should be addressed to the appropriate mailing lists, such as openbsc(a)lists.osmocom.org. Feedback to the organizers should be sent to osmocon2017(a)sysmocom.de. Looking forward to the next OsmoCon, which we'll expect to be spanning ore than just a single day. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

Splitting out M3UA and MTP3 out of Open BSC into a separate library
by Arran Cudbard-Bell 15 Dec '25

15 Dec '25

Hi, Developing a module for FreeRADIUS to support EAP-SIM and EAP-AKA authentication against a HLR. The HLR we were targeting only supported a SCTP/M3UA/SCCP/TCAP/MAP stack, so we couldn't use SUA. Ripping the M3UA/MTP3 code out of OpenBSC worked surprisingly well. We ended up running the event loop in a separate thread to work around the threading issues. Unfortunately the HLR implements the ANSI variant of everything, whereas OpenBSC and supporting libraries seem to have been written to be compatible with the ITU standards. ...but the differences are fairly minor at MTP3 and SCCP layers, and i've started work on a patchset for libosmo-sccp. https://gerrit.osmocom.org/#/c/73/ Anyway, trying to gauge interest in splitting those layers out of Open BSC into a separate library, would be happy to take on M2UA as well for consistency. It would almost certainly get more projects using the code. There's very little out there even in Perl land for working with SS7. Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

8 8

GPRS - local and foreign TLLIs
by Luca Melette 18 Nov '25

18 Nov '25

Hello everybody, after setting up a nanoBTS with OpenBSC/SGSN/GGSN, I had some troubles trying to connect my smartphone to the GPRS cell. Investigating the BTS-to-SGSN traffic, I saw that the frames sent by the SGSN were all marked with the same N(U) value (at LLC layer), the value was 0. With some debug, I found that the there was a mismatch in the TLLI storage, used to keep the status of attached terminals. The mentioned code is contained in gprs_llc.c, involving LL Entity functions and gprs_llc_tx_ui(). /* look-up or create the LL Entity for this (TLLI, SAPI) tuple */ lle = lle_by_tlli_sapi(msgb_tlli(msg), sapi); if (!lle) { struct gprs_llc_llme *llme; LOGP(DLLC, LOGL_ERROR, "LLC TX: unknown TLLI 0x%08x, " "creating LLME on the fly\n", msgb_tlli(msg)); llme = llme_alloc(msgb_tlli(msg)); lle = &llme->lle[sapi]; } The TX function uses the previously received TLLI to lookup for the LLE. The lle_by_tlli_sapi() performs the search, but preliminary it applies a foreign2local TLLI conversion to ensure to have a local one. Since no valid entry for the searched TLLI is found, a new one is created. And the problem is here. The new entry has the foreign TLLI. Next time the lookup fails again, and a new entry is created. This way, the counter N(U) is always reset, and the mobile do not recognize the message sequence and no attach is possible. My question is about foreign and local TLLIs. I patched the lookup, avoiding the conversion, so that the LLE is found and everything works fine... but... What is the sense of the conversion? Should the TLLI be always stored as a local one? Can this problem be solved with another foreign2local while allocating new entries? Actually, my problem has been solved with that workaround. But I'm curious to know what is the right way. Hope somebody can answer :) Thanks. Cheers, LM

4 5

Pysim error: SW match failed
by Martin Nagy 16 Aug '25

16 Aug '25

Hi all, After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error: /pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto Insert card now (or CTRL-C to cancel) Autodetected card type fakemagicsim Generated card parameters : > Name : 26C3 > SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000 > ICCID : 8949262427518313026 > MCC/MNC : 262/42 > IMSI : 262422461512085 > Ki : 7b74741a1ee14337ec23f9ab92a13648 > OPC : ccd867d60797d8d45354a51b3ef568ff Programming ... Traceback (most recent call last): File "./pySim-prog.py", line 530, in <module> card.program(cp) File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3)) File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary return self._tp.send_apdu_checksw(pdu) File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1])) RuntimeError: SW match failed ! Expected 9000 and got 9804. I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code. Thanks a lot and best regards Martin

3 3

Re: Help with sccp library
by mosbah abdelkader 07 Jul '25

07 Jul '25

> I don't understand. This callback will be called with data you need to write > to the network. In case of MTP Level3 you will need to wrap that around the > msgb you got. I means: is the interaction with mtp3 layer implemented (is sending sccp data by mtp3 implemented by the library?)? Also, what about the reception of data from mtp3 layer. is that implemented in the sccp lib. I am asking these questions because I see the code of mtp3 in the lib but no significant call is present in the sccp part of the lib. Thank you for your help.

4 3

dynamic traffic channels
by Neels Hofmeyr 20 May '25

20 May '25

On Tue, Jun 28, 2016 at 10:05:28AM +0200, Harald Welte wrote: > [translated from german] > is it certain that we switch a channel to PDCH only when > gprs mode != none? A TS can be GSM_PCHAN_TCH_F_PDCH; those are the only ones for which we send a PDCH ACT message. We send a PDCH ACT message - during init (CHANNEL OML's state changed to enabled -> send PDCH ACT), - and upon channel release ack when pchan == GSM_PCHAN_TCH_F_PDCH. So the question is, when we receive a channel release ack, could that be the PDCH release and we switch PDCH right back on by accident? No, because we only receive a chan rel ack when the *TCH/F* is being released. That is because the PDCH release is initiated "internally" from the PDCH DEACT, and thus this condition in common/rsl.c rsl_tx_rf_rel_ack() catches on, which existed before dyn PDCH: if (lchan->rel_act_kind != LCHAN_REL_ACT_RSL) { LOGP(DRSL, LOGL_NOTICE, "%s not sending REL ACK\n", gsm_lchan_name(lchan)); return 0; } In rsl_rx_rf_chan_rel() the rel_act_kind is set to LCHAN_REL_ACT_RSL, but not in the rsl_rx_dyn_pdch(). This is analogous to the ip.access way -- the ip.access nanobts replies to a PDCH DEACT with a PDCH DEACT ACK and doesn't send a separate channel release ack. Maybe we could set rel_act_kind to some new LCHAN_REL_ACT_IPAC_DYN_PDCH for clarity? (But we shouldn't actually send a release ack, to stay compatible.) Even though it works as-is, we should indeed add another flag check: - We do check the flags that no ACT/DEACT is already pending; - And we do send a PDCH DEACT only if ts->flags & TS_F_PDCH_ACTIVE; - But we would send a PDCH ACT despite ts->flags & TS_F_PDCH_ACTIVE. This should never happen, but it would make sense to ensure that. ~Neels

3 5

nano3G Access Points Authorization
by root＠雪碧 08 May '17

08 May '17

Hello, I want to configure the nano3G Access Points through 8089 port ( nano3G AP’s configuration web page )，but i don't konw the username and password . what should i do? http://www.ipaccess.com/uploads/wysiwyg_editor/files/2017/S8_S16-Datasheet-… Best regards.

5 6

autoreconf: "header not found" in generated source
by Vadim Yanitskiy 02 May '17

02 May '17

Hi all, I am currently working on https://gerrit.osmocom.org/#/c/2075/ The problem is that the conv.h should be shared between several source code files, and it works fine for all of them, excepting the gsm0503_test_vectors.c, which will be generated automatically by the utils/conv_gen.py in the next commit. The header is currently included this way: #include "conv.h" And building in separate directory fails: CC conv/gsm0503_test_vectors.o conv/gsm0503_test_vectors.c:25:18: fatal error: conv.h: No such file or directory #include "conv.h" ^ compilation terminated. This is why I tried to move this header to the global include directory. According to received feedback from Harald and Sylvain, this approach isn't good and I need to find another one. Any suggestions how to make the conv/gsm0503_test_vectors.c able "to see" the conv.h header? With best regards, Vadim Yanitskiy.

4 8

osmo-bts-trx error / osmo-trx illegal instruction (core dumped)
by Ron 02 May '17

02 May '17

Hi All, Upon running "osmo-bts-trx -c osmo-bts.cfg” while "osmo-nitb -C -c openbsc.conf -T -P -m” and “osmo-trx” are running, the following error shows and also shuts down “osmo-trx” osmo-bts-trx error: root@entropy:~/osmocom_files# osmo-bts-trx -c osmo-bts.cfg ((*)) | / \ OsmoBTS <0017> control_if.c:725 CTRL at 127.0.0.1 4238 <0010> telnet_interface.c:95 telnet at 127.0.0.1 4241 <0012> input/ipaccess.c:885 enabling ipaccess BTS mode, OML connecting to 192.168.1.129:3002 <000b> trx_if.c:584 Open transceiver for phy0.0 <0012> input/ipa.c:129 connection done. <0012> input/ipaccess.c:706 received ID get <0001> oml.c:475 Ignoring T200[0] (150 ms) as sent by BSC due to suspected LAPDm bug! <0001> oml.c:475 Ignoring T200[1] (180 ms) as sent by BSC due to suspected LAPDm bug! <0001> oml.c:475 Ignoring T200[2] (180 ms) as sent by BSC due to suspected LAPDm bug! <0001> oml.c:475 Ignoring T200[3] (1680 ms) as sent by BSC due to suspected LAPDm bug! <0001> oml.c:475 Ignoring T200[4] (520 ms) as sent by BSC due to suspected LAPDm bug! <0001> oml.c:475 Ignoring T200[5] (165 ms) as sent by BSC due to suspected LAPDm bug! <0001> oml.c:475 Ignoring T200[6] (1680 ms) as sent by BSC due to suspected LAPDm bug! <0001> oml.c:844 ADM state already was Unlocked <0012> input/ipa.c:129 connection done. <0012> input/ipaccess.c:706 received ID get <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <0009> pcu_sock.c:651 PCU socket not connected, dropping message <000b> trx_if.c:187 No response from transceiver for phy0.0 <0009> pcu_sock.c:848 PCU socket connected to external PCU <0001> oml.c:72 Reporting FAILURE to BSC: 0.3.20170425 <0000> rsl.c:624 (bts=0,trx=0,ts=4,ss=0) not sending CHAN ACT ACK <0000> rsl.c:624 (bts=0,trx=0,ts=5,ss=0) not sending CHAN ACT ACK <0000> rsl.c:624 (bts=0,trx=0,ts=6,ss=0) not sending CHAN ACT ACK <0000> rsl.c:624 (bts=0,trx=0,ts=7,ss=0) not sending CHAN ACT ACK <000b> trx_if.c:187 No response from transceiver for phy0.0 <000b> trx_if.c:187 No response from transceiver for phy0.0 <000b> trx_if.c:187 No response from transceiver for phy0.0 <000b> trx_if.c:187 No response from transceiver for phy0.0 <000b> trx_if.c:187 No response from transceiver for phy0.0 <000b> trx_if.c:187 No response from transceiver for phy0.0 <000b> trx_if.c:187 No response from transceiver for phy0.0 <000b> trx_if.c:187 No response from transceiver for phy0.0 <0007> l1sap.c:413 Invalid condition detected: Frame difference is > 1! <0001> bts.c:208 Shutting down BTS 0, Reason No clock from osmo-trx <000b> trx_if.c:203 CTRL NOHANDOVER ignored: No clock from transceiver, please fix! <000b> trx_if.c:203 CTRL NOHANDOVER ignored: No clock from transceiver, please fix! <0000> rsl.c:528 (bts=0,trx=0,ts=4,ss=0) not sending REL ACK <000b> trx_if.c:203 CTRL NOHANDOVER ignored: No clock from transceiver, please fix! <000b> trx_if.c:203 CTRL NOHANDOVER ignored: No clock from transceiver, please fix! <0000> rsl.c:528 (bts=0,trx=0,ts=5,ss=0) not sending REL ACK <000b> trx_if.c:203 CTRL NOHANDOVER ignored: No clock from transceiver, please fix! <000b> trx_if.c:203 CTRL NOHANDOVER ignored: No clock from transceiver, please fix! <0000> rsl.c:528 (bts=0,trx=0,ts=6,ss=0) not sending REL ACK <000b> trx_if.c:203 CTRL NOHANDOVER ignored: No clock from transceiver, please fix! <000b> trx_if.c:203 CTRL NOHANDOVER ignored: No clock from transceiver, please fix! <0000> rsl.c:528 (bts=0,trx=0,ts=7,ss=0) not sending REL ACK Shutdown timer expired osmo-trx logs: NOTICE 139966735525632 16:51:01.4 Transceiver.cpp:794:driveControl: Changing TSC from 0 to 7 NOTICE 139966735525632 16:51:01.4 Transceiver.cpp:243:start: Starting the transceiver Illegal instruction (core dumped) osmo-nitb logs: Thu Apr 27 16:50:43 2017 <001e> input/ipa.c:263 accept()ed new link from 192.168.1.129 to port 3002 Thu Apr 27 16:50:43 2017 <001e> input/ipa.c:263 accept()ed new link from 192.168.1.129 to port 3003 Thu Apr 27 16:50:43 2017 <0004> bsc_init.c:288 bootstrapping RSL for BTS/TRX (0/0) on ARFCN 885 using MCC=1 MNC=1 LAC=1 CID=1 BSIC=63 BTS 0 reported connected PCU version 0.3.20170425 Thu Apr 27 16:51:06 2017 <001e> input/ipaccess.c:241 Sign link vanished, dead socket Thu Apr 27 16:51:06 2017 <001e> input/ipaccess.c:69 Forcing socket shutdown with no signal link set Thu Apr 27 16:51:06 2017 <0020> bsc_init.c:341 Lost some E1 TEI link: 1 0x7f5f48820070 Thu Apr 27 16:51:06 2017 <0020> bsc_init.c:341 Lost some E1 TEI link: 2 0x7f5f48820070 ^Csignal 2 received Also attached the configuration files used. What seems causes the issue? OS: Ubuntu 16.04 SDR: B210 Best Regards, Ron Rylan B. Menez Operations Manager +63 998 989 7973 +63 2 893 1781 [cid:bbb8aa9b-ea08-431b-bb55-8cc77a18e169@apcprd06.prod.outlook.com] Singapore * Philippines Products: Gridloc*Intelle*Hype*Lighthouse*Telco Services*Software Development This email (including any attachment to it) is confidential and intended only for the use of the individual named above and may contain information that is privileged. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this email is strictly prohibited. If you have received this email in error, please notify us immediately by return email or telephone and destroy the original message (including any attachment to it). Thank you.

5 13

nano3G <-> sip-connector <-> asterisk?
by Andreas Mueller 02 May '17

02 May '17

Hello, is it possible to connect the openbsc from the vlr_3G Branch with sip-connector to asterisk as described on https://osmocom.org/projects/osmo-sip-conector/wiki/Osmo-sip-connector, or are there changes in the vlr_3G Branch that makes this impossible? When trying to set this up I was able to call an UMTS-Phone which was connected to the nano3G from a softphone using jitsi, and the UMTS-Phone was ringing, but it was not possible to answer the call. I have only limited experiences with asterisk and so I am for example unsure about what voice-codecs to use, if my asterisk-config is correct,... and so I would like to know if it should work in principle and I have to find the correct configuration. have a nice weekend, Andreas

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC April 2017