OpenBSC June 2017

openbsc@lists.osmocom.org

23 participants
46 discussions

Video Recordings of OsmoCon 2017
by Harald Welte 09 Feb '26

09 Feb '26

Hi all, the Osmocom Conference 2017 last week was an overwhelming success. We received lots of positive feedback from all sides. Thanks to all the speakers, to the attendees as well as to the anonymous sponsor of the travel grant funds. It is my great pleasure that due to the great support by C3VOC (The CCC Video Operation Center), we have full recordings of all talks given at OsmoCon 2017. You can find the videos on the C3VOC site at https://media.ccc.de/search/?q=osmocon They are also linked individually from the OsmoCon 2017 homepage at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoCon2017 I hope the video recordings will be of help for everyone who could not make it to the event in person. We will also be collecting the slides and put them up on the wiki during the next few days. Please don't hesitate to raise any feedback and/or questions. Technical feedback/questions regarding Osmocom software / projects should be addressed to the appropriate mailing lists, such as openbsc(a)lists.osmocom.org. Feedback to the organizers should be sent to osmocon2017(a)sysmocom.de. Looking forward to the next OsmoCon, which we'll expect to be spanning ore than just a single day. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

3 2

GPRS - local and foreign TLLIs
by Luca Melette 04 Feb '26

04 Feb '26

Hello everybody, after setting up a nanoBTS with OpenBSC/SGSN/GGSN, I had some troubles trying to connect my smartphone to the GPRS cell. Investigating the BTS-to-SGSN traffic, I saw that the frames sent by the SGSN were all marked with the same N(U) value (at LLC layer), the value was 0. With some debug, I found that the there was a mismatch in the TLLI storage, used to keep the status of attached terminals. The mentioned code is contained in gprs_llc.c, involving LL Entity functions and gprs_llc_tx_ui(). /* look-up or create the LL Entity for this (TLLI, SAPI) tuple */ lle = lle_by_tlli_sapi(msgb_tlli(msg), sapi); if (!lle) { struct gprs_llc_llme *llme; LOGP(DLLC, LOGL_ERROR, "LLC TX: unknown TLLI 0x%08x, " "creating LLME on the fly\n", msgb_tlli(msg)); llme = llme_alloc(msgb_tlli(msg)); lle = &llme->lle[sapi]; } The TX function uses the previously received TLLI to lookup for the LLE. The lle_by_tlli_sapi() performs the search, but preliminary it applies a foreign2local TLLI conversion to ensure to have a local one. Since no valid entry for the searched TLLI is found, a new one is created. And the problem is here. The new entry has the foreign TLLI. Next time the lookup fails again, and a new entry is created. This way, the counter N(U) is always reset, and the mobile do not recognize the message sequence and no attach is possible. My question is about foreign and local TLLIs. I patched the lookup, avoiding the conversion, so that the LLE is found and everything works fine... but... What is the sense of the conversion? Should the TLLI be always stored as a local one? Can this problem be solved with another foreign2local while allocating new entries? Actually, my problem has been solved with that workaround. But I'm curious to know what is the right way. Hope somebody can answer :) Thanks. Cheers, LM

5 6

OsmoNITB timeslots configuration and UmTRX
by Родион Гадыршин 27 Jan '26

27 Jan '26

Hello, list. I have umtrx v2.1 and I have already built GSM and GPRS components. Now I want to know which way of configuring timeslots in osmobsc.cfn is the best. I want GPRS, calls and SMS work. My current configuration is: timeslot 0 phys_chan_config CCCH+SDCCH4 hopping enabled 0 timeslot 1 phys_chan_config SDCCH8 hopping enabled 0 timeslot 2 phys_chan_config TCH/F hopping enabled 0 timeslot 3 phys_chan_config TCH/F hopping enabled 0 timeslot 4 phys_chan_config PDCH hopping enabled 0 timeslot 5 phys_chan_config PDCH hopping enabled 0 timeslot 6 phys_chan_config PDCH hopping enabled 0 timeslot 7 phys_chan_config PDCH hopping enabled 0 Is there a better way to configure? Maybe better use TCH/F_TCH/H_PDCH, but I have heard, that TCH/F is currently not working in dynamic configurations - only TCH/H does. And there is no only TCH/H_PDCH mode. So, could you please give me an advice?

3 2

Splitting out M3UA and MTP3 out of Open BSC into a separate library
by Arran Cudbard-Bell 15 Dec '25

15 Dec '25

Hi, Developing a module for FreeRADIUS to support EAP-SIM and EAP-AKA authentication against a HLR. The HLR we were targeting only supported a SCTP/M3UA/SCCP/TCAP/MAP stack, so we couldn't use SUA. Ripping the M3UA/MTP3 code out of OpenBSC worked surprisingly well. We ended up running the event loop in a separate thread to work around the threading issues. Unfortunately the HLR implements the ANSI variant of everything, whereas OpenBSC and supporting libraries seem to have been written to be compatible with the ITU standards. ...but the differences are fairly minor at MTP3 and SCCP layers, and i've started work on a patchset for libosmo-sccp. https://gerrit.osmocom.org/#/c/73/ Anyway, trying to gauge interest in splitting those layers out of Open BSC into a separate library, would be happy to take on M2UA as well for consistency. It would almost certainly get more projects using the code. There's very little out there even in Perl land for working with SS7. Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

8 8

Pysim error: SW match failed
by Martin Nagy 16 Aug '25

16 Aug '25

Hi all, After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error: /pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto Insert card now (or CTRL-C to cancel) Autodetected card type fakemagicsim Generated card parameters : > Name : 26C3 > SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000 > ICCID : 8949262427518313026 > MCC/MNC : 262/42 > IMSI : 262422461512085 > Ki : 7b74741a1ee14337ec23f9ab92a13648 > OPC : ccd867d60797d8d45354a51b3ef568ff Programming ... Traceback (most recent call last): File "./pySim-prog.py", line 530, in <module> card.program(cp) File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3)) File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary return self._tp.send_apdu_checksw(pdu) File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1])) RuntimeError: SW match failed ! Expected 9000 and got 9804. I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code. Thanks a lot and best regards Martin

3 3

Re: Help with sccp library
by mosbah abdelkader 07 Jul '25

07 Jul '25

> I don't understand. This callback will be called with data you need to write > to the network. In case of MTP Level3 you will need to wrap that around the > msgb you got. I means: is the interaction with mtp3 layer implemented (is sending sccp data by mtp3 implemented by the library?)? Also, what about the reception of data from mtp3 layer. is that implemented in the sccp lib. I am asking these questions because I see the code of mtp3 in the lib but no significant call is present in the sccp part of the lib. Thank you for your help.

4 3

dynamic traffic channels
by Neels Hofmeyr 20 May '25

20 May '25

On Tue, Jun 28, 2016 at 10:05:28AM +0200, Harald Welte wrote: > [translated from german] > is it certain that we switch a channel to PDCH only when > gprs mode != none? A TS can be GSM_PCHAN_TCH_F_PDCH; those are the only ones for which we send a PDCH ACT message. We send a PDCH ACT message - during init (CHANNEL OML's state changed to enabled -> send PDCH ACT), - and upon channel release ack when pchan == GSM_PCHAN_TCH_F_PDCH. So the question is, when we receive a channel release ack, could that be the PDCH release and we switch PDCH right back on by accident? No, because we only receive a chan rel ack when the *TCH/F* is being released. That is because the PDCH release is initiated "internally" from the PDCH DEACT, and thus this condition in common/rsl.c rsl_tx_rf_rel_ack() catches on, which existed before dyn PDCH: if (lchan->rel_act_kind != LCHAN_REL_ACT_RSL) { LOGP(DRSL, LOGL_NOTICE, "%s not sending REL ACK\n", gsm_lchan_name(lchan)); return 0; } In rsl_rx_rf_chan_rel() the rel_act_kind is set to LCHAN_REL_ACT_RSL, but not in the rsl_rx_dyn_pdch(). This is analogous to the ip.access way -- the ip.access nanobts replies to a PDCH DEACT with a PDCH DEACT ACK and doesn't send a separate channel release ack. Maybe we could set rel_act_kind to some new LCHAN_REL_ACT_IPAC_DYN_PDCH for clarity? (But we shouldn't actually send a release ack, to stay compatible.) Even though it works as-is, we should indeed add another flag check: - We do check the flags that no ACT/DEACT is already pending; - And we do send a PDCH DEACT only if ts->flags & TS_F_PDCH_ACTIVE; - But we would send a PDCH ACT despite ts->flags & TS_F_PDCH_ACTIVE. This should never happen, but it would make sense to ensure that. ~Neels

3 5

osmo-bts-trx fails frequently on osmo-gsm-tester
by Neels Hofmeyr 10 Oct '17

10 Oct '17

We're still having massive stability problems with osmo-bts-trx on the osmo-gsm-tester. I have run a tcpdump on the ntp port for the past days, and nothing is doing ntp besides the actual ntp service. Today I started ntp while an osmo-bts-trx run was active and what do you know, the osmo-bts-trx process exits immediately. I think this is bad, osmo-bts-trx shouldn't use wall clock time for precise timing needs. Besides that, I have no idea what could cause the clock skews, except maybe that the CPU or the USB are not fast enough?? I'm wondering, is there still such a thing as a separate linux realtime kernel? We will soon take to productive use another main unit which will be a cleanly installed OS. If we see the same problems on that system and can't find a software fix, we may need to reconsider the tester for osmo-bts-trx... ~N

8 26

catch-22 VTY error
by Neels Hofmeyr 07 Sep '17

07 Sep '17

I'd like to share a VTY config error analysis that has a tricky solution: I started osmo-bsc -c osmo-bsc.cfg with, according to openbsc/doc/examples/osmo-bsc: net [...] bts 0 [...] periodic location update 30 trx 0 [...] and get this error: There is no such command. Error occurred during reading below line: trx 0 what? 'net / bts / trx' is no command?? Solution: I'm on the vlr_3G branch (incorporating 2G via A-interface) and on this branch, I've actually moved the 'periodic location update N' command a level up, from net / bts / periodic to net / periodic (background: assuming that OsmoMSC does not have individual BTS info, we moved some settings up to network level; whether this makes sense for osmo-bsc is a different question, it's just what happens to be on the vlr_3G branch now). So there is no net / bts / periodic command. Why do I get an error for net / bts / trx instead? two reasons: 1. 'trx 0' was the line following the 'periodic' command, 2. since 'periodic' exists one level above, the vty code goes to the parent node automatically. About 2: we tend to indent our VTY config files, but in fact the indentation has no effect whatsoever, it is just eye candy (very useful eye candy). The code in question: If a command does not exist, try 'vty_go_parent()' and see if the command exists there. That's what allows us to omit 'exit' in our config files to go to the parent node explicitly: libosmocore/src/vty/command.c: int config_from_file(struct vty *vty, FILE * fp) { int ret; vector vline; while (fgets(vty->buf, VTY_BUFSIZ, fp)) { vline = cmd_make_strvec(vty->buf); /* In case of comment line */ if (vline == NULL) continue; /* Execute configuration command : this is strict match */ ret = cmd_execute_command_strict(vline, vty, NULL); /* Try again with setting node to CONFIG_NODE */ while (ret != CMD_SUCCESS && ret != CMD_WARNING && ret != CMD_ERR_NOTHING_TODO && is_config_child(vty)) { HERE -----> vty_go_parent(vty); ret = cmd_execute_command_strict(vline, vty, NULL); } cmd_free_strvec(vline); if (ret != CMD_SUCCESS && ret != CMD_WARNING && ret != CMD_ERR_NOTHING_TODO) return ret; } return CMD_SUCCESS; } In this case the 'periodic...' command does in fact now exist one level above, so the vty_go_parent() is successful and running that command works. But, the vty config parsing then sits above on the 'network' level, is no longer in 'bts 0' and hence refuses to accept the following bts-level command, in this case 'trx 0'. Confusing! So it's not a bug, it's a feature. But it's a feature we might see quite often if we move the 'periodic' command up to network level and users attempt to use their old config files. Same goes for the 'timezone' command, BTW, so we might want to rename commands, or re-consider moving commands one level up in the first place. Maybe we should leave backward compat catchers in place that print a warning. ~N -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

2 4

Creating GSM Users Association (GSMUA)
by Mychaela Falconia 06 Jul '17

06 Jul '17

Hello FreeCalypso and Osmocom communities, I am in the process of creating an informal organisation representing the interests of those members of the GSM universe whose interests are not represented by GSMA etc, and I am inviting you to join me in this venture. I propose that we name our informal organisation GSMUA, standing for GSM Users Association, and my vision for this GSMUA is to be a counter-body (antibody?) to the official GSMA. I just registered the gsmua.org domain name, but there is no website or mailing list set up yet. If someone from the Osmocom camp would like to host the server infrastructure for gsmua.org, I will happily point the DNS to you, otherwise the FreeCalypso family can host it on our server. My vision for GSMUA is to represent the interests of GSM end users (empowered end users who wish to fully own and control all aspects of their user equipment while operating on public mobile networks in a fully spec-compliant manner), small boutique manufacturers of GSM devices (both MS/user equipment and network infrastructure), small community network operators and others whose interests are not represented by GSMA etc, especially in cases where our interests are in direct conflict with the interests of big players such as giant device manufacturers, giant commercial network operators and governments. A key goal of GSMUA is to be project-neutral, that is, every person and every small company belonging to any of the categories listed above (empowered end user, small boutique device manufacturer, small community network operator etc) should be fully welcome regardless of which specific project they are associated with. As of today there are at least two different projects offering GSM MS implementations (OsmocomBB and FreeCalypso) and at least two different projects offering network-side GSM implementations (Osmocom and OpenBTS), and I hope that this number of available alternatives will continue to grow: freedom of choice is always a good thing. But at the present time there exists no neutral soil on which members of different projects with a common interest (GSM networks and devices serving the interests of end users rather than big corporations and governments) and a common enemy (just named) can meet, and this lack of neutral meeting ground is the problem which GSMUA is meant to solve. I also have one practical application for GSMUA in mind already: to manage and legitimize recycling of wasted IMEI number ranges. By the official rules of GSMA etc each different *type* of GSM mobile equipment requires a different TAC, i.e., a range of at least 1 million IMEI numbers. So if a small boutique GSM device manufacturer makes a boutique MS device of which no more than 100 units will ever be made, 999900 IMEI numbers have to be wasted by the official rules. While I don't know of any manufacturer who got a range of 1 million IMEIs and only made 100 devices, we do have examples like Openmoko GTA01/02 and Pirelli DP-L10. In the case of Openmoko GTA02 I've been told that about 15 thousand units were made in total; in the case of Pirelli DP-L10 it appears that the total number produced was somewhere under 100 thousand. In each case a full range of 1 million IMEIs was allocated, and at least 900 thousand numbers out of each range are currently unused and wasted. If a small boutique manufacturer wishes to offer a boutique GSM MS product to the general public and wishes to ship each unit with a world-unique IMEI that stands a good chance of being accepted as valid by common GSM networks, and the product in question does not qualify for IMEI allocation by the official rules (e.g., the product is a development board specifically intended for users to run their own firmware and connect to live public networks with it, taking full personal responsibility for their actions) - the situation I found myself in with my GSM MS development board - I feel that the small boutique manuf in question should be empowered to squat on a small subrange of someone else's IMEI range if it is known beyond reasonable doubt to be wasted and unused. However, this recycling of wasted IMEI number ranges could be better organized and given at least some aura of semi-legitimacy if there were a community body set up to manage it, and this is where my proposed GSMUA can come in. Once we get our GSMUA up and running and assign a group of volunteers to be IMEI recycling managers, any small GSM or 3G+ device manufacturer who needs a small range of IMEI numbers will be able to request one from GSMUA, and we will allocate and assign these small subranges out of whatever wasted range we decide to squat on, ensuring that each requestor gets a different subrange. So these are my ideas, and I would like to see them turn into reality. We are going to need a simple website and a community mailing list at gsmua.org, and for the IMEI recycling service we will need a small group of volunteers to serve as its managers - I and Das Signal from FreeCalypso will be happy to serve on that panel, but it would be nice to also have someone from the Osmocom camp for better neutrality. Bright Blessings, Mychaela Falconia, Mother of FreeCalypso

5 6

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC June 2017