OpenBSC June 2024

openbsc@lists.osmocom.org

8 participants
20 discussions

GPRS - local and foreign TLLIs
by Luca Melette 18 Nov '25

18 Nov '25

Hello everybody, after setting up a nanoBTS with OpenBSC/SGSN/GGSN, I had some troubles trying to connect my smartphone to the GPRS cell. Investigating the BTS-to-SGSN traffic, I saw that the frames sent by the SGSN were all marked with the same N(U) value (at LLC layer), the value was 0. With some debug, I found that the there was a mismatch in the TLLI storage, used to keep the status of attached terminals. The mentioned code is contained in gprs_llc.c, involving LL Entity functions and gprs_llc_tx_ui(). /* look-up or create the LL Entity for this (TLLI, SAPI) tuple */ lle = lle_by_tlli_sapi(msgb_tlli(msg), sapi); if (!lle) { struct gprs_llc_llme *llme; LOGP(DLLC, LOGL_ERROR, "LLC TX: unknown TLLI 0x%08x, " "creating LLME on the fly\n", msgb_tlli(msg)); llme = llme_alloc(msgb_tlli(msg)); lle = &llme->lle[sapi]; } The TX function uses the previously received TLLI to lookup for the LLE. The lle_by_tlli_sapi() performs the search, but preliminary it applies a foreign2local TLLI conversion to ensure to have a local one. Since no valid entry for the searched TLLI is found, a new one is created. And the problem is here. The new entry has the foreign TLLI. Next time the lookup fails again, and a new entry is created. This way, the counter N(U) is always reset, and the mobile do not recognize the message sequence and no attach is possible. My question is about foreign and local TLLIs. I patched the lookup, avoiding the conversion, so that the LLE is found and everything works fine... but... What is the sense of the conversion? Should the TLLI be always stored as a local one? Can this problem be solved with another foreign2local while allocating new entries? Actually, my problem has been solved with that workaround. But I'm curious to know what is the right way. Hope somebody can answer :) Thanks. Cheers, LM

4 5

Pysim error: SW match failed
by Martin Nagy 16 Aug '25

16 Aug '25

Hi all, After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error: /pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto Insert card now (or CTRL-C to cancel) Autodetected card type fakemagicsim Generated card parameters : > Name : 26C3 > SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000 > ICCID : 8949262427518313026 > MCC/MNC : 262/42 > IMSI : 262422461512085 > Ki : 7b74741a1ee14337ec23f9ab92a13648 > OPC : ccd867d60797d8d45354a51b3ef568ff Programming ... Traceback (most recent call last): File "./pySim-prog.py", line 530, in <module> card.program(cp) File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3)) File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary return self._tp.send_apdu_checksw(pdu) File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1])) RuntimeError: SW match failed ! Expected 9000 and got 9804. I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code. Thanks a lot and best regards Martin

3 3

pycrate repo update
by benoit michau 22 Jul '25

22 Jul '25

Dear osmocom developpers, This is just to let you know that the Python library pycrate has a new home : https://github.com/pycrate-org/pycrate. The packages on Pypi are now feeded from there. This library can be used in many cases dealing with mobile signalling. I wanted to let you know, as even if I am not aware of any osmocom projects depending on it, some of you may use the library from time to time, or could have local applications depending on it. Best Regards Benoit

2 1

Re: Help with sccp library
by mosbah abdelkader 07 Jul '25

07 Jul '25

> I don't understand. This callback will be called with data you need to write > to the network. In case of MTP Level3 you will need to wrap that around the > msgb you got. I means: is the interaction with mtp3 layer implemented (is sending sccp data by mtp3 implemented by the library?)? Also, what about the reception of data from mtp3 layer. is that implemented in the sccp lib. I am asking these questions because I see the code of mtp3 in the lib but no significant call is present in the sccp part of the lib. Thank you for your help.

4 3

dynamic traffic channels
by Neels Hofmeyr 20 May '25

20 May '25

On Tue, Jun 28, 2016 at 10:05:28AM +0200, Harald Welte wrote: > [translated from german] > is it certain that we switch a channel to PDCH only when > gprs mode != none? A TS can be GSM_PCHAN_TCH_F_PDCH; those are the only ones for which we send a PDCH ACT message. We send a PDCH ACT message - during init (CHANNEL OML's state changed to enabled -> send PDCH ACT), - and upon channel release ack when pchan == GSM_PCHAN_TCH_F_PDCH. So the question is, when we receive a channel release ack, could that be the PDCH release and we switch PDCH right back on by accident? No, because we only receive a chan rel ack when the *TCH/F* is being released. That is because the PDCH release is initiated "internally" from the PDCH DEACT, and thus this condition in common/rsl.c rsl_tx_rf_rel_ack() catches on, which existed before dyn PDCH: if (lchan->rel_act_kind != LCHAN_REL_ACT_RSL) { LOGP(DRSL, LOGL_NOTICE, "%s not sending REL ACK\n", gsm_lchan_name(lchan)); return 0; } In rsl_rx_rf_chan_rel() the rel_act_kind is set to LCHAN_REL_ACT_RSL, but not in the rsl_rx_dyn_pdch(). This is analogous to the ip.access way -- the ip.access nanobts replies to a PDCH DEACT with a PDCH DEACT ACK and doesn't send a separate channel release ack. Maybe we could set rel_act_kind to some new LCHAN_REL_ACT_IPAC_DYN_PDCH for clarity? (But we shouldn't actually send a release ack, to stay compatible.) Even though it works as-is, we should indeed add another flag check: - We do check the flags that no ACT/DEACT is already pending; - And we do send a PDCH DEACT only if ts->flags & TS_F_PDCH_ACTIVE; - But we would send a PDCH ACT despite ts->flags & TS_F_PDCH_ACTIVE. This should never happen, but it would make sense to ensure that. ~Neels

3 5

Cell coverage of OsmoBTS B205mini-i
by JPichel 11 Jul '24

11 Jul '24

Hi, I am using osmo-bts-trx with a B205-mini-i, using only CS services. I am currently running the following elements on Ubuntu 22.04, all built from source from the latest version: - osmo-trx-uhd - osmo-bts-trx - osmo-bsc - osmo-msc - osmo-hlr - osmo-mgw - osmo-stp - osmo-sip-connector I have been testing the range of the cell, and I can't seem to get more than around 50 meters, even when I transmit at ~21 dBm using a power amplifier at TX. I find this range too low, since I am used to getting 200-300 meters out of the box when running 4G and 5G networks with the same device, so I suspect I am not configuring the network correctly. I've tried looking at every parameter, so far I've only noticed improvements when setting the min-qual-* to the minimum values and ms_max_power to the maximum. These are my configs for TRX, BTS and BSC: OsmoTRX: ``` log stderr ... ! line vty no login ! cpu-sched policy rr 18 trx bind-ip 127.0.0.1 remote-ip 127.0.0.1 egprs disable tx-sps 4 rx-sps 4 clock-ref gpsdo chan 0 ``` ``` ! ! OsmoBTS () configuration saved from vty !! ! log stderr ... ! line vty no login ! phy 0 instance 0 osmotrx tx-attenuation 0 osmotrx rx-gain 50 osmotrx ip local 127.0.0.1 osmotrx ip remote 127.0.0.1 bts 0 band GSM900 ipa unit-id 1234 0 oml remote-ip 127.0.0.1 gsmtap-remote-host 127.0.0.1 gsmtap-sapi enable-all min-qual-rach -100 min-qual-norm -100 trx 0 phy 0 instance 0 nominal-tx-power 10 ``` ``` ! osmo-bsc default configuration ! (assumes STP to run on 127.0.0.1 and uses default point codes) ! log stderr logging color 1 logging print category-hex 0 logging print category 1 logging timestamp 0 logging print file basename last logging print level 1 e1_input e1_line 0 driver ipa network network country code 1 mobile network code 1 encryption a5 0 neci 1 paging any use tch 0 handover 0 handover algorithm 1 handover1 window rxlev averaging 10 handover1 window rxqual averaging 1 handover1 window rxlev neighbor averaging 10 handover1 power budget interval 6 handover1 power budget hysteresis 3 handover1 maximum distance 9999 ! T3212 is in units of 6min, so below we set 5 * 6 = 30min timer net T3212 5 mgw 0 remote-ip 127.0.0.1 remote-port 2427 local-port 2727 bts 0 type osmo-bts band GSM900 cell_identity 1234 location_area_code 0x0001 base_station_id_code 63 ms max power 40 !default: cell reselection hysteresis 4 cell reselection hysteresis 14 radio-link-timeout 32 channel allocator mode set-all ascending rxlev access min 0 rach tx integer 9 rach max transmission 7 channel-description attach 1 channel-description bs-pa-mfrms 5 channel-description bs-ag-blks-res 1 early-classmark-sending forbidden ipa unit-id 1234 0 oml ipa stream-id 255 line 0 codec-support fr gprs mode none trx 0 rf_locked 0 ! 945M DL/900M UL arfcn 50 nominal power 10 max_power_red 0 rsl e1 tei 0 timeslot 0 phys_chan_config CCCH+SDCCH4 hopping enabled 0 timeslot 1 phys_chan_config TCH/F hopping enabled 0 timeslot 2 phys_chan_config TCH/F hopping enabled 0 timeslot 3 phys_chan_config TCH/F hopping enabled 0 timeslot 4 phys_chan_config TCH/F hopping enabled 0 timeslot 5 phys_chan_config TCH/F hopping enabled 0 timeslot 6 phys_chan_config TCH/F hopping enabled 0 timeslot 7 phys_chan_config TCH/F hopping enabled 0 ms-power-control mode dyn-bts rxlev-thresh lower 0 upper 63 msc 0 allow-emergency allow amr-config 12_2k forbidden amr-config 10_2k forbidden amr-config 7_95k forbidden amr-config 7_40k forbidden amr-config 6_70k forbidden amr-config 5_90k allowed amr-config 5_15k forbidden amr-config 4_75k forbidden bsc mid-call-timeout 0 ``` You might notice I am using the gpsdo as the clock-ref. That's because I've also tried with a B210 with the internal GPSDO, but the results are the same. Thanks in advance, Jonathan Pichel

4 6

E1 to IP with iCE40 E1 USB interface
by Alina Androne 15 Jun '24

15 Jun '24

Hello, How can I utilize the iCE40 E1 USB adapter to transition from E1 to IP in a GSM network, connecting a physical Siemens BSC (which has a BTS connected) to OsmoMSC? Only the BTS and BSC are physical. I already have osmo-e1d installed. Should I use osmo-e1d or dahdi version for this transition? What would be the best approach to begin the process? Regards, Alina

5 10

how do I configure half-rate voice support
by cocfarabicoc＠gmail.com 14 Jun '24

14 Jun '24

I opened this issue for your support and suggestions. I have doing call testing with msisdn(Private network serving the local user). When osmo-bsc-cfg's timeslots are 0->CCCH+SDCCH4, rest 1-7 TCH/F, I can successfully connect 6 phones to each other. When I try to call between 7th and 8th phones, I get an error (from osmo-bts), "Resources unavailable,unspecified"(GSM48_CC_CAUSE_RESOURCE_UNAVAIL). Since each timeslot is allocated to 1 user, I receive an insufficient resource warning. My osmo-bsc-cfg; e1_input e1_line 0 driver ipa e1_line 0 port 0 no e1_line 0 keepalive cs7 instance 0 point-code 1.23.0 asp asp-clnt-msc-0 2905 0 m3ua remote-ip 127.0.0.1 sctp-role client sccp-address msc routing-indicator PC point-code 0.23.1 network network country code 901 mobile network code 75 encryption a5 1 3 neci 1 paging any use tch 0 handover 1 handover algorithm 1 handover1 power budget hysteresis 999 handover1 power budget interval 99 bts 0 type sysmobts band GSM900 cell_identity 0 location_area_code 23 base_station_id_code 63 ms max power 39 cell reselection hysteresis 14 rxlev access min 0 radio-link-timeout 64 penalty time 20 temporary offset 0 cell bar qualify 0 cell reselection offset 31 channel allocator ascending rach tx integer 14 rach max transmission 1 rach emergency call allowed 1 channel-description attach 1 channel-description bs-pa-mfrms 5 channel-description bs-ag-blks-res 2 no access-control-class-ramping access-control-class-ramping-step-interval 5 access-control-class-ramping-step-size 1 access-control-class-ramping-chan-load 71 89 early-classmark-sending allowed early-classmark-sending-3g allowed ipa unit-id 1800 0 oml ipa stream-id 255 line 0 neighbor-list mode manual-si5 codec-support fr hr efr amr amr tch-f modes 0 2 4 7 amr tch-f threshold ms 32 32 32 amr tch-f hysteresis ms 8 8 8 amr tch-f threshold bts 32 32 32 amr tch-f hysteresis bts 8 8 8 amr tch-f start-mode auto amr tch-h modes 0 2 4 amr tch-h threshold ms 32 32 amr tch-h hysteresis ms 8 8 amr tch-h threshold bts 32 32 amr tch-h hysteresis bts 8 8 amr tch-h start-mode auto gprs mode none ms-power-control mode static trx 0 rf_locked 0 arfcn 100 nominal power 23 max_power_red 0 rsl e1 tei 0 timeslot 0 phys_chan_config CCCH+SDCCH4 hopping enabled 0 timeslot 1 phys_chan_config TCH/F hopping enabled 0 timeslot 2 phys_chan_config TCH/F hopping enabled 0 timeslot 3 phys_chan_config TCH/F hopping enabled 0 timeslot 4 phys_chan_config TCH/F hopping enabled 0 timeslot 5 phys_chan_config TCH/F hopping enabled 0 timeslot 6 phys_chan_config TCH/F hopping enabled 0 timeslot 7 phys_chan_config TCH/F hopping enabled 0 msc 0 codec-list hr1 fr1 allow-emergency deny amr-config 12_2k forbidden amr-config 10_2k forbidden amr-config 7_95k forbidden amr-config 7_40k forbidden amr-config 6_70k forbidden amr-config 5_90k allowed amr-config 5_15k forbidden amr-config 4_75k forbidden amr-payload octet-aligned msc-addr msc asp-protocol m3ua lcls-mode disabled lcls-codec-mismatch forbidden mgw remote-ip 127.0.0.1 mgw remote-port 2427 bsc mid-call-timeout 0 cbc no remote-ip no listen-port end I wanted to set half-rate on one trx so that more phones could talk. On my first try, I get this warning("Assignment for this trans already started earlier"- from osmo-msc- function : msc_a_try_call_assignment) and I cannot make any calls. My bsc-cfg for TCH/H; e1_input e1_line 0 driver ipa e1_line 0 port 0 no e1_line 0 keepalive cs7 instance 0 point-code 1.23.0 asp asp-clnt-msc-0 2905 0 m3ua remote-ip 127.0.0.1 sctp-role client sccp-address msc routing-indicator PC point-code 0.23.1 network network country code 901 mobile network code 75 encryption a5 1 3 neci 1 paging any use tch 0 handover 1 handover algorithm 1 handover1 power budget hysteresis 999 handover1 power budget interval 99 bts 0 type sysmobts band GSM900 cell_identity 0 location_area_code 23 base_station_id_code 63 ms max power 39 cell reselection hysteresis 14 rxlev access min 0 radio-link-timeout 64 penalty time 20 temporary offset 0 cell bar qualify 0 cell reselection offset 31 channel allocator ascending rach tx integer 14 rach max transmission 1 rach emergency call allowed 1 channel-description attach 1 channel-description bs-pa-mfrms 5 channel-description bs-ag-blks-res 2 no access-control-class-ramping access-control-class-ramping-step-interval 5 access-control-class-ramping-step-size 1 access-control-class-ramping-chan-load 71 89 early-classmark-sending allowed early-classmark-sending-3g allowed ipa unit-id 1800 0 oml ipa stream-id 255 line 0 neighbor-list mode manual-si5 codec-support fr hr efr amr amr tch-f modes 0 2 4 7 amr tch-f threshold ms 32 32 32 amr tch-f hysteresis ms 8 8 8 amr tch-f threshold bts 32 32 32 amr tch-f hysteresis bts 8 8 8 amr tch-f start-mode auto amr tch-h modes 0 2 4 amr tch-h threshold ms 32 32 amr tch-h hysteresis ms 8 8 amr tch-h threshold bts 32 32 amr tch-h hysteresis bts 8 8 amr tch-h start-mode auto gprs mode none ms-power-control mode static trx 0 rf_locked 0 arfcn 100 nominal power 23 max_power_red 0 rsl e1 tei 0 timeslot 0 phys_chan_config CCCH+SDCCH4 hopping enabled 0 timeslot 1 phys_chan_config TCH/H hopping enabled 0 timeslot 2 phys_chan_config TCH/H hopping enabled 0 timeslot 3 phys_chan_config TCH/H hopping enabled 0 timeslot 4 phys_chan_config TCH/H hopping enabled 0 timeslot 5 phys_chan_config TCH/H hopping enabled 0 timeslot 6 phys_chan_config TCH/H hopping enabled 0 timeslot 7 phys_chan_config TCH/H hopping enabled 0 msc 0 codec-list hr1 fr1 allow-emergency deny amr-config 12_2k forbidden amr-config 10_2k forbidden amr-config 7_95k forbidden amr-config 7_40k forbidden amr-config 6_70k forbidden amr-config 5_90k allowed amr-config 5_15k forbidden amr-config 4_75k forbidden amr-payload octet-aligned msc-addr msc asp-protocol m3ua lcls-mode disabled lcls-codec-mismatch forbidden mgw remote-ip 127.0.0.1 mgw remote-port 2427 bsc mid-call-timeout 0 cbc no remote-ip no listen-port end What needs to be done to connect more than 6 phones? Am I making a mistake in the config for the half-rate setting? I am waiting for your suggestions and opinions.

2 1

Re: RFC: new type for NAS/EPS in gsmtap.h and question
by md jashin88 13 Jun '24

13 Jun '24

1 0

osmo-smlc / sccp_lb_inst.c
by jheyrendt.ext＠orange.com 05 Jun '24

05 Jun '24

Hi Do you know if the packet osmo-smlc should work with osmo-bsc, osmo-stp last versions? I just tested, saw errors and tried to debug but perhaps I made mistakes (link, as, asp are up between BSC and SMLC via osmo-stp) osmo-smlc 0.2.4 DLSCCP DEBUG <0011> sccp_user.c:176 Delivering N-PCSTATE.indication to SCCP User 'SCCP Management' DLSCCP DEBUG <0011> sccp_scmg.c:298 Ignoring SCCP user primitive N-PCSTATE.indication DLSCCP DEBUG <0011> sccp_user.c:176 Delivering N-PCSTATE.indication to SCCP User 'OsmoSMLC-Lb' DLB ERROR <0002> sccp_lb_inst.c:167 (Lb) sccp_lb_sap_up(N-PCSTATE.indication) unsupported Many thanks in advance Best regards Jean-Marc

2 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC June 2024