August 2024 - OpenBSC - lists.osmocom.org

On the use of 'decmatch' in TTCN-3
by Harald Welte 31 Aug '26

31 Aug '26

Hi, I know that TTCN-3 is still new to a lot of you, but we are writing tons of integration testing against the various osmocom programs in it. It is quite amazing technology, and I would like to ask you to bear with me reading this mail :) Pau was stating the question earlier today on not finding an example on how to use decmatch. Indeed, it took me some months to find that gem in the TTCN-3 world. It solves the problem that you often have during test of layered protocol stacks: you have separate encoders/decoders for each protocol layer, and now you want to match on some of the *inner* payload. So normally, you have some kind of header definition + a binary (octetstring) payload. This happens in RSL with the L3_INFO IE, and just the same on BSSAP/DTAP where again the L3 message (for example call control) is encapsulated inside one information element. Now you have multiple options of addressing the problem: a) hand-written calls to the decoder function b) write na 'emulation' for the entire protocol layer c) use decmatch. a) would look like this (pseudo-code): var octetstring l3oct; var RSL_Message rsl RSL.receive(tr_RSL_DATA_REQ(g_chan_nr, ?, ?)) -> value rsl { var PDU_ML3_MS_NW l3 := dec_PDU_ML3_MS_NW(rsl.payload); if (match(l3, some_template)) { ... do something } ... } Which uses the built-in pattern-matching on the RSL port to match any message that matches the tr_RSL_DATA_REQ template, and stores the resulting RSL message in a variable. It then uses an explicit call to the decoder function of the L3 message, and then uses regular conditional expressions for further matching on that inner L3 payload. This is more or less how you would write in C, python or any other quite imperative programming languages. It's very verbose, time consuming and un-abstract/elegant. TTCN-3 has many declarative aspects to it. Code like the above is a waste of your time :) b) would mean that you implement some test component that handles the RSL messages on its bottom side test port, and the L3 messages on its top side test port. That is a possible way, and if you need a lot of state/logic of RSL, it maeks sense. But what if you really simply want to have a match? Then it would be a lot of effort and a large detour. c) decmatch to the rescue! You can write RSL.receive(tr_RSL_DATA_REQ(g_chan_nr, ?, decmatch tr_RRM_RR_STATUS)) which means: * do a receive on the RSL test port, and match on an incoming RSL message that matches the tr_RSL_DATA_REQ template, with channel number specified, link_id any (?), *and* if the octetstring payload, if decoded, matches the template tr_RRM_RR_STATUS ! This is *extremely* powerful and expressive. It allows you to condense complex, parametric template matching over multiple proocol layers. It would in the end match RSL DATA REQUEST, only if they contained a [valid] encoded RR STATUS. See https://gerrit.osmocom.org/6229 for the actual test case I used for the above examples. Please also note that I never had to even write the function name of the decoder (dec_PDU_ML3_MS_NW), but TTCN-3 *automatically* figures out which decoder function it must call in order to decode from the binary octetstring. Happy (TTCN-3) hacking + Osmocom bugfixing, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

4 4

E1 to IP with iCE40 E1 USB interface
by Alina Androne 28 May '26

28 May '26

Hello, How can I utilize the iCE40 E1 USB adapter to transition from E1 to IP in a GSM network, connecting a physical Siemens BSC (which has a BTS connected) to OsmoMSC? Only the BTS and BSC are physical. I already have osmo-e1d installed. Should I use osmo-e1d or dahdi version for this transition? What would be the best approach to begin the process? Regards, Alina

6 12

GSM Silent call
by samir 04 May '26

04 May '26

Hi, I have read that silent-calls in GSM can be used to make a call to a target MS and listen to it without having the target knowing it. Is this theoretically possible ? If yes, can it be done in OpenBSC ?

4 3

cmd2 update causing pySim-shell to fail
by bryan coxwell 02 May '26

02 May '26

Hi all, Just wanted to share an issue and a quick workaround I found for it in case anyone else has the same problem. I believe a cmd2 update is causing pySim-shell to fail. After installing it on a fresh install of Ubuntu Server 20.04 and getting the following error when I run "python3 pySim-shell -p0": >Using PC/SC reader interface >Autodetected card type: sysmoUSIM-SJS1 >AIDs on card: > USIM: a0000000871002ffffffff8907090000 >Traceback (most recent call last): > File "pySim-shell.py", line 512, in <module> > app = PysimApp(card, rs, opts.script) > File "pySim-shell.py", line 59, in __init__ > super().__init__(persistent_history_file='~/.pysim_shell_history', allow_cli_args=False, use_ipython=True, auto_load_commands=False, command_sets=basic_commands, >startup_script=script) >TypeError: __init__() got an unexpected keyword argument 'use_ipython' If you run into this you can fix it by uninstalling cmd2 and reinstalling cmd2 with "pip3 install cmd2==1.5". Best, Bryan

15 18

SMS: UCS-2 concatenation with UTF16 emoticons
by Keith 26 Apr '26

26 Apr '26

Hi all, I noticed that SMS with emoticons on the boundary of the concatenated segments are not displaying correctly on the destination handset. * - imagine the disaster when that kiss-blowing smiley face thing at the end of your SMS turns out as a diamond with a ? for the recpipient! OMG, the potential butterfly effect is too much to think about... :)) So... This is my analysis: We have 140 bytes for the message, less the 6 bytes for the user header data in the case of concatenated SMS , leaving 134 bytes. It's well know that this means 67 characters per segment for an SMS using UCS-2 encoding. But, it we fill the message with emoticons that are using 4 bytes per 'character', then we have space for 134/4 = 33 and a half. Ooops. Still, the destination handset should reassemble the message and stick the two "halves" of the emoticon together, right? - except I'm not observing this. To rule out us doing something wrong in osmo, I wonder might somebody else (who has an unlimited SMS package) from a commercial provider try sending some crafted SM from one emoji-enabled phone to another, something like this: 😱abcdefghijklmnopqrstuvwxyz123456789abcdefghijklmnopqrstuvwxyz123😱56789 That's likely going to get mangled by mailing list or your mua, so it is: [4 byte emoji]abcdefghijklmnopqrstuvwxyz123456789abcdefghijklmnopqrstuvwxyz123[4 byte emoji]56789 You could also try various messages filled with emojis. Of course, if you bring up your osmo network with SMPP-mirror you can watch the trace in wireshark, you'll see when the last emoji gets chopped in two. You could try the same message on osmo and your commerical network. If it's actually a problem of the phones, you should get [4 byte emoji]abcdefghijklmnopqrstuvwxyz123456789abcdefghijklmnopqrstuvwxyz123[two diamonds with ?]56789 Thanks! Keith.

6 7

ip.access nano 3G S8 Configuration
by John Thewlis - Meath Broadband 20 Apr '26

20 Apr '26

We are trying to setup this AP as part of the 3.5G Osmocom project. We have the software stack operational and are now preparing the nano for testing. When we try to login via telnet at port 8090 we are getting a constant refusal to connect:- root@osm/openbsc/openbsc/src/ipaccess# telnet 192.168.192.30 8090 Trying 192.168.192.30... telnet: Unable to connect to remote host: Connection refused The device seems to be locked as indicated by the leds on the front panel. We have tried resetting the nano to see if this would help but to no avail. Any ideas as to how to access the device for initial configuration?. Thanks John

7 7

Need nano3G (S8 - Model 237A)
by Akib Sayyed 16 Apr '26

16 Apr '26

Dear List I am extremely sorry for off the topic question. I am willing to buy nano3G Nodeb. Is anyone in list have spare which can be sold. Please let me know. -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243 <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

8 10

Splitting out M3UA and MTP3 out of Open BSC into a separate library
by Arran Cudbard-Bell 15 Apr '26

15 Apr '26

Hi, Developing a module for FreeRADIUS to support EAP-SIM and EAP-AKA authentication against a HLR. The HLR we were targeting only supported a SCTP/M3UA/SCCP/TCAP/MAP stack, so we couldn't use SUA. Ripping the M3UA/MTP3 code out of OpenBSC worked surprisingly well. We ended up running the event loop in a separate thread to work around the threading issues. Unfortunately the HLR implements the ANSI variant of everything, whereas OpenBSC and supporting libraries seem to have been written to be compatible with the ITU standards. ...but the differences are fairly minor at MTP3 and SCCP layers, and i've started work on a patchset for libosmo-sccp. https://gerrit.osmocom.org/#/c/73/ Anyway, trying to gauge interest in splitting those layers out of Open BSC into a separate library, would be happy to take on M2UA as well for consistency. It would almost certainly get more projects using the code. There's very little out there even in Perl land for working with SS7. Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

9 9

[PATCH 4/4] core/conv: Add optimized Viterbi decoding
by Vadim Yanitskiy 15 Apr '26

15 Apr '26

Hi Tom and all, After a quick look at the 4th patch, related to your optimized Viterbi decoder, I have noticed that currently the convolutional code definitions from the 'src/gsm/gsm0503_conv.c' are out of the 'tests/conv' test coverage... So, I would like to extend the test coverage. All I need are the test vectors, which I'll add to existing ones. Some of them I already found in your 4th patch, but some pending I need to write myself. Right now I have a simple question... Let's look at one example: { .name = "GSM RACH (non-recursive, flushed, not punctured)", .code = &gsm_conv_rach, .in_len = 14, .out_len = 36, // ??? .has_vec = 0, .vec_in = { }, .vec_out = { }, } As I noticed, the 'in_len' may be taken from the code definition: const struct osmo_conv_code gsm0503_rach = { .N = 2, .K = 5, .len = 14, // The 'in_len' is here! .next_output = xcch_output, .next_state = xcch_state, }; But I don't know how to calculate the 'out_len'... Could you please give me some hint? I already started to work on your 4th patch: https://gerrit.osmocom.org/1542 https://gerrit.osmocom.org/1543 With best regards, Vadim Yanitskiy.

2 2

OsmoTRX+B205mini crashes when having another USB device on a different port
by JPichel 20 Mar '26

20 Mar '26

Hello everyone, I am experiencing problems when trying to run osmotrx with a b205mini and I connect another USB device to a different port on the machine. When I do this, osmotrx crashes instantly. Also, when I have the other device already plugged in when I start osmotrx, it takes ~20 seconds to crash. Sometimes it just crashes without giving a reason, like here: DLGLOBAL NOTICE Setting SCHED_RR priority 18 (cpu_sched_vty.c:471) DLGLOBAL NOTICE Setting SCHED_RR priority 18 (cpu_sched_vty.c:471) DLGLOBAL NOTICE Available via telnet 127.0.0.1 4237 (telnet_interface.c:88) DLCTRL NOTICE CTRL at 127.0.0.1 4236 (control_if.c:1024) [INFO] [UHD] linux; GNU C++ version 11.2.0; Boost_107400; UHD_4.1.0.5-3 DMAIN NOTICE -- Transceiver active with 1 channel(s) (osmo-trx.cpp:621) DLSTATS NOTICE Stats timer expire_count=7: We missed 6 timers (stats.c:169) DLGLOBAL NOTICE Stats timer expire_count=31: We missed 30 timers (rate_ctr.c:350) DTRXCTRL NOTICE Changing TSC from 0 to 7 (Transceiver.cpp:1032) DTRXCTRL NOTICE [chan=0] switching to TRXD version 1 (Transceiver.cpp:1059) DMAIN NOTICE Starting the transceiver (Transceiver.cpp:287) LLDTRXCLK NOTICE Sending CLOCK indications (Transceiver.cpp:1198) UDDEV ERROR No packet received, implementation timed-out (UHDDevice.cpp:782) DDEV FATAL UHD: Receive timed out (UHDDevice.cpp:786) DMAIN FATAL Receive error 0 (radioInterface.cpp:340) DTRXDUL FATAL Something went wrong in thread RxLower, requesting stop (Transceiver.cpp:1359) DMAIN NOTICE Shutting down transceiver... (osmo-trx.cpp:588) DMAIN NOTICE Stopping the transceiver (Transceiver.cpp:345) terminate called without an active exception Aborted And sometimes it reports an USB error and shows the talloc report: DMAIN NOTICE -- Transceiver active with 1 channel(s) (osmo-trx.cpp:621) DLSTATS NOTICE Stats timer expire_count=6: We missed 5 timers (stats.c:169) DLGLOBAL NOTICE Stats timer expire_count=26: We missed 25 timers (rate_ctr.c:350) DTRXCTRL NOTICE Changing TSC from 0 to 7 (Transceiver.cpp:1032) DTRXCTRL NOTICE [chan=0] switching to TRXD version 1 (Transceiver.cpp:1059) DMAIN NOTICE Starting the transceiver (Transceiver.cpp:287) DTRXCLK NOTICE Sending CLOCK indications (Transceiver.cpp:1198) LLUterminate called after throwing an instance of 'uhd::io_error' what(): EnvironmentError: IOError: usb rx6 transfer status: LIBUSB_TRANSFER_OVERFLOW signal 6 received talloc report on 'OsmoTRX' (total 8531 bytes in 29 blocks) rate_ctr.c:233 contains 1160 bytes in 1 blocks (ref 0) 0x559c72388720 trx_rate_ctr.cpp:343 contains 8 bytes in 1 blocks (ref 0) 0x559c723886b0 trx_rate_ctr.cpp:342 contains 40 bytes in 1 blocks (ref 0) 0x559c72389540 trx_rate_ctr.cpp:341 contains 32 bytes in 1 blocks (ref 0) 0x559c723895d0 telnet_connection contains 1 bytes in 1 blocks (ref 0) 0x559c723893d0 struct sched_vty_opts contains 72 bytes in 1 blocks (ref 0) 0x559c723489f0 logging contains 6197 bytes in 13 blocks (ref 0) 0x559c722c5d10 struct trx_ctx contains 1021 bytes in 8 blocks (ref 0) 0x559c722a0e80 msgb contains 0 bytes in 1 blocks (ref 0) 0x559c722c3ac0 full talloc report on 'OsmoTRX' (total 8531 bytes in 29 blocks) rate_ctr.c:233 contains 1160 bytes in 1 blocks (ref 0) 0x559c72388720 trx_rate_ctr.cpp:343 contains 8 bytes in 1 blocks (ref 0) 0x559c723886b0 trx_rate_ctr.cpp:342 contains 40 bytes in 1 blocks (ref 0) 0x559c72389540 trx_rate_ctr.cpp:341 contains 32 bytes in 1 blocks (ref 0) 0x559c723895d0 telnet_connection contains 1 bytes in 1 blocks (ref 0) 0x559c723893d0 struct sched_vty_opts contains 72 bytes in 1 blocks (ref 0) 0x559c723489f0 logging contains 6197 bytes in 13 blocks (ref 0) 0x559c722c5d10 vty_logp_doc_str contains 1377 bytes in 1 blocks (ref 0) 0x559c7231c040 vty_logp_cmd_str contains 260 bytes in 1 blocks (ref 0) 0x559c7231ba00 vty_log_level_doc_str contains 1170 bytes in 1 blocks (ref 0) 0x559c722ff430 vty_log_level_cmd_str contains 236 bytes in 1 blocks (ref 0) 0x559c722ff2d0 vty_log_level_doc_str contains 1305 bytes in 1 blocks (ref 0) 0x559c722fc610 vty_log_level_cmd_str contains 257 bytes in 1 blocks (ref 0) 0x559c722fc4a0 struct log_target contains 330 bytes in 3 blocks (ref 0) 0x559c7220c550 struct osmo_wqueue contains 96 bytes in 1 blocks (ref 0) 0x7ff689ff4090 struct log_category contains 74 bytes in 1 blocks (ref 0) 0x559c722c6290 struct log_info contains 1261 bytes in 3 blocks (ref 0) 0x559c722ac370 uint8_t contains 37 bytes in 1 blocks (ref 0) 0x559c722c6350 struct log_info_cat contains 1184 bytes in 1 blocks (ref 0) 0x559c722c5d80 struct trx_ctx contains 1021 bytes in 8 blocks (ref 0) 0x559c722a0e80 127.0.0.1 contains 10 bytes in 1 blocks (ref 0) 0x559c722c5c20 127.0.0.1 contains 10 bytes in 1 blocks (ref 0) 0x559c722c5ba0 struct cmd_element contains 122 bytes in 2 blocks (ref 0) 0x559c72369030 logging level lms (debug|info|notice|error|fatal) contains 50 bytes in 1 blocks (ref 0) 0x559c7236c1a0 utils.c:386 contains 405 bytes in 1 blocks (ref 0) 0x559c7225e5b0 utils.c:386 contains 65 bytes in 1 blocks (ref 0) 0x559c723524f0 contains 1 bytes in 1 blocks (ref 0) msgb contains 0 bytes in 1 blocks (ref 0) On the BTS side I see several messages of missed timers, but this is something I see also when I don't have the USB plugged in: <0006> scheduler_trx.c:489 GSM clock started, waiting for clock indications <0006> scheduler_trx.c:578 GSM clock skew: old fn=0, new fn=2555007 <0006> scheduler_trx.c:428 FN timer expire_count=4: We missed 3 timers <0006> scheduler_trx.c:606 We were 1 FN slower than TRX, compensated <0006> scheduler_trx.c:606 We were 1 FN slower than TRX, compensated <0006> scheduler_trx.c:428 FN timer expire_count=6: We missed 5 timers <0006> scheduler_trx.c:593 We were 1 FN faster than TRX, compensating <0006> scheduler_trx.c:606 We were 1 FN slower than TRX, compensated <0006> scheduler_trx.c:593 We were 1 FN faster than TRX, compensating <0006> scheduler_trx.c:606 We were 2 FN slower than TRX, compensated <0006> scheduler_trx.c:428 FN timer expire_count=7: We missed 6 timers <0006> scheduler_trx.c:593 We were 1 FN faster than TRX, compensating <0006> scheduler_trx.c:606 We were 1 FN slower than TRX, compensated <0006> scheduler_trx.c:593 We were 1 FN faster than TRX, compensating <0006> scheduler_trx.c:606 We were 1 FN slower than TRX, compensated <0006> scheduler_trx.c:428 FN timer expire_count=7: We missed 6 timers <0006> scheduler_trx.c:593 We were 1 FN faster than TRX, compensating <0006> scheduler_trx.c:606 We were 1 FN slower than TRX, compensated <0006> scheduler_trx.c:428 FN timer expire_count=7: We missed 6 timers <0006> scheduler_trx.c:435 No more clock from transceiver Does anyone know if this is a software or hardware problem? I am thinking maybe it is related to the power supply of the USB port, but I have no idea. I really need to have both devices connected at the same time. Any help or suggestion is appreciated, Jonathan

3 3