OpenBSC

openbsc@lists.osmocom.org

10 participants
4277 discussions

osmo-trx commit 3da1f83
by Cyril 06 Mar '18

06 Mar '18

Hello, How do you select the log level with the libosmocore logging system introduced in commit 3da1f83 ? What is the equivalent of '-l DEBUG' command line option now ? Thanks ! Cyril

2 2

Submissions for OsmoDevCon 2018
by Harald Welte 04 Mar '18

04 Mar '18

Dear Osmocom community, it's already end of January and OsmoDevCon 2018 in April is getting closer and closer. As indicated before, I would like to group the topics by days and put together at least a rough framework shcedule, so that people with specific interests don't have to be present for four full days to make sure they don't miss anything. So I'd like to re-invite all attendees to consider adding a topic/porposal to the wiki page at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCon2018#section-9 so that we can group different topic areas and put together a rough schedule outline. A proposal doesn't mean you have to give a talk. It could be anything, including * a talk that you would want to listen to, and you're looking for somebody to give it * a discussion about a certain topic * a workshop / hands on session * lightning talks? Like any community event, OsmoDevCon lives by its contributors. I can't wait to hear about all the things you've been up to. Thanks! Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 1

TTCN-3 test suite for OsmoBTS
by Harald Welte 02 Mar '18

02 Mar '18

Hi all, today I've docker-ized the latest TTCN-3 test suite I've been developing over the last week or so. They're now running nightly in our Jenkins, you can see the results analyzer at https://jenkins.osmocom.org/jenkins/view/TTCN3/job/ttcn3-bts-test/test_resu… (don't forget the "Expand All" button) Out of all the test suites I've written in recent months, the OsmoBTS test suite is what I'm particularly happy about. While of course not achieving 100% coverage it actually tests a lot of things, including various cases that would be very hard to impossible to achieve in manual testing.o A larger number of tests is also relate to the BTS<->PCU socket interface, where [almost] each of the message types occurring in Rx/Tx is triggered + tested accordingly. The system information scheduling test cases were working for me 2 days ago, I'm not sure what I did wrong to break them again, I'll investigate. In terms of important needed OsmoBTS tests, I see: * verification of PCU -> Um for all different coding schemes (requires PDCH support in trxcon first, or fall-back to virt_phy instead) * testing of timing advance loop * testing of uplink power control loop (needs fake_trx extension) * testing of voice channels in all codec modes * memory leak related testing It was a loooong week full of late night and early morning shifts, but I'm happy that progress was possible in a rather short amount of time. Thanks to Vadim "fixeria" for his work on trxcon + fake_trx, which means we can test a fully unmodified osmo-bts-trx ("the real thing"), rather than osmo-bts-virtual, which is a BTS model that doesn't exist this way in reality. The nice part is that the test cases only use L1CTL on one hand side and RSL/PCUIF/VTY/CTRL on the other side, and as such they should in theory work equally with the followign setups: a) TTCN3 -L1CTL-> trxcon -> fake_trx -> osmo-bts-trx -> TTCN3 (current) b) TTCN3 -L1CTL-> virt_phy osmo-bts-virtual -> TTCN3 c) TTCN3 -L1CTL-> OsmocomBB-firmware -RF-> osmo-bts-{sysmo,lc15,octphy} -> TTCN3 Only 'a)' is currently used, but it would definitely be interesting to be able to use the exact same test cases (minus TA/power-control loop test) with real hardware and the different PHYs. Any contributions are as always very much welcome. With all the existing test cases out there and the dockerized setup, it should be super easy to reproduce the test results on your local machine, and to copy+paste+edit an existing test to extend test coverage even further. The development of the test suite has already resulted in dozens (!) of bugs being discovered some of them quite severe. Check the increased activity since february 22nd at http://osmocom.org/projects/osmobts/issues?utf8=%E2%9C%93&set_filter=1&f%5B… for more information Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Re: trxcon, fake-trx and osmo-bts-trx: Simulating TA + Power Control
by Vadim Yanitskiy 02 Mar '18

02 Mar '18

Hi Harald, > fake_trx must be able to insert additional false "delay" > ... > 1) Implementation of TA in fake_trx > ... > 2) implementation of "fake delay" in fake_trx > ... Done. Great collaborative work! > fake_trx must be able to insert additional false "path loss" > ... > For RSSI processing it's slightly more complicated: This needs to be discussed. > fake_trx would need to know the nominal transmit power > of both MS and BTS. For this example, let's assume MS > nominal power is +30dBm and BTS +23 dBm... Do we really need to specify the nominal transmit power for both? At the moment, trxcon is capable to parse the L1CTL_PARAM_REQ messages from the higher layers, and it basically forwards exactly TX power instead of TX attenuation to transceiver... Or should we change this value to attenuation, and go by the way you suggested above? This task doesn't seem too complicated, so I'll implement this. By the way, I have another idea. We are talking about path loss, which does not only affect power levels, but also introduces some bit corruption level. This could be also simulated in FakeTRX, but first of all, it's good to know, do we need this feature? I think it makes sense, because a MS also reports BER in its Measurement Reports. With best regards, Vadim Yanitskiy.

1 0

A5/1 Encryption Enabled - Programmable SIM unable to camp
by Ron 01 Mar '18

01 Mar '18

Hi All, Does anyone tried enabling the A5/1 Encryption using osmo-bsc and osmo-msc? We are using an UPBOARD with the following elements; osmo-bsc, osmo-bts-trx and osmo-trx in it; and a NUC with osmo-hlr, osmo-msc, osmo-mgcp, and osmo-stp. Both servers are using Ubuntu 16.04 OS. We enabled the a5/1 encryption in both osmo-bsc and osmo-msc. Then provisioned the programmable SIM to osmo-hlr with aud2g comp128v1 auth. OsmoHLR# subscriber imsi 515941234567890 show ID: 9 IMSI: 515941234567890 MSISDN: 09271234567 2G auth: COMP128v1 KI=00112233445566778899aabbccddeeff We are not really sure what causes the LOCUP Reject. Can anyone help us with this issue? Attached are the configuration used during the testing and a trace taken during the testing. Best Regard, Ron Menez ron.menez(a)entropysolution.com<mailto:ron.menez@entropysolution.com>

2 3

UMTRX - Missing IMEI in the Identity Request
by Ron 01 Mar '18

01 Mar '18

Hi All, We have encountered an issue in latching/phone camping using UMTRX and OSMOCOM elements. During the registration process, encryption command fails since the OsmoBSC/BTS does not provide the IMEI in the Identity Request. Note that the Mobile core only permits a5/1 encryption. This issue is not encountered using ETTUS B210 with same version of OSMOCOM elements and same configuration files. May we know if this is a known issue? The UHD version used is the UHD_003.010.002.HEAD-3-g122bfae1 and the UMTRX Driver used is1.0.3-128-93d4343. We used the URL below in installing the driver and module of UMTRX: https://umtrx.org/applications/driver/ Best Regard, Ron Menez ron.menez(a)entropysolution.com<mailto:ron.menez@entropysolution.com>

2 1

trxcon, fake-trx and osmo-bts-trx: Simulating TA + Power Control
by Harald Welte 01 Mar '18

01 Mar '18

This is picking up on a discussion that fixeria and I have had in https://gerrit.osmocom.org/#/c/6846 so far. The goal is to be able to fully test the timing advance and power control loops in unmodified osmo-bts-trx (from the BTS_Tests.ttcn test suite). For this, we need: * fake_trx must be able to insert additional false "delay" * fake_trx must be able to insert additional false "path loss" Let's look at TOA/timing first: 1) Implementation of TA in fake_trx * MS sets timing advance via L1CTL * trxcon translates this into SETTA command to fake_trx * fake_trx stores this curernt TA value (in bit periods) * fake_trx initializes the per-burst TOA (in 1/256th symbol periods) to the negative of those values when converting from Tx to Rx burst format, before feeding to osmo-bts-trx 2) implementation of "fake delay" in fake_trx * test case at any time requests fake_trx to apply a "fake delay" (in 1/256th symbol periods) * fake_trx stores this signed 16bit value * fake_trx applies this fake_delay value when converting uplink Tx bursts to Rx bursts, after having applied the timing advance. So a typical exchange between MS and BTS looks like this: * testcase instructs fake_trx to apply fake_delay of 512 (2 bit periods) * MS sends RACH burst with no timing advance at all * fake_trx applies TA=0 and adds fake_delay value (512), resulting in reported timing value of 512 in the bursts passed to osmo-bts-trx * osmo-bts-trx detects '512' and forwards this as timing offset to the BSC * BSC will allocate a channel, and instruct MS to use TA=2 on it * MS sends SETTA=2 to fake_trx * any bursts from MS in fake_trx are processed as follows: ** set toa=-256*2=-512 (TA value of 2) ** add fake_delay: toa=-512 (result of above) + 512 (fake delay) = 0 * osmo-bts-trx receives bursts with toa=0, i.e. timing advance loop is balanced When the MS is moving further away, we can simulate this by: * testcase sends fake_delay=1024 to fake_trx * uplink bursts now are processed in fake_trx as: ** set toa=-256*2=-512 (TA value of 2) ** add fake_delay: toa=-512 (result of above) + 1024 (fake delay) = +512 * osmo-bts-trx receives bursts with toa=512, reports this to timing advance loop code * TA loop code will result in SACCH downlink L1 header to contain TA=4 (not just 2 like before) * MS will send "SETTA 4" to fake_trx * uplink bursts now are processed in fake_trx as: ** set toa=-256*4=-1024 (TA value of 4) ** add fake_delay: toa=-1024 (result of above) + 1024 (fake delay) = 0 * loop is balanced again For RSSI processing it's slightly more complicated: * fake_trx would need to know the nominal transmit power of both MS and BTS. This could be from config file, command line argument or some control commands. For this example, let's assume MS nominal power is +30dBm and BTS +23 dBm * fake_trx will have some "SET PATH LOSS" command by which the test case can tell it about the path loss it shall apply (in uplink and/or downlink direction) * fake_trx receives "SET PATH LOSS 110" for 110dB path loss * uplink burst processing then looks like this ** fake_trx knows MS nominal power is +30 dBm ** fake_trx subtracts the attenuation value from the Tx Burst Data header (e.g. 10 dB) ** fake_trx computes +30 (nominal power) -10 (burst attenuation) - 110 (path loss) = -90 dBm ** fake_trx reports -87dBm RSSI in the uplink burst to osmo-bts-trx * downlink burst processing then looks like this ** fake_trx knows of BTS transmit power level is 23dBm ** fake_trx reads attenuation from tx burst header (e.g. 0dB) ** fake_trx computes +23 (nominal power) -0 (burst attenuation) - 110 (path loss) = -87 dBm ** fake_trx reports Rx bursts with -87dBm RSSI to trxcon I hope this makes sense. Comments welcome. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Help with GPRS and new split stack
by Rafael Diniz 27 Feb '18

27 Feb '18

Hi all, I'm running the new split stack on a LC 15 (osmo-bts and osmo-pcu from stock LC15, and osmo-bsc, osmo-msc, osmo-stp, osmo-hlr, ... from debian 9 armv7l nightly in a chroot). osmo-sgsn gives me: 0180225034309988 DGPRS <000f> gprs_subscriber.c:714 SUBSCR(250026920931392) Received GSUP message OSMO_GSUP_MSGT_SEND_AUTH_INFO_ERROR 20180225034309988 DGPRS <000f> gprs_subscriber.c:470 SUBSCR(250026920931392) Send authentication info has failed with cause 2, handled as: Permission denied 20180225034309988 DGPRS <000f> gprs_subscriber.c:478 SUBSCR(250026920931392) GPRS send auth info req failed, access denied, GMM cause = 'IMSI unknown in HLR' (2) 20180225034309988 DGPRS <000f> gprs_subscriber.c:828 SUBSCR(250026920931392) Updating subscriber authentication info 20180225034309988 DMM <0002> gprs_sgsn.c:726 MM(250026920931392/e550701e) Subscriber data update 20180225034309988 DMM <0002> sgsn_auth.c:219 MM(250026920931392/e550701e) Updating authorization (unknown -> authenticate) 20180225034309988 DMM <0002> sgsn_auth.c:236 MM(250026920931392/e550701e) Missing auth tuples, authorization not possible 20180225034309988 DMM <0002> sgsn_auth.c:248 MM(250026920931392/e550701e) Got authorization update: state unknown -> rejected 20180225034309988 DMM <0002> gprs_gmm.c:1140 MM(250026920931392/e550701e) Not authorized, rejecting ATTACH REQUEST with cause 'IMSI unknown in HLR' (2) 20180225034309988 DMM <0002> gprs_gmm.c:489 MM(250026920931392/e550701e) <- GPRS ATTACH REJECT: IMSI unknown in HLR 20180225034309988 DMM <0002> gprs_gmm.c:313 MM(250026920931392/e550701e) Cleaning MM context due to GPRS ATTACH REJECT osmo-hlr: 20180225034401485 DAUC <0003> db_auc.c:129 IMSI='250026920931392': No 2G Auth Data 20180225034401485 DAUC <0003> db_auc.c:165 IMSI='250026920931392': No 3G Auth Data 20180225034401485 DAUC <0003> hlr.c:79 250026920931392: IMSI known, but has no auth data; Returning slightly inaccurate cause 'IMSI Unknown' via GSUP But I added the IMSIs in the HLR. Which kind of auth data should I put to a SIM card from a mainstream carrier? Thanks, Rafael Diniz

2 4

Approach to system testing for Osmocom stack
by Holger Freyther 26 Feb '18

26 Feb '18

Hi, the lua binding code was added to be able to automate OpenBSC tests. In theory we should be able to do this for SMS and UpdateLocation (call handling with MNCC exposing is left as a todo) but in practice we miss a piece of software to coordinate this and run the test. We miss it because it is an interesting problem but also I lost time on switching countries, learning new tricks at a project... The basic testing structure looks easy as well. We want to define the number of concurrent subscribers (0, 10, 100, 1000, n) and to make it simple a single test (UL, send SMS, t) and execute the same test for each subscriber and call it a success if y% of tests succeed within time T. The way to measure this is easy as well. The lua script would print some data (e.g. the name of the ms) when it starts and completes. For some degrees of freedom I don't have a good idea.. and feedback is welcome. I am not sure if I should spawn, configure, add subscribers, a flavor of Osmocom cellular? I look into having some set of templates for the config, the stack to launch and in concept it looks awfully similar to something the GSM tester is doing. Shall we leave virtbts/cellular to the Osmocom tester and just focus on coordinating mobile? My feeling is to leave this to the Osmo GSM tester. If we have n subscribers I would launch m copies of "mobile" (but run multiple MS in a single binary). So with 4 MS per mobile process and 10k subs we would end with 2.5k processes + many log messages coming from each. Would that scale with python? Should we look into doing this one in Go? Or can some of GSM tester be used (the template part)? I would probably design this concurrently with Go(besides being the first). any ideas/comments? holger

4 12

Re: Help with GPRS and new split stack
by Vadim Yanitskiy 26 Feb '18

26 Feb '18

Hi Rafael, Please pay your attention at the following warnings: > hlr.c:79 250026920931392: IMSI known, but has no auth data; > Returning slightly inaccurate cause 'IMSI Unknown' via GSUP and > sgsn_auth.c:236 MM(250026920931392/e550701e) > Missing auth tuples, authorization not possible > sgsn_auth.c:248 MM(250026920931392/e550701e) > Got authorization update: state unknown -> rejected Are you sure you do have all required auth information in HLR? > IMSI 250 02 6920931392 BTW: is it a random IMSI? Otherwise, this IMSI belongs to a Russian carrier - Megafon. If I am correct, and this SIM is a commercial SIM, you won't be able to get the auth data for them. With best regards, Vadim Yanitskiy.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC