Skip to content

Loading builds...

Changes

#28183 (Apr 24, 2026, 4:26:04 PM)

jenkins.sh: pin libosmocore version to current version v1.14

Change-Id: I678957099348e067d62a4abd04cbdac822463cf4
lynxis at

#28182 (Apr 24, 2026, 3:21:16 PM)

personalization: fix SdKey.apply_val() implementation

'securityDomain' elements are decoded to ProfileElementSD instances,
which keep higher level representations of the key data apart from the
decoded[] lists.

So far, apply_val() was dropping binary values in decoded[], which does
not work, because ProfileElementSD._pre_encode() overwrites
self.decoded[] from the higher level representation.

Implement using
- ProfileElementSD.find_key() and SecurityDomainKeyComponent to modify
  an exsiting entry, or
- ProfileElementSD.add_key() to create a new entry.

Before this patch, SdKey parameters seemed to patch PES successfully,
but their modifications did not end up in the encoded DER.

(BTW, this does not fix any other errors that may still be present in
the various SdKey subclasses, patches coming up.)

Related: SYS#6768
Change-Id: I07dfc378705eba1318e9e8652796cbde106c6a52
Jenkins: skip-card-test
Vadim Yanitskiy at

#28181 (Apr 24, 2026, 3:21:12 PM)

saip SmspTpScAddr: safeguard against decoding error

Reading the TS48 V6.0 eSIM_GTP_SAIP2.1A_NoBERTLV profile results in an
exception [1] in SmspTpScAddr. I have a caller that needs to skip
erratic values instead of raising.

The underlying issue, I presume, is that either the data needs
validation before decode_record_bin(), or decode_record_bin() needs
well-defined error handling.

So far I know only of this IndexError, so, as a workaround, catch that.

[1]
  File "/pysim/pySim/esim/saip/personalization.py", line 617, in get_values_from_pes
    ef_smsp_dec = ef_smsp.decode_record_bin(f_smsp.body, 1)
  File "/pysim/pySim/filesystem.py", line 1047, in decode_record_bin
    return parse_construct(self._construct, raw_bin_data)
  File "/application/venv/lib/python3.13/site-packages/osmocom/construct.py", line 550, in parse_construct
    parsed = c.parse(raw_bin_data, total_len=length, **context)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 404, in parse
    return self.parse_stream(io.BytesIO(data), **contextkw)
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 416, in parse_stream
    return self._parsereport(stream, context, "(parsing)")
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2236, in _parse
    subobj = sc._parsereport(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2770, in _parse
    return self.subcon._parsereport(stream, context, path)
           ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2236, in _parse
    subobj = sc._parsereport(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2770, in _parse
    return self.subcon._parsereport(stream, context, path)
           ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 820, in _parse
    return self._decode(obj, context, path)
           ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/osmocom/construct.py", line 268, in _decode
    if r[-1] == 'f':
       ~^^^^
  File "/application/venv/lib/python3.13/site-packages/osmocom/utils.py", line 50, in __getitem__
    return hexstr(super().__getitem__(val))
                  ~~~~~~~~~~~~~~~~~~~^^^^^
IndexError: string index out of range

Change-Id: Ic436e206776b81f24de126e8ee0ae8bf5f3e8d7a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28180 (Apr 24, 2026, 3:21:07 PM)

transitional name mapping

To help existing applications transition to a common naming scheme for
the SdKey classes, offer this intermediate result, where the SdKey
classes' .name are still unchanged as before generating them.

Change-Id: I974cb6c393a2ed2248a6240c2722d157e9235c33
Jenkins: skip-card-test
Vadim Yanitskiy at

#28179 (Apr 24, 2026, 3:20:56 PM)

remove transitional name mapping

This reverts commit I974cb6c393a2ed2248a6240c2722d157e9235c33

Now, finally, all SdKey classes have a unified logical naming scheme.

Change-Id: Ic185af4a903c2211a5361d023af9e7c6fc57ae78
Jenkins: skip-card-test
Vadim Yanitskiy at

#28178 (Apr 24, 2026, 3:20:48 PM)

add test_configurable_parameters.py

Change-Id: Ia55f0d11f8197ca15a948a83a34b3488acf1a0b4
Jenkins: skip-card-test
Vadim Yanitskiy at

#28177 (Apr 24, 2026, 3:20:41 PM)

personalization: implement reading back values from a PES

Implement get_values_from_pes(), the reverse direction of apply_val():
read back and return values from a ProfileElementSequence. Implement for
all ConfigurableParameter subclasses.

Future: SdKey.get_values_from_pes() is reading pe.decoded[], which works
fine, but I07dfc378705eba1318e9e8652796cbde106c6a52 will change this
implementation to use the higher level ProfileElementSD members.

Implementation detail:

Implement get_values_from_pes() as classmethod that returns a generator.
Subclasses should yield all occurences of their parameter in a given
PES.

For example, the ICCID can appear in multiple places.
Iccid.get_values_from_pes() yields all of the individual values. A set()
of the results quickly tells whether the PES is consistent.

Rationales for reading back values:

This allows auditing an eSIM profile, particularly for producing an
output.csv from a batch personalization (that generated lots of random
key material which now needs to be fed to an HLR...).

Reading back from a binary result is more reliable than storing the
values that were fed into a personalization.
By auditing final DER results with this code, I discovered:
- "oh, there already was some key material in my UPP template."
- "all IMSIs ended up the same, forgot to set up the parameter."
- the SdKey.apply() implementations currently don't work, see
  I07dfc378705eba1318e9e8652796cbde106c6a52 for a fix.

Change-Id: I234fc4317f0bdc1a486f0cee4fa432c1dce9b463
Jenkins: skip-card-test
Vadim Yanitskiy at

#28176 (Apr 24, 2026, 3:20:33 PM)

use random.SystemRandom as random nr source (/dev/urandom)

/dev/urandom is somewhat better than python's PRNG

Change-Id: I6de38c14ac6dd55bc84d53974192509c18d02bfa
Jenkins: skip-card-test
Vadim Yanitskiy at

#28175 (Apr 24, 2026, 3:20:23 PM)

personalization: add get_typical_input_len() to ConfigurableParameter

The aim is to tell a user interface how wide an input text field should
be chosen to be convenient -- ideally showing the entire value in all
cases, but not too huge for fields that have no sane size limit.

Change-Id: I2568a032167a10517d4d75d8076a747be6e21890
Jenkins: skip-card-test
Vadim Yanitskiy at

#28174 (Apr 24, 2026, 3:20:20 PM)

personalization.ConfigurableParameter: fix BytesIO() input

Change-Id: I0ad160eef9015e76eef10baee7c6b606fe249123
Jenkins: skip-card-test
Vadim Yanitskiy at

#28173 (Apr 24, 2026, 3:20:18 PM)

saip: add numeric_base indicator to ConfigurableParameter

By default, numeric_base = None, to indicate that there are no explicit
limitations on the number space.

For parameters that are definitely decimal, set numeric_base = 10.
For definitely hexadecimal, set numeric_base = 16.

Do the same for ConfigurableParameter as well as ParamSource, so callers
can match them up: if a parameter is numeric_base = 10, then omit
sources that are numeric_base = 16, and vice versa.

Change-Id: Ib0977bbdd9a85167be7eb46dd331fedd529dae01
Jenkins: skip-card-test
Vadim Yanitskiy at

#28172 (Apr 24, 2026, 3:20:14 PM)

esim.saip.personalization: fix TLSPSK keys

Add AES variant of TLSPSK DEK (SCP81 KVN40 key_id=0x02).

Change-Id: I713a008fd26bbfcf437e0f29717b753f058ce76a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28171 (Apr 24, 2026, 3:20:11 PM)

param_source: allow plugging a random implementation (for testing)

Change-Id: Idce2b18af70c17844d6f09f7704efc869456ac39
Jenkins: skip-card-test
Vadim Yanitskiy at

#28170 (Apr 24, 2026, 3:20:05 PM)

ConfigurableParameter: safer val length check

Change-Id: Ibe91722ed1477b00d20ef5e4e7abd9068ff2f3e4
Jenkins: skip-card-test
Vadim Yanitskiy at

#28169 (Apr 24, 2026, 3:20:01 PM)

MncLen

Change-Id: I6c600faeab00ffb072acbe94c9a8b2d1397c07d3
Jenkins: skip-card-test
Vadim Yanitskiy at

#28168 (Apr 24, 2026, 3:19:57 PM)

personalization: make AlgorithmID a new EnumParam

The AlgorithmID has a few preset values, and hardly anyone knows which
is which. So instead of entering '1', '2' or '3', make it work with
prededined values 'Milenage', 'TUAK' and 'usim-test'.

Implement the enum value part abstractly in new EnumParam.

Make AlgorithmID a subclass of EnumParam and define the values as from
pySim/esim/asn1/saip/PE_Definitions-3.3.1.asn

Related: SYS#6768
Change-Id: I71c2ec1b753c66cb577436944634f32792353240
Jenkins: skip-card-test
Vadim Yanitskiy at

#28167 (Apr 24, 2026, 3:19:53 PM)

generate sdkey classes from a list

Change-Id: Ic92ddea6e1fad8167ea75baf78ffc3eb419838c4
Jenkins: skip-card-test
Vadim Yanitskiy at

#28166 (Apr 24, 2026, 3:19:48 PM)

saip SmspTpScAddr.get_values_from_pes: allow empty values

Change-Id: Ibbdd08f96160579238b50699091826883f2e9f5a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28165 (Apr 24, 2026, 3:19:44 PM)

saip: SdKey.__doc__: update SdKey listing

Change-Id: Ib5011b0c7d76b082231744cf09077628dc4e69b7
Jenkins: skip-card-test
Vadim Yanitskiy at

#28164 (Apr 24, 2026, 3:19:38 PM)

test_configurable_parameters.py: add tests for new parameters

For:
SmspTpScAddr
MilenageRotation
MilenageXoringConstants
TuakNrOfKeccak

Change-Id: Iecbea14fe31a9ee08d871dcde7f295d26d7bd001
Jenkins: skip-card-test
Vadim Yanitskiy at

#28163 (Apr 24, 2026, 3:19:33 PM)

personalization: fix EF_SMSP length, alpha_id padding

The efFileSize needs to be updated and the alpha_id needs to be != None.

Change-Id: Ief6e02517f3e96158a2509d763b88aec4bd5a296
Jenkins: skip-card-test
Vadim Yanitskiy at

#28162 (Apr 24, 2026, 3:19:28 PM)

personalization: add int as input type for BinaryParameter

Change-Id: I31d8142cb0847a8b291f8dc614d57cb4734f0190
Jenkins: skip-card-test
Vadim Yanitskiy at

#28161 (Apr 24, 2026, 3:19:23 PM)

personalization: add param_source.py, add batch.py

Implement pySim.esim.saip.batch.BatchPersonalization,
generating N eSIM profiles from a preset configuration.

Batch parameters can be fed by a constant, incrementing, random or from
CSV rows: add pySim.esim.saip.param_source.* classes to feed such input
to each of the BatchPersonalization's ConfigurableParameter instances.

Related: SYS#6768
Change-Id: I01ae40a06605eb205bfb409189fcd2b3a128855a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28160 (Apr 24, 2026, 3:19:15 PM)

add comment about not updating existing key_usage_qualifier

Change-Id: Ie23ae5fde17be6b37746784bf1601b4d0874397a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28159 (Apr 24, 2026, 3:19:08 PM)

saip/param_source: try to not repeat random values

Change-Id: I4fa743ef5677580f94b9df16a5051d1d178edeb0
Jenkins: skip-card-test
Vadim Yanitskiy at

#28158 (Apr 24, 2026, 3:19:00 PM)

sdkeys kv40 aes

Change-Id: If5b53c840ebd1f224f9bb4706a602b415194f47b
Jenkins: skip-card-test
Vadim Yanitskiy at

#28157 (Apr 24, 2026, 3:18:55 PM)

SdKey KVN4X ID02: set key_usage_qual=0x48

Related: SYS#7865
Change-Id: Idc5d33a4a003801f60c95fff6931706a9aeb6692
Jenkins: skip-card-test
Vadim Yanitskiy at

#28156 (Apr 24, 2026, 3:18:51 PM)

use secrets.SystemRandom as secure random nr source

secrets.SystemRandom is defined as the most secure random source
available on the given operating system.

Change-Id: I8049cd1292674b3ced82b0926569128535af6efe
Jenkins: skip-card-test
Vadim Yanitskiy at

#28155 (Apr 24, 2026, 3:18:46 PM)

add test_param_src.py

Change-Id: I03087b84030fddae98b965e0075d44e04ec6ba5c
Jenkins: skip-card-test
Vadim Yanitskiy at

#28154 (Apr 24, 2026, 3:18:41 PM)

personalization audit: optionally audit all (unknown) SD keys

By a flag, allow to audit also all Security Domain KVN that we have
*not* created ConfigurableParameter subclasses for.

For example, SCP80 has reserved kvn 0x01..0x0f, but we offer only
Scp80Kvn01, Scp80Kvn02, Scp80Kvn03. So we would not show kvn
0x03..0x0f in an audit.

This patch includes audits of all SD key kvn there may be in the UPP.
This will help to spot SD keys that may already be present in a UPP
template, with unexpected / unusual kvn.

Change-Id: Icaf6f7b589f117868633c0968a99f2f0252cf612
Jenkins: skip-card-test
Vadim Yanitskiy at

#28153 (Apr 24, 2026, 3:18:37 PM)

personalization: indicate default ParamSource per ConfigurableParameter

Add default_source class members pointing to ParamSource classes to all
ConfigurableParameter subclasses.

This is useful to automatically set up a default ParamSource for a given
ConfigurableParameter subclass, during user interaction to produce a
batch personalization.

For example, if the user selects a Pin1 parameter, a calling program can
implicitly set this to a RandomDigitSource, which will magically make it
work the way that most users need.

BTW, default_source and default_value can be combined to configure a
matching ParamSource instance:

  my_source = MyParam.default_source.from_str( MyParam.default_value )

Change-Id: Ie58d13bce3fa1aa2547cf3cee918c2f5b30a8b32
Jenkins: skip-card-test
Vadim Yanitskiy at

#28152 (Apr 24, 2026, 3:18:33 PM)

UppAudit: better indicate exception cause

Change-Id: I4d986b89a473a5b12ed56b4710263b034876a33e
Jenkins: skip-card-test
Vadim Yanitskiy at

#28151 (Apr 24, 2026, 3:18:29 PM)

comment in uicc.py on Security Domain Keys: add SCP81

Change-Id: Ib0205880f58e78c07688b4637abd5f67ea0570d1
Jenkins: skip-card-test
Vadim Yanitskiy at

#28150 (Apr 24, 2026, 3:18:25 PM)

ConfigurableParameter: do not magically overwrite the 'name' attribute

Change-Id: I6f631444c6addeb7ccc5f6c55b9be3dc83409169
Jenkins: skip-card-test
Vadim Yanitskiy at

#28149 (Apr 24, 2026, 3:18:21 PM)

personalization: implement UppAudit and BatchAudit

Change-Id: Iaab336ca91b483ecdddd5c6c8e08dc475dc6bd0a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28148 (Apr 24, 2026, 10:59:18 AM)

personalization: add param_source.py, add batch.py

Implement pySim.esim.saip.batch.BatchPersonalization,
generating N eSIM profiles from a preset configuration.

Batch parameters can be fed by a constant, incrementing, random or from
CSV rows: add pySim.esim.saip.param_source.* classes to feed such input
to each of the BatchPersonalization's ConfigurableParameter instances.

Related: SYS#6768
Change-Id: I01ae40a06605eb205bfb409189fcd2b3a128855a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28147 (Apr 24, 2026, 10:02:10 AM)

jobs/gerrit-verifications.yml: pysim: allow skipping card tests

I've already implemented this logic in 6a3b8a0, however by mistake
I added it to master-builds.yml instead of gerrit-verifications.yml.
This is wrong because we specifically need this feature for Jenkins
verification, not for the master builds.

For daily master builds, on the other hand, we specifically want to
execute all existing job types, so revert my recent changes from
master-builds.yml, but keep the new job type.

Change-Id: I986d88545f64e13cd571ba9ff56bc924822e39a0
Fixes: 6a3b8a0 ("jobs/master-builds.yml: pysim: allow skipping card tests")
Vadim Yanitskiy at

#28146 (Apr 23, 2026, 11:40:34 PM)

debian-trixie-build: add tshark

This is needed for running pysim unit tests on generic nodes.
As of now we're executing them on the 'simtester' node, which cannot
run more than one job at once, making build verification for large
pysim patchsets extremely slow.

Change-Id: Idbe934e5cc29b06fd1b13b85893de5856eca836e
Related: osmo-ci.git I986d88545f64e13cd571ba9ff56bc924822e39a0
Vadim Yanitskiy at

#28145 (Apr 23, 2026, 10:24:08 PM)

saip SmspTpScAddr: safeguard against decoding error

Reading the TS48 V6.0 eSIM_GTP_SAIP2.1A_NoBERTLV profile results in an
exception [1] in SmspTpScAddr. I have a caller that needs to skip
erratic values instead of raising.

The underlying issue, I presume, is that either the data needs
validation before decode_record_bin(), or decode_record_bin() needs
well-defined error handling.

So far I know only of this IndexError, so, as a workaround, catch that.

[1]
  File "/pysim/pySim/esim/saip/personalization.py", line 617, in get_values_from_pes
    ef_smsp_dec = ef_smsp.decode_record_bin(f_smsp.body, 1)
  File "/pysim/pySim/filesystem.py", line 1047, in decode_record_bin
    return parse_construct(self._construct, raw_bin_data)
  File "/application/venv/lib/python3.13/site-packages/osmocom/construct.py", line 550, in parse_construct
    parsed = c.parse(raw_bin_data, total_len=length, **context)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 404, in parse
    return self.parse_stream(io.BytesIO(data), **contextkw)
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 416, in parse_stream
    return self._parsereport(stream, context, "(parsing)")
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2236, in _parse
    subobj = sc._parsereport(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2770, in _parse
    return self.subcon._parsereport(stream, context, path)
           ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2236, in _parse
    subobj = sc._parsereport(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2770, in _parse
    return self.subcon._parsereport(stream, context, path)
           ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 820, in _parse
    return self._decode(obj, context, path)
           ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/osmocom/construct.py", line 268, in _decode
    if r[-1] == 'f':
       ~^^^^
  File "/application/venv/lib/python3.13/site-packages/osmocom/utils.py", line 50, in __getitem__
    return hexstr(super().__getitem__(val))
                  ~~~~~~~~~~~~~~~~~~~^^^^^
IndexError: string index out of range

Change-Id: Ic436e206776b81f24de126e8ee0ae8bf5f3e8d7a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28144 (Apr 23, 2026, 10:24:06 PM)

personalization.ConfigurableParameter: fix BytesIO() input

Change-Id: I0ad160eef9015e76eef10baee7c6b606fe249123
Jenkins: skip-card-test
Vadim Yanitskiy at

#28143 (Apr 23, 2026, 10:24:03 PM)

personalization: add param_source.py, add batch.py

Implement pySim.esim.saip.batch.BatchPersonalization,
generating N eSIM profiles from a preset configuration.

Batch parameters can be fed by a constant, incrementing, random or from
CSV rows: add pySim.esim.saip.param_source.* classes to feed such input
to each of the BatchPersonalization's ConfigurableParameter instances.

Related: SYS#6768
Change-Id: I01ae40a06605eb205bfb409189fcd2b3a128855a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28142 (Apr 23, 2026, 10:24:00 PM)

saip: SdKey.__doc__: update SdKey listing

Change-Id: Ib5011b0c7d76b082231744cf09077628dc4e69b7
Jenkins: skip-card-test
Vadim Yanitskiy at

#28141 (Apr 23, 2026, 10:23:55 PM)

esim.saip.personalization: fix TLSPSK keys

Add AES variant of TLSPSK DEK (SCP81 KVN40 key_id=0x02).

Change-Id: I713a008fd26bbfcf437e0f29717b753f058ce76a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28140 (Apr 23, 2026, 10:23:52 PM)

MncLen

Change-Id: I6c600faeab00ffb072acbe94c9a8b2d1397c07d3
Jenkins: skip-card-test
Vadim Yanitskiy at

#28139 (Apr 23, 2026, 10:23:48 PM)

saip/param_source: try to not repeat random values

Change-Id: I4fa743ef5677580f94b9df16a5051d1d178edeb0
Jenkins: skip-card-test
Vadim Yanitskiy at

#28138 (Apr 23, 2026, 10:23:45 PM)

add comment about not updating existing key_usage_qualifier

Change-Id: Ie23ae5fde17be6b37746784bf1601b4d0874397a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28137 (Apr 23, 2026, 10:23:42 PM)

test_configurable_parameters.py: add tests for new parameters

For:
SmspTpScAddr
MilenageRotation
MilenageXoringConstants
TuakNrOfKeccak

Change-Id: Iecbea14fe31a9ee08d871dcde7f295d26d7bd001
Jenkins: skip-card-test
Vadim Yanitskiy at

#28136 (Apr 23, 2026, 10:23:39 PM)

saip SmspTpScAddr.get_values_from_pes: allow empty values

Change-Id: Ibbdd08f96160579238b50699091826883f2e9f5a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28135 (Apr 23, 2026, 10:23:36 PM)

use secrets.SystemRandom as secure random nr source

secrets.SystemRandom is defined as the most secure random source
available on the given operating system.

Change-Id: I8049cd1292674b3ced82b0926569128535af6efe
Jenkins: skip-card-test
Vadim Yanitskiy at

#28134 (Apr 23, 2026, 10:23:32 PM)

UppAudit: better indicate exception cause

Change-Id: I4d986b89a473a5b12ed56b4710263b034876a33e
Jenkins: skip-card-test
Vadim Yanitskiy at

#28133 (Apr 23, 2026, 10:23:28 PM)

personalization: add get_typical_input_len() to ConfigurableParameter

The aim is to tell a user interface how wide an input text field should
be chosen to be convenient -- ideally showing the entire value in all
cases, but not too huge for fields that have no sane size limit.

Change-Id: I2568a032167a10517d4d75d8076a747be6e21890
Jenkins: skip-card-test
Vadim Yanitskiy at

#28132 (Apr 23, 2026, 10:23:24 PM)

use random.SystemRandom as random nr source (/dev/urandom)

/dev/urandom is somewhat better than python's PRNG

Change-Id: I6de38c14ac6dd55bc84d53974192509c18d02bfa
Jenkins: skip-card-test
Vadim Yanitskiy at

#28131 (Apr 23, 2026, 10:23:20 PM)

personalization: fix SdKey.apply_val() implementation

'securityDomain' elements are decoded to ProfileElementSD instances,
which keep higher level representations of the key data apart from the
decoded[] lists.

So far, apply_val() was dropping binary values in decoded[], which does
not work, because ProfileElementSD._pre_encode() overwrites
self.decoded[] from the higher level representation.

Implement using
- ProfileElementSD.find_key() and SecurityDomainKeyComponent to modify
  an exsiting entry, or
- ProfileElementSD.add_key() to create a new entry.

Before this patch, SdKey parameters seemed to patch PES successfully,
but their modifications did not end up in the encoded DER.

(BTW, this does not fix any other errors that may still be present in
the various SdKey subclasses, patches coming up.)

Related: SYS#6768
Change-Id: I07dfc378705eba1318e9e8652796cbde106c6a52
Jenkins: skip-card-test
Vadim Yanitskiy at

#28130 (Apr 23, 2026, 10:23:16 PM)

personalization: indicate default ParamSource per ConfigurableParameter

Add default_source class members pointing to ParamSource classes to all
ConfigurableParameter subclasses.

This is useful to automatically set up a default ParamSource for a given
ConfigurableParameter subclass, during user interaction to produce a
batch personalization.

For example, if the user selects a Pin1 parameter, a calling program can
implicitly set this to a RandomDigitSource, which will magically make it
work the way that most users need.

BTW, default_source and default_value can be combined to configure a
matching ParamSource instance:

  my_source = MyParam.default_source.from_str( MyParam.default_value )

Change-Id: Ie58d13bce3fa1aa2547cf3cee918c2f5b30a8b32
Jenkins: skip-card-test
Vadim Yanitskiy at

#28129 (Apr 23, 2026, 10:23:12 PM)

sdkeys kv40 aes

Change-Id: If5b53c840ebd1f224f9bb4706a602b415194f47b
Jenkins: skip-card-test
Vadim Yanitskiy at

#28128 (Apr 23, 2026, 10:23:09 PM)

SdKey KVN4X ID02: set key_usage_qual=0x48

Related: SYS#7865
Change-Id: Idc5d33a4a003801f60c95fff6931706a9aeb6692
Jenkins: skip-card-test
Vadim Yanitskiy at

#28127 (Apr 23, 2026, 10:23:05 PM)

personalization: implement reading back values from a PES

Implement get_values_from_pes(), the reverse direction of apply_val():
read back and return values from a ProfileElementSequence. Implement for
all ConfigurableParameter subclasses.

Future: SdKey.get_values_from_pes() is reading pe.decoded[], which works
fine, but I07dfc378705eba1318e9e8652796cbde106c6a52 will change this
implementation to use the higher level ProfileElementSD members.

Implementation detail:

Implement get_values_from_pes() as classmethod that returns a generator.
Subclasses should yield all occurences of their parameter in a given
PES.

For example, the ICCID can appear in multiple places.
Iccid.get_values_from_pes() yields all of the individual values. A set()
of the results quickly tells whether the PES is consistent.

Rationales for reading back values:

This allows auditing an eSIM profile, particularly for producing an
output.csv from a batch personalization (that generated lots of random
key material which now needs to be fed to an HLR...).

Reading back from a binary result is more reliable than storing the
values that were fed into a personalization.
By auditing final DER results with this code, I discovered:
- "oh, there already was some key material in my UPP template."
- "all IMSIs ended up the same, forgot to set up the parameter."
- the SdKey.apply() implementations currently don't work, see
  I07dfc378705eba1318e9e8652796cbde106c6a52 for a fix.

Change-Id: I234fc4317f0bdc1a486f0cee4fa432c1dce9b463
Jenkins: skip-card-test
Vadim Yanitskiy at

#28126 (Apr 23, 2026, 10:23:02 PM)

personalization: implement UppAudit and BatchAudit

Change-Id: Iaab336ca91b483ecdddd5c6c8e08dc475dc6bd0a
Jenkins: skip-card-test
Vadim Yanitskiy at

#28125 (Apr 23, 2026, 10:22:59 PM)

transitional name mapping

To help existing applications transition to a common naming scheme for
the SdKey classes, offer this intermediate result, where the SdKey
classes' .name are still unchanged as before generating them.

Change-Id: I974cb6c393a2ed2248a6240c2722d157e9235c33
Jenkins: skip-card-test
Vadim Yanitskiy at

#28124 (Apr 23, 2026, 10:22:54 PM)

comment in uicc.py on Security Domain Keys: add SCP81

Change-Id: Ib0205880f58e78c07688b4637abd5f67ea0570d1
Jenkins: skip-card-test
Vadim Yanitskiy at

#28123 (Apr 23, 2026, 10:22:50 PM)

add test_configurable_parameters.py

Change-Id: Ia55f0d11f8197ca15a948a83a34b3488acf1a0b4
Jenkins: skip-card-test
Vadim Yanitskiy at

#28122 (Apr 23, 2026, 10:22:45 PM)

remove transitional name mapping

This reverts commit I974cb6c393a2ed2248a6240c2722d157e9235c33

Now, finally, all SdKey classes have a unified logical naming scheme.

Change-Id: Ic185af4a903c2211a5361d023af9e7c6fc57ae78
Jenkins: skip-card-test
Vadim Yanitskiy at

#28121 (Apr 23, 2026, 10:22:40 PM)

personalization: fix EF_SMSP length, alpha_id padding

The efFileSize needs to be updated and the alpha_id needs to be != None.

Change-Id: Ief6e02517f3e96158a2509d763b88aec4bd5a296
Jenkins: skip-card-test
Vadim Yanitskiy at

#28120 (Apr 23, 2026, 10:22:34 PM)

personalization: add int as input type for BinaryParameter

Change-Id: I31d8142cb0847a8b291f8dc614d57cb4734f0190
Jenkins: skip-card-test
Vadim Yanitskiy at

#28119 (Apr 23, 2026, 10:22:30 PM)

generate sdkey classes from a list

Change-Id: Ic92ddea6e1fad8167ea75baf78ffc3eb419838c4
Jenkins: skip-card-test
Vadim Yanitskiy at

#28118 (Apr 23, 2026, 10:22:24 PM)

saip: SmspTpScAddr: fix get_values_from_pes

Change-Id: I2010305340499c907bb7618c04c61e194db34814
Jenkins: skip-card-test
Vadim Yanitskiy at

#28117 (Apr 23, 2026, 10:22:20 PM)

personalization audit: optionally audit all (unknown) SD keys

By a flag, allow to audit also all Security Domain KVN that we have
*not* created ConfigurableParameter subclasses for.

For example, SCP80 has reserved kvn 0x01..0x0f, but we offer only
Scp80Kvn01, Scp80Kvn02, Scp80Kvn03. So we would not show kvn
0x03..0x0f in an audit.

This patch includes audits of all SD key kvn there may be in the UPP.
This will help to spot SD keys that may already be present in a UPP
template, with unexpected / unusual kvn.

Change-Id: Icaf6f7b589f117868633c0968a99f2f0252cf612
Jenkins: skip-card-test
Vadim Yanitskiy at

#28116 (Apr 23, 2026, 10:22:14 PM)

add test_param_src.py

Change-Id: I03087b84030fddae98b965e0075d44e04ec6ba5c
Jenkins: skip-card-test
Vadim Yanitskiy at

#28115 (Apr 23, 2026, 10:22:10 PM)

personalization: make AlgorithmID a new EnumParam

The AlgorithmID has a few preset values, and hardly anyone knows which
is which. So instead of entering '1', '2' or '3', make it work with
prededined values 'Milenage', 'TUAK' and 'usim-test'.

Implement the enum value part abstractly in new EnumParam.

Make AlgorithmID a subclass of EnumParam and define the values as from
pySim/esim/asn1/saip/PE_Definitions-3.3.1.asn

Related: SYS#6768
Change-Id: I71c2ec1b753c66cb577436944634f32792353240
Jenkins: skip-card-test
Vadim Yanitskiy at

#28114 (Apr 23, 2026, 10:22:05 PM)

personalization: allow reading back multiple values from PES

Change-Id: Iecb68af7c216c6b9dc3add469564416b6f37f7b2
Jenkins: skip-card-test
Vadim Yanitskiy at

#28113 (Apr 23, 2026, 10:22:01 PM)

ConfigurableParameter: do not magically overwrite the 'name' attribute

Change-Id: I6f631444c6addeb7ccc5f6c55b9be3dc83409169
Jenkins: skip-card-test
Vadim Yanitskiy at

#28112 (Apr 23, 2026, 10:21:57 PM)

ConfigurableParameter: safer val length check

Change-Id: Ibe91722ed1477b00d20ef5e4e7abd9068ff2f3e4
Jenkins: skip-card-test
Vadim Yanitskiy at

#28111 (Apr 23, 2026, 10:21:50 PM)

saip: add numeric_base indicator to ConfigurableParameter

By default, numeric_base = None, to indicate that there are no explicit
limitations on the number space.

For parameters that are definitely decimal, set numeric_base = 10.
For definitely hexadecimal, set numeric_base = 16.

Do the same for ConfigurableParameter as well as ParamSource, so callers
can match them up: if a parameter is numeric_base = 10, then omit
sources that are numeric_base = 16, and vice versa.

Change-Id: Ib0977bbdd9a85167be7eb46dd331fedd529dae01
Jenkins: skip-card-test
Vadim Yanitskiy at

#28110 (Apr 23, 2026, 10:21:43 PM)

param_source: allow plugging a random implementation (for testing)

Change-Id: Idce2b18af70c17844d6f09f7704efc869456ac39
Jenkins: skip-card-test
Vadim Yanitskiy at

#28109 (Apr 23, 2026, 7:18:18 PM)

jobs/gerrit-verifications.yml: pysim: allow skipping card tests

I've already implemented this logic in 6a3b8a0, however by mistake
I added it to master-builds.yml instead of gerrit-verifications.yml.
This is wrong because we specifically need this feature for Jenkins
verification, not for the master builds.

For daily master builds, on the other hand, we specifically want to
execute all existing job types, so revert my recent changes from
master-builds.yml, but keep the new job type.

Change-Id: I986d88545f64e13cd571ba9ff56bc924822e39a0
Fixes: 6a3b8a0 ("jobs/master-builds.yml: pysim: allow skipping card tests")
Vadim Yanitskiy at

#28108 (Apr 23, 2026, 7:18:11 PM)

jobs/master-builds.yml: add missing job type 'distcheck'

We do have this job type in gerrit-verifications.yml, so it's executed
for each patch submitted to Gerrit.  However, we are not executing
'distcheck' during the daily master builds - fix this.

Change-Id: I4898ba712a29a6afc34bc22adec6a3131ce8c794
Fixes: 31fd5cf0 ("gerrit-verifications: execute 'distcheck' job for pysim")
Vadim Yanitskiy at

#28107 (Apr 23, 2026, 7:18:03 PM)

jobs/master-builds.yml: fix typo: crad-test -> card-test

Change-Id: I0686af6c026e298c86d3a64cc161e5c84ec7dc57
Fixes: ee1ef65 ("jobs/master-builds.yml: pysim: separate JOB_TYPE for card tests")
Vadim Yanitskiy at

#28106 (Apr 23, 2026, 6:49:26 PM)

contrib/jenkins.sh: separate JOB_TYPE for card tests

A separate job gives us a possibility to skip tests requiring physical
cards for specific commits that do not touch the core logic.  See the
related commits in osmo-ci.git.

Change-Id: If76d812ee43b7eb3b57fdc660c60bf31fbff5b16
Related: osmo-ci.git Ia48d1b468f65d7c2e6b4128eeac36d0f3d03c45e
Related: osmo-ci.git I986d88545f64e13cd571ba9ff56bc924822e39a0
Vadim Yanitskiy at

#28105 (Apr 23, 2026, 6:17:11 PM)

contrib/jenkins.sh: add setup_venv()

Reduece code duplication by factoring out virtualenv setup and
activation into a shell function.

Change-Id: Ibb193d12d5502c78104ef53badc6037f08e92df1
Vadim Yanitskiy at

#28104 (Apr 23, 2026, 4:57:46 PM)

contrib/jenkins.sh: separate JOB_TYPE for card tests

A separate job gives us a possibility to skip tests requiring physical
cards for specific commits that do not touch the core logic.  See the
related commits in osmo-ci.git.

Change-Id: If76d812ee43b7eb3b57fdc660c60bf31fbff5b16
Related: osmo-ci.git Ia48d1b468f65d7c2e6b4128eeac36d0f3d03c45e
Related: osmo-ci.git I986d88545f64e13cd571ba9ff56bc924822e39a0
Vadim Yanitskiy at

#28103 (Apr 23, 2026, 4:57:41 PM)

contrib/jenkins.sh: add setup_venv()

Reduece code duplication by factoring out virtualenv setup and
activation into a shell function.

Change-Id: Ibb193d12d5502c78104ef53badc6037f08e92df1
Vadim Yanitskiy at

#28102 (Apr 23, 2026, 4:50:27 PM)

contrib/jenkins.sh: separate JOB_TYPE for card tests

A separate job gives us a possibility to skip tests requiring physical
cards for specific commits that do not touch the core logic.  See the
related commits in osmo-ci.git.

Change-Id: If76d812ee43b7eb3b57fdc660c60bf31fbff5b16
Related: osmo-ci.git Ia48d1b468f65d7c2e6b4128eeac36d0f3d03c45e
Related: osmo-ci.git I986d88545f64e13cd571ba9ff56bc924822e39a0
Vadim Yanitskiy at

#28101 (Apr 23, 2026, 4:40:40 PM)

contrib/jenkins.sh: add setup_venv()

Reduece code duplication by factoring out virtualenv setup and
activation into a shell function.

Change-Id: Ibb193d12d5502c78104ef53badc6037f08e92df1
Vadim Yanitskiy at

#28100 (Apr 23, 2026, 4:40:35 PM)

contrib/jenkins.sh: separate JOB_TYPE for card tests

A separate job gives us a possibility to skip tests requiring physical
cards for specific commits that do not touch the core logic.  See the
related commits in osmo-ci.git.

Change-Id: If76d812ee43b7eb3b57fdc660c60bf31fbff5b16
Related: osmo-ci.git Ia48d1b468f65d7c2e6b4128eeac36d0f3d03c45e
Related: osmo-ci.git I986d88545f64e13cd571ba9ff56bc924822e39a0
Vadim Yanitskiy at

#28099 (Apr 23, 2026, 2:09:11 PM)

testenv: Allow adding extra parameters to podman

Allows to add additional command line parameters to podman, if defined
int the testsuite section of testenv.cfg:

[testsuite]
...
podman_extra=--volume /dev/bus/usb:/dev/bus/usb

Change-Id: I6a2be0d60efcd70ea2081e0314927885085bb5e0
Andreas Eversberg at

#28098 (Apr 23, 2026, 1:34:45 PM)

OBS: build_srcpkg.Dockerfile: add dh-runit

Add dh-runit, so we can build source packages of newer versions of
pcsc-lite.

Related: https://salsa.debian.org/debian/pcsc-lite/-/commit/c7c40df72dc3c754341501e34aa096fd72a61cef
Change-Id: I8d852cebb9decb3c881fd3ff9b530213bade0216
Oliver Smith at

#28097 (Apr 23, 2026, 1:23:27 PM)

pySim-prog/cards: fix programming of EF.SMSP

The legacy code found in legacy/cards.py does not use the modern
construct based encoder (pySim-read uses it). The card classes either
use their own implementation of update_smsp or use the generic method
provided by the SimCard class. The latter one is true for FairwavesSIM
and WavemobileSim.

Unfortunately the implementation found in the SimCard is wrong. It
adds padding at the end of the file instead of the beginning. This
completely messes up the contents of EF.SMSP for the cards using this
method. To fix this, let's use the leftpad feature provided by
the update_record. This will ensure a correct alignment of the file
contents.

Related: SYS#7765
Change-Id: Ie112418f1f1461762d61365d3863181ca6be7245
pmaier@sysmocom.de at

#28096 (Apr 23, 2026, 1:23:25 PM)

ts_51_011/EF.SMSP: fix handling of 'alpha_id' field

The field 'alpha_id' is technically not an optional field, even though
the specification describes it as optional. Once the card manufacturer
decides that the field should be present, it must be always present and
vice versa.

(see code comment for a more detailed description)

Related: SYS#7765
Change-Id: I0ec99b2648b22c56f9145345e4cd8776f9217701
pmaier@sysmocom.de at

#28095 (Apr 23, 2026, 1:13:27 PM)

Fix: Prevent bankd from exiting upon SIGPIPE

IF a client disconnects from a worker thread while the worker is
responding to a to a request from that client, the socket is closed and
SIGPIPE is sent to the worker, causing the application to exit.

To prevent this, all workers have a dummy handler to prevent this. Now
the worker can handle the closing of the socket.

Change-Id: I13d6e9da48d12f93c00bd2d021789bde71aca7cf
Andreas Eversberg at

#28094 (Apr 23, 2026, 1:13:24 PM)

Fix: Prevent race conditions when accessing slotmap in bankd

All threads (main and workers) can use slotmap_by_bank() and
slotmap_by_client() to get a mapping entry from the slot map. While
working with this entry (reading values), it could be deleted by a
different thread.

For example, if a client connects to a worker, the worker will check if
there is an existing mapping between a reader and this client. If it
exists, slotmap_by_client() will return a pointer. If the mapping is
deleted at this time by the server, the worker uses a pointer to a
mapping entry that has just been freed.

Change-Id: I3464726f37beb7c47b4e1f00c018ffa4f3948906
Andreas Eversberg at

#28093 (Apr 23, 2026, 1:10:57 PM)

pySim-prog/cards: fix programming of EF.SMSP

The legacy code found in legacy/cards.py does not use the modern
construct based encoder (pySim-read uses it). The card classes either
use their own implementation of update_smsp or use the generic method
provided by the SimCard class. The latter one is true for FairwavesSIM
and WavemobileSim.

Unfortunately the implementation found in the SimCard is wrong. It
adds padding at the end of the file instead of the beginning. This
completely messes up the contents of EF.SMSP for the cards using this
method. To fix this, let's use the leftpad feature provided by
the update_record. This will ensure a correct alignment of the file
contents.

Related: SYS#7765
Change-Id: Ie112418f1f1461762d61365d3863181ca6be7245
pmaier@sysmocom.de at

#28092 (Apr 23, 2026, 1:10:54 PM)

ts_51_011/EF.SMSP: fix handling of 'alpha_id' field

The field 'alpha_id' is technically not an optional field, even though
the specification describes it as optional. Once the card manufacturer
decides that the field should be present, it must be always present and
vice versa.

(see code comment for a more detailed description)

Related: SYS#7765
Change-Id: I0ec99b2648b22c56f9145345e4cd8776f9217701
pmaier@sysmocom.de at

#28091 (Apr 23, 2026, 1:02:33 PM)

ts_51_011/EF.SMSP: fix handling of 'alpha_id' field

The field 'alpha_id' is technically not an optional field, even though
the specification describes it as optional. Once the card manufacturer
decides that the field should be present, it must be always present and
vice versa.

(see code comment for a more detailed description)

Related: SYS#7765
Change-Id: I0ec99b2648b22c56f9145345e4cd8776f9217701
pmaier@sysmocom.de at

#28090 (Apr 23, 2026, 1:02:21 PM)

pySim-prog/cards: fix programming of EF.SMSP

The legacy code found in legacy/cards.py does not use the modern
construct based encoder (pySim-read uses it). The card classes either
use their own implementation of update_smsp or use the generic method
provided by the SimCard class. The latter one is true for FairwavesSIM
and WavemobileSim.

Unfortunately the implementation found in the SimCard is wrong. It
adds padding at the end of the file instead of the beginning. This
completely messes up the contents of EF.SMSP for the cards using this
method. To fix this, let's use the leftpad feature provided by
the update_record. This will ensure a correct alignment of the file
contents.

Related: SYS#7765
Change-Id: Ie112418f1f1461762d61365d3863181ca6be7245
pmaier@sysmocom.de at

#28089 (Apr 23, 2026, 12:37:13 PM)

testenv: Allow adding extra parameters to podman

Allows to add additional command line parameters to podman, if defined
int the testsuite section of testenv.cfg:

[testsuite]
...
podman_extra=--volume /dev/bus/usb:/dev/bus/usb

Change-Id: I6a2be0d60efcd70ea2081e0314927885085bb5e0
Andreas Eversberg at

#28088 (Apr 23, 2026, 12:28:53 PM)

testenv: Allow adding extra parameters to podman

Allows to add additional command line parameters to podman, if defined
int the testsuite section of testenv.cfg:

[testsuite]
...
podman_extra=--volume /dev/bus/usb:/dev/bus/usb

Change-Id: I6a2be0d60efcd70ea2081e0314927885085bb5e0
Andreas Eversberg at

#28087 (Apr 23, 2026, 11:53:03 AM)

Fix: Prevent bankd from exiting upon SIGPIPE

IF a client disconnects from a worker thread while the worker is
responding to a to a request from that client, the socket is closed and
SIGPIPE is sent to the worker, causing the application to exit.

To prevent this, all workers have a dummy handler to prevent this. Now
the worker can handle the closing of the socket.

Change-Id: I13d6e9da48d12f93c00bd2d021789bde71aca7cf
Andreas Eversberg at

#28086 (Apr 23, 2026, 11:52:59 AM)

Fix: Prevent race conditions when accessing slotmap in bankd

All threads (main and workers) can use slotmap_by_bank() and
slotmap_by_client() to get a mapping entry from the slot map. While
working with this entry (reading values), it could be deleted by a
different thread.

For example, if a client connects to a worker, the worker will check if
there is an existing mapping between a reader and this client. If it
exists, slotmap_by_client() will return a pointer. If the mapping is
deleted at this time by the server, the worker uses a pointer to a
mapping entry that has just been freed.

Change-Id: I3464726f37beb7c47b4e1f00c018ffa4f3948906
Andreas Eversberg at

#28085 (Apr 23, 2026, 11:13:49 AM)

jobs/master-builds.yml: pysim: allow skipping card tests

Skip tests requiring physical cards ("card-test") for commits
having a special marker in the COMMIT_MSG:

  Jenkins: skip-card-tests

This speeds up the build verification significantly, and may be
useful for patches that do not modify the core logic (such as
documentation improvements and misc fixes).

Change-Id: I591717a2e2659c02447087dec23aa279cfd55551
Vadim Yanitskiy at

#28084 (Apr 23, 2026, 11:09:02 AM)

tests/sysmo-octsim/run-tests: tempfile -> mktemp

Fix for:
  WARNING: tempfile is deprecated; consider using mktemp instead.

Change-Id: I785a81173aae7202e4c01ead0ced11142d2e1794
Oliver Smith at

#28083 (Apr 23, 2026, 11:07:49 AM)

tests/sysmo-octsim/run-tests: tempfile -> mktemp

Fix for:
  WARNING: tempfile is deprecated; consider using mktemp instead.

Change-Id: I785a81173aae7202e4c01ead0ced11142d2e1794
Oliver Smith at

#28082 (Apr 23, 2026, 10:22:47 AM)

ts_51_011/EF.SMSP: fix handling of 'alpha_id' field

The field 'alpha_id' is technically not an optional field, even though
the specification describes it as optional. Once the card manufacturer
decides that the field should be present, it must be always present and
vice versa.

(see code comment for a more detailed description)

Related: SYS#7765
Change-Id: I0ec99b2648b22c56f9145345e4cd8776f9217701
pmaier@sysmocom.de at

#28081 (Apr 23, 2026, 10:08:03 AM)

ts_51_011/EF.SMSP: fix handling of 'alpha_id' field

The field 'alpha_id' is technically not an optional field, even though
the specification describes it as optional. Once the card manufacturer
decides that the field should be present, it must be always present and
vice versa.

(see code comment for a more detailed description)

Related: SYS#7765
Change-Id: I0ec99b2648b22c56f9145345e4cd8776f9217701
pmaier@sysmocom.de at

#28080 (Apr 23, 2026, 9:30:05 AM)

ts_51_011/EF.SMSP: fix handling of 'alpha_id' field

The field 'alpha_id' is technically not an optional field, even though
the specification describes it as optional. Once the card manufacturer
decides that the field should be present, it must be always present and
vice versa.

(see code comment for a more detailed description)

Related: SYS#7765
Change-Id: I0ec99b2648b22c56f9145345e4cd8776f9217701
pmaier@sysmocom.de at

#28079 (Apr 22, 2026, 11:36:21 PM)

jobs/master-builds.yml: pysim: allow skipping card tests

Skip tests requiring physical cards ("card-test") for commits
having a special marker in the COMMIT_MSG:

  Jenkins: skip-card-tests

This speeds up the build verification significantly, and may be
useful for patches that do not modify the core logic (such as
documentation improvements and misc fixes).

Change-Id: I591717a2e2659c02447087dec23aa279cfd55551
Vadim Yanitskiy at

#28078 (Apr 22, 2026, 11:27:34 PM)

jobs/master-builds.yml: pysim: separate JOB_TYPE for card tests

Change-Id: Ia48d1b468f65d7c2e6b4128eeac36d0f3d03c45e
Depends: pysim.git If76d812ee43b7eb3b57fdc660c60bf31fbff5b16
Vadim Yanitskiy at

#28077 (Apr 22, 2026, 11:27:32 PM)

jobs/master-builds.yml: pysim: allow skipping card tests

Skip tests requiring physical cards ("card-test") for commits
having a special marker in the COMMIT_MSG:

  Jenkins: skip-card-tests

This speeds up the build verification significantly, and may be
useful for patches that do not modify the core logic (such as
documentation improvements and misc fixes).

Change-Id: I591717a2e2659c02447087dec23aa279cfd55551
Vadim Yanitskiy at

#28076 (Apr 22, 2026, 11:27:27 PM)

contrib/jenkins.sh: separate JOB_TYPE for card tests

A separate job gives us a possibility to skip tests requiring physical
cards for specific commits that do not touch the core logic.  See the
related commits in osmo-ci.git.

Change-Id: If76d812ee43b7eb3b57fdc660c60bf31fbff5b16
Related: osmo-ci.git Ia48d1b468f65d7c2e6b4128eeac36d0f3d03c45e
Related: osmo-ci.git I591717a2e2659c02447087dec23aa279cfd55551
Vadim Yanitskiy at

#28075 (Apr 22, 2026, 11:27:23 PM)

tests: pySim-smpp2sim_test.sh: fix copy-pasted comment

Change-Id: I8167c6a3251bb6755810c96075010e920ceee8ac
Jenkins: skip-card-tests
Vadim Yanitskiy at

#28074 (Apr 22, 2026, 10:45:20 PM)

tests: pySim-smpp2sim_test.sh: fix copy-pasted comment

Change-Id: I8167c6a3251bb6755810c96075010e920ceee8ac
Jenkins: skip-card-tests
Vadim Yanitskiy at

#28073 (Apr 22, 2026, 10:45:17 PM)

contrib/jenkins.sh: add support for "Jenkins: skip-card-tests" marker

Add a have_jenkins_marker() helper that checks the commit message
for a given value on the "Jenkins:" footer line, for instance:

  Jenkins: skip-card-tests

When this marker is present, the real-card integration tests
(pySim-prog_test and pySim-shell_test) are skipped, allowing commits
that don't affect card I/O to bypass long card-dependent test runs.

Change-Id: If76d812ee43b7eb3b57fdc660c60bf31fbff5b16
Jenkins: skip-card-tests
Vadim Yanitskiy at

#28072 (Apr 22, 2026, 10:37:24 PM)

tests: pySim-smpp2sim_test.sh: fix copy-pasted comment

Change-Id: I8167c6a3251bb6755810c96075010e920ceee8ac
Jenkins: skip-card-tests
Vadim Yanitskiy at

#28071 (Apr 22, 2026, 10:37:17 PM)

contrib/jenkins.sh: add setup_venv()

Change-Id: Ibb193d12d5502c78104ef53badc6037f08e92df1
Vadim Yanitskiy at

#28070 (Apr 22, 2026, 10:37:05 PM)

contrib/jenkins.sh: add support for "Jenkins: skip-card-tests" marker

Add a have_jenkins_marker() helper that checks the commit message
for a given value on the "Jenkins:" footer line, for instance:

  Jenkins: skip-card-tests

When this marker is present, the real-card integration tests
(pySim-prog_test and pySim-shell_test) are skipped, allowing commits
that don't affect card I/O to bypass long card-dependent test runs.

Change-Id: If76d812ee43b7eb3b57fdc660c60bf31fbff5b16
Jenkins: skip-card-tests
Vadim Yanitskiy at

#28069 (Apr 22, 2026, 10:27:54 PM)

build: detect pthread_setname_np and sched_* APIs, guard usage

Add configure checks for pthread_setname_np and sched_* functions.
Wrap their usage with HAVE_* guards to avoid build failures on
platforms where they are unavailable.

Return -ENOTSUP for unsupported scheduler operations.

Improves portability across non-Linux and restricted environments
(e.g. WebAssembly).

Change-Id: Ic3f1492544439d88c5e6683330c6696de1c2f85b
dtv.comp at

#28068 (Apr 22, 2026, 10:27:47 PM)

convolve: avoid function pointer casts by adding wrapper functions

Introduce _base_convolve_*_void() wrappers matching the expected
function pointer signatures and use them instead of casting
_base_convolve_* functions to (void *).

This removes unsafe function pointer casts and improves
type safety, which is required for stricter toolchains and
non-native targets (e.g. WebAssembly)

Change-Id: Idecb118be285eb3e4691d1761d0d8fa24fd80c75
dtv.comp at

#28067 (Apr 22, 2026, 10:22:19 PM)

device: add WebSDR radio backend

Introduce a new optional WebSDR device backend, enabled via
--with-websdr.

Add WebSDRDevice implementation and build integration, providing
a RadioDevice interface backed by callback hooks for control and
sample I/O.

Intended for Web-based deployments where osmo-trx interacts with
SDR hardware via a WebSDR/WebUSB frontend.

Change-Id: Ie459cbd70388dd8ff5b89221d30770bab0bd9014
dtv.comp at

#28066 (Apr 22, 2026, 10:22:14 PM)

transceiver: add optional WebSDR device support

- Add support for WebSDR devices enabled via the --with-websdr
configure flag.
- add libosmo-trx-websdr library and pkg-config file
- update .gitignore for wasm and pkg-config artifacts

Change-Id: Ia0d340c323c2eea28fbe82601ba0af7cfbd68f6d
dtv.comp at

#28065 (Apr 22, 2026, 9:20:19 PM)

abis: add optional WebSDR E1 input driver

Add a new optional E1 input backend for WebSDR, enabled via
--with-websdr.

Introduce input/websdr.c and public callback API to replace
socket-based IPA transport with a callback-driven interface
for OML/RSL and OSMUX.

Intended for WebAssembly builds where Osmocom components run
in a browser and communicate with SDR via WebUSB.

Change-Id: Ib804dc8eb67a91678603f54ea0beccd5c61e4a80
dtv.comp at

#28064 (Apr 22, 2026, 9:14:14 PM)

abis: add optional WebSDR E1 input driver

Add a new optional E1 input backend for WebSDR, enabled via
--with-websdr.

Introduce input/websdr.c and public callback API to replace
socket-based IPA transport with a callback-driven interface
for OML/RSL and OSMUX.

Intended for WebAssembly builds where Osmocom components run
in a browser and communicate with SDR via WebUSB.

Change-Id: Ib804dc8eb67a91678603f54ea0beccd5c61e4a80
dtv.comp at

#28063 (Apr 22, 2026, 9:12:11 PM)

vty: make CPU scheduling optional based on platform support

Add configure checks for sched_* APIs and guard their usage
in cpu_sched_vty with HAVE_SCHED_* macros.

If scheduler functions are not available, return -ENOTSUP
instead of failing at build time.

Also change osmo_cpu_sched_vty_init() to return int.

This improves portability on platforms lacking full sched
support (e.g. non-Linux or restricted environments).

Change-Id: Ic5b7e39fac16531d370cb81f769ba87fef18cb81
dtv.comp at

#28062 (Apr 22, 2026, 8:48:40 PM)

abis: add optional WebSDR E1 input driver

Add a new optional E1 input backend for WebSDR, enabled via
--with-websdr.

Introduce input/websdr.c and public callback API to replace
socket-based IPA transport with a callback-driven interface
for OML/RSL and OSMUX.

Intended for WebAssembly builds where Osmocom components run
in a browser and communicate with SDR via WebUSB.

Change-Id: Ib804dc8eb67a91678603f54ea0beccd5c61e4a80
dtv.comp at

#28061 (Apr 22, 2026, 10:56:51 AM)

OBS: build_srcpkg.Dockerfile: add dh-cmake

Add dh-cmake, so we can build source packages of programs using cmake,
such as kamailio.

Change-Id: I8b5debce4f2fc0c41c69f861822394e139ac5dfc
Oliver Smith at

#28060 (Apr 22, 2026, 12:21:23 AM)

timers: fix ATR timeout

Default WWT to 1.5s.

Both atr and card uart timeouts were combined in
7ae9a65c7fadf3d9d89370761c7352cbcac83a00 but the timeout
was accidentally left as 0 which was the original ATR fsm
state change timeout. The current code uses 0 as
"no timeout", so that killed the timeouts during the ATR.

Related: SYS#7991
Change-Id: I94d6641a10bf6d1df8640727e753da8171267339
ewild at

#28059 (Apr 21, 2026, 7:27:25 AM)

jobs/gerrit: fix artifacts logic

The previous logic failed when there are not artifacts for archiving,
for multiple reasons. Fix all of them:

* "allow-empty" needs to be set, so jenkins doesn't fail the job when it
  can't find any artifacts to archive.
* The "artifacts" string must not be empty even if "allow-empty" is set,
  as otherwise it assumes a configuration error.
* The jenkins jobs fails in the archiving step if the workspace dir
  doesn't exist.

Fixes: 4c392b9e ("jobs/gerrit: archive osmo-ccid-firmware artifacts")
Change-Id: If7a051d7be2beb617c2eda4fd1a669565c2c5b55
Oliver Smith at

#28058 (Apr 21, 2026, 7:18:00 AM)

tests/fetch_image: add SKIP_FETCH_IMAGE env var

Allow skipping the image fetch logic to let the gerrit job copy the
image from another job instead.

Related: osmo-ci I736b2b194813e6edff0197145fe08168c3e66903
Change-Id: I9445d6d5e4723bf6a87d4bffcdc638560471328b
Oliver Smith at

#28057 (Apr 21, 2026, 7:12:55 AM)

Fix: Remove slot mapping at bankd when client disconnects

If a client disconnects before removing the slot mapping, the slotmap
entry will not be removed automatically. A subsequent client connection
for the same mapping will then trigger the the error: “ignoring
identical slotmap.”

In a setup with multiple readers, there are multiple bankd worker
threads. If a client re-connects, but if its connection is accepted by
a different thread, subsequent reader access or unmapping will fail.
There will be no mapping at the new thread.

The approach of this fix is to remove the slot mapping, if the client
connection to the worker thread terminates.

Change-Id: I2fd03490e2506c55104309a0ef952389119023b8
Andreas Eversberg at

#28056 (Apr 21, 2026, 7:10:50 AM)

Fix access pcscd in various RemsimBankd_Tests

Access to pcscd was denied, so that bankd never conneced to the reader.
This caused TC_createMapping_exchangeTPDU to fail, because it requires
connection to virtual smart card for this test

Change-Id: Ibae1c5167daa0157058bc40ce1857c1e6bb9da31
Andreas Eversberg at

#28055 (Apr 21, 2026, 7:08:58 AM)

Fix: Remove slot mapping at bankd when client disconnects

If a client disconnects before removing the slot mapping, the slotmap
entry will not be removed automatically. A subsequent client connection
for the same mapping will then trigger the the error: “ignoring
identical slotmap.”

In a setup with multiple readers, there are multiple bankd worker
threads. If a client re-connects, but if its connection is accepted by
a different thread, subsequent reader access or unmapping will fail.
There will be no mapping at the new thread.

The approach of this fix is to remove the slot mapping, if the client
connection to the worker thread terminates.

Change-Id: I2fd03490e2506c55104309a0ef952389119023b8
Andreas Eversberg at

#28054 (Apr 21, 2026, 7:08:00 AM)

Fix access pcscd in various RemsimBankd_Tests

Access to pcscd was denied, so that bankd never conneced to the reader.
This caused TC_createMapping_exchangeTPDU to fail, because it requires
connection to virtual smart card for this test

Change-Id: Ibae1c5167daa0157058bc40ce1857c1e6bb9da31
Andreas Eversberg at

#28053 (Apr 21, 2026, 7:05:25 AM)

Fix bankd connection at RemsimClient_Tests.TC_bank_disconnect_reconnect

After each connection (initial connection and reconnect), the test must
wait for the bankd connection to be fully established. Previously the
IPA/RSPRO emulation failed, because the socket was closed before sending
the acknowledgemen, leading to a 'Broken pipe' error.

Change-Id: I0a8b339bcc4136442994b8825904df8aaf9aa95d
Andreas Eversberg at

#28052 (Apr 21, 2026, 6:58:22 AM)

Fix bankd connection at RemsimClient_Tests.TC_bank_disconnect_reconnect

After each connection (initial connection and reconnect), the test must
wait for the bankd connection to be fully established. Previously the
IPA/RSPRO emulation failed, because the socket was closed before sending
the acknowledgemen, leading to a 'Broken pipe' error.

Change-Id: I0a8b339bcc4136442994b8825904df8aaf9aa95d
Andreas Eversberg at

#28051 (Apr 21, 2026, 6:52:47 AM)

Fix: Remove slot mapping at bankd when client disconnects

If a client disconnects before removing the slot mapping, the slotmap
entry will not be removed automatically. A subsequent client connection
for the same mapping will then trigger the the error: “ignoring
identical slotmap.”

In a setup with multiple readers, there are multiple bankd worker
threads. If a client re-connects, but if its connection is accepted by
a different thread, subsequent reader access or unmapping will fail.
There will be no mapping at the new thread.

The approach of this fix is to remove the slot mapping, if the client
connection to the worker thread terminates.

Change-Id: I2fd03490e2506c55104309a0ef952389119023b8
Andreas Eversberg at

#28050 (Apr 21, 2026, 6:52:39 AM)

Fix bankd connection at RemsimClient_Tests.TC_bank_disconnect_reconnect

After each connection (initial connection and reconnect), the test must
wait for the bankd connection to be fully established. Previously the
IPA/RSPRO emulation failed, because the socket was closed before sending
the acknowledgemen, leading to a 'Broken pipe' error.

Change-Id: I0a8b339bcc4136442994b8825904df8aaf9aa95d
Andreas Eversberg at

#28049 (Apr 21, 2026, 6:52:27 AM)

Fix access pcscd in various RemsimBankd_Tests

Access to pcscd was denied, so that bankd never conneced to the reader.
This caused TC_createMapping_exchangeTPDU to fail, because it requires
connection to virtual smart card for this test

Change-Id: Ibae1c5167daa0157058bc40ce1857c1e6bb9da31
Andreas Eversberg at

#28048 (Apr 21, 2026, 6:45:14 AM)

jobs/gerrit-verifications: fix hwtest param

This must be a bool instead of a string. Without this patch, the
condition checking for the bool is always true.

Fixes: 986c2648 ("jobs/gerrit: run osmo-ccid-firmware-hwtest")
Change-Id: I3117ddab888dd226ed57b62b9b9e672f1cb9127d
Oliver Smith at

#28047 (Apr 21, 2026, 6:42:09 AM)

Fix: Remove slot mapping at bankd when client disconnects

If a client disconnects before removing the slot mapping, the slotmap
entry will not be removed automatically. A subsequent client connection
for the same mapping will then trigger the the error: “ignoring
identical slotmap.”

In a setup with multiple readers, there are multiple bankd worker
threads. If a client re-connects, but if its connection is accepted by
a different thread, subsequent reader access or unmapping will fail.
There will be no mapping at the new thread.

The approach of this fix is to remove the slot mapping, if the client
connection to the worker thread terminates.

Change-Id: I2fd03490e2506c55104309a0ef952389119023b8
Andreas Eversberg at

#28046 (Apr 21, 2026, 6:41:44 AM)

Fix bankd connection at RemsimClient_Tests.TC_bank_disconnect_reconnect

After each connection (initial connection and reconnect), the test must
wait for the bankd connection to be fully established. Previously the
IPA/RSPRO emulation failed, because the socket was closed before sending
the acknowledgemen, leading to a 'Broken pipe' error.

Change-Id: I0a8b339bcc4136442994b8825904df8aaf9aa95d
Andreas Eversberg at

#28045 (Apr 21, 2026, 6:41:05 AM)

Fix access pcscd in various RemsimBankd_Tests

Access to pcscd was denied, so that bankd never conneced to the reader.
This caused TC_createMapping_exchangeTPDU to fail, because it requires
connection to virtual smart card for this test

Change-Id: Ibae1c5167daa0157058bc40ce1857c1e6bb9da31
Andreas Eversberg at

#28044 (Apr 20, 2026, 2:39:21 PM)

Fix access pcscd in various RemsimBankd_Tests

Access to pcscd was denied, so that bankd never conneced to the reader.
This caused TC_createMapping_exchangeTPDU to fail, because it requires
connection to virtual smart card for this test

Change-Id: Ibae1c5167daa0157058bc40ce1857c1e6bb9da31
Andreas Eversberg at

#28043 (Apr 20, 2026, 2:39:12 PM)

Fix bankd connection at RemsimClient_Tests.TC_bank_disconnect_reconnect

After each connection (initial connection and reconnect), the test must
wait for the bankd connection to be fully established. Previously the
IPA/RSPRO emulation failed, because the socket was closed before sending
the acknowledgemen, leading to a 'Broken pipe' error.

Change-Id: I0a8b339bcc4136442994b8825904df8aaf9aa95d
Andreas Eversberg at

#28042 (Apr 20, 2026, 2:37:30 PM)

Fix: Remove slot mapping at bankd when client disconnects

If a client disconnects before removing the slot mapping, the slotmap
entry will not be removed automatically. A subsequent client connection
for the same mapping will then trigger the the error: “ignoring
identical slotmap.”

In a setup with multiple readers, there are multiple bankd worker
threads. If a client re-connects, but if its connection is accepted by
a different thread, subsequent reader access or unmapping will fail.
There will be no mapping at the new thread.

The approach of this fix is to remove the slot mapping, if the client
connection to the worker thread terminates.

Change-Id: I2fd03490e2506c55104309a0ef952389119023b8
Andreas Eversberg at

#28041 (Apr 20, 2026, 11:17:24 AM)

ansible/setup-simtest: sort packages

Change-Id: I9fac58407b7c5a38e2ed56e6e5718ce13ed23973
Oliver Smith at

#28040 (Apr 20, 2026, 11:17:21 AM)

ansible/hosts: update simtest

Change-Id: Ica3c229ddf617b61e88774d3b330263307f84e97
Oliver Smith at

#28039 (Apr 20, 2026, 11:17:18 AM)

ansible: openjdk: add mkdir ~/jenkins

Ensure the JDK can always be installed to /home/{{ jenkins_user
}}/jenkins/jdk/bin/java, even if ~/jenkins does not exit yet at this
point. This could be because jenkins didn't connect to the node yet, or
because the jenkins dir isn't set to ~/jenkins.

Related: OS#6998#note-4
Change-Id: I384398e2fe45988eaac32d61095c989914699245
Oliver Smith at

#28038 (Apr 20, 2026, 11:17:15 AM)

ansible/setup-simtest: add sudo and wget

Both are needed for the new openjdk install logic.

Related: OS#6998#note-3
Change-Id: I4d5c400daec9c74d069c60a6221ae57e8c6f7953
Oliver Smith at

#28037 (Apr 20, 2026, 11:17:12 AM)

ansible/setup-simtest: merge apt tasks

Do apt update and installing packages in one task, similar to how we do
it in other ansible yml files.

Change-Id: I269b368fdca682814976b2cda1c14c33529650b7
Oliver Smith at

#28036 (Apr 20, 2026, 11:17:09 AM)

ansible/simtest: remove pip install logic

The pip install logic fails with:
  :stderr: error: externally-managed-environment

Remove this. Dependencies are installed venv/virtualenv:
https://gitea.osmocom.org/sim-card/pysim/src/commit/c50f4b4a0222a964710ce3124a66fe13c804be65/contrib/jenkins.sh#L25-L30

Change-Id: I460e22d78966d14e02b639efc4f74d7356e22f28
Oliver Smith at

#28035 (Apr 20, 2026, 10:12:54 AM)

OBS: pyhss_download_deps: fix dependency loop

Fix that the Osmocom_OBS_nightly job is failing for the pyhss package
with a dependency loop in hatchling:

  LookupError: https://files.pythonhosted.org/…/hatchling-1.29.0.tar.gz (from https://pypi.org/simple/hatchling/) (requires-python:>=3.10) is already being built: hatchling>=1.21.0 from https://files.pythonhosted.org/…/hatchling-1.29.0.tar.gz

This happens as it recursively collects source packages and their
(build) dependencies:

  pymongo
  -> dnspython
  -> hatchling
  -> pluggy
  -> setuptools-scm
  -> vcs-versioning
  -> hatchling

When only ignoring the hatchling source package, we get a similar
dependency loop with pluggy, so ignore both source packages. Hatchling
gets added later as binary package and pluggy is only a build-time
dependency for hatchling. The resulting PyHSS package builds fine with
this change.

Change-Id: I0484627fd105627fabe9435379e704db54e72ae3
Oliver Smith at

#28034 (Apr 17, 2026, 1:49:30 PM)

osmo_io: iofd_txqueue_dequeue(): fix double next->io_len decrement

The fill-up logic in iofd_txqueue_dequeue() was incorrectly
decrementing next->io_len twice: once when removing a buffer that
didn't fit, and again when assigning to msg_iovlen.  This may cause
next->io_len to reach 0 and trigger an assert at osmo_io.c:274:

  Assert failed next->io_len > 0

Add separate osmo_io_backpressure_test to verify queue management
under network backpressure conditions.  Use separate .ok files for
poll vs io_uring backends since they produce different I/O patterns.
This unit test reproduces the assert when the fix is not applied.

Change-Id: Ia96e25d11d8d683fa9dd0c56bdac257992edd782
Fixes: 3c2a02db4 ("osmo-io: Put together message buffers when dequeued from tx queue")
Related: OS#6997
Vadim Yanitskiy at

#28033 (Apr 17, 2026, 1:43:30 PM)

osmo_io: iofd_txqueue_dequeue(): fix double next->io_len decrement

The fill-up logic in iofd_txqueue_dequeue() was incorrectly
decrementing next->io_len twice: once when removing a buffer that
didn't fit, and again when assigning to msg_iovlen.  This may cause
next->io_len to reach 0 and trigger an assert at osmo_io.c:274:

  Assert failed next->io_len > 0

Add separate osmo_io_backpressure_test to verify queue management
under network backpressure conditions.  Use separate .ok files for
poll vs io_uring backends since they produce different I/O patterns.
This unit test reproduces the assert when the fix is not applied.

Change-Id: Ia96e25d11d8d683fa9dd0c56bdac257992edd782
Fixes: 3c2a02db4 ("osmo-io: Put together message buffers when dequeued from tx queue")
Related: OS#6997
Vadim Yanitskiy at

#28032 (Apr 17, 2026, 11:36:57 AM)

jobs/gerrit: archive osmo-ccid-firmware artifacts

Prepare to use the built firmware in a new hwtest job.

Related: SYS#7963
Change-Id: Ib220f708725e502724ef0375130e7db77c6e91fa
Oliver Smith at

#28031 (Apr 17, 2026, 11:36:54 AM)

jobs/gerrit-osmo-ccid-firmware-hwtest: new job

Add a new test that flashes the firmware from the previous build job and
runs tests against it. Tests are intentionally from the master branch
for security reasons.

Related: SYS#7963
Depends: osmo-ccid-firmware I9445d6d5e4723bf6a87d4bffcdc638560471328b
Change-Id: I736b2b194813e6edff0197145fe08168c3e66903
Oliver Smith at

#28030 (Apr 17, 2026, 11:36:52 AM)

jobs/gerrit: run osmo-ccid-firmware-hwtest

Related: SYS#7963
Change-Id: I438239f65f4b52fb5c77654b366b3c3254fcb44f
Oliver Smith at

#28029 (Apr 17, 2026, 11:36:49 AM)

jenkins-gerrit/artifacts_download: new script

Add a script for downloading artifacts from the build job in a gerrit
pipeline, so it can be used in the hwtest job job.

pipeline: <--- URL to the pipeline is passed to all jobs
  parallel:
    sequential:
      build  <--- artifacts are here
      hwtest <--- will call the new script with the pipeline URL
    lint
    binpkgs
    ...

Related: SYS#7963
Change-Id: Ia96951d62b464b2e0b80f8e555cb77e5b9e52f78
Oliver Smith at

#28028 (Apr 17, 2026, 11:24:25 AM)

tests/fetch_image: add SKIP_FETCH_IMAGE env var

Allow skipping the image fetch logic to let the gerrit job copy the
image from another job instead.

Related: osmo-ci I736b2b194813e6edff0197145fe08168c3e66903
Change-Id: I9445d6d5e4723bf6a87d4bffcdc638560471328b
Oliver Smith at

#28027 (Apr 17, 2026, 11:12:50 AM)

tests/fetch_image: support copying from artifact

Allow copying the image from another job in
octsim_osmo-ccid-firmware-artifacts job.

Related: osmo-ci I736b2b194813e6edff0197145fe08168c3e66903
Change-Id: I9445d6d5e4723bf6a87d4bffcdc638560471328b
Oliver Smith at

#28026 (Apr 17, 2026, 10:39:45 AM)

ansible: ntpd: update for debian 13

Use the openntpd package, as there isn't a ntp package anymore. The
service gets enabled and started automatically after installing it, so
remove the block that did it manually.

Change-Id: I7dad2f0cc034f487d4c97ec37325dab667f24ce3
Oliver Smith at

#28025 (Apr 17, 2026, 10:39:41 AM)

ansible: add Debian-13.yml

Related: OS#6998
Change-Id: I34db89aba34e7c49843db0aa39fd593e35f4700a
Oliver Smith at

#28024 (Apr 17, 2026, 10:39:38 AM)

ansible: docker: update apt key install method

Fix that the deprecated method for installing the apt key for the docker
repository was still used.

Fix for (with debian 13):
  Failed to find required executable "apt-key" in paths: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Related: OS#6998
Change-Id: I8184b6f9369886b79a3cf015ceee6e46e38b089c
Oliver Smith at

#28023 (Apr 17, 2026, 10:39:36 AM)

ansible: lx2-raspbian{12 => 13}build-ansible

Related: OS#6998
Change-Id: I66afdc0ba86cfde6613226abba900c31e486f846
Oliver Smith at

#28022 (Apr 17, 2026, 10:18:11 AM)

ansible: add Debian-13.yml

Related: OS#6998
Change-Id: I34db89aba34e7c49843db0aa39fd593e35f4700a
Oliver Smith at

#28021 (Apr 17, 2026, 10:02:54 AM)

ansible: lx2-raspbian{12 => 13}build-ansible

Change-Id: I66afdc0ba86cfde6613226abba900c31e486f846
Oliver Smith at

#28020 (Apr 17, 2026, 10:02:51 AM)

ansible: jenkins: update install openjdk logic

New jenkins versions require newer java versions to be installed on the
jenkins nodes. Install openjdk from download.java.net instead of using
distribution packages, so we are not limited by what the distribution
offers (which is oftentimes not recent enough).

Change-Id: I1de9a67aafe71e8c8b77c57baddb09611cb2e1fd
Oliver Smith at

#28019 (Apr 17, 2026, 10:02:48 AM)

ansible: docker: update apt key install method

Fix that the deprecated method for installing the apt key for the docker
repository was still used.

Fix for:
  Failed to find required executable "apt-key" in paths: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Change-Id: I8184b6f9369886b79a3cf015ceee6e46e38b089c
Oliver Smith at

#28018 (Apr 17, 2026, 10:02:43 AM)

ansible: debian: remove logic for jessie

This is a really old release we don't use anymore, so clean up related
commands from the ansible tasks.

Change-Id: Ifad5e9088e026a61b2e3463936c1ba602f4a99df
Oliver Smith at

#28017 (Apr 16, 2026, 1:59:23 PM)

tests/fetch_image: support copying from artifact

Allow copying the image from another job in
octsim_osmo-ccid-firmware-artifacts job.

Related: osmo-ci I736b2b194813e6edff0197145fe08168c3e66903
Change-Id: I9445d6d5e4723bf6a87d4bffcdc638560471328b
Oliver Smith at

#28016 (Apr 16, 2026, 1:29:53 PM)

tests/fetch_image: support copying from artifact

Allow copying the image from another job in
octsim_osmo-ccid-firmware-artifacts job.

Related: osmo-ci I736b2b194813e6edff0197145fe08168c3e66903
Change-Id: I9445d6d5e4723bf6a87d4bffcdc638560471328b
Oliver Smith at

#28015 (Apr 16, 2026, 1:19:22 PM)

tests/fetch_image: support copying from artifact

Allow copying the image from another job in
octsim_osmo-ccid-firmware-artifacts job.

Related: osmo-ci I736b2b194813e6edff0197145fe08168c3e66903
Change-Id: I9445d6d5e4723bf6a87d4bffcdc638560471328b
Oliver Smith at

#28014 (Apr 16, 2026, 1:15:17 PM)

tests/fetch_image: support copying from artifact

Allow copying the image from another job in
octsim_osmo-ccid-firmware-artifacts job.

Related: osmo-ci I736b2b194813e6edff0197145fe08168c3e66903
Change-Id: I9445d6d5e4723bf6a87d4bffcdc638560471328b
Oliver Smith at

#28013 (Apr 16, 2026, 1:09:43 PM)

tests/fetch_image: support copying from artifact

Allow copying the image from another job in
octsim_osmo-ccid-firmware-artifacts job.

Related: osmo-ci I736b2b194813e6edff0197145fe08168c3e66903
Change-Id: I9445d6d5e4723bf6a87d4bffcdc638560471328b
Oliver Smith at

#28012 (Apr 16, 2026, 1:05:17 PM)

tests/fetch_image: support copying from artifact

Allow copying the image from another job in
octsim_osmo-ccid-firmware-artifacts job.

Related: osmo-ci I736b2b194813e6edff0197145fe08168c3e66903
Change-Id: I9445d6d5e4723bf6a87d4bffcdc638560471328b
Oliver Smith at

#28011 (Apr 16, 2026, 11:01:40 AM)

requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747)

PyYAML versions 5.1–5.3.1 are vulnerable to CVE-2020-1747, which allows
arbitrary code execution through yaml.FullLoader. While PyYAML 5.4+
patches this, the dependency specification (pyyaml >= 5.1) doesn't
guarantee a safe version. Let's increase the requirement to version
5.4 to ensure a safe version of is used.

This patch is based on suggestions from:
"YanTong C <chyeyantong03@gmail.com>"

Change-Id: I901c76c59e9c1bab030eab81038e04a475b32510
pmaier@sysmocom.de at

#28010 (Apr 16, 2026, 9:09:35 AM)

osmo-smdpp.py: fix path Traversal Bypass in SM-DP+ (CWE-22)

Root Cause:
os.path.commonprefix() compares strings character-by-character, NOT by path
components. This is a well-known Python antipattern (Python docs explicitly
warn: "this function may return invalid paths because it works a character
at a time").

Attack Context:
The matchingId parameter is received from a network client via the GSMA
ES9+ authenticateClient API endpoint (POST to
/gsma/rsp2/es9plus/authenticateClient). The SM-DP+ server is a Twisted web
application listening on port 443. An unauthenticated eUICC client sends
the matchingId in the ctxParamsForCommonAuthentication ASN.1 structure.

Fix:
Replace os.path.commonprefix() with proper path component checking:

Change-Id: I7a42b40aa2bbcd5f0ec99f172503354c6eaa9828
pmaier@sysmocom.de at

#28009 (Apr 16, 2026, 9:09:32 AM)

requirements: ensure safe version of PyYAML >= 5.4 (CVE-2020-1747)

PyYAML versions 5.1–5.3.1 are vulnerable to CVE-2020-1747, which allows
arbitrary code execution through yaml.FullLoader. While PyYAML 5.4+
patches this, the dependency specification (pyyaml >= 5.1) doesn't
guarantee a safe version. Let's increase the requirement to version
5.4 to ensure a safe version of is used.

This patch is based on suggestions from:
"YanTong C <chyeyantong03@gmail.com>"

Change-Id: I901c76c59e9c1bab030eab81038e04a475b32510
pmaier@sysmocom.de at

#28008 (Apr 16, 2026, 9:09:23 AM)

pySim-prog: fix Insecure PRNG for SIM Authentication Keys (CWE-338)

Root Cause:
pySim-prog.py uses Python's random module (Mersenne Twister MT19937) to
generate Ki and OPC — the root authentication keys for SIM cards. MT19937
is a deterministic PRNG that is not cryptographically secure. Its internal
state (624 × 32-bit words, 19,937 bits) can be fully recovered after
observing 624 consecutive outputs.

Impact:
1. SIM Card Cloning: An attacker who determines the PRNG state can predict
all Ki/OPC values generated before and after. With these keys, SIM cards
can be cloned.
2. Network Authentication Bypass: Ki/OPC are used in the Milenage algorithm
for 3G/4G/5G authentication. Predictable keys mean an attacker can
authenticate as any subscriber whose SIM was provisioned with the weak RNG.
3. Batch Compromise: In bulk provisioning scenarios (pySim-prog's primary
use case), hundreds or thousands of SIMs may be programmed sequentially.
Compromising one batch means recovering the PRNG state to predict all keys.

Fix:
Replace random.randrange() with os.urandom()

Change-Id: Id3e00d3ec5386f17c1525cacfc7d3f5bba43381f
pmaier@sysmocom.de at

#28007 (Apr 16, 2026, 5:47:52 AM)

formatting: update .clang-format

Updates the formatting rules derived from linux kernel
098b6e44cbaa2d526d06af90c862d13fb414a0ec

At the same time tell clang-format to keep the bespoke formatting
used for the fsm and usb descs.

Change-Id: I1fd4d38897946693b5495fa4d0b61925eb9d07f7
benispeter at

#28006 (Apr 15, 2026, 5:16:26 PM)

octsim: usb_descriptors: use LE16/LE32 for consistancy

Even this is ran on ARM and most likely on x86, add byte ordering
function (LE16/LE32) to 16 bit and 32 bit fields as the remaining
usb descriptor does.

Change-Id: Ia77d65faf56c5d3c57cc76c91af33fce4fbbff5c
lynxis at

#28005 (Apr 15, 2026, 5:16:21 PM)

octsim: main: document the fixed allocation sizes for msgb

Use the same allocation for all msgb to prevent
heap allocation fragmentation.
Add a comment to document it.

Change-Id: I33809d2c1973231627f6da5d9b01e9525f2b38c1
lynxis at

#28004 (Apr 15, 2026, 2:27:57 PM)

octsim: usb_descriptors: use LE16/LE32 for consistancy

Even this is ran on ARM and most likely on x86, add byte ordering
function (LE16/LE32) to 16 bit and 32 bit fields as the remaining
usb descriptor does.

Change-Id: Ia77d65faf56c5d3c57cc76c91af33fce4fbbff5c
lynxis at

#28003 (Apr 15, 2026, 10:03:02 AM)

Reset 'release_99' flag in test cases at comment_start()

Rather than resetting release_99 flag in every test case that did set
it, do it in comment_start().

Change-Id: I55a49dd24a5df6ee8e28fa6b410988e82d10c554
Andreas Eversberg at

#28002 (Apr 15, 2026, 10:01:40 AM)

pySim/transport: fix GET RESPONSE behaviour

The current behavior we implement in the method __send_apdu_T0 is
incomplete. Some details discussed in ETSI TS 102 221,
section 7.3.1.1.4, clause 4 seem to be not fully implemented. We
may also end up sending a GET RESPONSE in other APDU cases than
case 4 (the only case that uses the GET RESPONSE command).

Related: OS#6970
Change-Id: I26f0566af0cdd61dcc97f5f502479dc76adc37cc
pmaier@sysmocom.de at

#28001 (Apr 15, 2026, 9:49:23 AM)

Bump version: 1.13.1.12-8e6ea → 1.14.0

Change-Id: Ifa079c76148fd25f543b7875d3d89b35c19ffe6b
Oliver Smith at

#28000 (Apr 14, 2026, 9:41:42 PM)

contrib/jenkins.sh: use Gitea mirrors for libnftnl and nftables

Change-Id: I28950d823dfd91e8e2ac23a19e5a86d1027096b3
Depends: osmo-ci.git I830a16c8bf7f595b16113bf2ba5e81bae56533dd
Vadim Yanitskiy at

#27999 (Apr 14, 2026, 6:49:28 PM)

octsim: main: reduce msgb_alloc for irqs to 8 bytes

The message itself is only 3 bytes, but the usb stack might benefit
from 8 byte buffers.

Change-Id: I33809d2c1973231627f6da5d9b01e9525f2b38c1
lynxis at

#27998 (Apr 14, 2026, 6:49:20 PM)

octsim: usb_descriptor: reduce IRQ endpoint max packet size to 4 bytes

The largest message on the endpoint is the 4 byte hardware error.
The slot status is 3 bytes for 8 slots.

Change-Id: I615ff16d9bc0e8d39156015e41b4abe4502aaca1
lynxis at

#27997 (Apr 14, 2026, 6:49:14 PM)

octsim: usb_descriptors: use LE16/LE32 for consistancy

Even this is ran on ARM and most likely on x86, add byte ordering
function (LE16/LE32) to 16 bit and 32 bit fields as the remaining
usb descriptor does.

Change-Id: Ia77d65faf56c5d3c57cc76c91af33fce4fbbff5c
lynxis at

#27996 (Apr 14, 2026, 4:39:54 PM)

cosmetic: fix missing spaces in string_req_h

Change-Id: Ia92ac605d83718399f19db67057e740ceaa8c37f
lynxis at

#27995 (Apr 14, 2026, 4:39:49 PM)

Implement vendor requests to set debug/break_on_panic

Use vendor request in to read and set the break_on_panic.
In the future this vendor request could be also used to set other
debug related options.

Change-Id: Ia2bffa05b96e3857610cb3ad2f9122fa75a90780
lynxis at

#27994 (Apr 14, 2026, 4:21:30 PM)

Implement vendor requests to set debug/break_on_panic

Use vendor request in to read and set the break_on_panic.
In the future this vendor request could be also used to set other
debug related options.

Change-Id: Ia2bffa05b96e3857610cb3ad2f9122fa75a90780
lynxis at

#27993 (Apr 14, 2026, 4:16:09 PM)

Implement vendor requests to set debug/break_on_panic

Use vendor request in to read and set the break_on_panic.
In the future this vendor request could be also used to set other
debug related options.

Change-Id: Ia2bffa05b96e3857610cb3ad2f9122fa75a90780
lynxis at

#27992 (Apr 14, 2026, 3:10:18 PM)

Rework default IRQ handler and osmo panic handler

Don't break on panic by default. Using a variable allows
to set it by SWD or later by a usb message.

Use the same handler for osmo panics as well as unknown IRQ.
Including faults (bus, hard).

Change-Id: Ibcabe0c58ff14ebe76159470dd90fdef064febea
lynxis at

#27991 (Apr 14, 2026, 11:16:51 AM)

osmo_git_clone_url(): add Gitea mirrors for libnftnl and nftables

Change-Id: I830a16c8bf7f595b16113bf2ba5e81bae56533dd
Related: osmo-upf.git I28950d823dfd91e8e2ac23a19e5a86d1027096b3
Vadim Yanitskiy at

#27990 (Apr 14, 2026, 11:16:45 AM)

scripts: fix deprecation warnings

scripts/verify_value_string_arrays_are_terminated.py:22: SyntaxWarning:
    "\s" is an invalid escape sequence. Such sequences will not work in the future.
    Did you mean "\\s"? A raw string is also an option.
scripts/verify_value_string_arrays_are_terminated.py:22: SyntaxWarning:
    "\s" is an invalid escape sequence. Such sequences will not work in the future.
    Did you mean "\\s"? A raw string is also an option.
scripts/verify_value_string_arrays_are_terminated.py:23: SyntaxWarning:
    "\s" is an invalid escape sequence. Such sequences will not work in the future.
    Did you mean "\\s"? A raw string is also an option.
scripts/verify_value_string_arrays_are_terminated.py:23: SyntaxWarning:
    "\s" is an invalid escape sequence. Such sequences will not work in the future.
    Did you mean "\\s"? A raw string is also an option.
scripts/verify_value_string_arrays_are_terminated.py:30: DeprecationWarning:
    codecs.open() is deprecated. Use open() instead.

Change-Id: Ie78b84dd556266f96780a4232f95b58e0e3eabc0
Vadim Yanitskiy at

#27989 (Apr 14, 2026, 11:16:30 AM)

contrib/jenkins.sh: use Gitea mirrors for libnftnl and nftables

Change-Id: I28950d823dfd91e8e2ac23a19e5a86d1027096b3
Depends: osmo-ci.git I830a16c8bf7f595b16113bf2ba5e81bae56533dd
Vadim Yanitskiy at

#27988 (Apr 14, 2026, 9:37:01 AM)

jobs/octsim_osmo-ccid-firmware: add branch param

Change-Id: I05321cd2c174060381e099aa49d5932f9cafdd28
Oliver Smith at

#27987 (Apr 14, 2026, 9:36:57 AM)

jobs/octsim_osmo-ccid-firmware: PYTHONUNBUFFERED=1

Ensure that the python output is getting displayed directly when running
in jenkins.

Change-Id: Iffe74b270f33286f394db1be03e6ce1953aff4bf
Oliver Smith at

#27986 (Apr 14, 2026, 9:36:54 AM)

jobs/octsim_osmo-ccid-firmware: remove timer

This job already gets triggered once a day from
master-osmo-ccid-firmware. Running it once a day like all other master
jobs should be enough, remove the timed trigger that caused it to run
twice a day.

Change-Id: Ia4fdb6d504c7a08cf258e82436627894602f7301
Oliver Smith at

#27985 (Apr 14, 2026, 9:36:51 AM)

jobs/octsim_osmo-ccid-firmware: don't use axis

There is only one node, so we can specify it directly instead of using a
build axis.

Change-Id: I552c8f1b244c8e8b0f902720698fbb6ba660fb72
Oliver Smith at

#27984 (Apr 14, 2026, 9:36:47 AM)

jobs/octsim_osmo-ccid-firmware: various tweaks

* move name and desc up (in preparation to adding another job in the same file)
* remove "concurrent: false": the octsimtest node is already configured
  to only accept one job. if we had multiple octsimtest nodes, we
  wouldn't need this limitation of not running concurrently, so this
  isn't useful.
* remove options without effect (block-downstream, block-upstream,
  disabled, build-blocker, etc.)
* add "scm checkout" comment to retry-count as we have it in other files

Change-Id: If64787efbe4a1305cd60941b69e9416960d056a2
Oliver Smith at

#27983 (Apr 14, 2026, 7:12:38 AM)

jobs/octsim_osmo-ccid-firmware: add email param

Allow configuring the email notifications before starting a job, so no
notifications can be set while testing changes to the jenkins job. Add
jenkins-notifications@lists.osmocom.org while at it, as we have it with
almost all other jobs.

Change-Id: Ifcd580873479fc259119139d47447ba0e21b21f4
Oliver Smith at

#27982 (Apr 13, 2026, 1:56:52 PM)

Check for protocol extension bit in message type at a central location

Bits 8 and 7 of message type can be used as sequence number or have
specific default values. The added check will verify the bits according
to the prococol descriptor and Release version.

The Rules for these bits are described in GSM TS 124.007, clause
11.2.3.2.1 for Release <= 98 and 11.2.3.2.2 for Release >= 99.

There is also no need to clear bit 7 in message type for these
protocols, as it is done already in gsm48_hdr_msg_type().

Some unit tests fail without fixes that are included in this patch.

Change-Id: Iae41bc6a2e9fd85583509b6c6154dd5a935fb5df
Andreas Eversberg at

#27981 (Apr 12, 2026, 12:26:54 PM)

.gitignore: add missing osmux_{input,output}_test

Take a chance to group test binaries and specify their full paths.

Change-Id: Icb9014fe3c501940cef2d599403aa102135dd384
Vadim Yanitskiy at

#27980 (Apr 11, 2026, 9:08:33 AM)

firmware/se_k2xx: add board specific AFC params

Set afc_slope to 405 and afc_initial_dac_value to -370, derived from
AFC parameter averages computed across TIFFS readings of 7 unique
SE K2xx units (5 x K200i + 1 x K205i + 1 x K220i).

Change-Id: Iee2569c124dd0160f16457e0171cfd48d961045e
Related: OS#5822
Vadim Yanitskiy at

#27979 (Apr 11, 2026, 9:08:21 AM)

firmware/se_k2xx: add board specific RF tables

SE K2xx phones use a different PA than GTA0x/FCDEV3B, so the
compiled-in Tx ramp templates must match the actual hardware.
Replace the previously copied GTA0x ramps with values extracted
from the SE K2xx official firmware using the calextract tool
from the freecalypso-reveng repository:

https://www.freecalypso.org/hg/freecalypso-reveng/

The Tx levels tables are left unchanged, as they are believed to
be the same TI internal defaults across these designs.

Change-Id: If90973ae6bf9af1cd15e2d80e0b99fe098b648bd
Related: OS#5822
Vadim Yanitskiy at

#27978 (Apr 10, 2026, 11:02:50 PM)

firmware/se_k2xx: add board specific AFC params

Set afc_slope to 405 and afc_initial_dac_value to -2957, derived from
AFC parameter averages computed across TIFFS readings of 7 unique
SE K2xx units (5 x K200i + 1 x K205i + 1 x K220i).

Change-Id: Iee2569c124dd0160f16457e0171cfd48d961045e
Related: OS#5822
Vadim Yanitskiy at

#27977 (Apr 10, 2026, 11:02:45 PM)

firmware/se_k2xx: add board specific RF tables

SE K2xx phones use a different PA than GTA0x/FCDEV3B, so the
compiled-in Tx ramp templates must match the actual hardware.
Replace the previously copied GTA0x ramps with values extracted
from the SE K2xx official firmware using the calextract tool
from the freecalypso-reveng repository:

https://www.freecalypso.org/hg/freecalypso-reveng/

The Tx levels tables are left unchanged, as they are believed to
be the same TI internal defaults across these designs.

Change-Id: If90973ae6bf9af1cd15e2d80e0b99fe098b648bd
Related: OS#5822
Vadim Yanitskiy at

#27976 (Apr 10, 2026, 10:15:52 PM)

firmware/se_k2xx: add board specific RF tables

SE K2xx phones use a different PA than GTA0x/FCDEV3B, so the
compiled-in Tx ramp templates must match the actual hardware.
Replace the previously copied GTA0x ramps with values extracted
from the SE K2xx official firmware using the calextract tool
from the freecalypso-reveng repository:

https://www.freecalypso.org/hg/freecalypso-reveng/

The Tx levels tables are left unchanged, as they are believed to
be the same TI internal defaults across these designs.

Change-Id: If90973ae6bf9af1cd15e2d80e0b99fe098b648bd
Related: OS#5822
Vadim Yanitskiy at

#27975 (Apr 10, 2026, 10:15:48 PM)

firmware/se_k2xx: add board specific AFC params

Set afc_slope to 405 and afc_initial_dac_value to -2957, derived from
AFC parameter averages computed across TIFFS readings of 7 unique
SE K2xx units (5 x K200i + 1 x K205i + 1 x K220i).

Change-Id: Iee2569c124dd0160f16457e0171cfd48d961045e
Related: OS#5822
Vadim Yanitskiy at

#27974 (Apr 10, 2026, 7:41:54 PM)

csn1: ProcessError_impl(): add a missing newline

The comment about caller's responsibility is wrong and misleading.
The caller provides format string parameters, not the format string!

Change-Id: I0f7c0a6d25db03c1fe8503b57053130ed29baf23
Vadim Yanitskiy at

#27973 (Apr 9, 2026, 3:59:05 PM)

pySim/transport: fix GET RESPONSE behaviour

The current behavior we implement in the method __send_apdu_T0 is
incomplete. Some details discussed in ETSI TS 102 221,
section 7.3.1.1.4, clause 4 seem to be not fully implemented. We
may also end up sending a GET RESPONSE in other APDU cases than
case 4 (the only case that uses the GET RESPONSE command).

Related: OS#6970
Change-Id: I26f0566af0cdd61dcc97f5f502479dc76adc37cc
pmaier@sysmocom.de at

#27972 (Apr 9, 2026, 3:33:24 PM)

pySim/transport: fix GET RESPONSE behaviour

The current behavior we implement in the method __send_apdu_T0 is
incomplete. Some details discussed in ETSI TS 102 221,
section 7.3.1.1.4, clause 4 seem to be not fully implemented. We
may also end up sending a GET RESPONSE in other APDU cases than
case 4 (the only case that uses the GET RESPONSE command).

Related: OS#6970
Change-Id: I26f0566af0cdd61dcc97f5f502479dc76adc37cc
pmaier@sysmocom.de at

#27971 (Apr 9, 2026, 3:11:28 PM)

sgsn_libgtp: fix NULL dereference in cb_delete_context()

sgsn_pdp_ctx_free() contains an abnormal path (with a backtrace log)
for the case where a PDP context is freed while its libgtp handle is
still attached.  In that path, lib->priv is set to NULL to prevent
other callbacks (e.g. cb_data_ind()) from dereferencing the already-
freed sgsn_pdp_ctx.

When libgtp subsequently calls cb_delete_context() as part of its own
teardown, pdp->priv is NULL, causing an immediate NULL dereference at
the pctx->lib = NULL assignment.

Guard against this by returning early when priv is NULL: the SGSN-side
context is already gone, so there is nothing left for the callback to do.

Change-Id: I7d800766b08d87b6f2b23a0cd45435925f9998ff
Vadim Yanitskiy at

#27970 (Apr 9, 2026, 10:31:24 AM)

rspro_server: don't access the msg on error cases

The msg is NULL on errors.

Related: SYS#7930
Change-Id: I4e95c2473acd72cd2e01df329691c8f31882b3d9
lynxis at

#27969 (Apr 9, 2026, 10:30:58 AM)

rspro_server: don't access the msg on error cases

The msg is NULL on errors.

Related: SYS#7930
Change-Id: I4e95c2473acd72cd2e01df329691c8f31882b3d9
lynxis at

#27968 (Apr 8, 2026, 11:00:19 PM)

handover_fsm: send_handover_performed(): check lchan != NULL

The target lchan is expected to be valid on HO_RESULT_OK, but it's
still safer to check it against NULL before dereferencing.

Change-Id: Iee734c98dc79681808e7d75360c208a941cc6821
Related: 107391d8c ("handover_fsm: fix send_handover_performed() using wrong lchan")
Vadim Yanitskiy at

#27967 (Apr 8, 2026, 11:00:13 PM)

assignment_fsm: ipacc_chan_mode_supported(): log unsupported chan_mode

Change-Id: I1718994e25ff1349618bdb4660afbe735c5c3977
Related: aa959d74f ("assignment_fsm: check ipaccess channel mode support")
Vadim Yanitskiy at

#27966 (Apr 7, 2026, 3:50:40 PM)

filesystem: JsonEditor: offer interactive retry on error

When json.loads() fails (e.g. the user made a syntax mistake), prompt
the user with "Re-open file for editing? [y]es/[n]o:" and loop back to
the editor if they answer 'y' or 'yes'.  If the user declines, return
the original unmodified value so no write is attempted; the temp file
is still cleaned up by __exit__() in that case.

Change-Id: I9161b7becea0d8dfd3f5f740fbb253da2f061a1d
Related: OS#6899
Vadim Yanitskiy at

#27965 (Apr 7, 2026, 3:50:20 PM)

tests: fix TransRecEF _test_de_encode to operate at file level

Previously, _test_de_encode vectors for TransRecEF subclasses were tested
via decode_record_hex()/encode_record_hex(), i.e. one record at a time,
with the decoded value being a scalar.

Switch test_de_encode_record() in TransRecEF_Test to use decode_hex() /
encode_hex() instead, so that vectors represent whole-file content
(decoded value is a list of records) -- consistent with how LinFixedEF
handles _test_de_encode.  Update all existing vectors accordingly.

Change-Id: I4a9610f9ee39833cd0c90f64f89f5fbdd6f0846d
Vadim Yanitskiy at

#27964 (Apr 7, 2026, 3:50:02 PM)

pySim/ts_51_011.py: add multi-record test vector for EF_PL

Change-Id: I9f7a444b18056b1683cbd52a25af950125531746
Vadim Yanitskiy at

#27963 (Apr 7, 2026, 3:49:53 PM)

filesystem: JsonEditor: use NamedTemporaryFile

A plain NamedTemporaryFile is sufficient here: we only need a single
file, not a directory to hold it.  Using NamedTemporaryFile is simpler
(no subdirectory to manage) and gives us a .json suffix for free,
which editors use for syntax highlighting.

Change-Id: If3b0bd0fcc90732407dbd03b9cc883f7abeb948e
Vadim Yanitskiy at

#27962 (Apr 7, 2026, 3:13:52 PM)

filesystem: JsonEditor: use NamedTemporaryFile

A plain NamedTemporaryFile is sufficient here: we only need a single
file, not a directory to hold it.  Using NamedTemporaryFile is simpler
(no subdirectory to manage) and gives us a .json suffix for free,
which editors use for syntax highlighting.

Change-Id: If3b0bd0fcc90732407dbd03b9cc883f7abeb948e
Vadim Yanitskiy at

#27961 (Apr 7, 2026, 3:13:47 PM)

filesystem: JsonEditor: offer interactive retry on error

When json.loads() fails (e.g. the user made a syntax mistake), prompt
the user with "Re-open file for editing? [y]es/[n]o:" and loop back to
the editor if they answer 'y' or 'yes'.  If the user declines, return
the original unmodified value so no write is attempted; the temp file
is still cleaned up by __exit__() in that case.

Change-Id: I9161b7becea0d8dfd3f5f740fbb253da2f061a1d
Related: OS#6899
Vadim Yanitskiy at

#27960 (Apr 7, 2026, 3:13:41 PM)

filesystem: edit_{binary,record}_decoded: add encode/decode examples

When invoking `edit_binary_decoded` or `edit_record_decoded`, the
temp file opened in the editor now contains the EF's encode/decode
test vectors as //-comment lines below the JSON content, similar to
how 'git commit' appends comments to the commit message template.
The comment block is stripped before JSON parsing on save,
so it has no effect on the written data.

The feature is implemented via a new module-level JsonEditor context
manager class that encapsulates the full edit cycle:

* write JSON + examples to a TemporaryDirectory
* invoke the editor
* read back, strip //-comments, parse and return the result

Change-Id: I5a046a9c7ba7e08a98cf643d5a26bc669539b38f
Related: OS#6900
Vadim Yanitskiy at

#27959 (Apr 7, 2026, 1:29:42 PM)

gprs_gmm: gsm48_rx_gmm_att_req(): drop stale PDP contexts on re-Attach

When an MS sends an Attach Request with a known IMSI or P-TMSI, it
implies the MS has restarted and lost all its PDP context state.  The
SGSN must clean up any PDP contexts it still holds for that subscriber;
otherwise it will not create new ones upon subsequent PDP Context
Activation, causing data connectivity failure after a device reboot.

Change-Id: I20c1f5f741275115635188b2f4b1c5fe7c6e40f1
Related: OS#6922
Vadim Yanitskiy at

#27958 (Apr 7, 2026, 11:02:59 AM)

tests/osmo-sgsn_test-nodes.vty: add missing list entries

Change-Id: I6b4cbbae30c602d0fd4ef9b2f91c97f20217eb53
Vadim Yanitskiy at

#27957 (Apr 7, 2026, 11:02:27 AM)

gprs_sm: QoS: make max-sdu-size configurable

Some phones, such as the Sony Ericsson Z520, reject or ignore the
Activate PDP Context Accept if they dislike the max-sdu-size value
in the QoS profile.  Make this value configurable via the VTY so
it can be adjusted to accommodate such devices.

Change-Id: I0819da18dafecf322f8902643dae8dbcaa5dc98b
Related: OS#6735
Vadim Yanitskiy at

#27956 (Apr 7, 2026, 9:35:55 AM)

osmo-bts-omldummy: properly report NM_ATT_IPACC_SUPP_FEATURES

osmo-bts-omldummy is used as the OML backend in the ttcn3-bsc-test.
The common OML code encodes bts->support.* and trx->support.* fields
verbatim into the IPA Supported Features IE (NM_ATT_IPACC_SUPP_FEATURES)
in Get Attributes Responses.  Since bts_model_init() and
bts_model_trx_init() never initialized these fields, they were reported
as all-zeros to osmo-bsc.

osmo-bsc now inspects the supported channel modes before activating a
channel.  An all-zero chan_modes value (present but no bits set) causes
osmo-bsc to reject every speech mode, breaking all assignment-related
TTCN-3 test cases.

Initialize ciphers, gprs_codings, freq_bands, chan_types and chan_modes
to sensible values, matching what osmo-bts-virtual does, so that
osmo-bts-omldummy reports its capabilities correctly.

Change-Id: I7fe83f78c829c300e70a59509847b815a77974d7
Fixes: 0978d1df ("oml: implement handling of NM_ATT_IPACC_SUPP_FEATURES")
Related: OS#6324
Vadim Yanitskiy at

#27955 (Apr 6, 2026, 4:57:51 PM)

gprs_sm: QoS: make max-sdu-size configurable

Some phones, such as the Sony Ericsson Z520, reject or ignore the
Activate PDP Context Accept if they dislike the max-sdu-size value
in the QoS profile.  Make this value configurable via the VTY so
it can be adjusted to accommodate such devices.

Change-Id: I0819da18dafecf322f8902643dae8dbcaa5dc98b
Related: OS#6735
Vadim Yanitskiy at

#27954 (Apr 6, 2026, 4:57:43 PM)

tests/osmo-sgsn_test-nodes.vty: add missing list entries

Change-Id: I6b4cbbae30c602d0fd4ef9b2f91c97f20217eb53
Vadim Yanitskiy at

#27953 (Apr 6, 2026, 4:25:41 PM)

gprs_sm: gsm48_tx_gsm_act_pdp_acc(): fix QoS profile length

The Activate PDP Context Accept was always sending sizeof(default_qos)
(14 bytes) as the QoS profile length, regardless of what the UE
requested.  Older modules such as the Air20X may crash and restart
during PDP attachment because of that.

In GTP, qos_req.l encodes 1 ARP byte followed by the QoS profile
octets, so (qos_req.l - 1) is the actual profile length.  Mirror
back the same QoS profile length the UE sent in its request,
capped at sizeof(default_qos) to avoid overrunning the default_qos
buffer.  This matters in particular for R97/R98 UEs that send a
3-byte QoS profile and should not receive a 14-byte response.

Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
Related: OS#6922
Vadim Yanitskiy at

#27952 (Apr 6, 2026, 4:25:35 PM)

gprs_gmm: gsm48_rx_gmm_att_req(): drop stale PDP contexts on re-Attach

When an MS sends an Attach Request with a known IMSI or P-TMSI, it
implies the MS has restarted and lost all its PDP context state.  The
SGSN must clean up any PDP contexts it still holds for that subscriber;
otherwise it will not create new ones upon subsequent PDP Context
Activation, causing data connectivity failure after a device reboot.

Change-Id: I20c1f5f741275115635188b2f4b1c5fe7c6e40f1
Related: OS#6922
Vadim Yanitskiy at

#27951 (Apr 6, 2026, 2:56:56 PM)

bssap: mark some pointers as const

Change-Id: Iebb28d6ae0b468545994669248a442dd17f36d4c
Vadim Yanitskiy at

#27950 (Apr 6, 2026, 2:56:52 PM)

assignment_fsm: pass lchan to lchan_type_compat_with_mode()

The lchan pointer is needed by the next patch, which will check
the BTS ipaccess supported-features flags to reject channel modes
that the BTS has reported as unsupported before attempting to
activate the lchan.

Change-Id: I51d5d1a1cf3c51f85f738196967d5c69870681bb
Related: OS#6324
Vadim Yanitskiy at

#27949 (Apr 6, 2026, 2:56:46 PM)

assignment_fsm: check ipaccess channel mode support

Add ipacc_chan_mode_supported(), which checks the NM_IPAC_F_CHANM_*
flags stored in the Baseband Transceiver's MO state (populated during
OML bring-up) to decide whether the BTS can handle a requested channel
mode.  If the IE containing supported channel modes was never received,
the function returns true as if the given mode was supported.

Without this change, requesting a channel mode not supported by the
BTS results in a NACK to the RSL Channel Activation, which causes
the lchan to be marked as BROKEN and thus unavailable.

Change-Id: I680ba7993786f5486d671f931e75df4543670a37
Related: OS#6324
Vadim Yanitskiy at

#27948 (Apr 6, 2026, 2:56:41 PM)

bssap: use LOGPFSML in bssmap_handle_ass_req_tp_codec_list()

Change-Id: Ie51ada174388f4c3e9ffe8a5bec4297bda38584b
Vadim Yanitskiy at

#27947 (Apr 6, 2026, 2:56:37 PM)

bssap: use LOGPFSML in bssmap_handle_assignm_req()

Change-Id: If99661c0ff1177214bacdb2d1bcb9da1d2d2957c
Vadim Yanitskiy at

#27946 (Apr 6, 2026, 2:56:33 PM)

ipaccess: fix buffer overread in ipacc_parse_supp_flags()

The loop used OSMO_MAX(e->len, 4), which iterates at least 4 times
even when the IE is shorter than 4 bytes, causing a buffer overread.
Replace with OSMO_MIN(e->len, sizeof(u32)) to cap the iteration both
at the actual IE length and at the uint32_t accumulator size.

Change-Id: I97c69a71eb650cbef1cc3652d0a2a966cfd6cf60
Vadim Yanitskiy at

#27945 (Apr 6, 2026, 2:56:28 PM)

lchan_fsm: don't mark lchan as BORKEN on unsupported mode NACK

When the BTS NACKs a Channel Activation with RSL_ERR_SERV_OPT_UNAVAIL
or RSL_ERR_SERV_OPT_UNIMPL, it means the requested service or channel
mode is not supported - not that the hardware is broken.  In this
case the lchan should transition to LCHAN_ST_WAIT_AFTER_ERROR rather
than LCHAN_ST_BORKEN, which is reserved for genuine hardware failures.

Also add LCHAN_EV_RTP_ERROR to LCHAN_ST_WAIT_AFTER_ERROR's in_event_mask
so that a late LCHAN_EV_RTP_ERROR (e.g. MGCP CRCX timeout arriving after
the NACK was already handled) is silently absorbed rather than triggering
an unexpected-event warning.

Change-Id: Ide3830a697501a0c245a41451302f1e68d553b3c
Related: osmo-ttcn3-hacks.git I000b7b44749380c5af4da42abe37b4ada6e06ee4
Related: OS#6324
Vadim Yanitskiy at

#27944 (Apr 6, 2026, 2:56:24 PM)

lchan_fsm: ignore late lchan_rtp_fsm events

The lchan_rtp_fsm is a child FSM that manages the MGW/RTP endpoint.
When the parent lchan_fsm transitions away before the child has
finished its work (e.g. a CRCX timeout or a DLCX completing after
the lchan is already idle), the child can still deliver
LCHAN_EV_RTP_RELEASED or LCHAN_EV_RTP_ERROR to the parent.

Currently these late events are not in the in_event_mask of every
state that can be reached with the child still running:

* LCHAN_ST_UNUSED: entered from WAIT_AFTER_ERROR after the error timer
  fires, while a DLCX triggered at error time may still be in flight.
* LCHAN_ST_WAIT_AFTER_ERROR: already handles LCHAN_EV_RTP_RELEASED but
  misses LCHAN_EV_RTP_ERROR (e.g. CRCX timeout arriving after the
  NACK was handled).

Add the missing events to both states' in_event_mask and provide a
no-op handler in lchan_fsm_unused() so that the assert is not hit.

Change-Id: Ie6333bd941e4e5a6ddf0e3f113b8764e8bc2bbc0
Vadim Yanitskiy at

#27943 (Apr 6, 2026, 2:56:19 PM)

ipaccess: store Supported Features IE to the MO state

Change-Id: Ic89d42c478677ffda4d544f461e7850dd3157040
Related: OS#6324
Vadim Yanitskiy at

#27942 (Apr 6, 2026, 2:53:34 PM)

handover_fsm: fix send_handover_performed() using wrong lchan

send_handover_performed() is called from handover_end() before
gscon_change_primary_lchan() updates conn->lchan to the new lchan.
As a result, the Cell Identifier, Chosen Channel, Chosen Encryption
Algorithm, and Speech Version/Codec IEs were all populated from the
source (old) lchan rather than the target (new) lchan.

As per 3GPP TS 48.008 §3.2.1.25, HANDOVER PERFORMED must report the
target cell and channel.  For intra-BSC handover to a different BTS
this caused the MSC to receive the wrong Cell Identifier.

Fix by initialising lchan from ho->new_lchan instead of conn->lchan,
and deriving the BTS via lchan->ts->trx->bts.

Change-Id: I4111351dc38fc2dbe844c2bd07b3ecfaaadd864e
Related: osmo-ttcn3-hacks.git I82aadcc3a80c183cb93522b829071294b156a218
Found-By: Claude Sonnet 4.6
Vadim Yanitskiy at

#27941 (Apr 6, 2026, 2:43:50 PM)

bsc: verify Cell ID in BSSMAP HandoverPerformed

As per 3GPP TS 48.008 §3.2.1.25, HANDOVER PERFORMED must report the
target cell.  Add an optional cell_id parameter to the template
(defaulting to '?' for backward compatibility) and update the two
intra-BSC handover test helpers to assert that the Cell Identifier
IE carries the target BTS (BTS 1: MCC=001 MNC=01 LAC=1 CI=1).

Also remove the unnecessary interleave wrapper in
f_tc_ho_during_lcs_loc_req(): the two receives arrive on separate
ports (RAN_CONN vs BSSAP_LE) so sequential receive is sufficient.

Change-Id: I82aadcc3a80c183cb93522b829071294b156a218
Related: osmo-bsc.git I4111351dc38fc2dbe844c2bd07b3ecfaaadd864e
Vadim Yanitskiy at

#27940 (Apr 6, 2026, 2:43:45 PM)

bsc: add TC_chan_act_nack_not_borken

Test that when the BTS NACKs a CHANnel ACTIVation with
RSL_ERR_SERV_OPT_UNAVAIL or RSL_ERR_SERV_OPT_UNIMPL, the BSC:
does NOT mark the lchan as BORKEN.

Change-Id: I000b7b44749380c5af4da42abe37b4ada6e06ee4
Related: osmo-bsc.git Ide3830a697501a0c245a41451302f1e68d553b3c
Related: OS#6324
Vadim Yanitskiy at

#27939 (Apr 6, 2026, 2:43:37 PM)

library/RSL_Types: improve CHAN_ACTIV templates

Change-Id: I80af30fe9b24b93908876fd8059f45b6e3105406
Vadim Yanitskiy at

#27938 (Apr 2, 2026, 4:32:09 PM)

msc: ASCI: Fix race condition in TC_assign_fail

The f_sleep(0.5) to delay the registration of the PC for the 2nd SCCP
connection sometimes fired too late and we received the VGCS/VBS
Assignment Request before the channel ConnHdlr was registered in
RAN_Emulation.
Then in turn we need to delay call establishment until the channel is
ready.
Implement proper synchronization points to make sure the order of
registers is accomplished while making sure the 2 ConnHdlrs are
registered before they need it.

Change-Id: Id80982b6b968bbe462aeac2b9be646ab50eace83
Pau Espin Pedrol at

#27937 (Apr 2, 2026, 10:55:54 AM)

pysim/pcsc: do not use getProtocol for protocol selection

The documentation of the getProtocol provided by pyscard says:

"Return bit mask for the protocol of connection, or None if no
protocol set. The return value is a bit mask of
CardConnection.T0_protocol, CardConnection.T1_protocol,
CardConnection.RAW_protocol, CardConnection.T15_protocol"

This suggests that the purpose of getProtocol is not to determine
which protocols are supported. Its purpose is to determine which
protocol is currently selected (either through auto selection or
through the explicit selection made by the API user). This means
we are using getProtocol wrong.

So far this was no problem, since the auto-selected protocol
should be a supported protocol anyway. However, the automatic
protocol selection may not always return a correct result (see
bug report from THD-siegfried [1]).

Let's not trust the automatic protocol selection. Instead let's
parse the ATR and make the decision based on the TD1/TD2 bytes).

[1] https://osmocom.org/issues/6952

Related: OS#6952
Change-Id: Ib119948aa68c430e42ac84daec8b9bd542db7963
pmaier@sysmocom.de at

#27936 (Apr 2, 2026, 10:03:23 AM)

contrib/jenkins: add SKIP_FIRMWARE_CLEAN argument

If this is set, then don't clean the firmware at the end. This is needed
to store the built firmware as artifact in jenkins, for passing it along
to another job.

Related: SYS#7963
Change-Id: I9e2342b8111645ef5d3b7bf4ac364ca592aa600b
Oliver Smith at

#27935 (Apr 2, 2026, 9:22:02 AM)

jobs/octsim_osmo-ccid-firmware: add 30 min timeout

I just stopped a job run that was going for 2 days 16 h. When
successful, the job finishes in 10 min, so let it abort automatically
after 30 min.

Change-Id: Iaccc96b8b29880c9e115e52561fcd43f7b6a8f77
Oliver Smith at

#27934 (Apr 2, 2026, 9:02:29 AM)

msc: Fix race condition in TC_reset_two(_1iu)

The test failed sporadically with:
"RAN_Emulation.ttcnpp:600 Dynamic test case error: Sending data on the
connection of port BSSAP to 659:SCCP_SP_PORT failed. (Broken pipe)"

That's because it was simply waiting for a fixed amount of time while
letting the underlaying RAN_Emulation do the RESET procedure.
Sometimes it started tearing down the test before the procedure was
fully completed, and RAN_Emulation failed passing the Reset (ACK) up the
stack because the component was already unmapped.

Fix the issue by making sure the RAN_Emulation finished the RESET
procedure before stopping the testThe test.

Change-Id: I27afd7a47e6c6cf0f70e1ecc9e26dd2c220e72ab
Pau Espin Pedrol at

#27933 (Apr 2, 2026, 8:33:49 AM)

msc: Fix race condition in TC_reset_two(_1iu)

The test failed sporadically with:
"RAN_Emulation.ttcnpp:600 Dynamic test case error: Sending data on the
connection of port BSSAP to 659:SCCP_SP_PORT failed. (Broken pipe)"

That's because it was simply waiting for a fixed amount of time while
letting the underlaying RAN_Emulation do the RESET procedure.
Sometimes it started tearing down the test before the procedure was
fully completed, and RAN_Emulation failed passing the Reset (ACK) up the
stack because the component was already unmapped.

Fix the issue by making sure the RAN_Emulation finished the RESET
procedure before stopping the testThe test.

Change-Id: I27afd7a47e6c6cf0f70e1ecc9e26dd2c220e72ab
Pau Espin Pedrol at

#27932 (Apr 2, 2026, 7:49:14 AM)

msc: ASCI: Fix race condition in TC_assign_fail

The f_sleep(0.5) to delay the registration of the PC for the 2nd SCCP
connection sometimes fired too late and we received the VGCS/VBS
Assignment Request before the channel ConnHdlr was registered in
RAN_Emulation.
Implement proper synchronization points to make sure the order of
registers is accomplished while making sure the 2 ConnHdlrs are
registered before they need it.

Change-Id: Id80982b6b968bbe462aeac2b9be646ab50eace83
Pau Espin Pedrol at

#27931 (Apr 1, 2026, 2:32:06 PM)

Support administrative block in role ASP

* Avoid activating later on if inactive when becoming blocked.
* Move to inactive state (and notify peer with ASPIA) if active when becoming blocked.
* Attempt re-activation if needed when becoming non-blocked.

Related: OS#6752
Change-Id: If32902575e874d2acc9a5fc12509af42ed151739
Pau Espin Pedrol at

#27930 (Apr 1, 2026, 2:32:02 PM)

asp: Fix wrong variable logged in ss7_asp_xua_srv_conn_rx_cb()

Change-Id: I24206a19fe57772caf8036464a2e1b6b8630fd7a
Pau Espin Pedrol at

#27929 (Apr 1, 2026, 2:31:06 PM)

Create missing LayerManager fsm in dynamic srv xua asps

Dynamic xUA ASPs in transport_role=server where missing initialization
+start of its LayerManager, meaning they had no xua_default_lm_fsm
instance attached.
Previous the xua_default_lm_fsm didn't do anything internally, but since
recently ir properly transitions through states in SG role too, so
we want to handle blocking/unblocking, etc.

Change-Id: Id01e7a24e92aecc61aa2850632b3712bb338e9f2
Pau Espin Pedrol at

#27928 (Apr 1, 2026, 2:30:42 PM)

stp: m3ua: Expect unsolicited ASPIA ACK after unblocking ASP

Since libosmo-sigtran.git Change-Id
If32902575e874d2acc9a5fc12509af42ed151739, osmo-stp will send an
unsolicited ASPIA ACK to the peer whenever the ASP becomes unblock, in
order to somehow give a chance to the peer to notice something changed
and for instance possibly attempt re-activation of the ASP.

Related: OS#6752
Change-Id: I4b70e576beae3c386d68f17a60d6f23d1a54293a
Pau Espin Pedrol at

#27927 (Apr 1, 2026, 1:01:02 PM)

filesystem: edit_{binary,record}_decoded: add encode/decode examples

When invoking `edit_binary_decoded` or `edit_record_decoded`, the
temp file opened in the editor now contains the EF's encode/decode
test vectors as //-comment lines below the JSON content, similar to
how 'git commit' appends comments to the commit message template.
The comment block is stripped before JSON parsing on save,
so it has no effect on the written data.

The feature is implemented via a new module-level JsonEditor context
manager class that encapsulates the full edit cycle:

* write JSON + examples to a TemporaryDirectory
* invoke the editor
* read back, strip //-comments, parse and return the result

Change-Id: I5a046a9c7ba7e08a98cf643d5a26bc669539b38f
Related: OS#6900
Vadim Yanitskiy at

#27926 (Apr 1, 2026, 1:00:59 PM)

docs: auto-generate Card Filesystem Reference

Add a Sphinx extension (docs/pysim_fs_sphinx.py) that hooks into the
builder-inited event and generates docs/filesystem.rst before Sphinx
reads any source files.

The generated page contains a hierarchical listing of all implemented
EFs and DFs, organised by application/specification (UICC/TS 102 221,
ADF.USIM/TS 31.102, ADF.ISIM/TS 31.103, SIM/TS 51.011).  For each file,
the class docstring and any _test_de_encode / _test_decode vectors
are included as an encoding/decoding example table.

docs/filesystem.rst is fully generated at build time and is therefore
added to .gitignore.

Add tests/unittests/test_fs_coverage.py that walks all pySim.* modules
and verifies that every CardProfile, CardApplication, and standalone
CardDF subclass with EF/DF children is either listed in the SECTIONS
(and will appear in the docs) or explicitly EXCLUDED.

Change-Id: I06ddeefc6c11e04d7c24e116f3f39c8a6635856f
Related: OS#6316
Vadim Yanitskiy at

#27925 (Apr 1, 2026, 1:00:55 PM)

filesystem: JsonEditor: offer interactive retry on error

When json.loads() fails (e.g. the user made a syntax mistake), prompt
the user with "Re-open file for editing? [y]es/[n]o:" and loop back to
the editor if they answer 'y' or 'yes'.  If the user declines, return
the original unmodified value so no write is attempted; the temp file
is still cleaned up by __exit__() in that case.

Change-Id: I9161b7becea0d8dfd3f5f740fbb253da2f061a1d
Related: OS#6899
Vadim Yanitskiy at

#27924 (Apr 1, 2026, 1:00:51 PM)

filesystem: JsonEditor: use NamedTemporaryFile

A plain NamedTemporaryFile is sufficient here: we only need a single
file, not a directory to hold it.  Using NamedTemporaryFile is simpler
(no subdirectory to manage) and gives us a .json suffix for free,
which editors use for syntax highlighting.

Change-Id: If3b0bd0fcc90732407dbd03b9cc883f7abeb948e
Vadim Yanitskiy at

#27923 (Apr 1, 2026, 12:33:47 PM)

Create missing LayerManager fsm in dynamic srv xua asps

Dynamic xUA ASPs in transport_role=server where missing initialization
+start of its LayerManager, meaning they had no xua_default_lm_fsm
instance attached.
Previous the xua_default_lm_fsm didn't do anything internally, but since
recently ir properly transitions through states in SG role too, so
we want to handle blocking/unblocking, etc.

Change-Id: Id01e7a24e92aecc61aa2850632b3712bb338e9f2
Pau Espin Pedrol at

#27922 (Apr 1, 2026, 12:33:45 PM)

cosmetic: xua_asp_fsm: Fix wrong indentation

Change-Id: I21c13ff7bc67c060e739eae38088ac00700680de
Pau Espin Pedrol at

#27921 (Apr 1, 2026, 12:33:43 PM)

xua_lm: Add S_INACTIVE state and improve state transitions

The S_INACTIVE state will be needed once we support administrative state
block in role ASP/(active)IPSP.

It is also useful now since sometimes we just want to leave an asp in
that state without any timer running (eg. asps in override which are not
active until the active one goes inactive).

Adding the S_INACTIVE state also allows transitioning states in role
SG, since we now have somewhere to go instead of leaving it alwas as
S_IDLE.

The S_INACTIVE state also allows staying in that state until the ASP ACT
ACK is received, moment at which the ASP is considered ACTIVE according
to specs.

Change-Id: I7e6127c150e479d0c436875b41824b3061e4fa48
Pau Espin Pedrol at

#27920 (Apr 1, 2026, 12:33:40 PM)

asp: Fix wrong variable logged in ss7_asp_xua_srv_conn_rx_cb()

Change-Id: I24206a19fe57772caf8036464a2e1b6b8630fd7a
Pau Espin Pedrol at

#27919 (Apr 1, 2026, 12:32:38 PM)

Support administrative block in role ASP

* Avoid activating later on if inactive when becoming blocked.
* Move to inactive state (and notify peer with ASPIA) if active when becoming blocked.
* Attempt re-activation if needed when becoming non-blocked.

Related: OS#6752
Change-Id: If32902575e874d2acc9a5fc12509af42ed151739
Pau Espin Pedrol at

#27918 (Apr 1, 2026, 12:17:26 PM)

asp: Fix wrong variable logged in ss7_asp_xua_srv_conn_rx_cb()

Change-Id: I24206a19fe57772caf8036464a2e1b6b8630fd7a
Pau Espin Pedrol at

#27917 (Apr 1, 2026, 12:03:13 PM)

stp: m3ua: Introduce test TC_adm_block_after_act

Related: libosmo-sigtran.git Change-Id If8e34cfb05b8b63173b8bb01a520c058daf1fe39
Related: OS#6752
Change-Id: I18672d228c1d15ef99039bccbb972e0b2496b545
Pau Espin Pedrol at

#27916 (Apr 1, 2026, 12:02:46 PM)

Support administrative block in role ASP

* Avoid activating later on if inactive when becoming blocked.
* Move to inactive state (and notify peer with ASPIA) if active when becoming blocked.
* Attempt re-activation if needed when becoming non-blocked.

Related: OS#6752
Change-Id: If32902575e874d2acc9a5fc12509af42ed151739
Pau Espin Pedrol at

#27915 (Apr 1, 2026, 12:02:43 PM)

Create missing LayerManager fsm in dynamic srv xua asps

Dynamic xUA ASPs in transport_role=server where missing initialization
+start of its LayerManager, meaning they had no xua_default_lm_fsm
instance attached.
Previous the xua_default_lm_fsm didn't do anything internally, but since
recently ir properly transitions through states in SG role too, so
we want to handle blocking/unblocking, etc.

Change-Id: Id01e7a24e92aecc61aa2850632b3712bb338e9f2
Pau Espin Pedrol at

#27914 (Apr 1, 2026, 10:11:33 AM)

Support administrative block in role ASP

Change-Id: If32902575e874d2acc9a5fc12509af42ed151739
Pau Espin Pedrol at

#27913 (Apr 1, 2026, 10:10:24 AM)

cosmetic: xua_asp_fsm: Fix wrong indentation

Change-Id: I21c13ff7bc67c060e739eae38088ac00700680de
Pau Espin Pedrol at

#27912 (Apr 1, 2026, 9:47:19 AM)

xua_lm: Add S_INACTIVE state and improve state transitions

The S_INACTIVE state will be needed once we support administrative state
block in role ASP/(active)IPSP.

It is also useful now since sometimes we just want to leave an asp in
that state without any timer running (eg. asps in override which are not
active until the active one goes inactive).

Adding the S_INACTIVE state also allows transitioning states in role
SG, since we now have somewhere to go instead of leaving it alwas as
S_IDLE.

The S_INACTIVE state also allows staying in that state until the ASP ACT
ACK is received, moment at which the ASP is considered ACTIVE according
to specs.

Change-Id: I7e6127c150e479d0c436875b41824b3061e4fa48
Pau Espin Pedrol at

#27911 (Apr 1, 2026, 8:47:04 AM)

xua asp block: SG: turn asp inactive when administratively blocked

This commit intentionally leaves aside implementing active->inactive
transition for asps with role ASP/(active) IPSP.

Change-Id: If8e34cfb05b8b63173b8bb01a520c058daf1fe39
Pau Espin Pedrol at

#27910 (Apr 1, 2026, 8:47:00 AM)

xua_asp_fsm: Stop T(ack) when receiving an Error msg as response

There's no need to keep retrying retransmission if the peer already told
us something is wrong with the message.

Change-Id: Icaeb472fe67911eb15755442cf11010d3c593f1d
Pau Espin Pedrol at

#27909 (Apr 1, 2026, 8:46:55 AM)

xua_lm: Handle M-Error.ind

Change-Id: I5bdba1ab09084b3eafcb8b4aaa9c9762b15e8583
Pau Espin Pedrol at

#27908 (Apr 1, 2026, 8:46:52 AM)

xua_lm: Use XLM SAP to send M-SCTP_RELEASE.req

Change-Id: I582855acaced48fb838700a3013f94bee7db75ad
Pau Espin Pedrol at

#27907 (Apr 1, 2026, 8:46:49 AM)

xua_rkm: send_reg_req: Avoid adding Routing Context with value 0

We use routing context 0 internally as "no routing context". Since the
Routing Context in the Routing KEy IE in RKM REG REQ is optional, if
local rctx is 0 (because we expect to get one allocated by the STP and
receive it through RKM REG RESP), avoid sending it with the value 0.

Change-Id: Iaa584fea3020af06951aea16e638ac6e6a84ae21
Pau Espin Pedrol at

#27906 (Apr 1, 2026, 8:46:44 AM)

Move xUA<->LM SAP logic to its own file

Right now it's difficult to gasp what's implemented of the SAP since it
was scattered around several places.
Put all the SAP forwarding logic into its own file so it's easy to
follow and extend (eg. adding new helper functions, etc.)

Change-Id: I93d74dd7f6ea8f2e60a8bc41be15362e433e8962
Pau Espin Pedrol at

#27905 (Apr 1, 2026, 8:46:39 AM)

sigtran_sap.h: Fix comment stating RK(DE)_REG prims are not implemented

Change-Id: I81a4df1a826fed2f24a4c7ca410b514b1251b44d
Pau Espin Pedrol at

#27904 (Apr 1, 2026, 8:46:36 AM)

xua_lm: Fix ending up from active to idle forever

Previous transition to S_IDLE was wrong, since there's no way to recover
from that state unless the SCTP connection is closed.
Instead, try harder waiting for some new notifications to try
re-activating the ASP and see if the AS becomes active, or end up timing
out and reconnecting to re-attempt complete set of steps.

Change-Id: I5c97c0ede9c27c63f9259b43b7267a3d5d71681d
Pau Espin Pedrol at

#27903 (Apr 1, 2026, 8:46:32 AM)

xua_lm: Use XLM SAP to send M-ASP_{UP, ACTIVE}.req

Change-Id: I5850d9ec9092ff3d099627856697a4184b0d5853
Pau Espin Pedrol at

#27902 (Apr 1, 2026, 8:46:27 AM)

xua_lm: Handle rx of unsolicited ASPIA ACK

Related: OS#6752
Change-Id: Ica4fbaefd08cdb5c4ca2e2a608606ddbec85297c
Pau Espin Pedrol at

#27901 (Apr 1, 2026, 8:43:47 AM)

Use osmo_ss7_asp_active() in several places

Change-Id: I172e691cb61ac68e2410b44e124737f7a4dd2775
Pau Espin Pedrol at

#27900 (Apr 1, 2026, 7:32:09 AM)

Use osmo_ss7_asp_active() in several places

Change-Id: I172e691cb61ac68e2410b44e124737f7a4dd2775
Pau Espin Pedrol at

#27899 (Mar 31, 2026, 9:53:18 PM)

filesystem: JsonEditor: use NamedTemporaryFile

A plain NamedTemporaryFile is sufficient here: we only need a single
file, not a directory to hold it.  Using NamedTemporaryFile is simpler
(no subdirectory to manage) and gives us a .json suffix for free,
which editors use for syntax highlighting.

Change-Id: If3b0bd0fcc90732407dbd03b9cc883f7abeb948e
Vadim Yanitskiy at

#27898 (Mar 31, 2026, 9:53:15 PM)

docs: auto-generate Card Filesystem Reference

Add a Sphinx extension (docs/pysim_fs_sphinx.py) that hooks into the
builder-inited event and generates docs/filesystem.rst before Sphinx
reads any source files.

The generated page contains a hierarchical listing of all implemented
EFs and DFs, organised by application/specification (UICC/TS 102 221,
ADF.USIM/TS 31.102, ADF.ISIM/TS 31.103, SIM/TS 51.011).  For each file,
the class docstring and any _test_de_encode / _test_decode vectors
are included as an encoding/decoding example table.

docs/filesystem.rst is fully generated at build time and is therefore
added to .gitignore.

Add tests/unittests/test_fs_coverage.py that walks all pySim.* modules
and verifies that every CardProfile, CardApplication, and standalone
CardDF subclass with EF/DF children is either listed in the SECTIONS
(and will appear in the docs) or explicitly EXCLUDED.

Change-Id: I06ddeefc6c11e04d7c24e116f3f39c8a6635856f
Related: OS#6316
Vadim Yanitskiy at

#27897 (Mar 31, 2026, 9:53:13 PM)

filesystem: JsonEditor: offer interactive retry on error

When json.loads() fails (e.g. the user made a syntax mistake), prompt
the user with "Re-open file for editing? [y]es/[n]o:" and loop back to
the editor if they answer 'y' or 'yes'.  If the user declines, return
the original unmodified value so no write is attempted; the temp file
is still cleaned up by __exit__() in that case.

Change-Id: I9161b7becea0d8dfd3f5f740fbb253da2f061a1d
Related: OS#6899
Vadim Yanitskiy at

#27896 (Mar 31, 2026, 9:53:10 PM)

filesystem: edit_{binary,record}_decoded: add encode/decode examples

When invoking `edit_binary_decoded` or `edit_record_decoded`, the
temp file opened in the editor now contains the EF's encode/decode
test vectors as //-comment lines below the JSON content, similar to
how 'git commit' appends comments to the commit message template.
The comment block is stripped before JSON parsing on save,
so it has no effect on the written data.

The feature is implemented via a new module-level JsonEditor context
manager class that encapsulates the full edit cycle:

* write JSON + examples to a TemporaryDirectory
* invoke the editor
* read back, strip //-comments, parse and return the result

Change-Id: I5a046a9c7ba7e08a98cf643d5a26bc669539b38f
Related: OS#6900
Vadim Yanitskiy at

#27895 (Mar 31, 2026, 3:50:46 PM)

xua_rkm: send_reg_req: Avoid adding Routing Context with value 0

We use routing context 0 internally as "no routing context". Since the
Routing Context in the Routing KEy IE in RKM REG REQ is optional, if
local rctx is 0 (because we expect to get one allocated by the STP and
receive it through RKM REG RESP), avoid sending it with the value 0.

Change-Id: Iaa584fea3020af06951aea16e638ac6e6a84ae21
Pau Espin Pedrol at

#27894 (Mar 31, 2026, 3:50:43 PM)

xua_lm: Handle rx of unsolicited ASPIA ACK

Related: OS#6752
Change-Id: Ica4fbaefd08cdb5c4ca2e2a608606ddbec85297c
Pau Espin Pedrol at

#27893 (Mar 31, 2026, 3:49:43 PM)

xua_asp_fsm: Stop T(ack) when receiving an Error msg as response

There's no need to keep retrying retransmission if the peer already told
us something is wrong with the message.

Change-Id: Icaeb472fe67911eb15755442cf11010d3c593f1d
Pau Espin Pedrol at

#27892 (Mar 31, 2026, 2:38:12 PM)

xua_rkm: send_reg_req: Avoid adding Routing Context with value 0

We use routing context 0 internally as "no routing context". Since the
Routing Context in the Routing KEy IE in RKM REG REQ is optional, if
local rctx is 0 (because we expect to get one allocated by the STP and
receive it through RKM REG RESP), avoid sending it with the value 0.

Change-Id: Iaa584fea3020af06951aea16e638ac6e6a84ae21
Pau Espin Pedrol at

#27891 (Mar 31, 2026, 1:49:58 PM)

xua_lm: Fix ending up from active to idle forever

Previous transition to S_IDLE was wrong, since there's no way to recover
from that state unless the SCTP connection is closed.
Instead, try harder waiting for some new notifications to try
re-activating the ASP and see if the AS becomes active, or end up timing
out and reconnecting to re-attempt complete set of steps.

Change-Id: I5c97c0ede9c27c63f9259b43b7267a3d5d71681d
Pau Espin Pedrol at

#27890 (Mar 31, 2026, 1:49:53 PM)

m3ua: m3ua_gen_error_msg(): include Routing Context IE in cause Invalid Routing Context

As per RFC4666 3.8.1:
"""
The "Invalid Routing Context" error is sent if a message is received
from a peer with an invalid (unconfigured) Routing Context value.
For this error, the invalid Routing Context(s) MUST be included in
the Error message."
"""

Hence add the originating Routing Context IE so the error message can be
further identified.
For the same reason, also add the Diagnostic Information for the
specific cases in the switch statement, and make them more robust about
possible null pointer dereference.

Change-Id: If821109701e315d17f5334c680670ea6c7bce3bd
Pau Espin Pedrol at

#27889 (Mar 31, 2026, 1:49:49 PM)

Move xUA<->LM SAP logic to its own file

Right now it's difficult to gasp what's implemented of the SAP since it
was scattered around several places.
Put all the SAP forwarding logic into its own file so it's easy to
follow and extend (eg. adding new helper functions, etc.)

Change-Id: I93d74dd7f6ea8f2e60a8bc41be15362e433e8962
Pau Espin Pedrol at

#27888 (Mar 31, 2026, 1:49:44 PM)

xua_lm: Handle M-Error.ind

Change-Id: I5bdba1ab09084b3eafcb8b4aaa9c9762b15e8583
Pau Espin Pedrol at

#27887 (Mar 31, 2026, 1:49:40 PM)

xua_as_fsm: Remove FIXME regarding queueing of msgs during state PENDING

Queueing of messags during T(r) (state PENDING) is already implemented,
see xua_as_fsm_pending() further below in the same file.

Change-Id: Ie572367493066039f7022250d94b815a4da5bd16
Pau Espin Pedrol at

#27886 (Mar 31, 2026, 1:49:33 PM)

xua asp block: SGP/IPSP: Answer ASPAC with Err if blocked

Reject received ASPACs when the asp is administratively blocked.

Moving an already active ASP into inactive state upon user applies
adminsitrative block is not covered in this commit; it will be
implementer later.

This commit doesn't yet implement asp blocking in ASP role nor
(ASP-side) IPSP role.

Related: OS#6752
Change-Id: I23851fe05c06b6bf59b902632029a2382231427e
Pau Espin Pedrol at

#27885 (Mar 31, 2026, 1:49:26 PM)

xua_asp_fsm: Include Routing Context IE in Err msg cuase Invalid Routing Context

As per RFC4666 3.8.1:
"""
For this error, the invalid Routing Context(s) MUST be included in
the Error message.
"""

Change-Id: Ia8bff16248967209d73cd6d5b54ac30fda283247
Pau Espin Pedrol at

#27884 (Mar 31, 2026, 1:49:19 PM)

xua_lm: Use XLM SAP to send M-ASP_{UP, ACTIVE}.req

Change-Id: I5850d9ec9092ff3d099627856697a4184b0d5853
Pau Espin Pedrol at

#27883 (Mar 31, 2026, 1:49:05 PM)

xua_lm: Use XLM SAP to send M-SCTP_RELEASE.req

Change-Id: I582855acaced48fb838700a3013f94bee7db75ad
Pau Espin Pedrol at

#27882 (Mar 31, 2026, 1:48:41 PM)

sigtran_sap.h: Fix comment stating RK(DE)_REG prims are not implemented

Change-Id: I81a4df1a826fed2f24a4c7ca410b514b1251b44d
Pau Espin Pedrol at

#27881 (Mar 31, 2026, 1:44:34 PM)

xua asp block: SG: turn asp inactive when administratively blocked

This commit intentionally leaves aside implementing active->inactive
transition for asps with role ASP/(active) IPSP.

Change-Id: If8e34cfb05b8b63173b8bb01a520c058daf1fe39
Pau Espin Pedrol at

#27880 (Mar 31, 2026, 12:19:10 PM)

docs/conf.py: silence autosectionlabel duplicate-label warnings

sphinxarg.ext generates generic sub-headings ("Named arguments",
"Positional arguments", "Sub-commands", "General options", ...) for
every argparse command and tool.  These repeat across many files and
trigger large numbers of autosectionlabel duplicate-label warnings.

Two-pronged fix:

* `autosectionlabel_maxdepth = 3` eliminates the depth-4+ warnings
  (sub-headings inside each individual command block).
* `suppress_warnings` per file silences the residual depth-3 collisions
  ("serial reader", "decode_hex", "sub-commands", ...) that still
  appear across tool documentation files.

Cross-references into these generic argparse-generated sections are not
a supported use-case, so suppressing the warnings is appropriate.

Change-Id: I9cdf2a4f6cbd435b16b90ab668205600ffd7c3b0
Vadim Yanitskiy at

#27879 (Mar 31, 2026, 12:19:04 PM)

docs: auto-generate Card Filesystem Reference

Add a Sphinx extension (docs/pysim_fs_sphinx.py) that hooks into the
builder-inited event and generates docs/filesystem.rst before Sphinx
reads any source files.

The generated page contains a hierarchical listing of all implemented
EFs and DFs, organised by application/specification (UICC/TS 102 221,
ADF.USIM/TS 31.102, ADF.ISIM/TS 31.103, SIM/TS 51.011).  For each file,
the class docstring and any _test_de_encode / _test_decode vectors
are included as an encoding/decoding example table.

docs/filesystem.rst is fully generated at build time and is therefore
added to .gitignore.

Change-Id: I06ddeefc6c11e04d7c24e116f3f39c8a6635856f
Related: OS#6316
Vadim Yanitskiy at

#27878 (Mar 31, 2026, 12:18:58 PM)

filesystem: edit_{binary,record}_decoded: add encode/decode examples

When invoking `edit_binary_decoded` or `edit_record_decoded`, the
temp file opened in the editor now contains the EF's encode/decode
test vectors as //-comment lines below the JSON content, similar to
how 'git commit' appends comments to the commit message template.
The comment block is stripped before JSON parsing on save,
so it has no effect on the written data.

The feature is implemented via a new module-level JsonEditor context
manager class that encapsulates the full edit cycle:

* write JSON + examples to a TemporaryDirectory
* invoke the editor
* read back, strip //-comments, parse and return the result

Change-Id: I5a046a9c7ba7e08a98cf643d5a26bc669539b38f
Related: OS#6900
Vadim Yanitskiy at

#27877 (Mar 31, 2026, 12:18:52 PM)

filesystem: JsonEditor: offer interactive retry on error

When json.loads() fails (e.g. the user made a syntax mistake), prompt
the user with "Re-open file for editing? [y]es/[n]o:" and loop back to
the editor if they answer 'y' or 'yes'.  If the user declines, return
the original unmodified value so no write is attempted; the temp file
is still cleaned up by __exit__() in that case.

Change-Id: I9161b7becea0d8dfd3f5f740fbb253da2f061a1d
Related: OS#6899
Vadim Yanitskiy at

#27876 (Mar 31, 2026, 12:18:42 PM)

filesystem: JsonEditor: use NamedTemporaryFile

A plain NamedTemporaryFile is sufficient here: we only need a single
file, not a directory to hold it.  Using NamedTemporaryFile is simpler
(no subdirectory to manage) and gives us a .json suffix for free,
which editors use for syntax highlighting.

Change-Id: If3b0bd0fcc90732407dbd03b9cc883f7abeb948e
Vadim Yanitskiy at

#27875 (Mar 31, 2026, 12:18:29 PM)

docs/conf.py: add autodoc_mock_imports for klein and twisted

The eSIM SM-DP+ server modules (`pySim.esim.es2p`, `pySim.esim.es9p`,
`pySim.esim.http_json_api`) unconditionally import optional server-side
dependencies at module level:

  pySim.esim.es2p          -- from klein import Klein
  pySim.esim.http_json_api -- from twisted.web.server import Request

Both imports fail during a docs build if the packages are absent or
broken, causing three "autodoc: failed to import" warnings and three
missing chapters in the generated manual.

Even when klein and twisted are installed, twisted 23.10.0 (the
version pulled in transitively by smpp.twisted3's `Twisted~=23.10.0`
constraint) is incompatible with Python 3.13+ because twisted.web.http
unconditionally executes `import cgi`, a module that was removed from
the standard library in Python 3.13.

Fix: add `autodoc_mock_imports = ['klein', 'twisted']` to conf.py.
Sphinx inserts mock entries into sys.modules before each autodoc import
attempt, so the modules can be imported and documented without requiring
the real packages to be importable at build time.

Change-Id: I71650466f02a6a6d150650deed167c05d2cb6e64
Vadim Yanitskiy at

#27874 (Mar 31, 2026, 11:40:23 AM)

pysim/pcsc: do not use getProtocol for protocol selection

The documentation of the getProtocol provided by pyscard says:

"Return bit mask for the protocol of connection, or None if no
protocol set. The return value is a bit mask of
CardConnection.T0_protocol, CardConnection.T1_protocol,
CardConnection.RAW_protocol, CardConnection.T15_protocol"

This suggests that the purpose of getProtocol is not to determine
which protocols are supported. Its purpose is to determine which
protocol is currently selected (either through auto selection or
through the explicit selection made by the API user). This means
we are using getProtocol wrong.

So far this was no problem, since the auto-selected protocol
should be a supported protocol anyway. However, the automatic
protocol selection may not always return a correct result (see
bug report from THD-siegfried [1]).

Let's not trust the automatic protocol selection. Instead let's
parse the ATR and make the decision based on the TD1/TD2 bytes).

[1] https://osmocom.org/issues/6952

Related: OS#6952
Change-Id: Ib119948aa68c430e42ac84daec8b9bd542db7963
pmaier@sysmocom.de at

#27873 (Mar 31, 2026, 10:20:00 AM)

sigtran_sap.h: Document spec specifying xUA<->LM primitive

Change-Id: I14c3092a3feac5661d03b9b9114889b348b11bb1
Pau Espin Pedrol at

#27872 (Mar 31, 2026, 9:51:39 AM)

xua_as_fsm: Remove FIXME regarding queueing of msgs during state PENDING

Queueing of messags during T(r) (state PENDING) is already implemented,
see xua_as_fsm_pending() further below in the same file.

Change-Id: Ie572367493066039f7022250d94b815a4da5bd16
Pau Espin Pedrol at

#27871 (Mar 31, 2026, 9:51:35 AM)

xua asp block: SGP/IPSP: Answer ASPAC with Err if blocked

Reject received ASPACs when the asp is administratively blocked.

Moving an already active ASP into inactive state upon user applies
adminsitrative block is not covered in this commit; it will be
implementer later.

This commit doesn't yet implement asp blocking in ASP role nor
(ASP-side) IPSP role.

Related: OS#6752
Change-Id: I23851fe05c06b6bf59b902632029a2382231427e
Pau Espin Pedrol at

#27870 (Mar 31, 2026, 9:50:41 AM)

xua asp block: SG: turn asp inactive when administratively blocked

This commit intentionally leaves aside implementing active->inactive
transition for asps with role ASP/(active) IPSP.

Change-Id: If8e34cfb05b8b63173b8bb01a520c058daf1fe39
Pau Espin Pedrol at

#27869 (Mar 31, 2026, 9:46:57 AM)

pySim-read: remove import random

In pySim-read we do not have to compute any random numbers, so
we may remove random from the imports

Change-Id: Iae4ee6aafb339cc682345299b92b4ecd0bbca14e
pmaier@sysmocom.de at

#27868 (Mar 31, 2026, 7:48:19 AM)

tlv: Allow control over comprehension bit in COMPR_TLV_IE

This allows construction of a comprehension TLV with the bit set or
cleared. The default is comprehension=True to not break existing code.

```
>>> foo = Foo(decoded=b"2342", comprehension=True)
>>> bar = Foo(decoded=b"2342", comprehension=False)
```

Related: OS#6989
Change-Id: I9ca689b9b51152f3907ea470c7b42a0b12208459
dwillmann at

#27867 (Mar 31, 2026, 7:48:15 AM)

tlv: Remove unused branch

0xff is checked in the first if statement and already raises a ValueError

Change-Id: Ia6a0656721a1fcaf5f16526fefe62c30b0ddb664
dwillmann at

#27866 (Mar 30, 2026, 11:57:22 PM)

filesystem: JsonEditor: offer interactive retry on error

When json.loads() fails (e.g. the user made a syntax mistake), prompt
the user with "Re-open file for editing? [y]es/[n]o:" and loop back to
the editor if they answer 'y' or 'yes'.  If the user declines, return
the original unmodified value so no write is attempted; the temp file
is still cleaned up by __exit__() in that case.

Change-Id: I9161b7becea0d8dfd3f5f740fbb253da2f061a1d
Related: OS#6899
Vadim Yanitskiy at

#27865 (Mar 30, 2026, 10:51:43 PM)

filesystem: JsonEditor: use NamedTemporaryFile

A plain NamedTemporaryFile is sufficient here: we only need a single
file, not a directory to hold it.  Using NamedTemporaryFile is simpler
(no subdirectory to manage) and gives us a .json suffix for free,
which editors use for syntax highlighting.

Change-Id: If3b0bd0fcc90732407dbd03b9cc883f7abeb948e
Vadim Yanitskiy at

#27864 (Mar 30, 2026, 10:51:40 PM)

filesystem: edit_{binary,record}_decoded: add encode/decode examples

When invoking `edit_binary_decoded` or `edit_record_decoded`, the
temp file opened in the editor now contains the EF's encode/decode
test vectors as //-comment lines below the JSON content, similar to
how 'git commit' appends comments to the commit message template.
The comment block is stripped before JSON parsing on save,
so it has no effect on the written data.

The feature is implemented via a new module-level JsonEditor context
manager class that encapsulates the full edit cycle:

* write JSON + examples to a TemporaryDirectory
* invoke the editor
* read back, strip //-comments, parse and return the result

Change-Id: I5a046a9c7ba7e08a98cf643d5a26bc669539b38f
Related: OS#6900
Vadim Yanitskiy at

#27863 (Mar 30, 2026, 10:51:33 PM)

docs: auto-generate Card Filesystem Reference

Add a Sphinx extension (docs/pysim_fs_sphinx.py) that hooks into the
builder-inited event and generates docs/filesystem.rst before Sphinx
reads any source files.

The generated page contains a hierarchical listing of all implemented
EFs and DFs, organised by application/specification (UICC/TS 102 221,
ADF.USIM/TS 31.102, ADF.ISIM/TS 31.103, SIM/TS 51.011).  For each file,
the class docstring and any _test_de_encode / _test_decode vectors
are included as an encoding/decoding example table.

docs/filesystem.rst is fully generated at build time and is therefore
added to .gitignore.

Change-Id: I06ddeefc6c11e04d7c24e116f3f39c8a6635856f
Related: OS#6316
Vadim Yanitskiy at

#27862 (Mar 30, 2026, 3:31:08 PM)

stp: m3ua: Introduce test TC_adm_block_after_act

Related: OS#6752
Change-Id: I18672d228c1d15ef99039bccbb972e0b2496b545
Pau Espin Pedrol at

#27861 (Mar 30, 2026, 2:46:33 PM)

stp: m3ua: Introduce test TC_adm_block_act_err

Related: OS#6752
Related: libosmo-sigtran.git Change-Id I23851fe05c06b6bf59b902632029a2382231427e
Change-Id: I9869ec2b71a3f6814340e181d67bab4c9266a2f4
Pau Espin Pedrol at

#27860 (Mar 30, 2026, 2:42:43 PM)

xua asp block: SGP/IPSP: Answer ASPAC with Err if blocked

Reject received ASPACs when the asp is administratively blocked.

Moving an already active ASP into inactive state upon user applies
adminsitrative block is not covered in this commit; it will be
implementer later.

This commit doesn't yet implement asp blocking in ASP role nor
(ASP-side) IPSP role.

Related: OS#6752
Change-Id: I23851fe05c06b6bf59b902632029a2382231427e
Pau Espin Pedrol at

#27859 (Mar 30, 2026, 2:42:32 PM)

stp: m3ua: Introduce test TC_adm_block_act_err

Related: OS#6752
Related: libosmo-sigtran.git Change-Id I23851fe05c06b6bf59b902632029a2382231427e
Change-Id: I9869ec2b71a3f6814340e181d67bab4c9266a2f4
Pau Espin Pedrol at

#27858 (Mar 30, 2026, 2:31:23 PM)

stp: Move NTFY expect to up & act step helper functions

Change-Id: Ia835a5dd54cc37f529ca1c4ff9892d44fe239241
Pau Espin Pedrol at

#27857 (Mar 30, 2026, 2:25:15 PM)

docs/conf.py: add autodoc_mock_imports for klein and twisted

The eSIM SM-DP+ server modules (`pySim.esim.es2p`, `pySim.esim.es9p`,
`pySim.esim.http_json_api`) unconditionally import optional server-side
dependencies at module level:

  pySim.esim.es2p          -- from klein import Klein
  pySim.esim.http_json_api -- from twisted.web.server import Request

Both imports fail during a docs build if the packages are absent or
broken, causing three "autodoc: failed to import" warnings and three
missing chapters in the generated manual.

Even when klein and twisted are installed, twisted 23.10.0 (the
version pulled in transitively by smpp.twisted3's `Twisted~=23.10.0`
constraint) is incompatible with Python 3.13+ because twisted.web.http
unconditionally executes `import cgi`, a module that was removed from
the standard library in Python 3.13.

Fix: add `autodoc_mock_imports = ['klein', 'twisted']` to conf.py.
Sphinx inserts mock entries into sys.modules before each autodoc import
attempt, so the modules can be imported and documented without requiring
the real packages to be importable at build time.

Change-Id: I71650466f02a6a6d150650deed167c05d2cb6e64
Vadim Yanitskiy at

#27856 (Mar 30, 2026, 2:09:49 PM)

firmware: werror on missing return

Silently ignoring a missing return just broke all timers,
so prevent similar mistakes in the future.

Change-Id: I2e25884077af6334c9e9ddace3900b04061fae04
ewild at

#27855 (Mar 30, 2026, 2:02:44 PM)

firmware: fix timers, add missing return

Change-Id: I5b12284c88d8fe6e4fe55cc4cd2aad550d276af4
ewild at

#27854 (Mar 30, 2026, 1:50:16 PM)

docs/conf.py: silence autosectionlabel duplicate-label warnings

sphinxarg.ext generates generic sub-headings ("Named arguments",
"Positional arguments", "Sub-commands", "General options", ...) for
every argparse command and tool.  These repeat across many files and
trigger large numbers of autosectionlabel duplicate-label warnings.

Two-pronged fix:

* `autosectionlabel_maxdepth = 3` eliminates the depth-4+ warnings
  (sub-headings inside each individual command block).
* `suppress_warnings` per file silences the residual depth-3 collisions
  ("serial reader", "decode_hex", "sub-commands", ...) that still
  appear across tool documentation files.

Cross-references into these generic argparse-generated sections are not
a supported use-case, so suppressing the warnings is appropriate.

Change-Id: I9cdf2a4f6cbd435b16b90ab668205600ffd7c3b0
Vadim Yanitskiy at

#27853 (Mar 30, 2026, 1:32:46 PM)

docs/legacy: fix typo "EF,IMSI" -> "EF.IMSI"

Change-Id: I1f246ec008a57b2373ed3f5531ab4166101f4dd0
Vadim Yanitskiy at

#27852 (Mar 30, 2026, 1:32:43 PM)

docs/conf.py: silence autosectionlabel duplicate-label warnings

sphinxarg.ext generates generic sub-headings ("Named arguments",
"Positional arguments", "Sub-commands", "General options", ...) for
every argparse command and tool.  These repeat across many files and
trigger large numbers of autosectionlabel duplicate-label warnings.

Two-pronged fix:

* `autosectionlabel_maxdepth = 3` eliminates the depth-4+ warnings
  (sub-headings inside each individual command block).
* `suppress_warnings` per file silences the residual depth-3 collisions
  ("serial reader", "decode_hex", "sub-commands", ...) that still
  appear across tool documentation files.

Cross-references into these generic argparse-generated sections are not
a supported use-case, so suppressing the warnings is appropriate.

Change-Id: I9cdf2a4f6cbd435b16b90ab668205600ffd7c3b0
Vadim Yanitskiy at

#27851 (Mar 30, 2026, 1:32:40 PM)

docs/put_key-tutorial: fix three typos

  "verifiation"        -> "verification"
  "this is identifies" -> "this identifies" (extra word)
  "and and"            -> "and" (doubled word)

Change-Id: I1ae6b01638cc2c3dd8355ba801f85cc179ca8bd3
Vadim Yanitskiy at

#27850 (Mar 30, 2026, 1:32:38 PM)

docs/card-key-provider: fix heading levels and typo

The "ADM PIN" and "SCP02 / SCP03" sub-sections of "Field naming" used
the '~' heading character, which Sphinx resolved to level 4 - skipping
level 3 and throwing build ERRORs.  As a result, both sub-sections
had no heading at all.  Change both to '^' (level 3) to match the
other sub-sections in this file.

While at it, fix a typo: "consisting if" -> "consisting of".

Change-Id: Ia56efc7fadcc0fd62e87e63850b929d2f80851ba
Vadim Yanitskiy at

#27849 (Mar 30, 2026, 1:32:33 PM)

docs/shell: fix copy-paste typos in editor command descriptions

Two adjacent commands (`edit_record_decoded`, `edit_binary_decoded`)
had identical copy-pasted error messages with three typos each:

  "modificatiosn" -> "modifications"
  "us the"        -> "use the"
  "comamdn"       -> "command"

Change-Id: Ie23baba4634e2cc40f81439fb11b102778aed1f6
Vadim Yanitskiy at

#27848 (Mar 30, 2026, 1:32:30 PM)

docs/saip-tool: fix typo "insertaion" -> "insertion"

Change-Id: Ie9c9235ec964a15fab19d6ca5a83b2b1ddf07e7b
Vadim Yanitskiy at

#27847 (Mar 30, 2026, 12:22:40 PM)

m3ua: m3ua_gen_error_msg(): include Routing Context IE in cause Invalid Routing Context

As per RFC4666 3.8.1:
"""
The "Invalid Routing Context" error is sent if a message is received
from a peer with an invalid (unconfigured) Routing Context value.
For this error, the invalid Routing Context(s) MUST be included in
the Error message."
"""

Hence add the originating Routing Context IE so the error message can be
further originated.
For the same reason, also add the Diagnostic Information for the
specific cases in the switch statement, and make them more robust about
possible null pointer dereference.

Change-Id: If821109701e315d17f5334c680670ea6c7bce3bd
Pau Espin Pedrol at

#27846 (Mar 30, 2026, 12:22:37 PM)

xua_asp_fsm: Include Routing Context IE in Err msg cuase Invalid Routing Context

As per RFC4666 3.8.1:
"""
For this error, the invalid Routing Context(s) MUST be included in
the Error message.
"""

Change-Id: Ia8bff16248967209d73cd6d5b54ac30fda283247
Pau Espin Pedrol at

#27845 (Mar 30, 2026, 12:13:23 PM)

m3ua: m3ua_gen_error_msg(): include Routing Context IE in cause Invalid Routing Context

As per RFC4666 3.8.1:
"""
The "Invalid Routing Context" error is sent if a message is received
from a peer with an invalid (unconfigured) Routing Context value.
For this error, the invalid Routing Context(s) MUST be included in
the Error message."
"""

Hence add the originating Routing Context IE so the error message can be
further originated.
For the same reason, also add the Diagnostic Information for the
specific cases in the switch statement, and make them more robust about
possible null pointer dereference.

Change-Id: If821109701e315d17f5334c680670ea6c7bce3bd
Pau Espin Pedrol at

#27844 (Mar 30, 2026, 12:13:19 PM)

xua_asp_fsm: Include Routing Context IE in Err msg cuase Invalid Routing Context

As per RFC4666 3.8.1:
"""
For this error, the invalid Routing Context(s) MUST be included in
the Error message.
"""

Change-Id: Ia8bff16248967209d73cd6d5b54ac30fda283247
Pau Espin Pedrol at

#27843 (Mar 30, 2026, 12:00:57 PM)

OBS: nightly: add ".0" after versions on git tags

Fix that with the current logic of generating version numbers for
nightly, a version done on a tag can be higher than the following
version:

on tag:                    1.14.0.202603231800         # <tag>.<YY><MM><DD><HH><mm><SS>
on tag (with this patch):  1.14.0.0.202603231800       # <tag>.0.<YY><MM><DD><HH><mm><SS>
next commit after the tag: 1.14.0.1.2016.202603241800  # <tag>.<patch-count-since-last-tag>.<commit-hash>.<YY><MM><DD><HH><mm><SS>

Fixes: OS#6981
Change-Id: Id140d8ea76bf98357711587a9909d54097250fd6
Oliver Smith at

#27842 (Mar 30, 2026, 11:32:31 AM)

xua: Split traffic mode readonly validation from internal state update

First validate the whole message, then once evyerthing is fine, act on
the message updating internal state.

Change-Id: I05ba891e774ebe341229b968c92e0383b6899bd6
Pau Espin Pedrol at

#27841 (Mar 30, 2026, 11:32:27 AM)

asp_vty: Fix wrong vty write 'blocked' command

This is not criticial since "block"/"no block" commands are yet to be
fully implemented.

Change-Id: Ia42a064cfdbba025bc3ae5479e8e6edec4abe770
Pau Espin Pedrol at

#27840 (Mar 30, 2026, 11:32:23 AM)

xua_find_as_for_asp(): Optimize lookup

Instead of looking up on all AS configured in an instance, look up on
the subset associated to the ASP we are looking up for.
Since we are also not looking a 2nd pass to then validate if ASP and
returned AS is related, in worst case this would split lookup complexity
by half.

Change-Id: If85ad27ad5e55be0c22e2716fa7329409a7b85b5
Pau Espin Pedrol at

#27839 (Mar 30, 2026, 11:32:19 AM)

osmo_ss7_find_free_{rctx,l_rk_id}(): Make more robust to wrap-around

Previous versions of those functions would end up broken over time after
~2^32 were allocated, turning the program into an unusuable stte.

Change-Id: Ie10f4048d0af384dc84c79e6fc441c8537649d55
Pau Espin Pedrol at

#27838 (Mar 30, 2026, 11:32:15 AM)

asp: Configure block and shutdown adm state independently

The block/no block and shutdown/no shutdown commands tweak independent
states; adapt the code to what's presented to the user. This simplifies
handling of both states, since the user may want eg. have it blocked and
shutdown, and then "no shutdown" it but make sure it stays blocked so no
race condition happens.

Related: OS#6752
Change-Id: I3ab81a4f6f6b72015c5068d5a27128642622cf99
Pau Espin Pedrol at

#27837 (Mar 30, 2026, 11:32:10 AM)

xua_rkm: handle_rkey_reg(): Skip AS ilookup of known free RCTX

There's no need to attempt a look up for an AS with a RCTX we just
ensured is not yet allocated to any AS.

Change-Id: I40719527c527db58244972a797c4287107306532
Pau Espin Pedrol at

#27836 (Mar 30, 2026, 11:31:57 AM)

xua_asp_fsm: XUA_ASP_E_ASPTM_ASPAC: Validate RCTX AS is associated to ASP

Previously we only validated that a local AS was configured for the
provided routing context, but we didn't validate that the AS was actually
associated to the requesting ASP.

Change-Id: Idcd51b9bbe38064ed03d076a76279384a3927334
Pau Espin Pedrol at

#27835 (Mar 30, 2026, 11:29:47 AM)

handle_rkey_dereg(): Optimize lookup

Instead of looking up on all AS configured in an instance, look up on
the subset associated to the ASP we are looking up for.
Since we are also not looking a 2nd pass to then validate if ASP and
returned AS is related, in worst case this would split lookup complexity
by half.

Change-Id: I56ac5caef9bcded9dd08ca532a413af94070a1bd
Pau Espin Pedrol at

#27834 (Mar 30, 2026, 10:47:47 AM)

stp: m3ua: Fix incorrect RCTX being sent in TC_combinedlset_loadshare

An ASPAC was being sent containing an RCTX of an unrelated AS to the
sending ASP.
Newer libosmo-sigtran properly validates AS/RCTX is associated to the
ASP in the local config, and hence now returns an error properly making
the test fail.

Change-Id: Id8381a028a919a265ca330ef4f61c76637c168f6
Pau Espin Pedrol at

#27833 (Mar 30, 2026, 9:50:03 AM)

struct trx_power_params: fix inaccurate comment

Change-Id: I1bdb7fab24fee28dbeac0ed05e13f650e08c98e9
Fixes: 4c632421 ("bts_shutdown_fsm: fix spurious RAMP_COMPL events in WAIT_TRX_CLOSED")
Vadim Yanitskiy at

#27832 (Mar 30, 2026, 8:07:01 AM)

OBS: pyhss_download_deps: add python 3.14

Download binary package dependencies for python 3.14 too, so we can
build the package for Ubuntu 26.04.

Related: OS#6983
Related: https://gitea.osmocom.org/osmocom/pyhss/commit/2125f52c5eb1b3e66b1ebe2febadb7c886536681
Change-Id: Ic23d52c081f68fb8d6f7d9e370883236ca9bf35f
Oliver Smith at

#27831 (Mar 30, 2026, 8:00:58 AM)

stp: STP_Tests_M3UA_TCP: Introduce tests TC_m3ua_tcp_{cli,srv}_adm_shutdown

Related tests already existed for STP_Tests_M3UA, but we want to
explicitly test against M3UA_TCP since these tests involve the transport
layer directly.

Related: OS#6752
Change-Id: Ia37a0e244895fbb447ef8e71a0980538cc9fd7f8
Pau Espin Pedrol at

#27830 (Mar 30, 2026, 8:00:50 AM)

stp: STP_Tests_IPA: Introduce tests TC_ipa_tcp_{cli,srv}_adm_shutdown

Related tests already exist for M3UA and M3UA_TCP, but were missing for
IPA ASPs.

Change-Id: Ie30de6caa3e2b680aff9e50898e63f615b526500
Related: OS#6752
Pau Espin Pedrol at

#27829 (Mar 29, 2026, 1:51:38 PM)

osmo-bts-trx: rx_data_fn(): fix copy-paste in comment

Change-Id: Ibf35c468310a690fd873cf968bb2c44b493ca5ea
Vadim Yanitskiy at

#27828 (Mar 29, 2026, 1:48:11 PM)

bts_shutdown_fsm: fix spurious RAMP_COMPL events in WAIT_TRX_CLOSED

With multiple TRXes ramping down in lockstep, both their final
ramp-timer callbacks fire back-to-back in the same event loop pass,
setting p_total_cur_mdBm to the target value for both before any async
hardware acknowledgement arrives.  When the first SETPOWER ack returns
and fires ramp_down_compl_cb() for TRX0, the remaining-TRX check in
st_wait_ramp_down_compl() inspects p_total_cur_mdBm for TRX1 and finds
it already at the target - concluding that all TRXes are done.  The FSM
then transitions to WAIT_TRX_CLOSED, and the second ack (for TRX1)
fires ramp_down_compl_cb() into the wrong state, producing:

  BTS_SHUTDOWN(...){WAIT_TRX_CLOSED}: Event BTS_SHUTDOWN_EV_TRX_RAMP_COMPL not permitted

The root cause is that p_total_cur_mdBm is a *requested* value set in
the timer callback, not a confirmed one.  The hardware confirmation
arrives asynchronously via power_trx_change_compl() ->
power_ramp_do_step(), which is also where compl_cb() is invoked.

Fix by adding a 'complete' flag to trx_power_params.ramp that is:

* cleared when _power_ramp_start() begins a new ramp, and
* set just before compl_cb() is called in power_ramp_do_step()

The shutdown FSM remaining-TRX count then checks !ramp.complete instead of
comparing p_total_cur_mdBm against the target, correctly reflecting which
TRXes have actually received hardware confirmation of ramp completion.

Change-Id: Ia71393e871187d6b44b7f520eb421bab354aafd1
Vadim Yanitskiy at

#27827 (Mar 29, 2026, 1:48:02 PM)

osmo-bts-trx: rx_rach_fn(): remove redundant fall-back

Condition `synch_seq != RACH_SYNCH_SEQ_TS0` is unlikely to be true,
given that no other synch. sequences are defined by 3GPP TS 45.002.
Even if this happens for whatever reason (e.g. a bug), assigning
`synch_seq` to `RACH_SYNCH_SEQ_TS0` is not needed, as `synch_seq`
is never read after the switch statement.  The logging message is
not useful either, since we already print the synch. seq. above.

Change-Id: I4cdc03dc6631ca17d13a3067ad03020e3e97eab1
Vadim Yanitskiy at

#27826 (Mar 27, 2026, 7:55:07 PM)

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd
ewild at

#27825 (Mar 27, 2026, 6:15:19 PM)

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd
ewild at

#27824 (Mar 27, 2026, 5:24:45 PM)

nokia_site: add objects to query TRX power and power steps

This commit adds a method to query per TRX RF power and
power control step capabilities of radio HW.

Change-Id: Ib5a00c0b528407144cca88e5cbde940d7a5509f0
metro4 at

#27823 (Mar 27, 2026, 4:55:24 PM)

stp: STP_Tests_M3UA_TCP: Introduce tests TC_m3ua_tcp_{cli,srv}_adm_shutdown

Related tests already existed for STP_Tests_M3UA, but we want to
explicitly test against M3UA_TCP since these tests involve the transport
layer directly.

Related: OS#6752
Change-Id: Ia37a0e244895fbb447ef8e71a0980538cc9fd7f8
Pau Espin Pedrol at

#27822 (Mar 27, 2026, 4:55:20 PM)

stp: STP_Tests_IPA: Introduce tests TC_ipa_tcp_{cli,srv}_adm_shutdown

Related tests already exist for M3UA and M3UA_TCP, but were missing for
IPA ASPs.

Change-Id: Ie30de6caa3e2b680aff9e50898e63f615b526500
Related: OS#6752
Pau Espin Pedrol at

#27821 (Mar 27, 2026, 9:18:29 AM)

OBS: pyhss_download_deps: fix dependency loop

Fix that the Osmocom_OBS_nightly job is failing for the pyhss package
with a dependency loop in hatchling:

  LookupError: https://files.pythonhosted.org/…/hatchling-1.29.0.tar.gz (from https://pypi.org/simple/hatchling/) (requires-python:>=3.10) is already being built: hatchling>=1.21.0 from https://files.pythonhosted.org/…/hatchling-1.29.0.tar.gz

This happens as it recursively collects source packages and their
(build) dependencies:

  pymongo
  -> dnspython
  -> hatchling
  -> pluggy
  -> setuptools-scm
  -> vcs-versioning
  -> hatchling

When only ignoring the hatchling source package, we get a similar
dependency loop with pluggy, so ignore both source packages. Hatchling
gets added later as binary package and pluggy is only a build-time
dependency for hatchling. The resulting PyHSS package builds fine with
this change.

Change-Id: I0484627fd105627fabe9435379e704db54e72ae3
Oliver Smith at

#27820 (Mar 27, 2026, 9:18:24 AM)

OBS: pyhss_download_deps: add python 3.14

Download binary package dependencies for python 3.14 too, so we can
build the package for Ubuntu 26.04.

Related: OS#6983
Related: https://gitea.osmocom.org/osmocom/pyhss/commit/2125f52c5eb1b3e66b1ebe2febadb7c886536681
Change-Id: Ic23d52c081f68fb8d6f7d9e370883236ca9bf35f
Oliver Smith at

#27819 (Mar 27, 2026, 7:41:39 AM)

osmo-bts-trx: check sscanf() result in NOMTXPOWER/SETPOWER handlers

Both trx_ctrl_rx_rsp_nomtxpower() and trx_ctrl_rx_rsp_setpower() were
calling sscanf() without checking its return value.  On a parse failure
the local variable remained uninitialized and was passed directly to the
callback, resulting in a garbage power level.

Change-Id: I3dc399cfae70c450d53d66bb99f3832f160fca39
Vadim Yanitskiy at

#27818 (Mar 27, 2026, 7:40:14 AM)

lint/checkpatch: ignore SSCANF_TO_KSTRTO

This kernel-specific warning doesn't make sense when linting our code so
disable it.

Change-Id: If096c600331d7ad5786395c5c41a6742da44a3e8
Oliver Smith at

#27817 (Mar 26, 2026, 9:47:22 PM)

l1sap: check_for_ciph_cmd(): add missing msgb length check

The function accesses msg->data[0..4] without first verifying that the
message is at least 5 bytes long, which would cause a buffer over-read
on a malformed (too short) LAPDm frame.

Change-Id: I47690f1a6357e42913bfa8100e36c05cb4f0607a
Vadim Yanitskiy at

#27816 (Mar 26, 2026, 9:47:18 PM)

osmo-bts-trx: clean up log messages in response handlers

Drop the redundant "transceiver" prefix from LOGPPHI() calls -
the macro already prepends the PHY instance name.

Change-Id: Iec722198f161621dd00ce3baabb732e1a1d91a37
Vadim Yanitskiy at

#27815 (Mar 26, 2026, 9:47:13 PM)

scheduler: trx_sched_is_sacch_fn(): fix returning non-bool

The function is declared `bool` but returns `-EINVAL` on an error path.
`-EINVAL` is `-22`, which in C implicitly converts to `bool true`.
Returning `false` makes more sense when we don't know the MF layout.

Change-Id: Ib2394687815aed4990c3880446176e4c97440667
Vadim Yanitskiy at

#27814 (Mar 26, 2026, 9:46:59 PM)

osmo-bts-trx: check sscanf() result in NOMTXPOWER/SETPOWER handlers

Both trx_ctrl_rx_rsp_nomtxpower() and trx_ctrl_rx_rsp_setpower() were
calling sscanf() without checking its return value.  On a parse failure
the local variable remained uninitialized and was passed directly to the
callback, resulting in a garbage power level.

Change-Id: I3dc399cfae70c450d53d66bb99f3832f160fca39
Vadim Yanitskiy at

#27813 (Mar 26, 2026, 9:46:53 PM)

measurement: is_meas_complete(): fix fn_mod variable type

`fn_mod` was declared as 'unsigned int' but initialized to -1, which
yields `UINT_MAX` via implicit conversion.  Use 'int' instead to make
the sentinel value unambiguous and match the `%d` format used in
the debug log.

Change-Id: I6b0bce9bc9fca1d6effbb2da2319132cdff4e9c7
Vadim Yanitskiy at

#27812 (Mar 26, 2026, 9:46:45 PM)

tx_power: get_pa_drive_level_mdBm(): assert on out-of-range ARFCN

The function previously returned `INT_MIN` as an error sentinel when
the ARFCN exceeded the calibration table size (1024 entries, covering
all valid GSM ARFCNs 0..1023).  None of the callers checked for this
value, so it would silently propagate through power calculations and
eventually be passed to `bts_model_change_power()`.

An out-of-range ARFCN indicates a serious misconfiguration;
replace the range check and `return INT_MIN` with an `OSMO_ASSERT`.

Change-Id: I70c54652e0b07d399363276bc60946aa8b195725
Vadim Yanitskiy at

#27811 (Mar 26, 2026, 9:46:39 PM)

phy_link: phy_instance_link_to_trx(): add missing semicolon

Change-Id: Ica33798adfdc5aad6b6aa9e252e9cc9294bad659
Vadim Yanitskiy at

#27810 (Mar 26, 2026, 9:46:32 PM)

bts_ctrl_commands: remove debugging leftover

Change-Id: I571a10f94482e3097aa915f192db6215f085dbcd
Vadim Yanitskiy at

#27809 (Mar 26, 2026, 9:44:52 PM)

phy_link: phy_{link,instance}_name(): fix shared static buffer

Both functions were writing into the same static buffer, so any caller
holding a pointer returned by one and then invoking the other would
silently end up with a stale/overwritten string.  Move name_buf into
each function as a local static, so the two buffers are independent.

Change-Id: I79e9d7f5b1e5c275911cf88854211f1ce8a28669
Vadim Yanitskiy at

#27808 (Mar 26, 2026, 5:35:31 PM)

firmware: add tear-free 64bit load/store helpers for jiffies

On Cortex-M4 a 64bit load may compile to two separate LDR
instructions which can lead to torn reads due to interrupts.
LDRD/STRD are restartable, they either complete or restart from
scratch, so the result is always consistent. The only "downside" is the
required alignment, which is fine.

Change-Id: I729c0fdfb5b228b03c2df1cf098743100b1ea625
ewild at

#27807 (Mar 26, 2026, 5:35:28 PM)

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd
ewild at

#27806 (Mar 26, 2026, 3:57:48 PM)

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd
ewild at

#27805 (Mar 26, 2026, 3:57:44 PM)

firmware: add tear-free 64bit load/store helpers for jiffies

On Cortex-M4 a 64bit load may compile to two separate LDR
instructions which can lead to torn reads due to interrupts.
LDRD/STRD are restartable, they either complete or restart from
scratch, so the result is always consistent. The only "downside" is the
required alignment, which is fine.

Change-Id: I729c0fdfb5b228b03c2df1cf098743100b1ea625
ewild at

#27804 (Mar 26, 2026, 3:13:29 PM)

Implement ITU Q.704 T10 timer

Implement timer T10 used for periodic ASP Audit procedure as described
in:
* ITU Q.704 13.5.2
* rfc4666 4.5.3
* ETSI TS 102 142 V1.1.1

This procedure is used in order to recover the signalling route
availability information that may not have been received because of
some signalling network failure.

Related: OS#6883
Change-Id: Ic12b1aa8f2a02f32615dade34f0e1f01b2535f7b
Pau Espin Pedrol at

#27803 (Mar 26, 2026, 1:14:11 PM)

cosmetic: xua_snm: Add spec reference regarding no SSNM tx

Change-Id: I69912d5b7032c12e06648e5f5a700384182bb1f9
Pau Espin Pedrol at

#27802 (Mar 26, 2026, 1:13:21 PM)

cosmetic: xua_snm: Add spec reference regarding no SSNM tx

Change-Id: I69912d5b7032c12e06648e5f5a700384182bb1f9
Pau Espin Pedrol at

#27801 (Mar 26, 2026, 12:42:11 PM)

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd
ewild at

#27800 (Mar 26, 2026, 12:37:21 PM)

firmware: add tear-free 64bit load/store helpers for jiffies

On Cortex-M4 a 64bit load may compile to two separate LDR
instructions which can lead to torn reads due to interrupts.
LDRD/STRD are restartable, they either complete or restart from
scratch, so the result is always consistent. The only "downside" is the
required alignment, which is fine.

Change-Id: I729c0fdfb5b228b03c2df1cf098743100b1ea625
ewild at

#27799 (Mar 26, 2026, 12:37:16 PM)

firmware: replace libosmocore fsm timers

Concurrent access from main loop and the different uart irqs was not
going well and caused crashes. The libosmocore fsm does still allocate
one internal timer, but it is not used by the firmware, so libosmocore
will not touch the rbtree.

Additionally ignore checkpatch jiffies complaints because we're trying
to do firmware here.

Closes: SYS#7877
Change-Id: Id2bd67b3946bb451008965f0b68b4a919f4d10bd
ewild at

#27798 (Mar 26, 2026, 11:57:45 AM)

OBS: add Ubuntu 26.04

Change-Id: Id22f4902b73ad9b4131b837a8036df68cf665f8f
Oliver Smith at

#27797 (Mar 26, 2026, 10:01:50 AM)

pgw: Test v6 and v4v6 PDU session userplane

Change-Id: Idf009b9118db8117c547a1bb0f27afdfa3f03924
Pau Espin Pedrol at

#27796 (Mar 25, 2026, 10:33:14 PM)

pfcp_peer: add configurable heartbeat fail threshold + association reset

Introduce heartbeat_fail_threshold (default: 3) that tracks consecutive
unanswered PFCP Heartbeat Requests via the heartbeat_fail_count field
and resets the association when the threshold is reached.  The counter
applies to both periodic heartbeats and those triggered via the REST
API, and resets to zero on any successful Heartbeat Response.

Change-Id: I8cb0fb23468aba4dead9865a90d893c78c6ae074
Vadim Yanitskiy at

#27795 (Mar 25, 2026, 10:33:11 PM)

pfcp_peer: detect UPF restart via RTS mismatch in Heartbeat Response

Check the Recovery Timestamp (RTS) in each Heartbeat Response against
the value stored during Association Setup (`rem_rts`).  A mismatch
means the UPF has restarted; log a warning, increment the new
`pfcp.peer_restart counter`, and reset the PFCP association so it is
re-established with the restarted peer.

The `is_integer(ExpRTS)` guard prevents a spurious reset when a stale
Heartbeat Response arrives in the connecting state (where `rem_rts`
is still undefined).

Change-Id: I00a8384db1ea9c38d0ad9ff90b3d45ad86c3a020
Vadim Yanitskiy at

#27794 (Mar 25, 2026, 10:33:05 PM)

pfcp_peer: tune Heartbeat Request/Response logging

Reduce verbosity of the Tx/Rx Heartbeat Req/Resp log messages from
LOG_INFO to LOG_DEBUG in preparation for periodic heartbeat support.
Without this change, periodic heartbeats would flood the logging.

Change-Id: I6435cdf64fd86fa5358d57ea4d56dcad8eb9e69e
Vadim Yanitskiy at

#27793 (Mar 25, 2026, 10:31:36 PM)

pfcp_peer: implement periodic PFCP heartbeat

Add a heartbeat_interval parameter to the pfcp_peer config section.
When non-zero, pfcp_peer sends a periodic Heartbeat Request to the UPF
at the configured interval using a named gen_statem timeout (hb_timer).
The timer is started on entry to the connected state and cancelled on
re-entry to the connecting state.  Default is 10000 ms (10 seconds).

Change-Id: I306324f8eca325202a3fa23125854db9d5eaab38
Vadim Yanitskiy at

#27792 (Mar 25, 2026, 9:38:23 PM)

rspro_server: use correct byte order in log message "Bankd IP/Port changed to <IP>:<Port>

The byte order is wrong and results in printing the IP as reverse.
"Bankd IP/Port changed to 1.0.0.127:9999".

Change-Id: I288ea70091d24fa95732f7035ab50100831be841
lynxis at

#27791 (Mar 25, 2026, 4:34:58 PM)

GTPv2_Templates: Add enum for PDN Type and use it in pgw testsuite

Change-Id: I9833e998522a09a15b93c8fed0e18a5e8159d760
Pau Espin Pedrol at

#27790 (Mar 25, 2026, 4:34:55 PM)

5gc: Introduce test TC_pdu_sess_est_pco_pcscf

Our deps/nas fork is modified to fix multiple incorrect definitions
around ProtocolContainer record.

Change-Id: Ic7b22ad647bcac944551ac1c29080f895ca72cf8
Pau Espin Pedrol at

#27789 (Mar 25, 2026, 4:34:52 PM)

pgw: Test v6 and v4v6 PDU session userplane

Change-Id: Idf009b9118db8117c547a1bb0f27afdfa3f03924
Pau Espin Pedrol at

#27788 (Mar 25, 2026, 4:34:36 PM)

GTPv1U_Emulation: Rename s/f_gtp1u_ping4/f_gtp1u_ping/

The function can also be (and is) used to ping IPv6 hosts.

Change-Id: I195cb048176aefddcb477083ddc949b86ec592fa
Pau Espin Pedrol at