Skip to content

Loading builds...

Changes

#27351 (Mar 10, 2026, 7:28:15 PM)

ccid: Handle the TPDU-length = 4 case according to CCID spec

While ISO7816-3 forbids any TPDU shorter from 5 bytes, the CCID spec
begs to differ and actually permits a host to send us 4-byte TPDUs of
Form 1, giving the responsibility of adding the P3=00h octet to the CCID
implementation.

Let's implement this accordingly.  While at it, also reject TPDUs of
lengths 1, 2 and 3 bytes - just like zero-length TPDUs.

Change-Id: Ia27962bda526af3373b36d637e2b548aa01a3346
Closes: OS#6973
laforge at

#27350 (Mar 10, 2026, 5:17:11 PM)

dfu-download: flash the first block in manifest phase

To prevent half flashed applications, erase the first page
when dfu downloading starts and save the first block for later.
In manifest stage, flash the first block.
If the first 4 byte are 0xffffffff, the board won't boot
into application and go into the dfu bootloader.

Change-Id: I894f3ee71587ccb287e92d7025039954991c631f
lynxis at

#27349 (Mar 10, 2026, 5:17:07 PM)

dfu: rewrite firmware downloading

Improve handling of dfu_state by moving more state changing towards the
IRQ handler. Having both the main loop and IRQ changes dfu_state within
the same state could lead to races.

The main loop is now only a simple worker which reports back via dfu_flash_done &
dfu_flash_status.

Change-Id: I345d5948455b25cd8a2efb1abfd9d0986ebd8cef
lynxis at

#27348 (Mar 10, 2026, 5:17:04 PM)

Replace snprintf() to free 4 kb

Change-Id: Ide644648bda86d4ae77a6713d1e140a4b78ba835
lynxis at

#27347 (Mar 10, 2026, 5:16:59 PM)

dfu: MANIFEST_SYNC: stay in MANIFEST_SYNC when manifestationIntolerant & completed

In theory a device which is manifestintolerant and completed the manifestation should
not reach MANIFEST_SYNC again.

Remove the state transistion to WAIT-RESET and stay in the current state and
wait for the main loop to change the state is safer.

Change-Id: I8c34a18e2336731126a8c01070d86e2547578e3d
lynxis at

#27346 (Mar 10, 2026, 5:16:55 PM)

dfu: protect USB_DFU_STATE_DFU_MANIFEST by a critical section

In the MANIFEST state, the IRQ won't move the state, but
to prevent incosistency between dfu_manifestation_complete &
dfu_state, use a critical section.

Change-Id: Idf5fb7d55b4051ba7e235dfa409a4de18a8f208c
lynxis at

#27345 (Mar 10, 2026, 4:57:28 PM)

NGAP_Templates: Expect optional IEs in HandoverRequest templates

Change-Id: I227d67a589127ccfc5f44950daa3c0d95e425437
Pau Espin Pedrol at

#27344 (Mar 10, 2026, 4:57:24 PM)

NGAP_Templates: Add missing IE TargetToSource_TransparentContainer to HandoverRequestAcknowledge

Change-Id: I19b0b718021326a64fe3bf1b3508a769a453557d
Pau Espin Pedrol at

#27343 (Mar 10, 2026, 4:57:20 PM)

NGAP_Templates: Fix missing SourceToTarget_TransparentContainer IE not appended

Change-Id: I40cff63f3d662fa168b57abe4ef95f347ab74435
Pau Espin Pedrol at

#27342 (Mar 10, 2026, 4:57:13 PM)

NGAP_Templates: Fix wrong id in HandoverReq template IE

Change-Id: I160a319543c32187bc4f2f3f4cf0baa667758f79
Pau Espin Pedrol at

#27341 (Mar 10, 2026, 4:27:58 PM)

core: fix config.h

While exploring why logging is disabled but still shows up in the binaries
I kind of wondered how all the config.h HAVE_XX checks we have everwhere work.
Apparently they do not work at all, due to missing or misplaced include of config.h.

This affects tons of other checks as well.

The jenkins hook ensures the include order is checked to ensure config.h
does not get misplaced or lost in the future.

Change-Id: Ic2cf52a3b60f43a2f5d3fe01c41a41f6fd9a8000
ewild at

#27340 (Mar 10, 2026, 4:11:34 PM)

core: fix config.h

While exploring why logging is disabled but still shows up in the binaries
I kind of wondered how all the config.h HAVE_XX checks we have everwhere work.
Apparently they do not work at all, due to missing or misplaced include of config.h.

This affects tons of other checks as well.

The jenkins hook ensures the include order is checked to ensure config.h
does not get misplaced or lost in the future.

Change-Id: Ic2cf52a3b60f43a2f5d3fe01c41a41f6fd9a8000
ewild at

#27339 (Mar 10, 2026, 4:03:00 PM)

ccid: properly reject PC_to_RDR_{ResetParameters,SetParameters}

As per CCID 1.1 ch 6.2.3 a reader that does not support
these commands can reject them, which we now do, instead of
pretending to accept the params.

This requires https://gitlab.com/wireshark/wireshark/-/issues/20107 to
be properly decoded in wireshark >= 4.4.8 .

As a bonus this fixes the error response in gen_err_resp which so far had superfluous param data attached to it.

Closes: OS#5380
Change-Id: I4d0671c160e9028097397ec47982bafbfdc24f24
ewild at

#27338 (Mar 10, 2026, 3:59:47 PM)

ccid: properly reject PC_to_RDR_{ResetParameters,SetParameters}

As per CCID 1.1 ch 6.2.3 a reader that does not support
these commands can reject them, which we now do, instead of
pretending to accept the params.

This requires https://gitlab.com/wireshark/wireshark/-/issues/20107 to
be properly decoded in wireshark >= 4.4.8 .

Closes: OS#5380
Change-Id: I4d0671c160e9028097397ec47982bafbfdc24f24
ewild at

#27337 (Mar 10, 2026, 3:42:10 PM)

pySim-prog/pySim-read: add pySimLogger and verbose cmdline argument

pySim-prog and pySim-read do not integrate the pySimLogger yet. As we
may add more debug output that should not be visible on normal use, we
should ensure that the pySimLogger is correctly set up.

Change-Id: Ia2fa535fd9ce4ffa301c3f5d6f98c1f7a4716c74
pmaier@sysmocom.de at

#27336 (Mar 10, 2026, 2:29:53 PM)

PySimLogger: add parameter to set initial log-level/verbosity

When we initialize a new PySimLogger, we always call the setup method
first and then use the set_verbose and set_level method to configure
the initial log level and the initial log verbosity. However, we
initialize the PySimLogger in all our programs the same way and we
end up with the same boilerplate code every time. Let's add a keyword
parameter to the setup method where we can pass our opts.verbose (bool)
parameter so that the setup method can do the work for the main program.

In case the caller wants a different default configuration he still can
call set_verbose and set_level methods as needed.

Change-Id: I4b8ef1e203186878910c9614a1d900d5759236a8
pmaier@sysmocom.de at

#27335 (Mar 10, 2026, 2:29:51 PM)

pySim-prog/pySim-read: add pySimLogger and verbose cmdline argument

pySim-prog and pySim-read do not integrate the pySimLogger yet. As we
may add more debug output that should not be visible on normal use, we
should ensure that the pySimLogger is correctly set up.

Change-Id: Ia2fa535fd9ce4ffa301c3f5d6f98c1f7a4716c74
pmaier@sysmocom.de at

#27334 (Mar 10, 2026, 2:29:48 PM)

pySim-shell/cosmetic: remove semicolon

Change-Id: I629bacd432491211b939fcd2bed554b44ef441bc
pmaier@sysmocom.de at

#27333 (Mar 10, 2026, 2:20:15 PM)

cdma_ruim: fix copy-pasted desc for EF.AD

Change-Id: I2338f35c21978dd6b8916c0abd57b94f5e087655
Vadim Yanitskiy at

#27332 (Mar 10, 2026, 2:20:12 PM)

global_platform: install_cap_parser: argument groups cannot be nested

pySim-shell currently does not work on systems with Python 3.14+:

  File ".../pysim/pySim/global_platform/__init__.py", line 868, in AddlShellCommands
    install_cap_parser_inst_prm_g_grp = install_cap_parser_inst_prm_g.add_argument_group()
  File "/usr/lib/python3.14/argparse.py", line 1794, in add_argument_group
    raise ValueError('argument groups cannot be nested')
  ValueError('argument groups cannot be nested')

The problem is that install_cap_parser creates a nested group inside
of mutually exclusive group.  argparse never supported group nesting
properly, so it has been deprecated since Python 3.11, and eventually
got removed in Python 3.14.

Remove group nesting, adjust the usage string, and implement the
mutual exclusiveness/inclusiveness manually in do_install_cap().

Change-Id: Idddf72d5a745345e134b23f2f01e0257d0667579
Vadim Yanitskiy at

#27331 (Mar 10, 2026, 1:36:14 PM)

sane embedded builds without host talloc

So far host talloc was always required.
This fixes this up to only build a subset of stuff
that actually works for embedded targets while
using the pseudotalloc header file, and the actual
firmware can supply its own talloc, without
involving some random build system supplied talloc
headers.

Unfortunately static symbols can't really be weak,
so just going for always-on weak pseudotalloc does
not work.

Change-Id: Ibb309a01ac6cad827b33ac18be408be1ac2cf7e0
ewild at

#27330 (Mar 10, 2026, 1:34:17 PM)

ccid: properly emit wait time ext messages

The CCID message that tells the host that the card
asked for a wait time extension was missing.

This is a bit weird, because it breaks the 1:1
relationship between messages and responses that
usually exists, nor does it consume a bSeq,
so we just count and emit WT msgs as appropriate.

Closes: OS#6458
Change-Id: Ib69483d453a0e5ebb1bc1885a8f78790a0f10d70
ewild at

#27329 (Mar 10, 2026, 1:22:13 PM)

firmware: enable watchdog timer

2s is plenty, and while not perfect it should at
least ensure that hangs that require manual
intervention happen rarely if at all.

At least from a custimer POV having resets in case
something breaks is better than ending up with non
working devices that are stuck.

Change-Id: I1ef1fc70d33492efe0171a7879c1a23f16957195
ewild at

#27328 (Mar 10, 2026, 1:22:04 PM)

ccid: properly emit wait time ext messages

The CCID message that tells the host that the card
asked for a wait time extension was missing.

This is a bit weird, because it breaks the 1:1
relationship between messages and responses that
usually exists, nor does it consume a bSeq,
so we just count and emit WT msgs as appropriate.

Closes: OS#6458
Change-Id: Ib69483d453a0e5ebb1bc1885a8f78790a0f10d70
ewild at

#27327 (Mar 10, 2026, 11:40:14 AM)

pySim/transport: fix GET RESPONSE behaviour

The current behavior we implement in the method __send_apdu_T0 is
incomplete. Some details discussed in ETSI TS 102 221,
section 7.3.1.1.4, clause 4 seem to be not fully implemented. We
may also end up sending a GET RESPONSE in other APDU cases than
case 4 (the only case that uses the GET RESPONSE command).

Related: OS#6970
Change-Id: I26f0566af0cdd61dcc97f5f502479dc76adc37cc
pmaier@sysmocom.de at

#27326 (Mar 10, 2026, 11:40:09 AM)

contrib/csv-to_pgsl: explicitly set log level to INFO in non verbose mode

The current log level for PySimLogger currently is DEBUG. (The default
for verbose is False). Since those defaults may change over time, we
should conciously set what we want in verbose and non verbose mode, like
we already do in pySim-shell.

Change-Id: I4b8ef1e203186878910c9614a1d900d5759236a8
pmaier@sysmocom.de at

#27325 (Mar 10, 2026, 11:40:06 AM)

pySim-prog/pySim-read: add pySimLogger and verbose cmdline argument

pySim-prog and pySim-read do not integrate the pySimLogger yet. As we
may add more debug output that should not be visible on normal use, we
should ensure that the pySimLogger is correctly set up.

Change-Id: Ia2fa535fd9ce4ffa301c3f5d6f98c1f7a4716c74
pmaier@sysmocom.de at

#27324 (Mar 10, 2026, 11:04:11 AM)

pySim/transport: fix GET RESPONSE behaviour

The current behavior we implement in the method __send_apdu_T0 is
incomplete. Some details discussed in ETSI TS 102 221,
section 7.3.1.1.4, clause 4 seem to be not fully implemented. We
may also end up sending a GET RESPONSE in other APDU cases than
case 4 (the only case that uses the GET RESPONSE command).

Related: OS#6970
Change-Id: I26f0566af0cdd61dcc97f5f502479dc76adc37cc
pmaier@sysmocom.de at

#27323 (Mar 10, 2026, 10:49:43 AM)

Errata 2.6.10: enable watchdog on boot

Previous the code was enabling the watchdog window on boot,
but not the watchdog as the errata specified.
It seems WDT EN and WDT WEN got accidental swapped.

Use the hal defines which also describes the function
of the bits.

Change-Id: I581037724d19fb5abd0c5067f16a5769f9e264a7
lynxis at

#27322 (Mar 10, 2026, 10:45:09 AM)

Errata 2.6.10: enable watchdog on boot

Previous the code was enabling the watchdog window on boot,
but not the watchdog as the errata specified.
It seems WDT EN and WDT WEN got accidental swapped.

Use the hal defines which also describes the function
of the bits.

Change-Id: I581037724d19fb5abd0c5067f16a5769f9e264a7
lynxis at

#27321 (Mar 10, 2026, 10:45:06 AM)

Improve comments on errata 2.6.10

Errata 2.6.10 affects Rev A, D, F: The cache lines
of AHB0 and AHB1 might not reset properly on Power up
resulting in courrupted data in rare cases.

The errata recommends fixing this by:
- for AHB0: start WDT by NVMEM and disable by ARM core.
- for AHB1: disable and re-enable cache line

Change-Id: I3c35f590a4e43d778e70f2f377e0d470c3a652b2
lynxis at

#27320 (Mar 10, 2026, 10:34:13 AM)

ccid: Fix CCID RDR_to_PC_Parameters (missing bProtocolNum)

Our RDR_to_PC_Parameters message was broken, as it was missing
the bProtocolNum value after the header.  Let's fix that.

Change-Id: I67d5cb876d20b29f4759d5b194606f34b8b966c4
laforge at

#27319 (Mar 10, 2026, 10:34:09 AM)

ccid: Fix [unused] RDR_to_PC_Hardware_Error struct definition

Our definition of the message was wrong; it is an interrupt endpoint
message without the full header of the bulk-in endpoint. Luckily the
definition was not used in the code base, so this is not fixing any
problem visible on the protocol level.

Change-Id: Ieb756c37402c4ebea32cc3cd23ba3842f4c0df3e
laforge at

#27318 (Mar 10, 2026, 12:17:23 AM)

Improve comments on errata 2.6.10

Errata 2.6.10 affects Rev A, D, F: The cache lines
of AHB0 and AHB1 might not reset properly on Power up
resulting in courrupted data in rare cases.

The errata recommends fixing this by:
- for AHB0: start WDT by NVMEM and disable by ARM core.
- for AHB1: disable and re-enable cache line

Change-Id: I3c35f590a4e43d778e70f2f377e0d470c3a652b2
lynxis at

#27317 (Mar 10, 2026, 12:17:20 AM)

Errata 2.6.10: enable watchdog on boot

Previous the code was enabling the watchdog window on boot,
but not the watchdog as the errata specified.
It seems WDT EN and WDT WEN got accidental swapped.

Use the hal defines which also describes the function
of the bits.

Change-Id: I581037724d19fb5abd0c5067f16a5769f9e264a7
lynxis at

#27316 (Mar 9, 2026, 7:32:41 PM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27315 (Mar 9, 2026, 7:21:43 PM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27314 (Mar 9, 2026, 7:21:30 PM)

radio: improve API documentation in RadioDevice

Change-Id: I7b41c549d743ad180a1ddcd8c0313e1003860070
dtv.comp at

#27313 (Mar 9, 2026, 5:46:28 PM)

build: install common/GSM/transceiver libraries for emscripten and add pkg-config files

Expose previously internal libs (libcommon, libGSM, libtransceiver_common)
when building with emscripten, install headers and generate .pc files.
Keep them noinst for native builds.

Change-Id: I2495c5b5c79f2fe74bef83902058e1d2207c1f3c
dtv.comp at

#27312 (Mar 9, 2026, 5:46:24 PM)

transceiver: add optional Laurent burst LUT modulation (int16)

Introduce an optional Burst LUT optimization for Laurent-based burst
modulation, enabled via --with-burst-lut.

- Add precomputed Laurent LUT tables (float and int16 I/Q variants)
- Generate LUT at initialization (prepareBurstLUT)
- Use LUT-based modulation for sps=4 when enabled
- Keep original modulateBurstLaurent() as fallback
- Add configure.ac option and USE_BURST_LUT define

This reduces runtime computation by replacing per-burst Laurent
processing with memcpy-based LUT lookups.

Change-Id: I1715c2d33dc55fe1c7be5c6e7259d378ea5e80b2
dtv.comp at

#27311 (Mar 9, 2026, 5:39:00 PM)

radio: improve API documentation in RadioDevice

Change-Id: I7b41c549d743ad180a1ddcd8c0313e1003860070
dtv.comp at

#27310 (Mar 9, 2026, 5:38:55 PM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27309 (Mar 9, 2026, 3:59:23 PM)

pySim/transport: fix GET RESPONSE behaviour

The current behavior we implement in the method __send_apdu_T0 is
incomplete. Some details discussed in ETSI TS 102 221,
section 7.3.1.1.4, clause 4 seem to be not fully implemented. We
may also end up sending a GET RESPONSE in other APDU cases than
case 4 (the only case that uses the GET RESPONSE command).

Related: OS#6970
Change-Id: I26f0566af0cdd61dcc97f5f502479dc76adc37cc
pmaier@sysmocom.de at

#27308 (Mar 9, 2026, 3:23:13 PM)

pySim/transport: fix GET RESPONSE behaviour

The current behavior we implement in the method __send_apdu_T0 is
incomplete. Some details discussed in ETSI TS 102 221,
section 7.3.1.1.4, clause 4 seem to be not fully implemented. We
may also end up sending a GET RESPONSE in other APDU cases than
case 4 (the only case that uses the GET RESPONSE command).

Related: OS#6970
Change-Id: I26f0566af0cdd61dcc97f5f502479dc76adc37cc
pmaier@sysmocom.de at

#27307 (Mar 9, 2026, 11:44:30 AM)

bankd: Avoid osmocom logging mutex deadlock in signal handling

The main thread communicates slotmap add + delete via POSIX signals
to the worker threads.  As those signals interrupt the normal
processing of the worker thread, they might get delivered while the
thread is already logging something, causing a deadlock.  This has
been observed in the real world in the following stack trace (where it's
actually two nested signals):

As a hot-fix, let's avoid logging from the handle_sig_map{del,add}()
functions at all, making them safe against a deadlock around this mutex.

We should decide how to proceed in general with potentially some
architectural changes later on; any such changes are not suitable as a
hot fix due to their potential of introducing other regressions.

Change-Id: I5ea32886dfaf624b4dc5ad7924941c7b904c1d36
Related: SYS#7930
laforge at

#27306 (Mar 6, 2026, 9:57:41 PM)

s1ap_utils_test: fix: expected value goes first

Change-Id: Ib7c6478b95a78c9797e86180a89c098e75b615e0
Vadim Yanitskiy at

#27305 (Mar 6, 2026, 9:57:38 PM)

s1ap_utils: add API for building S1 SETUP FAILURE PDU

This API will be used in a follow-up patch adding the MME pooling.
Take a chance to add a parsing test for the new PDU blob.

Change-Id: I5a4e060e0a2ebdfbcfafac42f9de2e49ac3583b8
Related: SYS#7052
Vadim Yanitskiy at

#27304 (Mar 6, 2026, 9:57:35 PM)

[REST] Add MmeList, MmeAdd, MmeInfo, MmeDelete

Change-Id: Iad249aed99face9e35fd19e0596cf2364ade4c77
Related: SYS#7052
Vadim Yanitskiy at

#27303 (Mar 6, 2026, 9:57:32 PM)

enb_proxy: add initial MME pooling support

Rework the CONNECTING state to dynamically select an MME from the pool
via mme_registry:mme_select/1, passing the eNB's Tracking Area Codes
(from the ?'id-SupportedTAs' IE of the S1 SETUP REQUEST) and a list of
already-tried MMEs, so successive attempts pick a different candidate.

On connection failure (SCTP establishment timeout or error), or when the
selected MME rejects the S1 SETUP REQUEST or fails to respond in time,
the FSM re-enters the CONNECTING state rather than terminating.  This
triggers another mme_select/1 call with the failed MME added to the
tried_mmes list.  S1 SETUP FAILURE PDUs from the MME are intentionally
not forwarded to the eNB, so the retry is fully transparent.

Once mme_select/1 exhausts all candidates it returns 'error'; at that
point the FSM builds and sends an S1 SETUP FAILURE PDU to the eNB and
terminates.

Other changes:
* add close_sock/1, close_conn/1 helpers; simplify terminate/3
* add ?S1GW_CTR_ENB_PROXY_MME_SELECT_ERROR counter

Change-Id: I83dc4a78c78a7b87e87f5ca9a941a168d6c1dc36
Related: SYS#7052
Vadim Yanitskiy at

#27302 (Mar 6, 2026, 9:54:34 PM)

mme_registry: the MME registry (pool) implementation

Change-Id: Id5480222439bf93eca2e994b291c619dff823b01
Related: SYS#7052
Vadim Yanitskiy at

#27301 (Mar 6, 2026, 9:35:37 PM)

enb_registry: rework handling of eNB property updates

The idea of an enb_event/0 containing the current MME connection
state and the associated information (Global-eNB-ID, eNB/MME conn
info) looked promising initially, however turned out to be
impractical in light of ongoing MME pooling related changes.

* remove type enb_state/0
* rename type enb_event/0 -> enb_prop/0
* rename function enb_event/2 -> enb_update/2 (now private)
* enb_prop/0: separate the state from other properties
* enb_update/2: accept a list of enb_prop/0 - enb_proplist/0
* add typed notify_*() helpers that group related property updates,
  ensuring consistency and serving as the sole public call sites
* notify_mme_connecting(): explicitly clears mme_conn_info
* openapi: EnbItem.state reflects the actual enb_proxy FSM state

Change-Id: Ib5c5dedce729151cd7350390987fdd008b254ef4
Related: SYS#7052
Vadim Yanitskiy at

#27300 (Mar 6, 2026, 9:35:33 PM)

enb_registry: rework handling of eNB property updates

The idea of an enb_event/0 containing the current MME connection
state and the associated information (Global-eNB-ID, eNB/MME conn
info) looked promising initially, however turned out to be
impractical in light of ongoing MME pooling related changes.

* remove type enb_state/0
* rename type enb_event/0 -> enb_prop/0
* rename function enb_event/2 -> enb_update/2 (now private)
* enb_prop/0: separate the state from other properties
* enb_update/2: accept a list of enb_prop/0 - enb_proplist/0
* add typed notify_*() helpers that group related property updates,
  ensuring consistency and serving as the sole public call sites
* notify_mme_connecting(): explicitly clears mme_conn_info
* openapi: EnbItem.state reflects the actual enb_proxy FSM state

Change-Id: Ib5c5dedce729151cd7350390987fdd008b254ef4
Related: SYS#7052
Vadim Yanitskiy at

#27299 (Mar 6, 2026, 9:35:29 PM)

enb_registry: call enb_metrics_register/1 from a proper place

Change-Id: I38237463aa9c968f89bf4f195407a18cba7e73c9
Vadim Yanitskiy at

#27298 (Mar 6, 2026, 9:35:25 PM)

pfcp_peer: replace deprecated erlang:timestamp/0 with os:system_time/1

erlang:timestamp/0 is deprecated since OTP 18.  os:system_time(second)
is the modern replacement and yields the result directly in seconds,
removing the need to reassemble the {MegaSec, Sec, _} tuple.

Change-Id: I4ad886a2222f0cee8a668b42efe8bfac800a55ac
Vadim Yanitskiy at

#27297 (Mar 6, 2026, 9:35:19 PM)

s1ap_proxy: fix discarded result of handle_ies/3 in HO REQ ACK handler

The call processing the optional E-RABFailedToSetupListHOReqAck IE did
not pattern-match its return value, causing any errors returned by
handle_ies/3 to be silently swallowed.  Bind the result to {_, S2}
to make the intent explicit.

Change-Id: I1c8feeb63fe23876ae443784980e9dc22a450c54
Vadim Yanitskiy at

#27296 (Mar 6, 2026, 9:35:10 PM)

erab_fsm: fix comment inaccuracies and a typo

Two comments copy-pasted from session_establish were left saying
"ESTABLISH Req" in session_modify and session_delete handlers where
"MODIFY Req" and "DELETE Req" are correct respectively.
Also fix typo "unieue" -> "unique" in init/1.

Change-Id: If84638142988767363aa080012b44082dee39f90
Vadim Yanitskiy at

#27295 (Mar 6, 2026, 9:35:06 PM)

pfcp_peer: wrap seq_nr at 24-bit boundary

PFCP sequence numbers are 24-bit (3GPP TS 29.244 section 7.2.2.2), but
the counter was incremented without wrapping, eventually exceeding the
type spec after 16,777,215 requests.  Introduce PFCP_SEQ_NR_MAX and use
it in the type spec and in the increment expression.

Change-Id: Ie269894add9a82c36698320379df3aca3f7ffea8
Vadim Yanitskiy at

#27294 (Mar 6, 2026, 9:34:59 PM)

enb_registry: fix pattern match in handle_info 'DOWN' handler

PIDs maps pid() => enb_handle() (an integer), so maps:find/2 returns
{ok, SomeHandle}.  The old pattern {ok, Pid} tried to match an integer
against the already-bound pid() variable, which never succeeds.

This handler is only called on abnormal termination (process crash),
so the broken match caused the registry entry to never be cleaned up
in that case.  Fix by using a fresh {ok, Handle} binding and removing
the now-redundant follow-up maps:get/2 call.

Change-Id: I4cb044e8071c4ae2fc48c507f8733af6c617ec46
Vadim Yanitskiy at

#27293 (Mar 6, 2026, 9:34:24 PM)

enb_registry: fix duplicate registration check in enb_register/0

next_handle was bound in the function head and reused in the case
pattern {ok, Handle}, turning what looks like a binding into an
equality test against next_handle.  The duplicate check therefore
only fired if the previously assigned handle happened to equal the
current next_handle counter, which is essentially never true.

Fix by removing next_handle from the function head pattern and reading
it with S#state.next_handle inside the error branch, so that Handle in
{ok, Handle} is always a fresh binding that matches any existing handle.

Change-Id: Ia64f3e2e79bea055e5c37df9bce91a4bcbf7184c
Vadim Yanitskiy at

#27292 (Mar 6, 2026, 9:33:20 PM)

pfcp_peer: replace watchdog process with a timer

The watchdog process is spawned bare (no link/monitor), so if it
crashes its failure goes unnoticed, and if pfcp_peer restarts the
orphaned watchdog may fire a stale cast at the new process.

The watchdog process exists solely to send a delayed message to
pfcp_peer on timeout, and to be cancelled (by receiving
heartbeat_response) when the response arrives.  That's exactly what
erlang:start_timer/3 does natively - no separate process needed.

Change-Id: I8d71ad8300feefb0aecbf690a825a2b4e9f1102c
Vadim Yanitskiy at

#27291 (Mar 6, 2026, 9:28:26 PM)

enb_registry: fix addr/port filter logic (use andalso)

In Erlang a function body returns only its last expression.  The comma
between the two enb_filter_by_sub_field/2 calls caused the result of
the addr check to be silently discarded, so the filter only tested the
port.  Replace the comma with andalso to require both to match.

Change-Id: I8061636cd1077a4f3a9e9d37a31224f5e373becb
Vadim Yanitskiy at

#27290 (Mar 6, 2026, 7:40:29 PM)

nokia_site: Change the LAPD N200 counter for RSL

This commit raises the LAPD RSL N200 (retransmission) counter for
Nokia RSL links. The reason is that the readiness of the TRX is not
signalled (OML) nor can be queried from the BTS in any way, and on
larger macro setups the TRX reset takes ~15 seconds, thus the RSL
bootstrap times out before the TRX becomes ready.

This issue presents itself with UltraSite types, does not affect
InSite or MetroSite (the later two are "integrated TRX" units).
More modern macro setups like the Flexi or Multiradio are likely
affected.

Runtime tested with InSite and UltraSite (multi-TRX).

Change-Id: Ie4bb804ea636eba2182586db13a625c5933eff31
metro4 at

#27289 (Mar 6, 2026, 7:31:17 PM)

nokia_site: Change the LAPD N200 counter for RSL

This commit raises the LAPD RSL N200 (retransmission) counter for
Nokia RSL links. The reason is that the readiness of the TRX is not
signalled (OML) nor can be queried from the BTS in any way, and on
larger macro setups the TRX reset takes ~15 seconds, thus the RSL
bootstrap times out before the TRX becomes ready.

This issue presents itself with UltraSite types, does not affect
InSite or MetroSite (the later two are "integrated TRX" units).
More modern macro setups like the Flexi or Multiradio are likely
affected.

Runtime tested with InSite and UltraSite (multi-TRX).

Change-Id: Ie4bb804ea636eba2182586db13a625c5933eff31
metro4 at

#27288 (Mar 6, 2026, 3:40:31 PM)

nokia_site: Change the LAPD N200 counter for RSL

This commit raises the LAPD RSL N200 (retransmission) counter for
Nokia RSL links. The reason is that the readiness of the TRX is not
signalled (OML) nor can be queried from the BTS in any way, and on
larger macro setups the TRX reset takes ~15 seconds, thus the RSL
bootstrap times out before the TRX becomes ready.

This issue presents itself with UltraSite types, does not affect
InSite or MetroSite (the later two are "integrated TRX" units).

Runtime tested with InSite and UltraSite (multi-TRX).

Change-Id: Ie4bb804ea636eba2182586db13a625c5933eff31
metro4 at

#27287 (Mar 6, 2026, 3:40:26 PM)

nokia_site: Add new BTS types to the list

This commit adds Flexi EDGE, Flexi Multiradio and Flexi Multiradio 10
BTS types to the supported device list.

Keep in mind that this was not yet tested as we lack actual HW,
but the OML logic should be the same.

Change-Id: Ie3f1a3c3d7d72a49401d66625516f92cc7384949
metro4 at

#27286 (Mar 6, 2026, 2:52:22 PM)

global_platform/scp: fix dek_encrypt/dek_decrypt for SCP02

The methods dek_encrypt/dek_decrypt use the wrong algorithm and the
wrong key material. The algorithm should be 3DES rather then single
DES and the key must be the DEK session key instead of the static
DEK key from which the DEK session key is derived.

Related: SYS#7902
Change-Id: I3d0cc7378680b346fa39152c8b7074446d2c869d
pmaier@sysmocom.de at

#27285 (Mar 6, 2026, 1:20:10 PM)

Fix lint errors: test for membership should be `not in`

src/osmocom/tlv.py:477:16: E713 [*] Test for membership should be `not in`
    |
475 |         key-value pair, where the key is the snake-reformatted type name of 'self'"""
476 |         expected_key_name = camel_to_snake(type(self).__name__)
477 |         if not expected_key_name in decoded:
    |                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ E713
478 |             raise ValueError("Dict %s doesn't contain expected key %s" % (decoded, expected_key_name))
479 |         self.from_val_dict(decoded[expected_key_name])
    |
    = help: Convert to `not in`

Change-Id: I2ca3135f1ce38dcc06dc95c38f4b6258a60121cd
Oliver Smith at

#27284 (Mar 6, 2026, 1:19:22 PM)

Fix lint errors: avoid equality comparisons to `False`

src/osmocom/utils.py:150:8: E712 Avoid equality comparisons to `False`; use `if not signed:` for false checks
    |
148 |     """
149 |
150 |     if signed == False and number < 0:
    |        ^^^^^^^^^^^^^^^ E712
151 |         raise ValueError("expecting a positive number")
    |
    = help: Replace with `not signed`

Change-Id: I2ebb33c498b4a7e6229980462aa51b579fa4f782
Oliver Smith at

#27283 (Mar 6, 2026, 12:53:30 PM)

{hlr,hss}/pyhss/config: remove unused options

PyHSS had several unused config options. They have been removed
upstream, remove them from the osmo-ttcn3-hacks configs as well.

Related: https://github.com/nickvsnetworking/pyhss/pull/284
Change-Id: I87cf01e00fe0a3b32be9eaa4cf4c1ddf02cddc0b
Oliver Smith at

#27282 (Mar 6, 2026, 12:38:10 PM)

hlr: pyhss: run the pyhss_hss service

Database preparations used to be done in PyHSS by all services if they
noticed that this was needed. The time between checking and creating the
tables caused a race condition where two services attempting to create
tables at the same time will result at one of them failing, we have seen
this in our ttcn3-hlr-test-pyhss jobs sometimes:

  [Database] [DEBUG] Table apn already exists
  [Database] [DEBUG] Table auc already exists
  [Database] [DEBUG] Table subscriber already exists
  …
  [testenv][pyhss] pyhss_gsup: setup script failed

I have fixed this upstream by letting only the main service (pyhss_hss)
prepare the database:
https://github.com/nickvsnetworking/pyhss/commit/8b8a2202c345fbb7262c9d07d03003cd2fdb819f

This means that we now need to run the pyhss_hss service in the HLR
tests, so pyhss_gsup doesn't fail with:

  [Database] [INFO] Waiting for the main service to prepare the database
  ERROR: 127.0.0.1:4222 did not become available within 5s!
  [testenv][pyhss] pyhss_gsup: setup script failed

Change-Id: I4fe689c8d8617432175ba403b45021c0f646970b
Oliver Smith at

#27281 (Mar 6, 2026, 10:57:40 AM)

repo-install-test: ignore charon-systemd

This package from strongswan-epdg causes the SSH connection to QEMU to
break when installed in debian 13. Don't install it. Use the wildcard,
because there is also a debug symbols package that pulls in
charon-systemd.

Change-Id: Ic641d5361c51df147a8cef5d49eb1e0f07b72e87
Oliver Smith at

#27280 (Mar 6, 2026, 10:57:35 AM)

repo-install-test: run for debian 13 too

This passes for latest, and should pass for nightly once this patch is
merged: https://gerrit.osmocom.org/c/osmo-sgsn/+/42277

Change-Id: I1db9de8c740d5167e4813ece36f422b27aed5111
Oliver Smith at

#27279 (Mar 6, 2026, 10:57:30 AM)

repo-install-test: don't use deprecated apt-key

apt-key has been removed in debian 13, use "[signed-by=…]" instead.

Change-Id: I7b8b9336b16cceb7ece317c59de2f55ed404392e
Oliver Smith at

#27278 (Mar 6, 2026, 10:57:25 AM)

repo-install-test: fix test_conflict for debian 13

Two changes are necessary to make this test work with debian 13:

* Installing libosmocore from osmocom-latest, then switching to
  osmocom-nightly and attempting to install another package is not
  enough anymore to trigger a conflict. apt is now able to resolve this
  by uninstalling the osmocom-latest package and upgrading libosmocore
  to the nightly version. Force the conflict by explicitly marking
  osmocom-latest (osmocom-$FEED) as installed and for hold.

* The apt conflict message has been reworked, so the string to look for
  needs to be adjusted.

Change-Id: Ibdcd583e48b97ced11ad4939974dccea3e139480
Oliver Smith at

#27277 (Mar 6, 2026, 10:57:21 AM)

repo-install-test: ignore pyhss

PyHSS listens on the same port as OsmoHLR, which causes the test to fail
with debian 13 because OsmoHLR can't start up properly. PyHSS wasn't
built for earlier debian versions in the Osmocom binary repositories.

Change-Id: I796e85a212dff94fbf9b8ef563eba47418c221cc
Oliver Smith at

#27276 (Mar 6, 2026, 10:57:15 AM)

repo-install-test: ignore sdcc-dbgsym

Fix for this error with debian 13:

  The following packages have unmet dependencies:
   sdcc-dbgsym : Depends: sdcc (= 4.2.0~osmocom3.113.9edd) but 4.5.0+dfsg-1 is to be installed
  E: Unable to correct problems, you have held broken packages.
  E: The following information from --solver 3.0 may provide additional context:
     Unable to satisfy dependencies. Reached two conflicting decisions:
     1. sdcc:amd64=4.2.0~osmocom3.113.9edd is not selected for install
     2. sdcc:amd64=4.2.0~osmocom3.113.9edd is selected for install because:
        1. sdcc-dbgsym:amd64=4.2.0~osmocom3.113.9edd is selected for install
        2. sdcc-dbgsym:amd64 Depends sdcc (= 4.2.0~osmocom3.113.9edd)

Change-Id: Ibb12118853f354d177cb94df63b60dd3bd9dfcb7
Oliver Smith at

#27275 (Mar 6, 2026, 10:05:56 AM)

contrib/smpp-ota-tool: use '-' instead of '_' in command line args

Some commandline arguments have an underscore in their name. Let's
replace those with dashes.

Change-Id: Icbe9d753d59263997e9ca34d46ed0daca36ca16c
Related: SYS#6868
pmaier@sysmocom.de at

#27274 (Mar 6, 2026, 10:05:52 AM)

contrib/smpp-ota-tool: define commandline arguments in global scope

The commandline arguments are currently defined under __main__ in a
private scope. From there they are not reachable to the sphinx
argparse module. We have to define the arguments globally at the
top. (like in the other applications)

Related: SYS#7881
Change-Id: I2d9782e3f5b1cac78c22d206fdcac4118c7d5e7c
pmaier@sysmocom.de at

#27273 (Mar 6, 2026, 10:05:49 AM)

docs/smpp-ota-tool: Add documentation/tutorial

We already have documentation that explains how to run pySim-smpp2sim.
With smpp-ota-tool we now have a counterpart for pySim-smpp2sim, so
let's add documentation for this tool as well.

Related: SYS#7881
Change-Id: If0d18a263f5a6dc035b90f5c5c6a942d46bbba49
pmaier@sysmocom.de at

#27272 (Mar 6, 2026, 10:05:47 AM)

tests/pySim-smpp2sim_test/card_sanitizer: update card backup with new test keyset

In our test setup we run the card_sanitizer.py script regualary to ensure that
we have consistent start conditions when running our tests. In case a testcase
crashes for some reason and leaves messed up files on a test card. The
card_sanitizer.py script will ensure that any problem like that is cleaned up
over night.

For the testcases we are about to add in the patch following this one, we need
to provision a new test keyset to one of our test cards. This has been already
done manually. However since the card_sanitizer still has the old keys in its
backup we will have to update that as well.

Change-Id: I5aa8a413b19b3e43a79d03e904daab50b4b1e767
Related: OS#6868
pmaier@sysmocom.de at

#27271 (Mar 6, 2026, 10:05:42 AM)

contrib/smpp-ota-tool: fix description string (copy+paste error)

Change-Id: I559844bfa1ac372370ef9d148f2f8a6bf4ab4ef5
Related: SYS#6868
pmaier@sysmocom.de at

#27270 (Mar 6, 2026, 10:05:38 AM)

tests/pySim-smpp2sim_test: add testcases for AES128 and AES256

Extend the existing test script so that it can handle multiple
testcases. Also add support for switching eUICC profiles.
Finally, add a testcases to test OTA-SMS (RFM) with AES128 and
AES256 encryption.

Change-Id: I1f10504f3a29a8c74a17991632d932819fecfa5a
Related: OS#6868
pmaier@sysmocom.de at

#27269 (Mar 6, 2026, 9:31:17 AM)

dfu-download: flash the first block in manifest phase

To prevent half flashed applications, erase the first page
when dfu downloading starts and save the first block for later.
In manifest stage, flash the first block.
If the first 4 byte are 0xffffffff, the board won't boot
into application and go into the dfu bootloader.

Change-Id: I894f3ee71587ccb287e92d7025039954991c631f
lynxis at

#27268 (Mar 6, 2026, 9:20:00 AM)

debian/changelog: bump to 1.14.0

Fix that debian/changelog is still on 1.12.0 on current master while the
latest stable version is on 1.13.x. This is confusing, and it also
results in unexpected behavior on debian 13: After enabling the Osmocom
nightly repository and asking apt to install osmo-sgsn or osmo-gtphub,
it will pick the 1.13.x versions from the debian repository instead of
the versions from the Osmocom nightly repository.

Related: OS#6968
Change-Id: Id8763bf96141fcb38f550c7885a1c9fd02cec198
Oliver Smith at

#27267 (Mar 6, 2026, 9:18:12 AM)

dfu-download: flash the first block in manifest phase

To prevent half flashed applications, erase the first page
when dfu downloading starts and save the first block for later.
In manifest stage, flash the first block.
If the first 4 byte are 0xffffffff, the board won't boot
into application and go into the dfu bootloader.

Change-Id: I894f3ee71587ccb287e92d7025039954991c631f
lynxis at

#27266 (Mar 5, 2026, 10:18:50 PM)

Replace snprintf() to free 4 kb

Change-Id: Ide644648bda86d4ae77a6713d1e140a4b78ba835
lynxis at

#27265 (Mar 5, 2026, 10:18:46 PM)

dfu-download: flash the first block in manifest phase

To prevent half flashed applications, erase the first page
when dfu downloading starts and save the first block for later.
In manifest stage, flash the first block.
If the first 4 byte are 0xffffffff, the board won't boot
into application and go into the dfu bootloader.

Change-Id: I894f3ee71587ccb287e92d7025039954991c631f
lynxis at

#27264 (Mar 5, 2026, 10:15:21 PM)

Makefile: on clean: remove dfu & flash .o & .d files

Change-Id: I9705f15c41ea0df8b8486b6326264db36f797dd8
lynxis at

#27263 (Mar 5, 2026, 10:14:36 PM)

dfu-download: flash the first block in manifest phase

To prevent half flashed applications, erase the first page
when dfu downloading starts and save the first block for later.
In manifest stage, flash the first block.
If the first 4 byte are 0xffffffff, the board won't boot
into application and go into the dfu bootloader.

Change-Id: I894f3ee71587ccb287e92d7025039954991c631f
lynxis at

#27262 (Mar 5, 2026, 10:14:32 PM)

Replace snprintf() to free 4 kb

Change-Id: Ide644648bda86d4ae77a6713d1e140a4b78ba835
lynxis at

#27261 (Mar 5, 2026, 3:02:37 PM)

esim/http_json_api: allow URL rewriting

The URL used when HTTP requests are performed is defined statically
with the url_prefix passed to the constructor of JsonHttpApiClient
together with the path property in JsonHttpApiFunction.

For applications that require dynamic URLs there is no way to rewrite
the URL. Let's add a mechanism that allows API users to apply custom
URL reqriting rules by adding a reqrite_url method to
JsonHttpApiFunction. API users may then overload this method with a
custom implementation as needed.

Related: SYS#7918
Change-Id: Id2713a867079cc140517fe312189e5e2162608a5
pmaier@sysmocom.de at

#27260 (Mar 5, 2026, 1:36:59 PM)

nokia_site: Add new BTS types to the list

This commit adds Flexi EDGE, Flexi Multiradio and Flexi Multiradio 10
BTS types to the supported device list.

Keep in mind that this was not yet tested as we lack actual HW,
but the OML logic should be the same.

Change-Id: Ia0dbbf148394d8205dc9219b41cfba3cf62bdeaa
metro4 at

#27259 (Mar 5, 2026, 11:55:13 AM)

WIP: dfu-download: flash the first block into manifest phase

To prevent half flashed applications, erase the first page
when dfu downloading starts and save the first block for later.
In manifest stage, flash the first block.
If the first 4 byte are 0xffffffff, the board won't boot
into application and go into the dfu bootloader.

TODO: Needs testing.

Change-Id: I894f3ee71587ccb287e92d7025039954991c631f
lynxis at

#27258 (Mar 4, 2026, 1:30:14 PM)

Print load before and after each test

Make it easier to figure out why tests are failing sporadically by
printing the load before and after each test. For example:

  ------ MGCP_Test.TC_crcx_sdp ------
  (14:24:42) load average: 0,41, 0,44, 0,54

Change-Id: If7d82c3c8105b3f3ca3470ba8f525ae8468dbeae
Oliver Smith at

#27257 (Mar 4, 2026, 12:01:03 PM)

ggsn: TC_pdp(4)6_clients_interact: Expect UEs can interact using global IPv6 address

The link-local IPv6 address is only meant to be used privately between
the UE and the GGSN, but the UEs should be in general able to reach each
other using their global IPv6 address (unless some operator policy
explicitly forbids it).

Since open5gs.git 6cc627c4855703a17c92352660078325c6ce63cc, open5gs-upfd supports
proper routing of IPv6 packets between UEs.

osmo-ggsn apparently doesn't implement that internal routing logic yet,
so these tests will start failing now, but it's actually legit to have
it not passing the test anymore.

Change-Id: I0267a9c3bb85736a2aeb4f7dd91f44dbce626958
Pau Espin Pedrol at

#27256 (Mar 3, 2026, 11:42:50 PM)

remove transitional name mapping

This reverts commit I974cb6c393a2ed2248a6240c2722d157e9235c33

Now, finally, all SdKey classes have a unified logical naming scheme.

Change-Id: Ic185af4a903c2211a5361d023af9e7c6fc57ae78
Neels Hofmeyr at

#27255 (Mar 3, 2026, 11:42:48 PM)

test_configurable_parameters.py: add tests for new parameters

For:
SmspTpScAddr
MilenageRotation
MilenageXoringConstants
TuakNrOfKeccak

Change-Id: Iecbea14fe31a9ee08d871dcde7f295d26d7bd001
Neels Hofmeyr at

#27254 (Mar 3, 2026, 11:42:46 PM)

personalization audit: optionally audit all (unknown) SD keys

By a flag, allow to audit also all Security Domain KVN that we have
*not* created ConfigurableParameter subclasses for.

For example, SCP80 has reserved kvn 0x01..0x0f, but we offer only
Scp80Kvn01, Scp80Kvn02, Scp80Kvn03. So we would not show kvn
0x03..0x0f in an audit.

This patch includes audits of all SD key kvn there may be in the UPP.
This will help to spot SD keys that may already be present in a UPP
template, with unexpected / unusual kvn.

Change-Id: Icaf6f7b589f117868633c0968a99f2f0252cf612
Neels Hofmeyr at

#27253 (Mar 3, 2026, 11:42:43 PM)

RandomHexDigitSource: rather return in string format, not bytes

Change-Id: I4e86289f6fb72cbd4cf0c90b8b49538cfab69a7f
Neels Hofmeyr at

#27252 (Mar 3, 2026, 11:42:40 PM)

saip: SdKey.__doc__: update SdKey listing

Change-Id: Ib5011b0c7d76b082231744cf09077628dc4e69b7
Neels Hofmeyr at

#27251 (Mar 3, 2026, 11:42:38 PM)

ConfigurableParameter: do not magically overwrite the 'name' attribute

Change-Id: I6f631444c6addeb7ccc5f6c55b9be3dc83409169
Neels Hofmeyr at

#27250 (Mar 3, 2026, 11:42:34 PM)

ConfigurableParameter: safer val length check

Change-Id: Ibe91722ed1477b00d20ef5e4e7abd9068ff2f3e4
Neels Hofmeyr at

#27249 (Mar 3, 2026, 11:42:31 PM)

add comment about not updating existing key_usage_qualifier

Change-Id: Ie23ae5fde17be6b37746784bf1601b4d0874397a
Neels Hofmeyr at

#27248 (Mar 3, 2026, 11:42:27 PM)

saip SmspTpScAddr.get_values_from_pes: allow empty values

Change-Id: Ibbdd08f96160579238b50699091826883f2e9f5a
Neels Hofmeyr at

#27247 (Mar 3, 2026, 11:42:25 PM)

transitional name mapping

To help existing applications transition to a common naming scheme for
the SdKey classes, offer this intermediate result, where the SdKey
classes' .name are still unchanged as before generating them.

Change-Id: I974cb6c393a2ed2248a6240c2722d157e9235c33
Neels Hofmeyr at

#27246 (Mar 3, 2026, 11:42:23 PM)

use random.SystemRandom as random nr source (/dev/urandom)

/dev/urandom is somewhat better than python's PRNG

Change-Id: I6de38c14ac6dd55bc84d53974192509c18d02bfa
Neels Hofmeyr at

#27245 (Mar 3, 2026, 11:42:19 PM)

param_source: allow plugging a random implementation (for testing)

Change-Id: Idce2b18af70c17844d6f09f7704efc869456ac39
Neels Hofmeyr at

#27244 (Mar 3, 2026, 11:42:17 PM)

personalization.ConfigurableParameter: fix BytesIO() input

Change-Id: I0ad160eef9015e76eef10baee7c6b606fe249123
Neels Hofmeyr at

#27243 (Mar 3, 2026, 11:42:13 PM)

generate sdkey classes from a list

Change-Id: Ic92ddea6e1fad8167ea75baf78ffc3eb419838c4
Neels Hofmeyr at

#27242 (Mar 3, 2026, 11:42:10 PM)

personalization: add int as input type for BinaryParameter

Change-Id: I31d8142cb0847a8b291f8dc614d57cb4734f0190
Neels Hofmeyr at

#27241 (Mar 3, 2026, 11:42:07 PM)

saip SmspTpScAddr: safeguard against decoding error

Reading the TS48 V6.0 eSIM_GTP_SAIP2.1A_NoBERTLV profile results in an
exception [1] in SmspTpScAddr. I have a caller that needs to skip
erratic values instead of raising.

The underlying issue, I presume, is that either the data needs
validation before decode_record_bin(), or decode_record_bin() needs
well-defined error handling.

So far I know only of this IndexError, so, as a workaround, catch that.

[1]
  File "/pysim/pySim/esim/saip/personalization.py", line 617, in get_values_from_pes
    ef_smsp_dec = ef_smsp.decode_record_bin(f_smsp.body, 1)
  File "/pysim/pySim/filesystem.py", line 1047, in decode_record_bin
    return parse_construct(self._construct, raw_bin_data)
  File "/application/venv/lib/python3.13/site-packages/osmocom/construct.py", line 550, in parse_construct
    parsed = c.parse(raw_bin_data, total_len=length, **context)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 404, in parse
    return self.parse_stream(io.BytesIO(data), **contextkw)
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 416, in parse_stream
    return self._parsereport(stream, context, "(parsing)")
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2236, in _parse
    subobj = sc._parsereport(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2770, in _parse
    return self.subcon._parsereport(stream, context, path)
           ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2236, in _parse
    subobj = sc._parsereport(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 2770, in _parse
    return self.subcon._parsereport(stream, context, path)
           ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/application/venv/lib/python3.13/site-packages/construct/core.py", line 820, in _parse
    return self._decode(obj, context, path)
           ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
  File "/application/venv/lib/python3.13/site-packages/osmocom/construct.py", line 268, in _decode
    if r[-1] == 'f':
       ~^^^^
  File "/application/venv/lib/python3.13/site-packages/osmocom/utils.py", line 50, in __getitem__
    return hexstr(super().__getitem__(val))
                  ~~~~~~~~~~~~~~~~~~~^^^^^
IndexError: string index out of range

Change-Id: Ic436e206776b81f24de126e8ee0ae8bf5f3e8d7a
Neels Hofmeyr at

#27240 (Mar 3, 2026, 11:42:04 PM)

esim.saip.personalization: fix TLSPSK keys

Add AES variant of TLSPSK DEK (SCP81 KVN40 key_id=0x02).

Change-Id: I713a008fd26bbfcf437e0f29717b753f058ce76a
Neels Hofmeyr at

#27239 (Mar 3, 2026, 11:42:01 PM)

use secrets.SystemRandom as secure random nr source

secrets.SystemRandom is defined as the most secure random source
available on the given operating system.

Change-Id: I8049cd1292674b3ced82b0926569128535af6efe
Neels Hofmeyr at

#27238 (Mar 3, 2026, 11:41:58 PM)

saip: add numeric_base indicator to ConfigurableParameter and ParamSource

By default, numeric_base = None, to indicate that there are no explicit
limitations on the number space.

For parameters that are definitely decimal, set numeric_base = 10.
For definitely hexadecimal, set numeric_base = 16.

Do the same for ConfigurableParameter as well as ParamSource, so callers
can match them up: if a parameter is numeric_base = 10, then omit
sources that are numeric_base = 16, and vice versa.

Change-Id: Ib0977bbdd9a85167be7eb46dd331fedd529dae01
Neels Hofmeyr at

#27237 (Mar 3, 2026, 11:41:55 PM)

SdKey KVN4X ID02: set key_usage_qual=0x48

Related: SYS#7865
Change-Id: Idc5d33a4a003801f60c95fff6931706a9aeb6692
Neels Hofmeyr at

#27236 (Mar 3, 2026, 11:41:52 PM)

saip/param_source: try to not repeat random values

Change-Id: I4fa743ef5677580f94b9df16a5051d1d178edeb0
Neels Hofmeyr at

#27235 (Mar 3, 2026, 11:41:49 PM)

UppAudit: better indicate exception cause

Change-Id: I4d986b89a473a5b12ed56b4710263b034876a33e
Neels Hofmeyr at

#27234 (Mar 3, 2026, 11:41:47 PM)

saip: SmspTpScAddr: fix get_values_from_pes

Change-Id: I2010305340499c907bb7618c04c61e194db34814
Neels Hofmeyr at

#27233 (Mar 3, 2026, 11:41:43 PM)

add test_param_src.py

Change-Id: I03087b84030fddae98b965e0075d44e04ec6ba5c
Neels Hofmeyr at

#27232 (Mar 3, 2026, 11:41:40 PM)

add test_configurable_parameters.py

Change-Id: Ia55f0d11f8197ca15a948a83a34b3488acf1a0b4
Neels Hofmeyr at

#27231 (Mar 3, 2026, 11:37:22 PM)

comment in uicc.py on Security Domain Keys: add SCP81

Change-Id: Ib0205880f58e78c07688b4637abd5f67ea0570d1
Neels Hofmeyr at

#27230 (Mar 3, 2026, 11:37:19 PM)

personalization: implement UppAudit and BatchAudit

Change-Id: Iaab336ca91b483ecdddd5c6c8e08dc475dc6bd0a
Neels Hofmeyr at

#27229 (Mar 3, 2026, 11:37:17 PM)

param_source: allow input val expansion like '0 * 32'

Working with keys, we often generate 4, 8, 16, 32 digit wide random
values. Those then typically have default input values like

00000000000000000000000000000000

it is hard for humans to count the number of digits. Much easier:

00*16

Teach the ParamSource subclasses dealing with random values to
understand an expansion like this. Any expansion is carried out before
all other input value handling.

Use this expansion also in the default_value of ConfigurableParameter
subclasses that have a default_source pointing at a ParamSource that now
understand this expansion.

Related: SYS#6768
Change-Id: Ie7171c152a7b478736f8825050305606b5af5735
Neels Hofmeyr at

#27228 (Mar 3, 2026, 11:37:14 PM)

personalization: fix SdKey.apply_val() implementation

'securityDomain' elements are decoded to ProfileElementSD instances,
which keep higher level representations of the key data apart from the
decoded[] lists.

So far, apply_val() was dropping binary values in decoded[], which does
not work, because ProfileElementSD._pre_encode() overwrites
self.decoded[] from the higher level representation.

Implement using
- ProfileElementSD.find_key() and SecurityDomainKeyComponent to modify
  an exsiting entry, or
- ProfileElementSD.add_key() to create a new entry.

Before this patch, SdKey parameters seemed to patch PES successfully,
but their modifications did not end up in the encoded DER.

(BTW, this does not fix any other errors that may still be present in
the various SdKey subclasses, patches coming up.)

Related: SYS#6768
Change-Id: I07dfc378705eba1318e9e8652796cbde106c6a52
Neels Hofmeyr at

#27227 (Mar 3, 2026, 11:37:11 PM)

personalization: make AlgorithmID a new EnumParam

The AlgorithmID has a few preset values, and hardly anyone knows which
is which. So instead of entering '1', '2' or '3', make it work with
prededined values 'Milenage', 'TUAK' and 'usim-test'.

Implement the enum value part abstractly in new EnumParam.

Make AlgorithmID a subclass of EnumParam and define the values as from
pySim/esim/asn1/saip/PE_Definitions-3.3.1.asn

Related: SYS#6768
Change-Id: I71c2ec1b753c66cb577436944634f32792353240
Neels Hofmeyr at

#27226 (Mar 3, 2026, 11:37:08 PM)

personalization: add get_typical_input_len() to ConfigurableParameter

The aim is to tell a user interface how wide an input text field should
be chosen to be convenient -- ideally showing the entire value in all
cases, but not too huge for fields that have no sane size limit.

Change-Id: I2568a032167a10517d4d75d8076a747be6e21890
Neels Hofmeyr at

#27225 (Mar 3, 2026, 11:37:05 PM)

personalization: allow reading back multiple values from PES

Change-Id: Iecb68af7c216c6b9dc3add469564416b6f37f7b2
Neels Hofmeyr at

#27224 (Mar 3, 2026, 11:36:59 PM)

personalization: indicate default ParamSource per ConfigurableParameter

Add default_source class members pointing to ParamSource classes to all
ConfigurableParameter subclasses.

This is useful to automatically set up a default ParamSource for a given
ConfigurableParameter subclass, during user interaction to produce a
batch personalization.

For example, if the user selects a Pin1 parameter, a calling program can
implicitly set this to a RandomDigitSource, which will magically make it
work the way that most users need.

BTW, default_source and default_value can be combined to configure a
matching ParamSource instance:

  my_source = MyParam.default_source.from_str( MyParam.default_value )

Change-Id: Ie58d13bce3fa1aa2547cf3cee918c2f5b30a8b32
Neels Hofmeyr at

#27223 (Mar 3, 2026, 11:30:57 PM)

personalization: implement reading back values from a PES

Implement get_values_from_pes(), the reverse direction of apply_val():
read back and return values from a ProfileElementSequence. Implement for
all ConfigurableParameter subclasses.

Future: SdKey.get_values_from_pes() is reading pe.decoded[], which works
fine, but I07dfc378705eba1318e9e8652796cbde106c6a52 will change this
implementation to use the higher level ProfileElementSD members.

Implementation detail:

Implement get_values_from_pes() as classmethod that returns a generator.
Subclasses should yield all occurences of their parameter in a given
PES.

For example, the ICCID can appear in multiple places.
Iccid.get_values_from_pes() yields all of the individual values. A set()
of the results quickly tells whether the PES is consistent.

Rationales for reading back values:

This allows auditing an eSIM profile, particularly for producing an
output.csv from a batch personalization (that generated lots of random
key material which now needs to be fed to an HLR...).

Reading back from a binary result is more reliable than storing the
values that were fed into a personalization.
By auditing final DER results with this code, I discovered:
- "oh, there already was some key material in my UPP template."
- "all IMSIs ended up the same, forgot to set up the parameter."
- the SdKey.apply() implementations currently don't work, see
  I07dfc378705eba1318e9e8652796cbde106c6a52 for a fix.

Change-Id: I234fc4317f0bdc1a486f0cee4fa432c1dce9b463
Neels Hofmeyr at

#27222 (Mar 3, 2026, 11:29:36 PM)

MilenageRotationConstants: set example_input to 3GPP default

Change-Id: I36a9434b2f96d26d710f489d5afce1f0ef05bba1
Neels Hofmeyr at

#27221 (Mar 3, 2026, 11:29:34 PM)

personalization: add param_source.py, add batch.py

Implement pySim.esim.saip.batch.BatchPersonalization,
generating N eSIM profiles from a preset configuration.

Batch parameters can be fed by a constant, incrementing, random or from
CSV rows: add pySim.esim.saip.param_source.* classes to feed such input
to each of the BatchPersonalization's ConfigurableParameter instances.

Related: SYS#6768
Change-Id: I497c60c101ea0eea980e8b1a4b1f36c0eda39002

rather move BatchPersonalization to separate module

Change-Id: I01ae40a06605eb205bfb409189fcd2b3a128855a
Neels Hofmeyr at

#27220 (Mar 3, 2026, 11:29:30 PM)

SmspTpScAddr: set example_input

Change-Id: Ie2c367788215d746807be24051478f0032a19448
Neels Hofmeyr at

#27219 (Mar 3, 2026, 4:55:37 PM)

Bump version: 1.13.0.1-6d38 → 1.13.1

Change-Id: Ic648f4165427d04b25855d7c42d3b44ba155e1ad
Pau Espin Pedrol at

#27218 (Mar 3, 2026, 4:32:44 PM)

nokia_site: Change the LAPD N200 counter for RSL

This commit raises the LAPD RSL N200 (retransmission) counter for
Nokia RSL links. The reason is that the readiness of the TRX is not
signalled (OML) nor can be queried from the BTS in any way, and on
larger macro setups the TRX reset takes ~15 seconds, thus the RSL
bootstrap times out before the TRX becomes ready.

This issue presents itself with UltraSite types, does not affect
InSite or MetroSite (the later two are "integrated TRX" units).

Runtime tested with InSite and UltraSite (multi-TRX).

Change-Id: I2386eea4f225fadbd282de52a43dddb6d284f4f9
metro4 at

#27217 (Mar 3, 2026, 4:29:29 PM)

Drop libusb dependency

We aren't using libusb anywhere directly, so drop checks for it, plus
incorrect USB_INCLUDES which was empty.

Change-Id: I600db0bfe6f746024a329f2972879563d2a013b0
Pau Espin Pedrol at

#27216 (Mar 3, 2026, 3:34:20 PM)

ipc: Makefile.am: Pick already compiled UHDDevice.o object

Take the chance to reorder LDADD, since it expects dependencies to be in
inversed-tree order.

Change-Id: I344309cb7264caf1622b70e87bb44ad3f32edb88
Pau Espin Pedrol at

#27215 (Mar 3, 2026, 3:26:53 PM)

ipc: Makefile.am: Pick already compiled UHDDevice.o object

Take the chance to reorder LDADD, since it expects dependencies to be in
inversed-tree order.

Change-Id: I344309cb7264caf1622b70e87bb44ad3f32edb88
Pau Espin Pedrol at

#27214 (Mar 3, 2026, 2:41:21 PM)

ipc: Makefile.am: Pick already compiled UHDDevice.o object

Take the chance to reorder LDADD, since it expects dependencies to be in
inversed-tree order.

Change-Id: I344309cb7264caf1622b70e87bb44ad3f32edb88
Pau Espin Pedrol at

#27213 (Mar 3, 2026, 2:41:08 PM)

Depend on libosmogsm explicitly

Transceiver52M/device/common/bandmanager.h uses gsm_freq102arfcn() from
libosmogsm, so we should include libosmogsm.

Change-Id: I379b7e285ea9c124709de32d6e8a44b819f62111
Pau Espin Pedrol at

#27212 (Mar 3, 2026, 2:38:28 PM)

configure.ac: Avoid building shared libraries by default

Those libraries are internal to osmo-trx and won't be installed,
so there's no use in building them.

Change-Id: I93c8ace45008b6ab8fba070c174bcec11e3b106e
Pau Espin Pedrol at

#27211 (Mar 3, 2026, 1:50:15 PM)

configure.ac: Update deprecated AC_PROG_LIBTOOL to LT_INIT

As mentioned in
https://www.gnu.org/software/libtool/manual/html_node/LT_005fINIT.html.

Change-Id: I3b811b11ee4bbd5856329a5bdbcb5a8d2776495a
Pau Espin Pedrol at

#27210 (Mar 3, 2026, 1:50:12 PM)

configure.ac: Avoid building shared libraries by default

Those libraries are internal to osmo-trx and won't be installed,
so there's no use in building them.

Change-Id: I93c8ace45008b6ab8fba070c174bcec11e3b106e
Pau Espin Pedrol at

#27209 (Mar 3, 2026, 1:47:16 PM)

Depend on libosmogsm explicitly

Transceiver52M/device/common/bandmanager.h uses gsm_freq102arfcn() from
libosmogsm, so we should include libosmogsm.

Change-Id: I379b7e285ea9c124709de32d6e8a44b819f62111
Pau Espin Pedrol at

#27208 (Mar 3, 2026, 12:30:34 PM)

Implement a blinking LED using Timer Counter 0

Sadly the LED is connected to a GPIO doesn't have useful functions.
The only other function is ETM tracing.
The GPIO can't be controlled by a Timer Counter (TC) or
Timer Counter for Control (TCC) because only certain GPIOs
are able to be controlled by it.

Use a Timer Counter to count the time in one-shot mode
and trigger the LED from the main main loop.
This has the advantage of keeping the interference to a minimum in difference
to a Timer Counter interrupt.
Additional by using the ARM core to change the LED, it can be used as heart beat,
if the LED blinks, the ARM core is still 'alive'.

There are other possibilities to trigger the LED:
- use a TC to trigger the Event System, which toggles the GPIO.
- use a TC to trigger the DMA engine, which transfer 1 byte toggles the GPIO.

Change-Id: I8144120d07f73356855d084016edcb77d202da7f
lynxis at

#27207 (Mar 3, 2026, 12:29:49 PM)

Implement a blinking LED using Timer Counter 0

Sadly the LED is connected to a GPIO doesn't have useful functions.
The only other function is ETM tracing.
The GPIO can't be controlled by a Timer Counter (TC) or
Timer Counter for Control (TCC) because only certain GPIOs
are able to be controlled by it.

Use a Timer Counter to count the time in one-shot mode
and trigger the LED from the main main loop.
This has the advantage of keeping the interference to a minimum in difference
to a Timer Counter interrupt.
Additional by using the ARM core to change the LED, it can be used as heart beat,
if the LED blinks, the ARM core is still 'alive'.

There are other possibilities to trigger the LED:
- use a TC to trigger the Event System, which toggles the GPIO.
- use a TC to trigger the DMA engine, which transfer 1 byte toggles the GPIO.

Change-Id: I8144120d07f73356855d084016edcb77d202da7f
lynxis at

#27206 (Mar 3, 2026, 12:04:24 PM)

Implement a blinking LED using Timer Counter 0

Sadly the LED is connected to a GPIO doesn't have useful functions.
The only other function is ETM tracing.
The GPIO can't be controlled by a Timer Counter (TC) or
Timer Counter for Control (TCC) because only certain GPIOs
are able to be controlled by it.

Use a Timer Counter to count the time in one-shot mode
and trigger the LED from the main main loop.
This has the advantage of keeping the interference to a minimum in difference
to a Timer Counter interrupt.
Additional by using the ARM core to change the LED, it can be used as heart beat,
if the LED blinks, the ARM core is still 'alive'.

There are other possibilities to trigger the LED:
- use a TC to trigger the Event System, which toggles the GPIO.
- use a TC to trigger the DMA engine, which transfer 1 byte toggles the GPIO.

Change-Id: I8144120d07f73356855d084016edcb77d202da7f
lynxis at

#27205 (Mar 3, 2026, 10:39:25 AM)

hnbgw: Fix regression in hnbgw-test-latest

Fix unintended if condition removal in recent commit when
in the -latest case. That commit expected to leave the -latest path
untouched but ended up removing the line. Re-add it.

Fixes: 92f92923418c9803a0eb26fae97e56eed47a612d
Change-Id: I0abefedc9f9193b9665c3529a0f0e841db63401d
Pau Espin Pedrol at

#27204 (Mar 2, 2026, 11:37:27 PM)

transceiver: add optional Laurent burst LUT modulation (int16)

Introduce an optional Burst LUT optimization for Laurent-based burst
modulation, enabled via --with-burst-lut.

- Add precomputed Laurent LUT tables (float and int16 I/Q variants)
- Generate LUT at initialization (prepareBurstLUT)
- Use LUT-based modulation for sps=4 when enabled
- Keep original modulateBurstLaurent() as fallback
- Add configure.ac option and USE_BURST_LUT define

This reduces runtime computation by replacing per-burst Laurent
processing with memcpy-based LUT lookups.

Change-Id: I1715c2d33dc55fe1c7be5c6e7259d378ea5e80b2
dtv.comp at

#27203 (Mar 2, 2026, 11:23:18 PM)

transceiver: add optional Laurent burst LUT modulation (int16)

Introduce an optional Burst LUT optimization for Laurent-based burst
modulation, enabled via --with-burst-lut.

- Add precomputed Laurent LUT tables (float and int16 I/Q variants)
- Generate LUT at initialization (prepareBurstLUT)
- Use LUT-based modulation for sps=4 when enabled
- Keep original modulateBurstLaurent() as fallback
- Add configure.ac option and USE_BURST_LUT define

This reduces runtime computation by replacing per-burst Laurent
processing with memcpy-based LUT lookups.

Change-Id: I1715c2d33dc55fe1c7be5c6e7259d378ea5e80b2
dtv.comp at

#27202 (Mar 2, 2026, 11:23:14 PM)

build: install common/GSM/transceiver libraries for emscripten and add pkg-config files

Expose previously internal libs (libcommon, libGSM, libtransceiver_common)
when building with emscripten, install headers and generate .pc files.
Keep them noinst for native builds.

Change-Id: I2495c5b5c79f2fe74bef83902058e1d2207c1f3c
dtv.comp at

#27201 (Mar 2, 2026, 8:03:44 PM)

nokia_site: Change the LAPD N200 counter for RSL

This commit raises the LAPD RSL N200 (retransmission) counter for
Nokia RSL links. The reason is that the readiness of the TRX is not
signalled (OML) nor can be queried from the BTS in any way, and on
larger macro setups the TRX reset takes ~15 seconds, thus the RSL
bootstrap times out before the TRX becomes ready.

This issues presents itself with UltraSite types, does not affect
InSite or MetroSite (the later two are "integrated TRX" units).

Runtime tested with InSite and UltraSite (multi-TRX).

Change-Id: I2386eea4f225fadbd282de52a43dddb6d284f4f9
metro4 at

#27200 (Mar 2, 2026, 7:19:23 PM)

nokia_site: Add new BTS types to the list

This commit adds Flexi EDGE, Flexi Multiradio and Flexi Multiradio 10
BTS types to the supported device list.

Keep in mind that this was not yet tested as we lack actual HW,
but the OML logic should be the same.

Change-Id: Ia0dbbf148394d8205dc9219b41cfba3cf62bdeaa
metro4 at

#27199 (Mar 2, 2026, 3:14:51 PM)

Use new libosmo-asn1-tcap API osmo_asn1_tcap_TCMessage_decode()

This allows passing a talloc context used to allocate memory when
decoding the message.

Related: SYS#5423
Related: OS#6965
Change-Id: Iebeb2808c54c5b82026a1b31d985aa73f602b42a
Pau Espin Pedrol at

#27198 (Mar 2, 2026, 2:44:06 PM)

build: install common/GSM/transceiver libraries for emscripten and add pkg-config files

Expose previously internal libs (libcommon, libGSM, libtransceiver_common)
when building with emscripten, install headers and generate .pc files.
Keep them noinst for native builds.

Change-Id: I2495c5b5c79f2fe74bef83902058e1d2207c1f3c
dtv.comp at

#27197 (Mar 2, 2026, 2:35:54 PM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27196 (Mar 2, 2026, 1:10:24 PM)

debian/*.install: make paths consistent

Some of the paths start with a leading slash and some don't. Both
variants work, but this is confusing. Let's go without the leading
slash, because the paths are releative (in this case to debian/tmp where
"make install" puts the files during debian packaging).

Related: https://gerrit.osmocom.org/c/osmo-trx/+/42198/comment/ae98245f_98e51337/
Related: https://www.debian.org/doc/manuals/maint-guide/dother.en.html#install
Related: https://manpages.debian.org/testing/debhelper/dh_install.1.en.html#debian/
Change-Id: I4b9de40e1fc6d3935ae8ff82804d94cb863663e9
Oliver Smith at

#27195 (Mar 2, 2026, 12:49:53 PM)

docs/smpp-ota-tool: Add documentation/tutorial

We already have documentation that explains how to run pySim-smpp2sim.
With smpp-ota-tool we now have a counterpart for pySim-smpp2sim, so
let's add documentation for this tool as well.

Related: SYS#7881
Change-Id: If0d18a263f5a6dc035b90f5c5c6a942d46bbba49
pmaier@sysmocom.de at

#27194 (Mar 2, 2026, 12:01:22 PM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27193 (Mar 1, 2026, 9:18:51 PM)

tch: fix RTP clock not ticking for unhandled payload types

When the payload type from the DSP is not handled by the switch
in l1if_tch_rx(), rmsg stays NULL and we return 0 without calling
add_l1sap_header(), silently dropping a 20ms RTP tick.

Always allocate an empty RTP frame when rmsg is NULL so the RTP
clock keeps ticking.

Related: OS#5974

Change-Id: I202522ea6f83d77872a2f84d9a2622b87e829a0c
Signed-off-by: Thorkell Thorkelsson <thorkellmanithorkelsson@gmail.com>
thorkellmanithorkelsson at

#27192 (Mar 1, 2026, 9:16:12 PM)

tch: fix RTP clock not ticking for unhandled payload types

When the payload type from the DSP is not handled by the switch
in l1if_tch_rx(), rmsg stays NULL and we return 0 without calling
add_l1sap_header(), silently dropping a 20ms RTP tick.

Always allocate an empty RTP frame when rmsg is NULL so the RTP
clock keeps ticking.

Related: OS#5974

Change-Id: I202522ea6f83d77872a2f84d9a2622b87e829a0c
Signed-off-by: Thorkell Thorkelsson <thorkellmanithorkelsson@gmail.com>
thorkellmanithorkelsson at

#27191 (Mar 1, 2026, 2:30:00 AM)

tch: fix RTP clock not ticking for unhandled payload types

When the payload type from the DSP is not handled by the switch
in l1if_tch_rx(), rmsg stays NULL and we return 0 without calling
add_l1sap_header(), silently dropping a 20ms RTP tick.

Always allocate an empty RTP frame when rmsg is NULL so the RTP
clock keeps ticking.

Related: OS#5974

Change-Id: I202522ea6f83d77872a2f84d9a2622b87e829a0c
Signed-off-by: Thorkell Thorkelsson <thorkellmanithorkelsson@gmail.com>
thorkellmanithorkelsson at

#27190 (Feb 28, 2026, 9:57:18 PM)

build: install common/GSM/transceiver libraries for emscripten and add pkg-config files

Expose previously internal libs (libcommon, libGSM, libtransceiver_common)
when building with emscripten, install headers and generate .pc files.
Keep them noinst for native builds.

Change-Id: I2495c5b5c79f2fe74bef83902058e1d2207c1f3c
dtv.comp at

#27189 (Feb 28, 2026, 9:11:32 PM)

radio: improve API documentation in RadioDevice

Change-Id: I7b41c549d743ad180a1ddcd8c0313e1003860070
dtv.comp at

#27188 (Feb 28, 2026, 9:11:23 PM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27187 (Feb 27, 2026, 8:45:07 PM)

tests: Use mem alloc macro instead of direct calloc() call

This way we make sure the proper function to alloc is called.

Change-Id: Ia9c7cf1f958f273dd7a5e23cf7633e45fa9d577f
Pau Espin Pedrol at

#27186 (Feb 27, 2026, 8:45:02 PM)

Use talloc to allocate asn1c decoded structs

This commit adds talloc support but will still use talloc NULL context
everywhere when allocating memory.
This is already useful since it allows programs enabling null context
tracking to get a report of memory usage.

Related: SYS#5423
Related: OS#6965
Change-Id: I6d885527caa5b60011b4fac341b93026ab1833d9
Pau Espin Pedrol at

#27185 (Feb 27, 2026, 8:44:57 PM)

Add README.md

Change-Id: Ie3fa506cb9b40992cebe6942ea833a2e49ba2680
Pau Espin Pedrol at

#27184 (Feb 27, 2026, 8:44:53 PM)

Introduce API osmo_asn1_tcap_TCMessage_decode()

This new API allows passing a talloc context where all memory is
allocated by asn1c code is allocated.

Related: SYS#5423
Related: OS#6965
Change-Id: I02923afb3936a1acf6643def27528e35e4b03e86
Pau Espin Pedrol at

#27183 (Feb 27, 2026, 8:44:16 PM)

Makefile.am: Avoid removing tcap.h during make -C src/ regen

That header is ours and is the public entry towards the library.

Change-Id: I89a34ef61e6f74ba7482a5abcf55404c157a14fb
Pau Espin Pedrol at

#27182 (Feb 27, 2026, 5:46:00 PM)

5gc: Introduce test TC_handover_inter_ngran_xn

Change-Id: I4de3f0a02ddbccc85988754a4cd83fe67b1453dc
Pau Espin Pedrol at

#27181 (Feb 27, 2026, 5:31:39 PM)

irq: make default IRQ handler Dummy_Handler weak

To allow overwriting the default handler from the application,
make it weak.

Change-Id: I544e9c84dd538bb744fb799904adc58f9d850465
lynxis at

#27180 (Feb 27, 2026, 5:30:38 PM)

main: rework panic handler

When an OSMO_ASSERT() fails it will call the osmo panic handler.
Previous it will always calls into a breakpoint which will require
a power-cycle.

Change the default (for production) to use a system reset.
But still allow calling into breakpoint by setting `break_on_panic` via SWD.

Change-Id: I91c732001e848ec5509bf81af8aac1a2a80eb718
lynxis at

#27179 (Feb 27, 2026, 5:30:36 PM)

irq: make default IRQ handler Dummy_Handler weak

To allow overwriting the default handler from the application,
make it weak.

Change-Id: I83850b8bad54f55bb26e69d7c4bdac7357c21902
lynxis at

#27178 (Feb 27, 2026, 5:30:32 PM)

sysmoOCTSIM: define own IRQ handlers

Previous: In case of an fault, nmi or an uncatched IRQ, the OCTSIM
would go into a while(1) loop and would require a power cycle.
Overwrite the default Dummy_Handler with our own handler and
add panic handler as function to allow them to show up as
a different backtrace.

Change-Id: If8476fd4a784312a0597ddd0b7eb54a7ebf94868
lynxis at

#27177 (Feb 27, 2026, 2:55:09 PM)

Use new libosmo-asn1-tcap API osmo_asn1_tcap_TCMessage_decode()

This allows passing a talloc context used to allocate memory when
decoding the message.

Related: SYS#5423
Related: OS#6965
Change-Id: Iebeb2808c54c5b82026a1b31d985aa73f602b42a
Pau Espin Pedrol at

#27176 (Feb 27, 2026, 2:53:24 PM)

Introduce API osmo_asn1_tcap_TCMessage_decode()

This new API allows passing a talloc context where all memory is
allocated by asn1c code is allocated.

Related: SYS#5423
Related: OS#6965
Change-Id: I02923afb3936a1acf6643def27528e35e4b03e86
Pau Espin Pedrol at

#27175 (Feb 27, 2026, 12:25:00 PM)

contrib/smpp-ota-tool: use '-' instead of '_' in command line args

Some commandline arguments have an underscore in their name. Let's
replace those with dashes.

Change-Id: Icbe9d753d59263997e9ca34d46ed0daca36ca16c
Related: SYS#6868
pmaier@sysmocom.de at

#27174 (Feb 27, 2026, 12:24:57 PM)

contrib/smpp-ota-tool: define commandline arguments in global scope

The commandline arguments are currently defined under __main__ in a
private scope. From there they are not reachable to the sphinx
argparse module. We have to define the arguments globally at the
top. (like in the other applications)

Related: SYS#7881
Change-Id: I2d9782e3f5b1cac78c22d206fdcac4118c7d5e7c
pmaier@sysmocom.de at

#27173 (Feb 27, 2026, 12:24:54 PM)

docs/smpp-ota-tool: Add documentation/tutorial

We already have documentation that explains how to run pySim-smpp2sim.
With smpp-ota-tool we now have a counterpart for pySim-smpp2sim, so
let's add documentation for this tool as well.

Related: SYS#7881
Change-Id: If0d18a263f5a6dc035b90f5c5c6a942d46bbba49
pmaier@sysmocom.de at

#27172 (Feb 27, 2026, 12:24:52 PM)

contrib/smpp-ota-tool: fix description string (copy+paste error)

Change-Id: I559844bfa1ac372370ef9d148f2f8a6bf4ab4ef5
Related: SYS#6868
pmaier@sysmocom.de at

#27171 (Feb 27, 2026, 12:18:31 PM)

NGAP_Emulation: Use specific record types for AMF/RAN IDs

Change-Id: Ibd85be865a3a61c97d312df76ab3d1ae7ae32a6a
Pau Espin Pedrol at

#27170 (Feb 27, 2026, 12:18:27 PM)

NGAP_Emulation.ttcn: Update AMF ID once received from AMF

This way follow-up lookups will make sure the AMF ID is correct too.

Change-Id: Ic36552eaedf6cad84e385348454146fcb85ecb08
Pau Espin Pedrol at

#27169 (Feb 27, 2026, 10:47:45 AM)

remsim-client: Don't attempt to pass on illegal TPDU length

TPDUs with length < 5 or > 260 bytes are illegal in T=0.  It doesn't
make sense to send them to bankd, triggering bugs in either bankd,
pcsc-lite or the CCID firmware down the road.  Let's filter them right
where they might originate.

Change-Id: I175eb4622d0e69dbc6aca2cddfe091a78f225da5
laforge at

#27168 (Feb 27, 2026, 10:47:41 AM)

remsim-bankd: Don't pass on illegal TPDUs of illegal length

TPDUs with length < 5 bytes or > 260 bytes are illegal in T=0.  It
doesn't make sense to send them to pcsc-lite, triggering bugs in either
pcsc-lite or the CCID firmware down the road.  Let's filter them.

Change-Id: I5c9f1143b85470234acd2e2ffe3e0cf72bd2ae43
laforge at

#27167 (Feb 27, 2026, 10:34:28 AM)

remsim-bankd: Don't pass on illegal TPDUs of illegal length

TPDUs with length < 5 bytes or > 260 bytes are illegal in T=0.  It
doesn't make sense to send them to pcsc-lite, triggering bugs in either
pcsc-lite or the CCID firmware down the road.  Let's filter them.

Change-Id: I5c9f1143b85470234acd2e2ffe3e0cf72bd2ae43
laforge at

#27166 (Feb 27, 2026, 10:34:26 AM)

remsim-client: Don't attempt to pass on illegal TPDU length

TPDUs with length < 5 or > 260 bytes are illegal in T=0.  It doesn't
make sense to send them to bankd, triggering bugs in either bankd,
pcsc-lite or the CCID firmware down the road.  Let's filter them right
where they might originate.

Change-Id: I175eb4622d0e69dbc6aca2cddfe091a78f225da5
laforge at

#27165 (Feb 27, 2026, 10:32:18 AM)

remsim-client: Don't attempt to pass on illegal TPDU length

TPDUs with length < 5 or > 260 bytes are illegal in T=0.  It doesn't
make sense to send them to bankd, triggering bugs in either bankd,
pcsc-lite or the CCID firmware down the road.  Let's filter them right
where they might originate.

Change-Id: I175eb4622d0e69dbc6aca2cddfe091a78f225da5
laforge at

#27164 (Feb 27, 2026, 10:32:16 AM)

remsim-bankd: Don't pass on illegal TPDUs of illegal length

TPDUs with length < 5 bytes or > 260 bytes are illegal in T=0.  It
doesn't make sense to send them to pcsc-lite, triggering bugs in either
pcsc-lite or the CCID firmware down the road.  Let's filter them.

Change-Id: I5c9f1143b85470234acd2e2ffe3e0cf72bd2ae43
laforge at

#27163 (Feb 27, 2026, 10:24:04 AM)

log at NOTICE level if somebody uses loopback addresses.

It appears a common mistake is to e.g. run remsim-server + remsim-bankd
on one machine and then instruct them to use localhost or other
loopback-routed addresses.  This won't work as that address is then
sent to a [remote] remsim-client that attempts to reach the bankd
at localhost.

Change-Id: I3b4eda10e81a705aef8d647a860890a74cba8f13
laforge at

#27162 (Feb 27, 2026, 10:24:01 AM)

remsim-client: Don't attempt to pass on TPDU length < 5

TPDUs with length < 5 bytes are illegal in T=0.  It doesn't make sense
to send them to bankd, triggering bugs in either bankd, pcsc-lite or the
CCID firmware down the road.  Let's filter them right where they might
originate.

Change-Id: I175eb4622d0e69dbc6aca2cddfe091a78f225da5
laforge at

#27161 (Feb 27, 2026, 10:19:47 AM)

WIP: make 6Cxx status codes in case 2/4 ambiguous situations work

Change-Id: I968608e73057e9f57d3a89aae485d1a278e503e4
laforge at

#27160 (Feb 27, 2026, 10:19:45 AM)

Use gsmtap_inst_fd2() to remove compiler warning

gsmtap.c: In function 'osmo_st2_gsmtap_send_apdu':
gsmtap.c:69:9: warning: 'gsmtap_inst_fd' is deprecated: Use gsmtap_inst_fd2() instead [-Wdeprecated-declarations]
   69 |         rc = write(gsmtap_inst_fd(g_gti), buf, gross_len);
      |         ^~

Change-Id: I62de38175e63cb563635a01b025b805981e4b7a9
laforge at

#27159 (Feb 27, 2026, 8:10:50 AM)

clang-format: set ColumnLimit: 0

While our coding style says "we accept line lengths of up to 120
characters", in practice we oftentimes end up preferring longer lines
(e.g. due to having comments at the end, or to keep them consistent with
similar but shorter lines).

The checkpatch config has already been adjusted to just ignore the line
length completely. Adjust the clang-format config to do the same.

Related: osmo-ci I88fd86ac550fddb3017aeceb647c3d9e75367372
Change-Id: I1f0d511d90a0725f195e08dd6a99eb3d55bd6fc1
Oliver Smith at

#27158 (Feb 27, 2026, 8:00:45 AM)

lint/checkpatch: fix false FUNCTION_ARGUMENTS

Fix that the linter complains about:
  WARNING:FUNCTION_ARGUMENTS: function definition argument 'void' should also have an identifier name

For functions with attributes at the end, e.g.:
  void Fallback_Handler(void) __attribute__((weak, alias("Dummy_Handler")));

Related: https://gerrit.osmocom.org/c/osmo-ccid-firmware/+/42224/comment/7c5b3be0_6ff61090/
Change-Id: I139bdabb38bd0c9ceda99921ebdc0196850c2a53
Oliver Smith at

#27157 (Feb 26, 2026, 6:38:07 PM)

fix(threads): centralize portable strerror handling

- Move strerror_r portability logic to Utils
- Add strerror_buf() helper
- Simplify thread error logging in Threads.cpp

Change-Id: I642aff8a9f98823e117c4debd19384ddf5975039
dtv.comp at

#27156 (Feb 26, 2026, 5:53:35 PM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27155 (Feb 26, 2026, 5:17:20 PM)

After initialisation: turn user led on

Related: OS#5158
Change-Id: Ide37ea32648536d333bd5051b142eb15959d29bf
lynxis at

#27154 (Feb 26, 2026, 5:05:56 PM)

sysmoOCTSIM: define own IRQ handlers

Previous: In case of an fault, nmi or an uncatched IRQ, the OCTSIM
would go into a while(1) loop and would require a power cycle.
Use a generic panic handler

Change-Id: If8476fd4a784312a0597ddd0b7eb54a7ebf94868
lynxis at

#27153 (Feb 26, 2026, 5:05:54 PM)

main: rework panic handler

When an OSMO_ASSERT() fails it will call the osmo panic handler.
Previous it will always calls into a breakpoint which will require
a power-cycle.

Change the default (for production) to use a system reset.
But still allow calling into breakpoint by setting `break_on_panic` via SWD.

Change-Id: I91c732001e848ec5509bf81af8aac1a2a80eb718
lynxis at

#27152 (Feb 26, 2026, 5:05:50 PM)

same54: make the default irq handler weak

The default handler for all IRQs is the Dummy_Handler, which is a
simple while(true); wait-loop.

Introduce a weak symbol Default_Handler which alias to the
Dummy_Handler.

This allows replacing the default handler by a single
symbol rather than setting all IRQs seperate to the new handler.

Change-Id: I544e9c84dd538bb744fb799904adc58f9d850465
lynxis at

#27151 (Feb 26, 2026, 4:59:50 PM)

After initialisation: turn system led on

Related: OS#5158
Change-Id: Ide37ea32648536d333bd5051b142eb15959d29bf
lynxis at

#27150 (Feb 26, 2026, 4:36:03 PM)

dfu: fix integer overflow in delay_us()

delay_us(uint16_t) can't handle us > 65535.
Split the 100 ms into 2 function calls.

Change-Id: Ieaf1109c99662a21927901a2e0e3ddac42aa3d3c
lynxis at

#27149 (Feb 26, 2026, 3:44:16 PM)

tcap: Use osmo_asn1_tcap_set_talloc_ctx() to set app talloc ctx

Change-Id: I9c1abc040fdeb58cb97e9b99a2382f336146bc40
Pau Espin Pedrol at

#27148 (Feb 26, 2026, 3:41:45 PM)

Introduce API osmo_asn1_tcap_set_talloc_ctx()

Related: SYS#5423
Related: OS#6965
Change-Id: I206d401efc7ae7680ac2eff75ee062b9b2676a58
Pau Espin Pedrol at

#27147 (Feb 26, 2026, 3:12:16 PM)

Makefile.am: Avoid removing tcap.h during make -C src/ regen

That header is ours and is the public entry towards the library.

Change-Id: I89a34ef61e6f74ba7482a5abcf55404c157a14fb
Pau Espin Pedrol at

#27146 (Feb 26, 2026, 3:12:13 PM)

Add README.md

Change-Id: Ie3fa506cb9b40992cebe6942ea833a2e49ba2680
Pau Espin Pedrol at

#27145 (Feb 26, 2026, 3:12:11 PM)

tests: Use mem alloc macro instead of direct calloc() call

This way we make sure the proper function to alloc is called.

Change-Id: Ia9c7cf1f958f273dd7a5e23cf7633e45fa9d577f
Pau Espin Pedrol at

#27144 (Feb 26, 2026, 3:11:43 PM)

WIP: talloc

Change-Id: I6d885527caa5b60011b4fac341b93026ab1833d9
Pau Espin Pedrol at

#27143 (Feb 26, 2026, 1:22:46 PM)

lint/checkpatch: support multiple configs

Run checkpatch with any .checkpatch*.conf found in the project dir. This
is in preparation for having two .checkpatch.conf files in osmo-trx, in
order to use different linting rules for C++ code:
* .checkpatch.c.conf
* .checkpatch.c++.conf

Related: osmo-trx I0df5b6f2f0bf1469a80a1f5859809c30f523f683
Change-Id: Ia2e75d9783382cefc3900a4ab51a5a919a2cbbbc
Oliver Smith at

#27142 (Feb 26, 2026, 1:09:30 PM)

checkpatch.conf: lint more code

The current linter configuration misses to find lots of formatting
errors as we've seen here:
https://gerrit.osmocom.org/c/osmo-trx/+/42198/comments/f8f1b5a2_3c7e1389

This is caused by the following exclude rules in .checkpatch.conf, which
were added there to avoid that some of the checkpatch rules don't work
correctly with C++ code:

  ---exclude .*h
  ---exclude Transceiver52M/grgsm_vitac/.*
  ---exclude utils/va-test/.*

Fix this by splitting the .checkpatch.conf into two files,
.checkpatch.c.conf and .checkpatch.c++.conf. Let the C version use the
default rules. Let the C++ version ignore the rules that don't work with
C++ code:

* SPACING
  Fails on:
    std::vector<std::string>
  With:
    ERROR:SPACING: spaces required around that '<' (ctx:VxV)
    ERROR:SPACING: spaces required around that '>' (ctx:VxW)

* FUNCTION_ARGUMENTS
  Fails on:
    ScopedLock lock(mLock);
  With:
    WARNING:FUNCTION_ARGUMENTS: function definition argument 'mLock' should also have an identifier name

* INDENTED_LABEL
  Fails on:
    private:
    protected:
  With:
    WARNING:INDENTED_LABEL: labels should not be indented

* NEW_TYPEDEFS
  Fails on:
    typedef std::map<K,D*> Map;
  With:
    WARNING:NEW_TYPEDEFS: do not add new typedefs

With the new config, the linter only complains about the following
things across the existing C++ code, which seem to be legitimate linting
problems (and if not, can be ignored as well):

  BRACES_NOT_NECESSARY, CODE_INDENT, LEADING_SPACE,
  MULTISTATEMENT_MACRO_USE_DO_WHILE, OPEN_BRACE, POINTER_LOCATION,
  PRINTF_I_OSMO, SINGLE_STATEMENT_DO_WHILE_MACRO, SPACE_BEFORE_TAB,
  STATIC_CONST_CHAR_ARRAY, TABSTOP, TRAILING_WHITESPACE

Depends: osmo-ci Ia2e75d9783382cefc3900a4ab51a5a919a2cbbbc
Change-Id: I0df5b6f2f0bf1469a80a1f5859809c30f523f683
Oliver Smith at

#27141 (Feb 26, 2026, 1:09:05 PM)

lint/checkpatch: support multiple configs

Run checkpatch with any .checkpatch*.conf found in the project dir. This
is in preparation for having two .checkpatch.conf files in osmo-trx, in
order to use different linting rules for C++ code:
* .checkpatch.c.conf
* .checkpatch.c++.conf

Related: osmo-trx I0df5b6f2f0bf1469a80a1f5859809c30f523f683
Change-Id: Ia2e75d9783382cefc3900a4ab51a5a919a2cbbbc
Oliver Smith at

#27140 (Feb 26, 2026, 12:08:05 PM)

tcap: Support TID with length 1..4

As described in ITU Q.773 4.2.1.3:
"The length of a Transaction ID is 1 to 4 octets."

asn.1 files also describe TIDs the following way:
OrigTransactionID ::= [APPLICATION 8] IMPLICIT OCTET STRING (SIZE (1..4) )
DestTransactionID ::=[APPLICATION 9] IMPLICIT OCTET STRING (SIZE (1..4) )

Take the chance to avoid asserting based on received external input msg.

Related: SYS#5423
Change-Id: I2748d85624e4be708f7554ee3e60a5bda9162845
Pau Espin Pedrol at

#27139 (Feb 26, 2026, 12:08:01 PM)

tcap: Fix wrong address type printed in log line

Change-Id: I28b0d488159d9fa88e69e8c8b2e53a97b461763a
Pau Espin Pedrol at

#27138 (Feb 26, 2026, 12:06:38 PM)

stp: Enable tracking of NULL memory context

Similar to what's done in most of the OsmoCNI programs.
This allows dumpinng the NULL context using VTY command
'show talloc-context all'.

Change-Id: I4a925967e5bb61c346cf6c4dd2c89b6aaea44b94
Pau Espin Pedrol at

#27137 (Feb 26, 2026, 12:02:00 PM)

tcap: Support TID with length 1..4

As described in ITU Q.773 4.2.1.3:
"The length of a Transaction ID is 1 to 4 octets."

asn.1 files also describe TIDs the following way:
OrigTransactionID ::= [APPLICATION 8] IMPLICIT OCTET STRING (SIZE (1..4) )
DestTransactionID ::=[APPLICATION 9] IMPLICIT OCTET STRING (SIZE (1..4) )

Take the chance to avoid asserting based on received external input msg.

Related: SYS#5423
Change-Id: I2748d85624e4be708f7554ee3e60a5bda9162845
Pau Espin Pedrol at

#27136 (Feb 26, 2026, 12:01:47 PM)

tcap: Lower log level failing to parse msg

invalid rx packets should be logged as NOTICED, not as ERROR.

Change-Id: Idef5736ee2481260f958eece2f5a3bfc009b3d69
Pau Espin Pedrol at

#27135 (Feb 26, 2026, 12:01:30 PM)

tcap: Fix wrong address type printed in log line

Change-Id: I28b0d488159d9fa88e69e8c8b2e53a97b461763a
Pau Espin Pedrol at

#27134 (Feb 26, 2026, 12:00:43 PM)

tcap: Fix return code in tcap_as_rx_sccp_asp()

That code path is not an error, simply the message is not TCAP.

Take the chance to clarify the behavior of the function.

Change-Id: I54c4a1bbaa8e107cf433cc898658a672c2b53c3c
Pau Espin Pedrol at

#27133 (Feb 26, 2026, 11:59:23 AM)

stp: Enable tracking of NULL memory context

Similar to what's done in most of the OsmoCNI programs.
This allows dumpinng the NULL context using VTY command
'show talloc-context all'.

Change-Id: I4a925967e5bb61c346cf6c4dd2c89b6aaea44b94
Pau Espin Pedrol at

#27132 (Feb 26, 2026, 11:15:35 AM)

stp: Enable tracking of NULL memory context

Similar to what's done in most of the OsmoCNI programs.
This allows dumpinng the NULL context using VTY command
'show talloc-context all'.

Change-Id: I4a925967e5bb61c346cf6c4dd2c89b6aaea44b94
Pau Espin Pedrol at

#27131 (Feb 26, 2026, 10:32:38 AM)

tcap: Support TID with length 1..4

As described in ITU Q.773 4.2.1.3:
"The length of a Transaction ID is 1 to 4 octets."

asn.1 files also describe TIDs the following way:
OrigTransactionID ::= [APPLICATION 8] IMPLICIT OCTET STRING (SIZE (1..4) )
DestTransactionID ::=[APPLICATION 9] IMPLICIT OCTET STRING (SIZE (1..4) )

Related: SYS#5423
Change-Id: I2748d85624e4be708f7554ee3e60a5bda9162845
Pau Espin Pedrol at

#27130 (Feb 26, 2026, 10:32:35 AM)

tcap: Lower log level failing to parse msg

invalid rx packets should be logged as NOTICED, not as ERROR.

Change-Id: Idef5736ee2481260f958eece2f5a3bfc009b3d69
Pau Espin Pedrol at

#27129 (Feb 26, 2026, 10:27:27 AM)

tcap: Support TID with length 1..4

As described in ITU Q.773 4.2.1.3:
"The length of a Transaction ID is 1 to 4 octets."

asn.1 files also describe TIDs the following way:
OrigTransactionID ::= [APPLICATION 8] IMPLICIT OCTET STRING (SIZE (1..4) )
DestTransactionID ::=[APPLICATION 9] IMPLICIT OCTET STRING (SIZE (1..4) )

Related: SYS#5423
Change-Id: I2748d85624e4be708f7554ee3e60a5bda9162845
Pau Espin Pedrol at

#27128 (Feb 26, 2026, 10:27:24 AM)

tcap: Fix return code in tcap_as_rx_sccp_asp()

That code path is not an error, simply the message is not TCAP.

Change-Id: I54c4a1bbaa8e107cf433cc898658a672c2b53c3c
Pau Espin Pedrol at

#27127 (Feb 26, 2026, 10:26:25 AM)

tcap: Lower log level failing to parse msg

invalid rx packets should be logged as NOTICED, not as ERROR.

Change-Id: Idef5736ee2481260f958eece2f5a3bfc009b3d69
Pau Espin Pedrol at

#27126 (Feb 25, 2026, 10:29:08 PM)

octsim_osmo-ccid-firmware: add myself to the recipients

Change-Id: I2b96ad0d34e4344ccb0351737df31b08cb65e116
lynxis at

#27125 (Feb 25, 2026, 7:31:52 PM)

fix(threads): centralize portable strerror handling

- Move strerror_r portability logic to Utils
- Add strerror_buf() helper
- Simplify thread error logging in Threads.cpp

Change-Id: I642aff8a9f98823e117c4debd19384ddf5975039
dtv.comp at

#27124 (Feb 25, 2026, 7:26:56 PM)

ensure libosmocore logging is properly disabled for builds

Change-Id: I169a059d8daff0a3993318a4ea3ab7adcb05fee3
ewild at

#27123 (Feb 25, 2026, 7:19:01 PM)

fix(threads): centralize portable strerror handling

- Move strerror_r portability logic to Utils
- Add strerror_buf() helper
- Simplify thread error logging in Threads.cpp

Change-Id: I642aff8a9f98823e117c4debd19384ddf5975039
dtv.comp at

#27122 (Feb 25, 2026, 5:58:17 PM)

tcap: Avoid updating trans_track if AS doesn't have tcap-routing enabled

Change-Id: I0106df80f6c186b184bada8f06d38d0d54cce735
Pau Espin Pedrol at

#27121 (Feb 25, 2026, 4:54:20 PM)

fix --disable-log-macros

Before 9197c1ac, the AC_ARG_ENABLE(log_macros, ...)
action was hardcoded to [log_macros="yes"], so *any*
use of the flag --enable-log-macros or --disable-log-macros
would set log_macros="yes" -> AC_DEFINE([LIBOSMOCORE_NO_LOGGING]).

The commit changed this to the standard [log_macros=$enableval], but
broke the conditional test, so
- AC_ARG_ENABLE sets $enableval to "no" for --disable-* flags
-> log_macros is now "no"
-> test fails
-> LIBOSMOCORE_NO_LOGGING is never defined...

The opposite of what it should do...

Change-Id: I809ab2f61e72428ba21061055296eb83d6d710ab
ewild at

#27120 (Feb 25, 2026, 4:54:15 PM)

core: fix config.h

While exploring why logging is disabled but still shows up in the binaries
I kind of wondered how all the config.h HAVE_XX checks we have everwhere work.
Apparently they do not work at all, due to missing or misplaced include of config.h.

This affects tons of other checks as well.

Change-Id: Ic2cf52a3b60f43a2f5d3fe01c41a41f6fd9a8000
ewild at

#27119 (Feb 25, 2026, 4:40:28 PM)

core: fix config.h

While exploring why logging is disabled but still shows up in the binaries
I kind of wondered how all the config.h HAVE_XX checks we have everwhere work.
Apparently they do not work at all, due to missing or misplaced include of config.h.

This affects tons of other checks as well.

Change-Id: Ic2cf52a3b60f43a2f5d3fe01c41a41f6fd9a8000
ewild at

#27118 (Feb 25, 2026, 4:39:59 PM)

fix --disable-log-macros

Before 9197c1ac, the AC_ARG_ENABLE(log_macros, ...)
action was hardcoded to [log_macros="yes"], so *any*
use of the flag --enable-log-macros or --disable-log-macros
would set log_macros="yes" -> AC_DEFINE([LIBOSMOCORE_NO_LOGGING]).

The commit changed this to the standard [log_macros=$enableval], but
broke the conditional test, so
- AC_ARG_ENABLE sets $enableval to "no" for --disable-* flags
-> log_macros is now "no"
-> test fails
-> LIBOSMOCORE_NO_LOGGING is never defined...

The opposite of what it should do...

Change-Id: I809ab2f61e72428ba21061055296eb83d6d710ab
ewild at

#27117 (Feb 25, 2026, 4:36:19 PM)

core: fix config.h

While exploring why logging is disabled but still shows up in the binaries
I kind of wondered how all the config.h HAVE_XX checks we have everwhere work.
Apparently they do not work at all, due to missing or misplaced include of config.h.

This affects tons of other checks as well.

Change-Id: Ic2cf52a3b60f43a2f5d3fe01c41a41f6fd9a8000
ewild at

#27116 (Feb 25, 2026, 4:35:38 PM)

fix --disable-log-macros

Before 9197c1ac, the AC_ARG_ENABLE(log_macros, ...)
action was hardcoded to [log_macros="yes"], so *any*
use of the flag --enable-log-macros or --disable-log-macros
would set log_macros="yes" -> AC_DEFINE([LIBOSMOCORE_NO_LOGGING]).

The commit changed this to the standard [log_macros=$enableval], but
broke the conditional test, so
- AC_ARG_ENABLE sets $enableval to "no" for --disable-* flags
-> log_macros is now "no"
-> test fails
-> LIBOSMOCORE_NO_LOGGING is never defined...

The opposite of what it should do...

Change-Id: I809ab2f61e72428ba21061055296eb83d6d710ab
ewild at

#27115 (Feb 25, 2026, 4:34:08 PM)

fix(threads): centralize portable strerror handling

- Move strerror_r portability logic to Utils
- Add strerror_buf() helper
- Add strerror_str() wrapper using std::error_code
- Simplify thread error logging in Threads.cpp

Change-Id: I642aff8a9f98823e117c4debd19384ddf5975039
dtv.comp at

#27114 (Feb 25, 2026, 4:20:42 PM)

RTP: make ortp optional at compile time

It is now possible to run osmo-bts configure with --disable-ortp
option, which makes it use only twrtp library (integrated into
libosmo-netif) and removes all dependency on Belledonne software,
such that osmo-bts can be built on top of libosmo-abis that has also
been configured with its respective --disable-ortp option.

TODO: contrib/ber/rtp_ber utility still uses ortp and has no support
for twrtp or any other alternative - therefore, when osmo-bts is
configured with --disable-ortp, this utility is not built.

Related: OS#6474
Change-Id: Ib171bd42a65117457319befee2615e0c36c8d9e1
falcon at

#27113 (Feb 25, 2026, 4:20:38 PM)

remove bogons from src/osmo-bts-oc2g/Makefile.am

This Makefile.am contained references to ORTP_CFLAGS and ORTP_LIBS,
which are bogons because our configure makes no pkg-config calls
for ortp, whether ortp support is included or excluded - instead
these pkg-config calls that produce ORTP_CFLAGS and ORTP_LIBS
happen only in libosmo-abis, while all subsequent ortp users in
Osmocom go through osmo_ortp shim provided by that library.

Related: OS#6474
Change-Id: Id9f091a42118393f973b982e18d1920f72bfcbb4
falcon at

#27112 (Feb 25, 2026, 3:24:23 PM)

core: fix config.h

While exploring why logging is disabled but still shows up in the binaries
I kind of wondered how all the config.h HAVE_XX checks we have everwhere work.
Apparently they do not work at all, due to missing or misplaced include of config.h.

This affects tons of other checks as well.

Change-Id: Ic2cf52a3b60f43a2f5d3fe01c41a41f6fd9a8000
ewild at

#27111 (Feb 25, 2026, 2:11:17 PM)

checkpatch.conf: lint more code

The current linter configuration leads to too many linting errors, as
seen here:
https://gerrit.osmocom.org/c/osmo-trx/+/42198/comments/f8f1b5a2_3c7e1389

Fix this by not excluding files where the linter generates false
positives. But instead ignoring specific rules that generate these false
positives (mostly related to this being a C++ code base). The following
rules are now ignored:

* SPACING
  Fails on:
    std::vector<std::string>
  With:
    ERROR:SPACING: spaces required around that '<' (ctx:VxV)
    ERROR:SPACING: spaces required around that '>' (ctx:VxW)

* FUNCTION_ARGUMENTS
  Fails on:
    ScopedLock lock(mLock);
  With:
    WARNING:FUNCTION_ARGUMENTS: function definition argument 'mLock' should also have an identifier name

* INDENTED_LABEL
  Fails on:
    private:
    protected:
  With:
    WARNING:INDENTED_LABEL: labels should not be indented

* NEW_TYPEDEFS
  Fails on:
    typedef std::map<K,D*> Map;
  With:
    WARNING:NEW_TYPEDEFS: do not add new typedefs

With the new config, the linter only complains about the following
things across the existing code, which seem to be legitimate linting
problems (and if not, can be ignored as well):

  BRACES_NOT_NECESSARY, CODE_INDENT, LEADING_SPACE,
  MULTISTATEMENT_MACRO_USE_DO_WHILE, OPEN_BRACE, POINTER_LOCATION,
  PRINTF_I_OSMO, SINGLE_STATEMENT_DO_WHILE_MACRO, SPACE_BEFORE_TAB,
  STATIC_CONST_CHAR_ARRAY, TABSTOP, TRAILING_WHITESPACE

Change-Id: I0df5b6f2f0bf1469a80a1f5859809c30f523f683
Oliver Smith at

#27110 (Feb 25, 2026, 1:32:34 PM)

fix --disable-log-macros

Before 9197c1ac, the AC_ARG_ENABLE(log_macros, ...)
action was hardcoded to [log_macros="yes"], so *any*
use of the flag --enable-log-macros or --disable-log-macros
would set log_macros="yes" -> AC_DEFINE([LIBOSMOCORE_NO_LOGGING]).

The commit changed this to the standard [log_macros=$enableval], but
broke the conditional test, so
- AC_ARG_ENABLE sets $enableval to "no" for --disable-* flags
-> log_macros is now "no"
-> test fails
-> LIBOSMOCORE_NO_LOGGING is never defined...

The opposite of what it should do...

Change-Id: I809ab2f61e72428ba21061055296eb83d6d710ab
ewild at

#27109 (Feb 25, 2026, 11:15:38 AM)

tests/pySim-smpp2sim_test: add testcases for AES128 and AES256

Extend the existing test script so that it can handle multiple
testcases. Also add support for switching eUICC profiles.
Finally, add a testcases to test OTA-SMS (RFM) with AES128 and
AES256 encryption.

Change-Id: I1f10504f3a29a8c74a17991632d932819fecfa5a
Related: OS#6868
pmaier@sysmocom.de at

#27108 (Feb 25, 2026, 11:00:18 AM)

bsc: TC_stat_msc_sctp_disconnected Fix sporadic failure

Since we recently increased a bit the timeout to assume the BSSAP_LE
peer (SMLC) is implicitly up, the function
f_bssap_le_wait_sccp_peer_available() may still be onging when we drop
the sctp connection at the STP in the test, which will generate an
explicit DUNA towards BSSAP_LE and hence fail the test because it never
comes back available before it times out.

Since we don't need nor test SMLC in this test, simply disable starting
the SMLC here to avoid this race condition and simplify the test.

Change-Id: Ib063a481d9039cbcd462609404dbae14922c7510
Pau Espin Pedrol at

#27107 (Feb 25, 2026, 10:37:35 AM)

tests/pySim-smpp2sim_test: add testcases for AES128 and AES256

Extend the existing test script so that it can handle multiple
testcases. Also add support for switching eUICC profiles.
Finally, add a testcases to test OTA-SMS (RFM) with AES128 and
AES256 encryption.

Change-Id: I1f10504f3a29a8c74a17991632d932819fecfa5a
Related: OS#6868
pmaier@sysmocom.de at

#27106 (Feb 25, 2026, 10:34:23 AM)

bankd: csv: fix crash on invalid lines

When no valid csv line is given (e.g. without any commas),
bankd will crash when trying to compile a regex with NULL.

Change-Id: Id6059c7dd4a119ffb1658a6cd7345a40bef3a69f
lynxis at

#27105 (Feb 25, 2026, 10:34:20 AM)

bankd: csv: fail on invalid csv lines

Instead of ignoring invalid regex and non-existent
regex for reader.

Change-Id: If10889b43c99adb99d0b7dcdb4287952c3a93d69
lynxis at

#27104 (Feb 25, 2026, 8:47:46 AM)

fix(threads): support GNU and POSIX strerror_r variants

- Add required headers
- Use correct handling for GNU-specific strerror_r
- Provide fallback error string for portability

Change-Id: I642aff8a9f98823e117c4debd19384ddf5975039
dtv.comp at

#27103 (Feb 25, 2026, 6:31:55 AM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27102 (Feb 24, 2026, 10:06:33 PM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27101 (Feb 24, 2026, 10:01:33 PM)

feat(usdr): add USDR backend support (osmo-trx-usdr)

- Implement USDRDevice backend for Transceiver52M
- Add --with-usdr configure option and build integration
- Add systemd service unit (osmo-trx-usdr.service)
- Add Debian packaging files for osmo-trx-usdr
- Provide example configuration file
- Extend manuals and device documentation with USDR backend section

Change-Id: I5d1d25921514954c4929ae6e7352168b3ceb05df
dtv.comp at

#27100 (Feb 24, 2026, 8:42:10 PM)

dfu: make dfu_state/dfu_status volatile

Both variable might be changed from IRQ and from main loop.

Change-Id: I7ad5255064917c203cebe5ab54a5d457baa2f5ed
lynxis at

#27099 (Feb 24, 2026, 8:42:04 PM)

dfu: rewrite firmware downloading

Improve handling of dfu_state by moving more state changing towards the
IRQ handler. Having both the main loop and IRQ changes dfu_state within
the same state could lead to races.

The main loop is now only a simple worker which reports back via dfu_flash_done &
dfu_flash_status.

Change-Id: I345d5948455b25cd8a2efb1abfd9d0986ebd8cef
lynxis at

#27098 (Feb 24, 2026, 8:41:57 PM)

dfu: MANIFEST_SYNC: stay in MANIFEST_SYNC when manifestationIntolerant & completed

In theory a device which is manifestintolerant and completed the manifestation should
not reach MANIFEST_SYNC again.

Remove the state transistion to WAIT-RESET and stay in the current state and
wait for the main loop to change the state is safer.

Change-Id: I8c34a18e2336731126a8c01070d86e2547578e3d
lynxis at

#27097 (Feb 24, 2026, 8:41:53 PM)

dfu: irq: replace if(states) with a switch case

Improves the overview. No functional change.

Change-Id: Ic32fe16dff4b7bb933ec62e36a9c7c7829aece1b
lynxis at

#27096 (Feb 24, 2026, 8:41:45 PM)

dfu: mainloop: work on a local copy of dfu_state

Prevent race conditions between main loop and irq.
Copy at the start of the loop the dfu state and work on it.

Change-Id: Ic146c8fa5ba25425cf785bae66f9c99b0faab944
lynxis at

#27095 (Feb 24, 2026, 8:41:34 PM)

dfu: usb_dfu() convert if() intos switch/case

Improves the overview of the handled states.
No functional change.

Change-Id: Ie0abcdb51612598e77cacf7772276919ded17d5a
lynxis at

#27094 (Feb 24, 2026, 8:41:25 PM)

dfu: protect USB_DFU_STATE_DFU_MANIFEST by a critical section

In the MANIFEST state, the IRQ won't move the state, but
to prevent incosistency between dfu_manifestation_complete &
dfu_state, use a critical section.

Change-Id: Idf5fb7d55b4051ba7e235dfa409a4de18a8f208c
lynxis at

#27093 (Feb 24, 2026, 6:57:46 PM)

RTP: make ortp optional at compile time

It is now possible to run osmo-bts configure with --disable-ortp
option, which makes it use only twrtp library (integrated into
libosmo-netif) and removes all dependency on Belledonne software,
such that osmo-bts can be built on top of libosmo-abis that has also
been configured with its respective --disable-ortp option.

TODO: contrib/ber/rtp_ber utility still uses ortp and has no support
for twrtp or any other alternative - therefore, when osmo-bts is
configured with --disable-ortp, this utility is not built.

Related: OS#6474
Change-Id: Ib171bd42a65117457319befee2615e0c36c8d9e1
falcon at

#27092 (Feb 24, 2026, 6:23:26 PM)

RTP: add vty option for ortp vs twrtp selection

With this patch it finally becomes possible for the user to select
which RTP library should be used: ortp or twrtp.  ortp is still
the default for now, in order to not alter behavior for existing
installations until twrtp receives more real world testing by users
beyond the original author.  Future patches may change the default
or even remove ortp support altogether - but twrtp should receive
more testing as a user opt-in feature first.

Related: OS#6474
Change-Id: Iff4e3a399250c16ba8fe4cb12e4e22f4c6b346ec
falcon at

#27091 (Feb 24, 2026, 6:21:53 PM)

RTP: make ortp optional at compile time

It is now possible to run osmo-bts configure with --disable-ortp
option, which makes it use only twrtp library (integrated into
libosmo-netif) and removes all dependency on Belledonne software,
such that osmo-bts can be built on top of libosmo-abis that has also
been configured with its respective --disable-ortp option.

TODO: contrib/ber/rtp_ber utility still uses ortp and has no support
for twrtp or any other alternative - therefore, when osmo-bts is
configured with --disable-ortp, this utility is not built.

Related: OS#6474
Change-Id: Ib171bd42a65117457319befee2615e0c36c8d9e1
falcon at

#27090 (Feb 24, 2026, 4:59:44 PM)

mgw: Fix sporadic failure in TC_one_crcx_loopback_rtp

Change-Id: I29d8d376e343975e3dfeb018bdfda8350bdfc58a
Pau Espin Pedrol at

#27089 (Feb 24, 2026, 3:56:54 PM)

mgw: Improve failure message in f_TC_one_crcx_loopback_rtp()

Change-Id: I51c656371c330e4689738321d0739e280cab530d
Pau Espin Pedrol at

#27088 (Feb 24, 2026, 2:41:29 PM)

dfu: usb_dfu() convert if() intos switch/case

Improves the overview of the handled states.
No functional change.

Change-Id: Ie0abcdb51612598e77cacf7772276919ded17d5a
lynxis at

#27087 (Feb 24, 2026, 2:41:23 PM)

dfu: irq: GET_STATUS: set state before sending it

The DFU spec, v1.1: "6.1.2 DFU_GETSTATUS Request" states the
GET_STATUS should contain the state,
to which the device transistions to after processing this message.

Change-Id: I6d28404d6936f7ea79fcee90f0c8191f0f623ad8
lynxis at

#27086 (Feb 24, 2026, 2:41:19 PM)

dfu: MANIFEST_SYNC: stay in MANIFEST_SYNC when manifestationIntolerant & completed

In theory a device which is manifestintolerant and completed the manifestation should
not reach MANIFEST_SYNC again.

Remove the state transistion to WAIT-RESET and stay in the current state and
wait for the main loop to change the state is safer.

Change-Id: I8c34a18e2336731126a8c01070d86e2547578e3d
lynxis at

#27085 (Feb 24, 2026, 2:41:16 PM)

dfu: rewrite firmware downloading

Improve handling of dfu_state by moving more state changing towards the
IRQ handler. Having both the main loop and IRQ changes dfu_state within
the same state could lead to races.

The main loop is now only a simple worker which reports back via dfu_flash_done &
dfu_flash_status.

Change-Id: I345d5948455b25cd8a2efb1abfd9d0986ebd8cef
lynxis at

#27084 (Feb 24, 2026, 2:41:12 PM)

dfu: irq: replace if(states) with a switch case

Improves the overview. No functional change.

Change-Id: Ic32fe16dff4b7bb933ec62e36a9c7c7829aece1b
lynxis at

#27083 (Feb 24, 2026, 2:41:09 PM)

dfu: mainloop: work on a local copy of dfu_state

Prevent race conditions between main loop and irq.
Copy at the start of the loop the dfu state and work on it.

Change-Id: Ic146c8fa5ba25425cf785bae66f9c99b0faab944
lynxis at

#27082 (Feb 24, 2026, 2:41:05 PM)

dfu: protect USB_DFU_STATE_DFU_MANIFEST by a critical section

In the MANIFEST state, the IRQ won't move the state, but
to prevent incosistency between dfu_manifestation_complete &
dfu_state, use a critical section.

Change-Id: Idf5fb7d55b4051ba7e235dfa409a4de18a8f208c
lynxis at

#27081 (Feb 24, 2026, 2:40:56 PM)

dfu: make dfu_state/dfu_status volatile

Both variable might be changed from IRQ and from main loop.

Change-Id: I7ad5255064917c203cebe5ab54a5d457baa2f5ed
lynxis at

#27080 (Feb 24, 2026, 12:23:36 PM)

ttcn3-bts-test: write bts logs to tmpfs

Pau suggested in the related issue that we try to write the bts logs
into tmpfs, instead of directly to ext4. This seems to cause the slow
downs, which then result in clock skew errors.

Related: SYS#6794#note-29
Change-Id: Id9a93f7149ef7e9bfde1f4fe3a8299ba46645d50
Oliver Smith at

#27079 (Feb 24, 2026, 12:13:26 PM)

ccid_slot_fsm.c: Reject T=0 TPDU > 260 bytes

The CCID v1.1 specification states a T=0 TPDU must not exceed 260 bytes,
so let's properly handle this error case.

Change-Id: Iceb0013adf448fe56c909fd8ccf14a021d8b7331
laforge at

#27078 (Feb 24, 2026, 12:13:23 PM)

ccid_device: Reject XfrBlock with zero-length data

While the CCID v1.1 spec seems to declare dwLength == 0 is within
the valid range, it's of course a no-op as we cannot transact a TPDU
that isn't there.

Change-Id: I65df88477e4b1c03dc20a8d41e5cbd1c9f363ba8
laforge at

#27077 (Feb 24, 2026, 10:55:29 AM)

tests/pySim-smpp2sim_test: add testcases for AES128 and AES256

Extend the existing test script so that it can handle multiple
testcases. Also add support for switching eUICC profiles.
Finally, add a testcases to test OTA-SMS (RFM) with AES128 and
AES256 encryption.

Change-Id: I1f10504f3a29a8c74a17991632d932819fecfa5a
Related: OS#6868
pmaier@sysmocom.de at

#27076 (Feb 24, 2026, 10:54:01 AM)

stream: Improve error handling and logging in write_cb

Nowhere in man 2 write/send/sendmsg it can be read that a return of 0
is actually an error, so avoid handling that case as error in
stream_cli.

While at ti, log the errno string.

Change-Id: I68468f0452cbc86b6210bbd1dbfa251579270adb
Pau Espin Pedrol at

#27075 (Feb 24, 2026, 10:36:20 AM)

stream_cli: Log errno string if write failed

Change-Id: I68468f0452cbc86b6210bbd1dbfa251579270adb
Pau Espin Pedrol at

#27074 (Feb 24, 2026, 8:55:43 AM)

tests/pySim-smpp2sim_test: add testcases for AES128 and AES256

Extend the existing test script so that it can handle multiple
testcases. Also add support for switching eUICC profiles.
Finally, add a testcases to test OTA-SMS (RFM) with AES128 and
AES256 encryption.

Change-Id: I1f10504f3a29a8c74a17991632d932819fecfa5a
Related: OS#6868
pmaier@sysmocom.de at

#27073 (Feb 24, 2026, 8:55:40 AM)

contrib/smpp-ota-tool: warn about mixed up KIC/KIC indexes

Cards usually have multiple sets of KIC, KID (and KIK). The keys
are selected through an index. However, mixing keys from different
sets is concidered as a security violation and cards should reject
such configurations.

Let's print a warning to make users aware that something is off.

Change-Id: Ieb4e14145baba1c2cb4a237b612b04694940f402
Related: OS#6868
pmaier@sysmocom.de at

#27072 (Feb 24, 2026, 8:55:38 AM)

contrib/smpp-ota-tool: fix boolean commandline parameters

Boolean parameters should be false by default and use store_true when
set.

Change-Id: I0652b48d2ea5efbaaf5bc147aa8cef7ab8b0861d
Related: OS#6868
pmaier@sysmocom.de at

#27071 (Feb 24, 2026, 8:55:35 AM)

contrib/smpp-ota-tool: add missing usage helpstrings

Change-Id: Ic1521ba11b405f311a30fdb3585ad518375669ae
Related: OS#6868
pmaier@sysmocom.de at

#27070 (Feb 24, 2026, 6:53:02 AM)

sigtran-osmocom.adoc: Describe tcap-aware loadshare

Change-Id: I58979e8f6c5156706b1016069eaaf2801ec9311b
Related: OS#5423
dwillmann at

#27069 (Feb 23, 2026, 8:14:52 PM)

RTP: add vty option for ortp vs twrtp selection

With this patch it finally becomes possible for the user to select
which RTP library should be used: ortp or twrtp.  ortp is still
the default for now, in order to not alter behavior for existing
installations until twrtp receives more real world testing by users
beyond the original author.  Future patches may change the default
or even remove ortp support altogether - but twrtp should receive
more testing as a user opt-in feature first.

Related: OS#6474
Change-Id: Iff4e3a399250c16ba8fe4cb12e4e22f4c6b346ec
falcon at

#27068 (Feb 23, 2026, 7:56:30 PM)

RTP: use new abstraction layer instead of direct osmo_ortp

As of this patch in the series, the RTP library in active use
is still always ortp, but all BTS code now accesses it through
the new abstraction layer, paving the way for twrtp option.

Related: OS#6474
Change-Id: I5e3de4f84e8e8875437cb94a9b8feeb07f9cc1cf
falcon at

#27067 (Feb 23, 2026, 7:56:25 PM)

RTP: add vty option for ortp vs twrtp selection

With this patch it finally becomes possible for the user to select
which RTP library should be used: ortp or twrtp.  ortp is still
the default for now, in order to not alter behavior for existing
installations until twrtp receives more real world testing by users
beyond the original author.  Future patches may change the default
or even remove ortp support altogether - but twrtp should receive
more testing as a user opt-in feature first.

Related: OS#6474
Change-Id: Iff4e3a399250c16ba8fe4cb12e4e22f4c6b346ec
falcon at

#27066 (Feb 23, 2026, 7:53:39 PM)

RTP: implement RTP socket abstraction layer

This abstraction layer is another step toward supporting a choice
between legacy Belledonne ortp and Osmocom-integrated twrtp.

Related: OS#6474
Depends: Ibda74c0dbfb163f5d0e3fb13f593a6e2c6817673 (libosmo-netif.git)
Change-Id: Ic945f6d753ec7f5c0ac5cecc9f71049464de7e8f
falcon at

#27065 (Feb 23, 2026, 5:00:34 PM)

contrib/smpp-ota-tool: add missing usage helpstrings

Change-Id: Ic1521ba11b405f311a30fdb3585ad518375669ae
Related: OS#6868
pmaier@sysmocom.de at

#27064 (Feb 23, 2026, 3:56:40 PM)

tests/pySim-smpp2sim_test: add testcases for AES128 and AES256

Extend the existing test script so that it can handle multiple
testcases. Also add support for switching eUICC profiles.
Finally, add a testcases to test OTA-SMS (RFM) with AES128 and
AES256 encryption.

Change-Id: I1f10504f3a29a8c74a17991632d932819fecfa5a
Related: OS#6868
pmaier@sysmocom.de at

#27063 (Feb 23, 2026, 3:37:58 PM)

personalization: fix SdKey.apply_val() implementation

'securityDomain' elements are decoded to ProfileElementSD instances,
which keep higher level representations of the key data apart from the
decoded[] lists.

So far, apply_val() was dropping binary values in decoded[], which does
not work, because ProfileElementSD._pre_encode() overwrites
self.decoded[] from the higher level representation.

Implement using
- ProfileElementSD.find_key() and SecurityDomainKeyComponent to modify
  an exsiting entry, or
- ProfileElementSD.add_key() to create a new entry.

Before this patch, SdKey parameters seemed to patch PES successfully,
but their modifications did not end up in the encoded DER.

(BTW, this does not fix any other errors that may still be present in
the various SdKey subclasses, patches coming up.)

Related: SYS#6768
Change-Id: I07dfc378705eba1318e9e8652796cbde106c6a52
Neels Hofmeyr at

#27062 (Feb 23, 2026, 3:37:55 PM)

personalization: make AlgorithmID a new EnumParam

The AlgorithmID has a few preset values, and hardly anyone knows which
is which. So instead of entering '1', '2' or '3', make it work with
prededined values 'Milenage', 'TUAK' and 'usim-test'.

Implement the enum value part abstractly in new EnumParam.

Make AlgorithmID a subclass of EnumParam and define the values as from
pySim/esim/asn1/saip/PE_Definitions-3.3.1.asn

Related: SYS#6768
Change-Id: I71c2ec1b753c66cb577436944634f32792353240
Neels Hofmeyr at

#27061 (Feb 23, 2026, 3:37:53 PM)

personalization: implement reading back values from a PES

Implement get_values_from_pes(), the reverse direction of apply_val():
read back and return values from a ProfileElementSequence. Implement for
all ConfigurableParameter subclasses.

Future: SdKey.get_values_from_pes() is reading pe.decoded[], which works
fine, but I07dfc378705eba1318e9e8652796cbde106c6a52 will change this
implementation to use the higher level ProfileElementSD members.

Implementation detail:

Implement get_values_from_pes() as classmethod that returns a generator.
Subclasses should yield all occurences of their parameter in a given
PES.

For example, the ICCID can appear in multiple places.
Iccid.get_values_from_pes() yields all of the individual values. A set()
of the results quickly tells whether the PES is consistent.

Rationales for reading back values:

This allows auditing an eSIM profile, particularly for producing an
output.csv from a batch personalization (that generated lots of random
key material which now needs to be fed to an HLR...).

Reading back from a binary result is more reliable than storing the
values that were fed into a personalization.
By auditing final DER results with this code, I discovered:
- "oh, there already was some key material in my UPP template."
- "all IMSIs ended up the same, forgot to set up the parameter."
- the SdKey.apply() implementations currently don't work, see
  I07dfc378705eba1318e9e8652796cbde106c6a52 for a fix.

Change-Id: I234fc4317f0bdc1a486f0cee4fa432c1dce9b463
Neels Hofmeyr at

#27060 (Feb 23, 2026, 3:37:51 PM)

personalization: add get_typical_input_len() to ConfigurableParameter

The aim is to tell a user interface how wide an input text field should
be chosen to be convenient -- ideally showing the entire value in all
cases, but not too huge for fields that have no sane size limit.

Change-Id: I2568a032167a10517d4d75d8076a747be6e21890
Neels Hofmeyr at

#27059 (Feb 23, 2026, 3:37:48 PM)

personalization: indicate default ParamSource per ConfigurableParameter

Add default_source class members pointing to ParamSource classes to all
ConfigurableParameter subclasses.

This is useful to automatically set up a default ParamSource for a given
ConfigurableParameter subclass, during user interaction to produce a
batch personalization.

For example, if the user selects a Pin1 parameter, a calling program can
implicitly set this to a RandomDigitSource, which will magically make it
work the way that most users need.

BTW, default_source and default_value can be combined to configure a
matching ParamSource instance:

  my_source = MyParam.default_source.from_str( MyParam.default_value )

Change-Id: Ie58d13bce3fa1aa2547cf3cee918c2f5b30a8b32
Neels Hofmeyr at

#27058 (Feb 23, 2026, 3:37:46 PM)

personalization: add param_source.py, add batch.py

Implement pySim.esim.saip.batch.BatchPersonalization,
generating N eSIM profiles from a preset configuration.

Batch parameters can be fed by a constant, incrementing, random or from
CSV rows: add pySim.esim.saip.param_source.* classes to feed such input
to each of the BatchPersonalization's ConfigurableParameter instances.

Related: SYS#6768
Change-Id: I497c60c101ea0eea980e8b1a4b1f36c0eda39002

rather move BatchPersonalization to separate module

Change-Id: I01ae40a06605eb205bfb409189fcd2b3a128855a
Neels Hofmeyr at

#27057 (Feb 23, 2026, 3:37:43 PM)

personalization: allow reading back multiple values from PES

Change-Id: Iecb68af7c216c6b9dc3add469564416b6f37f7b2
Neels Hofmeyr at

#27056 (Feb 23, 2026, 3:37:40 PM)

MilenageRotationConstants: set example_input to 3GPP default

Change-Id: I36a9434b2f96d26d710f489d5afce1f0ef05bba1
Neels Hofmeyr at

#27055 (Feb 23, 2026, 1:56:42 PM)

contrib/smpp-ota-tool: warn about mixed up KIC/KIC indexes

Cards usually have multiple sets of KIC, KID (and KIK). The keys
are selected through an index. However, mixing keys from different
sets is concidered as a security violation and cards should reject
such configurations.

Let's print a warning to make users aware that something is off.

Change-Id: Ieb4e14145baba1c2cb4a237b612b04694940f402
Related: OS#6868
pmaier@sysmocom.de at

#27054 (Feb 23, 2026, 1:56:40 PM)

contrib/smpp-ota-tool/cosmetic: use lazy formatting for logging

Change-Id: I2540472a50b7a49b5a67d088cbdd4a2228eef8f4
Related: OS#6868
pmaier@sysmocom.de at

#27053 (Feb 23, 2026, 1:56:37 PM)

contrib/smpp-ota-tool: use correct kid index

(normally KID index and KIC index should be the same since mixing keys
is a concidered as a security violation. However, in this tool we
want to allow users to specify different indexes for KIC and KIC so that
they can make tests to make sure their cards correctly reject mixed up
key indexes)

Change-Id: I8847ccc39e4779971187e7877b8902fca7f8bfc1
Related: OS#6868
pmaier@sysmocom.de at

#27052 (Feb 23, 2026, 1:56:35 PM)

contrib/smpp-ota-tool/cosmetic: fix sourcecode formatting

Change-Id: Icbce41ffac097d2ef8714bc8963536ba54a77db2
Related: OS#6868
pmaier@sysmocom.de at

#27051 (Feb 23, 2026, 1:56:30 PM)

contrib/smpp-ota-tool: add missing usage helpstrings

Change-Id: Ic1521ba11b405f311a30fdb3585ad518375669ae
Related: OS#6868
pmaier@sysmocom.de at

#27050 (Feb 23, 2026, 1:56:26 PM)

tests/pySim-smpp2sim_test: add testcases for AES128 and AES256

Extend the existing test script so that it can handle multiple
testcases. Also add support for switching eUICC profiles.
Finally, add a testcases to test OTA-SMS (RFM) with AES128 and
AES256 encryption.

Change-Id: I1f10504f3a29a8c74a17991632d932819fecfa5a
Related: OS#6868
pmaier@sysmocom.de at

#27049 (Feb 23, 2026, 1:56:23 PM)

contrib/smpp-ota-tool: fix boolean commandline parameters

Boolean parameters should be false by default and use store_true when
set.

Change-Id: I0652b48d2ea5efbaaf5bc147aa8cef7ab8b0861d
Related: OS#6868
pmaier@sysmocom.de at

#27048 (Feb 23, 2026, 1:35:11 PM)

hnbgw: Fix race conditions during PFCP Association

Since osmo-hnbgw now sends Heartbeat Requests, we need to take that into
account.
Furthermore, since it also now supports retriggering association when
detecting peer restarted upon rx of Heartbeat Req, use that to trigger
an association to clean up state and have a deterministic way to
synchronize at that point regarding state.

Change-Id: If62bd6c6e4d6cf73791029172d3d8880629f36a8
Pau Espin Pedrol at

#27047 (Feb 23, 2026, 1:35:08 PM)

hnbgw: Introduce test TC_pfcp_heartbeat_recovery_timestamp

Related: SYS#7294
Change-Id: I3f8098d7a34666961437fecc5100422a5e7436a4
Pau Espin Pedrol at

#27046 (Feb 23, 2026, 1:35:02 PM)

hnbgw: introduce test TC_pfcp_heartbeat_timeout

Related: SYS#7294
Change-Id: I1e0b50bc19e1fa1240274baea1e7fedd1265ffcb
Pau Espin Pedrol at

#27045 (Feb 23, 2026, 11:35:26 AM)

dfu: do not reset itself

In theory USB_DFU_ATTRIBUTES_WILL_DETACH is nice, in practice
not so much, because usb uses control transfers and "waiting" for
status response completion after finishing flashing is cumbersome.
There is basically no advantage if the device resets itself, and
just waiting for the host to do it like most DFU devices work
(and what the BL used to do in the beginning) works
around the status issue.

Change-Id: I1b9e48470083597640918a8a1126922b31150153
ewild at

#27044 (Feb 23, 2026, 10:45:15 AM)

BSSAP_LE_Emulation: Increase timeout in f_bssap_le_wait_sccp_peer_available()

It was spotted in SMLC_Tests.ttcn that the current timeout may be too
short, and the test fails because ttcn3 connects to STP and receives a
DUNA, and then the IUT (osmo-smlc) connects to STP around 4 seconds
later, which is too late with existing timeout.

Change-Id: I2d4210bf5785a09bf384a1534c407dcf63b1c38b
Pau Espin Pedrol at

#27043 (Feb 23, 2026, 10:02:36 AM)

dfu: make resp buffer static

USB dma uses a buffer depending on alignment, so this can be safe,
but it should not be depend on reading and knowing the asf source code...

Change-Id: I2f9336143190350817e6352b00751b35b1600b62
ewild at

#27042 (Feb 23, 2026, 10:02:33 AM)

dfu: fix bState transition/reporting order as per dfu spec

DFU spec wants the next state, not the current one.

Change-Id: I06519c73cdb0b082002632da9cfe7436c63f52b0
ewild at

#27041 (Feb 23, 2026, 10:02:30 AM)

dfu: do not reset itself

In theory USB_DFU_ATTRIBUTES_WILL_DETACH is nice, in practice
not so much, because usb uses control transfers and "waiting" for
status response completion after finishing flashing is cumbersome.
There is basically no advantage if the device resets itself, and
just waiting for the host to do it like most DFU devices work
(and what the BL used to do in the beginning) works
around the status issue.

Change-Id: I1b9e48470083597640918a8a1126922b31150153
ewild at

#27040 (Feb 23, 2026, 1:38:28 AM)

main: rework panic handler

When an OSMO_ASSERT() fails it will call the osmo panic handler.
Previous it will always calls into a breakpoint which will require
a power-cycle.

Change the default (for production) to use a system reset.
But still allow calling into breakpoint by setting `break_on_panic` via SWD.

Change-Id: I91c732001e848ec5509bf81af8aac1a2a80eb718
lynxis at

#27039 (Feb 22, 2026, 8:45:45 PM)

dfu: usb_dfu() convert if() intos switch/case

Improves the overview of the handled states.
No functional change.

Change-Id: Ie0abcdb51612598e77cacf7772276919ded17d5a
lynxis at

#27038 (Feb 22, 2026, 8:45:39 PM)

dfu: MANIFEST_SYNC: stay in MANIFEST_SYNC when manifestationIntolerant & completed

In theory a device which is manifestintolerant and completed the manifestation should
not reach MANIFEST_SYNC again.

Remove the state transistion to WAIT-RESET and stay in the current state and
wait for the main loop to change the state is safer.

Change-Id: I8c34a18e2336731126a8c01070d86e2547578e3d
lynxis at

#27037 (Feb 22, 2026, 8:45:33 PM)

dfu: mainloop: work on a local copy of dfu_state

Prevent race conditions between main loop and irq.
Copy at the start of the loop the dfu state and work on it.

Change-Id: Ic146c8fa5ba25425cf785bae66f9c99b0faab944
lynxis at

#27036 (Feb 22, 2026, 8:45:16 PM)

dfu: protect USB_DFU_STATE_DFU_MANIFEST by a critical section

In the MANIFEST state, the IRQ won't move the state, but
to prevent incosistency between dfu_manifestation_complete &
dfu_state, use a critical section.

Change-Id: Idf5fb7d55b4051ba7e235dfa409a4de18a8f208c
lynxis at

#27035 (Feb 22, 2026, 8:45:11 PM)

dfu: irq: GET_STATUS: set state before sending it

The DFU spec, v1.1: "6.1.2 DFU_GETSTATUS Request" states the
GET_STATUS should contain the state,
to which the device transistions to after processing this message.

Change-Id: I6d28404d6936f7ea79fcee90f0c8191f0f623ad8
lynxis at

#27034 (Feb 22, 2026, 8:45:06 PM)

dfu: rewrite firmware downloading

Improve handling of dfu_state by moving more state changing towards the
IRQ handler. Having both the main loop and IRQ changes dfu_state within
the same state could lead to races.

The main loop is now only a simple worker which reports back via dfu_flash_done &
dfu_flash_status.

Change-Id: I345d5948455b25cd8a2efb1abfd9d0986ebd8cef
lynxis at

#27033 (Feb 22, 2026, 8:45:00 PM)

dfu: irq: replace if(states) with a switch case

Improves the overview. No functional change.

Change-Id: Ic32fe16dff4b7bb933ec62e36a9c7c7829aece1b
lynxis at

#27032 (Feb 22, 2026, 8:44:41 PM)

dfu: MANIFEST: mainloop: wait 5 ms before handling the state

Gives the USB stack some time to deliver the last USB message before
going through the state machine which might end in a too quick system reset.

Change-Id: If9178120eed46f75089abf1898db3176cce93df2
lynxis at

#27031 (Feb 22, 2026, 8:37:34 PM)

dfu: MANIFEST: mainloop: wait 5 ms before handling the state

Gives the USB stack some time to deliver the last USB message before
going through the state machine which might end in a too quick system reset.

Change-Id: If9178120eed46f75089abf1898db3176cce93df2
lynxis at

#27030 (Feb 22, 2026, 8:37:29 PM)

dfu: irq: replace if(states) with a switch case

Improves the overview. No functional change.

Change-Id: Ic32fe16dff4b7bb933ec62e36a9c7c7829aece1b
lynxis at

#27029 (Feb 22, 2026, 8:37:22 PM)

dfu: mainloop: work on a local copy of dfu_state

Prevent race conditions between main loop and irq.
Copy at the start of the loop the dfu state and work on it.

Change-Id: Ic146c8fa5ba25425cf785bae66f9c99b0faab944
lynxis at

#27028 (Feb 22, 2026, 8:37:16 PM)

dfu: make dfu_state/dfu_status volatile

Both variable might be changed from IRQ and from main loop.

Change-Id: I7ad5255064917c203cebe5ab54a5d457baa2f5ed
lynxis at

#27027 (Feb 22, 2026, 8:36:59 PM)

dfu: MANIFEST_SYNC: stay in MANIFEST_SYNC when manifestationIntolerant & completed

In theory a device which is manifestintolerant and completed the manifestation should
not reach MANIFEST_SYNC again.

Remove the state transistion to WAIT-RESET and stay in the current state and
wait for the main loop to change the state is safer.

Change-Id: I8c34a18e2336731126a8c01070d86e2547578e3d
lynxis at

#27026 (Feb 22, 2026, 8:36:53 PM)

dfu: usb_dfu() convert if() intos switch/case

Improves the overview of the handled states.
No functional change.

Change-Id: Ie0abcdb51612598e77cacf7772276919ded17d5a
lynxis at

#27025 (Feb 22, 2026, 8:36:46 PM)

dfu: irq: GET_STATUS: set state before sending it

The DFU spec, v1.1: "6.1.2 DFU_GETSTATUS Request" states the
GET_STATUS should contain the state,
to which the device transistions to after processing this message.

Change-Id: I6d28404d6936f7ea79fcee90f0c8191f0f623ad8
lynxis at

#27024 (Feb 22, 2026, 8:36:39 PM)

Improve comments on errata 2.6.10

Errata 2.6.10 affects Rev A, D, F: The cache lines
of AHB0 and AHB1 might not reset properly on Power up
resulting in courrupted data in rare cases.

The errata recommends fixing this by:
- for AHB0: WDT enable & disable
- for AHB1: disable and re-enable cache line

Change-Id: I3c35f590a4e43d778e70f2f377e0d470c3a652b2
lynxis at

#27023 (Feb 22, 2026, 8:36:24 PM)

dfu: protect USB_DFU_STATE_DFU_MANIFEST by a critical section

In the MANIFEST state, the IRQ won't move the state, but
to prevent incosistency between dfu_manifestation_complete &
dfu_state, use a critical section.

Change-Id: Idf5fb7d55b4051ba7e235dfa409a4de18a8f208c
lynxis at

#27022 (Feb 22, 2026, 8:36:03 PM)

dfu: rewrite firmware downloading

Improve handling of dfu_state by moving more state changing towards the
IRQ handler. Having both the main loop and IRQ changes dfu_state within
the same state could lead to races.

The main loop is now only a simple worker which reports back via dfu_flash_done &
dfu_flash_status.

Change-Id: I345d5948455b25cd8a2efb1abfd9d0986ebd8cef
lynxis at

#27021 (Feb 22, 2026, 4:55:19 AM)

RTP: add vty option for ortp vs twrtp selection

With this patch it finally becomes possible for the user to select
which RTP library should be used: ortp or twrtp.  ortp is still
the default for now, in order to not alter behavior for existing
installations until twrtp receives more real world testing by users
beyond the original author.  Future patches may change the default
or even remove ortp support altogether - but twrtp should receive
more testing as a user opt-in feature first.

Related: OS#6474
Change-Id: Iff4e3a399250c16ba8fe4cb12e4e22f4c6b346ec
falcon at

#27020 (Feb 22, 2026, 4:44:34 AM)

RTP: add vty option for ortp vs twrtp selection

With this patch it finally becomes possible for the user to select
which RTP library should be used: ortp or twrtp.  ortp is still
the default for now, in order to not alter behavior for existing
installations until twrtp receives more real world testing by users
beyond the original author.  Future patches may change the default
or even remove ortp support altogether - but twrtp should receive
more testing as a user opt-in feature first.

Related: OS#6474
Change-Id: Iff4e3a399250c16ba8fe4cb12e4e22f4c6b346ec
falcon at

#27019 (Feb 22, 2026, 4:38:08 AM)

RTP: use new abstraction layer instead of direct osmo_ortp

As of this patch in the series, the RTP library in active use
is still always ortp, but all BTS code now accesses it through
the new abstraction layer, paving the way for twrtp option.

Related: OS#6474
Change-Id: I5e3de4f84e8e8875437cb94a9b8feeb07f9cc1cf
falcon at

#27018 (Feb 22, 2026, 4:25:06 AM)

RTP: implement RTP socket abstraction layer

This abstraction layer is another step toward supporting a choice
between legacy Belledonne ortp and Osmocom-integrated twrtp.

Related: OS#6474
Depends: Ibda74c0dbfb163f5d0e3fb13f593a6e2c6817673 (libosmo-netif.git)
Change-Id: Ic945f6d753ec7f5c0ac5cecc9f71049464de7e8f
falcon at

#27017 (Feb 22, 2026, 4:17:28 AM)

RTP: implement RTP socket abstraction layer

This abstraction layer is another step toward supporting a choice
between legacy Belledonne ortp and Osmocom-integrated twrtp.

Related: OS#6474
Depends: Ibda74c0dbfb163f5d0e3fb13f593a6e2c6817673 (libosmo-netif.git)
Change-Id: Ic945f6d753ec7f5c0ac5cecc9f71049464de7e8f
falcon at

#27016 (Feb 22, 2026, 4:08:10 AM)

RTP: add vty configuration for twjit

This patch is the first step in the series adding the ability to use
twrtp+twjit instead of Belledonne ortp.  twjit requires vty config
for tunable parameters - add this config.  Actual use of this added
config will happen in subsequent patches.

Related: OS#6474
Change-Id: I9ccd060fce8416e01356fccd9ae465a7298a9ce5
falcon at

#27015 (Feb 22, 2026, 3:44:20 AM)

RTP: add vty configuration for twjit

This patch is the first step in the series adding the ability to use
twrtp+twjit instead of Belledonne ortp.  twjit requires vty config
for tunable parameters - add this config.  Actual use of this added
config will happen in subsequent patches.

Related: OS#6474
Change-Id: I9ccd060fce8416e01356fccd9ae465a7298a9ce5
falcon at

#27014 (Feb 22, 2026, 3:44:17 AM)

RTP: use new abstraction layer instead of direct osmo_ortp

As of this patch in the series, the RTP library in active use
is still always ortp, but all BTS code now accesses it through
the new abstraction layer, paving the way for twrtp option.

Related: OS#6474
Change-Id: I5e3de4f84e8e8875437cb94a9b8feeb07f9cc1cf
falcon at

#27013 (Feb 22, 2026, 3:44:13 AM)

RTP: implement RTP socket abstraction layer

This abstraction layer is another step toward supporting a choice
between legacy Belledonne ortp and Osmocom-integrated twrtp.

Related: OS#6474
Depends: Ibda74c0dbfb163f5d0e3fb13f593a6e2c6817673 (libosmo-netif.git)
Change-Id: Ic945f6d753ec7f5c0ac5cecc9f71049464de7e8f
falcon at

#27012 (Feb 22, 2026, 3:42:07 AM)

RTP: add vty option for ortp vs twrtp selection

With this patch it finally becomes possible for the user to select
which RTP library should be used: ortp or twrtp.  ortp is still
the default for now, in order to not alter behavior for existing
installations until twrtp receives more real world testing by users
beyond the original author.  Future patches may change the default
or even remove ortp support altogether - but twrtp should receive
more testing as a user opt-in feature first.

Related: OS#6474
Change-Id: Iff4e3a399250c16ba8fe4cb12e4e22f4c6b346ec
falcon at

#27011 (Feb 21, 2026, 11:21:25 AM)

main: rework panic handler

When an OSMO_ASSERT() fails it will call the osmo panic handler.
Previous it will always calls into a breakpoint which will require
a power-cycle.

Change the default (for production) to use a system reset.
But still allow calling into breakpoint by setting `break_on_panic` via SWD.

Change-Id: I91c732001e848ec5509bf81af8aac1a2a80eb718
lynxis at

#27010 (Feb 21, 2026, 11:17:49 AM)

main: rework panic handler

When an OSMO_ASSERT() fails it will call the osmo panic handler.
Previous it will always calls into a breakpoint which will require
a power-cycle.

Change the default (for production) to use a system reset.
But still allow calling into breakpoint by setting `break_on_panic` via SWD.

Change-Id: I91c732001e848ec5509bf81af8aac1a2a80eb718
lynxis at

#27009 (Feb 21, 2026, 11:16:00 AM)

main: rework panic handler

When an OSMO_ASSERT() fails it will call the osmo panic handler.
Previous it will always calls into a breakpoint which will require
a power-cycle.

Change the default (for production) to use a system reset.
But still allow calling into breakpoint by setting `break_on_panic` via SWD.

Change-Id: I91c732001e848ec5509bf81af8aac1a2a80eb718
lynxis at

#27008 (Feb 21, 2026, 11:12:10 AM)

main: fix crash when ccid_df_write_in() fails

The OSMO_ASSERT(msg->list.next != LLIST_POISON1) are checking msgb
which has been removed from the llist.
All llist members which aren't part of a list have LLIST_POISON1 assigned.

These OSMO_ASSERT()s will always trigger this msgb.

Fixes: a684bc4e38b4 ("Make ch9 usb tests work")
Change-Id: I49c81fba756f3620638b6c6c664f53e4a8758ef9
lynxis at

#27007 (Feb 21, 2026, 11:12:06 AM)

main: don't access msgbs after giving them away

Because of IRQ, it is dangerous to access a msgb,
which has been giving away to a queue (ownership transfer).

Further OSMO_ASSERT() should never fail on a queue'd object,
except it has been taken already from an IRQ context.
Fix a potential crash.

Fixes: a684bc4e38b4 ("Make ch9 usb tests work")
Change-Id: I79844f77d5cd75e08b0eb44b22c4ad223cb79dcb
lynxis at

#27006 (Feb 21, 2026, 11:08:04 AM)

ccid_common: iso_handle_fsm_events: add missing return

Fix warning about control reaches end of non-void function.

Change-Id: I4066c8a1ab1eadb3d8f8cbaf5aa0afbbb2e5dd80
lynxis at

#27005 (Feb 20, 2026, 12:32:55 PM)

Bump version: 1.1.2 → 1.1.3

Change-Id: I4ffcc7d6bba6fd86525dd93fc8c643d50d81b7f0
Oliver Smith at

#27004 (Feb 20, 2026, 10:58:21 AM)

Bump version: 1.1.2 → 1.1.3

Change-Id: Ibc9d5efa85def78cfc3f1f09f0cde46aa7cfbd3c
Oliver Smith at

#27003 (Feb 20, 2026, 10:19:05 AM)

ccid: fix rdr_to_pc_parameters and rdr_to_pc_hardware_error

Change-Id: I67d5cb876d20b29f4759d5b194606f34b8b966c4
ewild at

#27002 (Feb 20, 2026, 9:58:50 AM)

tcap: vty: Fix writing tcap-routing command

Change-Id: I36d23c0e330c224b69094fb861520c4a4a32b3d8
Pau Espin Pedrol at

#27001 (Feb 20, 2026, 1:33:12 AM)

esim/http_json_api.py: support text/plain response Content-Type

Allow returning text/plain Content-Types as 'data' output argument.

So far, all the esim/http_json_api functions require a JSON response.
However, a specific vendor has a list function where the request is JSON
but the response is text/plain CSV data. Allow and return in a dict.

Change-Id: Iba6e4cef1048b376050a435a900c0f395655a790
Neels Hofmeyr at

#27000 (Feb 19, 2026, 5:35:49 PM)

rspro_server: fix releasing timed out clients

Fix crash on reconnects of clients if they timed out.

The duplicate check will use conn->peer of the old peer,
but conn->peer is NULL because rspro_client_conn_destroy() never destroys
the connection if conn->peer is valid when rspro_client_conn_destroy() is called.

void rspro_client_conn_destroy(conn)
{
if (conn->peer) {
peer = conn->peer;
conn->peer = NULL;
osmo_stream_srv_destroy(peer); /* calls sock_closed_cb()
}
[..]
}

int sock_closed_cb(peer)
{
[..]
if (conn->peer) {
osmo_fsm_inst_dispatch(conn->fi, CLNTC_E_TCP_DOWN, NULL); /* calls in the end rspro_client_conn_destroy() */
}
return 0;
}

Re-organize the clean up:
* rspro_client_conn_destroy() will be only called by the FSM clean up
* closed_cb will inform the fi to clean up

Fixes: 8cfe1d808a57 ("Use new osmo_ipa_ka_fsm_inst APIs from libosmo-netif")
Related: OS#6957
Change-Id: I1f7faf5ffdd909362c492ab434b63fa7e79ada95
lynxis at

#26999 (Feb 19, 2026, 5:33:28 PM)

remsim: server: add a client timeout test

1. Connect to the server
2. Don't answer to IPA PINGs
3. Server closes the connection
4. Client reconnects
5. Older server versions will crash

Change-Id: Iec52d3ce229c2ab84ab0ff9d8dbbff59b7f3fbd9
lynxis at

#26998 (Feb 19, 2026, 3:37:20 PM)

5gc: Split f_start_handleri_with_pars() into multiple helpers

This allows initializing multiple ConnHldr and then connecting them and
starting them later. This is similar to what is is done eg. in
MSC_Tests.

Change-Id: Ic60009c5f7fcdc43f6e13f9ea469bfaddc639c33
Pau Espin Pedrol at

#26997 (Feb 19, 2026, 3:03:59 PM)

5gc: Add missing TC_connection_suspend to control block

Fixes: 1af55d318d43967ee5d056bdf2bc3a50c096389b
Change-Id: I2e9e3647917f22e16d9dd6e7199f62a305cc57b3
Pau Espin Pedrol at

#26996 (Feb 19, 2026, 1:13:22 PM)

Bump version: 1.10.0.36-b9839-dirty → 1.11.0

Change-Id: I595b31071a071bfa5666931d99e24e9b56877a6f
Pau Espin Pedrol at

#26995 (Feb 19, 2026, 12:56:47 PM)

Add [no ]force-cell-sel-ind-after-rel

Change-Id: Ie5fa3e036e0a0dd4049a4230d6cd4cb7c158088e
Related: SYS#7482
Vadim Yanitskiy at

#26994 (Feb 19, 2026, 12:27:09 PM)

Bump version: 1.10.0.36-b9839-dirty → 1.11.0

Change-Id: I595b31071a071bfa5666931d99e24e9b56877a6f
Pau Espin Pedrol at

#26993 (Feb 19, 2026, 12:17:13 PM)

Bump version: 1.8.0.3-9533 → 1.8.1

Change-Id: I44a6d0216f2a8ea4a536374c99cfedfbec75eabf
Pau Espin Pedrol at

#26992 (Feb 19, 2026, 12:12:24 PM)

Bump version: 0.5.2.4-2463 → 0.5.3

Change-Id: I36a3c6219bbd4f7dc13b5d5e40687d3f61aa02d5
Pau Espin Pedrol at

#26991 (Feb 19, 2026, 12:04:12 PM)

Bump version: 1.14.0.10-44efd → 1.14.1

Change-Id: I2a3907eabebc7f282f0a00d50b11894847669c1f
Pau Espin Pedrol at

#26990 (Feb 19, 2026, 12:04:09 PM)

ipaccess-config-e1-driver: Make sure struct input_signal_data is zero initialized

Change-Id: If97c4a4202eaf96446d48e821d5e59c98bafe51c
(cherry picked from commit 37929c0886be2fa71aadadc571ee024c3d54a3a6)
Pau Espin Pedrol at

#26989 (Feb 19, 2026, 12:04:05 PM)

assignment_fsm: Fix use-after-free of lchan->conn

Scenario:
* A DYNAMIC/OSMOCOM TS in PDCH mode is selected to be used for TCH/F,
  hence the TS is being switched to TCH/F: RF Channel Release is being
  transmitted and waiting to receive RF Channel release ACK. Hence,
  lchan is in state LCHAN_ST_WAIT_TS_READY, and there's a conn with an
  assignment FSM pointing to it in conn->assignment.new_lchan.
  lchan->conn also points to the related conn.
* The BSSMAP SCCP link goes down (link lost), which will terminate the
  conn->fi of all conns related to the MSC peer going down.
  During that teardown, first gscon_pre_term()->gscon_release_lchans()->
  assignment_reset() is called, which sets
  conn->assignment.new_lchan=NULL and calls lchan_release(). This path
  leaves conn->assignment.new_lchan->conn untouched!
* Later in the call path, when finally the bsc_subscr is put() to 0
  references and associated lchan gets its lchan_forget_conn() called,
  it will access lchan->conn which was not freed in the previous step
  mentioned above during assignment_reset().

This patch fixes the issue by adding a lchan_forget_conn() after the
lchan_release() in assignment_reset(), to make sure the conn is no
longer user by the lchan afterwards.

Related: OS#6936
Change-Id: Ifbb9a61cd8a40d953ef5c2b52f9be9ef0dffefa4
(cherry picked from commit 44efd5b20b50ab894ed32ada3340fb5507b4852b)
Pau Espin Pedrol at

#26988 (Feb 19, 2026, 11:41:47 AM)

Bump version: 1.12.0.73-10f3 → 1.13.0

Change-Id: I877d255890a525a34fbf89101b3ff0bbd0989c87
Pau Espin Pedrol at

#26987 (Feb 19, 2026, 9:42:17 AM)

5gc: Introduce test TC_connection_suspend

The test is expected to fail because open5gs (as of v2.7.3) doesn't
implement such features; see open5gs ticket referenced below.

Related: SYS#7073
Related: open5gs GH#4322

Change-Id: I6da2571518a9b50369fa8e0dd19e447137ea20c6
Pau Espin Pedrol at

#26986 (Feb 19, 2026, 9:34:56 AM)

Tear down context_maps when UPF assoc goes down

Related: SYS#7294
Change-Id: I7dcd9114861fa8f4bf855a02c286f85083ad75fe
Pau Espin Pedrol at

#26985 (Feb 19, 2026, 8:18:45 AM)

Fix/change TC_tcap_loadshare_ipa_tcap_udts()

The behaviour changed to not reject tcap messages outside of any valid
route. Change the test expectation that these messages are indeed
forwarded.

Change-Id: Ibffa98702fd6eb276410630ab525d986fa0f36e0
dwillmann at

#26984 (Feb 18, 2026, 6:30:42 PM)

Fix/change TC_tcap_loadshare_ipa_tcap_udts()

The behaviour changed to not reject tcap messages outside of any valid
route. Change the test expectation that these messages are indeed
forwarded.

Change-Id: Ibffa98702fd6eb276410630ab525d986fa0f36e0
dwillmann at

#26983 (Feb 18, 2026, 5:35:37 PM)

5gc: Introduce test TC_connection_suspend

The test is expected to fail because open5gs (as of v2.7.3) doesn't
implement such features; see open5gs ticket referenced below.

Related: SYS#7073
Related: open5gs GH#4322

Change-Id: I6da2571518a9b50369fa8e0dd19e447137ea20c6
Pau Espin Pedrol at

#26982 (Feb 18, 2026, 4:30:41 PM)

twjit: add underrun extension feature

Themyscira Wireless RTP jitter buffer implementation (twjit) was
originally designed for continuous streaming, as opposed to RTP
streams with intentional gaps.  However, intentional gaps in the
case of DTX pauses or radio errors are called for by 3GPP AoIP
specs and are the default mode for UL RTP Tx in OsmoBTS - therefore,
this philosophical incompatibility between twjit and RTP intentional
gaps is likely to be an obstacle to the desired replacement of
Belledonne ortp with twrtp+twjit in OsmoBTS.  The greatest practical
effect of this philosophical mismatch occurs with RTP streams that
apply intentional gaps for DTX: with standard twjit algorithm,
isolated-island comfort noise update packets throughout each DTX
pause will be dropped.

Underrun extension is an optionally-enabled modification to twjit
algorithm that solves the problem of isolated-island CN update
packets during DTX pauses - i.e., delivers these packets to the
application on the output side of twjit.  As detailed in the
included document update, this solution is not perfect in that
these isolated CN update packets will be delivered only in steady
flow state but not in new flow acquisition states - but it is the
best solution this author can currently provide for the problem of
RTP intentional gaps.

Related: OS#6474
Change-Id: Ibda74c0dbfb163f5d0e3fb13f593a6e2c6817673
falcon at

#26981 (Feb 18, 2026, 12:57:24 PM)

Tear down context_maps when UPF assoc goes down

Related: SYS#7294
Change-Id: I7dcd9114861fa8f4bf855a02c286f85083ad75fe
Pau Espin Pedrol at

#26980 (Feb 18, 2026, 12:57:22 PM)

Integrate mgw/mgcp failures more tightly into context_map fsm

Similar to what we already do in RAN/CN link lost.
As a result, we now trigger RLSD instead of Iu RANAP Release Req, which
adequates better to the level where hnbgw is espected to operate.

Change-Id: Ief051e1384d2282708302dc1756454d8f88a6fae
Pau Espin Pedrol at

#26979 (Feb 18, 2026, 12:54:31 PM)

5gc: Introduce test TC_connection_inactive

The test is expected to fail because open5gs (as of v2.7.3) doesn't
implement such features; see open5gs ticket referenced below.

Related: SYS#7073
Related: open5gs GH#4319
Change-Id: Icf60dde814b7c8ef4cdb4c886423058c7d741a9b
Pau Espin Pedrol at

#26978 (Feb 18, 2026, 12:49:22 PM)

5gc: Introduce test TC_connection_inactive

The test is expected to fail because open5gs (as of v2.7.3) doesn't
implement such features; see open5gs ticket referenced below.

Related: SYS#7073
Related: open5gs GH#4319
Change-Id: Icf60dde814b7c8ef4cdb4c886423058c7d741a9b
Pau Espin Pedrol at

#26977 (Feb 18, 2026, 12:49:19 PM)

ngap: Add multiple templates related to RRC_INACTIVE

Change-Id: Ie0e6f5054c45e681373c6db59d2b298c71ad4836
Pau Espin Pedrol at

#26976 (Feb 17, 2026, 6:20:32 PM)

twjit: add underrun extension feature

Themyscira Wireless RTP jitter buffer implementation (twjit) was
originally designed for continuous streaming, as opposed to RTP
streams with intentional gaps.  However, intentional gaps in the
case of DTX pauses or radio errors are called for by 3GPP AoIP
specs and are the default mode for UL RTP Tx in OsmoBTS - therefore,
this philosophical incompatibility between twjit and RTP intentional
gaps is likely to be an obstacle to the desired replacement of
Belledonne ortp with twrtp+twjit in OsmoBTS.  The greatest practical
effect of this philosophical mismatch occurs with RTP streams that
apply intentional gaps for DTX: with standard twjit algorithm,
isolated-island comfort noise update packets throughout each DTX
pause will be dropped.

Underrun extension is an optionally-enabled modification to twjit
algorithm that solves the problem of isolated-island CN update
packets during DTX pauses - i.e., delivers these packets to the
application on the output side of twjit.  As detailed in the
included document update, this solution is not perfect in that
these isolated CN update packets will be delivered only in steady
flow state but not in new flow acquisition states - but it is the
best solution this author can currently provide for the problem of
RTP intentional gaps.

Related: OS#6474
Change-Id: Ibda74c0dbfb163f5d0e3fb13f593a6e2c6817673
falcon at

#26975 (Feb 17, 2026, 5:20:48 PM)

ngap: Update asn files V17.5.0 -> V19.1.0

Copied from wireshark.git be5cfd209f62933bc46744dca3e22e731b24ab6b
epan/dissectors/asn1/ngap/*.asn.

Change-Id: I4838c1031f2e168e6bce59f3d4fc7871fb597466
Pau Espin Pedrol at

#26974 (Feb 17, 2026, 4:39:22 PM)

5gc: Update details on missing open5gs 5GC features

Change-Id: I7be0bbb70207ac6c0ff77f230da56aace29c1eda
Pau Espin Pedrol at

#26973 (Feb 17, 2026, 4:28:47 PM)

5gc: Update details on missing open5gs 5GC features

Change-Id: I7be0bbb70207ac6c0ff77f230da56aace29c1eda
Pau Espin Pedrol at

#26972 (Feb 17, 2026, 4:24:07 PM)

5gc: Update details on missing open5gs 5GC features

Change-Id: I7be0bbb70207ac6c0ff77f230da56aace29c1eda
Pau Espin Pedrol at

#26971 (Feb 17, 2026, 1:32:57 PM)

ttcn3-asterisk-ims-ue-test: show trace on coredump

Use wrapper_core_bt_on_error.sh to show a backtrace in case asterisk
crashes and a coredump is generated. Set CWD to /data, so the core and
core.backtrace files end up in the jenkins artifacts.

The result looks like this (forced a segfault in main() to test this):
  $ cat asterisk-ipv4/core.backtrace
  [New LWP 18]
  [Thread debugging using libthread_db enabled]
  Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
  Core was generated by `/usr/sbin/asterisk -C /etc/asterisk/asterisk.conf -f -g -vvvvv -ddddd'.
  Program terminated with signal SIGSEGV, Segmentation fault.
  #0  0x000073908c476ffb in ?? () from /lib/x86_64-linux-gnu/libc.so.6
  #0  0x000073908c476ffb in ?? () from /lib/x86_64-linux-gnu/libc.so.6
  #1  0x00005ba2677294dc in memset (__dest=0x0, __ch=1, __len=1) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:59
  #2  main (argc=<optimized out>, argv=0x7fff865fdd28) at asterisk.c:3839

Change-Id: Iee22cbeaa2b2c136c789afc3ebd3ec1be10a6ac7
Oliver Smith at

#26970 (Feb 17, 2026, 1:32:54 PM)

asterisk-master: use git clone --depth=1

Speed up cloning the big asterisk git repositories.

Change-Id: Ifc0c2375482e39ecf2f34b93cf6f02a83da29990
Oliver Smith at

#26969 (Feb 17, 2026, 1:27:49 PM)

ttcn3-asterisk-ims-ue-test: show trace on coredump

Use wrapper_core_bt_on_error.sh to show a backtrace in case asterisk
crashes and a coredump is generated. Set CWD to /data, so the core and
core.backtrace files end up in the jenkins artifacts.

The result looks like this (forced a segfault in main() to test this):
  $ cat asterisk-ipv4/core.backtrace
  [New LWP 18]
  [Thread debugging using libthread_db enabled]
  Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
  Core was generated by `/usr/sbin/asterisk -C /etc/asterisk/asterisk.conf -f -g -vvvvv -ddddd'.
  Program terminated with signal SIGSEGV, Segmentation fault.
  #0  0x000073908c476ffb in ?? () from /lib/x86_64-linux-gnu/libc.so.6
  #0  0x000073908c476ffb in ?? () from /lib/x86_64-linux-gnu/libc.so.6
  #1  0x00005ba2677294dc in memset (__dest=0x0, __ch=1, __len=1) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:59
  #2  main (argc=<optimized out>, argv=0x7fff865fdd28) at asterisk.c:3839

Change-Id: Iee22cbeaa2b2c136c789afc3ebd3ec1be10a6ac7
Oliver Smith at

#26968 (Feb 17, 2026, 1:27:45 PM)

asterisk-master: use git clone --depth=1

Speed up cloning the big asterisk git repositories.

Change-Id: Ifc0c2375482e39ecf2f34b93cf6f02a83da29990
Oliver Smith at

#26967 (Feb 17, 2026, 1:27:41 PM)

common/wrapper_core_bt_on_error: import

Import this script from osmo-ci dfa9fcca
("scripts/wrapper_core_bt_on_error: new script"), so it can be used in
ttcn3-asterisk-ims-ue-test in a follow-up patch.

Change-Id: I773ff8b8c07c96e1b5b417fa28518ac7dc2e14ec
Oliver Smith at

#26966 (Feb 17, 2026, 9:12:13 AM)

Fix/change TC_tcap_loadshare_ipa_tcap_udts()

The behaviour changed to not reject tcap messages outside of any valid
route. Change the test expectation that these messages are indeed
forwarded.

Change-Id: Ibffa98702fd6eb276410630ab525d986fa0f36e0
dwillmann at

#26965 (Feb 17, 2026, 8:08:49 AM)

libgsmhr/fetch_sources: fix download from 3gpp.org

Fix that the script gets a 403 forbidden error since 2026-01-26. Set a
user-agent string and switch the protocol to https while at it.

Change-Id: I5679bc519e7891e3342d8e78c11bf5eb6b44a217
Oliver Smith at

#26964 (Feb 17, 2026, 7:57:30 AM)

libgsmhr/fetch_sources: set protocol to https

The http version gives a 403 forbidden error since 2026-01-26.

Change-Id: I5679bc519e7891e3342d8e78c11bf5eb6b44a217
Oliver Smith at

#26963 (Feb 17, 2026, 12:49:10 AM)

rspro_server: fix releasing timed out clients

Fix crash on reconnects of clients if they timed out.

The duplicate check will use conn->peer of the old peer,
but conn->peer is NULL because rspro_client_conn_destroy() never destroys
the connection if conn->peer is valid when rspro_client_conn_destroy() is called.

void rspro_client_conn_destroy(conn)
{
if (conn->peer) {
peer = conn->peer;
conn->peer = NULL;
osmo_stream_srv_destroy(peer); /* calls sock_closed_cb()
}
[..]
}

int sock_closed_cb(peer)
{
[..]
if (conn->peer) {
osmo_fsm_inst_dispatch(conn->fi, CLNTC_E_TCP_DOWN, NULL); /* calls in the end rspro_client_conn_destroy() */
}
return 0;
}

Fixes: 8cfe1d808a57 ("Use new osmo_ipa_ka_fsm_inst APIs from libosmo-netif")
Related: OS#6957
Change-Id: I1f7faf5ffdd909362c492ab434b63fa7e79ada95
lynxis at

#26962 (Feb 16, 2026, 5:40:00 PM)

hnbgw: Introduce test TC_pfcp_heartbeat_recovery_timestamp

Related: SYS#7294
Change-Id: I3f8098d7a34666961437fecc5100422a5e7436a4
Pau Espin Pedrol at

#26961 (Feb 16, 2026, 4:20:47 PM)

pfcp: Trigger assoc_cb(false) upon Recovery Timestamp change

Signal cp_peer becomes disassociated to the user when the recovery
timestamp value changes.
The library will automatically try to re-associate after signalling the
association change.

Related: SYS#7294
Change-Id: I5400ae9c2f00b3c87a73aef5cebba67cf9434477
Pau Espin Pedrol at

#26960 (Feb 16, 2026, 3:52:27 PM)

hnbgw: introduce test TC_pfcp_heartbeat_timeout

Related: SYS#7294
Change-Id: I1e0b50bc19e1fa1240274baea1e7fedd1265ffcb
Pau Espin Pedrol at

#26959 (Feb 16, 2026, 3:15:35 PM)

Tear down context_maps when UPF assoc goes down

Related: SYS#7294
Change-Id: I7dcd9114861fa8f4bf855a02c286f85083ad75fe
Pau Espin Pedrol at

#26958 (Feb 16, 2026, 3:15:32 PM)

Integrate mgw/mgcp failures more tightly into context_map fsm

Similar to what we already do in RAN/CN link lost.
As a result, we now trigger RLSD instead of Iu RANAP Release Req, which
adequates better to the level where hnbgw is espected to operate.

Change-Id: Ief051e1384d2282708302dc1756454d8f88a6fae
Pau Espin Pedrol at

#26957 (Feb 16, 2026, 3:14:29 PM)

hnbgw: TC_rab_assign_mgcp_to: Allow hnbgw to tear down CN conn at SCCP level

Newer versions of osmo-hnbgw will be tearing down the CN conn at SCCP
level by transmitting an RLSD in this scenario, instead of sending a Iu
RANAP Release Request crafted by the osmo-hnbgw itself.
The HNBGW is expected to forward RANAP messages between UE/HNB and CN,
not to generate them.

Related: SYS#7294
Change-Id: Idb062a072c7403442ce981c6c9caeb7effb86554
Pau Espin Pedrol at

#26956 (Feb 16, 2026, 3:14:25 PM)

hnbgw: introduce test TC_pfcp_heartbeat_timeout

Related: SYS#7294
Change-Id: I1e0b50bc19e1fa1240274baea1e7fedd1265ffcb
Pau Espin Pedrol at

#26955 (Feb 16, 2026, 2:32:49 PM)

bts: as_rsl_meas_res(): tolerate low RxLev in early reports

The MS is not guaranteed to begin transmitting immediately after
activation of the respective logical channel.  There is typically a
short interval during which the BTS receives no bursts.  Consequently,
the initial RSL measurement reports are expected to indicate poor
RxLev/RxQual values.

We already tolerate bad RxQual values;  however, sporadic failures
still occur due to low RxLev in the very first report.  Extend the
logic in f_build_meas_res_tmpl() to tolerate low RxLev as well.

Change-Id: Ic632917d429ec597dba524bf79749944cf1fc628
Related: 8ce558dd ("bts: as_rsl_meas_res(): tolerate bad RxQual in early reports")
Related: OS#6933
Vadim Yanitskiy at

#26954 (Feb 16, 2026, 2:32:45 PM)

Makefile: clean-logs: also remove *.merged

Change-Id: I6efe839ae2d527387b533fd110965335c0f850c9
Vadim Yanitskiy at

#26953 (Feb 16, 2026, 11:19:06 AM)

cp_peer: Implement local originated heartbeat procedure

Submit PFCP Hearbeat Request with configured interval,
and timeout after no PFCP Hearbeat Response received based on
configuration.

Upon timeout, the cp_peer assoc_cb() is called to notify the user that
the peer is considered not associated anymore. It will then try to
keep associating again automatically.

Default value for OSMO_PFCP_TIMER_HEARTBEAT_RESP is increased to 35s to
allow for a single Heartbeat Request packet loss.

Related: SYS#7294
Change-Id: I7efc0961e1ea39dd7f4cc6ba96be4cf5ce9a2d6c
Pau Espin Pedrol at

#26952 (Feb 16, 2026, 11:19:02 AM)

Move struct osmo_pfcp_endpoint to pfcp_endpoint_private.h

Similar to what we have with pfcp_cp_peer_private.h.

Change-Id: Id3dcd1c2e086d40bbc7060d5e89aed5ee18249e1
Pau Espin Pedrol at

#26951 (Feb 16, 2026, 10:54:01 AM)

xua_asp_fsm: Validate remote ASP Id matching config in SG role

The node in SG role really doesn't have an ASP Id of its own (it is
never sent over the wire). Hence, use the "asp-identifier <N>" VTY
config in SG role to require the ASP to identify itself with a given
ASP identifier.

Related: OS#6953
Change-Id: I3e22439aa7e22f7a6113b093c44ace6745c808b9
Pau Espin Pedrol at

#26950 (Feb 16, 2026, 10:41:56 AM)

xua_asp_fsm: Validate remote ASP Id matching config in SG role

The node in SG role really doesn't have an ASP Id of its own (it is
never sent over the wire). Hence, use the "asp-identifier <N>" VTY
config in SG role to require the ASP to identify itself with a given
ASP identifier.

Related: OS#6953
Change-Id: I3e22439aa7e22f7a6113b093c44ace6745c808b9
Pau Espin Pedrol at

#26949 (Feb 16, 2026, 10:41:52 AM)

cosmetic: xua_as_fsm: Fix mixed brace/no-brace blocks in if/else

Change-Id: Ibfd818d354c09409b04b392853f544a220de3a72
Pau Espin Pedrol at

#26948 (Feb 16, 2026, 10:41:48 AM)

asp: Introduce asp->assoc_as_list

This way we can iterate easily/quickly the AS served by a given ASP.
This in turn allows simplifying some code since we cache the amount of
AS served by the ASP at any time, so we save some counting.

Related: SYS#6953
Change-Id: I1ca90748286374109dbb4277cbc7b2337ce2072a
Pau Espin Pedrol at

#26947 (Feb 16, 2026, 10:41:43 AM)

tests/vty: Introduce testASPservesTonsOfAS

Change-Id: I39016a479fde7d61b7c0f39ca769cd8c958b55b6
Pau Espin Pedrol at

#26946 (Feb 16, 2026, 10:41:40 AM)

tests/vty: Introduce testTonsOfASP

Add test to validate tons of ASPs (1000) can be configured, all serving
one given AS.

Related: SYS#7519
Change-Id: I9bfcfcbea3c4cec0e6284ae59d30670fcf3ccac4
Pau Espin Pedrol at

#26945 (Feb 16, 2026, 10:41:36 AM)

Allow configuring local ASP Identifier

If configured, it will be transmitted during ASP UP and ASP UP ACK.
This may be needed if facing an SG/IPSP peer who requires ASP Identifier
to be set.

Related: OS#6953
Change-Id: Ib94d542f940e13d5c007bc3319e7dde65cf81f12
Pau Espin Pedrol at

#26944 (Feb 16, 2026, 10:41:33 AM)

Introduce struct osmo_ss7_as_asp_assoc

This new struct allows supporting unlimited number of ASPs per AS.
It can also potentially be used in the future to:
* Hold M3UA "ASP Identifier" per AS<->ASP association
* Speed up iterating over AS served by a given ASP.

NOTE: Having >16 ASPs per AS may not be desirable, for instance under
loadshare traffic mode ITU SLS is 4 bit, so despite having ext_sls
extending the table to 128 entries based on OPC, it may not provide
enough entropy to properly loadshare among all of them.

Related: OS#7519
Change-Id: I149ab467899633ac50cba3e482b2cae02124279d
Pau Espin Pedrol at

#26943 (Feb 16, 2026, 10:41:30 AM)

xua_default_lm_fsm: Submit RKM REG REQ for all AS in ASP

So far only the first rctx (AS) was being registered.
This fixes RKM for ASPs serving multiple AS in ASP/IPSP role.

Relted: OS#6943
Change-Id: I932c1b05dfd37fd7b89adea0d1ea59a5dc6138b4
Pau Espin Pedrol at

#26942 (Feb 16, 2026, 10:41:27 AM)

xua_asp_fsm: Error on ASP UP (ACK) with non-unique ASP Identifier

Following RFC4666:
"""
   The "Invalid ASP Identifier" error is sent by an SGP in response to
   an ASP Up message with an invalid (i.e., non-unique) ASP Identifier
"""

Change-Id: I2d422acaa2f04c7d1eebd92c3185c4f5476a1789
Pau Espin Pedrol at

#26941 (Feb 16, 2026, 10:41:23 AM)

ss7_as: Optimize ASP Tx selection in Override traffic mode

Cache the last selected ASP, and expect it to still be the active ASP
most of the time until it changes.

Change-Id: I3d480d23591f4bd216293be60b22389b182fd8f3
Pau Espin Pedrol at

#26940 (Feb 16, 2026, 10:41:18 AM)

ss7_as: Optimize ss7_as_asp_assoc_find()

Look for counterpart on the object with the shortest list, ie. convert
from O(N) to O(min(N,M)).
This way eg. if we have 100 ASPs on 1 AS, lookup time becomes O(1).
Same if we have eg. 1 ASP serving 100 AS.

Change-Id: I139aede15af6b6a77d19e6fcf6b6abe8ed6599a6
Pau Espin Pedrol at

#26939 (Feb 16, 2026, 10:41:12 AM)

xua_asp_fsm: Remove obvious comments

Those can already be interpretred directly by the ENSURE_* macros.
No need to clog the file with more lines describing stuff.

Change-Id: Idec06646c48fbce4cbe200e88f987dfb3e9d5a39
Pau Espin Pedrol at

#26938 (Feb 16, 2026, 10:38:39 AM)

xua_as_fsm: Remove TODO no longer valid

Routing Context is filled in in fill_notify_route_ctx().

Take the chance to move the logging a bit up in the function, to have
all npar filling together.

Change-Id: I57af18dacc0470d36ddd4705a9530bd44b31f9c0
Pau Espin Pedrol at

#26937 (Feb 16, 2026, 10:35:18 AM)

m3ua: Fix missing break in m3a_rx_snm for IPSP

Fixes: e597f08dde51361434a027dc4362a5698220afb6
Change-Id: I387794b0a736ee8419e7d12dc0f586aa30b9ac26
Pau Espin Pedrol at

#26936 (Feb 16, 2026, 5:10:00 AM)

Fixed PDP QoS return length and terminal reconnection issues.

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26935 (Feb 16, 2026, 5:09:29 AM)

Fixed PDP QoS return length and terminal reconnection issues.

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26934 (Feb 16, 2026, 5:07:09 AM)

Fixed PDP QoS return length and terminal reconnection issues.

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26933 (Feb 16, 2026, 5:06:44 AM)

Fixed PDP QoS return length and terminal reconnection issues.

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26932 (Feb 15, 2026, 5:25:50 PM)

personalization: add param_source.py, add batch.py

Implement pySim.esim.saip.batch.BatchPersonalization,
generating N eSIM profiles from a preset configuration.

Batch parameters can be fed by a constant, incrementing, random or from
CSV rows: add pySim.esim.saip.param_source.* classes to feed such input
to each of the BatchPersonalization's ConfigurableParameter instances.

Related: SYS#6768
Change-Id: I497c60c101ea0eea980e8b1a4b1f36c0eda39002

rather move BatchPersonalization to separate module

Change-Id: I01ae40a06605eb205bfb409189fcd2b3a128855a
Neels Hofmeyr at

#26931 (Feb 15, 2026, 5:25:48 PM)

personalization: indicate default ParamSource per ConfigurableParameter

Add default_source class members pointing to ParamSource classes to all
ConfigurableParameter subclasses.

This is useful to automatically set up a default ParamSource for a given
ConfigurableParameter subclass, during user interaction to produce a
batch personalization.

For example, if the user selects a Pin1 parameter, a calling program can
implicitly set this to a RandomDigitSource, which will magically make it
work the way that most users need.

BTW, default_source and default_value can be combined to configure a
matching ParamSource instance:

  my_source = MyParam.default_source.from_str( MyParam.default_value )

Change-Id: Ie58d13bce3fa1aa2547cf3cee918c2f5b30a8b32
Neels Hofmeyr at

#26930 (Feb 15, 2026, 5:25:46 PM)

personalization: implement reading back values from a PES

Implement get_values_from_pes(), the reverse direction of apply_val():
read back and return values from a ProfileElementSequence. Implement for
all ConfigurableParameter subclasses.

Future: SdKey.get_values_from_pes() is reading pe.decoded[], which works
fine, but I07dfc378705eba1318e9e8652796cbde106c6a52 will change this
implementation to use the higher level ProfileElementSD members.

Implementation detail:

Implement get_values_from_pes() as classmethod that returns a generator.
Subclasses should yield all occurences of their parameter in a given
PES.

For example, the ICCID can appear in multiple places.
Iccid.get_values_from_pes() yields all of the individual values. A set()
of the results quickly tells whether the PES is consistent.

Rationales for reading back values:

This allows auditing an eSIM profile, particularly for producing an
output.csv from a batch personalization (that generated lots of random
key material which now needs to be fed to an HLR...).

Reading back from a binary result is more reliable than storing the
values that were fed into a personalization.
By auditing final DER results with this code, I discovered:
- "oh, there already was some key material in my UPP template."
- "all IMSIs ended up the same, forgot to set up the parameter."
- the SdKey.apply() implementations currently don't work, see
  I07dfc378705eba1318e9e8652796cbde106c6a52 for a fix.

Change-Id: I234fc4317f0bdc1a486f0cee4fa432c1dce9b463
Neels Hofmeyr at

#26929 (Feb 15, 2026, 5:25:43 PM)

personalization: allow reading back multiple values from PES

Change-Id: Iecb68af7c216c6b9dc3add469564416b6f37f7b2
Neels Hofmeyr at

#26928 (Feb 15, 2026, 5:10:00 PM)

MilenageRotationConstants: set example_input to 3GPP default

Change-Id: I36a9434b2f96d26d710f489d5afce1f0ef05bba1
Neels Hofmeyr at

#26927 (Feb 13, 2026, 2:44:57 PM)

pySim.esim.saip.File: Support pinStatusTemplateDO + lcsi

The tuples defining a DF or ADF in an eSIM template must contain a
pinStatusTemplateDO.  When parsing tuples into a File() instance, we
must save it, and re-create it at the time we re-encode that file.

Same applies to the lcsi (life cycle state indicator), which may
optionally exist for any file.

Change-Id: I073aa4374f2cd664d07fa0224bf0d4c809cdf4aa
Closes: OS#6955
laforge at

#26926 (Feb 13, 2026, 1:14:05 PM)

WIP: hnbgw: introduce test TC_pfcp_heartbeat_timeout

Related: SYS#7294
Change-Id: I1e0b50bc19e1fa1240274baea1e7fedd1265ffcb
Pau Espin Pedrol at

#26925 (Feb 13, 2026, 12:59:52 PM)

cp_peer: Implement local originated heartbeat procedure

Submit PFCP Hearbeat Request with configured interval,
and timeout after no PFCP Hearbeat Response received based on
configuration.

Upon timeout, the cp_peer assoc_cb() is called to notify the user that
the peer is considered not associated anymore. It will then try to
keep associating again automatically.

Related: SYS#7294
Change-Id: I7efc0961e1ea39dd7f4cc6ba96be4cf5ce9a2d6c
Pau Espin Pedrol at

#26924 (Feb 13, 2026, 8:54:18 AM)

xua_asp_fsm: Error on ASP UP (ACK) with non-unique ASP Identifier

Following RFC4666:
"""
   The "Invalid ASP Identifier" error is sent by an SGP in response to
   an ASP Up message with an invalid (i.e., non-unique) ASP Identifier
"""

Change-Id: I2d422acaa2f04c7d1eebd92c3185c4f5476a1789
Pau Espin Pedrol at

#26923 (Feb 13, 2026, 8:54:15 AM)

xua_asp_fsm: Remove obvious comments

Those can already be interpretred directly by the ENSURE_* macros.
No need to clog the file with more lines describing stuff.

Change-Id: Idec06646c48fbce4cbe200e88f987dfb3e9d5a39
Pau Espin Pedrol at

#26922 (Feb 13, 2026, 8:54:12 AM)

xua_asp_fsm: Validate remote ASP Id matching config in SG role

The node in SG role really doesn't have an ASP Id of its own (it is
never sent over the wire). Hence, use the "asp-identifier <N>" VTY
config in SG role to require the ASP to identify itself with a given
ASP identifier.

Related: OS#6953
Change-Id: I3e22439aa7e22f7a6113b093c44ace6745c808b9
Pau Espin Pedrol at

#26921 (Feb 13, 2026, 8:54:10 AM)

cosmetic: xua_as_fsm: Fix mixed brace/no-brace blocks in if/else

Change-Id: Ibfd818d354c09409b04b392853f544a220de3a72
Pau Espin Pedrol at

#26920 (Feb 13, 2026, 8:52:52 AM)

Allow configuring local ASP Identifier

If configured, it will be transmitted during ASP UP and ASP UP ACK.
This may be needed if facing an SG/IPSP peer who requires ASP Identifier
to be set.

Related: OS#6953
Change-Id: Ib94d542f940e13d5c007bc3319e7dde65cf81f12
Pau Espin Pedrol at

#26919 (Feb 12, 2026, 4:05:45 PM)

xua_asp_fsm: Validate remote ASP Id matching config in SG role

The node in SG role really doesn't have an ASP Id of its own (it is
never sent over the wire). Hence, use the "asp-identifier <N>" VTY
config in SG role to require the ASP to identift itself with a given
ASP identifier.

Related: OS#6953
Change-Id: I3e22439aa7e22f7a6113b093c44ace6745c808b9
Pau Espin Pedrol at

#26918 (Feb 12, 2026, 3:24:00 PM)

cosmetic: xua_as_fsm: Fix mixed brace/no-brace blocks in if/else

Change-Id: Ibfd818d354c09409b04b392853f544a220de3a72
Pau Espin Pedrol at

#26917 (Feb 12, 2026, 3:22:40 PM)

xua_asp_fsm: Error on ASP UP (ACK) with non-unique ASP Identifier

Following RFC4666:
"""
   The "Invalid ASP Identifier" error is sent by an SGP in response to
   an ASP Up message with an invalid (i.e., non-unique) ASP Identifier
"""

Change-Id: I2d422acaa2f04c7d1eebd92c3185c4f5476a1789
Pau Espin Pedrol at

#26916 (Feb 12, 2026, 2:49:20 PM)

xua_asp_fsm: Remove obvious comments

Those can already be interpretred directly by the ENSURE_* macros.
No need to clog the file with more lines describing stuff.

Change-Id: Idec06646c48fbce4cbe200e88f987dfb3e9d5a39
Pau Espin Pedrol at

#26915 (Feb 12, 2026, 1:26:17 PM)

Allow configuring local ASP Identifier

If configured, it will be transmitted during ASP UP and ASP UP ACK.
This may be needed if facing an SG/IPSP peer who requires ASP Identifier
to be set.

Related: OS#6953
Change-Id: Ib94d542f940e13d5c007bc3319e7dde65cf81f12
Pau Espin Pedrol at

#26914 (Feb 12, 2026, 12:49:04 PM)

xua_as_fsm: Remove TODO no longer valid

Routing Context is filled in in fill_notify_route_ctx().

Take the chance to move the logging a bit up in the function, to have
all npar filling together.

Change-Id: I57af18dacc0470d36ddd4705a9530bd44b31f9c0
Pau Espin Pedrol at

#26913 (Feb 12, 2026, 11:37:50 AM)

xua_default_lm_fsm: Submit RKM REG REQ for all AS in ASP

So far only thre first rctx (AS) was being registered.
This fixes RKM for ASPs serving multiple AS in ASP/IPSP role.

Relted: OS#6943
Change-Id: I932c1b05dfd37fd7b89adea0d1ea59a5dc6138b4
Pau Espin Pedrol at

#26912 (Feb 12, 2026, 11:25:23 AM)

ss7_as: Optimize ss7_as_asp_assoc_find()

Look for counterpart on the object with the shortest list, ie. convert
from O(N) to O(min(N,M)).
This way eg. if we have 100 ASPs on 1 AS, lookup time becomes O(1).
Same if we have eg. 1 ASP serving 100 AS.

Change-Id: I139aede15af6b6a77d19e6fcf6b6abe8ed6599a6
Pau Espin Pedrol at

#26911 (Feb 12, 2026, 11:25:20 AM)

asp: Introduce asp->assoc_as_list

This way we can iterate easily/quickly the AS served by a given ASP.
This in turn allows simplifying some code since we cache the amount of
AS served by the ASP at any time, so we save some counting.

Related: SYS#6953
Change-Id: I1ca90748286374109dbb4277cbc7b2337ce2072a
Pau Espin Pedrol at

#26910 (Feb 12, 2026, 11:06:14 AM)

WIP: asp: Introduce asp->assoc_as_list

Related: SYS#6953
Change-Id: I1ca90748286374109dbb4277cbc7b2337ce2072a
Pau Espin Pedrol at

#26909 (Feb 12, 2026, 11:06:10 AM)

ss7_as: Optimize ss7_as_asp_assoc_find()

Look for counterpart on the object with the shortest list, ie. convert
from O(N) to O(min(N,M)).
This way eg. if we have 100 ASPs on 1 AS, lookup time becomes O(1).
Same if we have eg. 1 ASP serving 100 AS.

Change-Id: I139aede15af6b6a77d19e6fcf6b6abe8ed6599a6
Pau Espin Pedrol at

#26908 (Feb 12, 2026, 10:33:54 AM)

tests/vty: Introduce testTonsOfASP

Add test to validate tons of ASPs (1000) can be configured, all serving
one given AS.

Related: SYS#7519
Change-Id: I9bfcfcbea3c4cec0e6284ae59d30670fcf3ccac4
Pau Espin Pedrol at

#26907 (Feb 12, 2026, 10:33:50 AM)

Introduce struct osmo_ss7_as_asp_assoc

This new struct allows supporting unlimited number of ASPs per AS.
It can also potentially be used in the future to:
* Hold M3UA "ASP Identifier" per AS<->ASP association
* Speed up iterating over AS served by a given ASP.

NOTE: Having >16 ASPs per AS may not be desirable, for instance under
loadshare traffic mode ITU SLS is 4 bit, so despite having ext_sls
extending the table to 128 entries based on OPC, it may not provide
enough entropy to properly loadshare among all of them.

Related: OS#7519
Change-Id: I149ab467899633ac50cba3e482b2cae02124279d
Pau Espin Pedrol at

#26906 (Feb 12, 2026, 10:33:48 AM)

ss7_as: Optimize ASP Tx selection in Override traffic mode

Cache the last selected ASP, and expect it to still be the active ASP
most of the time until it changes.

Change-Id: I3d480d23591f4bd216293be60b22389b182fd8f3
Pau Espin Pedrol at

#26905 (Feb 12, 2026, 10:32:42 AM)

tests/vty: Introduce testASPservesTonsOfAS

Change-Id: I39016a479fde7d61b7c0f39ca769cd8c958b55b6
Pau Espin Pedrol at

#26904 (Feb 11, 2026, 4:36:37 PM)

tests/vty: Introduce testASPservesTonsOfAS

Change-Id: I39016a479fde7d61b7c0f39ca769cd8c958b55b6
Pau Espin Pedrol at

#26903 (Feb 11, 2026, 4:10:04 PM)

tests/vty: Introduce testTonsOfASP

Add test to validate tons of ASPs (1000) can be configured, all serving
one given AS.

Related: SYS#7519
Change-Id: I9bfcfcbea3c4cec0e6284ae59d30670fcf3ccac4
Pau Espin Pedrol at

#26902 (Feb 11, 2026, 3:30:44 PM)

ss7_as: Optimize ASP Tx selection in Override traffic mode

Cache the last selected ASP, and expect it to still be the active ASP
most of the time until it changes.

Change-Id: I3d480d23591f4bd216293be60b22389b182fd8f3
Pau Espin Pedrol at

#26901 (Feb 11, 2026, 1:12:29 PM)

msc: TC_ho_inter_bsc: wait for the target BSC to become ready

A race condition may occur between the two testcase components
emulating BSCs: the source BSC initiates handover to the terget
BSC before the later completes connection establishment with the
MSC.  In this case, the MSC fails to find the target peer and
rejects our HandoverRequired with HandoverRequiredReject.

  Target RAN peer from neighbor config is not connected: Cell ID CGI:023-42-5-6 resolves to target address 0.24.2
  Cannot find target peer for cell ID CGI:023-42-5-6
  Attempted Handover to 1 cells without success

Let's avoid this by waiting for the target BSC to become available
before initiating the handover procedure.  Use the COORD port
("intercom") to signal readiness of the target BSC.

Change-Id: I00b8a8b89ec7bb15590d30aadf40055981375a5d
Related: OS#6951
Vadim Yanitskiy at

#26900 (Feb 11, 2026, 12:49:54 PM)

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26899 (Feb 11, 2026, 12:48:39 PM)

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26898 (Feb 11, 2026, 12:46:57 PM)

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26897 (Feb 11, 2026, 12:45:43 PM)

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26896 (Feb 11, 2026, 10:29:53 AM)

msc: f_tc_ho_inter_bsc0(): catch BSSMAP HandoverRequiredReject

It may happen that the target BSC is not yet connected to the MSC.
In this case the MSC rejects handover with HandoverRequiredReject.
Let's catch this PDU to make the verdict cleaner in such case.

Change-Id: I5ba98e323e0c7794554ccb115d7697ad03ccbfa5
Vadim Yanitskiy at

#26895 (Feb 11, 2026, 5:20:14 AM)

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26894 (Feb 10, 2026, 5:09:03 PM)

Introduce struct osmo_ss7_as_asp_assoc

This new struct allows supporting unlimited number of ASPs per AS.
It can also potentially be used in the future to:
* Hold M3UA "ASP Identifier" per AS<->ASP association
* Speed up iterating over AS served by a given ASP.

NOTE: Having >16 ASPs per AS may not be desirable, for instance under
loadshare traffic mode ITU SLS is 4 bit, so despite having ext_sls
extending the table to 128 entries based on OPC, it may not provide
enough entropy to properly loadshare among all of them.

Related: OS#7519
Change-Id: I149ab467899633ac50cba3e482b2cae02124279d
Pau Espin Pedrol at

#26893 (Feb 10, 2026, 3:41:36 PM)

Some older modules, such as the Air20X module, may crash during PDP attachment due to excessively long QoS response packets.
If the PDP is not released after successful attachment, the module will restart, and subsequent TCP connections will fail.

Related: OS#6922
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
canghaiwuhen at

#26892 (Feb 10, 2026, 3:08:40 PM)

cosmetic: ss7_asp.h: Drop comment no longer valid

Since a while ago, remote asp ID is stored in asp->remote_asp_id.

Fixes: b8fe5e4a1adfb54f265efc81432eab6252e9b04f
Change-Id: I2253b1cb9e24270b9d6b3400d3fa20827c66ad23
Pau Espin Pedrol at

#26891 (Feb 10, 2026, 1:11:21 PM)

compile_asn1_subdir: filter compiled files by .asn suffix

When I open the .asn file in vim, pySim should not attempt to read the
vim .swp file as asn.1.

  File "/home/moi/osmo-dev/src/pysim/pySim/esim/saip/__init__.py", line 45, in <module>
    asn1 = compile_asn1_subdir('saip')
[...]
  File "<frozen codecs>", line 325, in decode
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xad in position 21: invalid start byte

Related: OS#6937
Change-Id: I37df3fc081e51e2ed2198876c63f6e68ecc8fcd8
Neels Hofmeyr at

#26890 (Feb 10, 2026, 1:01:38 PM)

xua_snm: assert for unexpected condition

The rx DUNA/DAVA/DUPU paths are already guarded at m3ua.c and sua.c to
only call xua_snm_rx_{duna,dava,dupu}() in ASP role. Hence, calling
those functions is expected to always happen in ASP role.

Change-Id: I24bb335a2a856bf1a5ca255f7afbfe103ebcd86f
Pau Espin Pedrol at

#26889 (Feb 10, 2026, 1:01:23 PM)

xua_snm: assert for unexpected condition

The rx DUNA/DAVA/DUPU paths are already guarded at m3ua.c and sua.c to
only call xua_snm_rx_{duna,dava,dupu}() in ASP role. Hence, calling
those functions is expected to always happen in ASP role.

Change-Id: I24bb335a2a856bf1a5ca255f7afbfe103ebcd86f
Pau Espin Pedrol at

#26888 (Feb 10, 2026, 12:47:20 PM)

xua: Improve logging around unexpected snm messages

Log rx of unexpected message type according to configured role.
Decrease verbosity of DAUD logging to match the new logging.

For SUA we can use M3UA's m3ua_snm_msgt_names because the value/strings
are the same and they are actually used through m3ua_msg_class_snm in
xua_dialect_sua.

Change-Id: I697e52dfd733cb9ee260bba133204a7462c4e8ee
Pau Espin Pedrol at

#26887 (Feb 10, 2026, 12:43:28 PM)

esim/http_json_api: add alternative API interface (follow up)

This is a follow up patch to change:
I2a5d4b59b12e08d5eae7a1215814d3a69c8921f6

- do not ignore length of kwargs
- fix role parameter (roles other than 'legacy_client' can be used now)
- use startswith instead of match

Related: SYS#7866
Change-Id: Ifae13e82d671ff09bddf771f063a388d2ab283eb
pmaier@sysmocom.de at

#26886 (Feb 10, 2026, 12:32:39 PM)

xua: Allow rx DAUD in IPSP with quirk daud_in_asp

That quirk was added back in time most probably when interacting with
some peer who claimed to be in SG mode but actually was in IPSP mode.
Hence, to be on the safe side, be relaxed and allow accepting DAUD also
if the quirk is added, otherwise it may be impossible to continue
communication with that faulty peer.
In theory according to spec DAUD should only be sent ASP->SG.

Change-Id: I8ad0889f4584446f8b01f1255498f57e0cd34012
Pau Espin Pedrol at

#26885 (Feb 10, 2026, 12:31:01 PM)

jobs/build-kernels-testenv: use linux-shallow-clone

Related: OS#6938
Change-Id: I8cb2acfaf585b9f92347a4562525a66ed03b0236
Oliver Smith at

#26884 (Feb 10, 2026, 12:30:59 PM)

scripts/kernel/linux-shallow-clone: new script

Add a script that maintains a linux repository in one place on jenkins
nodes, so we need less git clones from git.kernel.org and less disk
space. All jobs that need a kernel tree can now clone the relevant
branch directly from the jenkins node.

Follow up patches will add a jenkins job that runs the script daily and
adjust the existing jobs to make use of this instead of doing their own
clones.

Currently this script produces a 396M bare git repository.

Related: OS#6938
Change-Id: Id3aadb46813047ecac3b80868192809b272dba0e
Oliver Smith at

#26883 (Feb 10, 2026, 12:30:57 PM)

jobs/linux-shallow-clone: new jenkins job

Related: OS#6938
Change-Id: Ia58cdc82a655d4cc772a84adb675e98961bf86c5
Oliver Smith at

#26882 (Feb 10, 2026, 12:30:55 PM)

jobs/master-builds-dahdi: use linux-shallow-clone

Related: OS#6938
Change-Id: Iea0af6259bd481c946ff72d6552b65668fd809ca
Oliver Smith at

#26881 (Feb 10, 2026, 12:30:52 PM)

jobs/gerrit-verifications-dahdi: use linux-shallow-clone

Related: OS#6938
Change-Id: Ie8d9be886cc1d089e015f03bcedf0307f4f312e4
Oliver Smith at

#26880 (Feb 10, 2026, 10:36:26 AM)

pySim-shell_test/euicc: ensure test-profile is enabled

When testing commands like get_profile_info, enable_profile,
disable_profile or the commands to manage notifications, we
should ensure that the correct profile is enabled before
executing the actual testcase.

Change-Id: Ie57b0305876bc5001ab3a9c3a3b5711408161b74
pmaier@sysmocom.de at

#26879 (Feb 9, 2026, 5:31:58 PM)

sua: Support rx SCON in role=SG

Change-Id: Ide2b4f876ddbdb1bb0bfed11fad6fc13aaf1afda
Pau Espin Pedrol at

#26878 (Feb 9, 2026, 5:31:55 PM)

sua: Support rx SCON in role=ASP

Change-Id: I1e4146c2cb8fab460d5e810b602c20293272c2e4
Pau Espin Pedrol at

#26877 (Feb 9, 2026, 5:31:00 PM)

sua: Support rx SCON in role=IPSP

Change-Id: I3f46b634084c1d71643812828d4f114ab45dffde
Pau Espin Pedrol at

#26876 (Feb 9, 2026, 4:37:18 PM)

xua_aspm_fsm: Remove unneeded workaround submitting XUA_ASP_E_M_ASP_ACTIVE_REQ

Sending that kind of event is up to the layer manager.
Right now, all ASPs (except ipa_aspm_fsm, which don't need that event
because there's no ACTIVATE in IPA) have an associated layer manager
FSM, so that workaround is not needed.

Change-Id: If6c2c5b6ffc4080320aadc550d823abc5d613d6f
Pau Espin Pedrol at

#26875 (Feb 9, 2026, 4:29:18 PM)

xua_as_fsm: Trigger PC (un)availability to upper layers in IPSP

Same as done in ASP. This is specially important in IPSP in order to
trigger availability/unavailability of PCs defined in the SCCP
addressbook.

Change-Id: I0e6015f04ad0647cc151d3c772355a18cb55547a
Pau Espin Pedrol at

#26874 (Feb 9, 2026, 2:25:07 PM)

logging: Support nonblocking-io for log target stderr & file, make it default

The nonblocking-io used to be the mode used until recently, where wq
only was used if the write buffer was full.
This is more performant that always waiting for poll() to write, plus
the fact that we write to system synchronously, hence seeing output
immediatelly or not losing it if program crashes.
Furthermore, It turns out using wq in multithreaded programs may cause
problems, so better switch back to using nonblocking-io by default.

Related: OS#6947
Change-Id: I46420f4b174d3a9ed01e993e2e89aea3b46c0dd7
Pau Espin Pedrol at

#26873 (Feb 9, 2026, 1:34:05 PM)

logging: Support nonblocking-io for log target stderr & file, make it default

The nonblocking-io used to be the mode used until recently, where wq
only was used if the write buffer was full.
This is more performant that always waiting for poll() to write, plus
the fact that we write to system synchronously, hence seeing output
immediatelly or not losing it if program crashes.
Furthermore, It turns out using wq in multithreaded programs may cause
problems, so better switch back to using nonblocking-io by default.

Related: OS#6947
Change-Id: I46420f4b174d3a9ed01e993e2e89aea3b46c0dd7
Pau Espin Pedrol at

#26872 (Feb 9, 2026, 1:00:35 PM)

logging: Support nonblocking-io for log target stderr & file, make it default

The nonblocking-io used to be the mode used until recently, where wq
only was used if the write buffer was full.
This is more performant that always waiting for poll() to write, plus
the fact that we write to system synchronously, hence seeing output
immediatelly or not losing it if program crashes.
Furthermore, It turns out using wq in multithreaded programs may cause
problems, so better switch back to using nonblocking-io by default.

Related: OS#6947
Change-Id: I46420f4b174d3a9ed01e993e2e89aea3b46c0dd7
Pau Espin Pedrol at

#26871 (Feb 9, 2026, 12:41:51 PM)

Osmocom_OBS_sync: fix failing on new scmsync tag

The openSUSE OBS instance has added an scmsync tag to their debian 13
meta config:

  <scmsync>https://src.opensuse.org/obs/debian#13</scmsync>

This feature is not supported by the stable OBS version yet (they run
current master), and so the sync fails with:

  project validation error: 6:0: ERROR: Element project has extra content: scmsync

Remove the tag to fix this.

Change-Id: Ia2d2ce3a2eeda9a0ed7ce7c7de54293081b44f4e
Oliver Smith at

#26870 (Feb 9, 2026, 12:37:42 PM)

pySim/euicc: fix encoding/decoding of Iccid

The class Iccid uses a BcdAdapter to encoded/decode the ICCID. This
works fine for ICCIDs that have an even (20) number of digits. In case
the digit count is odd (19), the ICCID the last digit requires padding.

Let's switch to PaddedBcdAdapter for encoding/decoding, to ensure that
odd-length ICCIDs are padded automatically.

Change-Id: I527a44ba454656a0d682ceb590eec6d9d0ac883a
Related: OS#6868
pmaier@sysmocom.de at

#26869 (Feb 9, 2026, 12:37:39 PM)

pySim-shell_test/euicc: ensure test-profile is enabled

When testing commands like get_profile_info, enable_profile,
disable_profile or the commands to manage notifications, we
should ensure that the correct profile is enabled before
executing the actual testcase.

Change-Id: Ie57b0305876bc5001ab3a9c3a3b5711408161b74
pmaier@sysmocom.de at

#26868 (Feb 9, 2026, 12:36:39 PM)

Add CAS channel support

CAS is currently supported by e1d driver only.

Change-Id: I81cc89e01bb4207dc899ab28f24a131f24b61c9c
Andreas Eversberg at

#26867 (Feb 9, 2026, 12:36:02 PM)

pySim/global_platform: replace deprecated argument group() creation

The global platform code used install_cap_parser.add_mutually_exclusive_group().add_argument_group()
But calling add_argument_group() on an exclusive group was never an intended feature nor
according to python docs was a working feature.

Change-Id: I4f73d3417a12b7fe94e33a265cdae244f3c9a1e9
lynxis at

#26866 (Feb 9, 2026, 11:58:35 AM)

logging: Fix print tid value in multithreadded programs

Change-Id: I363751ab1368d916aad8905b056ec4f9d62b7175
Pau Espin Pedrol at

#26865 (Feb 9, 2026, 11:36:15 AM)

osmo_io_uring: Split global init from per-thread init

osmo_iofd_init() is expected to be called per-thread, while some code in
osmo_iofd_uring_init() was only expected to be called once.

Change-Id: Ifa5c46d7532ea49869f3cfe7268fdd082906fd10
Pau Espin Pedrol at

#26864 (Feb 9, 2026, 11:36:11 AM)

osmo_io: Lazy-initialize during osmo_iofd_setup()

This way new threads (!=main) don't need to explicitly call
osmo_iofd_init() explicitly before using osmo_io. This is specially
useful for threads using osmo_io indirectly, eg, when logging.

The osmo_iofd_setup() API is really the only main API which requires
initialization. All other APIs requiring it come after osmo_iofd_setup()
since they use an osmo_iofd pointer.

Change-Id: Ia543c1b9d111c929cd9dbed266b6d21b74e47e4b
Pau Espin Pedrol at

#26863 (Feb 9, 2026, 11:04:00 AM)

osmo_io: Move function declaration to internal header

Change-Id: I25ffb94e00225bcdc565f56a3f0f7834df00e974
Pau Espin Pedrol at

#26862 (Feb 9, 2026, 11:01:39 AM)

pysim.utils.decomposeATR: Fix docutils warning

pySim/utils.py:docstring of pySim.utils.decomposeATR:9: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils]

Change-Id: Ifda4ba15014ba97634fd5bd5c9b19d9110f4670e
laforge at

#26861 (Feb 9, 2026, 11:01:37 AM)

pySim.esim.saip: Fix docstring warnings:

this fixes the following two warnings:

pySim/esim/saip/__init__.py:docstring of pySim.esim.saip.FsNode.walk:1: WARNING: Inline strong start-string without end-string. [docutils]
pySim/esim/saip/__init__.py:docstring of pySim.esim.saip.FsNodeDF.walk:1: WARNING: Inline strong start-string without end-string. [docutils]

Change-Id: Id7debf9296923b735f76623808cee68967a1ece7
laforge at

#26860 (Feb 9, 2026, 11:01:34 AM)

pySim.esim.saip.personalization: Fix docstring errors + warnings

pysim/pySim/esim/saip/personalization.py:docstring of pySim.esim.saip.personalization.ConfigurableParameter:27: ERROR: Unexpected indentation. [docutils]
pysim/pySim/esim/saip/personalization.py:docstring of pySim.esim.saip.personalization.ConfigurableParameter:29: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils]
pysim/pySim/esim/saip/personalization.py:docstring of pySim.esim.saip.personalization.ConfigurableParameter:34: ERROR: Unexpected indentation. [docutils]
pysim/pySim/esim/saip/personalization.py:docstring of pySim.esim.saip.personalization.ConfigurableParameter:35: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils]
pysim/pySim/esim/saip/personalization.py:docstring of pySim.esim.saip.personalization.ConfigurableParameter:52: ERROR: Unexpected indentation. [docutils]
pysim/pySim/esim/saip/personalization.py:docstring of pySim.esim.saip.personalization.ConfigurableParameter:53: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils]

Change-Id: I3918308856c3a1a5e6e90561c3e2a6b88040670d
laforge at

#26859 (Feb 9, 2026, 11:01:32 AM)

pySim.esim.saip.personalization: Fix docstring error

pySim/esim/saip/personalization.py:docstring of pySim.esim.saip.personalization.MilenageXoringConstants:4: ERROR: Unexpected indentation. [docutils]

Change-Id: If6ae360b7f74c095fa9075ae9aa988440496e6de
laforge at

#26858 (Feb 9, 2026, 11:00:48 AM)

pySim-shell_test/euicc: ensure test-profile is enabled

When testing commands like get_profile_info, enable_profile,
disable_profile or the commands to manage notifications, we
should ensure that the correct profile is enabled before
executing the actual testcase.

Change-Id: Ie57b0305876bc5001ab3a9c3a3b5711408161b74
pmaier@sysmocom.de at

#26857 (Feb 9, 2026, 10:43:59 AM)

pySim-shell_test/euicc: ensure test-profile is enabled

When testing commands like get_profile_info, enable_profile
or disable_profile, we should ensure that the correct profile
is enabled befor executing the actual testcase.

Change-Id: Ie57b0305876bc5001ab3a9c3a3b5711408161b74
pmaier@sysmocom.de at

#26856 (Feb 9, 2026, 10:17:33 AM)

pySim-shell_test/euicc: ensure test-profile is enabled

When testing the enable_profile / disable_profile commands we expect that
the profile we test with is enabled before the test begins. To be more
robust lets send an enable_profile command before the actual test begins.

Change-Id: Ie57b0305876bc5001ab3a9c3a3b5711408161b74
pmaier@sysmocom.de at

#26855 (Feb 9, 2026, 10:06:01 AM)

ModemATCommandLink: fix SyntaxWarning: invalid escape sequence '\+'

Change-Id: If8de5299a4dc5a8525ef6657213db95d30e3c83b
Fixes: OS#6948
Vadim Yanitskiy at

#26854 (Feb 9, 2026, 9:10:39 AM)

pySim-shell_test/euicc: fix testcase method name

We have two test_enable_disable_profile method, the second one should
be called test_set_nickname.

Change-Id: I5ff79218fdafc8c42c8b58cc00be3e56e09d808b
pmaier@sysmocom.de at