Skip to content

Loading builds...

Changes

#848 (Jul 8, 2026, 2:43:00 PM)

STP_Tests_TCAP: Fix ipa_to_ipa testcase

tcap routing doesn't work the way the test thinks. E.g. a Begin can't be
routed to a special destination because it does't contain a dtid which
is needed to route to the correct ASP.

Change-Id: Ie274232b706348b5ab6d0ac248883d86c53ebb4e
dwillmann at
STP_Tests_TCAP: Test routing of fragments in TC_tcap_loadshare_ipa_tcap_range_success_pc

A TCAP Begin will cause the stp to create a cache entry and route
according to that. Send only a TCAP Continue so we check the tcap range
routing logic.

Change-Id: I1cb47174b8f0e69970e75109b9d15b2012e150c3
dwillmann at

#847 (Jul 7, 2026, 2:43:00 PM)

library: add f_gsm_fn_{sum,sub,diff}()

Change-Id: Ie91ccef5d3f170f4a341a6cf9d3323a896b299e6
laforge at
bts: TC_pcu_interf_ind: check reporting interval instead of absolute FN

Recent osmo-bts commit 53f0ec29 broke TC_pcu_interf_ind:

  Verdict: fail reason: Odd TDMA frame number := 935

There's no requirement that periodic interference reports must land
on a TDMA frame number satisfying 'fn mod 104 == 0' - only that they
keep arriving every configured averaging period.  Instead, verify
that the interval between consecutive reports equals 104 TDMA frames
(1 SACCH period), using the new f_gsm_fn_sub() helper.

Change-Id: Ia96f2926400bae8c0a6fb8f81eb56b48ca5f2de9
Related: 53f0ec29 ("l1sap: fix duplicate RF RESOURCE INDICATION on clock bootstrap")
Vadim Yanitskiy at

#844 (Jul 4, 2026, 2:43:00 PM)

stp: for TCAP loadshare: use NI == national

Use a non-zero NI. The TCAP tests don't check it
on the receive path, but the osmo-stp is checking
it if it matches the configuration.

Related: SYS#8061
Change-Id: I51ef302ad72ff3c434fddb39006ce50106a5918f
lynxis at

#841 (Jul 1, 2026, 2:43:00 PM)

5gc: disable TC_handover_inter_ngran_xn for latest

Temporarily disable the test for latest as it is known to result in a
crash with open5gs v2.8.0.

Related: OS#7023
Change-Id: Ibf3683683093c41a85bb443e14eab23d23fefa24
Oliver Smith at

#839 (Jun 29, 2026, 2:43:00 PM)

Revert "bts: limit stderr logging to ERROR to avoid long write() to ext4 fs"

This reverts commit 3c798765f04dd7428c76e3c5cbf3f2ee27a0af4d.

Reducing logging verbosity did not help: we're still seeing the clock
skew errors and restarts.  This makes debugging harder, and is not
relevant anymore because we've switched to tmpfs [1].

Related: [1] docker-playground.git Id9a93f7149ef7e9bfde1f4fe3a8299ba46645d50
Change-Id: Id234394fda1ce752f93448e2fc03887a097f6b9d
Vadim Yanitskiy at
Revert "bts: limit stderr logging to NOTICE to avoid long write() to ext4 fs"

This reverts commit c3ab9ec33f37c6837fb8bcb0fa0bbd2e98781fb7.

Reducing logging verbosity did not help: we're still seeing the clock
skew errors and restarts.  This makes debugging harder, and is not
relevant anymore because we've switched to tmpfs [1].

Related: [1] docker-playground.git Id9a93f7149ef7e9bfde1f4fe3a8299ba46645d50
Change-Id: Ief6c3a6ca3053ccf745a186f7bb440e8540336f4
Vadim Yanitskiy at

#834 (Jun 24, 2026, 2:43:00 PM)

stp: tcap-loadshare: add TC_tcap_loadshare_m3ua_to_ipa_udts

If a TCAP message arrives which is:
* not a TCAP Begin or Abort (e.g. a TCAP Continue)
* not in the TCAP session cache/tracking
* not have a dTID for a registered TCAP Add Range

The tcap load-share will reject this message with a UDTS

Related: SYS#8061
Change-Id: I181b25aedfd70d156c08197d361560b6d055e65a
lynxis at

#828 (Jun 18, 2026, 2:43:00 PM)

CCID: Check if reader accepts highest P3 value 0xff

This test should ensure that there is no buffer overflow when receiving
large responses from SIM.

Change-Id: I298795d791f2964758bd4792e10131f92cf561bc
Andreas Eversberg at
CCID: Check if reader handles special P3 value 0x00 correctly

If data is requested from SIM with P3 set 0x00, it means that 256
bytes are requested. The reader will receive a procedure byte, which
must cause it to receive all 256 data bytes + two status words.

Change-Id: Icc3fd1937b9829fcf825c58d7b676aa2be2c48e7
Andreas Eversberg at
CCID: Check if reader restarts WWT upon NULL procedure byte

The reader will receive a NULL procedure byte every 0.2 for a long time.
The reader may only respond with a status that time extension was
requested. At the end the SIM proceeds with a valid response. This
response must be returned by the reader.

Change-Id: I4eb09e86f88df19d96e9ec55872654352ca2ebd5
Andreas Eversberg at
SIMTRACE: Increase USB receive buffer size

The maximum SIM request data can be 255 bytes. Additionally, the
SIMtrace PDU header is 14 bytes. So increase the buffer to 269 bytes.

Change-Id: I05261b4a754b4892955d0b4e426bd32be261efa7
Andreas Eversberg at
CCID: Check if reader sends request TPDU with maximum size

The maximum size of a request TPDU can have 5 bytes header and 255 bytes
data. It is expected that the reader transmits all bytes to SIM without
failure.

Change-Id: I7c1cb52b578c19d6c0ec1493e45f6ed9c43735b4
Andreas Eversberg at
CCID: Check response of reader with empty SIM carrier

The reader has a SIM carrier inserted, but there is no response from the
SIM while expecting the ATR. The reader will get a timeout and is
expected to respond with a suitable error code.

The test uses the slot with the SIMtrace inserted. The SIMtrace will not
respond with an ATR. This way there is no (extra) empty slot required
for this test.

Change-Id: Ifebdcce8f9dd9a51de5a5cb6cf223041d5c38622
Andreas Eversberg at
CCID: Add testenv.cfg to run tests using testenv

Change-Id: I97c9da414facf438aa28d5200c4152730ff763a2
Andreas Eversberg at
CCID: Check if reader times out while expecting status words

A case 1 APDU is sent toward the reader. The reader expects two status
words. If none of these are sent by the SIM the reader must timeout and
send an error message back to the host.

Change-Id: I054b56a9e2f10e5b984ad0398efb4be5696ce16c
Andreas Eversberg at

#821 (Jun 11, 2026, 2:43:00 PM)

NGAP: UESecurityCapabilities is optional in PathSwitchRequestAcknowledge

Current master branch of Open5GS includes UESecurityCapabilities IE
in PathSwitchRequestAcknowledge, older versions do not. In order to
match message of all versions, replace the IE by an an asterisk.

Change-Id: I4849709d2601505d9aa3ea6c85b718ec65540dff
Andreas Eversberg at
CCID: Update titan.TestPorts.USB to current head

Update the USB test port dependency to include recent changes and
bugfixes that are required for further CCID tests.

Change-Id: I9dd769d2098822721f673b1293542fffa46542cc
laforge at
CCID: Truncated APDU test

A SELECT APDU must have a header + two bytes of data (what to select).
The test truncates this APDU in all variants, ranging from 6 bytes down
to 0 bytes. The reader may respond with an error caused by invald
request or with and error caused by timeout of the SIM.

Change-Id: I3df2ad9871bccdd03f618a6a457671adb1624590
laforge at
SIMTRACE: Add missing pres_pol to CardEmu_BD_Config message

Change-Id: I443e8151b0aa9bff150222ab6b507ed1f7946768
laforge at
CCID: Integrate SIMTRACE emulation into test cases

This integration allows to add tests that use SIMtrace hardware instead
of a physical SIM. These tests can be used to test handling of invalid
behaviors, such as invalid responses or timeouts.

The number of slots (mp_use_slot_count) are reduced to 7, so that the
8th slot can be used with a SIMtrace for subsequent tests.

Change-Id: Ia27dd5198edb188bc73196ac3fbd6d56ba75812e
laforge at
CCID: Add test to verify a working Simtrace setup

This test checks if a valid request is forwarded to SIMtrace and a
valid response is returned back to the reader.

Change-Id: I19264bc257024e9028996e417ff23bbbaebf5f92
laforge at
CCID: Check if reader handles truncated SIM response

The reader knows how many byte of data is expected in the SIM response.
The emulated SIM will truncate that response, so that some data and the
final status words are not sent by the SIM. The tests expects the
reader to time out and return an appropriate error core.

Change-Id: I6db6d7889a1355ee9aa2005e676fed5d20a3f2dc
laforge at

#812 (Jun 2, 2026, 2:43:00 PM)

NGAP: Add UESecurityCapabilities IE to PathSwitchRequestAcknowledge

This IE is now used by Open5GS, so add it to the receive template.

This fixes C5G_Tests.TC_handover_inter_ngran_xn.

Note that there is also a pull request to fix the location of this IE in
Open5GS. (https://github.com/open5gs/open5gs/pull/4589) Without this fix
the test case will fail.

Change-Id: Ic46f201db3dcf84a7d62fb1cd17c839ef540e8bb
Andreas Eversberg at
C5G: Release UE Context before sending Service request

A recent fix in Open5GS rejects RAN_UE_NGAP_ID in InitialUEMessage. This
causes all tests to fail that send a subsequent InitialUEMessage with
the same RAN_UE_NGAP_ID.

Release the UE Context before re-using the RAN_UE_NGAP_ID, because the
connection handler can only handle one context at a time.

Note that the AMF_UE_NGAP_ID is incremented by Open5GS for every
context.

This fixes:
    TC_ue_service_request_cm_idle_inact_sess
    TC_ue_service_request_cm_idle_ul_data
    TC_ue_service_request_cm_idle_unknown_sess_active

Related: Open5GS Issues #4481
Change-Id: If6fae56487aebd810c51cbab170d95d5dec7e138
Andreas Eversberg at