baseband-devel October 2024

baseband-devel@lists.osmocom.org

2 participants
2 discussions

Start a nNew thread

Engagetted !

by Sébastien Lorquet

http://www.engadget.com/2010/12/29/researchers-eavesdrop-on-encrypted-gsm-c… Congrats!

7 months, 3 weeks

Osmocom bb mobile station cannot register to YateBTS basestation

by nish079858＠gmail.com

I am having trouble connecting my osmocom bb setup to a conventional basestation setup using the mobile application, and would really appreciate any help in this matter. My basestation is a YateBTS setup setup on radio band DCS1800 with ARFCN 555, and PLMN 001 01 (test network). I am using sysmocom SIMs with PLMN 999 70. I have verified operation of YateBTS by connecting two other phones and am able to get service on them and even do phone calls. For my osmocom bb setup, I have a motorola c115 device in which I load the e88 layer1.highram.bin firmware. The firmware loads correctly and am able to detect the basestation when I run cell_log application. However when I run the mobile application, I seem to be stuck in RR connection pending. Mobile application does see the cell connection and MM connection seems to be active, and is able to read the SIM card correctly also, just doesn't seem to complete the registration. Here are the logs, and config file I used. Really appreciate any help with this. Thanks in advance!! ---------------------------------------osmocon logs------------------------------------------ Synchronize_TDMA =>FB @ FNR 378464 fn_offset=189241 qbits=4920 LOST 1907! L1CTL_NEIGH_PM_REQ new list with 0 entries BAT-ADC: 621 5 0 0 1023 440 0 0 Charger at 43 mV. Battery at 4245 mV. Charging at 0 mA. Battery capacity is 100%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 BAT-ADC: 622 5 0 0 1023 440 0 0 Charger at 43 mV. Battery at 4252 mV. Charging at 0 mA. Battery capacity is 100%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 BAT-ADC: 622 5 0 0 1023 453 0 0 Charger at 43 mV. Battery at 4252 mV. Charging at 0 mA. Battery capacity is 100%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 TOA AVG is not 16 qbits, correcting (got 13) L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=555, flags=0x7) Starting FCCH RecognitionFB0 (192454:2): TOA= 1296, Power= -53dBm, Angle=19720Hz FB0 (192464:8): TOA= 8784, Power= -51dBm, Angle= -598Hz FB1 (192475:9): TOA=10007, Power= -51dBm, Angle= 47Hz fn_offset=192473 (fn=192475 + attempt=9 + ntdma = 7) delay=8 (fn_offset=192473 + 11 - fn=192475 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 192473 fn_offset=192473 qbits=4844 Synchronize_TDMA LOST 3720! SB1 (384952:1): TOA= 24, Power= -50dBm, Angle= 114Hz => SB 0x019c4808: BSIC=2 fn=192485(145/ 7/11) qbits=4 Synchronize_TDMA =>FB @ FNR 384951 fn_offset=192485 qbits=4912 LOST 1904! L1CTL_PARAM_REQ (ta=0, tx_power=0) L1CTL_RACH_REQ (ra=0x0a, offset=26, combined=1, uic=0xff) L1CTL_PARAM_REQ (ta=0, tx_power=0) L1CTL_RACH_REQ (ra=0x07, offset=143, combined=1, uic=0xff) L1CTL_PARAM_REQ (ta=0, tx_power=0) L1CTL_RACH_REQ (ra=0x0d, offset=118, combined=1, uic=0xff) BAT-ADC: 622 5 0 0 1023 440 0 0 Charger at 43 mV. Battery at 4252 mV. Charging at 0 mA. Battery capacity is 100%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 TOA AVG is not 16 qbits, correcting (got 17) L1CTL_DM_REL_REQL1CTL_RESET_REQ: FULL!L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=555, flags=0x7) Starting FCCH RecognitionFB0 (194158:8): TOA= 8784, Power= -52dBm, Angle=19720Hz FB0 (194168:8): TOA= 8784, Power= -50dBm, Angle= -530Hz FB1 (194178:8): TOA= 8755, Power= -50dBm, Angle= 6Hz fn_offset=194176 (fn=194178 + attempt=8 + ntdma = 6) delay=8 (fn_offset=194176 + 11 - fn=194178 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 194176 fn_offset=194176 qbits=4836 Synchronize_TDMA LOST 3716! SB1 (388359:1): TOA= 26, Power= -50dBm, Angle= 77Hz => SB 0x01514908: BSIC=2 fn=194188(146/20/31) qbits=12 Synchronize_TDMA =>FB @ FNR 388358 fn_offset=194188 qbits=4920 LOST 1908! L1CTL_NEIGH_PM_REQ new list with 0 entries ---------------------------------------mobile application logs------------------------------------------ Copyright (C) 2010-2015 Andreas Eversberg, Sylvain Munaut, Holger Freyther, Harald Welte Contributions by Alex Badea, Pablo Neira, Steve Markgraf and others License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. <0013> app_mobile.c:305 Mobile '1' initialized, please start phone now! <001d> telnet_interface.c:88 Available via telnet 127.0.0.1 4247 <0011> sim.c:1091 selected file (len 10) <0011> sim.c:1091 selected file (len 9) <0011> sim.c:1091 selected file (len 11) <0011> sim.c:1091 selected file (len 14) <0011> sim.c:1091 selected file (len 9) <0011> sim.c:1091 selected file (len 60) <0011> sim.c:1091 selected file (len 1) <0011> sim.c:1091 selected file (len 17) <0005> subscriber.c:1194 SIM reading failed, file invalid <0011> sim.c:1091 selected file (len 2) <0011> sim.c:1091 selected file (len 12) <0011> sim.c:1086 selected record (len 34 structure 1) <0011> sim.c:1086 selected record (len 52 structure 1) <0001> gsm48_rr.c:2796 Changing CCCH_MODE to 2 <0001> sysinfo.c:848 Now updating previously received SYSTEM INFORMATION 4 ---------------------------------------``VTY interface``------------------------------------------ Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Welcome to the OsmocomBB(mobile) VTY interface OsmocomBB(mobile)> % (MS 1) % Trying to register with network Test, Test... OsmocomBB(mobile)> show ms 1 MS '1' is up, MM connection active IMEI: 355609009915009 IMEISV: 3556090099150090 IMEI generation: fixed automatic network selection state: A1 trying RPLMN MCC=001 MNC=01 (Test, Test) cell selection state: connected mode 1 ARFCN=555(DCS) CGI=001-01-1000-10 (Test, Test) radio resource layer state: connection pending mobility management layer state: wait for RR connection (location updating) OsmocomBB(mobile)> % (MS 1) % Trying to register with network Test, Test... OsmocomBB(mobile)> show subs 1 Mobile Subscriber of MS '1': IMSI: 999700000085749 ICCID: 8988211000000857493 SMS Service Center Address: 3548900076 Status: U1_UPDATED IMSI detached TMSI 0x007b0009 LAI: 001-01-1000 (Test, Test) GPRS Status: GU2_NOT_UPDATED IMSI detached PTMSI-sig 0xffffff RAI: invalid Registered PLMN: MCC-MNC 001-01 (Test, Test) Access barred cells: no Access classes: C9 List of preferred PLMNs: MCC |MNC -------+------- 000 |00 (Marshall Islands, 00) OsmocomBB(mobile)> % (MS 1) % Trying to register with network Test, Test... OsmocomBB(mobile)> show cell 1 ARFCN |MCC |MNC |LAC |cell ID|forb.LA|prio |min-db |max-pwr|rx-lev -------+-------+-------+-------+-------+-------+-------+-------+-------+------- 555DCS|001 |01 |0x03e8 |0x000a |no |normal |-110 | 0 |-54 OsmocomBB(mobile)> % (MS 1) % Trying to register with network Test, Test... % (MS 1) % Trying to register with network Test, Test... % (MS 1) % Trying to register with network Test, Test... % (MS 1) % Trying to register with network Test, Test... ---------------------------------------``config file``------------------------------------------ ! ! OsmocomBB(mobile) (0.0.0) configuration saved from vty !! ! log stderr blocking-io logging filter all 1 logging color 1 logging print category-hex 1 logging print category 0 logging print thread-id 0 logging timestamp 0 logging print file 1 logging level rsl notice logging level rr notice logging level plmn notice logging level cs notice logging level nb notice logging level mm notice logging level cc notice logging level gcc notice logging level bcc notice logging level ss notice logging level sms notice logging level mncc notice logging level meas notice logging level pag notice logging level l1c notice logging level sap notice logging level sum notice logging level sim notice logging level gps notice logging level mob notice logging level prim notice logging level lua debug logging level gapk debug logging level tun notice logging level rlcmac notice logging level llc notice logging level sndcp notice logging level gmm notice logging level sm notice logging level lglobal notice logging level llapd notice logging level linp notice logging level lmux notice logging level lmi notice logging level lmib notice logging level lsms notice logging level lctrl notice logging level lgtp notice logging level lstats notice logging level lgsup notice logging level loap notice logging level lss7 notice logging level lsccp notice logging level lsua notice logging level lm3ua notice logging level lmgcp notice logging level ljibuf notice logging level lrspro notice logging level lns notice logging level lbssgp notice logging level lnsdata notice logging level lnssignal notice logging level liuup notice logging level lpfcp notice logging level lcsn1 notice logging level lio notice ! stats interval 5 ! line vty no login ! gps device /dev/ttyACM0 gps baudrate default no gps enable ! no hide-default ! ms 1 layer2-socket /tmp/osmocom_l2 imei 355609009915009 0 imei-fixed sim reader test-sim imsi 999700000085749 ki comp128 12 34 56 78 9a bc de f0 12 34 56 78 9a bc de f0 no barred-access no rplmn hplmn-search foreign-country no locigprs sap-socket /tmp/osmocom_sap mncc-socket /tmp/ms_mncc_1 mncc-handler internal network-selection-mode auto no emergency-imsi no sms-service-center no call-waiting no auto-answer no force-rekey no clip no clir tx-power auto no simulated-delay no stick location-updating neighbour-measurement codec full-speed prefer codec half-speed no abbrev support sms a5/1 a5/2 p-gsm e-gsm r-gsm gsm-850 dcs no pcs class-900 4 class-850 4 class-dcs 1 class-pcs 1 channel-capability sdcch+tchf+tchh full-speech-v1 full-speech-v2 half-speech-v1 full-data-14400 full-data-9600 full-data-4800 half-data-4800 full-data-2400 half-data-2400 min-rxlev -106 dsc-max 90 no skip-max-per-band vgcs vbs c7-any-timeout 30 uplink-release-local no asci-allow-any tch-voice io-handler none tch-data io-handler none io-tch-format osmo no shutdown ! gsmtap no remote-host no local-host

8 months, 2 weeks

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel October 2024