Osmocom bb mobile station cannot register to YateBTS basestation - baseband-devel

2 Oct 2024


      I am having trouble connecting my osmocom bb setup to a conventional basestation setup using the mobile application, and would really appreciate any help in this matter.
My basestation is a YateBTS setup setup on radio band DCS1800 with ARFCN 555, and PLMN 001 01 (test network). I am using sysmocom SIMs with PLMN 999 70. I have verified operation of YateBTS by connecting two other phones and am able to get service on them and even do phone calls. For my osmocom bb setup, I have a motorola c115 device in which I load the e88 layer1.highram.bin firmware. The firmware loads correctly and am able to detect the basestation when I run cell_log application. However when I run the mobile application, I seem to be stuck in RR connection pending. Mobile application does see the cell connection and MM connection seems to be active, and is able to read the SIM card correctly also, just doesn't seem to complete the registration. Here are the logs, and config file I used.
Really appreciate any help with this. Thanks in advance!!
---------------------------------------osmocon logs------------------------------------------ 
Synchronize_TDMA
=>FB @ FNR 378464 fn_offset=189241 qbits=4920
LOST 1907!
L1CTL_NEIGH_PM_REQ new list with 0 entries
BAT-ADC: 621   5   0   0 1023 440   0   0  
    Charger at 43 mV.
    Battery at 4245 mV.
    Charging at 0 mA.
    Battery capacity is 100%.
    Battery range is 3199..3999 mV.
    Battery full at 468 LSB .. full at 585 LSB
    Charging at 239 LSB (204 mA).
    BCICTL2=0x3ff
    battery-info.flags=0x00000000
    bat_compal_e88_chg_state=0
BAT-ADC: 622   5   0   0 1023 440   0   0  
    Charger at 43 mV.
    Battery at 4252 mV.
    Charging at 0 mA.
    Battery capacity is 100%.
    Battery range is 3199..3999 mV.
    Battery full at 468 LSB .. full at 585 LSB
    Charging at 239 LSB (204 mA).
    BCICTL2=0x3ff
    battery-info.flags=0x00000000
    bat_compal_e88_chg_state=0
BAT-ADC: 622   5   0   0 1023 453   0   0  
    Charger at 43 mV.
    Battery at 4252 mV.
    Charging at 0 mA.
    Battery capacity is 100%.
    Battery range is 3199..3999 mV.
    Battery full at 468 LSB .. full at 585 LSB
    Charging at 239 LSB (204 mA).
    BCICTL2=0x3ff
    battery-info.flags=0x00000000
    bat_compal_e88_chg_state=0
TOA AVG is not 16 qbits, correcting (got 13)
L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=555, flags=0x7)
Starting FCCH RecognitionFB0 (192454:2): TOA= 1296, Power= -53dBm, Angle=19720Hz
FB0 (192464:8): TOA= 8784, Power= -51dBm, Angle= -598Hz
FB1 (192475:9): TOA=10007, Power= -51dBm, Angle=   47Hz
  fn_offset=192473 (fn=192475 + attempt=9 + ntdma = 7)
  delay=8 (fn_offset=192473 + 11 - fn=192475 - 1
  scheduling next FB/SB detection task with delay 8
=>FB @ FNR 192473 fn_offset=192473 qbits=4844
Synchronize_TDMA
LOST 3720!
SB1 (384952:1): TOA=   24, Power= -50dBm, Angle=  114Hz
=> SB 0x019c4808: BSIC=2 fn=192485(145/ 7/11) qbits=4
Synchronize_TDMA
=>FB @ FNR 384951 fn_offset=192485 qbits=4912
LOST 1904!
L1CTL_PARAM_REQ (ta=0, tx_power=0)
L1CTL_RACH_REQ (ra=0x0a, offset=26, combined=1, uic=0xff)
L1CTL_PARAM_REQ (ta=0, tx_power=0)
L1CTL_RACH_REQ (ra=0x07, offset=143, combined=1, uic=0xff)
L1CTL_PARAM_REQ (ta=0, tx_power=0)
L1CTL_RACH_REQ (ra=0x0d, offset=118, combined=1, uic=0xff)
BAT-ADC: 622   5   0   0 1023 440   0   0  
    Charger at 43 mV.
    Battery at 4252 mV.
    Charging at 0 mA.
    Battery capacity is 100%.
    Battery range is 3199..3999 mV.
    Battery full at 468 LSB .. full at 585 LSB
    Charging at 239 LSB (204 mA).
    BCICTL2=0x3ff
    battery-info.flags=0x00000000
    bat_compal_e88_chg_state=0
TOA AVG is not 16 qbits, correcting (got 17)
L1CTL_DM_REL_REQL1CTL_RESET_REQ: FULL!L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=555, flags=0x7)
Starting FCCH RecognitionFB0 (194158:8): TOA= 8784, Power= -52dBm, Angle=19720Hz
FB0 (194168:8): TOA= 8784, Power= -50dBm, Angle= -530Hz
FB1 (194178:8): TOA= 8755, Power= -50dBm, Angle=    6Hz
  fn_offset=194176 (fn=194178 + attempt=8 + ntdma = 6)
  delay=8 (fn_offset=194176 + 11 - fn=194178 - 1
  scheduling next FB/SB detection task with delay 8
=>FB @ FNR 194176 fn_offset=194176 qbits=4836
Synchronize_TDMA
LOST 3716!
SB1 (388359:1): TOA=   26, Power= -50dBm, Angle=   77Hz
=> SB 0x01514908: BSIC=2 fn=194188(146/20/31) qbits=12
Synchronize_TDMA
=>FB @ FNR 388358 fn_offset=194188 qbits=4920
LOST 1908!
L1CTL_NEIGH_PM_REQ new list with 0 entries
---------------------------------------mobile application logs------------------------------------------ 
Copyright (C) 2010-2015 Andreas Eversberg, Sylvain Munaut, Holger Freyther, Harald Welte
Contributions by Alex Badea, Pablo Neira, Steve Markgraf and others
License GPLv2+: GNU GPL version 2 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
<0013> app_mobile.c:305 Mobile '1' initialized, please start phone now!
<001d> telnet_interface.c:88 Available via telnet 127.0.0.1 4247
<0011> sim.c:1091 selected file (len 10)
<0011> sim.c:1091 selected file (len 9)
<0011> sim.c:1091 selected file (len 11)
<0011> sim.c:1091 selected file (len 14)
<0011> sim.c:1091 selected file (len 9)
<0011> sim.c:1091 selected file (len 60)
<0011> sim.c:1091 selected file (len 1)
<0011> sim.c:1091 selected file (len 17)
<0005> subscriber.c:1194 SIM reading failed, file invalid
<0011> sim.c:1091 selected file (len 2)
<0011> sim.c:1091 selected file (len 12)
<0011> sim.c:1086 selected record (len 34 structure 1)
<0011> sim.c:1086 selected record (len 52 structure 1)
<0001> gsm48_rr.c:2796 Changing CCCH_MODE to 2
<0001> sysinfo.c:848 Now updating previously received SYSTEM INFORMATION 4
---------------------------------------``VTY interface``------------------------------------------ 
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Welcome to the OsmocomBB(mobile) VTY interface
OsmocomBB(mobile)> 
% (MS 1)
% Trying to register with network Test, Test...
OsmocomBB(mobile)> show ms 1
MS '1' is up, MM connection active
  IMEI: 355609009915009
     IMEISV: 3556090099150090
     IMEI generation: fixed
  automatic network selection state: A1 trying RPLMN
                                     MCC=001 MNC=01 (Test, Test)
  cell selection state: connected mode 1
                        ARFCN=555(DCS) CGI=001-01-1000-10
                        (Test, Test)
  radio resource layer state: connection pending
  mobility management layer state: wait for RR connection (location updating)
OsmocomBB(mobile)> 
% (MS 1)
% Trying to register with network Test, Test...
OsmocomBB(mobile)> show subs 1
Mobile Subscriber of MS '1':
 IMSI: 999700000085749
 ICCID: 8988211000000857493
 SMS Service Center Address: 3548900076
 Status: U1_UPDATED  IMSI detached  TMSI 0x007b0009
         LAI: 001-01-1000  (Test, Test)
 GPRS Status: GU2_NOT_UPDATED IMSI detached  PTMSI-sig 0xffffff  RAI: invalid
 Registered PLMN: MCC-MNC 001-01  (Test, Test)
 Access barred cells: no
 Access classes: C9
 List of preferred PLMNs:
        MCC    |MNC
        -------+-------
        000    |00        (Marshall Islands, 00)
OsmocomBB(mobile)> 
% (MS 1)
% Trying to register with network Test, Test...
OsmocomBB(mobile)> show cell 1
ARFCN  |MCC    |MNC    |LAC    |cell ID|forb.LA|prio   |min-db |max-pwr|rx-lev
-------+-------+-------+-------+-------+-------+-------+-------+-------+-------
 555DCS|001    |01     |0x03e8 |0x000a |no     |normal |-110   |   0   |-54
OsmocomBB(mobile)> 
% (MS 1)
% Trying to register with network Test, Test...
% (MS 1)
% Trying to register with network Test, Test...
% (MS 1)
% Trying to register with network Test, Test...
% (MS 1)
% Trying to register with network Test, Test...
---------------------------------------``config file``------------------------------------------ 
!
! OsmocomBB(mobile) (0.0.0) configuration saved from vty
!!
!
log stderr blocking-io
 logging filter all 1
 logging color 1
 logging print category-hex 1
 logging print category 0
 logging print thread-id 0
 logging timestamp 0
 logging print file 1
 logging level rsl notice
 logging level rr notice
 logging level plmn notice
 logging level cs notice
 logging level nb notice
 logging level mm notice
 logging level cc notice
 logging level gcc notice
 logging level bcc notice
 logging level ss notice
 logging level sms notice
 logging level mncc notice
 logging level meas notice
 logging level pag notice
 logging level l1c notice
 logging level sap notice
 logging level sum notice
 logging level sim notice
 logging level gps notice
 logging level mob notice
 logging level prim notice
 logging level lua debug
 logging level gapk debug
 logging level tun notice
 logging level rlcmac notice
 logging level llc notice
 logging level sndcp notice
 logging level gmm notice
 logging level sm notice
 logging level lglobal notice
 logging level llapd notice
 logging level linp notice
 logging level lmux notice
 logging level lmi notice
 logging level lmib notice
 logging level lsms notice
 logging level lctrl notice
 logging level lgtp notice
 logging level lstats notice
 logging level lgsup notice
 logging level loap notice
 logging level lss7 notice
 logging level lsccp notice
 logging level lsua notice
 logging level lm3ua notice
 logging level lmgcp notice
 logging level ljibuf notice
 logging level lrspro notice
 logging level lns notice
 logging level lbssgp notice
 logging level lnsdata notice
 logging level lnssignal notice
 logging level liuup notice
 logging level lpfcp notice
 logging level lcsn1 notice
 logging level lio notice
!
stats interval 5
!
line vty
 no login
!
gps device /dev/ttyACM0
gps baudrate default
no gps enable
!
no hide-default
!
ms 1
 layer2-socket /tmp/osmocom_l2
 imei 355609009915009 0
 imei-fixed
 sim reader
 test-sim
  imsi 999700000085749
  ki comp128 12 34 56 78 9a bc de f0 12 34 56 78 9a bc de f0 
  no barred-access
  no rplmn
  hplmn-search foreign-country
  no locigprs
 sap-socket /tmp/osmocom_sap
 mncc-socket /tmp/ms_mncc_1
 mncc-handler internal
 network-selection-mode auto
 no emergency-imsi
 no sms-service-center
 no call-waiting
 no auto-answer
 no force-rekey
 no clip
 no clir
 tx-power auto
 no simulated-delay
 no stick
 location-updating
 neighbour-measurement
 codec full-speed prefer
 codec half-speed
 no abbrev
 support
  sms
  a5/1
  a5/2
  p-gsm
  e-gsm
  r-gsm
  gsm-850
  dcs
  no pcs
  class-900 4
  class-850 4
  class-dcs 1
  class-pcs 1
  channel-capability sdcch+tchf+tchh
  full-speech-v1
  full-speech-v2
  half-speech-v1
  full-data-14400
  full-data-9600
  full-data-4800
  half-data-4800
  full-data-2400
  half-data-2400
  min-rxlev -106
  dsc-max 90
  no skip-max-per-band
  vgcs
  vbs
 c7-any-timeout 30
 uplink-release-local
 no asci-allow-any
 tch-voice
  io-handler none
 tch-data
  io-handler none
  io-tch-format osmo
 no shutdown
!
gsmtap
 no remote-host
 no local-host