OpenAirInterface 4G/LTE with LimeSDR_Mini

OS ubuntu 17.04

# apt-file search gtp.ko | grep lowlatency
linux-image-4.13.0-36-lowlatency: /lib/modules/4.13.0-36-lowlatency/kernel/drivers/net/gtp.ko
# apt install linux-image-4.13.0-36-lowlatency

SoapySDR

# git clone https://github.com/pothosware/SoapySDR
# apt-get install cmake g++ libpython-dev python-numpy swig
# mkdir build
# cd build
# cmake ..
# make -j4
# sudo make install
# sudo ldconfig #needed on debian systems
# SoapySDRUtil --info

LimeSuite
# sudo apt-get install git g++ cmake libsqlite3-dev libi2c-dev libusb-1.0-0-dev
#install graphics dependencies
sudo apt-get install libwxgtk3.0-dev freeglut3-dev
# git clone https://github.com/myriadrf/LimeSuite
# cd LimeSuite
# cd build
# cmake ..

Download & Compile the eNB on 17.04
# git clone https://github.com/myriadrf/trx-lms7002m
# wget http://open-cells.com/d5138782a8739209ec5760865b1e53b0/opencells-mods-20170710.tgz
# tar xf opencells-mods-20170710.tgz
# git clone https://gitlab.eurecom.fr/oai/openairinterface5g.git
# cd openairinterface5g
# git checkout 08b8b3142df16831396a5283a015564ff56bf91c
# git apply ../opencells-mods/eNB.patch
# source oaienv
# ./cmake_targets/build_oai -I
# ./cmake_targets/build_oai -c -w LMSSDR --eNB -x

Download and patch EPC
# cd
# git clone https://gitlab.eurecom.fr/oai/openair-cn.git
# cd openair-cn
# git checkout develop
# git apply opencells-mods/EPC.patch
# source oaienv; cd scripts
# ./build_hss -i

set your MySQL password and remember it!
Answer yes to install: freeDiameter 1.2.0
phpmyadminn choose apache, configure database for phpmyadmin with
dbconfig-common: yes, password: same as MySQL for simplicity

Install 3PP SW for mme and spgw

# ./build_mme -i

Do you want to install freeDiameter 1.2.0: no
Do you want to install asn1c rev 1516 patched? : no
Do you want to install libgtpnl ? : yes
wireshark permissions: as you prefer

# ./build_spgw -i

Do you want to install libgtpnl ? : no

Compile the EPC nodes
# cd ~/openair-cn; source oaienv; cd scripts
# ./build_hss
# ./build_mme
# ./build_spgw

# nano openairinterface5g/targets/PROJECTS/GENERIC-LTE-EPC/CONF/enb.band7.tm1.25PRB.lmssdr.conf

Change tx_gain 127 and rx_gain 160 je careful i am not sure it is necessary and it is max values

Change to this
////////// MME parameters:
mme_ip_address = ( { ipv4 = “127.0.0.20”;
ipv6 = “192:168:30::17”;
active = “yes”;
preference = “ipv4”;
}
);

NETWORK_INTERFACES :
{
ENB_INTERFACE_NAME_FOR_S1_MME = “lo”;
ENB_IPV4_ADDRESS_FOR_S1_MME = “127.0.0.10/8”;

ENB_INTERFACE_NAME_FOR_S1U = “lo”;
ENB_IPV4_ADDRESS_FOR_S1U = “127.0.0.10/8”;
ENB_PORT_FOR_S1U = 2152; # Spec 2152
};

And this

In the eNB config file, you need also to set the MCC and MNC as per your SIM card:

tracking_area_code = “1”;
mobile_country_code = “208”;
mobile_network_code = “92”;

Install this configuration for EPC

For the EPC, we install in OAI default directory: /usr/local/etc/oai

# sudo mkdir -p /usr/local/etc/oai
# sudo cp -rp ~/opencells-mods/config_epc/* /usr/local/etc/oai

# cd ~/openair-cn; source oaienv; cd scripts
# ./check_hss_s6a_certificate /usr/local/etc/oai/freeDiameter hss.OpenAir5G.Alliance
# ./check_mme_s6a_certificate /usr/local/etc/oai/freeDiameter mme.OpenAir5G.Alliance

Only the SGi output to internet need to be configured.

# nano /usr/local/etc/oai/spgw.conf,

your should set the interface that is connected to Internet, and,
to tell to the PGW to implement NAPT for the UE traffic

PGW_INTERFACE_NAME_FOR_SGI = “wlp2s0”;
PGW_MASQUERADE_SGI = “yes”;

Change wlp2s0 with your interface

For the SIM card, you’ll have more to do:

SIM MCC/MNC should be duplicated in a couple of files
eNB: See above in eNB configuration chapter
MME file: /usr/local/etc/oai/mme.conf to update

GUMMEI_LIST = ( MCC=”208″ ; MNC=”92″; MME_GID=”4″ ; MME_CODE=”1″; } );
TAI_LIST = ({MCC=”208″ ; MNC=”92″; TAC = “1”; } );

A HSS database in text is in: opencells-mods/opencells_db.sql

for phpmyadmin
# sudo ln -s /usr/share/phpmyadmin /var/www/html

10 users is network 208/92 (a French test network) are also created

# nano /usr/local/etc/oai/hss.conf
HSS Configure the password for MySQL set password as the password you created during MySQL installation

uncomment #OPERATOR_key = “11111111111111111111111111111111”; # OP key matching your database

# cd ~/openair-cn/scripts
# ./hss_db_import 127.0.0.1 root linux oai_db ~/opencells-mods/opencells_db.sql

supposed your password is linux

program the Usim
apt-get install python-pyscard python-serial python-pip
pip install pytlv
to find ki matching you should k at startup of
# ./run_hss

to find opc
# ./auchss.py -o 11111111111111111111111111111111 -k 6874736969202073796D4B2079650A73

# sudo python pySim-prog.py –type=”sysmoUSIM-SJS1″ –mcc=208 –mnc=92 –imsi=208920100001108 –opc=777f0406a78d9598b0330d63f4c52199 –ki=6874736969202073796D4B2079650A73 –iccid=8988211000000227713 –pin-adm=40303607 –acc=0200

Change pin-adm=40303607 –acc=0200 with your own values

Running !!
# cd ~/openair-cn/scripts
# sudo ./run_hss
# sudo ./run_mme
# sudo ./run_spgw

# cd ~/openairinterface5g
# sudo -E targets/bin/lte-softmodem.Rel14 -O targets/PROJECTS/GENERIC-LTE-EPC/CONF/enb.band7.tm1.25PRB.lmssdr.conf –rf-config-file ~/trx-lms7002m/config-limeSDR/LimeSDR_Mini_v06.ini -d

The last puzzle piece with the lousy bursty throughput and those log errors:

[PHY][W][eNB 0, CC 0] frame 733, subframe 4, UE 0: ULSCH consecutive error count reached 20, triggering UL Failure
[MAC][I][UL_failure_indication] [eNB 0][UE 0/80e6] Frame 733 subframeP 4 Signaling UL Failure for UE 0 on CC_id 0 (timer 0)
[PHY][E]ERROR: Format 1A: rb_alloc (1ff) > RIV_max (144)

was partly solved by using the lte-softmodem -d switch Enable soft scope and L1 and L2 stats (Xforms), since it was built with the -x –xforms option, and partly by randomly moving the phone around and noticing there was a sweet spot where Firefox would download and install very fast.
Good luck

26 Comments

  1. Dast says:

    Great! what the main problem to solve for running it ?

    Like

    1. The main problem was the power of the antenna i shall put the UE close to the antenna with even touch the antenna… And my rx and tx gain was at the max but it works for association and download

      Like

      1. Dast says:

        For the GSM, we have old base station like donate to our university, we open all the compenent and the amplifier is one module ! we will use it for limesdr-mini but for the 3G and 4G , search some solution! I see also schematic of amplifier 10W for sdr but it creating circuit like always expensive! i could send you the schematic but it’s on pdf not link and i don’t know how to upload something for your blog.

        Like

  2. Dast says:

    Hey, what version of Kali did you use ?

    Like

  3. Dast says:

    I think next step is install srslte and openlte with soapyUHD !!!! mine see the network but can’t connect maybe some problem of configuration!!!

    Liked by 1 person

  4. Dast says:

    May be it could help you for the amplifier:

    Click to access MRF282.pdf

    Click to access MRF284.pdf

    Click to access RF3826-RFMD-datasheet-10695070.pdf

    https://www.qorvo.com/products/d/da004930

    Click to access RFMD_MPD_GaN_Power_Amps.pdf

    Click to access RFMD_MPD_GaN_Power_Amps.pdf

    https://www.rfmw.com/ProductDetail/TGF3015SM-Qorvo/496852/?ProdId=496852&

    It is 10w and really on the band 3Mhz-3.8Ghz ! if you would like to do modmobmap and modmobjam for the smartjamming the power amplifier is a good opportunities

    Liked by 2 people

    1. For exemple for the last at 59$ you need something else to adapt To limemini?

      Like

      1. Dast says:

        you need resistor and condesator (smd) so you need also “soudure à air chaude” ! the TGF3015SM is just the CI of the amplifier, on datasheet you can see the other component for it! but it’s not so expensive than the amplifier. it’s just any basic smd component !

        Liked by 1 person

  5. Dast says:

    See the datasheet and you have the minimal schematic! but the problem is you should well dimensionned the radiator. When the huawei amplifier run correctly, i will send on this blog my experimentation and explanation

    Like

  6. Mohsin Zaidi says:

    Bastien, have you been able to get around the “the error Failed to find ue context associated with eNB ue s1ap id” error and attach to OAI?

    Like

    1. Yes by putting the mobile touching the antenna

      Liked by 1 person

      1. Mohsin Zaidi says:

        I see, thank you! I will try that.

        Like

    2. Dast says:

      Hei Mohsin Zaidi, i also have the same error “the error Failed to find ue context associated with eNB ue s1ap id”. When you touch the antenna with the phone did you able to solve the problem ? what kind of antenne did you use ?

      MAC: remove UE 0 rnti 61d6
      [MAC][I][rrc_mac_remove_ue] Removing UE 0 from Primary CC_id 0 (rnti 61d6)
      [S1AP][W][s1ap_ue_context_release_req] Failed to find ue context associated with eNB ue s1ap id: 0
      [S1AP][E][s1ap_eNB_task] Failed to find ue context associated with eNB ue s1ap id: 0
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI 61d6] Removed UE context
      [PHY][I][eNB 0][RAPROC] Frame 159 Terminating ra_proc for harq 0, UE 0
      [MAC][I][rx_sdu] [eNB 0][RAPROC] CC_id 0 Frame 159, Received CCCH: 5b.ee.d9.e5.22.26, Terminating RA procedure for UE rnti 8235
      [MAC][I][rx_sdu] [eNB 0][RAPROC] CC_id 0 Frame 159 CCCH: Received Msg3: length 6, offset 3
      MAC: new UE id 0 rnti 8235
      [MAC][I][rx_sdu] [eNB 0][RAPROC] CC_id 0 Frame 159 Added user with rnti 8235 => UE 0
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI 8235] Received RRC_MAC_CCCH_DATA_IND
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 159 subfarme 6, UE 0: not configured, skipping UE scheduling
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI 8235] Accept new connection from UE random UE identity (0x22529eedbe000000) MME code 0 TMSI 0 cause 3
      [MAC][I][rrc_mac_config_req] [CONFIG][eNB 0/0] Configuring MAC/PHY for UE 0 (8235)
      [PHY][I]phy_config_dedicated_eNB: physicalConfigDedicated=0x7f3304000f40
      [PHY][I]Transmission Mode (phy_config_dedicated_eNB) 1
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI 8235] [RAPROC] Logical Channel DL-CCCH, Generating RRCConnectionSetup (bytes 25)
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI 8235]CALLING RLC CONFIG SRB1 (rbid 1)
      [PDCP][N][FRAME 00000][eNB][MOD 00][RNTI 8235][SRB 01] Action ADD LCID 1 (SRB id 1) configured with SN size 5 bits and RLC AM
      [RLC][I][FRAME 00000][eNB][MOD 00][RNTI 8235] [SRB 1] rrc_rlc_add_rlc SRB
      [RLC][I][FRAME 00000][eNB][MOD 00][RNTI 8235][SRB AM 01][CONFIGURE] max_retx_threshold 4 poll_pdu 4 poll_byte 65535 t_poll_retransmit 80 t_reordering 35 t_status_prohibit 0
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 159 subfarme 7, UE 0: not configured, skipping UE scheduling
      [PHY][I][eNB 0] Sent physicalConfigDedicated=0x7f3304000f40 for UE 0
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 159 subfarme 8, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 159 subfarme 9, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 160, subframeP 0: Generating Msg4 with RRC Piggyback (RA proc 0, RNTI 8235)
      [MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 160 subframeP 0 Msg4 : TBS 41, sdu_len 25, msg4_header 8, msg4_padding 0, msg4_post_padding 7
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 160 subfarme 0, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 160 subfarme 1, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 160 subfarme 2, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 160 subfarme 3, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 160 subfarme 4, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 160, subframeP 5: Checking if Msg4 was acknowledged:
      MAC: msg4 acknowledged for rnti 8235 fsf 160/5, let’s configure it
      [MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 160, subframeP 5 : Msg4 acknowledged
      [MAC][I][schedule_ulsch_rnti] [eNB 0][PUSCH 2/8235] CC_id 0 Frame 160 subframeP 6 Scheduled UE 0 (mcs 10, first rb 1, nb_rb 6, rb_table_index 5, TBS 129, harq_pid 2)
      [MAC][I][schedule_ulsch_rnti] [eNB 0][PUSCH 2/8235] CC_id 0 Frame 163 subframeP 8 Scheduled UE 0 (mcs 10, first rb 1, nb_rb 6, rb_table_index 5, TBS 129, harq_pid 2)
      [MAC][I][schedule_ulsch_rnti] [eNB 0][PUSCH 2/8235] CC_id 0 Frame 167 subframeP 0 Scheduled UE 0 (mcs 10, first rb 1, nb_rb 6, rb_table_index 5, TBS 129, harq_pid 2)
      [RRC][I]Removing UE 8235 instance
      [RRC][W][eNB 0] Removing UE RNTI 8235
      MAC: remove UE 0 rnti 8235
      [MAC][I][rrc_mac_remove_ue] Removing UE 0 from Primary CC_id 0 (rnti 8235)
      [S1AP][W][s1ap_ue_context_release_req] Failed to find ue context associated with eNB ue s1ap id: 0
      [S1AP][E][s1ap_eNB_task] Failed to find ue context associated with eNB ue s1ap id: 0
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI 8235] Removed UE context

      [PHY][I][eNB 0][RAPROC] Frame 215 Terminating ra_proc for harq 4, UE 0
      [MAC][I][rx_sdu] [eNB 0][RAPROC] CC_id 0 Frame 215, Received CCCH: 53.b0.3a.1b.fb.6, Terminating RA procedure for UE rnti bf18
      [MAC][I][rx_sdu] [eNB 0][RAPROC] CC_id 0 Frame 215 CCCH: Received Msg3: length 6, offset 3
      MAC: new UE id 0 rnti bf18
      [MAC][I][rx_sdu] [eNB 0][RAPROC] CC_id 0 Frame 215 Added user with rnti bf18 => UE 0
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI bf18] Received RRC_MAC_CCCH_DATA_IND
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 0, UE 0: not configured, skipping UE scheduling
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI bf18] Accept new connection from UE random UE identity (0xb0bfa1033b000000) MME code 0 TMSI 0 cause 3
      [MAC][I][rrc_mac_config_req] [CONFIG][eNB 0/0] Configuring MAC/PHY for UE 0 (bf18)
      [PHY][I]phy_config_dedicated_eNB: physicalConfigDedicated=0x7f3304011350
      [PHY][I]Transmission Mode (phy_config_dedicated_eNB) 1
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI bf18] [RAPROC] Logical Channel DL-CCCH, Generating RRCConnectionSetup (bytes 25)
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI bf18]CALLING RLC CONFIG SRB1 (rbid 1)
      [PDCP][N][FRAME 00000][eNB][MOD 00][RNTI bf18][SRB 01] Action ADD LCID 1 (SRB id 1) configured with SN size 5 bits and RLC AM
      [RLC][I][FRAME 00000][eNB][MOD 00][RNTI bf18] [SRB 1] rrc_rlc_add_rlc SRB
      [RLC][I][FRAME 00000][eNB][MOD 00][RNTI bf18][SRB AM 01][CONFIGURE] max_retx_threshold 4 poll_pdu 4 poll_byte 65535 t_poll_retransmit 80 t_reordering 35 t_status_prohibit 0
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 1, UE 0: not configured, skipping UE scheduling
      [PHY][I][eNB 0] Sent physicalConfigDedicated=0x7f3304011350 for UE 0
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 2, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 3, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 4, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 216, subframeP 5: Generating Msg4 with RRC Piggyback (RA proc 0, RNTI bf18)
      [MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 216 subframeP 5 Msg4 : TBS 41, sdu_len 25, msg4_header 8, msg4_padding 0, msg4_post_padding 7
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 5, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 6, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 7, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 8, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_ulsch_rnti] [eNB 0] frame 216 subfarme 9, UE 0: not configured, skipping UE scheduling
      [MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 217, subframeP 0: Checking if Msg4 was acknowledged:
      MAC: msg4 acknowledged for rnti bf18 fsf 217/0, let’s configure it
      [MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 217, subframeP 0 : Msg4 acknowledged
      [MAC][I][schedule_ulsch_rnti] [eNB 0][PUSCH 6/bf18] CC_id 0 Frame 217 subframeP 0 Scheduled UE 0 (mcs 10, first rb 1, nb_rb 6, rb_table_index 5, TBS 129, harq_pid 6)
      [MAC][I][schedule_ulsch_rnti] [eNB 0][PUSCH 6/bf18] CC_id 0 Frame 220 subframeP 2 Scheduled UE 0 (mcs 10, first rb 1, nb_rb 6, rb_table_index 5, TBS 129, harq_pid 6)
      [MAC][I][schedule_ulsch_rnti] [eNB 0][PUSCH 6/bf18] CC_id 0 Frame 223 subframeP 4 Scheduled UE 0 (mcs 10, first rb 1, nb_rb 6, rb_table_index 5, TBS 129, harq_pid 6)
      [RRC][I]Removing UE bf18 instance
      [RRC][W][eNB 0] Removing UE RNTI bf18
      MAC: remove UE 0 rnti bf18
      [MAC][I][rrc_mac_remove_ue] Removing UE 0 from Primary CC_id 0 (rnti bf18)
      [S1AP][W][s1ap_ue_context_release_req] Failed to find ue context associated with eNB ue s1ap id: 0
      [S1AP][E][s1ap_eNB_task] Failed to find ue context associated with eNB ue s1ap id: 0
      [RRC][I][FRAME 00000][eNB][MOD 00][RNTI bf18] Removed UE context

      Like

  7. Dast says:

    why to not use http://www.cdiscount.com/telephonie/accessoires-portable-gsm/antenne-booster-signal-4g-lte-49dbi-connexion/f-1442034-non6922032281018.html but it’s for lte only. it’s high gain but it’s a boost not amplifier so it’s not robust of obstacle , Line of sight (or direct visibility). The popular antenna for sdr is http://domuslb.org/luring/log-periodic?q=293&fbclid=IwAR2eihCkjnd-UcB6wrjUS9d0tgg_zktaZpC1psC7KGBRxRaQn8AWhV7sFQM even for the usrp

    Like

  8. Vlad says:

    For some reason, the UE just doesn’t see the eNB. With the regular version of LimeSDR I am able to see the eNB, but with Mini it doesn’t show up. Tried putting the UE up to the antenna, did not help.

    Liked by 1 person

  9. Dast says:

    For mine, i can find the network but when i try connect i can’t !! hey Bastien , is possible that you send your logfile and indeed your configuration! i would like also ask you for the sql, what did you add on it!!!

    Like

  10. Dast says:

    Hey Bastien, i can’t always connect to my network! my question is what kind of device(hardware) did you use for program the usim and where did you buy it ?

    Like

  11. Dast says:

    Hey bastien of kind of antenna did you use? i have the problem “Failed to find ue context associated with eNB ue s1ap id: 0” . I try the antenna but did not work i think! so i demand you what kind of antenna did you use?

    Like

  12. C7sky says:

    [SCTP][E][sctp_eNB_read_from_socket] sctp_recvmsg (fd 42, len -1 ): Connection refused:111

    Like

  13. hannan says:

    hello bastien,

    i was following your guide to make my system work for Limesdr v1.4 USB. i was able to run all hss,mme,spgw and softmodem but i can never find my network on the phone. Can u share your RF ini file and any changes you made in the conf file.

    Like

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.