OAI and LimeSDR-Mini

Yes it is Limesdr_Mini_v0.6… I was able to see my 4g network by selecting band7 in samsung s4 mini service mode now i got these since I don’t have USIM card

Connecting to device: LimeSDR Mini, media=USB 3.0, module=FT601, addr=24607:1027, serial=1D40ED5D833C8F
Reference clock 40.00 MHz
Set sample rate 7.680000 MHz
Set TX frequency 2680.000000 MHz
RX LPF configured
Filter calibrated. Filter order-4th, filter bandwidth set to 5 MHz.Real pole 1st order filter set to 2.5 MHz. Preemphasis filter not active
TX LPF configured
Rx calibration finished
Tx calibration finished
SR: 7.680 MHz
SR: 7.680 MHz
L
[PHY][I][eNB 0][RAPROC] Frame 513 Terminating ra_proc for harq 4, UE 0
[MAC][I][rx_sdu] [eNB 0][RAPROC] CC_id 0 Frame 513, Received CCCH: 59.8f.84.dc.3d.56, Terminating RA procedure for UE rnti b637
[MAC][I][rx_sdu] [eNB 0][RAPROC] CC_id 0 Frame 513 CCCH: Received Msg3: length 6, offset 3
MAC: new UE id 0 rnti b637
[MAC][I][rx_sdu] [eNB 0][RAPROC] CC_id 0 Frame 513 Added user with rnti b637 => UE 0
[MAC][I][schedule_ulsch_rnti] [eNB 0] frame 513 subfarme 6, UE 0: not configured, skipping UE scheduling
[RRC][I][FRAME 00000][eNB][MOD 00][RNTI b637] Received RRC_MAC_CCCH_DATA_IND
[RRC][I][FRAME 00000][eNB][MOD 00][RNTI b637] Accept new connection from UE random UE identity (0xd5c34df898000000) MME code 0 TMSI 0 cause 3
[MAC][I][schedule_ulsch_rnti] [eNB 0] frame 513 subfarme 7, UE 0: not configured, skipping UE scheduling
[MAC][I][rrc_mac_config_req] [CONFIG][eNB 0/0] Configuring MAC/PHY for UE 0 (b637)
[PHY][I]phy_config_dedicated_eNB: physicalConfigDedicated=0x7f5e1c003240
[PHY][I][eNB 0] Sent physicalConfigDedicated=0x7f5e1c003240 for UE 0
[PHY][I]Transmission Mode (phy_config_dedicated_eNB) 1
[RRC][I][FRAME 00000][eNB][MOD 00][RNTI b637] [RAPROC] Logical Channel DL-CCCH, Generating RRCConnectionSetup (bytes 25)
[RRC][I][FRAME 00000][eNB][MOD 00][RNTI b637]CALLING RLC CONFIG SRB1 (rbid 1)
[PDCP][N][FRAME 00000][eNB][MOD 00][RNTI b637][SRB 01] Action ADD LCID 1 (SRB id 1) configured with SN size 5 bits and RLC AM
[RLC][I][FRAME 00000][eNB][MOD 00][RNTI b637] [SRB 1] rrc_rlc_add_rlc SRB
[RLC][I][FRAME 00000][eNB][MOD 00][RNTI b637][SRB AM 01][CONFIGURE] max_retx_threshold 4 poll_pdu 4 poll_byte 65535 t_poll_retransmit 80 t_reordering 35 t_status_prohibit 0
[MAC][I][schedule_ulsch_rnti] [eNB 0] frame 513 subfarme 8, UE 0: not configured, skipping UE scheduling
[MAC][I][schedule_ulsch_rnti] [eNB 0] frame 513 subfarme 9, UE 0: not configured, skipping UE scheduling
[MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 514, subframeP 0: Generating Msg4 with RRC Piggyback (RA proc 0, RNTI b637)
[MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 514 subframeP 0 Msg4 : TBS 41, sdu_len 25, msg4_header 8, msg4_padding 0, msg4_post_padding 7
[MAC][I][schedule_ulsch_rnti] [eNB 0] frame 514 subfarme 0, UE 0: not configured, skipping UE scheduling
[MAC][I][schedule_ulsch_rnti] [eNB 0] frame 514 subfarme 1, UE 0: not configured, skipping UE scheduling
[MAC][I][schedule_ulsch_rnti] [eNB 0] frame 514 subfarme 2, UE 0: not configured, skipping UE scheduling
[MAC][I][schedule_ulsch_rnti] [eNB 0] frame 514 subfarme 3, UE 0: not configured, skipping UE scheduling
[MAC][I][schedule_ulsch_rnti] [eNB 0] frame 514 subfarme 4, UE 0: not configured, skipping UE scheduling
[MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 514, subframeP 5: Checking if Msg4 was acknowledged:
MAC: msg4 acknowledged for rnti b637 fsf 514/5, let’s configure it
[MAC][I][schedule_RA] [eNB 0][RAPROC] CC_id 0 Frame 514, subframeP 5 : Msg4 acknowledged
[MAC][I][schedule_ulsch_rnti] [eNB 0][PUSCH 6/b637] CC_id 0 Frame 514 subframeP 6 Scheduled UE 0 (mcs 10, first rb 1, nb_rb 6, rb_table_index 5, TBS 129, harq_pid 6)
[MAC][I][schedule_ulsch_rnti] [eNB 0][PUSCH 6/b637] CC_id 0 Frame 517 subframeP 8 Scheduled UE 0 (mcs 10, first rb 1, nb_rb 6, rb_table_index 5, TBS 129, harq_pid 6)
[MAC][I][schedule_ulsch_rnti] [eNB 0][PUSCH 6/b637] CC_id 0 Frame 521 subframeP 0 Scheduled UE 0 (mcs 10, first rb 1, nb_rb 6, rb_table_index 5, TBS 129, harq_pid 6)
[RRC][I]Removing UE b637 instance
[RRC][W][eNB 0] Removing UE RNTI b637
MAC: remove UE 0 rnti b637
[MAC][I][rrc_mac_remove_ue] Removing UE 0 from Primary CC_id 0 (rnti b637)
[RRC][I][FRAME 00000][eNB][MOD 00][RNTI b637] Removed UE context
[S1AP][W][s1ap_ue_context_release_req] Failed to find ue context associated with eNB ue s1ap id: 0
[S1AP][E][s1ap_eNB_task] Failed to find ue context associated with eNB ue s1ap id: 0

1 Like

This is the best I can get - using LimeSuite from last 12/2017 and a LimeSDR (non-mini) - up and running:

Version information:
Library version: v17.12.0-gfe53178a
Build timestamp: 2018-10-11
Interface version: v2017.12.0
Binary interface: 17.12-1

{ git checkout fe53178a3c74ce983ca8314c582c0547f723ec20 } which does not support the Mini :frowning:

The SGS4 is having issues with aging certificates anymore :\ But as shows above when positioned just right it can download files like anything, right around 2Mbps.

A successful ue attach:

RX Sample rate range, min: 100000.000000, max: 80000000.000000, step: 1.000000
SR: 7.680 MHz
SR: 7.680 MHz
L
connected
got mess 1
MAC: new UE id 0 rnti 605
MAC: msg4 acknowledged for rnti 605 fsf 461/0, let’s configure it

KeNB:0ea9783cda3c9fc26a7d727c479fe65924ae29d118d862fc9a4373440f5b8fe4

KRRCenc:7b858252fd249fb331cc8c0965584282755ad4e1cf5084c0e21de94aacb8ed3f

KRRCint:d0315f9b58731cbd6432f1bc82ba09bd37fa37ace94435a34184b6ca626bd9ac

1 Like

I have an issue getting a Samsung S4Mini to attach to the LimeSDR / OAI which is solved by this one weird trick - start up OpenLTE on band 20, the phone sees THAT ok and try to connect, then switch that off and startup OAI and boom it connects. Without that, the sgs4 finds nothing.

So doing a scan with OpenLTE utility LTE_fdd_dl_scan for frequencies around my earfcn gets this voluminous report - eNodeB is the LimeSDR and using the LMSMini for the scanner:

info channel_found_begin freq=2680000000 dl_earfcn=3350 freq_offset=172.863 phys_cell_id=0 sfn=847 n_ant=1 phich_dur=Normal phich_res=1/6 bandwidth=5
info sib1_decoded freq=2680000000 dl_earfcn=3350 freq_offset=172.863 phys_cell_id=0 sfn=848 mcc[0]=244 mnc[0]=91 network[0]=Sonera resv_for_oper[0]=false tac=1 cell_id=3584 cell_barred=false intra_freq_resel=not_allowed q_rx_lev_min=-130 q_rx_lev_min_offset=0 band=7 si_win_len=20 si_periodicity[0]=8 sib_mapping_info[0]=2,3 duplex_mode=fdd si_value_tag=0
info sib2_decoded freq=2680000000 dl_earfcn=3350 freq_offset=172.863 phys_cell_id=0 sfn=849 emergency_barring=disabled mo_signalling_barring=disabled mo_data_barring=disabled num_rach_preambles=64 power_ramping_step=4 preamble_init_target_rx_power=-104 preamble_trans_max=10 ra_response_window_size=10 mac_contention_resolution_timer=48 max_num_harq_tx_for_msg_3=4 modification_period_coeff=2 default_paging_cycle=128 modification_period=256 n_b=128 root_sequence_index=0 prach_config_index=0 preamble_format=0 rach_sfn=even rach_subframe_num=1 high_speed_flag=unrestricted_set n_cs_config=1 prach_freq_offset=2 reference_signal_power=-34 p_b=0 n_sb=1 hopping_mode=inter_subframe pusch_n_rb_hopping_offset=0 64_qam=not_allowed group_hopping=enabled group_assignment_pusch=0 sequence_hopping=disabled cyclic_shift=1 delta_pucch_shift=1 n_rb_cqi=1 n_cs_an=0 n1_pucch_an=0 p0_nominal_pusch=-96 ul_power_ctrl_alpha=1.0 p0_nominal_pucch=-104 delta_f_pucch_format_1=2 delta_f_pucch_format_1b=3 delta_f_pucch_format_2=0 delta_f_pucch_format_2a=0 delta_f_pucch_format_2b=0 delta_preamble_msg_3=12 ul_cp_length=normal t300=1000 t301=1000 t310=1000 n310=20 t311=10000 n311=1 additional_spectrum_emission=1 time_alignment_timer=INFINITY
info sib3_decoded freq=2680000000 dl_earfcn=3350 freq_offset=172.863 phys_cell_id=0 sfn=849 q_hyst=4 threshold_serving_low=62 cell_resel_priority=7 q_rx_lev_min=-140 s_intra_search=62 allowed_meas_bw=1.4 presence_ant_port_1=false neigh_cell_cnfg=0 t_resel_eutra=1
info channel_found_end freq=2680000000 dl_earfcn=3350 freq_offset=172.863 phys_cell_id=0

2 Likes

is this report is coming to the limesdr or the limesdrmini ?

LimeSDR is radio head end of an OpenAirInterface instance with a cell phone attached and getting data.

LimeSDR-Mini is in a notebook running OpenLTE LTE_fdd_dl_scan and scanning the earfcn which finds the signal and prints a report.

someone has this error in this discussion bastien : OpenAirInterface configuration : the error Failed to find ue context associated with eNB ue s1ap id:

tutorial for limesdrmini with oai here https://bastienbaranoff.wordpress.com/2018/10/23/openairinterface-4g-lte-with-limesdr_mini/

1 Like

Thank you @bastienbaranoff & @cswiger for your great tutorials and tips they were very helpful. Now am running OAI with my limesdr-mini and unfortunately I didn’t manage to get a suitable commercial phone (UE) with the programmed USIM yet, at the meanwhile I got this output :

“[PHY][I]rx_rf: rfdevice timing drift of 2720 samples (ts_off 26720)” after the “L”, I wanted to know if I am on the right way ? Kindly to find a full ltesoftmodem log in this link : https://www.dropbox.com/s/34pj60gqztpvm9y/ltesoftmodem_log.txt?dl=0&fbclid=IwAR0LcMKuu368Ir3jI64H1NnFN29uAjEdMsmieOpPRa-TvEZutCIQCPdRB80

when you have the problem “rf device timing drift” it’s also error coming on the port:

  • may be you libusb is not installing correctly
  • may be you didn’t use usb 3.0
  • may be you use anormal usb 3.0, if the computer has other port usb3.0, try with it
1 Like

Yeah @dast I tried your suggestions and I’ve noticed that when I plug my limesdr-mini and run ltesoftmodem, it is directly driven to USB 2.0 even-though my physical usb port is 3.0, but when I restart ltesoftmodem second time it will be driven to USB 3.0 but am always getting “rf device timing drift” . I tried different ports on my laptops but no use, one more thing I’ve installed libusb using apt install libusb-1.0-0-dev. I checked it :
root@oai-Aspire-V3-575T:~# dpkg -l libusb-1.0*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
++±=============================-===================-===================-================================================================
ii libusb-1.0-0:amd64 2:1.0.20-1 amd64 userspace USB programming library
ii libusb-1.0-0-dbg:amd64 2:1.0.20-1 amd64 userspace USB programming library development files
ii libusb-1.0-0-dev:amd64 2:1.0.20-1 amd64 userspace USB programming library development files
ii libusb-1.0-doc 2:1.0.20-1 all documentation for userspace USB programming

“[PHY][I]rx_rf: rfdevice timing drift of …" problem is so detrimental for the ltesoftmodem performances i.e : it will not let the UE see the eNB ? or has relation with DL throughput ?

I am using Samsung galaxy S8+ trying to scan OAI enodeB deployed on my lime-mini, LTE band 7 locked using hidden network functions :

:frowning_face: unfortunately I started manual network resarch but didn’t detect anything . Please any idea about the problem ??

Note : I still having this error “[PHY][I]rx_rf: rfdevice timing drift of …" in the ltesoftmodem terminal, anotherthing to mention : I am not using programmed USIM card yet.

Help please.

Hi @dast, I’ve solved “rf device timing drift” problem by changing my PC host so it was problem of hardware. I launched a scan for my eNB and my phone was able to see the nework 208/92. Now I am facing another problem , my phone is not able to register. Some times I got some signal on the Scope but failed to register.

Any help please regarding “Registering issue !!!” ???

Sim card used : Piswords Blank LTE USIM bought from Aliexpress programmed using personalize tool.
Phone used : Oppo R7s.

i’m also fascinating to this problem ! maybe comment on this site web could help you : https://www.mobibrw.com/2018/10729/comment-page-1#comment-3451

Mine also see the network but can’t access it! i use the same card ! pisword!!!when i test openbts-umts for example, when my simcard inserted on the phone is for the operator ! i see the network 001-01 (3g) ! when i insert the pisword card i can’t see the network!!! i don’t know what is the real problem of the lte-sim of the pisword!

@dast What is your mobile phone model, and are you using LTE Band 7 duplexer ?

my phone see the network for the 4g!!! but now i try to test the usim with openbts-umts. what kind of device and software did you use for programming the usim? me i use https://fr.aliexpress.com/item/LTE-FDD-WCDMA-CCID-SIM-USIM-4G-Secure-Card-Reader-writer-tool-cloner-programmer-clone-copy/32811023157.html?spm=2114.06010108.3.255.VkkYOL&ws_ab_test=searchweb0_0%2Csearchweb201602_5_10152_10065_10151_10068_5010019_10136_10137_10157_10060_10138_10155_10062_10156_437_10154_10056_10055_10054_10059_303_100031_10099_10103_10102_10096_10147_10052_10053_10107_10050_10142_10051_5190019_10084_10083_10080_10082_10081_10110_519_10111_10112_10113_10114_10179_10181_10183_10182_10185_10078_10079_10073_10123_142%2Csearchweb201603_9%2CppcSwitch_5&btsid=f3bb42fc-5ea4-48f7-a215-dc8277662c9c&algo_expid=26c514e3-8de7-46ba-b403-2eea71abe6df-35&algo_pvid=26c514e3-8de7-46ba-b403-2eea71abe6df&fbclid=IwAR2zYF3OVBPvlN3KxRp4Mkcx8Px4GTq25UnLtDGi-kg-YXjXdXGoFb0CwCc and the software http://www.mobibrw.com/wp-content/uploads/2018/03/GRSIMWrite-3.10.zip because the usim reader writter doesn’t have software for writting ki, op, msisdn and imsi by default! or what kind of software did you use ?

I use the same the same tool “Piswords+GRSIMWrite-3.10” following this tutorial : https://www.mobibrw.com/2018/10729/comment-page-1

I found in some mailing-list of openairinterface that it can be problem coming from the used phone, what is your phone model ?

I use samsung S5 . But i see the network! the problem is that i can’t access to it. My problem is not due to the phone, it’s due to the configuration

@dast I found in an official wiki of openairinterface that some phones bought from a certain carrier. They have a wrapper that will block other networks, for example OAI. Here is another solution, https://lists.eurecom.fr/sympa/arc/openair5g-user/2016-06/msg00076.html

But this solution has high risk on the mobile ROM and need some knowledge about rooting and flashing.