RF simulator and OAI UE tutorial

Version 0: initial writing

This tutorial explains how to run OpenAir EPC+eNB+UE with a RF card simulator.

Starting point: the all-in-one tutorial has been run, so the system is installed and running.

Setup the UE

The all-in-one tutorial already compiled the UE, even if we didn’t use it yet.

Our patch file also contains the needed configuration files.

We need now to add a virtual SIM card in binary form to our directory:

../../nas_sim_tools/build/conf2uedata -c ~/opencells-mods/sim.conf -o .

conf2uedata command compiles a OpenAir ascii description of a SIM card into binary files that the OpenAir UE can read.

The hss dump file we provided contains the same SIM card.

Two machines: UE on a second machine

Assuming here you have a separate machine for the UE, you have to install OAI again, nevertheless the next step is easy.

On eNB machine, run the eNB as with RF board, but adding “–rfsim” and some parameters in the configuration file (see “rfsimulator” section we added in ~/opencells-mods/enb.10MHz.b200).

sudo ./lte-softmodem –rfsim -O ~/opencells-mods/enb.10MHz.b200 –log_config.hw_log_level error

“–log_config.hw_log_level error” is there to show how you can change the log level per component on the command line. This is possible for all parameters. We will use the same for UE, because the UE doesn’t have a configuration file.

Lets’ run the UE on the second machine

./lte-uesoftmodem -C 2685000000 -r 50 --rfsim --rfsimulator.serveraddr a.b.c.d

a.b.s.d is the eNB machine IP address.

The UE is now running, any IP traffic can be routed by the LTE network: UE+eNB+EPC

One machine UE + SGi interface

3GPP networks tunnel the UE IP address to the SGi.

SGi is in the PGW for regular LTE, maybe in the eNB in OpenAir noS1 mode.

The UE can’t run directly on the same “machine” because both UE and the 3GPP network border (PGW, or eNB in all cases where eNB performs local connection to internet (OAI nS1, LIPA, SIPTO, …)) will try to route the same IP address.

One solution is to run the UE in a virtual machine.

A lighter solution is to create only a network namespace for the UE (a component of a “virtual machine”)

In case of previous trails, delete the already created network namespaces

assuming enp0s31f6 is your network interface to internet, and that network can be used freely in your intranet.

ip netns delete ueNameSpace
ip link delete v-eth1
ip netns add ueNameSpace  
ip link add v-eth1 type veth peer name v-ue1
ip link set v-ue1 netns ueNameSpace
ip addr add dev v-eth1  
ip link set v-eth1 up  
iptables -t nat -A POSTROUTING -s -o enp0s31f6 -j MASQUERADE  
iptables -A FORWARD -i enp0s31f6 -o v-eth1 -j ACCEPT  
iptables -A FORWARD -o enp0s31f6 -i v-eth1 -j ACCEPT 
ip netns exec ueNameSpace ip link set dev lo up   
ip netns exec ueNameSpace ip addr add dev v-ue1  
ip netns exec ueNameSpace ip link set v-ue1 up 

Set your window in the new namespace:

ip netns exec ueNameSpace bash

Run the UE

./lte-uesoftmodem -C 2685000000 -r 50 --rfsim --rfsimulator.serveraddr

you need now to transfer all ip packets in the namespace to the IP interface created by the OpenAir UE

route add default oaitun_ue1

Now, you can run any application in the UE namespace: all IP traffic will go through the UE+eNB+EPC

ip netns exec ueNameSpace bash

DNS in the UE namespace

DNS resolv is convenient to use in the UE namespace.

If your DNS configuration uses a gateway on lo (a address starting by 127.0.0 as do Ubuntu by default), resolv won’t work because you have another lo interface inside the network namespace (so the DNS query won’t reach the resolver outside of the namespace).

The simplest is to add a routable DNS server in your Linux configuration for also this namespace, example using the google DNS server:

sudo echo 'nameserver' >> /etc/resolv.conf

41 thoughts on “RF simulator and OAI UE tutorial”

  1. Hi Laurent,

    First of all, thank you for the post, it was very interesting.

    I wondered if it was possible to use the rfsimulator to connect two UEs (two PCs) MAC-MAC directly by using just an Ethernet cable, to try sidelink and D2D applications.

    Thank you and best regards,
    Guillermo Gallud

    1. Hi,
      I have never tried.
      The rfsimulator replaces a RF borad from OAI point of view, so it could be possible.

      About sidelink and D2D in OAI:
      – there was a builtin, dedicated, ethernet transmission on simulated RF
      – i don’t know if the development is finished (if it works now on actual rf)

      Best regards,

  2. Hi,
    Thank you for your post, in this regard, I tried to run rfsimulator following the readme file in this branch: https://gitlab.eurecom.fr/oai/openairinterface5g/tree/develop-nr-2020w03/targets/ARCH/rfsimulator.

    I went to the process of cloning the branch, installing lowlatency linux image an headers, setting up the power management, disabling CPU frequency scaling, disabling CPU performance, C-states, hyperthreading, P-states in the Bios setup, double checking CPU frequency did not change for more than 1-2 Herz using the i7z app and verifying uname -r showing lowlatency kernel being used.

    I sourced the oaienv in openairinterface5g folder and built in cmake_targets both –gNB and –nrUE following the readme file. Everything compiled with no issues

    In the /ran_build/build folder I compiled the rfsimulator using the make file per readme file instructions. no issues.

    Finally, I used “sudo RFSIMULATOR= ./nr-uesoftmodem –numerology 1 -r 106 -C 3510000000” to launch the UE for now, but I am getting an ERROR saying after configuring the card 7, nb antennas_tx/rx and setting the /dev/cpu_dma_latency set to 10 us :

    “[HW] library oai_device couldn’t be loaded”.

    I may assume this is a trivial error, reason by which I did not state all my CPU information and Ubuntu OS but if you think it is necessary please let me know, I did not want to add more lines to this question.


    1. Hi,

      1) CPU frequency scaling, disabling CPU performance, C-states, hyperthreading, P-states … is useless

      2) you have now to add –rfsim option
      sudo RFSIMULATOR= ./nr-uesoftmodem –numerology 1 -r 106 -C 3510000000 --rfsim
      😉 another person added this options, but didn’t update the document
      Note that you can use already now the interface without environment variables
      sudo ./nr-uesoftmodem –numerology 1 -r 106 -C 3510000000 --rfsim --rfsimulator.serveraddr

      Same for the gNB: add --rfsim --rfsimulator.serveraddr server


      1. Thank you so much, it works and I added the option -d for the scope; do you happen to know where I can get documentation on how the RFsimulator and the NR DL scope UE works?, I may assume “no” then I would have to go to the source code.
        Please let me know if the documentation is available somewhere.


        1. Hi,

          I wrote docuementation on rfsimulator in: targets/ARCH/rfsimulator/README.md
          The code may have evolved since this doc have been released, I will try to find time to update it
          Anyway, everything is in this directory: targets/ARCH/rfsimulator/
          and in: openair1/SIMULATIONS/TOOLS openair1/SIMULATIONS/RF

          There is no doc, the code is quite simple in:openair1/PHY/TOOLS/nr_phy_scope.c
          It takes data in globally accessible buffers and display it
          The difficulty is to understand each buffer usage.
          There is no good documentation for this, even if I wrote a tutorial https://open-cells.com/d5138782a8739209ec5760865b1e53b0/OAI-general.pdf


  3. Hi,

    I’m running rfsimulator, but I want to use savefile feature, in order to store the IQ samples. The main purpose is to analyze the physical layer, and build a link with matlab, in both directions. It can be very useful for physical layer development.

    My main problem is that I don’t know the IQ file format, I know there is header. Does the file store DL and UL samples? Is there any documentation?

    Many thanks!

    1. Hi,
      The rfsimulator file storage phase stores only Tx data, the stored would be used as Rx data.
      For actual RF data, the OAI USRP driver contains a feature to save Rx data for later replay as Rx data.

      The data is organized as consecutive blocks of data with a header.
      The header format is in targets/ARCH/COMMON/common_lib.h, type: samplesBlockHeader_t
      The source stored_data.c is an example of the way to read the file:
      read one header: read(…, sizeof(samplesBlockHeader_t))
      use the header to compute the following samples bytes: header.size*header.nbAnt*4
      The 4 is there because a OAI sample is 2x16bits complex number (I and Q are short int, in native CPU bits order (likely Intel order)), I is first, Q follows,


      1. Hi Laurent,

        Thank you for the information, I have built a simple matlab script which extracts the samples. Now I’m doing some tests with LTE toolbox.

        The OAI USRP driver feature for saving Rx data is documented somewhere?

        Many thanks again.


  4. Dear Forum memnbers,

    We are trying to bring up the OAI code base, on the RF simulator mode.

    We are doing the following:

    PC 1 : OS 16.04 Ubuntu with low latency kernel – 4.4.10 version
    PC 2 : OS 16.04 Ubuntu with low latency kernel – 4.4.10 version

    Code used: Latest from OAI development branch.
    Logs from the eNB PC and the UE PC we have sent to the contact@open-cells.com mail ID.

    Pls suggest what can be done.

    Can you also pls provide the conf files for bringing up the rf simulator setup?

    Mohamed Ithiris

    1. Hi,

      You may use a up to date ubuntu, but it is not the issue, neither the file names (you swapped trace files names)
      Your traces are screen shot image, there is the command line you typed)

      The UE tells very clearly can’t reach IP@:
      Please debug locally yourself with Linux people (like netstat, wireshark to see the TCP connection failure reason)


  5. Laurent,

    Thanks a lot mate for your help, just another quick question, I can see that in the current OAI demos, static TDD was used, do you guys have ever tried FDD communication?

  6. Laurent,

    Thanks again for helping here, in regards of 5G, I have seen documentation on how to connect OAI eNB (USRP B210) with COTS UE and your post talking about LTE OAI configuration. We need to test 5G FDD with COTS UE and also using a X300 running nr-uesoftmodem (just for testing purposes), from this I have just a couple of questions:

    1. Did your team perform this test OAI (NR CN, RAN) 5g FDD with UE COTS and/or x300 running nrUE?

    2. Where can I find the actual process (documentation) to set up the Core Network, RAN, nrUE COTs (Simcard configuration) and with a nrUE PC nr-uesoftmodem. I went through this page to set up the RFSimulator for NR which is working:


    1. Hi,
      In develop branch, as far we know, the only working case is the DL, in “phy-test” mode.
      No UL is working, RACH is also not here.
      Some other branch have code to merge soon.
      So, today, with develop branch, we are quite far from attaching a UE.
      Most of us are implementing “NSA” (non standalone => with 4G initial attachment) mode, so maybe it will come soon

      1. We are very interested in NSA too which most of the providers are following this path to deploy 5G, in this regard, could you please point me at the right web link to deploy:

        – LTE EPC.
        – LTE RAN and the way to add the gNB as secondary node. (I have not seen any documentation about this NSA scenario where in the RAN there is gNB attached to provide user plane 5g services)
        – I may assume that we can use a 5G UE COTs and the icon on the screen will say 5G because there is a gNB connected to the network, am I right?

        Thanks a lot.

  7. As many (All?) of the examples of OAI UE mode are from old releases (when lte-softmodem do as ENB and UE). Could you post examples about lte-uesoftmodem ? I’ve been fighting for a week trying just only to read SIBs from a commercial ENB with a BLADE2 testing all of releases, GITs etc etc.

    If I try

    ./lte-uesoftmodem.Rel14 -U 1 –noS1 -C 2660000000 -r 25 –ue-txgain 60 –ue-rxgain 50 -d –ue-nb-ant-rx 1 –ue-nb-ant-tx 1 -g 4

    I got

    Failed to set TX frequency: Provided parameter was out of the allowable range
    [BRF] brf_error: Provided parameter was out of the allowable range

    Thank you !!!

    1. Hi Jesus,
      The example is old, but not that much: please read it, as it uses ./lte-uesoftmodem as binary name for UE
      brf_error: the message is saying clearly that the RF board can’t emit at 2.66 GHz.
      We don’t have this RF board in our lab.

  8. Hi Laurent,

    Could you please explain more about the fact that the UE is not able to be beside eNB,PGW in one machine? Why we can not do it in all in one scenario? Gtp will anyway provide the interface and will assign an ip address for UE.

    Thank you,

    1. Hi Shahab,
      GTP tunnels the user plan data, fine, this is not the issue.
      The PGW show itself to the IP network as the UEs: the global IP routing ends UEs addresses in the PGW/Gi interface.
      The UE receives one IP address from the PGW, then it creates a IP interface in it’s computer with this address.

      So, if the PGW and the UE are in the same machine (the same Linux instance), there are two IP interfaces that captures the same IP address.
      This is not possible.

      So, we explain how to use Linux namespaces to separate one Linux instance into two separate groups (name spaces) of IP interfaces.
      Creating two virtual machines uses the same Linux kernel namespaces, nevertheless we don’t need the other parts of a virtual machine: we don’t need process/task separate namespace, neither separate filesystems.


      1. Hi Laurent,

        Thank you for your reply. It is an interesting topic.
        Do you mean because SPGW also is routing toward internet so performing kind of ping in its machine will not allow actually the UE sends the packets to internet so we might need another to do so? This doesn’t prevent to run the UE in the same machine though, it’s more routing issue if I understood correctly.

        Best Regards,

        1. Hi Shahab,

          To re-explain: you can’t have two IP interfaces, in the same machine, listening the same IP address.
          The SPGW listens the same address as the UE.

          The normal operator configuration: the SPGW have a list of IP addresses the operator can use on global internet.
          The SPGW captures the internet traffic to all these addresses and send to internet all the packets coming from the UEs.
          But, it doesn’t perform NAPT: it sends to each UE it’s own address, so the SPGW have only to remove the GTP IP-in-IP encapsulation to send the UE traffic in internet.


  9. Dear Laurent,
    your help is required on below issue. thanks in advance
    i am using two VMs.
    first VM to run rf-simulator with gnb and nr-ue

    and second VM to run epc-core, on core part i am running hss, mme and spgw-cups

    once i am starting the gNB, then it should give the stats on mme side that 1 gnb connected but its not happening so.

    gNB and nr-ue are getting connected to each other.

    could you suggest what may be the reason so that i am not getting any stats regarding gNB connected on MME?

    1. Hi Vikash,

      The gNB runs currently only in ‘phy-test’ mode.
      The development is far from being completed.
      Furthermore, 5G core (called 5GC) is different from EPC.

      Maybe I will make a page on 5G status.
      Best regards,

      1. Hi Laurent,

        I would like to elaborate more on vikash’s query. We would like to run in NSA mode(5G-RAN) and EPC. Is it possible in openairinterface, or it is yet to be developed?

        We are using below command to run UE and gNB. UE and gNB are getting connected. But we can’s see any message from gNB to UE.
        5G UE
        sudo RFSIMULATOR= ./nr-uesoftmodem –rfsim –phy-test –rrc_config_path ../../../ci-scripts/rrc-files –numerology 1 -r 106 -C 3510000000

        sudo RFSIMULATOR=server ./nr-softmodem -O ../../../targets/PROJECTS/GENERIC-LTE-EPC/CONF/gnb.band78.tm1.106PRB.usrpn300.conf –parallel-config PARALLEL_SINGLE_THREAD –rfsim


      2. Hi Laurent,
        I’m able to receive and decode MIB on nrUE from gNB in phy-test no s1 mode.
        In the current 5G state, am I able to ping nrUE from gNB?


  10. Dear laurent,
    Thanks for your valuable input.
    what is “phy-test” mode? have you written any article on how to use “phy-test” mode?
    could you please provide the link to use “phy-test”?

  11. Ok thank you Laurent!
    But now, following the develop branch, should I be able to ping from nrUE to gNB?


    1. Yes, I did it recently only with our RF simulator, but it should work with RF boards also.
      It is “phy-test” mode: a hardcoded scheluer allocates some radio resources blocks for one UE (no random access, no network entry, …)
      Nevertheless, the full path works end to end (Linux IP interface to Linux IP interface)

  12. Dear laurent,
    can we use OAI-UE with cots eNB? if so, could you suggest me some tutorial to configure/commands to use the same.


    1. Dear Vilkash,
      Yes, if you have the HSS database.
      The OAI UE uses only the internal software SIM, so you can’t use a regular operator SIM.
      If someone want to develop the interface to a true SIM in the UE, I think it is not a huge development.

      1. Dear laurent,
        Thanks for your input on oai-ue with cots enb.
        here i have understood oai-ue means some simulated UE provided by openairinterface,
        which can communicate with COTS eNB , did you mean the same?

        one more question if we use simulated UE with COTS eNB, then which interface they use to communicate each other?

        1. Hi,
          This is a UE LTE modem, as the signal processing is done by the CPU, it require CPU power.
          The external behavior is almost as a Huawei dongle like E3372: it creates a IP interface in the linux machine, that you can route IP packets in it.
          As I said: the commercial SIM interface is lacking, so no interoperability tests have been done yet with commercial eNB.
          Nevertheless, the OAI eNB runs fine with commercial UE, so the OAI UE is likely implementing the 3GPP LTE standard.

          1. Dear laurent,
            Your help is appreciated, here
            I am trying to connect OAI-UE and LIMESDR-USB.
            I am executing eNB as:

            sudo ./targets/bin/lte-softmodem.Rel14 -O targets/PROJECTS/GENERIC-LTE-EPC/CONF/enb.band7.tm1.25PRB.usrpb210\(\ USED\ FOR\ LIMESDR\)\ \(1\).conf –rf-config-file ./targets/ARCH/LMSSDR/LimeSDR_above_1p8GHz_1v4.ini

            eNB is getting attached to MME.

            I am executing UE as:
            sudo ./cmake_targets/lte_build_oai/build/lte-uesoftmodem -U 1 -C 2680012000 -r 25 –ue-rxgain 125 –ue-txgain 125 –ue-max-power 0 –ue-scan-carrier –phy-test –nokrnmod 1 –noS1 2>&1 | tee UE.lo

            While executing UE I am getting below logs:
            [LOADER] library liboai_device.so successfully loaded
            LMSSDR: Initializing openair0_device for RRU …
            cal 0: freq 3500000000.000000, offset 44.000000, diff 819988000.000000
            cal 1: freq 2660000000.000000, offset 55.000000, diff 20012000.000000
            cal 2: freq 2300000000.000000, offset 54.000000, diff 380012000.000000
            cal 3: freq 1880000000.000000, offset 54.000000, diff 800012000.000000
            cal 4: freq 816000000.000000, offset 79.000000, diff 1864012000.000000
            [HW] [RRU] has loaded LMSSDR device.

            Cannot claim interface – Resource busy
            Failed to open device
            connection is not open
            TransferPacket: Write failed (ret=0)
            connection is not open
            TransferPacket: Write failed (ret=0)
            Failed to open. Device is busy.
            Unable to open device
            Can’t open device port: Failed to open. Device is busy.

            Am I doing something wrong ??

    1. Hi,
      The normal way is to configure it in the smartphone.
      The only file I know is EF-ACL which is “APN Control List”, in the SIM.
      It can contain the APN names which the Operator wants the Device to use, but it is here to limit the possibilities.

      1. Thanks for your response. Is there some example of EF-ACL ? Is it an option in sim.conf? Or a separated file?

  13. I am trying to run the rfsim for 5G NR. I checked out the develop branch. But when I run the ue side code
    sudo RFSIMULATOR= ./nr-uesoftmodem –rfsim –phy-test –rrc_config_path ../../../ci-scripts/rrc-files

    I do not see any folder at the location ci-scripts/rrc-files. The script throws error that

    [HW] Version: Branch: develop Abrev. Hash: 12e5fe339 Date: Wed Jul 1 07:34:38 2020 +0200

    Assertion (fd) failed!
    In openair_rrc_top_init_ue_nr() /home/ubadmin/openairinterface5g/openair2/RRC/NR_UE/rrc_UE.c:336
    cannot read file ../../../ci-scripts/rrc-files/reconfig.raw: errno 2, No such file or directory

Leave a Reply

Your email address will not be published. Required fields are marked *