From c4570bc829d1b94f6d9f276603fa208b2cbdb3d2 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 12 Jul 2024 17:28:23 +0200 Subject: [PATCH 1/2] Avoid segfault in SRS modulation when ue-nb-ant-tx (fp) does not match UE capabilities * the mismatch between UE capabilities, passed to PHY by NFAPI PDU, and --ue-nb-ant-tx causes a segfault in SRS modulation * issue with indexing txdataF[p_index], which fails due to an out-of-bounds access since first dimension of txdataF is sized based on ue->frame_parms.nb_antennas_tx * N_ap used in SRS modulation is based on the number of antenna ports in the SRS configuration (srs_config_pdu->num_ant_ports) --- openair1/PHY/NR_UE_TRANSPORT/srs_modulation_nr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/openair1/PHY/NR_UE_TRANSPORT/srs_modulation_nr.c b/openair1/PHY/NR_UE_TRANSPORT/srs_modulation_nr.c index 4af545b931..02ad38cc0e 100644 --- a/openair1/PHY/NR_UE_TRANSPORT/srs_modulation_nr.c +++ b/openair1/PHY/NR_UE_TRANSPORT/srs_modulation_nr.c @@ -205,7 +205,9 @@ int generate_srs_nr(nfapi_nr_srs_pdu_t *srs_config_pdu, uint16_t T_SRS = srs_config_pdu->t_srs; uint16_t T_offset = srs_config_pdu->t_offset; uint8_t R = 1<num_repetitions; - uint8_t N_ap = 1<num_ant_ports; // Number of antenna port for transmission + /* Number of antenna ports (M) can't be higher than number of physical antennas (N): M <= N */ + uint8_t num_ant_ports = 1 << srs_config_pdu->num_ant_ports; // Number of antenna port for transmission + int N_ap = num_ant_ports > frame_parms->nb_antennas_tx ? frame_parms->nb_antennas_tx : num_ant_ports; uint8_t N_symb_SRS = 1<num_symbols; // Number of consecutive OFDM symbols uint8_t l0 = frame_parms->symbols_per_slot - 1 - l_offset; // Starting symbol position in the time domain uint8_t n_SRS_cs_max = srs_max_number_cs[srs_config_pdu->comb_size]; From 101f178c3ef426ebb0ba1f6744415dffed3c8913 Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Mon, 15 Jul 2024 16:23:20 +0200 Subject: [PATCH 2/2] Verify UE capabilities at RRC UE initialization * number of configured SRS antenna ports M <= N (number of physical antenna ports) --- executables/nr-ue.c | 2 +- openair2/RRC/NR_UE/rrc_UE.c | 16 +++++++++++++++- openair2/RRC/NR_UE/rrc_proto.h | 2 +- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/executables/nr-ue.c b/executables/nr-ue.c index 8a73bdd311..431bf26e3d 100644 --- a/executables/nr-ue.c +++ b/executables/nr-ue.c @@ -989,7 +989,7 @@ void *UE_thread(void *arg) void init_NR_UE(int nb_inst, char *uecap_file, char *reconfig_file, char *rbconfig_file) { - NR_UE_RRC_INST_t *rrc_inst = nr_rrc_init_ue(uecap_file, nb_inst); + NR_UE_RRC_INST_t *rrc_inst = nr_rrc_init_ue(uecap_file, nb_inst, get_nrUE_params()->nb_antennas_tx); NR_UE_MAC_INST_t *mac_inst = nr_l2_init_ue(nb_inst); AssertFatal(mac_inst, "Couldn't allocate MAC module\n"); diff --git a/openair2/RRC/NR_UE/rrc_UE.c b/openair2/RRC/NR_UE/rrc_UE.c index c4efe51e8b..cab08077ce 100644 --- a/openair2/RRC/NR_UE/rrc_UE.c +++ b/openair2/RRC/NR_UE/rrc_UE.c @@ -297,7 +297,19 @@ void process_nsa_message(NR_UE_RRC_INST_t *rrc, nsa_message_t nsa_message_type, } } -NR_UE_RRC_INST_t* nr_rrc_init_ue(char* uecap_file, int nb_inst) +/** + * @brief Verify UE capabilities parameters against CL-fed params + * (e.g. number of physical TX antennas) + */ +static bool verify_ue_cap(NR_UE_NR_Capability_t *UE_NR_Capability, int nb_antennas_tx) +{ + NR_FeatureSetUplink_t *ul_feature_setup = UE_NR_Capability->featureSets->featureSetsUplink->list.array[0]; + int srs_ant_ports = 1 << ul_feature_setup->supportedSRS_Resources->maxNumberSRS_Ports_PerResource; + AssertFatal(srs_ant_ports <= nb_antennas_tx, "SRS antenna ports (%d) > nb_antennas_tx (%d)\n", srs_ant_ports, nb_antennas_tx); + return true; +} + +NR_UE_RRC_INST_t* nr_rrc_init_ue(char* uecap_file, int nb_inst, int num_ant_tx) { NR_UE_rrc_inst = (NR_UE_RRC_INST_t *)calloc(nb_inst, sizeof(NR_UE_RRC_INST_t)); AssertFatal(NR_UE_rrc_inst, "Couldn't allocate %d instances of RRC module\n", nb_inst); @@ -328,6 +340,8 @@ NR_UE_RRC_INST_t* nr_rrc_init_ue(char* uecap_file, int nb_inst) assert(dec_rval.code == RC_OK); } fclose(f); + /* Verify consistency of num PHY antennas vs UE Capabilities */ + verify_ue_cap(rrc->UECap.UE_NR_Capability, num_ant_tx); } memset(&rrc->timers_and_constants, 0, sizeof(rrc->timers_and_constants)); diff --git a/openair2/RRC/NR_UE/rrc_proto.h b/openair2/RRC/NR_UE/rrc_proto.h index 1de5c19122..739d81cb4e 100644 --- a/openair2/RRC/NR_UE/rrc_proto.h +++ b/openair2/RRC/NR_UE/rrc_proto.h @@ -53,7 +53,7 @@ extern queue_t nr_tx_req_queue; extern queue_t nr_ul_dci_req_queue; extern queue_t nr_ul_tti_req_queue; -NR_UE_RRC_INST_t *nr_rrc_init_ue(char* uecap_file, int nb_inst); +NR_UE_RRC_INST_t *nr_rrc_init_ue(char* uecap_file, int nb_inst, int num_ant_tx); void init_nsa_message (NR_UE_RRC_INST_t *rrc, char* reconfig_file, char* rbconfig_file); void process_nsa_message(NR_UE_RRC_INST_t *rrc, nsa_message_t nsa_message_type, void *message, int msg_len);