When we check if the pointer is NULL before CALLOCing,
then the gNB will crash. It seems that we are mostlikely
leaking memeory since the gNB only crashes with the old
change. By reverting these changes, the gNB does not crash.
We are seeing UE-to-UE IP traffic on this commit when
the tunnel interfaces are established (~50% of the time).
In this commit, we changed the UCI handling.
When the UL_TTI_REQ arrives at the NRUE it
has info related to how many UCIs we should
pull from the queue and send to the gNB. If
we do not have that many UCIs available (likely
becasue a DL_TTI_REQ is late), then we will
requeue the UL_TTI_REQ and wait until we have
all the UCI indications before multiplexing.
This change makes it easier to handle multiple
UCIs becasue previously we would send what we
had and then try again later which made keeping
track of the UL_TTI_REQ and second UCI more
difficult.
Also, we had two heap-buffer-overflow crashes while
filling the CRC_IND and RX_IND. The corrected CALLOC
command is included in this commit as well.
Lastly, we included a better fix for handling late
DL_TTI_REQs. If the number of active harqs is larger
than the number of UCIs we have built, this is a good
indicator that the DL_TTI_REQ is late. To mitigate
problems, we will requeue the UL_TTI_REQ to when the
late DL_TTI_REQ comes in, we can handle the late
UCI that is built from it.
This commit includes a hack fix that has allowed
the Ip traffic to work in SA mode. Furthermore,
NSA mode (without the EPC) works in this commit
as well with up to 4 NSA UEs. We will need to
understand better the issue with the UL_DCI
handling in the NRUE that was causing the gNB
to crash.
The AssertFatal in the gNB when the gNB runs out
of downlink HARQ PIDs is caused by the NRUE
receiving a UL_DCI and then building BOTH a UCI
and a CRC/RX pair. So we are essentially sending
a UL and DL DCI to the gNB in this case which
results in an unexpected HARQ PID being received
in the gNB. The filtering in this commit stops
the UCI being built in the NRUE when a UL_DCI
is recevied.
The IP traffic of a single NRUE works most
of the time in this commit. There seems to
be a bug in the gNB and it will occassionally
crash with a heap-buffer-overflow. This will
be looked at in the next commit.
The changes in this commit include gathering
all of the UCI indications in the queue that
have the same scheduled sfn_slot and sending
them as one aggregated UCI when the scheduled
sfn_slot matches the received ul_tti_request.
The following was changed in this commit:
- A new struct in the mac instance was created
for all emulated L1 fields.
- NR UE RRC state bug was fixed
- Checking the RAR rnti based on the MAC instance
ra.ra_rnti and not hardcoding to 0x10b
- Modified the name of the new emulate_l2 flag
to make sense: emulate_l1
For multiple UEs, we need to be able to filter the rx'd messages by
the RNTI. However, we do not have the RNTI value until the CFRA (NSA)
or CBRA (SA) procedure is complete. The check below will handle this.
Also, depending on the RNTI value, we can have a SIB (0xffff), RAR (0x10b),
Msg3 (TC_RNTI) or an actual DCI message (CRNTI). When we get Msg3, the
MAC instance of the UE still has a CRNTI = 0. Only once the RA procedure
succeeds is the CRNTI value updated to the TC_RNTI.
1. The preamble index in the NRUE is random for SA.
Using the preamble index from the mac->ra is
correct.
2. The dl_pathloss calculated is from L1. We should
shunt this feature out for our emulated mode. If
we add the abstraction later, we can model the
pathloss in the proxy and update it in the RA
procedure of the NRUE.
3. Checking that the crnti != t_crnti is not valid
for SA mode. And may only be needed for multi-UE
in NSA mode. We might be able to delete it all
together. For now, we only use for NSA mode.
4. Checking the RAR based on rnti = 10b and not the
RA_STATE is better.
Also, in the nr_rrc_mac_config_req_ue(), we should
only be configuring L1 if we are not in the L2 emul
mode. We are crashing due to the RRC state in the NRUE
not being set/checked properly.
In this commit, we changed the stub function of the NRUE
to handle the MIB and SIB1, which arrive in a single
DL_TTI_REQ. If we have not received the MIB, we first
call the scheduler, then we handle any received NFAPI
messages. The NFAPI message handler will then call
the nr_ue_dl_indication() again, which will process
first the MIB, then SIB1. It seems that we are not
properly sending the SIB1 response back to the gNB so
the NRUE eventually crashes. We are however, properly
decoding the MIB and SIB which is a step in the right
direction!
In the previous commit, the NRUE would record
the time it received a slot and compare this
rx time to the next slot. If the next slot
came in before it had been 500us, the NRUE
would sleep a delta amount to make the duration
between the two slot indications 500 us. This
change complicated the code and did not
improve the performance so it was removed.
Furthermore, this commit removes the old
queueing mechanism of the slot indications and
uses calloc rather than an array.
In SA mode, there were DCI_INDs and RX_INDS that
were allocated on the stack and were assigned to
pointers used in the MAC instance. In NSA mode we
allocated these members on the heap so we free'd
them once we were done. In SA mode, they were not
allocated on the heap so this free call caused an
a free() error. We have now allocated these pointers
on the heap to avoid this error and ensure the
pointers are correct.
Also, this commit changes the len argument in the
pusharray32 to match the actual field type (uint16_t).
There is also simple name change from sf -> slot.
The new queueing system is not a permanent solution.
It was simply a way for us to try to handle late
dl_tti_requests. If we queue every single ul_tti_req
that we get, the queue gets full very quickly becasue
we only remove ul_ttis from the queue when a uci has
been populated with a matching sfn/sf. Because of this,
we only queue ul_ttis if we have a uci_indication
prepared already. Rarely, a dl_tti_req will arrive at
the NRUE too late, and the NRUE does not have time
to create the uci_ind so we dont process the corresponding
ul_tti. A seprate queue was made to hold all other ul_ttis
the arrive in the NRUE (this queue will continuously
get full and then emptied) but will occasionally hold
a ul_tti that corresponds to a uci that hasnt
been populated yet.
Laurent THOMAS