In FDD mode, the UE_mode switches to PUSCH mode before the initial TA value was applied.
Because of this, the ta_command was misinterpreted.
Fix this by adding 31 to the initial TA comamnd and handle it the same as TA updates.
Implement data transfer (38.331 5.2):
- transmit operation (in nr_pdcp_entity_recv_sdu)
- receive operation (in nr_pdcp_entity_recv_pdu)
- t-Reordering expiration
To keep track of time the function nr_pdcp_wakeup_timer_thread has been
added and is called by the gNB's MAC scheduler via nr_pdcp_tick.
(The UE has not been modified.)
A thread has been introduced to set time of all the existing PDCP
entities in the system. This probably does not scale well with many
PDCP entities (many UEs connected to the gNB). To be changed at some
point when needed. Hopefully, with a few UEs this mechanism won't be
too problematic (ie. won't cause realtime problems).
The problem with time in PDCP is that SDUs are kept if some are
missing, to do reordering. A timer is started and when it expires
we have to transmit the SDUs even if some are still missing. We
want to do that as soon as possible. So we have to check timers
often (every millisecond).
In RLC the time is set when there is some activity (SDU or PDU
received). In PDCP we cannot wait for this kind of activity. We
would keep packets longer than necessary, which may disturb
upper layers (think: TCP). That is why we introduced the thread,
as a simple mechanism to keep packets no longer than necessary.
The locking done by this thread may create realtime issues.
The whole logic of time keeping can be changed later if it turns
out that it is not efficient.
The functions dealing with DRB AM have been removed. All the types
of PDCP entities (DRB AM, DRB UM, SRB) use the same mechanism for
transmit and receive operations. So the code has been made common
for all those types.
We don't deal with:
- entity re-establishment, entity release or entity suspend
- SDU discard (the timer is present but not used)
- status reporting
- data recovery
- data volume calculation
- header compression / decompression
There is no plan to implement those features in a near future.
Integrity protection is not done yet, and will be implemented soon.
Minimalist gnb tracer to trace (for the moment) rxdataF when some
decoding for PUCCH or PUSCH has been done.
Important: T_BUFFER_MAX and T_CACHE_SIZE have been changed. T_BUFFER_MAX
is twice as big as before. T_CACHE_SIZE has been devided by two. Globally,
the memory usage of the T tracer is the same, but since we divided by two
the number of buffers in the cache, we may hit some realtime problems if
all the buffers are busy at some point. The simple solution would be to
use 8192*2 for T_CACHE_SIZE as it was, but then we double the memory usage
of the T tracer. This, or another solution, to be defined.
MR1029 : Benetel driver update
This MR fixes an issue with the driver for the 4G Benetel RRUs.
Power levels on the 5G side were adapted to avoid saturation of the signals.
5G performance is now the same as with USRP.
Support for 2 antennas for both 4G and 5G was added
MR1062 : fixing the RE offset for each Rx antenna in pusch channel estimation
This code allocates memory from the heap:
```
static void *UE_phy_stub_standalone_pnf_task(void *arg)
{
...
UL_INFO->crc_ind.crc_indication_body.crc_pdu_list =
calloc(NB_UE_INST, sizeof(nfapi_crc_indication_pdu_t));
```
I see NB_UE_INST==1.
Then this code:
```
void fill_crc_indication_UE_MAC(int Mod_id,
int frame,
int subframe,
UL_IND_t *UL_INFO,
uint8_t crc_flag,
int index,
uint16_t rnti,
nfapi_ul_config_request_t
*ul_config_req) {
...
nfapi_crc_indication_pdu_t *pdu =
&UL_INFO->crc_ind.crc_indication_body
.crc_pdu_list[UL_INFO->crc_ind.crc_indication_body.number_of_crcs];
```
used .number_of_crcs to index into .crc_pdu_list without first
checking if .number_of_crcs is in range.
When run with multiple UEs, sometimes .number_of_crcs==1 and then
-fsanitize=address complains.
Change is to use NUMBER_OF_UE_MAX instead of NB_UE_INST.
With this change, -fsanitize=address stopping complaining.
-fsanitize=address detected that we were trying to access bytes
past the end of a block of malloc'ed memory.
Specifically, in this code:
```
} else if (ENB_NAS_USE_TUN) {
if( LOG_DEBUGFLAG(DEBUG_PDCP) )
log_dump(PDCP, pdcpData, sizeToWrite, LOG_DUMP_CHAR,"PDCP
output to be sent to TUN interface: \n");
ret = write(nas_sock_fd[0], pdcpData, sizeToWrite);
```
-fsanitize=address said:
```
==80==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x61100004ffdc at pc 0x7f57c5f576a5 bp 0x7f57bb53c240 sp
0x7f57bb53b9e8
READ of size 108 at 0x61100004ffdc thread T7
0x61100004ffdc is located 0 bytes to the right of 220-byte region
[0x61100004ff00,0x61100004ffdc)
```
So, the code was trying to access the first byte after a block of
heap memory.
sizeToWrite was calculated like this:
```
int sizeToWrite= sizeof (pdcp_data_ind_header_t) +
pdcpHead->data_size;
```
There were a few other similar invocations of write() in the same
function used the wrong size. That sizeToWrite calculation
should be used only when the header is being sent, too, which
happens in only one place in this function.
With this commit, our tests pass and -fsanitize=address is happy.
The global mbms_rab_id was defined as `uint16_t` in
eNB_scheduler_mch.c but `int` in other places. So, code that
wrotes this global would clobber the two bytes that follow the
variable in memory.
Found by `-fsanitize=address`.
In phy_free_lte_eNB in lte_init.c, the lte-uesoftmodem would
crash during shutdown because it was dereferencing null pointers.
This commit adds checks to avoid that.
For some reason the htons invocation got deleted which broke
the VNF P7 interface.
Also fixed some build issues, not sure how these got onto the
develop branch to begin with.
Thomas Schlichter