This commit resolves undefined behaviour runtime errors related
to misaligned memory access. E.g.
> openair3/NAS/COMMON/IES/FGSMobileIdentity.c:193:3:
> runtime error: store to misaligned address 0x608000021e2b for type 'uint16_t',
> which requires 2 byte alignment 0x608000021e2b: note: pointer points here 00 f1 ...
* ENCODE_U24: safely encode 24-bit values into a buffer
by using memcpy to copy 3 bytes in network byte order (big-endian).
* ENCODE_U16: safely encodes a 16-bit value into a buffer, handling
misalignment by memcpy 2 bytes to buffer in network byte order (big-endian).
* In LTE there is logic that checks the thread configurtion with the
getters `get_thread_parallel_conf()` and `get_thread_worker_conf()`
in NR these getters are not used, only setters, which have no impact
* buffer is allocated but not freed after use by PDCP
> Direct leak of 192 byte(s) in 3 object(s) allocated from:
> 0 0x7ffff74b4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> 1 0x55555775ee74 in encode_dyn_cb /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/per_encoder.c:23
> 2 0x55555774776e in _uper_encode_flush_outp /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:126
> 3 0x55555774776e in uper_encode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:36
> 4 0x555557747c91 in uper_encode_to_new_buffer /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:85
> 5 0x5555576c5172 in do_NR_ULInformationTransfer /openair2/RRC/NR/MESSAGES/asn1_msg.c:965
> 6 0x555556fba691 in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1819
> 7 0x555556fc4d2e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1717
> 8 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* bcch_message is malloced by ASN.1 decoder and needs to be always freed after use along with its contents
> Direct leak of 64 byte(s) in 1 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x555557737ecd in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
>2 0x555557746f81 in uper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
>3 0x5555577471fe in uper_decode_complete /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:16
>4 0x555556f8b1c9 in nr_rrc_ue_decode_NR_BCCH_DL_SCH_Message /openair2/RRC/NR_UE/rrc_UE.c:732
>5 0x555556fbc365 in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1775
>6 0x555556fc4c2e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1718
>7 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* strdup is returning a malloced string that needs to freed after use
> Direct leak of 90 byte(s) in 1 object(s) allocated from:
>0 0x7ffff745b9a7 in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:454
>1 0x555556c7b341 in main /executables/nr-uesoftmodem.c:461
>2 0x7ffff5e29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
* local dl_dcch_msg shall be freed after use
> Direct leak of 384 byte(s) in 6 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x555557737ced in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
>2 0x555557746da1 in uper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
>3 0x555556fa4b31 in nr_rrc_ue_decode_dcch /openair2/RRC/NR_UE/rrc_UE.c:1612
>4 0x555556fbb25c in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1792
>5 0x555556fc4a4e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1718
>6 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* allocate memory in heap for the struct ue_CapabilityRAT_Container used locally for buffer encoding
* free the struct members only for the ul_dcch_msg allocated on the stack
> Direct leak of 40 byte(s) in 1 object(s) allocated from:
> 0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> 1 0x555556f7a89f in nr_rrc_ue_process_ueCapabilityEnquiry /openair2/RRC/NR_UE/rrc_UE.c:1861
> 2 0x555556fa4d85 in nr_rrc_ue_decode_dcch /openair2/RRC/NR_UE/rrc_UE.c:1650
> 3 0x555556fbb33c in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1790
> 4 0x555556fc4b2e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1716
> 5 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* the mismatch between UE capabilities, passed to PHY by NFAPI PDU, and --ue-nb-ant-tx
causes a segfault in SRS modulation
* issue with indexing txdataF[p_index], which fails due to an out-of-bounds access
since first dimension of txdataF is sized based on ue->frame_parms.nb_antennas_tx
* N_ap used in SRS modulation is based on the number of antenna ports
in the SRS configuration (srs_config_pdu->num_ant_ports)
* the goal is to make the documentation more procedural and
descriptive and easier to understand
* added missing info in RLC-NR about reassembling of AM frames
* nb_re_pdsch is directly linked to nb_rb_pdsch, if the latter is 0 the
former is also 0
* compute average channel level only when number of RE for PDSCH is not 0
the average channel level will be set to 0 otherwise
* Added a log message to handle this special case, which is consequence
of other issues in the RX chain
* with this commit, the inconsistency in the RX chain will be handled
in later in nr_ue_pdsch_procedures with a demodulation failure
other minor changes:
* Improved clarity by using NR_NB_SC_PER_RB instead of hard-coded value 12 in nb of RBs calculation
* cleaned up unused variable and outdated comments
- according to 5.3.7.4 of TS 38.331: 1> re-establish RLC for SRB1;
- gNB:
1) re-establish RLC for SRB1 in nr_rlc_update_id
2) re-establish RLC for remaining RBs concurrently with RRCReconfiguration
issue: gNB) in nr_rlc_update_id the gNB is re-establishing RLC for all
RBs at the same time when receiving RRCReestablishmentRequest
from UE
UE) according to the specs, the UE is re-establishing RLC for
SRB1 with RRCReestablishmentRequest the other RBs are
re-established during RRCReconfiguration (in our case in
nr_rrc_ue_process_RadioBearerConfig) when receiving
reestablishRLC IE in rlc_BearerToAddModList
RLC TX) this leads to RLC counters mismatch after re-establishment:
control PDUs discarded until max nb of retx is reached
and then UL failure occurs
- remove PDCP reestablishment for DRBs from RRCReestablishment message generation
- do PDCP reestablishment and CUUP notification calls after reception or RRCReestablishmentComplete
- this is necessary to make it consistent with the RRCReconfiguration message that contains
RadioBearerConfig with the list of bearers to add/release
which is followed by PDCP re-establishment at UE
- SRB1 shall be re-established at the time of RRCReestablishmentRequest
according to 5.3.7.4 of 3GPP TS 38.331
- SRB2 shall be re-established when creating srb-ToAddModList
according to 5.3.5.6.3 of 3GPP TS 38.331
- adding a new test case
- the test case simulate a DL radio channel with noise and runs Iperf test with such channel conditions
- use CustomCommand class to send commands to a Telnet server
- switched from netcat’s unsupported -N option (OpenBSD) to --send-only (Ncat 7.94) for compatibility with CI
re-sync CI test in F1 RFSIM
- to be used in the future, for CI of RRCReestablishment in RFSIM
- adding four new test cases (040021, 040022, 040023, 040023) to the RFSIM F1 configuration
- the test cases simulate a disruption of the radio channel, verify UE sync loss and resync
and restore the original channel conditions
- use CustomCommand class to send commands to a Telnet server
temp xml
- this change simplifies the enum definition and makes it easier
to add, remove, or modify states in the future
- the states are now defined in the NR_UE_L2_STATES macro,
and the enum members are generated automatically from this macro
- PDCP reestablishment on CUCP (DRBs) triggering Bearer Context Modification procedures over E1
- Performing PDCP reestablishment for requested DRBs on CUUP
- Introduced function to notify re-establishment to CU-UP
- removed call to PDCP reestablishment for the DRBs on CUCP (it's done on CUUP)
cuup_notify_reestablishment:
- to fetch PDU session to setup in E1 following logic as in e1_send_bearer_updates
- fill bearer context modification request with stored F1-U tunnel information
during E1 reestablishment, otherwise it would initialized to 0 by default
- update GTP tunnel with the stored configuration after E1 reestablishment
- many structs and definitions are overlapping between the two different E1 procedures
- introduced naming specific to E1 Bearer Context Modification to improve readability
- grouped SDAP and PDCP configuration IEs for better reusability and readability
- introduced functions to set and get default PDCP config (DRBs and Bearer Contexts)
find_or_next_pdu_session:
- find_or_next_pdu_session refers to the E1 Bearer Context Modification Request
-- therefore it has to return pdu_session_to_mod_t* and takes in input e1ap_bearer_mod_req_t *
see !MR2545 for more context
- according to specs, in NR there are 4 SRBs
- in OAI the relevant define is used in the RRC procedures
- this commit harmonizes code by removing redundancy
- triggered by RRC reconfiguration events according to clause 5.3.5.6.5 of TS 38.331
- This procedure does QoS flow to DRB mapping according to clause 5.3.1 of TS 37.324
- QoS flows to DRBs to be released are also handled
- deleted: ../../../executables/rfsim.c
- removed unused command line options to set SINR and SNR
- removed unused functions to get SINR and SNR
- removed unused RFSIM struct members
- CU-CP replying to the CU-UP with a Setup Failure message in case of unsuccessfull E1 Setup Request
- message is decoded by the CU-UP, and stops the process
Guido Casati