* In LTE there is logic that checks the thread configurtion with the
getters `get_thread_parallel_conf()` and `get_thread_worker_conf()`
in NR these getters are not used, only setters, which have no impact
* buffer is allocated but not freed after use by PDCP
> Direct leak of 192 byte(s) in 3 object(s) allocated from:
> 0 0x7ffff74b4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> 1 0x55555775ee74 in encode_dyn_cb /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/per_encoder.c:23
> 2 0x55555774776e in _uper_encode_flush_outp /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:126
> 3 0x55555774776e in uper_encode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:36
> 4 0x555557747c91 in uper_encode_to_new_buffer /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:85
> 5 0x5555576c5172 in do_NR_ULInformationTransfer /openair2/RRC/NR/MESSAGES/asn1_msg.c:965
> 6 0x555556fba691 in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1819
> 7 0x555556fc4d2e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1717
> 8 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* bcch_message is malloced by ASN.1 decoder and needs to be always freed after use along with its contents
> Direct leak of 64 byte(s) in 1 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x555557737ecd in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
>2 0x555557746f81 in uper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
>3 0x5555577471fe in uper_decode_complete /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:16
>4 0x555556f8b1c9 in nr_rrc_ue_decode_NR_BCCH_DL_SCH_Message /openair2/RRC/NR_UE/rrc_UE.c:732
>5 0x555556fbc365 in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1775
>6 0x555556fc4c2e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1718
>7 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* local dl_dcch_msg shall be freed after use
> Direct leak of 384 byte(s) in 6 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x555557737ced in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
>2 0x555557746da1 in uper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
>3 0x555556fa4b31 in nr_rrc_ue_decode_dcch /openair2/RRC/NR_UE/rrc_UE.c:1612
>4 0x555556fbb25c in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1792
>5 0x555556fc4a4e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1718
>6 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* The RRC task is freeing the ITTI message but the message members that are allocated separetely still need to be freed
> Direct leak of 470 byte(s) in 6 object(s) allocated from:
>0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>1 0x55555721f117 in itti_malloc /common/utils/ocp_itti/intertask_interface.cpp:64
>2 0x555556f2356c in deliver_sdu_srb /openair2/LAYER2/nr_pdcp/nr_pdcp_oai_api.c:775
>3 0x555556f4e10e in nr_pdcp_entity_recv_pdu /openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c:184
>4 0x555556f278ad in do_pdcp_data_ind /openair2/LAYER2/nr_pdcp/nr_pdcp_oai_api.c:285
>5 0x555556f278ad in pdcp_data_ind_thread /openair2/LAYER2/nr_pdcp/nr_pdcp_oai_api.c:307
>6 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* allocate memory in heap for the struct ue_CapabilityRAT_Container used locally for buffer encoding
* free the struct members only for the ul_dcch_msg allocated on the stack
> Direct leak of 40 byte(s) in 1 object(s) allocated from:
> 0 0x7ffff74b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> 1 0x555556f7a89f in nr_rrc_ue_process_ueCapabilityEnquiry /openair2/RRC/NR_UE/rrc_UE.c:1861
> 2 0x555556fa4d85 in nr_rrc_ue_decode_dcch /openair2/RRC/NR_UE/rrc_UE.c:1650
> 3 0x555556fbb33c in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:1790
> 4 0x555556fc4b2e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:1716
> 5 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
* strdup() function is returning a malloced string
which must be freed after use
* replace the strdup with direct use of strings to avoid heap allocation
> Direct leak of 23 byte(s) in 1 object(s) allocated from:
> 0 0x7ffff745b9a7 in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:454
> 1 0x555559e36f87 in RCconfig_nr_parallel /openair2/GNB_APP/gnb_config.c:2054
> 2 0x555559e38ea3 in NRRCConfig /openair2/GNB_APP/gnb_config.c:2097
> 3 0x555559155542 in get_options /executables/nr-softmodem.c:423
> 4 0x555559155542 in main /executables/nr-softmodem.c:623
> 5 0x7ffff5e29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
> Direct leak of 14 byte(s) in 1 object(s) allocated from:
> 0 0x7ffff745b9a7 in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:454
> 1 0x555559e370c5 in RCconfig_nr_parallel /openair2/GNB_APP/gnb_config.c:2063
> 2 0x555559e38ea3 in NRRCConfig /openair2/GNB_APP/gnb_config.c:2097
> 3 0x555559155542 in get_options /executables/nr-softmodem.c:423
> 4 0x555559155542 in main /executables/nr-softmodem.c:623
> 5 0x7ffff5e29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
38.473 requires to reset UE-related contexts in F1 Setup Request, so do
it.
However, avoid resetting UE states in phy_test: it has preconfigured UE
which we should not reset. Note that if NSA/phy-test used F1, we could
likely reset the UE state here, as the F1 UE context setup would come
afterwards.
This assert and assumption is incorrect, according to 38.101-1 UE channel is defined only by the BWP size
and BWP size can be any value supported by the RRC parameters defining the BWP.
To determine the UE channel the smallest bandwidth supporting the BWP is selected. This is an assumption based
on references in the same document to UE channel bandwidth being equal to one of the values in set
{5, 10, 15, 20, 25, 30, 35, 40, 50, 60, 70, 80, 90, 100}.
Also:
- calculated P_CMIN during BWP setup since the parameter doesn't depend on DCI.
- initiialize uniqCfg structure in test_nr_ue_power_procedures main function which enables LOG prints during tests
The next commit implements the release of all UEs following the F1 Reset
message. It uses nr_mac_release_ue(), which as of now, triggered a
release complete message automatically, which we don't want in the case
of F1 Reset.
This commit refactors the code to split UE release at MAC/RLC and
release complete message sending to allow to release UEs without sending
the complete. Corresponding users are updated.
* aper_decode allocates memory for for local pointer `pdusessionTransfer`, in `decodePDUSessionResourceSetup`
* this memory seems not to be freed but its members are by:
`ASN_STRUCT_FREE_CONTENTS_ONLY(asn_DEF_NGAP_PDUSessionResourceSetupRequestTransfer,pdusessionTransfer);`
which btw in its header says: "AVOID using it in the application code; Use a safer ASN_STRUCT_RESET() instead"
* the following mem leak was detected by ASAN:
```
Direct leak of 72 byte(s) in 1 object(s) allocated from:
*0 0x7ffff74b4a57 in __interceptor_calloc /src/libsanitizer/asan/asan_malloc_linux.cpp:154
*1 0x55555cb306df in SEQUENCE_decode_aper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_aper.c:36
*2 0x55555ca9fa28 in aper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/aper_decoder.c:78
*3 0x55555b99bae6 in decodePDUSessionResourceSetup /openair2/RRC/NR/rrc_gNB_NGAP.c:273
*4 0x55555b99fec2 in trigger_bearer_setup /openair2/RRC/NR/rrc_gNB_NGAP.c:357
*5 0x55555b9b54bf in rrc_gNB_process_NGAP_PDUSESSION_SETUP_REQ /openair2/RRC/NR/rrc_gNB_NGAP.c:830
*6 0x55555b936871 in rrc_gnb_task /openair2/RRC/NR/rrc_gNB.c:2428
*7 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
```
* This commit replaces ASN_STRUCT_FREE_CONTENTS_ONLY with ASN_STRUCT_FREE, which will free the memory allocated for the entire struct and its members
* fill_DRB_configList_e1 is filling `DRB_configList->list` then passing to PDCP
* the contents of the struct are allocated but seem not to be freed
* the following mem leak was detected by ASAN
```
Direct leak of 32 byte(s) in 1 object(s) allocated from:
*0 0x7ffff74b4c38 in __interceptor_realloc /src/libsanitizer/asan/asan_malloc_linux.cpp:164
*1 0x55555caa6a3e in asn_set_add /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27
*2 0x55555c8b8bb6 in fill_DRB_configList_e1 /openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c:42
*3 0x55555c8be6eb in e1_bearer_context_setup /openair2/LAYER2/nr_pdcp/cucp_cuup_handler.c:189
*4 0x55555d329668 in cucp_cuup_bearer_context_setup_direct /openair2/RRC/NR/cucp_cuup_direct.c:31
*5 0x55555b9a2c37 in trigger_bearer_setup /openair2/RRC/NR/rrc_gNB_NGAP.c:437
*6 0x55555b9b54bf in rrc_gNB_process_NGAP_PDUSESSION_SETUP_REQ /openair2/RRC/NR/rrc_gNB_NGAP.c:830
*7 0x55555b936871 in rrc_gnb_task /openair2/RRC/NR/rrc_gNB.c:2428
*8 0x7ffff5e94ac2 in start_thread nptl/pthread_create.c:442
```
* using ASN_STRUCT_RESET to free the memory used by the members of the structure
without freeing the structure pointer which is allocated on the stack
OAI 5GC seems to have a bug, and occasionally might send a PDU session
setup request without having sent a UE context setup request, resulting
in no security context activated for a UE. This lead to an assertion in
rrc_gNB_process_e1_bearer_context_setup_resp().
To prevent the gNB from stopping, check if security is active before
triggering PDU sessions. If not, the gNB will reject PDU sessions.
sched_ul_bytes is reduced already in case the last HARQ round fails through handle_nr_ul_harq() -> abort_nr_ul_harq().
Therefore, the reduction in nr_rx_sdu() is wrong, and btw. it wrongly assumes the max. UL HARQ rounds to 4.
So simply remove this peace of code in nr_rx_sdu().
sched_ul_bytes tracks the volume of in-flight data.
When data is successfully received, sched_ul_bytes is decreased in nr_rx_sdu().
In case of reusing HARQ processes, the tb_size stored there is not correct.
Therefore use the actual SDU size instead.
making aerial shm prefix configurable (so we can use muliptle VNFs per PNF)
making the nvipc thread affinity configurable and using threadCreate.
removing aerial_vnf_nr_aerial_p7_start_thread
In NSA, the RA process contains the RNTI of the UE to add. The previous
implementation would not remove the RNTI in NSA/for CFRA, which is
unclear (why should it stay? RA is over). Also, we did not clear all
contents, which masked a bug, as we were reusing an RA process for a
subsequent attach, leading to a segfault on reattach. That is fixed in
this commit.
Also, we were using the RA structure after having cleared it in
_nr_rx_sdu(), which semantically makes no sense.
To harmonize handling of the preambles: completely reset the RA
processes inside nr_clear_ra_proc(). For SA, also add the initialization
of allowed preambles.
Finally, this commit fixes a memory leak: we always (also in SA) fill a
list of preambles in a dynamically allocated preamble list. Since the
total list is only up to 64 preambles of 1B each, put it directly into
the struct instead of dynamically allocating it.
Remove the secondaryCellGroup variable in RRC, as it is not used there.
Note that in the case of F1, the secondaryCellGroup entirely belongs to
the DU, i.e., MAC. Also, we don't do anything with it in RRC.
NSA is quite verbose, some messages are large and it is not very
"interesting" for the average user. The logs can be enabled on demand,
or directly seen in Wireshark instead.
Guido Casati