Fix various bugs and inconsistencies in config read, SCTP, ITTI, GTP
Fix bugs across various layers, mostly layer 3, including memory leaks.
See the commits for more details.
SRS configuration
- Fix segmentation fault, a memory leak, and LOGs for SRS usage
NFAPI_NR_SRS_BEAMMANAGEMENT
- Refactor SRS configuration;
- Add SRS ResourceSet to get the SNR measurements at MAC layer
In this MR we have 2 SRS ResourceSet, for the same SRS Resource. This
way, in addition to obtaining the UL-RI, we also obtain the SNR in the
MAC and fill the PRB Black list.
This branch has been tested with COTS UE and with RFSim. The measured
values seem correct.
Using the USIM interface in the MAC is non-sensical (violates layer
separation). Add header include in nr-softmodem.c, which previously came
through nr_mac_gNB.h -> usim_interface.h.
Add configurable values of NR RLC and NR PDCP to the configuration file
This is for the gNB (the UE gets the values from the gNB).
The physical simulators were also adapted (we put the previously
hardcoded values that were everywhere in the code into the simulators
themselves). I don't think we need to have those values configurable for
the simulators, but I can study the possibility to add this if someone
tells me it's important (if not important I prefer not to do it, I am
not sure if it is trivial to do or not).
ASN_SEQUENCE_ADD is calling realloc which is allocating memory for the
'array' which was not freed.
> Direct leak of 32 byte(s) in 1 object(s) allocated from:
> #0 0x7ce97deb4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> #1 0x5813fba02574 in asn_set_add /openairinterface5g/n2-handover-preparation/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27
> #2 0x5813faf6c672 in createSRBlist /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:331
> #3 0x5813faf9aa78 in rrc_gNB_generate_RRCSetup /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:421
> #4 0x5813fafba2ee in rrc_handle_RRCSetupRequest /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1243
> #5 0x5813fafba2ee in rrc_gNB_process_initial_ul_rrc_message /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2019
> #6 0x5813fafcdc3a in rrc_gnb_task /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2761
> #7 0x7ce97c894ac2 in start_thread nptl/pthread_create.c:442
> Direct leak of 32 byte(s) in 1 object(s) allocated from:
> #0 0x7ce97deb4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> #1 0x5813fba02574 in asn_set_add /openairinterface5g/n2-handover-preparation/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27
> #2 0x5813faf6c672 in createSRBlist /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:331
> #3 0x5813faf7d89d in get_RRCReconfiguration_params /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:660
> #4 0x5813faf914b3 in rrc_gNB_generate_dedicatedRRCReconfiguration /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:716
> #5 0x5813faf96856 in rrc_CU_process_ue_context_setup_response /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2190
> #6 0x5813fafcd3ed in rrc_gnb_task /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2796
> #7 0x7ce97c894ac2 in start_thread nptl/pthread_create.c:442
dynamically allocated memory is pushed to the seq_arr that
is doing a memcpy, so it can be either or better allocated
in the stack instead
> Direct leak of 16 byte(s) in 1 object(s) allocated from:
> #0 0x7efd8f6b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> #1 0x577888f3457e in fill_neighbour_cell_configuration /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:1914
> #2 0x577888f3457e in RCconfig_NRRRC /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2108
> #3 0x57788869a0d2 in create_gNB_tasks /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:253
> #4 0x57788869a0d2 in main /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:619
> #5 0x7efd8e029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
the dynamically allocated memory is pushed to the seq_arr that
is doing a memcpy, so it can be either or better allocated in the
stack instead
> Direct leak of 48 byte(s) in 1 object(s) allocated from:
> #0 0x7d4c934b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> #1 0x577622a40137 in fill_neighbour_cell_configuration /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:1933
> #2 0x577622a40137 in RCconfig_NRRRC /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2109
> #3 0x5776221a30f2 in create_gNB_tasks /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:253
> #4 0x5776221a30f2 in main /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:619
> #5 0x7d4c91e29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
seq_arr_push_back is doing a memcpy so locally allocated memory can be freed after.
Allocate in stack.
> Direct leak of 64 byte(s) in 2 object(s) allocated from:
> #0 0x7ec4bb8b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> #1 0x55895aae1b1f in fill_measurement_configuration /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2015
> #2 0x55895aae1b1f in RCconfig_NRRRC /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2112
> #3 0x55895a246112 in create_gNB_tasks /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:253
> #4 0x55895a246112 in main /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:619
> #5 0x7ec4ba229d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
Inside of passing the RRCReconfiguration buffer, call RRCReconfiguration
message generation inside the F1 callback. This will simplify the code in the
rrc_CU_process_ue_context_setup_response() function once the N2 handover case
is introduced. In rrc_CU_process_ue_context_setup_response(), with presence
of the HO context, the HO ACK callback is called only once and depending
on the type of HO it will do either RRCReconfiguration for F1 and
HandoverCommand for N2.
The byte_array reference contains the pointer to the
encoded RRC buffer to be used in the handover acknowledge
callback (e.g. in F1 to trigger RRCReconfiguration)
This is necessary because the function was re-establishing PDCP only for SRB2
however according to specs 3GPP TS 38.331 RadioBearerConfig, PDCP shall be
re-established for SRB1 and/or SRB2 whenever the security key used for the
radio bearer changes, with some exceptions for SRB1 (i.e. when resuming
an RRC connection, or at the first reconfiguration after RRC connection
reestablishment in NR, do not re-establish PDCP for SRB1).
* the input param "reestablish" is converted into a bitmap to indicate
whether PDCP should be re-established for the SRB1 and/or SRB2.
* For convenience the bitmap is 0-based, with index 1 corresponding to SRB1,
index 2 to SRB2.
This commit is keeping the legacy re-establishment, that is re-establishment
of PCDP for SRB2 only.
according to TS 38.331, RRCReconfiguration messages can be carried
in a container by different RRC messages, e.g. HandoverPreparationInformation,
HandoverCommand, RRCResume etc.. therefore before the introduction of new
RRCReconfiguration messages, e.g. for handover, a new design seems to be necessary
in order to improve modularity and maintainability of the code.
The goal of this commit is to make the generation of RRCReconfiguration
messages more modular by (1) preparing the RRCReconfiguration parameters
data in RRC (2) pass it to ASN1 for IEs allocation (3) encode to buffer
The following changes are introduced:
(1) introduce struct nr_rrc_reconfig_param_t to store the RRC parameters relevant
to encode the RRCReconfiguration IEs
(2) add RRC function get_RRCReconfiguration_params to fetch nr_rrc_reconfig_param_t
data from the UE context and
(3) pass it to the ASN1 encoder, e.g. do_RRCReconfiguration
(4) add a function build_RRCReconfiguration_IEs to allocate memory and build the
ASN1 NR_RRCReconfiguration_IEs_t and
(5) adopt it in do_RRCReconfiguration
(4) add free_RRCReconfiguration_params for memory management of nr_rrc_reconfig_param_t data
(6) add test for rrc_reconfiguration
get_RRCReconfiguration_params:
This function prepares RRCReconfigurationParams for RRC encoding.
Motivation of this change: depending on the RRCReconfiguration
message to be encoded, the ownership of ASN1 memory allocation
should belong to the ASN1 layer, therefore this function is
preparing the nr_rrc_reconfig_param_t data to pass to the
ASN1 encoder to build the ASN1 message and encode to buffer
The function is preparing the params for the IEs that are
either mandatory or shared among different RRC messages.
Specific fields that depend on the message to be encoded are then
added afterwards in the caller. The input param to indicate
re-establishment has been split between SRBs and DRBs, since
depending on the scenario the PDCP re-establishment can vary.
This will be addressed in a later commit.
This function is also handling xid.
build_RRCReconfiguration_IE:
The long term goal is to transfer ownership of memory allocation in ASN1 encoding to
build_RRCReconfiguration_IE, then by calling ASN_STRUCT_FREE_CONTENTS_ONLY
on dl_dcch_msg, all IEs allocated in the context are freed after encoding to buffer.
In the long term, createDRBlist, createSRBlist can also be brought into the context
of build_RRCReconfiguration_IEs and free the ASN1 structure after encoding.
This improves maintability and helps preventing memory leaks.
Currently, what is not allocated in the context, is nulled and freed outside.
free_RRCReconfiguration_params:
this function frees memory allocated to build the nr_rrc_reconfig_param_t data,
including the NR_DRB_ToAddModList_t and NR_SRB_ToAddModList_t. The function
freeDRBlist has been removed since no longer necessary.
dedicated_NAS_msg_list:
dedicated_NAS_msg_list handling has also been refactored, by:
(1) fetch the NAS PDUs from the UE context in get_RRCReconfiguration_params,
which translates to (2) passing an array of dedicatedNAS-MessageList + size
to the ASN1 encoding function where (3) the ASN1 encoding logic for the
dedicated_NAS_msg_list IE has been moved
Note, 3GPP TS 38.331:
dedicatedNAS-MessageList: SEQUENCE (SIZE(1..maxDRB)) OF DedicatedNAS-Message
* differentiate the 2 functions based on the input: either NR Cell ID or PCI
* enhanced variables naming to distinguish the parameters
* add logging for debugging purposes
This count is used to size the dynamic array lcids_bj_pos. In case
count is zero, this would lead to runtime error. With this change,
the function will indicate to the caller that no SDUs are present and
will print an error.
According to 3GPP TS 38.331 5.3.5.5.2 (Reconfiguration with sync), the UE
shall consider the target SpCell to be one with a physical cell identity
indicated by the physCellId
- remove hardcoded values
- adapt gNB RRC code
- adapt gNB MAC code
- adapt physical simulators, where we put the hardcoded values
that were everywhere else before; if there is a need for those
simulators to get configurable values, more work is needed
(but it's doubtful that it is needed)
To be used in a later commit to retrieve NR PDCP configuration
parameters.
To use, add the following to the configuration file (outside of other
configurations). Adapt the values to your setup. The names ("len18bits",
"ms100", etc.) come from 3GPP TS 38.331.
pdcp = {
drb = {
sn_size = "len18bits"
t_reordering = "ms100"
discard_timer = "infinity"
}
}
Default values are applied if the configuration is absent.
The default values are the ones given above.
To be used in a later commit to retrieve NR RLC configuration
parameters.
To use, add the following to the configuration file (outside of other
configurations). Adapt the values to your setup. The names ("ms45",
"size12", etc.) come from 3GPP TS 38.331.
rlc = {
srb = {
t_poll_retransmit = "ms45"
t_reassembly = "ms25"
t_status_prohibit = "ms0"
poll_pdu = "infinity"
poll_byte = "infinity"
max_retx_threshold = "t8"
sn_field_length = "size12"
}
drb_am = {
t_poll_retransmit = "ms45"
t_reassembly = "ms15"
t_status_prohibit = "ms15"
poll_pdu = "p64"
poll_byte = "kB500"
max_retx_threshold = "t32"
sn_field_length = "size18"
}
drb_um = {
t_reassembly = "ms15"
sn_field_length = "size12"
}
}
Default values are applied if the configuration is absent.
The default values are the ones given above.
Fix data race in NR UE MSG3 scheduling
Fixed a data race between DL processing of RAR and UL scheduler, which might
result in dropping MSG3.
It was possible that the UL scheduler for the UL slot which RAR indicates as
MSG3 slot was already run by the time the RAR was decoded.
Therefore when DCI for RAR is decoded, assume worst case and halt UL scheduler
for next slot until RAR is decoded solving the data race. This also in turn
halts all later scheduling due to sequential nature of the UL scheduler calls.
Closes#962
Move RRC radio parameters file to DU
A number of radio-related RRC parameters, e.g., CellGroupConfig, "originate" at
the DU and are sent to the CU for forwarding to the UE only. Similarly, there
are additional parameters, e.g., RLC-BearerConfig (part of CellGroupConfig),
that originate at the DU.
Hence, the DU decides about these parameters, depending on the MAC state and
capabilities. To clarify this, move the existing
openair2/RRC/NR/nr_rrc_config.{c,h} => openair2/LAYER2/NR_MAC_gNB/nr_radio_config.{c,h}
So that developers know that while those are RRC parameters, they originate at
the DU.
In other words, the CU/RRC is not supposed to use any of these functions in
the RRC. Correspondingly, includes of this file have been cleaned up (and when
they are not necessary at the MAC as well)
Fixed a data race between DL processing of RAR and UL scheduler, which
might result in dropping MSG3.
It was possible that the UL scheduler for the UL slot which RAR
indicates as MSG3 slot was already run by the time the RAR was decoded.
Therefore when DCI for RAR is decoded, assume worst case and halt the
earliest corresponding UL scheduler call until RAR is decoded solving
the data race. This also in turn halts all later scheduling due to
sequential nature of the UL scheduler calls.
Enhance UE identity management in Initial UE Message and other NGAP improvements
This MR improves the Initial UE Message procedures by supporting simultaneous
presence of both 5G-S-TMSI and GUAMI. Previously, only one identity could be
used, leading to potential AMF selection failures. Now the presenceMask allows
both identities. The AMF selection is prioritizing GUAMI first, then falling
back to 5G-S-TMSI, and finally using PLMN or highest capacity.
Also, fix handling of selected PLMN identity in NGAP.
Refactoring:
- Select the AMF based on (1) absence of UE Identity (2) Presence of GUAMI
(3) Presence of 5G-S-TMSI
- Also refactored the AMF selection logic for better readability and reliability.
- Refactor and cleanup rrc_gNB_send_NGAP_NAS_FIRST_REQ
- Replace ngap_pdu_t with byte_array_t
- Add guami_t to ngran_types.h: refactor NGAP and RRC code to use one common
GUAMI type instead of two identical ones
Also:
- Bugfix in ngap_gNB_handle_ng_setup_response: use correct count for PLMNSupportList
Closes issue #801
A number of radio-related RRC parameters, e.g., CellGroupConfig,
"originate" at the DU and are sent to the CU for forwarding to the UE
only. Similarly, there are additional parameters, e.g., RLC-BearerConfig
(part of CellGroupConfig), that originate at the DU.
Hence, the DU decides about these parameters, depending on the MAC state
and capabilities. To clarify this, move the existing
openair2/RRC/NR/nr_rrc_config.{c,h} => openair2/LAYER2/NR_MAC_gNB/nr_radio_config.{c,h}
So that developers know that while those are RRC parameters, they
originate at the DU.
In other words, the CU/RRC is not supposed to use any of these functions
in the RRC. Correspondingly, includes of this file have been cleaned up
(and when they are not necessary at the MAC as well).
One of the next commits moves nr_rrc_config.c "down to" the MAC/DU. The
BearerConfig functions are only used at the DU, so move them here in the
corresponding file.
selectedPLMN-Identity IE in RRCSetupComplete is an Index (long) of the PLMN selected
by the UE from the plmn-IdentityInfoList (SIB1) (see 3GPP TS 38.331)
while
Selected PLMN Identity in NGAP INITIAL UE MESSAGE Indicates the selected PLMN
id for the non-3GPP access (PLMN Identity ID carrying MNC, MCC and MNC size,
9.2.5.1 3GPP TS 38.413)
The legacy code was setting Selected PLMN Identity in the latter to an ID
value as the former, however in NGAP the IE to be encoded is PLMN Identity 9.3.3.5
therefore:
* set plmn type plmn_id_t in ngap_nas_first_req_t
* check whether received selectedPLMN-Identity is within bounds
* select PLMN from gNB_RrcConfigurationReq by selectedPLMN-Identity ID
note: this commit is assuming that the plmn-IdentityInfoList in SIB1
is matching the PLMN list in gNB_RrcConfigurationReq
* in NGAP: store the PLMN in the NGAP UE context, no need to fetch the PLMN
in the NGAP instance since the UE context already tells what PLMN
was selected
Closes#801
* use bitmask to select presence of either 5G-S-TMSI or GUAMI
* select the AMF based on
(1) absence of UE Identity (2) Presence of GUAMI (3) Presence of 5G-S-TMSI
Related to #801
Robert Schmidt