fix (UE RRC): queue MAC reset before RLC teardown on RRCSetup fallback

When the gNB answers RRCReestablishmentRequest with RRCSetup (TS 38.331
clause 5.3.3.4 fallback), the UE must release all bearers except SRB0 before
applying the new masterCellGroup. CONFIG_RESET was queued after RLC release,
so the MAC slot thread kept polling LCID 1 from a stale lc_ordered_list while
the RLC entity was already NULL.

Queue NR_MAC_RRC_CONFIG_RESET (RRC_SETUP_REESTAB_RESUME) first, then release
PDCP, RLC, and SDAP. On the MAC thread, clear lc_ordered_list except SRB0
before release_mac_configuration() so the UL scheduler stops looping released
logical channels until CONFIG_CG re-adds SRB1.

Changes:
- rrc_UE.c: move CONFIG_RESET to the start of nr_rrc_rrcsetup_fallback()
- config_ue.c: drop non-SRB0 lc_ordered_list entries on RRC_SETUP_REESTAB_RESUME

Closes: #128

Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
This commit is contained in:
Guido Casati
2026-06-23 16:02:19 +02:00
parent 1c659403b7
commit e179a6df8f
2 changed files with 14 additions and 10 deletions

View File

@@ -1901,6 +1901,12 @@ void nr_rrc_mac_config_req_reset(module_id_t module_id, NR_UE_MAC_reset_cause_t
mac->state = UE_BARRED;
break;
case RRC_SETUP_REESTAB_RESUME:
for (int i = mac->lc_ordered_list.count; i > 0; i--) {
nr_lcordered_info_t *lc = mac->lc_ordered_list.array[i - 1];
if (lc->rb.type == NR_LCID_SRB && lc->rb.choice.srb_id == 0)
continue;
asn_sequence_del(&mac->lc_ordered_list, i - 1, 1);
}
release_mac_configuration(mac, cause);
nr_ue_mac_default_configs(mac);
break;

View File

@@ -2159,8 +2159,15 @@ static void nr_rrc_rrcsetup_fallback(NR_UE_RRC_INST_t *rrc)
memset(rrc->kgnb, 0, sizeof(rrc->kgnb));
rrc->as_security_activated = false;
// release the RRC configuration except for the default L1 parameter values,
// default MAC Cell Group configuration and CCCH configuration
nr_mac_rrc_message_t rrc_msg = {0};
rrc_msg.payload_type = NR_MAC_RRC_CONFIG_RESET;
rrc_msg.payload.config_reset.cause = RRC_SETUP_REESTAB_RESUME;
nr_rrc_send_msg_to_mac(rrc, &rrc_msg);
// release radio resources for all established RBs except SRB0,
// including release of the RLC entities, of the associated PDCP entities and of SDAP
// including release of the associated PDCP entities and of SDAP
for (int i = 1; i <= MAX_DRBS_PER_UE; i++) {
if (get_DRB_status(rrc, i) != RB_NOT_PRESENT) {
set_DRB_status(rrc, i, RB_NOT_PRESENT);
@@ -2178,15 +2185,6 @@ static void nr_rrc_rrcsetup_fallback(NR_UE_RRC_INST_t *rrc)
}
nr_sdap_delete_ue_entities(rrc->ue_id);
// release the RRC configuration except for the default L1 parameter values,
// default MAC Cell Group configuration and CCCH configuration
// TODO to be completed
NR_UE_MAC_reset_cause_t cause = RRC_SETUP_REESTAB_RESUME;
nr_mac_rrc_message_t rrc_msg = {0};
rrc_msg.payload_type = NR_MAC_RRC_CONFIG_RESET;
rrc_msg.payload.config_reset.cause = cause;
nr_rrc_send_msg_to_mac(rrc, &rrc_msg);
// indicate to upper layers fallback of the RRC connection
// TODO