Prevent triggering N2 handover when the UE has no active PDU session
by adding an early check in nr_rrc_trigger_n2_ho(), so we avoid building
an invalid HO Required. This aligns with 3GPP TS 38.413 (§9.2.3.1), where
HANDOVER REQUIRED carries a PDU Session Resource List with at least one
PDU Session Resource Item (range 1..maxnoofPDUSessions).
Fix EMA cold-start for noise and SNR/RSSI measurements
Initialize n0_subband_power and power control avg_snr/avg_rssi directly
from the first measurement instead of starting from zero.
Starting from zero causes the EMA to converge slowly, leading to
underestimated noise power at gNB startup. This results in inflated SNR
estimates, which triggers UE uplink power ramp-up, antenna saturation,
and a positive feedback loop of increasing noise.
L1 RX: use queues instead of arrays and linear search for PUCCH, PUSCH, SRS, PRACH
This MR is an attempt to reduce the time L1 RX searches in array for the
next job to process, and instead use a queue. This queue is a FIFO,
because the various jobs (FAPI messages) to process come in order, and
need to be processed in order. The MR (hopefully, to be measured)
reduces the amount of time spent searching for the next UE (because the
next job is always at the beginning of the queue), and should scale
better for many UEs.
It does the following:
- introduce two helper libraries for (1) Frame.Slot calculation (sfn_t),
already introduced in !3521 (merged) commit 3102068e, and (2) a ring
buffer with fixed size
- use sfn_t and ring buffer (gNB->pucch_queue) to remove the linear
array for PUCCH (gNB->pucch)
- use sfn_t and ring buffer (gNB->pusch_queue) for some PUSCH lookups.
Because we need to still store PUSCH contexts, gNB->pusch is still
there
- use sfn_t and ring buffer (gNB->srs_queue) to remove the linear array
for SRS (gNB->srs)
- use sfn_t and ring buffers (gNB->prach_ru_queue and
gNB->prach_l1rx_queue) to remove the linear array for PRACH
(gNB->prach_list)
- some minor cleanups, e.g., additional loops over the PUSCH array,
using const, using pointers instead of indices, etc
Miscellaneous code improvements
- A fix in a yaml config file as reported by @Abdo-Gaber
- proper positioning of static functions in a couple of gNB scheduler
files
- some effort to split NR from LTE code in compilation
- harmonization of macros for unused variables
at RRC we don't store CSI-MeasConfig information so in some scenarios (see #1063) we may not have the full pictures to understand if what RRC received is a valid configuration
we verify at L2 instead after updating CSI-MeasConfig and if it fails we send a message to RRC
Add encode/decode helpers and basic round-trip tests for NR SIB2, SIB3
and SIB4 in test_asn1_msg.cpp to ensure we produce decodable messages
with expected fields. Extend SIB4 coverage with an
inter_freq_carrier_freq_info_ranges test that exercises boundary and
out-of-range values for carrier reselection parameters and checks
encoder failures for invalid configurations.
Changes:
- Introduce encode_and_decode_sib2, encode_and_decode_sib3 and
encode_and_decode_sib4 helpers that call do_SIB2_NR, do_SIB3_NR,
do_SIB4_NR and uper_decode and assert non-empty, non-null byte
arrays and successful decoding.
- Add sib2_basic_encode_decode, sib3_basic_encode_decode and
sib4_basic_encode_decode tests that populate minimal but
representative NR_SIB2_t, NR_SIB3_t and NR_SIB4_t instances and
verify selected decoded fields match the originals.
- Add inter_freq_carrier_freq_info_ranges test that builds an NR_SIB4_t
with NR_InterFreqCarrierFreqInfo_t and varies different offsets and
thresholds to confirm valid combinations encode and invalid ones
are rejected.
- Add comprehensive documentation header explaining the structure's role
as single source of truth for neighbor cell information across multiple
protocols (NGAP/XnAP handover, measurement config, DU validation, SIB3/SIB4)
- Add detailed field comments documenting protocol-specific mappings:
* Core identification fields (gNB_ID, nrcell_id, physicalCellId)
* Frequency/RF parameters (absoluteFrequencySSB, subcarrierSpacing, band)
* Handover target identification (plmn, tac)
- Document NGAP/XnAP IE mappings for plmn and tac fields
Remove the isIntraFrequencyNeighbour field and all code that sets or
uses it, simplifying neighbour cell handling and avoiding redundant
state in the RRC gNB code. The flag duplicated information that can be
derived from the neighbour absoluteFrequencySSB and the serving cell
SSB ARFCN, and intra-frequency neighbours are logged in the SIB3
preparation flow.
Changes:
- Remove isIntraFrequencyNeighbour from nr_neighbour_cell_t in
openair2/RRC/NR/nr_rrc_defs.h
- Delete is_intra_frequency_neighbour() and
label_intra_frequency_neighbours() helpers from
openair2/RRC/NR/rrc_gNB_du.c
- Remove calls to label_intra_frequency_neighbours() from
rrc_gNB_process_f1_setup_req() and
rrc_gNB_process_f1_du_configuration_update() in rrc_gNB_du.c
- Stop setting .isIntraFrequencyNeighbour in the local
nr_neighbour_cell_t neighbourConfig initializer in
openair2/RRC/NR/rrc_gNB_mobility.c
Add SIB4 encode/decode helpers and populate SIB4 from configured
inter-frequency carriers and neighbour cells, wiring it into DU F1
Setup handling and MAC SystemInformation.
Changes:
- Add do_SIB4_NR() and NR_SIB4.h inclusion in asn1_msg.c/asn1_msg.h to
UPER-encode NR_SIB4_t into a byte_array_t.
- Extend nr_mac_configure_other_sib() in NR_MAC_gNB/config.c with an
NR_SIB_4 case that validates the SIB container, decodes NR_SIB4_t via
uper_decode, logs failures, and appends SIB4 to SystemInformation.
- Introduce build_inter_freq_carrier_from_cfg() and
get_sib4_inter_freq_neighbors() in rrc_gNB_du.c to build
NR_InterFreqCarrierFreqInfo_t and NR_SIB4_t from inter-frequency and
neighbour cell configuration, skipping invalid or empty carriers.
- Handle NR_SIB_4 in rrc_gNB_process_f1_setup_req() by deriving SIB4
from neighbour/inter-frequency configuration, encoding it with
do_SIB4_NR(), validating the resulting byte_array_t and adding the SI
message for the DU cell when encoding succeeds.
Introduce NR SIB3 encoding in RRC and wire SIB3 neighbour information
into CU–DU F1 Setup and DU SystemInformation. Extend MAC to decode NR
SIB3 from CU-provided SIB containers and attach the decoded SIB3 to the
DU SystemInformation structure.
Changes:
- Add NR_SIB3 ASN.1 include and a do_SIB3_NR() encoder in asn1_msg
so SIB3 can be serialized into a byte_array_t buffer.
- Introduce get_q_offset_asn1() and get_sib3_intra_freq_neighbors() in
rrc_gNB_du.c to build an intra-frequency neighbour cell list for SIB3,
mapping q_OffsetCell dB values to NR_Q_OffsetRange and optionally
filling q_RxLevMinOffsetCell and q_QualMinOffsetCell.
- Limit the number of intra-frequency neighbours in SIB3 to
NR_maxCellIntra, logging a warning and skipping additional cells when
the limit is reached.
- Hook SIB3 construction and encoding into rrc_gNB_process_f1_setup_req()
so SIB type 3 entries are added to the F1 Setup Response when
neighbour configuration and matching neighbours are available.
- Handle NR_SIB_3 in nr_mac_configure_other_sib() by validating the CU
SIB3 container buffer, decoding it with uper_decode into an NR_SIB3_t,
and attaching the resulting SIB3 to the MAC SystemInformation via
add_sib_to_systeminformation().
Introduce typed SIB3/SIB4 neighbour and inter-frequency carrier
configuration structures, wire them into the RRC neighbour and gNB
instances, and centralise parsing and bounds checking of per-frequency
SIB4 parameters from the gNB frequency list.
Changes:
- Define SIB3/SIB4 reselection and offset bound macros in gnb_config.c
and apply them when parsing SIB4 frequency_config and
per-carrier q_RxLevMin/t_ReselectionNR.
- Add add_inter_freq and parse_inter_freq_list helpers in gnb_config.c
to populate a shared inter_freqs seq_arr_t from gNB_CONFIG_STRING_GNB_LIST
frequency_list entries, enforcing unique (ARFCN,SCS) combinations and
logging duplicates.
- Extend neighbour cell parameters in gnb_paramdef.h with SIB3 per-
neighbour offset fields and define frequency_list/frequency_config
option names, descriptor tables, and index constants for SIB4 inter-
frequency configuration.
- Introduce nr_neighbour_cell_neighbor_offset_t, nr_neighbour_cell_sib3_t,
nr_neighbour_cell_sib4_freq_t, nr_neighbour_cell_sib4_t, and
nr_inter_freq_cfg_t in nr_rrc_defs.h, and extend nr_neighbour_cell_t
and gNB_RRC_INST with sib3/sib4 and inter_freqs members respectively.
- udpated fill_neighbour_cell_configuration to use GET_PARAMS_LIST
with params bound check
Introduce a typed SIB2 cell reselection configuration, load it from the
gNB configuration into the RRC gNB instance, and use it to build and
encode SIB2 instead of relying on a fixed SIB2 definition.
Validate SIB2 parameters against explicit bounds and make the SIB2
encoder consume a pre-built ASN.1 structure with safer error handling.
Changes:
- Add SIB2 mobility timer and q-HystSF enums plus SIB2 config structs
(`sib2_speed_state_reselection_pars_t`, `sib2_config_t`) and a
`sib2_config` field on `gNB_RRC_INST` in `nr_rrc_defs.h`.
- Define SIB2 configuration option names, defaults
(`GNB_CONFIG_STRING_SIB2_*`, `GNBSIB2PARAMS_DESC`)
in `gnb_paramdef.h` for q_Hyst, thresholds, mobility timers, scaling
factors and deriveSSB_IndexFromCell.
- Add `sib2_config` parameter keys, defaults, and range/value checks in
`gnb_paramdef.h` (`GNBSIB2PARAMS_DESC`).
- Add SIB2 `fill_sib2_configuration()` in `gnb_config.c` to read SIB2
parameters from the config file log the resulting configuration and
store it in `rrc->sib2_config` via `RCconfig_NRRRC()`.
- Add `get_q_hyst_asn1()` and `get_sib2_from_cfg()` in `rrc_gNB_du.c`, and
update `rrc_gNB_process_f1_setup_req()` to encode/add SIB2 from config with
explicit encode-failure handling and logging.
- Change `do_SIB2_NR` signature in `asn1_msg.h/.c` to
`byte_array_t do_SIB2_NR(const NR_SIB2_t *sib2)`, remove internal default
SIB2 construction, and add ASN.1 constraint/encode error logging.
Unify SIB container handling by introducing a typed SIB enum and storing
SIB payloads as byte_array_t across common NR types, F1AP helpers, MAC,
and RRC DU setup code.
Changes:
- Include byte_array support in nr_common.h, add nr_sib_type_t (NR_SIB_1–NR_SIB_21),
and change nr_SIBs_t to hold only nr_sib_type_t SIB_type.
- Switch f1ap_sib_msg_t in f1ap_messages_types.h to use a byte_array_t SI_container
instead of raw pointer and length fields.
- Update F1AP encode/decode, equality, copy, and free helpers in
f1ap_interface_management.c to work on SI_container.buf / SI_container.len and
use eq_byte_array, copy_byte_array, and free_byte_array.
- Adapt F1AP tests in f1ap_lib_test.c to build and inspect SIB containers via
SI_container.buf and SI_container.len.
- Replace magic SIB numbers with nr_sib_type_t values in gnb_config.c
(get_sys_info and fill_du_sibs) to validate and configure DU SIBs.
- Rework nr_mac_configure_other_sib in NR_MAC_gNB/config.c to decode SIB2
from a byte_array_t container, fix freeing by releasing the decoded sib2 on
failure, and use NR_SIB_2 / NR_SIB_19 for CU/DU SIB selection.
- Add an add_si_msg helper in rrc_gNB_du.c and refactor the SIB2 branch of
rrc_gNB_process_f1_setup_req to populate cell->SI_msg from encoded local
byte array while iterating SIBs with FOR_EACH_SEQ_ARR.
Tighten neighbour-cell config parsing by enforcing parameter constraints in
the descriptor and switching parsing code to name-based lookups with gpd.
Changes:
- Update `GNBNEIGHBOURCELLPARAMS_DESC` in `openair2/GNB_APP/gnb_paramdef.h`
to add checks for `physical id`, `absoluteFrequencySSB`, `scs`, `band`
`tracking_area_code`.
- Remove neighbour-cell parameter index macros.
- Refactor `parse_neighbour_cells_list` in `openair2/GNB_APP/gnb_config.c`
to use `gpd()` lookups for neighbour fields instead of fixed indexes.
- Extend `parse_neighbour_cells_list` with an `n_cell_params` argument and
update `fill_neighbour_cell_configuration` to pass
`sizeofArray(ncell_params)`.
Inline neighbour cell arrays into the RRC neighbour configuration and
update RRC/DU helpers to use const-aware access and shared iteration
helpers when walking neighbour lists and building measurement configs.
Changes:
- Change neighbour_cells in neighbour_cell_configuration_t from a
seq_arr_t * to an embedded seq_arr_t field.
- Initialize and populate the embedded neighbour_cells directly in
parse_neighbour_cells_list in gnb_config.c, dropping dynamic
allocation of the neighbour list container.
- Refactor get_neighbour_cell_by_pci and nr_rrc_get_measconfig in
rrc_gNB.c to access the embedded neighbour_cells via const pointers,
introduce a local meas_cfg and a3_event_list, and iterate neighbour
cells with FOR_EACH_SEQ_ARR.
- Treat neighbour cell configuration entries as const in rrc_gNB_du.c
(get_cell_neighbour_list, label_intra_frequency_neighbours,
valid_du_in_neighbour_configs) and iterate neighbour lists with
FOR_EACH_SEQ_ARR instead of index-based loops.
Outer gNB neighbour_list entries now only declare the serving cell
nr_cellid. The code resolves that field with gpd instead of a fixed column
index.
Changes:
- gnb_paramdef.h: remove unused NEIGHBOUR_CELL_PHYSICAL_ID from
GNB_NEIGHBOUR_LIST_PARAM_LIST (keep NRCELLID only).
- gnb_config.c: in fill_neighbour_cell_configuration, set nr_cell_id
from gpd
Refactor gNB configuration code to share PLMN extraction logic and to
split neighbour-cell configuration into smaller helpers with safer
allocation and clearer list handling.
Changes:
- Add `extract_plmn_from_params()` in `gnb_config_common.c` and declare
it in `gnb_config_common.h` to centralize PLMN extraction from
`paramdef_t`.
- Update `set_plmn_config()` to use `extract_plmn_from_params()` when
filling the PLMN array instead of duplicating field assignments.
- Refactor `fill_neighbour_cell_configuration()` in `gnb_config.c` to
delegate per-cell neighbour parsing to
`parse_neighbour_cells_list()` and sorting to
`sort_neighbour_configuration()`, simplifying the main loop.
- Use `extract_plmn_from_params()` when parsing neighbour PLMNs in
`parse_neighbour_cells_list()` and log each neighbour with its PLMN,
PCI, and other radio parameters before adding it to the sequence.
- Switch allocation of `rrc->neighbour_cell_configuration` in
`fill_neighbour_cell_configuration()` from `malloc` to
`malloc_or_fail()` to enforce consistent handling of allocation
failures.
Thread-pool support for TX symbol processing.
This MR adds thread-pool support for TX symbol processing. It allows modulation
/mapping/layer-precoding to run in parallel and offers a speedup of around 3
compared to single-thread execution. This is particularly important for large
bandwidths and 4 or more TX antenna ports where the precoding operation is quite
computationally-intensive.
Please see the description of !3489 for the performance comparison results and
the nr_dlsim timing measurements.
Fix for NULL pucch-ResourceCommon at MSG4
Field pucch-ResourceCommon, used for ACK of MSG4, in some scenarios was
overwritten by RRCSetup before being used. Storing it in advance prevents
the segfault. In addition there is a clenaup of similar procedures at gNB.
* Add option `--L1s.L1_num_tx_sym_per_thread` for the softmodems and `-Y` for `nr_dlsim`
to provide the number of symbols processed per thread.
It defaults to 0 which makes that every symbols are processed in one thread.
* The last symbol processing task is processed in the L1 TX thread.
When receiving single-entry PHR with HARQ PID -1
(nr_mac_process_mac_pdu() is called with such parameter in at least two
places), the error handling path calls continue skipping the accounting
of the current sub-pdu (pduP and pdu_len). This results in an infinite
loop. Fix by moving functionality into a separate function.
Fixes: 2e0493632d ("RLC data ind: single call for complete TB at gNB")
Signed-off-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Further unused arguments cleanup
More fixes for unused function arguments (see #1057),
add_compile_options(-Wunused-parameter) added in folders:
- nfapi
- openair2
- openair3
- USRP
- rfsimulator
nr rlc: tolerate bogus data
Some unfriendly entity may play with the RLC module and send bogus data to
trigger funky behaviors here and there.
A report sent by Dhanish indentifies one such issue.
From analyzing this report, a possible scenario is the following. Unfriendly
entity sends an RLC PDU with: is_first=0 is_last=0 so=15 lenght of data,
whatever, let's say 1.
This PDU is put in the RX list.
Then later it sends another PDU (for the same SN, obviously), with: is_first=1
is_last=1 so=0 (well, since is_first=1, necessarily so=0; it is not transmitted,
see 38.322 6.2.2.3 for UM and 38.322 6.2.2.4 for AM) length=10, let's say.
This PDU is also put in the RX list, before the previous one.
Then the function sdu_full() returns 1, so reassemble_and_deliver() is called
and the 'while (pdu)' loop is executed for both PDUs. When the second (bogus
one) is processed, so==10 (after processing the first PDU) and the line: int
len = pdu->size - (so - pdu->so) is: int len = 1 - (10 - 15) which is not good.
So we detect the case 'pdu->so > so' and reject the SDU. We could label the
other entity as bogus, since no standard RLC implementation will produce such a
case, but let's remain friendly, even with unfriendly entities. (To be changed
later if needed.)
The problem was reported for RLC AM but is also present in RLC UM. (Not in RLC
TM, where there is no segmentation.) Note: according to the report, this bug was
found using a fuzzer described as 'AI-assisted custom 5G NR protocol fuzzer'. It
had to be said.
Some unfriendly entity may play with the RLC module and send bogus data to
trigger funky behaviors here and there.
A report sent by Dhanish, India, indentifies one such issue.
From analyzing this report, a possible scenario is the following.
Unfriendly entity sends an RLC PDU with:
is_first=0
is_last=0
so=15
lenght of data, whatever, let's say 1.
This PDU is put in the RX list.
Then later it sends another PDU (for the same SN, obviously), with:
is_first=1
is_last=1
so=0 (well, since is_first=1, necessarily so=0; it is not transmitted,
see 38.322 6.2.2.3 for UM and 38.322 6.2.2.4 for AM)
length=10, let's say.
This PDU is also put in the RX list, before the previous one.
Then the function sdu_full() returns 1, so reassemble_and_deliver() is
called and the 'while (pdu)' loop is executed for both PDUs. When the
second (bogus one) is processed, so==10 (after processing the first
PDU) and the line: int len = pdu->size - (so - pdu->so)
is: int len = 1 - (10 - 15)
which is not good.
So we detect the case 'pdu->so > so' and reject the SDU. We could label
the other entity as bogus, since no standard RLC implementation will
produce such a case, but let's remain friendly, even with unfriendly
entities. (To be changed later if needed.)
The problem was reported for RLC AM but is also present in RLC UM.
(Not in RLC TM, where there is no segmentation.)
Note: according to the report, this bug was found using a fuzzer
described as 'AI-assisted custom 5G NR protocol fuzzer'. It had
to be said.
Cleanup common_lib.h
This change reduces the number of dependecies of common_lib.h and simplifies
the task of implementing an external OAI radio library.
Remove a lot of unused code, defines, and config options
Remove unused header files and defines.
Slightly clean up gnb_config.c by removing all _IDX variables. Remove
these unused parameters:
- MACRLCs.[0].num_cc
- MACRLCs.[0].local_n_portc
- MACRLCs.[0].remove_n_portc
- MACRLCs.[0].remote_s_portc
- MACRLCs.[0].remote_s_portd
- L1s.[0].num_cc
- L1s.[0].local_n_portc
Remove the gNB_MAC_INST.eth_params_s, since it's only purpose is to
store what can be on the stack.
For the Aerial log message, don't print an empty prefix but what is
actually used for Aerial.
