CI: set interface name in UPF container for RFSim5G
This MR addresses an issue related to CN deployment, observed in the RFSim5G CI pipeline. Specifically, the IP addresses within the UPF container were not consistently bound to the correct network interfaces. This inconsistency led to incorrect IP address assignments for the N3, N4, and N6 interfaces, resulting in connectivity issues.
See merge request oai/openairinterface5g!3517
Integration: `2025.w27`
Closes#958
See merge request oai/openairinterface5g!3506
* !3349 Speed up docker deployment in CI
* !3360 NR UE: fix reestablishment for NTN
* !3488 Refactor F1 UE context messages, add unit tests
* !3502 bugfix for UL TBSLBRM
* !3475 Use of common functions to prepare FAPI PDUs at gNB MAC
* !3499 NR UE: enable CSI report for SISO case
* !3497 Update/refine gNB MAC stats, update L1
* remove unit test `--output-on-failure` option to avoid hitting timeout
* !3508 gNB: fix NTN UL retransmissions
* !3494 bugfix: read msg_type only after deciphering
* set `tx_amp_backoff_dB = 30;` for RFsim 2x2 to make it pass
* !3432 NR RRC Reject UE
* !3500 Various fixes for UE handling, HO doc updates
* !3398 continuously update SIB19 information for rfsim NTN LEO scenarios
continuously update SIB19 information for rfsim NTN LEO scenarios
Contains mainly these changes:
- gNB: add function nr_update_sib19() allowing to update SIB19
information
- rfsimulator: update SIB19 contents every frame for LEO channel
simulations
- NR UE: improve initial timing advance calculation from SIB19
Before, we only considered ta_Common_r17 and the SAT position from SIB19
to compute the initial timing advance value. This is good enough if the
satellite does not move too fast (e.g. GEO satellite).
Now we also consider ta_CommonDrift_r17, ta_CommonDriftVariant_r17 and
the SAT velocity together with the epoch time from SIB19. This improves
the accuracy of the initial TA computation, esp. for LEO satellite
scenarios.
Various fixes for UE handling, HO doc updates
- On release request, search both attach and connected list to free a UE.
- on DU disconnect, only release the correspnonding UE contexts.
- When no AMF for the UE, auto-release the UE (NGAP would also send an
answer, but better check first)
- implement a "grace period" before the DU/MAC automatically releases a
UE: this is to avoid cases in which (for whatever reason) the UE
release request is not honored by the CU. In order to not fill up UE
contexts unnecessarily, the DU will eventually (after 10s) drop the UE
context
- some clarification in HO tutorial
When the RA procedure fails at Msg4, we trigger UL failure and send a
message to the CU to request release. There was a bug in that upon the
ensueing release command, we did not search in the attach list (only
connected list). However, the UE failing at Msg4 does not have
transitioned to the connected list yet, thus not freeing the context.
Fixes: 8f62baefa6 ("Use list of UEs during RA instead of array of RA
processes)"
It might happen that the CU does not answer a release request. In that
case, the MAC would never free the UE context, potentially blocking the
DU. Avoid this by introducing a "grace period" after which a UE context
is automatically freed at the MAC (and RLC), currently at 10s after the
30s UL failure timer.
Mark non-existing AMF UE NGAP ID through invalid INT64_MAX number
(permitted range is up to 2^40-1). Check for this range in the RAN
function, as we might otherwise pass the invalid AMF UE NGAP ID to the
agent, which would assert with
nr-softmodem: /oai-ran/openair2/E2AP/flexric/src/lib/3gpp/enc/enc_gnb.c:83: enc_gNB_UE_asn: Assertion `gnb->amf_ue_ngap_id < 1UL << 40' failed.
In other words, don't send KPM messages for a UE which has no valid AMF
UE NGAP ID yet (which follows from the fact that the spec requires an
AMF UE NGAP ID; the previous behavior of simply sending 0 could be
considered a bug, because it's not the UE's true AMF UE NGAP ID).
NR RRC Reject UE
Improvements in procedures to handle RRCReject message both at gNB and
UE. At gNB we send RRC Reject if the UE cannot be given resources to go
into connected mode.
bugfix: read msg_type only after deciphering
There was a problem with accessing msg_type from the input buffer before
deciphering, giving obviously wrong value.
CI team: we should add a test in the CI with NAS ciphering + integrity
(connection to the core) set to not null (I suggest nea2/nia2). With
openair's core, this is done by setting this in the amf config file
(nia1 and nea2 at the top of the list):
supported_integrity_algorithms:
- "NIA2"
- "NIA1"
- "NIA0"
supported_encryption_algorithms:
- "NEA2"
- "NEA1"
- "NEA0"
And also put full security in the AS. This is done with this in the gnb
config file:
security = {
ciphering_algorithms = ( "nea2", "nea0" );
integrity_algorithms = ( "nia2", "nia1", "nia0" );
drb_ciphering = "yes";
drb_integrity = "yes"
};
Ideally we should test this with both openair UE and cots UE. But as a
strict minimum do for openair UE (this is where the bug was).
No need to do much traffic, a few ping is enough. But if you want to
check throughput with full security, why not.
Remove this option: some tests produce an excessive amount of output on
failure (e.g., googletest/benchmark). This seems to overwhelm the Python
CI code. Suppress this output, because we can always manually run this
test. A high-level "this test is ok/nok" should be fine for the CI.
NR UE: enable CSI report for SISO case
Correct precoded_sinr_dB wrongly set to 0 for SISO case, also correct
ri_restriction is 0 when calculating CQI bit length for SISO.
Update/refine gNB MAC stats, update L1
Only applicable with -q option.
Print a number of statistics, e.g., rx_ulsch_sdu to track UL MAC stats
timing. Remove unused time_meas_t definitions, and fix the name for the
total gNB scheduler time.
Print the RU stats in nrL1_stats.log, as some are already there, and do
not "pollute" the periodic logs when -q is enabled.
I used this to see why there are sometimes late slots with Aerial. I
used the above stats to get a general overview. This additional patch
shows that at least in RFsim, the RLC indication in rx ulsch sdu can
take up to 20us on my machine. Given that we can have multiple PDUs in
UL (10?), this can amount to a sizeable amount of time. While this is
for another MR, I thought the cleanup would be nice to have.
Do not pollute periodic output, and rather print those into
nrL1_stats.log. A number of them are already there anyway, so transfer
the rest. Note: ru->ifdevice.tx_fhaul is omitted, as we don't have any
IF5 split in 5G.
Refactor F1 UE context messages, add unit tests
Add encoder+decoder+util functions for F1 UE context messages, and use
them in the stack. The overall goal is to unit test encoder+decoder (to
be sure that what we send is what we receive), and remove any memory
leaks related to F1 handling. Messages that have a unit test:
- F1 UE context setup request/response
- F1 UE context modification request/response
- F1 UE context release request/command/complete
This MR removes almost all remaining memory leaks that are observable in
a "standard" configuration, running SISO in RFsim. In RFsim (without
channel modelling), there are only two memory leaks shown in asan, one
in L1, and one in NGAP.
Speed up docker deployment in CI
- Using docker compose up --wait instead of a custom healthcheck script:
from: https://docs.docker.com/reference/cli/docker/compose/up/
--wait Wait for services to be running|healthy. Implies detached mode.
--wait-timeout Maximum duration in seconds to wait for the project to be running|healthy
- Speeding up the healthchecks by reducing the interval from 1-10s to
0.5s during start period
start_period creates a special period after the start of the container
where the healthcheck is executed every start_interval . During this
time the failures do not count towards the retries counter, but
successes change the status to healthy. This allows container to reach
healthy status much sooner.
- Using init: true to speed up docker compose down/stop
`init: true` initializes the docker container with tini or
alternative: tini is used to collect all the processes and correctly
pass the termination signal to them. This allows the docker container
to be stopped without waiting 10 seconds to kill the container
- Smallest example of this is:
services:
test-init:
image: ubuntu:jammy
command: sleep 10d
We use the same resource for CSI meas report and RSRP (judging by the
name of the functions), but the memory allocations need to be separate
to avoid a double free:
==2063066==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c27d43e3ce8 at pc 0x000000fcd279 bp 0x7be7cc9e7120 sp 0x7be7cc9e7118
READ of size 8 at 0x7c27d43e3ce8 thread T6
#0 0x000000fcd278 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:97
#1 0x000000fcd278 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#2 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
#3 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
#4 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
#5 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#6 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
#7 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
#8 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
#9 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#10 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
#11 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
#12 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#13 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#14 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
#15 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
#16 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#17 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#18 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#19 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#20 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#21 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#22 0x0000009d78ae in ue_context_setup_request /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:692
#23 0x00000083fee2 in rrc_add_nsa_user /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_nsa.c:330
#24 0x000000886e8b in rrc_gNB_process_f1_setup_req /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_du.c:444
#25 0x000000833942 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2766
#26 0x7fe7d5e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#27 0x7fe7d527f1d3 in start_thread (/lib64/libc.so.6+0x711d3) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#28 0x7fe7d5301ceb in __GI___clone3 (/lib64/libc.so.6+0xf3ceb) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
0x7c27d43e3ce8 is located 24 bytes inside of 40-byte region [0x7c27d43e3cd0,0x7c27d43e3cf8)
freed by thread T6 here:
#0 0x7fe7d5ee5bcb in free.part.0 (/lib64/libasan.so.8+0xe5bcb) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
#2 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
#3 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
#4 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#5 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
#6 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
#7 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
#8 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#9 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
#10 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
#11 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#12 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#13 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
#14 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
#15 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#16 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#17 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#18 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#19 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#20 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#21 0x0000009d78ae in ue_context_setup_request /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:692
#22 0x00000083fee2 in rrc_add_nsa_user /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_nsa.c:330
#23 0x000000886e8b in rrc_gNB_process_f1_setup_req /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_du.c:444
#24 0x000000833942 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2766
#25 0x7fe7d5e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
previously allocated by thread T6 here:
#0 0x7fe7d5ee6883 in calloc (/lib64/libasan.so.8+0xe6883) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x000000a1ac53 in get_default_secondaryCellGroup /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:3969
#2 0x0000009d8913 in create_new_UE /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:571
#3 0x0000009d8913 in ue_context_setup_request /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:638
#4 0x00000083fee2 in rrc_add_nsa_user /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_nsa.c:330
#5 0x000000886e8b in rrc_gNB_process_f1_setup_req /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_du.c:444
#6 0x000000833942 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2766
#7 0x7fe7d5e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
Thread T6 created by T0 here:
#0 0x7fe7d5ede492 in pthread_create (/lib64/libasan.so.8+0xde492) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x0000012a4ba3 in threadCreate /home/richie/w/f1-refactor-ue-context/common/utils/system.c:283
#2 0x0000006b5fef in itti_create_task /home/richie/w/f1-refactor-ue-context/common/utils/ocp_itti/intertask_interface.cpp:317
#3 0x000000435c5f in create_gNB_tasks /home/richie/w/f1-refactor-ue-context/executables/nr-softmodem.c:310
#4 0x000000435c5f in main /home/richie/w/f1-refactor-ue-context/executables/nr-softmodem.c:620
#5 0x7fe7d52115f4 in __libc_start_call_main (/lib64/libc.so.6+0x35f4) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#6 0x7fe7d52116a7 in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x36a7) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#7 0x0000004672d4 in _start (/home/richie/w/f1-refactor-ue-context/build/nr-softmodem+0x4672d4) (BuildId: 81450e9a0b832ca9e36b1984ecc232efde59d424)
Closes: #958
Direct leak of 512 byte(s) in 1 object(s) allocated from:
#0 0x7f37634e5e2b in realloc.part.0 (/lib64/libasan.so.8+0xe5e2b) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x000000fbb9ad in encode_dyn_cb /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/per_encoder.c:23
#2 0x000000fc279e in asn_put_few_bits /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/asn_bit_data.c:220
#3 0x000000fc279e in asn_put_few_bits /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/asn_bit_data.c:192
#4 0x000000fc2ce5 in asn_put_many_bits /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/asn_bit_data.c:293
#5 0x000000fb8c33 in OCTET_STRING_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/OCTET_STRING_uper.c:306
#6 0x000000fd191a in SEQUENCE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:403
#7 0x000000fd191a in SEQUENCE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:403
#8 0x000000fcb140 in CHOICE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:177
#9 0x000000fd191a in SEQUENCE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:403
#10 0x000000fcb140 in CHOICE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:177
#11 0x000000fcb140 in CHOICE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:177
#12 0x000000fd191a in SEQUENCE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:403
#13 0x000000fbc1ed in uper_encode /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:27
#14 0x000000fbc73a in uper_encode_to_new_buffer /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:85
#15 0x000000e10fbd in do_RRCReconfiguration /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/MESSAGES/asn1_msg.c:586
#16 0x000000805712 in rrc_gNB_encode_RRCReconfiguration /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:652
#17 0x000000893860 in nr_rrc_f1_ho_acknowledge /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_mobility.c:280
#18 0x0000008079ac in rrc_CU_process_ue_context_setup_response /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2139
#19 0x0000008330d8 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2771
#20 0x7f3763428ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
During refactoring, I had asan errors in the next line. It took me some
time to figure out that a DRB ID 0 is not valid (cf.
get_next_available_drb_id() and get_drb(), they enforce this).
Direct leak of 48 byte(s) in 1 object(s) allocated from:
#0 0x7fea71ee6f0b in malloc (/lib64/libasan.so.8+0xe6f0b) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x0000007f29c0 in malloc_or_fail /home/richie/w/f1-refactor-ue-context/common/utils/utils.h:86
#2 0x0000007f29c0 in cuup_notify_reestablishment /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:872
#3 0x000000808002 in rrc_CU_process_ue_context_setup_response /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2126
#4 0x0000008330d8 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2770
#5 0x7fea71e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
Direct leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x7f672d6e5e2b in realloc.part.0 (/lib64/libasan.so.8+0xe5e2b) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x000000fbb4ed in encode_dyn_cb /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/per_encoder.c:23
#2 0x000000fbbeeb in _uper_encode_flush_outp /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:126
#3 0x000000fbbeeb in uper_encode /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:36
#4 0x000000fbc27a in uper_encode_to_new_buffer /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:85
#5 0x00000081037c in handle_ueCapabilityInformation /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:1549
#6 0x000000813ced in rrc_gNB_decode_dcch /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:1902
#7 0x0000008334f2 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2741
#8 0x7f672d628ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
Move the filling of DRBs to set up for UE context setup/modification
request into the corresponding functions, and use malloc() deliberately
to avoid memory leaks. In fact fill_drb_to_be_setup_from_e1_resp()
allocates memory dynamically (and has to do that), so the easiest is to
do the same for DRBs. The most straight-forward way seems to be to then
dynamically allocate all memory for F1 UE context setup/modification
request messages, and free with the corresponding free functions,
which removes a couple of memory leaks.
Similarly to the commit "Use F1 UE context setup/modif Request in
stack", we do both UE context setup/modification response at once
because of some functions that are shared by the MAC message handler.
Use the new, tested F1 UE context setup request and modification
requests in the stack.
We have to do both at once, because there are some functions that are
used by handlers for both messages, notably
- handle_ue_context_drbs_setup()
- handle_ue_context_srbs_setup()
(+ and some functions called by those two). For instance, the first uses
the (new/old) type f1ap_drb_to_be_setup_t/f1ap_drb_to_setup_t which is
shared. The alternative would be to duplicate the functionality
temporarily, and I want to avoid unnecessary code churn.
Reintroduce separate message types to simplify the encoding/decoding,
including shorter names. The old types will be removed once everything
has been migrated to the new encoder/decoder, which should ensure that
everything is properly migrated to the unit-tested encoder/decoders.
Also, for each type of F1 message (F1 UE context setup request,
response, modification request, ...) introduce a separate type to avoid
to mistakenly use wrong fields, which can lead to bugs. In this regard,
the DL PDCP SN bit size in the DRB-ToBeSetup list of the UE context
setup request is optional, as it will also be used in the UE context
modification request DRB SetupMod list (which avoids quite some code
duplication). The encoder checks that this IE is present, though.
The previous condition was wrong: if a UE did not have the assoc_id of
the DU that connected (i.e., it was connected to another DU then the one
disconnecting), it was marked for deletion. Instead, skip those UEs.
This modification aims to improve health status detection by using PRACH IO as
an indicator of the gNB's status (container is marked as "healthy" when the
PRACH IO value in gNB nrL1_stats.log exceeds 0.0 dB.). The new condition accounts
for scenarios where the container may not exit or produce error codes (e.g.,
“sleep” logs or "error code overflow" messages).
- `init: true` initializes the docker container with tini or alternative - it is
used to collect all the processes and correctly pass the termination signal to
them, this allows the docker container to be stopped without waiting 10 seconds
to kill the container
- speeding up the healthchecks by reducing the interval from 1-10s to 0.5s during
start period
Co-authored-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
F1AP_LIB_FIND_IE() is used to look up elements in a list, but was
hitherto hardcoded to use "protocolIEs" as an intermediate struct. A
follow-up commit will use this macro where we don't have protocolIEs,
but "iE_Extensions". Hence, modify to make it work for that case (and
others) as well.
Introduce generic _F1_CHECK_EXP(), which is like the macros for checking
values (_F1_EQ_CHECK_INT() etc). Reuse the same for introducing
_F1_EQ_CHECK_OPTIONAL_IE that will be used to write the check for
optional fields more concisely.
CP_OPT_BYTE_ARRAY() FREE_OPT_BYTE_ARRAY() are macros to wrap handling of
optional byte arrays.
_F1_MALLOC() simplifies allocations and is similar to asn1cCallocOne(),
but provided to avoid confusion (since more than ASN.1 structures will
use it).
All will be used in the following commits.
Integration: `2025.w26`
See merge request oai/openairinterface5g!3493
* !3435 Cleanup PDU Session Handling in RRC/NGAP
* !3371 Add NAS Authentication Reject enc/dec library and unit test
* !3490 nr pdcp security: add a 'decipher' API function
* !3477 CI: Upgrade Aerial version to 25-1
* !3491 Fix Msg3 with MAC CE for C-RNTI and RRCReestablishmentComplete
Print a number of statistics, e.g., rx_ulsch_sdu to track UL MAC stats
timing. Remove unused time_meas_t definitions, and fix the name for the
total gNB scheduler time.
Fix Msg3 with MAC CE for C-RNTI and RRCReestablishmentComplete
- Only trigger RRCReconfiguration if UE is not performing RRCReestablishment
- The RRCReconfiguration will be triggered by the RRCReestablishmentComplete
Since this MR fixes a regression, additional info can be found in the following
closed issues and merged MR:
- #687 (closed)
- #747 (closed)
- !2600 (merged)
CI: Upgrade Aerial version to 25-1
- Update the Nvidia L1 (cuBB) from version 24-3 to 25-1
- Decrease the number of cores dedicated to the OAI gNB; testing showed
it does not need that many
This fixes a lifelock in nr_ue_get_sdu(), because select_logical_channels() would select
a suspended LCID for scheduling, but fill_mac_sdu() would not provide data for it.
Cleanup PDU Session Handling in RRC/NGAP
Currently, NGAP and RRC share the same structures and responsibilities when
handling PDU Session information: this creates tight coupling, redundancy, and
makes the code harder to maintain.
- NGAP should be responsible only for: Protocol-specific encoding/decoding
(3GPP TS 38.413)
- RRC should own: PDU Session handling and storage in the UE context
This MR is the first step in a broader refactoring of the PDU Session handling
code across NGAP and RRC layers, with the goal of splitting responsibilities
cleanly between both modules.
- Unified gtpu_tunnel_t for tunnel endpoint config (formerly f1u_tunnel_t)
- Refactored and relocated PDU Session struct definitions for better separation
between NGAP and RRC
- Moved pdusession_t for PDU Session handling out of NGAP, now defined and
managed by RRC only
- Defined 3GPP TS 38.413 message-specific structs in NGAP module
- NGAP now decodes NGAP PDU Session Resource Setup/Modify IEs and transfers
decoded data to RRC via ITTI
- Add helper functions to copy from NGAP message to pdusession_t
- Introduced new encoders/decoders/helpers in NGAP for handling PDU Session
Resource Setup/Modify procedures (e.g. decode_pdusession_transfer)
- Migrated to NGAP and removed duplicated logic for QoS information decoding
(fill_qos)
- Improved logging of GTP tunnel info
- Merged redundant functions (f1u_dl_gtp_update and f1u_ul_gtp_update)
- Removed unused code and obsolete types
- do free_func in seq_arr_erase_it on the provided range and updated unit test
- Other fixes and simplifications (e.g. simplified and clarified naming of
tunnel/session parameters and structs)
This cleanup improves code readability, has a high code churn (the deletions are
~159.7% of the insertions) and prepares for better modularity before the
refactoring of PDU Session handling in RRC/NGAP.
Add NAS Authentication Reject enc/dec library and unit test
This MR introduces the library for encoding/decoding of NAS Authentication
Reject (8.2.5.1 of 3GPP TS 24.501) and relevant unit test.
The message is sent by the AMF to the UE to indicate that the authentication
procedure has failed. A NAS handler was also introduced.
The implementation is limited to epoch times that are not more than 5.12 seconds in the future (allowed are up to 10.24 seconds)
and ntn-UlSyncValidityDuration < 5.12 seconds (allowed are up to 90 seconds).
To fix this limitation, the hyper frame number HFN has to be introduced at the OAI UE!
Before, we only considered ta_Common_r17 and the SAT position from SIB19 to compute the initial timing advance value.
This is good enough if the satellite does not move too fast (e.g. GEO satellite).
Now we also consider ta_CommonDrift_r17 and the SAT velocity together with the epoch time from SIB19.
This improves the accuracy of the initial TA computation, esp. for LEO satellite scenarios.
During reestablishment the UE goes back to not synchronized state.
While the synchronizatin is running, we trash frames using the function readFrame().
And when we successfully synchronize, we skip samples to align with the start of the frame using syncInFrame().
In rfsimulator mode, both of these functions send dummy data using the function dummyWrite().
Unfortunately, the writeTimestamp provided to that function was always assuming a duration from RX to TX of NR_UE_CAPABILITY_SLOT_RX_TO_TX.
But in NTN mode, this value is changed when receiving SIB19.
Therefore we have to consider this changed value instead of the static one.
CI: Add "may_fail" step to execute flaky steps
Add a generic may_fail CI XML step option that indicates the CI step may
fail, but the CI would still be marked as succeeded (instead of skipping
all steps and mark as failed). The cause of this failure depends on the
specific step, e.g., Iperf failing because of low throughput. This
allows to clean up some code and e.g. remove the command_fail option of
Custom_Command, which is then superfluous (and less generic). An
inconvenience is that those may_fail steps will be marked as "failed" in
the HTML. Later cleanup can correct this.
The may_fail is used for executing FHI7.2 testing to push 700 Mbps in DL
(close to the maximum).
Fix some bugs and add some clean up, see commit messages.
Enabling usage of ulsyncvalidityDuration timer in SIB19
ntn-UlSyncValidityDuration in SIB19 from Spec 38.331 v17.12 A validity
duration configured by the network for assistance information which
indicates the maximum time duration (from epochTime) during which the UE
can apply assistance information without having acquired new assistance
information. The unit of ntn-UlSyncValidityDuration is second. Value s5
corresponds to 5 s, value s10 indicate 10 s and so on.
ntn-UlSyncValidityDuration-r17 ENUMERATED{ s5, s10, s15, s20, s25, s30, s35,s40, s45, s50, s55, s60, s120, s180, s240, s900}
Implementation of epochtime is under discussion.
It can be configured in configuration file according to the above
enumeration. For GEO - 240s, MEO - 20s, LEO-5s can be used.
Handle authentication not accepted by the network. The handler assumes the message
is not integrity protected, processes the received NAS message and logs whether a
EAP-failure is enclosed. The UE enters state: 5GMM-DEREGISTERED.
Not done in this commit: the UE shall performs actions as per 5.4.1.3.5 of
3GPP TS 24.501, including (1) Abort any ongoing 5GMM procedure
(2) Stop all active timers: T3510, T3516, T3517, T3519, T3520, T3521
(3) Delete stored SUCI. (4) handle EAP-failure message.
- This is to avoid the Docker image builder from being confused in case we have multiple nvIPC files in `/opt/nvidia-ipc`
- This occurs when we have an MR to upgrade the cuBB image
USRP lib: fix incorrect config check for time_source fallback
Corrected a logic bug in usrp_lib.cpp where the code mistakenly checked
openair0_cfg[0].clock_source instead of time_source when a time_source
was already specified in usrp_args.
Also improved the warning log to clarify that the config value is being
ignored in favor of the explicit user-provided usrp_args.
Co-authored-by: Alexandre Serio alexandre.j.serio@altice.pt
NAS Registration Reject: Add bounds and lengths checks
This change adds lengths checks to the received registration reject
message and also performs a bounds check for the received cause.
Since the cause is not checked, any string in the memory can be
dereferenced, possibly leading to DoS.
Signed-off-by: Eduard Vlad eduard.vlad@rwth-aachen.de
Finalize FAPI dump functions, add Digital Beamforming Table and Precoding Matrix
Table to CONFIG.request
This MR finalizes the addition of dump utility functions for the PARAM.response,
CONFIG.request, CONFIG.response, TX_DATA.request and UCI.indication messages.
These functions are intended to be used to aid in debugging FAPI messages between
the VNF and the PNF by printing out every parameter in a more readable form,
instead of a simple hexdump. These are also used by the nFAPI Hex Parser utility,
to be able to debug an Hex dump provided from elsewhere.
Furthermore, this MR also adds the necessary logic to send/receive the Digital
Beamforming Table and Precoding Matrix Table, this in the CONFIG.request message.
This is achieved by the addition of 2 Vendor Extension TLVs (0xA002 and 0xA003),
in order to be able to reuse existing logic to pack/unpack the data. Note: The
present implementation predicts the existence of multiple instances of the
Precoding Matrix Table via the parameter num_pm_idx, whic is not present in the
SCF specification. Note: The created TLVs are only used to ease the pack/unpack
procedure, by allowing to reuse already existing logic for other TlVs, the tag
and length are not sent.
The necessary additions to the utility functions are done to account for these
table. The CONFIG.request unitary test is changed to fill these tables with
randomized data to test transport and copy.
Motivation of the commit:
Previously, the RRC module on the NGAP interface directly handled ASN.1 decoding
of NGAP PDU Session Resource items, that was directly stored in pdusession_t, i.e.
in the UE context. Decode logic between Setup and Modify was also duplicated.,
e.g. fill_qos/fill_qos2. The idea behind this change is to achieve this flow:
(1) NGAP handler: decoding (2) ITTI to RRC: transfer decoded message (3) RRC
handler: process decoded message, e.g. store in UE context, etc..
The goal of this commit is to:
* improve the NGAP decoding library by adding decoding functions
* let RRC handle the already decoded data
* enhance error handling, with decode failures now consistently detected and rejected early
* have a cleaner, more maintainable code with fewer duplications and a clearer separation of modules
Changes:
* Moved all ASN.1 decode logic for PDU Session Resource items into the NGAP library
* Introduced decode functions for NGAP IEs whenever necessary, e.g. decode_TNLInformation
decode_pdusession_transfer
* Removed duplicate fill_qos functions and centralized QoS handling in NGAP
* Added function to copy from NGAP PDU Session Resource item to RRC pdusession_t: this actually
replaces decodePDUSessionResourceSetup in RRC, copying from the decoded NGAP struct to
the UE context pdusession_t
Motivation:
The previous code had overlapping and partially inconsiste definitions of
`pdusession_t` and related structures across NGAP and RRC. This struct type
was used for either the data stored in the UE context and the NGAP message
IEs holding the PDU session to setup/modify information.
This patch aims to separte the `pdusession_t` in RRC, where it logically belongs,
since RRC owns the state of the PDU sessions. NGAP should only
deal with protocol messages, i.e. enc/dec and transfer structures to RRC.
This clarifies module ownership. This also makes the code easier to maintain.
Changes:
* Moved `pdusession_t` definition from NGAP (`ngap_messages_types.h`) to RRC
(`nr_rrc_defs.h`)
* Added a simpler `pdusession_resource_item_t` structure to NGAP for use in
protocol messages
* Adjusted NGAP structures accordingly (Initial Context Setup, PDU Session
Setup Request, and PDU Session Modify Request).
* do decodePDUSessionResourceSetup to decode the NGAP IEs holding PDU session
information and store what necessary in the UE context PDU Session IE: NOTE
this changes were necessary since previously this function was acting on
the common NGAP/RRC pdu_session_t struct
Rename the struct members:
`pdusession_param` to `pdusession` in NGAP Initial Context Setup Request
`pdusession_setup_params` in `ngap_pdusession_setup_req_t`
`pdusession_modify_params` and `ngap_pdusession_modify_req_t`
Motivation:
Clarify the role of GTP tunnel endpoint IDs in PDU session handling. Previously,
the struct members (gNB_teid_N3, UPF_teid_N3, etc.) were confusingly named and
duplicated with separate transport-layer address fields.
This refactoring replaces these with explicit n3_incoming and n3_outgoing members using
gtpu_tunnel_t. This aligns with GTP conventions: "incoming TEID" refers to the
TEID received from the remote peer (UPF on N3), while "outgoing TEID" is the
TEID sent by the local entity (NG-RAN on N3) to the remote peer.
Benefits:
* Improves readability and clarity of the code
* Reduces redundant struct members, i.e. remove UPF_teid_N3, UPF_addr_N3
* Aligns naming with 3GPP conventions for transport layer tunnels
Changes:
* Replace gtp_addr_N3, gNB_teid_N3, gtp_teid, upf_addr with n3_incoming and n3_outgoing
* Update all related code to use the new struct members
* Aligns naming with 3GPP conventions for transport layer tunnels
This struct is used in different layers, e.g. RRC, NGAP: therefore it
has been moved to platform_types.h.
Also, the struct holds the tunnel endpoint configuration for any GTP-U
tunnel, therefore the f1u prefix is not accurate and was updated
to a more generic gtpu.
* Remove drb_is_active: function is unused and the logic will be later
added to another function to add DRBs if necessary
* Remove unused NGAP structs and empty TODO functions
* Remove unused pdusession_setup_req_t struct definition
The seq_arr_erase_it function was modifying start_it during the free_func loop,
which led to incorrectly apply the free_func on the whole array.
This commit makes sure the elements "freed" are only those in the range and not the whole seq_arr.
* Fixes the logic by introducing a temporary iterator for the free loop,
preserving start_it and end_it for correct offset calculations.
* Adds a regression test in test_seq_arr to verify that only the selected
subrange is erased and that free_func is called exactly on that range.
DL NAS Transport: Fix Message Type retrieval on too short message
The change addresses the SM message type retrieval for DL NAS Transport
messages. The assumption of an offset 17 = 7 (MM Sec) + 3 (MM Plain) + 1
(IEI) + 2 (Len) + 4 (SM) is correct.
However, if the DL NAS Transport is received in a plain header, the
lengths would not add up anymore. (This is not complying with the
standard, so not allowed, but possible). The check for the length is
necessary to not process arbitrary memory contents beyond the
pdu_buffer.
Suspend RBs at UE
In case of suspended radio bearer (by RRC), the MAC needs to discarded received
PDUs and avoid to transmit using LCID related to that RB
"multi-ue profile" was a specific iperf option to do iperf across
multiple UEs. However, this is not necessary anymore, the Iperf
handling multiple UEs "implicitly" (based on the number of UEs).
As of the parent commit, there is a generic "may_fail" option through
which we could still ignore an error. Thus, command_fail is superfluous,
and avoids some extra code.
Further, in all these cases, we should better be informed about any
error, so let's not use may_fail for these tests.
There might be various occasions where a CI step should be attempted to
be executed, despite a chance of failing. For instance, we might want
to try executing an instable Iperf test, and still mark the CI as
passing if it fails.
This commit introduces a generic "may_fail" option that will mark any CI
test as succeeded, despite having failed.
Ideally, we would print a warning in the HTML code, but this is not
possible because each step emits its own HTML code, instead of the main
loop handling this. We can improve this in the future.
SPEC 38.331 section 5.2.2.6
Inform MAC that UL SYNC got lost because of T430 expiry
- Send message NR_MAC_RRC_CONFIG_RESET with cause UL_SYNC_LOST_T430_EXPIRY to MAC
Reacquire SIB19 after T430 expiry
This is not checked in this commit
- RACH needs to be performed through probably PDCCH order to reobtain UL-SYNC
- system usecase involving Recovery from T430 expiry not tested yet as that requires changes on gNB side.
Spec 38.331 section 5.2.2.4.21 indicates this
1> start or restart T430 for serving cell with the timer value set to ntn-UlSyncValidityDuration for the serving cell
from the subframe indicated by epochTime for the serving cell;
NOTE: UE should attempt to re-acquire SIB19 before the end of the duration indicated by ntn-UlSyncValidityDuration and epochTime
Epochtime IE
When explicitly provided through SIB, or through dedicated signaling, the EpochTime is the starting time of a DL
sub-frame, indicated by a SFN and a sub-frame number signaled together with the assistance information.
For serving cell, the field sfn indicates the current SFN or the next upcoming SFN after the frame where the message indicating the epochTime is received.
This field is mandatory present when ntn-Config is provided in dedicated configuration.
gNB implementation related to epochtime will be done in a separate merge request.
Adds the packing and unpacking functions needed for the PM Table in CONFIG.request
This table tag is specified in SCF222.10.06(0x104B), previous versions didn't have a tag for this table, and this version of the spec introduces the parameter `num_pm_idx`, previously not present.
A struct nfapi_nr_pm_tlv_ve_t is added to represent this TLV in order to be able to use the pack_nr_tlv function.
The necessary additions to the utility functions are done to account for this table.
The unitary test is changed to fill this table with randomized data to test transport and copy.
Adds the packing and unpacking functions needed for the DBT Table in CONFIG.request
This table tag is specified in SCF222.5.0 (0x1043) and this tag is used to transport the table, previous versions did not include a tag for the table.
A struct nfapi_nr_dbt_tlv_ve_t is added to represent this TLV in order to be able to use the pack_nr_tlv function.
The necessary additions to the utility functions are done to account for this table.
The unitary test is changed to fill this table with randomized data to test transport and copy.
NR UE fallback to RRCSetup from RRCReestablishment
Implementation of the procedure to handle reception of RRCSetup as response
to RRCReestablishment request
Step 004000 appears double in the XML description. Remove one to avoid
that it is executed twice (because the Python code goes through the list
of test descriptions and executes all that match the current ID =>
double if appears twice).
Corrected a logic bug in usrp_lib.cpp where the code mistakenly checked
openair0_cfg[0].clock_source instead of time_source when a time_source
was already specified in usrp_args.
Also improved the warning log to clarify that the config value is being
ignored in favor of the explicit user-provided usrp_args.
Co-authored-by: Alexandre Serio <alexandre.j.serio@altice.pt>
Integration: `2025.w24`
Closes#965
See merge request oai/openairinterface5g!3476
* !3354 Preparation Work for N2 Handover
* !3383 Add configurable values of NR RLC and NR PDCP to the configuration file
* !3468 Resolve "SSB frequency at gnb.sa.band78.fr1.24PRB.usrpb210.conf is invalid"
* !3466 YAML related updates
* !3460 SRS configuration
* !3474 Fix AMF selection fallback by PLMN ID when no UE identity is present or matching
* !3473 Fix various bugs and inconsistencies in config read, SCTP, ITTI, GTP
* !3169 NR RU improvements for analog beamforming
* !3456 CI: update config for AW2S pipeline
* !3369 Add Security Mode Reject lib/unit test and adopt in stack
* !3457 Fix NR reestablishment
* !3412 [E2 agent] E2AP README update and OAI-FlexRIC CI pipeline improvements
[E2 agent] E2AP README update and OAI-FlexRIC CI pipeline improvements
- E2AP README - add OSC nearRT-RIC section; update with proper FlexRIC
links, and explanations on prerequisites, as well as for xApps
- OAI-FlexRIC CI - use separate containers for xApps
- add reference files for CU-UP/CU-CP
- add logging for KPM NSSAI condition
Fix NR reestablishment by implementing the "DRB-suspend" at the MAC.
This means that the during reestablishment, gNB MAC discards received
DRB packets, and does not schedule DRB. Fix a couple of additional
issues in reestablishment. # Please enter a commit message to explain
why this merge is necessary,
For additional information, see
https://gitlab.eurecom.fr/oai/openairinterface5g/-/merge_requests/2668#note_119369
The spCellConfig is to be dropped during reestablishment and to be
applied after reconfiguration. Implement this using the
RRCReconfigurationComplete acknowledgment from the CU to the DU,
applying the spCellConfig if present (which signals a prior
reestablishment). Remove a prior flag that is not needed anymore, and
do not "guess" when is the reconfiguration, because it is now handled in
the case of the ack.
The spCellConfig is not relevant as long as we use a common search space
for DCIs (and the activation of dedicated search space happens after
applying spCellConfig). For PUCCH, there is the PDSCH transmission of
RRCReconfiguration which gets ack'ed in the default PUCCH.
RRCReconfigurationComplete is sent in PUSCH (again through common
search space). In theory, there cannot be another PUCCH before the
application of spCellConfig, as all bearers are still suspended, and
there should not be another SRB1 transmission in the meantime, as only
one RRC transaction can be active at a time.
Co-authored-by: francescomani <email@francescomani.it>
Add a flag for each RB that tracks suspension state. Mark all RBs
(except SRB1) as suspended on reestablishment, and de-suspend on
reconfiguration. Only check RLC status for non-suspended RBs. For UL
data traffic, check that DRB/SRB2 exist (SRB1 should be there as soon as
the UE context exists).
Add Security Mode Reject lib/unit test and adopt in stack
This MR is adding the library for the NAS Security Mode Reject, and
relevant unit test.
The UE shall send a SECURITY MODE REJECT containing a 5GMM cause that
typically indicates one of the following cause values: (23) UE security
capabilities mismatch. (24) security mode rejected, unspecified
- The message shall be protected if a security context is available.
- The message is adopted in the handling of Security Mode Command failure.
See 3GPP TS 24.501 5.4.2.5 "NAS security mode command not accepted by
the UE".
This MR includes changes from !3262:
> This patch series addresses a security issue where the UE improperly
> accepts a Security Mode Command (SMC) without an authentication header
> (Security Header 0). This behavior violates TS 24.501 and enables an
> attacker to bypass authentication, set integrity protection to NULL
> (NIA0), and reconfigure the UE without proper verification.
>
> We identified the following issues:
>
> 1. The UE currently accepts unauthenticated SMC messages, even
> allowing NIA0 and EIA0 to be set outside emergency mode.
> 2. When applying NIA0, the MAC field remains uninitialized,
> consistently containing the sequence 0xFF3F0000, making it feasible
> to bypass authentication and enforce insecure configurations.
> 3. The UE does not properly signal security mode failures to the Core
> Network.
>
> This patch series tries to address the above-mentioned issues:
>
> 1. Reject unauthenticated SMC messages, enforcing the requirement that
> they must be integrity-protected.
> 2. Validate MAC before applying security settings, ensuring that only
> authenticated messages are accepted.
> 3. Tear down the security context if an integrity check fails.
> 4. Introduce the Security Mode Reject message to inform the Core
> Network of failed SMC procedures, as required by TS 24.501.
This change performs the algorithm rejection in the corresponding NAS
handler for 5G, since the protocol definitions differ between LTE and
5G, regarding NIA0/EIA0 user plane traffic.
Therefore, for 5G NIA0 is rejected, since it is not allowed under normal
circumstances, while LTE user plane traffic can indeed have EIA0
selected.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
It is not allowed to accept an unauthenticated SMC message,
as this effectively bypasses all security measures and
enables a malicioius attacker to compromise the confidentiality
and integrity of exchanged messages.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Co-authored-by: Guido Casati <hello@guidocasati.com>
Retrieving the mac is necessary during the handling of the SMC, since the
context is generated from the specified keys therein. Therefore, it is
necessary to check the MAC right after generation and ensure the authenticity
of the message. If it is not given, the message must be rejected.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Co-authored-by: Guido Casati <hello@guidocasati.com>
This is necessary to indicate to the Core network, that
the security mode command procedure has failed.
Check for the security context presence when generating the Security Mode
reject message: according to 3GPP TS 24.501 5.4.2.5 "NAS security mode command
not accepted by the UE" The UE shall send a SECURITY MODE REJECT containing
a 5GMM cause that typically indicates one of the following cause values:
(23) UE security capabilities mismatch
(24) security mode rejected, unspecified
The message shall be protected if a security context is available
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Co-authored-by: Guido Casati <hello@guidocasati.com>
This 5GMM message is required for an invalid security mode command,
e.g. when the MAC integrity fails, or the wrong Security Header is set.
* Add encode/decode functions for common IEs in fgmm_lib: this library
provides encoding/decoding helpers for IEs shared across multiple
NAS messages. The goal is to avoid the legacy approach of creating
separate files per IE
* add NAS Cause enc/dec lib
* Adopted byte_array_t to handle the buffer
Co-authored-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Fix various bugs and inconsistencies in config read, SCTP, ITTI, GTP
Fix bugs across various layers, mostly layer 3, including memory leaks.
See the commits for more details.
Fix AMF selection fallback by PLMN ID when no UE identity is present or matching
If a mask is present (i.e., not zero), AMF selection by PLMN ID may
still fail, causing the AMF selection process to skip the fallback
option, i.e. selection by PLMN ID, when no UE identity is available or
when no match is found.
This MR adds also warnings in case there's a match for the AMF is not
found.
SRS configuration
- Fix segmentation fault, a memory leak, and LOGs for SRS usage
NFAPI_NR_SRS_BEAMMANAGEMENT
- Refactor SRS configuration;
- Add SRS ResourceSet to get the SNR measurements at MAC layer
In this MR we have 2 SRS ResourceSet, for the same SRS Resource. This
way, in addition to obtaining the UL-RI, we also obtain the SNR in the
MAC and fill the PRB Black list.
This branch has been tested with COTS UE and with RFSim. The measured
values seem correct.
Using the USIM interface in the MAC is non-sensical (violates layer
separation). Add header include in nr-softmodem.c, which previously came
through nr_mac_gNB.h -> usim_interface.h.
Avoid leaking memory upon failed socket binding by calling
freeaddrinfo() before exiting in error cases.
Fixes leak:
Direct leak of 64 byte(s) in 1 object(s) allocated from:
#0 0x0000004ac038 in malloc (/home/richie/oai/cmake_targets/ran_build/build/nr-softmodem+0x4ac038) (BuildId: 875d6e5bc54d7c89bdcf151452f12703cb6fd110)
#1 0x7f0fdd92e2a6 in getaddrinfo (/lib64/libc.so.6+0x1202a6) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#2 0x00000043d7ad in getaddrinfo (/home/richie/oai/cmake_targets/ran_build/build/nr-softmodem+0x43d7ad) (BuildId: 875d6e5bc54d7c89bdcf151452f12703cb6fd110)
#3 0x000000700c73 in udpServerSocket(openAddr_s) /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:486:17
#4 0x000000700c73 in gtpv1Init /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:546:10
#5 0x000000c692b8 in cuup_init_n3 /home/richie/oai/openair2/E1AP/e1ap.c:744:61
#6 0x000000549ea1 in create_gNB_tasks /home/richie/oai/executables/nr-softmodem.c:320:7
#7 0x000000549ea1 in main /home/richie/oai/executables/nr-softmodem.c:619:15
#8 0x7f0fdd8115f4 in __libc_start_call_main (/lib64/libc.so.6+0x35f4) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#9 0x7f0fdd8116a7 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x36a7) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#10 0x000000408524 in _start (/home/richie/oai/cmake_targets/ran_build/build/nr-softmodem+0x408524) (BuildId: 875d6e5bc54d7c89bdcf151452f12703cb6fd110)
This printf just shows which config sections are being read, but this
has no useful information for a user. It was introduced in 7731f5bd2d
but was not present prior to this commit, either.
YAML related updates
- Add common function config_common_getdefault
- Handle exceptions from the yaml-cpp library, transform them into
understandable errors written to stderr
- Add some unit tests.
Add configurable values of NR RLC and NR PDCP to the configuration file
This is for the gNB (the UE gets the values from the gNB).
The physical simulators were also adapted (we put the previously
hardcoded values that were everywhere in the code into the simulators
themselves). I don't think we need to have those values configurable for
the simulators, but I can study the possibility to add this if someone
tells me it's important (if not important I prefer not to do it, I am
not sure if it is trivial to do or not).
Preparation Work for N2 Handover
This MR introduces preliminary improvements to support !3334.
Refactored utility NGAP functions
- Moved allocAddrCopy to NGAP utilities
Decoding Functions for NGAP IEs:
- Added common decoding functions (decode_ngap_guami,
decode_ngap_UEAggregateMaximumBitRate, decode_ngap_nssai, etc.)
- Adopted these functions across the NGAP stack
Improvements to RRC and Handover Handling:
- Enhanced get_neighbour_cell_information and get_neighbour_config to
differentiate input parameters (cell by NR Cell ID vs. gNB by PCI)
- Used byte_array_t in nr_initiate_handover
- Introduced RRCReconfigurationParams_t to structure RRCReconfiguration
IEs
- Added a function to build NR_RRCReconfiguration_IEs_t
- Adopted this approach in do_RRCReconfiguration and refactored the
function
- Refactored the handling of Dedicated NAS message list
- Add masterKeyUpdate handling in RRCReconfiguration generation
PDCP Re-Establishment Improvements:
- Enabled PDCP re-establishment for SRB1/SRB2 based on a bitmap in
createSRBlist (3GPP TS 38.331 RadioBearerConfig)
NH & KgNB Key Management:
- Added NH derivation function as per 3GPP TS 33.501 A.10
- Moved KgNB derivation function to key_nas_deriver utilities
Add the ability to pack/unpack 2 new TLVs for analog beamforming
total_num_beams_vendor_ext and analog_beam_list
Add the unpack related changes for the first 2 vendor extension TLVs introduced related to beamforming.
For the moment the packing is guarded by an Assert to ensure it is not used.
Add the necessary utility function changes to support these VE TLVs
Add the necessary changes to the corresponding unitary test for pack/unpack,
commented for the moment, since the packing is disabled with an Assert.
The mask could be present, .e.g not zero, but the selection of the AMF could
fail. This would lead to a skipping the selection of the AMF by PLMN ID,
which is the last option when no UE identity is present and/or matching.
Free memory allocated in NGAP after use in RRC.
Direct leak of 29 byte(s) in 1 object(s) allocated from:
> #0 0x7f11200b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
> #1 0x558b7fcd0137 in malloc_or_fail /n2-handover-preparation/common/utils/utils.h:86
> #2 0x558b7fcd0137 in create_byte_array /n2-handover-preparation/common/utils/ds/byte_array.c:32
> #3 0x558b7fdb7a5c in rrc_gNB_send_NGAP_NAS_FIRST_REQ /n2-handover-preparation/openair2/RRC/NR/rrc_gNB_NGAP.c:183
> #4 0x558b7fd2ab30 in rrc_gNB_process_RRCSetupComplete /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:439
> #5 0x558b7fd2ab30 in handle_rrcSetupComplete /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1715
> #6 0x558b7fd63e23 in rrc_gNB_decode_dcch /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1851
> #7 0x558b7fd8b4c3 in rrc_gnb_task /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2718
> #8 0x7f111ea94ac2 in start_thread nptl/pthread_create.c:442
ASN_SEQUENCE_ADD is calling realloc which is allocating memory for the
'array' which was not freed.
> Direct leak of 32 byte(s) in 1 object(s) allocated from:
> #0 0x7ce97deb4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> #1 0x5813fba02574 in asn_set_add /openairinterface5g/n2-handover-preparation/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27
> #2 0x5813faf6c672 in createSRBlist /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:331
> #3 0x5813faf9aa78 in rrc_gNB_generate_RRCSetup /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:421
> #4 0x5813fafba2ee in rrc_handle_RRCSetupRequest /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1243
> #5 0x5813fafba2ee in rrc_gNB_process_initial_ul_rrc_message /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2019
> #6 0x5813fafcdc3a in rrc_gnb_task /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2761
> #7 0x7ce97c894ac2 in start_thread nptl/pthread_create.c:442
> Direct leak of 32 byte(s) in 1 object(s) allocated from:
> #0 0x7ce97deb4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> #1 0x5813fba02574 in asn_set_add /openairinterface5g/n2-handover-preparation/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27
> #2 0x5813faf6c672 in createSRBlist /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:331
> #3 0x5813faf7d89d in get_RRCReconfiguration_params /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:660
> #4 0x5813faf914b3 in rrc_gNB_generate_dedicatedRRCReconfiguration /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:716
> #5 0x5813faf96856 in rrc_CU_process_ue_context_setup_response /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2190
> #6 0x5813fafcd3ed in rrc_gnb_task /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2796
> #7 0x7ce97c894ac2 in start_thread nptl/pthread_create.c:442
dynamically allocated memory is pushed to the seq_arr that
is doing a memcpy, so it can be either or better allocated
in the stack instead
> Direct leak of 16 byte(s) in 1 object(s) allocated from:
> #0 0x7efd8f6b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> #1 0x577888f3457e in fill_neighbour_cell_configuration /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:1914
> #2 0x577888f3457e in RCconfig_NRRRC /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2108
> #3 0x57788869a0d2 in create_gNB_tasks /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:253
> #4 0x57788869a0d2 in main /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:619
> #5 0x7efd8e029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
the dynamically allocated memory is pushed to the seq_arr that
is doing a memcpy, so it can be either or better allocated in the
stack instead
> Direct leak of 48 byte(s) in 1 object(s) allocated from:
> #0 0x7d4c934b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> #1 0x577622a40137 in fill_neighbour_cell_configuration /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:1933
> #2 0x577622a40137 in RCconfig_NRRRC /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2109
> #3 0x5776221a30f2 in create_gNB_tasks /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:253
> #4 0x5776221a30f2 in main /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:619
> #5 0x7d4c91e29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
seq_arr_push_back is doing a memcpy so locally allocated memory can be freed after.
Allocate in stack.
> Direct leak of 64 byte(s) in 2 object(s) allocated from:
> #0 0x7ec4bb8b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> #1 0x55895aae1b1f in fill_measurement_configuration /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2015
> #2 0x55895aae1b1f in RCconfig_NRRRC /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2112
> #3 0x55895a246112 in create_gNB_tasks /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:253
> #4 0x55895a246112 in main /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:619
> #5 0x7ec4ba229d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
Inside of passing the RRCReconfiguration buffer, call RRCReconfiguration
message generation inside the F1 callback. This will simplify the code in the
rrc_CU_process_ue_context_setup_response() function once the N2 handover case
is introduced. In rrc_CU_process_ue_context_setup_response(), with presence
of the HO context, the HO ACK callback is called only once and depending
on the type of HO it will do either RRCReconfiguration for F1 and
HandoverCommand for N2.
The byte_array reference contains the pointer to the
encoded RRC buffer to be used in the handover acknowledge
callback (e.g. in F1 to trigger RRCReconfiguration)
This is necessary because the function was re-establishing PDCP only for SRB2
however according to specs 3GPP TS 38.331 RadioBearerConfig, PDCP shall be
re-established for SRB1 and/or SRB2 whenever the security key used for the
radio bearer changes, with some exceptions for SRB1 (i.e. when resuming
an RRC connection, or at the first reconfiguration after RRC connection
reestablishment in NR, do not re-establish PDCP for SRB1).
* the input param "reestablish" is converted into a bitmap to indicate
whether PDCP should be re-established for the SRB1 and/or SRB2.
* For convenience the bitmap is 0-based, with index 1 corresponding to SRB1,
index 2 to SRB2.
This commit is keeping the legacy re-establishment, that is re-establishment
of PCDP for SRB2 only.
according to TS 38.331, RRCReconfiguration messages can be carried
in a container by different RRC messages, e.g. HandoverPreparationInformation,
HandoverCommand, RRCResume etc.. therefore before the introduction of new
RRCReconfiguration messages, e.g. for handover, a new design seems to be necessary
in order to improve modularity and maintainability of the code.
The goal of this commit is to make the generation of RRCReconfiguration
messages more modular by (1) preparing the RRCReconfiguration parameters
data in RRC (2) pass it to ASN1 for IEs allocation (3) encode to buffer
The following changes are introduced:
(1) introduce struct nr_rrc_reconfig_param_t to store the RRC parameters relevant
to encode the RRCReconfiguration IEs
(2) add RRC function get_RRCReconfiguration_params to fetch nr_rrc_reconfig_param_t
data from the UE context and
(3) pass it to the ASN1 encoder, e.g. do_RRCReconfiguration
(4) add a function build_RRCReconfiguration_IEs to allocate memory and build the
ASN1 NR_RRCReconfiguration_IEs_t and
(5) adopt it in do_RRCReconfiguration
(4) add free_RRCReconfiguration_params for memory management of nr_rrc_reconfig_param_t data
(6) add test for rrc_reconfiguration
get_RRCReconfiguration_params:
This function prepares RRCReconfigurationParams for RRC encoding.
Motivation of this change: depending on the RRCReconfiguration
message to be encoded, the ownership of ASN1 memory allocation
should belong to the ASN1 layer, therefore this function is
preparing the nr_rrc_reconfig_param_t data to pass to the
ASN1 encoder to build the ASN1 message and encode to buffer
The function is preparing the params for the IEs that are
either mandatory or shared among different RRC messages.
Specific fields that depend on the message to be encoded are then
added afterwards in the caller. The input param to indicate
re-establishment has been split between SRBs and DRBs, since
depending on the scenario the PDCP re-establishment can vary.
This will be addressed in a later commit.
This function is also handling xid.
build_RRCReconfiguration_IE:
The long term goal is to transfer ownership of memory allocation in ASN1 encoding to
build_RRCReconfiguration_IE, then by calling ASN_STRUCT_FREE_CONTENTS_ONLY
on dl_dcch_msg, all IEs allocated in the context are freed after encoding to buffer.
In the long term, createDRBlist, createSRBlist can also be brought into the context
of build_RRCReconfiguration_IEs and free the ASN1 structure after encoding.
This improves maintability and helps preventing memory leaks.
Currently, what is not allocated in the context, is nulled and freed outside.
free_RRCReconfiguration_params:
this function frees memory allocated to build the nr_rrc_reconfig_param_t data,
including the NR_DRB_ToAddModList_t and NR_SRB_ToAddModList_t. The function
freeDRBlist has been removed since no longer necessary.
dedicated_NAS_msg_list:
dedicated_NAS_msg_list handling has also been refactored, by:
(1) fetch the NAS PDUs from the UE context in get_RRCReconfiguration_params,
which translates to (2) passing an array of dedicatedNAS-MessageList + size
to the ASN1 encoding function where (3) the ASN1 encoding logic for the
dedicated_NAS_msg_list IE has been moved
Note, 3GPP TS 38.331:
dedicatedNAS-MessageList: SEQUENCE (SIZE(1..maxDRB)) OF DedicatedNAS-Message
* differentiate the 2 functions based on the input: either NR Cell ID or PCI
* enhanced variables naming to distinguish the parameters
* add logging for debugging purposes
this commit is refactoring the function ngap_gNB_handle_nas_first_req
to (1) fill first a local instance of ngap_gNB_ue_context_t and then
(2) pass it to ngap_store_ue_context which will allocate memory
for the instance to store in ngap
This count is used to size the dynamic array lcids_bj_pos. In case
count is zero, this would lead to runtime error. With this change,
the function will indicate to the caller that no SDUs are present and
will print an error.
According to 3GPP TS 38.331 5.3.5.5.2 (Reconfiguration with sync), the UE
shall consider the target SpCell to be one with a physical cell identity
indicated by the physCellId
The primary motivation here is to remove a VLA, as in the parent
commits. Closer inspection revealed that (1) it is only used by the LTE
UE, and (2) it only logs some data which we likely don't need. So I
simply removed this function.
Upon failure, the error message was saying that something failed (i.e.,
the reason), but not parameters of the getaddrinfo(). Simplify root
cause analysis by providing the parameters for the attempted
getaddrinfo() call.
This function is needed also in upcoming NGAP
libraries (i.e. N2 Handover) and therefore is moved
to the NGAP utilities file. The function converts
transport_layer_addr_t data struct to BIT_STRING_t
by copying the content of its members. The naming
is also updated to tnl_to_bitstring.
* Functions added:
decode_ngap_guami
decode_ngap_UEAggregateMaximumBitRate
decode_ngap_nssai
decode_ngap_security_capabilities
decode_ngap_mobility_restriction
* Adopt these functions in the common NGAP library
- remove hardcoded values
- adapt gNB RRC code
- adapt gNB MAC code
- adapt physical simulators, where we put the hardcoded values
that were everywhere else before; if there is a need for those
simulators to get configurable values, more work is needed
(but it's doubtful that it is needed)
To be used in a later commit to retrieve NR PDCP configuration
parameters.
To use, add the following to the configuration file (outside of other
configurations). Adapt the values to your setup. The names ("len18bits",
"ms100", etc.) come from 3GPP TS 38.331.
pdcp = {
drb = {
sn_size = "len18bits"
t_reordering = "ms100"
discard_timer = "infinity"
}
}
Default values are applied if the configuration is absent.
The default values are the ones given above.
To be used in a later commit to retrieve NR RLC configuration
parameters.
To use, add the following to the configuration file (outside of other
configurations). Adapt the values to your setup. The names ("ms45",
"size12", etc.) come from 3GPP TS 38.331.
rlc = {
srb = {
t_poll_retransmit = "ms45"
t_reassembly = "ms25"
t_status_prohibit = "ms0"
poll_pdu = "infinity"
poll_byte = "infinity"
max_retx_threshold = "t8"
sn_field_length = "size12"
}
drb_am = {
t_poll_retransmit = "ms45"
t_reassembly = "ms15"
t_status_prohibit = "ms15"
poll_pdu = "p64"
poll_byte = "kB500"
max_retx_threshold = "t32"
sn_field_length = "size18"
}
drb_um = {
t_reassembly = "ms15"
sn_field_length = "size12"
}
}
Default values are applied if the configuration is absent.
The default values are the ones given above.
Integration: `2025.w23`
Closes#962, #956, and #801
See merge request oai/openairinterface5g!3464
* !3302 Enhance UE identity management in Initial UE Message and other NGAP improvements
* !3400 T bugfix: check input data a bit better
* !3459 Improvements in NR band tables according to Rel.17
* !3465 Fix checking that amf_ip_address section is not set.
* !3463 Move RRC radio parameters file to DU
* CI: Use host network mode in NSA-B200 pipeline
* !3389 Relax NR_UE_CAPABILITY_SLOT_RX_TO_TX asserts
* !3417 Imscope updates
* !3443 Fix data race in NR UE MSG3 scheduling
* !3467 remove dead globals
Fix data race in NR UE MSG3 scheduling
Fixed a data race between DL processing of RAR and UL scheduler, which might
result in dropping MSG3.
It was possible that the UL scheduler for the UL slot which RAR indicates as
MSG3 slot was already run by the time the RAR was decoded.
Therefore when DCI for RAR is decoded, assume worst case and halt UL scheduler
for next slot until RAR is decoded solving the data race. This also in turn
halts all later scheduling due to sequential nature of the UL scheduler calls.
Closes#962
imscope updates
- Add CSV export button to imscope
- Add extra cache for IQ data in imscope record thread so that UE time domain
data can be kept until PDSCH is decoded.
- Add metadata to UE time domain samples scope
- Add UE pdsch pre-compensation IQ and PDSCH channel estimates
Move RRC radio parameters file to DU
A number of radio-related RRC parameters, e.g., CellGroupConfig, "originate" at
the DU and are sent to the CU for forwarding to the UE only. Similarly, there
are additional parameters, e.g., RLC-BearerConfig (part of CellGroupConfig),
that originate at the DU.
Hence, the DU decides about these parameters, depending on the MAC state and
capabilities. To clarify this, move the existing
openair2/RRC/NR/nr_rrc_config.{c,h} => openair2/LAYER2/NR_MAC_gNB/nr_radio_config.{c,h}
So that developers know that while those are RRC parameters, they originate at
the DU.
In other words, the CU/RRC is not supposed to use any of these functions in
the RRC. Correspondingly, includes of this file have been cleaned up (and when
they are not necessary at the MAC as well)
Instead of running xApps from oai-flexric container,
create dedicated xApp containers.
In addition, modify the flexric.conf: DB_PATH doesn't exist;
DB_DIR is the correct name.
- prerequisites - use the links to FlexRIC tutorial
- build FlexRIC - use the build tutorial from FlexRIC tutorial
- explain in more details the supported service model functionalities
- explanation if no RIC INDICATION is being sent
- use multi-UE rfsim tutorial from doc/, not oai-workshops repository
Fixed a data race between DL processing of RAR and UL scheduler, which
might result in dropping MSG3.
It was possible that the UL scheduler for the UL slot which RAR
indicates as MSG3 slot was already run by the time the RAR was decoded.
Therefore when DCI for RAR is decoded, assume worst case and halt the
earliest corresponding UL scheduler call until RAR is decoded solving
the data race. This also in turn halts all later scheduling due to
sequential nature of the UL scheduler calls.
Following a power cycle of the CI machines in the NSA-B200 setup, the gNB
machine encountered a networking issue. Although packets were observed leaving
and returning to the host of gNB, they failed to reach the container.
Debugging steps taken:
- upgraded the gNB machine
- reinstalled Docker
- reviewed and verified IP rules and routing settings
Setting the container to use host network mode resolved the issue.
Enhance UE identity management in Initial UE Message and other NGAP improvements
This MR improves the Initial UE Message procedures by supporting simultaneous
presence of both 5G-S-TMSI and GUAMI. Previously, only one identity could be
used, leading to potential AMF selection failures. Now the presenceMask allows
both identities. The AMF selection is prioritizing GUAMI first, then falling
back to 5G-S-TMSI, and finally using PLMN or highest capacity.
Also, fix handling of selected PLMN identity in NGAP.
Refactoring:
- Select the AMF based on (1) absence of UE Identity (2) Presence of GUAMI
(3) Presence of 5G-S-TMSI
- Also refactored the AMF selection logic for better readability and reliability.
- Refactor and cleanup rrc_gNB_send_NGAP_NAS_FIRST_REQ
- Replace ngap_pdu_t with byte_array_t
- Add guami_t to ngran_types.h: refactor NGAP and RRC code to use one common
GUAMI type instead of two identical ones
Also:
- Bugfix in ngap_gNB_handle_ng_setup_response: use correct count for PLMNSupportList
Closes issue #801
Segmentation fault occured since the commit ID 9e5c5497ab,
where we try to copy the pointer which was not even been allocated. Before, we were
copying the address of a NULL pointer and therefore no segmentation fault.
This commit fixes the segmentation fault by checking if the memory was allocated, i.e. should not be
in the case of CU (as it doesn't contain MAC/RLC layers).
A number of radio-related RRC parameters, e.g., CellGroupConfig,
"originate" at the DU and are sent to the CU for forwarding to the UE
only. Similarly, there are additional parameters, e.g., RLC-BearerConfig
(part of CellGroupConfig), that originate at the DU.
Hence, the DU decides about these parameters, depending on the MAC state
and capabilities. To clarify this, move the existing
openair2/RRC/NR/nr_rrc_config.{c,h} => openair2/LAYER2/NR_MAC_gNB/nr_radio_config.{c,h}
So that developers know that while those are RRC parameters, they
originate at the DU.
In other words, the CU/RRC is not supposed to use any of these functions
in the RRC. Correspondingly, includes of this file have been cleaned up
(and when they are not necessary at the MAC as well).
One of the next commits moves nr_rrc_config.c "down to" the MAC/DU. The
BearerConfig functions are only used at the DU, so move them here in the
corresponding file.
When data is generated by "normal" T tracers, it should be fine.
But it might come from unknown sources and then content might be
"strange". So let's validate input data a bit more.
The way allocation is done (granularity of 64KiB) makes a crash more
difficult to achieve, but if a trace is exactly 64KiB, we miss 4 bytes
in the realloc and then anything may happen.
GUAMI fields (Set ID, Pointer and Region ID) were decoded as Octet String,
however they are encoded as BIT STRING. Therefore, the GUAMI value was wrongly decoded.
In the AMF logs the AMF IDs are 1,1,1, however in gNB logs we had 1,64,4
Quick local test confirmed that:
---- TESTING AMF IDs = 1 ----
Region ID (OCTET STRING): 1
Region ID (BIT STRING): 1
Set ID (OCTET STRING): 64
Set ID (BIT STRING): 1
Pointer (OCTET STRING): 4
Pointer (BIT STRING): 1
The difference arises because:
- OCTET STRING treats the buffer as raw bytes, with all bits used.
- BIT STRING includes a `bits_unused` field, which tells how many padding bits
are present in the least significant end. This is especially important in
3GPP ASN.1 definitions like AMF Set ID (10 bits), AMF Region ID (8 bits),
AMF Pointer (6 bits), where the full byte(s) may contain unused bits that
must be masked out.
selectedPLMN-Identity IE in RRCSetupComplete is an Index (long) of the PLMN selected
by the UE from the plmn-IdentityInfoList (SIB1) (see 3GPP TS 38.331)
while
Selected PLMN Identity in NGAP INITIAL UE MESSAGE Indicates the selected PLMN
id for the non-3GPP access (PLMN Identity ID carrying MNC, MCC and MNC size,
9.2.5.1 3GPP TS 38.413)
The legacy code was setting Selected PLMN Identity in the latter to an ID
value as the former, however in NGAP the IE to be encoded is PLMN Identity 9.3.3.5
therefore:
* set plmn type plmn_id_t in ngap_nas_first_req_t
* check whether received selectedPLMN-Identity is within bounds
* select PLMN from gNB_RrcConfigurationReq by selectedPLMN-Identity ID
note: this commit is assuming that the plmn-IdentityInfoList in SIB1
is matching the PLMN list in gNB_RrcConfigurationReq
* in NGAP: store the PLMN in the NGAP UE context, no need to fetch the PLMN
in the NGAP instance since the UE context already tells what PLMN
was selected
Closes#801
* use bitmask to select presence of either 5G-S-TMSI or GUAMI
* select the AMF based on
(1) absence of UE Identity (2) Presence of GUAMI (3) Presence of 5G-S-TMSI
Related to #801
* add function to process AMF Identifier
* add function to select AMF
* set const parameters in utility nnsf functions
* adopt utilities for memory allocation
* improve readability and maintainability
* improve logging
ngap_pdu_t has the same definition as byte_array_t, so it is
replaced by the latter. This simplify the stack and reduces
duplicated code.
Also, add function create_byte_array to copy from an
existing buffer to a new byte_array_t and replaced
allocCopy with create_byte_array, and adopted
OCTET_STRING_fromBuf whenever possible.
ntn-UlSyncValidityDuration in SIB19 from Spec 38.331 v17.12
A validity duration configured by the network for assistance information which indicates the maximum time duration
(from epochTime) during which the UE can apply assistance information without having acquired new assistance information.
The unit of ntn-UlSyncValidityDuration is second. Value s5 corresponds to 5 s, value s10 indicate 10 s and so on.
ntn-UlSyncValidityDuration-r17 ENUMERATED{ s5, s10, s15, s20, s25, s30, s35,s40, s45, s50, s55, s60, s120, s180, s240, s900}
Implementation of epochtime is under discussion.
It can be configured in configuration file according to the above enumeration. For GEO - 240s, MEO - 20s, LEO-5s can be used.
This change adds lengths checks to the received registration reject
message and also performs a bounds check for the received cause.
Since the cause is not checked, any string in the memory can be
dereferenced, possibly leading to DoS.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
The change addresses the SM message type retrieval for DL NAS Transport
messages. The assumption of an offset 17 = 7 (MM Sec) + 3 (MM Plain) + 1
(IEI) + 2 (Len) + 4 (SM) is correct.
However, if the DL NAS Transport is received in a plain header, the
lengths would not add up anymore. (This is not complying with the
standard, so not allowed, but possible). The check for the length is
necessary to not process arbitrary memory contents beyond the
`pdu_buffer`.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
@@ -231,6 +231,9 @@ Or by providing this the the command line parameters:
The main parameters to cope with the large NTN propagation delay are cellSpecificKoffset, ta-Common, ta-CommonDrift and the ephemeris data (satellite position and velocity vectors).
The parameter `ntn-UlSyncValidityDuration-r17` indicates the maximum time duration from epochtime during which the UE can apply assistance information without having acquired new assistance information. i.e this enables UE to re-read SIB19 before timer with value ulSyncValidityDuration expires. The unit of the field is in seconds. Example values for GEO: 240s, MEO: 20s, LEO: 5s.
As epochtime is not implemented yet, UE starts the timer from the TTI where SIB19 is received with ntn-UlSyncValidityDuration-r17 IE.
The parameter `cellSpecificKoffset_r17` is the scheduling offset used for the timing relationships that are modified for NTN (see TS 38.213).
The unit of the field Koffset is number of slots for a given subcarrier spacing of 15 kHz.
@@ -10,6 +10,8 @@ There are three main beamforming techinques: analog, digital and hybrid. The nam
The presence of a limited number of predefined beams at RU poses constraints to the scheduler at gNB. As a matter of fact, the scheduler can serve only a limited number of beams, depending on the RU characteristics (possibly only 1), in a given time scale, that also depends on the RU characteristics (e.g. 1 slot or 1 symbol). This limitation doesn't exist for digital beamforming.
Analog beamforming implementation also allows to enable distributed antenna systems (DAS), where each beam corrisponds to one antenna (or a set of antennas) of the system. In this scenario, the scheduler constaint is alleviated because normally the number of concurrent beams allowed equals the total number of beams.
# Configuration file fields for analog beamforming
A set of parameters in configuration files controls the implementation of analog beamforming and instructs the scheduler on how to behave in such scenarios. Since most notably this technique in 5G is employed in FR2, the configuration file example currently available is a RFsim one for band 261. [Config file example](../ci-scripts/conf_files/gnb.sa.band261.u3.32prb.rfsim.conf)
@@ -18,8 +20,9 @@ In the `MACRLC` section of configuration files, there are three new parameters:
-`set_analog_beamforming` can be set to 1 or 0 to activate or desactivate analog beamforming (default value is 0)
-`beam_duration` is the number of slots (currently minimum duration of a beam) the scheduler is tied to a beam (default value is 1)
-`beams_per_period` is the number of concurrent beams the RU can handle in the beam duration (default value is 1)
-`beam_weights` is a vector field containing the set of beam indices to be provided by the OAI L1 to the RU is also required. In current implementation, the number of beam indices should be equal to the number of SSBs transmitted
In the `gNBs` section of the configuration file, under the phyisical parameters, a vector field containing the set of beam indices to be provided by the OAI L1 to the RU is also required. This field is called `beam_weights`. In current implementation, the number of beam indices should be equal to the number of SSBs transmitted.
DAS is enabled by setting to 1 the parameter `enable_das` in the L1 section of the configuration file. In case of DAS enabled, the field `beam_weights` in `MACRLC` section can be omitted.
# Implementation in OAI scheduler
@@ -28,3 +31,28 @@ This matrix contains the beams already allocated in a given slot, to flag the sc
To this goal, we extended the virtual resource block (VRB) map by one dimension to also contain information per allocated beam. As said, the scheduler can independently schedule users in a number of beams up to `beams_per_period` concurrently.
It is important to note that in current implementation, there are several periodical channels, e.g. PRACH or PUCCH for CSI et cetera, that have the precendence in being assigned a beam, that is because the scheduling is automatic, set in RRC configuration, and not up to the scheduler. For these instances, we assume the beam is available (if not there are assertions to stop the process). For data channels, the currently implemented PF scheduler is used. The only modification is that a UE can be served only if there is a free beam available or the one of the beams already in use correspond to that UE beam.
# FAPI implementation
To be noted that in our implementation analog beamforming is only supported in non-split/monolithic mode because we don't support yet SCF P19 interface that would be needed to manage these procedure in a split scenario with SCF FAPI.
In `config_request` structure, a vendor extension (`nfapi_nr_analog_beamforming_ve_t`) configures the lower layers at initialization with the following information:
-`analog_bf_vendor_ext` which can assume values 1 or 0 for enabling or disabling analog beamforming
-`num_beams_period_vendor_ext` which corresponds to the configuration parameter `beams_per_period`
-`total_num_beams_vendor_ext` which corresponds to the number of beams configured in `beam_weights`
-`analog_beam_list` which contains the RU beamforming indices configured in `beam_weights`
Additionally, L2 provides in each channel FAPI message information about the beam index. Small Cell Forum (SCF) FAPI provides in its PHY API specifications for the channels only a field for digital beamforming as part of the `precoding_and_beamforming` stucture. Therefore without a better option, we are currently using that one to store the internal analog beamforming index. This is the index used internally by the code to progressively identify the beam with a value from 0 to `total_num_beams_vendor_ext`.
# L1 implementation
To handle multiple concurrent beams, the buffers containing Tx and Rx data in frequency domain (`txdataF` and `rxdataF`) have been extended by one dimension to contain multiple concurrent beams to be transmitted/received.
The function `beam_index_allocation`, called by every L1 channel, is responsible to match the FAPI analog beam index to the RU beam index and to store the latter `beam_id` structure, which allocates the beams per symbol, despite L2 only supporting beam change at slot level. At the same time, the function returns the concurrent beam index, to be used to store data in frequency domain buffers. While doing so, the function also checks if there is room for current beam in the list of concurrent beams, which should always be the case, if L2 properly allocated the channels.
In case of DAS, since each beam corresponds to a specific antenna port, the `beam_index_allocation` function is simplified in the sense that the beam index corresponds to the antenna port index of the frequency domain buffers.
# RU implementation
The implementation is still work in progress.
The first dimension of the Tx and Rx buffers that used to contain the number of Tx/Rx antennas, it is now extended to contain the number of parallel streams which is the number of antennas multiplied by the number of concurrent beams.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.