Reduce throughput requirement, as this fails once two DUs are connected
to a UE, which creates more load on the machine and frequently fails
with low throughput.
CI: Enable Physim threshold check for tests on Caracal and GH
This MR adds support for configurable timing threshold files in PhySim
tests.
- Introduces a new CMake cache variable PHYSIM_CHECK_FILES to specify
one or more timing threshold files (semicolon-separated).
- Enables optional enforcement of timing thresholds check in PhySim
tests without changing existing test definitions.
- Defines timing thresholds for LDPC encoding/decoding in nr_ulsim,
nr_dlsim and ldpctest on Caracal and GH machines.
SRS noise power
This MR implements the calculation of the noise power based on SRS in a
different way, and check whether SNR is more accurate or not. This MR is
built on top of the MR: !3460
A graph was added in T_Tracer to observe UL-SNR calculated using SRS.
See merge request description for measurement results.
Replace the previous add_timed_physim_test() macro with add_physim_test()
to use a single, unified function for defining physim tests. This simplifies
the test configuration and removes redundant macro definitions while keeping
all existing functionality.
This change follows up on the earlier addition of support for including
custom timing threshold files (PHYSIM_CHECK_FILES).
Update existing tests accordingly.
Add missing timinig analysis scripts to RHEL9 physim docker image. These files
are now copied from the build stage to /oai-ran/openair1/SIMULATION/tests/,
where they are expected by ctest.
Resolves following issue when running ctest in docker container:
CMake Error: Error processing file: /oai-ran/openair1/SIMULATION/tests/RunTimedTest.cmake
For some physical simulators, we have multiple SNR iterations.
The previous version of the script correctly retained only the last
measurement, but if a previous measurement condition set RC=1, the
script would fail although the final "good" run might fulfil the
measurement condition (IOW, it would show SUCCESS, but still fail on the
check).
Instead, check if all measurement lines finish on SUCCESS, which handles
the above case.
The awk script in analyze-timing.sh used syntax that works with gawk but fails
on systems where mawk is the default implementation, producing errors such as:
awk: /dev/fd/3: line 6: syntax error at or near ,
-- test command finished with SIGPIPE
Concretely, the match(text, pattern, variable) function does not exist
in mawk, as it cannot capture matches in variables. Work around by
substituing strings, and force a numeric comparison.
Fixes to prevent assertion due to 0 PRB allocation
Assertion (NPRB>0 && (NPRB + RBstart <= BWPsize)) failed!
In PRBalloc_to_locationandbandwidth0() /home/user/openairinterface5g/common/utils/nr/nr_common.c:506
Illegal NPRB/RBstart Configuration (0,51) for BWPsize 51
Probably caused by missing safeguards to prevent computing TBS with 0 PRB
as input.
Fix OAI UE memory leaks
Fix 1: Replaced asn1cFreeStruc with ASN_STRUCT_FREE in MAC layer to properly
free nested ASN.1 structures in cell group configuration.
Fix 2: Removed premature nullification of dedicatedNAS_Message->buf in
dlInformationTransfer processing to allow proper ASN.1 cleanup.
Fix 3: Fixed memory ownership in nr_rrc_process_dedicatedNAS_MessageList by
copying OCTET_STRING data instead of transferring ownership, preventing
ASN.1 cleanup from losing track of allocated memory
Closes#828
fix RSRP computation at UE
Conflicts between !3595 (merged) and !3596 (merged) leading to double conversion
of RSRP into index in L1 and L2. With this fix it is only converted in L2.
Replace int16 min when obvious
INT16_MIN doesn't have a opposite value on 16 bits, so SIMD abs (absolute()), or
simple C operations doesn't make the expected result.
example:
(gdb) p (short)-(short)-32768
$4 = -32768
(gdb)
This MR replaces constants INT16_MIN by -INT16_MAX (so -32767) in places where
it used for mathematical operations. This is not perfect, nevertheless reduces
overflow probability.
We saw in some places a dirty case: code do first calls to _mm_adds_epi16
(or subs), so because of the saturated operations, the probability to reach
32767 and -32768 is higher than the other numbers but, _mm_abs_epi16(), or
negate operations (conjugate) can follow, that is making strong error as
abs(-32768)=-32768
Also, don't use "set -x" debugging for oc login command:
ci-scripts/cls_cmd.py:242 sets BASH_XTRACEFD=1, which makes that all
"set -x" output is in stdout, leading to a redirect to the file into
which we redirect. This would lead to the following error with
unsuccessfull oc login:
error: You are not a member of project "****-core-for-ci-ran".
Error from server (Forbidden): imagestreams.image.openshift.io "oai-physim"
is forbidden: User "system:anonymous" cannot get resource "imagestreams" in
API group "image.openshift.io" in the namespace "****-ran"
This fixes basically two problems. First, remove "set -e", which leads
to the script exiting on error. For instance, there was the sleep which
should account for the time of the pod being in "ContainerCreating", but
might not be enough. In that case, the script would exit, leaving the
pod deployed.
Second, a fixed time is not good, as it can be too short and unduly
prolong waiting time. Replace with a loop.
- Remove unnecessary NULL assignment for dedicatedNAS_Message->buf
- The original buffer is copied and transfered to NAS, so it can be properly freed by ASN.1 structure cleanup
Root cause: Code was nullifying dedicatedNAS_Message->buf pointer before ASN.1 cleanup could free the original allocation, causing the leak from OCTET_STRING_decode_uper.
AddressSanitizer leak trace (FIXED):
Direct leak of 119 byte(s) in 3 object(s) allocated from:
/#0 0x7ec2a42b4c38 in __interceptor_realloc
/#1 0x555fade852e0 in OCTET_STRING_decode_uper
/#9 0x555fadb48b11 in nr_rrc_ue_decode_dcch.
The leak was caused by improper memory ownership handling in the
dedicatedNAS_MessageList processing. The function was transferring
buffer ownership to NAS messages and then preventing ASN.1 cleanup
from freeing the original allocations by setting
list.count = 0, causing a memory leak.
Leak trace:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
/#0 0x7f2ce3ab4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
/#1 0x567907083f0f in OCTET_STRING_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/OCTET_STRING_uper.c:89
/#2 0x5679070ed5e6 in SET_OF_decode_uper /cmake_targets/ran_build/build/openair2/RRC/NR/MESSAGES/constr_SET_OF_uper.c:70
/#3 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118
/#4 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118
/#5 0x56790709a403 in CHOICE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:84
/#6 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118
/#7 0x56790709a403 in CHOICE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:84
/#8 0x56790709a403 in CHOICE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:84
/#9 0x56790707b6dc in SEQUENCE_decode_uper /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:118
/#10 0x56790708b5f1 in uper_decode /cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
/#11 0x567906d44b4b in nr_rrc_ue_decode_dcch /openair2/RRC/NR_UE/rrc_UE.c:2212
/#12 0x567906d520a3 in rrc_nrue /openair2/RRC/NR_UE/rrc_UE.c:2615
/#13 0x567906d5f77e in rrc_nrue_task /openair2/RRC/NR_UE/rrc_UE.c:2501
/#14 0x7f2ce2494ac2 in start_thread nptl/pthread_create.c:442
Fix:
- Copy OCTET_STRING data instead of transferring ownership
- Allow ASN.1 cleanup to properly free original allocations
This fixes the leak that occurred during rrcReconfiguration
message processing when dedicatedNAS_MessageList was present.
Closes#828
- Replace asn1cFreeStruc with ASN_STRUCT_FREE in MAC layer cleanup
- Fixes improper memory management of NR_CellGroupConfig structures
Root cause: asn1cFreeStruc only calls ASN_STRUCT_RESET + free(), which doesn't properly free nested ASN.1 allocations. ASN_STRUCT_FREE frees all nested structures completely.
AddressSanitizer leak trace:
Direct leak of 288 byte(s) in 1 object(s) allocated from:
/#0 0x7fb72bab4a57 in __interceptor_calloc
/#1 0x593752b28d0d in SEQUENCE_decode_uper
/#2 0x593752b9a546 in SET_OF_decode_uper
/#3 0x593752b2863c in SEQUENCE_decode_uper
/#4 0x593752b47363 in CHOICE_decode_uper
/#5 0x593752b2863c in SEQUENCE_decode_uper
/#6 0x593752b2863c in SEQUENCE_decode_uper
/#7 0x593752b2863c in SEQUENCE_decode_uper
/#8 0x593752b2863c in SEQUENCE_decode_uper
/#9 0x593752b2863c in SEQUENCE_decode_uper
/#10 0x593752b38551 in uper_decode
/#11 0x5937527d859f in nr_rrc_ue_process_masterCellGroup
/#12 0x5937527d9408 in nr_rrc_process_reconfiguration_v1530
/#13 0x5937527dd5bb in nr_rrc_ue_process_rrcReconfiguration
/#14 0x5937527f5e6b in nr_rrc_ue_decode_dcch
/#15 0x5937527ff003 in rrc_nrue
/#16 0x59375280c6de in rrc_nrue_task
Integration: `2025.w40`
* !3672 \[ci\] Fix MissingPropertyException - COTS-UE by binding OAI_Registry globally
* !3609 BWP with no PRACH occasions
* !3657 do not assert for mismatched TBS in phy-test mode
* !3667 CI: Updates for HO and AW2S pipeline
* !3674 NR UE: remove function get_nr_RSRP() and get_nr_rx_total_gain_dB() for cleanup
* !3478 NR UE: add UCI (HARQ-ACK/NACK) on PUSCH support at PHY
* !3664 modulation LUTs size was wrong, and remove inconsistent test of SSE2 enable
* !3665 Make all targets compile
* !3554 Handle failures in RRCReconfiguration encoding gracefully
* !3655 Improvements to N2 handover
* !3678 Add OAIUE longrun pipeline
* !3628 Update documentation
Closes#979, #726, #959, #967, and #930
See merge request oai/openairinterface5g!3676
Add OAIUE longrun pipeline
Add a new XML file for OAIUE longrun.
- Test description:
* 40 MHz BW, n78
* gNB with USRP N310, UE with USRP N310
* CN deployed on OC
- Test duration: 1 hour
- Test scenario: 3x DL 10 min test (20 Mbps) + 3x UL 10 min test (5
Mbps)
pods deployed through helm occasionally take more time, leading to
errors such as
Error from server (BadRequest): container "physim" in pod "oai-physims-4g-sczvl" is waiting to start: ContainerCreating
Give a bit more time before checking the logs. We cannot wait too much,
as the container will just end on FINISHED in running state, so the logs
will always be there.
Make all targets compile
This MR enables us to compile all targets, and does that in one CI test. This
closes#726. Now, this should work:
cd ~/openairinterface5g
mkdir build && cd build
cmake .. -GNinja && ninja
To achieve this, I did the following:
- some targets have been fixed (warnings, errors)
- some targets have been removed when they did not seem to serve a good purpose
(e.g., an almost empty test)
- some targets have been commented (e.g., LTE simulators, some unitary tests)
which we maybe want to revive in the future
- some targets built when just building with ninja, but not all. For instance,
telnetsrv_enb would typically build, but it was missing a dependency. Doing
cmake .. -GNinja && ninja telnetsrv_enb would show this (in develop)
To help with the last bullet point, there is a script compile_targets.sh that
can compile targets independently (and in parallel, to not wait for ages) to
show that targets compile properly compile-targets.patch.
In almost all cases, the problem is that a specific module uses the logging
module, which depends on T, which needs to dynamically create headers. The way
to do this is to have a dependency, and many targets use generate_T or {T_LIB}
({} intentional: T might be absent, so then it evaluates to nothing). However,
not all do this, and those that depend on T actually don't depend on T, but on
the logging module, which in turn depends on T. So in many places, a simple
dependency onto log_headers fixes this problem, and generate_T or {T_LIB}
simplifies the dependency (but not always). The commits should have more info.
Note that at least the targets in FlexRIC do not all compile, at least in the
configuration that we use in docker/Dockerfile.build.ubuntu. So for the latter,
we cannot build with a simple ninja, but FlexRIC seems to be the only one that
does not compile. Since FlexRIC is a separate repository, that needs to be
addressed in the corresponding repository.
Previously, the script attempted to directly merge ${merge}, which could f
ail if the branch was not already available locally. This update explicitly
fetches the branch from origin and then merges FETCH_HEAD with --ff, ensuring
the merge works even when the branch is missing locally.
- Move 'What is a gNB neighbor?' explanation from rrc-usage.md to handover-tutorial.md where it belongs
- Replace generic parameter names with actual configuration parameter names and specific descriptions (e.g. gNB_ID, nr_cellid)
- Add example configuration structure showing proper syntax
- Add missing 'band' parameter that was not listed before
- Provide concrete examples and exact constraints for each parameter
- Cross-reference between documents for better organization
This addresses documentation issues where generic parameter descriptions were
not useful for developers configuring neighbor cells.
- Remove extensive traffic testing before HO (iperf tests 030001, 030002)
- Do 1 ping test after attachment
- Reduce ping packet count from 100 to 50 packets for remaining connectivity test
Time savings: ~2-3 minutes by removing traffic validation overhead
Split monolithic e1_send_bearer_updates into three focused functions:
- e1_send_bearer_updates(): DRB setup from F1 UE Context Modification Response
- e1_request_pdcp_status(): Request PDCP status during inter-CU handover
- e1_notify_pdcp_status(): Notify CU-UP with PDCP status during handover
Extract common helpers:
- append_e1_drb_mod_req(): Common DRB-to-mod for bearer request logic
- e1_send_bearer_modification_request(): Common sending step
Bug fixes:
- Fix loop bounds (i < n instead of i == n)
- Fix array access bounds checking
- Fix DRB ID consistency
Memory management:
- Add missing free_e1ap_context_mod_request calls
- Improve error handling with early returns
In the process:
- Simplify cuup_notify_reestablishment with FOR_EACH_SEQ_ARR loop
- Adopted all callers to use new consolidated functions
Improves maintainability and eliminates complex conditional logic.
Replace field-by-field assignment with struct copy for plmn_identity.
Both source and destination use identical plmn_id_t type, making
this change safe and more maintainable.
- Reduces lines of code
- More readable and less error-prone
- Single memory copy operation instead of multiple field assignments
- ngap_gNB_handover_notify: Fix misleading error message from 'Failed to encode'
to 'Failed to find UE context' for better clarity
- ngap_gNB_handle_ul_ran_status_transfer: Standardize error message format
from 'Could not find' to 'Failed to find' for consistency across functions
This ensures consistent and accurate error reporting across all NGAP handover functions.
- Update encoder functions in ngap_gNB_mobility_management.c to use calloc_or_fail
- Provides zero-initialized memory and consistent error handling
- Prevents uninitialized fields and improves memory safety
Also:
- Update NG Setup Request to use calloc_or_fail
- Replace inefficient 'allocate, extract, free' pattern with direct value extraction
- Remove unused functions get_gap_config_from_smtc() and get_gap_config()
- Add extract_gap_config_from_smtc() that extracts values directly without allocation
- Eliminates use-after-free risk and improves performance
- No allocation overhead, no memory leaks
- Add missing ASN_STRUCT_FREE for NR_MeasGapConfig in create_measgap_config
- Fix 48-byte measurement gap config leak in get_gap_config_from_smtc
AddressSanitizer backtrace:
Direct leak of 48 byte(s) in 1 object(s) allocated from:
/#0 0x7d32adab4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
/#1 0x5751f99cbb79 in calloc_or_fail /home/guido/repo/openairinterface5g/develop/common/utils/utils.h:74
/#2 0x5751f99cbb79 in get_gap_config_from_smtc /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4164
/#3 0x5751f99cbb79 in create_measgap_config /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4310
/#4 0x5751f9964abe in ue_context_setup_request /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:709
/#5 0x5751f979e568 in nr_initiate_handover /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:218
/#6 0x5751f97a637f in nr_rrc_trigger_n2_ho_target /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:526
/#7 0x5751f9703608 in rrc_gNB_process_e1_bearer_context_setup_resp /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:2641
/#8 0x5751f9706b7b in rrc_gnb_task /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:3020
/#9 0x7d32ac494ac2 in start_thread nptl/pthread_create.c:442
Root cause: create_measgap_config allocated NR_MeasGapConfig via get_gap_config_from_smtc()
but never freed it after extracting the needed values to populate the measgap_config_t
return structure.
- Add missing handover context cleanup in rrc_CU_process_ue_context_release_complete
- Fix 16-byte handover context leak in N2 handover source gNB trigger path
AddressSanitizer backtrace:
Direct leak of 16 byte(s) in 1 object(s) allocated from:
/#0 0x7fee67cb4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
/#1 0x58059e33454b in calloc_or_fail /home/guido/repo/openairinterface5g/develop/common/utils/utils.h:74
/#2 0x58059e33454b in alloc_ho_ctx /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:47
/#3 0x58059e339e4d in nr_rrc_trigger_n2_ho /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:556
/#4 0x58059e33ae93 in nr_HO_N2_trigger_telnet /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:611
Root cause: Handover context allocated in N2 handover source gNB trigger path (nr_rrc_trigger_n2_ho)
for any successful N2 handover but not properly freed in all handover completion scenarios.
The UE context release complete handler was missing cleanup for handover context.
Solution: refactor handover context cleanup
- Move nr_rrc_finalize_ho() call to rrc_delete_ue_data() for centralized cleanup
- Remove redundant nr_rrc_finalize_ho() calls from handover failure paths:
* rrc_CU_process_ue_context_release_request() - UE not deleted yet
* invalidate_du_connections() - UE will be deleted later
- Keep nr_rrc_finalize_ho() calls in handover success paths where UE continues operating
- Ensures handover context is cleaned up exactly once when UE is actually deleted
- Prevents potential double-free and use-after-free issues in handover cleanup
This centralizes all UE data cleanup in rrc_delete_ue_data() and ensures
handover context is properly managed throughout the UE lifecycle and cleaned up
when UE delete happens.
NR UE: add UCI (HARQ-ACK/NACK) on PUSCH support at PHY
Add UCI (HARQ-ACK/NACK) on PUSCH support at nrUE PHY, the multiplexing procedure
can be found in TS 38.212 section 6.2.7.
Verified with 3rd-pary gNB for cases when HARQ payload bits length is 1, 2 or 3.
Closes#959 and #967 .
- Add missing ASN_STRUCT_FREE for NR_MeasurementTimingConfiguration in ue_context_setup_request
- Fix 64-byte MTC sequence leak in get_nr_mtc → SEQUENCE_decode_uper
AddressSanitizer backtrace:
Direct leak of 64 byte(s) in 1 object(s) allocated from:
/#0 0x7dcfcb8b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
/#1 0x591fcc59b67d in SEQUENCE_decode_uper /home/guido/repo/openairinterface5g/develop/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
/#2 0x591fcc57eaa1 in uper_decode /home/guido/repo/openairinterface5g/develop/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
/#3 0x591fcbdbedeb in get_nr_mtc /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4216
/#4 0x591fcbd58188 in ue_context_setup_request /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:635
/#5 0x591fcbb92568 in nr_initiate_handover /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:218
/#6 0x591fcbb9a37f in nr_rrc_trigger_n2_ho_target /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:526
/#7 0x591fcbaf7608 in rrc_gNB_process_e1_bearer_context_setup_resp /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:2640
/#8 0x591fcbafab7b in rrc_gnb_task /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:3019
/#9 0x7dcfca294ac2 in start_thread nptl/pthread_create.c:442
Root cause: ue_context_setup_request allocated NR_MeasurementTimingConfiguration via
get_nr_mtc() but never freed it after creating the measurement gap configuration.
The create_measgap_config function only reads from the structure and doesn't take
ownership, so the caller must free it.
- Replace heap allocation with stack allocation for seq_arr_t structures
- Use proper seq_arr_free() with free functions for ASN.1 structures
- Remove unnecessary malloc/free calls for sequence containers
- Improve memory safety and performance with automatic cleanup
Fixes 128-byte memory leak:
Direct leak of 128 byte(s) in 2 object(s) allocated from:
/#0 0x7e7f39ab4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
/#1 0x56df8b07312d in SEQUENCE_decode_uper /home/guido/repo/openairinterface5g/develop/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:37
/#2 0x56df8b056551 in uper_decode /home/guido/repo/openairinterface5g/develop/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/uper_decoder.c:83
/#3 0x56df8a896b1b in get_nr_mtc /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:4216
/#4 0x56df8a82feb8 in ue_context_setup_request /home/guido/repo/openairinterface5g/develop/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:635
/#5 0x56df8a66a298 in nr_initiate_handover /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:218
/#6 0x56df8a6720af in nr_rrc_trigger_n2_ho_target /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB_mobility.c:526
/#7 0x56df8a5cf338 in rrc_gNB_process_e1_bearer_context_setup_resp /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:2633
/#8 0x56df8a5d28ab in rrc_gnb_task /home/guido/repo/openairinterface5g/develop/openair2/RRC/NR/rrc_gNB.c:3012
/#9 0x7e7f38494ac2 in start_thread nptl/pthread_create.c:442
- Add early check for existing UE context by AMF UE NGAP ID at beginning of rrc_gNB_process_Handover_Request
- Add dedicated function to get UE context by AMF UE NGAP ID: rrc_gNB_get_ue_context_by_amf_ue_ngap_id()
- Send handover failure with appropriate cause if UE context already exists
- Remove redundant ho_context NULL check that could never be true for newly created UE contexts
- Prevents duplicate handover processing and resource leaks
Move UE context creation and storage to after successful PDU encoding
to prevent memory leaks if encoding fails. Also add proper PDU cleanup
when AMF fetch fails and use consistent NULL check style.
This ensures UE context is only stored when the operation is guaranteed
to succeed, improving error handling and memory management.
In the current memory management the caller wasn't responsible for freeing
memory they allocate. The ngap_gNB_encode_pdu function was taking ownership
of PDU contents by calling ASN_STRUCT_FREE_CONTENTS_ONLY, while callers
also expected to manage the same memory. This created unclear ownership semantics and
potential double-free bugs.
- Remove ASN_STRUCT_FREE_CONTENTS_ONLY from ngap_gNB_encode_pdu to prevent double-free
- Remove unnecessary ASN_STRUCT_FREE when encode function returns NULL
- Add proper ASN_STRUCT_FREE cleanup for heap-allocated PDUs in ngap_gNB.c functions
- Add ASN_STRUCT_FREE_CONTENTS_ONLY cleanup for stack-allocated PDUs in NAS and context management functions
- Ensure consistent memory cleanup patterns across all NGAP encoder callers
- Fix potential memory leaks in all ngap_gNB_encode_pdu call sites
This prevents double-free bugs and ensures proper cleanup of ASN.1 structures
in both heap and stack allocation scenarios.
Add check for cu_exists_f1_ue_data() before calling cu_get_f1_ue_data()
to prevent assertion failure when telnet command 'ci fetch_du_by_ue_id'
is used for UEs that have been handed over via N2 (and no longer have
F1 UE data).
This fixes the crash:
Assertion (ret == HASH_TABLE_OK && data != ((void *)0)) failed!
In get_hashtable_data() /oai-ran/openair2/F1AP/f1ap_ids.c:36
element for ue_id 1 not found
The function now returns NULL gracefully when F1 UE data is not available.
Co-authored-by: Guido Casati <hello@guidocasati.com>
- Add proper cleanup of allocated ASN.1 structures in all return paths
- Fix early returns that were leaking NR_HandoverPreparationInformation
- Fix early returns that were leaking NR_RRCReconfiguration
- Add cleanup at end of successful function execution
This prevents memory leaks when processing handover preparation information
during N2 handover procedures.
- Add UE context cleanup before sending handover failure message
- Prevents memory/resource leak when PDU session establishment fails during handover
- UE context was created but never cleaned up on failure path
This fixes a bug where UE contexts would accumulate over time
when handovers failed after context creation.
Since there is no UCI on PUSCH implementation in gNB, it is good to test
UE's implementation with matlab.
This commit allows to test with matlab in two ways:
1. generate OFDM waveform from ulsim and decode it in matlab using
uci_on_pusch_decode.m
2. generate codeword in matlab using uci_on_pusch_encode.m read it in
ulsim and compare the bits. ulsim option -o is used
When the codeword has UCI multiplexed with data, we need to handle UCI scrambling according to 38.211 section 6.3.1.1.
Especially when O_ACK <= 2 there are x and y placeholder bits for UCI.
Get beta offset, alpha scaling and other parameters to calculate rate matching information for UCI on PUSCH,
then use the rate matching info to encode UCI and re-encode PUSCH, call nr_uci_on_pusch to get final multiplexed codeword for scrambling.
NR UE: remove function get_nr_RSRP() and get_nr_rx_total_gain_dB() for cleanup
The function get_nr_RSRP() and get_nr_rx_total_gain_dB() are not used anywhere
in the code, removing for cleanup.
CI: Updates for HO and AW2S pipeline
This MR introduces several CI updates:
- Change center frequency from 3439 MHz (n78) to 4185 MHz (n77) in HO setup to
prevent interference with other lab setups.
- Enable attaching multiple AmariUEs simultaneously in the AW2S pipeline - save
~25s.
- Update RX gain configuration on AmariUE - improve DL throughput.
BWP with no PRACH occasions
This MR includes fixes at gNB and UE in case the current BWP has no PRACH
occasions, i.e. we need to switch to initial BWP.
`def` creates a variable local to the script object, not automatically visible inside helper functions.
This fixes the following exception in Jenkins:
Found unhandled groovy.lang.MissingPropertyException exception:
No such property: OAI_Registry for class: groovy.lang.Binding
These libraries depend on the logging module, so add the right
dependency log_headers. Indirectly, this will fulfill the condition of
T. I consider the prior usage of generate_T or {T_LIB} incorrect,
because basically none of these libraries actually, actively use T, but
rather only the logging module, which pulls in T. The dependency of
log_headers will also take care of generating and including T headers,
which is a dependency of the logging module.
For conf2uedata and related, fulfill the dependency
through conf2uedata_lib (on which the rest depends).
These libraries have no dependencies on UTIL, so it's better to omit it.
However, then the test is missing symbols for the config (which likely,
indirectly came through UTIL -> LOG -> CONFIG_LIB, so add it now onto
the test.
These libraries have an (indirect) dependency on T, either by using the
logging module (which in turn depends on T), or through other includes.
The easiest is to depend on the logging module, which will fulfil also
the T dependency.
It would equally be feasible to use the utils target (which in turn
depends on log_headers), but this would necessitate to compile, and does
not seem to be necessary.
Since E2 agent uses the config library, include it directly. This also
makes the dependency on T obsolete, because
- it is the logging headers that are needed, and
- the T dependency is fulfilled through the log_headers.
It seems that many compilation units include T.h through the config
module (as evidenced when taking out T.h from
config_load_configmodule.h). This is strange, because T.h is only used
in the logging headers. Hence, move it to there, where it is used.
coding_defs.h included defs_common.h, which pulls in many dependencies,
e.g., the logging module, which pulls in T. However, it does not use
anything of this. So remove, and include stdbool.h instead (because bool
is used in coding_defs.h.
nr_polar_defs.h relied on some includes done in coding_defs. Use
includes for pthreads and SIMD to define types that are used in
nr_polar_defs.h.
We don't use JER. This avoids compilation problems, such as:
/usr/bin/ld: openair3/NRPPA/MESSAGES/libasn1_nrppa.a(INTEGER_jer.c.o): in function `INTEGER_decode_jer':
tmp.MtrwVDhQqY/openair3/NRPPA/MESSAGES/INTEGER_jer.c:186:(.text+0x5b8): undefined reference to `jer_decode_primitive
XNAP is asn1c compiled with -no-gen-BER. Correspondingly, no
ber_decoder.h file is created. However, when running cmake followed by
ninja, it notices the absence of this file:
ninja explain: output openair2/XNAP/MESSAGES/ber_decoder.h doesn't exist
which triggers a complete rebuild of XNAP ASN.1. Without this file, the
targets are not marked as dirty.
This constant seems to be an analogon to NUMBER_OF_UE_MAX; replace with
the latter, as it does the same. (NBIoT does not work, anyway)
Fix dependencies of the NB_IoT target so it compiles.
Remove, because
1) it does not compile (the asn1c generated code should be prepend with
LTE_ etc, nobody did that)
2) a shared module makes no sense
3) the configuration is trivial to recreate
Link E2_AGENT libraries directly into nr-softmodem/lte-softmodem instead
of L2/L2_NR/F1AP. Doing that ensures that simulators, e.g.,
nr_dlsim/nr_ulsim do still compile. It also simplifies the code.
Prior to this, compiling nr_ulsim with E2_AGENT, for instance, resulted
in the following errors, fixed in this commit:
FAILED: nr_ulsim
/usr/bin/ld: openair2/E2AP/RAN_FUNCTION/libe2_ran_func_du_cucp_cuup.a(ran_func_rc.c.o): in function `send_aper_ric_ind':
/home/oai/robert/cleanup-t-dependency-cmake/openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_rc.c:643: (.text+0xee6): undefined reference to `async_event_agent_api'
/usr/bin/ld: /home/oai/robert/cleanup-t-dependency-cmake/openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_rc.c:643:(.text+0x11ca): undefined reference to `async_event_agent_api'
/usr/bin/ld: /home/oai/robert/cleanup-t-dependency-cmake/openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_rc.c:643:(.text+0x1485): undefined reference to `async_event_agent_api'
/usr/bin/ld: /home/oai/robert/cleanup-t-dependency-cmake/openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_rc.c:643:(.text+0x159c): undefined reference to `async_event_agent_api'
/usr/bin/ld: /home/oai/robert/cleanup-t-dependency-cmake/openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_rc.c:643:(.text+0x16b1): undefined reference to `async_event_agent_api'
[...]
warning: ‘genericPowerPerAntena’ defined but not used [-Wunused-function]
warning: ‘graph.text’ is used uninitialized [-Wuninitialized]
warning: ignoring return value of ‘read’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
Lower the RX gain used by the Amarisoft UE in CI tests to prevent DL signal
saturation. This resolves an issue with low DL throughput observed in CI.
RX/TX signal levels on the Amarisoft UE can be checked with "t spl" command
in lteue; MAX values should not approach 0.
Data and control multiplexing procedure is defined in 38.212 section 6.2.7.
Step 3 (CSI1 and CSI2 mapping) is not implemented, only HARQ-ACK.
PUSCH frequency hopping is not supported.
Use betaOffset and alpha scaling etc. to get rate matching information of UCI on PUSCH (e.g. max bit capacity of encoded UCI and encoded ULSCH)
according to TS 38.212 section 6.3.2.4 and 6.2.7.
38.212 section 5.3.3.1 and 5.3.3.2 describe how to encode 1-bit and 2-bit information.
This is needed when typically HARQ-ACK will be transmitted on PUSCH.
38.212 section 5.4.3 also describes how to do rate matching for channel coding of small block lengths.
- Replace error handling for impossible ID mismatches with DevAssert statements
- If ngap_get_ue_context() succeeds, returned context must have matching NGAP gNB UE IDs by definition
- This catches potential bugs in the lookup function immediately
- Affects: handover_required, handover_notify, handover_cancel, ul_ran_status_transfer
These checks were logically impossible since we looked up the context using
the same IDs we were then checking for mismatch.
- Fixed incorrect log messages that said 'PCI=%lu' when printing nr_cell_id
- Now prints both NR Cell ID and PCI when DU is found
- Provides better debugging information for handover requests
- Add _E1_EQ_CHECK_OPTIONAL_PTR checks for pdcp_config, sdap_config, UP_TL_information, and securityIndication
- Fix bug in eq_pdu_session_to_mod_item where a->UP_TL_information was compared with itself instead of b->UP_TL_information
- Fix eq_security_ind call to properly handle return value with early return pattern
- Improve consistency with existing macro usage patterns in the codebase
- Provide better error reporting for optional pointer field mismatches
Replace result &= pattern with consistent early return pattern:
- Fix mixing of logical (&&) and binary (&) operators
- Use consistent 'if (!eq_()) return false;' pattern throughout
- Fix bug in eq_bearer_context_mod_response where drbModA was compared with itself
- Remove unused 'bool result = true;' variables
- Always return true at the end of equality functions
This makes the code more consistent with the rest of the codebase
and provides better error reporting through the existing _E1_EQ_CHECK macros.
Integration `2025.w39`
* !3582 replace bad DCI by specific message for each case and add checks for bad...
* !3595 Implementing the option to have more than 1 RSRP in CSI report
* !3640 Code cleanup (SRS, config files and more)
* !3654 Extend t300 in multi_ue rfsim testcase
* !3650 NR UE improvements for scheduling ACK/NACK for MSG4
* !3652 In ReconfigurationWithSync, make sure epochTime_r17 present if there is a ntn_Config_r17
* !3653 NR UE: in nr_ue_scheduler.c set LCID_buffer_remain to 0 if RLC indicates not more bytes in buffer
* !3549 Switch to new (internal) registry
* !3513 Improvements to RRC PDU session and DRB handling logic
Closes#995 and #997
See merge request oai/openairinterface5g!3658
Improvements to RRC PDU session and DRB handling logic
This merge request introduces a major simplification and cleanup of the gNB RRC
PDU Sessions and DRBs handling logic. The core goals of this work are to:
- Replace fixed-size PDU Session, DRBs and QoS arrays with dynamic containers
- Simplify and modularize helper functions for session/DRB management
- Prepare for further refactoring of the PDU Session state machine
- Improve code safety and maintainability through better bounds checking
common/utils/threadPool/measurement_display.c:55:14 warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘long long unsigned int’ [-Wformat=]
- Replace simple counter-based DRB ID assignment with actual DRB ID lookup
- Add nested loop to iterate through DRBs for each PDU session to be release
- Improve logic flow with early continue for non-matching PDU sessions
This ensures DRB release list contains correct DRB IDs that correspond to actual DRB entities
* There is no IE corresponding to PDU sessions failed to release
in the PDU SESSION RESOURCE RELEASE RESPONSE message. This was removed
and the corresponding code was refactored and cleaned up.
* In the Release Command handler, only established PDU Session are set to be
released. The Response message is filled accordingly.
Motivation:
The previous architecture had several issues:
- Duplicate DRB generation logic in generateDRB() and generateDRB_ASN1()
- Embedded SDAP/PDCP configs in drb_t created tight coupling
- No clear separation between RRC internal state and ASN.1 encoding
- Maintenance burden due to duplicated configuration logic
New Architecture:
- drb_t now only stores DRB-specific data (ID, PDU session ID, PDCP config)
- SDAP configuration moved to PDU session level (following PDCP design pattern)
- ASN.1 encoding helpers (nr_rrc_build_*_config_ie()) handle conversion
- Single source of truth for DRB creation in RRC via nr_rrc_add_drb()
Key changes:
- Store nr_sdap_configuration_t per PDU session
- Simplified drb_t structure: removed embedded SDAP/PDCP configs, added pdusession_id
- New helper: nr_rrc_build_sdap_config_ie()
- Updated createDRBlist() to use new helper functions and proper DRB ID lookup
- Refactored trigger_bearer_setup() to use nr_rrc_add_drb() and fill_e1_drb_to_setup()
- Removed generateDRB() and generateDRB_ASN1() functions
- Updated set_bearer_context_pdcp_config() to return config by value
- Added SDAP configuration header file for type definitions
This eliminates code duplication, improves maintainability, and creates
a cleaner separation between RRC state management and ASN.1 encoding.
- Move QoS-related enums and structures from ngap_messages_types.h to 5g_platform_types.h
- Replace ngap_* QoS types with generic qos_* types for better reusability
- Update field names from allocation_retention_priority to arp for consistency
- Update all references across RRC and NGAP modules to use new type names
- Remove duplicate QoS type definitions from NGAP-specific header
This improves code organization by centralizing QoS parameter definitions
in a common platform types header and eliminates NGAP-specific naming
in favor of more generic, reusable type definitions.
The maximum number of QoS flows is 64.
- Replace QOSFLOW_MAX_VALUE with MAX_QOS_FLOWS constant
- Move MAX_QOS_FLOWS definition to common/platform_constants.h
- Remove duplicate QOSFLOW_MAX_VALUE definition from ngap_messages_types.h
This improves maintainability by centralizing the QoS flow limit constant
and eliminates duplicate definitions across different header files.
- Limit scope of get_default_rbconfig function: from asn1_msg.c/.h to rrc_gNB_nsa.c where it's used
- Create new rrc_gNB_asn1.c/h files for ASN.1 utility functions: they can be used in other RRC files
- Add nr_rrc_build_pdcp_config_ie function for building PDCP configuration IEs
- Update get_default_rbconfig to use the new PDCP config builder
- Add rrc_gNB_asn1.c to CMakeLists.txt build configuration
The previous DRB management relied on a fixed-size array (established_drbs[MAX_DRBS_PER_UE])
and manual status tracking using DRB_ACTIVE/INACTIVE flags. This approach was inefficient,
and made assumptions about DRB ID allocation that do not generalize well
to dynamic procedures like bearer modification or removal.
* Replace fixed-size array established_drbs[] with dynamic
seq_arr_t *drbs in gNB_RRC_UE_t
* Refactor get_drb() and added nr_rrc_add_drb() with clean abstractions
using find and seq_arr lib
* Updated all DRB-related logic (e.g., generateDRB,
F1AP/E1AP tunnel config, reestablishment, mobility) to use seq_arr.
* Removed status field and DRB_ACTIVE/INACTIVE logic: list presence implies active
* DRB ID allocation now tracked via seq_arr size : simplifies DRB management and
avoids DRB ID–indexed assumptions: code assumed DRB IDs mapped directly to
array indices: established_drbs[drb_id - 1]. This could break when:
DRB IDs are not sequential, DRBs are removed and re-added, or there are gaps in IDs
The RRC PDU Session struct is converted from a fixed-size array
to a dynamically sized seq_arr. This improves flexibility and
simplifies session management by eliminating arbitrary size limits
and enabling dynamic addition/removal of PDU sessions.
Helper functions and loops have been adapted to use the seq_arr API.
This change is a step toward more robust and maintainable handling
of PDU sessions in the gNB RRC layer.
The "status" state machine remains untouched in this commit and
is refactored in a later commit.
Also:
* add macro to push to seq_arr and return the new element
* move initialization of xid (RRC PDU Session struct) to
find_pduSession (temporary, will be finalized in a later
commit) since with the new seq_arr design the initialization
is no longer possible in the UE context generation (also
does not belong to it, initialize when adding a new PDU Session)
The function was printing a "not found" error message even in the case
the return value was set to "true". Return directly true/false.
This is relevant in PDU Session Release procedures.
- Process all PDU sessions in handover request instead of only the first one
- Add DevAssert for bounds checking on nb_of_pdusessions
- Fix logic error where multiple PDU sessions were ignored in handover scenarios
Previously, the RRC layer was incorrectly allocating stack memory for the ho_required_transfer field and passing it to NGAP, however it was not used. The IE is mandatory but contains only 1 optional IE, therefore is encoded in the NG message with empty content.
Changes:
- Remove unnecessary ho_required_transfer field from pdusession_resource_t definition, the IE is encoded anyway with empty content. If Direct Forwarding Path Availability is needed at any stage in the future it can be added to pdusession_resource_t and filled in RRC.
- Add clarifying comment about empty HandoverRequiredTransfer structure
NR UE: in nr_ue_scheduler.c set LCID_buffer_remain to 0 if RLC indicates not
more bytes in buffer
If the RLC indicates that there is no more data in the buffer, also the
scheduler's LCID_buffer_remain should be set to 0. Else the UE sends BSR
indicating it has data to be transmitted. The gNB would then unnecessarily
schedule UL for this UE, which would not be used, as there is no actual data
to be transmitted.
Extend t300 in multi_ue rfsim testcase
Extend t300 to 1000 to increase the time the gNB has to handle MSG3. Hopefully
this prevents the UEs from timing out after MSG3. Add UE id to timer timeout
LOGs so the UE behavior can be traced through the stack.
Code cleanup (SRS, config files and more)
- Remove deprecated elements from some configuration files (also closes#997)
- Improve SRS code with a better separation between common code and gNB/UE code
- Other minor compilation improvements
Implementing the option to have more than 1 RSRP in CSI report
In collaboration with NI/Emerson.
The standard allows up to 4 RSRP measurements in CSI report (1 full and the other
differential). In current OAI, we just configure 1 RSRP report for the strongest
SSB. This MR allows to configure at gNB more than 1 RSRP report (depending on
config file, number of SSBs and UE capabilities) and makes changes at the UE to
send this report.
replace bad DCI by specific message for each case and add checks for bad...
Replace bad DCI by specific message for each case and add checks for bad
pointers, or sanitize detected warnings. Then fix several issues in DCI
decoding. With this MR, LTE UE has less bad DCI, and each bad DCI has a
reason better diagnosis.
If the RLC indicates that there is no more data in the buffer, also the scheduler's
LCID_buffer_remain should be set to 0. Else the UE sends BSR indicating it has data
to be transmitted. The gNB would then unnecessarily schedule UL for this UE, which
would not be used, as there is no actual data to be transmitted.
Correctly handle unpacking of the first RSRP report and its resource ID before processing additional reports.
Use the initial RSRP value as the reference for differential RSRP calculations in subsequent reports.
N2 handover
This MR introduces full support for N2 handover, covering handover
decision, preparation, execution, and notification between source and
target NG-RAN nodes.
Key features:
1. Handover Decision & Preparation:
- Implement N2 handover decision based on UE measurement reports.
- Generate the Handover Preparation Information message, including
RRCReconfiguration.
- Send Handover Required message from the source NG-RAN to the AMF.
2. Handover Execution:
- Decode and handle the Handover Request on the target NG-RAN.
- Process the Handover Command on the source gNB, triggering
RRCReconfiguration.
- Initiate Handover Notify after successful completion.
3 NGAP & RRC Enhancements:
- Implement NGAP encoding/decoding functions for Handover Required,
Handover Request, Handover Command, Handover Failure, and Handover
Notify (3GPP TS 38.413).
- Adds NG-RAN Status Transfer support (UL/DL) for PDCP COUNT
preservation during mobility:
- support for NGAP Uplink and Downlink RAN Status Transfer messages
(TS 38.413 §9.2.3.13-14) to enable proper PDCP COUNT value
transfer during handover or recovery: NGAP encoding/decoding for
RAN Status Transfer, PDCP helpers to extract and apply COUNT (HFN
+ SN) per DRB. This aligns with TS 38.300 §9.2.3.2.1 and TS 23.502
§4.9.1.3.3, ensuring PDCP status preservation in AM.
4. Testing:
- Introduce a Telnet command to manually trigger N2 handover using UE
ID and neighbor PCI.
- Add configuration file for testing N2 handover with a target gNB.
CI: build images on Jetson (armv8)
Add a new build pipeline for NVIDIA Jetson (armv8). Images have tag
prefix armv8_ to distinguish from gracehopper-built images prefixed arm_
(should have maybe been better with armv9_?)
This commit completes the NGAP Mobility Management procedure for N2 handover.
Upon failure on source gNB the Handover Cancel message is sent to the AMF which
in return responds with an ack.
Upon reception of NG RAN Status at the target CU-CP, send PDCP Status
via E1 Bearer Context Modification to the target CU-UP and update PDCP Count
upon reception of the message.
For the sake of simplicity, re-used and extended legacy e1_send_bearer_updates.
Further refactoring is not addressed in this commit.
Once fetched the PDCP Status from the PDCP entity over E1, the CU-CP triggers
the NG RAN Status Transfer procedure to transfer the PDCP Status to the target
CU.
This commit is also introducing the RRC callback.
* Check presence of PDCP Status Requested in Bearer Context Modification Request
* Fetch PDCP Status from PDCP entity and fill in the Bearer Context Modification Response
The E1 Bearer Context Modification Request shall send a PDCP Status Request IE
during handover, e.g. the HO context is set to source, and it is not target, i.e.
only in N2 not in F1.
The current function "e1_send_bearer_updates" used to fill the E1 Request has been
refactored only for the sake of this commit and to avoid duplicated and redundant code.
The function itself deeper analysis and eventually a refactoring that will not be addressed
in this commit.
* Introduced nr_pdcp_count_update() to apply COUNT values to the PDCP entity:
- Computes tx_next, rx_next, and rx_deliv from HFN+SN
- Handles both 12-bit and 18-bit SN modes with dynamic bitmask
* Introduced nr_pdcp_get_drb_count_values() to extract PDCP COUNT values from entity:
- Used for building UL RAN Status Transfer on source CU side
According to 4.9.1.3.3 of 3GPP TS 23.502:
> 2a. - 2c. The S-RAN sends the Uplink RAN Status Transfer message to the S-AMF,
> as specified in TS 36.300 [46] and TS 38.300 [9]. The S-RAN may omit sending
> this message if none of the radio bearers of the UE shall be treated with PDCP status preservation.
TS 38.300 says:
> For DRBs not configured with DAPS, the source gNB sends the SN STATUS TRANSFER message to the target
> gNB to convey the uplink PDCP SN receiver status and the downlink PDCP SN transmitter status of DRBs for
> which PDCP status preservation applies (i.e. for RLC AM). The uplink PDCP SN receiver status includes at
> least the PDCP SN of the first missing UL PDCP SDU and may include a bit map of the receive status of the out
> of sequence UL PDCP SDUs that the UE needs to retransmit in the target cell, if any. The downlink PDCP SN
> transmitter status indicates the next PDCP SN that the target gNB shall assign to new PDCP SDUs, not having a
> PDCP SN yet.
i.e., for DRBs for which PDCP status preservation applies (i.e. for RLC AM), which is is our case.
This commit introduces full support for NG-RAN Status Transfer message handling
(TS 38.413 §9.2.3.13-14) in CU. It enables correct state transfer of PDCP COUNT
values (SN + HFN) during mobility or recovery scenarios.
Summary of changes - NGAP:
* Added encoding/decoding support for UL/DL RAN Status Transfer message
* Defined structures for: ngap_drb_count_value_t, ngap_drb_status_t,
ngap_ran_status_container_t, ngap_ran_status_transfer_t
The pipeline is using the already existing conf files
for the source/target gNB CUs/DUs.
For the sake of simplicity, neighbour-config.conf has
been rewritten and simplified in this commit, then
adopted in this pipeline. The file was not used before.
* the command gets in input the neighbour PCI and the UE ID
* the telnet ci function to retrieve the UE context was extended in the process
* add function to trigger handover on the same gNB for testing purposes
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
* trigger upon reception of MasterKeyUpdate
* derive NH, store NH NCC and valid NH key in RRC
* masterKeyUpdate: derive enc/int keys after master key update
and set PDCP security for SRB1
* call nr_rrc_process_reconfiguration_v1530 before nr_rrc_ue_process_RadioBearerConfig
and move dedicatedNAS_MessageList processing at the end of the flow. The sequence
shall be (1) keys/security update (2) radioBearerConfig processing, with PDCP entity
creation, PDCP reestablishment, SDAP entity creation (3) NAS PDUs processing, which
triggers PDU Session Establishment Accept, which sets up the TUN interface.
SDAP entity is a pre-requisite, therefore the radioBearerConfig has to be processed
(in nr_rrc_ue_process_RadioBearerConfig, add_drb) early enough, or it may cause a
race condition in SDAP.
* add trigger function to (1) add the callbacks and (2) initiate
handover on the target NG-RAN
* add handover failure callback on target NG-RAN: the Handover
Failure is a procedure that belongs to the target NG-RAN and
it is different from the Handover Cancel procedure
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
This commit introduces the NG Mobility Management Procedure known as
Handover Notification. The outbound message is sent by the target NG-RAN
and is known as Handover Notify. The procedure is used to indicate to
the AMF that the UE has arrived to the target cell and the NG-based
handover has been successfully completed
* after RRCReconfiguration complete, in the N2 callback for HO success
* add NGAP encoder for the message
* RRC callback to trigger Handover Notify message
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
* add NG Handover Command message decoder
* process in RRC: encode RRCReconfiguration message
from the received HandoverCommandMessage
* trigger RRCReconfiguration for handover
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
* generate Handover Command for the source NG-RAN
to be added to the target to source transparent
container of the Handover Acknowledge message
* add Handover Acknowledge callback for N2
* send NG Handover Acknowledge to AMF
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
This commit completes the NG Mobility Management Procedure known as
Handover Resource Allocation. The outbound message is sent by the
target NG-RAN and is known as Handover Request Acknowledge.
Major changes:
* add RRC callback to trigger the generation of NG Handover
Request Acknowledge on the target NG-RAN
* add NG Handover Request Acknowledge encoder
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
This commit introduces the NG Mobility Management Procedure known as
Handover Resource Allocation. The inbound message is sent by the AMF
and is known as Handover Request.
Major changes:
(0) Add Handover Resource Allocation initiating message decoding
* add case for NGAP initiating message and unsuccessful message decoding
(1) handle Handover Request on the target NG-RAN
(2) decode NG Handover Request message
(3) process payload, e.g. create UE context,
store IDs, set UP security and trigger bearer setup
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
This message is sent from the Target NG-RAN to the AMF.
The commit introduces:
* NGAP encoding function
* N2 callback for the target gNB
* handle the failure in RRC, inform NGAP
* send NGAP message to AMF via SCTP
Note: UE context in NGAP is fetched from the amf_ue_ngap_id
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
(1) add N2 ho decision based on measurements
(2) add trigger for N2 HO on source CU
(3) generate NG Handover Preparation Information message,
including RRCReconfiguration, to be passed to the
NG Handover Required message
(4) call RRC callback for Handover Required message
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
This commit introduces the NG Mobility Management Procedure known as
Handover Preparation. The outbound message is sent by the source NG-RAN
and is known as Handover Required.
* introduce NGAP library for Mobility Management
* introduce NGAP IEs encoder functions for Handover Required and relevant common IEs
* handle RRC trigger in NGAP and Send NGAP Handover Required to the AMF
Co-authored-by: batuhan duyuler <batuhan.duyuler@firecell.io>
During the N2 HO review has been found that the HO context
was not allocated at trigger time but later in the flow. This
might lead to issues in some scenarios (e.g. in N2 HO)
and it was fixed in this commit.
Introduce a new timer for the use case where a UE should not be
scheduled anymore after a certain time. This is the case, for instance,
during handover, where the "source DU" forwards the RRCReconfiguration
and should stop scheduling this UE after some time.
Originally, transm_interrupt was introduced in 5c6d90aaff ("Use
NR_timer_t for UE transmission interrupt, e.g., RRC processing") to stop
scheduling a UE.
Commit 004403c84d ("Implement F1 UE Ctxt Modif Transmission Action
Indicator") reused this timer in an attempt to save code with an
"interrupt follow action".
In commit 89ebbb4192 ("Do not trigger ul failure in measgap scheduling
and standardize the verification if MAC is active in other scheduling
functions"), the transm_interrupt timer is used to not schedule a UE
through function nr_mac_ue_is_active(). This led to the UE not being
forwarded the RRCReconfiguration, effectively breaking handover, as the
message never reaches the UE. By using a new timer, the intended
functionality is restored.
Fixes: 89ebbb4192 ("Do not trigger ul failure in measgap scheduling
and standardize the verification if MAC is active in other
scheduling functions")
Remove this flag, as it is not used as of this commit, and introduces
confusion (see next commit: we reused the trans_interrupt timer for
the transmission action indicator stop action, where the UE should stay
active, while it is *not* when transm_interrupt is active).
For clarity, rename to native_armv9 for clarity. The check inside Python
checked for native_arm, and if we introduce native_armv8 (for jetson),
it would also match that.
Add nr-cuup to run_locally.sh
E1 deploy wasn't enable in the run_locally.sh script to run the CI on a local
machine. This MR is adding it. It was validated locally.
Fix UE DCI monitoring after RRC setup
After the UE is configured with pdcch-Config, it continues to monitor
fallback search spaces in pdcch-ConfigCommon for DCI with C-RNTI.
The rational is that after sending RRC Setup the network won't know if
the UE has received and successfully applied it. Hence the network would
still continue to use the fallback DCI till it receives RRC setup
complete.
Closes#954
Fix memory allocation issue in KPM RAN function sd parameter handling
This fixes a segmentation fault in the gNB when a KPM xApp sends the sd
parameter in the subscription message.
The segmentation fault seems to occur because *sd is uninitialized when
malloc(**sd) is called. This causes a double dereference of an uninitialized
pointer - **sd reads a random memory value which becomes the size parameter
for malloc(), leading to unpredictable memory allocation and segfaults.
This fix allocates the size using malloc(sizeof(uint32_t)) instead of
dereferencing the uninitialized pointer.
After the UE is configured with pdcch-Config, it continues to monitor
fallback search spaces in pdcch-ConfigCommon for DCI with C-RNTI.
The rational is that after sending RRC Setup the network won't know if
the UE has received and successfully applied it. Hence the network would
still continue to use the fallback DCI till it receives RRC setup
complete.
Fix an issue in which the unpacking is erroneously deemed unsuccessful even though it succeed in pulling all the bytes, this was due to not properly handling the return value of pull16 which is either 0 or 2, not 0 or 1.
Check the results of push and pull operation with correct boolean operator.
During the review of the N2 HO MR it has been found that the wrong type
plmn_identity_t (S1AP) was used in RRC. Now updated to the platform type plmn_id_t.
The malloced struct is initialized to garbage and when
the IE is absent, the output "PDCP reestablishment"
member (allocated in the stack) is set to a random value.
Integration: `2025.w37`
* !3514 NR UE: add support for PDSCH rate matching with NZP CSI-RS
* !3630 feat(ldpc_aal): Do not try EAL init if FHI 7.2 is enabled
* !3634 reset MSG3 C-RNTI flag in case of failure
* !3566 fix 600 cppcheck notifications
* !3633 Fix PLMN print in select_amf
* !3631 Revert "Removed TRP-scheme byte from UL BF PDU to Interop with Aerial 25-1 (FAPI 10.02)"
* !3622 Populate sampled_ue_antennas
* !3601 gNB: adaptive DL/UL MCS based on reported SSB-SINR and measured PUSCH SNR
* !3637 fix bug in computing number of LCG IDs with data at UE
* !3635 Fixes and updates for UL scheduling, notably DSUUU
* !3607 Reworking BWP configuration
* !3531 Refactor measConfig
* !3612 CI: Creation of F1 Handover pipeline
* !3611 CI: Generalize PhySim tests, run PhySims on Gracehopper
Closes#985 and #975
See merge request oai/openairinterface5g!3636
CI: Generalize PhySim tests, run PhySims on Gracehopper
This changeset generalizes/harmonizes the CI infrastructure for physim
testing, and adds a new pipeline for physim tests on Gracehopper
machines.
Specifically:
- Refactor the existing CI code for running and analyzing physical
simulators. The existing code assumed those tests are deployed using
OpenShift. Instead, OpenShift/Helm-specificities (e.g., running a
"release") have been removed, and instead of hardcoding the deployment
of the physical simulators using a script for Helm, the function takes
any script that can deploy using Helm/docker/from source. The overall
appearance is the same.
- Add a new pipeline RAN-PhySim-GraceHopper-5G that executes physical
simulators on gracehopper. Reporting is done in the same way as for
existing physical simulators (e.g., like in the RAN-PhySim-Cluster-5G
pipeline), but deployed in docker instead of helm.
-> some tests don't work reliably on ARM yet and are skipped
- the RAN-gNB-N300-Timing-Phytest-LDPC pipeline has been reworked to use
the same code for testing T2 offload, with ctest, and the same
reporting.
- the CUDA LDPC test XML has been removed, as these tests don't work
reliably.
- add a new macro add_timed_physim_test() that allows to define
thresholds to be checked, so that ctest will check for them. see the
documentation for more information
CI: Creation of F1 Handover pipeline
In this MR we are modifying/adding all the required files (.xml, .conf,
.yml) in order to create a pipeline on Jenkins that allows us to test
OTA F1 handover.
Remove the runtime, which is not interesting, and add instead
- test name and if the test failed
- the threshold checks, if any, and
- possible additional information about test failures.
Prior to this change, each test would have, as label, it's description.
This leads to many labels, which are normally reserved for grouping
tests. Move the description into a custom property instead.
Since we rely on the JSON output for the generation of HTML reports, we
need to also extract the description from the generated JSON. However,
custom properties are only logged starting from cmake 3.30. For
back-wards compatibility, write an additional, separate environment
variable TEST_DESCRIPTION from which the description can be read as a
fallback.
For the add_timed_physim_test(), this has been already done in a parent
commit.
The unit tests have been imported with this command:
xmlstarlet sel -t
-m '//testCaseList/testCase[class="Run_Physim"]' \
-v "concat('add_timed_physim_test(physim.5g-offload.',physim_test,'.testX.Y \"',desc,'\" ',physim_test,' ',physim_run_args,')')" \
-n t2_offload_enc_nr_dlsim.xml t2_offload_dec_nr_ulsim.xml >> ../../openair1/SIMULATION/tests/CMakeLists.txt
The next commit will further cleanup this output. I commit it like this
for verification purposes.
Add two new macros that allow to register physim tests for ctest,
including timing thresholds that should be fulfilled.
First, add_timed_physim_test() registers a new test using a helper
script RunTimedTest.cmake. This is because after test execution, we need
to analyze logs, and the recommended way to do multiple steps in one
test is via a helper cmake script:
https://cmake.org/pipermail/cmake-developers/2016-February/027816.html
Second, check_physim_threshold() adds new thresholds. It takes a text to
be parsed, and a condition (e.g., "< 20") to check for the number
following the threshold (which is assumed to be present right after the
threshold). It uses a test property to count the total number of checks
(limiting them to 10), and sets environment variables for the script. I
initially planned to use a test property for checks, but those are only
valid in the same directory, and RunTimedTest.cmake seems to be assumed
by cmake to be "elsewhere", hence I needed to resort to environment
variables.
RunTimedTest.cmake is called through cmake with the test parameters and
checks. It re-constructs a list of checks [1], runs the test, and pipes
the log into a separate script that is passed all checks (see below).
Afterwards, it verifies that both the test and script passed.
A script analyze-timing.sh builds an awk script from the checks passed.
The script analyzes each line of the test output for the threshold, and
compares against the threshold. analyze-timing.sh returns success if all
checks passed.
[1] I did not manage to pass a "list" of checks in a single environment
variable through the check_physim_threshold(), which would be simpler.
Change signature of the macro to take the full test name, a separate
description (previously called a label?), and the executable and test
invocation. The overall signature becomes easier.
The rational for the full test name is that a later commit will
introduce the possibility to define physim tests that are checked for
specific times, in which case we need to reuse the test name. Thus,
using the full name from the beginning leads to more clarity, even
though they are a bit longer.
Add an additional safety check that the given simulator is actually a
target defined within the project (in other words, it actually exists).
Update the documentation correspondingly.
Most (but not all) physical simulators are defined under
openair1/SIMULATION/. Defining physical simulators below there seems to
be the more "obvious" directory anyway, as the physical simulators are
openair1/SIMULATION/tests
Phy(L1) Sim tests => PhySim (tests)
Refactor measConfig
- Refactor and minor improvements in get_MeasConfig function;
- Add support for band in neighbourConfiguration (It is currently
possible to handover cells with different frequencies, as long as they
are in the same band, but this MR allows the handover to also be done
between cells in different bands).
Reworking BWP configuration
This MR reworks the configuration via fail of additional BWPs. Moreover, it
allows for a single BWP to be configured for a given UE at a given time (BWP
switch possible only via reconfiguration). It also reworks PTRS configuration
for consistency with the BWP one.
Fixes and updates for UL scheduling, notably DSUUU
Fix a number of problems that stem from !3521, notably regarding Msg3
scheduling, retransmissions in "UL-heavy" TDD scenarios, and BSR
handling. Modify a CI test to run a UL-heavy TDD scenario, and add
documentation for UL-heavy TDD scenarios.
The parameter is either set to 10 (the default, so not necessary), or to
0 forcing the gNB to schedule the UE all the time, which is only
necessary in specific scenario, and here simply wrong.
In high throughput UL scenarios, at least with our configuration, the UE
only sends Short BSR. The maximum is 300000 bytes, which is completely
"scheduled away" after a couple of UL grants. Increase the periodic BSR
to 5ms to get more BSR, which results in higher UL throughput.
On BSR reception, reset sched_ul_bytes. This change means that we assume
that no data is "in flight" for this UE at time of BSR reception, or,
put differently, that we overestimate the buffer size at UE (in the
worst case).
To illustrate this, consider the following traces before/after this
change.
Before this change: Upon BSR reception, the estimated BSR of the UE is
reset, but the gNB still accounts for data "in flight". It is visible
that the calculated buffer size (estimated - scheduled) quickly goes to
zero, and we don't use all resources, despite the buffer still being
full. The maximum application throughput in this run was ~220Mbps.
[NR_MAC] SHORT BSR at 773.19, est buf 300000
[NR_MAC] ULSCH/PUSCH: 774. 6 RNTI af8e UL sched 774. 9 PRB start 0:162 TDA 2 TBS 32797 est 300000 sched 152704 est BSR 147296 TPC 1
[NR_MAC] ULSCH/PUSCH: 774. 6 RNTI af8e UL sched 774.11 PRB start 0:162 TDA 4 TBS 7172 est 300000 sched 159876 est BSR 140124 TPC 1
[NR_MAC] ULSCH/PUSCH: 774.10 RNTI af8e UL sched 774.12 PRB start 0:162 TDA 0 TBS 32797 est 292845 sched 185501 est BSR 107344 TPC 1
[NR_MAC] ULSCH/PUSCH: 774.10 RNTI af8e UL sched 774.13 PRB start 0:162 TDA 2 TBS 32797 est 292845 sched 218298 est BSR 74547 TPC 1
[NR_MAC] ULSCH/PUSCH: 774.11 RNTI af8e UL sched 774.14 PRB start 0:162 TDA 2 TBS 32797 est 260117 sched 218298 est BSR 41819 TPC 1
[NR_MAC] ULSCH/PUSCH: 774.11 RNTI af8e UL sched 774.16 PRB start 0:162 TDA 4 TBS 7172 est 260117 sched 225470 est BSR 34647 TPC 1
[NR_MAC] ULSCH/PUSCH: 774.15 RNTI af8e UL sched 774.17 PRB start 0: 35 TDA 0 TBS 7172 est 220236 sched 185501 est BSR 34735 TPC 1
[NR_MAC] ULSCH/PUSCH: 774.15 RNTI af8e UL sched 774.18 PRB start 0:162 TDA 2 TBS 32797 est 220236 sched 218298 est BSR 1938 TPC 1
[NR_MAC] ULSCH/PUSCH: 774.16 RNTI af8e UL sched 774.19 PRB start 0: 10 TDA 2 TBS 2017 est 187508 sched 187518 est BSR -10 TPC 1
[NR_MAC] SHORT BSR at 774. 9, est buf 300000
[NR_MAC] ULSCH/PUSCH: 775. 0 RNTI af8e UL sched 775. 2 PRB start 0:162 TDA 0 TBS 32797 est 260117 sched 147549 est BSR 112568 TPC 1
[NR_MAC] ULSCH/PUSCH: 775. 0 RNTI af8e UL sched 775. 3 PRB start 0:162 TDA 2 TBS 32797 est 260117 sched 180346 est BSR 79771 TPC 1
[NR_MAC] ULSCH/PUSCH: 775. 1 RNTI af8e UL sched 775. 4 PRB start 0:162 TDA 2 TBS 32797 est 227389 sched 180346 est BSR 47043 TPC 1
[NR_MAC] ULSCH/PUSCH: 775. 1 RNTI af8e UL sched 775. 6 PRB start 0:162 TDA 4 TBS 7172 est 227389 sched 187518 est BSR 39871 TPC 1
[NR_MAC] ULSCH/PUSCH: 775. 5 RNTI af8e UL sched 775. 7 PRB start 0:162 TDA 0 TBS 32797 est 180353 sched 173174 est BSR 7179 TPC 1
[NR_MAC] ULSCH/PUSCH: 775. 5 RNTI af8e UL sched 775. 8 PRB start 0: 36 TDA 2 TBS 7298 est 180353 sched 180472 est BSR -119 TPC 1
After this change: The gNB resets the number of bytes "in flight"
(sched). Thus, the calculated buffer is larger, and does not "run out"
before a new BSR arrives (which still indicates the maximum). The UE is
thus allocated all resources, but we might overestimate some resources.
The maximum application throughput in this run was ~300Mbps, limited by
MCS and not by estimated buffer size as in the previous case.
[NR_MAC] SHORT BSR at 43. 3, est buf 300000
[NR_MAC] ULSCH/PUSCH: 43.15 RNTI d3ea UL sched 43.17 PRB start 0:162 TDA 0 TBS 36897 est 263180 sched 36897 est BSR 226283 TPC 1
[NR_MAC] ULSCH/PUSCH: 43.15 RNTI d3ea UL sched 43.18 PRB start 0:162 TDA 2 TBS 36897 est 263180 sched 73794 est BSR 189386 TPC 1
[NR_MAC] ULSCH/PUSCH: 43.16 RNTI d3ea UL sched 43.19 PRB start 12:150 TDA 2 TBS 33822 est 263180 sched 107616 est BSR 155564 TPC 1
[NR_MAC] ULSCH/PUSCH: 43.16 RNTI d3ea UL sched 44. 1 PRB start 0:162 TDA 4 TBS 7941 est 263180 sched 115557 est BSR 147623 TPC 1
[NR_MAC] ULSCH/PUSCH: 44. 1 RNTI d3ea UL sched 44. 3 PRB start 0:162 TDA 0 TBS 36897 est 173698 sched 25881 est BSR 147817 TPC 1
[NR_MAC] ULSCH/PUSCH: 44. 1 RNTI d3ea UL sched 44. 4 PRB start 0:162 TDA 2 TBS 36897 est 173698 sched 62778 est BSR 110920 TPC 1
[NR_MAC] ULSCH/PUSCH: 44. 1 RNTI d3ea UL sched 44. 6 PRB start 0:162 TDA 4 TBS 7941 est 173698 sched 70719 est BSR 102979 TPC 1
[NR_MAC] SHORT BSR at 43.13, est buf 300000
[NR_MAC] ULSCH/PUSCH: 44. 5 RNTI d3ea UL sched 44. 7 PRB start 0:162 TDA 0 TBS 36897 est 292079 sched 36897 est BSR 255182 TPC 1
[NR_MAC] ULSCH/PUSCH: 44. 5 RNTI d3ea UL sched 44. 8 PRB start 0:162 TDA 2 TBS 36897 est 292079 sched 73794 est BSR 218285 TPC 1
[NR_MAC] ULSCH/PUSCH: 44. 6 RNTI d3ea UL sched 44. 9 PRB start 0:162 TDA 2 TBS 36897 est 292079 sched 110691 est BSR 181388 TPC 1
[NR_MAC] ULSCH/PUSCH: 44. 6 RNTI d3ea UL sched 44.11 PRB start 0:162 TDA 4 TBS 7941 est 292079 sched 118632 est BSR 173447 TPC 1
[NR_MAC] ULSCH/PUSCH: 44.10 RNTI d3ea UL sched 44.12 PRB start 0:162 TDA 0 TBS 36897 est 213587 sched 39972 est BSR 173615 TPC 1
[NR_MAC] ULSCH/PUSCH: 44.10 RNTI d3ea UL sched 44.13 PRB start 0:162 TDA 2 TBS 36897 est 213587 sched 76869 est BSR 136718 TPC 1
gNB: adaptive DL/UL MCS based on reported SSB-SINR and measured PUSCH SNR
Currently this is used esp. if the number of rounds is limited to 1
(e.g. disable_harq).
Revert "Removed TRP-scheme byte from UL BF PDU to Interop with Aerial 25-1 (FAPI 10.02)"
This commit broke compatibility with Aerial when compiled with
-DSCF_FAPI_10_04_SRS=ON. It was decided that this should become the
default.
Modify documentation, and use a dedicated image name to make it clear in
the CI that it has SRS.
A future commit will enable to deploy physical simulators via docker.
Hence:
- Move the script to run out of deploy_oc_physim(), to make it more
generic (later commits will introduce other scripts)
- pass the working directory (the function will be moved into
cls_oaicitest, as it fits neither cls_containerize nor cls_cluster
when deploying the tests from source)
- not using ci-scripts: don't hardcode a specific path, just use the
working directory
- avoid helm-specific pods summary, and put it into the general "physim
logs"
- remove helm-specific "release", and use a generic name for results
- always log pod logs and status to debug, even if deployment was not
successful or tests did not finish.
Instead of making the function a class member, make it an instance
member because (1) it is more aligned with other functions, notably,
run(), and (2) especially for RemoteCmd() it can be faster, as
successive exec_script() calls do not require a new SSH connection.
This commit broke compatibility with Aerial when compiled with -DSCF_FAPI_10_04_SRS=ON. It was decided that this should become the default.
This reverts commit 8beb382277.
Instead of only saving this information in the first transmission, also
store it on each retransmission. This should ensure that if some
information changes, we always relate to the last transmission. For
instance, power control information might have changed, and should be
considered in subsequent rounds, if necessary. It also simplifies code.
Fixes: 6294ce715e ("Reorder pf_ul to process retransmission")
In at least the case of mu=1, min_rxtxtime=2 and DDDSU with no UL
symbols (for ULSCH) in the mixed slot, the current state of code does
not allow a UE to attach. This is because at mu=1, Msg3 is k2+delta,
where k2=min_rxtxtime and delta(mu)=3.
Prior, this special case was handled because we had a dedicated Msg3
TDA, which in most cases is not necessary (because the mixed slot
allocates the DCI, and the following mixed slot has the UL grant). Add
code that tries to ensure that we only add the Msg3 TDA in cases when we
need it.
Fixes: 961a646dc7 ("Remove dedicated Msg3 TDA")
reset MSG3 C-RNTI flag in case of failure
If MSG3 with C-RNTI fails, the UE should come back with a
re-establishment (after a given number of RA failures in general). In
that case, the OAI UE wouldn't reset the MSG3 with C-RNTI flag leading
to re-establishment failure.
feat(ldpc_aal): Do not try EAL init if FHI 7.2 is enabled
When FHI 7.2 is enabled, the EAL initialization is done by the FHI and
the attempt to init EAL by ldpc_aal will fail. In that case, it is not
necessary neither to provide a DPDK core list for BBDEV.
This MR offers to skip EAL init in ldpc_aal when FHI 7.2 is enabled in
order to avoid error messages in the log and to allow dropping the
useless DPDK cores argument in that case.
Also add some fixes to the LDPC offload documentation.
NR UE: add support for PDSCH rate matching with NZP CSI-RS
Currently only ZP CSI-RS is considered in function
configure_ratematching_csi, add support for NZP CSI-RS.
Closes#975
If the DCI in PDCCH is not correctly received, no PDSCH would be decoded but counted as no error.
Also if the DCI was not correctly received, a TBS of 0 would be used in some computations and memory allocations.
Fix these not counting if there is no PDSCH decoding, and by using the known TBS instead of the one received from the DCI.
Previously, the TDA reuse condition was wrong: for multiple TDAs with
different k2, the symbol allocation might be the same, in which the
previous logic was using the wrong TDA. Fix the condition, and insert an
assert to ensure the allocated TDA is correct.
Integration: `2025.w36`
* !3613 Speedup complex rotate for aarch64
* !3614 Ldpc encoder zc384 optimization
* !3625 gNB scheduler small fixes
* !3629 Fix for gNB max feedback time parameter
* !3619 Fix RA 2-Step MgsB Ack at UE
* !3626 Upgrade CI to Aerial 25-2
See merge request oai/openairinterface5g!3627
When FHI 7.2 is enabled, the EAL initialization is done by the FHI and
the attempt to init EAL by ldpc_aal will fail.
In that case, it is not necessary neither to provide a DPDK core list
for BBDEV.
This commit offers to skip EAL initialization if it is already initialized
in order to allow dropping the useless DPDK cores argument in that case.
The change relies on `rte_dev_probe` to detect if EAL was already
initialized.
Fix for gNB max feedback time parameter
This bug is causing assertions like the following
Assertion (curr_pucch->active == 0) failed!
In nr_csi_meas_reporting() /oai-ran/openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_uci.c:282
CSI structure is scheduled in advance. It should be free!
because the PUCCH structure would be smaller than it should be causing
overlapping.
gNB scheduler small fixes
A couple of fixes in gNB scheduling function. Removing a superfluous input from
CCE function and adding a missing call to reset beam allocation.
Ldpc encoder zc384 optimization
This is a modification for the ldpc encoder which improves performance for
high-throughput cases. It contains a newly-generated file for innermost part of
the parity bit generation which, for AVX512, uses the mm512_permutex2var_epi8
instruction and for 128-bit (aarch64) the mm_alignr_epi8 (vextq_s8) in the
computation corresponding to each non-zero bit of the H matrix. This allows for
removing a very large memcpy and reduces the memory demand for the parity matrix
computation. For the moment this is limited to largest case in BG1, namely
Zc=384. This is the only format used when the number of segments after codeblock
segmentation is large (>8). This improves the timing required for ldpc parity
bits generation by more than a factor 2 with AVX512. This significantly reduces
the total time to generate the DLSCH/PDSCH.
See the merge request description for numbers.
Speedup complex rotate for aarch64
This is a simple optimization for aarch64 for the "rotate_cpx_vector" used for
the phase_rotation in 5G NR. It provides a speedup of around 1.5 on high-end
aarch64 targets compared to the SIMDe translated version. It is implemented with
native NEON intrinsics and was largely inspired by suggestions from ChatGPT 5 :-)
newly-generated files for innermost part of the parity bit
generation which, for AVX512, uses the mm512_permutex2var_epi8
instruction and for 128-bit (aarch64) the mm_alignr_epi8 (vextq_s8) in
the computation corresponding to each non-zero bit of the H matrix.
It is generated with ldpctest -n0 -g1. the changes for this are in a
future MR. I did these changes to compare with the GPU version
(ldpc_encoder_cuda), so that the CPU version is as fast as possible. The
generator will come when we merge the GPU encoder/decoder which also has
a generator for the CUDA version. it was difficult to extract the
changes in ldpctest/ldpc_encoder.c so I just took the generated file.
This allows for removing a very large memcpy and reduces the memory
demand for the parity matrix computation. For the moment this is limited
to largest case in BG1, namely Zc=384. This is the only format used when
the number of segments after codeblock segmentation is large (>8). This
improves the timing required for ldpc parity bits generation by more
than a factor 2 with AVX512. This significantly reduces the total time
to generate the DLSCH/PDSCH
Redirect to files and manual analysis as done in this Dockerfile is not
necessary since we just output all relevant build files to stdout.
Simplify to do the same here.
See: 35361db76b ("build_oai: don't redirect compilations to a file")
Fix OAIUE-OTA pipeline and increase tested traffic
I tried to "fix" the OAIUE pipeline in !3610 (merged) for making it more reliable, but inadvertently introduced many ULSCH DTX for UL traffic. Fix this, and increase DL traffic.
See merge request oai/openairinterface5g!3621
Integration: `2025.w35`
* !3604 Consider PDSCH EPRE to DMRS EPRE in NR UE
* !3606 Fix SRS TLV unpack
* !3602 Update RFsim CN
* !3516 [FHI72 M-plane] CM improvements and PM implementation
* !3538 add a new graphical T tracer to see gNB MAC scheduling decisions
* !3425 RFSim test for 10 UEs/process
Closes#950
See merge request oai/openairinterface5g!3610
RFSim test for 10 UEs/process
This MR adds a testcase and changes required to run 10 UEs in a single
process with RFSim
- Added deregistration for all connected UEs
- Refactored MAC/RRC instance handling
- made map_current_symbol thread safe
- made opeanir0_cfg thread safe and local
- Added 10UE/process testcase
Some code in T tracers is used by both LTE and NR.
In LTE, we expect 10 subframes per frame, and the logging is done with
this assumption. We have one tick per subframe.
In NR, we deal with slots, not subframes. And we have n ticks per frame
(depending on mu). As of today, only n=20 is tested (corresponding to
mu=1).
A previous commit introduced 'subframes_per_frame' which had the correct
meaning for LTE but was truly 'slots per frame' for NR. This creates
confusion.
Let's replace 'subframe' by 'tick' to reduce confusion.
Update RFsim CN
- Update RFsim CNs to latest version
- update the MBIM stop script to remove IP addresses (we don't use this
script directly, so it does not have an impact)
[FHI72 M-plane] CM improvements and PM implementation
Configuration Management:
- addition of the RU username in the fhi_72 section of the config file;
previously hardcoded to oranbenetel
- modification of the frequency offset, frame structure, fft size,
cyclic prefix, and Tx gain;
- addition of the managed delay node;
for Tx/Rx endpoints.
Performance Management implementation where OAI gNB
activates/deactivates available RU performance measurements.
- Replaced ITTI message queues with notifiedFIFO for RRC to MAC communication in UE.
- Enables correct message delivery to multiple MAC instances running in parallel threads.
- Introduced `nr_mac_rrc_message_t` union for MAC-RRC messages.
- Updated all relevant message handling and initialization code to use notifiedFIFO.
Performance Management support explanation.
Example run modified according to:
- modification of the frequency offset, frame structure, fft size, cyclic prefix, and Tx gain;
- addition of the managed delay node;
for Tx/Rx endpoints.
Introduced a parameter start_up_timing which indicates if PM activation is supported during the start-up
procedure. We initialize this parameter, based on the vendor.
Notification interval is set to 10s.
Definition in o-ran-uplane-conf.yang model:
"Gain correction of RF path linked with array element or array layers.
Common part of overall gain_correction.
gain_correction = common array-carrier gain-correction + eAxC gain correction."
Fix SRS TLV unpack
This MR changes the type of a variable to get the last index in which we
unpack the full 32 bits in a SRS TLV to int16 instead of uint16, in
order to be -1 when the TLV length is 0, thus skipping unpacking. This
only affects the SRS.indications sent by Aerial L1, which don't have
padding in the TLV, in case of OAI L1, we unpack in "full" 32 bit blocks
until the end of the TLV, if the length is 0, the unpacking loop exits
immediately. Furthermore, it also adds a check for the Report Type
parameter value in handle_nr_srs_measurements. If this value is zero,
according to SCF 222.10.04 Table 3-129 means a null report, so we can
skip processing it.
- Use MAX_NUM_NR_UE_INST in NR UE MAC to control number of MAC instances.
- Modify the MAC interface slightly so that nr_l2_init_ue only initializes one instance
Use MAX_NUM_NR_UE_INST for number of NR UE RRC instances. Change the RRC
interface slightly so nr_rrc_init_ue initializes only one RRC instance pointed
to by the id given to the function
Integration: `2025.w34`
* !3555 Remove dead code and variables, simplify code
* !3591 separate computation of size and value for DCI precoding information
* !3550 some work for better interoperability with srsRAN DU
* !3562 cleaning syntax of nr-ru.c
* !3598 Align add_boolean_option as per CMake documentation use only ON/OFF for uniformity
* !3407 Taps client for vrtsim
* !3035 NR L1 common channel level functions
* !3589 RF emulator and improvements of the timers
* !3577 Fix for UECAP file handling in dora/phytest mode
* !3600 Fix for UE TCI state ID configuration
* !3599 DLSCH scheduler: fix bugs in UE sorting
See merge request oai/openairinterface5g!3597
The CI detects whether a UE connected (and has a PDU session) by trying
to read the IP address. It therefore assumes that as long as the UE is
not connected, no IP would be present.
With the existing stop_quectel_mbim.sh script, this was not the case; it
would simply leave the IP address. Modify this script to flush all IP
addresses on disconnect to remedy this.
DLSCH scheduler: fix bugs in UE sorting
Fix two issues/bugs when sorting UEs in the DLSCH scheduler following
the PF metric, which should improve fairness.
RF emulator and improvements of the timers
RF emulator:
Add an RF library emulating a real device without the need of a real
device. This is thought to enable using phy-test without requiring a
radio device or channel simulation. The library synchronizes on the
real time clock, drops TX and generate noise on RX. Noise generation
can be disabled and the noise level configured.
Timers improvements:
- Fix standard deviation for merged timers
- Add display of ULSCH decoding timers
- Add decoding timer in AAL
Update the comparator() to properly sort UEs based on their coefficient
by appliey a consistent logic of -1/0/1 (see man qsort) for
smaller/equal/larger. The previous logic was only sorting based on 0/1
(equal/larger), which would result in some UEs with a high coefficient
not necessarily advancing to the start of the list, which could reduce
the likelihood of them being scheduled when they actually should (in
other words, this should improve fairness).
See also: 62e4025bc8 ("Integrate inactivity scheduling into main
allocation loop")
Taps client for vrtsim
The MR allows vrtsim to connect to the Raytracing Channel Emulator (CE later).
https://gitlab.eurecom.fr/oai/raytracing-channel-emulator
Additional Ubuntu packages required:
- libnanomsg-dev
- flatbuffers-compiler
- libflatbuffers-dev
Everything was tested on the same host. Follow the steps below to
successfully replicate:
1. Build nr-softmodem dependencies
2. Build nr-softmodem for (gNB, nrUE) with OAI_VRTSIM_TAPS_CLIENTset to ON.
3. Start the core network (Optional) follow this tutorial
4. Start the gNB
sudo ./nr-softmodem -O ../../../targets/PROJECTS/GENERIC-NR-5GC/CONF/gnb.sa.band78.fr1.106PRB.usrpb210.conf --gNBs.[0].min_rxtxtime 6 --device.name vrtsim --vrtsim.role server --vrtsim.timescale 0.5 --vrtsim.taps-socket ipc:///tmp/ru_socket_0
5. Start the nrUE
sudo ./nr-uesoftmodem -C 3619200000 -r 106 --numerology 1 --ssb 516 --band 78 --device.name vrtsim --vrtsim.taps-socket ipc:///tmp/ue_socket_0
6. Start the CE Server, once the UE and gNB are running properly, so the
server can connect to IPC sockets
7. Start CE client; the binaries can be downloaded from a pipeline run
or from this link
8. Move the UE in the CE client to generate a new taps array and
populate the taps in softmodems
Align add_boolean_option as per CMake documentation use only ON/OFF for uniformity
The add_boolean_option of CMake is not uniform everywhere. We were using
either True/False or ON/OFF. It is better to be uniform to avoid
confusion.
As an example, see here CMake documentation for an example:
https://cmake.org/cmake/help/latest/module/CMakeDependentOption.html#example-basic-usage
There are also some minor spelling corrections.
some work for better interoperability with srsRAN DU
Just add the minimum to get some user plane traffic going on.
When doing user plane traffic, in the CU logs we have a lot of:
[GTPU] NR-RAN container type: 1 not supported
That will be fixed in another MR, not here.
Interoperability testing with srsRAN DU shows than when receiving
RRCReconfigurationCompleteIndicator in a UEContextModificationRequest
the DU replies in the UEContextModificationResponse with an empty
CellGroupConfig.
This CellGroupConfig is encoded as 2 zero bytes. Let's ignore this
message when we receive it, don't forward it to the UE in a
RRC Reconfiguration, as it should per standard (38.473 8.3.4.2):
If the CellGroupConfig IE is included in the DU to CU RRC Information
IE contained in the UE CONTEXT MODIFICATION RESPONSE message, the
gNB-CU shall perform RRC Reconfiguration as described in TS 38.331 [8].
The CellGroupConfig IE shall transparently be signaled to the UE as
specified in TS 38.331 [8].
To be removed/reworked in the future if the interoperability
situation improves.
This is in 3GPP TS 38.425.
Because it was not done, there was a problem of interoperability
between openair CU and srsran DU. No DL traffic was reaching the UE.
A new GTPU API function is introduced: gtpv1uSendDirectWithNRUSeqNum().
It is only used in the gNB CU, in PDCP. So it was decided to not add a
new parameter to gtpv1uSendDirect() but instead add a new API function.
Replace the unwieldy unix socket implementation of peer information
exchange with an authorative connection descriptor file that
informs the client of the connection method an number of antennas
on the server.
This allows the server to run without the client and allows the
client to reconnect as long as the server is running, as many times
as needed.
Move the channel state management outside the channel implementation.
This simplifies the channel implementation but forces users of the
channel to manage it's state manually.
Add handling for error states in vrtsim which allows to close the
softmodems with CTRL+C without hanging, improving user experience
- Client detection of stale timer.
- Abort state for client and server
Added a libary that can connect to a channel emulator and provide taps
as they are generated.
- Enable connection from vrtsim to channel emulation server
- Depends on flatbuffers definition file from raytracing-channel-emulator
- Depends on libanomsg-dev and flatbuffers-compiler (Ubuntu) or equivalent
- Added a compile time option ENABLE_TAPS_CLIENT to prevent other users
from being affected by additional dependencies
separate computation of size and value for DCI precoding information
This removes stuff that is only relevant for the gNB from the common
functions and moves it to the gNB scheduler functions (related to UL
precoding). In principle no functional change.
2 functions with same name as static to make it clearer they are separate.
remove unused copy of log_level global var.
remove threequarter sampling variable from the radio board general
configuration. The decision of sampling rate is made above. A better
behavior can be done later, like ask to the radio board what sampling
rate it can do,then use it to decide the appropiate sampling rate from
the gNB configuration. In UE case, it is another issue, as the sampling
rate would change after we decode SIB1, but also it is not developped
yet.
Think: NR with different number of slots per frame depending on mu.
The name 'subframes_per_frame' is a bit ambiguous. It is valid for LTE,
but for NR it should be 'slots_per_frame'.
For example, for sub-carrier spacing of 30KHz, we have 20 slots per
frame, so in this case subframes_per_frame = 20. In reality whatever
the numerology, there is always 10 subframes per frame in NR.
But how to name this variable which is used both for LTE and NR cases?
'subframes_or_slots_per_frame'? It's a bit long and also ambiguous.
Conclusion: no big deal I think. 'subframes_per_frame' and so be it.
- Allow client to exit cleanly if server is down
- Ensure timing_thread is joined only once avoiding exit_function loop
- Free noise_device
- Save previously sent samples for channel modelling
Integration: `2025.w33`
* !3563 UE fixes: pucch format 2 and CSI IM
* !3567 Workaround for handling 2 SS0 occasions per slot
* !3578 fix a T trace
* !3395 RFsim variable size H_awgn_mimo
* !3581 NR UE NTN: consider acceleration on orbital path to calculate N_UE_TA_drift_variant
* !3580 NR UE: fix pdcch llr_size calculation in nr_rx_pdcch()
* !3576 Cleanup documentation and interface of the LDPC segment coding libraries
* !3573 Make Amarisoft UE sim a RedCap UE
* !3586 Print UE command line parameters at gNB MAC for split architecture without L1
* !3584 add gtpu error packet parsing and display
* !3556 Introduce support for Cat-B RU using Predefined-Beam BF with Aerial L1
* !3492 Upgrade CI images to Ubuntu 24
* !3521 Refactor ULSCH scheduler towards more TDD pattern flexibility
* !3590 Improve MAC docs for MCS and docker for BuildKit usage
* !3579 CI: speed up and simplify build, remove unnecessary Python code, remove --eNB\* parameter list
Closes#927 and #973
See merge request oai/openairinterface5g!3583
Add a simple RF emulator library with no real RF.
It only synchronizes the gNB with the real time clock.
It is to be used for stress test or benchmarking in phy-test mode.
Improve MAC docs for MCS and docker for BuildKit usage
See commits for details. The first one is for fixing an omission in
!3281, the second to clarify docker build usage.
Closes: #973
CI: speed up and simplify build, remove unnecessary Python code, remove --eNB* parameter list
This cleans up the CI framework for running end-to-end tests, and
improves the integration with OAI code. Specifically
- cleanup build_oai and helpers to output all text, which is captured
better by the CI
- build some images in the Cluster-Build in parallel to increase speed
- remove all --eNB{,1,2}{IPAddress,UserName,Password} variables. Those
were indexed through "instance" and "server ID" and are replaced with
the actual node name. I consider further cleanup to introduce a
"global" XML file node name so we don't need this in each step and
instead define this once.
- individual cleanup
A previous commit changed to use archiveArtifact() to recover CI logs,
and then attempted to "guess" the L1/MAC stats file name through a
regex. However, the format "enb-[0-9]+" is not correct, as
archiveArtifact() puts the task ID ("[0-9]+") BEFORE the file name
(here, "enb"). So, make it more generic and match the final "-enb.log"
("$" means "end of string").
Fixes: 244ea8fc22 ("Use archiveArtifact() for TerminateeNB()")
Many of these tests exit with an exit code != 0. Thus, the CI
automatically logs the result. Rather, write everything including stderr
to the file for analysis.
Also, rewrite the file with ">" instead of appending through ">>". While
appending works because the CI removes files after archiving, it seems
"cleaner" to remove files.
It is superseded by the CreateWorkspace() function and task step (which
removes and recreates a workspace), and this option was not actually
used in any function except for the build of unit tests, but no XML
step actually specified this option.
After having transitioned to direct node names in the XML, these
parameters are not relevant anymore.
The best way to view this patch is with
git show <SHA> --ignore-all-space
Remove this class. It is not safe to use (no return codes, can get out
of sync), hardcodes the use of passwords, and it's API is cumbersone.
More explanations can also be found in !1867. It is superseded by
cls_cmd.py
Since 28ce0dc444 ("Main: pass in ctx"), the CI always collects logs
into cmake_targets/log/. Hence, LogCollecteNB() is never called. We can
remove it.
Further, change the cmake_targets/log/ to ci-log/, which is shorter, and
append a / on the zip path to make sure that only contents is zipped.
Reimplement these functions by
- using cls_cmd
- retain only the necessary steps from the timing-phytest function
- pass in ctx and node information, instead of server ID
- remove all superfluous variables that don't seem to be used
- make some lists (corresponding indices are "server ID") into normal
variables.
Pass node directly from XML to these functions
- BuildClusterImage()
- BuildImage()
- BuildProxy()
- BuildRunTests()
instead of reading the "server ID" and looking up from
eNB_IPAddress/eNB1_IPAddress/eNB2_IPAddress.
Improve the proxy build unit test by properly passing ctx information.
build_oai primarily builds UHD for OAI. Thus, a number of targets (B100,
USRP1/2, ...) can be omitted, as OAI does not run on them. Further,
disable documentation and man pages, which is typically not necessary
for the averages user, and does not need to be installed for containers.
Similarly to the parent, don't redirect log files to a file. It makes
the CI more complicated, and also raises user awareness of what is being
installed.
Refactor ULSCH scheduler towards more TDD pattern flexibility
Refactors ULSCH scheduler, notably to support "UL-heavy" TDD patterns,
e.g., DSUUU. Also allows to run TDD pattern2 with UL slots, which was a
limitation in the previous code.
Increase the number of aggregration level candidates. Since we have many
UEs with concurrent traffic in that pipeline, we should ensure that we
can allocate many DCIs to not waste resources (e.g., not all RBs used
because could not find DCIs for specific UEs).
Add the possibility to use UL slots in TDD pattern 2. For simplicity, we
require the mixed slot to be of the same symbols in pattern 1 & 2. For
UL slots, simply use the right amount of UL TDAs, depending on which
number of UL slots among pattern 1 & 2 is bigger.
One complication is the TDA for the mixed slot. The current code assumes
that k2 has to be equal or larger than (number of DL slots +1) (because
the spec says min k2=2, but we might want to schedule DSUUU). Then,
there could be for instance the following cases:
- only pattern 1: DSUUU DSUUU ...: the mixed slot has to be reached an
entire period in advance
- pattern 1 & 2: DSUUU DDDDD: normal mixed slot k2, e.g., like for 7DS2U
- pattern 1 & 2: DSUUU DDDSU: the mixed slot has to be reached
N_ul2+N_dl1+1 slots in advance
I can't think of more cases right now. To avoid unscheduled slots, I put
an assertion (which could also trivially be taken out).
Adds the capability to pack/unpack the TDD table in CONFIG.request
following both SCF222.10.02 (Tag 0x1027) and SCF222.10.04 (Tag 0x1035)
formats In the case of Aerial, the TDD table is packed following the
10.04 format, but with the 10.02 tag Prevent the packing of Digital
Beamforming table and Precoding Matrix table for Aerial
A new function get_best_ul_tda() allows to select the "best" TDA out of
a number of TDA. Specifically, get_best_ul_tda() considers in how many
RBs a given TDA might be allocated, and multiplies this number of RBs
with the number of symbols in the TDA to form a "score". The TDA with
the best "score" is selected, considering it maximizes resource usage.
In phytest scheduler, we use this function to verify that the given TDA
can be really allocated in all selected slots.
Schedule SRS longer in advance, so that it would also be enough even
with big k2 for UL TDA.
Remove useless types: we do not use the information on sched_srs
anymore, so remove it.
Check that the VRB map is free before making allocations.
Since the parent commit, the TDA for UL scheduling is dynamically
selected, instead of being hardcoded to specific indices. We can thus
also omit the SRS TDA if no SRS is configured.
Also add SRS-specific TDAs if we schedule further into the future.
Add multiple TDAs with k2 larger than the min_rxtxtime, to potentially
allow to allocate all available slots. For this, nr_rrc_config_ul_tda()
inspects the TDD pattern, and allocates as many TDAs as necessary. It
also sorts the TDA list, with smaller k2 and larger symbol lengths
first.
This in turn is now used by get_num_ul_tda() to use a k2 and the slot
configuration to find a suitable TDA, assuming a list as sorted in
nr_rrc_config_ul_tda().
Note that since get_num_ul_tda() does only inspect the available UL
slots, there might be overlap (e.g., when scheduling SRS), which will be
fixed in a follow-up commit.
Also, TDD pattern 2 is not handled here yet, and a follow-up commit will
fix it.
Add a loop to advance slots as determined by current ("DL") slot, and
advance further into the future (for "UL" slots) if TDAs allow. Ensure
to schedule all TDAs if it's the last DL slot, to guarantee a previously
scheduled TDA will also reoccur (i.e., for guaranteeing that
retransmissions can be made).
Note that the check for number of UE being zero is removed, as this
allows to keep "ul_next" close to the "min_next" slot. This way, we can
use fs_get_max(); otherwise, if we did not always execute this loop,
they might diverge far from each other, making the logic inside the loop
more complicated.
This commit introduces a new type "fsn_t" (frame-slot number) that
encapsulates a single frame-slot combination in a single struct. The
helper functions (in gNB_scheduler_ulsch.c) should be moved to a new
file under common/, but we don't do this here to limit the amount of
code changes.
For scheduling multiple ULSCH ahead, we will have to use different k2.
Hence, we will need to check for k2 in the TDA selection as well. The
function get_ul_tda() is renamed to get_num_ul_tda() to reflect that it
might return multiple TDAs (not done in this commit, but in a follow-up
MR). get_num_ul_tda() also returns a pointer to the first suitable TDA.
In the phy-test scheduler, simplify the selection of the TDA to use: do
not hardcode a specific K2, but rather, use the first one (with any k2).
For the multi-UL slot scheduling functionality in a follow-up commit, it
would be important to know if the scheduler allocated any UEs. If
pf_ul() allocated for some UEs, we might run it again on a different
slot. If on the other hand, no UEs were allocated, there is no point in
running it again.
Introduce support for Cat-B RU using Predefined-Beam BF with Aerial L1
This merge introduces the support for BeamID based Beamforming in OAI L2 using FAPI and leveraging Aerial L1. Support for OAI L1 is not in the scope of this MR.
Main changes:
- Introduced a third state for the analog_beamforming parameter.
0=disabled,1=analog_bf,2=oran_bf
- Correctly populated the FAPI BF PDUs (prg_size, num_prgs,
dig_bf_interfaces)
The Dockerfiles are reused for building on different architectures
(amd64/arm64). They differ, though, on some steps for downloading or
installing platform-specific utilities.
This is handled automatically when using BuildKit, which is the default
in docker versions v23.0+. Older docker versions require some special
settings. Explain this in the README.
Closes: #973
Previous commits removed min_grant_mcs and instead introduced
dl/ul_min_mcs as a more generic replacement.
Fixes: 96b0cae63e ("Drop 'min_grant_mcs' configuration parameter ")
Fixes: 699afafc6f ("Add support for 'dl_min_mcs' and 'ul_min_mcs'
configuration parameters")
Make Amarisoft UE sim a RedCap UE
Change Amarisoft UE configuration and gNB of the AW2S pipeline to
be/handle RedCap UEs.
The UE should only connect if the gNB handles RedCap UEs. In the logs,
we should see
[MAC] UE with RNTI 3725 is RedCap
which we check for the first two UEs (one normal UE/absence of this
message, one RedCap UE/presence of this message).
Cleanup documentation and interface of the LDPC segment coding libraries
Fix interface: The LDPC segment decoder interface had variables
'harq_pid', 'ulsch_id' and 'C' that are not useful to the segment
decoder. This MR removes these variables from the interface.
Fix documentation: libconfig log do not display anymore by default so we
may better not show them in the documentation to avoid any
misunderstanding.
Remove ldpc_cl library since the library does not work.
Since the parent commit, UE 1 is normal (no RedCap), UE 2 is RedCap.
Verify that the gNB agrees with that and detects the second UE as RedCap
by analyzing some logs.
The first check is a bit elaborate, but basically is
[ $(docker logs | grep XYZ | wc -l) -eq 0 ]
^ ^ ^ ^ ^
1 2 3 4 5
(1) is the if statement, that compares
(4) the number of occurrences
(3) of "RedCap" in the
(2) docker logs
(5) to being equal to
Note for all UEs which number, and whether it is RedCap (so this need to
be kept in sync with the Amarisoft UE sim configuration file in use!).
Change the parameters to be redcap (release: 17, redcap: "redcap") on
some UEs, and modify the path to the updated configuration.
Specifically, make UE 1 normal (no RedCap), UE 2 RedCap, UEs 3&4 normal,
UEs 5&6 RedCap, etc.
RedCap UEs should now only be able to connect if the gNB is handling Redcap
UEs, which is done in the parent commit.
NR UE NTN: consider acceleration on orbital path to calculate N_UE_TA_drift_variant
The ntn-Config ephemerisInfo contains the SAT position and velocity
vector but not the acceleration vector.
But the acceleration magnitude on the orbital path can be calculated as:
t = 2 * pi * r / v
omega = 2 * pi / t = v / r
acceleration = omega² * r = v² / r
Where t is the orbital period, r is the orbital radius, v is the orbital
velocity, omega is the angular velocity. The acceleration direction is
from the SAT position towards the earth center. To calculate the
acceleration towards the UE, this is projected on the direction from the
SAT to the UE.
This is used to calculate the variable N_UE_TA_drift_variant and improve
the TA accuracy.
Workaround for handling 2 SS0 occasions per slot
Search Space 0 monitoring might depend on SSB. In !3332 this dependence
was removed by moving the configuration of SS0 earlier in a workaround
to avoid a segfault in handover. Now, a new workaround is needed to
handle 2 search space occasions per slot.
As DEBIAN_FRONTEND has been set as environment variable, there is no need to use DEBIAN_FRONTEND=noninteractive inside RUN lines, it is redundant, hence it has been removed.
Libboost went from 1.74.0 to 1.83.0 alongside Ubuntu update.
GCC version is set as default to be more practical.
In Ubuntu22, apt sources were in .list files, in Ubuntu24 they are in .sources files.
Add --break-system-packages for pip installation to use same logic as before, see the pip update 23.0.1 (2023-02-17).
With Ubuntu24 liboai_device requires libpython3.12
Redirecting to a file has the problem that it is difficult in the CI to
recover these files. Furthermore, at least with ninja, when running
build_oai interactively, the build output will only take some lines
(because ninja rewrites lines), so the change should not be that big to
users.
One CI function would print the entire output from build_oai to the
console. Since that output might be long now, do not do this. The file
is archived, anyway.
The acceleration magnitude on the orbital path can be calculated as:
t = 2 * pi * r / v
omega = 2 * pi / t = v / r
acceleration = omega² * r = v² / r
Where t is the orbital period, r is the orbital radius, v is the orbital velocity, omega is the angular velocity.
The acceleration direction is from the SAT position towards the earth center.
To calculate the acceleration towards the UE, this is projected on the direction from the SAT to the UE.
Variables 'harq_pid', 'ulsch_id' and 'C' of the segment decoder
interface were not used any more by the implementations and set to zero
by all the callers.
Then it is more relevant and compliant to remove them.
Integration: `2025.w32`
* !3548 NR UE: fix reliable SIB19 reception when ntn-UlSyncValidityDuration-r17 expires
* !3559 numelt in place of config_isparamset
* !3487 T hacks: add new tracer ant0 and a tool to plot ofdm data from usrp or rfsim (output or input)
* !3541 simplify and make more local variables in nr_rx_pdcch() and fix small bugs
* !3547 Add a CU-UP load tester and improve GTP performance
* !3552 CI: refactor iperf3 UDP analysis function
* !3557 Fix PDSCH rate-matching for periodic CSI in UE
* !3571 fix time manager tests in the CI
* !3344 LDPC BBDEV/AAL rework
* !3560 CI: Refactor log collection, collect also (COTS) UE logs
See merge request oai/openairinterface5g!3565
CI: Refactor log collection, collect also (COTS) UE logs
Refactor log handling in CI: collect according to currently used XML files. This
makes it homogeneous in the pipelines, and avoids accidental overwriting (as
happens in phytest-timing), as well as harmonizing the log placement
(e.g., no YAML lookup in Ping/Iperf).
Allow to trace and archive UE logs (e.g., Quectel via QLog, Amarisoft UE logs).
By default, no logs will be collected as of this MR, as many files are big.
Various cleanup in Jenkinsfiles, some bugfixes, add unit tests.
Sometimes the connection fails because of the reboot. Without may_fail,
it would stop the build, which will then run the wrong code, possibly.
Instead, continue; if there is a problem with USRP, it will be visible
when starting nr-softmodem.
I have to make both together, since they both depend on
AnalyzeBuildLogs().
- remove mkdir for legacy sub-logfiles in build_oai, that does not exist
anymore; also, remove corresponding log analysis, I think we don't use
it and it is overkill (either build works or not)
- manually try to copy "all.txt"
- explicitly list log files to copy, then analyze
- AnalyzeBuildLogs(): pass log files to inspect explicitly
LDPC BBDEV/AAL rework
This branch aims to generalize the existing LDPC T2 implementation to support
other DPDK BBDEV accelerators, e.g., Intel ACC100/200.
Differences from the current T2 implementation include:
1. relax CMakeLists.txt checking for custom dpdk-t2 implementation,
technically, any DPDK BBDEV should work
2. BBDEV capability checks during init
3. llr_scaling to scale the input llr accordingly for better decoding
performance on the Intel ACC100/200
4. self-managed harq buffers for the ACC200, as internal harq memory is not
available
Tested BBDEV devices:
1. Intel ACC100
2. Intel ACC200/VRB1
Set the context for each task step. Set the artifact result path based
on the XML, so it is harmonized; currently, most pipelines use the "YAML
path" of docker-compose, but that does not always make sense. For
instance, Ping/Iperf() needs to look up this path, but does not
inherently belong to one specific YAML path (there might even be more).
This class provides a generic "context" for individual tasks about the
current task step, and where to log results. It's used by
archiveArtifact() that would automatically log files in the right
directory, based on a directory in the context, and in a way that order
of files is preserved for long-running pipelines.
Note: this does not actually work. In the pipelines, we see that for
some reason, quectel-CM cannot establish a connection. Manually, it
works though(?)
It is not necessary (the final undeploys at the end are "always_exec"),
and makes the CI potentially fail since there is nothing to copy at this
point.
check for IP once before sleeping in case UE IP address exists, which
should speed up the CI. With this, Only print the actual attach command
once. Print errors only at the beginning. This should simplify attach
command output logs.
The CI fails sometimes, because some processes/threads are created in
unpredictable order and if the client connects before the server is
ready some tests fail, as seen in the following log:
[UTIL] client/server iq-samples: launch sub-processes
[UTIL] threadCreate() for time client: creating thread (no affinity, default priority)
[UTIL] time manager configuration: [time source: server] [mode: client] [server IP: 127.0.0.1} [server port: 7374]
[UTIL] time client: connection to 127.0.0.1:7374 failed, try again in 1s
[UTIL] threadCreate() for time source iq samples: creating thread (no affinity, default priority)
[UTIL] threadCreate() for time server: creating thread (no affinity, default priority)
[UTIL] time manager configuration: [time source: iq_samples] [mode: server] [server IP: 127.0.0.1} [server port: 7374]
[UTIL] client/server: rlc ticks: 1000 pdcp ticks: 1000 x2ap ticks: 1000
CMDLINE: "/oai-ran/build/common/utils/time_manager/tests/test_time_manager_auto" "--time_management.mode" "server" "--time_management.time_source" "iq_samples"
[UTIL] client/server: rlc ticks: 0 pdcp ticks: 0 x2ap ticks: 0
CMDLINE: "/oai-ran/build/common/utils/time_manager/tests/test_time_manager_auto" "--time_management.mode" "client"
[UTIL] client-server iq-samples: ERROR
The client/server iq-samples test is started.
Then we see this log:
[UTIL] time manager configuration: [time source: server] [mode: client] [server IP: 127.0.0.1} [server port: 7374]
Which means that the client is running.
It tries to connect to the server (not running yet), but fails, so sleeps
for 1 second before attempting another connection to the server:
[UTIL] time client: connection to 127.0.0.1:7374 failed, try again in 1s
The sleep is done by the time_client thread, the main thread of the test
program continues and does a sleep(1).
Then the server arrives:
[UTIL] time manager configuration: [time source: iq_samples] [mode: server] [server IP: 127.0.0.1} [server port: 7374]
It sends all the ticks (to no client, since the client is still sleeping).
Then the test is over, the sleep(1) of the client finishes and the program
exits. The client never connected to the server.
We have this log:
[UTIL] client/server: rlc ticks: 0 pdcp ticks: 0 x2ap ticks: 0
And the test fails.
It's complicated to write an automatic test involving several uncoordinated
programs. The operating system may create processes in any order. We use
some sleeping to wait, but it may be too short or too long, leading to test
failure.
Let's see with more sleep if the CI fails less.
Fix PDSCH rate-matching for periodic CSI in UE
Changed the search structure to have periodic resoruce id in the outer
loop and configured resource set as inner loop to prevent configuring
resource that is not needed.
Use const for input pointers.
CI: refactor iperf3 UDP analysis function
- add helper function to covert reported bitrate values to Mbps for calculations
- clean up the UDP analysis function, improve test report formatting
- fix an issue where Gbps values were incorrectly reported
(example: https://jenkins-oai.eurecom.fr/job/RAN-SA-AERIAL-CN5G/4802/)
- update CI unit test report checks to match the new formatting
Rename the library to reflect that it's more a generic AAL driver than
specifically for AAL. To this end, rename some documentation.
As of this commit, the options are still called nrLDPC_coding_t2. The
next commit will correct this.
Co-authored-by: Xin Zhe Khooi <khooixz@comp.nus.edu.sg>
Changed the search structure to have periodic resoruce id in the outer
loop and configured resource set as inner loop to prevent configuring
resource that is not needed.
Use const for input pointers.
Add a CU-UP load tester and improve GTP performance
This adds a simple tester program for the CU-UP. It sets up a number of
UEs/bearers in the CU-UP via the E1 interface, then streams data in
downlink/uplink (as seen by the CU-UP). More information is available in
tests/nr-cuup/README.md.
Includes some fixes to properly verify that SCTP is installed, and use
"the right cmake way" to use it in cmake code (see commit for details).
simplify and make more local variables in nr_rx_pdcch() and fix small bugs...
simplify and make more local variables in nr_rx_pdcch() and fix small bugs
(size 9 RE instaed of 12 RE)
T hacks: add new tracer ant0 and a tool to plot ofdm data from usrp or rfsim
(output or input)
The tool ant0 dumps IQ data to a file (or stdout) as float complex or short.
It is needed for a student's project. (Well, we could use record/extract, but
it's simpler.) The tool ofdm-plot is used to plot output or input signal from
gnb in the frequency domain. May be useful to debug, why not.
numelt in place of config_isparamset
config_isparamset doesn't seem to work for array types, a temporary solution is
using numelt to verify if the parameter is set in config file
NR UE: fix reliable SIB19 reception when ntn-UlSyncValidityDuration-r17 expires
Fixes:
- gNB: fix scheduling of Rel-17 SIBs
- gNB: fix case in update_SIB1_NR_SI() when multiple Rel-17 SIBs would be defined
- NR UE: fix calculation of SI window expiry
Updating LEO scenario to test this
- set ntn-UlSyncValidityDuration-r17 to 5 seconds for LEO scenario
- NTN config: setting sib1_tda is not required anymore
Remove these F1-C port numbers. The configuration is not actually
applied, and the default F1-C port number 38472 (see F1AP_PORT_NUMBER)
is hardcoded in the F1 module.
For the moment, I leave the configuration option, in case we want to
allow to configure the port numbers later).
Make a common pattern, which makes it simpler to find them in gNB logs,
and, maybe more importantly, link tunnel creation and update (the update
message was missing the "incoming" TEID, so it is not easy to link to
creation apart from the UE ID, but even then the UE might have multiple
tunnels).
Reuse the gtpv1u_bearer_t for internal functions. Hopefully this will
also simplify implementation of IPv6, as it encapsulates IP address
handling within gtpv1u_bearer_t.
The (remote) port number of the GTP module is configured during
initialization. It is therefore not required when calling
newGtpuCreateTunnel(), and could even lead to bugs (if another port
number is used than specified during GTP init).
This is a simple CU-UP load tester. It sets up a configurable number of UEs in the
CU-UP, then sends GTP traffic in downlink/uplink in the N3-F1/F1-N3
direction at the CU-UP. It then compares the sent and received data.
Additional parameters, such as amount of traffic, test length, packet
size, and IP addresses/ports are configurable.
To run:
mkdir build && cd build && cmake .. -GNinja && ninja nr-cuup nr-cuup-load-test params_libconfig
./tests/nr-cuup/nr-cuup-load-test
./nr-cuup -O ../tests/nr-cuup/load-test.conf
The tester should be able to detect lost and reordered packets.
Example lost: Receive order 2,3,5,6 (lost packet 4)
=> on packet 2, expected 2, next=expected+1=3
=> on packet 3, expected 3, next=expected+1=4
=> on packet 5, expected 4, diff=5-4=1 (lost 1), next=payload+1=6
=> on packet 6, expected 6
=> 1 lost
Example reordered: Receiver order 2,5,3,6 (lost packet 4)
=> on packet 2, expected 2, next=expected+1=3
=> on packet 5, expected 3, diff=5-3=2 (lost 2), next=payload+1=6
=> on packet 3, expected 6, (reduce lost by 1 to 1), next=expected=6
=> on packet 6, expected 6
=> 1 lost
Example reordered: Receiver order 2,5,3,4,6 (no losses)
The boolean value v17_sib was not set to true when allocating si_schedulingInfo_v17 and schedulingInfo2_r17.
So multiple Rel-17 SIBs would lead to multiple allocations and only the last SIB being actually configured.
Fix this by removing the redundant v17_sib variable and directly check if the memory was already allocated.
Also move the definition and allocation of si_schedulingInfo_v17 closer to its actual usage.
Now that we reliably receive SIB19, we can set the ntn-UlSyncValidityDuration-r17 to a sane value
and thus make sure that the UE always has up-to-date SIB19 information.
A dedicated Msg3 TDA is simply not necessary: get_feasible_msg3_tda()
already iterates through all TDAs to find a suitable one for Msg3, and
takes things such as parameter Δ already into account.
The only prerequisite is that the ra_ResponseWindow is long enough. In
some configurations, Msg3 TDA ensured that Msg2 still happened during
ra_ResponseWindow, while Msg3 was outside of it. This is not necessarily
the case anymore, unless ra_ResponseWindow is long enough.
For the normal user, removing ra_ResponseWindow from the config will be
enough.
Since the parent commit, the ra_ResponseWindow will be chosen
automatically. Correspondingly, remove most ra_ResponseWindow options
from configuration files in the repository.
One problem in some mu=1 configs is that the ra_ResponseWindow=4 (10
slots), which might be overly restrictive if the L1 slot ahead is
somewhat close to 10 (e.g., 6), in which case we might not be always
able to allocate Msg2 in time.
A notable exception here is gnb-vnf.sa.band66.u0.25prb.nfapi.conf, in
which we still provide it (1) since it uses a non-standard configuration
of a ra_ResponseWindow longer than 10ms (see also issue #916 for more
information) and (2) as an example.
If the config file does not specify ra_ResponseWindow, select it to be
10 slots in mu=0, or 20 slots for all others.
This should give us enough flexibility to allocate Msg2 without running
out of the response window. The next commit will remove most
ra_ResponseWindow options in configs.
Scheduling for inactivity only deviates in details from the main
scheduling logic: we simply allocate a fixed number of RBs instead of
making it dependent of data.
In this commit, add an additional flag to sort UEs that are scheduled
for inactivity in front of "normal" UEs (with traffic). Then, schedule
those UEs by limiting/fixing the amount of RBs to schedule to
min_grant_prb.
Update the comparator() to properly sort UEs based on this flag and the
coefficient by applying a consistent logic of -1/0/1 (see man qsort) for
smaller/equal/larger. The inactivity flag, if set, will always have
higher priority over the coefficient to schedule these UEs first, as was
the case prior to this commit.
Remove sched_ctrl->sched_ulsch, and call the post-processing function
post_process_ulsch() in the places where sched_ctrl->sched_ulsch has
been assigned. This will have two effects:
- it is not necessary to have the final loop over all UEs, which might
be costly especially towards many UEs.
- till now, there is only a single sched_ulsch; however, a later commit
will allow to schedule multiple PUSCH transmissions from a single (DL)
slot. This would require to make sched_ctrl->sched_ulsch, and
also iterate through all sched_ulsch. In this new scheme, we can
simply call post_process_ulsch() multiple times, which is simpler (and
therefore, implicitly handleded as of this commit).
Write a single NR_sched_pusch_t structure in a single statement (where
possible). Assign to sched_ctrl->sched_pusch later, where the
post-processing functionality will be called in a follow-up commit.
Write a single NR_sched_pusch_t structure in a single statement (where
possible). Assign to sched_ctrl->sched_pusch in one place, where the
post-processing functionality will be called in a follow-up commit.
Avoid to overwrite the existing retInfo. Instead, create a new
NR_sched_pusch_t and assign to sched_ctrl->sched_pusch in one place. A
follow-up commit will directly trigger the post processor here.
Write a single NR_sched_pusch_t structure in a single statement (where
possible). Assign to sched_ctrl->sched_pusch in one place, where the
post-processing functionality will be called in a follow-up commit.
PF uses MCS and average throughput to decide which UE to schedule. Thus,
the first loop selects the MCS, and the second does the main UE
allocation after sorting by priority, depending on the MCS.
A follow-up commit will remove sched_pusch from NR_UE_sched_ctrl_t.
Thus, we cannot rely on sched_ctrl to store the MCS in the first loop,
and look it up from there in the second. Instead, store it as part of
the UE iterator data, and take it from there.
A later commit will remove sched_ctrl->sched_pusch. Instead, the TX
power is also stored for each HARQ process (as they contain
sched_pusch). Read it from there, which should have the same effect.
Introduce an array with information on FAPI structures to save resource
allocation into. It's in nr_mac_gNB.h because the next commit reuses
this for all preprocessors.
DC subcarrier has a significantly higher energy compared to other CSI IM
resource elements. This causes the average interference + noise
estimation to be higher than CSI-RS signal power making the CQI 0. With
a third-party gnb that schedules PDSCH based on CQI, the UE never
receives DL DCI once it starts sending CSI reports.
- Add helper function to normalize bitrate values to Mbps for calculations.
- Add helper function to extract data from iperf test report.
- Clean up the UDP analysis function, improve test report formatting.
- Fix an issue where Gbps values were incorrectly reported due to inconsistent
unit parsing.
- Update CI unit test report checks to match the new formatting.
feat(LDPCImplementation.md): Fix documentation
Few ambiguities and outdated names were found in the LDPC documentation
by Vlademir Brusse (see in the devel mailing list).
- Outdated names of the functions of the segment coding interface.
- Ambiguity about loading of the segment coding libraries.
Fix Dedicated BWPs
- Improve SearchSpace selection
- Improve CORESET selection
- Fix fill 'initialDownlinkBWP->pdsch_Config' when there are
DedicatedBWPs
* This fixes the reported 'RSRP = 0' issue when the UE is in the
InitialBWP and we have DedicatedBWPs configured
- Add a 'common' type SearchSpace in the NR_BWP_DownlinkDedicated IE for
DedicatedBWPs
- Fix hardcoded 'controlResourceSetId' by making it dynamic
- Remove 'searchspaceid' from 'verify_agg_levels' function because it
was used only for LOG
- CI: Add DedicatedBWP to '40 MHz TDD F1+E1 SA' in
'RAN-SA-B200-Module-SABOX-Container'
Fix overflow when negating minimum int16_t value in precoding
This closes#955
It prevents undefined behavior caused by the minimum int16_t value
(-32768) in two's complement representation. Because possible negation
by multiplying with -1 during precoding cause an overflows since +32768
cannot be represented in 16-bit signed integers and end up again in
-32768 because of overflow, here reveald by using the SIMD functions.
Workaround we use a slightly smaller number than 1 in Q15 Format to
prevent this error. Q15 representation of (integer value -32767) -1 +
2^-15 = -0.999969482421875
remove specific directory for LTE SIM management tools
This is very old code has never been integrated with the "main" OAI
cmake infrastructure and more recent libraries.
This MR integrates the three binaries for LTE virtual sim management in
the regular build process and log system
Avoid the include gtpv1_u_messages_types.h, as this pulls in e.g., LTE
RRC definitions. The CU-UP load tester integrated in one of the
following commits should be able to build without LTE RRC, if it was for
GTP. Unfortunately, ITTI also pulls in LTE RRC, so it's also somewhat
useless...
Put some forward declarations instead. That also shows that the API is
unnecessarily complex, and would need some cleanup.
Remove sctp from all other targets, since we use sctp::sctp on
SCTP_CLIENT (would fail if it does not exist), and SCTP_CLIENT already
fulfils the SCTP dependency.
- Provide some documentation
- Make cmake keywards and sctp lib name lowercase
- Use standard form of find_package_handle_standard_args()
- Make an imported target sctp::sctp that will fail if being used in
cmake unless defined, which will avoid that "sctp" appears in the
cmake code but is silently discarded
See also:
https://cmake.org/cmake/help/latest/manual/cmake-developer.7.html#a-sample-find-module
Following frequency change in the pipeline, we observed degraded UL channel
conditions resulting in low UL throughput. Increasing attenuation on the gNB
side was found to mitigate this issue by improving UL channel quality
and reducing UL noise power.
Increase tested UL and DL bitrates in OAIUE pipeline.
Tell strncpy() the size including the NULL byte to make sure we copy all
data.
This just fixes these warnings:
openair3/NAS/TOOLS/conf_usim.c: In function ‘gen_usim_data’:
openair3/NAS/TOOLS/conf_usim.c:191:17: warning: ‘strncpy’ output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation]
openair3/NAS/TOOLS/conf_usim.c:190:53: note: length computed here
openair3/NAS/TOOLS/conf_usim.c:195:17: warning: ‘strncpy’ output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation]
openair3/NAS/TOOLS/conf_usim.c:194:54: note: length computed here
add copy with limited size and truncate properly with null C string termination.
As clang-format doesn't handle tab indented files and as it is not the
OAI coding rule, the entire file is re-indented with present OAI coding
rule.
Move the path to the beginning, so that we can use it early.
Specifically, it was after the SCTP module, and the next commit will use
the Findsctp.cmake module to find SCTP. Use the cmake-proper variable.
Remove --usim-test command line option
Remove the --usim-test option: to my knowledge, it's not used by users,
and is misleadingly placed in various places where there should not be a
difference w.r.t. USIM configuration.
When making the changes, I assumed that --usim-test would be 0 (the
default), which is the case in all executables when not specified in
options except for the nr_dlsim, nr_pbchsmi, nr_ulsim simulators.
The only exception is the initialization of PDCP from the MAC, which
does not seem to be correct (the PDCP is in the CU, so it does not make
sense to call it from the MAC which is in the DU).
Synchronized Real-Time Data Recording Application Addition
The main Features of Synchronized Real-Time Data Recording Application:
- The Data Recording Application runs in parallel to the gNB or UE
server or in another server as Data Recording or Data Lake Server
- It makes use of (an extended version) of OAI’s T-tracer framework
- It communicates with base station, and user terminal
- It synchronizes and combines data traces and control information
(meta-data) from Base station and User terminal into consistent SigMF
data sets
Details on implementation addition:
- T_tracer Extension to Support up to 35 Parameters in the T() macro
- Add traces on gNB PHY UL and related requirement: FD PUSH IQ, FD DMRS, and UL Channel estimates wi/wo interpolation, and Rx Payload bits:
1. The required memories have been created and initialized in:
openair1/PHY/NR_TRANSPORT/nr_ulsch_demodulation.c
2. Those memories: memory for DMRS signals, memory for channel
estimates based on DMRS positions, memory to store slot grid with
channel coefficients based on DMRS positions after interpolation,
and memory to store extracted data including PUSCH + DMRS.
3. The input parameters to nr_pusch_channel_estimation() has been
updated to get the pointer to the added memories of
pusch_dmrs_slot_mem and pusch_ch_est_dmrs_pos_slot_mem
(openair1/PHY/NR_ESTIMATION/nr_ul_estimation.h)
4. The DMRS grid of NR slot and the estimated channel coefficients at
DMRS locations are logged to created memories in:
openair1/PHY/NR_ESTIMATION/nr_ul_channel_estimation.c
5. The function inner_rx in
openair1/PHY/NR_TRANSPORT/nr_ulsch_demodulation.c is updated to log
the extracted ULSCH PRBs and the interpolated channel coefficients.
6. The T-macro() has been called in
(openair1/PHY/NR_TRANSPORT/nr_ulsch_demodulation.c) to trace added
traces: T_GNB_PHY_UL_FD_DMRS, T_GNB_PHY_UL_FD_CHAN_EST_DMRS_POS,
T_GNB_PHY_UL_FD_PUSCH_IQ, T_GNB_PHY_UL_FD_CHAN_EST_DMRS_INTERPL
- Add traces on UE PHY UL and related requirement: Tx Scrambled bits and Tx payload bits
1. Update input parameters to nr_ulsch_encoding () in
nr_transport_proto_ue.h to get number_dmrs_symbols to be added to
meta-data.
2. In nr_ulsch_coding.c: Trace UE PHY UL Payload TX bits (T_message:
T_UE_PHY_UL_PAYLOAD_TX_BITS) including related meta-data and UTC
time.
3. In nr_ulsch_ue.c: Trace UE PHY UL Scrambled TX bits (T_message:
T_UE_PHY_UL_SCRAMBLED_TX_BITS) including related meta-data and UTC
time.
4. Fix the input prameters in nr_ulsch_encoding () called in
(openair1/SIMULATION/NR_PHY/ulschsim.c) since a new input parameter
has been added.
- Add Data Collection Services (T-Tracers for gNB and UE)
1. Add _tracer_app_gnb and t_tracer_app_ue apps to common/utils/T/tracer/Makefile
2. Add Data collection Service for gNB: common/utils/T/tracer/t_tracer_app_gnb.c
3. Add Data Collection Service for UE: common/utils/T/tracer/t_tracer_app_ue.c
- Add Shared memory configuration
(common/utils/T/tracer/shared_memory_config.h), since we will have too
much memory consumption on the stack if the T-tracer is not fast
enough to process the traces or if we have too much traces. As a
result, tracers start to capture data, write data in shared memory,
then close the T-Tracer after getting the recording of N slots. The
Data recording App will read data from the shared memory.
- Add Main app of Data Recording Application v1.0 including: Config
files, SigMF Interface, Config Interface, Sync Service, and def
messages: The data recording App includes mainly the following files:
1. The main app: data_recording_app_v1.0.py that has the data control
service, interact with tracers, data sync and conversion service.
2. The configuration file:
common/utils/data_recording/config/config_data_recording.json
3. The wireless dictionary file:
common/utils/data_recording/config/wireless_link_parameter_map.yaml
4. Config Interface
(common/utils/data_recording/lib/config_interface.py) that reads
the configuration for both gNB and UE.
5. Sync interface (common/utils/data_recording/lib/sync_service.py)
that sync captured data for gNB and UE before saving them in SigMF
format
6. The SigMF Interface
(common/utils/data_recording/lib/sigmf_interface.py) to store
recorded data and meta-data in SigMF format
7. A simple script
(common/utils/data_recording/sync_validation_demo.py) to validate
that the recorded bits from gNB and UE are in Sync
- For more info look to doc/data_recording.md
The LLR threshold buffers hold only for one symbol but the LLRs are
computed for all symbols together. So only the threshold of last symbol
was used for computing LLR for all other symbols.
This commit calls nr_dlsch_llr for each symbol togther with rest of
nr_rx_pdsch() and calls nr_dlsch_layer_demapping at the last symbol.
Fixes issue 948.
TS 38.213 4.1 says coreset 0 is present only if kssb < 24 for FR1 and <
12 for FR2. This commit sets get_sib1 flag based on kssb.
Also, setting of mac state is taken out of function nr_ue_decode_mib().
After RRCSetup, until RRCReconfigurationComplete, gNB continues to schedule ULSCH using DCIs in a common searchspace.
In theory, the UE should decode DCIs in:
<downlinkBWP-ToAddModList>
<BWP-Downlink>
<bwp-Common>
<pdcch-ConfigCommon>
<setup>
<commonSearchSpaceList>
...
</commonSearchSpaceList>
However, due to the limited amount of time to investigate this issue, the easy way I found to get DCIs decoded in common searchspace of a DedicatedBWP was by adding a common searchspace in the bwp-Dedicated:
<bwp-Dedicated>
<pdcch-Config>
<setup>
<searchSpacesToAddModList>
<SearchSpace>
...
</SearchSpace>
</searchSpacesToAddModList>
This way, let's call it a workaround.
There is a removal of the NR_SearchSpace__searchSpaceType_PR because, at this point, the gNB already selected the searchspace and it calls this function only to find the coreset with controlResourceSetId based on the previously searchspace id selected;
There is no need to send a pointer to the entire searchspace structure because we only need the controlResourceSetId: NR_ControlResourceSetId_t coreset_id = *ss->controlResourceSetId;
It also prevents a segmentation fault, in develop when NR_SearchSpace__searchSpaceType_PR_common because gNB calls sched_ctrl->coreset = get_coreset(nr_mac, scc, bwpd, sched_ctrl->search_space, target_ss); the bwpd is NR_BWP_DownlinkDedicated_t *bwpd = NULL; and is it incompatible with the cast to NR_BWP_Downlink_t in coreset = ((NR_BWP_Downlink_t*)bwp)->bwp_Common->pdcch_ConfigCommon->choice.setup->commonControlResourceSet; this was never noticed until now because gNB barely used NR_SearchSpace__searchSpaceType_PR_common
Integration: `2025.w30`
* !3529 Add CI RFsim5G test for second PDU session
* !3532 Count bits in variable with mask
* !3533 CI: test T2 with DPDK 22.11
* !3535 RAN-Container-Parent: Auto-generate artifact in failure case
* !3542 bugfix: avoid segmentation fault when Redcap tries to connect to gNB
* !3543 rfsimulator: fix model name for channel
* !3540 CI: migrate RFSim4G to acamas machine
See merge request oai/openairinterface5g!3539
Pre-initialize this variable. It should be set in pucch2x_scrambling(),
but the compiler warns with
In function ‘pucch2x_modulation’,
inlined from ‘generate_pucch2x’ at oai/openair1/PHY/LTE_UE_TRANSPORT/pucch_ue.c:425:3:
oai/openair1/PHY/LTE_UE_TRANSPORT/pucch_ue.c:361:18: warning: ‘btilde’ may be used uninitialized [-Wmaybe-uninitialized]
361 | d[i] = btilde[i] == 1 ? -amp : amp;
oai/openair1/PHY/LTE_UE_TRANSPORT/pucch_ue.c: In function ‘generate_pucch2x’:
oai/openair1/PHY/LTE_UE_TRANSPORT/pucch_ue.c:387:11: note: ‘btilde’ declared here
387 | uint8_t btilde[20];
Remove the --usim-test option: to my knowledge, it's not used by users,
and is misleadingly placed in various places where there should not be a
difference w.r.t. USIM configuration.
When making the changes, I assumed that --usim-test would be 0 (the
default), which is the case in all executables when not specified in
options except for the nr_dlsim, nr_pbchsmi, nr_ulsim simulators.
The only exception is the initialization of PDCP from the MAC, which is
not correct (the PDCP is in the CU, so it does not make sense to call it
from the MAC which is in the DU). Instead, always initialize from main,
even in the NSA case (NSA was covered by the incorrect initialization
from MAC).
This in turn let to some more cleanup around function du_rlc_data_req().
After receiving GTP packets at the DU, they were given to the PDCP to
enqueue the packet at RLC. This does not work anymore, since the PDCP is
not initialized; it also does not seem necessary, as this enqueue
functionality is necessary to decouple PDCP and RLC to avoid deadlocks
in monolithic, but in split-mode, this cannot happen. Instead, call
directly into the RLC when receiving GTP packets.
It provides and overview about the Architecture, Requirement Packages,
Configuration Files, How to run Data Recording Application, and an
Overview on Collected Data Set.
The data recording App includes the following files:
- The main app: data_recording_app_v1.0.py that has the data control service, interact with tracers, and data sync and conversion service
- The configuration file: common/utils/data_recording/config/config_data_recording.json
- The wireless dictionary file: common/utils/data_recording/config/wireless_link_parameter_map.yaml
- The SigMF Interface (common/utils/data_recording/lib/sigmf_interface.py) to store recorded data and meta-data in SigMF format
- A simple script (common/utils/data_recording/sync_validation_demo.py) to validate that the recorded bits from gNB and UE are in Sync
- For more info look to doc/data_recording.md
A squashed commit further updates:
- Enhance Data Recording App structure
- Support the new state machine of T-Tracers
- Add new files for Config Interface, sync Service, def of data recording messages, and common utilties
- Make part of logging on Terminal configurable
- Add _tracer_app_gnb and t_tracer_app_ue apps to common/utils/T/tracer/Makefile
- Add Data collection Service for gNB: common/utils/T/tracer/t_tracer_app_gnb.c
- Add Data Collection Service for UE: common/utils/T/tracer/t_tracer_app_ue.c
- Add Shared memory configuration (common/utils/T/tracer/shared_memory_config.h),
since We will have too much memory consumption on the stack if the
T-tracer is not fast enough to process the traces or if we have too
much traces. As a result, tracers start to capture data, write data in
shared memory, then close the T-Tracer after getting the recording of
N slots
- Support the operation of : COnfig, Record, and Stop
- Poll from Socket and not use get_events to mitigate long-time waiting
if there is no data in buffer or the UE is already released or crashed
- Add extra offset to improve data sync
- Update input parameters to nr_ulsch_encoding () in
nr_transport_proto_ue.h to get number_dmrs_symbols to be added to
meta-data.
- In nr_ulsch_coding.c: Trace UE PHY UL Payload TX bits (T_message:
T_UE_PHY_UL_PAYLOAD_TX_BITS) including related meta-data and UTC time.
- In nr_ulsch_ue.c: Trace UE PHY UL Scrambled TX bits (T_message:
T_UE_PHY_UL_SCRAMBLED_TX_BITS) including related meta-data and UTC
time.
- Fix the input prameters in nr_ulsch_encoding () called in
(openair1/SIMULATION/NR_PHY/ulschsim.c) since a new input parameter
has been added.
- The required memories have been created and initialized in:
openair1/PHY/NR_TRANSPORT/nr_ulsch_demodulation.c
- Those memories: memory for DMRS signals, memory for channel estimates
based on DMRS positions, memory to store slot grid with channel
coefficients based on DMRS positions after interpolation, and memory
to store extracted data including PUSCH + DMRS.
- The input parameters to nr_pusch_channel_estimation() has been updated
to get the pointer to the added memories of pusch_dmrs_slot_mem and
pusch_ch_est_dmrs_pos_slot_mem
(openair1/PHY/NR_ESTIMATION/nr_ul_estimation.h)
- The DMRS grid of NR slot and the estimated channel coefficients at
DMRS locations are logged to created memories in:
openair1/PHY/NR_ESTIMATION/nr_ul_channel_estimation.c
- The function inner_rx in
openair1/PHY/NR_TRANSPORT/nr_ulsch_demodulation.c is updated to log
the extracted ULSCH PRBs and the interpolated channel coefficients.
- The T-macro() has been called in
(openair1/PHY/NR_TRANSPORT/nr_ulsch_demodulation.c) to trace added
traces: T_GNB_PHY_UL_FD_DMRS, T_GNB_PHY_UL_FD_CHAN_EST_DMRS_POS,
T_GNB_PHY_UL_FD_PUSCH_IQ, T_GNB_PHY_UL_FD_CHAN_EST_DMRS_INTERPL
bugfix: avoid segmentation fault when Redcap tries to connect to gNB
bugfix: avoid segmentation fault when Redcap tries to connect to gNB
as NR_ServingCellConfig_t scd is NULL when Redcap does RA
RAN-Container-Parent: Auto-generate artifact in failure case
RAN-Container-Parent uses Jenkinsfile-GitLab-Container, which only
triggers sub pipelines, then collects their results. However, if a sub
pipeline did not generate an artifact, the result was skipped. It would
also not show it in the automatically generated result page, when it
should.
Remedy this by automatically generating a file with a link to the
pipeline if the artifact could not be retrieved, which
1. Will give a link, which is easier for developers to follow to the
pipeline than manually clicking through Jenkins,
2. Makes the failed pipeline appear in the list of failed pipelines.
CI: test T2 with DPDK 22.11
Following the upgrade of T2 to the latest firmware, DPDK 22.11 is now required.
This MR updates the testing pipeline to ensure compatibility and deployment of
T2 physims with DPDK 22.11.
bridge->nb_cnx++ is done before calling snprintf(modelname,... in the function,
so we take the model name of the next channel. This commit corrects the issue by
using bridge->nb_cnx - 1, ensuring that the model name corresponds to the currently
connected client.
This bug was introduced by MR !3455.
Co-authored-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
Co-authored-by: Laurent THOMAS <laurent.thomas@open-cells.com>
RAN-Container-Parent uses Jenkinsfile-GitLab-Container, which only
triggers sub pipelines, then collects their results. However, if a sub
pipeline did not generate an artifact, the result was skipped. It would
also not show it in the automatically generated result page, when it
should.
Remedy this by automatically generating a file with a link to the
pipeline if the artifact could not be retrieved, which
1. Will give a link, which is easier for developers to follow to the
pipeline than manually clicking through Jenkins,
2. Makes the failed pipeline appear in the list of failed pipelines.
Build and run OAI physims with DPDK version 22.11 for testing with the latest
T2 firmware release. Environment variables PKG_CONFIG_PATH and LD_LIBRARY_PATH
are set to point to the custom installation path of DPDK v22.11.
Integration: `2025.w29`
* !3346 Add WLS as a transport option for VNF/PNF, refactor existing options
* !3455 RF simulator: Fix concurrency issues during new client connections
* !3515 Extended changes to "Initial support for RedCap" feature in gNB
* !3510 NR UE: fix PDSCH overlap with ZP CSI-RS case
* !3512 speedup NR RLC RX for AM
* !3528 fix(RLC): Count dropped DL SDUs by the RLC
* !3486 NR UE: Enable additional PDU session
* !3225 Measurement gaps
* !3526 CI: migrate RFSim5G to acamas machine
* !3527 CI: Change RU in Aerial setup from Foxconn to WNC
See merge request oai/openairinterface5g!3525
CI: Change RU in Aerial setup from Foxconn to WNC
- Change frequency in the gNB config file, from 3.75GHz to 3.5GHz
- Add high throughput tests with may_fail tag (1Gbps in DL and 90Mbps in UL)
- Update Aerial tutorial to match the changes
NR UE: Enable additional PDU session
- fix a bug with wraparound of buffer_remain_ep
- Add --extra-pdu-id command line option
Testing procedure:
1. Start cn in openairinterface5g/doc/tutorial_resources/oai-cn5g with
docker compose up
2. Start gnb:
sudo ./nr-softmodem -O ../../targets/PROJECTS/GENERIC-NR-5GC/CONF/gnb.sa.band78.fr1.106PRB.usrpb210.conf --gNBs.[0].min_rxtxtime 6 --rfsim --rfsimulator.server_address server
3. Monitor extra interfaces being created:
watch -n 0.5 "ifconfig | grep tun"
4. Start UE:
sudo ./nr-uesoftmodem -C 3619200000 -r 106 --numerology 1 --ssb 516 --band 78 --rfsim --uicc0.imsi 001010000000001 --extra-pdu-id 11
5. An extra tun interface oaitun_ue1p11 should be created. Observe in
the terminal from step 3
6. Ping the core network from both interfaces, e.g., ping -I
oaitun_ue1p11 10.0.0.1, ping -I oaitun_ue1 10.0.0.1. This should
generate traffic on the gNB on different LCIDs.
Measurement gaps
Scheduling measurement gaps to provide sufficient time for the UE to
re-tune its transceiver to the target carrier, complete the set of
measurements and then re-tune its transceiver back to the original
carrier.
This commit reduces the UL throughput target in the 2x2 test to align
with the host’s performance capabilities. The adjustment ensures more
reliable and consistent CI results.
Based on observations from testing on acamas, the interval between DL
disruption and the UE synch check needs to be increased - the UE takes
longer to go out of sync . A sleep of 15 seconds has proven to be a
reliable value to ensure constant results.
fix(RLC): Count dropped DL SDUs by the RLC
When a downlink SDU was discarded by the RLC Acknowledged Mode entity
due to a full transmit buffer (tx_maxsize), the drop statistics were not
being updated. The txpdu_dd_pkts and txpdu_dd_bytes counters remained at
0. It should be noted that while the statistics are named txpdu_dd_*,
the drop at this stage occurs at the SDU level.
speedup NR RLC RX for AM
rx_list is replaced by an array of size 2^(SN size - 1) which is 131072
for an SN size of 18 bits, leading to 1048576 bytes of memory used.
(Less for smaller SN sizes.)
A lot of RX processing was to run through rx_list. When the list was big
(with some non-ideal channel), it can take some time. Removing this list
should improve things. Checking with benchmark_nr_rlc_am_entity a
speedup of more thant x10 is achieved (except for the case 1024 which is
surprisingly faster than the others in the develop branch).
The only thing that may be slower is when looking for cur->next where
the SN is different, in which case we need to look for all SN one by one
until we find something or reach the limit (rx_highest_status). These
are the functions get_first_rx_pdu() and get_next_rx_pdu().
Add SYS_NICE capability to enable setting thread priority and affinity
in rfsim5g tests. This improves execution speed in test cases with
heavier processing workloads.
When migrating from RHEL (on cacofonix) to Ubuntu 22.04 (on acamas), the `nc`
command needs to be replaced by `ncat`. The version of `nc` available on Ubuntu
is the OpenBSD variant, which lacks support for some options used in our scripts.
`ncat` from the Nmap is used instead.
RF simulator: Fix concurrency issues during new client connections
- Fix concurrency issues happening when a new client connects, sometimes
leading to a total softmodem deadlock.
- trace in 4G RAR processing to debug ci result
Add WLS as a transport option for VNF/PNF, refactor existing options
This MR adds a new transport mechanism for the VNF and PNF split, using
the Intel WLS library, which makes use of DPDK and shared memory to
transport messages. This transport mechanism is what is used to
interface with Radisys ODU, while also working with OAI VNF/PNF.
The VNF and PNF have been refactored so that the transport-specific
functions are isolated from the rest of the logic, and as such,
interchangeable by means of function pointers.
The same change is done for the packing/unpacking procedures, allowing
to switch between FAPI and nFAPI encoding.
This MR also reduces the amount of duplicated code, by refactoring the
VNF with Aerial, which now only has the transport-relevant functions, as
well as the ones that are unique to it ( for example, the unpacking
procedures where a secondary data buffer is used for the message
payloads )
Additionally a new callback is added to the VNF to process
ERROR.indication messages, which currently only indicates which message
originated the error, and which error occurred.
When a downlink SDU was discarded by the RLC Acknowledged Mode entity due to a full transmit buffer (tx_maxsize), the drop statistics were not being updated.
The `txpdu_dd_pkts` and `txpdu_dd_bytes` counters remained at 0.
It should be noted that while the statistics are named `txpdu_dd_*`, the drop at this stage occurs at the SDU level.
Add nr_fapi_p5 library to the simulators common library for access to the utility function `copy_config_request`
Add dummy VNF/PNF functions to be referenced by lte-softmodem, before LTE and NR implementations of the VNF/PNF are separated
Add a section in nfapi.md related to the different transport mechanisms available for VNF/PNF communication
Edit NR_NFAPI_archi.md to describe the VNF and PNF processing logic, as well as adding a flowchart for each of the components execution
Add the necessary patch to install the WLS library in the system
The changes done in this commit are to contribute the supporting changes
for the existing "Initial support for RedCap" feature in gNB.
In this patch, handle and store the RedCap related IE's present in "NR
UE Capability Information" msg which are
- 'supportOfRedCap-r17'
- 'supportOf16DRB-RedCap-r17'
- 'longSN-RedCap-r17'
- 'am-WithLongSN-RedCap-r17'
use 'longSN-RedCap-r17' and 'am-WithLongSN-RedCap-r17' IEs to set the SN
length to either 12 Bit or 18 Bit accordingly.
Previously, we only supported intra-frequency handovers, so the
measurements where only for intra-frequency, reusing the same
measurement object. Now that we would support inter-frequency handover,
also add multiple MeasObjects for each neighbor.
Add some helper functions that will be used by the MAC handler to fill
the right MeasGap configuration based on Measurement Configuration sent
by the CU, in the next commit.
Checks whether there are at least 4 bytes available to pull tag and length values.
On tlv_list unpack, if the size is sent as 0, immediately exit the function
Created a function nr_error_ind_cb for the VNF that takes a received ERROR.indication and shows some details regarding the reported error from the PNF, since up until now it was not handled and treated as an unknown message.
Proper error handling procedure not created, only shows that the error occurred.
Remove duplicated functions in fapi_vnf_p7.c, leaving only functions for messages that require usage of the secondaty data_buf for unpacking
Move vnf_info struct declaration to nfapi_vnf.h to be available in fapi_nvIPC.c
Add check to vnf_nr_handle_param_response for when phy_info is not found
The WLS VNF is in charge of Enqueueing the used blocks after usage for transport, this is done by keeping track of all blocks used, and calling WLS_Enqueue for all of them upon receiving a SLOT.indication
The common library exposes functions for the PNF to return the received blocks to the VNF for it to call WLS_Enqueue on them.
This is done in order to ensure the Blocks are returned after processing, also preventing the Dequeueing of blocks that are still being used, i.e. the internal value is not -1
All saved blocks are to be enqueued at the reception of a SLOT.indication by the VNF
Additionally, the definition of NFAPI_MAX_PACKED_MESSAGE_SIZE was moved to nfapi_interface.h and removed from the other headers, this is done to allow to set the maximum message size when using WLS by only changing the value in one place
Fixup fapi_nr_message_header_unpack call in nfapi_hex_parser
Integration: `2025.w28`
* !3517 CI: set interface name in UPF container for RFSim5G
* !3501 Fix automatic SSS detection logic
* !3503 DLSCH RB extraction: check DMRS bitmap only in DMRS symbols
* !3498 bugfix: UE AMBR is optional
* !3504 Improvements to the FHI for enabling further use cases
Closes#975
See merge request oai/openairinterface5g!3518
Recently f buffer was changed to hold packed bits and the correspoinding
change in dlsim was not done so the number of error bits before decoding
was incorrectly reported. This commit fixes it.
Improvements to the FHI for enabling further use cases
These changes to the FHI were primarily thought to enable the integration of
the intel ACC ( !3344 ) in parallel of the FHI.
I preferred to make a separate MR because I believe this topic is orthogonal
enough to be handled separately and because I wanted to bring even further
improvements.
The improvements that it actually brings are:
- Enable compiling and running xran F release with DPDK 21+
- Enable including a BBDEV device in addition of the ethernet device for the
FHI when performing EAL init, which is necessary for using the intel ACC
with the FHI.
- Fix an issue in usage of pkgconfig in xran E and F release. This enables to
reliably build xran with the version of DPDK requested to pkgconfig while
before this fix xran was always selecting the headers installed in /usr/local.
E release had the same issue of not using pkgconfig properly as F release.
This issue was fixed in F release when enabling its compatibility with DPDK 21+.
This commit brings this fix to E release.
In order to be usable in parallel of FHI 7.2, BBDEV devices should be included in the EAL initialization that is prformed by xran.
This commit adds a way of adding the BBDEV device from OAI.
Also fixes an issue with pkgconfig in xran.
Get xran stats in the trx_oran_get_stats function
and use trx_oran_get_stats upon stopping and ending RF.
Co-authored-by: Romain Beurdouche <romain.beurdouche@eurecom.fr>
Look up xran_fh_init/xran_fh_config through driver instead of peaking
into xran internals. Note that xran writes values back into these
structs during initialization, and hence it is important to store them
_after initialization_.
Some remarks regarding less obvious changes:
- slotnum is replaced by slots_in_sf: SLOTNUM_PER_SUBFRAME uses the time
duration of a slot (=interval_us_local) to calculate the numbers of
slots in a subframe, which can be done with a simple shift instead
- The prach duration should be queried from the PRACH configuration
table. The function to query the occasion info is part of the MAC
layer code while this information can be used outside of this layer.
Use header `nr_prach_config.h` to not duplicate functionality.
Co-authored-by: Romain Beurdouche <romain.beurdouche@eurecom.fr>
Split out type and function definitions for a cleaner separation for
some consumers of these functions. Concretely, nr_mac_common.h includes
various ASN.1 NR RRC headers, but not all consumers of these APIs might
need these headers. For instance, the next commit will use these
functions in the driver for 7.2 (it needs to compute PRACH length), but
the driver itself does not depend on nor does it need the ASN.1 NR RRC
headers. Defining a new header avoids the problem.
bugfix: UE AMBR is optional
This was a problem with open5gs and more than one PDU session. The core network
sets UE AMBR only once, leading to failure in the gNB for the second PDU session.
(A proper handling of AMBR has to be develop at some point in the gNB.)
The buffers are set up by the OAI xran driver, so instead of peaking
into xran internal data, access the buffers through the driver directly.
The buffers get set up through the following xran calls
In xran_5g_fronthault_config():
- src => sFrontHaulTxBbuIoBufCtrl
- srccp => sFrontHaulTxPrbMapBbuIoBufCtrl
- dst => sFrontHaulRxBbuIoBufCtrl
- dstcp => sFrontHaulRxPrbMapBbuIoBufCtrl
In xran_5g_prach_req()
- prach(dst) => sFHPrachRxBbuIoBufCtrl
- prach(dst)decomp => sFHPrachRxBbuIoBufCtrlDecomp
Note that in all cases:
- the xran buffer array is [XRAN_N_FE_BUF_LEN][XRAN_MAX_SECTOR_NR][XRAN_MAX_ANTENNA_NR]
(of [internal] type BbuIoBufCtrlStruct, but we give an sBufferList)
- the driver buffer array is [XRAN_MAX_ANTENNA_NR][XRAN_N_FE_BUF_LEN]
Hence, we switch the order of indexing, leave out the sector, and omit
the sBufferList member.
xran_get_slot_idx_from_tti() has been introduced to access data
information from xran. However, it makes no sense, as the used macros to
calculate frame, slot, subframe, are already in the public API. Hence,
use these macros directly.
It would be possible to remove xran_get_slot_idx_from_tti(), but doing
so we would need to update the patch ID, causing trouble to users.
CI: set interface name in UPF container for RFSim5G
This MR addresses an issue related to CN deployment, observed in the RFSim5G CI pipeline. Specifically, the IP addresses within the UPF container were not consistently bound to the correct network interfaces. This inconsistency led to incorrect IP address assignments for the N3, N4, and N6 interfaces, resulting in connectivity issues.
See merge request oai/openairinterface5g!3517
Fix automatic SSS detection logic
When we try to detect a specific PCI and it fails, the SSS detection returns
successful detection with wrong frequency offset.
This was a problem with open5gs and more than one PDU session.
The core network sets UE AMBR only once, leading to failure in the gNB
for the second PDU session.
(A proper handling of AMBR has to be develop at some point in the gNB.)
Integration: `2025.w27`
Closes#958
See merge request oai/openairinterface5g!3506
* !3349 Speed up docker deployment in CI
* !3360 NR UE: fix reestablishment for NTN
* !3488 Refactor F1 UE context messages, add unit tests
* !3502 bugfix for UL TBSLBRM
* !3475 Use of common functions to prepare FAPI PDUs at gNB MAC
* !3499 NR UE: enable CSI report for SISO case
* !3497 Update/refine gNB MAC stats, update L1
* remove unit test `--output-on-failure` option to avoid hitting timeout
* !3508 gNB: fix NTN UL retransmissions
* !3494 bugfix: read msg_type only after deciphering
* set `tx_amp_backoff_dB = 30;` for RFsim 2x2 to make it pass
* !3432 NR RRC Reject UE
* !3500 Various fixes for UE handling, HO doc updates
* !3398 continuously update SIB19 information for rfsim NTN LEO scenarios
continuously update SIB19 information for rfsim NTN LEO scenarios
Contains mainly these changes:
- gNB: add function nr_update_sib19() allowing to update SIB19
information
- rfsimulator: update SIB19 contents every frame for LEO channel
simulations
- NR UE: improve initial timing advance calculation from SIB19
Before, we only considered ta_Common_r17 and the SAT position from SIB19
to compute the initial timing advance value. This is good enough if the
satellite does not move too fast (e.g. GEO satellite).
Now we also consider ta_CommonDrift_r17, ta_CommonDriftVariant_r17 and
the SAT velocity together with the epoch time from SIB19. This improves
the accuracy of the initial TA computation, esp. for LEO satellite
scenarios.
Various fixes for UE handling, HO doc updates
- On release request, search both attach and connected list to free a UE.
- on DU disconnect, only release the correspnonding UE contexts.
- When no AMF for the UE, auto-release the UE (NGAP would also send an
answer, but better check first)
- implement a "grace period" before the DU/MAC automatically releases a
UE: this is to avoid cases in which (for whatever reason) the UE
release request is not honored by the CU. In order to not fill up UE
contexts unnecessarily, the DU will eventually (after 10s) drop the UE
context
- some clarification in HO tutorial
When the RA procedure fails at Msg4, we trigger UL failure and send a
message to the CU to request release. There was a bug in that upon the
ensueing release command, we did not search in the attach list (only
connected list). However, the UE failing at Msg4 does not have
transitioned to the connected list yet, thus not freeing the context.
Fixes: 8f62baefa6 ("Use list of UEs during RA instead of array of RA
processes)"
It might happen that the CU does not answer a release request. In that
case, the MAC would never free the UE context, potentially blocking the
DU. Avoid this by introducing a "grace period" after which a UE context
is automatically freed at the MAC (and RLC), currently at 10s after the
30s UL failure timer.
Mark non-existing AMF UE NGAP ID through invalid INT64_MAX number
(permitted range is up to 2^40-1). Check for this range in the RAN
function, as we might otherwise pass the invalid AMF UE NGAP ID to the
agent, which would assert with
nr-softmodem: /oai-ran/openair2/E2AP/flexric/src/lib/3gpp/enc/enc_gnb.c:83: enc_gNB_UE_asn: Assertion `gnb->amf_ue_ngap_id < 1UL << 40' failed.
In other words, don't send KPM messages for a UE which has no valid AMF
UE NGAP ID yet (which follows from the fact that the spec requires an
AMF UE NGAP ID; the previous behavior of simply sending 0 could be
considered a bug, because it's not the UE's true AMF UE NGAP ID).
rx_list is replaced by an array of size 2^(SN size - 1)
which is 131072 for an SN size of 18 bits, leading to
1048576 bytes of memory used. (Less for smaller SN sizes.)
A lot of RX processing was to run through rx_list. When the list was
big (with some non-ideal channel), it can take some time. Removing this
list should improve things. Checking with benchmark_nr_rlc_am_entity
a speedup of more thant x10 is achieved (except for the case 1024 which
is surprisingly faster than the others in the develop branch).
The only thing that may be slower is when looking for cur->next where
the SN is different, in which case we need to look for all SN one by
one until we find something or reach the limit (rx_highest_status).
These are the functions get_first_rx_pdu() and get_next_rx_pdu().
NR RRC Reject UE
Improvements in procedures to handle RRCReject message both at gNB and
UE. At gNB we send RRC Reject if the UE cannot be given resources to go
into connected mode.
bugfix: read msg_type only after deciphering
There was a problem with accessing msg_type from the input buffer before
deciphering, giving obviously wrong value.
CI team: we should add a test in the CI with NAS ciphering + integrity
(connection to the core) set to not null (I suggest nea2/nia2). With
openair's core, this is done by setting this in the amf config file
(nia1 and nea2 at the top of the list):
supported_integrity_algorithms:
- "NIA2"
- "NIA1"
- "NIA0"
supported_encryption_algorithms:
- "NEA2"
- "NEA1"
- "NEA0"
And also put full security in the AS. This is done with this in the gnb
config file:
security = {
ciphering_algorithms = ( "nea2", "nea0" );
integrity_algorithms = ( "nia2", "nia1", "nia0" );
drb_ciphering = "yes";
drb_integrity = "yes"
};
Ideally we should test this with both openair UE and cots UE. But as a
strict minimum do for openair UE (this is where the bug was).
No need to do much traffic, a few ping is enough. But if you want to
check throughput with full security, why not.
Remove this option: some tests produce an excessive amount of output on
failure (e.g., googletest/benchmark). This seems to overwhelm the Python
CI code. Suppress this output, because we can always manually run this
test. A high-level "this test is ok/nok" should be fine for the CI.
NR UE: enable CSI report for SISO case
Correct precoded_sinr_dB wrongly set to 0 for SISO case, also correct
ri_restriction is 0 when calculating CQI bit length for SISO.
Update/refine gNB MAC stats, update L1
Only applicable with -q option.
Print a number of statistics, e.g., rx_ulsch_sdu to track UL MAC stats
timing. Remove unused time_meas_t definitions, and fix the name for the
total gNB scheduler time.
Print the RU stats in nrL1_stats.log, as some are already there, and do
not "pollute" the periodic logs when -q is enabled.
I used this to see why there are sometimes late slots with Aerial. I
used the above stats to get a general overview. This additional patch
shows that at least in RFsim, the RLC indication in rx ulsch sdu can
take up to 20us on my machine. Given that we can have multiple PDUs in
UL (10?), this can amount to a sizeable amount of time. While this is
for another MR, I thought the cleanup would be nice to have.
Do not pollute periodic output, and rather print those into
nrL1_stats.log. A number of them are already there anyway, so transfer
the rest. Note: ru->ifdevice.tx_fhaul is omitted, as we don't have any
IF5 split in 5G.
Refactor F1 UE context messages, add unit tests
Add encoder+decoder+util functions for F1 UE context messages, and use
them in the stack. The overall goal is to unit test encoder+decoder (to
be sure that what we send is what we receive), and remove any memory
leaks related to F1 handling. Messages that have a unit test:
- F1 UE context setup request/response
- F1 UE context modification request/response
- F1 UE context release request/command/complete
This MR removes almost all remaining memory leaks that are observable in
a "standard" configuration, running SISO in RFsim. In RFsim (without
channel modelling), there are only two memory leaks shown in asan, one
in L1, and one in NGAP.
Speed up docker deployment in CI
- Using docker compose up --wait instead of a custom healthcheck script:
from: https://docs.docker.com/reference/cli/docker/compose/up/
--wait Wait for services to be running|healthy. Implies detached mode.
--wait-timeout Maximum duration in seconds to wait for the project to be running|healthy
- Speeding up the healthchecks by reducing the interval from 1-10s to
0.5s during start period
start_period creates a special period after the start of the container
where the healthcheck is executed every start_interval . During this
time the failures do not count towards the retries counter, but
successes change the status to healthy. This allows container to reach
healthy status much sooner.
- Using init: true to speed up docker compose down/stop
`init: true` initializes the docker container with tini or
alternative: tini is used to collect all the processes and correctly
pass the termination signal to them. This allows the docker container
to be stopped without waiting 10 seconds to kill the container
- Smallest example of this is:
services:
test-init:
image: ubuntu:jammy
command: sleep 10d
Fix concurrency issues happening when a new client connects, sometimes
leading to a total softmodem deadlock.
Key changes:
- Fix sample sending on new client connection: send the first
sample only to the newly connected client.
- Remove the --rfsimulator.hanging-workaround option
- Replace global nb_ue and Sockmutex with nb_cnx and Sockmutex
in rfsimulator_state_t for better concurrency and clarity.
We use the same resource for CSI meas report and RSRP (judging by the
name of the functions), but the memory allocations need to be separate
to avoid a double free:
==2063066==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c27d43e3ce8 at pc 0x000000fcd279 bp 0x7be7cc9e7120 sp 0x7be7cc9e7118
READ of size 8 at 0x7c27d43e3ce8 thread T6
#0 0x000000fcd278 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:97
#1 0x000000fcd278 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#2 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
#3 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
#4 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
#5 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#6 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
#7 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
#8 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
#9 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#10 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
#11 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
#12 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#13 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#14 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
#15 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
#16 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#17 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#18 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#19 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#20 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#21 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#22 0x0000009d78ae in ue_context_setup_request /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:692
#23 0x00000083fee2 in rrc_add_nsa_user /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_nsa.c:330
#24 0x000000886e8b in rrc_gNB_process_f1_setup_req /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_du.c:444
#25 0x000000833942 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2766
#26 0x7fe7d5e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#27 0x7fe7d527f1d3 in start_thread (/lib64/libc.so.6+0x711d3) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#28 0x7fe7d5301ceb in __GI___clone3 (/lib64/libc.so.6+0xf3ceb) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
0x7c27d43e3ce8 is located 24 bytes inside of 40-byte region [0x7c27d43e3cd0,0x7c27d43e3cf8)
freed by thread T6 here:
#0 0x7fe7d5ee5bcb in free.part.0 (/lib64/libasan.so.8+0xe5bcb) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
#2 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
#3 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
#4 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#5 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
#6 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
#7 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:91
#8 0x000000fcd103 in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#9 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:236
#10 0x000000fd6249 in SET_OF_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SET_OF.c:220
#11 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#12 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#13 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:185
#14 0x000000fc90c9 in CHOICE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE.c:158
#15 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#16 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#17 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#18 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#19 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:88
#20 0x000000fcd01a in SEQUENCE_free /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE.c:69
#21 0x0000009d78ae in ue_context_setup_request /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:692
#22 0x00000083fee2 in rrc_add_nsa_user /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_nsa.c:330
#23 0x000000886e8b in rrc_gNB_process_f1_setup_req /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_du.c:444
#24 0x000000833942 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2766
#25 0x7fe7d5e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
previously allocated by thread T6 here:
#0 0x7fe7d5ee6883 in calloc (/lib64/libasan.so.8+0xe6883) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x000000a1ac53 in get_default_secondaryCellGroup /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/nr_radio_config.c:3969
#2 0x0000009d8913 in create_new_UE /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:571
#3 0x0000009d8913 in ue_context_setup_request /home/richie/w/f1-refactor-ue-context/openair2/LAYER2/NR_MAC_gNB/mac_rrc_dl_handler.c:638
#4 0x00000083fee2 in rrc_add_nsa_user /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_nsa.c:330
#5 0x000000886e8b in rrc_gNB_process_f1_setup_req /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_du.c:444
#6 0x000000833942 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2766
#7 0x7fe7d5e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
Thread T6 created by T0 here:
#0 0x7fe7d5ede492 in pthread_create (/lib64/libasan.so.8+0xde492) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x0000012a4ba3 in threadCreate /home/richie/w/f1-refactor-ue-context/common/utils/system.c:283
#2 0x0000006b5fef in itti_create_task /home/richie/w/f1-refactor-ue-context/common/utils/ocp_itti/intertask_interface.cpp:317
#3 0x000000435c5f in create_gNB_tasks /home/richie/w/f1-refactor-ue-context/executables/nr-softmodem.c:310
#4 0x000000435c5f in main /home/richie/w/f1-refactor-ue-context/executables/nr-softmodem.c:620
#5 0x7fe7d52115f4 in __libc_start_call_main (/lib64/libc.so.6+0x35f4) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#6 0x7fe7d52116a7 in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x36a7) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#7 0x0000004672d4 in _start (/home/richie/w/f1-refactor-ue-context/build/nr-softmodem+0x4672d4) (BuildId: 81450e9a0b832ca9e36b1984ecc232efde59d424)
Closes: #958
Direct leak of 512 byte(s) in 1 object(s) allocated from:
#0 0x7f37634e5e2b in realloc.part.0 (/lib64/libasan.so.8+0xe5e2b) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x000000fbb9ad in encode_dyn_cb /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/per_encoder.c:23
#2 0x000000fc279e in asn_put_few_bits /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/asn_bit_data.c:220
#3 0x000000fc279e in asn_put_few_bits /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/asn_bit_data.c:192
#4 0x000000fc2ce5 in asn_put_many_bits /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/asn_bit_data.c:293
#5 0x000000fb8c33 in OCTET_STRING_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/OCTET_STRING_uper.c:306
#6 0x000000fd191a in SEQUENCE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:403
#7 0x000000fd191a in SEQUENCE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:403
#8 0x000000fcb140 in CHOICE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:177
#9 0x000000fd191a in SEQUENCE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:403
#10 0x000000fcb140 in CHOICE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:177
#11 0x000000fcb140 in CHOICE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_CHOICE_uper.c:177
#12 0x000000fd191a in SEQUENCE_encode_uper /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/constr_SEQUENCE_uper.c:403
#13 0x000000fbc1ed in uper_encode /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:27
#14 0x000000fbc73a in uper_encode_to_new_buffer /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:85
#15 0x000000e10fbd in do_RRCReconfiguration /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/MESSAGES/asn1_msg.c:586
#16 0x000000805712 in rrc_gNB_encode_RRCReconfiguration /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:652
#17 0x000000893860 in nr_rrc_f1_ho_acknowledge /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB_mobility.c:280
#18 0x0000008079ac in rrc_CU_process_ue_context_setup_response /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2139
#19 0x0000008330d8 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2771
#20 0x7f3763428ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
During refactoring, I had asan errors in the next line. It took me some
time to figure out that a DRB ID 0 is not valid (cf.
get_next_available_drb_id() and get_drb(), they enforce this).
Direct leak of 48 byte(s) in 1 object(s) allocated from:
#0 0x7fea71ee6f0b in malloc (/lib64/libasan.so.8+0xe6f0b) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x0000007f29c0 in malloc_or_fail /home/richie/w/f1-refactor-ue-context/common/utils/utils.h:86
#2 0x0000007f29c0 in cuup_notify_reestablishment /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:872
#3 0x000000808002 in rrc_CU_process_ue_context_setup_response /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2126
#4 0x0000008330d8 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2770
#5 0x7fea71e28ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
Direct leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x7f672d6e5e2b in realloc.part.0 (/lib64/libasan.so.8+0xe5e2b) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
#1 0x000000fbb4ed in encode_dyn_cb /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/per_encoder.c:23
#2 0x000000fbbeeb in _uper_encode_flush_outp /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:126
#3 0x000000fbbeeb in uper_encode /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:36
#4 0x000000fbc27a in uper_encode_to_new_buffer /home/richie/w/f1-refactor-ue-context/build/openair2/RRC/LTE/MESSAGES/uper_encoder.c:85
#5 0x00000081037c in handle_ueCapabilityInformation /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:1549
#6 0x000000813ced in rrc_gNB_decode_dcch /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:1902
#7 0x0000008334f2 in rrc_gnb_task /home/richie/w/f1-refactor-ue-context/openair2/RRC/NR/rrc_gNB.c:2741
#8 0x7f672d628ee5 in asan_thread_start(void*) (/lib64/libasan.so.8+0x28ee5) (BuildId: 7f1aa7e2e600e8c9d54ce6e3d36f3d31bfe7949a)
Move the filling of DRBs to set up for UE context setup/modification
request into the corresponding functions, and use malloc() deliberately
to avoid memory leaks. In fact fill_drb_to_be_setup_from_e1_resp()
allocates memory dynamically (and has to do that), so the easiest is to
do the same for DRBs. The most straight-forward way seems to be to then
dynamically allocate all memory for F1 UE context setup/modification
request messages, and free with the corresponding free functions,
which removes a couple of memory leaks.
Similarly to the commit "Use F1 UE context setup/modif Request in
stack", we do both UE context setup/modification response at once
because of some functions that are shared by the MAC message handler.
Use the new, tested F1 UE context setup request and modification
requests in the stack.
We have to do both at once, because there are some functions that are
used by handlers for both messages, notably
- handle_ue_context_drbs_setup()
- handle_ue_context_srbs_setup()
(+ and some functions called by those two). For instance, the first uses
the (new/old) type f1ap_drb_to_be_setup_t/f1ap_drb_to_setup_t which is
shared. The alternative would be to duplicate the functionality
temporarily, and I want to avoid unnecessary code churn.
Reintroduce separate message types to simplify the encoding/decoding,
including shorter names. The old types will be removed once everything
has been migrated to the new encoder/decoder, which should ensure that
everything is properly migrated to the unit-tested encoder/decoders.
Also, for each type of F1 message (F1 UE context setup request,
response, modification request, ...) introduce a separate type to avoid
to mistakenly use wrong fields, which can lead to bugs. In this regard,
the DL PDCP SN bit size in the DRB-ToBeSetup list of the UE context
setup request is optional, as it will also be used in the UE context
modification request DRB SetupMod list (which avoids quite some code
duplication). The encoder checks that this IE is present, though.
The previous condition was wrong: if a UE did not have the assoc_id of
the DU that connected (i.e., it was connected to another DU then the one
disconnecting), it was marked for deletion. Instead, skip those UEs.
This modification aims to improve health status detection by using PRACH IO as
an indicator of the gNB's status (container is marked as "healthy" when the
PRACH IO value in gNB nrL1_stats.log exceeds 0.0 dB.). The new condition accounts
for scenarios where the container may not exit or produce error codes (e.g.,
“sleep” logs or "error code overflow" messages).
- `init: true` initializes the docker container with tini or alternative - it is
used to collect all the processes and correctly pass the termination signal to
them, this allows the docker container to be stopped without waiting 10 seconds
to kill the container
- speeding up the healthchecks by reducing the interval from 1-10s to 0.5s during
start period
Co-authored-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
F1AP_LIB_FIND_IE() is used to look up elements in a list, but was
hitherto hardcoded to use "protocolIEs" as an intermediate struct. A
follow-up commit will use this macro where we don't have protocolIEs,
but "iE_Extensions". Hence, modify to make it work for that case (and
others) as well.
Introduce generic _F1_CHECK_EXP(), which is like the macros for checking
values (_F1_EQ_CHECK_INT() etc). Reuse the same for introducing
_F1_EQ_CHECK_OPTIONAL_IE that will be used to write the check for
optional fields more concisely.
CP_OPT_BYTE_ARRAY() FREE_OPT_BYTE_ARRAY() are macros to wrap handling of
optional byte arrays.
_F1_MALLOC() simplifies allocations and is similar to asn1cCallocOne(),
but provided to avoid confusion (since more than ASN.1 structures will
use it).
All will be used in the following commits.
Switches the used socket type in pnf_interface.c and vnf_interface.c.
These values must always be the same in both components so the same socket type is used in both
Adds 3 new function pointers to the P5 and P7 VNF structures, allowing to configure which function to use to pack/unpack the messages, as well as unpack the message header, being then used seamlessly regardless of using the FAPI or nFAPI functions.
Adds 3 new function pointers to the P5 and P7 PNF structures, allowing to configure which function to use to pack/unpack the messages, as well as unpack the message header, being then used seamlessly regardless of using the FAPI or nFAPI functions.
Changes the header unpack and message unpack functions to return true on success and false on failure, instead of an int
This change is done in preparation to add the header unpack functions to the VNF and PNF structures as function pointers, used to peek the message headers prior to processing.
Add a faux fapi_nr_p7_message_header_unpack with the same signature as nfapi_nr_p7_message_header_unpack, to be used for the P7 header unpack function pointer.
Integration: `2025.w26`
See merge request oai/openairinterface5g!3493
* !3435 Cleanup PDU Session Handling in RRC/NGAP
* !3371 Add NAS Authentication Reject enc/dec library and unit test
* !3490 nr pdcp security: add a 'decipher' API function
* !3477 CI: Upgrade Aerial version to 25-1
* !3491 Fix Msg3 with MAC CE for C-RNTI and RRCReestablishmentComplete
Print a number of statistics, e.g., rx_ulsch_sdu to track UL MAC stats
timing. Remove unused time_meas_t definitions, and fix the name for the
total gNB scheduler time.
Fix Msg3 with MAC CE for C-RNTI and RRCReestablishmentComplete
- Only trigger RRCReconfiguration if UE is not performing RRCReestablishment
- The RRCReconfiguration will be triggered by the RRCReestablishmentComplete
Since this MR fixes a regression, additional info can be found in the following
closed issues and merged MR:
- #687 (closed)
- #747 (closed)
- !2600 (merged)
CI: Upgrade Aerial version to 25-1
- Update the Nvidia L1 (cuBB) from version 24-3 to 25-1
- Decrease the number of cores dedicated to the OAI gNB; testing showed
it does not need that many
This fixes a lifelock in nr_ue_get_sdu(), because select_logical_channels() would select
a suspended LCID for scheduling, but fill_mac_sdu() would not provide data for it.
Cleanup PDU Session Handling in RRC/NGAP
Currently, NGAP and RRC share the same structures and responsibilities when
handling PDU Session information: this creates tight coupling, redundancy, and
makes the code harder to maintain.
- NGAP should be responsible only for: Protocol-specific encoding/decoding
(3GPP TS 38.413)
- RRC should own: PDU Session handling and storage in the UE context
This MR is the first step in a broader refactoring of the PDU Session handling
code across NGAP and RRC layers, with the goal of splitting responsibilities
cleanly between both modules.
- Unified gtpu_tunnel_t for tunnel endpoint config (formerly f1u_tunnel_t)
- Refactored and relocated PDU Session struct definitions for better separation
between NGAP and RRC
- Moved pdusession_t for PDU Session handling out of NGAP, now defined and
managed by RRC only
- Defined 3GPP TS 38.413 message-specific structs in NGAP module
- NGAP now decodes NGAP PDU Session Resource Setup/Modify IEs and transfers
decoded data to RRC via ITTI
- Add helper functions to copy from NGAP message to pdusession_t
- Introduced new encoders/decoders/helpers in NGAP for handling PDU Session
Resource Setup/Modify procedures (e.g. decode_pdusession_transfer)
- Migrated to NGAP and removed duplicated logic for QoS information decoding
(fill_qos)
- Improved logging of GTP tunnel info
- Merged redundant functions (f1u_dl_gtp_update and f1u_ul_gtp_update)
- Removed unused code and obsolete types
- do free_func in seq_arr_erase_it on the provided range and updated unit test
- Other fixes and simplifications (e.g. simplified and clarified naming of
tunnel/session parameters and structs)
This cleanup improves code readability, has a high code churn (the deletions are
~159.7% of the insertions) and prepares for better modularity before the
refactoring of PDU Session handling in RRC/NGAP.
Add NAS Authentication Reject enc/dec library and unit test
This MR introduces the library for encoding/decoding of NAS Authentication
Reject (8.2.5.1 of 3GPP TS 24.501) and relevant unit test.
The message is sent by the AMF to the UE to indicate that the authentication
procedure has failed. A NAS handler was also introduced.
The implementation is limited to epoch times that are not more than 5.12 seconds in the future (allowed are up to 10.24 seconds)
and ntn-UlSyncValidityDuration < 5.12 seconds (allowed are up to 90 seconds).
To fix this limitation, the hyper frame number HFN has to be introduced at the OAI UE!
Before, we only considered ta_Common_r17 and the SAT position from SIB19 to compute the initial timing advance value.
This is good enough if the satellite does not move too fast (e.g. GEO satellite).
Now we also consider ta_CommonDrift_r17 and the SAT velocity together with the epoch time from SIB19.
This improves the accuracy of the initial TA computation, esp. for LEO satellite scenarios.
During reestablishment the UE goes back to not synchronized state.
While the synchronizatin is running, we trash frames using the function readFrame().
And when we successfully synchronize, we skip samples to align with the start of the frame using syncInFrame().
In rfsimulator mode, both of these functions send dummy data using the function dummyWrite().
Unfortunately, the writeTimestamp provided to that function was always assuming a duration from RX to TX of NR_UE_CAPABILITY_SLOT_RX_TO_TX.
But in NTN mode, this value is changed when receiving SIB19.
Therefore we have to consider this changed value instead of the static one.
CI: Add "may_fail" step to execute flaky steps
Add a generic may_fail CI XML step option that indicates the CI step may
fail, but the CI would still be marked as succeeded (instead of skipping
all steps and mark as failed). The cause of this failure depends on the
specific step, e.g., Iperf failing because of low throughput. This
allows to clean up some code and e.g. remove the command_fail option of
Custom_Command, which is then superfluous (and less generic). An
inconvenience is that those may_fail steps will be marked as "failed" in
the HTML. Later cleanup can correct this.
The may_fail is used for executing FHI7.2 testing to push 700 Mbps in DL
(close to the maximum).
Fix some bugs and add some clean up, see commit messages.
Enabling usage of ulsyncvalidityDuration timer in SIB19
ntn-UlSyncValidityDuration in SIB19 from Spec 38.331 v17.12 A validity
duration configured by the network for assistance information which
indicates the maximum time duration (from epochTime) during which the UE
can apply assistance information without having acquired new assistance
information. The unit of ntn-UlSyncValidityDuration is second. Value s5
corresponds to 5 s, value s10 indicate 10 s and so on.
ntn-UlSyncValidityDuration-r17 ENUMERATED{ s5, s10, s15, s20, s25, s30, s35,s40, s45, s50, s55, s60, s120, s180, s240, s900}
Implementation of epochtime is under discussion.
It can be configured in configuration file according to the above
enumeration. For GEO - 240s, MEO - 20s, LEO-5s can be used.
Handle authentication not accepted by the network. The handler assumes the message
is not integrity protected, processes the received NAS message and logs whether a
EAP-failure is enclosed. The UE enters state: 5GMM-DEREGISTERED.
Not done in this commit: the UE shall performs actions as per 5.4.1.3.5 of
3GPP TS 24.501, including (1) Abort any ongoing 5GMM procedure
(2) Stop all active timers: T3510, T3516, T3517, T3519, T3520, T3521
(3) Delete stored SUCI. (4) handle EAP-failure message.
- This is to avoid the Docker image builder from being confused in case we have multiple nvIPC files in `/opt/nvidia-ipc`
- This occurs when we have an MR to upgrade the cuBB image
USRP lib: fix incorrect config check for time_source fallback
Corrected a logic bug in usrp_lib.cpp where the code mistakenly checked
openair0_cfg[0].clock_source instead of time_source when a time_source
was already specified in usrp_args.
Also improved the warning log to clarify that the config value is being
ignored in favor of the explicit user-provided usrp_args.
Co-authored-by: Alexandre Serio alexandre.j.serio@altice.pt
NAS Registration Reject: Add bounds and lengths checks
This change adds lengths checks to the received registration reject
message and also performs a bounds check for the received cause.
Since the cause is not checked, any string in the memory can be
dereferenced, possibly leading to DoS.
Signed-off-by: Eduard Vlad eduard.vlad@rwth-aachen.de
Finalize FAPI dump functions, add Digital Beamforming Table and Precoding Matrix
Table to CONFIG.request
This MR finalizes the addition of dump utility functions for the PARAM.response,
CONFIG.request, CONFIG.response, TX_DATA.request and UCI.indication messages.
These functions are intended to be used to aid in debugging FAPI messages between
the VNF and the PNF by printing out every parameter in a more readable form,
instead of a simple hexdump. These are also used by the nFAPI Hex Parser utility,
to be able to debug an Hex dump provided from elsewhere.
Furthermore, this MR also adds the necessary logic to send/receive the Digital
Beamforming Table and Precoding Matrix Table, this in the CONFIG.request message.
This is achieved by the addition of 2 Vendor Extension TLVs (0xA002 and 0xA003),
in order to be able to reuse existing logic to pack/unpack the data. Note: The
present implementation predicts the existence of multiple instances of the
Precoding Matrix Table via the parameter num_pm_idx, whic is not present in the
SCF specification. Note: The created TLVs are only used to ease the pack/unpack
procedure, by allowing to reuse already existing logic for other TlVs, the tag
and length are not sent.
The necessary additions to the utility functions are done to account for these
table. The CONFIG.request unitary test is changed to fill these tables with
randomized data to test transport and copy.
Motivation of the commit:
Previously, the RRC module on the NGAP interface directly handled ASN.1 decoding
of NGAP PDU Session Resource items, that was directly stored in pdusession_t, i.e.
in the UE context. Decode logic between Setup and Modify was also duplicated.,
e.g. fill_qos/fill_qos2. The idea behind this change is to achieve this flow:
(1) NGAP handler: decoding (2) ITTI to RRC: transfer decoded message (3) RRC
handler: process decoded message, e.g. store in UE context, etc..
The goal of this commit is to:
* improve the NGAP decoding library by adding decoding functions
* let RRC handle the already decoded data
* enhance error handling, with decode failures now consistently detected and rejected early
* have a cleaner, more maintainable code with fewer duplications and a clearer separation of modules
Changes:
* Moved all ASN.1 decode logic for PDU Session Resource items into the NGAP library
* Introduced decode functions for NGAP IEs whenever necessary, e.g. decode_TNLInformation
decode_pdusession_transfer
* Removed duplicate fill_qos functions and centralized QoS handling in NGAP
* Added function to copy from NGAP PDU Session Resource item to RRC pdusession_t: this actually
replaces decodePDUSessionResourceSetup in RRC, copying from the decoded NGAP struct to
the UE context pdusession_t
Motivation:
The previous code had overlapping and partially inconsiste definitions of
`pdusession_t` and related structures across NGAP and RRC. This struct type
was used for either the data stored in the UE context and the NGAP message
IEs holding the PDU session to setup/modify information.
This patch aims to separte the `pdusession_t` in RRC, where it logically belongs,
since RRC owns the state of the PDU sessions. NGAP should only
deal with protocol messages, i.e. enc/dec and transfer structures to RRC.
This clarifies module ownership. This also makes the code easier to maintain.
Changes:
* Moved `pdusession_t` definition from NGAP (`ngap_messages_types.h`) to RRC
(`nr_rrc_defs.h`)
* Added a simpler `pdusession_resource_item_t` structure to NGAP for use in
protocol messages
* Adjusted NGAP structures accordingly (Initial Context Setup, PDU Session
Setup Request, and PDU Session Modify Request).
* do decodePDUSessionResourceSetup to decode the NGAP IEs holding PDU session
information and store what necessary in the UE context PDU Session IE: NOTE
this changes were necessary since previously this function was acting on
the common NGAP/RRC pdu_session_t struct
Rename the struct members:
`pdusession_param` to `pdusession` in NGAP Initial Context Setup Request
`pdusession_setup_params` in `ngap_pdusession_setup_req_t`
`pdusession_modify_params` and `ngap_pdusession_modify_req_t`
Motivation:
Clarify the role of GTP tunnel endpoint IDs in PDU session handling. Previously,
the struct members (gNB_teid_N3, UPF_teid_N3, etc.) were confusingly named and
duplicated with separate transport-layer address fields.
This refactoring replaces these with explicit n3_incoming and n3_outgoing members using
gtpu_tunnel_t. This aligns with GTP conventions: "incoming TEID" refers to the
TEID received from the remote peer (UPF on N3), while "outgoing TEID" is the
TEID sent by the local entity (NG-RAN on N3) to the remote peer.
Benefits:
* Improves readability and clarity of the code
* Reduces redundant struct members, i.e. remove UPF_teid_N3, UPF_addr_N3
* Aligns naming with 3GPP conventions for transport layer tunnels
Changes:
* Replace gtp_addr_N3, gNB_teid_N3, gtp_teid, upf_addr with n3_incoming and n3_outgoing
* Update all related code to use the new struct members
* Aligns naming with 3GPP conventions for transport layer tunnels
This struct is used in different layers, e.g. RRC, NGAP: therefore it
has been moved to platform_types.h.
Also, the struct holds the tunnel endpoint configuration for any GTP-U
tunnel, therefore the f1u prefix is not accurate and was updated
to a more generic gtpu.
* Remove drb_is_active: function is unused and the logic will be later
added to another function to add DRBs if necessary
* Remove unused NGAP structs and empty TODO functions
* Remove unused pdusession_setup_req_t struct definition
The seq_arr_erase_it function was modifying start_it during the free_func loop,
which led to incorrectly apply the free_func on the whole array.
This commit makes sure the elements "freed" are only those in the range and not the whole seq_arr.
* Fixes the logic by introducing a temporary iterator for the free loop,
preserving start_it and end_it for correct offset calculations.
* Adds a regression test in test_seq_arr to verify that only the selected
subrange is erased and that free_func is called exactly on that range.
DL NAS Transport: Fix Message Type retrieval on too short message
The change addresses the SM message type retrieval for DL NAS Transport
messages. The assumption of an offset 17 = 7 (MM Sec) + 3 (MM Plain) + 1
(IEI) + 2 (Len) + 4 (SM) is correct.
However, if the DL NAS Transport is received in a plain header, the
lengths would not add up anymore. (This is not complying with the
standard, so not allowed, but possible). The check for the length is
necessary to not process arbitrary memory contents beyond the
pdu_buffer.
Suspend RBs at UE
In case of suspended radio bearer (by RRC), the MAC needs to discarded received
PDUs and avoid to transmit using LCID related to that RB
"multi-ue profile" was a specific iperf option to do iperf across
multiple UEs. However, this is not necessary anymore, the Iperf
handling multiple UEs "implicitly" (based on the number of UEs).
As of the parent commit, there is a generic "may_fail" option through
which we could still ignore an error. Thus, command_fail is superfluous,
and avoids some extra code.
Further, in all these cases, we should better be informed about any
error, so let's not use may_fail for these tests.
There might be various occasions where a CI step should be attempted to
be executed, despite a chance of failing. For instance, we might want
to try executing an instable Iperf test, and still mark the CI as
passing if it fails.
This commit introduces a generic "may_fail" option that will mark any CI
test as succeeded, despite having failed.
Ideally, we would print a warning in the HTML code, but this is not
possible because each step emits its own HTML code, instead of the main
loop handling this. We can improve this in the future.
SPEC 38.331 section 5.2.2.6
Inform MAC that UL SYNC got lost because of T430 expiry
- Send message NR_MAC_RRC_CONFIG_RESET with cause UL_SYNC_LOST_T430_EXPIRY to MAC
Reacquire SIB19 after T430 expiry
This is not checked in this commit
- RACH needs to be performed through probably PDCCH order to reobtain UL-SYNC
- system usecase involving Recovery from T430 expiry not tested yet as that requires changes on gNB side.
Spec 38.331 section 5.2.2.4.21 indicates this
1> start or restart T430 for serving cell with the timer value set to ntn-UlSyncValidityDuration for the serving cell
from the subframe indicated by epochTime for the serving cell;
NOTE: UE should attempt to re-acquire SIB19 before the end of the duration indicated by ntn-UlSyncValidityDuration and epochTime
Epochtime IE
When explicitly provided through SIB, or through dedicated signaling, the EpochTime is the starting time of a DL
sub-frame, indicated by a SFN and a sub-frame number signaled together with the assistance information.
For serving cell, the field sfn indicates the current SFN or the next upcoming SFN after the frame where the message indicating the epochTime is received.
This field is mandatory present when ntn-Config is provided in dedicated configuration.
gNB implementation related to epochtime will be done in a separate merge request.
Adds the packing and unpacking functions needed for the PM Table in CONFIG.request
This table tag is specified in SCF222.10.06(0x104B), previous versions didn't have a tag for this table, and this version of the spec introduces the parameter `num_pm_idx`, previously not present.
A struct nfapi_nr_pm_tlv_ve_t is added to represent this TLV in order to be able to use the pack_nr_tlv function.
The necessary additions to the utility functions are done to account for this table.
The unitary test is changed to fill this table with randomized data to test transport and copy.
Adds the packing and unpacking functions needed for the DBT Table in CONFIG.request
This table tag is specified in SCF222.5.0 (0x1043) and this tag is used to transport the table, previous versions did not include a tag for the table.
A struct nfapi_nr_dbt_tlv_ve_t is added to represent this TLV in order to be able to use the pack_nr_tlv function.
The necessary additions to the utility functions are done to account for this table.
The unitary test is changed to fill this table with randomized data to test transport and copy.
NR UE fallback to RRCSetup from RRCReestablishment
Implementation of the procedure to handle reception of RRCSetup as response
to RRCReestablishment request
Step 004000 appears double in the XML description. Remove one to avoid
that it is executed twice (because the Python code goes through the list
of test descriptions and executes all that match the current ID =>
double if appears twice).
Corrected a logic bug in usrp_lib.cpp where the code mistakenly checked
openair0_cfg[0].clock_source instead of time_source when a time_source
was already specified in usrp_args.
Also improved the warning log to clarify that the config value is being
ignored in favor of the explicit user-provided usrp_args.
Co-authored-by: Alexandre Serio <alexandre.j.serio@altice.pt>
Integration: `2025.w24`
Closes#965
See merge request oai/openairinterface5g!3476
* !3354 Preparation Work for N2 Handover
* !3383 Add configurable values of NR RLC and NR PDCP to the configuration file
* !3468 Resolve "SSB frequency at gnb.sa.band78.fr1.24PRB.usrpb210.conf is invalid"
* !3466 YAML related updates
* !3460 SRS configuration
* !3474 Fix AMF selection fallback by PLMN ID when no UE identity is present or matching
* !3473 Fix various bugs and inconsistencies in config read, SCTP, ITTI, GTP
* !3169 NR RU improvements for analog beamforming
* !3456 CI: update config for AW2S pipeline
* !3369 Add Security Mode Reject lib/unit test and adopt in stack
* !3457 Fix NR reestablishment
* !3412 [E2 agent] E2AP README update and OAI-FlexRIC CI pipeline improvements
[E2 agent] E2AP README update and OAI-FlexRIC CI pipeline improvements
- E2AP README - add OSC nearRT-RIC section; update with proper FlexRIC
links, and explanations on prerequisites, as well as for xApps
- OAI-FlexRIC CI - use separate containers for xApps
- add reference files for CU-UP/CU-CP
- add logging for KPM NSSAI condition
Fix NR reestablishment by implementing the "DRB-suspend" at the MAC.
This means that the during reestablishment, gNB MAC discards received
DRB packets, and does not schedule DRB. Fix a couple of additional
issues in reestablishment. # Please enter a commit message to explain
why this merge is necessary,
For additional information, see
https://gitlab.eurecom.fr/oai/openairinterface5g/-/merge_requests/2668#note_119369
The spCellConfig is to be dropped during reestablishment and to be
applied after reconfiguration. Implement this using the
RRCReconfigurationComplete acknowledgment from the CU to the DU,
applying the spCellConfig if present (which signals a prior
reestablishment). Remove a prior flag that is not needed anymore, and
do not "guess" when is the reconfiguration, because it is now handled in
the case of the ack.
The spCellConfig is not relevant as long as we use a common search space
for DCIs (and the activation of dedicated search space happens after
applying spCellConfig). For PUCCH, there is the PDSCH transmission of
RRCReconfiguration which gets ack'ed in the default PUCCH.
RRCReconfigurationComplete is sent in PUSCH (again through common
search space). In theory, there cannot be another PUCCH before the
application of spCellConfig, as all bearers are still suspended, and
there should not be another SRB1 transmission in the meantime, as only
one RRC transaction can be active at a time.
Co-authored-by: francescomani <email@francescomani.it>
Add a flag for each RB that tracks suspension state. Mark all RBs
(except SRB1) as suspended on reestablishment, and de-suspend on
reconfiguration. Only check RLC status for non-suspended RBs. For UL
data traffic, check that DRB/SRB2 exist (SRB1 should be there as soon as
the UE context exists).
Add Security Mode Reject lib/unit test and adopt in stack
This MR is adding the library for the NAS Security Mode Reject, and
relevant unit test.
The UE shall send a SECURITY MODE REJECT containing a 5GMM cause that
typically indicates one of the following cause values: (23) UE security
capabilities mismatch. (24) security mode rejected, unspecified
- The message shall be protected if a security context is available.
- The message is adopted in the handling of Security Mode Command failure.
See 3GPP TS 24.501 5.4.2.5 "NAS security mode command not accepted by
the UE".
This MR includes changes from !3262:
> This patch series addresses a security issue where the UE improperly
> accepts a Security Mode Command (SMC) without an authentication header
> (Security Header 0). This behavior violates TS 24.501 and enables an
> attacker to bypass authentication, set integrity protection to NULL
> (NIA0), and reconfigure the UE without proper verification.
>
> We identified the following issues:
>
> 1. The UE currently accepts unauthenticated SMC messages, even
> allowing NIA0 and EIA0 to be set outside emergency mode.
> 2. When applying NIA0, the MAC field remains uninitialized,
> consistently containing the sequence 0xFF3F0000, making it feasible
> to bypass authentication and enforce insecure configurations.
> 3. The UE does not properly signal security mode failures to the Core
> Network.
>
> This patch series tries to address the above-mentioned issues:
>
> 1. Reject unauthenticated SMC messages, enforcing the requirement that
> they must be integrity-protected.
> 2. Validate MAC before applying security settings, ensuring that only
> authenticated messages are accepted.
> 3. Tear down the security context if an integrity check fails.
> 4. Introduce the Security Mode Reject message to inform the Core
> Network of failed SMC procedures, as required by TS 24.501.
This change performs the algorithm rejection in the corresponding NAS
handler for 5G, since the protocol definitions differ between LTE and
5G, regarding NIA0/EIA0 user plane traffic.
Therefore, for 5G NIA0 is rejected, since it is not allowed under normal
circumstances, while LTE user plane traffic can indeed have EIA0
selected.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
It is not allowed to accept an unauthenticated SMC message,
as this effectively bypasses all security measures and
enables a malicioius attacker to compromise the confidentiality
and integrity of exchanged messages.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Co-authored-by: Guido Casati <hello@guidocasati.com>
Retrieving the mac is necessary during the handling of the SMC, since the
context is generated from the specified keys therein. Therefore, it is
necessary to check the MAC right after generation and ensure the authenticity
of the message. If it is not given, the message must be rejected.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Co-authored-by: Guido Casati <hello@guidocasati.com>
This is necessary to indicate to the Core network, that
the security mode command procedure has failed.
Check for the security context presence when generating the Security Mode
reject message: according to 3GPP TS 24.501 5.4.2.5 "NAS security mode command
not accepted by the UE" The UE shall send a SECURITY MODE REJECT containing
a 5GMM cause that typically indicates one of the following cause values:
(23) UE security capabilities mismatch
(24) security mode rejected, unspecified
The message shall be protected if a security context is available
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Co-authored-by: Guido Casati <hello@guidocasati.com>
This 5GMM message is required for an invalid security mode command,
e.g. when the MAC integrity fails, or the wrong Security Header is set.
* Add encode/decode functions for common IEs in fgmm_lib: this library
provides encoding/decoding helpers for IEs shared across multiple
NAS messages. The goal is to avoid the legacy approach of creating
separate files per IE
* add NAS Cause enc/dec lib
* Adopted byte_array_t to handle the buffer
Co-authored-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
Fix various bugs and inconsistencies in config read, SCTP, ITTI, GTP
Fix bugs across various layers, mostly layer 3, including memory leaks.
See the commits for more details.
Fix AMF selection fallback by PLMN ID when no UE identity is present or matching
If a mask is present (i.e., not zero), AMF selection by PLMN ID may
still fail, causing the AMF selection process to skip the fallback
option, i.e. selection by PLMN ID, when no UE identity is available or
when no match is found.
This MR adds also warnings in case there's a match for the AMF is not
found.
SRS configuration
- Fix segmentation fault, a memory leak, and LOGs for SRS usage
NFAPI_NR_SRS_BEAMMANAGEMENT
- Refactor SRS configuration;
- Add SRS ResourceSet to get the SNR measurements at MAC layer
In this MR we have 2 SRS ResourceSet, for the same SRS Resource. This
way, in addition to obtaining the UL-RI, we also obtain the SNR in the
MAC and fill the PRB Black list.
This branch has been tested with COTS UE and with RFSim. The measured
values seem correct.
Using the USIM interface in the MAC is non-sensical (violates layer
separation). Add header include in nr-softmodem.c, which previously came
through nr_mac_gNB.h -> usim_interface.h.
Avoid leaking memory upon failed socket binding by calling
freeaddrinfo() before exiting in error cases.
Fixes leak:
Direct leak of 64 byte(s) in 1 object(s) allocated from:
#0 0x0000004ac038 in malloc (/home/richie/oai/cmake_targets/ran_build/build/nr-softmodem+0x4ac038) (BuildId: 875d6e5bc54d7c89bdcf151452f12703cb6fd110)
#1 0x7f0fdd92e2a6 in getaddrinfo (/lib64/libc.so.6+0x1202a6) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#2 0x00000043d7ad in getaddrinfo (/home/richie/oai/cmake_targets/ran_build/build/nr-softmodem+0x43d7ad) (BuildId: 875d6e5bc54d7c89bdcf151452f12703cb6fd110)
#3 0x000000700c73 in udpServerSocket(openAddr_s) /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:486:17
#4 0x000000700c73 in gtpv1Init /home/richie/oai/openair3/ocp-gtpu/gtp_itf.cpp:546:10
#5 0x000000c692b8 in cuup_init_n3 /home/richie/oai/openair2/E1AP/e1ap.c:744:61
#6 0x000000549ea1 in create_gNB_tasks /home/richie/oai/executables/nr-softmodem.c:320:7
#7 0x000000549ea1 in main /home/richie/oai/executables/nr-softmodem.c:619:15
#8 0x7f0fdd8115f4 in __libc_start_call_main (/lib64/libc.so.6+0x35f4) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#9 0x7f0fdd8116a7 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x36a7) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
#10 0x000000408524 in _start (/home/richie/oai/cmake_targets/ran_build/build/nr-softmodem+0x408524) (BuildId: 875d6e5bc54d7c89bdcf151452f12703cb6fd110)
This printf just shows which config sections are being read, but this
has no useful information for a user. It was introduced in 7731f5bd2d
but was not present prior to this commit, either.
YAML related updates
- Add common function config_common_getdefault
- Handle exceptions from the yaml-cpp library, transform them into
understandable errors written to stderr
- Add some unit tests.
Add configurable values of NR RLC and NR PDCP to the configuration file
This is for the gNB (the UE gets the values from the gNB).
The physical simulators were also adapted (we put the previously
hardcoded values that were everywhere in the code into the simulators
themselves). I don't think we need to have those values configurable for
the simulators, but I can study the possibility to add this if someone
tells me it's important (if not important I prefer not to do it, I am
not sure if it is trivial to do or not).
Preparation Work for N2 Handover
This MR introduces preliminary improvements to support !3334.
Refactored utility NGAP functions
- Moved allocAddrCopy to NGAP utilities
Decoding Functions for NGAP IEs:
- Added common decoding functions (decode_ngap_guami,
decode_ngap_UEAggregateMaximumBitRate, decode_ngap_nssai, etc.)
- Adopted these functions across the NGAP stack
Improvements to RRC and Handover Handling:
- Enhanced get_neighbour_cell_information and get_neighbour_config to
differentiate input parameters (cell by NR Cell ID vs. gNB by PCI)
- Used byte_array_t in nr_initiate_handover
- Introduced RRCReconfigurationParams_t to structure RRCReconfiguration
IEs
- Added a function to build NR_RRCReconfiguration_IEs_t
- Adopted this approach in do_RRCReconfiguration and refactored the
function
- Refactored the handling of Dedicated NAS message list
- Add masterKeyUpdate handling in RRCReconfiguration generation
PDCP Re-Establishment Improvements:
- Enabled PDCP re-establishment for SRB1/SRB2 based on a bitmap in
createSRBlist (3GPP TS 38.331 RadioBearerConfig)
NH & KgNB Key Management:
- Added NH derivation function as per 3GPP TS 33.501 A.10
- Moved KgNB derivation function to key_nas_deriver utilities
Add the ability to pack/unpack 2 new TLVs for analog beamforming
total_num_beams_vendor_ext and analog_beam_list
Add the unpack related changes for the first 2 vendor extension TLVs introduced related to beamforming.
For the moment the packing is guarded by an Assert to ensure it is not used.
Add the necessary utility function changes to support these VE TLVs
Add the necessary changes to the corresponding unitary test for pack/unpack,
commented for the moment, since the packing is disabled with an Assert.
The mask could be present, .e.g not zero, but the selection of the AMF could
fail. This would lead to a skipping the selection of the AMF by PLMN ID,
which is the last option when no UE identity is present and/or matching.
Free memory allocated in NGAP after use in RRC.
Direct leak of 29 byte(s) in 1 object(s) allocated from:
> #0 0x7f11200b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
> #1 0x558b7fcd0137 in malloc_or_fail /n2-handover-preparation/common/utils/utils.h:86
> #2 0x558b7fcd0137 in create_byte_array /n2-handover-preparation/common/utils/ds/byte_array.c:32
> #3 0x558b7fdb7a5c in rrc_gNB_send_NGAP_NAS_FIRST_REQ /n2-handover-preparation/openair2/RRC/NR/rrc_gNB_NGAP.c:183
> #4 0x558b7fd2ab30 in rrc_gNB_process_RRCSetupComplete /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:439
> #5 0x558b7fd2ab30 in handle_rrcSetupComplete /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1715
> #6 0x558b7fd63e23 in rrc_gNB_decode_dcch /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1851
> #7 0x558b7fd8b4c3 in rrc_gnb_task /n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2718
> #8 0x7f111ea94ac2 in start_thread nptl/pthread_create.c:442
ASN_SEQUENCE_ADD is calling realloc which is allocating memory for the
'array' which was not freed.
> Direct leak of 32 byte(s) in 1 object(s) allocated from:
> #0 0x7ce97deb4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> #1 0x5813fba02574 in asn_set_add /openairinterface5g/n2-handover-preparation/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27
> #2 0x5813faf6c672 in createSRBlist /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:331
> #3 0x5813faf9aa78 in rrc_gNB_generate_RRCSetup /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:421
> #4 0x5813fafba2ee in rrc_handle_RRCSetupRequest /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:1243
> #5 0x5813fafba2ee in rrc_gNB_process_initial_ul_rrc_message /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2019
> #6 0x5813fafcdc3a in rrc_gnb_task /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2761
> #7 0x7ce97c894ac2 in start_thread nptl/pthread_create.c:442
> Direct leak of 32 byte(s) in 1 object(s) allocated from:
> #0 0x7ce97deb4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
> #1 0x5813fba02574 in asn_set_add /openairinterface5g/n2-handover-preparation/cmake_targets/ran_build/build/openair2/RRC/LTE/MESSAGES/asn_SET_OF.c:27
> #2 0x5813faf6c672 in createSRBlist /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:331
> #3 0x5813faf7d89d in get_RRCReconfiguration_params /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:660
> #4 0x5813faf914b3 in rrc_gNB_generate_dedicatedRRCReconfiguration /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:716
> #5 0x5813faf96856 in rrc_CU_process_ue_context_setup_response /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2190
> #6 0x5813fafcd3ed in rrc_gnb_task /openairinterface5g/n2-handover-preparation/openair2/RRC/NR/rrc_gNB.c:2796
> #7 0x7ce97c894ac2 in start_thread nptl/pthread_create.c:442
dynamically allocated memory is pushed to the seq_arr that
is doing a memcpy, so it can be either or better allocated
in the stack instead
> Direct leak of 16 byte(s) in 1 object(s) allocated from:
> #0 0x7efd8f6b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> #1 0x577888f3457e in fill_neighbour_cell_configuration /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:1914
> #2 0x577888f3457e in RCconfig_NRRRC /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2108
> #3 0x57788869a0d2 in create_gNB_tasks /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:253
> #4 0x57788869a0d2 in main /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:619
> #5 0x7efd8e029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
the dynamically allocated memory is pushed to the seq_arr that
is doing a memcpy, so it can be either or better allocated in the
stack instead
> Direct leak of 48 byte(s) in 1 object(s) allocated from:
> #0 0x7d4c934b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> #1 0x577622a40137 in fill_neighbour_cell_configuration /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:1933
> #2 0x577622a40137 in RCconfig_NRRRC /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2109
> #3 0x5776221a30f2 in create_gNB_tasks /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:253
> #4 0x5776221a30f2 in main /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:619
> #5 0x7d4c91e29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
seq_arr_push_back is doing a memcpy so locally allocated memory can be freed after.
Allocate in stack.
> Direct leak of 64 byte(s) in 2 object(s) allocated from:
> #0 0x7ec4bb8b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> #1 0x55895aae1b1f in fill_measurement_configuration /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2015
> #2 0x55895aae1b1f in RCconfig_NRRRC /openairinterface5g/n2-handover-preparation/openair2/GNB_APP/gnb_config.c:2112
> #3 0x55895a246112 in create_gNB_tasks /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:253
> #4 0x55895a246112 in main /openairinterface5g/n2-handover-preparation/executables/nr-softmodem.c:619
> #5 0x7ec4ba229d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
Inside of passing the RRCReconfiguration buffer, call RRCReconfiguration
message generation inside the F1 callback. This will simplify the code in the
rrc_CU_process_ue_context_setup_response() function once the N2 handover case
is introduced. In rrc_CU_process_ue_context_setup_response(), with presence
of the HO context, the HO ACK callback is called only once and depending
on the type of HO it will do either RRCReconfiguration for F1 and
HandoverCommand for N2.
The byte_array reference contains the pointer to the
encoded RRC buffer to be used in the handover acknowledge
callback (e.g. in F1 to trigger RRCReconfiguration)
This is necessary because the function was re-establishing PDCP only for SRB2
however according to specs 3GPP TS 38.331 RadioBearerConfig, PDCP shall be
re-established for SRB1 and/or SRB2 whenever the security key used for the
radio bearer changes, with some exceptions for SRB1 (i.e. when resuming
an RRC connection, or at the first reconfiguration after RRC connection
reestablishment in NR, do not re-establish PDCP for SRB1).
* the input param "reestablish" is converted into a bitmap to indicate
whether PDCP should be re-established for the SRB1 and/or SRB2.
* For convenience the bitmap is 0-based, with index 1 corresponding to SRB1,
index 2 to SRB2.
This commit is keeping the legacy re-establishment, that is re-establishment
of PCDP for SRB2 only.
according to TS 38.331, RRCReconfiguration messages can be carried
in a container by different RRC messages, e.g. HandoverPreparationInformation,
HandoverCommand, RRCResume etc.. therefore before the introduction of new
RRCReconfiguration messages, e.g. for handover, a new design seems to be necessary
in order to improve modularity and maintainability of the code.
The goal of this commit is to make the generation of RRCReconfiguration
messages more modular by (1) preparing the RRCReconfiguration parameters
data in RRC (2) pass it to ASN1 for IEs allocation (3) encode to buffer
The following changes are introduced:
(1) introduce struct nr_rrc_reconfig_param_t to store the RRC parameters relevant
to encode the RRCReconfiguration IEs
(2) add RRC function get_RRCReconfiguration_params to fetch nr_rrc_reconfig_param_t
data from the UE context and
(3) pass it to the ASN1 encoder, e.g. do_RRCReconfiguration
(4) add a function build_RRCReconfiguration_IEs to allocate memory and build the
ASN1 NR_RRCReconfiguration_IEs_t and
(5) adopt it in do_RRCReconfiguration
(4) add free_RRCReconfiguration_params for memory management of nr_rrc_reconfig_param_t data
(6) add test for rrc_reconfiguration
get_RRCReconfiguration_params:
This function prepares RRCReconfigurationParams for RRC encoding.
Motivation of this change: depending on the RRCReconfiguration
message to be encoded, the ownership of ASN1 memory allocation
should belong to the ASN1 layer, therefore this function is
preparing the nr_rrc_reconfig_param_t data to pass to the
ASN1 encoder to build the ASN1 message and encode to buffer
The function is preparing the params for the IEs that are
either mandatory or shared among different RRC messages.
Specific fields that depend on the message to be encoded are then
added afterwards in the caller. The input param to indicate
re-establishment has been split between SRBs and DRBs, since
depending on the scenario the PDCP re-establishment can vary.
This will be addressed in a later commit.
This function is also handling xid.
build_RRCReconfiguration_IE:
The long term goal is to transfer ownership of memory allocation in ASN1 encoding to
build_RRCReconfiguration_IE, then by calling ASN_STRUCT_FREE_CONTENTS_ONLY
on dl_dcch_msg, all IEs allocated in the context are freed after encoding to buffer.
In the long term, createDRBlist, createSRBlist can also be brought into the context
of build_RRCReconfiguration_IEs and free the ASN1 structure after encoding.
This improves maintability and helps preventing memory leaks.
Currently, what is not allocated in the context, is nulled and freed outside.
free_RRCReconfiguration_params:
this function frees memory allocated to build the nr_rrc_reconfig_param_t data,
including the NR_DRB_ToAddModList_t and NR_SRB_ToAddModList_t. The function
freeDRBlist has been removed since no longer necessary.
dedicated_NAS_msg_list:
dedicated_NAS_msg_list handling has also been refactored, by:
(1) fetch the NAS PDUs from the UE context in get_RRCReconfiguration_params,
which translates to (2) passing an array of dedicatedNAS-MessageList + size
to the ASN1 encoding function where (3) the ASN1 encoding logic for the
dedicated_NAS_msg_list IE has been moved
Note, 3GPP TS 38.331:
dedicatedNAS-MessageList: SEQUENCE (SIZE(1..maxDRB)) OF DedicatedNAS-Message
* differentiate the 2 functions based on the input: either NR Cell ID or PCI
* enhanced variables naming to distinguish the parameters
* add logging for debugging purposes
this commit is refactoring the function ngap_gNB_handle_nas_first_req
to (1) fill first a local instance of ngap_gNB_ue_context_t and then
(2) pass it to ngap_store_ue_context which will allocate memory
for the instance to store in ngap
This count is used to size the dynamic array lcids_bj_pos. In case
count is zero, this would lead to runtime error. With this change,
the function will indicate to the caller that no SDUs are present and
will print an error.
According to 3GPP TS 38.331 5.3.5.5.2 (Reconfiguration with sync), the UE
shall consider the target SpCell to be one with a physical cell identity
indicated by the physCellId
The primary motivation here is to remove a VLA, as in the parent
commits. Closer inspection revealed that (1) it is only used by the LTE
UE, and (2) it only logs some data which we likely don't need. So I
simply removed this function.
Upon failure, the error message was saying that something failed (i.e.,
the reason), but not parameters of the getaddrinfo(). Simplify root
cause analysis by providing the parameters for the attempted
getaddrinfo() call.
This function is needed also in upcoming NGAP
libraries (i.e. N2 Handover) and therefore is moved
to the NGAP utilities file. The function converts
transport_layer_addr_t data struct to BIT_STRING_t
by copying the content of its members. The naming
is also updated to tnl_to_bitstring.
* Functions added:
decode_ngap_guami
decode_ngap_UEAggregateMaximumBitRate
decode_ngap_nssai
decode_ngap_security_capabilities
decode_ngap_mobility_restriction
* Adopt these functions in the common NGAP library
- remove hardcoded values
- adapt gNB RRC code
- adapt gNB MAC code
- adapt physical simulators, where we put the hardcoded values
that were everywhere else before; if there is a need for those
simulators to get configurable values, more work is needed
(but it's doubtful that it is needed)
To be used in a later commit to retrieve NR PDCP configuration
parameters.
To use, add the following to the configuration file (outside of other
configurations). Adapt the values to your setup. The names ("len18bits",
"ms100", etc.) come from 3GPP TS 38.331.
pdcp = {
drb = {
sn_size = "len18bits"
t_reordering = "ms100"
discard_timer = "infinity"
}
}
Default values are applied if the configuration is absent.
The default values are the ones given above.
To be used in a later commit to retrieve NR RLC configuration
parameters.
To use, add the following to the configuration file (outside of other
configurations). Adapt the values to your setup. The names ("ms45",
"size12", etc.) come from 3GPP TS 38.331.
rlc = {
srb = {
t_poll_retransmit = "ms45"
t_reassembly = "ms25"
t_status_prohibit = "ms0"
poll_pdu = "infinity"
poll_byte = "infinity"
max_retx_threshold = "t8"
sn_field_length = "size12"
}
drb_am = {
t_poll_retransmit = "ms45"
t_reassembly = "ms15"
t_status_prohibit = "ms15"
poll_pdu = "p64"
poll_byte = "kB500"
max_retx_threshold = "t32"
sn_field_length = "size18"
}
drb_um = {
t_reassembly = "ms15"
sn_field_length = "size12"
}
}
Default values are applied if the configuration is absent.
The default values are the ones given above.
Integration: `2025.w23`
Closes#962, #956, and #801
See merge request oai/openairinterface5g!3464
* !3302 Enhance UE identity management in Initial UE Message and other NGAP improvements
* !3400 T bugfix: check input data a bit better
* !3459 Improvements in NR band tables according to Rel.17
* !3465 Fix checking that amf_ip_address section is not set.
* !3463 Move RRC radio parameters file to DU
* CI: Use host network mode in NSA-B200 pipeline
* !3389 Relax NR_UE_CAPABILITY_SLOT_RX_TO_TX asserts
* !3417 Imscope updates
* !3443 Fix data race in NR UE MSG3 scheduling
* !3467 remove dead globals
Fix data race in NR UE MSG3 scheduling
Fixed a data race between DL processing of RAR and UL scheduler, which might
result in dropping MSG3.
It was possible that the UL scheduler for the UL slot which RAR indicates as
MSG3 slot was already run by the time the RAR was decoded.
Therefore when DCI for RAR is decoded, assume worst case and halt UL scheduler
for next slot until RAR is decoded solving the data race. This also in turn
halts all later scheduling due to sequential nature of the UL scheduler calls.
Closes#962
imscope updates
- Add CSV export button to imscope
- Add extra cache for IQ data in imscope record thread so that UE time domain
data can be kept until PDSCH is decoded.
- Add metadata to UE time domain samples scope
- Add UE pdsch pre-compensation IQ and PDSCH channel estimates
Move RRC radio parameters file to DU
A number of radio-related RRC parameters, e.g., CellGroupConfig, "originate" at
the DU and are sent to the CU for forwarding to the UE only. Similarly, there
are additional parameters, e.g., RLC-BearerConfig (part of CellGroupConfig),
that originate at the DU.
Hence, the DU decides about these parameters, depending on the MAC state and
capabilities. To clarify this, move the existing
openair2/RRC/NR/nr_rrc_config.{c,h} => openair2/LAYER2/NR_MAC_gNB/nr_radio_config.{c,h}
So that developers know that while those are RRC parameters, they originate at
the DU.
In other words, the CU/RRC is not supposed to use any of these functions in
the RRC. Correspondingly, includes of this file have been cleaned up (and when
they are not necessary at the MAC as well)
Instead of running xApps from oai-flexric container,
create dedicated xApp containers.
In addition, modify the flexric.conf: DB_PATH doesn't exist;
DB_DIR is the correct name.
- prerequisites - use the links to FlexRIC tutorial
- build FlexRIC - use the build tutorial from FlexRIC tutorial
- explain in more details the supported service model functionalities
- explanation if no RIC INDICATION is being sent
- use multi-UE rfsim tutorial from doc/, not oai-workshops repository
Fixed a data race between DL processing of RAR and UL scheduler, which
might result in dropping MSG3.
It was possible that the UL scheduler for the UL slot which RAR
indicates as MSG3 slot was already run by the time the RAR was decoded.
Therefore when DCI for RAR is decoded, assume worst case and halt the
earliest corresponding UL scheduler call until RAR is decoded solving
the data race. This also in turn halts all later scheduling due to
sequential nature of the UL scheduler calls.
Following a power cycle of the CI machines in the NSA-B200 setup, the gNB
machine encountered a networking issue. Although packets were observed leaving
and returning to the host of gNB, they failed to reach the container.
Debugging steps taken:
- upgraded the gNB machine
- reinstalled Docker
- reviewed and verified IP rules and routing settings
Setting the container to use host network mode resolved the issue.
Enhance UE identity management in Initial UE Message and other NGAP improvements
This MR improves the Initial UE Message procedures by supporting simultaneous
presence of both 5G-S-TMSI and GUAMI. Previously, only one identity could be
used, leading to potential AMF selection failures. Now the presenceMask allows
both identities. The AMF selection is prioritizing GUAMI first, then falling
back to 5G-S-TMSI, and finally using PLMN or highest capacity.
Also, fix handling of selected PLMN identity in NGAP.
Refactoring:
- Select the AMF based on (1) absence of UE Identity (2) Presence of GUAMI
(3) Presence of 5G-S-TMSI
- Also refactored the AMF selection logic for better readability and reliability.
- Refactor and cleanup rrc_gNB_send_NGAP_NAS_FIRST_REQ
- Replace ngap_pdu_t with byte_array_t
- Add guami_t to ngran_types.h: refactor NGAP and RRC code to use one common
GUAMI type instead of two identical ones
Also:
- Bugfix in ngap_gNB_handle_ng_setup_response: use correct count for PLMNSupportList
Closes issue #801
Segmentation fault occured since the commit ID 9e5c5497ab,
where we try to copy the pointer which was not even been allocated. Before, we were
copying the address of a NULL pointer and therefore no segmentation fault.
This commit fixes the segmentation fault by checking if the memory was allocated, i.e. should not be
in the case of CU (as it doesn't contain MAC/RLC layers).
A number of radio-related RRC parameters, e.g., CellGroupConfig,
"originate" at the DU and are sent to the CU for forwarding to the UE
only. Similarly, there are additional parameters, e.g., RLC-BearerConfig
(part of CellGroupConfig), that originate at the DU.
Hence, the DU decides about these parameters, depending on the MAC state
and capabilities. To clarify this, move the existing
openair2/RRC/NR/nr_rrc_config.{c,h} => openair2/LAYER2/NR_MAC_gNB/nr_radio_config.{c,h}
So that developers know that while those are RRC parameters, they
originate at the DU.
In other words, the CU/RRC is not supposed to use any of these functions
in the RRC. Correspondingly, includes of this file have been cleaned up
(and when they are not necessary at the MAC as well).
One of the next commits moves nr_rrc_config.c "down to" the MAC/DU. The
BearerConfig functions are only used at the DU, so move them here in the
corresponding file.
When data is generated by "normal" T tracers, it should be fine.
But it might come from unknown sources and then content might be
"strange". So let's validate input data a bit more.
The way allocation is done (granularity of 64KiB) makes a crash more
difficult to achieve, but if a trace is exactly 64KiB, we miss 4 bytes
in the realloc and then anything may happen.
GUAMI fields (Set ID, Pointer and Region ID) were decoded as Octet String,
however they are encoded as BIT STRING. Therefore, the GUAMI value was wrongly decoded.
In the AMF logs the AMF IDs are 1,1,1, however in gNB logs we had 1,64,4
Quick local test confirmed that:
---- TESTING AMF IDs = 1 ----
Region ID (OCTET STRING): 1
Region ID (BIT STRING): 1
Set ID (OCTET STRING): 64
Set ID (BIT STRING): 1
Pointer (OCTET STRING): 4
Pointer (BIT STRING): 1
The difference arises because:
- OCTET STRING treats the buffer as raw bytes, with all bits used.
- BIT STRING includes a `bits_unused` field, which tells how many padding bits
are present in the least significant end. This is especially important in
3GPP ASN.1 definitions like AMF Set ID (10 bits), AMF Region ID (8 bits),
AMF Pointer (6 bits), where the full byte(s) may contain unused bits that
must be masked out.
selectedPLMN-Identity IE in RRCSetupComplete is an Index (long) of the PLMN selected
by the UE from the plmn-IdentityInfoList (SIB1) (see 3GPP TS 38.331)
while
Selected PLMN Identity in NGAP INITIAL UE MESSAGE Indicates the selected PLMN
id for the non-3GPP access (PLMN Identity ID carrying MNC, MCC and MNC size,
9.2.5.1 3GPP TS 38.413)
The legacy code was setting Selected PLMN Identity in the latter to an ID
value as the former, however in NGAP the IE to be encoded is PLMN Identity 9.3.3.5
therefore:
* set plmn type plmn_id_t in ngap_nas_first_req_t
* check whether received selectedPLMN-Identity is within bounds
* select PLMN from gNB_RrcConfigurationReq by selectedPLMN-Identity ID
note: this commit is assuming that the plmn-IdentityInfoList in SIB1
is matching the PLMN list in gNB_RrcConfigurationReq
* in NGAP: store the PLMN in the NGAP UE context, no need to fetch the PLMN
in the NGAP instance since the UE context already tells what PLMN
was selected
Closes#801
* use bitmask to select presence of either 5G-S-TMSI or GUAMI
* select the AMF based on
(1) absence of UE Identity (2) Presence of GUAMI (3) Presence of 5G-S-TMSI
Related to #801
* add function to process AMF Identifier
* add function to select AMF
* set const parameters in utility nnsf functions
* adopt utilities for memory allocation
* improve readability and maintainability
* improve logging
ngap_pdu_t has the same definition as byte_array_t, so it is
replaced by the latter. This simplify the stack and reduces
duplicated code.
Also, add function create_byte_array to copy from an
existing buffer to a new byte_array_t and replaced
allocCopy with create_byte_array, and adopted
OCTET_STRING_fromBuf whenever possible.
ntn-UlSyncValidityDuration in SIB19 from Spec 38.331 v17.12
A validity duration configured by the network for assistance information which indicates the maximum time duration
(from epochTime) during which the UE can apply assistance information without having acquired new assistance information.
The unit of ntn-UlSyncValidityDuration is second. Value s5 corresponds to 5 s, value s10 indicate 10 s and so on.
ntn-UlSyncValidityDuration-r17 ENUMERATED{ s5, s10, s15, s20, s25, s30, s35,s40, s45, s50, s55, s60, s120, s180, s240, s900}
Implementation of epochtime is under discussion.
It can be configured in configuration file according to the above enumeration. For GEO - 240s, MEO - 20s, LEO-5s can be used.
This change adds lengths checks to the received registration reject
message and also performs a bounds check for the received cause.
Since the cause is not checked, any string in the memory can be
dereferenced, possibly leading to DoS.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
The change addresses the SM message type retrieval for DL NAS Transport
messages. The assumption of an offset 17 = 7 (MM Sec) + 3 (MM Plain) + 1
(IEI) + 2 (Len) + 4 (SM) is correct.
However, if the DL NAS Transport is received in a plain header, the
lengths would not add up anymore. (This is not complying with the
standard, so not allowed, but possible). The check for the length is
necessary to not process arbitrary memory contents beyond the
`pdu_buffer`.
Signed-off-by: Eduard Vlad <eduard.vlad@rwth-aachen.de>
add_boolean_option(SANITIZE_MEMORYFalse"enable the memory sanitizer (MSan, requires clang, incompatible with ASan/UBSan)"ON)
add_boolean_option(SANITIZE_MEMORYOFF"enable the memory sanitizer (MSan, requires clang, incompatible with ASan/UBSan)"ON)
if(SANITIZE_MEMORY)
if(SANITIZE_UNDEFINEDORSANITIZE_ADDRESS)
message(FATAL_ERROR"memory sanitizer cannot coexist with address sanitizer or undefined behavior sanitizer, please disable either MSan or ASan and UBSan")
@@ -276,15 +273,16 @@ endif()
# OAI uses this feature to re-use OAI LOG_I(ASN1, ...)
# see common/utils/config.h
add_boolean_option(TRACE_ASN1C_ENC_DECOFF"Enable ASN1 encoder/decoder debug traces via OAI logging system"ON)
add_boolean_option(T_TRACERTrue"Activate the T tracer, a debugging/monitoring framework"ON)
add_boolean_option(ENABLE_LTTNGFalse"Activate the LTTNG tracer, a debugging/monitoring framework"ON)
add_boolean_option(UE_AUTOTEST_TRACEFalse"Activate UE autotest specific logs"ON)
logging.info(f'\u001B[1m{image} size is {imageSize[image]}\u001B[0m')
grep_exp=r"\|".join(attemptedImages)
self.cmd.run(f'oc get images | grep -e \'{grep_exp}\' &> cmake_targets/log/image_registry.log');
self.cmd.run(f'for pod in $(oc get pods | tail -n +2 | awk \'{{print $1}}\'); do oc get pod $pod -o json &>> cmake_targets/log/build_pod_summary.log; done')
self.htmlFile.write(' <div class="well well-lg">End of Test Report -- Copyright <span class="glyphicon glyphicon-copyright-mark"></span> 2018 <a href="http://www.openairinterface.org/">OpenAirInterface</a>. All Rights Reserved.</div>\n')
self.htmlFile.write(' <div class="well well-lg">End of Test Report -- Copyright <span class="glyphicon glyphicon-copyright-mark"></span> 2025 <a href="http://www.openairinterface.org/">OpenAirInterface</a>. All Rights Reserved.</div>\n')
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
