Skip to content

Commit 6e208ea

Browse files
committed
rrc: fix RLF re-establishment crash -- address peer teardown with leg-correct node id
handleRadioLinkFailure drives the symmetric teardown on the peer via peerBm->releaseLink(myId), where myId identifies the failing node to the peer: the peer deletes its PDCP/RLC/MAC entities for this link keyed by that id (the source/dest id it saw on the bearer). myId was hardcoded to registration_->getLteNodeId(), which is NODEID_NONE on a standalone NR gNB (a GNODEB stores its id in nrNodeId; see Registration). So the peer UE received 0, its keyed PDCP deletion (kept per-node to protect the other leg in DC) matched nothing, and pdcp-rx-<gnb>-<drb> survived -- while the UE-side RLC deletion (wipe-all) removed the RLC entity. On the first post-reconnect DL packet the on-demand rebuild then hit 'Cannot insert module pdcp-rx-1-1 ... already exists' and aborted. Address the peer with our id on the FAILING leg instead: myId = nrStack ? registration_->getNrNodeId() : registration_->getLteNodeId(); This is the id the peer actually keyed by, so its keyed PDCP deletion now removes the stale entity and re-establishment rebuilds cleanly. Latent since the DRB teardown became duplex (the cross-node symmetric releaseLink is the bidirectional half); the mismatched field is the node id, not the drbId. Validated (nr/standalone VoIP-DL-AM-Lossy, forced RLF via maxRtxThreshold=1 maxHarqRtx=0, t311=1s t301=0.1s): run is now crash-free through the full 5s, teardown addresses the UE with the gNB's NR id (1, was 0), and DL delivery RESUMES -- 113 UE deliveries, 95 of them after the reconnect at t=1.529s (parent: crashed at 18, none after). Fingerprint suite 137/137 PASS byte-identical (default t311=0 => RLF path not exercised).
1 parent 0e3be82 commit 6e208ea

1 file changed

Lines changed: 6 additions & 1 deletion

File tree

src/simu5g/stack/rrc/BearerManagement.cc

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,12 @@ void BearerManagement::handleRadioLinkFailure(MacNodeId nodeId, bool nrStack)
134134
// bearer rebuilds fresh, SN-consistent entities on both sides. Reaching the peer via the
135135
// binder mirrors handover's cross-node HandoverController::deleteOldBuffers.
136136
releaseLink(nodeId);
137-
MacNodeId myId = registration_->getLteNodeId();
137+
// Address the peer's symmetric teardown with OUR node id on the failing leg: the peer keys
138+
// its entities (PDCP/RLC/MAC) for this link by that id (the source/dest id it saw on the
139+
// bearer). Using getLteNodeId() unconditionally sent NODEID_NONE from a standalone NR gNB
140+
// (whose id lives in nrNodeId), so the peer's keyed PDCP deletion missed pdcp-rx-<gnb>-<drb>
141+
// and a later re-establishment collided with the leftover entity.
142+
MacNodeId myId = nrStack ? registration_->getNrNodeId() : registration_->getLteNodeId();
138143
if (cModule *peerRrc = binderModule->getRrcByNodeId(nodeId)) {
139144
if (auto *peerBm = dynamic_cast<BearerManagement *>(peerRrc->getSubmodule("bearerManagement")))
140145
peerBm->releaseLink(myId);

0 commit comments

Comments
 (0)