Skip to content

nfapi: support SRS channel reports for 64 gNB antenna elements#268

Open
gabri94 wants to merge 2 commits into
duranta-project:developfrom
gabri94:aerial-64l-srs
Open

nfapi: support SRS channel reports for 64 gNB antenna elements#268
gabri94 wants to merge 2 commits into
duranta-project:developfrom
gabri94:aerial-64l-srs

Conversation

@gabri94

@gabri94 gabri94 commented Jul 6, 2026

Copy link
Copy Markdown
Collaborator

This MR is part of the reciprocity-based dynamic BF series and goes together with #156 and #267.
Additional MRs will follow with the FAPI changes to support Dynamic Beamforming, as well as adaptations to the scheduler.

Body

SRS-reciprocity workflows with Aerial mMIMO (Cat-B, 64-element arrays) return the
normalized channel IQ matrix over FAPI, but the SRS.indication structs and codec
were dimensioned for 8 gNB antenna elements. A 64-element report needs up to
272 PRGs × 4 UE ports × 64 elements × 4 B ≈ 272 KiB, which the current code
truncates or silently drops.

Changes

  • Buffer dimensioning (nfapi_nr_interface_scf.h): new NFAPI_NR_SRS_MAX_*
    macros size channel_matrix and the SRS report TLV value[] for
    64 antenna elements / 4 UE SRS ports / 272 PRGs. The two buffers are now sized
    consistently (previously the report TLV allowed more UE ports than
    channel_matrix could hold).
  • Integer overflow fixes on the SRS report path, which become fatal at these
    report sizes:
    • unpack_nr_srs_report_tlv_value(): last_idx was int16_t, overflowing for
      reports ≥ 128 KiB so the copy loop never ran and the report was dropped.
      Widened to int32_t, and oversized reports are now rejected instead of
      overrunning the value buffer.
    • pack/unpack_nr_srs_normalized_channel_iq_matrix(): channel_matrix_size
      was uint16_t (wraps at 64 KiB). Widened to uint32_t and bounded by
      sizeof(channel_matrix).
    • handle_nr_srs_measurements(): the SRS_IND_DEBUG print indexed the matrix
      with a uint16_t, which wraps for Nu·Ng·Np > 65535.

The SRS.indication report structs were dimensioned for 8 gNB antenna
elements: channel_matrix held 272*2*8*4 bytes and the report TLV value
carried 64 KiB. A massive-MIMO L1 (Aerial) reporting the normalized
channel IQ matrix for 64 antenna elements needs up to
272 PRGs * 4 UE ports * 64 elements * 4 B = 272 KiB per report.

Introduce NFAPI_NR_SRS_MAX_* dimensioning macros and size both
channel_matrix and the report TLV value from them, so the two buffers
stay consistent (the report TLV previously allowed more UE ports than
channel_matrix could hold).

Assisted-by: Claude Code:claude-fable-5
uint8_t unpack_nr_srs_report_tlv_value(nfapi_srs_report_tlv_t *report_tlv, uint8_t **ppReadPackedMsg, uint8_t *end)
{
if ((report_tlv->length + 3) / 4 > sizeof(report_tlv->value) / sizeof(report_tlv->value[0])) {
return 0;

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think here a warning should be printed, informing that a report too big to be unpacked was received, maybe NFAPI_TRACE_DEBUG.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, but i used NFAPI_TRACE_ERROR rather than DEBUG, since it's quite a critical problem if it happens. Moreover all the other unpack failures for FAPI are treated as ERRORS.

@rubensoaressilva rubensoaressilva added the 5G-NR Perform 5G Tests label Jul 9, 2026
@rubensoaressilva rubensoaressilva added this to the REVIEW_IN_PROGRESS milestone Jul 9, 2026
With 64 gNB antenna elements the SRS channel IQ matrix exceeds the
ranges the SRS report code path was written for (272 PRGs * 2 UE ports
* 64 elements * 4 B = 136 KiB per report):

- unpack_nr_srs_report_tlv_value(): last_idx was int16_t, which
  overflows at report lengths >= 128 KiB, so the copy loop never ran
  and the report was silently dropped. Widen to int32_t and reject
  reports larger than the value buffer instead of overrunning it.
- pack/unpack_nr_srs_normalized_channel_iq_matrix():
  channel_matrix_size was uint16_t and wraps at 64 KiB, truncating the
  matrix. Widen to uint32_t and bound it by sizeof(channel_matrix).
- handle_nr_srs_measurements(): the SRS_IND_DEBUG print indexed the
  matrix with a uint16_t, which wraps for Nu*Ng*Np > 65535.

Assisted-by: Claude Code:claude-fable-5
// elements (Ng), 4 sampled UE SRS ports (Nu), 272 PRGs and 4-byte complex
// samples (iqSize).
#define NFAPI_NR_SRS_MAX_PRGS 272
#define NFAPI_NR_SRS_MAX_GNB_ANTENNA_ELEMENTS 64

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to make this a configuration parameter? or a compile-time definition? I feel that by always allocating 64AE we're wasting a lot of resources for all CAT-A users

@durantabot

Copy link
Copy Markdown
Collaborator

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

5G-NR Perform 5G Tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants