mux/bsr: fix issue with corrupted UL-SCH PDU

BSR was triggered although there was not enough space in MAC PDU

srsue/src/stack/mac/mux.cc

@@ -188,8 +188,6 @@ uint8_t* mux::pdu_get(srslte::byte_buffer_t* payload, uint32_t pdu_sz)
   }
   pending_crnti_ce = 0;
 
-  print_logical_channel_state("after CCCH scheduling");
-
   bsr_proc::bsr_t bsr; 
   bool regular_bsr = bsr_procedure->need_to_send_bsr_on_ul_grant(pdu_msg.rem_size(), &bsr);
 

srsue/src/stack/mac/proc_bsr.cc

@@ -335,12 +335,10 @@ bool bsr_proc::need_to_send_bsr_on_ul_grant(uint32_t grant_size, bsr_t* bsr)
     }
     total_data--; // Because last SDU has no size header
 
-    /* All triggered BSRs shall be cancelled in case the UL dci can accommodate all pending data available for
-       transmission but is not sufficient to additionally accommodate the BSR MAC control element plus its subheader.
-     */
+    // Only include BSR if it can fit into the remaining grant
     generate_bsr(bsr, 0);
-    bsr_sz = bsr->format==LONG_BSR?3:1;
-    if (total_data <= (int)grant_size && total_data + 1 + bsr_sz > grant_size) {
+    bsr_sz = bsr->format == LONG_BSR ? 3 : 1;
+    if (bsr_sz > grant_size) {
       Debug("Grant is not enough to accommodate the BSR MAC CE\n");
     } else {
       Debug("BSR:   Including Regular BSR: grant_size=%d, total_data=%d, bsr_sz=%d\n", grant_size, total_data, bsr_sz);

srsue/test/mac_test.cc

@@ -873,6 +873,86 @@ int mac_ul_sch_pdu_three_byte_test()
   return SRSLTE_SUCCESS;
 }
 
+// UL-SCH with Trucated BSR and 6 B Msg3
+int mac_ul_sch_pdu_msg3_test()
+{
+  const uint8_t tv[] = {0x3c, 0x00, 0xd0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+  srslte::log_filter mac_log("MAC");
+  mac_log.set_level(srslte::LOG_LEVEL_DEBUG);
+  mac_log.set_hex_limit(100000);
+
+  srslte::log_filter rlc_log("RLC");
+  rlc_log.set_level(srslte::LOG_LEVEL_DEBUG);
+  rlc_log.set_hex_limit(100000);
+
+  // dummy layers
+  phy_dummy phy;
+  rlc_dummy rlc(&rlc_log);
+  rrc_dummy rrc;
+
+  // the actual MAC
+  mac mac(&mac_log);
+  mac.init(&phy, &rlc, &rrc);
+  const uint16_t crnti = 0x1001;
+  mac.set_ho_rnti(crnti, 0);
+
+  // generate config for LCIDs in different LCGs than CCCH
+  std::vector<logical_channel_config_t> lcids;
+  logical_channel_config_t              config = {};
+  // The config of DRB1
+  config.lcid     = 3;
+  config.lcg      = 3;
+  config.PBR      = 8;
+  config.BSD      = 100; // 100ms
+  config.priority = 15;
+  lcids.push_back(config);
+
+  // setup LCIDs in MAC
+  for (auto& channel : lcids) {
+    mac.setup_lcid(channel.lcid, channel.lcg, channel.priority, channel.PBR, channel.BSD);
+  }
+
+  // write dummy data
+  rlc.write_sdu(0, 6);   // UL-CCCH with Msg3
+  rlc.write_sdu(3, 100); // DRB data on other LCG
+
+  // generate TTI
+  uint32 tti = 0;
+  mac.run_tti(tti++);
+  usleep(100);
+
+  // create UL action and grant and push MAC PDU
+  {
+    mac_interface_phy_lte::tb_action_ul_t ul_action = {};
+    mac_interface_phy_lte::mac_grant_ul_t mac_grant = {};
+
+    mac_grant.rnti           = crnti; // make sure MAC picks it up as valid UL grant
+    mac_grant.tb.ndi_present = true;
+    mac_grant.tb.ndi         = true;
+    mac_grant.tb.tbs         = 9; // give room for MAC subheader, SDU and one padding byte
+    int cc_idx               = 0;
+
+    // Send grant to MAC and get action for this TB, then call tb_decoded to unlock MAC
+    mac.new_grant_ul(cc_idx, mac_grant, &ul_action);
+
+    // print generated PDU
+    mac_log.info_hex(ul_action.tb.payload, mac_grant.tb.tbs, "Generated PDU (%d B)\n", mac_grant.tb.tbs);
+#if HAVE_PCAP
+    pcap_handle->write_ul_crnti(ul_action.tb.payload, mac_grant.tb.tbs, 0x1001, true, 1);
+#endif
+
+    TESTASSERT(memcmp(ul_action.tb.payload, tv, sizeof(tv)) == 0);
+  }
+
+  // make sure MAC PDU thread picks up before stopping
+  sleep(1);
+  mac.run_tti(0);
+  mac.stop();
+
+  return SRSLTE_SUCCESS;
+}
+
 int main(int argc, char** argv)
 {
 #if HAVE_PCAP
@@ -930,5 +1010,10 @@ int main(int argc, char** argv)
     return -1;
   }
 
+  if (mac_ul_sch_pdu_msg3_test()) {
+    printf("mac_ul_sch_pdu_msg3_test() test failed.\n");
+    return -1;
+  }
+
   return 0;
 }