Replacing content of MAC PDU for testing purposes causes it to not always get sent

[JelleB-2055020]

Hi, this is one of my first questions on an open source repo so my apologies if I'm not adhering to protocol.

I'm trying to write a proof of concept setup for my master's thesis that replaces the contents of a MAC PDU sent by upper layers to transmit to the UE. I wrote the following code in srsRAN_Project/lib/mac/mac_dl/mac_cell_processor.cpp for mac_cell_processor::assemble_dl_data_request:

// ... unaltered code
for (const dl_msg_alloc& grant : dl_res.ue_grants) {
    logger.debug("MAC Cell Processor: amt cw: {}", grant.pdsch_cfg.codewords.size());
    for (unsigned cw_idx = 0; cw_idx != grant.pdsch_cfg.codewords.size(); ++cw_idx) {
      const pdsch_codeword& cw = grant.pdsch_cfg.codewords[cw_idx];
      span<const uint8_t>   pdu;

      if (cw.new_data) {
        logger.debug("MAC Cell Processor: Assembling DL PDU for new data");
        pdu = dlsch_assembler.assemble_newtx_pdu(
            grant.pdsch_cfg.rnti, grant.pdsch_cfg.harq_id, cw_idx, grant.tb_list[cw_idx], cw.tb_size_bytes);
      } else {
        logger.debug("MAC Cell Processor: Assembling DL PDU for retx data");
        pdu =
            dlsch_assembler.assemble_retx_pdu(grant.pdsch_cfg.rnti, grant.pdsch_cfg.harq_id, cw_idx, cw.tb_size_bytes);
      }

      // ------------------------------- CUSTOM REPLACER CODE -------------------------------
      // attempt to replace the MAC PDU with the cached MAC PDU
      bool replaced = false;
      Replacer* replacer = Replacer::get_initiated_instance();
      if (replacer == nullptr){
        logger.warning("Replacer: could not get initiated instance in MAC Cell Processor, should only happen once at the start of the program");
      } else {
        replaced = Replacer->attempt_replace_mac_pdu(pdu, !cw.new_data);

        if (replaced){
          logger.debug("Replacer: replaced MAC PDU with cached MAC PDU: {}", pdu);
        } else {
          logger.debug("Replacer: did not replace MAC PDU with cached MAC PDU: {}", pdu);
        }
      }
      // --------------------------------------------------------------------------------
      
      logger.debug("MAC Cell Processor: final pdu: {}", pdu);
      data_res.ue_pdus.emplace_back(cw_idx, pdu);
      logger.debug(pdu.data(), pdu.size(), "MAC Cell Processor: Assembled DL PDU");
      logger.debug("ue={} rnti={} harq={} cw={} value={} tb_size={} bytes: Assembled DL PDU",
                  ue_mng.get_ue_index(grant.pdsch_cfg.rnti),
                  grant.pdsch_cfg.rnti,
                  grant.pdsch_cfg.harq_id,
                  cw_idx,
                  pdu,
                  cw.tb_size_bytes);
    }
  }
// ... unaltered code

The replacement happens successfully with regards to the content of the PDU. However, after having replaced the content of the PDU, I notice the gNB doesn't always actually transmit the PDU. Sometimes it does, sometimes it doesn't. Is there some mechanism internally that detects that the content of the PDU was altered that prohibits the PDU from being transmitted by the MAC layer?

As for how I get a data grant: I trigger a more or less empty PDU to be sent from an upper layer (PDCP), replacing its contents in the function above with the content that I need to transmit. Furthermore, this exact approach does work on SRSUE, which prompted me to do it this way on SRSRAN.

Do you have any advice where I could perform the alteration? In my current situation I need to replace the entire content of the original MAC PDU with the content of a test MAC PDU, so I cannot start at a higher layer such as PDCP for example.

Finally, here's an excerpt of the logs showing that the PDU was actually replaced, but no PDU was transmitted in the end:

2025-03-16T19:26:14.087128 [MAC     ] [D] [    96.7] Replacer: replaced MAC PDU with cached MAC PDU: 1 3 0 7 0 4 3 0 1 0 63 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
2025-03-16T19:26:14.087128 [MAC     ] [D] [    96.7] MAC Cell Processor: final pdu: 1 3 0 7 0 4 3 0 1 0 63 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
2025-03-16T19:26:14.087128 [MAC     ] [D] [    96.7] MAC Cell Processor: Assembled DL PDU
2025-03-16T19:26:14.087129 [MAC     ] [D] [    96.7] ue=0 rnti=0x4601 harq=0 cw=0 value=1 3 0 7 0 4 3 0 1 0 63 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 tb_size=72 bytes: Assembled DL PDU