Skip to content

fix(sdap): skip unmapped-QFI drop check on UE DL path#158

Open
alexjiao2021 wants to merge 1 commit into
duranta-project:developfrom
alexjiao2021:fix-ue-sdap
Open

fix(sdap): skip unmapped-QFI drop check on UE DL path#158
alexjiao2021 wants to merge 1 commit into
duranta-project:developfrom
alexjiao2021:fix-ue-sdap

Conversation

@alexjiao2021

Copy link
Copy Markdown
Collaborator

Ping UE failed with 3rd-party gNB, UE will report error as below:
[SDAP] Dropping UL SDAP PDU with unmapped QFI=5 (ue=0 pdu_session=1 drb=2)

gNB has configuration for SDAP as below:

                                drb-ToAddModList: 1 item
                                    Item 0
                                        DRB-ToAddMod
                                            cnAssociation: sdap-Config (1)
                                                sdap-Config
                                                    pdu-Session: 1
                                                    sdap-HeaderDL: absent (1)
                                                    sdap-HeaderUL: present (0)
                                                    ..1. .... defaultDRB: True
                                                    mappedQoS-FlowsToAdd: 1 item
                                                        Item 0
                                                            QFI: 2
                                            drb-Identity: 2

Complete gNB RRC log in pcap format:
nr_rrc.zip
UE log:
nr_ue_ping_fail.log

This PR fixed the issue, details are in commit message.

@alexjiao2021 alexjiao2021 requested a review from GuidoCasati June 10, 2026 05:21
@alexjiao2021 alexjiao2021 added the nrUE Run only 5G UE tests (physims included, LDPC tests excluded). label Jun 10, 2026
@alexjiao2021 alexjiao2021 added this to the REVIEW_CAN_START milestone Jun 10, 2026
When enable_sdap is true but the DL SDAP header is absent
(sdap_dl_rx == false), the RX entity still reads the first byte
of the buffer as a QFI. On the UE side that byte belongs to the
IP payload, so the qfi2drb_table lookup returns SDAP_NO_MAPPING_RULE
and the packet was silently dropped, causing ping failures.

The drop guard is only meaningful on the gNB UL path, guard it
with is_gnb so the UE DL path is unaffected.

Signed-off-by: Alex Jiao <alex.jiao@keysight.com>
@durantabot

Copy link
Copy Markdown
Collaborator

CI Build: #184 | Failed on the following stages:

@durantabot

Copy link
Copy Markdown
Collaborator

CI Build: #185 | Failed on the following stages:

@GuidoCasati

Copy link
Copy Markdown
Collaborator

Hi @alexjiao2021, thanks for reporting this.

We have a similar scenario in https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-upf/-/work_items/36 in the CN to gNB N3 path: the simple-switch UPF sends DL GTP-U with default qfi = 0x05 until an UL packet reclassifies the session.

In this case, it also happen that QFI=5 is received but for a different reason: gNB sends DL without SDAP header, the UE SDAP sees raw IPv4 SDUs and QFI=5 comes from IPv4 header byte 0x45.

This is actually a bug, since entity->enable_sdap, is true if either UL or DL header is present, and your capture shows that it can be not the case since we have UL header only.

However, the fix is not enough, as it would still parse IP header as an SDAP header, so we have bogus qfi, and also parsing should be done only when RRC says header is present. I'll think about a more proper fix, which I believe should do the header parsing on a per-direction role.

@alexjiao2021

Copy link
Copy Markdown
Collaborator Author

However, the fix is not enough, as it would still parse IP header as an SDAP header, so we have bogus qfi, and also parsing should be done only when RRC says header is present. I'll think about a more proper fix, which I believe should do the header parsing on a per-direction role.

Thanks @GuidoCasati , once you have a more proper fix ready, I'll close this PR.

@GuidoCasati

Copy link
Copy Markdown
Collaborator

However, the fix is not enough, as it would still parse IP header as an SDAP header, so we have bogus qfi, and also parsing should be done only when RRC says header is present. I'll think about a more proper fix, which I believe should do the header parsing on a per-direction role.

Thanks @GuidoCasati , once you have a more proper fix ready, I'll close this PR.

hi @alexjiao2021, could you please test #249 and see if it solve the issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

nrUE Run only 5G UE tests (physims included, LDPC tests excluded).

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants