SDAP header handling fixes (#249)
OAI SDAP treated SDAP header presence as a single PDU-session flag
(enable_sdap), so a valid asymmetric RRC config (UL header present, DL
header absent) caused the UE to parse downlink payload as an SDAP QFI
and drop traffic (e.g. IPv4 0x45 -> bogus QFI 5).
SDAP now follows RRC SDAP-Config per DRB and per direction from (TS
38.331 / TS 37.324). Header presence, QFI-to-DRB mapping, and
default-DRB fallback all derive from what RRC configured for each DRB.
In the new implementation, RRC (SDAP-Config IE) fills sdap_config_t per
DRB (role, defaultDRB, mapped QFIs), SDAP entity stores it in
qfi2drb_table + default_drb row to be used in the TX/RX data path.
Also, simplify mapping logic, improves E1 QoS-flow remap, and completes
UE reflective QoS mapping with the correct entity_role on new QFI rows.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
RRC fixes (#225)
- Hardens NR RRC re-establishment handling on the gNB and UE:
re-establishment requests with invalid PCI/C-RNTI or incomplete UE
context are rejected or fall back to RRCSetup per TS 38.33.
- Fixes an invalid post-release connected state after PDU session
teardown
- Stops gNB process aborts when a UE sends spare RRC establishment-cause
values.
- Fix RRCSetup fallback: the UE MAC layer is reset before bearer
teardown on RRCSetup fallback to avoid scheduler use of released RLC
entities.
Closes: #127Closes: #128Closes: #148
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Francesco Mani <email@francescomani.it>
A UE RRCSetupRequest with establishmentCause in the spare range (10–15)
could abort nr-softmodem: RRC asserted on cause >= NGAP_RRC_CAUSE_LAST,
and cause 11 failed NGAP ASN.1 encode when passed through by index.
NR RRC (TS 38.331) and NGAP RRCEstablishmentCause (TS 38.413 §9.3.1.111)
do not share one integer namespace: spare values must not be sent
as NGAP causes.
Remove the RRC AssertFatal on causes. When building
InitialUEMessage, map RRC indices 0–9 to the matching NGAP cause
and map anything else to notAvailable, as specified for unmapped UE
causes.
Changes:
- Drop establishment-cause range AssertFatal in rrc_gNB_send_NGAP_NAS_FIRST_REQ
- Add rrc2ngap_establishment_cause() and use it for InitialUEMessage RRCEstablishmentCause
- Remove redundant DevCheck on establishment_cause in ngap_gNB_handle_nas_first_req
- Adopt mapping logic in rrc_gNB_send_NGAP_NAS_FIRST_REQ
Closes: #127
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
When the gNB answers RRCReestablishmentRequest with RRCSetup (TS 38.331
clause 5.3.3.4 fallback), the UE must release all bearers except SRB0 before
applying the new masterCellGroup. CONFIG_RESET was queued after RLC release,
so the MAC slot thread kept polling LCID 1 from a stale lc_ordered_list while
the RLC entity was already NULL.
Queue NR_MAC_RRC_CONFIG_RESET (RRC_SETUP_REESTAB_RESUME) first, then release
PDCP, RLC, and SDAP. On the MAC thread, clear lc_ordered_list except SRB0
before release_mac_configuration() so the UL scheduler stops looping released
logical channels until CONFIG_CG re-adds SRB1.
Changes:
- rrc_UE.c: move CONFIG_RESET to the start of nr_rrc_rrcsetup_fallback()
- config_ue.c: drop non-SRB0 lc_ordered_list entries on RRC_SETUP_REESTAB_RESUME
Closes: #128
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
TS 38.331 §5.3.1.1 forbids RRC_CONNECTED with SRB2 and zero DRBs.
Releasing all DRBs must release the RRC connection.
After PDU session release (3GPP TS 23.502 §4.3.4.2), OAI left
SRB2 up and COTS UEs could re-establish into an invalid configuration.
On NGAP PDU Session Release Response, if no DRBs remain and SRB2 is
active, send NGAP UE Context Release Request. AMF Command drives
RRCRelease on the existing CU-CP path.
Closes: #148
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Avoid E1 bearer modification when the UE has no DRBs left (e.g. after PDU
session release). (TS 38.331 clause 5.3.5.6.5 DRB with reestablishPDCP)
Changes:
- cuup_notify_reestablishment(): return early if drbs is empty
Fixes: #148
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Replace the magic number 0x7fffffffff used for masking 39-bit random
values with a named constant NR_RRC_RANDOM_VALUE_39_BIT_MASK defined
in nr_rrc_defs.h.
Refs:
- TS 38.331 5.3.3.3: Random UE identity (39-bit values)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Replace hardcoded C-RNTI range values (0x1, 0xffef) with named constants
NR_C_RNTI_MIN and NR_C_RNTI_MAX. Correct maximum value to 0xfff2 per TS 38.321
Table 7.1-1. Change invalid C-RNTI handling to return early instead of
fallback to RRCSetup for spec compliance.
Fallback to RRCSetup only occurs when UE context cannot be retrieved,
not for validation errors, which for out-of-range values could
come from malicious UEs.
Major changes:
- Add NR_C_RNTI_MIN (0x0001) and NR_C_RNTI_MAX (0xfff2) constants to
common/platform_constants.h
- Replace magic numbers in C-RNTI validation with named constants
- Change error path from fallback_rrc_setup to return for invalid C-RNTI
- Early validation before further processing
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Add defensive parameter checks at the start of
rrc_handle_RRCReestablishmentRequest to prevent NULL pointer
dereferences and invalid assoc_id handling.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Add validation of physCellId against valid range (0-1007) per TS 38.331
specification. Invalid PCI values are now rejected early in the
reestablishment procedure.
This prevents processing of invalid reestablishment requests with
out-of-range PCI values, improving robustness and spec compliance.
Major changes:
- Add NR_PHYS_CELL_ID_MAX to common/platform_constants.h
- Add PCI range check in rrc_handle_RRCReestablishmentRequest() before
cell lookup, returning early on invalid values
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Add validation checks per TS 38.331 5.3.7.1 to ensure SRB2 and at
least one DRB are active before processing RRC reestablishment
requests. Use more specific NGAP cause code for procedure failures.
Reestablishment requests without SRB2 or DRB setup now properly
fall back to RRC setup with appropriate NGAP cause indication
Major changes:
- Add SRB2 active check before processing reestablishment
- Add DRB active check (at least one DRB required)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
After having removed eth_params_t from all L2/L3 files, we can reduce
the scope of common_lib.h, and remove the include from many files.
Signed-off-by: Robert Schmidt <robert.schmidt@openairinterface.org>
In 4G, it's not used.
In 5G, there is no need, as we can pass it directly to the CU task.
Signed-off-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Non-dynamic fiveQI on F1AP/E1AP may name standardized or pre-configured
profiles (TS 38.473), the range is 0..255. Decode now accepts
MIN_FIVEQI..MAX_FIVEQI (0..255) and fails only when fiveQI is outside
that range. Pre-configured and other non-standardized non-dynamic values
remain unsupported: RRC still skips them via is_5qi_standardized().
Changes:
- F1AP/E1AP: range-check 0..255 only
- improve documentation
Refs:
- 3GPP TS 38.473 §9.3.1.49 (non-dynamic standardized or pre-configured 5QI)
- 3GPP TS 23.501 §5.7.2.1
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Complete NR L2/L3 Paging path from F1AP to NAS (gNB and UE) (#151)
This MR wires a 5G‑NR paging flow across the stack, from F1AP Paging on
the DU down to PCCH scheduling in MAC/RLC, RRC/ASN encode/decode, and
UE‑side NAS Service Request triggering, including the NR UE changes in
L1/L2.
It centralises paging PF/PO computation and PCCH scheduling in MAC,
using shared SSB/Type0‑PDCCH and common PDSCH helpers that are also
reused by SIB1. On the UE, it enables decoding of NR PCCH messages,
matching ng‑5G‑S‑TMSI/fullI‑RNTI, and conditionally initiating a
network‑triggered Service Request when 5GMM state allows it. The change
set includes focused refactors and ASN.1 tests to validate the new
paging encode/decode path.
Changes:
- MAC gNB common helpers: Move SSB/Type0‑PDCCH utilities from the
BCH scheduler into shared MAC primitives and introduce a reusable
Type0‑occasion helper and common PDSCH RB/MCS/TBS sizing
- MAC paging PF/PO responsibility: Add a dedicated PCCH scheduler module
that implements TS 38.304 §7 PF/PO computation (defaultPagingCycle,
nAndPagingFrameOffset, Ns, SFN‑based PF formula and PO slot mapping)
and owns the “is this (frame,slot) a paging occasion for UE_ID?”
decision.
- F1AP -> MAC -> RLC PCCH path (gNB/DU): Have the DU decode F1AP Paging
with CN UE identity, build an NR RRC Paging message (PCCH) in MAC, and
hand it to RLC as a dedicated PCCH SDU together with UE_ID (5G‑S‑TMSI
mod 1024), using per‑module PCCH storage. RAN UE paging identity
is explicitly rejected.
- Direct CU to DU paging path: Implement direct F1 Paging handling
in the NR RRC DL direct interface for RLC PCCH storage for later
scheduling.
- PCCH scheduling and NFAPI integration (gNB MAC): Integrate
schedule_nr_pcch() into the DL scheduler so that when a stored PCCH
SDU exists and the current (frame,slot) is a paging occasion, MAC
resolves the paging search space and CORESET, selects a beam (from SSB),
allocates CCEs and PDSCH resources, builds NFAPI DL_TTI PDUs
(PDCCH + PDSCH with P‑RNTI, DCI 1_0), and populates the matching
TX_DATA PDU, then clears the cached PCCH.
- DCI handling for P‑RNTI paging: Adjust DCI payload preparation
to treat P‑RNTI specially, returning after setting DMRS and antenna
ports and skipping HARQ and UE scheduling state that do not exist for
paging, so paging DCIs no longer touch UE HARQ data structures.
- PHY UE RX Chain: DCI handling for P‑RNTI on UE, monitor DCI on Paging
Occasions, process DCI 1_0 with CRC scrambled by P‑RNTI on the paging
search space, trigger PDSCH decoding for PCCH based on that DCI, deliver
decoded PCCH to upper layers from the PHY/MAC side
- RRC/ASN paging encode API: Replace the legacy buffer‑based do_NR_Paging
with a nr_paging_params_t‑based API returning a byte_array_t,
supporting both ng‑5G‑S‑TMSI and fullI‑RNTI identities, and optional IEs
(e.g. accessType non‑3GPP and pagingCause v17), and encoding via
uper_encode_to_new_buffer, with ownership and failure semantics clearly
defined for callers.
- UE‑side PCCH reception and matching: Add UE MAC to RRC logic
to deliver PCCH SDUs to RRC, decode NR PCCH via a new nr_pcch_decode()
helper into an array of nr_paging_params_t, iterate PagingRecordList on
the UE, compare M‑TMSI/fullI‑RNTI against local identity, and log whether
a paging match was found.
- NAS integration for network‑triggered Service Request: On a UE paging
match, send a NAS_PAGING_IND from RRC to NAS and, when the UE has a
GUTI, is 5GMM‑REGISTERED and in 5GMM‑IDLE, generate and send a Service
Request uplink NAS message
- Tests and validation helpers: Extend nr_asn1 paging tests
to encode Paging via do_NR_Paging, decode it via nr_pcch_decode,
and verify round‑trips for multiple ng‑5G‑S‑TMSI values, accessType,
and fullI‑RNTI bit patterns, using a shared encode/decode helper that
exercises the same decoder path used by the UE.
Notes:
Paging handling currently supports CN UE paging
identity (5G‑S‑TMSI) only. RAN UE paging identity is logged and ignored.
A paging match triggers a Service Request only when the UE has a GUTI,
is 5GMM‑REGISTERED, and in 5GMM‑IDLE. T3346 and suspend‑indication
handling are documented as future work and not implemented here.
Testing:
Tested with Open5gs. How to trigger Paging in Open5GS lab setup:
- Use gNB telnet to request NGAP UE Context Release: `rrc ctx_rel_req
<RRC_UE_ID>`
- Wait until AMF reports CM-IDLE (for example gNB-UEs is now 0).
- Generate downlink data from the Linux host to the UE IP: `ping
<UE_IP>`
- Host-originated downlink data will trigger paging.
Closes#74
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Francesco Mani <email@francescomani.it>
UE paging can recreate the AS-side SDAP entity while NAS still keeps the
PDU session established. Per TS 38.304 clause 7.1 and TS 24.501 clauses
5.6.2.2.1,5.6.1.2 paging/service request restores user-plane resources
for an established PDU session, it does not imply deleting the UE IP/TUN
interface.
Deleting the UE TUN with SDAP entity teardown breaks user-plane continuity
after re-attach. We need SDAP entity lifetime and UE TUN lifetime to be
decoupled. This commit keeps a UE/PDU-session TUN registry outside the
SDAP entity lifetime. When a UE SDAP entity is recreated, reattach it
to the preserved TUN socket and restart the reader thread. On first PDU
session setup, NAS registers the TUN before attaching the reader.
The sequence is the following: (1) NAS register the iface
(2) sdap entity attaches to the iface (3) UE goes IDLE, SDAP
entity is destroyed, iface is deatched and brought down (4)
UE Service Request, SDAP entity is created (5) iface reattaches
to the SDAP entity and is brought up
UE reattach assumes the PDU session TUN interface was registered
before the SDAP entity is recreated.
DL/UL data is intentionally dropped when SDAP is not yet attached
or QFI is unavailable, rather than queued in this layer.
Changes:
- `nr_sdap.c`: keep a UE/PDU-session TUN registry, duplicate the stored
socket into each SDAP entity, and add attach/detach/destroy helpers.
- `nr_sdap_entity.c`: detach SDAP entities from their TUN reader on
deletion, preserve UE TUN interfaces across idle cleanup, and destroy
gNB TUN interfaces when the gNB entity is removed. Drop downlink SDUs
if the UE SDAP entity is not attached to a TUN socket yet.
- `openair3/NAS/NR_UE/nr_nas_msg.c`: set QFI before UE TUN creation so
first attach can pick up cached QFI.
- `common/utils/tuntap_if.c`: add `tuntap_set_up`/`tuntap_set_down` helpers
for UE interface state reflection and initialize `flags` in `tuntap_destroy`
to avoid maybe-uninitialized build failures.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Keep normal no-redirection RRCRelease on the acquired
camped-cell context while preserving the existing full
GO_TO_IDLE cell-selection path for other idle transitions.
Changes:
- Add UE_IDLE and GO_TO_IDLE_KEEP_CAMPED to represent camped
idle without starting RA.
- Map no-redirection RRCRelease to GO_TO_IDLE_KEEP_CAMPED and
keep SIB1 validity for that path.
- Release connected-mode MAC/BWP0 dedicated config while
preserving common BWP0 and paging PDCCH context.
- Keep the existing full GO_TO_IDLE cleanup for idle transitions
that must perform cell selection.
Refs:
- TS 38.331 §5.3.11
- TS 38.304 §5.2.5, §5.2.6, §7.1
- TS 38.321 §5.12
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Route paging-triggered Service Request through NAS_INITIAL_UL_TRANSFER_REQ so
RRC can buffer the PDU for RRCSetupComplete (dedicatedNAS-Message, TS 38.331)
when no UL-DCCH SRB exists, start MAC RA from RRC_IDLE, or drop the ITTI PDU
with LOG_W if SRB1/SRB2 is already established (NAS paging path is 5GMM-IDLE
only).
Changes:
- Define ITTI NAS_INITIAL_UL_TRANSFER_REQ and
NAS_INITIAL_UL_TRANSFER_REQ() (rrc_messages_def.h,
rrc_messages_types.h).
- Extend NR_UE_RRC_INST_t with pending_initial_nas for setup-complete
transport (rrc_defs.h).
- Refactor ULInformationTransfer+PDCP send into
nr_rrc_ue_send_ul_information_transfer_nas(): on NAS_UPLINK_DATA_REQ,
refuse PDCP when neither SRB1 nor SRB2 is established (free PDU).
- On NAS_INITIAL_UL_TRANSFER_REQ: store NAS in pending_initial_nas when
no SRB, in RRC_STATE_IDLE_NR set ra_trigger to RRC_CONNECTION_SETUP,
call nr_rrc_ue_prepare_RRCSetupRequest(), and nr_rrc_send_msg_to_mac()
with NR_MAC_RRC_START_RA, otherwise replace pending and send on SRB.
- Use forwarded initial NAS messafe in rrc_ue_generate_RRCSetupComplete():
if pending_initial_nas is set, move it into the NAS payload and refresh
security keys when integrity context exists, else generateRegistrationRequest().
- In nr_nas_msg.c, add send_nas_initial_ul_transfer_req() and use it for
paging Service Request instead of send_nas_uplink_data_req()
Refs: TS 24.501, TS 38.331 §5.3.3.4, TS 33.501 §6.8.1.2
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
RRC starts random access via NR_MAC_RRC_START_RA with an explicit
cause. RA trigger is no longer piggybacked on NR_MAC_RRC_CONFIG_RESET.
T300 expiry and RRC re-establishment are the call sites switched in this
commit. MAC handles setup/T300 and re-establishment paths in
nr_mac_start_ra().
Changes:
- Add nr_mac_rrc_types.h (nr_mac_ra_start_cause_t)
- Add nr_mac_rrc_start_ra_t in rrc_messages_types.h
- In rrc_UE.c, add nr_rrc_trigger_mac_ra(), call it from
handle_t300_expiry and nr_rrc_initiate_rrcReestablishment
- In config_ue.c:
- add nr_mac_start_ra() entry point with causes switch
- add nr_rrc_mac_start_ra() handler
- remove T300_EXPIRY, RE_ESTABLISHMENT reset handling
in nr_rrc_mac_config_req_reset, now delegated to
nr_mac_start_ra
- mac_defs.h: drop T300_EXPIRY from NR_UE_MAC_reset_cause_t
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Transfer UE-side paging matches from RRC to NAS so a registered idle UE
can generate and send a Service Request after `NAS_PAGING_IND`. Guard
the path with explicit cause, identity, state, and mode checks so
unsupported cases are logged and ignored.
Changes:
- in `rrc_UE.c`, send `NAS_PAGING_IND` to TASK_NAS_NRUE with cause
`AS_CONNECTION_ESTABLISH` from `rrc_nrue()` when a paging match is found
- in `nr_nas_msg.c`, implement `NAS_PAGING_IND` handling in `nas_nrue()`
- accept only paging indications with cause
`AS_CONNECTION_ESTABLISH`, then require `nas->guti`,
`FGS_REGISTERED`, and `FGS_IDLE` before proceeding
- generate the Service Request with `generateServiceRequest()` and send
it through `send_nas_uplink_data_req()`
Refs:
- TS 23.502 §4.2.3.3 (Network Triggered Service Request)
- TS 24.501 §5.6.2.2.1 (Paging for 5GS services)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
In NR RRC idle or inactive, decode PCCH SDUs from MAC and scan Paging
records (TS 38.331 §5.3.2.3) for ng-5G-S-TMSI against the UE M-TMSI
(lower 32 bits of fiveG_S_TMSI). PCCH is ignored in other states.
Changes:
- Add nr_rrc_ue_decode_pcch(): call nr_pcch_decode(), compare each
ng-5G-S-TMSI M-TMSI to (fiveG_S_TMSI & UINT32_MAX), return on match
or failure
- In rrc_nrue(), handle NR_RRC_MAC_PCCH_DATA_IND by wrapping sdu/
sdu_size in byte_array_t, calling nr_rrc_ue_decode_pcch()
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Push the 5G-S-TMSI received by UE RRC down to MAC so paging can use
the TS 38.304 UE_ID.
Changes:
- add a paging UE_ID field to the UE MAC paging configuration
- add nr_rrc_mac_config_req_paging_ue_id() to derive UE_ID from
5G-S-TMSI and store it under the MAC interface mutex
- update the NAS_5GMM_IND handling in rrc_nrue() to pass the received
5G-S-TMSI to MAC for paging PF/PO derivation
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
At each DL slot, schedule_nr_pcch() scans pcch_queue for records whose
UE paging occasion matches (frame, slot), encodes one PCCH-Message via
do_NR_Paging(), and fills P-RNTI PDCCH/PDSCH NFAPI PDUs.
Paging occasion detection is now owned by MAC via PCCH scheduler
helper that implements PF/PO computation per TS 38.304
§7. Computation is determined by defaultPagingCycle (T),
nAndPagingFrameOffset (N), ns (Ns), with PF formula
(SFN + PF_offset) mod T = (T div N) * (UE_ID mod N),
and PO slot mapping for Ns = 1/2/4. Paging is transmitted only
when (frame, slot) is the UE's paging occasion
(TS 38.304 §7.1) and when a Type2-PDCCH CSS is configured via
pagingSearchSpace, so the UE can receive it.
The RRC PCCH path is simplified accordingly.
Changes
In `openair2/LAYER2/NR_MAC_gNB/gNB_scheduler_pcch.c`:
- Add paging-specific scheduling logic, including `is_paging_occasion()`,
paging-search-space resolution, and `nr_fill_nfapi_dl_PCCH_pdu()`
- Add `schedule_nr_pcch()` implementation to allocate CCE/PDSCH
resources, populate DL/TX NFAPI requests, encode at PO via do_NR_Paging()
In gNB scheduler:
- Invoke `schedule_nr_pcch()` in SA-mode DL scheduling
In `openair2/LAYER2/NR_MAC_COMMON/nr_mac_common.c`:
- Add PCCH scheduling helpers to be reused at UE side
Also:
- Remove no longer relevant `rrc_gNB_generate_pcch_msg()` from `rrc_gNB.c`
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
When the core pages an idle UE, the DU queues paging records unti
MAC can send it on PCCH at the right PF/PO. This commit moves that
buffering into gNB MAC and connects the existing F1AP Paging entry points.
The CN UE paging is therefore routed from F1AP inputs into a MAC-managed
PCCH queue. The unused RRC PCCH generator stub is dropped. This makes paging
delivery path explicit in MAC for later PF/PO scheduling.
Changes:
- f1ap_du_paging.c: decode F1AP Paging and call f1_paging()
- mac_rrc_dl_handler.c: add f1_paging()- CN UE identity only, reject RAN UE,
call nr_mac_pcch_enqueue
- gNB_scheduler_pcch.c (new): queue init/free/enqueue, store identity only
(nr_mac_pcch_record_t: ue_id, fiveg_s_tmsi) in spsc_q
- nr_mac_gNB.h: add nr_mac_pcch_record_t and pcch_queue on NR_COMMON_channels_t
- mac_rrc_dl_direct.c: f1_paging_transfer_direct(), call f1_paging()
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Add PCCH decoding and use in ASN.1 tests.
Changes:
- add `nr_pcch_decode()`
- extend `test_asn1_msg.cpp` with `encode_decode_paging()` round trips
for multiple `ng-5G-S-TMSI` values, `accessType`, and `fullI-RNTI`
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Replace the old buffer-based do_NR_Paging API with a params struct and
byte_array_t return; add support for fullI-RNTI and optional accessType/
pagingCause. Encoding uses uper_encode_to_new_buffer, callers own and
free the returned buffer.
Changes:
- asn1_msg.h:
- Add nr_paging_params_t (ue_identity_type, union ue_identity union
{ m_tmsi or full_i_rnti }, access_type, paging_cause),
- Add NR_PAGING_FULL_I_RNTI_SIZE define.
- asn1_msg.c:
- Implement do_NR_Paging with nr_paging_params_t.
- Support ng-5G-S-TMSI (48-bit, M-TMSI in bytes 2–5)
and fullI-RNTI (40-bit, 5 bytes).
- Set optional accessType (non3GPP) and optional nonCriticalExtension
(pagingRecordList-v1700 with pagingCause-r17).
- Use asn1cCalloc for ASN.1 allocations and encode via
uper_encode_to_new_buffer. On failure free buffer and return empty
byte_array_t.
- rrc_gNB.c: disable do_NR_Paging call in rrc_gNB_generate_pcch_msg
with #if 0 (will be removed in a descendant commit, no need to update
call site yet).
- test_asn1_msg.cpp: update caller in asn1 tests (minimal change, test
will be updated in a later commit)
- common/platform_constants.h: add NR_PCCH_MAX_PAGING_RECORDS
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
wrong usage of extern declaration in C files, and header cleanup
wrong usage of extern declaration in C files, instead of headers, and
fix hidden bugs by this wrong extern declaration duplication.
this fixes pure bugs because we cast variables to the wrong types, even
if the bug has no consequence
it also separates 4G/5G include files, as the error is also in the
headers mixup. Clean up header includes in F1AP.
Further remove some "CU/DUuniqinstances".
Reviewed-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
NAS UE Service Request fixes and improvements for Paging
This MR improves the NAS UE Service Request path and makes
paging-related resume handling more robust. It fixes KSI/KgNB
synchronization, corrects 5G-S-TMSI and encoder/decoder length handling,
and adds Service Accept handling in the NAS_CONN_ESTABLI_CNF path.
It also zero-initializes the initial NAS buffer used during RRC setup
complete to avoid carrying stale data into early NAS message handling.
Reviewed-By: Cedric Roux <cedric.roux@eurecom.fr>
NR UE: remove hardcoded 64KB limit for UE capability file
When trying to parse UE capability file (xml converted from a COTS UE),
there will be an error:
[NR_RRC] UE Capabilities XER file /home/ue_caps/ue_cap_20260514_172636.xml is too large (65536)
This is fixed by replacing fixed-size stack buffer with heap allocation
sized to the actual file, allowing large UE capability XER files to be
loaded without hitting the previous 65536-byte limit.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Replace fixed-size stack buffer with heap allocation sized to the
actual file, allowing large UE capability XER files to be loaded
without hitting the previous 65536-byte limit.
Signed-off-by: Alex Jiao <alex.jiao@keysight.com>
Initialize the local NAS message container before it is used in the
RRCSetupComplete generation path to avoid undefined state from stack data.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Multi-QoS Handling and PDU Session Modify
This MR implements comprehensive QoS flows handling and PDU Session
Modify procedures in the RRC layer, enabling full support for multiple
QoS flows per DRB and dynamic QoS management per 3GPP specs. Key
changes:
1. Multi-QoS Flows Support
- Multiple QoS flows per DRB: Support for multiple QoS flows mapped to a
single DRB
- Intelligent QoS-to-DRB mapping: Implements resource-type-aware
multiplexing based on 3GPP TS 23.501 Table 5.7.4-1
- DC-GBR flows (5QI 82-90): Dedicated DRB, max 1 flow per DRB
- GBR flows (5QI 1-4, 65-67, 71-76): Max 2 flows per DRB
- Non-GBR flows (5QI 5-11, 69-70, 79-80): Max 5 flows per DRB
- Aggregate cap: Maximum 5 flows per DRB
- 5QI validation: Early validation of standardized 5QI values (1-9,
65-90) during QoS flow setup/modify
2. PDU Session Modify Procedures
- Complete E1AP/RRC integration: Full Bearer Context Modification
support with DRB lifecycle management
- DRB To Setup/Modify/Remove lists: Complete support for all DRB
operations in Bearer Context Modification
- QoS flow operations: Support for QoS flow add, modify, and release
operations
- QoS flow mapping: Proper handling of QoS flow modifications in
DRB To Modify List
- Automatic DRB management: DRB setup, modification, and removal
based on QoS flow changes. Reuse existing DRBs if the incoming QoS
flow is compatible.
- Delayed transactions: PDU Session Modify added to delayed
transactions list for proper sequencing
3. GTP-U Tunnel Refactoring
- Architecture alignment:
- N3 tunnels: 1 per PDU session with QFI marking, container for
multiple bearers, supporting multiple QoS flows
- F1-U tunnels: 1 per DRB without QFI marking
- SDAP ownership of QoS: move QoS management to be fully owned by
SDAP
4. QoS Enhancements
- Dynamic5QI support: Full support for Dynamic5QI with packet delay
budget and packet error rate
- GBR QoS flows: Support for Guaranteed Bit Rate QoS flows with
GFBR/MFBR parameters
- DRB QoS aggregation: DRB-level QoS computed from all mapped QoS
flows using ARP priority (not 5QI priority)
- QoS priority level refactoring: Proper type definitions per 3GPP
TS 23.501 (QoS Priority Level: 1-127, ARP Priority Level: 1-15)
Technical Changes
RRC Layer
- Refactored `nr_rrc_add_bearers()` to support intelligent QoS-to-DRB
mapping
- Added `nr_rrc_update_qos()` for QoS flow add/modify with automatic DRB
assignment
- Implemented `nr_rrc_update_pdusession()` for QoS flow release and DRB
cleanup
- Consolidated F1 UE Context Modification Request handling
- Simplified PDU status tracking by removing intermediate states
- Added QoS flow and DRB removal utilities
- Updated RRC bearers tests with comprehensive multi-QoS testing
- Adapted `nr-cuup-load-test.c` to new GTP design
NGAP Layer
- Extended PDU Session Resource Modify Request Transfer with QoS
add/modify/release lists
- Added proper type definitions (`pdusession_mod_req_transfer_t`,
`qos_flow_to_release_t`)
- Fixed NGAP PDU Session Modify transfer encoding
GTP-U Layer
- Refactored tunnel creation API: scalar fields instead of arrays
- Split tunnel creation into `n3_gtpu_create()` and
`f1_drb_gtpu_create()`
- Added bearer-to-QFI mapping structure (`gtpv1u_rb_t`)
- Implemented QFI de-duplication and one-to-one QFI-to-bearer mapping
- Reduced inter-dependencies between LTE and NR
SDAP Layer
- Fixed default DRB tracking: Only one default DRB per SDAP entity per
PDU session (TS 37.324)
- Set default DRB to first DRB added when creating bearers
F1AP Layer
- Added GBR QoS Flow Information IE handling in CU
- Implemented DRB QoS aggregation from multiple QoS flows
- Extended F1AP test cases to support multiple QoS flows
Code Quality Improvements
- Improved error handling throughout the stack
- Enhanced logging and debugging capabilities
- Added comprehensive unit tests for multi-QoS scenarios
- Improved type safety and validation
Testing
The code was validated with Open5gs v2.7.6, OAI CN5G and COTS UE.
How to reproduce with Open5gs:
1. Start Open5gs
2. From the Open5gs web UI: add multiple QFIs to the same DNN.
3. Restart Open5gs
4. Run gNB and UE
The user will see the following:
1. QoS flows arrive via NGAP PDU Session Setup/Modify requests, each
with a QFI and 5QI.
2. The gNB assigns each flow to a DRB, creating a new DRB or reusing an
existing one based on 5QI compatibility (compatible flows, i.e. same
5QI characteristics, share a DRB)
3. At the SDAP layer, packets are tagged with QFI headers; at the GTP-U
layer, uplink packets include QFI in the PDU Session Container for
core network mapping.
Documentation
- Added comprehensive QoS flows handling documentation with 3GPP
standards references
- Updated PDU Session Modify sequence diagrams
Note
* This implementation aligns with:
- 3GPP TS 23.501 (QoS framework)
- 3GPP TS 38.413 (NGAP)
- 3GPP TS 37.324 (SDAP)
- 3GPP TS 38.463 (F1AP)
- 3GPP TS 29.281 (GTP-U)
- 3GPP TS 38.331 (RRC)
* Multi-QoS and PDU Session Modify are both added to this MR since QoS
flows update is triggered by PDU Session Modify in some scenarios
(e.g. with Open5gs, used for validation).
* Core functional changes introduced by commits with prefix "QoS
Handling" or "PDU Session Modify"
* This MR replaces the old !2703.
* This MR adopts relevant CU changes from !2836, namely:
* Adds new shared QoS types
* Add standardized 5QI table and helper
* Dynamic5QI support + validation
* Computation of DRB QoS (aggregate QoS) and priority/GBR
* F1AP DRB-level QoS
* Closes#541 (5QI validation)
* Closes#1075 (Optional NAS-PDU in PDU Session Setup Request)
Signed-off-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>
Reviewed-by: Rakesh Mundlamuri <rakesh.mundlamuri@openairinterface.org>
Verify that a given cell's assoc_id (i.e., it's "host DU") is the
assoc_id of the currently treated DU to avoid treating a config update
of another (potentially malicious) DU.
Closes: #1081
Signed-off-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Issue:
With a commercial UE, NGAP traces showed the PDU Session Resource Modify
Response carrying a QoSFlowAddOrModifyResponseList that did not match the
preceding Modify Request: the gNB listed every QoS flow already stored on the
PDU session instead of only the flows present in QoS Flow Add or Modify Request
List for that modify.
e.g. QoSFlowAddOrModifyResponseList including QFI 1,2
QoSFlowAddOrModifyRequestList QFI 2
AMF ErrorIndication with semantic_error after modify
That breaks the intended semantics in TS 38.413, which
expects QoSFlowAddOrModifyResponseList to carry the QFIs from this
procedure’s QoS Flow Add or Modify Request List only.
Changes:
Add a per-flow ngap_pending flag set in nr_rrc_update_qos when a request
item is applied, clear it before each new modify, and build the response
from marked flows only.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
* Extend delay_transaction() and rrc_delay_transaction() to support NGAP_PDUSESSION_MODIFY_REQ
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
This commit extends PDU Session Modify handling with E1AP Bearer Context
Modification integration for QoS flow add/modify/release and DRB lifecycle
updates (setup, modification, removal).
E1AP Bearer Context Modification - DRB Setup Support:
- Extend CU-UP handler (e1_bearer_context_modif) to process DRBs to setup/to remove:
create F1-U tunnels, create/release PDCP-SDAP resources, and update QoS flow mappings
- Extend CU-CP response handler to process DRBs to setup: save F1-U tunnel info,
mark PDU sessions for RRC reconfiguration, and trigger F1 UE Context
Modification Request with both setup and release DRBs
- Update rrc_gNB_process_e1_bearer_context_modif_resp to collect DRBs to
setup/release from E1 response, send F1 UE Context Modification when needed,
and otherwise trigger direct RRC reconfiguration or NGAP modify response.
- Populate the E1AP Bearer Context Modification request with DRB-To-Setup and
DRB-To-Modify lists derived from QoS flow processing. For CP->UP E1 Bearer
Context Modification, Flow Mapping Information in DRB-To-Modify carries
the QoS Flow QoS Parameters List for that DRB: per TS 38.463, when present,
CU-UP replaces the previous mapping for that DRB, and this behavior is now enforced.
RRC PDU Session Modify - QoS and DRB Management:
- Add nr_rrc_apply_qos_add_modify() to process QoS add/modify and map flows to
existing or new DRBs
- Add nr_rrc_apply_qos_release() and nr_rrc_apply_pdusession_modify() to
process QoS release, build E1 DRB setup/modify/remove lists, and prepare
bearer-context modification.
- Refactor nr_rrc_update_qos() processing for QoS add/modify,
with DRB mapping to existing or new DRBs through the modify path helpers
- Extend nr_rrc_update_pdusession() with helpers for QoS
add/modify/release, building E1 DRB modify/setup/remove lists, and
sending bearer-context modification.
- Integrate E1 Bearer Context Modification into PDU Session Modify flow to
propagate DRB changes to CU-UP
- Update default DRB in SDAP configuration after QoS changes
- Add `nr_sdap_entity_update_qos_flows` to replace DRB flow
mappings from E1 flow information and clear stale SDAP role/mapping
state when QFIs are removed.
Code Refactoring:
- Add find_or_add_pdu_session_mod() to create/reuse session entries
in the E1 Bearer Context Modification request while building message.
- Add nr_rrc_send_e1_after_qos_update() to detect DRBs left without mapped
QoS flows, remove them from UE state, and append them to E1 DRBs-to-remove.
- Use rrc_gNB_generate_dedicatedRRCReconfiguration instead of
rrc_gNB_modify_dedicatedRRCReconfiguration, drop the old function
End-to-End PDU Session Modify Flow:
1. AMF -> CU-CP: NGAP PDU Session Resource Modify Request (QoS add/modify/release)
2. CU-CP (RRC): Process QoS flows -> map to DRBs (reuse existing or create new) ->
populate E1AP Bearer Context Modification Request (DRBs to setup/modify/remove)
3. CU-CP -> CU-UP: E1AP Bearer Context Modification Request
4. CU-UP: Create F1-U tunnels for new DRBs -> create/release PDCP-SDAP
resources -> update DRB/QFI mapping information
5. CU-UP -> CU-CP: E1AP Bearer Context Modification Response (F1-U tunnel info)
6. CU-CP: If DRB setup/release exists, send F1 UE Context Modification Request
7. CU-CP: Else if QoS/NAS requires it, send direct RRC Reconfiguration
8. CU-CP: Else complete modify directly with NGAP PDU Session Resource Modify Response
9. UE -> CU-CP: RRC Reconfiguration Complete
10. CU-CP -> AMF: NGAP PDU Session Resource Modify Response
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
This commit extends the PDU Session Resource Modify Request handling (within
PDU Session Modify) to fully support QoS Flow add/modify and release operations
(3GPP TS 38.413 section 9.3.4.3) via the Transfer IE. This is propagated to
RRC which performs PDU Session update, which occurs upon PDU Session Modify.
Refactoring was necessary since type `pdusession_transfer_t` and
`pdusession_resource_item_t` both for setup, were inaccurately used for the modify procedure.
The implementation adds proper type definitions, decoding logic,
and error handling for QoS flow management during PDU session modification transfer,
namely:
- Adds QoS add/modify and release lists to the NGAP Modify Request Transfer type
- Introduces QoS Flow With Cause IE
- Decode new IEs and propagate QoS changes to RRC session state
NGAP PDU Session Modify Request Transfer:
- Add qos_flow_to_release_t structure to represent QoS Flow to Release Items IE
with QFI and release cause (per 3GPP TS 38.413 section 9.3.1.13)
- Introduce pdusession_mod_req_transfer_t structure to properly represent
PDU Session Resource Modify Request Transfer IEs:
* QoS Flow Add or Modify Request List (mandatory)
* QoS Flow to Release List (optional)
- Add pdusession_resource_mod_item_t structure for PDU Session Resource
Modify Request Items, replacing pdusession_resource_item_t, which is for setup
- Update ngap_pdusession_modify_req_t to use the new type-specific structure
- Refactor decodePDUSessionResourceModify() to return
pdusession_mod_req_transfer_t instead of pdusession_transfer_t
- Implement proper decoding of QosFlowAddOrModifyRequestList IE
- Add decoding support for QosFlowToReleaseList (QosFlowListWithCause) IE:
* Extract QFI and cause for each QoS flow to be released
- Improve error handling throughout
ngap_msg_includes.h:
- Add includes for NGAP_QosFlowListWithCause.h and
NGAP_QosFlowWithCauseItem.h to support QoS flow release decoding
NGAP/RRC:
- Update nr_rrc_update_pdusession() function signature to accept
pdusession_resource_mod_item_t instead of pdusession_resource_item_t
- Remove references to unnecessary pdu_session_type and n3_incoming
fields that are not part of the Modify Request Transfer structure
- Update QoS flow update logic to use nb_qos_to_add_modify and
qos_to_add_modify fields from the new transfer structure
This implementation aligns NGAP with 3GPP TS 38.413 specifications
and provides a foundation for handling QoS flow modifications and releases
during PDU session resource modification procedures.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
