Wrong UL traffic mapping for multi-QoS

[sgarg00]

Originally reported by Guido Casati on 2026-05-20 — GitLab #1096

With multiple QoS flows, the OAI NR UE seems to direct all uplink traffic to the wrong QoS flow.

This most likely due to the UE using only first QoS rule’s QFI from PDU Session Establishment Accept (handle_pdu_session_accept) for SDAP reading (sdap_tun_read_thread) from the TUN. Additional QoS rules are not used to select QFI per packet on UL.

That matches lab reports where gNB LCID vs traffic sent looks “wrong”.

Expected behavior: UE receives multiple QoS rules with packet filters and direction applicable to UL, maps UL traffic to the correct QFI (and thus DRB via SDAP) according to those rules.

See TS 24.501 and TS 37.324.

Steps to reproduce:

• Core: Configure 2 QoS flows or more (e.g. QFI 1 / 2 / 3) and distinct packet filters (e.g. UDP ports 52080 - QFI 2, 52081 - QFI 3)
• gNB and UE: Attach and confirm in logs that multiple QFIs are established.
• UL: From UE, run iperf to 52080 and 52081
• Result:
  • N3 GTPU UL PDUs show same QFI 1 for both ports,
  • gNB MAC shows UL bytes on default LCID only,
  • UE SDAP logs TX Entity QFI 1 only.

e.g. ul-qfi-issue-01.pcapng

where we have

• DRB 1 - QFI 1 (5QI 9), default DRB
• DRB 2 - QFI 2 (5QI 69) and QFI 3 (5QI 67) multiplexed on the same DRB
• two UDP flows (e.g. iperf to 10.45.0.x:52080 and :52081) expecting two QoS flows / two DRBs and therefore activity on both LCID 4 and LCID 5, however
  • all UL user bytes you see are on LCID 4, not LCID 5
  • UL SDAP to GTP shows only qfi=1