Downlink packets can be sent with the wrong QFI before any uplink packet has been received for the session. This was noticed with the simple-switch UPF, ~~however it is separate from QoS enforcement support and possible present in the eBPF UPF as well.~~ EDIT: not present in eBPF UPF. From logs and debugging: - SMF creates the PFCP session with `QFI = 1` - CN logs show `QFI = 1` on creation of PDR 1 - RAN expects `QFI = 1` - but the UPF sends DL GTP-U packets with `QFI = 5` before the first UL packet arrives It looks like the UPF sets DL GTP-U QFI from `session->qfi`, which defaults to `0x05`, and this value is only overwritten later when an UL packet is classified on the UL PDR path (for example through `pfcp_session_look_up_pack_in_access`). In an N2 handover scenario, DL traffic was sent before any UL traffic is seen, so `session->qfi` was never corrected in time. Problem: the UPF should preserve and use the QFI provisioned by SMF/PFCP when encapsulating DL packets toward the RAN. When the UPF sends a different QFI than the one configured, that causes a mismatch with what the RAN expects and can break scenarios where DL packets are sent before the UL. See logs in https://gitlab.eurecom.fr/oai/openairinterface5g/-/merge_requests/3814#note_218834: - SMF log: - `Successfully associate PDR 1 with F-TEID ID 0x1 - IP: ... (QFI: 1)` - `QoS parameters: QFI 1, 5QI: 9, ...` - UE/RAN side later sees: - `Dropping UL SDAP PDU with unmapped QFI=5` So the session is provisioned with `QFI 1`, but traffic is seen with `QFI 5`. Steps to reproduce: 1. Deploy with multiple QoS flows 2. Trigger an N2 handover scenario. 3. Send DL traffic immediately after handover, before any UL packet is sent by the UE. 4. Observe the QFI used by the UPF in DL GTP-U traffic and the UE/RAN behavior for errors/warnings. As a workaround, sending an UL ping before DL traffic avoids the issue because the UL packet causes the UPF to classify the session and overwrite the default QFI.