5G RRC连接重建（RRC Re-establishment）信令流全链拆解

flowchart TD
    A[UE评估PDCCH BLER] -->|BLER >= Qout| B[N310计数器+1]
    A -->|BLER < Qout| C[N311计数器+1]
    B -->|N310达到门限| D[启动T310定时器]
    D -->|T310超时| E[宣告RLF]
    D -->|N311达到门限| F[停止T310, 恢复同步]
    E --> G[启动T311, 开始小区选择]
    G -->|找到合适小区| H[发起RRC连接重建]
    G -->|T311超时| I[进入RRC_IDLE]

sequenceDiagram
    participant UE as UE
    participant DU as gNB-DU(目标)
    participant CU as gNB-CU(目标)
    participant Src as gNB-CU(源)
    participant AMF

    Note over UE: RLF检测 / 切换失败 / 重配失败
    Note over UE: 启动T311, 小区选择

    rect rgb(255, 230, 230)
    Note over UE,DU: Phase 1: 随机接入
    UE->>DU: 1. PRACH Preamble (Msg1)
    DU->>UE: 2. Random Access Response (Msg2, 分配新C-RNTI+TA)
    end

    rect rgb(230, 255, 230)
    Note over UE,CU: Phase 2: RRC重建请求
    UE->>DU: 3. RRCReestablishmentRequest (SRB0/CCCH)
    Note right of UE: ue-Identity={C-RNTI, PCI}<br/>reestablishmentCause<br/>shortMAC-I(16bit)
    DU->>CU: 4. F1AP: INITIAL UL RRC MESSAGE TRANSFER
    end

    rect rgb(230, 230, 255)
    Note over CU,Src: Phase 3: Xn上下文获取
    CU->>Src: 5. XnAP: RETRIEVE UE CONTEXT REQUEST
    Note right of CU: 携带源PCI + C-RNTI + shortMAC-I
    Src->>CU: 6. XnAP: RETRIEVE UE CONTEXT RESPONSE
    Note left of Src: 携带完整UE上下文:<br/>CellGroupConfig, SecurityContext,<br/>DRB列表, PDU Session信息
    end

    rect rgb(255, 255, 230)
    Note over UE,AMF: Phase 4: RRC重建完成
    CU->>DU: 7. F1AP: DL RRC MESSAGE TRANSFER (含RRCReestablishment)
    DU->>UE: 8. RRCReestablishment (SRB1/DCCH)
    Note left of UE: masterCellGroupConfig<br/>radioBearerConfig<br/>nextHopChainingCount
    UE->>DU: 9. RRCReestablishmentComplete (SRB1/DCCH, 加密+完整性保护)
    DU->>CU: 10. F1AP: UL RRC MESSAGE TRANSFER
    end

    rect rgb(240, 230, 255)
    Note over CU,AMF: Phase 5: 后续恢复（可选）
    CU->>AMF: 11. NGAP: PATH SWITCH REQUEST
    Note right of CU: 通知AMF UE已切换到新gNB
    AMF->>CU: 12. NGAP: PATH SWITCH REQUEST ACK
    CU->>Src: 13. XnAP: UE CONTEXT RELEASE
    CU->>UE: 14. RRCReconfiguration (恢复DRB等)
    UE->>CU: 15. RRCReconfigurationComplete
    end

RRCReestablishmentRequest ::=    SEQUENCE {
    ue-Identity         ReestablishmentUE-Identity,
    reestablishmentCause    ENUMERATED {reconfigurationFailure,
                                        handoverFailure,
                                        otherFailure,
                                        spare},
    spare                    BIT STRING (SIZE (2))
}

ReestablishmentUE-Identity ::=    SEQUENCE {
    c-RNTI                 BIT STRING (SIZE (16)),
    physCellId             PhysCellId (0..1007),
    shortMAC-I             ShortMAC-I
}

ShortMAC-I ::=    BIT STRING (SIZE (16))

flowchart LR
    A["K<sub>RRCint</sub>"] -->|KDF| B["计算完整MAC-I<br/>(128 bit)"]
    C["源PCI + 源频点ARFCN"] --> B
    D["消息内容"] --> B
    B -->|截断低16位| E["shortMAC-I<br/>(16 bit)"]

    style A fill:#ff9999
    style E fill:#99ff99

RRCReestablishment ::=    SEQUENCE {
    rrc-TransactionIdentifier    RRC-TransactionIdentifier (0..3),
    criticalExtensions           CHOICE {
        rrcReestablishment           RRCReestablishment-IEs
    }
}

RRCReestablishment-IEs ::=    SEQUENCE {
    masterCellGroup          OCTET STRING,      -- 包含CellGroupConfig
    lateForwardingSCG        ENUMERATED {true} OPTIONAL,
    radioBearerConfig        RadioBearerConfig,
    masterKeyUpdate          MasterKeyUpdate OPTIONAL,
    dedicatedNAS-MessageList SEQUENCE OF DedicatedNAS-Message OPTIONAL,
    nonCriticalExtension     RRCReestablishment-v1530-IEs OPTIONAL
}

MasterKeyUpdate ::=    SEQUENCE {
    keySetChangeIndicator    BOOLEAN,
    nextHopChainingCount     NextHopChainingCount (0..7),
    k-RFCfg                  Key-RFCfg OPTIONAL
}

flowchart TD
    A["K<sub>AMF</sub> (AMF根密钥)"] -->|"KDF"| B["K<sub>gNB</sub> (源gNB密钥)"]
    B -->|"KDF + PCI + ARFCN"| C["K<sub>gNB</sub>* (目标gNB密钥)"]
    C -->|"KDF + NH"| D["K<sub>gNB-new</sub> (新gNB密钥)"]
    D -->|"KDF"| E["K<sub>RRCint</sub>"]
    D -->|"KDF"| F["K<sub>RRCenc</sub>"]
    D -->|"KDF"| G["K<sub>UPint</sub>"]
    D -->|"KDF"| H["K<sub>UPenc</sub>"]

    style A fill:#ffcccc
    style B fill:#ffddaa
    style C fill:#ffffaa
    style D fill:#aaffaa
    style E fill:#aaddff
    style F fill:#aaddff
    style G fill:#aaddff
    style H fill:#aaddff

RETRIEVE UE CONTEXT REQUEST:
  - Source PCI
  - Source C-RNTI  
  - shortMAC-I (16 bit)
  - Target Cell ID

RETRIEVE UE CONTEXT RESPONSE (成功):
  - UE Context (完整):
    · CellGroupConfig (MAC/RLC/PHY配置)
    · Security Context (密钥材料)
    · RRC-Container (源小区的RRC配置)
    · PDU Session Resource List
    · DRB Information
    · UE Aggregate Maximum Bit Rate
    · Allowed Nssai List
  - RRC-Container with RRCReestablishment message (可选)

RETRIEVE UE CONTEXT FAILURE (失败):
  - Cause: unknown-pair, short-mac-failure等

sequenceDiagram
    participant UE
    participant DU as gNB-DU(目标)
    participant CU as gNB-CU(目标)

    Note over UE: RLF后选择到目标DU小区

    UE->>DU: PRACH + RRCReestablishmentRequest
    DU->>DU: 查找old gNB-DU F1AP UE ID
    Note over DU: 若old UE在本DU:<br/>直接获取上下文

    alt Old UE在同一个DU
        DU->>DU: 复用原有上下文
        DU->>CU: INITIAL UL RRC MESSAGE TRANSFER
    else Old UE在不同DU或同一CU下
        DU->>CU: INITIAL UL RRC MESSAGE TRANSFER
        Note right of DU: 含源PCI + C-RNTI
        CU->>CU: 通过PCI确定源gNB
        CU->>CU: Xn获取源UE上下文
        CU->>DU: F1AP: UE CONTEXT SETUP REQUEST
        Note left of CU: 携带CellGroupConfig等
        DU->>CU: F1AP: UE CONTEXT SETUP RESPONSE
    end

    CU->>DU: F1AP: DL RRC MESSAGE TRANSFER (RRCReestablishment)
    DU->>UE: RRCReestablishment
    UE->>DU: RRCReestablishmentComplete
    DU->>CU: F1AP: UL RRC MESSAGE TRANSFER

stateDiagram-v2
    [*] --> RRC_CONNECTED: RRC Setup完成
    RRC_CONNECTED --> RLF_Detected: T310超时 / 切换失败 / 重配失败
    RLF_Detected --> Cell_Selection: 启动T311
    Cell_Selection --> RRC_Reestab_Proceed: 找到合适小区(T311未超时)
    Cell_Selection --> RRC_IDLE: T311超时

    RRC_Reestab_Proceed --> Wait_Reestab: 发送Request, 启动T301
    Wait_Reestab --> RRC_CONNECTED: 收到RRCReestablishment
    Wait_Reestab --> RRC_IDLE: T301超时
    Wait_Reestab --> RRC_IDLE: 收到RRCReject + T302超时

    RRC_CONNECTED --> RRC_Reconfig: 恢复DRB
    RRC_Reconfig --> RRC_CONNECTED: 重配成功

# 过滤RRC Reestablishment Request (RRC层)
tshark -i eth0 -f "port 38472" -Y "rrc.rrcConnectionReestablishmentRequest"

# 过滤XnAP Retrieve UE Context
tshark -i eth0 -f "port 38473" -Y "xnap.RetriveUEContext"

# 过滤F1AP UE Context Setup (CU-DU架构)
tshark -i eth0 -f "port 38472" -Y "f1ap.procedureCode == 40"

# 统计RRC重建成功率
tshark -r capture.pcap -Y "rrc.rrcConnectionReestablishmentRequest || rrc.rrcConnectionReestablishment || rrc.rrcConnectionReestablishmentComplete" -T fields -e rrc.messageType | sort | uniq -c