Intra LTE Handover with NR bearerconfig IE handover failed

Hi experts,

Please help me to understand why the reestablishment handover here is rejected.

Is it because the NR bearerconfig info forwarded cause the handover failure?

//NR PDCP Configured

drb-ToAddModList 
  {
    {
      cnAssociation eps-BearerIdentity : 5,
      drb-Identity 1,
      reestablishPDCP true,
      pdcp-Config 
      {
        drb 
        {
          discardTimer infinity,
          pdcp-SN-SizeUL len18bits,
          pdcp-SN-SizeDL len18bits,
          headerCompression notUsed : NULL,
          statusReportRequired true
        },
        t-Reordering ms120
      }
    }
  },
  securityConfig 
  {
    securityAlgorithmConfig 
    {
      cipheringAlgorithm nea2,
      integrityProtAlgorithm nia2

//LTE HO is configured but “reestablishPDCP” IE is not configured

2022 Apr  5  04:46:44.733  [A4]  0xB0C0  LTE RRC OTA Packet  --  DL_DCCH / RRCConnectionReconfiguration

Subscription ID = 1
Physical Cell ID = 301
Freq = 9310
              mobilityControlInfo 
              {
                targetPhysCellId 231,
                carrierFreq 
                {
                  dl-CarrierFreq 38100
                },
                drb-ToAddModList 
                {
                  {
                    eps-BearerIdentity 5,
                    drb-Identity 1,
                    rlc-Config am : 
                      {
			  securityConfigHO 
              {
                handoverType intraLTE : 
                  {
                    securityAlgorithmConfig 
                    {
                      cipheringAlgorithm eea2,
                      integrityProtAlgorithm eia2
                    },
                    keyChangeIndicator FALSE,

Observation/Conclusion:

  1. DUT:- Model Name:- A736BXXU1AVCA CSC:- CSC(XME), NET1(XME), NET2(XME) HW ID:- 7
    QCom Build ID:- MPSS.HI.4.3.c5.1-00005-KODIAK_GEN_PACK-1.3500.53
    IMEI:- 35282829003211/7 Sim ID:- 8960152203339804190F

  2. Device is on LTE Pcell PCI 301, Freq 9310 & in one case it was on PCI 454, Freq 9310

  3. NR PDCP is configured, LTE HO takes place but “reestablishPDCP” IE is not configured by the NW

  4. Since in this case LTE keys are changing as HO is triggered, so reestablishPDCP flag need to be set by the network.

  5. Due to multiple NR Reconfig failure device goes to no service mode which is impacting user experience

  6. Spec reference 36.331 5.3.4.5
    NOTE 2a: At handover the reestablishPDCP flag will be set for all RBs configured with NR PDCP in nr-RadioBearerConfig1 or nr-RadioBearerConfig2 TS 38.331 [82] which will cause the PDCP entity to be re-established also for these RBs.

  7. NW to check the reason why “reestablishPDCP” IE was not included
    Analysis:

//NR PDCP Configured

drb-ToAddModList 
  {
    {
      cnAssociation eps-BearerIdentity : 5,
      drb-Identity 1,
      reestablishPDCP true,
      pdcp-Config 
      {
        drb 
        {
          discardTimer infinity,
          pdcp-SN-SizeUL len18bits,
          pdcp-SN-SizeDL len18bits,
          headerCompression notUsed : NULL,
          statusReportRequired true
        },
        t-Reordering ms120
      }
    }
  },
  securityConfig 
  {
    securityAlgorithmConfig 
    {
      cipheringAlgorithm nea2,
      integrityProtAlgorithm nia2

//LTE HO is configured but “reestablishPDCP” IE is not configured

2022 Apr  5  04:46:44.733  [A4]  0xB0C0  LTE RRC OTA Packet  --  DL_DCCH / RRCConnectionReconfiguration
Subscription ID = 1
Physical Cell ID = 301
Freq = 9310
              mobilityControlInfo 
              {
                targetPhysCellId 231,
                carrierFreq 
                {
                  dl-CarrierFreq 38100
                },
                drb-ToAddModList 
                {
                  {
                    eps-BearerIdentity 5,
                    drb-Identity 1,
                    rlc-Config am : 
                      {
			  securityConfigHO 
              {
                handoverType intraLTE : 
                  {
                    securityAlgorithmConfig 
                    {
                      cipheringAlgorithm eea2,
                      integrityProtAlgorithm eia2
                    },
                    keyChangeIndicator FALSE,

//In LTE HO is taking place and keys are being changes so NW should configure reestablishPDCP

04:46:44.731	nr5g_rrc_llcdb.c     43508     ELLCDB: RRC OTA validation failed. Security key changed without reestablishRLC (DRB id 1)
04:46:44.731	nr5g_rrc_llcdb.c     32512     ELLCDB: PDCP/RLC Reestablish validation failed
04:46:44.731	nr5g_rrc_utils.c     3672     HSending NR5G_RRC_CFG_STAT_UPD_IND with status (1). Overall config                 num_bearer (0), nr5g_sec_config_valid(0), mrdc_bc_info.lte_band_combo.num_bands(0), mrdc_bc_info.nr_band_combo.num_bands (0) num_nr_cc(0)
04:46:44.731	nr5g_rrc_llc.c     2062     ELLCDB: cfg_reqi processing for proc (4) type (0) failed ! step1_step2_status (1) 
04:46:44.731	lte_rrc_config_nr5g.c     471     HReceived NR5G_RRC_CFG_STAT_UPD_IND(status:1) FAILURE due to validatn from NR5G-RRC, Triggering RLF 

2022 Apr  5  04:46:44.732  [37] 0x1FFB Event  --  EVENT_LTE_RRC_RADIO_LINK_FAILURE_STAT RLF Cause = RLF NR RECONGIF FAILURE
2022 Apr  5  04:46:45.475  [4B]  0xB0C0  LTE RRC OTA Packet  --  UL_CCCH / RRCConnectionReestablishmentRequest
Subscription ID = 1
Physical Cell ID = 55
Freq = 6245
reestablishmentCause reconfigurationFailure,
2022 Apr  5  04:46:45.536  [54]  0xB0C0  LTE RRC OTA Packet  --  DL_CCCH / RRCConnectionReestablishmentReject
Physical Cell ID = 55
Freq = 6245
2022 Apr  5  04:46:45.627  [87]  0xB0ED  LTE NAS EMM Plain OTA Outgoing Message  --  Tracking area update request Msg
2022 Apr  5  04:46:45.629  [83]  0xB0C0  LTE RRC OTA Packet  --  UL_CCCH / RRCConnectionRequest
Physical Cell ID = 55
Freq = 6245
2022 Apr  5  04:46:45.701  [60]  0xB0C0  LTE RRC OTA Packet  --  UL_DCCH / RRCConnectionSetupComplete
Physical Cell ID = 55
Freq = 6245
2022 Apr  5  04:46:49.774  [1A]  0xB0EC  LTE NAS EMM Plain OTA Incoming Message  --  Tracking area update reject Msg
Subscription ID = 1
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
security_header_or_skip_ind = 0 (0x0)
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 75 (0x4b) (Tracking area update reject)
lte_emm_msg
  emm_ta_update_rej
    emm_cause
      cause_value = 9 (0x9) (UE identity cannot be derived by the network)
2022 Apr  5  04:46:49.774  [60]  0xB0C0  LTE RRC OTA Packet  --  DL_DCCH / RRCConnectionRelease
Physical Cell ID = 55
Freq = 6245
2022 Apr  5  04:46:49.847  [BA]  0xB0C0  LTE RRC OTA Packet  --  UL_CCCH / RRCConnectionRequest
Physical Cell ID = 55
Freq = 6245
04:44:04.660	nr5g_rrc_llcdb.c     43508     ELLCDB: RRC OTA validation failed. Security key changed without reestablishRLC (DRB id 3)
04:44:04.660	nr5g_rrc_llcdb.c     32512     ELLCDB: PDCP/RLC Reestablish validation failed
04:44:04.660	nr5g_rrc_utils.c     3672     HSending NR5G_RRC_CFG_STAT_UPD_IND with status (1). Overall config                 num_bearer (0), nr5g_sec_config_valid(0), mrdc_bc_info.lte_band_combo.num_bands(0), mrdc_bc_info.nr_band_combo.num_bands (0) num_nr_cc(0)
04:44:04.660	nr5g_rrc_llc.c     2062     ELLCDB: cfg_reqi processing for proc (4) type (0) failed ! step1_step2_status (1) 
04:44:04.660	lte_rrc_config_nr5g.c     471     HReceived NR5G_RRC_CFG_STAT_UPD_IND(status:1) FAILURE due to validatn from NR5G-RRC, Triggering RLF 
2022 Apr  5  04:44:04.660  [E3] 0x1FFB Event  --  EVENT_LTE_RRC_RADIO_LINK_FAILURE_STAT RLF Cause = RLF NR RECONGIF FAILURE
04:46:19.571	nr5g_rrc_sec.c     1540     HRRC SEC:Received new sk_counter (0)
04:46:19.571	nr5g_rrc_sec.c     1551     HRRC SEC:Current SN cipher Algo is NEA0. Not invalidating NR keys for new sk-counter
04:46:19.571	nr5g_rrc_llcdb.c     43508     ELLCDB: RRC OTA validation failed. Security key changed without reestablishRLC (DRB id 3)
04:46:19.571	nr5g_rrc_llcdb.c     32512     ELLCDB: PDCP/RLC Reestablish validation failed
04:46:19.571	nr5g_rrc_utils.c     3672     HSending NR5G_RRC_CFG_STAT_UPD_IND with status (1). Overall config                 num_bearer (0), nr5g_sec_config_valid(0), mrdc_bc_info.lte_band_combo.num_bands(0), mrdc_bc_info.nr_band_combo.num_bands (0) num_nr_cc(0)
04:46:19.571	nr5g_rrc_llc.c     2062     ELLCDB: cfg_reqi processing for proc (4) type (0) failed ! step1_step2_status (1) 
04:46:19.571	lte_rrc_config_nr5g.c     471     HReceived NR5G_RRC_CFG_STAT_UPD_IND(status:1) FAILURE due to validatn from NR5G-RRC, Triggering RLF 

2022 Apr  5  04:46:19.572  [81] 0x1FFB Event  --  EVENT_LTE_RRC_RADIO_LINK_FAILURE_STAT RLF Cause = RLF NR RECONGIF FAILURE