Integration `2025.w46`

* !3754 NR UE: correctly provide measured SSB SINR value from PHY to MAC
* !3666 NTN: Fixing variable ULDLduplex issue for NTN bands
* !3747 SDAP: guard RX header parsing with enable_sdap and init per-entity
* !3729 DCI 00 alt size fix
* !3753 gNB: fix MAC TA command scheduling if measurement gaps are configured
* !3722 [NGAP] Fix incorrect AMF Set ID type (uint8 → uint16) causing AMF lookup failure
* !3745 Collection of small fixes
* !3755 CI: Increase tested UL throughput on Aerial pipeline using 2L UL
* !3752 [MAC] Add UL total/used aggregated MAC stats; [E2 agent] Properly calculate used UE PRBs in KPM
* !3707 Cleanup phy_procedures_gNB_uespec_RX
* !3750 Handling newly opened UE issues
* !3751 Update log header format to align log output
* !3757 Remove schedule response and update L1 threading documentation
* !3748 Refactor imscope
* !3760 gNB: modify RLC configuration applied for SRB1 during RRCReestablishment
* !3684 PDU Session Release

Closes #867, #960, #1025, #1024, #1026, #1031, #1030, and #1012

See merge request oai/openairinterface5g!3756

PDU Session Release

This MR implements end-to-end PDU Session Release functionality
according to 3GPP TS 38.413 and TS 38.331 specifications.

Reason for Change Previous implementation had incomplete and wrongly
places tunnel cleanup during PDU session release. UP cleanup shall be
done at CUUP, RRCReconfiguration shall be sent after retrieval of
updated CellGroupConfig from the DU. This implies F1 and E1 exchanges
during PDU session release procedure.

Major Changes:

1. RRC PDU Session Release: DRBs and PDU session teardown in NGAP PDU
   Session Release Response callback
  - Helper Functions: Introduced rm_pduSession,
    find_drb_by_pdusession_id and rm_drbs() helpers to locate and clean
    up DRBs linked to a specific PDU session
  - Targeted Cleanup: RRC PDU Session and per-session DRB removal in
    rrc_gNB_send_NGAP_PDUSESSION_RELEASE_RESPONSE()
  - Status Cleanup: Removed unused PDU_SESSION_STATUS_RELEASED status
2. RRC PDU Session Release: Refactor
   rrc_gNB_process_NGAP_PDUSESSION_RELEASE_COMMAND
  - Any PDU session in the pdusession_release_params list that is
    present in the RRC list can be set to release, regardless of its
    status
  - Function Signature Update: Updated function signature and other
    minor changes
  - Response Handling: rrc_gNB_send_NGAP_PDUSESSION_RELEASE_RESPONSE is
    sent upon completion of RRCReconfiguration
3. RRC PDU Session Release: add missing procedures E1AP Integration:
  - Populates E1AP Bearer Modification for each to be released session
  - PDCP Enhancement: Added nr_pdcp_release_drbs() to remove all DRBs
    linked to a given PDU session in CUUP
  - GTP-U Cleanup: GTP tunnel teardown handled in CUUP
    e1_bearer_context_modif() using correct F1 or N3 GTP instance
4. NR PDCP/GTP:
  - Enhanced Tunnel Deletion Logic: Separate handling for N3 tunnels (1
    per PDU session) and F1-U tunnels (1 per DRB)
  - New PDCP API Function: Added nr_pdcp_get_drb_ids_for_pdusession()
    function to retrieve all DRB IDs associated with a specific PDU
    session
5. RRC PDU Session Release: F1AP-based UE Context Modification:
  - Replaced direct RRC message transfer with F1AP UE Context
    Modification Request for proper retrieval from DU
  - Cell Group Configuration: handling of updated CellGroupConfig from
    DU ensures DRB release at CU
6. Docs and testing:
  - Added PDU session add/remove test cases to 25 PRB RFSIM pipeline
  - Documentation: Added PDU Session Release sequence diagram
  - Telnet Commands: Added ci command to trigger NGAP PDU Session
    Release and ciUE command to trigger establishment of a new PDU
    Session
7. Additional fixes:
  - UE RLC Management: ensure release of RLC entities
  - Unify NG delay control before calling the RRC NGAP handler, for both
    Setup and Release
8. Code Cleanup: Cleaned up unused GTP teardown functions.

Closes #867

- Add delayed_action_state_t in the UE context for ongoing delayed action
- Move delay check and timer re-enqueue to rrc thread in rrc_gNB.c (rrc_delay_transaction)
- Call delay before NGAP setup/release handlers; remove local delay logic from rrc_gNB_NGAP.c
- Clear on RRCReconfigurationComplete (reset_delayed_action)

Closes #960

- Enable telnet server on VNF (gNB) and UE in docker-compose.yaml
- Add new test cases for PDU session management:
  * Add PDU session via UE telnet
  * Release PDU session via telnet
  * Verify connectivity after PDU session release
- Integrate telnet commands into existing container_5g_rfsim_u0_25prb.xml pipeline
- Test cases added before undeploy step in proper execution order

This commit introduces a new telnet server command `pdu_session_release` to
manually trigger the NGAP PDU Session Release Command message from the telnet ci shell.
This is useful for integration testing of PDU session teardown behavior.

Details:
- Added `trigger_ngap_pdu_session_release()` to send NGAP_PDUSESSION_RELEASE_COMMAND
  to the RRC task, targeting the specified `gNB_ue_ngap_id`.
- The command currently releases PDU session ID 10 (hardcoded).
- Hooked into telnet shell with command: `pdu_session_release [gNB_ue_ngap_id]`

Usage example:
telnet > pdu_session_release 1

RRC PDU Session Release: DRBs and PDU session teardown in NGAP PDU Session Release Response callback

We need to keep PDU sessions and DRBs in list until the NGAP PDU Session Release Response is sent.

* Introduced find_drb() and remove_drbs_by_pdu_session() helpers to locate
  and clean up DRBs linked to a specific PDU session
* Targeted per-session DRB removal in rrc_gNB_send_NGAP_PDUSESSION_RELEASE_RESPONSE()
* Ensures DRBs for unaffected PDU sessions remain intact
* Remove unused PDU_SESSION_STATUS_RELEASED status: keeping this status is no longer relevant
  since the PDU sessions are effectively removed from the RRC lists

Closes #867

Also, refactor rrc_gNB_process_NGAP_PDUSESSION_RELEASE_COMMAND

3GPP TS 38.413 8.2.2 PDU Session Resource Release says:

> upon reception the NG-RAN node shall execute the release of the requested PDU sessions.
> For each PDU session to be released the NG-RAN node shall release the corresponding
> resources over Uu and over NG, if any.

Therefore, any PDU session in the pdusession_release_params list that is
also present in the RRC list can be set to release, regardless of its status.

The function signature was also updated along with other minor changes.

The partial-tunnel deletion API was buggy and redundant:
* e.g. It erased entries from globGtp.te2ue_mapping but never erases
  the corresponding entries from inst->ue2te_mapping[ue].bearers

All current use cases are already covered by:
* newGtpuDeleteOneTunnel() for targeted deletion
* newGtpuDeleteAllTunnels() for full cleanup

Call sites should explicitly loop over newGtpuDeleteOneTunnel()
if multiple tunnels need removal.

This commit implements proper PDU Session Release handling across
RRC, PDCP, F1AP, E1AP to ensure clean resource cleanup when
a PDU session is terminated.

Key changes:

NGAP:

In `rrc_gNB_process_NGAP_PDUSESSION_RELEASE_COMMAND()`:
  * Populates E1AP Bearer Modification for each released session
  * If a CU-UP is connected, triggers `bearer_context_mod()` for PDU teardown

PDCP:
 * Added `nr_pdcp_release_drbs()` to remove all DRBs linked to a given PDU session
 * Called from `e1_bearer_context_modif()` for correct clean-up during session release

F1AP UE Context Modification:

  Replace direct RRC message transfer with F1AP UE Context Modification Request
  to properly handle PDU session release according to 3GPP TS 38.331.

  3GPP TS 38.331 `5.3.5.6.4 DRB release` says: whether or not the RLC and MAC entities associated
  with a PDCP entity are reset or released is determined by the CellGroupConfig. Thus,
  updated CellGroupConfig needs to be received by the UE. This has to be retrieved by CUCP
  from the DU. Therefore:

  After receiving an NGAP_PDUSESSION_RELEASE_COMMAND, the CUCP shall:
  1) forward (store for later) the NAS PDU to the UE, if present as per 3GPP TS 38.413, and
  2) send a UE Context Modification to the DU with the list of DRBs to release
     and the RRC container (RRCReconfiguration with NAS PDU)

  After reception of UE Context Modification Response, the list of drbs to release
  is prepared based on PDU session status PDU_SESSION_STATUS_TORELEASE
  in rrc_gNB_generate_dedicatedRRCReconfiguration and then encoded
  in drb_ToReleaseList for a new RRCReconfiguration with the new cellGroupConfig.

  Key changes:
  * rrc_gNB_generate_dedicatedRRCReconfiguration_release() now uses F1AP UE Context
    Modification Request instead of direct RRC transfer
  * Only DRBs to be released are now added to the list.
  * The ASN.1 memory allocation is entirely done in build_RRCReconfiguration_IEs
  * No longer needed to store ASN1 struct in UE context

GTP-U:
  * Previous implementation had incomplete tunnel cleanup during PDU session release
    - Missing distinction between N3 (PDU session level) and F1-U (DRB level) tunnels
    - Lack of proper DRB identification for F1-U tunnel deletion
  Major Changes:
  * GTP tunnel teardown now handled in `e1_bearer_context_modif()` using the correct
  F1 or N3 GTP instance (`newGtpuDeleteOneTunnel()`)
  * Enhanced Tunnel Deletion Logic (cucp_cuup_handler.c):
   - Separate handling for N3 tunnels (1 per PDU session) and F1-U tunnels (1 per DRB)
   - Added proper DRB identification for F1-U tunnel cleanup
   - Improved error handling with detailed logging for each tunnel deletion
   - Enhanced logging to distinguish between N3 and F1-U tunnel operations
  * New PDCP API Function (nr_pdcp_oai_api.c/h):
   - Added nr_pdcp_get_drb_ids_for_pdusession() function
   - Enables retrieval of all DRB IDs associated with a specific PDU session
   - Supports proper F1-U tunnel cleanup by providing DRB identifiers in CUUP
  * Enhanced GTP Interface (gtp_itf.cpp/h):
   - Modified newGtpuDeleteOneTunnel() to accept tunnel_type parameter
   - Improved logging to distinguish between PDU session and DRB tunnel types
   - Better error messages for tunnel deletion failures
   - Enhanced debugging information for remaining tunnels

Clean-up:
* Ensured xid tracking works consistently between PDU Session Establishment (with NAS PDU)
  and dedicated RRCReconfiguration
* Add function to release GTP-U tunnel in Bearer Context Modification Request handler
* Do not send rrc_gNB_send_NGAP_PDUSESSION_RELEASE_RESPONSE when no PDU session are to
  be released: it is sent upon completion of the RRCReconfiguration and needs to contain
  released PDU Sessions (mandatory IE), therefore it is no necessary to send it in case
  there is no PDU session to release.

Related to #867
Co-authored-by: rmagueta <rmagueta@allbesmart.pt>

Merge remote-tracking branch 'origin/fix_NR_RLC_Config_during_RRCReestablishment' into integration_2025_w46 (!3760)

gNB: modify RLC configuration applied for SRB1 during RRCReestablishment

TS 38.331 clause 5.3.7.4 specifies to apply the configuration defined in
9.2.1 for SRB1 at UE side. This implies that the gNB also has to apply
sn_field_length = 12, but there are no implications on the other RLC
parameters.

As wrong timer values break SRB1 e.g. for long RTT NTN scenarios, this
commit switches to using the RLC timer values provided in the
configuration file. Currently we still set poll_pdu, poll_byte and
max_retx_threshold to the values defined in 9.2.1, but this can be
changed.

Refactor imscope

This MR refactors imscope by introducing changes to the default layout
in the config file imgui.ini. The global settings are moved to a new
menu item. This modified layout is intended as a suggestion subject to
change based on feedback. This MR also adds PDCCH LLR and IQ plots to
the UE scope and set axes to AutoFit by default.

The MR has a screenshot of the new layout.

Remove schedule response and update L1 threading documentation

This merge requests removes the somewhat superfluous "schedule response"
mechanism. "schedule response" was run after running the scheduler
itself and copied various FAPI messages into a global msgDataTx
structure from which the various TX/RX jobs were triggered. It is not
necessary, though, given that the scheduler is run inside the tx_func()
(running the TX jobs of the L1), and so the scheduler output FAPI
messages can directly be read into a variable of the existing
NR_Sched_Rsp_t type. This allows to delete a couple of hundred lines of
code (while retaining functionality), and simplifies the msgDataTx type
(which is still there to trigger TX job (including the scheduler) from
the ru thread).

In short, prior, there was this call chain:

- tx_func() calls run_scheduler_monolithic() (through fptr
  NR_slot_indication())
  - get some memory through allocate_sched_response() which has enough
    space for NR_Sched_Rsp_t type variable
  - call the scheduler and fill the variable
  - call nr_schedule_response() (through fptr NR_schedule_response())
    which copies into L1: to msgDataTx for TX, to separate structures
    for RX

this is changed to

- tx_func() runs one message at a time, hence we can use memory in the
  data segment for NR_Sched_Rsp_t. It calls run_scheduler_monolithic()
  through the fptr
  - pointers into NR_Sched_Rsp_t are passed to the scheduler, which
    fills as before
  - we return, memory is in its right place and does not need an extra
    copy.

Additionally, this merge request updates documentation on threading and
cleans up some unused code along the way.

Update log header format to align log output

The new format:
- left-aligns the log header name and enforces a minimum width of 6 characters,
  padding shorter names with spaces while allowing longer names to be printed in
  full
- shortens UTC timestamp
- align function names to 32 characters

Example output:

[19:51:34.647930] [NGAP]   I (ngap_gNB_decode_initiat:100)   Handover Resource Allocation initiating message
[19:51:34.648539] [NGAP]   D (decode_ng_handover_requ:267)   AllowedNSSAI.list.count 2
[19:51:34.648586] [NGAP]   I (ngap_gNB_handle_handove:728)   Received NG Handover Request from AMF OAI-AMF (ID=1)
[19:51:34.648627] [NR_RRC] I (rrc_gNB_process_Handove:1199)  Received Handover Request (on NR Cell ID=11111111, PCI=1)
[19:51:34.648647] [NR_RRC] A (rrc_gNB_create_ue_conte:230)   [--] (cellID 0, UE ID 1 RNTI ffff) Create UE context: CU UE ID 1 DU UE ID 4294967295 (rnti: ffff, random ue id ffffffffffffffff)
[19:51:34.648659] [NR_RRC] A (set_UE_security_algos:692)     [--] (cellID 0, UE ID 1 RNTI ffff) Selected security algorithms: ciphering 0, integrity 2

Handling newly opened UE issues

Closes #1025 #1024 #1026 #1031 #1030

Reimplement nFAPI message exchange between L1 and L2 following the
changes in parent commit removing msgDataTx.

Avoid direct calls and use NR_IF_module fptrs to avoid linking problems.
allowing to remove some function definitions that are not needed.

Note: after this commit, monolithic works but nFAPI operation is broken
and fixed in the next commit, to keep the changes small(er). All
simulators work.

This commit removes the use of msgDataTx's intermediate buffers for FAPI
messages and the call of the "Schedule response". The latter incurs an
additional copy of FAPI messages for the TX chain (for the RX chain, it
is and will remain there) which we can avoid.

Instead, it uses an NR_Sched_Rsp_t-typed variable sched_response to
store the results of the scheduler when called from tx_func(). Thus, the
scheduler remains unchanged (it gets a pointer to where to put FAPI
messages), but we don't call nr_schedule_response() to then copy FAPI
messages into the L1, but have them in a local variable sched_response.
sched_response on on the data segment, as it is big and would overflow
the stack; at the same time, this is ok because only one tx_func() runs
at a time.

Since we don't use allocate_sched_response() anymore, we don't need
deref_sched_response().

clear_slot_beamid() is moved to tx_func(), as it was called in
nr_schedule_response().

Since the "intermediate" NR_gNB_DLSCH_t structure groups both the
DL_tti_pdsch and TX_data.req structures, a pointer has been created to
point to pdsch_pdu. This affects a number of simulators, as they have to
put some messages on the stack:

- nr_dlschsim: put the corresponding variable on the stack
- nr_pbchsim: a new array for the SSB PDUs has been introduced

Further, these changes are now necessary:

- nr_dlsim:  there were variables "rel15" and "pdsch_pdu_rel15" that
  point to the same PDSCH PDU. At least "rel15" would not exist, as the
  corresponding pointer is now populated in phy_procedures_gNB_TX(), and
  we therefore refer to the single PDSCH PDU variable with
  "pdsch_pdu_rel15", but at the place where "rel15" used to be
  initialized.
- nr_ulsim: use nr_save_ul_tti_req() to load PDUs into the RX chain
  instead of nr_schedule_response(), which does not exist anymore.

The next commit will remove msgDataTx. We can therefore not use
msgDataTx to retain the PDSCH/DLSCH variables, and move them to the gNB.

Note that the only reason for NR_gNB_DLSCH_t after this commit is to
hold various large buffers (c, b, f). Future work could be done to
remove this, in which case the array inside PHY_VARS_gNB could be
deleted.

On this occasion, clean up the use of init_DLSCH_struct() and
reset_DLSCH_struct() (renamed destroy_DLSCH_struct()) and centralize
their call in phy_init_nr_gNB()/phy_free_nr_gNB(), and correct
simulators accordingly.

TS 38.331 clause 5.3.7.4 specifies to apply the configuration defined in 9.2.1 for SRB1 at UE side.
This implies that the gNB also has to apply sn_field_length = 12, but there are no implications on the other RLC parameters.

As wrong timer values break SRB1 e.g. for long RTT NTN scenarios, this commit switches to using the RLC timer values provided in the configuration file.
Currently we still set poll_pdu, poll_byte and max_retx_threshold to the values defined in 9.2.1, but this can be changed.

Merge remote-tracking branch 'origin/improve-readability-phy_procedures_gNB_uespec_RX' into integration_2025_w46 (!3707)

Cleanup phy_procedures_gNB_uespec_RX

phy_procedures_gNB_uespec_RX is too long function with too long lines of code,
this commit only shorten lines and improve a bit the readability

[MAC] Add UL total/used aggregated MAC stats; [E2 agent] Properly calculate
used UE PRBs in KPM; [CI] Simplify and improve the Undeploy_Object() and
implement Stop_Object()

- Create common dlul_mac_stats_t struct for both DL and UL total/used aggregated
  PRBs
- Use correct unit [%] for RRU.PrbTotDl and RRU.PrbTotUl , instead of [PRBs]
- Use correct unit [Mb] for DRB.PdcpSduVolumeDL and DRB.PdcpSduVolumeUL [kb]
- Implement Stop_Object() (docker compose stop = SIGTERM)
- Simplify the Undeploy_Object() function
- Improve the logging for Deploy/Undeploy_Object() functions
- OAI-FlexRIC CI: properly stop all the containers (one by one or a subgroup of
  running containers), and rename oai-flexric to nearRT-RIC container

CI: Increase tested UL throughput on Aerial pipeline using 2L UL

The goal of this MR is to activate the use of 2-layer uplink by enabling SRS
and to increase the tested UL throughput in CI.

The new format left-aligns the component name and enforces a minimum width
of 7 (log component) characters, padding shorter names with spaces after
the closing "]".

Example output:

    [14:05:43.395376] [E1AP]   I releasing UE 1
    [14:05:43.395400] [GTPU]   I [91] UE ID 1: Delete all tunnels (1 tunnels)
    [14:05:43.395414] [NR_RRC] A [DL] (cellID bc614e, UE ID 1 RNTI 8e27) Send RRC Release
    [14:05:43.395431] [RRC]    I UE 1: received bearer release complete
    [14:05:43.424551] [RLC]    W Remove UE 36391
    [14:05:43.424597] [NR_RRC] I removed UE CU UE ID 1/RNTI 8e27
    [14:05:43.424773] [NR_RRC] A [--] (cellID bc614e, UE ID 1 RNTI 8e27) Remove UE context
    [14:05:43.425205] [NR_MAC] I Remove NR rnti 0x8e27
    [14:05:43.582158] [HW]     W Lost socket
    ^C
    ** Caught SIGTERM, shutting down
    Returned from ITTI signal handler
    [14:05:43.948721] [GNB_APP] I stopping nr-softmodem
    [14:05:43.948746] [PHY]    I Killing gNB 0 processing threads
    [14:05:44.574818] [PHY]    I Stopping RU 0 processing threads
    [14:05:44.575000] [PHY]    I RU 0 RF device stopped
    [14:05:44.575006] [GNB_APP] I turned off RU rfdevice

Prior to this change, when no "level" option is given to the logging
module, we see

    [PHY]   RU 0 RF started cpu_meas_enabled 0
    [HW]   No connected device, generating void samples...

with three spaces, which is too much. This change reduces the amount of
spaces to 1 without log level.
Co-authored-by: Robert Schmidt <robert.schmidt@openairinterface.org>

We probably almost never care about the date, but it takes a lot of
space. Remove it; if somebody needs the full time stamp including the
date, we could still add it with a new option.