Introduce UE NAS Simulator

This MR introduces a simple standalone tester for 5G UE NAS signaling and NGAP
messages. It connects to the AMF to perform NGAP and NAS encoding/decoding and
validates the UE Registration and PDU Session Establishment processes without
the overhead of a full Radio Access Network (PHY/MAC/RLC).

The motivation for this tester is as follows,
- This tester is a lightweight, deterministic tool to test the UE NAS layer
directly.
- Developers can easily inject specific NAS messages depending on the use-case.
- Developers can validate custom NAS/NGAP messages without the need to implement
complete RRC/MAC etc procedures.

Start the 5G Core network to test the UE NAS simulator. The compiling and
testing procedure is described below.
To compile:
mkdir build && cd build && cmake .. -GNinja && ninja nr-ue-nas-simulator-test

To run:
  LD_LIBRARY_PATH=. ./tests/nr-ue-nas-simulator/nr-ue-nas-simulator-test -O ../tests/nr-ue-nas-simulator/test.conf

Merge remote-tracking branch 'origin/grafana-dist-channel_quality' into integration_2026_w13 (!3805)

[E2 agent] Refactor E2SM-KPM and implement support for REPORT style 1

- Refactor E2SM-KPM to:
  - better handle different supported REPORT styles needed for "E2 Setup
    Request"
  - pass "Measurement Label" for calculating the measurement values
- Implement Subscription for E2SM-KPM REPORT style 1 and fill the PDSCH MCS
  distribution measurement (CARR.PDSCHMCSDist)
- Fix the memory leakage caused by the UEs filtering based on NSSAI for REPORT
  style 4

Tested successfully with and without ASan:
- in rfsim mode: gNB-mono, CU/DU and CU-CP/CU-UP/DU
- with the USRP B210: gNB-mono

and xapp_kpm_moni, xapp_rc_moni and xapp_kpm_rc xApps.

1. Allocate memory for the ue_id and ue_info_list arrays on the stack.
Explanation:
   Every granularity period, the program passes through the fp_match_cond_type,
   then through match_s_nssai_test_cond_type function pointers. Based on the node type,
   the function used calloc() for these arrays.
   => the longer a connection with an E2SM-KPM xApp was, the more memory leakage occured.
2. If matched UEs > 0, only free the memory of ue_id content after each
   Indication Message was sent.

Needed notably due to MR https://gitlab.eurecom.fr/mosaic5g/flexric/-/merge_requests/74.

But also, in the meantime, the MR https://gitlab.eurecom.fr/mosaic5g/flexric/-/merge_requests/73 was merged,
with the goal of reducing compilation warnings in the "Release" build.

Co-authored-by: Teodora Vladić <teodora.vladic@openairinterface.org>

At this stage, all supported measurements do not take the label into account (noLabel = true),
but will be of value for distribution measurements.

Extend the ran_def_kpm with REPORT style types.

Implement kpm_report_style function pointer for filling different REPORT styles.

FHI72: handle more than 64 cores

Remove old CUDA LDPC implementation

A new implementation is under way in !3955. To simplify the MR, remove the old
LDPC CUDA implementation in a first step.

Update cir-generator image tag to v0.0.1

mac: fixes to prevent prb overlapping

- this patch fixes a bug in the MAC where the scheduled PRB resources can
  overlap
- at the same time, we try to enforce the same semantics for "rbStart" (which
  should be relative to the BWP) across the code as much as possible

Bugfix in UE DLSCH LLR functions

Closes #1044
Fix bug in PTRS compensation.

UE: update pdcch config only after mib read

- In MR !3929, this change was done to call update_pdcch_config if mac
  configuration is changed.
- Observed that the issue related to RAR after handover if SSB position changes
  occurs also in develop 2026_w10 where MR !3929 is merged.
- update_pdcch_config should be done only after sync obtained.
- this fix is similar to the fix in initial commits of MR !3929

* Option to build ldpc_cuda was remaining in the build script
* Build script option to build ldpc_cuda was still used in CI
* Mentions of ldpc_cuda were remaining in the documentation

Note: In the documentation, the example of ldpctest usage that was
loading ldpc_cuda was replaced by an example in which it is loading
ldpc_orig even though this is pointless as it makes ldpctest compare
ldpc_orig with ldpc_orig. On the other hand, it is the only library
other than the default ldpc that uses the former interface.

Fix DAS via index based beamforming

DAS implementation via index based analog beamforming was broken after !3715.
This MR fixes it.

Remove OSD, some scripts, oaisim references

The README says:
  It is just generating the XML file and it is placing it in
  $(OPENAIR_TARGETS)/SIMU/EXAMPLE/OSD/WEBXML/ or http://localhost/xmlfile/
  so that the oaisim could pars and run the simulation/emulation

oaisim does not exist anymore, and corresponding simulation cannot be done.
Also, it requires XAMPP and similar technologies, that I think nobody uses
in the context of OAI.
Remove also most references to oaisim.
Remove some scripts that are likely not used by anybody, or straight useless.

Co-authored-by: Xin Zhe Khooi <khooixz@comp.nus.edu.sg>
Assisted-by: Gemini:3 Flash
Reviewed-by: Francesco Mani <email@francescomani.it>

Integration `2026.w12`

* !3985 Fix XNAP to avoid recompilation and unnecessary includes
* !3724 Better c style pss sss
* !3972 Resolve "Demote AssertFatal `PUCCH list is full` message to a warning"
* !3956 [FHI72] [xran F] Revert and simplify the code for Liteon FR2 interoperability
* !3970 Fix for NTN phy-test mode
* !3987 T: minor: remove target record_db from automatic building
* !3993 UE: Derive Serving Network Name from SIB1 PLMN
* !3997 vrtsim doc: clarify container requirements
* !3935 [FHI72] Fix long PRACH format
* !3998 Set rxgain to 0 in vrtsim
* !3964 CI: Add FHI7.2 phytest pipeline
* !4001 Remove unused ci-scripts/mysql4testresults/ dir and content
* !3999 bugfix: use proper pointer
* !3986 handle start symbol on non-zeroth downlink symbol for SIB1 for multiplexing pattern 3 configuration.
* !3957 replace static allocation of max antennas in a dynamic structure for gnb rach
* !3859 Delay compensation in SRS
* !3909 Adjust ssPBCH_BlockPower in FHI7.2 configs

Closes #1058

See merge request oai/openairinterface5g!3989

Merge remote-tracking branch 'origin/fix-ssPBCH_BlockPower-config' into integration_2026_w12 (!3909)

Adjust ssPBCH_BlockPower in FHI7.2 configs

ssPBCH_BlockPower is the average EPRE of the resources elements that carry
secondary synchronization signals in dBm. In OAI, the SSB is the same level
as all the rest, so we can compute ssPBCH_BlockPower from RU TX power and
bandwidth using:

ssPBCH_BlockPower = P_TX(dBm) − 10 x log10(N_RB x 12)

where:
- P_TX is the RU transmit power
  - 24 dBm for indoor RUs (configurable on the RU)
  - 35 dBm for outdoor RUs (configurable on the RU)
- N_RB is the number of resource blocks for the configured bandwidth
- 12 corresponds to the number of subcarriers per RB

Delay compensation in SRS

Implementation of delay compensation in channel estimation based on SRS.

Testing, for example, with

    sudo ./nr_ulsim -n1 -s50 -S50 -R51 -E 1 -W2 -y2 -z2 -d 10

we obtain the following logs.

LOGs with develop branch:

    [NR_PHY] 	  __lsRe__________lsIm__|____intRe_______intIm__|____noiRe_______noiIm__
    [NR_PHY] (   0)    687	  -198  |     688	  -198  |      -1	    -3
    [NR_PHY] (   1)      0	     0  |     688	  -196  |      -1	    -3
    [NR_PHY] (   2)    687	  -198  |     644	  -272  |      -1	    -1
    [NR_PHY] (   3)      0	     0  |     600	  -346  |      -1	    -1
    [NR_PHY] (   4)    513	  -498  |     556	  -422  |      -1	    -1
    [NR_PHY] (   5)      0	     0  |     512	  -496  |      -1	    -1
    [NR_PHY] (   6)    513	  -498  |     440	  -542  |      -1	     0
    [NR_PHY] (   7)      0	     0  |     370	  -588  |      -1	     0
    [NR_PHY] (   8)    226	  -682  |     298	  -634  |      -1	    -3
    [NR_PHY] (   9)      0	     0  |     228	  -680  |      -1	    -3
    [NR_PHY] (  10)    226	  -682  |     140	  -686  |      -1	    -1
    [NR_PHY] (  11)      0	     0  |      52	  -690  |      -1	    -1

intRe and intIm are the real and imaginary part of the interpolated
channel, respectively. These are the columns that matter. As we can see,
for example, in subcarrier 0 we have (688, -198), then in subcarrier 1
we have (688, -196), which is almost the same, and then in subcarrier 3
we have a jump (644, -272). This MR improves channel estimation by
taking delay into account. If we look at the following logs, we see that
the values vary more consistently from subcarrier to subcarrier.

LOGs with this MR:

    [NR_PHY] 	  __lsRe__________lsIm__|____intRe_______intIm__|____noiRe_______noiIm__
    [NR_PHY] (   0)    487	  -139  |     490	  -111  |      -1	     0
    [NR_PHY] (   1)    487	  -139  |     483	  -138  |      -1	     0
    [NR_PHY] (   2)    487	  -139  |     465	  -197  |       0	     0
    [NR_PHY] (   3)    487	  -139  |     436	  -254  |       0	     0
    [NR_PHY] (   4)    364	  -353  |     402	  -305  |      -1	    -1
    [NR_PHY] (   5)    364	  -353  |     361	  -352  |      -1	    -1
    [NR_PHY] (   6)    364	  -353  |     317	  -392  |      -1	    -1
    [NR_PHY] (   7)    364	  -353  |     269	  -426  |      -1	    -1
    [NR_PHY] (   8)    160	  -481  |     214	  -455  |       0	    -1
    [NR_PHY] (   9)    160	  -481  |     159	  -478  |       0	    -1
    [NR_PHY] (  10)    160	  -481  |      98	  -495  |      -1	     0
    [NR_PHY] (  11)    160	  -481  |      39	  -502  |      -1	     0

replace static allocation of max antennas in a dynamic structure for gnb rach

NB_ANTENNAS_RX was used in 5G by mistake
there was also a error in O-RU implementation, with no consequences
(index not in right order)

Meson configuration was configuring a wrong maximum number of lcores on
the Arm platforms we are using (Neoverse V2 & NVIDIA Grace) as no
configuration is provided for these platforms with DPDK 20.11.9.
This commit solves this issue by requesting meson to use a generic
config that sets a high maximum number of lcores.

handle start symbol on non-zeroth downlink symbol for SIB1 for multiplexing
pattern 3 configuration.

This MR adds support for handling a non-zero start symbol for SIB1 when using
multiplexing pattern 3 with the per-slot CP format.

Previously, the implementation assumed that the first downlink symbol used by
a PDU always starts at symbol 0. However, this assumption does not hold for
SIB1 under multiplexing pattern 3, where the start symbol can be non-zero.

This issue does not apply to the per-symbol CP format.

Testing:
a. Microamp using the branch microamp_1048: UE registration ok. end-to-end ok.
b. Benetel: UE registration ok. end-to-end ok.

xran needs to be informed about the cores to use for packet processing.
Prior to this change, we only filled the first 64bits, but it can go up
to 128 in xran. Change the helper accordingly to support all.

The README says:

> It is just generating the XML file and it is placing it in
> $(OPENAIR_TARGETS)/SIMU/EXAMPLE/OSD/WEBXML/ or http://localhost/xmlfile/
> so that the oaisim could pars and run the simulation/emulation

oaisim does not exist anymore, and corresponding simulation cannot be
done. Also, it requires XAMPP and similar technologies, that I think
nobody uses in the context of OAI.

The nr_srs_channel_estimation function is split into the nr_srs_ls_channel_estimation and nr_srs_channel_interpolation functions to allow the use of a common delay

Define CIRCULAR_INC

bugfix: use proper pointer

Use proper pointer to trace the buffer.

Change layer_llr buffer from 2D to 3D with symbol as first dimenstion. Refactor
layer demapping function.