Add the E3 agent lifecycle on top of libe3: configuration mapping,
agent creation/init/start, dApp report and status-change handlers,
and xApp control and subscription-query helpers. Wire e3_init() and
e3_destroy() into nr-softmodem under the E3_AGENT guard.

The agent registers no concrete service models: service models (such
as spectrum sensing) live in their own modules and register
themselves, keeping the framework decoupled from any specific use
case.
Signed-off-by: Andrea Lacava <thecave003@gmail.com>

Add the E3AP CMake target, which links the external libe3 library
discovered via pkg-config, and the E3Configuration parser that reads
the link and transport selection from the gNB configuration file and
validates the supported link/transport combinations.

libe3 is kept external and is only required when E3_AGENT is enabled.
Signed-off-by: Andrea Lacava <thecave003@gmail.com>

Introduce the E3_AGENT CMake option (default OFF) and the matching
--build-e3 flag in build_oai so the E3 agent for O-RAN dApps can be
compiled opt-in. Gate the E3AP subdirectory and the nr-softmodem
linkage behind the option, and register an E3AP log component
together with its legacy T-tracer message IDs.

The E3 interface (nGRG) lets the gNB exchange real-time reports and
controls with external dApps. Keeping it behind a build flag leaves
the default CI build unchanged and avoids pulling in the external
libe3 dependency unless the agent is explicitly requested.
Signed-off-by: Andrea Lacava <thecave003@gmail.com>

Integration: `2026.w25`

- #150 fronthaul library fixes
- #176 Change ambigous language in Aerial_FAPI_Split_Tutorial.md
- #144 Fix vrtsim antenna configs
- #178 XNAP: Add encode/decode+unit tests for Xn HO Cancel, HO Success, RAN Paging
- #154 Fix UE PUCCH resource multiplexing
- #189 Add nr_dlbench: standalone DL scheduler + PHY TX benchmark
- #151 Complete NR L2/L3 Paging path from F1AP to NAS (gNB and UE)
- #201 [FHI72] Improve the fronthaul doc
- #139 Improvements in UCI on PUSCH implementation at UE
- #206 RAN and UE Roadmap
- #188 CI: Add UE timing phytest

Closes: #74
Closes: #90
Closes: #125
Closes: #130
Closes: #181

Remove an assert on successful dup() of a socket. At least when running
in phy-test mode without noS1, the socket does not exist, and the call
to dup() fails. In that case, we should carry on instead of simply
failing, similarly how the process does not abort when TUN setup fails.

Fixes: 8d289546 ("Paging UE (SDAP): reattach TUN after idle reset")
Signed-off-by: Robert Schmidt <robert.schmidt@openairinterface.org>

CI: Add UE timing phytest (#188)

Add a new XML file to also measure UE timings, similarly how we do with
gNB.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>

RAN and UE Roadmap (#206)
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>

Check timing thresholds on both UE and gNB side. If this commit works as
expected, it can replace xml_files/gnb_phytest_usrp_run.xml.
Signed-off-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>

Allow XML test cases to specify one or more files with timing stats that
define which container log paths to collect and analyze. AnalyzeRTStatsObject
loops over the provided list, falling back to the default gNB files
(nrL1_stats.log, nrMAC_stats.log) when none are specified.

Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>

Improvements in UCI on PUSCH implementation at UE (#139)

This MR improves the implementation of UCI on PUSCH at UE side and fixes
some issues found while testing and fixing the revised version.

Tested in ULSIM with MATLAB vectors provided by @sakthivelvelumani in
the following scenarios (bits)

- 2 ACK no CSI
- 7 CSI part1 no ACK no CSI part2
- 1 ACK 7 CSI part1 7 CSI part2
- 3 ACK 4 CSI part1 4 CSI part2

using the command line

    ./nr_ulsim -m 27 -u 1 -R 51 -r 51 -s 30 -o(path to the file containing the vector)

Closes: #181
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Sakthivel Velumani <s.velumani@northeastern.edu>

[FHI72] Improve the fronthaul doc (#201)

- explicitly set the K_VERSION variable in the fronthaul doc, and update
  PTP configuration
- fix IQ decompression for ARM architecture
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>

Signed-off-by: Sagar Arora <sagar.arora@openairinterface.org>

Complete NR L2/L3 Paging path from F1AP to NAS (gNB and UE) (#151)

This MR wires a 5G‑NR paging flow across the stack, from F1AP Paging on
the DU down to PCCH scheduling in MAC/RLC, RRC/ASN encode/decode, and
UE‑side NAS Service Request triggering, including the NR UE changes in
L1/L2.

It centralises paging PF/PO computation and PCCH scheduling in MAC,
using shared SSB/Type0‑PDCCH and common PDSCH helpers that are also
reused by SIB1. On the UE, it enables decoding of NR PCCH messages,
matching ng‑5G‑S‑TMSI/fullI‑RNTI, and conditionally initiating a
network‑triggered Service Request when 5GMM state allows it. The change
set includes focused refactors and ASN.1 tests to validate the new
paging encode/decode path.

Changes:
- MAC gNB common helpers: Move SSB/Type0‑PDCCH utilities from the
  BCH scheduler into shared MAC primitives and introduce a reusable 
Type0‑occasion helper and common PDSCH RB/MCS/TBS sizing
- MAC paging PF/PO responsibility: Add a dedicated PCCH scheduler module
  that implements TS 38.304 §7 PF/PO computation (defaultPagingCycle,
nAndPagingFrameOffset, Ns, SFN‑based PF formula and PO slot mapping)
and owns the “is this (frame,slot) a paging occasion for UE_ID?”
decision.
- F1AP -> MAC -> RLC PCCH path (gNB/DU): Have the DU decode F1AP Paging
  with CN UE identity, build an NR RRC Paging message (PCCH) in MAC, and
hand it to RLC as a dedicated PCCH SDU together with UE_ID (5G‑S‑TMSI
mod 1024), using per‑module PCCH storage. RAN UE paging identity
is explicitly rejected.
- Direct CU to DU paging path: Implement direct F1 Paging handling
  in the NR RRC DL direct interface for RLC PCCH storage for later 
scheduling.
- PCCH scheduling and NFAPI integration (gNB MAC): Integrate 
  schedule_nr_pcch() into the DL scheduler so that when a stored PCCH
SDU exists and the current (frame,slot) is a paging occasion, MAC 
resolves the paging search space and CORESET, selects a beam (from SSB),
allocates CCEs and PDSCH resources, builds NFAPI DL_TTI PDUs 
(PDCCH + PDSCH with P‑RNTI, DCI 1_0), and populates the matching
TX_DATA PDU, then clears the cached PCCH.
- DCI handling for P‑RNTI paging: Adjust DCI payload preparation
  to treat P‑RNTI specially, returning after setting DMRS and antenna 
ports and skipping HARQ and UE scheduling state that do not exist for
paging, so paging DCIs no longer touch UE HARQ data structures.
- PHY UE RX Chain: DCI handling for P‑RNTI on UE, monitor DCI on Paging
  Occasions, process DCI 1_0 with CRC scrambled by P‑RNTI on the paging 
search space, trigger PDSCH decoding for PCCH based on that DCI, deliver
decoded PCCH to upper layers from the PHY/MAC side
- RRC/ASN paging encode API: Replace the legacy buffer‑based do_NR_Paging 
with a nr_paging_params_t‑based API returning a byte_array_t,
supporting both ng‑5G‑S‑TMSI and fullI‑RNTI identities, and optional IEs
(e.g. accessType non‑3GPP and pagingCause v17), and encoding via 
uper_encode_to_new_buffer, with ownership and failure semantics clearly 
defined for callers.
- UE‑side PCCH reception and matching: Add UE MAC to RRC logic
  to deliver PCCH SDUs to RRC, decode NR PCCH via a new nr_pcch_decode() 
helper into an array of nr_paging_params_t, iterate PagingRecordList on 
the UE, compare M‑TMSI/fullI‑RNTI against local identity, and log whether 
a paging match was found.
- NAS integration for network‑triggered Service Request: On a UE paging
  match, send a NAS_PAGING_IND from RRC to NAS and, when the UE has a
GUTI, is 5GMM‑REGISTERED and in 5GMM‑IDLE, generate and send a Service
Request uplink NAS message
- Tests and validation helpers: Extend nr_asn1 paging tests
  to encode Paging via do_NR_Paging, decode it via nr_pcch_decode,
and verify round‑trips for multiple ng‑5G‑S‑TMSI values, accessType,
and fullI‑RNTI bit patterns, using a shared encode/decode helper that 
exercises the same decoder path used by the UE.

Notes:
Paging handling currently supports CN UE paging
identity (5G‑S‑TMSI) only. RAN UE paging identity is logged and ignored.
A paging match triggers a Service Request only when the UE has a GUTI,
is 5GMM‑REGISTERED, and in 5GMM‑IDLE. T3346 and suspend‑indication
handling are documented as future work and not implemented here.

Testing:
Tested with Open5gs. How to trigger Paging in Open5GS lab setup:

- Use gNB telnet to request NGAP UE Context Release: `rrc ctx_rel_req
  <RRC_UE_ID>`
- Wait until AMF reports CM-IDLE (for example gNB-UEs is now 0).
- Generate downlink data from the Linux host to the UE IP: `ping
  <UE_IP>`
- Host-originated downlink data will trigger paging.

Closes #74
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Francesco Mani <email@francescomani.it>

Signed-off-by: Francesco Mani <email@francescomani.it>

Signed-off-by: Francesco Mani <email@francescomani.it>

Signed-off-by: Francesco Mani <email@francescomani.it>

Signed-off-by: Francesco Mani <email@francescomani.it>

we need to remove the reserved elements from the pool of the avalable ones to compute position of the CSIp1 elements
Signed-off-by: Francesco Mani <email@francescomani.it>

Signed-off-by: Francesco Mani <email@francescomani.it>

Signed-off-by: Francesco Mani <email@francescomani.it>
Assisted-by: Claude:claude-sonnet-4-6

make function apply_template_to_codeword use bit-packed vectors to make the output uniform as the case without uci on pusch
Signed-off-by: Francesco Mani <email@francescomani.it>
Assisted-by: Claude:claude-sonnet-4-6

Signed-off-by: Francesco Mani <email@francescomani.it>

Signed-off-by: Francesco Mani <email@francescomani.it>
Assisted-by: Claude:claude-sonnet-4-6

Add nr_dlbench: standalone DL scheduler + PHY TX benchmark (#189)

This PR updates the MR from here:
https://gitlab.eurecom.fr/oai/openairinterface5g/-/merge_requests/4028
Besides, it adds separate modes to test AM and UM, as I have another PR
which accelerates the scheduler through refactoring how MAC accesses RLC
indications that needs AM for testing
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>

- added Paging documentation
- updated to latest NGAP, F1AP, E1AP, NAS status
- fixed spelling errors
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>

- Add a LOG_I to 'nr_sdap_add_entity' to inform the user
  a SDAP entity is being created
- Add LOG_W to `nr_sdap_get_entity` to warn about
  empty SDAP entity list
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>

Add an RRC telnet command that sends a RAN-initiated NGAP UE Context Release
Request with a user-inactivity cause.

Register ctx_rel_req in the RRC telnet command table.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>

After the UE answers a network page with a NAS Service Request, it waits
in 5GMM-SERVICE-REQUEST-INITIATED until the AMF replies or the radio
connection drops.
While that wait is active, duplicate pages must be ignored. When SR ends,
NAS must return to 5GMM-REGISTERED so a later page can start a new SR
(TS 24.501).

Changes:
- handle_service_accept(): set FGS_REGISTERED on SERVICE ACCEPT (TS 24.501 §5.6.1.4)
- handle_service_reject(): if SR was pending, set FGS_REGISTERED (§5.6.1.5)
- NR_NAS_CONN_RELEASE_IND: if SR was pending, set FGS_REGISTERED (§5.3.1.3 and §5.6.1.7 l)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>

UE paging can recreate the AS-side SDAP entity while NAS still keeps the
PDU session established. Per TS 38.304 clause 7.1 and TS 24.501 clauses
5.6.2.2.1,5.6.1.2 paging/service request restores user-plane resources
for an established PDU session, it does not imply deleting the UE IP/TUN
interface.

Deleting the UE TUN with SDAP entity teardown breaks user-plane continuity
after re-attach. We need SDAP entity lifetime and UE TUN lifetime to be
decoupled. This commit keeps a UE/PDU-session TUN registry outside the
SDAP entity lifetime. When a UE SDAP entity is recreated, reattach it
to the preserved TUN socket and restart the reader thread. On first PDU
session setup, NAS registers the TUN before attaching the reader.

The sequence is the following: (1) NAS register the iface
(2) sdap entity attaches to the iface (3) UE goes IDLE, SDAP
entity is destroyed, iface is deatched and brought down (4)
UE Service Request, SDAP entity is created (5) iface reattaches
to the SDAP entity and is brought up

UE reattach assumes the PDU session TUN interface was registered
before the SDAP entity is recreated.

DL/UL data is intentionally dropped when SDAP is not yet attached
or QFI is unavailable, rather than queued in this layer.

Changes:
- `nr_sdap.c`: keep a UE/PDU-session TUN registry, duplicate the stored
  socket into each SDAP entity, and add attach/detach/destroy helpers.
- `nr_sdap_entity.c`: detach SDAP entities from their TUN reader on
  deletion, preserve UE TUN interfaces across idle cleanup, and destroy
  gNB TUN interfaces when the gNB entity is removed. Drop downlink SDUs
  if the UE SDAP entity is not attached to a TUN socket yet.
- `openair3/NAS/NR_UE/nr_nas_msg.c`: set QFI before UE TUN creation so
  first attach can pick up cached QFI.
- `common/utils/tuntap_if.c`: add `tuntap_set_up`/`tuntap_set_down` helpers
  for UE interface state reflection and initialize `flags` in `tuntap_destroy`
  to avoid maybe-uninitialized build failures.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>

Fix UE PUCCH resource multiplexing (#154)

TS 38.213 9.5.2 specifies that if the UE wants to send HARQ-ACK and CSI
report on format 2/3/4, then the resource is selected by the PUCCH
resource indicator for sending HARQ-ACK.

In this case the resource set must be >= 1 because O_UCI has HARQ-ACK
and CSI report and is > 2.

So far we use the PUCCH resource of CSI report if HARQ-ACK format is < 2
and CSI report is >= 2. This PR fixes it.

Closes: #90
Reviewed-by: Francesco Mani <email@francescomani.it>

XNAP: Add encode/decode+unit tests for Xn HO Cancel, HO Success, RAN Paging (#178)

Extends the XNAP encode/decode library with three class 2 procedures
from 3GPP TS 38.423 v16.2.0, each with full encode/decode/eq/free
support and an APER round-trip unit test.

Handover Cancel (§9.1.1.6): Sent by the source node to abort an
in-progress handover before the UE has accessed the target cell.

- Source NG-RAN node UE XnAP ID (M)
- Cause (M)

Handover Success (§9.1.1.12): Sent by the target node to confirm the UE
has successfully accessed the target cell.

- Source NG-RAN node UE XnAP ID (M)
- Target NG-RAN node UE XnAP ID (M)
- Requested Target Cell Global ID (M)

RAN Paging (§9.1.1.7): Requests a neighbouring NG-RAN node to page a UE
in RRC_INACTIVE state.

- UE Identity Index Value (M) — 10-bit BIT STRING
- UE RAN Paging Identity (M) — 40-bit I-RNTI BIT STRING
- Paging DRX (M)
- RAN Paging Area (M) — cell-list variant, one PLMN + NR cell IDs
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-By: Guido Casati <guido.casati@openairinterface.org>

Assisted-by: Claude-Code:Opus-4.8
Signed-off-by: Maxime Elkael <m.elkael@northeastern.edu>

- Add RAN Paging message type definitions, including paging DRX
  enumeration (§9.2.3.66) and RAN paging area cell-list
  structure (§9.2.3.38)
- Implement encoder and decoder for RAN Paging
    RAN Paging (3GPP TS 38.423v16.2.0 §9.1.1.7)
    - UE Identity Index Value (M)
    - UE RAN Paging Identity (M)
    - Paging DRX (M)
    - RAN Paging Area (M)
- Add equality check and memory management helpers
- Add required ASN.1 header includes for RAN Paging IEs
- Extend XNAP library unit tests to cover RAN Paging
Reviewed-by: Venkatareddy Akumalla <venkatareddy.akumalla@openairinterface.org>
Signed-off-by: Mohammed Safwan <mohammed.safwan@openairinterface.org>

- Add Handover Success message type definitions
- Implement encoder and decoder for Handover Success
    Handover Success (3GPP TS 38.423v16.2.0 §9.1.1.12)
    - Source NG-RAN node UE XnAP ID (M)
    - Target NG-RAN node UE XnAP ID (M)
    - Requested Target Cell Global ID (M)
- Add equality check and memory management helpers
- Extend XNAP library unit tests to cover Handover Success
Reviewed-by: Venkatareddy Akumalla <venkatareddy.akumalla@openairinterface.org>
Signed-off-by: Mohammed Safwan <mohammed.safwan@openairinterface.org>

- Add Handover Cancel message type definitions
- Implement encoder and decoder for Handover Cancel
    Handover Cancel (3GPP TS 38.423v16.2.0 §9.1.1.6)
    - Source NG-RAN node UE XnAP ID (M)
    - Cause (M)
- Add equality check and memory management helpers
- Extend XNAP library unit tests to cover Handover Cancel
Reviewed-by: Venkatareddy Akumalla <venkatareddy.akumalla@openairinterface.org>
Signed-off-by: Mohammed Safwan <mohammed.safwan@openairinterface.org>

Signed-off-by: Teodora Vladić <teodora.vladic@openairinterface.org>
Fixes: https://github.com/duranta-project/openairinterface5g/commit/f65b8f564ffc90af553865784c8074170ac04e39 ("Correctly extract the PUSCH PRBs from an internet frame (one fragment)")

Signed-off-by: Sagar Arora <sagar.arora@openairinterface.org>

Shall be always up to date according to the cmake variable.
Signed-off-by: Teodora Vladić <teodora.vladic@openairinterface.org>

Fix vrtsim antenna configs (#144)

This PR fixes three issues: #130 #125, and an unreported issue related
to flaky vrtsim tests. With the new unix domain socket initialization
the unit test framework should be much more robust and not fail
randomly.
Reviewed-By: Merkebu Girmay <merkebu.girmay@openairinterface.org>
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>

Merge remote-tracking branch 'rubensoaressilva/Issue_1103_Ambiguous_language' into integration_2026_w25

Change ambigous language in Aerial_FAPI_Split_Tutorial.md (#176)

This PR addresses Issue 1103
(https://gitlab.eurecom.fr/oai/openairinterface5g/-/work_items/1103),
changing one note in Aerial_FAPI_Split_Tutorial.md regarding CN core
allocation when running on the same server.  The original wording could
be interpreted as allocating a separate core to each of the core network
functions, when that's not the intended interpretation.
Reviewed-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>