Do not limit DL power, because it is not done in the other pipelines
either. Set the UL target power high, as this increases the achievable
throughput high (PUCCH can be normal). Finally, increase BLER thresholds
to improve the MCS a bit.

Introduce new data structures to track the average SNR and RSSI, and
that allow to dynamically modify the target SNR (per UE) as well as
continuously get TPC updates based on the average SNR. The target SNR is
per power control loop (which a future commit will extend to use for
PUCCH).

Concretely, it maintains an average of measured SNR and RSSI.  It also
updates "tpc_in_flight", which tracks TPC changes that don't show up in
the average yet. For instance, imagine that the target SNR of 15 changes
to 20. Three successive TPC commands need to be sent (+3, +1, +1), but
it will take time to show up in the average SNR. To account for this,
tpc_in_flight is updated by the TPCs sent, and an average will make it
go down back to zero at the same pace as the average SNR approaches the
target SNR.  The sum of average SNR and tpc_in_flight sums up to the
actual, current SNR, which approximates the target SNR.

The SNR is kept within -1<=targetSNR<=+2dB to avoid too many TPC
changes.

The current average SNR (sum of average SNR and tpc_in_flight) is used
to continuously get TPC updates, taking into account recent TPCs sent,
the difference to target SNR, and RSSI.

If there is DTX, tpc_in_flight is modified to artificially introduce TPC
commands which increase the currently used SNR of the UE. This is
temporary, as tpc_in_flight eventually will go back to zero. If the DTX
was due to sudden SNR drop (e.g., higher path loss), this will allow to
quickly adapt the UE's SNR to new conditions.

The periodical logs are extended to not only show the current SNR, but
also the difference from the target for better analysis.
Co-authored-by: Maxime Elkael <m.elkael@northeastern.edu>

The same calculation is done in post_process_ulsch(), so we don't need it here.

The phr_txpower_calc field actually needs to be saved in the HARQ
process for later retrieval, so set sched_pusch after phr_txpower_calc
has been calculated.

Include plotting tool and README on how to log and visualize graphics.

Group related parameters and simplify setup of these parameters.

It is not filled in the Msg3 scheduler.

Fix XNAP to avoid recompilation and unnecessary includes

See merge request oai/openairinterface5g!3985

Remove the ITTI header, because it would trigger compilation errors (we
don't link in LTE/NR RRC headers), but we don't actually need it.

Notably, remove asn_codecs_prim_xer.h from the list of files, triggering
problems when re-running ninja, because the "canonical OAI asn1c"
(https://github.com/mouse07410/asn1c, commit ID
940dd5fa9f3917913fd487b13dfddfacd0ded06e) does not generate it:

    ninja explain: output openair2/XNAP/MESSAGES/asn_codecs_prim_xer.h doesn't exist

In this version, a couple of files are not generated, so remove them
from the list.

Also, leave the files in the order as shown by ls.

Integration `2026.w11`

* !3864 remove xran_fh_tx_send_slot_BySymbol() and xran_fh_rx_read_slot_BySymbol()
* !3967 Harmonize the use of definition for number of symbols per slot
* !3971 Limit dl_DataToUL_ACK values to 15 as per standard
* !3414 Added NTN-FR2 FDD bands defined in release 18 in Ka-band range
* !3919 Reduce number of mutex locking in MAC->RLC direction
* !3923 XNAP: Add encode/decode and unit tests for Xn Setup Request/Response/Failure
* !3965 Enable BladeRF support in gNB Docker image
* !3904 add multi-ue support to vrtsim
* !3980 SDR reordering: correct warning, and USRP: return samples written
* !3834 Use flat buffer for txdataF in gNB L1
* !3981 Bugfix: make longer telnet cmdfunc names
* Reduce timing reference value for feptx_total in 40 MHz phytest

See merge request oai/openairinterface5g!3976

The reduction reflects improved feptx_total performance introduced in !3834.

Bugfix: make longer telnet cmdfunc names

The maximum number of cmdfunc names is 20, which IMO is too low. Worse, if it's
longer, nothing will warn us because C will just fill the array to it's end
(without \0 at the end). To remedy this:

- Allow longer names till 64 bytes (I hit the previous limit of 20)
- Check that the name is within the length limit: if somebody wants a very long
  name, the strnlen() will return the maximum length, hitting that assertion.
- When reading a command during runtime, allow the corresponding maximum length.

On that occasion, also increase total number of permitted cmdfuncs.

Use flat buffer for txdataF in gNB L1

This MR changes txdataF buffer format to hold freq domain data starting from
PRB0 instead of circular buffer that starts from PRB N/2. The motive is to
simplify RE mapping function in L1 and copying data to xran lib.

SDR reordering: correct warning, and USRP: return samples written

See commits for more information.

add multi-ue support to vrtsim

Summary
Extending vrtsim to support multiple UEs with per-UE channel emulation using
CIRDB. Each UE can have different antenna configurations and independent
channel conditions (TDL models, delay spreads, and mobility speeds). This
includes:
- Add num_ues and ue_id parameters for server and client configuration
- Implement antenna offset multiplexing for UL combining and DL distribution
- Support heterogeneous antenna configurations across UEs (e.g., UE0: 1x2,
  UE1: 2x2)
- Integrate CIRDB for per-UE channel modeling with independent TDL models,
  delay spreads, and speeds
- Replace comma-separated per-UE params with structured ue_config blocks for
  cleaner configuration

Usage:
* Start 5G core network
    cd openairinterface5g/doc/tutorial_resources/oai-cn5g
    docker-compose up -d

* Create network namespaces
    sudo ip netns add ue0
    sudo ip netns add ue1

* Start gNB (2x2 with multi-UE CIRDB)
    sudo ./nr-softmodem -O ../../ci-scripts/conf_files/gnb.sa.band78.106prb.vrtsim.2x2.yaml --device.name vrtsim --vrtsim.role server --vrtsim.num_ues 2 --vrtsim.cirdb 1 --vrtsim.cirdb_file ~/raytracing-channel-emulator/server/external_taps/cir_db.bin --vrtsim.cirdb_yaml ~/raytracing-channel-emulator/server/external_taps/cir_db.yaml --vrtsim.ue_config.[0].antennas "1x2" --vrtsim.ue_config.[0].model_id 0 --vrtsim.ue_config.[0].ds_ns 10.0 --vrtsim.ue_config.[0].speed_mps 1.5 --vrtsim.ue_config.[1].antennas "2x2" --vrtsim.ue_config.[1].model_id 1 --vrtsim.ue_config.[1].ds_ns 30.0 --vrtsim.ue_config.[1].speed_mps 30.0

* Start UE 0 (1x2 antennas, TDL-A, 10ns DS, 1.5 m/s)
    sudo ip netns exec ue0 ./nr-uesoftmodem -O ../../ci-scripts/conf_files/nrue.vrtsim.chanmod.yaml -C 3319680000 -r 106 --numerology 1 --ssb 516 --device.name vrtsim --vrtsim.role client --vrtsim.ue_id 0 --band 78 --ue-nb-ant-tx 1 --ue-nb-ant-rx 2 --uicc0.imsi 001010000000001

* Start UE 1 (2x2 antennas, TDL-B, 30ns DS, 30 m/s)
    sudo ip netns exec ue1 ./nr-uesoftmodem -O ../../ci-scripts/conf_files/nrue.vrtsim.chanmod.yaml -C 3319680000 -r 106 --numerology 1 --ssb 516 --device.name vrtsim --vrtsim.role client --vrtsim.ue_id 1 --band 78 --ue-nb-ant-tx 2 --ue-nb-ant-rx 2 --uicc0.imsi 001010000000002

- Add num_ues and ue_id parameters for server and client configuration
- Implement ul combining and dl distribution to all ues
- Each ue uses dedicated antenna offsets based on ue_id
- Works with no-chanmod mode only and with uniform antenna dimensions across all ues

Enable BladeRF support in gNB Docker image

The goal of this MR is to add support for building a gNB image that supports
BladeRF.

The maximum number of cmdfunc names is 20, which IMO is too low. Worse,
if it's longer, nothing will warn us because C will just fill the array
to it's end (without \0 at the end). To remedy this:

- Allow longer names till 64 bytes (I hit the previous limit of 20)
- Check that the name is within the length limit: if somebody wants a
  very long name, the strnlen() will return the maximum length, hitting
  that assertion.
- When reading a command during runtime, allow the corresponding maximum
  length.

On that occasion, also increase total number of permitted cmdfuncs.

The original error was simply "failed to write to RF", which is not very
precise. Update with sample numbers for context, and add it in another
similar case for consistency.
Co-authored-by: Sagar Arora <sagar.arora@openairinterface.org>

At least writerProcessWaitingQueue() checks for the exact number of
samples written. In many other places, we check that the return is
non-zero.

The usrp-tx-write-thread functionality returned 0, which triggers
various problems. Return the number of samples, as in the "direct write"
case (if-block before else-block).
Co-authored-by: Sagar Arora <sagar.arora@openairinterface.org>

XNAP: Add encode/decode and unit tests for Xn Setup Request/Response/Failure

This MR adds complete support for the following in accordance with
3GPP TS 38.423 v16.2.0
- Add Xn Setup Request, Response, and Failure message type definitions
- Implement ASN.1 encode/decode for all Xn Setup messages
- Add equality checks and memory management helpers
- Create XNAP unit test infrastructure

Co-author: @venkatareddy

Acknowledgement
  This work was carried out as part of research and development at Indian
  Institute of Science (IISc), Bengaluru.

Reduce number of mutex locking in MAC->RLC direction

Currently, the scheduler locks RLC for each operation. Concretely
- for RLC status indication (to get amount of bytes per LC), it locks per LC
- for RLC indication (UL traffic), it locks for each MAC SDU of which there can
  be multiple in a TB
- for RLC data req (getting data from RLC to put into a transport block), it
  locks for each LCID and PDU to get.
This can have a certain overhead, because we need to re-lock RLC multiple times
instead of once (per operation above). In this MR, rework the interfaces such
that it is possible to get all information/data in a single lock-unlock cycle,
which should also help with "spikes" of scheduler times (in some scenarios, it
seems the scheduler takes longer than 0.5ms, and while it's not only locking,
re-locking might contribute), and an increase of number of UEs (e.g., instead
of doing 3 * N UEs lock cycles for getting status of SRB1, SRB2, DRB1, we do
only N times). Concretely, for each UEs RLC status indication, we lock once,
only once per LCID when filling a TB (in particular for LCID 4, on high
throughput, it might be many times), and only once per UL TB (for the common
case of UL data).

Minor fixes include the increase of the Aerial VNF thread priority, and reducing
the maximum RLC indication size to reduce excessive computation (we can't have
1MB in one TB, it is too much).

Adds the API, which will always prepend a 3 byte header before writing a
PDU. This can be used to call less often into RLC, and avoid potential
locking.

The API is used at the gNB DLSCH scheduler.  Also, this removes the
"overhead" calculation: since we fill the entire TB at once, RLC will
leave space for headers as necessary.

  - Add Xn Setup Failure message type definitions.
  - Implement encoder and decoder for Xn Setup Failure.
      Xn Setup Failure (3GPP TS 38.423v16.2.0 §9.1.3.3)
      - Cause (M)
  - Add equality check and memory management helpers.
  - Extend XNAP library unit tests to cover Setup Failure

- Add Xn Setup Response message type definitions
- Implement encoder and decoder for Xn Setup Response
     Xn Setup Response (3GPP TS 38.423v16.2.0 §9.1.3.2)
   - Global NG-RAN Node ID (M)
   - TAI Support List (M)
- Add equality check and memory management helpers
- Extend XNAP library unit tests to cover Setup Response