Integration `2025.w49`/`v2.4`

* !3786 Consistently use OAI_RNGSEED env variable for RNG
* !3758 Add yq to edit yaml files and add yaml-dev library in containers missing it
* Fix RFemulator noise device RNG initialization
* !3780 NGAP: fix PDU Session Release Response
* !3795 Increase Aerial-based L2 test core number
* !3794 Fix missing E2SM-RC message forward
* !3660 Fixes for BWP switching
* !3797 Fix FAPI WLS timing, UL counter, doc
* release notes v2.4

See merge request oai/openairinterface5g!3792

Merge remote-tracking branch 'origin/fapi-wls-fixes-timing-counter-doc' into integration_2025_w49 (!3797)

Fix FAPI WLS timing, UL counter, doc

- Fix FAPI WLS timing
- Fix periodical PNF UL throughput logs
- Update documentation to better explain how to run WLS with radio (USRP
  B210)

Fixes for BWP switching

This MR fixes some issues when performing BWP switching via
reconfiguration. It also adds a CI test for BWP switching.  # Please
enter a commit message to explain why this merge is necessary,

In all cases (CFRA in SA for HO, or CFRA in NSA/do-ra for access), the
UE has the full configuration already. We can therefore directly switch
to a dedicated search space, as it is already known to the UE.

Trigger various BWP switches through telnet, and test traffic after each
switch.

... so if we want to have 1 BWP configured at any given time we need to
reconfigure BWP 1 every time. This means that since the gNB has more
than 1 BWPs (for use for different UEs), that there is a "gNB BWP ID"
(as used by the gNB), which can be any BWP ID X, and one "UE BWP ID",
which is always 1. This commit implements this distinction.

Return from triggering reconfiguration with BWP switch if BWP is the
same as before the switch, and add check to verify if BWP triggered by
switch command exists

Also zero out the pointer in spCellConfigDedicated to avoid
use-after-free.

Function pointer send_p7_msg() returns a bool, so correctly set the
type, and interpret it correspondingly.

Current FAPI slot_ahead value for WLS is too low for UL, as we see these
errors:

    [NR_MAC] Unexpected ULSCH HARQ PID 14 (have 3) for RNTI 0xa68e
    [NR_MAC] UE a68e expected HARQ pid 3 feedback at  586. 7, but is at  587.17 instead (HARQ feedback is in the past)

Similarly to nFAPI, scale it by mu (for mu=1 => slot_ahead=2) to give
additional time, which removes these warnings at the VNF.

Increase Aerial-based L2 test core number

Merge remote-tracking branch 'origin/fix-e2ap-compilation-rrc-rc-forward' into integration_2025_w49 (!3794)

Fix missing E2SM-RC message forward

E2SM-RC RRC message forwarding (e.g., to signal a new UE, measurement
reports, ...) was broken since commit d6c29b2d, as we accidentally
removed the E2_AGENT compilation definition from RRC layer.

Although this commit fixes the mentioned issue, it also causes undefined
references to functions defined in ran_func_rc.c file.  Therefore, we
add a hack that provides the definition, and abort if we ever hit these
functions, which in theory should not happen.

Future cleanup should avoid linking in RRC and other layers into
simulators.

Fixes: d6c29b2d ("Fix E2_AGENT linking w.r.t. simulators ")

Testing has revealed that if PDCP drops some packets, the scheduler
falls behind with handling Slot.indication. It could be that we don't
have enough cores, which was reduced previously (from total 8 -> 2).
Reincrease to four cores to have a bit more headroom.

See-also: a18a4888 ("Change number of cores used for OAI gNB from 8 to 2")

Merge remote-tracking branch 'origin/fix-pdu-session-release-transfer' into integration_2025_w49 (!3780)

NGAP: fix PDU Session Release Response

1. Refactor NG UE Context Release Request

  - Removed incorrect UE Context Release Response code (not in 3GPP TS
    38.413)
  - Fixed UE Context Release Request to use correct PDU Session Resource
    List structure
  - Removed incorrect use of pdusession_release_t type

2. Fix PDU Session Release Response

  - Added missing mandatory PDUSessionResourceReleaseResponseTransfer IE
  - Implemented encode_ngap_pdusession_release_response_transfer()
    function
  - Fixed Release Command handler to correctly decode Cause from command
    transfer
  - Split Command/Response struct type definitions to prevent mixing

After !3786, we always have to initialize the RNG when using random
numbers. This was not done for RFemulator and has been added here.

The PDUSessionResourceReleaseResponse message was missing the mandatory
pDUSessionResourceReleaseResponseTransfer IE in each released PDU session item. This caused Open5GS to send an error indication.

Changes:
- Add encode_ngap_pdusession_release_response_transfer() function to
  properly encode the transfer structure (empty since Secondary RAT Usage
  Information is optional and not used, per 9.3.4.21)
- Always include the mandatory PDUSessionResourceReleasedListRelRes IE
- Always encode the pDUSessionResourceReleaseResponseTransfer for each
  PDU session item
- Fix Release Command handler to decode and log Cause from command transfer:
  instead of incorrectly copying command data to response: the 2 transfer
  IEs in the Command and the Response messages are different and should
  not be mixed
- Split Command/Response struct type definitions
- Add missing includes

1) Remove UE Context Release Response code: there is no
such thing in the specs, it is either UE Context Release Request
(NG-RAN node initiated) or UE Context Release (AMF initiated)
(3GPP TS 38.413). The former message has only the request, no
response is defined by the specs. The code in the stack had no
purpose at all and was removed.
2) The UE Context Release Request message only contains a PDU
Session Resource List (optional) of PDU Session IDs, therefore
the use of pdusession_release_t was wrong and was refactored

Add yq to edit yaml files and add yaml-dev library in containers missing it

- nr-cu-up and some containers were missing the yaml-config support
  libraries
- yq tool is required to manipulate YAML files from within the container
  for Helm charts

Consistently use OAI_RNGSEED env variable for RNG

use OAI_RNGSEED env variable everywhere. Hide normal table
initialization of Ziggurat generator from outside. Fix atoi() to use
stroul()

atoi() used previously does not capture all of unsigned long (so we
could not reproduce a high seed), and its use is discouraged as it does
not detect errors. Use strtoul() instead, which allows to also use other
bases (so we can e.g., write OAI_RNGSEED=0x1234)

Hide normal table initialization of Ziggurat generator from outside to
force the usage of randominit() for RNG initialization. In this step,
remove the randominit() seed parameter and only rely on OAI_RNGSEED for
a consistent RNG initialization, as this parameter was used differently
("0" as fixed number or to force a random seed).

Now, only use OAI_RNGSEED env variable to force the usage of a fixed
seed.

Integration `2025.w48`

* !3778 CI: Update IP addresses in Aerial gNB config files
* !3659 UE NTN - Epoch time handling for Target cell
* !3772 CI: Ensure EPC is always terminated in NSA-B200 pipeline
* !3773 Fix doc for UTC timestamp
* !3759 NR UE: fix bug for SRS generation when freqDomainShift (n_shift) is not 0
* !3774 Use UL functions for Qm/R determination
* !3767 Fix DRB integrity failures during handover and re-establishment
* !3764 Avoid measGap configuration on handover in intra-freq scenarios
* !3768 Fix MIB encoding in F1SetupRequest: use encode_MIB_NR_setup instead of encode_MIB_NR
* !3771 CI build analysis: print log file errors
* !3703 Taking into account UE capabilities for TBS_lbrm layers
* !3561 Implementation of STOP exchange
* !3776 Fix reestablishment after handover
* !3763 CI: Reduce the tries to attach the UE in CI runs
* !3761 fix(FHI 7.2): PRACH frame test
* !3616 [FHI72 M-plane] Update the M-plane support to v16.01
* !3790 Correctly copy nFAPI messages
* !3779 CFRA: mark RA complete when sending Msg2 - check CI

Closes #563 and #1034

See merge request oai/openairinterface5g!3775

CFRA: mark RA complete when sending Msg2

The current contention-free random access forces a "Msg3" (which does
not exist in CFRA) to be received by a UE. Sometimes, this "Msg3" is not
received (for whatever reason), and the MAC declare that RA failed.

This is problematic, as the spec says that RA is complete once Msg2 is
received by the UE. Since the gNB cannot know when this is, simply mark
it as complete once we sent Msg2.

We still send Msg3 in CFRA, which is explained further in the commits.

Also, improve logging and stabilize an RFsim test by reducing sl_ahead.

Correctly copy nFAPI messages

All nFAPI message have copy helpers, so use that for "loading" nFAPI
messages into the L1. This also fixes a bug/error message

2. 0 no corresponding tx_data.request for dl_tti.request index 11, dropping

because the loop over DL_tti.request assumed that all messages are PDSCH
PDUs, when we can have others such as PDCCH, etc. In other words, when
looking up indices ("11" in the example above), we were checking also
inside other messages for SSB, PDCCH, etc, which is of course wrong.
That loop was an attempt to validate matching PDSCH PDUs with
TX_data.requests. This check is already done inside
phy_procedures_gNB_TX() through an assert, but this commit replaces with
the equivalent check previously inside nr_pnf_p7_get_msgs(). This is ok,
as the L1 cannot trust the scheduler (in monolithic) to provide the
correct information, either.
Fixes: eefb9da6 ("Reimplement nFAPI message exchange after msgDataTx removal")

[FHI72 M-plane] Update the M-plane support to v16.01

- retrieve the additional hardware states (oper-state, admin-state,
  availability-state) and update according to the received notifications
- properly configure MIMO mode if a RU supports
- update the yang models to v16.01
- tested with Benetel v1.4.1, and added an example run in the M-plane doc

Note: backwards compatible with M-plane v05.00

Also, memory leakages fixed cause by ru_session_list_t, and xml functions
xmlReadMemory() and xmlNodeGetContent().