Add two new functions for calculation symbol timestamp and symbol
duration for NR_DL_FRAME_PARMS. These functions are not using
the existing indirection mechanism via function pointers as this
prevents the compiler from properly optimizing the code.

Integration `2025.w48`

* !3778 CI: Update IP addresses in Aerial gNB config files
* !3659 UE NTN - Epoch time handling for Target cell
* !3772 CI: Ensure EPC is always terminated in NSA-B200 pipeline
* !3773 Fix doc for UTC timestamp
* !3759 NR UE: fix bug for SRS generation when freqDomainShift (n_shift) is not 0
* !3774 Use UL functions for Qm/R determination
* !3767 Fix DRB integrity failures during handover and re-establishment
* !3764 Avoid measGap configuration on handover in intra-freq scenarios
* !3768 Fix MIB encoding in F1SetupRequest: use encode_MIB_NR_setup instead of encode_MIB_NR
* !3771 CI build analysis: print log file errors
* !3703 Taking into account UE capabilities for TBS_lbrm layers
* !3561 Implementation of STOP exchange
* !3776 Fix reestablishment after handover
* !3763 CI: Reduce the tries to attach the UE in CI runs
* !3761 fix(FHI 7.2): PRACH frame test
* !3616 [FHI72 M-plane] Update the M-plane support to v16.01
* !3790 Correctly copy nFAPI messages
* !3779 CFRA: mark RA complete when sending Msg2 - check CI

Closes #563 and #1034

See merge request oai/openairinterface5g!3775

CFRA: mark RA complete when sending Msg2

The current contention-free random access forces a "Msg3" (which does
not exist in CFRA) to be received by a UE. Sometimes, this "Msg3" is not
received (for whatever reason), and the MAC declare that RA failed.

This is problematic, as the spec says that RA is complete once Msg2 is
received by the UE. Since the gNB cannot know when this is, simply mark
it as complete once we sent Msg2.

We still send Msg3 in CFRA, which is explained further in the commits.

Also, improve logging and stabilize an RFsim test by reducing sl_ahead.

Correctly copy nFAPI messages

All nFAPI message have copy helpers, so use that for "loading" nFAPI
messages into the L1. This also fixes a bug/error message

2. 0 no corresponding tx_data.request for dl_tti.request index 11, dropping

because the loop over DL_tti.request assumed that all messages are PDSCH
PDUs, when we can have others such as PDCCH, etc. In other words, when
looking up indices ("11" in the example above), we were checking also
inside other messages for SSB, PDCCH, etc, which is of course wrong.
That loop was an attempt to validate matching PDSCH PDUs with
TX_data.requests. This check is already done inside
phy_procedures_gNB_TX() through an assert, but this commit replaces with
the equivalent check previously inside nr_pnf_p7_get_msgs(). This is ok,
as the L1 cannot trust the scheduler (in monolithic) to provide the
correct information, either.
Fixes: eefb9da6 ("Reimplement nFAPI message exchange after msgDataTx removal")

[FHI72 M-plane] Update the M-plane support to v16.01

- retrieve the additional hardware states (oper-state, admin-state,
  availability-state) and update according to the received notifications
- properly configure MIMO mode if a RU supports
- update the yang models to v16.01
- tested with Benetel v1.4.1, and added an example run in the M-plane doc

Note: backwards compatible with M-plane v05.00

Also, memory leakages fixed cause by ru_session_list_t, and xml functions
xmlReadMemory() and xmlNodeGetContent().

fix(FHI 7.2): PRACH frame test

A test was missing in the PRACH RX function of the FHI 7.2 in order to know if
the frame had a PRACH occasion. This was leading to continuous warning messages
as PRACH RX was triggered on frames in which PRACH was not expected by the
scheduler.

CI: Reduce the tries to attach the UE in CI runs

The goal of this MR is to save time in CI runs by reducing the UE attach tries
to 3 instead of 4 and UE timeout to 20 seconds, which will be incremented after
each fail, instead of 60 seconds.

Since the parent commit, CFRA is inconditionally marked complete on Msg3
reception (successful or not). This works because the current
implementation still sends a UL grant (see parent commit for details).

In this commit, handle Msg3 if received in CFRA (notably for TA and
power). Note that since we declare RA complete, UE->ra does not exist
anymore, and so an intermediate variable is introduced to capture the
CFRA flag. The code should be such that if we are in CFRA, we never
access any UE->ra variable.

All nFAPI message have copy helpers, so use that for "loading" nFAPI
messages into the L1. This also fixes a bug/error message

    2. 0 no corresponding tx_data.request for dl_tti.request index 11, dropping

because the loop over DL_tti.request assumed that all messages are PDSCH
PDUs, when we can have others such as PDCCH, etc. In other words, when
looking up indices ("11" in the example above), we were checking also
inside other messages for SSB, PDCCH, etc, which is of course wrong.

That loop was an attempt to validate matching PDSCH PDUs with
TX_data.requests. This check is already done inside
phy_procedures_gNB_TX() through an assert, but this commit replaces with
the equivalent check previously inside nr_pnf_p7_get_msgs(). This is ok,
as the L1 cannot trust the scheduler (in monolithic) to provide the
correct information, either.

Fixes: eefb9da6 ("Reimplement nFAPI message exchange after msgDataTx removal")

Number of tries is reduced from 4 to 3
After each failure the timeout is incremented by 20

A test was missing in the PRACH RX function of the FHI 7.2 in order to
know if the frame had a PRACH occasion.
This was leading to continuous warning messages as PRACH RX was
triggered on frames in which PRACH was not expected by the scheduler.

The current contention-free random access forces a "Msg3" (which does
not exist in CFRA) to be received by a UE. Sometimes, this "Msg3" is not
received (for whatever reason), and the MAC declare that RA failed.

This is problematic, as the spec says that RA is complete once Msg2 is
received by the UE. To avoid this, inconditionally mark RA as complete
as soon as we receive an indication of Msg3 (DTX or not).

Note that after this change, we still send a UL grant in Msg2. This is
because 38.321 §5.1.4 is not clear to me whether we should send UL grant
(it does not explicitly exclude it), and it says

> 3> if the Random Access Response includes a MAC subPDU with RAPID only:
> [...]
>   4> indicate the reception of an acknowledgement for SI request to
>      upper layers.

which is NOT the case (but then I don't know/think we can have CFRA for
SI request?).  Since it also works with COTS UE, I leave Msg3 for the
moment.

The reason to not directly mark RA as complete when sending Msg2 is
because of possible retransmissions in do-ra mode. In fact, in do-ra,
there might already be data awaiting. In that case, the DLSCH scheduler
schedules data _in the same slot as Msg2_, which the UE does not decode,
leading to retransmissions.

Implementation of STOP exchange

This implements the STOP.request/indication for all 3 transport mechanisms, the
VNF will send the STOP.request to the PNF, indicating it will disconnect, and
await a STOP.indication from the PNF

The WLS VNF is reworked to be able to start before the PNF, by calling call
rte_eal_init and rte_dev_probe to determine if dpdk has been initialized
properly, before calling rte_eal_init in the intended process when it is
appropriate to do so

Fix reestablishment after handover

- fix reestablishment by not re-creating LCIDs with priority set to 0 (see first
  commit for more details)
- cleanup code

Taking into account UE capabilities for TBS_lbrm layers

Closes #563

CI build analysis: print log file errors

The generated HTML from CI builds so far only shows the number of errors, but
not the errors themselves. This is inconvenient, as this means that developers
have to go to the logs.

This commit modifies AnalyzeBuildLogs(), which already iterates the entire file,
to store the lines containing "error:" (as it would be emitted by a compiler).
The callers of AnalyzeBuildLogs() now also print the analysis outcome in a more
concise manner.

Also, change the return parameter of AnalyzeBuildLogs() to a tuple to make the
variable handling easier, and remove the unused warnings list.

The idea is to reestablish all RLC entities (it's a new UE, and we set
reestablishRLC on all bearerrs), so we should reestablish all RLC
entities on gNB side as well, without any additional loop.
Co-authored-by: Roberto Magueta <rmagueta@allbesmart.pt>

Move the file process_addmod_bearers_cellGroupConfig() to the file where
it is used. Correctly set priorities as requested in RLC bearer
configuration.

In all cases (NSA, HO), we create LCIDs before the UE triggers random
access. Hence, process_addmod_bearers_cellGroupConfig() is not
necessary, as it just tries to recreate an LCID.

Furthermore, it includes a bug, as this function does set a wrong
priority (0), so the sorting of LCIDs is not correct. This in turn
creates problems with reestablishment, as LCID 1/SRB1 is not in the
first position, making reestablishment fail (where we assume LCID 1 be
in first position).

The actual bug of setting priorities is fixed in the next commit.

Fix MIB encoding in F1SetupRequest: use encode_MIB_NR_setup instead of encode_MIB_NR

- The DU was using encode_MIB_NR() while constructing the GNB-DU System
  Information for the F1SetupRequest.
- encode_MIB_NR() encodes a full NR_BCCH_BCH_Message_t, causing the MIB to be
  wrapped in a BCH container.
- This results in incorrect MIB values in the F1SetupRequest PCAP (e.g., wrong
  systemFrameNumber, SCS, DMRS position, cellBarred).
- According to 3GPP TS 38.473, the MIB carried in F1AP must be encoded as a raw
  NR_MIB_t.
- The correct function encode_MIB_NR_setup() encodes MIB in the required format
  but was not used.
- This patch replaces encode_MIB_NR() with encode_MIB_NR_setup() to ensure correct
  and standards-compliant MIB encoding in the F1SetupRequest.

Closes issue #1034.

Fix DRB integrity failures during handover and re-establishment

This MR fixes DRB integrity protection failures that occur during N2 handover
and connection re-establishment scenarios. The issues were caused by incorrect
security key handling and ciphering configuration during these procedures with
DRB integity enabled.

See merge request !3767 for more details.

Avoid measGap configuration on handover in intra-freq scenarios

During the handover, we are incorrectly configuring the measGap, even though
neighboring cells are on the same frequency. Since gNB is not expecting this
measGap, the SRS scheduling is performed. Therefore, we are periodically
receiving these logs after the handover:

[NR_MAC] Invalid timing advance offset for RNTI 58e2
[NR_MAC] Invalid timing advance offset for RNTI 58e2
[NR_MAC] Invalid timing advance offset for RNTI 58e2
[NR_MAC] Invalid timing advance offset for RNTI 58e2
[NR_MAC] Invalid timing advance offset for RNTI 58e2
[NR_MAC] Invalid timing advance offset for RNTI 58e2

These logs occur at a time when UE is performing a MeasGap operation and not
sending the SRS, while gNB thinks it will receive the SRS, but will not receive
any SRS.

This MR resolves this issue, and after the handover, these logs no longer
appear.

CI: Update IP addresses in Aerial gNB config files

This MR updates the NG-AMF and NG-U IP addresses in both Aerial configuration 
files (standard and UL-heavy) following the IP address change on GH1.

Use UL functions for Qm/R determination

During refactoring, the wrong functions and correspondingly tables have
been used to calculate UL TB size. Fix through correct functions.
This should fix these error messages:

3624774.778195 [MAC]    E (nr_get_Qm_dl:2034)             Invalid MCS table index 3 (expected in range [0,2])
3624774.778207 [MAC]    E (nr_get_code_rate_dl:2066)      Invalid MCS table index 3 (expected in range [0,2])
3624774.778211 [NR_MAC] E (nr_compute_tbs:63)             Error in compute TBS with a NULL input, returning NULL TBS

Fixes: 9449f777 ("Remove TBS table and recompute on demand")

NR UE: fix bug for SRS generation when freqDomainShift (n_shift) is not 0

According to TS 38.211 section 6.4.1.4.3, the frequency domain shift value
n_shift is from higher-layer parameter freqDomainShift. The quantity n_RRC
is given by higher-layer parameter freqDomainPosition. Also corrected
k_0_overbar_p calculation formula to align with standard.

Update IP addresses for NG-AMF and NG-U interfaces in Aerial config files to match GH1’s new assigned IP

Fix doc for UTC timestamp

After merging !3751 (merged), the UTC timestamp now prints only the time.
Update the documentation to reflect this simplified format.

CI: Ensure EPC is always terminated in NSA-B200 pipeline

This change avoids leaving EPC processes running after failed test.

UE NTN - Epoch time handling for Target cell

In case of Handover, NTNconfig sent in RRCreconfiguration triggering handover
contains epoch time wrt timing of Target cell. NTNconfig in RRC needs to be
processed only after timing is acquired on the target cell.

In case of Target cell, epoch time is the sfn nearest to the frame timing of the
target cell.

During refactoring, the wrong functions and correspondingly tables have
been used to calculate UL TB size. Fix through correct functions.

This should fix these error messages:

    3624774.778195 [MAC]    E (nr_get_Qm_dl:2034)             Invalid MCS table index 3 (expected in range [0,2])
    3624774.778207 [MAC]    E (nr_get_code_rate_dl:2066)      Invalid MCS table index 3 (expected in range [0,2])
    3624774.778211 [NR_MAC] E (nr_compute_tbs:63)             Error in compute TBS with a NULL input, returning NULL TBS

Fixes: 9449f777 ("Remove TBS table and recompute on demand")

After merging !3751, the UTC timestamp now prints only the time.
Update the documentation to reflect this simplified format.

This change updates the NSA-B200 CI pipeline to guarantee that the EPC is
properly terminated regardless of pipeline success or failure. This avoids
leaving EPC processes running after failed test.

The generated HTML from CI builds so far only shows the number of
errors, but not the errors themselves. This is inconvenient, as this
means that developers have to go to the logs.

This commit modifies AnalyzeBuildLogs(), which already iterates the
entire file, to store the lines containing "error:" (as it would be
emitted by a compiler). The callers of AnalyzeBuildLogs() now also print
the analysis outcome in a more concise manner.

Also, change the return parameter of AnalyzeBuildLogs() to a tuple to make
the variable handling easier, and remove the unused warnings list.

Do not configure NR_MeasurementTimingConfiguration during handover when neighboring cells are at the same frequency