Add SIB 3,4 support, configurable SIB2 and refactor CU/DU SIB management

This MR makes neighbour and inter-frequency configuration drive how
SIB2/SIB3/SIB4 are built and sent from CU to DUs. It standardizes SIB
payloads as byte_array_t with typed SIB IDs across RRC, F1AP and MAC,
reducing ad‑hoc buffer handling. Neighbour parsing, validation and
lookup are tightened.

Changes

- Minor refactor to gNB neighbour parsing and storage (shared PLMN
  extraction, safer allocation, etc).
- Represent SIB containers uniformly as byte_array_t plus nr_sib_type_t,
  and adapt F1AP, MAC and RRC users to the new container API.
- Make SIB2 cell-reselection information fully config-driven with
  explicit bounds checking and SIB2 ASN.1 building from that config.
- Generate SIB3 intra-frequency neighbours from the per-cell neighbour
  list and propagate them from CU to DU over F1, with MAC
  decoding/attaching them to SystemInformation.
- Generate SIB4 inter-frequency neighbours from a new frequency_list
  plus neighbour SIB3/SIB4 offsets, and propagate them from CU to DU
  over F1, with MAC decoding/attaching them.
- Add basic ASN.1 round-trip tests for SIB2/SIB3/SIB4 and SIB4 range
  checks, and update RRC docs to describe the neighbour/inter-frequency
  configuration model.

Testing:

1. in gNB conf file:

    cu_sibs = (2, 3, 4);

2. Update neighbour config file with SIB3/SIB4 conf:

    (see documentation)

3. run gNB and UE as usual

---

Logs & configs: see MR on Gitlab

Expand RRC usage and handover documentation to describe the two-level
neighbour configuration layout, lookup-key semantics,
and config-time SIB4 grouping behaviour. Expand the example config
to include a `frequency_list` block and per-neighbour SIB3/SIB4
offset fields. Add SIB2 config example.

Update handover-tutorial.md to describe the same nested model and
note that F1 and N2 handover share the same serving-cell keyed
mapping.

Add documentation about SIB3/SIB4 and MeasGaps implementation
in OAI with stress on the shared neighbour configuration data model.

Update FEATURE_SET.

Fix fill_srs_channel_matrix

Fix incorrect SRS subcarrier mapping in fill_srs_channel_matrix

The previous implementation of fill_srs_channel_matrix assumed an incorrect
SRS subcarrier mapping, leading to wrong indexing of the estimated channel
in frequency domain.

Update CN5G images to release v2.2.1 and update traffic generator image

- Updated all CN5G image tags to v2.2.1
- Updated image oaisoftwarealliance/trf-gen-cn5g to latest tag supporting
  multi-architecture platforms See here
- Enabled iperf3 server in daemon mode in oai-ext-dn
- Handover: Since MR oai/cn5g/oai-cn5g-amf!372 has been merged, the AMF
  image tag is updated to the latest release v2.2.1
- upgrade MySQL image to 9.6

Signed-off-by: Shubhika Garg <shubhika.garg@openairinterface.org>

Signed-off-by: Shubhika Garg <shubhika.garg@openairinterface.org>

   - This tag is multi-architecture compatible
Signed-off-by: Shubhika Garg <shubhika.garg@openairinterface.org>

Signed-off-by: Shubhika Garg <shubhika.garg@openairinterface.org>

fix(record_db doc): correct the path for T_messages.txt and mention use of ninja/make

The commit !4038 (51d84419) provided the wrong path for T_messages.txt. The path
it provided holds if the T tracer is built manually using make.

A note to explicitly mention the path for T_messages.txt when T tracer is built
using make.

Signed-off-by: Sagar Arora sagar.arora@openairinterface.org

Compilation without T: move to physims

fix: issue 911 - replace timer oneshot to periodic.

Updated SCTP reconnect timer from TIMER_ONE_SHOT to TIMER_PERIODIC so gNB
continuously retries AMF lookup every 30 seconds after disconnect.
Timer is now removed only when ngap_amf_associated_nb > 0, AMF association
is actually back.

Signed-off-by: Sagar Arora <sagar.arora@openairinterface.org>

Updated SCTP reconnect timer from TIMER_ONE_SHOT to
TIMER_PERIODIC so gNB continuously retries AMF lookup every
30 seconds after disconnect.

Timer is now removed only when ngap_amf_associated_nb > 0,
AMF association is actually back.

Update the shared neighbour config used by the F1 rfsim pipeline to
enable CU-provided SIB2 and neighbour-derived SIB3/SIB4 inputs.

In `ci-scripts/conf_files/gnb-cu.sa.band78.106prb.conf`
- Add `cu_sibs = (2, 3, 4)

In `ci-scripts/conf_files/neighbour-config.conf`:
- Add a complete `sib2_config` block
- Add `frequency_list` / `frequency_config` for inter-frequency SIB4 fields
- Extend both neighbour entries with per-cell offsets

Add encode/decode helpers and basic round-trip tests for NR SIB2, SIB3
and SIB4 in test_asn1_msg.cpp to ensure we produce decodable messages
with expected fields. Extend SIB4 coverage with an
inter_freq_carrier_freq_info_ranges test that exercises boundary and
out-of-range values for carrier reselection parameters and checks
encoder failures for invalid configurations.

Changes:
- Introduce encode_and_decode_sib2, encode_and_decode_sib3 and
  encode_and_decode_sib4 helpers that call do_SIB2_NR, do_SIB3_NR,
  do_SIB4_NR and uper_decode and assert non-empty, non-null byte
  arrays and successful decoding.
- Add sib2_basic_encode_decode, sib3_basic_encode_decode and
  sib4_basic_encode_decode tests that populate minimal but
  representative NR_SIB2_t, NR_SIB3_t and NR_SIB4_t instances and
  verify selected decoded fields match the originals.
- Add inter_freq_carrier_freq_info_ranges test that builds an NR_SIB4_t
  with NR_InterFreqCarrierFreqInfo_t and varies different offsets and
  thresholds to confirm valid combinations encode and invalid ones
  are rejected.

- Add comprehensive documentation header explaining the structure's role
  as single source of truth for neighbor cell information across multiple
  protocols (NGAP/XnAP handover, measurement config, DU validation, SIB3/SIB4)

- Add detailed field comments documenting protocol-specific mappings:
  * Core identification fields (gNB_ID, nrcell_id, physicalCellId)
  * Frequency/RF parameters (absoluteFrequencySSB, subcarrierSpacing, band)
  * Handover target identification (plmn, tac)

- Document NGAP/XnAP IE mappings for plmn and tac fields

Remove the isIntraFrequencyNeighbour field and all code that sets or
uses it, simplifying neighbour cell handling and avoiding redundant
state in the RRC gNB code. The flag duplicated information that can be
derived from the neighbour absoluteFrequencySSB and the serving cell
SSB ARFCN, and intra-frequency neighbours are logged in the SIB3
preparation flow.

Changes:
- Remove isIntraFrequencyNeighbour from nr_neighbour_cell_t in
  openair2/RRC/NR/nr_rrc_defs.h
- Delete is_intra_frequency_neighbour() and
  label_intra_frequency_neighbours() helpers from
  openair2/RRC/NR/rrc_gNB_du.c
- Remove calls to label_intra_frequency_neighbours() from
  rrc_gNB_process_f1_setup_req() and
  rrc_gNB_process_f1_du_configuration_update() in rrc_gNB_du.c
- Stop setting .isIntraFrequencyNeighbour in the local
  nr_neighbour_cell_t neighbourConfig initializer in
  openair2/RRC/NR/rrc_gNB_mobility.c

Add SIB4 encode/decode helpers and populate SIB4 from configured
inter-frequency carriers and neighbour cells, wiring it into DU F1
Setup handling and MAC SystemInformation.

Changes:
- Add do_SIB4_NR() and NR_SIB4.h inclusion in asn1_msg.c/asn1_msg.h to
  UPER-encode NR_SIB4_t into a byte_array_t.
- Extend nr_mac_configure_other_sib() in NR_MAC_gNB/config.c with an
  NR_SIB_4 case that validates the SIB container, decodes NR_SIB4_t via
  uper_decode, logs failures, and appends SIB4 to SystemInformation.
- Introduce build_inter_freq_carrier_from_cfg() and
  get_sib4_inter_freq_neighbors() in rrc_gNB_du.c to build
  NR_InterFreqCarrierFreqInfo_t and NR_SIB4_t from inter-frequency and
  neighbour cell configuration, skipping invalid or empty carriers.
- Handle NR_SIB_4 in rrc_gNB_process_f1_setup_req() by deriving SIB4
  from neighbour/inter-frequency configuration, encoding it with
  do_SIB4_NR(), validating the resulting byte_array_t and adding the SI
  message for the DU cell when encoding succeeds.

Introduce NR SIB3 encoding in RRC and wire SIB3 neighbour information
into CU–DU F1 Setup and DU SystemInformation. Extend MAC to decode NR
SIB3 from CU-provided SIB containers and attach the decoded SIB3 to the
DU SystemInformation structure.

Changes:
- Add NR_SIB3 ASN.1 include and a do_SIB3_NR() encoder in asn1_msg
  so SIB3 can be serialized into a byte_array_t buffer.
- Introduce get_q_offset_asn1() and get_sib3_intra_freq_neighbors() in
  rrc_gNB_du.c to build an intra-frequency neighbour cell list for SIB3,
  mapping q_OffsetCell dB values to NR_Q_OffsetRange and optionally
  filling q_RxLevMinOffsetCell and q_QualMinOffsetCell.
- Limit the number of intra-frequency neighbours in SIB3 to
  NR_maxCellIntra, logging a warning and skipping additional cells when
  the limit is reached.
- Hook SIB3 construction and encoding into rrc_gNB_process_f1_setup_req()
  so SIB type 3 entries are added to the F1 Setup Response when
  neighbour configuration and matching neighbours are available.
- Handle NR_SIB_3 in nr_mac_configure_other_sib() by validating the CU
  SIB3 container buffer, decoding it with uper_decode into an NR_SIB3_t,
  and attaching the resulting SIB3 to the MAC SystemInformation via
  add_sib_to_systeminformation().

Introduce typed SIB3/SIB4 neighbour and inter-frequency carrier
configuration structures, wire them into the RRC neighbour and gNB
instances, and centralise parsing and bounds checking of per-frequency
SIB4 parameters from the gNB frequency list.

Changes:
- Define SIB3/SIB4 reselection and offset bound macros in gnb_config.c
  and apply them when parsing SIB4 frequency_config and
  per-carrier q_RxLevMin/t_ReselectionNR.
- Add add_inter_freq and parse_inter_freq_list helpers in gnb_config.c
  to populate a shared inter_freqs seq_arr_t from gNB_CONFIG_STRING_GNB_LIST
  frequency_list entries, enforcing unique (ARFCN,SCS) combinations and
  logging duplicates.
- Extend neighbour cell parameters in gnb_paramdef.h with SIB3 per-
  neighbour offset fields and define frequency_list/frequency_config
  option names, descriptor tables, and index constants for SIB4 inter-
  frequency configuration.
- Introduce nr_neighbour_cell_neighbor_offset_t, nr_neighbour_cell_sib3_t,
  nr_neighbour_cell_sib4_freq_t, nr_neighbour_cell_sib4_t, and
  nr_inter_freq_cfg_t in nr_rrc_defs.h, and extend nr_neighbour_cell_t
  and gNB_RRC_INST with sib3/sib4 and inter_freqs members respectively.
- udpated fill_neighbour_cell_configuration to use GET_PARAMS_LIST
  with params bound check

Introduce a typed SIB2 cell reselection configuration, load it from the
gNB configuration into the RRC gNB instance, and use it to build and
encode SIB2 instead of relying on a fixed SIB2 definition.
Validate SIB2 parameters against explicit bounds and make the SIB2
encoder consume a pre-built ASN.1 structure with safer error handling.

Changes:
- Add SIB2 mobility timer and q-HystSF enums plus SIB2 config structs
  (`sib2_speed_state_reselection_pars_t`, `sib2_config_t`) and a
  `sib2_config` field on `gNB_RRC_INST` in `nr_rrc_defs.h`.
- Define SIB2 configuration option names, defaults
  (`GNB_CONFIG_STRING_SIB2_*`, `GNBSIB2PARAMS_DESC`)
  in `gnb_paramdef.h` for q_Hyst, thresholds, mobility timers, scaling
  factors and deriveSSB_IndexFromCell.
- Add `sib2_config` parameter keys, defaults, and range/value checks in
  `gnb_paramdef.h` (`GNBSIB2PARAMS_DESC`).
- Add SIB2 `fill_sib2_configuration()` in `gnb_config.c` to read SIB2
  parameters from the config file log the resulting configuration and
  store it in `rrc->sib2_config` via `RCconfig_NRRRC()`.
- Add `get_q_hyst_asn1()` and `get_sib2_from_cfg()` in `rrc_gNB_du.c`, and
  update `rrc_gNB_process_f1_setup_req()` to encode/add SIB2 from config with
  explicit encode-failure handling and logging.
- Change `do_SIB2_NR` signature in `asn1_msg.h/.c` to
  `byte_array_t do_SIB2_NR(const NR_SIB2_t *sib2)`, remove internal default
  SIB2 construction, and add ASN.1 constraint/encode error logging.

Add info logs for neighbour cell configuration parsing
without changing functional behaviour.

Unify SIB container handling by introducing a typed SIB enum and storing
SIB payloads as byte_array_t across common NR types, F1AP helpers, MAC,
and RRC DU setup code.

Changes:
- Include byte_array support in nr_common.h, add nr_sib_type_t (NR_SIB_1–NR_SIB_21),
  and change nr_SIBs_t to hold only nr_sib_type_t SIB_type.
- Switch f1ap_sib_msg_t in f1ap_messages_types.h to use a byte_array_t SI_container
  instead of raw pointer and length fields.
- Update F1AP encode/decode, equality, copy, and free helpers in
  f1ap_interface_management.c to work on SI_container.buf / SI_container.len and
  use eq_byte_array, copy_byte_array, and free_byte_array.
- Adapt F1AP tests in f1ap_lib_test.c to build and inspect SIB containers via
  SI_container.buf and SI_container.len.
- Replace magic SIB numbers with nr_sib_type_t values in gnb_config.c
  (get_sys_info and fill_du_sibs) to validate and configure DU SIBs.
- Rework nr_mac_configure_other_sib in NR_MAC_gNB/config.c to decode SIB2
  from a byte_array_t container, fix freeing by releasing the decoded sib2 on
  failure, and use NR_SIB_2 / NR_SIB_19 for CU/DU SIB selection.
- Add an add_si_msg helper in rrc_gNB_du.c and refactor the SIB2 branch of
  rrc_gNB_process_f1_setup_req to populate cell->SI_msg from encoded local
  byte array while iterating SIBs with FOR_EACH_SEQ_ARR.

Tighten neighbour-cell config parsing by enforcing parameter constraints in
the descriptor and switching parsing code to name-based lookups with gpd.

Changes:
- Update `GNBNEIGHBOURCELLPARAMS_DESC` in `openair2/GNB_APP/gnb_paramdef.h`
  to add checks for `physical id`, `absoluteFrequencySSB`, `scs`, `band`
  `tracking_area_code`.
- Remove neighbour-cell parameter index macros.
- Refactor `parse_neighbour_cells_list` in `openair2/GNB_APP/gnb_config.c`
  to use `gpd()` lookups for neighbour fields instead of fixed indexes.
- Extend `parse_neighbour_cells_list` with an `n_cell_params` argument and
  update `fill_neighbour_cell_configuration` to pass
  `sizeofArray(ncell_params)`.

Inline neighbour cell arrays into the RRC neighbour configuration and
update RRC/DU helpers to use const-aware access and shared iteration
helpers when walking neighbour lists and building measurement configs.

Changes:
- Change neighbour_cells in neighbour_cell_configuration_t from a
  seq_arr_t * to an embedded seq_arr_t field.
- Initialize and populate the embedded neighbour_cells directly in
  parse_neighbour_cells_list in gnb_config.c, dropping dynamic
  allocation of the neighbour list container.
- Refactor get_neighbour_cell_by_pci and nr_rrc_get_measconfig in
  rrc_gNB.c to access the embedded neighbour_cells via const pointers,
  introduce a local meas_cfg and a3_event_list, and iterate neighbour
  cells with FOR_EACH_SEQ_ARR.
- Treat neighbour cell configuration entries as const in rrc_gNB_du.c
  (get_cell_neighbour_list, label_intra_frequency_neighbours,
  valid_du_in_neighbour_configs) and iterate neighbour lists with
  FOR_EACH_SEQ_ARR instead of index-based loops.

Outer gNB neighbour_list entries now only declare the serving cell
nr_cellid. The code resolves that field with gpd instead of a fixed column
index.

Changes:
- gnb_paramdef.h: remove unused NEIGHBOUR_CELL_PHYSICAL_ID from
  GNB_NEIGHBOUR_LIST_PARAM_LIST (keep NRCELLID only).
- gnb_config.c: in fill_neighbour_cell_configuration, set nr_cell_id
  from gpd

Refactor gNB configuration code to share PLMN extraction logic and to
split neighbour-cell configuration into smaller helpers with safer
allocation and clearer list handling.

Changes:
- Add `extract_plmn_from_params()` in `gnb_config_common.c` and declare
  it in `gnb_config_common.h` to centralize PLMN extraction from
  `paramdef_t`.
- Update `set_plmn_config()` to use `extract_plmn_from_params()` when
  filling the PLMN array instead of duplicating field assignments.
- Refactor `fill_neighbour_cell_configuration()` in `gnb_config.c` to
  delegate per-cell neighbour parsing to
  `parse_neighbour_cells_list()` and sorting to
  `sort_neighbour_configuration()`, simplifying the main loop.
- Use `extract_plmn_from_params()` when parsing neighbour PLMNs in
  `parse_neighbour_cells_list()` and log each neighbour with its PLMN,
  PCI, and other radio parameters before adding it to the sequence.
- Switch allocation of `rrc->neighbour_cell_configuration` in
  `fill_neighbour_cell_configuration()` from `malloc` to
  `malloc_or_fail()` to enforce consistent handling of allocation
  failures.

Change 1: config_check_intval() now uses the correct integer pointer for TYPE_INT

Problem: config_check_intval() previously dereferenced param->uptr regardless
of param->type. For parameters declared as signed (TYPE_INT / TYPE_INT32), the
active union member is param->iptr, and param->uptr may be NULL -> using uptr
makes validation unsafe and type-inconsistent.

What changed: Updated config_check_intval() behavior (signature unchanged).
Handle both param->type, param->iptr and param->uptr.

Change 1: new config_check_uintrange() for unsigned range constraints

Problem: there was a signed range checker (config_check_intrange()) that reads
param->iptr, but there was no dedicated unsigned range validator using param->uptr.

What changed: added config_check_uintrange() in config_userapi.h/.c
The new function reads param->uptr as uint32_t and validates against
param->chkPptr->s2.okintrange[] endpoints.

Change 3: constify input params for f2 function pointers

Problem: checkedparam_t.s2.f2 was typed with non-const input params, even though
range checks only read. A safer const-safe signature is required.

What changed: s2.f2 now takes const configmodule_interface_t *
and const paramdef_t *. config_check_intrange() and config_check_uintrange() use
the same const-qualified parameters.

Use the integer pointer when reporting invalid integer values:
in `config_check_intrange()` error print from `param->uptr` to
`param->iptr`.

Integration `2026.w15`

* !4014 Microamp FR2 configuration file and documentation
* !4029 nr rlc: tolerate bogus data
* !4032 build_oai fixes: harmonize duplicate options, remove wrong --build-lib handling
* !3977 Further unused arguments cleanup
* !4009 Fix for NULL pucch-ResourceCommon at MSG4
* !4037 Increase reliability of ltebox start
* !4034 Prevent infinite loop on Single Entry PHR handling
* !4038 doc(record_db): explain how to use record_db
* fix compilation of T tracers with 'make'
* !3489 Thread-pool support for TX symbol processing.

See merge request oai/openairinterface5g!4033

Thread-pool support for TX symbol processing.

This MR adds thread-pool support for TX symbol processing. It allows modulation
/mapping/layer-precoding to run in parallel and offers a speedup of around 3
compared to single-thread execution. This is particularly important for large
bandwidths and 4 or more TX antenna ports where the precoding operation is quite
computationally-intensive.

Please see the description of !3489 for the performance comparison results and
the nr_dlsim timing measurements.

Extend the performance tuning section of documentation
to include explanation on the `--L1s.L1_num_tx_sym_per_thread` option
and on the AMD EPYC core complex behavior

Modification required after !3977 is merged.

doc(record_db): explain how to use record_db

Documentation for how to use record_db

Prevent infinite loop on Single Entry PHR handling

Avoid an infinite loop, and always pass HARQ PID. Also make more
functions static.

Signed-off-by: Sagar Arora <sagar.arora@openairinterface.org>
Reviewed-by: Nick Hedberg <nhedberg@nvidia.com>
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Assisted-by: gpt-5.4

Increase reliability of ltebox start

The existing ltebox startup sequence on nepes occasionally fails. Running

sudo su -c 'screen -dm -S simulated_hss /opt/hss_sim0609/starthss' \
    && sleep 1 && sudo /opt/ltebox/tools/start_mme && sudo /opt/ltebox/tools/start_xGw \
    & sleep 1 && ip a show dev tun1

Reliably shows that no tun1 interface is created, because that takes around
1s itself. Increasing the second sleep to 2 reliably deploys it correctly.
Do the same for sabox and ltebox on nano for consistency.

Fix for NULL pucch-ResourceCommon at MSG4

Field pucch-ResourceCommon, used for ACK of MSG4, in some scenarios was
overwritten by RRCSetup before being used. Storing it in advance prevents
the segfault. In addition there is a clenaup of similar procedures at gNB.