fix: Make test_vrtsim stable (#241)
Ensure all resources used by test_vrtsim are unique so that there is no
overlap, which might cause an issue in CI.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Add NR O-RU (#211)
This is a PR that will add a functional vrtsim-based nr-oru to the build
system. This is only slightly different SW to the one being presented at
the OAI summer 2026 workshop.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-By: Merkebu Girmay <merkebu.girmay@openairinterface.org>
fix(vrtsim): Reduce OS scheduler pressure caused by vrtsim timing thread (#235)
Increase the usleep to 20 uS to reduce the pressure on the OS scheduler.
This reduces the number of context switches and increases performance.
The value 20uS is approximately half a symbol in mu1 and shouldn't cause
too much extra delay.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
NGAP Procedures for Xn Handover: Path Switch Request Path Switch Request Acknowledge (#194)
This PR adds the following NGAP Path Switch procedures to support Xn
handover in accordance with 3GPP TS 38.413v16.2.0.
NGAP Path Switch Request: add encode and ITTI support
- Add a case in TASK_NGAP to support ITTI message from RRC to NGAP
- Add Path Switch Request message type definitions
- Implement encoder for Path Switch Request (3GPP TS 38.413v16.2.0
§9.2.3.8)
* RAN UE NGAP ID (M)
* Source AMF UE NGAP ID (M)
* User Location Information (M)
* UE Security Capabilities (M)
* PDU Session Resource to be Switched in Downlink List (M)
- Add required ASN.1 header includes for Path Switch Request IEs
NGAP Path Switch Request Acknowledge: add decode and handler
- Add handler at NGAP for Path Switch Request Acknowledge from AMF
- Add Path Switch Request Acknowledge message type definitions
- Implement decoder for Path Switch Request Acknowledge (3GPP TS
38.413v16.2.0 §9.2.3.9)
* AMF UE NGAP ID (M)
* RAN UE NGAP ID (M)
* Security Context (M)
* PDU Session Resource Switched List (M)
* Allowed NSSAI (M)
- Add required ASN.1 header includes for Path Switch Request Acknowledge
IEs
Notes:
- Added a case NGAP_PATH_SWITCH_REQ in task_ngap to support ITTI message
from RRC, and this will be allocated at
- RRC when the target gNB receives the RRC complete message from the UE
during Xn handover.
- OAI CN5G does not support any of the NGAP path switch procedures
(request, ack, and failure) as of today to test Xn Handover.
- We tested the procedures in an E2E setup at IISc with two gNBs in
E1+F1+7.2x split containing the Xn handover code and connected to the
same 5G core (used Open5GS & Aether-OnRamp separately), and also did
not observe any Path Switch Failure.
- The implementation of Path Switch Failure at OAI RAN will be done
along with the implementation of Path Switch procedures in OAI CN5G
once the XNAP integration in OAI RAN is complete.
Acknowledgement:
> This work has been partially carried out as part of Xn Handover
development at the Indian Institute of Science (IISc), Bengaluru.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-By: Guido Casati <guido.casati@openairinterface.org>
Ensure all resources used by test_vrtsim are unique so that there is no overlap,
which might cause an issue in CI.
Signed-off-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
Increase the usleep to 20 uS to reduce the pressure on the OS scheduler. This
reduces the number of context switches and increases performance. The value 20uS
is approximately half a symbol in mu1 and shouldn't cause too much extra delay.
Signed-off-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
- Add a case in TASK_NGAP to support ITTI message from RRC to NGAP
- Add Path Switch Request message type definitions
- Implement encoder for Path Switch Request (3GPP TS 38.413v16.2.0 §9.2.3.8)
- RAN UE NGAP ID (M)
- Source AMF UE NGAP ID (M)
- User Location Information (M)
- UE Security Capabilities (M)
- PDU Session Resource to be Switched in Downlink List (M)
- Add required ASN.1 header includes for Path Switch Request IEs
Co-authored-by: Rakesh BB <rakesh.bb@fsid-iisc.in>
Signed-off-by: Venkatareddy Akumalla <venkatareddy.akumalla@openairinterface.org>
Duranta is a Linux Foundation networking project and does not have
permission to display the trademarked OAI logo
(https://openairinterface.org/logo/), which belongs to the
OpenAirInterface Software Alliance (legal entity "OPENAIRINTERFACE").
Remove logo to avoid any legal problems.
Remove some superfluous text with HTML code in some documentation.
Signed-off-by: Robert Schmidt <robert.schmidt@openairinterface.org>
fix (nas): parse UE Registration Reject and add NAS connection release (#218)
The nrUE NAS task read the Registration Reject cause at a hardcoded
offset and called exit(1). This commits adds processing of
plain/security-protected 5GMM headers, decoding of the mandatory cause
per TS 24.501 §8.2.7, set 5GMM state.
Softmodem is stopped via termination_procedure and local AS detach
(send_nas_detach_req without wait_release -> 1) RRC IDLE 2)
NR_NAS_CONN_RELEASE_IND 3) itti_wait_tasks_unblock).
Changes:
- Add fgmm_registration_reject enc/dec
- Add handle_registration_reject()
- Replace inline FGS_REGISTRATION_REJECT case
- Fix unprotected_allowed() for plain Registration Reject
- Add nas_lib_test round-trip (Illegal_UE / 0x03)
Note: optional IEs (T3346, T3502, EAP) not decoded, §5.5.1.2.5 procedure TODO
Closes: #174
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
fix (f1ap): DRB-Information criticality and non-dynamic fiveQI handling in DU (#223)
Aligns OAI F1AP encoding with TS 38.473 for DRB-Information criticality
on UE Context Modification, and clarifies how non-dynamic fiveQI is
handled across F1AP/E1AP decode and CU RRC.
Non-dynamic fiveQI may name standardized or pre-configured profiles on
the wire (0..255). F1/E1 libs now accept the full ASN range and reject
only out-of-range values. Pre-configured and other non-standardized
non-dynamic 5QI remain unsupported at RRC via the existing
is_5qi_standardized() skip.
DU is now gracefully handling unsupported 5QIs instead of crashing.
Closes: #212
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
The nrUE NAS task mishandled FGS_REGISTRATION_REJECT: it read the 5GMM
cause at a hardcoded offset and called exit(1) from the NAS ITTI task,
which could abort the process while PHY threads were still running.
This commit adds processing of plain/security-protected 5GMM headers,
decoding of the mandatory cause per TS 24.501 §8.2.7, set 5GMM state.
Softmodem is stopped via termination_procedure and local AS detach
(send_nas_detach_req without wait_release -> 1) RRC IDLE 2)
NR_NAS_CONN_RELEASE_IND 3) itti_wait_tasks_unblock).
Ignore duplicate rejects once termination has started.
Changes:
- Add fgmm_registration_reject enc/dec
- Add handle_registration_reject()
- Replace inline FGS_REGISTRATION_REJECT case
- Fix unprotected_allowed() for plain Registration Reject
- Add nas_lib_test round-trip (Illegal_UE / 0x03)
Note: optional IEs (T3346, T3502, EAP) not decoded, stop-on-reject
replaces 21a7f99 exit(1), full §5.5.1.2.5 procedure remains TODO.
Closes#174
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Cleanup NR RU options (#210)
This PR is part of the effort to split LTE and NR code to avoid
cross-compilation as described in #110.
In nr-ru.c, up to now, we relied on if4_tools.c for some if4p5 functions
but what's in that file is strictly LTE using LTE frame parameters, so
it shouldn't work in NR. As a matter of fact, after some investigation
and feedback from @teodora-vladic about 7.2 split, none of those
functions are used in practice in NR and they can be removed. If this
works, we move one step closer to the full compilation split of LTE and
NR.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Teodora VladiÄ <teodora.vladic@openairinterface.org>
Bugfix PUCCH Format 2 (#224)
Fix RE offset computation in PUCCH format 2 generation. This fixes DL
retx with OCUDU in the CI.
Reviewed-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
Fix for issue 216 (#221)
When O_ACK <= 2, the reserved HARQ-ACK positions are selected from the
codeword using a d-factor stepping algorithm. The d-factor was computed
and applied at bit granularity, causing it to step through the flat
positions array mid-modulation-group when Qm > 1.
This scattered ACK/placeholder bits across more REs than intended,
mismatching the RE selection of the demultiplexer which operates at RE
granularity. As a result, placeholder positions were marked on REs that
the gNB treats as pure ULSCH, causing those positions to be transmitted
without the normal scrambling sequence XOR. This corrupts the ULSCH soft
bits at the gNB side, leading to PUSCH CRC failure.
Fix: compute the d-factor in RE units and step through the positions
array in strides of d_factor_re * Qm so that whole Qm-bit modulation
groups are always selected or skipped together.
Observed with O_ACK=1, MCS27 (256QAM), beta_offset_idx=11 where
Q_dash_ACK=6 (reserved) vs Q_dash_ACK_actual=3, giving d_factor=2. PUSCH
CRC was KO at third-party signal analyzers (MATLAB/WaveJudge) while the
OCUDU gNB could still decode due to soft LDPC margin.
Closes: #216
Reviewed-by: Francesco Mani <email@francescomani.it>
Reviewed-by: Sakthivel Velumani <s.velumani@northeastern.edu>
When a CU sends a DRB with a non-dynamic 5QI that is not in the
DU MAC lookup table, get_non_dynamic_priority() used to AssertFatal and
abort. Return -1 and log a warning instead, and skip flows with negative
priority when deriving the logical-channel priority so setup can continue.
A more spec-aligned fix would require F1AP UE Context Setup/Modification
Failure (not implemented) in case of a logical error in the DU:
> Where the logical error occurs in a request message of a class 1 procedure,
> and the procedure has a message to report this unsuccessful outcome,
> this message shall be sent with an appropriate cause value.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Non-dynamic fiveQI on F1AP/E1AP may name standardized or pre-configured
profiles (TS 38.473), the range is 0..255. Decode now accepts
MIN_FIVEQI..MAX_FIVEQI (0..255) and fails only when fiveQI is outside
that range. Pre-configured and other non-standardized non-dynamic values
remain unsupported: RRC still skips them via is_5qi_standardized().
Changes:
- F1AP/E1AP: range-check 0..255 only
- improve documentation
Refs:
- 3GPP TS 38.473 §9.3.1.49 (non-dynamic standardized or pre-configured 5QI)
- 3GPP TS 23.501 §5.7.2.1
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
UE Context Modification DRB setup-mod encoding sent id_DRB_Information
with reject criticality. TS 38.473 defines that IE as ignore
(QoSInformation-ExtIEs, id-DRB-Information).
Changes:
- Set QoSInformation extension id_DRB_Information criticality to ignore
in encode_drbs_to_setupmod()
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
When O_ACK <= 2, the reserved HARQ-ACK positions are selected from
the codeword using a d-factor stepping algorithm. The d-factor was
computed and applied at bit granularity, causing it to step through
the flat positions array mid-modulation-group when Qm > 1.
This scattered ACK/placeholder bits across more REs than intended,
mismatching the RE selection of the demultiplexer which operates at
RE granularity. As a result, placeholder positions were marked on
REs that the gNB treats as pure ULSCH, causing those positions to be
transmitted without the normal scrambling sequence XOR. This corrupts
the ULSCH soft bits at the gNB side, leading to PUSCH CRC failure.
Fix: compute the d-factor in RE units and step through the positions
array in strides of d_factor_re * Qm so that whole Qm-bit modulation
groups are always selected or skipped together.
Observed with O_ACK=1, MCS27 (256QAM), beta_offset_idx=11 where
Q_dash_ACK=6 (reserved) vs Q_dash_ACK_actual=3, giving d_factor=2.
PUSCH CRC was KO at third-party signal analyzers (MATLAB/WaveJudge)
while the OCUDU gNB could still decode due to soft LDPC margin.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Alex Jiao <alex.jiao@keysight.com>
Instead of guessing what is the absolute timestamp of each symbol returned
from fronthaul, add absolute hyper frame from GPS Epoch to the O-RU. The
O-RU can calculate the absolute sample index from hyper frame reliably
regardless of the frame/slot/symbol ordering.
Add config file for 1x1 O-DU that matches the edited O-RU config.
Signed-off-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
Added oru_south_read_thread that reads samples from vrtsim.
No UL FH processing is done as of this commit.
Signed-off-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
This function can be used to convert a timespec struct to a
openair0_timestamp. It can be used to synchronize the realtime
clock to the device sample number.
Signed-off-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
Start O-RU fronthaul library inside the O-RU application and start
reading DL IQ data.
Added configuration elements to the ORUs section to support configuring
the library.
Signed-off-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
Added initialization of frame params according to configuration added
in the new ORUs section. Only one ORU is supported right now.
Added example config that allows starting the ORU and verifying manually
that the config is read.
Signed-off-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
Remove an assert on successful dup() of a socket. At least when running
in phy-test mode without noS1, the socket does not exist, and the call
to dup() fails. In that case, we should carry on instead of simply
failing, similarly how the process does not abort when TUN setup fails.
Fixes: 8d2895463b ("Paging UE (SDAP): reattach TUN after idle reset")
Signed-off-by: Robert Schmidt <robert.schmidt@openairinterface.org>
CI: Add UE timing phytest (#188)
Add a new XML file to also measure UE timings, similarly how we do with
gNB.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
fh_if4p5_south_in and fh_if4p5_south_out are called in NR for 7.2 split but never actually executed
they are overwritten at runtime in ru_thread
Signed-off-by: Francesco Mani <email@francescomani.it>
Check timing thresholds on both UE and gNB side. If this commit works as
expected, it can replace xml_files/gnb_phytest_usrp_run.xml.
Signed-off-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>
Allow XML test cases to specify one or more files with timing stats that
define which container log paths to collect and analyze. AnalyzeRTStatsObject
loops over the provided list, falling back to the default gNB files
(nrL1_stats.log, nrMAC_stats.log) when none are specified.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>
Improvements in UCI on PUSCH implementation at UE (#139)
This MR improves the implementation of UCI on PUSCH at UE side and fixes
some issues found while testing and fixing the revised version.
Tested in ULSIM with MATLAB vectors provided by @sakthivelvelumani in
the following scenarios (bits)
- 2 ACK no CSI
- 7 CSI part1 no ACK no CSI part2
- 1 ACK 7 CSI part1 7 CSI part2
- 3 ACK 4 CSI part1 4 CSI part2
using the command line
./nr_ulsim -m 27 -u 1 -R 51 -r 51 -s 30 -o(path to the file containing the vector)
Closes: #181
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Sakthivel Velumani <s.velumani@northeastern.edu>
Complete NR L2/L3 Paging path from F1AP to NAS (gNB and UE) (#151)
This MR wires a 5GâNR paging flow across the stack, from F1AP Paging on
the DU down to PCCH scheduling in MAC/RLC, RRC/ASN encode/decode, and
UEâside NAS Service Request triggering, including the NR UE changes in
L1/L2.
It centralises paging PF/PO computation and PCCH scheduling in MAC,
using shared SSB/Type0âPDCCH and common PDSCH helpers that are also
reused by SIB1. On the UE, it enables decoding of NR PCCH messages,
matching ngâ5GâSâTMSI/fullIâRNTI, and conditionally initiating a
networkâtriggered Service Request when 5GMM state allows it. The change
set includes focused refactors and ASN.1 tests to validate the new
paging encode/decode path.
Changes:
- MAC gNB common helpers: Move SSB/Type0âPDCCH utilities from the
BCH scheduler into shared MAC primitives and introduce a reusableÂ
Type0âoccasion helper and common PDSCH RB/MCS/TBS sizing
- MAC paging PF/PO responsibility: Add a dedicated PCCH scheduler module
that implements TS 38.304 §7 PF/PO computation (defaultPagingCycle,
nAndPagingFrameOffset, Ns, SFNâbased PF formula and PO slot mapping)
and owns the âis this (frame,slot) a paging occasion for UE_ID?â
decision.
- F1AP -> MAC -> RLC PCCH path (gNB/DU): Have the DU decode F1AP Paging
with CN UE identity, build an NR RRC Paging message (PCCH) in MAC, and
hand it to RLC as a dedicated PCCH SDU together with UE_ID (5GâSâTMSI
mod 1024), using perâmodule PCCH storage. RAN UE paging identity
is explicitly rejected.
- Direct CU to DU paging path: Implement direct F1 Paging handling
in the NR RRC DL direct interface for RLC PCCH storage for laterÂ
scheduling.
- PCCH scheduling and NFAPIÂ integration (gNBÂ MAC): IntegrateÂ
schedule_nr_pcch() into the DL scheduler so that when a stored PCCH
SDU exists and the current (frame,slot) is a paging occasion, MACÂ
resolves the paging search space and CORESET, selects a beam (from SSB),
allocates CCEs and PDSCH resources, builds NFAPI DL_TTI PDUsÂ
(PDCCH + PDSCH with PâRNTI, DCI 1_0), and populates the matching
TX_DATA PDU, then clears the cached PCCH.
- DCI handling for PâRNTI paging: Adjust DCI payload preparation
to treat PâRNTI specially, returning after setting DMRS and antennaÂ
ports and skipping HARQ and UE scheduling state that do not exist for
paging, so paging DCIs no longer touch UE HARQ data structures.
- PHY UE RX Chain: DCI handling for PâRNTI on UE, monitor DCI on Paging
Occasions, process DCI 1_0 with CRC scrambled by PâRNTI on the pagingÂ
search space, trigger PDSCH decoding for PCCH based on that DCI, deliver
decoded PCCH to upper layers from the PHY/MAC side
- RRC/ASN paging encode API: Replace the legacy bufferâbased do_NR_PagingÂ
with a nr_paging_params_tâbased API returning a byte_array_t,
supporting both ngâ5GâSâTMSI and fullIâRNTI identities, and optional IEs
(e.g. accessType nonâ3GPP and pagingCause v17), and encoding viaÂ
uper_encode_to_new_buffer, with ownership and failure semantics clearlyÂ
defined for callers.
- UEâside PCCH reception and matching: Add UE MAC to RRC logic
to deliver PCCH SDUs to RRC, decode NR PCCH via a new nr_pcch_decode()Â
helper into an array of nr_paging_params_t, iterate PagingRecordList onÂ
the UE, compare MâTMSI/fullIâRNTI against local identity, and log whetherÂ
a paging match was found.
- NAS integration for networkâtriggered Service Request: On a UE paging
match, send a NAS_PAGING_IND from RRC to NAS and, when the UE has a
GUTI, is 5GMMâREGISTERED and in 5GMMâIDLE, generate and send a Service
Request uplink NAS message
- Tests and validation helpers: Extend nr_asn1 paging tests
to encode Paging via do_NR_Paging, decode it via nr_pcch_decode,
and verify roundâtrips for multiple ngâ5GâSâTMSI values, accessType,
and fullIâRNTI bit patterns, using a shared encode/decode helper thatÂ
exercises the same decoder path used by the UE.
Notes:
Paging handling currently supports CN UE paging
identity (5GâSâTMSI) only. RAN UE paging identity is logged and ignored.
A paging match triggers a Service Request only when the UE has a GUTI,
is 5GMMâREGISTERED, and in 5GMMâIDLE. T3346 and suspendâindication
handling are documented as future work and not implemented here.
Testing:
Tested with Open5gs. How to trigger Paging in Open5GS lab setup:
- Use gNB telnet to request NGAP UE Context Release: `rrc ctx_rel_req
<RRC_UE_ID>`
- Wait until AMF reports CM-IDLE (for example gNB-UEs is now 0).
- Generate downlink data from the Linux host to the UE IP: `ping
<UE_IP>`
- Host-originated downlink data will trigger paging.
Closes#74
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Francesco Mani <email@francescomani.it>
