RRC fixes (#225)
- Hardens NR RRC re-establishment handling on the gNB and UE:
re-establishment requests with invalid PCI/C-RNTI or incomplete UE
context are rejected or fall back to RRCSetup per TS 38.33.
- Fixes an invalid post-release connected state after PDU session
teardown
- Stops gNB process aborts when a UE sends spare RRC establishment-cause
values.
- Fix RRCSetup fallback: the UE MAC layer is reset before bearer
teardown on RRCSetup fallback to avoid scheduler use of released RLC
entities.
Closes: #127Closes: #128Closes: #148
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Francesco Mani <email@francescomani.it>
Integration: 2026.w27
- #227 Cleanup: NGAP reconnection debug log
- #233 fix: proper SA/NSA mode detection
- #239 Fix function init_context_sss_nr()
- #256 ci: Move test pcaps to github
- #244 fix(zmq): Fix clang compiler warnings in zmq radio
- #220 fix(NR_UE): gate half-frame PBCH mirror on caller-provided ssb_period
- #257 [FHI72] Update the xran K release tag due to the PR https://github.com/openairinterface/o-du-phy/pull/3
- #192 DLSIM test for type0 PDSCH frequency allocation
- #238 minorfix(imscope): moving alignas from struct type to atomic variable
- #255 ci: Speedup unit test dockerfile
- #217 NAS: refactor Identity Request handler and enforce spec-compliant security checks
- #243 Clean up openair0_device, remove eth_params usage in L2/L3
- #204 Implementation of the E3 Agent for dApps and E3AP (no service models)
- #258 NR UE: add assert for reserved bits per symbol not multiple of Qm
- #253 CI: Collect amariue logs, update eNB configs
- #203 CI: Add label check and signature verification in GitHub Actions
Closes: #219Closes: #82
CI: Add label check and signature verification in GitHub Actions (#203)
- Update contributing guidelines for signing of commits
- Check for unsigned commits in the github actions workflow
- Skip CI when no mandatory CI label present on the PR
- Always remove retrigger-ci label when present - Like post-always or
post-cleanup
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-by: Sagar Arora <sagar.arora@openairinterface.org>
Reviewed-by: Shubhika Garg <shubhika.garg@openairinterface.org>
- The require-maintainer-approval job was being skipped on push event
when upstream jobs (verify-signed-commits and check-labels) were skipped,
even though detect-changes job successfully marked protected files as changed.
- GitHub Actions may skip dependent jobs due to upstream skipped states before
evaluating custom conditions.
- Adding always() ensures the job condition is evaluated regardless of
the status of upstream jobs, while still enforcing the rule that the job
only runs when protected_files_changed == true.
Signed-off-by: Shubhika Garg <shubhika.garg@openairinterface.org>
The executor machine for this test is currently unavailable. The test
will be re-enabled once the replacement machine is configured.
Signed-off-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>
NR UE: add assert for reserved bits per symbol not multiple of Qm (#258)
map_overlapped_ack() divides num_reserved_bits_on_sym by Qm to get the
number of reserved REs. Add assertion to catch cases where the reserved
bit count is not a multiple of Qm, which would indicate a bug in the
upstream UCI-on-PUSCH mapping.
This is a follow-up of comment after PR #221
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Implementation of the E3 Agent for dApps and E3AP (no service models) (#204)
These changes introduce an E3 Agent for dApps in the OAI codebase. dApps
are real-time microservices designed to operate within the O-RAN
ecosystem, enabling sub-10 ms Artificial Intelligence (AI) routines in
the Radio Access Network (RAN).
The E3 Agent enables spectrum sensing, frequency-domain signal logging,
and dynamic PRB (Physical Resource Block) policies through IPC/ZMQ
communication with dApps or xApps.
The dApps are designed for co-location with the CU/DU, where it can
interact directly with user-plane data to enable different network
management scenarios such as optimizing network slicing, scheduling, and
resource management. A python library for the creation of the dApps is
available here [1].
Additional information about dApps:
- Paper on the dApp architecture [2]
- dApp framework presentation [3]
- Tutorial on dApp deployment on OAI [4]
As agreed in the original MR [5], this PR includes only the agent lifecycle,
configuration parsing, build plumbing, and the nr-softmodem init/destroy
hook.
It registers zero service models, so it builds and runs as an idle
agent. Concrete service models (e.g. spectrum sensing) and the PHY/MAC
hooks that drive them follow in later PRs.
Opt-in and dependencies
- Gated behind the E3_AGENT CMake option (OFF by default) / the
--build-e3 build flag. The default build is unaffected — e3ap is only
compiled and linked into nr-softmodem when E3_AGENT=ON.
- When enabled, requires the external libe3 library [6] (vendor-neutral
E3AP C++ lib), discovered via pkg_check_modules(CLIBE3 REQUIRED
libe3). It is not vendored.
Install libe3 (Debian/Ubuntu):
git clone https://github.com/wineslab/libe3 && cd libe3
./build_libe3 -I # installs deps: build-essential cmake pkg-config libzmq3-dev asn1c nlohmann-json3-dev libsctp-dev ...
./build_libe3 --install # release build + installation
Build & test
Tested in RFsim: the gNB initializes the E3 agent, opens its setup
socket (/tmp/dapps/setup), registers zero service models, and runs
without crashing. Configuration
The agent reads an optional E3Configuration section from the gNB config
file (parsed only when E3_AGENT=ON). If absent, it falls back to
built-in defaults (posix/ipc).
E3Configuration : {
link = "zmq"; # posix | zmq
transport = "ipc"; # tcp | sctp | ipc
};
The same parameters can be overridden on the command line (no
config-file edit required):
sudo ./nr-softmodem -O <gnb.conf> ... --E3Configuration.link zmq --E3Configuration.transport ipc
Validated link/transport combinations: (zmq,ipc) (zmq,tcp) (posix,tcp)
(posix,sctp) (posix,ipc).
Notes
- I have added a new log component E3AP specific for the ops performed
by the E3 Agent.
- This PR ships no gNB config file; the E3Configuration block / CLI
override above is the documented way to enable the agent. Example
configs follow in the next PRs.
[1] https://pypi.org/project/dapps/
[2] https://arxiv.org/pdf/2501.16502
[3] https://openrangym.com/o-ran-frameworks/dapps
[4] https://openrangym.com/tutorials/dapps-oai
[5] https://gitlab.eurecom.fr/oai/openairinterface5g/-/merge_requests/3361
[6] https://github.com/wineslab/libe3
Reviewed-by: Teodora Vladić <teodora.vladic@openairinterface.org>
Reviewed-by: Sagar Arora <sagar.arora@openairinterface.org>
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Add the E3 agent lifecycle on top of libe3: configuration mapping,
agent creation/init/start, dApp report and status-change handlers,
and xApp control and subscription-query helpers. Wire e3_init() and
e3_destroy() into nr-softmodem under the E3_AGENT guard.
The agent registers no concrete service models: service models (such
as spectrum sensing) live in their own modules and register
themselves, keeping the framework decoupled from any specific use
case.
Signed-off-by: Andrea Lacava <thecave003@gmail.com>
Add the E3AP CMake target, which links the external libe3 library
discovered via pkg-config, and the E3Configuration parser that reads
the link and transport selection from the gNB configuration file and
validates the supported link/transport combinations.
libe3 is kept external and is only required when E3_AGENT is enabled.
Signed-off-by: Andrea Lacava <thecave003@gmail.com>
Introduce the E3_AGENT CMake option (default OFF) and the matching
--build-e3 flag in build_oai so the E3 agent for O-RAN dApps can be
compiled opt-in. Gate the E3AP subdirectory and the nr-softmodem
linkage behind the option, and register an E3AP log component
together with its legacy T-tracer message IDs.
The E3 interface (nGRG) lets the gNB exchange real-time reports and
controls with external dApps. Keeping it behind a build flag leaves
the default CI build unchanged and avoids pulling in the external
libe3 dependency unless the agent is explicitly requested.
Signed-off-by: Andrea Lacava <thecave003@gmail.com>
Clean up openair0_device, remove eth_params usage in L2/L3 (#243)
This PR has three goals
- Remove the usage of eth_params in L2/L3 code, and replace with
tailored data structures for IP connectivity where necessary
- Remove many of the includes of common_lib.h where possible
- Slightly clean up openair0_device and in particular move fields to
eth_state_t where appropriate
Reviewed-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
Reviewed-by: Teodora Vladić <teodora.vladic@openairinterface.org>
NAS: refactor Identity Request handler and enforce spec-compliant security checks (#217)
Align UE Identity Request handling with TS 24.501 by checking the NAS
security header and rejecting unprotected non-SUCI requests.
Also, refactor Identity Response identity selection based on the
requested identity types, add to a helper and handle unavailable
identities in the UE context.
Closes: #82
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Reviewed-By: Rakesh Mundlamuri <rakesh.mundlamuri@openairinterface.org
ci: Speedup unit test dockerfile (#255)
Use docker cache, reduce the number of installed apt packages and reduce
compilation scope.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
A UE RRCSetupRequest with establishmentCause in the spare range (10–15)
could abort nr-softmodem: RRC asserted on cause >= NGAP_RRC_CAUSE_LAST,
and cause 11 failed NGAP ASN.1 encode when passed through by index.
NR RRC (TS 38.331) and NGAP RRCEstablishmentCause (TS 38.413 §9.3.1.111)
do not share one integer namespace: spare values must not be sent
as NGAP causes.
Remove the RRC AssertFatal on causes. When building
InitialUEMessage, map RRC indices 0–9 to the matching NGAP cause
and map anything else to notAvailable, as specified for unmapped UE
causes.
Changes:
- Drop establishment-cause range AssertFatal in rrc_gNB_send_NGAP_NAS_FIRST_REQ
- Add rrc2ngap_establishment_cause() and use it for InitialUEMessage RRCEstablishmentCause
- Remove redundant DevCheck on establishment_cause in ngap_gNB_handle_nas_first_req
- Adopt mapping logic in rrc_gNB_send_NGAP_NAS_FIRST_REQ
Closes: #127
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
When the gNB answers RRCReestablishmentRequest with RRCSetup (TS 38.331
clause 5.3.3.4 fallback), the UE must release all bearers except SRB0 before
applying the new masterCellGroup. CONFIG_RESET was queued after RLC release,
so the MAC slot thread kept polling LCID 1 from a stale lc_ordered_list while
the RLC entity was already NULL.
Queue NR_MAC_RRC_CONFIG_RESET (RRC_SETUP_REESTAB_RESUME) first, then release
PDCP, RLC, and SDAP. On the MAC thread, clear lc_ordered_list except SRB0
before release_mac_configuration() so the UL scheduler stops looping released
logical channels until CONFIG_CG re-adds SRB1.
Changes:
- rrc_UE.c: move CONFIG_RESET to the start of nr_rrc_rrcsetup_fallback()
- config_ue.c: drop non-SRB0 lc_ordered_list entries on RRC_SETUP_REESTAB_RESUME
Closes: #128
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
TS 38.331 §5.3.1.1 forbids RRC_CONNECTED with SRB2 and zero DRBs.
Releasing all DRBs must release the RRC connection.
After PDU session release (3GPP TS 23.502 §4.3.4.2), OAI left
SRB2 up and COTS UEs could re-establish into an invalid configuration.
On NGAP PDU Session Release Response, if no DRBs remain and SRB2 is
active, send NGAP UE Context Release Request. AMF Command drives
RRCRelease on the existing CU-CP path.
Closes: #148
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Avoid E1 bearer modification when the UE has no DRBs left (e.g. after PDU
session release). (TS 38.331 clause 5.3.5.6.5 DRB with reestablishPDCP)
Changes:
- cuup_notify_reestablishment(): return early if drbs is empty
Fixes: #148
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Replace the magic number 0x7fffffffff used for masking 39-bit random
values with a named constant NR_RRC_RANDOM_VALUE_39_BIT_MASK defined
in nr_rrc_defs.h.
Refs:
- TS 38.331 5.3.3.3: Random UE identity (39-bit values)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Replace hardcoded C-RNTI range values (0x1, 0xffef) with named constants
NR_C_RNTI_MIN and NR_C_RNTI_MAX. Correct maximum value to 0xfff2 per TS 38.321
Table 7.1-1. Change invalid C-RNTI handling to return early instead of
fallback to RRCSetup for spec compliance.
Fallback to RRCSetup only occurs when UE context cannot be retrieved,
not for validation errors, which for out-of-range values could
come from malicious UEs.
Major changes:
- Add NR_C_RNTI_MIN (0x0001) and NR_C_RNTI_MAX (0xfff2) constants to
common/platform_constants.h
- Replace magic numbers in C-RNTI validation with named constants
- Change error path from fallback_rrc_setup to return for invalid C-RNTI
- Early validation before further processing
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Add defensive parameter checks at the start of
rrc_handle_RRCReestablishmentRequest to prevent NULL pointer
dereferences and invalid assoc_id handling.
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Add validation of physCellId against valid range (0-1007) per TS 38.331
specification. Invalid PCI values are now rejected early in the
reestablishment procedure.
This prevents processing of invalid reestablishment requests with
out-of-range PCI values, improving robustness and spec compliance.
Major changes:
- Add NR_PHYS_CELL_ID_MAX to common/platform_constants.h
- Add PCI range check in rrc_handle_RRCReestablishmentRequest() before
cell lookup, returning early on invalid values
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Add validation checks per TS 38.331 5.3.7.1 to ensure SRB2 and at
least one DRB are active before processing RRC reestablishment
requests. Use more specific NGAP cause code for procedure failures.
Reestablishment requests without SRB2 or DRB setup now properly
fall back to RRC setup with appropriate NGAP cause indication
Major changes:
- Add SRB2 active check before processing reestablishment
- Add DRB active check (at least one DRB required)
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
minorfix(imscope): moving alignas from struct type to atomic variable (#238)
I was receiving the note below when I built with "imscope_record", so
this is the simplest PR to avoid the psABI note while signing the new
individual CLA.
[194/11156] Building CXX object openair1/PHY/TOOLS/imscope/CMakeFiles/imscope_record.dir/imscope_record.cpp.o
In file included from /home/turker/Documents/OpenAirInterface/26w25/openair1/PHY/defs_nr_UE.h:12,
from /home/turker/Documents/OpenAirInterface/26w25/openair1/PHY/TOOLS/imscope/imscope_internal.h:12,
from /home/turker/Documents/OpenAirInterface/26w25/openair1/PHY/TOOLS/imscope/imscope_record.cpp:5:
/usr/include/c++/13/atomic: In member function ‘_Tp std::atomic<_Tp>::exchange(_Tp, std::memory_order) [with _Tp = ImScopeDumpInstruction]’:
/usr/include/c++/13/atomic:311:7: note: the ABI for passing parameters with 64-byte alignment has changed in GCC 4.6
311 | exchange(_Tp __i, memory_order __m = memory_order_seq_cst) noexcept
| ^~~~~~~~
Reviewed-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
DLSIM test for type0 PDSCH frequency allocation (#192)
Adding the test requires some changes in gNB L2 structures but it
doesn't implement the full support of type0 allocation in L2
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Add an optional Identity Request test to the NAS/NGAP simulator.
With --identity-guti, the Initial UE Message carries a random 5G-GUTI
plus matching NGAP 5G-S-TMSI and GUAMI so the AMF requests SUCI per TS 23.502
registration step 6. The simulator then continues the usual attach, PDU
session, and deregistration flow.
Changes:
- nr-ue-nas-simulator: seed_unknown_guti(), identity_request BOOLPARAM,
NGAP ue_identity fill in send_initial_ue_message()
- Update README
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
Use docker cache, reduce the number of installed apt packages, add docker ignore
entry for build directory
Signed-off-by: Bartosz Podrygajlo <bartosz.podrygajlo@openairinterface.org>
fix(NR_UE): gate half-frame PBCH mirror on caller-provided ssb_period (#220)
is_ssb_in_symbol() read cfg->ssb_table.ssb_period directly, but before
the FAPI PHY config request arrives (received_config_request == false)
that field is still 0, which it interprets as a 5ms period and enables
the half-frame PBCH mirror. get_ssb_index_in_symbol() already assumes
the 20ms default period for its frame-periodicity test, so the two
disagree and the UE attempts a spurious PBCH decode in the second
half-frame (slot 5 for mu=0) before being configured.
Closes: #219
Reviewed-by: Francesco Mani <email@francescomani.it>
ci: Move test pcaps to github (#256)
Move fronthaul capture artifact to my github fork to improve CI
stability.
Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org>
fhstate is only used in the ETHERNET library, so move it to a smaller
scope. In AW2S it is write-only, so we can remove it.
Signed-off-by: Robert Schmidt <robert.schmidt@openairinterface.org>
Fix function init_context_sss_nr() (#239)
Reduce of the size of the d_sss matrix. This PR resolves a regression
found in the PR #152
Reviewed-by: Laurent THOMAS <laurent.thomas@open-cells.com>
Align UE Identity Request handling with TS 24.501 by checking the NAS
security header and rejecting unprotected non-SUCI requests.
Also, refactor Identity Response identity selection based on the
requested identity types, add to a helper and handle unavailable
identities in the UE context.
Closes#82
Signed-off-by: Guido Casati <guido.casati@openairinterface.org>
map_overlapped_ack() divides num_reserved_bits_on_sym by Qm to get the
number of reserved REs. Add assertion to catch cases where the reserved
bit count is not a multiple of Qm, which would indicate a bug in the
upstream UCI-on-PUSCH mapping.
Signed-off-by: Alex Jiao <alex.jiao@keysight.com>
