Merge remote-tracking branch 'origin/rrc-multi-cell' into integration_2026_w07 (!3783)

RRC: Multi-cell handling architecture

This MR implements a foundational multi-cell handling architecture for
RRC by separating DU management from cell management and establishing a
hierarchical cell organization within each DU container. The changes
enable proper multi-cell support where each DU can serve multiple cells,
addressing the previous limitation where DU and cell management were
tightly coupled with the assumption of one cell per DU.

Key Changes:

- Data Structure Separation: Separated for DU containers (DU-specific
  info) from cell containers (cell-specific data)
- Global DU and Cell Trees: Cells are now stored in global RB trees in
  RRC, similarly to DUs
- Du-specific cell seq_arr: within each DU container (du->cells) is
  stored a seq_arr of cells belonging to the DU
- UE Cell Association Framework: Introduced serving_cells array to track
  PCell and SCells for each UE with servCellIndex indexing
- Cell Management Library: Extracted cell management functions into
  rrc_cell_management.c/h for better testability and maintainability

Other relevant changes:

- F1AP Refactoring: cell list definitions, heap allocation to prevent
  stack overflow
- 5G-S-TMSI Helpers: Common helper functions for 3GPP TS 23.003
  compliant construction
- Integration Tests: Comprehensive test suite for DU lookup, cell
  lookup, and UE cell association
- Cell Duplication Checks: Validation in F1 DU configuration update to
  prevent duplicate cells
- Documentation: Updated RRC developer documentation with multi-cell
  architecture details

Validated with RFsim in re-establishment and handover scenarios.

common/utils/nr/nr_common.c

@@ -1487,3 +1487,35 @@ float get_beta_dmrs(int num_cdm_groups_no_data, bool is_type2)
   }
   return beta_dmrs_pusch;
 }
+
+/** @brief Construct full 5G-S-TMSI from 5G-S-TMSI components
+ * @param amf_set_id AMF Set ID (10 bits)
+ * @param amf_pointer AMF Pointer (6 bits)
+ * @param m_tmsi 5G-TMSI (32 bits)
+ * @return Full 5G-S-TMSI (48 bits)
+ * @note The 5G-S-TMSI is constructed as a 48-bit value:
+ *       - Bits 38-47: AMF Set ID (10 bits)
+ *       - Bits 32-37: AMF Pointer (6 bits)
+ *       - Bits 0-31:  5G-TMSI (32 bits)
+ * @ref 3GPP TS 23.003 */
+uint64_t nr_construct_5g_s_tmsi(uint16_t amf_set_id, uint8_t amf_pointer, uint32_t m_tmsi)
+{
+  // Construct full 5G-S-TMSI: <AMF Set ID (10 bits)><AMF Pointer (6 bits)><5G-TMSI (32 bits)>
+  return ((uint64_t)amf_set_id << 38) | ((uint64_t)amf_pointer << 32) | m_tmsi;
+}
+
+/** @brief Construct 5G-S-TMSI-Part1 from 5G-S-TMSI components
+ * @param amf_set_id AMF Set ID (10 bits)
+ * @param amf_pointer AMF Pointer (6 bits)
+ * @param m_tmsi 5G-TMSI (32 bits)
+ * @return 5G-S-TMSI-Part1 (rightmost 39 bits of the full 5G-S-TMSI)
+ * @note 5G-S-TMSI-Part1 is the rightmost 39 bits of the full 5G-S-TMSI:
+ *       - Bits 32-37: AMF Pointer (6 bits)
+ *       - Bits 0-31:  5G-TMSI (32 bits)
+ * @ref 3GPP TS 23.003 */
+uint64_t nr_construct_5g_s_tmsi_part1(uint16_t amf_set_id, uint8_t amf_pointer, uint32_t m_tmsi)
+{
+  // Construct full 5G-S-TMSI and extract Part1: rightmost 39 bits
+  uint64_t full_s_tmsi = nr_construct_5g_s_tmsi(amf_set_id, amf_pointer, m_tmsi);
+  return full_s_tmsi & ((1ULL << 39) - 1);
+}

common/utils/nr/nr_common.h

@@ -357,6 +357,12 @@ frequency_range_t get_freq_range_from_band(uint16_t band);
  */
 float get_beta_dmrs(int num_cdm_groups_no_data, bool is_type2);
 
+/** @brief Construct full 5G-S-TMSI from 5G-S-TMSI components */
+uint64_t nr_construct_5g_s_tmsi(uint16_t amf_set_id, uint8_t amf_pointer, uint32_t m_tmsi);
+
+/** @brief Construct 5G-S-TMSI-Part1 from 5G-S-TMSI components */
+uint64_t nr_construct_5g_s_tmsi_part1(uint16_t amf_set_id, uint8_t amf_pointer, uint32_t m_tmsi);
+
 #define CEILIDIV(a,b) ((a+b-1)/b)
 #define ROUNDIDIV(a,b) (((a<<1)+b)/(b<<1))
 #define BOUNDED_EVAL(a, b, c) (min(c, max(a, b)))

common/utils/telnetsrv/telnetsrv_ci.c

@@ -168,7 +168,7 @@ int fetch_du_by_ue_id(char *buf, int debug, telnet_printfunc_t prnt)
   nr_rrc_du_container_t *du = get_du_for_ue(RC.nrrrc[0], ue_id);
 
   if (du) {
-    prnt("gNB_DU_id %d is connected to ue_id %ld\n", du->setup_req->gNB_DU_id, ue_id);
+    prnt("gNB_DU_id %ld is connected to ue_id %ld\n", du->gNB_DU_id, ue_id);
     return 0;
   } else {
     ERROR_MSG_RET("No DU connected\n");