WIP: GSCON: Complete GSCON implementation (bsc_subscr_conn_fsm.c)

- Remove old osmo_bsc_mgcp.c code
- Use the fsm based MGW client API to handle MGCP
- Integrate some error handling
- Ensure that signalling, data and voice channels are distinguished
- Make internal handover work again

Closes: OS#2823
Closes: OS#2768
Closes: OS#2898
Change-Id: I42da6ce3bef95d7a1743c39c5640db5739333a61

17 files changed, 881 insertions, 1470 deletions

diff --git a/include/osmocom/bsc/Makefile.am b/include/osmocom/bsc/Makefile.am
index da05f1c51..b25dfd833 100644
--- a/include/osmocom/bsc/Makefile.am
+++ b/include/osmocom/bsc/Makefile.am
@@ -37,7 +37,6 @@ noinst_HEADERS = \
 	openbscdefines.h \
 	osmo_bsc.h \
 	osmo_bsc_grace.h \
-	osmo_bsc_mgcp.h \
 	osmo_bsc_rf.h \
 	osmo_bsc_sigtran.h \
 	bsc_msc_data.h \
diff --git a/include/osmocom/bsc/bsc_subscr_conn_fsm.h b/include/osmocom/bsc/bsc_subscr_conn_fsm.h
index 58b7d50a5..234161fa0 100644
--- a/include/osmocom/bsc/bsc_subscr_conn_fsm.h
+++ b/include/osmocom/bsc/bsc_subscr_conn_fsm.h
@@ -23,10 +23,13 @@ enum gscon_fsm_event {
 	GSCON_EV_RR_ASS_FAIL,
 	/* RR MODE MODIFY ACK received */
 	GSCON_EV_RR_MODE_MODIFY_ACK,
+
 	/* RR HO ACC (access burst on ext HO) */
-	GSCON_EV_RR_HO_ACC,
+	GSCON_EV_RR_HO_ACC,	/* NOT USED YET! */
 	/* RR HANDOVER COMPLETE received */
-	GSCON_EV_RR_HO_COMPL,
+	GSCON_EV_RR_HO_COMPL,	/* NOT USED YET! */
+	GSCON_EV_RR_HO_FAIL,	/* NOT USED YET! */
+
 	/* RSL RLL Release Indication */
 	GSCON_EV_RLL_REL_IND,
 	/* RSL CONNection FAILure Indication */
@@ -39,6 +42,29 @@ enum gscon_fsm_event {
 	GSCON_EV_MO_DTAP,
 	/* Mobile-terminated DTAP (from MSC) */
 	GSCON_EV_MT_DTAP,
+
+	/* Transmit custom SCCP message */
+	GSCON_EV_TX_SCCP,
+
+	/* MGW is indicating failure (BTS) */
+	GSCON_EV_MGW_FAIL_BTS,
+	/* MGW is indicating failure (MSC) */
+	GSCON_EV_MGW_FAIL_MSC,
+	/* CRCX response received (BTS) */
+	GSCON_EV_MGW_CRCX_RESP_BTS,
+	/* MDCX response received (BTS) */
+	GSCON_EV_MGW_MDCX_RESP_BTS,
+	/* CRCX response received (MSC) */
+	GSCON_EV_MGW_CRCX_RESP_MSC,
+
+	/* Internal handover request (intra-BSC handover) */
+	GSCON_EV_HO_START,
+	/* Handover timed out (T3103 in handover_logic.c) */
+	GSCON_EV_HO_TIMEOUT,
+	/* Handover failed (handover_logic.c) */
+	GSCON_EV_HO_FAIL,
+	/* Handover completed successfully (handover_logic.c) */
+	GSCON_EV_HO_COMPL,
 };
 
 struct gsm_subscriber_connection;
diff --git a/include/osmocom/bsc/gsm_data.h b/include/osmocom/bsc/gsm_data.h
index 0aba3746a..314eaa6d3 100644
--- a/include/osmocom/bsc/gsm_data.h
+++ b/include/osmocom/bsc/gsm_data.h
@@ -94,7 +94,7 @@ struct gsm_subscriber_connection {
 	/* global linked list of subscriber_connections */
 	struct llist_head entry;
 
-	/* Finite State Machine */
+	/* FSM instance to control the subscriber connection state (RTP, A) */
 	struct osmo_fsm_inst *fi;
 
 	/* libbsc subscriber information (if available) */
@@ -168,11 +168,30 @@ struct gsm_subscriber_connection {
 		 * assignment complete message) */
 		struct sockaddr_storage aoip_rtp_addr_local;
 
-		/* storage to keep states of the MGCP connection handler, the
-		* handler is created when an assignment request is received
-		* and is terminated when the assignment complete message is
-		* sent */
-		struct mgcp_ctx *mgcp_ctx;
+		/* FSM instance to control the BTS sided RTP connection */
+		struct osmo_fsm_inst *fi_bts;
+
+		/* FSM instance to control the MSC sided RTP connection */
+		struct osmo_fsm_inst *fi_msc;
+
+		/* Endpoint identifier of the MGCP endpoint the connection uses */
+		char *mgw_endpoint;
+
+		/* Channel rate flag, FR=1, HR=0, Invalid=-1 */
+		int full_rate;
+
+		/* Channel mode flage (signaling or voice channel) */
+		enum gsm48_chan_mode chan_mode;
+
+		/* FIXME: These members are for caching the handover
+		 * information when the FSM gets the handover start
+		 * signal. This is probably misplaced and should
+		 * be its own struct. (see also handover_logic.c) */
+		enum hodec_id from_hodec_id;
+		struct gsm_lchan *ho_old_lchan;
+		struct gsm_bts *ho_new_bts;
+		enum gsm_chan_t ho_new_lchan_type;
+		
 	} user_plane;
 };
 
diff --git a/include/osmocom/bsc/handover.h b/include/osmocom/bsc/handover.h
index 0fbfaf671..bb324343b 100644
--- a/include/osmocom/bsc/handover.h
+++ b/include/osmocom/bsc/handover.h
@@ -53,6 +53,8 @@ struct bsc_handover {
 
 int bsc_handover_start(enum hodec_id from_hodec_id, struct gsm_lchan *old_lchan, struct gsm_bts *new_bts,
 		       enum gsm_chan_t new_lchan_type);
+int bsc_handover_start_gscon(struct gsm_lchan *old_lchan, struct gsm_bts *new_bts,
+			     enum gsm_chan_t new_lchan_typ);
 void bsc_clear_handover(struct gsm_subscriber_connection *conn, int free_lchan);
 struct gsm_lchan *bsc_handover_pending(struct gsm_lchan *new_lchan);
 
diff --git a/include/osmocom/bsc/osmo_bsc.h b/include/osmocom/bsc/osmo_bsc.h
index 678ac41d2..ed5698db4 100644
--- a/include/osmocom/bsc/osmo_bsc.h
+++ b/include/osmocom/bsc/osmo_bsc.h
@@ -39,6 +39,4 @@ void bsc_gen_location_state_trap(struct gsm_bts *bts);
 
 struct llist_head *bsc_access_lists(void);
 
-int bssmap_send_aoip_ass_compl(struct gsm_lchan *lchan);
-
 #endif
diff --git a/include/osmocom/bsc/osmo_bsc_mgcp.h b/include/osmocom/bsc/osmo_bsc_mgcp.h
deleted file mode 100644
index 15039f747..000000000
--- a/include/osmocom/bsc/osmo_bsc_mgcp.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/* (C) 2017 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
- * All Rights Reserved
- *
- * Author: Philipp Maier
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#pragma once
-
-#include <osmocom/mgcp_client/mgcp_common.h>
-#include <osmocom/mgcp_client/mgcp_client.h>
-
-/* MGCP state handler context. This context information stores all information
- * to handle the direction of the RTP streams via MGCP. There is one instance
- * of this context struct per subscriber connection.
- * (see also struct osmo_bsc_sccp_con) */
-struct mgcp_ctx {
-	/* FSM instance, which handles the connection switching procedure */
-	struct osmo_fsm_inst *fsm;
-
-	/* RTP endpoint number. This number number identifies the endpoint
-	 * on the MGW on which the BTS and NET connection is created. This
-	 * endpoint number is assigned and released automatically. */
-	uint16_t rtp_endpoint;
-
-	/* RTP connection identifiers */
-	char conn_id_bts[MGCP_CONN_ID_LENGTH];
-	char conn_id_net[MGCP_CONN_ID_LENGTH];
-
-	/* Copy of the pointer and the data with context information
-	 * needed to process the AoIP and MGCP requests (system data) */
-	struct mgcp_client *mgcp;
-	struct gsm_subscriber_connection *conn;
-	enum gsm48_chan_mode chan_mode;
-	bool full_rate;
-	struct gsm_lchan *lchan;
-	struct gsm_lchan *ho_lchan;
-	struct msgb *resp;
-	mgcp_trans_id_t mgw_pending_trans;
-};
-
-void mgcp_init(struct gsm_network *net);
-
-struct mgcp_ctx *mgcp_assignm_req(void *ctx, struct mgcp_client *mgcp,
-				  struct gsm_subscriber_connection *conn,
-				  enum gsm48_chan_mode chan_mode, bool full_rate);
-void mgcp_clear_complete(struct mgcp_ctx *mgcp_ctx, struct msgb *resp);
-void mgcp_ass_complete(struct mgcp_ctx *mgcp_ctx, struct gsm_lchan *lchan);
-void mgcp_free_ctx(struct mgcp_ctx *mgcp_ctx);
diff --git a/src/libbsc/abis_rsl.c b/src/libbsc/abis_rsl.c
index 4734c6cef..2017d2c0c 100644
--- a/src/libbsc/abis_rsl.c
+++ b/src/libbsc/abis_rsl.c
@@ -2241,7 +2241,7 @@ static int abis_rsl_rx_rll(struct msgb *msg)
 				  BSC_RLLR_IND_REL_IND);
 		rsl_handle_release(msg->lchan);
 		/* if it was the main signalling link, let the subscr_conn_fsm know */
-		if (sapi == 0 && (rllh->link_id >> 6) == 0)
+		if (msg->lchan->conn && sapi == 0 && (rllh->link_id >> 6) == 0)
 			osmo_fsm_inst_dispatch(msg->lchan->conn->fi, GSCON_EV_RLL_REL_IND, msg);
 		break;
 	case RSL_MT_REL_CONF:
diff --git a/src/libbsc/handover_logic.c b/src/libbsc/handover_logic.c
index cdc21f56f..ca29290be 100644
--- a/src/libbsc/handover_logic.c
+++ b/src/libbsc/handover_logic.c
@@ -40,6 +40,7 @@
 #include <osmocom/bsc/gsm_04_08_utils.h>
 #include <osmocom/bsc/handover.h>
 #include <osmocom/bsc/handover_cfg.h>
+#include <osmocom/bsc/bsc_subscr_conn_fsm.h>
 
 static LLIST_HEAD(bsc_handovers);
 static LLIST_HEAD(handover_decision_callbacks);
@@ -81,6 +82,39 @@ static struct bsc_handover *bsc_ho_by_old_lchan(struct gsm_lchan *old_lchan)
 int bsc_handover_start(enum hodec_id from_hodec_id, struct gsm_lchan *old_lchan, struct gsm_bts *new_bts,
 		       enum gsm_chan_t new_lchan_type)
 {
+	/*! Note: Due to architectural changes this function now acts as a
+	 *  wrapper function that dispatches a signal to the GSCON FSM,
+	 *  which then calls bsc_handover_start_fsm() in case handover is
+	 *  actually permitted. The FSM will then supervise the handover
+	 *  process and (if necessary) communicate changes of IP-Addresses
+	 *  back to the MGW.
+	 * 
+	 *  The implementation of a wrapper function had been prefered over
+	 *  API changes in order to keep code that makes use of
+	 *  bsc_handover_start() unchanged */
+	
+	struct gsm_subscriber_connection *conn;
+
+	OSMO_ASSERT(old_lchan);
+	OSMO_ASSERT(new_bts);	
+
+	conn = old_lchan->conn;
+	OSMO_ASSERT(conn);
+
+	conn->user_plane.ho_from_hodec_id = from_hodec_id;
+	conn->user_plane.ho_old_lchan = old_lchan;
+	conn->user_plane.ho_new_bts = new_bts;
+	conn->user_plane.ho_new_lchan_type = new_lchan_type;
+
+	return osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_HO_START, NULL);
+}
+
+/*! \brief Actual implementation of bsc_handover_start(). This function must
+ *  not be called directly. The only legal caller is the GSCON FSM in
+ *  bsc_subscr_conn_fsm.c. */
+int bsc_handover_start_gscon(struct gsm_lchan *old_lchan, struct gsm_bts *new_bts,
+			     enum gsm_chan_t new_lchan_type)
+{
 	struct gsm_network *network;
 	struct gsm_lchan *new_lchan;
 	struct bsc_handover *ho;
@@ -211,6 +245,9 @@ static void ho_T3103_cb(void *_ho)
 	DEBUGP(DHO, "HO T3103 expired\n");
 	rate_ctr_inc(&net->bsc_ctrs->ctr[BSC_CTR_HANDOVER_TIMEOUT]);
 
+	/* Inform the GSCON FSM about the timed out handover */
+	osmo_fsm_inst_dispatch(ho->old_lchan->conn->fi, GSCON_EV_HO_TIMEOUT, NULL);
+
 	ho->new_lchan->conn->ho_lchan = NULL;
 	ho->new_lchan->conn = NULL;
 	lchan_release(ho->new_lchan, 0, RSL_REL_LOCAL_END);
@@ -306,6 +343,9 @@ static int ho_gsm48_ho_compl(struct gsm_lchan *new_lchan)
 	lchan_release(ho->old_lchan, 0, RSL_REL_LOCAL_END);
 
 	handover_free(ho);
+
+	/* Inform the GSCON FSM that the handover is complete */
+	osmo_fsm_inst_dispatch(new_lchan->conn->fi, GSCON_EV_HO_COMPL, NULL);
 	return 0;
 }
 
@@ -338,7 +378,8 @@ static int ho_gsm48_ho_fail(struct gsm_lchan *old_lchan)
 
 	lchan_release(new_lchan, 0, RSL_REL_LOCAL_END);
 
-
+	/* Inform the GSCON FSM that the handover failed */
+	osmo_fsm_inst_dispatch(old_lchan->conn->fi, GSCON_EV_HO_FAIL, NULL);
 	return 0;
 }
 
diff --git a/src/osmo-bsc/Makefile.am b/src/osmo-bsc/Makefile.am
index 37fa3bafa..422546acb 100644
--- a/src/osmo-bsc/Makefile.am
+++ b/src/osmo-bsc/Makefile.am
@@ -31,7 +31,6 @@ osmo_bsc_SOURCES = \
 	osmo_bsc_vty.c \
 	osmo_bsc_api.c \
 	osmo_bsc_grace.c \
-	osmo_bsc_mgcp.c \
 	osmo_bsc_msc.c \
 	osmo_bsc_sigtran.c \
 	osmo_bsc_filter.c \
diff --git a/src/osmo-bsc/bsc_subscr_conn_fsm.c b/src/osmo-bsc/bsc_subscr_conn_fsm.c
index b1754f08c..afc0e2d48 100644
--- a/src/osmo-bsc/bsc_subscr_conn_fsm.c
+++ b/src/osmo-bsc/bsc_subscr_conn_fsm.c
@@ -20,7 +20,7 @@
 #include <osmocom/core/logging.h>
 #include <osmocom/gsm/gsm0808.h>
 #include <osmocom/sigtran/sccp_sap.h>
-//#include <osmocom/sigtran/sccp_helpers.h>
+#include <osmocom/gsm/gsm0808_utils.h>
 
 #include <osmocom/bsc/debug.h>
 #include <osmocom/bsc/bsc_api.h>
@@ -30,10 +30,22 @@
 #include <osmocom/bsc/bsc_subscriber.h>
 #include <osmocom/bsc/osmo_bsc_sigtran.h>
 #include <osmocom/bsc/bsc_subscr_conn_fsm.h>
+#include <osmocom/bsc/osmo_bsc.h>
+#include <osmocom/mgcp_client/mgcp_client_fsm.h>
+#include <osmocom/core/byteswap.h>
 
 #define S(x)	(1 << (x))
 
-#define GSM0808_T10_VALUE	6
+#define MGCP_MGW_TIMEOUT 4	/* in seconds */
+#define MGCP_MGW_TIMEOUT_TIMER_NR 1
+
+#define MGCP_MGW_HO_TIMEOUT 4	/* in seconds */
+#define MGCP_MGW_HO_TIMEOUT_TIMER_NR 2
+
+#define GSM0808_T10_TIMER_NR 10
+#define GSM0808_T10_VALUE 6
+
+#define ENDPOINT_ID "rtpbridge/*@mgw"
 
 enum gscon_fsm_states {
 	ST_INIT,
@@ -45,10 +57,17 @@ enum gscon_fsm_states {
 	ST_WAIT_ASS_CMPL,
 	/* during assignment; waiting for MODE_MODIFY_ACK */
 	ST_WAIT_MODE_MODIFY_ACK,
-
-	/* BSSMAP CLEAR has bene received */
+	/* BSSMAP CLEAR has been received */
 	ST_CLEARING,
 
+/* MGW handling */
+	/* during assignment; waiting for MGW response to CRCX for BTS */
+	ST_WAIT_CRCX_BTS,
+	/* during assignment; waiting for MGW response to MDCX for BTS */
+	ST_WAIT_MDCX_BTS,
+	/* during assignment; waiting for MGW response to CRCX for MSC */
+	ST_WAIT_CRCX_MSC,
+
 /* MT (inbound) handover */
 	/* Wait for Handover Access from MS/BTS */
 	ST_WAIT_MT_HO_ACC,
@@ -60,31 +79,158 @@ enum gscon_fsm_states {
 	ST_WAIT_MO_HO_CMD,
 	/* Wait for Clear Command from MSC */
 	ST_MO_HO_PROCEEDING,
+
+/* Internal HO handling */
+	/* Wait for the handover logic to complete the handover */
+	ST_WAIT_HO_COMPL,
+	/* during handover; waiting for MGW response to MDCX for BTS */
+	ST_WAIT_MDCX_BTS_HO,
 };
 
 static const struct value_string gscon_fsm_event_names[] = {
-	{ GSCON_EV_A_CONN_IND,		"MT-CONNECT.ind" },
-	{ GSCON_EV_A_CONN_REQ,		"MO-CONNECT.req" },
-	{ GSCON_EV_A_CONN_CFM,		"MO-CONNET.cfm" },
-	{ GSCON_EV_A_ASSIGNMENT_CMD,	"ASSIGNMENT_CMD" },
-	{ GSCON_EV_A_CLEAR_CMD,		"CLEAR_CMD" },
-	{ GSCON_EV_A_DISC_IND,		"DISCONNET.ind" },
-	{ GSCON_EV_A_HO_REQ,		"HANDOVER_REQUEST" },
-
-	{ GSCON_EV_RR_ASS_COMPL,	"RR_ASSIGN_COMPL" },
-	{ GSCON_EV_RR_ASS_FAIL,		"RR_ASSIGN_FAIL" },
-	{ GSCON_EV_RR_MODE_MODIFY_ACK,	"RR_MODE_MODIFY_ACK" },
-	{ GSCON_EV_RR_HO_ACC,		"RR_HO_ACCESS" },
-	{ GSCON_EV_RR_HO_COMPL,		"RR_HO_COMPLETE" },
-	{ GSCON_EV_RLL_REL_IND,		"RLL_RELEASE.ind" },
-	{ GSCON_EV_RSL_CONN_FAIL,	"RSL_CONN_FAIL.ind" },
-	{ GSCON_EV_RSL_CLEAR_COMPL,	"RSL_CLEAR_COMPLETE" },
-
-	{ GSCON_EV_MO_DTAP,		"MO-DTAP" },
-	{ GSCON_EV_MT_DTAP,		"MT-DTAP" },
-	{ 0, NULL }
+	{GSCON_EV_A_CONN_IND, "MT-CONNECT.ind"},
+	{GSCON_EV_A_CONN_REQ, "MO-CONNECT.req"},
+	{GSCON_EV_A_CONN_CFM, "MO-CONNET.cfm"},
+	{GSCON_EV_A_ASSIGNMENT_CMD, "ASSIGNMENT_CMD"},
+	{GSCON_EV_A_CLEAR_CMD, "CLEAR_CMD"},
+	{GSCON_EV_A_DISC_IND, "DISCONNET.ind"},
+	{GSCON_EV_A_HO_REQ, "HANDOVER_REQUEST"},
+
+	{GSCON_EV_RR_ASS_COMPL, "RR_ASSIGN_COMPL"},
+	{GSCON_EV_RR_ASS_FAIL, "RR_ASSIGN_FAIL"},
+	{GSCON_EV_RR_MODE_MODIFY_ACK, "RR_MODE_MODIFY_ACK"},
+	{GSCON_EV_RR_HO_ACC, "RR_HO_ACCESS"},
+	{GSCON_EV_RR_HO_COMPL, "RR_HO_COMPLETE"},
+	{GSCON_EV_RLL_REL_IND, "RLL_RELEASE.ind"},
+	{GSCON_EV_RSL_CONN_FAIL, "RSL_CONN_FAIL.ind"},
+	{GSCON_EV_RSL_CLEAR_COMPL, "RSL_CLEAR_COMPLETE"},
+
+	{GSCON_EV_MO_DTAP, "MO-DTAP"},
+	{GSCON_EV_MT_DTAP, "MT-DTAP"},
+	{GSCON_EV_TX_SCCP, "TX_SCCP"},
+
+	{GSCON_EV_MGW_FAIL_BTS, "MGW_FAILURE_BTS"},
+	{GSCON_EV_MGW_FAIL_MSC, "MGW_FAILURE_MSC"},
+	{GSCON_EV_MGW_CRCX_RESP_BTS, "MGW_CRCX_RESPONSE_BTS"},
+	{GSCON_EV_MGW_MDCX_RESP_BTS, "MGW_MDCX_RESPONSE_BTS"},
+	{GSCON_EV_MGW_CRCX_RESP_MSC, "MGW_CRCX_RESPONSE_MSC"},
+
+	{GSCON_EV_HO_START, "HO_START"},
+	{GSCON_EV_HO_TIMEOUT, "HO_TIMEOUT"},
+	{GSCON_EV_HO_FAIL, "HO_FAIL"},
+	{GSCON_EV_HO_COMPL, "HO_COMPL"},
+
+	{0, NULL}
 };
 
+/* Send data SCCP message through SCCP connection. All sigtran messages
+ * that are send from this FSM must use this function. Never use
+ * osmo_bsc_sigtran_send() directly since this would defeat the checks
+ * provided by this function. */
+static void sigtran_send(struct gsm_subscriber_connection *conn, struct msgb *msg, struct osmo_fsm_inst *fi)
+{
+	int rc;
+
+	/* Make sure that we only attempt to send SCCP messages if we have
+	 * a life SCCP connection. Otherwise drop the message. */
+	if (fi->state == ST_INIT || fi->state == ST_WAIT_CC) {
+		LOGPFSML(fi, LOGL_ERROR, "No active SCCP connection, dropping message!\n");
+		msgb_free(msg);
+		return;
+	}
+
+	rc = osmo_bsc_sigtran_send(conn, msg);
+	if (rc < 0)
+		LOGPFSML(fi, LOGL_ERROR, "Unable to deliver SCCP message!\n");
+}
+
+/* Generate and send assignment complete message */
+static void send_ass_compl(struct gsm_lchan *lchan, struct osmo_fsm_inst *fi)
+{
+	struct msgb *resp;
+	struct gsm0808_speech_codec sc;
+	struct gsm_subscriber_connection *conn;
+
+	conn = lchan->conn;
+
+	OSMO_ASSERT(lchan->abis_ip.ass_compl.valid);
+	OSMO_ASSERT(conn);
+
+	LOGPFSML(fi, LOGL_DEBUG, "Sending assignment complete message... (id=%i)\n", conn->sccp.conn_id);
+
+	/* Extrapolate speech codec from speech mode */
+	gsm0808_speech_codec_from_chan_type(&sc, lchan->abis_ip.ass_compl.speech_mode);
+
+	/* Generate message */
+	resp = gsm0808_create_ass_compl(lchan->abis_ip.ass_compl.rr_cause,
+					lchan->abis_ip.ass_compl.chosen_channel,
+					lchan->abis_ip.ass_compl.encr_alg_id,
+					lchan->abis_ip.ass_compl.speech_mode,
+					&conn->user_plane.aoip_rtp_addr_local, &sc, NULL);
+
+	if (!resp) {
+		LOGPFSML(fi, LOGL_ERROR, "Failed to generate assignment completed message! (id=%i)\n",
+			 conn->sccp.conn_id);
+	}
+
+	sigtran_send(conn, resp, fi);
+}
+
+/* forward MT DTAP from BSSAP side to RSL side */
+static void submit_dtap(struct gsm_subscriber_connection *conn, struct msgb *msg, struct osmo_fsm_inst *fi)
+{
+	int rc;
+	struct msgb *resp = NULL;
+
+	OSMO_ASSERT(fi);
+	OSMO_ASSERT(msg);
+	OSMO_ASSERT(conn);
+
+	rc = gsm0808_submit_dtap(conn, msg, OBSC_LINKID_CB(msg), 1);
+	if (rc != 0) {
+		LOGPFSML(fi, LOGL_ERROR, "Tx BSSMAP CLEAR REQUEST to MSC\n");
+		resp = gsm0808_create_clear_rqst(GSM0808_CAUSE_EQUIPMENT_FAILURE);
+		sigtran_send(conn, resp, fi);
+		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+		return;
+	}
+}
+
+/* forward MO DTAP from RSL side to BSSAP side */
+/* FIXME: move fi parameter to the beginning */
+static void forward_dtap(struct msgb *msg, struct gsm_subscriber_connection *conn, struct osmo_fsm_inst *fi)
+{
+	struct msgb *resp = NULL;
+
+	OSMO_ASSERT(msg);
+	OSMO_ASSERT(conn);
+
+	resp = gsm0808_create_dtap(msg, OBSC_LINKID_CB(msg));
+	sigtran_send(conn, resp, fi);
+}
+
+/* In case there are open MGCP connections, toss
+ * those connections */
+static void toss_mgcp_conn(struct gsm_subscriber_connection *conn, struct osmo_fsm_inst *fi)
+{
+	LOGPFSML(fi, LOGL_ERROR, "tossing all MGCP connections...\n");
+
+	if (conn->user_plane.fi_bts) {
+		mgcp_conn_delete(conn->user_plane.fi_bts);
+		conn->user_plane.fi_bts = NULL;
+	}
+
+	if (conn->user_plane.fi_msc) {
+		mgcp_conn_delete(conn->user_plane.fi_msc);
+		conn->user_plane.fi_msc = NULL;
+	}
+
+	if (conn->user_plane.mgw_endpoint) {
+		talloc_free(conn->user_plane.mgw_endpoint);
+		conn->user_plane.mgw_endpoint = NULL;
+	}
+}
+
 static void gscon_fsm_init(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 {
 	struct gsm_subscriber_connection *conn = fi->priv;
@@ -109,7 +255,7 @@ static void gscon_fsm_init(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 	case GSCON_EV_A_CONN_IND:
 		scu_prim = data;
 		if (!conn->sccp.msc) {
-			LOGPFSML(fi, LOGL_NOTICE, "N-CONNET.ind from unknown MSC %s",
+			LOGPFSML(fi, LOGL_NOTICE, "N-CONNET.ind from unknown MSC %s\n",
 				 osmo_sccp_addr_dump(&scu_prim->u.connect.calling_addr));
 			osmo_sccp_tx_disconn(conn->sccp.msc->a.sccp_user, scu_prim->u.connect.conn_id,
 					     &scu_prim->u.connect.called_addr, 0);
@@ -122,7 +268,7 @@ static void gscon_fsm_init(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 		osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, NULL);
 		break;
 	default:
-		OSMO_ASSERT(0);
+		OSMO_ASSERT(false);
 		break;
 	}
 }
@@ -130,16 +276,16 @@ static void gscon_fsm_init(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 /* We've sent the CONNECTION.req to the SCCP provider and are waiting for CC from MSC */
 static void gscon_fsm_wait_cc(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 {
-	struct gsm_subscriber_connection *conn = fi->priv;
-
 	switch (event) {
 	case GSCON_EV_A_CONN_CFM:
-		/* MSC has confirmed the connection */
+		/* MSC has confirmed the connection, we now change into the
+		 * active state and wait there for further operations */
 		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
 		/* if there's user payload, forward it just like EV_MT_DTAP */
+		/* FIXME: Question: if there's user payload attached to the CC, forward it like EV_MT_DTAP? */
 		break;
 	default:
-		OSMO_ASSERT(0);
+		OSMO_ASSERT(false);
 		break;
 	}
 }
@@ -148,52 +294,175 @@ static void gscon_fsm_wait_cc(struct osmo_fsm_inst *fi, uint32_t event, void *da
 static void gscon_fsm_active(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 {
 	struct gsm_subscriber_connection *conn = fi->priv;
-	uint32_t *param = NULL;
-	struct msgb *msg = NULL;
 	struct msgb *resp = NULL;
-	int chan_mode, full_rate;
+	struct mgcp_conn_peer conn_peer;
 	int rc;
 
 	switch (event) {
 	case GSCON_EV_A_ASSIGNMENT_CMD:
-		/* MSC requests us to perform assignment. We need to check if current channel is
-		 * sufficient. If yes, do MODIFY. If not, do assignment */
-		param = data;
-		full_rate = *param >> 16;
-		chan_mode = *param & 0xffff;
-		LOGPFSM(fi, "ASSIGNMENT_CMD(full_rate=%d, chan_mode=%d)\n", full_rate, chan_mode);
-#if 1
-		rc = gsm0808_assign_req(conn, chan_mode, full_rate);
-		osmo_fsm_inst_state_chg(fi, ST_WAIT_ASS_CMPL, GSM0808_T10_VALUE, 10);
-#else
-		if (chan_compat_with_mode(conn->lchan, chan_mode, full_rate)) {
-			rc = gsm48_lchan_modify(conn->lchan, chan_mode);
-			osmo_fsm_inst_state_chg(fi, ST_WAIT_MODE_MODIFY_ACK, GSM0808_T10_VALUE, 10);
-		} else {
-			if (handle_new_assignment(conn, chan_mode, full_rate)) {
-				osmo_fsm_inst_state_chg(fi, ST_WAIT_ASS_CMPL, GSM0808_T10_VALUE, 10);
-			} else {
-				/* FIXME: tx assignment failure */
+		/* MSC requests us to perform assignment, this code section is
+		 * triggered via signal GSCON_EV_A_ASSIGNMENT_CMD from
+		 * bssmap_handle_assignm_req() in osmo_bsc_bssap.c, which does
+		 * the parsing of incoming assignment requests. */
+
+		LOGPFSML(fi, LOGL_NOTICE, "Channel assignment: chan_mode=%s, full_rate=%i\n",
+			 get_value_string(gsm48_chan_mode_names, conn->user_plane.chan_mode),
+			 conn->user_plane.full_rate);
+
+		/* FIXME: We need to check if current channel is sufficient. If
+		 * yes, do MODIFY. If not, do assignment (see commented lines below) */
+
+		/* FIXME: At the moment, the FSM is constructed in an
+		 * unfortunate way. In case of a voice channel assignment
+		 * we first go through a couple of MGCP related states,
+		 * then reach the state where the actual channel assignment
+		 * happens and then again we perform some MGCP related
+		 * actions and eventually end up in ST_ACTIVE again. This
+		 * should be restructured */
+
+		switch (conn->user_plane.chan_mode) {
+		case GSM48_CMODE_SPEECH_V1:
+		case GSM48_CMODE_SPEECH_EFR:
+		case GSM48_CMODE_SPEECH_AMR:
+			/* A voice channel is requested, so we run down the
+			 * mgcp-ass-mgcp state-chain (see FIXME above) */
+			memset(&conn_peer, 0, sizeof(conn_peer));
+			conn_peer.call_id = conn->sccp.conn_id;
+			osmo_strlcpy(conn_peer.endpoint, ENDPOINT_ID, sizeof(conn_peer.endpoint));
+
+			/* (Pre)Change state and create the connection */
+			osmo_fsm_inst_state_chg(fi, ST_WAIT_CRCX_BTS, MGCP_MGW_TIMEOUT, MGCP_MGW_TIMEOUT_TIMER_NR);
+			conn->user_plane.fi_bts =
+			    mgcp_conn_create(conn->network->mgw.client, fi, GSCON_EV_MGW_FAIL_BTS,
+					     GSCON_EV_MGW_CRCX_RESP_BTS, &conn_peer);
+			if (!conn->user_plane.fi_bts) {
+				resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_EQUIPMENT_FAILURE, NULL);
+				sigtran_send(conn, resp, fi);
+				osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+				return;
+			}
+			break;
+		case GSM48_CMODE_SIGN:
+			/* A signalling channel is requested, so we perform the
+			 * channel assignment directly without performing any
+			 * MGCP actions. ST_WAIT_ASS_CMPL will see by the
+			 * conn->user_plane.chan_mode parameter that this
+			 * assignment is for a signalling channel and will then
+			 * change back to ST_ACTIVE (here) immediately. */
+			rc = gsm0808_assign_req(conn, conn->user_plane.full_rate, conn->user_plane.chan_mode);
+			if (rc != 0) {
+				resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_EQUIPMENT_FAILURE, NULL);
+				sigtran_send(conn, resp, fi);
+				return;
 			}
+
+			osmo_fsm_inst_state_chg(fi, ST_WAIT_ASS_CMPL, GSM0808_T10_VALUE, GSM0808_T10_TIMER_NR);
+			break;
+		default:
+			/* An unsupported channel is requested, so we have to
+			 * reject this request by sending an assignment failure
+			 * message immediately */
+			LOGPFSML(fi, LOGL_ERROR, "Requested channel mode is not supported!\n",
+				 get_value_string(gsm48_chan_mode_names, conn->user_plane.chan_mode),
+				 conn->user_plane.full_rate);
+
+			/* The requested channel mode is not supported  */
+			resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_REQ_CODEC_TYPE_OR_CONFIG_NOT_SUPP, NULL);
+			sigtran_send(conn, resp, fi);
+			break;
 		}
-#endif
+		break;
+	case GSCON_EV_HO_START:
+		rc = bsc_handover_start_gscon(conn->user_plane.ho_old_lchan, conn->user_plane.ho_new_bts,
+					      conn->user_plane.ho_new_lchan_type);
+		if (rc) {
+			resp = gsm0808_create_clear_rqst(GSM0808_CAUSE_EQUIPMENT_FAILURE);
+			sigtran_send(conn, resp, fi);
+			osmo_fsm_inst_state_chg(fi, ST_CLEARING, 0, 0);
+			return;
+		}
+
+		/* Note: No timeout is set here, T3103 in handover_logic.c
+		 * will generate a GSCON_EV_HO_TIMEOUT event should the
+		 * handover time out, so we do not need another timeout
+		 * here (maybe its worth to think about giving GSCON
+		 * more power over the actual handover process). */
+		osmo_fsm_inst_state_chg(fi, ST_WAIT_HO_COMPL, 0, 0);
+		break;
+	case GSCON_EV_A_HO_REQ:
+		/* FIXME: reject any handover requests with HO FAIL until implemented */
 		break;
 	case GSCON_EV_MO_DTAP:
-		/* forward MO DTAP from RSL side to BSSAP side */
-		msg = data;
-		resp = gsm0808_create_dtap(msg, OBSC_LINKID_CB(msg));
-		osmo_bsc_sigtran_send(conn, resp);
+		forward_dtap((struct msgb *)data, conn, fi);
 		break;
 	case GSCON_EV_MT_DTAP:
-		/* forward MT DTAP from BSSAP side to RSL side */
-		msg = data;
-		rc = gsm0808_submit_dtap(conn, msg, OBSC_LINKID_CB(msg), 1);
+		submit_dtap(conn, (struct msgb *)data, fi);
 		break;
-	case GSCON_EV_A_HO_REQ:
-		/* FIXME: reject any handover requests with HO FAIL until implemented */
+	case GSCON_EV_TX_SCCP:
+		sigtran_send(conn, (struct msgb *)data, fi);
 		break;
 	default:
-		OSMO_ASSERT(0);
+		OSMO_ASSERT(false);
+		break;
+	}
+}
+
+/* Before we may start the channel assignment we need to get an IP/Port for the
+ * RTP connection from the MGW */
+static void gscon_fsm_wait_crcx_bts(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct gsm_subscriber_connection *conn = fi->priv;
+	struct mgcp_conn_peer *conn_peer = NULL;
+	struct msgb *resp = NULL;
+	int rc;
+
+	switch (event) {
+	case GSCON_EV_MGW_CRCX_RESP_BTS:
+		conn_peer = data;
+
+		/* Check if the MGW has assigned an enpoint to us, we can not
+		 * proceed */
+		if (strlen(conn_peer->endpoint) <= 0) {
+			resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_EQUIPMENT_FAILURE, NULL);
+			sigtran_send(conn, resp, fi);
+			osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+			return;
+		}
+
+		/* Memorize the endpoint name we got assigned from the MGW.
+		 * When the BTS sided connection is done, we need to create
+		 * a second connection on that same endpoint, so we need
+		 * to know its ID */
+		if (!conn->user_plane.mgw_endpoint)
+			conn->user_plane.mgw_endpoint = talloc_zero_size(conn, MGCP_ENDPOINT_MAXLEN);
+		OSMO_ASSERT(conn->user_plane.mgw_endpoint);
+		osmo_strlcpy(conn->user_plane.mgw_endpoint, conn_peer->endpoint, MGCP_ENDPOINT_MAXLEN);
+
+		/* Store the IP-Address and the port the MGW assigned to us,
+		 * then start the channel assignment. */
+		conn->user_plane.rtp_port = conn_peer->port;
+		conn->user_plane.rtp_ip = osmo_ntohl(inet_addr(conn_peer->addr));
+		rc = gsm0808_assign_req(conn, conn->user_plane.full_rate, conn->user_plane.chan_mode);
+		if (rc != 0) {
+			resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_RQSTED_SPEECH_VERSION_UNAVAILABLE, NULL);
+			sigtran_send(conn, resp, fi);
+			osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+			return;
+		}
+
+		osmo_fsm_inst_state_chg(fi, ST_WAIT_ASS_CMPL, GSM0808_T10_VALUE, GSM0808_T10_TIMER_NR);
+		break;
+	case GSCON_EV_MO_DTAP:
+		forward_dtap((struct msgb *)data, conn, fi);
+		break;
+	case GSCON_EV_MT_DTAP:
+		submit_dtap(conn, (struct msgb *)data, fi);
+		break;
+	case GSCON_EV_TX_SCCP:
+		sigtran_send(conn, (struct msgb *)data, fi);
+		break;
+	default:
+		OSMO_ASSERT(false);
 		break;
 	}
 }
@@ -203,24 +472,161 @@ static void gscon_fsm_wait_ass_cmpl(struct osmo_fsm_inst *fi, uint32_t event, vo
 {
 	struct gsm_subscriber_connection *conn = fi->priv;
 	struct gsm_lchan *lchan = conn->lchan;
+	struct mgcp_conn_peer conn_peer;
+	struct in_addr addr;
 	struct msgb *resp = NULL;
+	int rc;
 
 	switch (event) {
 	case GSCON_EV_RR_ASS_COMPL:
-		resp = gsm0808_create_assignment_completed(0, lchan_to_chosen_channel(lchan),
-			 			lchan->encr.alg_id, chan_mode_to_speech(lchan));
-		osmo_bsc_sigtran_send(conn, resp);
-		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+		switch (conn->user_plane.chan_mode) {
+		case GSM48_CMODE_SPEECH_V1:
+		case GSM48_CMODE_SPEECH_EFR:
+		case GSM48_CMODE_SPEECH_AMR:
+			/* FIXME: What if we are using SCCP-Lite? */
+
+			/* We are dealing with a voice channel, so we can not
+			 * confirm the assignment directly. We must first do
+			 * some final steps on the MGCP side. */
+
+			/* Prepare parameters with the information we got during the assignment */
+			memset(&conn_peer, 0, sizeof(conn_peer));
+			addr.s_addr = osmo_ntohl(lchan->abis_ip.bound_ip);
+			osmo_strlcpy(conn_peer.addr, inet_ntoa(addr), sizeof(conn_peer.addr));
+			conn_peer.port = lchan->abis_ip.bound_port;
+
+			/* (Pre)Change state and modify the connection */
+			osmo_fsm_inst_state_chg(fi, ST_WAIT_MDCX_BTS, MGCP_MGW_TIMEOUT, MGCP_MGW_TIMEOUT_TIMER_NR);
+			rc = mgcp_conn_modify(conn->user_plane.fi_bts, GSCON_EV_MGW_MDCX_RESP_BTS, &conn_peer);
+			if (rc != 0) {
+				resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_EQUIPMENT_FAILURE, NULL);
+				sigtran_send(conn, resp, fi);
+				osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+				return;
+			}
+			break;
+		case GSM48_CMODE_SIGN:
+			/* Confirm the successful assignment on BSSMAP and
+			 * change back into active state */
+			send_ass_compl(lchan, fi);
+			osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+			break;
+		default:
+			/* Unsupported modes should have been already filtered
+			 * by gscon_fsm_active(). If we reach the default
+			 * section here anyway than some unsupported mode must
+			 * have made it into the FSM, this would be a bug, so
+			 * we fire an assertion here */
+			OSMO_ASSERT(false);
+			break;
+		}
+
 		break;
 	case GSCON_EV_RR_ASS_FAIL:
-		/* FIXME: Nobody generates this yet? */
-		resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_RADIO_INTERFACE_MESSAGE_FAILURE,
-							 data);
-		osmo_bsc_sigtran_send(conn, resp);
+		resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_RQSTED_TERRESTRIAL_RESOURCE_UNAVAILABLE, NULL);
+		sigtran_send(conn, resp, fi);
 		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
 		break;
+	case GSCON_EV_MO_DTAP:
+		forward_dtap((struct msgb *)data, conn, fi);
+		break;
+	case GSCON_EV_MT_DTAP:
+		submit_dtap(conn, (struct msgb *)data, fi);
+		break;
+	case GSCON_EV_TX_SCCP:
+		sigtran_send(conn, (struct msgb *)data, fi);
+		break;
 	default:
-		OSMO_ASSERT(0);
+		OSMO_ASSERT(false);
+		break;
+	}
+}
+
+/* We are waiting for the MGW response to the MDCX */
+static void gscon_fsm_wait_mdcx_bts(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct gsm_subscriber_connection *conn = fi->priv;
+	struct mgcp_conn_peer conn_peer;
+	struct sockaddr_in *sin = NULL;
+	struct msgb *resp = NULL;
+
+	switch (event) {
+	case GSCON_EV_MGW_MDCX_RESP_BTS:
+
+		/* Prepare parameters with the connection information we got
+		 * with the assignment command */
+		memset(&conn_peer, 0, sizeof(conn_peer));
+		conn_peer.call_id = conn->sccp.conn_id;
+		sin = (struct sockaddr_in *)&conn->user_plane.aoip_rtp_addr_remote;
+		conn_peer.port = osmo_ntohs(sin->sin_port);
+		osmo_strlcpy(conn_peer.addr, inet_ntoa(sin->sin_addr), sizeof(conn_peer.addr));
+
+		/* Make sure we use the same endpoint where we created the
+		 * BTS connection. */
+		osmo_strlcpy(conn_peer.endpoint, conn->user_plane.mgw_endpoint, sizeof(conn_peer.endpoint));
+
+		/* (Pre)Change state and create the connection */
+		osmo_fsm_inst_state_chg(fi, ST_WAIT_CRCX_MSC, MGCP_MGW_TIMEOUT, MGCP_MGW_TIMEOUT_TIMER_NR);
+		conn->user_plane.fi_msc =
+		    mgcp_conn_create(conn->network->mgw.client, fi, GSCON_EV_MGW_FAIL_MSC, GSCON_EV_MGW_CRCX_RESP_MSC,
+				     &conn_peer);
+		if (!conn->user_plane.fi_bts) {
+			resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_EQUIPMENT_FAILURE, NULL);
+			sigtran_send(conn, resp, fi);
+			osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+			return;
+		}
+
+		break;
+	case GSCON_EV_MO_DTAP:
+		forward_dtap((struct msgb *)data, conn, fi);
+		break;
+	case GSCON_EV_MT_DTAP:
+		submit_dtap(conn, (struct msgb *)data, fi);
+		break;
+	case GSCON_EV_TX_SCCP:
+		sigtran_send(conn, (struct msgb *)data, fi);
+		break;
+	default:
+		OSMO_ASSERT(false);
+		break;
+	}
+}
+
+static void gscon_fsm_wait_crcx_msc(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct gsm_subscriber_connection *conn = fi->priv;
+	struct mgcp_conn_peer *conn_peer = NULL;
+	struct gsm_lchan *lchan = conn->lchan;
+	struct sockaddr_in *sin = NULL;
+
+	switch (event) {
+	case GSCON_EV_MGW_CRCX_RESP_MSC:
+		conn_peer = data;
+
+		/* Store address information we got in response from the CRCX command. */
+		sin = (struct sockaddr_in *)&conn->user_plane.aoip_rtp_addr_local;
+		sin->sin_family = AF_INET;
+		sin->sin_addr.s_addr = inet_addr(conn_peer->addr);
+		sin->sin_port = osmo_ntohs(conn_peer->port);
+
+		/* Send assignment complete message to the MSC */
+		send_ass_compl(lchan, fi);
+
+		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+
+		break;
+	case GSCON_EV_MO_DTAP:
+		forward_dtap((struct msgb *)data, conn, fi);
+		break;
+	case GSCON_EV_MT_DTAP:
+		submit_dtap(conn, (struct msgb *)data, fi);
+		break;
+	case GSCON_EV_TX_SCCP:
+		sigtran_send(conn, (struct msgb *)data, fi);
+		break;
+	default:
+		OSMO_ASSERT(false);
 		break;
 	}
 }
@@ -230,19 +636,30 @@ static void gscon_fsm_wait_mode_modify_ack(struct osmo_fsm_inst *fi, uint32_t ev
 {
 	struct gsm_subscriber_connection *conn = fi->priv;
 	struct gsm_lchan *lchan = conn->lchan;
-	struct msgb *resp;
 
 	switch (event) {
 	case GSCON_EV_RR_MODE_MODIFY_ACK:
 		/* we assume that not only have we received the RR MODE_MODIFY_ACK, but
 		 * actually that also the BTS side of the channel mode has been changed accordingly */
 		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
-		resp = gsm0808_create_assignment_completed(0, lchan_to_chosen_channel(lchan),
-				 			lchan->encr.alg_id, chan_mode_to_speech(lchan));
-		osmo_bsc_sigtran_send(conn, resp);
+
+		/* FIXME: Check if this requires special handling. For now I assume that the send_ass_compl()
+		 * can be used. But I am not sure. */
+		send_ass_compl(lchan, fi);
+
+		break;
+		/* FIXME: Do we need to handle DTAP traffic in this state? Maybe yes? Needs to be checked. */
+	case GSCON_EV_MO_DTAP:
+		forward_dtap((struct msgb *)data, conn, fi);
+		break;
+	case GSCON_EV_MT_DTAP:
+		submit_dtap(conn, (struct msgb *)data, fi);
+		break;
+	case GSCON_EV_TX_SCCP:
+		sigtran_send(conn, (struct msgb *)data, fi);
 		break;
 	default:
-		OSMO_ASSERT(0);
+		OSMO_ASSERT(false);
 		break;
 	}
 }
@@ -254,89 +671,218 @@ static void gscon_fsm_clearing(struct osmo_fsm_inst *fi, uint32_t event, void *d
 
 	switch (event) {
 	case GSCON_EV_RSL_CLEAR_COMPL:
-		/* FIXME: clear any MGCP context */
 		resp = gsm0808_create_clear_complete();
-		osmo_bsc_sigtran_send(conn, resp);
+		sigtran_send(conn, resp, fi);
+		osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, data);
 		break;
 	default:
-		OSMO_ASSERT(0);
+		OSMO_ASSERT(false);
 		break;
 	}
 }
 
+/* Wait for the handover logic to tell us whether the handover completed,
+ * failed or has timed out */
+static void gscon_fsm_wait_ho_compl(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct gsm_subscriber_connection *conn = fi->priv;
+	struct mgcp_conn_peer conn_peer;
+	struct gsm_lchan *lchan = conn->lchan;
+	struct in_addr addr;
+	struct msgb *resp;
+	int rc;
+
+	switch (event) {
+	case GSCON_EV_HO_COMPL:
+		/* The handover logic informs us that the handover has been
+		 * completet. Now we have to tell the MGW the IP/Port on the
+		 * new BTS so that the uplink RTP traffic can be redirected
+		 * there. */
+
+		/* Prepare parameters with the information we got during the
+		 * handover procedure (via IPACC) */
+		memset(&conn_peer, 0, sizeof(conn_peer));
+		addr.s_addr = osmo_ntohl(lchan->abis_ip.bound_ip);
+		osmo_strlcpy(conn_peer.addr, inet_ntoa(addr), sizeof(conn_peer.addr));
+		conn_peer.port = lchan->abis_ip.bound_port;
+
+		/* (Pre)Change state and modify the connection */
+		osmo_fsm_inst_state_chg(fi, ST_WAIT_MDCX_BTS_HO, MGCP_MGW_TIMEOUT, MGCP_MGW_TIMEOUT_TIMER_NR);
+		rc = mgcp_conn_modify(conn->user_plane.fi_bts, GSCON_EV_MGW_MDCX_RESP_BTS, &conn_peer);
+		if (rc != 0) {
+			resp = gsm0808_create_clear_rqst(GSM0808_CAUSE_EQUIPMENT_FAILURE);
+			sigtran_send(conn, resp, fi);
+			osmo_fsm_inst_state_chg(fi, ST_CLEARING, 0, 0);
+			return;
+		}
+		break;
+
+		osmo_fsm_inst_state_chg(fi, ST_WAIT_MT_HO_COMPL, MGCP_MGW_HO_TIMEOUT, MGCP_MGW_HO_TIMEOUT_TIMER_NR);
+		break;
+
+	case GSCON_EV_HO_TIMEOUT:
+	case GSCON_EV_HO_FAIL:
+		/* The handover logic informs us that the handover failed for
+		 * some reason. This means the phone stays on the TS/BTS on
+		 * which it currently is. We will change back to the active
+		 * state again as there are no further operations needed */
+		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+		break;
+	default:
+		OSMO_ASSERT(false);
+		break;
+	}
+}
+
+/* Wait for the MGW to confirm handover related modification of the connection
+ * parameters */
+static void gscon_fsm_wait_mdcx_bts_ho(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct gsm_subscriber_connection *conn = fi->priv;
+
+	switch (event) {
+	case GSCON_EV_MGW_MDCX_RESP_BTS:
+		/* The MGW has confirmed the handover MDCX, and the handover
+		 * is now also done on the RTP side. We may now change back
+		 * to the active state. */
+		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+		break;
+	case GSCON_EV_MO_DTAP:
+		forward_dtap((struct msgb *)data, conn, fi);
+		break;
+	case GSCON_EV_MT_DTAP:
+		submit_dtap(conn, (struct msgb *)data, fi);
+		break;
+	case GSCON_EV_TX_SCCP:
+		sigtran_send(conn, (struct msgb *)data, fi);
+		break;
+	default:
+		OSMO_ASSERT(false);
+		break;
+	}
+}
+
+#define EV_TRANSPARENT_SCCP S(GSCON_EV_TX_SCCP) | S(GSCON_EV_MO_DTAP) | S(GSCON_EV_MT_DTAP)
+
 static const struct osmo_fsm_state gscon_fsm_states[] = {
 	[ST_INIT] = {
-		.in_event_mask = S(GSCON_EV_A_CONN_REQ) |
-				 S(GSCON_EV_A_CONN_IND),
+		.name = OSMO_STRINGIFY(INIT),
+		.in_event_mask = S(GSCON_EV_A_CONN_REQ) | S(GSCON_EV_A_CONN_IND),
 		.out_state_mask = S(ST_WAIT_CC),
-		.name = "INIT",
 		.action = gscon_fsm_init,
 	},
 	[ST_WAIT_CC] = {
+		.name = OSMO_STRINGIFY(WAIT_CC),
 		.in_event_mask = S(GSCON_EV_A_CONN_CFM),
 		.out_state_mask = S(ST_ACTIVE),
-		.name = "WAIT_CC",
 		.action = gscon_fsm_wait_cc,
 	},
 	[ST_ACTIVE] = {
-		.in_event_mask = S(GSCON_EV_A_ASSIGNMENT_CMD) |
-				 S(GSCON_EV_A_HO_REQ) |
-				 S(GSCON_EV_MO_DTAP) |
-				 S(GSCON_EV_MT_DTAP),
-		.out_state_mask = S(ST_WAIT_ASS_CMPL) |
-				  S(ST_WAIT_MODE_MODIFY_ACK) |
-				  S(ST_CLEARING) |
-				  S(ST_WAIT_MO_HO_CMD) |
-				  S(ST_CLEARING),
-		.name = "ACTIVE",
+		.name = OSMO_STRINGIFY(ACTIVE),
+		.in_event_mask = EV_TRANSPARENT_SCCP | S(GSCON_EV_A_ASSIGNMENT_CMD) | S(GSCON_EV_A_HO_REQ) |
+				 S(GSCON_EV_HO_START),
+		.out_state_mask = S(ST_CLEARING) | S(ST_WAIT_CRCX_BTS) | S(ST_WAIT_ASS_CMPL) |
+				  S(ST_WAIT_MODE_MODIFY_ACK) | S(ST_WAIT_MO_HO_CMD) | S(ST_WAIT_HO_COMPL),
 		.action = gscon_fsm_active,
 	},
+	[ST_WAIT_CRCX_BTS] = {
+		.name = OSMO_STRINGIFY(WAIT_CRCX_BTS),
+		.in_event_mask = EV_TRANSPARENT_SCCP | S(GSCON_EV_MGW_CRCX_RESP_BTS),
+		.out_state_mask = S(ST_ACTIVE) | S(ST_WAIT_ASS_CMPL),
+		.action = gscon_fsm_wait_crcx_bts,
+	},
 	[ST_WAIT_ASS_CMPL] = {
-		.in_event_mask = S(GSCON_EV_RR_ASS_COMPL) |
-				 S(GSCON_EV_RR_ASS_FAIL) |
-				 S(GSCON_EV_MO_DTAP) |
-				 S(GSCON_EV_MT_DTAP),
-		.out_state_mask = S(ST_ACTIVE) |
-				  S(ST_CLEARING),
-		.name = "WAIT_ASS_CMPL",
+		.name = OSMO_STRINGIFY(WAIT_ASS_CMPL),
+		.in_event_mask = EV_TRANSPARENT_SCCP | S(GSCON_EV_RR_ASS_COMPL) | S(GSCON_EV_RR_ASS_FAIL),
+		.out_state_mask = S(ST_ACTIVE) | S(ST_WAIT_MDCX_BTS),
 		.action = gscon_fsm_wait_ass_cmpl,
 	},
+	[ST_WAIT_MDCX_BTS] = {
+		.name = OSMO_STRINGIFY(WAIT_MDCX_BTS),
+		.in_event_mask = EV_TRANSPARENT_SCCP | S(GSCON_EV_MGW_MDCX_RESP_BTS),
+		.out_state_mask = S(ST_ACTIVE) | S(ST_WAIT_CRCX_MSC),
+		.action = gscon_fsm_wait_mdcx_bts,
+	},
+	[ST_WAIT_CRCX_MSC] = {
+		.name = OSMO_STRINGIFY(WAIT_CRCX_MSC),
+		.in_event_mask = EV_TRANSPARENT_SCCP | S(GSCON_EV_MGW_CRCX_RESP_MSC),
+		.out_state_mask = S(ST_ACTIVE),
+		.action = gscon_fsm_wait_crcx_msc,
+	},
 	[ST_WAIT_MODE_MODIFY_ACK] = {
-		.in_event_mask = S(GSCON_EV_RR_MODE_MODIFY_ACK) |
-				 S(GSCON_EV_MO_DTAP) |
-				 S(GSCON_EV_MT_DTAP),
-		.out_state_mask = S(ST_ACTIVE) |
-				  S(ST_CLEARING),
-		.name = "WAIT_MODE_MODIFY_ACK",
+		.name = OSMO_STRINGIFY(WAIT_MODE_MODIFY_ACK),
+		.in_event_mask = EV_TRANSPARENT_SCCP | S(GSCON_EV_RR_MODE_MODIFY_ACK),
+		.out_state_mask = S(ST_ACTIVE) | S(ST_CLEARING),
 		.action = gscon_fsm_wait_mode_modify_ack,
 	},
 	[ST_CLEARING] = {
+		.name = OSMO_STRINGIFY(CLEARING),
 		.in_event_mask = S(GSCON_EV_RSL_CLEAR_COMPL),
-		.name = "CLEARING",
 		.action = gscon_fsm_clearing,
 	},
-	/* TODO: external handover */
+
+	/* TODO: external handover, probably it makes sense to break up the
+	 * program flow in handover_logic.c a bit and handle some of the logic
+	 * here? */
 	[ST_WAIT_MT_HO_ACC] = {
-		.name = "WAIT_MT_HO_ACC",
+		.name = OSMO_STRINGIFY(WAIT_MT_HO_ACC),
 	},
 	[ST_WAIT_MT_HO_COMPL] = {
-		.name = "WAIT_MT_HO_CMPL",
+		.name = OSMO_STRINGIFY(WAIT_MT_HO_COMPL),
 	},
 	[ST_WAIT_MO_HO_CMD] = {
-		.name = "WAIT_MO_HO_CMD",
+		.name = OSMO_STRINGIFY(WAIT_MO_HO_CMD),
 	},
 	[ST_MO_HO_PROCEEDING] = {
-		.name = "WAIT_MO_HO_PROCEEDING",
+		.name = OSMO_STRINGIFY(MO_HO_PROCEEDING),
 	},
-};
 
+	/* Internal handover */
+	[ST_WAIT_HO_COMPL] = {
+		.name = OSMO_STRINGIFY(WAIT_HO_COMPL),
+		.in_event_mask = S(GSCON_EV_HO_COMPL) | S(GSCON_EV_HO_FAIL) | S(GSCON_EV_HO_TIMEOUT),
+		.out_state_mask = S(ST_ACTIVE) | S(ST_WAIT_MDCX_BTS_HO),
+		.action = gscon_fsm_wait_ho_compl,
+	},
+	[ST_WAIT_MDCX_BTS_HO] = {
+		.name = OSMO_STRINGIFY(WAIT_MDCX_BTS_HO),
+		.in_event_mask = EV_TRANSPARENT_SCCP | S(GSCON_EV_MGW_MDCX_RESP_BTS),
+		.action = gscon_fsm_wait_mdcx_bts_ho,
+		.out_state_mask = S(ST_ACTIVE),
+	},
+};
 
 static void gscon_fsm_allstate(struct osmo_fsm_inst *fi, uint32_t event, void *data)
 {
 	struct gsm_subscriber_connection *conn = fi->priv;
 	struct msgb *resp = NULL;
 
+	/* When a connection on the MGW fails, make sure that the reference
+	 * in our book-keeping is erased. */
 	switch (event) {
+	case GSCON_EV_MGW_FAIL_BTS:
+		conn->user_plane.fi_bts = NULL;
+		break;
+	case GSCON_EV_MGW_FAIL_MSC:
+		conn->user_plane.fi_msc = NULL;
+		break;
+	}
+
+	/* Regular allstate event processing */
+	switch (event) {
+	case GSCON_EV_MGW_FAIL_BTS:
+	case GSCON_EV_MGW_FAIL_MSC:
+		/* Note: An MGW connection die per definition at any time.
+		 * However, if it dies during the assignment we must return
+		 * with an assignment failure */
+		OSMO_ASSERT(fi->state != ST_INIT && fi->state != ST_WAIT_CC)
+		    if (fi->state == ST_WAIT_CRCX_BTS || fi->state == ST_WAIT_ASS_CMPL || fi->state == ST_WAIT_MDCX_BTS
+			|| fi->state == ST_WAIT_CRCX_MSC) {
+			resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_EQUIPMENT_FAILURE, NULL);
+			sigtran_send(conn, resp, fi);
+			osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+		}
+		break;
 	case GSCON_EV_A_CLEAR_CMD:
 		/* MSC tells us to cleanly shut down */
 		osmo_fsm_inst_state_chg(fi, ST_CLEARING, 0, 0);
@@ -345,26 +891,33 @@ static void gscon_fsm_allstate(struct osmo_fsm_inst *fi, uint32_t event, void *d
 		/* According to 3GPP 48.008 3.1.9.1. "The BSS need not wait for the radio channel
 		 * release to be completed or for the guard timer to expire before returning the
 		 * CLEAR COMPLETE message" */
+
+		/* Close MGCP connections */
+		toss_mgcp_conn(conn, fi);
+
+		/* FIXME: Question: Is this a hack to force a clear complete from internel?
+		 * nobody seems to send the event from outside? */
 		osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_RSL_CLEAR_COMPL, NULL);
 		break;
 	case GSCON_EV_A_DISC_IND:
-		/* MSC or SIGTRAN network has hard-released SCCP connection */
-		/* hard-release the lchan */
-		/* hard-release any MGCP state */
-		osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, NULL);
+		/* MSC or SIGTRAN network has hard-released SCCP connection,
+		 * terminate the FSM now. */
+		osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, data);
 		break;
 	case GSCON_EV_RLL_REL_IND:
 		/* BTS reports that one of the LAPDm data links was released */
 		/* send proper clear request to MSC */
-		osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, NULL);
+		LOGPFSML(fi, LOGL_DEBUG, "Tx BSSMAP CLEAR REQUEST to MSC\n");
+		resp = gsm0808_create_clear_rqst(GSM0808_CAUSE_RADIO_INTERFACE_MESSAGE_FAILURE);
+		sigtran_send(conn, resp, fi);
 		break;
 	case GSCON_EV_RSL_CONN_FAIL:
-		LOGPFSM(fi, "Tx BSSMAP CLEAR REQUEST to MSC");
+		LOGPFSML(fi, LOGL_DEBUG, "Tx BSSMAP CLEAR REQUEST to MSC\n");
 		resp = gsm0808_create_clear_rqst(GSM0808_CAUSE_RADIO_INTERFACE_FAILURE);
-		osmo_bsc_sigtran_send(conn, resp);
+		sigtran_send(conn, resp, fi);
 		break;
 	default:
-		OSMO_ASSERT(0);
+		OSMO_ASSERT(false);
 		break;
 	}
 }
@@ -375,8 +928,6 @@ static void gscon_cleanup(struct osmo_fsm_inst *fi, enum osmo_fsm_term_cause cau
 {
 	struct gsm_subscriber_connection *conn = fi->priv;
 
-	/* FIXME: merge with gsm0808_clear() */
-
 	if (conn->ho_lchan) {
 		LOGPFSML(fi, LOGL_DEBUG, "Releasing ho_lchan\n");
 		bsc_clear_handover(conn, 1);
@@ -400,11 +951,6 @@ static void gscon_cleanup(struct osmo_fsm_inst *fi, enum osmo_fsm_term_cause cau
 		conn->bsub = NULL;
 	}
 
-	if (conn->user_plane.mgcp_ctx) {
-		/* FIXME: MGCP side of things */
-		//mgcp_clear_complete(conn->user_plane.mgcp_ctx, NULL);
-	}
-
 	if (conn->sccp.state != SUBSCR_SCCP_ST_NONE) {
 		LOGPFSML(fi, LOGL_DEBUG, "Disconnecting SCCP\n");
 		struct bsc_msc_data *msc = conn->sccp.msc;
@@ -423,10 +969,17 @@ static void gscon_cleanup(struct osmo_fsm_inst *fi, enum osmo_fsm_term_cause cau
 	fi->priv = NULL;
 }
 
+static void gscon_pre_term(struct osmo_fsm_inst *fi, enum osmo_fsm_term_cause cause)
+{
+	struct gsm_subscriber_connection *conn = fi->priv;
+
+	/* Make sure all possibly still open MGCP connections get closed */
+	toss_mgcp_conn(conn, fi);
+}
+
 static int gscon_timer_cb(struct osmo_fsm_inst *fi)
 {
 	struct gsm_subscriber_connection *conn = fi->priv;
-	struct bsc_msc_data *msc = conn->sccp.msc;
 	struct msgb *resp = NULL;
 
 	switch (fi->T) {
@@ -435,13 +988,21 @@ static int gscon_timer_cb(struct osmo_fsm_inst *fi)
 		/* N-DISCONNET.req is sent in gscon_cleanup() above */
 		osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, NULL);
 		break;
-	case 10: /* Assignment Failed */
+	case GSM0808_T10_TIMER_NR:	/* Assignment Failed */
 		resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_RADIO_INTERFACE_FAILURE, NULL);
-		osmo_bsc_sigtran_send(conn, resp);
+		sigtran_send(conn, resp, fi);
+		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+		break;
+	case MGCP_MGW_TIMEOUT_TIMER_NR:	/* Assignment failed (no response from MGW) */
+		resp = gsm0808_create_assignment_failure(GSM0808_CAUSE_EQUIPMENT_FAILURE, NULL);
+		sigtran_send(conn, resp, fi);
+		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
+		break;
+	case MGCP_MGW_HO_TIMEOUT_TIMER_NR:	/* Handover failed (no response from MGW) */
 		osmo_fsm_inst_state_chg(fi, ST_ACTIVE, 0, 0);
 		break;
 	default:
-		OSMO_ASSERT(0);
+		OSMO_ASSERT(false);
 	}
 	return 0;
 }
@@ -450,18 +1011,16 @@ static struct osmo_fsm gscon_fsm = {
 	.name = "SUBSCR_CONN",
 	.states = gscon_fsm_states,
 	.num_states = ARRAY_SIZE(gscon_fsm_states),
-	.allstate_event_mask =  S(GSCON_EV_A_DISC_IND) |
-				S(GSCON_EV_A_CLEAR_CMD) |
-				S(GSCON_EV_RSL_CONN_FAIL) |
-				S(GSCON_EV_RLL_REL_IND),
+	.allstate_event_mask = S(GSCON_EV_A_DISC_IND) | S(GSCON_EV_A_CLEAR_CMD) | S(GSCON_EV_RSL_CONN_FAIL) |
+	    S(GSCON_EV_RLL_REL_IND) | S(GSCON_EV_MGW_FAIL_BTS) | S(GSCON_EV_MGW_FAIL_MSC),
 	.allstate_action = gscon_fsm_allstate,
 	.cleanup = gscon_cleanup,
+	.pre_term = gscon_pre_term,
 	.timer_cb = gscon_timer_cb,
 	.log_subsys = DMSC,
 	.event_names = gscon_fsm_event_names,
 };
 
-
 /* Allocate a subscriber connection and its associated FSM */
 struct gsm_subscriber_connection *bsc_subscr_con_allocate(struct gsm_network *net)
 {
diff --git a/src/osmo-bsc/osmo_bsc_api.c b/src/osmo-bsc/osmo_bsc_api.c
index d48398f49..ef20c247e 100644
--- a/src/osmo-bsc/osmo_bsc_api.c
+++ b/src/osmo-bsc/osmo_bsc_api.c
@@ -32,24 +32,23 @@
 
 #include <osmocom/bsc/osmo_bsc_sigtran.h>
 
-#define return_when_not_connected(conn) \
-	if (conn->sccp.state != SUBSCR_SCCP_ST_CONNECTED) {\
-		LOGP(DMSC, LOGL_ERROR, "MSC Connection not present.\n"); \
-		return; \
-	}
+/* Check if we have a proper connection to the MSC */
+static bool msc_connected(struct gsm_subscriber_connection *conn)
+{
+	/* No subscriber conn at all */
+	if (!conn)
+		return false;
 
-#define return_when_not_connected_val(conn, ret) \
-	if (conn->sccp.state != SUBSCR_SCCP_ST_CONNECTED) {\
-		LOGP(DMSC, LOGL_ERROR, "MSC Connection not present.\n"); \
-		return ret; \
-	}
+	/* Connection to MSC not established */
+	if (!conn->sccp.msc)
+		return false;
 
-#define queue_msg_or_return(resp) \
-	if (!resp) { \
-		LOGP(DMSC, LOGL_ERROR, "Failed to allocate response.\n"); \
-		return; \
-	} \
-	osmo_bsc_sigtran_send(conn, resp);
+	/* Reset procedure not (yet) executed */
+	if (a_reset_conn_ready(conn->sccp.msc->a.reset) == false)
+		return false;
+
+	return true;
+}
 
 static int bsc_clear_request(struct gsm_subscriber_connection *conn, uint32_t cause);
 static int complete_layer3(struct gsm_subscriber_connection *conn,
@@ -149,24 +148,33 @@ static int bsc_filter_data(struct gsm_subscriber_connection *conn,
 
 static void bsc_sapi_n_reject(struct gsm_subscriber_connection *conn, int dlci)
 {
+	int rc;
 	struct msgb *resp;
-	return_when_not_connected(conn);
 
+	if (!msc_connected(conn))
+		return;
+	
 	LOGP(DMSC, LOGL_NOTICE, "Tx MSC SAPI N REJECT DLCI=0x%02x\n", dlci);
-
 	resp = gsm0808_create_sapi_reject(dlci);
-	queue_msg_or_return(resp);
+	rc = osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_TX_SCCP, resp);
+	if (rc != 0)
+		msgb_free(resp);
 }
 
 static void bsc_cipher_mode_compl(struct gsm_subscriber_connection *conn,
 				  struct msgb *msg, uint8_t chosen_encr)
 {
+	int rc;
 	struct msgb *resp;
-	return_when_not_connected(conn);
 
+	if (!msc_connected(conn))
+		return;
+	
 	LOGP(DMSC, LOGL_DEBUG, "CIPHER MODE COMPLETE from MS, forwarding to MSC\n");
 	resp = gsm0808_create_cipher_complete(msg, chosen_encr);
-	queue_msg_or_return(resp);
+	rc = osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_TX_SCCP, resp);
+	if (rc != 0)
+		msgb_free(resp);
 }
 
 static void bsc_send_ussd_no_srv(struct gsm_subscriber_connection *conn,
@@ -394,7 +402,9 @@ static int handle_cc_setup(struct gsm_subscriber_connection *conn,
 static void bsc_dtap(struct gsm_subscriber_connection *conn, uint8_t link_id, struct msgb *msg)
 {
 	int lu_cause;
-	return_when_not_connected(conn);
+
+	if (!msc_connected(conn))
+		return;
 
 	LOGP(DMSC, LOGL_INFO, "Tx MSC DTAP LINK_ID=0x%02x\n", link_id);
 
@@ -425,8 +435,9 @@ static void bsc_assign_compl(struct gsm_subscriber_connection *conn, uint8_t rr_
 			     uint8_t chosen_channel, uint8_t encr_alg_id,
 			     uint8_t speech_model)
 {
-	return_when_not_connected(conn);
-
+	if (!msc_connected(conn))
+		return;
+	
 	conn->lchan->abis_ip.ass_compl.rr_cause = rr_cause;
 	conn->lchan->abis_ip.ass_compl.chosen_channel = chosen_channel;
 	conn->lchan->abis_ip.ass_compl.encr_alg_id = encr_alg_id;
@@ -453,20 +464,18 @@ static void bsc_assign_compl(struct gsm_subscriber_connection *conn, uint8_t rr_
 static void bsc_assign_fail(struct gsm_subscriber_connection *conn,
 			    uint8_t cause, uint8_t *rr_cause)
 {
-	struct msgb *resp;
-	return_when_not_connected(conn);
-
 	LOGP(DMSC, LOGL_INFO, "Tx MSC ASSIGN FAIL\n");
-
-	resp = gsm0808_create_assignment_failure(cause, rr_cause);
-	queue_msg_or_return(resp);
+	osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_RR_ASS_FAIL, NULL);
 }
 
 static int bsc_clear_request(struct gsm_subscriber_connection *conn, uint32_t cause)
 {
+	int rc;
 	struct msgb *resp;
-	return_when_not_connected_val(conn, 1);
 
+	if (!msc_connected(conn))
+		return 1;
+	
 	LOGP(DMSC, LOGL_INFO, "Tx MSC CLEAR REQUEST\n");
 
 	resp = gsm0808_create_clear_rqst(GSM0808_CAUSE_RADIO_INTERFACE_FAILURE);
@@ -475,7 +484,10 @@ static int bsc_clear_request(struct gsm_subscriber_connection *conn, uint32_t ca
 		return 1;
 	}
 
-	osmo_bsc_sigtran_send(conn, resp);
+	rc = osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_TX_SCCP, resp);
+	if (rc != 0)
+		msgb_free(resp);
+	
 	return 1;
 }
 
@@ -483,12 +495,16 @@ static void bsc_cm_update(struct gsm_subscriber_connection *conn,
 			  const uint8_t *cm2, uint8_t cm2_len,
 			  const uint8_t *cm3, uint8_t cm3_len)
 {
+	int rc;
 	struct msgb *resp;
-	return_when_not_connected(conn);
 
+	if (!msc_connected(conn))
+		return;
+	
 	resp = gsm0808_create_classmark_update(cm2, cm2_len, cm3, cm3_len);
-
-	queue_msg_or_return(resp);
+	rc = osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_TX_SCCP, resp);
+	if (rc != 0)
+		msgb_free(resp);
 }
 
 static void bsc_mr_config(struct gsm_subscriber_connection *conn,
diff --git a/src/osmo-bsc/osmo_bsc_audio.c b/src/osmo-bsc/osmo_bsc_audio.c
index 295d8543a..f821e221f 100644
--- a/src/osmo-bsc/osmo_bsc_audio.c
+++ b/src/osmo-bsc/osmo_bsc_audio.c
@@ -29,7 +29,7 @@
 #include <osmocom/gsm/gsm0808.h>
 #include <osmocom/gsm/gsm0808_utils.h>
 #include <osmocom/bsc/osmo_bsc_sigtran.h>
-#include <osmocom/bsc/osmo_bsc_mgcp.h>
+#include <osmocom/bsc/bsc_subscr_conn_fsm.h>
 
 #include <arpa/inet.h>
 
@@ -76,8 +76,13 @@ static int handle_abisip_signal(unsigned int subsys, unsigned int signal,
 			     gsm_lchan_name(con->ho_lchan));
 			/* No need to do anything for handover here. As soon as a HANDOVER DETECT
 			 * happens, osmo_bsc_mgcp.c will trigger the MGCP MDCX towards MGW by
-			 * receiving an S_LCHAN_HANDOVER_DETECT signal. */
+			 * receiving an S_LCHAN_HANDOVER_DETECT signal. 
+			 * 
+			 * FIXME: This will not work, osmo_bsc_mgcp.c is now removed. The
+			 * switchover must be handled by the GSCON FSM because there we
+			 * we instantiate the child FSMs which handle the MGCP traffic. */
 #if 0
+/* FIXME: This does not work anymore, we will have to implement this in the GSCON FSM */
 			/* NOTE: When an ho_lchan exists, the MDCX is part of an
 			 * handover operation (intra-bsc). This means we will not
 			 * inform the MSC about the event, which means that no
@@ -92,7 +97,8 @@ static int handle_abisip_signal(unsigned int subsys, unsigned int signal,
 			 * IPA based base stations. See also osmo_bsc_api.c,
 			 * function bsc_assign_compl() */
 			LOGP(DMSC, LOGL_INFO, "Tx MSC ASSIGN COMPL (POSTPONED)\n");
-			mgcp_ass_complete(con->user_plane.mgcp_ctx, lchan);
+			osmo_fsm_inst_dispatch(con->fi, GSCON_EV_RR_ASS_COMPL, NULL);
+
 		}
 		break;
 	}
diff --git a/src/osmo-bsc/osmo_bsc_bssap.c b/src/osmo-bsc/osmo_bsc_bssap.c
index bd553e577..e507ce54f 100644
--- a/src/osmo-bsc/osmo_bsc_bssap.c
+++ b/src/osmo-bsc/osmo_bsc_bssap.c
@@ -25,7 +25,6 @@
 #include <osmocom/bsc/bsc_msc_data.h>
 #include <osmocom/bsc/debug.h>
 #include <osmocom/bsc/bsc_subscriber.h>
-#include <osmocom/bsc/osmo_bsc_mgcp.h>
 #include <osmocom/bsc/paging.h>
 #include <osmocom/bsc/gsm_04_08_utils.h>
 #include <osmocom/bsc/bsc_subscr_conn_fsm.h>
@@ -679,7 +678,7 @@ reject:
 		return -1;
 	}
 
-	osmo_bsc_sigtran_send(conn, resp);
+	osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_TX_SCCP, resp);
 	return -1;
 }
 
@@ -715,7 +714,6 @@ static int bssmap_handle_assignm_req(struct gsm_subscriber_connection *conn,
 	struct sockaddr_storage rtp_addr;
 	struct gsm0808_channel_type ct;
 	struct gsm0808_speech_codec_list *scl_ptr = NULL;
-	uint32_t param;
 	uint8_t cause;
 	int rc;
 
@@ -778,6 +776,18 @@ static int bssmap_handle_assignm_req(struct gsm_subscriber_connection *conn,
 			goto reject;
 		}
 
+		/* FIXME: At the moment osmo-bsc does not support any other
+		 * A-Interface other than AoIP. So we must reject all
+		 * assignment requests that are not AoIP compliant. However,
+		 * might support other A-Interface dialects lateron again,
+		 * thats why we preserve the logic around the AoIP detection
+		 * here. */
+		if (!aoip) {
+			LOGP(DMSC, LOGL_ERROR, "Requested A-Interface type is not supported! (AoIP only!)\n");
+			cause = GSM0808_CAUSE_REQ_A_IF_TYPE_NOT_SUPP;
+			goto reject;
+		}
+
 		/* Decode speech codec list (AoIP) */
 		conn->codec_list_present = false;
 		if (aoip) {
@@ -830,37 +840,21 @@ static int bssmap_handle_assignm_req(struct gsm_subscriber_connection *conn,
 			 * the network side RTP connection is made, as long it is made
 			 * before we return with the assignment complete message. */
 			memcpy(&conn->user_plane.aoip_rtp_addr_remote, &rtp_addr, sizeof(rtp_addr));
-
-			/* Create an assignment request using the MGCP fsm. This FSM
-			 * is directly started when its created (now) and will also
-			 * take care about the further processing (creating RTP
-			 * endpoints, calling gsm0808_assign_req(), responding to
-			 * the assignment request etc... */
-			conn->user_plane.mgcp_ctx = mgcp_assignm_req(msc->network,
-									msc->network->mgw.client,
-									conn, chan_mode, full_rate);
-			if (!conn->user_plane.mgcp_ctx) {
-				LOGP(DMSC, LOGL_ERROR, "MGCP / MGW failure, rejecting assignment... "
-					"(id=%i)\n", conn->sccp.conn_id);
-				cause = GSM0808_CAUSE_EQUIPMENT_FAILURE;
-				goto reject;
-			}
-
-			/* We now may return here, the FSM will do all further work */
-			return 0;
+		} else {
+			/* Note: In the sccp-lite case we to not perform any mgcp operation,
+			 * (the MSC does that for us). We set conn->rtp_ip to 0 and check
+			 * on this later. By this we know that we have to behave accordingly
+			 * to sccp-lite. */
+			conn->user_plane.rtp_port = mgcp_timeslot_to_port(multiplex, timeslot, msc->rtp_base);
+			conn->user_plane.rtp_ip = 0;
 		}
-		/* Note: In the sccp-lite case we to not perform any mgcp operation,
-		 * (the MSC does that for us). We set conn->rtp_ip to 0 and check
-		 * on this later. By this we know that we have to behave accordingly
-		 * to sccp-lite. */
-		conn->user_plane.rtp_port = mgcp_timeslot_to_port(multiplex, timeslot, msc->rtp_base);
-		conn->user_plane.rtp_ip = 0;
-		param = (full_rate << 16 | chan_mode);
-		osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_A_ASSIGNMENT_CMD, &param);
+		conn->user_plane.chan_mode = chan_mode;
+		conn->user_plane.full_rate = full_rate;
+		osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_A_ASSIGNMENT_CMD, NULL);
 		break;
 	case GSM0808_CHAN_SIGN:
-		param = GSM48_CMODE_SIGN;
-		osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_A_ASSIGNMENT_CMD, &param);
+		conn->user_plane.chan_mode = GSM48_CMODE_SIGN;
+		osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_A_ASSIGNMENT_CMD, NULL);
 		break;
 	default:
 		cause = GSM0808_CAUSE_INVALID_MESSAGE_CONTENTS;
@@ -872,7 +866,7 @@ reject:
 	resp = gsm0808_create_assignment_failure(cause, NULL);
 	OSMO_ASSERT(resp);
 
-	osmo_bsc_sigtran_send(conn, resp);
+	osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_TX_SCCP, resp);
 	return -1;
 }
 
@@ -1044,38 +1038,3 @@ int bsc_handle_dt(struct gsm_subscriber_connection *conn,
 
 	return -1;
 }
-
-/* Generate and send assignment complete message */
-int bssmap_send_aoip_ass_compl(struct gsm_lchan *lchan)
-{
-	struct msgb *resp;
-	struct gsm0808_speech_codec sc;
-	struct gsm_subscriber_connection *conn;
-
-	conn = lchan->conn;
-
-	OSMO_ASSERT(lchan->abis_ip.ass_compl.valid);
-	OSMO_ASSERT(conn);
-
-	LOGP(DMSC, LOGL_DEBUG, "Sending assignment complete message... (id=%i)\n", conn->sccp.conn_id);
-
-	/* Extrapolate speech codec from speech mode */
-	gsm0808_speech_codec_from_chan_type(&sc, lchan->abis_ip.ass_compl.speech_mode);
-
-	/* Generate message */
-	resp = gsm0808_create_ass_compl(lchan->abis_ip.ass_compl.rr_cause,
-					lchan->abis_ip.ass_compl.chosen_channel,
-					lchan->abis_ip.ass_compl.encr_alg_id,
-					lchan->abis_ip.ass_compl.speech_mode,
-					&conn->user_plane.aoip_rtp_addr_local,
-					&sc,
-					NULL);
-
-	if (!resp) {
-		LOGP(DMSC, LOGL_ERROR, "Failed to generate assignment completed message! (id=%i)\n",
-		     conn->sccp.conn_id);
-		return -EINVAL;
-	}
-
-	return osmo_bsc_sigtran_send(conn, resp);
-}
diff --git a/src/osmo-bsc/osmo_bsc_main.c b/src/osmo-bsc/osmo_bsc_main.c
index af8f83dae..27c5640ea 100644
--- a/src/osmo-bsc/osmo_bsc_main.c
+++ b/src/osmo-bsc/osmo_bsc_main.c
@@ -14,7 +14,7 @@
  * GNU Affero General Public License for more details.
  *
  * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * along with this program.  If not, see <http://www.gnu.org/lienses/>.
  *
  */
 
@@ -29,7 +29,6 @@
 #include <osmocom/bsc/ipaccess.h>
 #include <osmocom/bsc/ctrl.h>
 #include <osmocom/bsc/osmo_bsc_sigtran.h>
-#include <osmocom/bsc/osmo_bsc_mgcp.h>
 #include <osmocom/bsc/handover_decision.h>
 #include <osmocom/bsc/handover_decision_2.h>
 
@@ -511,8 +510,6 @@ int main(int argc, char **argv)
 		exit(1);
 	}
 
-	mgcp_init(bsc_gsmnet);
-
 	handover_decision_1_init();
 	hodec2_init(bsc_gsmnet);
 
diff --git a/src/osmo-bsc/osmo_bsc_mgcp.c b/src/osmo-bsc/osmo_bsc_mgcp.c
deleted file mode 100644
index db649c791..000000000
--- a/src/osmo-bsc/osmo_bsc_mgcp.c
+++ /dev/null
@@ -1,1146 +0,0 @@
-/* (C) 2017 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
- * All Rights Reserved
- *
- * Author: Philipp Maier
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include <osmocom/mgcp_client/mgcp_client.h>
-#include <osmocom/bsc/gsm_data.h>
-#include <osmocom/bsc/osmo_bsc_mgcp.h>
-#include <osmocom/bsc/debug.h>
-#include <osmocom/bsc/osmo_bsc.h>
-#include <osmocom/bsc/signal.h>
-#include <osmocom/core/logging.h>
-#include <osmocom/core/utils.h>
-#include <osmocom/core/timer.h>
-#include <osmocom/core/fsm.h>
-#include <osmocom/bsc/osmo_bsc_sigtran.h>
-#include <osmocom/bsc/bsc_subscr_conn_fsm.h>
-#include <osmocom/core/byteswap.h>
-#include <arpa/inet.h>
-
-#define S(x)	(1 << (x))
-
-#define MGCP_MGW_TIMEOUT 4	/* in seconds */
-#define MGCP_MGW_TIMEOUT_TIMER_NR 1
-#define MGCP_BSS_TIMEOUT 4	/* in seconds */
-#define MGCP_BSS_TIMEOUT_TIMER_NR 2
-
-#define MGCP_ENDPOINT_FORMAT "%x@mgw"
-
-/* Some internal cause codes to indicate fault
- * condition inside the FSM */
-enum bsc_mgcp_cause_code {
-	MGCP_ERR_MGW_FAIL,
-	MGCP_ERR_MGW_INVAL_RESP,
-	MGCP_ERR_MGW_TX_FAIL,
-	MGCP_ERR_UNEXP_TEARDOWN,
-	MGCP_ERR_ASSGMNT_FAIL,
-	MGCP_ERR_UNSUPP_ADDR_FMT,
-	MGCP_ERR_BSS_TIMEOUT,
-	MGCP_ERR_NOMEM
-};
-
-/* Human readable respresentation of the faul codes,
- * will be displayed by handle_error() */
-static const struct value_string bsc_mgcp_cause_codes_names[] = {
-	{MGCP_ERR_MGW_FAIL, "operation failed on MGW"},
-	{MGCP_ERR_MGW_INVAL_RESP, "invalid / unparseable response from MGW"},
-	{MGCP_ERR_MGW_TX_FAIL, "failed to transmit MGCP message to MGW"},
-	{MGCP_ERR_UNEXP_TEARDOWN, "unexpected connection teardown (BSS)"},
-	{MGCP_ERR_ASSGMNT_FAIL, "assignment failure (BSS)"},
-	{MGCP_ERR_UNSUPP_ADDR_FMT, "unsupported network address format used (MSC)"},
-	{MGCP_ERR_BSS_TIMEOUT, "assignment could not be completed in time (BSS)"},
-	{MGCP_ERR_NOMEM, "out of memory"},
-	{0, NULL}
-};
-
-enum fsm_bsc_mgcp_states {
-	ST_CRCX_BTS,
-	ST_ASSIGN_PROC,
-	ST_MDCX_BTS,
-	ST_CRCX_NET,
-	ST_ASSIGN_COMPL,
-	ST_CALL,
-	ST_MDCX_BTS_HO,
-	ST_HALT
-};
-
-enum bsc_mgcp_fsm_evt {
-	/* Initial event: start off the state machine */
-	EV_INIT,
-
-	/* External event: Assignment complete, event is issued shortly before
-	 * the assignment complete message is sent via the A-Interface */
-	EV_ASS_COMPLETE,
-
-	/* External event: Teardown event, this event is used to notify the end
-	 * of a call. It is also issued in case of errors to teardown a half
-	 * open connection. */
-	EV_TEARDOWN,
-
-	/* External event: Handover event, this event notifies the FSM that a
-	 * handover is required. The FSM will then perform an extra MDCX to
-	 * configure the new connection data at the MGW. The only valid state
-	 * where a Handover event can be received is ST_CALL. */
-	EV_HANDOVER,
-
-	/* Internal event: The mgcp_gw has sent its CRCX response for
-	 * the BTS side */
-	EV_CRCX_BTS_RESP,
-
-	/* Internal event: The mgcp_gw has sent its MDCX response for
-	 * the BTS side */
-	EV_MDCX_BTS_RESP,
-
-	/* Internal event: The mgcp_gw has sent its CRCX response for
-	 * the NET side */
-	EV_CRCX_NET_RESP,
-
-	/* Internal event: The mgcp_gw has sent its DLCX response for
-	 * the NET and BTS side */
-	EV_DLCX_ALL_RESP,
-
-	/* Internal event: The mgcp_gw has responded to the (Handover-)
-	   MDCX that has been send to update the BTS connection. */
-	EV_MDCX_BTS_HO_RESP,
-};
-
-/* A general error handler function. On error we still have an interest to
- * remove a half open connection (if possible). This function will execute
- * a controlled jump to the DLCX phase. From there, the FSM will then just
- * continue like the call were ended normally */
-#define handle_error(mgcp_ctx, cause) \
-	_handle_error(mgcp_ctx, cause, __FILE__, __LINE__)
-static void _handle_error(struct mgcp_ctx *mgcp_ctx, enum bsc_mgcp_cause_code cause,
-			  const char *file, int line)
-{
-	struct osmo_fsm_inst *fi;
-
-	OSMO_ASSERT(mgcp_ctx);
-	fi = mgcp_ctx->fsm;
-	OSMO_ASSERT(fi);
-
-	LOGPFSMLSRC(mgcp_ctx->fsm, LOGL_ERROR, file, line, "%s -- graceful shutdown...\n",
-		    get_value_string(bsc_mgcp_cause_codes_names, cause));
-
-	/* Set the VM into the state where it waits for the call end */
-	osmo_fsm_inst_state_chg(fi, ST_CALL, 0, 0);
-
-	/* Simulate the call end by sending a teardown event, so that
-	 * the FSM proceeds directly with the DLCX */
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_TEARDOWN, mgcp_ctx);
-}
-
-static void crcx_for_bts_resp_cb(struct mgcp_response *r, void *priv);
-
-/* Callback for ST_CRCX_BTS: startup state machine send out CRCX for BTS side */
-static void fsm_crcx_bts_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct mgcp_ctx *mgcp_ctx = data;
-	struct gsm_subscriber_connection *conn;
-	struct msgb *msg;
-	struct mgcp_msg mgcp_msg;
-	struct mgcp_client *mgcp;
-	uint16_t rtp_endpoint;
-	int rc;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-	mgcp = mgcp_ctx->mgcp;
-	OSMO_ASSERT(mgcp);
-
-	rtp_endpoint = mgcp_client_next_endpoint(mgcp);
-	mgcp_ctx->rtp_endpoint = rtp_endpoint;
-
-	LOGPFSML(fi, LOGL_DEBUG,
-		 "CRCX/BTS: creating connection for the BTS side on MGW endpoint:0x%x...\n", rtp_endpoint);
-
-	/* Generate MGCP message string */
-	mgcp_msg = (struct mgcp_msg) {
-		.verb = MGCP_VERB_CRCX,
-		.presence = (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID | MGCP_MSG_PRESENCE_CONN_MODE),
-		.call_id = conn->sccp.conn_id,
-		.conn_mode = MGCP_CONN_LOOPBACK
-	};
-	if (snprintf(mgcp_msg.endpoint, MGCP_ENDPOINT_MAXLEN, MGCP_ENDPOINT_FORMAT, rtp_endpoint) >=
-	    MGCP_ENDPOINT_MAXLEN) {
-		handle_error(mgcp_ctx, MGCP_ERR_NOMEM);
-		return;
-	}
-	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
-	OSMO_ASSERT(msg);
-
-	/* Transmit MGCP message to MGW */
-	mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg);
-	rc = mgcp_client_tx(mgcp, msg, crcx_for_bts_resp_cb, mgcp_ctx);
-	if (rc < 0) {
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL);
-		return;
-	}
-
-	osmo_fsm_inst_state_chg(fi, ST_ASSIGN_PROC, MGCP_MGW_TIMEOUT, MGCP_MGW_TIMEOUT_TIMER_NR);
-}
-
-/* Callback for MGCP-Client: handle response for BTS associated CRCX */
-static void crcx_for_bts_resp_cb(struct mgcp_response *r, void *priv)
-{
-	struct mgcp_ctx *mgcp_ctx = priv;
-	int rc;
-	struct gsm_subscriber_connection *conn;
-	uint32_t addr;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-
-	if (mgcp_ctx->fsm == NULL) {
-		LOGP(DMGCP, LOGL_ERROR,
-		     "CRCX/BTS: late MGW response, FSM already terminated -- ignoring...\n");
-		return;
-	}
-
-	if (r->head.response_code != 200) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR,
-			 "CRCX/BTS: response yields error: %d %s\n", r->head.response_code, r->head.comment);
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_FAIL);
-		return;
-	}
-
-	/* memorize connection identifier */
-	osmo_strlcpy(mgcp_ctx->conn_id_bts, r->head.conn_id, sizeof(mgcp_ctx->conn_id_bts));
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG, "CRCX/BTS: MGW responded with CI: %s\n", mgcp_ctx->conn_id_bts);
-
-	rc = mgcp_response_parse_params(r);
-	if (rc) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR, "CRCX/BTS: Cannot parse response\n");
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_INVAL_RESP);
-		return;
-	}
-
-	addr = inet_addr(r->audio_ip);
-	if (addr == INADDR_NONE) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR, "CRCX/BTS: Cannot parse response (invalid IP-address)\n");
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_INVAL_RESP);
-		return;
-	}
-
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG, "CRCX/BTS: MGW responded with address %s:%u\n", r->audio_ip, r->audio_port);
-
-	/* Set the connection details in the conn struct. The code that
-	 * controls the BTS via RSL will take these values and signal them
-	 * to the BTS via RSL/IPACC */
-	conn->user_plane.rtp_port = r->audio_port;
-	conn->user_plane.rtp_ip = osmo_ntohl(addr);
-
-	/* Notify the FSM that we got the response. */
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_CRCX_BTS_RESP, mgcp_ctx);
-}
-
-/* Callback for ST_ASSIGN_PROC: An mgcp response has been received, proceed
- * with the assignment request */
-static void fsm_proc_assignmnent_req_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct mgcp_ctx *mgcp_ctx = data;
-	struct gsm_subscriber_connection *conn;
-	enum gsm48_chan_mode chan_mode;
-	bool full_rate;
-	int rc;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-
-	switch (event) {
-	case EV_CRCX_BTS_RESP:
-		break;
-	default:
-		handle_error(mgcp_ctx, MGCP_ERR_UNEXP_TEARDOWN);
-		return;
-	}
-
-	OSMO_ASSERT(conn);
-	chan_mode = mgcp_ctx->chan_mode;
-	full_rate = mgcp_ctx->full_rate;
-
-	LOGPFSML(fi, LOGL_DEBUG, "MGW proceeding assignment request...\n");
-	uint32_t param = (full_rate << 16) | chan_mode;
-	osmo_fsm_inst_dispatch(conn->fi, GSCON_EV_A_ASSIGNMENT_CMD, &param);
-
-	osmo_fsm_inst_state_chg(fi, ST_MDCX_BTS, MGCP_BSS_TIMEOUT, MGCP_BSS_TIMEOUT_TIMER_NR);
-}
-
-static void mdcx_for_bts_resp_cb(struct mgcp_response *r, void *priv);
-
-/* Callback for ST_MDCX_BTS: When the BSS has completed the assignment,
- * proceed with updating the connection for the BTS side */
-static void fsm_mdcx_bts_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct mgcp_ctx *mgcp_ctx = data;
-	struct gsm_subscriber_connection *conn;
-	struct gsm_lchan *lchan;
-	struct msgb *msg;
-	struct mgcp_msg mgcp_msg;
-	struct mgcp_client *mgcp;
-	uint16_t rtp_endpoint;
-	struct in_addr addr;
-	int rc;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-
-	switch (event) {
-	case EV_ASS_COMPLETE:
-		break;
-	default:
-		handle_error(mgcp_ctx, MGCP_ERR_UNEXP_TEARDOWN);
-		return;
-	}
-
-	mgcp = mgcp_ctx->mgcp;
-	OSMO_ASSERT(mgcp);
-	lchan = mgcp_ctx->lchan;
-	OSMO_ASSERT(lchan);
-
-	rtp_endpoint = mgcp_ctx->rtp_endpoint;
-
-	addr.s_addr = osmo_ntohl(lchan->abis_ip.bound_ip);
-	LOGPFSML(fi, LOGL_DEBUG,
-		 "MDCX/BTS: completing connection for the BTS side on MGW endpoint:0x%x, BTS expects RTP input on address %s:%u\n",
-		 rtp_endpoint, inet_ntoa(addr), lchan->abis_ip.bound_port);
-
-	/* Generate MGCP message string */
-	mgcp_msg = (struct mgcp_msg) {
-		.verb = MGCP_VERB_MDCX,
-		.presence = (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID | MGCP_MSG_PRESENCE_CONN_ID |
-			     MGCP_MSG_PRESENCE_CONN_MODE | MGCP_MSG_PRESENCE_AUDIO_IP | MGCP_MSG_PRESENCE_AUDIO_PORT),
-		.call_id = conn->sccp.conn_id,
-		.conn_id = mgcp_ctx->conn_id_bts,
-		.conn_mode = MGCP_CONN_RECV_SEND,
-		.audio_ip = inet_ntoa(addr),
-		.audio_port = lchan->abis_ip.bound_port
-	};
-	if (snprintf(mgcp_msg.endpoint, sizeof(mgcp_msg.endpoint), MGCP_ENDPOINT_FORMAT, rtp_endpoint) >=
-	    sizeof(mgcp_msg.endpoint)) {
-		handle_error(mgcp_ctx, MGCP_ERR_NOMEM);
-		return;
-	}
-	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
-	OSMO_ASSERT(msg);
-
-	/* Transmit MGCP message to MGW */
-	mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg);
-	rc = mgcp_client_tx(mgcp, msg, mdcx_for_bts_resp_cb, mgcp_ctx);
-	if (rc < 0) {
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL);
-		return;
-	}
-
-	osmo_fsm_inst_state_chg(fi, ST_CRCX_NET, MGCP_MGW_TIMEOUT, MGCP_MGW_TIMEOUT_TIMER_NR);
-}
-
-/* Callback for MGCP-Client: handle response for BTS associated MDCX */
-static void mdcx_for_bts_resp_cb(struct mgcp_response *r, void *priv)
-{
-	struct mgcp_ctx *mgcp_ctx = priv;
-	int rc;
-	struct in_addr addr;
-	struct gsm_lchan *lchan;
-
-	OSMO_ASSERT(mgcp_ctx);
-	lchan = mgcp_ctx->lchan;
-	OSMO_ASSERT(lchan);
-
-	if (mgcp_ctx->fsm == NULL) {
-		LOGP(DMGCP, LOGL_ERROR,
-		     "MDCX/BTS: late MGW response, FSM already terminated -- ignoring...\n");
-		return;
-	}
-
-	if (r->head.response_code != 200) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR,
-			 "MDCX/BTS: response yields error: %d %s\n", r->head.response_code, r->head.comment);
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_FAIL);
-		return;
-	}
-
-	rc = mgcp_response_parse_params(r);
-	if (rc) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR, "MDCX/BTS: Cannot parse MDCX response\n");
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_INVAL_RESP);
-		return;
-	}
-
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG, "MDCX/BTS: MGW responded with address %s:%u\n", r->audio_ip, r->audio_port);
-
-	addr.s_addr = lchan->abis_ip.bound_ip;
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG,
-		 "MDCX/BTS: corresponding lchan has been bound to address %s:%u\n",
-		 inet_ntoa(addr), lchan->abis_ip.bound_port);
-
-	/* Notify the FSM that we got the response. */
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_MDCX_BTS_RESP, mgcp_ctx);
-}
-
-static void crcx_for_net_resp_cb(struct mgcp_response *r, void *priv);
-
-/* Callback for ST_CRCX_NET: An mgcp response has been received, proceed... */
-static void fsm_crcx_net_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct mgcp_ctx *mgcp_ctx = data;
-	struct gsm_subscriber_connection *conn;
-	struct msgb *msg;
-	struct mgcp_msg mgcp_msg;
-	struct mgcp_client *mgcp;
-	uint16_t rtp_endpoint;
-	struct sockaddr_in *sin;
-	char *addr;
-	uint16_t port;
-	int rc;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-	mgcp = mgcp_ctx->mgcp;
-	OSMO_ASSERT(mgcp);
-
-	switch (event) {
-	case EV_MDCX_BTS_RESP:
-		break;
-	default:
-		handle_error(mgcp_ctx, MGCP_ERR_UNEXP_TEARDOWN);
-		return;
-	}
-
-	rtp_endpoint = mgcp_ctx->rtp_endpoint;
-
-	LOGPFSML(fi, LOGL_DEBUG,
-		 "CRCX/NET: creating connection for the NET side on MGW endpoint:0x%x...\n", rtp_endpoint);
-
-	/* Currently we only have support for IPv4 in our MGCP software, the
-	 * AoIP part is ready to support IPv6 in theory, because the IE
-	 * parser/generator uses sockaddr_storage for the AoIP transport
-	 * identifier. However, the MGW does not support IPv6 yet. This is
-	 * why we stop here in case some MSC tries to signal IPv6 AoIP
-	 * transport identifiers */
-	if (conn->user_plane.aoip_rtp_addr_remote.ss_family != AF_INET) {
-		LOGPFSML(fi, LOGL_ERROR,
-			 "CRCX/NET: endpoint:%x MSC uses unsupported address format in AoIP transport identifier -- aborting...\n",
-			 rtp_endpoint);
-		handle_error(mgcp_ctx, MGCP_ERR_UNSUPP_ADDR_FMT);
-		return;
-	}
-
-	sin = (struct sockaddr_in *)&conn->user_plane.aoip_rtp_addr_remote;
-	addr = inet_ntoa(sin->sin_addr);
-	port = osmo_ntohs(sin->sin_port);
-	LOGPFSML(fi, LOGL_DEBUG, "CRCX/NET: MSC expects RTP input on address %s:%u\n", addr, port);
-
-	/* Generate MGCP message string */
-	mgcp_msg = (struct mgcp_msg) {
-		.verb = MGCP_VERB_CRCX,
-		.presence = (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID | MGCP_MSG_PRESENCE_CONN_MODE |
-			     MGCP_MSG_PRESENCE_AUDIO_IP | MGCP_MSG_PRESENCE_AUDIO_PORT),
-		.call_id = conn->sccp.conn_id,
-		.conn_mode = MGCP_CONN_RECV_SEND,
-		.audio_ip = addr,
-		.audio_port = port
-	};
-	if (snprintf(mgcp_msg.endpoint, sizeof(mgcp_msg.endpoint), MGCP_ENDPOINT_FORMAT, rtp_endpoint) >=
-	    sizeof(mgcp_msg.endpoint)) {
-		handle_error(mgcp_ctx, MGCP_ERR_NOMEM);
-		return;
-	}
-	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
-	OSMO_ASSERT(msg);
-
-	/* Transmit MGCP message to MGW */
-	mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg);
-	rc = mgcp_client_tx(mgcp, msg, crcx_for_net_resp_cb, mgcp_ctx);
-	if (rc < 0) {
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL);
-		return;
-	}
-
-	osmo_fsm_inst_state_chg(fi, ST_ASSIGN_COMPL, MGCP_MGW_TIMEOUT, MGCP_MGW_TIMEOUT_TIMER_NR);
-}
-
-/* Callback for MGCP-Client: handle response for NET associated CRCX */
-static void crcx_for_net_resp_cb(struct mgcp_response *r, void *priv)
-{
-	struct mgcp_ctx *mgcp_ctx = priv;
-	int rc;
-	struct gsm_subscriber_connection *conn;
-	struct gsm_lchan *lchan;
-	struct sockaddr_in *sin;
-	uint32_t addr;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-	lchan = mgcp_ctx->lchan;
-	OSMO_ASSERT(lchan);
-
-	if (mgcp_ctx->fsm == NULL) {
-		LOGP(DMGCP, LOGL_ERROR,
-		     "CRCX/NET: late MGW response, FSM already terminated -- ignoring...\n");
-		return;
-	}
-
-	if (r->head.response_code != 200) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR,
-			 "CRCX/NET: response yields error: %d %s\n", r->head.response_code, r->head.comment);
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_FAIL);
-		return;
-	}
-
-	/* memorize connection identifier */
-	osmo_strlcpy(mgcp_ctx->conn_id_net, r->head.conn_id, sizeof(mgcp_ctx->conn_id_net));
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG, "CRCX/NET: MGW responded with CI: %s\n", mgcp_ctx->conn_id_net);
-
-	rc = mgcp_response_parse_params(r);
-	if (rc) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR, "CRCX/NET: Cannot parse CRCX response\n");
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_INVAL_RESP);
-		return;
-	}
-
-	addr = inet_addr(r->audio_ip);
-	if (addr == INADDR_NONE) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR, "CRCX/NET: Cannot parse response (invalid IP-address)\n");
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_INVAL_RESP);
-		return;
-	}
-
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG, "CRCX/NET: MGW responded with address %s:%u\n",
-		 r->audio_ip, r->audio_port);
-
-	/* Store address */
-	sin = (struct sockaddr_in *)&conn->user_plane.aoip_rtp_addr_local;
-	sin->sin_family = AF_INET;
-	sin->sin_addr.s_addr = addr;
-	sin->sin_port = osmo_ntohs(r->audio_port);
-
-	/* Notify the FSM that we got the response. */
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_CRCX_NET_RESP, mgcp_ctx);
-}
-
-/* Callback for ST_ASSIGN_COMPL: Send back assignment complete and wait until the call ends */
-static void fsm_send_assignment_complete(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct mgcp_ctx *mgcp_ctx = data;
-	struct gsm_lchan *lchan;
-
-	OSMO_ASSERT(mgcp_ctx);
-
-	switch (event) {
-	case EV_CRCX_NET_RESP:
-		break;
-	default:
-		handle_error(mgcp_ctx, MGCP_ERR_UNEXP_TEARDOWN);
-		return;
-	}
-
-	lchan = mgcp_ctx->lchan;
-	OSMO_ASSERT(lchan);
-
-	/* Send assignment completion message via AoIP, this will complete
-	 * the circuit. The message will also contain the port and IP-Address
-	 * where the MGW expects the RTP input from the MSC side */
-	bssmap_send_aoip_ass_compl(lchan);
-
-	LOGPFSML(fi, LOGL_DEBUG, "call in progress, waiting for call end...\n");
-
-	osmo_fsm_inst_state_chg(fi, ST_CALL, 0, 0);
-}
-
-static void dlcx_for_all_resp_cb(struct mgcp_response *r, void *priv);
-static void mdcx_for_bts_ho_resp_cb(struct mgcp_response *r, void *priv);
-
-/* Helper function to perform a connection teardown. This function may be
- * called from ST_CALL and ST_MDCX_BTS_HO only. It will perform a state
- * change to ST_HALT when teardown is done. */
-static void handle_teardown(struct mgcp_ctx *mgcp_ctx)
-{
-	struct gsm_subscriber_connection *conn;
-	struct msgb *msg;
-	struct mgcp_msg mgcp_msg;
-	struct mgcp_client *mgcp;
-	uint16_t rtp_endpoint;
-	int rc;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-	mgcp = mgcp_ctx->mgcp;
-	OSMO_ASSERT(mgcp);
-
-	rtp_endpoint = mgcp_ctx->rtp_endpoint;
-
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG,
-		 "DLCX: removing connection for the BTS and NET side on MGW endpoint:0x%x...\n", rtp_endpoint);
-
-	/* We now relase the endpoint back to the pool in order to allow
-	 * other connections to use this endpoint */
-	mgcp_client_release_endpoint(rtp_endpoint, mgcp);
-
-	/* Generate MGCP message string */
-	mgcp_msg = (struct mgcp_msg) {
-		.verb = MGCP_VERB_DLCX,
-		.presence = (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID),
-		.call_id = conn->sccp.conn_id
-	};
-	if (snprintf(mgcp_msg.endpoint, sizeof(mgcp_msg.endpoint), MGCP_ENDPOINT_FORMAT, rtp_endpoint) >=
-	    sizeof(mgcp_msg.endpoint)) {
-		handle_error(mgcp_ctx, MGCP_ERR_NOMEM);
-		return;
-	}
-	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
-	OSMO_ASSERT(msg);
-
-	/* Transmit MGCP message to MGW */
-	mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg);
-	rc = mgcp_client_tx(mgcp, msg, dlcx_for_all_resp_cb, mgcp_ctx);
-	if (rc < 0) {
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL);
-		return;
-	}
-
-	osmo_fsm_inst_state_chg(mgcp_ctx->fsm, ST_HALT, MGCP_MGW_TIMEOUT, MGCP_MGW_TIMEOUT_TIMER_NR);
-}
-
-/* Helper function to perform a handover (MDCX). This function may be
- * called from ST_CALL and ST_MDCX_BTS_HO only. It will perform a state
- * change to ST_CALL when teardown is done. */
-static void handle_handover(struct mgcp_ctx *mgcp_ctx)
-{
-	struct gsm_subscriber_connection *conn;
-	struct msgb *msg;
-	struct mgcp_msg mgcp_msg;
-	struct mgcp_client *mgcp;
-	struct gsm_lchan *ho_lchan;
-	uint16_t rtp_endpoint;
-	struct in_addr addr;
-	int rc;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-	mgcp = mgcp_ctx->mgcp;
-	OSMO_ASSERT(mgcp);
-	ho_lchan = mgcp_ctx->ho_lchan;
-	OSMO_ASSERT(ho_lchan);
-
-	rtp_endpoint = mgcp_ctx->rtp_endpoint;
-
-	addr.s_addr = osmo_ntohl(ho_lchan->abis_ip.bound_ip);
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG,
-		 "MDCX/BTS/HO: handover connection from old BTS to new BTS side on MGW endpoint:0x%x, new BTS expects RTP input on address %s:%u\n\n",
-		 rtp_endpoint, inet_ntoa(addr), ho_lchan->abis_ip.bound_port);
-
-	/* Generate MGCP message string */
-	mgcp_msg = (struct mgcp_msg) {
-		.verb = MGCP_VERB_MDCX,
-		.presence = (MGCP_MSG_PRESENCE_ENDPOINT | MGCP_MSG_PRESENCE_CALL_ID | MGCP_MSG_PRESENCE_CONN_ID |
-			     MGCP_MSG_PRESENCE_CONN_MODE | MGCP_MSG_PRESENCE_AUDIO_IP |
-			     MGCP_MSG_PRESENCE_AUDIO_PORT),
-		.call_id = conn->sccp.conn_id,
-		.conn_id = mgcp_ctx->conn_id_bts,
-		.conn_mode = MGCP_CONN_RECV_SEND,
-		.audio_ip = inet_ntoa(addr),
-		.audio_port = ho_lchan->abis_ip.bound_port};
-	if (snprintf(mgcp_msg.endpoint, sizeof(mgcp_msg.endpoint), MGCP_ENDPOINT_FORMAT, rtp_endpoint) >=
-	    sizeof(mgcp_msg.endpoint)) {
-		handle_error(mgcp_ctx, MGCP_ERR_NOMEM);
-		return;
-	}
-	msg = mgcp_msg_gen(mgcp, &mgcp_msg);
-	OSMO_ASSERT(msg);
-
-	/* Transmit MGCP message to MGW */
-	mgcp_ctx->mgw_pending_trans = mgcp_msg_trans_id(msg);
-	rc = mgcp_client_tx(mgcp, msg, mdcx_for_bts_ho_resp_cb, mgcp_ctx);
-	if (rc < 0) {
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_TX_FAIL);
-		return;
-	}
-
-	osmo_fsm_inst_state_chg(mgcp_ctx->fsm, ST_MDCX_BTS_HO, MGCP_MGW_TIMEOUT, MGCP_MGW_TIMEOUT_TIMER_NR);
-}
-
-/* Callback for ST_CALL: Handle call teardown and Handover */
-static void fsm_active_call_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct mgcp_ctx *mgcp_ctx = data;
-
-	OSMO_ASSERT(mgcp_ctx);
-
-	switch (event) {
-	case EV_TEARDOWN:
-		handle_teardown(mgcp_ctx);
-		break;
-	case EV_HANDOVER:
-		handle_handover(mgcp_ctx);
-		break;
-	}
-
-}
-
-/* Callback for MGCP-Client: handle response for BTS/Handover associated MDCX */
-static void mdcx_for_bts_ho_resp_cb(struct mgcp_response *r, void *priv)
-{
-	struct mgcp_ctx *mgcp_ctx = priv;
-
-	OSMO_ASSERT(mgcp_ctx);
-
-	if (mgcp_ctx->fsm == NULL) {
-		LOGP(DMGCP, LOGL_ERROR, "MDCX/BTS/HO: late MGW response, FSM already terminated -- ignoring...\n");
-		return;
-	}
-
-	if (r->head.response_code != 200) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR,
-			 "MDCX/BTS/HO: response yields error: %d %s\n", r->head.response_code, r->head.comment);
-		handle_error(mgcp_ctx, MGCP_ERR_MGW_FAIL);
-		return;
-	}
-
-	/* Notify the FSM that we got the response. */
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_MDCX_BTS_HO_RESP, mgcp_ctx);
-}
-
-/* Callback for ST_MDCX_BTS_HO: Complete updating the connection data after
- * handoverin the call to another BTS */
-static void fsm_complete_handover(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct mgcp_ctx *mgcp_ctx = (struct mgcp_ctx *)data;
-
-	OSMO_ASSERT(mgcp_ctx);
-
-	switch (event) {
-	case EV_MDCX_BTS_HO_RESP:
-		/* The response from the MGW arrived, the connection pointing
-		 * towards the BTS is now updated, so we now change back to
-		 * ST_CALL, where we will wait for the call-end (or another
-		 * handover) */
-		LOGPFSML(fi, LOGL_DEBUG, "MDCX/BTS/HO: handover done, waiting for call end...\n");
-		osmo_fsm_inst_state_chg(fi, ST_CALL, 0, 0);
-		break;
-	case EV_HANDOVER:
-		/* This handles the rare, but possible situation where another
-		 * handover is happening while we still wait for the the MGW to
-		 * complete the current one. In this case we will stop waiting
-		 * for the response and directly move on with that second
-		 * handover */
-		handle_handover(mgcp_ctx);
-		break;
-	case EV_TEARDOWN:
-		/* It may happen that the BSS wants to teardown all connections
-		 * while we are still waiting for the MGW to respond. In this
-		 * case we start to teard down the connection immediately */
-		handle_teardown(mgcp_ctx);
-		break;
-	}
-}
-
-/* Callback for MGCP-Client: handle response for NET associated CRCX */
-static void dlcx_for_all_resp_cb(struct mgcp_response *r, void *priv)
-{
-	struct mgcp_ctx *mgcp_ctx = priv;
-	struct gsm_subscriber_connection *conn;
-	struct mgcp_client *mgcp;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-	mgcp = mgcp_ctx->mgcp;
-	OSMO_ASSERT(mgcp);
-
-	if (mgcp_ctx->fsm == NULL) {
-		LOGP(DMGCP, LOGL_ERROR,
-		     "DLCX: late MGW response, FSM already terminated -- ignoring...\n");
-		return;
-	}
-
-	/* Note: We check the return code, but in case of an error there is
-	 * not much that can be done to recover. However, at least we tryed
-	 * to remove the connection (if there was even any) */
-	if (r->head.response_code != 200) {
-		LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR,
-			 "DLCX: response yields error: %d %s\n", r->head.response_code, r->head.comment);
-	}
-
-	LOGPFSML(mgcp_ctx->fsm, LOGL_ERROR, "DLCX: MGW has acknowledged the removal of the connections\n");
-
-	/* Notify the FSM that we got the response. */
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_DLCX_ALL_RESP, mgcp_ctx);
-}
-
-/* Callback for ST_HALT: Terminate the state machine */
-static void fsm_halt_cb(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
-	struct mgcp_ctx *mgcp_ctx = (struct mgcp_ctx *)data;
-	struct gsm_subscriber_connection *conn;
-
-	OSMO_ASSERT(mgcp_ctx);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-
-	/* Send pending sigtran message */
-	if (mgcp_ctx->resp) {
-		LOGPFSML(fi, LOGL_DEBUG, "sending pending sigtran response message...\n");
-		osmo_bsc_sigtran_send(conn, mgcp_ctx->resp);
-		mgcp_ctx->resp = NULL;
-	}
-
-	/* Destroy the state machine and all context information */
-	osmo_fsm_inst_free(mgcp_ctx->fsm);
-	mgcp_ctx->fsm = NULL;
-}
-
-/* Timer callback to shut down in case of connectivity problems */
-static int fsm_timeout_cb(struct osmo_fsm_inst *fi)
-{
-	struct mgcp_ctx *mgcp_ctx = fi->priv;
-	struct mgcp_client *mgcp;
-
-	OSMO_ASSERT(mgcp_ctx);
-	mgcp = mgcp_ctx->mgcp;
-	OSMO_ASSERT(mgcp);
-
-	/* Ensure that no sigtran response, is present. Otherwiese we might try
-	 * to send a sigtran response when the sccp connection is already freed. */
-	mgcp_ctx->resp = NULL;
-
-	if (fi->T == MGCP_MGW_TIMEOUT_TIMER_NR) {
-		/* Note: We were unable to communicate with the MGW,
-		 * unfortunately there is no meaningful action we can take
-		 * now other than giving up. */
-
-		/* At least release the occupied endpoint ID */
-		mgcp_client_release_endpoint(mgcp_ctx->rtp_endpoint, mgcp);
-
-		/* Cancel the transaction that timed out */
-		mgcp_client_cancel(mgcp, mgcp_ctx->mgw_pending_trans);
-
-		/* Initiate self destruction of the FSM */
-		osmo_fsm_inst_state_chg(fi, ST_HALT, 0, 0);
-		osmo_fsm_inst_dispatch(fi, EV_TEARDOWN, mgcp_ctx);
-	} else if (fi->T == MGCP_BSS_TIMEOUT_TIMER_NR)
-		/* Note: If the logic that controls the BSS is unable to
-		 * negotiate a connection, we presumably still have a
-		 * working connection to the MGW, we will try to
-		 * shut down gracefully. */
-		handle_error(mgcp_ctx, MGCP_ERR_BSS_TIMEOUT);
-	else {
-		/* Note: Ther must not be any unsolicited timers
-		 * in this FSM. If so, we have serious problem. */
-		OSMO_ASSERT(false);
-	}
-
-	return 0;
-}
-
-static struct osmo_fsm_state fsm_bsc_mgcp_states[] = {
-
-	/* Startup state machine, send CRCX to BTS. */
-	[ST_CRCX_BTS] = {
-			 .in_event_mask = S(EV_INIT),
-			 .out_state_mask = S(ST_HALT) | S(ST_CALL) | S(ST_ASSIGN_PROC),
-			 .name = OSMO_STRINGIFY(ST_CRCX_BTS),
-			 .action = fsm_crcx_bts_cb,
-			 },
-
-	/* When the CRCX response for the BTS side is received, then
-	 * proceed the assignment on the BSS side. */
-	[ST_ASSIGN_PROC] = {
-			    .in_event_mask = S(EV_TEARDOWN) | S(EV_CRCX_BTS_RESP),
-			    .out_state_mask = S(ST_HALT) | S(ST_CALL) | S(ST_MDCX_BTS),
-			    .name = OSMO_STRINGIFY(ST_ASSIGN_PROC),
-			    .action = fsm_proc_assignmnent_req_cb,
-			    },
-
-	/* When the BSS has processed the assignment request,
-	 * then send the MDCX command for the BTS side in order to
-	 * update the connections with the actual PORT/IP where the
-	 * BTS expects the RTP input. */
-	[ST_MDCX_BTS] = {
-			 .in_event_mask = S(EV_TEARDOWN) | S(EV_ASS_COMPLETE),
-			 .out_state_mask = S(ST_HALT) | S(ST_CALL) | S(ST_CRCX_NET),
-			 .name = OSMO_STRINGIFY(ST_MDCX_BTS),
-			 .action = fsm_mdcx_bts_cb,
-			 },
-
-	/* When the MDCX response for the BTS siede is received, then
-	 * directly proceed with sending the CRCX command to connect the
-	 * network side. This is done in one phase (no MDCX needed). */
-	[ST_CRCX_NET] = {
-			 .in_event_mask = S(EV_TEARDOWN) | S(EV_MDCX_BTS_RESP),
-			 .out_state_mask = S(ST_HALT) | S(ST_CALL) | S(ST_ASSIGN_COMPL),
-			 .name = OSMO_STRINGIFY(ST_CRCX_NET),
-			 .action = fsm_crcx_net_cb,
-			 },
-
-	/* When the CRCX response for the NET side is received. Then
-	 * send the assignment complete message via the A-Interface and
-	 * enter wait state in order to wait for the end of the call. */
-	[ST_ASSIGN_COMPL] = {
-			     .in_event_mask = S(EV_TEARDOWN) | S(EV_CRCX_NET_RESP),
-			     .out_state_mask = S(ST_HALT) | S(ST_CALL),
-			     .name = OSMO_STRINGIFY(ST_ASSIGN_COMPL),
-			     .action = fsm_send_assignment_complete,
-			     },
-
-	/* When the call ends, remove all RTP connections from the
-	 * MGW by sending a wildcarded DLCX. In case of a handover,
-	 * go for an extra MDCX to update the connection and land in
-	 * this state again when done. */
-	[ST_CALL] = {
-		     .in_event_mask = S(EV_TEARDOWN) | S(EV_HANDOVER),
-		     .out_state_mask = S(ST_HALT) | S(ST_MDCX_BTS_HO),
-		     .name = OSMO_STRINGIFY(ST_CALL),
-		     .action = fsm_active_call_cb,
-		     },
-
-	/* A handover is in progress. When the response to the respective
-	 * MDCX is received, then go back to ST_CALL and wait for the
-	 * call end */
-	[ST_MDCX_BTS_HO] = {
-			    .in_event_mask = S(EV_TEARDOWN) | S(EV_HANDOVER) | S(EV_MDCX_BTS_HO_RESP),
-			    .out_state_mask = S(ST_HALT) | S(ST_CALL),
-			    .name = OSMO_STRINGIFY(ST_MDCX_BTS_HO),
-			    .action = fsm_complete_handover,
-			    },
-
-	/* When the MGW confirms that the connections are terminated,
-	 * then halt the state machine. */
-	[ST_HALT] = {
-		     .in_event_mask = S(EV_TEARDOWN) | S(EV_DLCX_ALL_RESP),
-		     .out_state_mask = 0,
-		     .name = OSMO_STRINGIFY(ST_HALT),
-		     .action = fsm_halt_cb,
-		     },
-};
-
-/* State machine definition */
-static struct osmo_fsm fsm_bsc_mgcp = {
-	.name = "MGW",
-	.states = fsm_bsc_mgcp_states,
-	.num_states = ARRAY_SIZE(fsm_bsc_mgcp_states),
-	.log_subsys = DMGCP,
-	.timer_cb = fsm_timeout_cb,
-};
-
-/* Notify that the a new call begins. This will create a connection for the
- * BTS on the MGW and set up the port numbers in struct osmo_bsc_sccp_con.
- * After that gsm0808_assign_req() to proceed.
- * Parameter:
- * ctx: talloc context
- * network: associated gsm network
- * conn: associated sccp connection
- * chan_mode: channel mode (system data, passed through)
- * full_rate: full rate flag (system data, passed through)
- * Returns an mgcp_context that contains system data and the OSMO-FSM */
-struct mgcp_ctx *mgcp_assignm_req(void *ctx, struct mgcp_client *mgcp,
-				  struct gsm_subscriber_connection *conn,
-				  enum gsm48_chan_mode chan_mode, bool full_rate)
-{
-	struct mgcp_ctx *mgcp_ctx;
-	char name[32];
-
-	OSMO_ASSERT(mgcp);
-	OSMO_ASSERT(conn);
-
-	OSMO_ASSERT(snprintf(name, sizeof(name), "MGW_%i", conn->sccp.conn_id) < sizeof(name));
-
-	/* Allocate and configure a new fsm instance */
-	mgcp_ctx = talloc_zero(ctx, struct mgcp_ctx);
-	OSMO_ASSERT(mgcp_ctx);
-
-	mgcp_ctx->fsm = osmo_fsm_inst_alloc(&fsm_bsc_mgcp, NULL, ctx, LOGL_DEBUG, name);
-	OSMO_ASSERT(mgcp_ctx->fsm);
-	mgcp_ctx->fsm->priv = mgcp_ctx;
-	mgcp_ctx->mgcp = mgcp;
-	mgcp_ctx->conn = conn;
-	mgcp_ctx->chan_mode = chan_mode;
-	mgcp_ctx->full_rate = full_rate;
-
-	/* start state machine */
-	OSMO_ASSERT(mgcp_ctx->fsm->state == ST_CRCX_BTS);
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_INIT, mgcp_ctx);
-
-	return mgcp_ctx;
-}
-
-/* Notify that the call has ended, remove all connections from the MGW,
- * then send the clear complete message and destroy the FSM instance
- * Parameter:
- * mgcp_ctx: context information (FSM, and pointer to external system data)
- * respmgcp_ctx: pending clear complete message to send via A-Interface */
-void mgcp_clear_complete(struct mgcp_ctx *mgcp_ctx, struct msgb *resp)
-{
-	struct gsm_subscriber_connection *conn;
-
-	OSMO_ASSERT(mgcp_ctx);
-	OSMO_ASSERT(resp);
-	conn = mgcp_ctx->conn;
-	OSMO_ASSERT(conn);
-
-	if (mgcp_ctx->fsm == NULL) {
-		LOGP(DMGCP, LOGL_ERROR,
-		     "clear completion attemted on already terminated FSM -- forwarding directly...\n");
-		osmo_bsc_sigtran_send(conn, resp);
-		mgcp_ctx->resp = NULL;
-		return;
-	}
-
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG, "bss is indicating call end...\n");
-
-	mgcp_ctx->resp = resp;
-
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_TEARDOWN, mgcp_ctx);
-}
-
-/* Notify that the BSS ready, send the assingnment complete message when the
- * mgcp connection is completed
- * Parameter:
- * mgcp_ctx: context information (FSM, and pointer to external system data)
- * lchan: needed for sending the assignment complete message via A-Interface */
-void mgcp_ass_complete(struct mgcp_ctx *mgcp_ctx, struct gsm_lchan *lchan)
-{
-	OSMO_ASSERT(mgcp_ctx);
-	OSMO_ASSERT(lchan);
-
-	if (mgcp_ctx->fsm == NULL) {
-		LOGP(DMGCP, LOGL_ERROR, "assignment completion attemted on already terminated FSM -- ignored\n");
-		mgcp_ctx->lchan = NULL;
-		return;
-	}
-
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG, "bss is indicating assignment completion...\n");
-
-	mgcp_ctx->lchan = lchan;
-
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_ASS_COMPLETE, mgcp_ctx);
-
-	return;
-}
-
-/* Notify that the call got handovered to another BTS, update the connection
- * that is pointing to the BTS side with the connection data for the new bts.
- * Parameter:
- * mgcp_ctx: context information (FSM, and pointer to external system data)
- * ho_lchan: the lchan on the new BTS */
-static void mgcp_handover(struct mgcp_ctx *mgcp_ctx, struct gsm_lchan *ho_lchan)
-{
-	OSMO_ASSERT(mgcp_ctx);
-	OSMO_ASSERT(ho_lchan);
-
-	if (mgcp_ctx->fsm == NULL) {
-		LOGP(DMGCP, LOGL_ERROR, "handover attemted on already terminated FSM -- ignored\n");
-		mgcp_ctx->ho_lchan = NULL;
-		return;
-	}
-
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG, "bss is indicating handover...\n");
-
-	mgcp_ctx->ho_lchan = ho_lchan;
-
-	osmo_fsm_inst_dispatch(mgcp_ctx->fsm, EV_HANDOVER, mgcp_ctx);
-
-	return;
-}
-
-/* GSM 08.58 HANDOVER DETECT has been received */
-static int mgcp_sig_ho_detect(struct gsm_lchan *new_lchan)
-{
-	struct gsm_subscriber_connection *conn;
-	if (!new_lchan) {
-		LOGP(DHO, LOGL_ERROR, "HO Detect signal for NULL lchan\n");
-		return -EINVAL;
-	}
-
-	conn = new_lchan->conn;
-
-	if (!conn) {
-		LOGP(DHO, LOGL_ERROR, "%s HO Detect for lchan without conn\n",
-		     gsm_lchan_name(new_lchan));
-		return -EINVAL;
-	}
-
-	if (!conn->sccp.conn_id) {
-		LOGP(DHO, LOGL_ERROR, "%s HO Detect for conn without sccp_conn_id\n",
-		     gsm_lchan_name(new_lchan));
-		return -EINVAL;
-	}
-
-	if (!conn->user_plane.mgcp_ctx) {
-		LOGP(DHO, LOGL_ERROR, "%s HO Detect for conn without MGCP ctx\n",
-		     gsm_lchan_name(new_lchan));
-		return -EINVAL;
-	}
-
-	mgcp_handover(conn->user_plane.mgcp_ctx, new_lchan);
-	return 0;
-}
-
-static int mgcp_sig_cb(unsigned int subsys, unsigned int signal,
-				void *handler_data, void *signal_data)
-{
-	struct lchan_signal_data *lchan_data;
-
-	switch (subsys) {
-	case SS_LCHAN:
-		lchan_data = signal_data;
-		switch (signal) {
-		case S_LCHAN_HANDOVER_DETECT:
-			return mgcp_sig_ho_detect(lchan_data->lchan);
-		}
-		break;
-	default:
-		break;
-	}
-
-	return 0;
-}
-
-/* Free an existing mgcp context gracefully
- * Parameter:
- * mgcp_ctx: context information (FSM, and pointer to external system data) */
-void mgcp_free_ctx(struct mgcp_ctx *mgcp_ctx)
-{
-	OSMO_ASSERT(mgcp_ctx);
-
-	if (mgcp_ctx->fsm == NULL) {
-		LOGP(DMGCP, LOGL_DEBUG, "fsm already terminated, freeing only related context information...\n");
-		talloc_free(mgcp_ctx);
-		return;
-	}
-
-	LOGPFSML(mgcp_ctx->fsm, LOGL_DEBUG, "terminating fsm and freeing related context information...\n");
-
-	osmo_fsm_inst_free(mgcp_ctx->fsm);
-	talloc_free(mgcp_ctx);
-}
-
-void mgcp_init(struct gsm_network *net)
-{
-	osmo_fsm_register(&fsm_bsc_mgcp);
-	osmo_signal_register_handler(SS_LCHAN, mgcp_sig_cb, NULL);
-}
diff --git a/src/osmo-bsc/osmo_bsc_sigtran.c b/src/osmo-bsc/osmo_bsc_sigtran.c
index 5fafe19c3..1a31a7c52 100644
--- a/src/osmo-bsc/osmo_bsc_sigtran.c
+++ b/src/osmo-bsc/osmo_bsc_sigtran.c
@@ -32,7 +32,6 @@
 #include <osmocom/bsc/osmo_bsc_sigtran.h>
 #include <osmocom/bsc/a_reset.h>
 #include <osmocom/bsc/gsm_04_80.h>
-#include <osmocom/bsc/osmo_bsc_mgcp.h>
 #include <osmocom/bsc/bsc_subscr_conn_fsm.h>
 
 /* A pointer to a list with all involved MSCs
diff --git a/tests/bssap/Makefile.am b/tests/bssap/Makefile.am
index e4fe38b77..30a9246c8 100644
--- a/tests/bssap/Makefile.am
+++ b/tests/bssap/Makefile.am
@@ -29,7 +29,6 @@ bssap_test_SOURCES = \
 	$(top_srcdir)/src/osmo-bsc/osmo_bsc_sigtran.c \
 	$(top_srcdir)/src/osmo-bsc/osmo_bsc_filter.c \
 	$(top_srcdir)/src/osmo-bsc/osmo_bsc_grace.c \
-	$(top_srcdir)/src/osmo-bsc/osmo_bsc_mgcp.c \
 	$(NULL)
 
 bssap_test_LDADD = \