large refactoring: support inter-BSC and inter-MSC Handover

3GPP TS 49.008 '4.3 Roles of MSC-A, MSC-I and MSC-T' defines distinct roles:
- MSC-A is responsible for managing subscribers,
- MSC-I is the gateway to the RAN.
- MSC-T is a second transitory gateway to another RAN during Handover.

After inter-MSC Handover, the MSC-I is handled by a remote MSC instance, while
the original MSC-A retains the responsibility of subscriber management.

MSC-T exists in this patch but is not yet used, since Handover is only prepared
for, not yet implemented.

Facilitate Inter-MSC and inter-BSC Handover by the same internal split of MSC
roles.

Compared to inter-MSC Handover, mere inter-BSC has the obvious simplifications:
- all of MSC-A, MSC-I and MSC-T roles will be served by the same osmo-msc
  instance,
- messages between MSC-A and MSC-{I,T} don't need to be routed via E-interface
  (GSUP),
- no call routing between MSC-A and -I via MNCC necessary.

This is the largest code bomb I have submitted, ever. Out of principle, I
apologize to everyone trying to read this as a whole. Unfortunately, I see no
sense in trying to split this patch into smaller bits. It would be a huge
amount of work to introduce these changes in separate chunks, especially if
each should in turn be useful and pass all test suites. So, unfortunately, we
are stuck with this code bomb.

The following are some details and rationale for this rather huge refactoring:

* separate MSC subscriber management from ran_conn

struct ran_conn is reduced from the pivotal subscriber management entity it has
been so far to a mere storage for an SCCP connection ID and an MSC subscriber
reference.

The new pivotal subscriber management entity is struct msc_a -- struct msub
lists the msc_a, msc_i, msc_t roles, the vast majority of code paths however
use msc_a, since MSC-A is where all the interesting stuff happens.

Before handover, msc_i is an FSM implementation that encodes to the local
ran_conn. After inter-MSC Handover, msc_i is a compatible but different FSM
implementation that instead forwards via/from GSUP. Same goes for the msc_a
struct: if osmo-msc is the MSC-I "RAN proxy" for a remote MSC-A role, the
msc_a->fi is an FSM implementation that merely forwards via/from GSUP.

* New SCCP implementation for RAN access

To be able to forward BSSAP and RANAP messages via the GSUP interface, the
individual message layers need to be cleanly separated. The IuCS implementation
used until now (iu_client from libosmo-ranap) did not provide this level of
separation, and needed a complete rewrite. It was trivial to implement this in
such a way that both BSSAP and RANAP can be handled by the same SCCP code,
hence the new SCCP-RAN layer also replaces BSSAP handling.

sccp_ran.h: struct sccp_ran_inst provides an abstract handler for incoming RAN
connections. A set of callback functions provides implementation specific
details.

* RAN Abstraction (BSSAP vs. RANAP)

The common SCCP implementation did set the theme for the remaining refactoring:
make all other MSC code paths entirely RAN-implementation-agnostic.

ran_infra.c provides data structures that list RAN implementation specifics,
from logging to RAN de-/encoding to SCCP callbacks and timers. A ran_infra
pointer hence allows complete abstraction of RAN implementations:

- managing connected RAN peers (BSC, RNC) in ran_peer.c,
- classifying and de-/encoding RAN PDUs,
- recording connected LACs and cell IDs and sending out Paging requests to
  matching RAN peers.

* RAN RESET now also for RANAP

ran_peer.c absorbs the reset_fsm from a_reset.c; in consequence, RANAP also
supports proper RESET semantics now. Hence osmo-hnbgw now also needs to provide
proper RESET handling, which it so far duly ignores. (TODO)

* RAN de-/encoding abstraction

The RAN abstraction mentioned above serves not only to separate RANAP and BSSAP
implementations transparently, but also to be able to optionally handle RAN on
distinct levels. Before Handover, all RAN messages are handled by the MSC-A
role.  However, after an inter-MSC Handover, a standalone MSC-I will need to
decode RAN PDUs, at least in order to manage Assignment of RTP streams between
BSS/RNC and MNCC call forwarding.

ran_msg.h provides a common API with abstraction for:

- receiving events from RAN, i.e. passing RAN decode from the BSC/RNC and
  MS/UE: struct ran_dec_msg represents RAN messages decoded from either BSSMAP
  or RANAP;
- sending RAN events: ran_enc_msg is the counterpart to compose RAN messages
  that should be encoded to either BSSMAP or RANAP and passed down to the
  BSC/RNC and MS/UE.

The RAN-specific implementations are completely contained by ran_msg_a.c and
ran_msg_iu.c.

In particular, Assignment and Ciphering have so far been distinct code paths
for BSSAP and RANAP, with switch(via_ran){...} statements all over the place.
Using RAN_DEC_* and RAN_ENC_* abstractions, these are now completely unified.

Note that SGs does not qualify for RAN abstraction: the SGs interface always
remains with the MSC-A role, and SGs messages follow quite distinct semantics
from the fairly similar GERAN and UTRAN.

* MGW and RTP stream management

So far, managing MGW endpoints via MGCP was tightly glued in-between
GSM-04.08-CC on the one and MNCC on the other side. Prepare for switching RTP
streams between different RAN peers by moving to object-oriented
implementations: implement struct call_leg and struct rtp_stream with distinct
FSMs each. For MGW communication, use the osmo_mgcpc_ep API that has originated
from osmo-bsc and recently moved to libosmo-mgcp-client for this purpose.
Instead of implementing a sequence of events with code duplication for the RAN
and CN sides, the idea is to manage each RTP stream separately by firing and
receiving events as soon as codecs and RTP ports are negotiated, and letting
the individual FSMs take care of the MGW management "asynchronously". The
caller provides event IDs and an FSM instance that should be notified of RTP
stream setup progress. Hence it becomes possible to reconnect RTP streams from
one GSM-04.08-CC to another (inter-BSC Handover) or between CC and MNCC RTP
peers (inter-MSC Handover) without duplicating the MGCP code for each
transition.

The number of FSM implementations used for MGCP handling may seem a bit of an
overkill. But in fact, the number of perspectives on RTP forwarding are far
from trivial:
- an MGW endpoint is an entity with N connections, and MGCP "sessions" for
  configuring them by talking to the MGW;
- an RTP stream is a remote peer connected to one of the endpoint's
  connections, which is asynchronously notified of codec and RTP port choices;
- a call leg is the higher level view on either an MT or MO side of a voice
  call, a combination of two RTP streams to forward between two remote peers.

  BSC                 MGW                PBX
                CI          CI
                [MGW-endpoint]
  [--rtp_stream--]          [--rtp_stream--]
  [----------------call_leg----------------]

* Use counts

Introduce using the new osmo_use_count API added to libosmocore for this
purpose. Each use token has a distinct name in the logging, which can be a
globally constant name or ad-hoc, like the local __func__ string constant.  Use
in the new struct msc_a, as well as change vlr_subscr to the new osmo_use_count
API.

* FSM Timeouts

Introduce using the new osmo_tdef API, which provides a common VTY
implementation for all timer numbers, and FSM state transitions with the
correct timeout. Originated in osmo-bsc, recently moved to libosmocore.

Depends: Ife31e6798b4e728a23913179e346552a7dd338c0 (libosmocore)
         Ib9af67b100c4583342a2103669732dab2e577b04 (libosmocore)
	 Id617265337f09dfb6ddfe111ef5e578cd3dc9f63 (libosmocore)
	 Ie9e2add7bbfae651c04e230d62e37cebeb91b0f5 (libosmo-sccp)
	 I26be5c4b06a680f25f19797407ab56a5a4880ddc (osmo-mgw)
	 Ida0e59f9a1f2dd18efea0a51680a67b69f141efa (osmo-mgw)
	 I9a3effd38e72841529df6c135c077116981dea36 (osmo-mgw)
Change-Id: I27e4988e0371808b512c757d2b52ada1615067bd

1 files changed, 73 insertions, 131 deletions

diff --git a/src/libvlr/vlr.c b/src/libvlr/vlr.c
index c6d8805d6..508246989 100644
--- a/src/libvlr/vlr.c
+++ b/src/libvlr/vlr.c
@@ -33,6 +33,7 @@
 #include <osmocom/msc/vlr_sgs.h>
 #include <osmocom/msc/vlr.h>
 #include <osmocom/msc/debug.h>
+#include <osmocom/msc/gsup_client_mux.h>
 
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -110,6 +111,18 @@ const char *vlr_subscr_name(const struct vlr_subscr *vsub)
 	return buf;
 }
 
+const char *vlr_subscr_short_name(const struct vlr_subscr *vsub, unsigned int maxlen)
+{
+	/* cast away the const so we can shorten the string within the static buffer */
+	char *name = (char*)vlr_subscr_name(vsub);
+	size_t len = strlen(name);
+	if (maxlen < 2)
+		return "-";
+	if (len > maxlen)
+		strcpy(name + maxlen - 2, "..");
+	return name;
+}
+
 const char *vlr_subscr_msisdn_or_name(const struct vlr_subscr *vsub)
 {
 	if (!vsub || !vsub->msisdn[0])
@@ -174,31 +187,6 @@ struct vlr_subscr *_vlr_subscr_find_by_msisdn(struct vlr_instance *vlr,
 	return NULL;
 }
 
-/* Transmit GSUP message to HLR */
-static int vlr_tx_gsup_message(const struct vlr_instance *vlr,
-			       const struct osmo_gsup_message *gsup_msg)
-{
-	struct msgb *msg = osmo_gsup_client_msgb_alloc();
-
-	int rc = osmo_gsup_encode(msg, gsup_msg);
-	if (rc < 0) {
-		LOGP(DVLR, LOGL_ERROR, "GSUP encoding failure: %s\n", strerror(-rc));
-		return rc;
-	}
-
-	if (!vlr->gsup_client) {
-		LOGP(DVLR, LOGL_NOTICE, "GSUP link is down, cannot "
-			"send GSUP: %s\n", msgb_hexdump(msg));
-		msgb_free(msg);
-		return -ENOTSUP;
-	}
-
-	LOGP(DVLR, LOGL_DEBUG, "GSUP tx: %s\n",
-	     osmo_hexdump_nospc(msg->data, msg->len));
-
-	return osmo_gsup_client_send(vlr->gsup_client, msg);
-}
-
 /* Transmit GSUP message for subscriber to HLR, using IMSI from subscriber */
 static int vlr_subscr_tx_gsup_message(const struct vlr_subscr *vsub,
 				      struct osmo_gsup_message *gsup_msg)
@@ -208,40 +196,39 @@ static int vlr_subscr_tx_gsup_message(const struct vlr_subscr *vsub,
 	if (strlen(gsup_msg->imsi) == 0)
 		OSMO_STRLCPY_ARRAY(gsup_msg->imsi, vsub->imsi);
 
-	return vlr_tx_gsup_message(vlr, gsup_msg);
-}
-
-/* Transmit GSUP error in response to original message */
-static int vlr_tx_gsup_error_reply(const struct vlr_instance *vlr,
-				   struct osmo_gsup_message *gsup_orig,
-				   enum gsm48_gmm_cause cause)
-{
-	struct osmo_gsup_message gsup_reply = {0};
-
-	OSMO_STRLCPY_ARRAY(gsup_reply.imsi, gsup_orig->imsi);
-	gsup_reply.cause = cause;
-	gsup_reply.message_type =
-		OSMO_GSUP_TO_MSGT_ERROR(gsup_orig->message_type);
+	gsup_msg->message_class = OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT;
 
-	return vlr_tx_gsup_message(vlr, &gsup_reply);
+	return gsup_client_mux_tx(vlr->gcm, gsup_msg);
 }
 
 static int vlr_subscr_use_cb(struct osmo_use_count_entry *e, int32_t old_use_count, const char *file, int line)
 {
 	struct vlr_subscr *vsub = e->use_count->talloc_object;
 	char buf[128];
+	int32_t total;
+	int level;
 
 	if (!e->use)
 		return -EINVAL;
 
-	LOGPSRC(DREF, LOGL_DEBUG, file, line, "VLR subscr %s %s %s: now used by %s\n",
+	total = osmo_use_count_total(&vsub->use_count);
+
+	if (total == 0
+	    || (total == 1 && old_use_count == 0 && e->count == 1))
+		level = LOGL_INFO;
+	else
+		level = LOGL_DEBUG;
+
+	LOGPSRC(DREF, level, file, line, "VLR subscr %s %s %s: now used by %s\n",
 		vlr_subscr_name(vsub), (e->count - old_use_count) > 0? "+" : "-", e->use,
 		osmo_use_count_name_buf(buf, sizeof(buf), e->use_count));
 
 	if (e->count < 0)
 		return -ERANGE;
 
-	if (osmo_use_count_total(e->use_count) <= 0)
+	vsub->max_total_use_count = OSMO_MAX(vsub->max_total_use_count, total);
+
+	if (total <= 0)
 		vlr_subscr_free(vsub);
 	return 0;
 }
@@ -261,6 +248,7 @@ static struct vlr_subscr *_vlr_subscr_alloc(struct vlr_instance *vlr)
 			.talloc_object = vsub,
 			.use_cb = vlr_subscr_use_cb,
 		},
+		.expire_lu = VLR_SUBSCRIBER_NO_EXPIRATION,
 	};
 	osmo_use_count_make_static_entries(&vsub->use_count, vsub->use_count_buf, ARRAY_SIZE(vsub->use_count_buf));
 
@@ -314,7 +302,8 @@ void vlr_subscr_cancel_attach_fsm(struct vlr_subscr *vsub,
 void vlr_subscr_free(struct vlr_subscr *vsub)
 {
 	llist_del(&vsub->list);
-	DEBUGP(DREF, "freeing VLR subscr %s\n", vlr_subscr_name(vsub));
+	DEBUGP(DVLR, "freeing VLR subscr %s (max total use count was %d)\n", vlr_subscr_name(vsub),
+	       vsub->max_total_use_count);
 
 	/* Make sure SGs timer Ts5 is removed */
 	osmo_timer_del(&vsub->sgs.Ts5);
@@ -611,17 +600,14 @@ vlr_subscr_pdp_data_get_by_id(struct vlr_subscr *vsub, unsigned context_id)
  ***********************************************************************/
 
 static int vlr_rx_gsup_unknown_imsi(struct vlr_instance *vlr,
-				   struct osmo_gsup_message *gsup_msg)
+				    const struct osmo_gsup_message *gsup_msg)
 {
 	if (OSMO_GSUP_IS_MSGT_REQUEST(gsup_msg->message_type)) {
-		int rc = vlr_tx_gsup_error_reply(vlr, gsup_msg, GMM_CAUSE_IMSI_UNKNOWN);
-		if (rc < 0)
-			LOGP(DVLR, LOGL_ERROR, "Failed to send error reply for IMSI %s\n", gsup_msg->imsi);
-
 		LOGP(DVLR, LOGL_NOTICE,
 		     "Unknown IMSI %s, discarding GSUP request "
 		     "of type 0x%02x\n",
 		     gsup_msg->imsi, gsup_msg->message_type);
+		gsup_client_mux_tx_error_reply(vlr->gcm, gsup_msg, GMM_CAUSE_IMSI_UNKNOWN);
 	} else if (OSMO_GSUP_IS_MSGT_ERROR(gsup_msg->message_type)) {
 		LOGP(DVLR, LOGL_NOTICE,
 		     "Unknown IMSI %s, discarding GSUP error "
@@ -640,7 +626,7 @@ static int vlr_rx_gsup_unknown_imsi(struct vlr_instance *vlr,
 }
 
 static int vlr_rx_gsup_purge_no_subscr(struct vlr_instance *vlr,
-				struct osmo_gsup_message *gsup_msg)
+				       const struct osmo_gsup_message *gsup_msg)
 {
 	if (OSMO_GSUP_IS_MSGT_ERROR(gsup_msg->message_type)) {
 		LOGGSUPP(LOGL_NOTICE, gsup_msg,
@@ -682,7 +668,9 @@ int vlr_subscr_req_sai(struct vlr_subscr *vsub,
 /* Initiate Check_IMEI_VLR Procedure (23.018 Chapter 7.1.2.9) */
 int vlr_subscr_tx_req_check_imei(const struct vlr_subscr *vsub)
 {
-	struct osmo_gsup_message gsup_msg = {0};
+	struct osmo_gsup_message gsup_msg = {
+		.message_class = OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT,
+	};
 	uint8_t imei_enc[GSM23003_IMEI_NUM_DIGITS+2]; /* +2: IE header */
 	int len;
 
@@ -698,17 +686,19 @@ int vlr_subscr_tx_req_check_imei(const struct vlr_subscr *vsub)
 	/* Send CHECK_IMEI_REQUEST */
 	gsup_msg.message_type = OSMO_GSUP_MSGT_CHECK_IMEI_REQUEST;
 	OSMO_STRLCPY_ARRAY(gsup_msg.imsi, vsub->imsi);
-	return vlr_tx_gsup_message(vsub->vlr, &gsup_msg);
+	return gsup_client_mux_tx(vsub->vlr->gcm, &gsup_msg);
 }
 
 /* Tell HLR that authentication failure occurred */
 int vlr_subscr_tx_auth_fail_rep(const struct vlr_subscr *vsub)
 {
-	struct osmo_gsup_message gsup_msg = {0};
+	struct osmo_gsup_message gsup_msg = {
+		.message_class = OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT,
+	};
 
 	gsup_msg.message_type = OSMO_GSUP_MSGT_AUTH_FAIL_REPORT;
 	OSMO_STRLCPY_ARRAY(gsup_msg.imsi, vsub->imsi);
-	return vlr_tx_gsup_message(vsub->vlr, &gsup_msg);
+	return gsup_client_mux_tx(vsub->vlr->gcm, &gsup_msg);
 }
 
 /* Update the subscriber with GSUP-received auth tuples */
@@ -771,21 +761,6 @@ static int vlr_subscr_handle_sai_res(struct vlr_subscr *vsub,
 	return 0;
 }
 
-static int decode_bcd_number_safe(char *output, int output_len,
-				  const uint8_t *bcd_lv, int input_len,
-				  int h_len)
-{
-	uint8_t len;
-	OSMO_ASSERT(output_len >= 1);
-	*output = '\0';
-	if (input_len < 1)
-		return -EIO;
-	len = bcd_lv[0];
-	if (input_len < len)
-		return -EIO;
-	return gsm48_decode_bcd_number(output, output_len, bcd_lv, h_len);
-}
-
 static void vlr_subscr_gsup_insert_data(struct vlr_subscr *vsub,
 					const struct osmo_gsup_message *gsup_msg)
 {
@@ -793,9 +768,9 @@ static void vlr_subscr_gsup_insert_data(struct vlr_subscr *vsub,
 	int rc;
 
 	if (gsup_msg->msisdn_enc) {//FIXME: vlr_subscr_set_msisdn()?
-		decode_bcd_number_safe(vsub->msisdn, sizeof(vsub->msisdn),
-				       gsup_msg->msisdn_enc,
-				       gsup_msg->msisdn_enc_len, 0);
+		gsm48_decode_bcd_number2(vsub->msisdn, sizeof(vsub->msisdn),
+					 gsup_msg->msisdn_enc,
+					 gsup_msg->msisdn_enc_len, 0);
 		LOGP(DVLR, LOGL_DEBUG, "IMSI:%s has MSISDN:%s\n",
 		     vsub->imsi, vsub->msisdn);
 	}
@@ -1033,7 +1008,7 @@ static void gmm_cause_to_fsm_and_mm_cause(enum gsm48_gmm_cause gmm_cause,
 
 /* Handle LOCATION CANCEL request from HLR */
 static int vlr_subscr_handle_cancel_req(struct vlr_subscr *vsub,
-					struct osmo_gsup_message *gsup_msg)
+					const struct osmo_gsup_message *gsup_msg)
 {
 	enum gsm48_reject_value gsm48_rej;
 	enum osmo_fsm_term_cause fsm_cause;
@@ -1081,87 +1056,59 @@ static int vlr_subscr_handle_check_imei(struct vlr_subscr *vsub, const struct os
 
 /* Incoming handler for GSUP from HLR.
  * Keep this function non-static for direct invocation by unit tests. */
-int vlr_gsupc_read_cb(struct osmo_gsup_client *gsupc, struct msgb *msg)
+int vlr_gsup_rx(struct gsup_client_mux *gcm, void *data, const struct osmo_gsup_message *gsup)
 {
-	struct vlr_instance *vlr = (struct vlr_instance *) gsupc->data;
+	struct vlr_instance *vlr = data;
 	struct vlr_subscr *vsub;
-	struct osmo_gsup_message gsup;
 	int rc;
 
-	DEBUGP(DVLR, "GSUP rx %u: %s\n", msgb_l2len(msg),
-	       osmo_hexdump_nospc(msgb_l2(msg), msgb_l2len(msg)));
-
-	rc = osmo_gsup_decode(msgb_l2(msg), msgb_l2len(msg), &gsup);
-	if (rc < 0) {
-		LOGP(DVLR, LOGL_ERROR,
-			"decoding GSUP message fails with error '%s' (%d)\n",
-			get_value_string(gsm48_gmm_cause_names, -rc), -rc);
-		goto msgb_free_and_return;
-	}
-
-	if (!gsup.imsi[0]) {
-		LOGP(DVLR, LOGL_ERROR, "Missing IMSI in GSUP message\n");
-		if (OSMO_GSUP_IS_MSGT_REQUEST(gsup.message_type)) {
-			rc = vlr_tx_gsup_error_reply(vlr, &gsup, GMM_CAUSE_INV_MAND_INFO);
-			if (rc < 0)
-				LOGP(DVLR, LOGL_ERROR, "Failed to send error reply for IMSI %s\n", gsup.imsi);
-		}
-		rc = -GMM_CAUSE_INV_MAND_INFO;
-		goto msgb_free_and_return;
-	}
-
-	vsub = vlr_subscr_find_by_imsi(vlr, gsup.imsi, __func__);
+	vsub = vlr_subscr_find_by_imsi(vlr, gsup->imsi, __func__);
 	if (!vsub) {
-		switch (gsup.message_type) {
+		switch (gsup->message_type) {
 		case OSMO_GSUP_MSGT_PURGE_MS_RESULT:
 		case OSMO_GSUP_MSGT_PURGE_MS_ERROR:
-			rc = vlr_rx_gsup_purge_no_subscr(vlr, &gsup);
-			goto msgb_free_and_return;
+			return vlr_rx_gsup_purge_no_subscr(vlr, gsup);
 		default:
-			rc = vlr_rx_gsup_unknown_imsi(vlr, &gsup);
-			goto msgb_free_and_return;
+			return vlr_rx_gsup_unknown_imsi(vlr, gsup);
 		}
 	}
 
-	switch (gsup.message_type) {
+	switch (gsup->message_type) {
 	case OSMO_GSUP_MSGT_SEND_AUTH_INFO_RESULT:
 	case OSMO_GSUP_MSGT_SEND_AUTH_INFO_ERROR:
-		rc = vlr_subscr_handle_sai_res(vsub, &gsup);
+		rc = vlr_subscr_handle_sai_res(vsub, gsup);
 		break;
 	case OSMO_GSUP_MSGT_INSERT_DATA_REQUEST:
-		rc = vlr_subscr_handle_isd_req(vsub, &gsup);
+		rc = vlr_subscr_handle_isd_req(vsub, gsup);
 		break;
 	case OSMO_GSUP_MSGT_LOCATION_CANCEL_REQUEST:
-		rc = vlr_subscr_handle_cancel_req(vsub, &gsup);
+		rc = vlr_subscr_handle_cancel_req(vsub, gsup);
 		break;
 	case OSMO_GSUP_MSGT_UPDATE_LOCATION_RESULT:
-		rc = vlr_subscr_handle_lu_res(vsub, &gsup);
+		rc = vlr_subscr_handle_lu_res(vsub, gsup);
 		break;
 	case OSMO_GSUP_MSGT_UPDATE_LOCATION_ERROR:
-		rc = vlr_subscr_handle_lu_err(vsub, &gsup);
+		rc = vlr_subscr_handle_lu_err(vsub, gsup);
 		break;
 	case OSMO_GSUP_MSGT_PURGE_MS_ERROR:
 	case OSMO_GSUP_MSGT_PURGE_MS_RESULT:
 	case OSMO_GSUP_MSGT_DELETE_DATA_REQUEST:
 		LOGVSUBP(LOGL_ERROR, vsub,
 			"Rx GSUP msg_type=%d not yet implemented\n",
-			gsup.message_type);
+			gsup->message_type);
 		rc = -GMM_CAUSE_MSGT_NOTEXIST_NOTIMPL;
 		break;
 	case OSMO_GSUP_MSGT_CHECK_IMEI_ERROR:
 	case OSMO_GSUP_MSGT_CHECK_IMEI_RESULT:
-		rc = vlr_subscr_handle_check_imei(vsub, &gsup);
+		rc = vlr_subscr_handle_check_imei(vsub, gsup);
 		break;
 	default:
-		/* Forward message towards MSC */
-		rc = vlr->ops.forward_gsup_msg(vsub, &gsup);
+		LOGP(DLGSUP, LOGL_ERROR, "GSUP Message type not handled by VLR: %d\n", gsup->message_type);
+		rc = -EINVAL;
 		break;
 	}
 
 	vlr_subscr_put(vsub, __func__);
-
-msgb_free_and_return:
-	msgb_free(msg);
 	return rc;
 }
 
@@ -1304,7 +1251,6 @@ struct vlr_instance *vlr_alloc(void *ctx, const struct vlr_ops *ops)
 	OSMO_ASSERT(ops->tx_common_id);
 	OSMO_ASSERT(ops->subscr_update);
 	OSMO_ASSERT(ops->subscr_assoc);
-	OSMO_ASSERT(ops->forward_gsup_msg);
 
 	INIT_LLIST_HEAD(&vlr->subscribers);
 	INIT_LLIST_HEAD(&vlr->operations);
@@ -1314,7 +1260,7 @@ struct vlr_instance *vlr_alloc(void *ctx, const struct vlr_ops *ops)
 	vlr->cfg.assign_tmsi = true;
 
 	/* osmo_auth_fsm.c */
-	osmo_fsm_register(&vlr_auth_fsm);
+	OSMO_ASSERT(osmo_fsm_register(&vlr_auth_fsm) == 0);
 	/* osmo_lu_fsm.c */
 	vlr_lu_fsm_init();
 	/* vlr_access_request_fsm.c */
@@ -1325,18 +1271,15 @@ struct vlr_instance *vlr_alloc(void *ctx, const struct vlr_ops *ops)
 	return vlr;
 }
 
-int vlr_start(struct ipaccess_unit *ipa_dev, struct vlr_instance *vlr,
-	      const char *gsup_server_addr_str, uint16_t gsup_server_port)
+int vlr_start(struct vlr_instance *vlr, struct gsup_client_mux *gcm)
 {
 	OSMO_ASSERT(vlr);
 
-	vlr->gsup_client = osmo_gsup_client_create2(vlr, ipa_dev,
-						    gsup_server_addr_str,
-						    gsup_server_port,
-						    &vlr_gsupc_read_cb, NULL);
-	if (!vlr->gsup_client)
-		return -ENOMEM;
-	vlr->gsup_client->data = vlr;
+	vlr->gcm = gcm;
+	gcm->rx_cb[OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT] = (struct gsup_client_mux_rx_cb){
+		.func = vlr_gsup_rx,
+		.data = vlr,
+	};
 
 	osmo_timer_setup(&vlr->lu_expire_timer, vlr_subscr_expire_lu, vlr);
 	osmo_timer_schedule(&vlr->lu_expire_timer, VLR_SUBSCRIBER_LU_EXPIRATION_INTERVAL, 0);
@@ -1383,14 +1326,13 @@ int vlr_subscr_rx_auth_resp(struct vlr_subscr *vsub, bool is_r99,
 }
 
 /* MSC->VLR: Receive result of Ciphering Mode Command from MS */
-void vlr_subscr_rx_ciph_res(struct vlr_subscr *vsub, struct vlr_ciph_result *res)
+void vlr_subscr_rx_ciph_res(struct vlr_subscr *vsub, enum vlr_ciph_result_cause result)
 {
 	if (vsub->lu_fsm && vsub->lu_fsm->state == VLR_ULA_S_WAIT_CIPH)
-		osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_CIPH_RES, res);
+		osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_CIPH_RES, &result);
 	if (vsub->proc_arq_fsm
 	    && vsub->proc_arq_fsm->state == PR_ARQ_S_WAIT_CIPH)
-		osmo_fsm_inst_dispatch(vsub->proc_arq_fsm, PR_ARQ_E_CIPH_RES,
-				       res);
+		osmo_fsm_inst_dispatch(vsub->proc_arq_fsm, PR_ARQ_E_CIPH_RES, &result);
 }
 
 /* Internal evaluation of requested ciphering mode.