gb: Add beginnings of a new BSSGP implementation

Similar to ns2 superseding ns, we now also intoduce a next generation
of BSSGP related code to libosmogb.  However, this is not aiming to
be a full implementation yet, but simply those parts that we currently
need from the revamped osmo-gbproxy.

The gprs_bssgp2.[ch] differs in two ways from the old code:
* it separates message encoding from message transmission
* it supports more recent specs / IEs

bssgp_bvc_fsm.c is a genric implementation of the BSSGP BVC
RESET/BLOCK/UNBLOCK logic with support for both PTP and signaling,
both on the SGSN side and the BSS side.

Change-Id: Icbe8e4f03b68fd73b8eae95f6f6cccd4fa9af95a

7 files changed, 1139 insertions, 0 deletions

diff --git a/include/Makefile.am b/include/Makefile.am
index f67e1ad6..0cb9cd28 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -64,7 +64,9 @@ nobase_include_HEADERS = \
 		       osmocom/ctrl/control_if.h \
 		       osmocom/ctrl/ports.h \
                        osmocom/gprs/frame_relay.h \
+                       osmocom/gprs/bssgp_bvc_fsm.h \
                        osmocom/gprs/gprs_bssgp.h \
+                       osmocom/gprs/gprs_bssgp2.h \
                        osmocom/gprs/gprs_bssgp_bss.h \
                        osmocom/gprs/gprs_msgb.h \
                        osmocom/gprs/gprs_ns.h \
diff --git a/include/osmocom/gprs/bssgp_bvc_fsm.h b/include/osmocom/gprs/bssgp_bvc_fsm.h
new file mode 100644
index 00000000..7c6fdeb0
--- /dev/null
+++ b/include/osmocom/gprs/bssgp_bvc_fsm.h
@@ -0,0 +1,61 @@
+#pragma once
+#include <stdint.h>
+
+struct gprs_ns2_inst;
+struct osmo_fsm_inst;
+struct gprs_ra_id;
+
+enum bssp_ptp_bvc_fsm_state {
+	BSSGP_BVCFSM_S_NULL,
+	BSSGP_BVCFSM_S_BLOCKED,
+	BSSGP_BVCFSM_S_WAIT_RESET_ACK,
+	BSSGP_BVCFSM_S_UNBLOCKED,
+};
+
+enum bssgp_ptp_bvc_fsm_event {
+	/* Rx of BSSGP PDUs from the remote side; 'data' is 'struct tlv_parsed', and
+	 * the assumption is that the caller has already validated all mandatory IEs
+	 * are present and of sufficient length */
+	BSSGP_BVCFSM_E_RX_BLOCK,
+	BSSGP_BVCFSM_E_RX_BLOCK_ACK,
+	BSSGP_BVCFSM_E_RX_UNBLOCK,
+	BSSGP_BVCFSM_E_RX_UNBLOCK_ACK,
+	BSSGP_BVCFSM_E_RX_RESET,
+	BSSGP_BVCFSM_E_RX_RESET_ACK,
+	/* Requests of the local user */
+	BSSGP_BVCFSM_E_REQ_BLOCK,	/* data: uint8_t *cause */
+	BSSGP_BVCFSM_E_REQ_UNBLOCK,
+	BSSGP_BVCFSM_E_REQ_RESET,	/* data: uint8_t *cause */
+};
+
+struct bssgp_bvc_fsm_ops {
+	/* call-back notifying the user of a state change */
+	void (*state_chg_notification)(uint16_t nsei, uint16_t bvci, int old_state, int new_state,
+					void *priv);
+	/* call-back notifying the user of a BVC-RESET event */
+	void (*reset_notification)(uint16_t nsei, uint16_t bvci, const struct gprs_ra_id *ra_id,
+				   uint16_t cell_id, uint8_t cause, void *priv);
+};
+
+struct osmo_fsm_inst *
+bssgp_bvc_fsm_alloc_sig_bss(void *ctx, struct gprs_ns2_inst *nsi, uint16_t nsei, uint32_t features);
+
+struct osmo_fsm_inst *
+bssgp_bvc_fsm_alloc_ptp_bss(void *ctx, struct gprs_ns2_inst *nsi, uint16_t nsei, uint16_t bvci,
+			    const struct gprs_ra_id *ra_id, uint16_t cell_id);
+
+struct osmo_fsm_inst *
+bssgp_bvc_fsm_alloc_sig_sgsn(void *ctx, struct gprs_ns2_inst *nsi, uint16_t nsei, uint32_t features);
+
+struct osmo_fsm_inst *
+bssgp_bvc_fsm_alloc_ptp_sgsn(void *ctx, struct gprs_ns2_inst *nsi, uint16_t nsei, uint16_t bvci);
+
+void bssgp_bvc_fsm_set_ops(struct osmo_fsm_inst *fi, const struct bssgp_bvc_fsm_ops *ops, void *ops_priv);
+
+bool bssgp_bvc_fsm_is_unblocked(struct osmo_fsm_inst *fi);
+
+uint8_t bssgp_bvc_fsm_get_block_cause(struct osmo_fsm_inst *fi);
+
+uint32_t bssgp_bvc_get_features_advertised(struct osmo_fsm_inst *fi);
+uint32_t bssgp_bvc_get_features_received(struct osmo_fsm_inst *fi);
+uint32_t bssgp_bvc_get_features_negotiated(struct osmo_fsm_inst *fi);
diff --git a/include/osmocom/gprs/gprs_bssgp2.h b/include/osmocom/gprs/gprs_bssgp2.h
new file mode 100644
index 00000000..0ab36191
--- /dev/null
+++ b/include/osmocom/gprs/gprs_bssgp2.h
@@ -0,0 +1,31 @@
+#pragma once
+#include <stdint.h>
+
+#include <osmocom/gprs/protocol/gsm_08_18.h>
+#include <osmocom/gprs/gprs_ns2.h>
+
+struct gprs_ns2_inst;
+struct gprs_ra_id;
+struct msgb;
+
+int bssgp2_nsi_tx_ptp(struct gprs_ns2_inst *nsi, uint16_t nsei, uint16_t bvci,
+		      struct msgb *msg, uint32_t lsp);
+
+int bssgp2_nsi_tx_sig(struct gprs_ns2_inst *nsi, uint16_t nsei, struct msgb *msg, uint32_t lsp);
+
+struct msgb *bssgp2_enc_bvc_block(uint16_t bvci, enum gprs_bssgp_cause cause);
+
+struct msgb *bssgp2_enc_bvc_block_ack(uint16_t bvci);
+
+struct msgb *bssgp2_enc_bvc_unblock(uint16_t bvci);
+
+struct msgb *bssgp2_enc_bvc_unblock_ack(uint16_t bvci);
+
+struct msgb *bssgp2_enc_bvc_reset(uint16_t bvci, enum gprs_bssgp_cause cause,
+				  const struct gprs_ra_id *ra_id, uint16_t cell_id,
+				  const uint8_t *feat_bm, const uint8_t *ext_feat_bm);
+
+struct msgb *bssgp2_enc_bvc_reset_ack(uint16_t bvci, const struct gprs_ra_id *ra_id, uint16_t cell_id,
+				      const uint8_t *feat_bm, const uint8_t *ext_feat_bm);
+
+struct msgb *bssgp2_enc_status(uint8_t cause, const uint16_t *bvci, const struct msgb *orig_msg);
diff --git a/src/gb/Makefile.am b/src/gb/Makefile.am
index b1407275..ea1cfde7 100644
--- a/src/gb/Makefile.am
+++ b/src/gb/Makefile.am
@@ -26,6 +26,7 @@ libosmogb_la_SOURCES = gprs_ns.c gprs_ns_frgre.c gprs_ns_vty.c gprs_ns_sns.c \
 		  gprs_bssgp_bss.c \
 		  gprs_ns2.c gprs_ns2_udp.c gprs_ns2_frgre.c gprs_ns2_fr.c gprs_ns2_vc_fsm.c gprs_ns2_sns.c \
 		  gprs_ns2_message.c gprs_ns2_vty.c \
+		  gprs_bssgp2.c bssgp_bvc_fsm.c \
 		  common_vty.c frame_relay.c
 endif
 
diff --git a/src/gb/bssgp_bvc_fsm.c b/src/gb/bssgp_bvc_fsm.c
new file mode 100644
index 00000000..d134acbb
--- /dev/null
+++ b/src/gb/bssgp_bvc_fsm.c
@@ -0,0 +1,783 @@
+/* BSSGP per-BVC Finite State Machine */
+
+/* (C) 2020 Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <string.h>
+#include <stdio.h>
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/tdef.h>
+
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/gsm/tlv.h>
+
+#include <osmocom/gprs/gprs_msgb.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_bssgp2.h>
+#include <osmocom/gprs/bssgp_bvc_fsm.h>
+
+#include "common_vty.h"
+
+#define S(x)	(1 << (x))
+
+/* TODO: Those are not made cofnigurable via a VTY yet */
+struct osmo_tdef bssgp_bvc_fsm_tdefs[] = {
+	{
+		.T = 1,
+		.default_val = 5,
+		.min_val = 1,
+		.max_val = 30,
+		.unit = OSMO_TDEF_S,
+		.desc = "Guards the BSSGP BVC (un)blocking procedure",
+	}, {
+		.T = 2,
+		.default_val = 10,
+		.min_val = 1,
+		.max_val = 120,
+		.unit = OSMO_TDEF_S,
+		.desc = "Guards the BSSGP BVC reset procedure",
+	}, {
+		.T = 3,
+		.default_val = 500,
+		.min_val = 100,
+		.max_val = 10000,
+		.unit = OSMO_TDEF_MS,
+		.desc = "Guards the BSSGP SUSPEND procedure",
+	}, {
+		.T = 4,
+		.default_val = 500,
+		.min_val = 100,
+		.max_val = 10000,
+		.unit = OSMO_TDEF_MS,
+		.desc = "Guards the BSSGP RESUME procedure",
+	}, {
+		.T = 5,
+		.default_val = 15,
+		.min_val = 1,
+		.max_val = 30,
+		.unit = OSMO_TDEF_S,
+		.desc = "Guards the BSSGP Radio Access Capability Update procedure",
+	},
+	{}
+};
+
+#define T1	1
+#define T2	2
+
+/* We cannot use osmo_tdef_fsm_* as it makes hard-coded assumptions that
+ * each new/target state will always use the same timer and timeout - or
+ * a timeout at all */
+#define T1_SECS	osmo_tdef_get(bssgp_bvc_fsm_tdefs, 1, OSMO_TDEF_S, 5)
+#define T2_SECS	osmo_tdef_get(bssgp_bvc_fsm_tdefs, 2, OSMO_TDEF_S, 10)
+
+/* forward declaration */
+static struct osmo_fsm bssgp_bvc_fsm;
+
+static const struct value_string ptp_bvc_event_names[] = {
+	{ BSSGP_BVCFSM_E_RX_BLOCK, "RX-BVC-BLOCK" },
+	{ BSSGP_BVCFSM_E_RX_BLOCK_ACK, "RX-BVC-BLOCK-ACK" },
+	{ BSSGP_BVCFSM_E_RX_UNBLOCK, "RX-BVC-UNBLOCK" },
+	{ BSSGP_BVCFSM_E_RX_UNBLOCK_ACK, "RX-BVC-UNBLOCK-ACK" },
+	{ BSSGP_BVCFSM_E_RX_RESET, "RX-BVC-RESET" },
+	{ BSSGP_BVCFSM_E_RX_RESET_ACK, "RX-BVC-RESET-ACK" },
+	{ BSSGP_BVCFSM_E_REQ_BLOCK, "REQ-BLOCK" },
+	{ BSSGP_BVCFSM_E_REQ_UNBLOCK, "REQ-UNBLOCK" },
+	{ BSSGP_BVCFSM_E_REQ_RESET, "REQ-RESET" },
+	{ 0, NULL }
+};
+
+struct bvc_fsm_priv {
+	/* NS-instance; defining the scope for NSEI below */
+	struct gprs_ns2_inst *nsi;
+
+	/* NSEI of the underlying NS Entity */
+	uint16_t nsei;
+
+	/* BVCI of this BVC */
+	uint16_t bvci;
+
+	/* are we the SGSN (true) or the BSS (false) */
+	bool role_sgsn;
+
+	/* BSS side: are we locally marked blocked? */
+	bool locally_blocked;
+	uint8_t block_cause;
+
+	/* cause value of the last outbound BVC-RESET (for re-transmissions) */
+	uint8_t last_reset_cause;
+
+	struct {
+		/* Bit 0..7: Features; Bit 8..15: Extended Features */
+		uint32_t advertised;
+		uint32_t received;
+		uint32_t negotiated;
+	} features;
+
+	/* Cell Identification used by BSS when
+	 * transmitting BVC-RESET / BVC-RESET-ACK, or those received
+	 * from BSS in SGSN role */
+	struct gprs_ra_id ra_id;
+	uint16_t cell_id;
+
+	/* call-backs provided by the user */
+	const struct bssgp_bvc_fsm_ops *ops;
+	/* private data pointer passed to each call-back invocation */
+	void *ops_priv;
+};
+
+static int fi_tx_ptp(struct osmo_fsm_inst *fi, struct msgb *msg)
+{
+	struct bssgp_normal_hdr *bgph = (struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	struct bvc_fsm_priv *bfp = fi->priv;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+
+	LOGPFSM(fi, "Tx BSSGP %s\n", osmo_tlv_prot_msg_name(&osmo_pdef_bssgp, bgph->pdu_type));
+
+	return bssgp2_nsi_tx_ptp(bfp->nsi, bfp->nsei, bfp->bvci, msg, 0);
+}
+
+static int fi_tx_sig(struct osmo_fsm_inst *fi, struct msgb *msg)
+{
+	struct bssgp_normal_hdr *bgph = (struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	struct bvc_fsm_priv *bfp = fi->priv;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+
+	LOGPFSM(fi, "Tx BSSGP %s\n", osmo_tlv_prot_msg_name(&osmo_pdef_bssgp, bgph->pdu_type));
+
+	return bssgp2_nsi_tx_sig(bfp->nsi, bfp->nsei, msg, 0);
+}
+
+/* helper function to transmit BVC-RESET with right combination of conditional/optional IEs */
+static void _tx_bvc_reset(struct osmo_fsm_inst *fi, uint8_t cause)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+	const uint8_t *features = NULL;
+	const uint8_t *features_ext = NULL;
+	uint8_t _features[2] = {
+		(bfp->features.advertised >> 0) & 0xff,
+		(bfp->features.advertised >> 8) & 0xff,
+	};
+	struct msgb *tx;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+
+	/* transmit BVC-RESET to peer; RA-ID only present for PTP from BSS */
+	if (bfp->bvci == 0) {
+		features = &_features[0];
+		features_ext = &_features[1];
+	}
+	tx = bssgp2_enc_bvc_reset(bfp->bvci, cause,
+				  bfp->bvci && !bfp->role_sgsn ? &bfp->ra_id : NULL,
+				  bfp->cell_id, features, features_ext);
+	fi_tx_sig(fi, tx);
+}
+
+/* helper function to transmit BVC-RESET-ACK with right combination of conditional/optional IEs */
+static void _tx_bvc_reset_ack(struct osmo_fsm_inst *fi)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+	const uint8_t *features = NULL;
+	const uint8_t *features_ext = NULL;
+	uint8_t _features[2] = {
+		(bfp->features.advertised >> 0) & 0xff,
+		(bfp->features.advertised >> 8) & 0xff,
+	};
+	struct msgb *tx;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+
+	/* transmit BVC-RESET-ACK to peer; RA-ID only present for PTP from BSS -> SGSN */
+	if (bfp->bvci == 0) {
+		features = &_features[0];
+		features_ext = &_features[1];
+	}
+	tx = bssgp2_enc_bvc_reset_ack(bfp->bvci, bfp->bvci && !bfp->role_sgsn ? &bfp->ra_id : NULL,
+				     bfp->cell_id, features, features_ext);
+	fi_tx_sig(fi, tx);
+}
+
+/* helper function to transmit BVC-STATUS with right combination of conditional/optional IEs */
+static void _tx_status(struct osmo_fsm_inst *fi, enum gprs_bssgp_cause cause, const struct msgb *rx)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+	struct msgb *tx;
+	uint16_t *bvci = NULL;
+
+	/* GSM 08.18, 10.4.14.1: The BVCI must be included if (and only if) the
+	 * cause is either "BVCI blocked" or "BVCI unknown" */
+	if (cause == BSSGP_CAUSE_UNKNOWN_BVCI || cause == BSSGP_CAUSE_BVCI_BLOCKED)
+		bvci = &bfp->bvci;
+
+	tx = bssgp2_enc_status(cause, bvci, rx);
+
+	if (msgb_bvci(rx) == 0)
+		fi_tx_sig(fi, tx);
+	else
+		fi_tx_ptp(fi, tx);
+}
+
+/* Update the features by bit-wise AND of advertised + received features */
+static void update_negotiated_features(struct osmo_fsm_inst *fi, const struct tlv_parsed *tp)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+
+	bfp->features.received = 0;
+
+	if (TLVP_PRES_LEN(tp, BSSGP_IE_FEATURE_BITMAP, 1))
+		bfp->features.received |= *TLVP_VAL(tp, BSSGP_IE_FEATURE_BITMAP);
+
+	if (TLVP_PRES_LEN(tp, BSSGP_IE_EXT_FEATURE_BITMAP, 1))
+		bfp->features.received |= (*TLVP_VAL(tp, BSSGP_IE_EXT_FEATURE_BITMAP) << 8);
+
+	bfp->features.negotiated = bfp->features.advertised & bfp->features.received;
+
+	LOGPFSML(fi, LOGL_NOTICE, "Updating features: Advertised 0x%04x, Received 0x%04x, Negotiated 0x%04x\n",
+		 bfp->features.advertised, bfp->features.received, bfp->features.negotiated);
+}
+
+/* "tail" of each onenter() handler: Calling the state change notification call-back */
+static void _onenter_tail(struct osmo_fsm_inst *fi, uint32_t prev_state)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+
+	if (prev_state == fi->state)
+		return;
+
+	if (bfp->ops && bfp->ops->state_chg_notification)
+		bfp->ops->state_chg_notification(bfp->nsei, bfp->bvci, prev_state, fi->state, bfp->ops_priv);
+}
+
+static void bssgp_bvc_fsm_null(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	/* we don't really expect anything in this state; all handled via allstate */
+	OSMO_ASSERT(0);
+}
+
+static void bssgp_bvc_fsm_blocked_onenter(struct osmo_fsm_inst *fi, uint32_t prev_state)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+	/* signaling BVC can never be blocked */
+	OSMO_ASSERT(bfp->bvci != 0);
+	_onenter_tail(fi, prev_state);
+}
+
+static void bssgp_bvc_fsm_blocked(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+	struct msgb *rx = NULL, *tx;
+	const struct tlv_parsed *tp = NULL;
+	uint8_t cause;
+
+	switch (event) {
+	case BSSGP_BVCFSM_E_RX_BLOCK_ACK:
+		rx = data;
+		tp = (const struct tlv_parsed *) msgb_bcid(rx);
+		/* If a BVC-BLOCK-ACK PDU is received by a BSS for the signalling BVC, the PDU is ignored. */
+		if (bfp->bvci == 0) {
+			LOGPFSML(fi, LOGL_ERROR, "Rx BVC-BLOCK-ACK on BVCI=0 is illegal\n");
+			if (!bfp->role_sgsn)
+				break;
+			_tx_status(fi, BSSGP_CAUSE_SEM_INCORR_PDU, rx);
+			break;
+		}
+		/* stop T1 timer */
+		osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_BLOCKED, 0, 0);
+		break;
+	case BSSGP_BVCFSM_E_RX_BLOCK:
+		rx = data;
+		tp = (const struct tlv_parsed *) msgb_bcid(rx);
+		cause = *TLVP_VAL(tp, BSSGP_IE_CAUSE);
+		LOGPFSML(fi, LOGL_NOTICE, "Rx BVC-BLOCK (cause=%s)\n", bssgp_cause_str(cause));
+		/* If a BVC-BLOCK PDU is received by an SGSN for a blocked BVC, a BVC-BLOCK-ACK
+		 * PDU shall be returned. */
+		if (bfp->role_sgsn) {
+			/* If a BVC-BLOCK PDU is received by an SGSN for
+			 * the signalling BVC, the PDU is ignored */
+			if (bfp->bvci == 0)
+				break;
+			tx = bssgp2_enc_bvc_block_ack(bfp->bvci);
+			fi_tx_sig(fi, tx);
+		}
+		break;
+	case BSSGP_BVCFSM_E_RX_UNBLOCK:
+		rx = data;
+		tp = (const struct tlv_parsed *) msgb_bcid(rx);
+		LOGPFSML(fi, LOGL_NOTICE, "Rx BVC-UNBLOCK\n");
+		if (bfp->bvci == 0) {
+			LOGPFSML(fi, LOGL_ERROR, "Rx BVC-UNBLOCK on BVCI=0 is illegal\n");
+			/* If BVC-UNBLOCK PDU is received by an SGSN for the signalling BVC, the PDU is ignored.*/
+			if (bfp->role_sgsn)
+				break;
+			_tx_status(fi, BSSGP_CAUSE_SEM_INCORR_PDU, rx);
+			break;
+		}
+		if (!bfp->role_sgsn) {
+			LOGPFSML(fi, LOGL_ERROR, "Rx BVC-UNBLOCK on BSS is illegal\n");
+			_tx_status(fi, BSSGP_CAUSE_SEM_INCORR_PDU, rx);
+			break;
+		}
+		tx = bssgp2_enc_bvc_unblock_ack(bfp->bvci);
+		fi_tx_sig(fi, tx);
+		osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_UNBLOCKED, T1_SECS, T1);
+		break;
+	case BSSGP_BVCFSM_E_REQ_UNBLOCK:
+		if (bfp->role_sgsn) {
+			LOGPFSML(fi, LOGL_ERROR, "SGSN side cannot initiate BVC unblock\n");
+			break;
+		}
+		if (bfp->bvci == 0) {
+			LOGPFSML(fi, LOGL_ERROR, "BVCI 0 cannot be unblocked\n");
+			break;
+		}
+		bfp->locally_blocked = false;
+		tx = bssgp2_enc_bvc_unblock(bfp->bvci);
+		fi_tx_sig(fi, tx);
+		osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_UNBLOCKED, 0, 0);
+		break;
+	}
+}
+
+/* Waiting for RESET-ACK: Receive PDUs but don't transmit */
+static void bssgp_bvc_fsm_wait_reset_ack(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+	const struct tlv_parsed *tp = NULL;
+	struct msgb *rx = NULL, *tx;
+
+	switch (event) {
+	case BSSGP_BVCFSM_E_RX_RESET_ACK:
+		rx = data;
+		tp = (const struct tlv_parsed *) msgb_bcid(rx);
+		if (bfp->bvci == 0)
+			update_negotiated_features(fi, tp);
+		if (bfp->role_sgsn && bfp->bvci != 0)
+			bfp->cell_id = bssgp_parse_cell_id(&bfp->ra_id, TLVP_VAL(tp, BSSGP_IE_CELL_ID));
+		if (!bfp->role_sgsn && bfp->bvci != 0 && bfp->locally_blocked) {
+			/* initiate the blocking procedure */
+			/* transmit BVC-BLOCK, transition to BLOCKED state and start re-transmit timer */
+			tx = bssgp2_enc_bvc_block(bfp->bvci, bfp->block_cause);
+			fi_tx_sig(fi, tx);
+			osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_BLOCKED, T1_SECS, T1);
+		} else
+			osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_UNBLOCKED, 0, 0);
+		break;
+	}
+}
+
+static void bssgp_bvc_fsm_unblocked(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+	const struct tlv_parsed *tp = NULL;
+	struct msgb *rx = NULL, *tx;
+
+	switch (event) {
+	case BSSGP_BVCFSM_E_RX_UNBLOCK_ACK:
+		rx = data;
+		tp = (const struct tlv_parsed *) msgb_bcid(rx);
+		/* If BVC-UNBLOCK-ACK PDU is received by an BSS for the signalling BVC, the PDU is ignored. */
+		LOGPFSML(fi, LOGL_ERROR, "Rx BVC-UNBLOCK-ACK on BVCI=0 is illegal\n");
+		if (bfp->bvci == 0) {
+			if (!bfp->role_sgsn)
+				break;
+			_tx_status(fi, BSSGP_CAUSE_SEM_INCORR_PDU, rx);
+			break;
+		}
+		/* stop T1 timer */
+		osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_UNBLOCKED, 0, 0);
+		break;
+	case BSSGP_BVCFSM_E_RX_UNBLOCK:
+		rx = data;
+		tp = (const struct tlv_parsed *) msgb_bcid(rx);
+		/* If a BVC-UNBLOCK PDU is received by an SGSN for a blocked BVC, a BVC-UNBLOCK-ACK
+		 * PDU shall be returned. */
+		if (bfp->role_sgsn) {
+			/* If a BVC-UNBLOCK PDU is received by an SGSN for
+			 * the signalling BVC, the PDU is ignored */
+			if (bfp->bvci == 0)
+				break;
+			bssgp_tx_simple_bvci(BSSGP_PDUT_BVC_UNBLOCK_ACK, bfp->nsei, bfp->bvci, 0);
+		}
+		break;
+	case BSSGP_BVCFSM_E_RX_BLOCK:
+		rx = data;
+		tp = (const struct tlv_parsed *) msgb_bcid(rx);
+		LOGPFSML(fi, LOGL_NOTICE, "Rx BVC-BLOCK (cause=%s)\n",
+			 bssgp_cause_str(*TLVP_VAL(tp, BSSGP_IE_CAUSE)));
+		/* If a BVC-BLOCK PDU is received by an SGSN for the signalling BVC, the PDU is ignored */
+		if (bfp->bvci == 0) {
+			LOGPFSML(fi, LOGL_ERROR, "Rx BVC-BLOCK on BVCI=0 is illegal\n");
+			if (bfp->role_sgsn)
+				break;
+			_tx_status(fi, BSSGP_CAUSE_SEM_INCORR_PDU, rx);
+			break;
+		}
+		if (!bfp->role_sgsn) {
+			LOGPFSML(fi, LOGL_ERROR, "Rx BVC-BLOCK on BSS is illegal\n");
+			_tx_status(fi, BSSGP_CAUSE_SEM_INCORR_PDU, rx);
+			break;
+		}
+		/* transmit BVC-BLOCK-ACK, transition to BLOCKED state */
+		tx = bssgp2_enc_bvc_block_ack(bfp->bvci);
+		fi_tx_sig(fi, tx);
+		osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_BLOCKED, 0, 0);
+		break;
+	case BSSGP_BVCFSM_E_REQ_BLOCK:
+		if (bfp->role_sgsn) {
+			LOGPFSML(fi, LOGL_ERROR, "SGSN may not initiate BVC-BLOCK\n");
+			_tx_status(fi, BSSGP_CAUSE_SEM_INCORR_PDU, rx);
+			break;
+		}
+		bfp->locally_blocked = true;
+		bfp->block_cause = *(uint8_t *)data;
+		/* transmit BVC-BLOCK, transition to BLOCKED state and start re-transmit timer */
+		tx = bssgp2_enc_bvc_block(bfp->bvci, bfp->block_cause);
+		fi_tx_sig(fi, tx);
+		osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_BLOCKED, T1_SECS, T1);
+		break;
+	}
+}
+
+static void bssgp_bvc_fsm_allstate(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+	uint8_t cause;
+	const struct tlv_parsed *tp = NULL;
+	struct msgb *rx = NULL;
+
+	switch (event) {
+	case BSSGP_BVCFSM_E_REQ_RESET:
+		bfp->locally_blocked = false;
+		cause = bfp->last_reset_cause = *(uint8_t *) data;
+		_tx_bvc_reset(fi, cause);
+		osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_WAIT_RESET_ACK, T2_SECS, T2);
+#if 0 /* not sure if we really should notify the application if itself has requested the reset? */
+		if (bfp->ops && bfp->ops->reset_notification)
+			bfp->ops->reset_notification(bfp->nsei, bfp->bvci, NULL, 0, cause, bfp->ops_priv);
+#endif
+		break;
+	case BSSGP_BVCFSM_E_RX_RESET:
+		rx = data;
+		tp = (const struct tlv_parsed *) msgb_bcid(rx);
+		cause = *TLVP_VAL(tp, BSSGP_IE_CAUSE);
+		if (bfp->role_sgsn && bfp->bvci != 0)
+			bfp->cell_id = bssgp_parse_cell_id(&bfp->ra_id, TLVP_VAL(tp, BSSGP_IE_CELL_ID));
+		LOGPFSML(fi, LOGL_NOTICE, "Rx BVC-RESET (cause=%s)\n", bssgp_cause_str(cause));
+		if (bfp->bvci == 0)
+			update_negotiated_features(fi, tp);
+		_tx_bvc_reset_ack(fi);
+		osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_UNBLOCKED, 0, 0);
+		if (bfp->ops && bfp->ops->reset_notification) {
+			bfp->ops->reset_notification(bfp->nsei, bfp->bvci, &bfp->ra_id, bfp->cell_id,
+						     cause, bfp->ops_priv);
+		}
+		break;
+	}
+}
+
+static int bssgp_bvc_fsm_timer_cb(struct osmo_fsm_inst *fi)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+	struct msgb *tx;
+
+	switch (fi->T) {
+	case T1:
+		switch (fi->state) {
+		case BSSGP_BVCFSM_S_BLOCKED:
+			/* re-transmit BVC-BLOCK */
+			tx = bssgp2_enc_bvc_block(bfp->bvci, bfp->block_cause);
+			fi_tx_sig(fi, tx);
+			osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_BLOCKED, T1_SECS, T1);
+			break;
+		case BSSGP_BVCFSM_S_UNBLOCKED:
+			/* re-transmit BVC-UNBLOCK */
+			tx = bssgp2_enc_bvc_unblock(bfp->bvci);
+			fi_tx_sig(fi, tx);
+			osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_UNBLOCKED, T1_SECS, T1);
+			break;
+		}
+		break;
+	case T2:
+		switch (fi->state) {
+		case BSSGP_BVCFSM_S_WAIT_RESET_ACK:
+			/* re-transmit BVC-RESET */
+			_tx_bvc_reset(fi, bfp->last_reset_cause);
+			osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_WAIT_RESET_ACK, T2_SECS, T2);
+			break;
+		case BSSGP_BVCFSM_S_UNBLOCKED:
+			/* re-transmit BVC-RESET-ACK */
+			_tx_bvc_reset_ack(fi);
+			osmo_fsm_inst_state_chg(fi, BSSGP_BVCFSM_S_UNBLOCKED, T2_SECS, T2);
+			break;
+		}
+		break;
+	default:
+		OSMO_ASSERT(0);
+		break;
+	}
+	return 0;
+}
+
+
+
+static const struct osmo_fsm_state bssgp_bvc_fsm_states[] = {
+	[BSSGP_BVCFSM_S_NULL] = {
+		/* initial state from which we must do a RESET */
+		.name = "NULL",
+		.in_event_mask = 0,
+		.out_state_mask = S(BSSGP_BVCFSM_S_WAIT_RESET_ACK) |
+				  S(BSSGP_BVCFSM_S_UNBLOCKED),
+		.action = bssgp_bvc_fsm_null,
+	},
+	[BSSGP_BVCFSM_S_BLOCKED] = {
+		.name = "BLOCKED",
+		.in_event_mask = S(BSSGP_BVCFSM_E_RX_UNBLOCK) |
+				 S(BSSGP_BVCFSM_E_RX_BLOCK) |
+				 S(BSSGP_BVCFSM_E_RX_BLOCK_ACK) |
+				 S(BSSGP_BVCFSM_E_REQ_UNBLOCK),
+		.out_state_mask = S(BSSGP_BVCFSM_S_WAIT_RESET_ACK) |
+				  S(BSSGP_BVCFSM_S_UNBLOCKED) |
+				  S(BSSGP_BVCFSM_S_BLOCKED),
+		.action = bssgp_bvc_fsm_blocked,
+		.onenter = bssgp_bvc_fsm_blocked_onenter,
+	},
+	[BSSGP_BVCFSM_S_WAIT_RESET_ACK]= {
+		.name = "WAIT_RESET_ACK",
+		.in_event_mask = S(BSSGP_BVCFSM_E_RX_RESET_ACK),
+		.out_state_mask = S(BSSGP_BVCFSM_S_UNBLOCKED) |
+				  S(BSSGP_BVCFSM_S_BLOCKED) |
+				  S(BSSGP_BVCFSM_S_WAIT_RESET_ACK),
+		.action = bssgp_bvc_fsm_wait_reset_ack,
+		.onenter = _onenter_tail,
+	},
+
+	[BSSGP_BVCFSM_S_UNBLOCKED] = {
+		.name = "UNBLOCKED",
+		.in_event_mask = S(BSSGP_BVCFSM_E_RX_BLOCK) |
+				 S(BSSGP_BVCFSM_E_RX_UNBLOCK) |
+				 S(BSSGP_BVCFSM_E_RX_UNBLOCK_ACK) |
+				 S(BSSGP_BVCFSM_E_REQ_BLOCK),
+		.out_state_mask = S(BSSGP_BVCFSM_S_BLOCKED) |
+				  S(BSSGP_BVCFSM_S_WAIT_RESET_ACK) |
+				  S(BSSGP_BVCFSM_S_UNBLOCKED),
+		.action = bssgp_bvc_fsm_unblocked,
+		.onenter = _onenter_tail,
+	},
+};
+
+static struct osmo_fsm bssgp_bvc_fsm = {
+	.name = "BSSGP-BVC",
+	.states = bssgp_bvc_fsm_states,
+	.num_states = ARRAY_SIZE(bssgp_bvc_fsm_states),
+	.allstate_event_mask = S(BSSGP_BVCFSM_E_REQ_RESET) |
+			       S(BSSGP_BVCFSM_E_RX_RESET),
+	.allstate_action = bssgp_bvc_fsm_allstate,
+	.timer_cb = bssgp_bvc_fsm_timer_cb,
+	.log_subsys = DLBSSGP,
+	.event_names = ptp_bvc_event_names,
+};
+
+static struct osmo_fsm_inst *
+_bvc_fsm_alloc(void *ctx, struct gprs_ns2_inst *nsi, bool role_sgsn, uint16_t nsei, uint16_t bvci)
+{
+	struct osmo_fsm_inst *fi;
+	struct bvc_fsm_priv *bfp;
+	char idbuf[64];
+
+	/* TODO: encode our role in the id string? */
+	snprintf(idbuf, sizeof(idbuf), "NSE%05u-BVC%05u", nsei, bvci);
+
+	fi = osmo_fsm_inst_alloc(&bssgp_bvc_fsm, ctx, NULL, LOGL_INFO, idbuf);
+	if (!fi)
+		return NULL;
+
+	bfp = talloc_zero(fi, struct bvc_fsm_priv);
+	if (!bfp) {
+		osmo_fsm_inst_free(fi);
+		return NULL;
+	}
+	fi->priv = bfp;
+
+	bfp->nsi = nsi;
+	bfp->role_sgsn = role_sgsn;
+	bfp->nsei = nsei;
+	bfp->bvci = bvci;
+
+	return fi;
+}
+
+/*! Allocate a SIGNALING-BVC FSM for the BSS role (facing a remote SGSN).
+ *  \param[in] ctx talloc context from which to allocate
+ *  \param[in] nsi NS Instance on which this BVC operates
+ *  \param[in] nsei NS Entity Identifier on which this BVC operates
+ *  \param[in] features Feature [byte 0] and Extended Feature [byte 1] bitmap
+ *  \returns newly-allocated FSM Instance; NULL in case of error */
+struct osmo_fsm_inst *
+bssgp_bvc_fsm_alloc_sig_bss(void *ctx, struct gprs_ns2_inst *nsi, uint16_t nsei, uint32_t features)
+{
+	struct osmo_fsm_inst *fi = _bvc_fsm_alloc(ctx, nsi, false, nsei, 0);
+	struct bvc_fsm_priv *bfp;
+
+	if (!fi)
+		return NULL;
+
+	bfp = fi->priv;
+	bfp->features.advertised = features;
+
+	return fi;
+}
+
+/*! Allocate a PTP-BVC FSM for the BSS role (facing a remote SGSN).
+ *  \param[in] ctx talloc context from which to allocate
+ *  \param[in] nsi NS Instance on which this BVC operates
+ *  \param[in] nsei NS Entity Identifier on which this BVC operates
+ *  \param[in] bvci BVCI of this FSM
+ *  \param[in] ra_id Routing Area Identity of the cell (reported to SGSN)
+ *  \param[in] cell_id Cell Identifier of the cell (reported to SGSN)
+ *  \returns newly-allocated FSM Instance; NULL in case of error */
+struct osmo_fsm_inst *
+bssgp_bvc_fsm_alloc_ptp_bss(void *ctx, struct gprs_ns2_inst *nsi, uint16_t nsei,
+			    uint16_t bvci, const struct gprs_ra_id *ra_id, uint16_t cell_id)
+{
+	struct osmo_fsm_inst *fi;
+	struct bvc_fsm_priv *bfp;
+
+	OSMO_ASSERT(bvci >= 2);
+	OSMO_ASSERT(ra_id);
+
+	fi = _bvc_fsm_alloc(ctx, nsi, false, nsei, bvci);
+	if (!fi)
+		return NULL;
+
+	bfp = fi->priv;
+	bfp->ra_id = *ra_id;
+	bfp->cell_id = cell_id;
+
+	return fi;
+}
+
+/*! Allocate a SIGNALING-BVC FSM for the SGSN role (facing a remote BSS).
+ *  \param[in] ctx talloc context from which to allocate
+ *  \param[in] nsi NS Instance on which this BVC operates
+ *  \param[in] nsei NS Entity Identifier on which this BVC operates
+ *  \param[in] features Feature [byte 0] and Extended Feature [byte 1] bitmap
+ *  \returns newly-allocated FSM Instance; NULL in case of error */
+struct osmo_fsm_inst *
+bssgp_bvc_fsm_alloc_sig_sgsn(void *ctx, struct gprs_ns2_inst *nsi, uint16_t nsei, uint32_t features)
+{
+	struct osmo_fsm_inst *fi = _bvc_fsm_alloc(ctx, nsi, true, nsei, 0);
+	struct bvc_fsm_priv *bfp;
+
+	if (!fi)
+		return NULL;
+
+	bfp = fi->priv;
+	bfp->features.advertised = features;
+
+	return fi;
+}
+
+/*! Allocate a PTP-BVC FSM for the SGSN role (facing a remote BSS).
+ *  \param[in] ctx talloc context from which to allocate
+ *  \param[in] nsi NS Instance on which this BVC operates
+ *  \param[in] nsei NS Entity Identifier on which this BVC operates
+ *  \param[in] bvci BVCI of this FSM
+ *  \returns newly-allocated FSM Instance; NULL in case of error */
+struct osmo_fsm_inst *
+bssgp_bvc_fsm_alloc_ptp_sgsn(void *ctx, struct gprs_ns2_inst *nsi, uint16_t nsei, uint16_t bvci)
+{
+	struct osmo_fsm_inst *fi;
+
+	OSMO_ASSERT(bvci >= 2);
+
+	fi = _bvc_fsm_alloc(ctx, nsi, true, nsei, bvci);
+	if (!fi)
+		return NULL;
+
+	return fi;
+}
+
+/*! Set the 'operations' callbacks + private data.
+ *  \param[in] fi FSM instance for which the data shall be set
+ *  \param[in] ops BSSGP BVC FSM operations (call-back functions) to register
+ *  \param[in] ops_priv opaque/private data pointer passed through to call-backs */
+void bssgp_bvc_fsm_set_ops(struct osmo_fsm_inst *fi, const struct bssgp_bvc_fsm_ops *ops, void *ops_priv)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+
+	bfp->ops = ops;
+	bfp->ops_priv = ops_priv;
+}
+
+/*! Return if the given BVC FSM is in UNBLOCKED state. */
+bool bssgp_bvc_fsm_is_unblocked(struct osmo_fsm_inst *fi)
+{
+	return fi->state == BSSGP_BVCFSM_S_UNBLOCKED;
+}
+
+/*! Determine the cause value why given BVC FSM is blocked. */
+uint8_t bssgp_bvc_fsm_get_block_cause(struct osmo_fsm_inst *fi)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+	return bfp->block_cause;
+}
+
+/*! Return the advertised features / extended features. */
+uint32_t bssgp_bvc_get_features_advertised(struct osmo_fsm_inst *fi)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+	return bfp->features.advertised;
+}
+
+/*! Return the received features / extended features. */
+uint32_t bssgp_bvc_get_features_received(struct osmo_fsm_inst *fi)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+	return bfp->features.received;
+}
+
+/*! Return the negotiated features / extended features. */
+uint32_t bssgp_bvc_get_features_negotiated(struct osmo_fsm_inst *fi)
+{
+	struct bvc_fsm_priv *bfp = fi->priv;
+
+	OSMO_ASSERT(fi->fsm == &bssgp_bvc_fsm);
+	return bfp->features.negotiated;
+}
+
+static __attribute__((constructor)) void on_dso_load_bvc_fsm(void)
+{
+	osmo_fsm_register(&bssgp_bvc_fsm);
+}
diff --git a/src/gb/gprs_bssgp2.c b/src/gb/gprs_bssgp2.c
new file mode 100644
index 00000000..e741fb46
--- /dev/null
+++ b/src/gb/gprs_bssgp2.c
@@ -0,0 +1,240 @@
+/* BSSGP2 - second generation of BSSGP library */
+
+/* (C) 2020 Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/byteswap.h>
+#include <osmocom/core/msgb.h>
+
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/gsm/tlv.h>
+
+#include <osmocom/gprs/gprs_ns2.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_bssgp2.h>
+
+
+/*! transmit BSSGP PDU over NS (PTP BVC)
+ *  \param[in] nsi NS Instance through which to transmit
+ *  \param[in] nsei NSEI of NSE through which to transmit
+ *  \param[in] bvci BVCI through which to transmit
+ *  \param[in] msg BSSGP PDU to transmit
+ *  \returns 0 on success; negative on error */
+int bssgp2_nsi_tx_ptp(struct gprs_ns2_inst *nsi, uint16_t nsei, uint16_t bvci,
+		      struct msgb *msg, uint32_t lsp)
+{
+	struct osmo_gprs_ns2_prim nsp = {};
+	int rc;
+
+	if (!msg)
+		return 0;
+
+	nsp.bvci = bvci;
+	nsp.nsei = nsei;
+	nsp.u.unitdata.link_selector = lsp;
+
+	osmo_prim_init(&nsp.oph, SAP_NS, PRIM_NS_UNIT_DATA, PRIM_OP_REQUEST, msg);
+	rc = gprs_ns2_recv_prim(nsi, &nsp.oph);
+
+	return rc;
+}
+
+/*! transmit BSSGP PDU over NS (SIGNALING BVC)
+ *  \param[in] nsi NS Instance through which to transmit
+ *  \param[in] nsei NSEI of NSE through which to transmit
+ *  \param[in] msg BSSGP PDU to transmit
+ *  \returns 0 on success; negative on error */
+int bssgp2_nsi_tx_sig(struct gprs_ns2_inst *nsi, uint16_t nsei, struct msgb *msg, uint32_t lsp)
+{
+	return bssgp2_nsi_tx_ptp(nsi, nsei, 0, msg, lsp);
+}
+
+/*! Encode BSSGP BVC-BLOCK PDU as per TS 48.018 Section 10.4.8. */
+struct msgb *bssgp2_enc_bvc_block(uint16_t bvci, enum gprs_bssgp_cause cause)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph;
+	uint16_t _bvci = osmo_htons(bvci);
+
+	if (!msg)
+		return NULL;
+
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	bgph->pdu_type = BSSGP_PDUT_BVC_BLOCK;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, (uint8_t *) &cause);
+
+	return msg;
+}
+
+/*! Encode BSSGP BVC-BLOCK-ACK PDU as per TS 48.018 Section 10.4.9. */
+struct msgb *bssgp2_enc_bvc_block_ack(uint16_t bvci)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph;
+	uint16_t _bvci = osmo_htons(bvci);
+
+	if (!msg)
+		return NULL;
+
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	bgph->pdu_type = BSSGP_PDUT_BVC_BLOCK_ACK;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+
+	return msg;
+}
+
+/*! Encode BSSGP BVC-UNBLOCK PDU as per TS 48.018 Section 10.4.10. */
+struct msgb *bssgp2_enc_bvc_unblock(uint16_t bvci)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph;
+	uint16_t _bvci = osmo_htons(bvci);
+
+	if (!msg)
+		return NULL;
+
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	bgph->pdu_type = BSSGP_PDUT_BVC_UNBLOCK;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+
+	return msg;
+}
+
+/*! Encode BSSGP BVC-UNBLOCK-ACK PDU as per TS 48.018 Section 10.4.11. */
+struct msgb *bssgp2_enc_bvc_unblock_ack(uint16_t bvci)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph;
+	uint16_t _bvci = osmo_htons(bvci);
+
+	if (!msg)
+		return NULL;
+
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	bgph->pdu_type = BSSGP_PDUT_BVC_UNBLOCK_ACK;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+
+	return msg;
+}
+
+/*! Encode BSSGP BVC-RESET PDU as per TS 48.018 Section 10.4.12.
+ *  \param[in] bvci PTP BVCI to encode into the BVCI IE
+ *  \param[in] cause BSSGP Cause value (reason for reset)
+ *  \param[in] ra_id Routing Area ID to be encoded to CELL_ID IE (optional)
+ *  \param[in] cell_id Cell ID to be encoded to CELL_ID IE (only if ra_id is non-NULL)
+ *  \param[in] feat_bm Feature Bitmap (optional)
+ *  \param[in] ext_feat_bm Extended Feature Bitmap (optional) */
+struct msgb *bssgp2_enc_bvc_reset(uint16_t bvci, enum gprs_bssgp_cause cause,
+				  const struct gprs_ra_id *ra_id, uint16_t cell_id,
+				  const uint8_t *feat_bm, const uint8_t *ext_feat_bm)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph;
+	uint16_t _bvci = osmo_htons(bvci);
+
+	if (!msg)
+		return NULL;
+
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	bgph->pdu_type = BSSGP_PDUT_BVC_RESET;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, (uint8_t *) &cause);
+	if (ra_id) {
+		uint8_t bssgp_cid[8];
+		bssgp_create_cell_id(bssgp_cid, ra_id, cell_id);
+		msgb_tvlv_put(msg, BSSGP_IE_CELL_ID, sizeof(bssgp_cid), bssgp_cid);
+	}
+
+	if (feat_bm)
+		msgb_tvlv_put(msg, BSSGP_IE_FEATURE_BITMAP, 1, feat_bm);
+
+	if (ext_feat_bm)
+		msgb_tvlv_put(msg, BSSGP_IE_EXT_FEATURE_BITMAP, 1, feat_bm);
+
+	return msg;
+}
+
+/*! Encode BSSGP BVC-RESET-ACK PDU as per TS 48.018 Section 10.4.13.
+ *  \param[in] bvci PTP BVCI to encode into the BVCI IE
+ *  \param[in] ra_id Routing Area ID to be encoded to CELL_ID IE (optional)
+ *  \param[in] cell_id Cell ID to be encoded to CELL_ID IE (only if ra_id is non-NULL)
+ *  \param[in] feat_bm Feature Bitmap (optional)
+ *  \param[in] ext_feat_bm Extended Feature Bitmap (optional) */
+struct msgb *bssgp2_enc_bvc_reset_ack(uint16_t bvci, const struct gprs_ra_id *ra_id, uint16_t cell_id,
+				      const uint8_t *feat_bm, const uint8_t *ext_feat_bm)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph;
+	uint16_t _bvci = osmo_htons(bvci);
+
+	if (!msg)
+		return NULL;
+
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	bgph->pdu_type = BSSGP_PDUT_BVC_RESET_ACK;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	if (ra_id) {
+		uint8_t bssgp_cid[8];
+		bssgp_create_cell_id(bssgp_cid, ra_id, cell_id);
+		msgb_tvlv_put(msg, BSSGP_IE_CELL_ID, sizeof(bssgp_cid), bssgp_cid);
+	}
+
+	if (feat_bm)
+		msgb_tvlv_put(msg, BSSGP_IE_FEATURE_BITMAP, 1, feat_bm);
+
+	if (ext_feat_bm)
+		msgb_tvlv_put(msg, BSSGP_IE_EXT_FEATURE_BITMAP, 1, feat_bm);
+
+	return msg;
+}
+
+/*! Encode BSSGP STATUS PDU as per TS 48.018 Section 10.4.14.
+ *  \param[in] cause BSSGP Cause value
+ *  \param[in] bvci optional BVCI - only encoded if non-NULL
+ *  \param[in] msg optional message buffer containing PDU in error - only encoded if non-NULL */
+struct msgb *bssgp2_enc_status(uint8_t cause, const uint16_t *bvci, const struct msgb *orig_msg)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph;
+
+	if (!msg)
+		return NULL;
+
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	bgph->pdu_type = BSSGP_PDUT_STATUS;
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, &cause);
+	if (bvci) {
+		uint16_t _bvci = osmo_htons(*bvci);
+		msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	}
+	if (orig_msg)
+		msgb_tvlv_put(msg, BSSGP_IE_PDU_IN_ERROR, msgb_bssgp_len(orig_msg), msgb_bssgph(orig_msg));
+
+	return msg;
+}
diff --git a/src/gb/libosmogb.map b/src/gb/libosmogb.map
index 8abac74e..e605d27d 100644
--- a/src/gb/libosmogb.map
+++ b/src/gb/libosmogb.map
@@ -45,6 +45,27 @@ bssgp_tx_paging;
 bssgp_vty_init;
 bssgp_nsi;
 
+bssgp2_nsi_tx_ptp;
+bssgp2_nsi_tx_sig;
+bssgp2_enc_bvc_block;
+bssgp2_enc_bvc_block_ack;
+bssgp2_enc_bvc_unblock;
+bssgp2_enc_bvc_unblock_ack;
+bssgp2_enc_bvc_reset;
+bssgp2_enc_bvc_reset_ack;
+bssgp2_enc_status;
+
+bssgp_bvc_fsm_alloc_sig_bss;
+bssgp_bvc_fsm_alloc_ptp_bss;
+bssgp_bvc_fsm_alloc_sig_sgsn;
+bssgp_bvc_fsm_alloc_ptp_sgsn;
+bssgp_bvc_fsm_set_ops;
+bssgp_bvc_fsm_is_unblocked;
+bssgp_bvc_fsm_get_block_cause;
+bssgp_bvc_get_features_advertised;
+bssgp_bvc_get_features_received;
+bssgp_bvc_get_features_negotiated;
+
 osmo_fr_network_alloc;
 osmo_fr_link_alloc;
 osmo_fr_link_free;