Merge remote-tracking branch 'origin/master' into daniel/onwaves

Change-Id: I1c79a29092855f4859edf1451c5e2d3e77da8323

26 files changed, 1005 insertions, 347 deletions

diff --git a/src/coding/gsm0503_coding.c b/src/coding/gsm0503_coding.c
index c72aabc0..7385d233 100644
--- a/src/coding/gsm0503_coding.c
+++ b/src/coding/gsm0503_coding.c
@@ -938,6 +938,11 @@ int gsm0503_pdtch_egprs_decode(uint8_t *l2_data, const sbit_t *bursts, uint16_t
 	struct egprs_cps cps;
 	union gprs_rlc_ul_hdr_egprs *hdr;
 
+	if (n_errors)
+		*n_errors = 0;
+	if (n_bits_total)
+		*n_bits_total = 0;
+
 	if ((nbits != GSM0503_GPRS_BURSTS_NBITS) &&
 		(nbits != GSM0503_EGPRS_BURSTS_NBITS)) {
 		/* Invalid EGPRS bit length */
@@ -979,6 +984,9 @@ int gsm0503_pdtch_egprs_decode(uint8_t *l2_data, const sbit_t *bursts, uint16_t
 		if (rc < 0)
 			return -EFAULT;
 	} else {
+		/* Bit counters for the second block */
+		int n_errors2, n_bits_total2;
+
 		/* MCS-7,8,9 block 1 */
 		rc = egprs_decode_data(l2_data, c1, cps.mcs, cps.p[0],
 			0, n_errors, n_bits_total);
@@ -987,7 +995,11 @@ int gsm0503_pdtch_egprs_decode(uint8_t *l2_data, const sbit_t *bursts, uint16_t
 
 		/* MCS-7,8,9 block 2 */
 		rc = egprs_decode_data(l2_data, c2, cps.mcs, cps.p[1],
-			1, n_errors, n_bits_total);
+			1, &n_errors2, &n_bits_total2);
+		if (n_errors)
+			*n_errors += n_errors2;
+		if (n_bits_total)
+			*n_bits_total += n_bits_total2;
 		if (rc < 0)
 			return -EFAULT;
 	}
diff --git a/src/ctrl/control_if.c b/src/ctrl/control_if.c
index 5962f7eb..ed18a2fc 100644
--- a/src/ctrl/control_if.c
+++ b/src/ctrl/control_if.c
@@ -389,20 +389,44 @@ int ctrl_handle_msg(struct ctrl_handle *ctrl, struct ctrl_connection *ccon, stru
 	struct ipaccess_head_ext *iph_ext;
 	int result;
 
-	if (msg->len < sizeof(*iph) + sizeof(*iph_ext)) {
+	if (msg->len < sizeof(*iph)) {
 		LOGP(DLCTRL, LOGL_ERROR, "The message is too short.\n");
 		return -EINVAL;
 	}
-
 	iph = (struct ipaccess_head *) msg->data;
+	if (iph->proto == IPAC_PROTO_IPACCESS) {
+		uint8_t msg_type = *(msg->l2h);
+		switch (msg_type) {
+		case IPAC_MSGT_PING:
+			if (ipa_ccm_send_pong(ccon->write_queue.bfd.fd) < 0)
+				LOGP(DLINP, LOGL_ERROR, "Cannot send PONG message. Reason: %s\n", strerror(errno));
+			break;
+		case IPAC_MSGT_PONG:
+			break;
+		case IPAC_MSGT_ID_ACK:
+			if (ipa_ccm_send_id_ack(ccon->write_queue.bfd.fd) < 0)
+				LOGP(DLINP, LOGL_ERROR, "Cannot send ID_ACK message. Reason: %s\n", strerror(errno));
+			break;
+		default:
+			LOGP(DLCTRL, LOGL_DEBUG, "Received unhandled IPACCESS protocol message of type 0x%x: %s\n",
+			     msg_type, msgb_hexdump(msg));
+			break;
+		}
+		return 0;
+	}
 	if (iph->proto != IPAC_PROTO_OSMO) {
-		LOGP(DLCTRL, LOGL_ERROR, "Protocol mismatch. We got 0x%x\n", iph->proto);
+		LOGP(DLCTRL, LOGL_ERROR, "Protocol mismatch. Received protocol 0x%x message: %s\n",
+		     iph->proto, msgb_hexdump(msg));
+		return -EINVAL;
+	}
+	if (msg->len < sizeof(*iph) + sizeof(*iph_ext)) {
+		LOGP(DLCTRL, LOGL_ERROR, "The message is too short.\n");
 		return -EINVAL;
 	}
-
 	iph_ext = (struct ipaccess_head_ext *) iph->data;
 	if (iph_ext->proto != IPAC_PROTO_EXT_CTRL) {
-		LOGP(DLCTRL, LOGL_ERROR, "Extended protocol mismatch. We got 0x%x\n", iph_ext->proto);
+		LOGP(DLCTRL, LOGL_ERROR, "Extended protocol mismatch. Received protocol 0x%x message: %s\n",
+		     iph_ext->proto, msgb_hexdump(msg));
 		return -EINVAL;
 	}
 
diff --git a/src/fsm.c b/src/fsm.c
index b5af2e7a..1f6141fa 100644
--- a/src/fsm.c
+++ b/src/fsm.c
@@ -414,7 +414,7 @@ const char *osmo_fsm_inst_name(struct osmo_fsm_inst *fi)
 		return fi->fsm->name;
 }
 
-/*! get human-readable name of FSM instance
+/*! get human-readable name of FSM state
  *  \param[in] fsm FSM descriptor
  *  \param[in] state FSM state number
  *  \returns string rendering of the FSM state
diff --git a/src/gb/gprs_ns.c b/src/gb/gprs_ns.c
index 9b7cc056..1281c9f4 100644
--- a/src/gb/gprs_ns.c
+++ b/src/gb/gprs_ns.c
@@ -1413,8 +1413,16 @@ int gprs_ns_process_msg(struct gprs_ns_inst *nsi, struct msgb *msg,
 		/* Section 7.2: unblocking procedure */
 		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS UNBLOCK\n", (*nsvc)->nsei);
 		ns_mark_unblocked(*nsvc);
-		ns_osmo_signal_dispatch(*nsvc, S_NS_UNBLOCK, 0);
+		/* This UNBLOCK_ACK message will cause our peer to move us into NS_UNBLOCKED state. */
 		rc = gprs_ns_tx_simple(*nsvc, NS_PDUT_UNBLOCK_ACK);
+		if (rc < 0)
+			break;
+		/*
+		 * UNBLOCK_ACK has been transmitted.
+		 * Signal handlers may send additional messages following UNBLOCK_ACK under
+		 * the assumption that NS is now in UNBLOCKED state at our peer's end.
+		 */
+		ns_osmo_signal_dispatch(*nsvc, S_NS_UNBLOCK, 0);
 		break;
 	case NS_PDUT_UNBLOCK_ACK:
 		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS UNBLOCK ACK\n", (*nsvc)->nsei);
@@ -1628,8 +1636,11 @@ int gprs_ns_nsip_listen(struct gprs_ns_inst *nsi)
 		LOGP(DNS, LOGL_NOTICE, "Listening for nsip packets on %s:%u\n", inet_ntoa(in), nsi->nsip.local_port);
 	}
 
-	if (ret < 0)
+	if (ret < 0) {
+		nsi->nsip.fd.cb = NULL;
+		nsi->nsip.fd.data = NULL;
 		return ret;
+	}
 
 	ret = setsockopt(nsi->nsip.fd.fd, IPPROTO_IP, IP_TOS,
 				&nsi->nsip.dscp, sizeof(nsi->nsip.dscp));
diff --git a/src/gsm/Makefile.am b/src/gsm/Makefile.am
index 29299a64..e28ea335 100644
--- a/src/gsm/Makefile.am
+++ b/src/gsm/Makefile.am
@@ -30,7 +30,8 @@ libgsmint_la_SOURCES =  a5.c rxlev_stat.c tlv_parser.c comp128.c comp128v23.c \
 			milenage/aes-internal.c milenage/aes-internal-enc.c \
 			milenage/milenage.c gan.c ipa.c gsm0341.c apn.c \
 			gsup.c gprs_gea.c gsm0503_conv.c oap.c gsm0808_utils.c \
-			gsm23003.c mncc.c bts_features.c oap_client.c
+			gsm23003.c mncc.c bts_features.c oap_client.c \
+			gsm29118.c
 libgsmint_la_LDFLAGS = -no-undefined
 libgsmint_la_LIBADD = $(top_builddir)/src/libosmocore.la
 
diff --git a/src/gsm/gsm0480.c b/src/gsm/gsm0480.c
index 7756ecba..021db62f 100644
--- a/src/gsm/gsm0480.c
+++ b/src/gsm/gsm0480.c
@@ -68,35 +68,6 @@ const struct value_string gsm0480_op_code_names[] = {
 	{ 0, NULL }
 };
 
-static inline unsigned char *msgb_wrap_with_TL(struct msgb *msgb, uint8_t tag)
-{
-	uint8_t *data = msgb_push(msgb, 2);
-
-	data[0] = tag;
-	data[1] = msgb->len - 2;
-	return data;
-}
-
-static inline unsigned char *msgb_push_TLV1(struct msgb *msgb, uint8_t tag,
-					    uint8_t value)
-{
-	uint8_t *data = msgb_push(msgb, 3);
-
-	data[0] = tag;
-	data[1] = 1;
-	data[2] = value;
-	return data;
-}
-
-static inline unsigned char *msgb_push_NULL(struct msgb *msgb)
-{
-	uint8_t *data = msgb_push(msgb, 2);
-
-	data[0] = ASN1_NULL_TYPE_TAG;
-	data[1] = 0;
-	return data;
-}
-
 /* wrap an invoke around it... the other way around
  *
  * 1.) Invoke Component tag
@@ -107,10 +78,10 @@ static inline unsigned char *msgb_push_NULL(struct msgb *msgb)
 int gsm0480_wrap_invoke(struct msgb *msg, int op, int link_id)
 {
 	/* 3. operation */
-	msgb_push_TLV1(msg, GSM0480_OPERATION_CODE, op);
+	msgb_tlv1_push(msg, GSM0480_OPERATION_CODE, op);
 
 	/* 2. invoke id tag */
-	msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, link_id);
+	msgb_tlv1_push(msg, GSM0480_COMPIDTAG_INVOKE_ID, link_id);
 
 	/* 1. component tag */
 	msgb_wrap_with_TL(msg, GSM0480_CTYPE_INVOKE);
@@ -825,20 +796,20 @@ struct msgb *gsm0480_gen_ussd_resp_7bit(uint8_t invoke_id, const char *text)
 	msgb_wrap_with_TL(msg, ASN1_OCTET_STRING_TAG);
 
 	/* Pre-pend the DCS octet string */
-	msgb_push_TLV1(msg, ASN1_OCTET_STRING_TAG, 0x0F);
+	msgb_tlv1_push(msg, ASN1_OCTET_STRING_TAG, 0x0F);
 
 	/* Then wrap these as a Sequence */
 	msgb_wrap_with_TL(msg, GSM_0480_SEQUENCE_TAG);
 
 	/* Pre-pend the operation code */
-	msgb_push_TLV1(msg, GSM0480_OPERATION_CODE,
+	msgb_tlv1_push(msg, GSM0480_OPERATION_CODE,
 			GSM0480_OP_CODE_PROCESS_USS_REQ);
 
 	/* Wrap the operation code and IA5 string as a sequence */
 	msgb_wrap_with_TL(msg, GSM_0480_SEQUENCE_TAG);
 
 	/* Pre-pend the invoke ID */
-	msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, invoke_id);
+	msgb_tlv1_push(msg, GSM0480_COMPIDTAG_INVOKE_ID, invoke_id);
 
 	/* Wrap this up as a Return Result component */
 	msgb_wrap_with_TL(msg, GSM0480_CTYPE_RETURN_RESULT);
@@ -889,10 +860,10 @@ struct msgb *gsm0480_gen_return_error(uint8_t invoke_id, uint8_t error_code)
 		return NULL;
 
 	/* First insert the problem code */
-	msgb_push_TLV1(msg, GSM_0480_ERROR_CODE_TAG, error_code);
+	msgb_tlv1_push(msg, GSM_0480_ERROR_CODE_TAG, error_code);
 
 	/* Before it, insert the invoke ID */
-	msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, invoke_id);
+	msgb_tlv1_push(msg, GSM0480_COMPIDTAG_INVOKE_ID, invoke_id);
 
 	/* Wrap this up as a Reject component */
 	msgb_wrap_with_TL(msg, GSM0480_CTYPE_RETURN_ERROR);
@@ -919,13 +890,13 @@ struct msgb *gsm0480_gen_reject(int invoke_id, uint8_t problem_tag, uint8_t prob
 		return NULL;
 
 	/* First insert the problem code */
-	msgb_push_TLV1(msg, problem_tag, problem_code);
+	msgb_tlv1_push(msg, problem_tag, problem_code);
 
 	/* If the Invoke ID is not available, Universal NULL (table 3.9) with length=0 shall be used */
 	if (invoke_id < 0 || invoke_id > 255)
-		msgb_push_NULL(msg);
+		msgb_tv_push(msg, ASN1_NULL_TYPE_TAG, 0);
 	else
-		msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, invoke_id);
+		msgb_tlv1_push(msg, GSM0480_COMPIDTAG_INVOKE_ID, invoke_id);
 
 	/* Wrap this up as a Reject component */
 	msgb_wrap_with_TL(msg, GSM0480_CTYPE_REJECT);
diff --git a/src/gsm/gsm0808.c b/src/gsm/gsm0808.c
index e3b10d0c..fe7bc2ca 100644
--- a/src/gsm/gsm0808.c
+++ b/src/gsm/gsm0808.c
@@ -182,9 +182,9 @@ struct msgb *gsm0808_create_clear_complete(void)
 }
 
 /*! Create BSSMAP Clear Command message
- *  \param[in] reason TS 08.08 cause value
+ *  \param[in] cause TS 08.08 cause value
  *  \returns callee-allocated msgb with BSSMAP Clear Command message */
-struct msgb *gsm0808_create_clear_command(uint8_t reason)
+struct msgb *gsm0808_create_clear_command(uint8_t cause)
 {
 	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
 					       "bssmap: clear command");
@@ -193,7 +193,7 @@ struct msgb *gsm0808_create_clear_command(uint8_t reason)
 
 	msg->l3h = msgb_tv_put(msg, BSSAP_MSG_BSS_MANAGEMENT, 4);
 	msgb_v_put(msg, BSS_MAP_MSG_CLEAR_CMD);
-	msgb_tlv_put(msg, GSM0808_IE_CAUSE, 1, &reason);
+	msgb_tlv_put(msg, GSM0808_IE_CAUSE, 1, &cause);
 
 	return msg;
 }
@@ -265,17 +265,42 @@ struct msgb *gsm0808_create_cipher_complete(struct msgb *layer3, uint8_t alg_id)
 }
 
 /*! Create BSSMAP Cipher Mode Reject message
- *  \param[in] reason TS 08.08 cause value
+ *  \param[in] cause 3GPP TS 08.08 §3.2.2.5 cause value
  *  \returns callee-allocated msgb with BSSMAP Cipher Mode Reject message */
-struct msgb *gsm0808_create_cipher_reject(uint8_t cause)
+struct msgb *gsm0808_create_cipher_reject(enum gsm0808_cause cause)
 {
 	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
-					       "bssmap: clear complete");
+					       "bssmap: cipher mode reject");
 	if (!msg)
 		return NULL;
 
 	msgb_v_put(msg, BSS_MAP_MSG_CIPHER_MODE_REJECT);
-	msgb_tlv_put(msg, GSM0808_IE_CAUSE, 1, &cause);
+
+	msgb_tlv_put(msg, GSM0808_IE_CAUSE, 1, (const uint8_t *)&cause);
+
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+/*! Create BSSMAP Cipher Mode Reject message
+ *  \param[in] class 3GPP TS 08.08 §3.2.2.5 cause's class
+ *  \param[in] ext 3GPP TS 08.08 §3.2.2.5 cause value (national application extension)
+ *  \returns callee-allocated msgb with BSSMAP Cipher Mode Reject message */
+struct msgb *gsm0808_create_cipher_reject_ext(enum gsm0808_cause_class class, uint8_t ext)
+{
+	uint8_t c[2];
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "bssmap: cipher mode reject");
+	if (!msg)
+		return NULL;
+
+	c[0] = 0x80 | (class << 4); /* set the high bit to indicate extended cause */
+	c[1] = ext;
+
+	msgb_v_put(msg, BSS_MAP_MSG_CIPHER_MODE_REJECT);
+
+	msgb_tlv_put(msg, GSM0808_IE_CAUSE, 2, c);
 
 	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
 
@@ -341,6 +366,19 @@ struct msgb *gsm0808_create_lcls_notification(enum gsm0808_lcls_status status, b
 	return msg;
 }
 
+/*! Create BSSMAP Classmark Request message
+ *  \returns callee-allocated msgb with BSSMAP Classmark Request message */
+struct msgb *gsm0808_create_classmark_request()
+{
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "classmark-request");
+	if (!msg)
+		return NULL;
+
+	msgb_v_put(msg, BSS_MAP_MSG_CLASSMARK_RQST);
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+	return msg;
+}
 
 /*! Create BSSMAP Classmark Update message
  *  \param[in] cm2 Classmark 2
@@ -386,12 +424,12 @@ struct msgb *gsm0808_create_sapi_reject(uint8_t link_id)
 	return msg;
 }
 
-/*! Create BSSMAP Assignment Request message
+/*! Create BSSMAP Assignment Request message, 3GPP TS 48.008 §3.2.1.1
  *  \param[in] ct Channel Type
  *  \param[in] cic Circuit Identity Code (Classic A only)
  *  \param[in] ss Socket Address of MSC-side RTP socket (AoIP only)
  *  \param[in] scl Speech Codec List (AoIP only)
- *  \param[in] ci Call Identifier (Optional, LCLS)
+ *  \param[in] ci Call Identifier (Optional), §3.2.2.105
  *  \returns callee-allocated msgb with BSSMAP Assignment Request message */
 struct msgb *gsm0808_create_ass(const struct gsm0808_channel_type *ct,
 				const uint16_t *cic,
@@ -1257,8 +1295,26 @@ static const struct value_string gsm0808_cause_names[] = {
 	{ 0, NULL }
 };
 
+static const struct value_string gsm0808_cause_class_names[] = {
+	{ GSM0808_CAUSE_CLASS_NORM0,		"Normal event" },
+	{ GSM0808_CAUSE_CLASS_NORM1,		"Normal event" },
+	{ GSM0808_CAUSE_CLASS_RES_UNAVAIL,	"Resource unavailable" },
+	{ GSM0808_CAUSE_CLASS_SRV_OPT_NA,	"Service or option not available" },
+	{ GSM0808_CAUSE_CLASS_SRV_OPT_NIMPL,	"Service or option not implemented" },
+	{ GSM0808_CAUSE_CLASS_INVAL,		"Invalid message" },
+	{ GSM0808_CAUSE_CLASS_PERR,		"Protocol error" },
+	{ GSM0808_CAUSE_CLASS_INTW,		"Interworking" },
+	{ 0, NULL }
+};
+
+/*! Return string name of BSSMAP Cause Class name */
+const char *gsm0808_cause_class_name(enum gsm0808_cause_class class)
+{
+	return get_value_string(gsm0808_cause_class_names, class);
+}
+
 /*! Return string name of BSSMAP Cause name */
-const char *gsm0808_cause_name(uint8_t cause)
+const char *gsm0808_cause_name(enum gsm0808_cause cause)
 {
 	return get_value_string(gsm0808_cause_names, cause);
 }
@@ -1275,6 +1331,7 @@ const struct value_string gsm0808_lcls_config_names[] = {
 	  "Connect both-way, bi-cast UL to CN, send access DL from CN" },
 	{ GSM0808_LCLS_CFG_BOTH_WAY_AND_BICAST_UL_SEND_DL_BLOCK_LOCAL_DL,
 	  "Connect both-way, bi-cast UL to CN, send access DL from CN, block local DL" },
+	{ GSM0808_LCLS_CFG_NA, "Not available" },
 	{ 0, NULL }
 };
 
@@ -1284,6 +1341,7 @@ const struct value_string gsm0808_lcls_control_names[] = {
 	{ GSM0808_LCLS_CSC_RELEASE_LCLS,			"Release LCLS" },
 	{ GSM0808_LCLS_CSC_BICAST_UL_AT_HANDOVER,		"Bi-cast UL at Handover" },
 	{ GSM0808_LCLS_CSC_BICAST_UL_AND_RECV_DL_AT_HANDOVER,	"Bi-cast UL and receive DL at Handover" },
+	{ GSM0808_LCLS_CSC_NA,					"Not available" },
 	{ 0, NULL }
 };
 
@@ -1293,6 +1351,7 @@ const struct value_string gsm0808_lcls_status_names[] = {
 	{ GSM0808_LCLS_STS_NO_LONGER_LS,	"Call is no longer locally switched" },
 	{ GSM0808_LCLS_STS_REQ_LCLS_NOT_SUPP,	"Requested LCLS configuration is not supported" },
 	{ GSM0808_LCLS_STS_LOCALLY_SWITCHED,	"Call is locally switched with requested LCLS config" },
+	{ GSM0808_LCLS_STS_NA,			"Not available" },
 	{ 0, NULL }
 };
 
diff --git a/src/gsm/gsm0808_utils.c b/src/gsm/gsm0808_utils.c
index 73f02341..c58d8284 100644
--- a/src/gsm/gsm0808_utils.c
+++ b/src/gsm/gsm0808_utils.c
@@ -349,9 +349,6 @@ uint8_t gsm0808_enc_speech_codec_list(struct msgb *msg,
 	OSMO_ASSERT(msg);
 	OSMO_ASSERT(scl);
 
-	/* Empty list */
-	OSMO_ASSERT(scl->len >= 1);
-
 	msgb_put_u8(msg, GSM0808_IE_SPEECH_CODEC_LIST);
 	tlv_len = msgb_put(msg, 1);
 	old_tail = msg->tail;
@@ -384,8 +381,6 @@ int gsm0808_dec_speech_codec_list(struct gsm0808_speech_codec_list *scl,
 	OSMO_ASSERT(scl);
 	if (!elem)
 		return -EINVAL;
-	if (len == 0)
-		return -EINVAL;
 
 	memset(scl, 0, sizeof(*scl));
 
@@ -404,11 +399,6 @@ int gsm0808_dec_speech_codec_list(struct gsm0808_speech_codec_list *scl,
 
 	scl->len = decoded;
 
-	/* Empty list */
-	if (decoded < 1) {
-		return -EINVAL;
-	}
-
 	return (int)(elem - old_elem);
 }
 
@@ -1161,6 +1151,106 @@ int gsm0808_speech_codec_from_chan_type(struct gsm0808_speech_codec *sc,
 	return 0;
 }
 
+/*! Determine a set of AMR speech codec configuration bits (S0-S15) from a
+ *  given GSM 04.08 AMR configuration struct.
+ *  \param[in] cfg AMR configuration in GSM 04.08 format.
+ *  \param[in] hint if the resulting configuration shall be used with a FR or HR TCH.
+ *  \returns configuration bits (S0-S15) */
+uint16_t gsm0808_sc_cfg_from_gsm48_mr_cfg(const struct gsm48_multi_rate_conf *cfg,
+					  bool fr)
+{
+	uint16_t s15_s0 = 0;
+
+	/* Check each rate bit in the AMR multirate configuration and pick the
+	 * matching default configuration as specified in 3GPP TS 28.062,
+	 * Table 7.11.3.1.3-2. */
+	if (cfg->m4_75)
+		s15_s0 |= GSM0808_SC_CFG_DEFAULT_AMR_4_75;
+	if (cfg->m5_15)
+		s15_s0 |= GSM0808_SC_CFG_DEFAULT_AMR_5_15;
+	if (cfg->m5_90)
+		s15_s0 |= GSM0808_SC_CFG_DEFAULT_AMR_5_90;
+	if (cfg->m6_70)
+		s15_s0 |= GSM0808_SC_CFG_DEFAULT_AMR_6_70;
+	if (cfg->m7_40)
+		s15_s0 |= GSM0808_SC_CFG_DEFAULT_AMR_7_40;
+	if (cfg->m7_95)
+		s15_s0 |= GSM0808_SC_CFG_DEFAULT_AMR_7_95;
+	if (cfg->m10_2)
+		s15_s0 |= GSM0808_SC_CFG_DEFAULT_AMR_10_2;
+	if (cfg->m12_2)
+		s15_s0 |= GSM0808_SC_CFG_DEFAULT_AMR_12_2;
+
+	/* Note: 3GPP TS 48.008, chapter 3GPP TS 48.008 states that for AMR
+	 * some of the configuration bits must be coded as zeros. The applied
+	 * bitmask matches the default codec settings. See also the definition
+	 * of enum gsm0808_speech_codec_defaults in gsm_08_08.h and
+	 * 3GPP TS 28.062, Table 7.11.3.1.3-2. */
+	if (fr)
+		s15_s0 &= GSM0808_SC_CFG_DEFAULT_FR_AMR;
+	else
+		s15_s0 &= GSM0808_SC_CFG_DEFAULT_HR_AMR;
+
+	return s15_s0;
+}
+
+/*! Determine a GSM 04.08 AMR configuration struct from a set of speech codec
+ *  configuration bits (S0-S15)
+ *  \param[out] cfg AMR configuration in GSM 04.08 format.
+ *  \param[in] s15_s0 configuration bits (S0-S15). */
+void gsm48_mr_cfg_from_gsm0808_sc_cfg(struct gsm48_multi_rate_conf *cfg,
+				      uint16_t s15_s0)
+{
+	memset(cfg, 0, sizeof(*cfg));
+
+	/* Strip option bits */
+	s15_s0 &= 0x00ff;
+
+	/* Rate 5,15k must always be present */
+	cfg->m5_15 = 1;
+
+	if ((s15_s0 & GSM0808_SC_CFG_DEFAULT_AMR_4_75 & 0xff) ==
+	    (GSM0808_SC_CFG_DEFAULT_AMR_4_75 & 0xff))
+		cfg->m4_75 = 1;
+	if ((s15_s0 & GSM0808_SC_CFG_DEFAULT_AMR_5_90 & 0xff) ==
+	    (GSM0808_SC_CFG_DEFAULT_AMR_5_90 & 0xff))
+		cfg->m5_90 = 1;
+	if ((s15_s0 & GSM0808_SC_CFG_DEFAULT_AMR_6_70 & 0xff) ==
+	    (GSM0808_SC_CFG_DEFAULT_AMR_6_70 & 0xff))
+		cfg->m6_70 = 1;
+	if ((s15_s0 & GSM0808_SC_CFG_DEFAULT_AMR_7_40 & 0xff) ==
+	    (GSM0808_SC_CFG_DEFAULT_AMR_7_40 & 0xff))
+		cfg->m7_40 = 1;
+	if ((s15_s0 & GSM0808_SC_CFG_DEFAULT_AMR_7_95 & 0xff) ==
+	    (GSM0808_SC_CFG_DEFAULT_AMR_7_95 & 0xff))
+		cfg->m7_95 = 1;
+	if ((s15_s0 & GSM0808_SC_CFG_DEFAULT_AMR_10_2 & 0xff) ==
+	    (GSM0808_SC_CFG_DEFAULT_AMR_10_2 & 0xff))
+		cfg->m10_2 = 1;
+	if ((s15_s0 & GSM0808_SC_CFG_DEFAULT_AMR_12_2 & 0xff) ==
+	    (GSM0808_SC_CFG_DEFAULT_AMR_12_2 & 0xff))
+		cfg->m12_2 = 1;
+
+	cfg->ver = 1;
+	cfg->icmi = 1;
+}
+
+int gsm0808_get_cipher_reject_cause(const struct tlv_parsed *tp)
+{
+	const uint8_t *buf = TLVP_VAL_MINLEN(tp, GSM0808_IE_CAUSE, 1);
+
+	if (!buf)
+		return -EBADMSG;
+
+	if (TLVP_LEN(tp, GSM0808_IE_CAUSE) > 1) {
+		if (!gsm0808_cause_ext(buf[0]))
+			return -EINVAL;
+		return buf[1];
+	}
+
+	return buf[0];
+}
+
 /*! Print a human readable name of the cell identifier to the char buffer.
  * This is useful both for struct gsm0808_cell_id and struct gsm0808_cell_id_list2.
  * See also gsm0808_cell_id_name() and gsm0808_cell_id_list_name().
diff --git a/src/gsm/gsm23003.c b/src/gsm/gsm23003.c
index 2c3b21e6..4fdad48a 100644
--- a/src/gsm/gsm23003.c
+++ b/src/gsm/gsm23003.c
@@ -169,6 +169,14 @@ static void to_bcd(uint8_t *bcd, uint16_t val)
 	bcd[0] = val % 10;
 }
 
+const char *osmo_gummei_name(const struct osmo_gummei *gummei)
+{
+	static char buf[32];
+	snprintf(buf, sizeof(buf), "%s-%04x-%02x", osmo_plmn_name(&gummei->plmn),
+		 gummei->mme.group_id, gummei->mme.code);
+	return buf;
+}
+
 /* Convert MCC + MNC to BCD representation
  * \param[out] bcd_dst caller-allocated memory for output
  * \param[in] mcc Mobile Country Code
@@ -297,3 +305,81 @@ int osmo_plmn_cmp(const struct osmo_plmn_id *a, const struct osmo_plmn_id *b)
 		return 1;
 	return osmo_mnc_cmp(a->mnc, a->mnc_3_digits, b->mnc, b->mnc_3_digits);
 }
+
+/*! Generate TS 23.003 Section 19.2 Home Network Realm/Domain (text form)
+ *  \param out[out] caller-provided output buffer, at least 33 bytes long
+ *  \param plmn[in] Osmocom representation of PLMN ID (MCC + MNC)
+ *  \returns number of characters printed (excluding NUL); negative on error */
+int osmo_gen_home_network_domain(char *out, const struct osmo_plmn_id *plmn)
+{
+	if (plmn->mcc > 999)
+		return -EINVAL;
+	if (plmn->mnc > 999)
+		return -EINVAL;
+	return sprintf(out, "epc.mnc%03u.mcc%03u.3gppnetwork.org", plmn->mnc, plmn->mcc);
+}
+
+/*! Parse a TS 23.003 Section 19.2 Home Network Realm/Domain (text form) into a \ref osmo_plmn_id
+ *  \param out[out] caller-allocated output structure
+ *  \param in[in] character string representation to be parsed
+ *  \returns 0 on success; negative on error */
+int osmo_parse_home_network_domain(struct osmo_plmn_id *out, const char *in)
+{
+	int rc;
+
+	memset(out, 0, sizeof(*out));
+	rc = sscanf(in, "epc.mnc%03hu.mcc%03hu.3gppnetwork.org", &out->mnc, &out->mcc);
+	if (rc < 0)
+		return rc;
+	if (rc != 2)
+		return -EINVAL;
+	return 0;
+}
+
+/*! Generate TS 23.003 Section 19.4.2.4 MME Domain (text form)
+ *  \param out[out] caller-provided output buffer, at least 56 bytes long
+ *  \param gummei[in] Structure representing the Globally Unique MME Identifier
+ *  \returns number of characters printed (excluding NUL); negative on error */
+int osmo_gen_mme_domain(char *out, const struct osmo_gummei *gummei)
+{
+	char domain[GSM23003_HOME_NETWORK_DOMAIN_LEN+1];
+	int rc;
+	rc = osmo_gen_home_network_domain(domain, &gummei->plmn);
+	if (rc < 0)
+		return rc;
+	return sprintf(out, "mmec%02x.mmegi%04x.mme.%s", gummei->mme.code, gummei->mme.group_id, domain);
+}
+
+/*! Parse a TS 23.003 Section 19.4.2.4 MME Domain (text form) into a \ref osmo_gummei
+ *  \param out[out] caller-allocated output GUMMEI structure
+ *  \param in[in] character string representation to be parsed
+ *  \returns 0 on success; negative on error */
+int osmo_parse_mme_domain(struct osmo_gummei *out, const char *in)
+{
+	int rc;
+
+	memset(out, 0, sizeof(*out));
+	rc = sscanf(in, "mmec%02hhx.mmegi%04hx.mme.epc.mnc%03hu.mcc%03hu.3gppnetwork.org",
+		    &out->mme.code, &out->mme.group_id,
+		    &out->plmn.mnc, &out->plmn.mcc);
+	if (rc < 0)
+		return rc;
+	if (rc != 4)
+		return -EINVAL;
+	return 0;
+}
+
+/*! Generate TS 23.003 Section 19.4.2.4 MME Group Domain (text form)
+ *  \param out[out] caller-provided output buffer, at least 56 bytes long
+ *  \param mmegi[in] MME Group Identifier
+ *  \param plmn[in] Osmocom representation of PLMN ID (MCC + MNC)
+ *  \returns number of characters printed (excluding NUL); negative on error */
+int osmo_gen_mme_group_domain(char *out, uint16_t mmegi, const struct osmo_plmn_id *plmn)
+{
+	char domain[GSM23003_HOME_NETWORK_DOMAIN_LEN+1];
+	int rc;
+	rc = osmo_gen_home_network_domain(domain, plmn);
+	if (rc < 0)
+		return rc;
+	return sprintf(out, "mmegi%04x.mme.%s", mmegi, domain);
+}
diff --git a/src/gsm/gsm29118.c b/src/gsm/gsm29118.c
new file mode 100644
index 00000000..3898be64
--- /dev/null
+++ b/src/gsm/gsm29118.c
@@ -0,0 +1,158 @@
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/tlv.h>
+
+#include <osmocom/gsm/protocol/gsm_29_118.h>
+
+const struct value_string sgsap_msg_type_names[] = {
+	{ SGSAP_MSGT_PAGING_REQ,	"PAGING-REQUEST" },
+	{ SGSAP_MSGT_PAGING_REJ,	"PAGING-REJECT" },
+	{ SGSAP_MSGT_SERVICE_REQ,	"SERVICE-REQUEST" },
+	{ SGSAP_MSGT_DL_UD,		"DOWNLINK-UNITDATA" },
+	{ SGSAP_MSGT_UL_UD,		"UPLINK-UNITDATA" },
+	{ SGSAP_MSGT_LOC_UPD_REQ,	"LOCATION-UPDATE-REQUEST" },
+	{ SGSAP_MSGT_LOC_UPD_ACK,	"LOCATION-UPDATE-ACCEPT" },
+	{ SGSAP_MSGT_LOC_UPD_REJ,	"LOCATION-UPDATE-REJECT" },
+	{ SGSAP_MSGT_TMSI_REALL_CMPL,	"TMSI-REALLOCATION-COMPLETE" },
+	{ SGSAP_MSGT_ALERT_REQ,		"ALERT-REQQUEST" },
+	{ SGSAP_MSGT_ALERT_ACK,		"ALERT-ACK" },
+	{ SGSAP_MSGT_ALERT_REJ,		"ALERT-REJECT" },
+	{ SGSAP_MSGT_UE_ACT_IND,	"UE-ACTIVITY-INDICATION" },
+	{ SGSAP_MSGT_EPS_DET_IND,	"EPS-DETACH-INDICATION" },
+	{ SGSAP_MSGT_EPS_DET_ACK,	"EPS-DETACH-ACK" },
+	{ SGSAP_MSGT_IMSI_DET_IND,	"IMSI-DETACH-INDICATION" },
+	{ SGSAP_MSGT_IMSI_DET_ACK,	"IMSI-DETACH-ACK" },
+	{ SGSAP_MSGT_RESET_IND,		"RESET-INDICATION" },
+	{ SGSAP_MSGT_RESET_ACK,		"RESET-ACK" },
+	{ SGSAP_MSGT_SERVICE_ABORT_REQ,	"SERVICE-ABORT-REQUEST" },
+	{ SGSAP_MSGT_MO_CSFB_IND,	"MO-CSFB-INDICATION" },
+	{ SGSAP_MSGT_MM_INFO_REQ,	"MM-INFO-REQUEST" },
+	{ SGSAP_MSGT_RELEASE_REQ,	"RELEASE-REQUEST" },
+	{ SGSAP_MSGT_STATUS,		"STATUS" },
+	{ SGSAP_MSGT_UE_UNREACHABLE,	"UE-UNREACHABLE" },
+	{ 0, NULL }
+};
+
+const struct value_string sgsap_iei_names[] = {
+	{ SGSAP_IE_IMSI,			"IMSI" },
+	{ SGSAP_IE_VLR_NAME,			"VLR-NAME" },
+	{ SGSAP_IE_TMSI,			"TMSI" },
+	{ SGSAP_IE_LAI,				"LAI" },
+	{ SGSAP_IE_CHAN_NEEDED,			"CHAN-NEEDED" },
+	{ SGSAP_IE_EMLPP_PRIORITY,		"EMLPP-PRIORITY" },
+	{ SGSAP_IE_TMSI_STATUS,			"TMSI-STATUS" },
+	{ SGSAP_IE_SGS_CAUSE,			"SGS-CAUSE" },
+	{ SGSAP_IE_MME_NAME,			"MME-NAME" },
+	{ SGSAP_IE_EPS_LU_TYPE,			"EPS-LU-TYPE" },
+	{ SGSAP_IE_GLOBAL_CN_ID,		"GLOBAL-CN-ID" },
+	{ SGSAP_IE_MOBILE_ID,			"MOBILE-ID" },
+	{ SGSAP_IE_REJECT_CAUSE,		"REJECT-CAUSE" },
+	{ SGSAP_IE_IMSI_DET_EPS_TYPE,		"IMSI-DET-EPS-TYPE" },
+	{ SGSAP_IE_IMSI_DET_NONEPS_TYPE,	"IMSI-DET-NONEPS-TYPE" },
+	{ SGSAP_IE_IMEISV,			"IMEISV" },
+	{ SGSAP_IE_NAS_MSG_CONTAINER,		"NAS-MSG-CONTAINER" },
+	{ SGSAP_IE_MM_INFO,			"MM-INFO" },
+	{ SGSAP_IE_ERR_MSG,			"ERR-MSG" },
+	{ SGSAP_IE_CLI,				"CLI" },
+	{ SGSAP_IE_LCS_CLIENT_ID,		"LCS-CLIENT-ID" },
+	{ SGSAP_IE_LCS_INDICATOR,		"LCS-INDICATOR" },
+	{ SGSAP_IE_SS_CODE,			"SS-CODE" },
+	{ SGSAP_IE_SERVICE_INDICATOR,		"SERVICE-INDICATOR" },
+	{ SGSAP_IE_UE_TIMEZONE,			"UE-TIMEZONE" },
+	{ SGSAP_IE_MS_CLASSMARK2,		"MS-CLASSMARK2" },
+	{ SGSAP_IE_TAI,				"TAI" },
+	{ SGSAP_IE_EUTRAN_CGI,			"EUTRAN-CGI" },
+	{ SGSAP_IE_UE_EMM_MODE,			"UE-EMM-MODE" },
+	{ SGSAP_IE_ADDL_PAGING_INDICATORS,	"ADDL-PAGING-INDICATORS" },
+	{ SGSAP_IE_TMSI_BASED_NRI_CONT,		"TMSI-BASED-NRI-CONT" },
+	{ 0, NULL }
+};
+
+const struct value_string sgsap_eps_lu_type_names[] = {
+	{ SGSAP_EPS_LUT_IMSI_ATTACH,	"IMSI Attach" },
+	{ SGSAP_EPS_LUT_NORMAL,		"Normal" },
+	{ 0, NULL }
+};
+
+const struct value_string sgsap_ismi_det_eps_type_names[] = {
+	{ SGSAP_ID_EPS_T_NETWORK_INITIATED,	"Network initiated IMSI detach from EPS" },
+	{ SGSAP_ID_EPS_T_UE_INITIATED,		"UE initiated IMSI detach from EPS" },
+	{ SGSAP_ID_EPS_T_EPS_NOT_ALLOWED,	"EPS not allowed" },
+	{ 0, NULL }
+};
+
+const struct value_string sgsap_ismi_det_noneps_type_names[] = {
+	{ SGSAP_ID_NONEPS_T_EXPLICIT_UE_NONEPS,
+	  "Explicit UE initiated IMSI detach from non-EPS" },
+	{ SGSAP_ID_NONEPS_T_COMBINED_UE_EPS_NONEPS,
+	  "Combined UE initiated IMSI detach from EPS and non-EPS" },
+	{ SGSAP_ID_NONEPS_T_IMPLICIT_UE_EPS_NONEPS,
+	  "Implicit network initiated IMSI detach from EPS and non-EPS" },
+	{ 0, NULL }
+};
+
+const struct value_string sgsap_service_ind_names[] = {
+	{ SGSAP_SERV_IND_CS_CALL,	"CS Call" },
+	{ SGSAP_SERV_IND_SMS,		"SMS" },
+	{ 0, NULL }
+};
+
+const struct value_string sgsap_sgs_cause_names[] = {
+	{ SGSAP_SGS_CAUSE_IMSI_DET_EPS,		"IMSI detached for EPS" },
+	{ SGSAP_SGS_CAUSE_IMSI_DET_EPS_NONEPS,	"IMSI detached for EPS and non-EPS" },
+	{ SGSAP_SGS_CAUSE_IMSI_UNKNOWN,		"IMSI unknown" },
+	{ SGSAP_SGS_CAUSE_IMSI_DET_NON_EPS,	"IMSI detached for non-EPS" },
+	{ SGSAP_SGS_CAUSE_IMSI_IMPL_DET_NON_EPS,"IMSI implicitly detached for non-EPS" },
+	{ SGSAP_SGS_CAUSE_UE_UNREACHABLE,	"UE unreachable" },
+	{ SGSAP_SGS_CAUSE_MSG_INCOMP_STATE,	"Message not compatible with protocol state" },
+	{ SGSAP_SGS_CAUSE_MISSING_MAND_IE,	"Missing mandatory IE" },
+	{ SGSAP_SGS_CAUSE_INVALID_MAND_IE,	"Invalid mandatory IE" },
+	{ SGSAP_SGS_CAUSE_COND_IE_ERROR,	"Conditional IE error" },
+	{ SGSAP_SGS_CAUSE_SEMANT_INCORR_MSG,	"Semantically incorrect message" },
+	{ SGSAP_SGS_CAUSE_MSG_UNKNOWN,		"Message unknown" },
+	{ SGSAP_SGS_CAUSE_MT_CSFB_REJ_USER,	"MT CSFB call rejected by user" },
+	{ SGSAP_SGS_CAUSE_UE_TEMP_UNREACHABLE,	"UE temporarily unreachable" },
+	{ 0, NULL }
+};
+
+
+const struct value_string sgsap_ue_emm_mode_names[] = {
+	{ SGSAP_UE_EMM_MODE_IDLE, 		"EMM-IDLE" },
+	{ SGSAP_UE_EMM_MODE_CONNECTED,		"EMM-CONNECTED" },
+	{ 0, NULL }
+};
+
+const struct tlv_definition sgsap_ie_tlvdef = {
+	.def = {
+		[SGSAP_IE_IMSI]			= { TLV_TYPE_TLV },
+		[SGSAP_IE_VLR_NAME]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_TMSI]			= { TLV_TYPE_TLV },
+		[SGSAP_IE_LAI]			= { TLV_TYPE_TLV },
+		[SGSAP_IE_CHAN_NEEDED]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_EMLPP_PRIORITY]	= { TLV_TYPE_TLV },
+		[SGSAP_IE_TMSI_STATUS]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_SGS_CAUSE]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_MME_NAME]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_EPS_LU_TYPE]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_GLOBAL_CN_ID]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_MOBILE_ID]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_REJECT_CAUSE]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_IMSI_DET_EPS_TYPE]	= { TLV_TYPE_TLV },
+		[SGSAP_IE_IMSI_DET_NONEPS_TYPE]	= { TLV_TYPE_TLV },
+		[SGSAP_IE_IMEISV]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_NAS_MSG_CONTAINER]	= { TLV_TYPE_TLV },
+		[SGSAP_IE_MM_INFO]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_ERR_MSG]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_CLI]			= { TLV_TYPE_TLV },
+		[SGSAP_IE_LCS_CLIENT_ID]	= { TLV_TYPE_TLV },
+		[SGSAP_IE_LCS_INDICATOR]	= { TLV_TYPE_TLV },
+		[SGSAP_IE_SS_CODE]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_SERVICE_INDICATOR]	= { TLV_TYPE_TLV },
+		[SGSAP_IE_UE_TIMEZONE]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_MS_CLASSMARK2]	= { TLV_TYPE_TLV },
+		[SGSAP_IE_TAI]			= { TLV_TYPE_TLV },
+		[SGSAP_IE_EUTRAN_CGI]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_UE_EMM_MODE]		= { TLV_TYPE_TLV },
+		[SGSAP_IE_ADDL_PAGING_INDICATORS]={ TLV_TYPE_TLV },
+		[SGSAP_IE_TMSI_BASED_NRI_CONT]	= { TLV_TYPE_TLV },
+	},
+};
diff --git a/src/gsm/gsm48.c b/src/gsm/gsm48.c
index 136b9375..ae9a1cf6 100644
--- a/src/gsm/gsm48.c
+++ b/src/gsm/gsm48.c
@@ -604,6 +604,7 @@ int gsm48_generate_mid_from_tmsi(uint8_t *buf, uint32_t tmsi)
 /*! Generate TS 24.008 §10.5.1.4 Mobile ID
  *  \param[out] buf Caller-provided output buffer
  *  \param[in] id Identity to be encoded
+ *  \param[in] mi_type Type of identity (e.g. GSM_MI_TYPE_TMSI)
  *  \returns number of bytes used in \a buf */
 uint8_t gsm48_generate_mid(uint8_t *buf, const char *id, uint8_t mi_type)
 {
@@ -945,6 +946,60 @@ const struct value_string gsm48_cc_msgtype_names[] = {
 	{ 0, NULL }
 };
 
+/*! TS 04.08 10.5..4.11 Call Control Cause Values */
+const struct value_string gsm48_cc_cause_names[] = {
+	{ GSM48_CC_CAUSE_UNASSIGNED_NR,		"UNASSIGNED_NR" },
+	{ GSM48_CC_CAUSE_NO_ROUTE,		"NO_ROUTE" },
+	{ GSM48_CC_CAUSE_CHAN_UNACCEPT,		"CHAN_UNACCEPT" },
+	{ GSM48_CC_CAUSE_OP_DET_BARRING,	"OP_DET_BARRING" },
+	{ GSM48_CC_CAUSE_NORM_CALL_CLEAR,	"NORM_CALL_CLEAR" },
+	{ GSM48_CC_CAUSE_USER_BUSY,		"USER_BUSY" },
+	{ GSM48_CC_CAUSE_USER_NOTRESPOND,	"USER_NOTRESPOND" },
+	{ GSM48_CC_CAUSE_USER_ALERTING_NA,	"USER_ALERTING_NA" },
+	{ GSM48_CC_CAUSE_CALL_REJECTED,		"CALL_REJECTED" },
+	{ GSM48_CC_CAUSE_NUMBER_CHANGED,	"NUMBER_CHANGED" },
+	{ GSM48_CC_CAUSE_PRE_EMPTION,		"PRE_EMPTION" },
+	{ GSM48_CC_CAUSE_NONSE_USER_CLR,	"NONSE_USER_CLR" },
+	{ GSM48_CC_CAUSE_DEST_OOO,		"DEST_OOO" },
+	{ GSM48_CC_CAUSE_INV_NR_FORMAT,		"INV_NR_FORMAT" },
+	{ GSM48_CC_CAUSE_FACILITY_REJ,		"FACILITY_REJ" },
+	{ GSM48_CC_CAUSE_RESP_STATUS_INQ,	"RESP_STATUS_INQ" },
+	{ GSM48_CC_CAUSE_NORMAL_UNSPEC,		"NORMAL_UNSPEC" },
+	{ GSM48_CC_CAUSE_NO_CIRCUIT_CHAN,	"NO_CIRCUIT_CHAN" },
+	{ GSM48_CC_CAUSE_NETWORK_OOO,		"NETWORK_OOO" },
+	{ GSM48_CC_CAUSE_TEMP_FAILURE,		"TEMP_FAILURE" },
+	{ GSM48_CC_CAUSE_SWITCH_CONG,		"SWITCH_CONG" },
+	{ GSM48_CC_CAUSE_ACC_INF_DISCARD,	"ACC_INF_DISCARD" },
+	{ GSM48_CC_CAUSE_REQ_CHAN_UNAVAIL,	"REQ_CHAN_UNAVAIL" },
+	{ GSM48_CC_CAUSE_RESOURCE_UNAVAIL,	"RESOURCE_UNAVAIL" },
+	{ GSM48_CC_CAUSE_QOS_UNAVAIL,		"QOS_UNAVAIL" },
+	{ GSM48_CC_CAUSE_REQ_FAC_NOT_SUBSC,	"REQ_FAC_NOT_SUBSC" },
+	{ GSM48_CC_CAUSE_INC_BARRED_CUG,	"INC_BARRED_CUG" },
+	{ GSM48_CC_CAUSE_BEARER_CAP_UNAUTH,	"BEARER_CAP_UNAUTH" },
+	{ GSM48_CC_CAUSE_BEARER_CA_UNAVAIL,	"BEARER_CA_UNAVAIL" },
+	{ GSM48_CC_CAUSE_SERV_OPT_UNAVAIL,	"SERV_OPT_UNAVAIL" },
+	{ GSM48_CC_CAUSE_BEARERSERV_UNIMPL,	"BEARERSERV_UNIMPL" },
+	{ GSM48_CC_CAUSE_ACM_GE_ACM_MAX,	"ACM_GE_ACM_MAX" },
+	{ GSM48_CC_CAUSE_REQ_FAC_NOTIMPL,	"REQ_FAC_NOTIMPL" },
+	{ GSM48_CC_CAUSE_RESTR_BCAP_AVAIL,	"RESTR_BCAP_AVAIL" },
+	{ GSM48_CC_CAUSE_SERV_OPT_UNIMPL,	"SERV_OPT_UNIMPL" },
+	{ GSM48_CC_CAUSE_INVAL_TRANS_ID,	"INVAL_TRANS_ID" },
+	{ GSM48_CC_CAUSE_USER_NOT_IN_CUG,	"USER_NOT_IN_CUG" },
+	{ GSM48_CC_CAUSE_INCOMPAT_DEST,		"INCOMPAT_DEST" },
+	{ GSM48_CC_CAUSE_INVAL_TRANS_NET,	"INVAL_TRANS_NET" },
+	{ GSM48_CC_CAUSE_SEMANTIC_INCORR,	"SEMANTIC_INCORR" },
+	{ GSM48_CC_CAUSE_INVAL_MAND_INF,	"INVAL_MAND_INF" },
+	{ GSM48_CC_CAUSE_MSGTYPE_NOTEXIST,	"MSGTYPE_NOTEXIST" },
+	{ GSM48_CC_CAUSE_MSGTYPE_INCOMPAT,	"MSGTYPE_INCOMPAT" },
+	{ GSM48_CC_CAUSE_IE_NOTEXIST,		"IE_NOTEXIST" },
+	{ GSM48_CC_CAUSE_COND_IE_ERR,		"COND_IE_ERR" },
+	{ GSM48_CC_CAUSE_MSG_INCOMP_STATE,	"MSG_INCOMP_STATE" },
+	{ GSM48_CC_CAUSE_RECOVERY_TIMER,	"RECOVERY_TIMER" },
+	{ GSM48_CC_CAUSE_PROTO_ERR,		"PROTO_ERR" },
+	{ GSM48_CC_CAUSE_INTERWORKING,		"INTERWORKING" },
+	{ 0 , NULL }
+};
+
 /*! TS 04.80, section 3.4 Messages for supplementary services control */
 const struct value_string gsm48_nc_ss_msgtype_names[] = {
 	OSMO_VALUE_STRING(GSM0480_MTYPE_RELEASE_COMPLETE),
diff --git a/src/gsm/gsm48_ie.c b/src/gsm/gsm48_ie.c
index 1baf2879..ffe3ebae 100644
--- a/src/gsm/gsm48_ie.c
+++ b/src/gsm/gsm48_ie.c
@@ -807,7 +807,7 @@ static int32_t smod(int32_t n, int32_t m)
 }
 
 /*! Decode TS 04.08 Cell Channel Description IE (10.5.2.1b) and other frequency lists
- *  \param[out] f Caller-provided output memory
+ *  \param[out] f Caller-provided output memory, an array of 1024 elements
  *  \param[in] cd Cell Channel Description IE
  *  \param[in] len Length of \a cd in bytes
  *  \returns 0 on success; negative on error */
diff --git a/src/gsm/gsm_utils.c b/src/gsm/gsm_utils.c
index 7e6c7947..8b4b5586 100644
--- a/src/gsm/gsm_utils.c
+++ b/src/gsm/gsm_utils.c
@@ -706,36 +706,61 @@ enum gsm_band gsm_band_parse(const char* mhz)
 	}
 }
 
-/*! Resolve GSM band from ARFCN
+/*! Resolve GSM band from ARFCN.
  *  In Osmocom, we use the highest bit of the \a arfcn to indicate PCS
  *  \param[in] arfcn Osmocom ARFCN, highest bit determines PCS mode
- *  \returns GSM Band */
-enum gsm_band gsm_arfcn2band(uint16_t arfcn)
+ *  \param[out] band GSM Band containing \arfcn if arfcn is valid, undetermined otherwise
+ *  \returns 0 if arfcn is valid and \a band was set, negative on error */
+int gsm_arfcn2band_rc(uint16_t arfcn, enum gsm_band *band)
 {
 	int is_pcs = arfcn & ARFCN_PCS;
 
 	arfcn &= ~ARFCN_FLAG_MASK;
 
-	if (is_pcs)
-		return GSM_BAND_1900;
-	else if (arfcn <= 124)
-		return GSM_BAND_900;
-	else if (arfcn >= 955 && arfcn <= 1023)
-		return GSM_BAND_900;
-	else if (arfcn >= 128 && arfcn <= 251)
-		return GSM_BAND_850;
-	else if (arfcn >= 512 && arfcn <= 885)
-		return GSM_BAND_1800;
-	else if (arfcn >= 259 && arfcn <= 293)
-		return GSM_BAND_450;
-	else if (arfcn >= 306 && arfcn <= 340)
-		return GSM_BAND_480;
-	else if (arfcn >= 350 && arfcn <= 425)
-		return GSM_BAND_810;
-	else if (arfcn >= 438 && arfcn <= 511)
-		return GSM_BAND_750;
-	else
-		return GSM_BAND_1800;
+	if (is_pcs) {
+		*band = GSM_BAND_1900;
+		return 0;
+	} else if (arfcn <= 124) {
+		*band = GSM_BAND_900;
+		return 0;
+	} else if (arfcn >= 955 && arfcn <= 1023) {
+		*band = GSM_BAND_900;
+		return 0;
+	} else if (arfcn >= 128 && arfcn <= 251) {
+		*band = GSM_BAND_850;
+		return 0;
+	} else if (arfcn >= 512 && arfcn <= 885) {
+		*band = GSM_BAND_1800;
+		return 0;
+	} else if (arfcn >= 259 && arfcn <= 293) {
+		*band = GSM_BAND_450;
+		return 0;
+	} else if (arfcn >= 306 && arfcn <= 340) {
+		*band = GSM_BAND_480;
+		return 0;
+	} else if (arfcn >= 350 && arfcn <= 425) {
+		*band = GSM_BAND_810;
+		return 0;
+	} else if (arfcn >= 438 && arfcn <= 511) {
+		*band = GSM_BAND_750;
+		return 0;
+	}
+	return -1;
+}
+
+/*! Resolve GSM band from ARFCN, aborts process on invalid ARFCN.
+ *  In Osmocom, we use the highest bit of the \a arfcn to indicate PCS.
+ *  DEPRECATED: Use gsm_arfcn2band_rc instead.
+ *  \param[in] arfcn Osmocom ARFCN, highest bit determines PCS mode
+ *  \returns GSM Band if ARFCN is valid (part of any valid band), aborts otherwise */
+enum gsm_band gsm_arfcn2band(uint16_t arfcn)
+{
+	enum gsm_band band;
+	if (gsm_arfcn2band_rc(arfcn, &band) == 0)
+		return band;
+
+	osmo_panic("%s:%d Invalid arfcn %" PRIu16 " passed to gsm_arfcn2band\n",
+		   __FILE__, __LINE__, arfcn);
 }
 
 struct gsm_freq_range {
diff --git a/src/gsm/gsup.c b/src/gsm/gsup.c
index 9c2f8175..18b35806 100644
--- a/src/gsm/gsup.c
+++ b/src/gsm/gsup.c
@@ -535,7 +535,7 @@ int osmo_gsup_encode(struct msgb *msg, const struct osmo_gsup_message *gsup_msg)
 
 	/* generic part */
 	if(!gsup_msg->message_type)
-		return -ENOMEM;
+		return -EINVAL;
 
 	msgb_v_put(msg, gsup_msg->message_type);
 
diff --git a/src/gsm/libosmogsm.map b/src/gsm/libosmogsm.map
index 1da398c1..3fe9dfcf 100644
--- a/src/gsm/libosmogsm.map
+++ b/src/gsm/libosmogsm.map
@@ -148,6 +148,7 @@ gsm0808_att_tlvdef;
 gsm0808_bssap_name;
 gsm0808_bssmap_name;
 gsm0808_cause_name;
+gsm0808_cause_class_name;
 gsm0808_create_ass;
 gsm0808_create_assignment_completed;
 gsm0808_create_ass_compl;
@@ -156,6 +157,9 @@ gsm0808_create_ass_fail;
 gsm0808_create_cipher;
 gsm0808_create_cipher_complete;
 gsm0808_create_cipher_reject;
+gsm0808_create_cipher_reject_ext;
+gsm0808_get_cipher_reject_cause;
+gsm0808_create_classmark_request;
 gsm0808_create_classmark_update;
 gsm0808_create_clear_command;
 gsm0808_create_clear_complete;
@@ -204,6 +208,8 @@ gsm0808_cell_id_discr_names;
 gsm0808_cell_id_u_name;
 gsm0808_chan_type_to_speech_codec;
 gsm0808_speech_codec_from_chan_type;
+gsm0808_sc_cfg_from_gsm48_mr_cfg;
+gsm48_mr_cfg_from_gsm0808_sc_cfg;
 gsm0808_speech_codec_type_names;
 gsm0808_permitted_speech_names;
 gsm0808_chosen_enc_alg_names;
@@ -312,15 +318,22 @@ osmo_lai_name;
 osmo_rai_name;
 osmo_cgi_name;
 osmo_cgi_name2;
+osmo_gummei_name;
 osmo_mnc_from_str;
 osmo_mnc_cmp;
 osmo_plmn_cmp;
+osmo_gen_home_network_domain;
+osmo_parse_home_network_domain;
+osmo_gen_mme_domain;
+osmo_parse_mme_domain;
+osmo_gen_mme_group_domain;
 gsm48_chan_mode_names;
 gsm_chan_t_names;
 gsm48_pdisc_names;
 gsm48_rr_msgtype_names;
 gsm48_mm_msgtype_names;
 gsm48_cc_msgtype_names;
+gsm48_cc_cause_names;
 gsm48_pdisc_msgtype_name;
 gsm48_reject_value_names;
 
@@ -336,6 +349,7 @@ gsm_7bit_decode_n_hdr;
 gsm_7bit_encode_n;
 gsm_7bit_encode_n_ussd;
 
+gsm_arfcn2band_rc;
 gsm_arfcn2band;
 gsm_arfcn2freq10;
 gsm_freq102arfcn;
@@ -501,5 +515,15 @@ osmo_oap_client_handle;
 osmo_oap_client_init;
 osmo_oap_client_register;
 
+sgsap_msg_type_names;
+sgsap_iei_names;
+sgsap_eps_lu_type_names;
+sgsap_ismi_det_eps_type_names;
+sgsap_ismi_det_noneps_type_names;
+sgsap_service_ind_names;
+sgsap_sgs_cause_names;
+sgsap_ue_emm_mode_names;
+sgsap_ie_tlvdef;
+
 local: *;
 };
diff --git a/src/logging.c b/src/logging.c
index de0f2b0f..e7cc4729 100644
--- a/src/logging.c
+++ b/src/logging.c
@@ -35,7 +35,6 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
-#include <ctype.h>
 
 #ifdef HAVE_STRINGS_H
 #include <strings.h>
@@ -61,13 +60,10 @@ osmo_static_assert(_LOG_FLT_COUNT <= 8*sizeof(((struct log_target*)NULL)->filter
 struct log_info *osmo_log_info;
 
 static struct log_context log_context;
-static void *tall_log_ctx = NULL;
+void *tall_log_ctx = NULL;
 LLIST_HEAD(osmo_log_target_list);
 
-#define LOGLEVEL_DEFS	6	/* Number of loglevels.*/
-
-static const struct value_string loglevel_strs[LOGLEVEL_DEFS+1] = {
-	{ 0,		"EVERYTHING" },
+const struct value_string loglevel_strs[] = {
 	{ LOGL_DEBUG,	"DEBUG" },
 	{ LOGL_INFO,	"INFO" },
 	{ LOGL_NOTICE,	"NOTICE" },
@@ -175,19 +171,7 @@ static const struct log_info_cat internal_cat[OSMO_NUM_DLIB] = {
 	},
 };
 
-/*! descriptive string for each log level */
-/* You have to keep this in sync with the structure loglevel_strs. */
-static const char *loglevel_descriptions[LOGLEVEL_DEFS+1] = {
-	"Don't use. It doesn't log anything",
-	"Log debug messages and higher levels",
-	"Log informational messages and higher levels",
-	"Log noticeable messages and higher levels",
-	"Log error messages and higher levels",
-	"Log only fatal messages",
-	NULL,
-};
-
-static void assert_loginfo(const char *src)
+void assert_loginfo(const char *src)
 {
 	if (!osmo_log_info) {
 		fprintf(stderr, "ERROR: osmo_log_info == NULL! "
@@ -963,149 +947,6 @@ int log_targets_reopen(void)
 	return rc;
 }
 
-/*! Generates the logging command string for VTY
- *  \param[in] unused_info Deprecated parameter, no longer used!
- *  \returns vty command string for use by VTY command node
- */
-const char *log_vty_command_string()
-{
-	struct log_info *info = osmo_log_info;
-	int len = 0, offset = 0, ret, i, rem;
-	int size = strlen("logging level (all|) ()") + 1;
-	char *str;
-
-	assert_loginfo(__func__);
-
-	for (i = 0; i < info->num_cat; i++) {
-		if (info->cat[i].name == NULL)
-			continue;
-		size += strlen(info->cat[i].name) + 1;
-	}
-
-	for (i = 0; i < LOGLEVEL_DEFS; i++)
-		size += strlen(loglevel_strs[i].str) + 1;
-
-	rem = size;
-	str = talloc_zero_size(tall_log_ctx, size);
-	if (!str)
-		return NULL;
-
-	ret = snprintf(str + offset, rem, "logging level (all|");
-	if (ret < 0)
-		goto err;
-	OSMO_SNPRINTF_RET(ret, rem, offset, len);
-
-	for (i = 0; i < info->num_cat; i++) {
-		if (info->cat[i].name) {
-			int j, name_len = strlen(info->cat[i].name)+1;
-			char name[name_len];
-
-			for (j = 0; j < name_len; j++)
-				name[j] = tolower((unsigned char)info->cat[i].name[j]);
-
-			name[name_len-1] = '\0';
-			ret = snprintf(str + offset, rem, "%s|", name+1);
-			if (ret < 0)
-				goto err;
-			OSMO_SNPRINTF_RET(ret, rem, offset, len);
-		}
-	}
-	offset--;	/* to remove the trailing | */
-	rem++;
-
-	ret = snprintf(str + offset, rem, ") (");
-	if (ret < 0)
-		goto err;
-	OSMO_SNPRINTF_RET(ret, rem, offset, len);
-
-	for (i = 0; i < LOGLEVEL_DEFS; i++) {
-		int j, loglevel_str_len = strlen(loglevel_strs[i].str)+1;
-		char loglevel_str[loglevel_str_len];
-
-		for (j = 0; j < loglevel_str_len; j++)
-			loglevel_str[j] = tolower((unsigned char)loglevel_strs[i].str[j]);
-
-		loglevel_str[loglevel_str_len-1] = '\0';
-		ret = snprintf(str + offset, rem, "%s|", loglevel_str);
-		if (ret < 0)
-			goto err;
-		OSMO_SNPRINTF_RET(ret, rem, offset, len);
-	}
-	offset--;	/* to remove the trailing | */
-	rem++;
-
-	ret = snprintf(str + offset, rem, ")");
-	if (ret < 0)
-		goto err;
-	OSMO_SNPRINTF_RET(ret, rem, offset, len);
-err:
-	str[size-1] = '\0';
-	return str;
-}
-
-/*! Generates the logging command description for VTY
- *  \param[in] unused_info Deprecated parameter, no longer used!
- *  \returns logging command description for use by VTY command node
- */
-const char *log_vty_command_description()
-{
-	struct log_info *info = osmo_log_info;
-	char *str;
-	int i, ret, len = 0, offset = 0, rem;
-	unsigned int size =
-		strlen(LOGGING_STR
-		       "Set the log level for a specified category\n") + 1;
-
-	assert_loginfo(__func__);
-
-	for (i = 0; i < info->num_cat; i++) {
-		if (info->cat[i].name == NULL)
-			continue;
-		size += strlen(info->cat[i].description) + 1;
-	}
-
-	for (i = 0; i < LOGLEVEL_DEFS; i++)
-		size += strlen(loglevel_descriptions[i]) + 1;
-
-	size += strlen("Global setting for all subsystems") + 1;
-	rem = size;
-	str = talloc_zero_size(tall_log_ctx, size);
-	if (!str)
-		return NULL;
-
-	ret = snprintf(str + offset, rem, LOGGING_STR
-			"Set the log level for a specified category\n");
-	if (ret < 0)
-		goto err;
-	OSMO_SNPRINTF_RET(ret, rem, offset, len);
-
-	ret = snprintf(str + offset, rem,
-			"Global setting for all subsystems\n");
-	if (ret < 0)
-		goto err;
-	OSMO_SNPRINTF_RET(ret, rem, offset, len);
-
-	for (i = 0; i < info->num_cat; i++) {
-		if (info->cat[i].name == NULL)
-			continue;
-		ret = snprintf(str + offset, rem, "%s\n",
-				info->cat[i].description);
-		if (ret < 0)
-			goto err;
-		OSMO_SNPRINTF_RET(ret, rem, offset, len);
-	}
-	for (i = 0; i < LOGLEVEL_DEFS; i++) {
-		ret = snprintf(str + offset, rem, "%s\n",
-				loglevel_descriptions[i]);
-		if (ret < 0)
-			goto err;
-		OSMO_SNPRINTF_RET(ret, rem, offset, len);
-	}
-err:
-	str[size-1] = '\0';
-	return str;
-}
-
 /*! Initialize the Osmocom logging core
  *  \param[in] inf Information regarding logging categories
  *  \param[in] ctx \ref talloc context for logging allocations
diff --git a/src/select.c b/src/select.c
index 0b115c61..b594ca55 100644
--- a/src/select.c
+++ b/src/select.c
@@ -324,11 +324,18 @@ int osmo_timerfd_setup(struct osmo_fd *ofd, int (*cb)(struct osmo_fd *, unsigned
 	ofd->when = BSC_FD_READ;
 
 	if (ofd->fd < 0) {
+		int rc;
+
 		ofd->fd = timerfd_create(CLOCK_MONOTONIC, TFD_NONBLOCK);
 		if (ofd->fd < 0)
 			return ofd->fd;
 
-		osmo_fd_register(ofd);
+		rc = osmo_fd_register(ofd);
+		if (rc < 0) {
+			close(ofd->fd);
+			ofd->fd = -1;
+			return rc;
+		}
 	}
 	return 0;
 }
diff --git a/src/socket.c b/src/socket.c
index 6f56efb5..0e17a28d 100644
--- a/src/socket.c
+++ b/src/socket.c
@@ -57,7 +57,7 @@ static struct addrinfo *addrinfo_helper(uint16_t family, uint16_t type, uint8_t
 					const char *host, uint16_t port, bool passive)
 {
 	struct addrinfo hints, *result;
-	char portbuf[16];
+	char portbuf[6];
 	int rc;
 
 	snprintf(portbuf, sizeof(portbuf), "%u", port);
@@ -605,29 +605,27 @@ int osmo_sock_unix_init(uint16_t type, uint8_t proto,
 	struct sockaddr_un local;
 	int sfd, rc, on = 1;
 	unsigned int namelen;
-	const size_t socket_path_len = strlen(socket_path);
 
 	if ((flags & (OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT)) ==
 		     (OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT))
 		return -EINVAL;
 
 	local.sun_family = AF_UNIX;
-	if (socket_path_len == sizeof(local.sun_path)) {
-		/* Handle corner-case where sun_path is not NUL-terminated. See the unix(7) man page. */
-		memcpy(local.sun_path, socket_path, sizeof(local.sun_path));
-	} else if (osmo_strlcpy(local.sun_path, socket_path, sizeof(local.sun_path)) >= sizeof(local.sun_path)) {
+	/* When an AF_UNIX socket is bound, sun_path should be NUL-terminated. See unix(7) man page. */
+	if (osmo_strlcpy(local.sun_path, socket_path, sizeof(local.sun_path)) >= sizeof(local.sun_path)) {
 		LOGP(DLGLOBAL, LOGL_ERROR, "Socket path exceeds maximum length of %zd bytes: %s\n",
 		     sizeof(local.sun_path), socket_path);
 		return -ENOSPC;
 	}
 
 #if defined(BSD44SOCKETS) || defined(__UNIXWARE__)
-	local.sun_len = socket_path_len;
+	local.sun_len = strlen(local.sun_path);
 #endif
 #if defined(BSD44SOCKETS) || defined(SUN_LEN)
 	namelen = SUN_LEN(&local);
 #else
-	namelen = socket_path_len + offsetof(struct sockaddr_un, sun_path);
+	namelen = strlen(local.sun_path) +
+		  offsetof(struct sockaddr_un, sun_path);
 #endif
 
 	sfd = socket(AF_UNIX, type, proto);
@@ -684,44 +682,105 @@ int osmo_sock_unix_init_ofd(struct osmo_fd *ofd, uint16_t type, uint8_t proto,
 	return osmo_fd_init_ofd(ofd, osmo_sock_unix_init(type, proto, socket_path, flags));
 }
 
-/*! Get address/port information on soocket in dyn-alloc string
- *  \param[in] ctx talloc context from which to allocate string buffer
+/*! Get the IP and/or port number on socket. This is for internal usage.
+ *  Convenience wrappers: osmo_sock_get_local_ip(),
+ *  osmo_sock_get_local_ip_port(), osmo_sock_get_remote_ip(),
+ *  osmo_sock_get_remote_ip_port() and osmo_sock_get_name()
  *  \param[in] fd file descriptor of socket
- *  \returns string identifying the connection of this socket
+ *  \param[out] ip IP address (will be filled in when not NULL)
+ *  \param[in] ip_len length of the ip buffer
+ *  \param[out] port number (will be filled in when not NULL)
+ *  \param[in] port_len length of the port buffer
+ *  \param[in] local (true) or remote (false) name will get looked at
+ *  \returns 0 on success; negative otherwise
  */
-char *osmo_sock_get_name(void *ctx, int fd)
+static int osmo_sock_get_name2(int fd, char *ip, size_t ip_len, char *port, size_t port_len, bool local)
 {
-	struct sockaddr sa_l, sa_r;
-	socklen_t sa_len_l = sizeof(sa_l);
-	socklen_t sa_len_r = sizeof(sa_r);
-	char hostbuf_l[64], hostbuf_r[64];
-	char portbuf_l[16], portbuf_r[16];
+	struct sockaddr sa;
+	socklen_t len = sizeof(sa);
+	char ipbuf[INET6_ADDRSTRLEN], portbuf[6];
 	int rc;
 
-	rc = getsockname(fd, &sa_l, &sa_len_l);
+	rc = local ? getsockname(fd, &sa, &len) : getpeername(fd, &sa, &len);
 	if (rc < 0)
-		return NULL;
+		return rc;
 
-	rc = getnameinfo(&sa_l, sa_len_l, hostbuf_l, sizeof(hostbuf_l),
-			 portbuf_l, sizeof(portbuf_l),
+	rc = getnameinfo(&sa, len, ipbuf, sizeof(ipbuf),
+			 portbuf, sizeof(portbuf),
 			 NI_NUMERICHOST | NI_NUMERICSERV);
 	if (rc < 0)
-		return NULL;
+		return rc;
 
-	rc = getpeername(fd, &sa_r, &sa_len_r);
-	if (rc < 0)
-		goto local_only;
+	if (ip)
+		strncpy(ip, ipbuf, ip_len);
+	if (port)
+		strncpy(port, portbuf, port_len);
+	return 0;
+}
 
-	rc = getnameinfo(&sa_r, sa_len_r, hostbuf_r, sizeof(hostbuf_r),
-			 portbuf_r, sizeof(portbuf_r),
-			 NI_NUMERICHOST | NI_NUMERICSERV);
-	if (rc < 0)
-		goto local_only;
+/*! Get local IP address on socket
+ *  \param[in] fd file descriptor of socket
+ *  \param[out] ip IP address (will be filled in)
+ *  \param[in] len length of the output buffer
+ *  \returns 0 on success; negative otherwise
+ */
+int osmo_sock_get_local_ip(int fd, char *ip, size_t len)
+{
+	return osmo_sock_get_name2(fd, ip, len, NULL, 0, true);
+}
+
+/*! Get local port on socket
+ *  \param[in] fd file descriptor of socket
+ *  \param[out] port number (will be filled in)
+ *  \param[in] len length of the output buffer
+ *  \returns 0 on success; negative otherwise
+ */
+int osmo_sock_get_local_ip_port(int fd, char *port, size_t len)
+{
+	return osmo_sock_get_name2(fd, NULL, 0, port, len, true);
+}
+
+/*! Get remote IP address on socket
+ *  \param[in] fd file descriptor of socket
+ *  \param[out] ip IP address (will be filled in)
+ *  \param[in] len length of the output buffer
+ *  \returns 0 on success; negative otherwise
+ */
+int osmo_sock_get_remote_ip(int fd, char *ip, size_t len)
+{
+	return osmo_sock_get_name2(fd, ip, len, NULL, 0, false);
+}
+
+/*! Get remote port on socket
+ *  \param[in] fd file descriptor of socket
+ *  \param[out] port number (will be filled in)
+ *  \param[in] len length of the output buffer
+ *  \returns 0 on success; negative otherwise
+ */
+int osmo_sock_get_remote_ip_port(int fd, char *port, size_t len)
+{
+	return osmo_sock_get_name2(fd, NULL, 0, port, len, false);
+}
+
+/*! Get address/port information on socket in dyn-alloc string
+ *  \param[in] ctx talloc context from which to allocate string buffer
+ *  \param[in] fd file descriptor of socket
+ *  \returns string identifying the connection of this socket
+ */
+char *osmo_sock_get_name(void *ctx, int fd)
+{
+	char hostbuf_l[INET6_ADDRSTRLEN], hostbuf_r[INET6_ADDRSTRLEN];
+	char portbuf_l[6], portbuf_r[6];
+
+	/* get local */
+	if (osmo_sock_get_name2(fd, hostbuf_l, sizeof(hostbuf_l), portbuf_l, sizeof(portbuf_l), true))
+		return NULL;
 
-	return talloc_asprintf(ctx, "(r=%s:%s<->l=%s:%s)", hostbuf_r, portbuf_r,
-				hostbuf_l, portbuf_l);
+	/* get remote */
+	if (!osmo_sock_get_name2(fd, hostbuf_r, sizeof(hostbuf_r), portbuf_r, sizeof(portbuf_r), false))
+		return talloc_asprintf(ctx, "(r=%s:%s<->l=%s:%s)", hostbuf_r, portbuf_r, hostbuf_l, portbuf_l);
 
-local_only:
+	/* local only: different format */
 	return talloc_asprintf(ctx, "(r=NULL<->l=%s:%s)", hostbuf_l, portbuf_l);
 }
 
diff --git a/src/stats_statsd.c b/src/stats_statsd.c
index 5ae25702..c3f739e2 100644
--- a/src/stats_statsd.c
+++ b/src/stats_statsd.c
@@ -184,20 +184,17 @@ static int osmo_stats_reporter_statsd_send_item(struct osmo_stats_reporter *srep
 	const struct osmo_stat_item_group *statg,
 	const struct osmo_stat_item_desc *desc, int64_t value)
 {
-	const char *unit = desc->unit;
-
-	if (unit == OSMO_STAT_ITEM_NO_UNIT) {
-		unit = "g";
-		if (value < 0)
-			osmo_stats_reporter_statsd_send(srep,
+	if (value < 0) {
+		return osmo_stats_reporter_statsd_send(srep,
 				statg->desc->group_name_prefix,
 				statg->idx,
-				desc->name, 0, unit);
+				desc->name, 0, "g");
+	} else {
+		return osmo_stats_reporter_statsd_send(srep,
+			statg->desc->group_name_prefix,
+			statg->idx,
+			desc->name, value, "g");
 	}
-	return osmo_stats_reporter_statsd_send(srep,
-		statg->desc->group_name_prefix,
-		statg->idx,
-		desc->name, value, unit);
 }
 #endif /* !EMBEDDED */
 
diff --git a/src/utils.c b/src/utils.c
index ea0bbde0..e6adcf86 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -557,8 +557,8 @@ const char *osmo_escape_str(const char *str, int in_len)
 /*! Like osmo_escape_str(), but returns double-quotes around a string, or "NULL" for a NULL string.
  * This allows passing any char* value and get its C representation as string.
  * \param[in] str  A string that may contain any characters.
- * \param[in] len  Pass -1 to print until nul char, or >= 0 to force a length.
- * \returns buf containing an escaped representation, possibly truncated, or str itself.
+ * \param[in] in_len  Pass -1 to print until nul char, or >= 0 to force a length.
+ * \returns buf containing a quoted and escaped representation, possibly truncated.
  */
 const char *osmo_quote_str_buf(const char *str, int in_len, char *buf, size_t bufsize)
 {
@@ -587,6 +587,12 @@ const char *osmo_quote_str_buf(const char *str, int in_len, char *buf, size_t bu
 	return buf;
 }
 
+/*! Like osmo_quote_str_buf() but returns the result in a static buffer.
+ * The static buffer is shared with get_value_string() and osmo_escape_str().
+ * \param[in] str  A string that may contain any characters.
+ * \param[in] in_len  Pass -1 to print until nul char, or >= 0 to force a length.
+ * \returns static buffer containing a quoted and escaped representation, possibly truncated.
+ */
 const char *osmo_quote_str(const char *str, int in_len)
 {
 	return osmo_quote_str_buf(str, in_len, namebuf, sizeof(namebuf));
@@ -632,4 +638,90 @@ uint32_t osmo_isqrt32(uint32_t x)
 	return g0;
 }
 
+/*! Convert a string to lowercase, while checking buffer size boundaries.
+ * The result written to \a dest is guaranteed to be nul terminated if \a dest_len > 0.
+ * If dest == src, the string is converted in-place, if necessary truncated at dest_len - 1 characters
+ * length as well as nul terminated.
+ * Note: similar osmo_str2lower(), but safe to use for src strings of arbitrary length.
+ *  \param[out] dest  Target buffer to write lowercase string.
+ *  \param[in] dest_len  Maximum buffer size of dest (e.g. sizeof(dest)).
+ *  \param[in] src  String to convert to lowercase.
+ *  \returns Length of \a src, like osmo_strlcpy(), but if \a dest == \a src at most \a dest_len - 1.
+ */
+size_t osmo_str_tolower_buf(char *dest, size_t dest_len, const char *src)
+{
+	size_t rc;
+	if (dest == src) {
+		if (dest_len < 1)
+			return 0;
+		dest[dest_len - 1] = '\0';
+		rc = strlen(dest);
+	} else {
+		if (dest_len < 1)
+			return strlen(src);
+		rc = osmo_strlcpy(dest, src, dest_len);
+	}
+	for (; *dest; dest++)
+		*dest = tolower(*dest);
+	return rc;
+}
+
+/*! Convert a string to lowercase, using a static buffer.
+ * The resulting string may be truncated if the internally used static buffer is shorter than src.
+ * The internal buffer is at least 128 bytes long, i.e. guaranteed to hold at least 127 characters and a
+ * terminating nul.
+ * See also osmo_str_tolower_buf().
+ * \param[in] src  String to convert to lowercase.
+ * \returns Resulting lowercase string in a static buffer, always nul terminated.
+ */
+const char *osmo_str_tolower(const char *src)
+{
+	static char buf[128];
+	osmo_str_tolower_buf(buf, sizeof(buf), src);
+	return buf;
+}
+
+/*! Convert a string to uppercase, while checking buffer size boundaries.
+ * The result written to \a dest is guaranteed to be nul terminated if \a dest_len > 0.
+ * If dest == src, the string is converted in-place, if necessary truncated at dest_len - 1 characters
+ * length as well as nul terminated.
+ * Note: similar osmo_str2upper(), but safe to use for src strings of arbitrary length.
+ *  \param[out] dest  Target buffer to write uppercase string.
+ *  \param[in] dest_len  Maximum buffer size of dest (e.g. sizeof(dest)).
+ *  \param[in] src  String to convert to uppercase.
+ *  \returns Length of \a src, like osmo_strlcpy(), but if \a dest == \a src at most \a dest_len - 1.
+ */
+size_t osmo_str_toupper_buf(char *dest, size_t dest_len, const char *src)
+{
+	size_t rc;
+	if (dest == src) {
+		if (dest_len < 1)
+			return 0;
+		dest[dest_len - 1] = '\0';
+		rc = strlen(dest);
+	} else {
+		if (dest_len < 1)
+			return strlen(src);
+		rc = osmo_strlcpy(dest, src, dest_len);
+	}
+	for (; *dest; dest++)
+		*dest = toupper(*dest);
+	return rc;
+}
+
+/*! Convert a string to uppercase, using a static buffer.
+ * The resulting string may be truncated if the internally used static buffer is shorter than src.
+ * The internal buffer is at least 128 bytes long, i.e. guaranteed to hold at least 127 characters and a
+ * terminating nul.
+ * See also osmo_str_toupper_buf().
+ * \param[in] src  String to convert to uppercase.
+ * \returns Resulting uppercase string in a static buffer, always nul terminated.
+ */
+const char *osmo_str_toupper(const char *src)
+{
+	static char buf[128];
+	osmo_str_toupper_buf(buf, sizeof(buf), src);
+	return buf;
+}
+
 /*! @} */
diff --git a/src/vty/command.c b/src/vty/command.c
index 43f974ce..a540cd5b 100644
--- a/src/vty/command.c
+++ b/src/vty/command.c
@@ -679,7 +679,7 @@ static int vty_dump_nodes(struct vty *vty)
 			elem = vector_slot(cnode->cmd_vector, j);
 			if (!vty_command_is_common(elem))
 				continue;
-			if (!elem->attr & CMD_ATTR_DEPRECATED)
+			if (!(elem->attr & (CMD_ATTR_DEPRECATED | CMD_ATTR_HIDDEN)))
 				vty_dump_element(elem, vty);
 		}
 	}
@@ -717,7 +717,7 @@ static int vty_dump_nodes(struct vty *vty)
 			elem = vector_slot(cnode->cmd_vector, j);
 			if (vty_command_is_common(elem))
 				continue;
-			if (!elem->attr & CMD_ATTR_DEPRECATED)
+			if (!(elem->attr & (CMD_ATTR_DEPRECATED | CMD_ATTR_HIDDEN)))
 				vty_dump_element(elem, vty);
 		}
 
@@ -2728,8 +2728,7 @@ gDEFUN(config_list, config_list_cmd, "list", "Print command list\n")
 
 	for (i = 0; i < vector_active(cnode->cmd_vector); i++)
 		if ((cmd = vector_slot(cnode->cmd_vector, i)) != NULL
-		    && !(cmd->attr == CMD_ATTR_DEPRECATED
-			 || cmd->attr == CMD_ATTR_HIDDEN))
+		    && !(cmd->attr & (CMD_ATTR_DEPRECATED | CMD_ATTR_HIDDEN)))
 			vty_out(vty, "  %s%s", cmd->string, VTY_NEWLINE);
 	return CMD_SUCCESS;
 }
diff --git a/src/vty/logging_vty.c b/src/vty/logging_vty.c
index 8c8a3326..f3e1419c 100644
--- a/src/vty/logging_vty.c
+++ b/src/vty/logging_vty.c
@@ -28,6 +28,7 @@
 
 #include <osmocom/core/talloc.h>
 #include <osmocom/core/logging.h>
+#include <osmocom/core/logging_internal.h>
 #include <osmocom/core/utils.h>
 #include <osmocom/core/strrb.h>
 #include <osmocom/core/loggingrb.h>
@@ -40,6 +41,25 @@
 #include <osmocom/vty/logging.h>
 
 #define LOG_STR "Configure logging sub-system\n"
+#define LEVEL_STR "Set the log level for a specified category\n"
+
+#define CATEGORY_ALL_STR "Deprecated alias for 'force-all'\n"
+#define FORCE_ALL_STR \
+	"Globally force all logging categories to a specific level. This is released by the" \
+	" 'no logging level force-all' command. Note: any 'logging level <category> <level>'" \
+	" commands will have no visible effect after this, until the forced level is released.\n"
+#define NO_FORCE_ALL_STR \
+	"Release any globally forced log level set with 'logging level force-all <level>'\n"
+
+#define LOG_LEVEL_ARGS "(debug|info|notice|error|fatal)"
+#define LOG_LEVEL_STRS \
+	"Log debug messages and higher levels\n" \
+	"Log informational messages and higher levels\n" \
+	"Log noticeable messages and higher levels\n" \
+	"Log error messages and higher levels\n" \
+	"Log only fatal messages\n"
+
+#define EVERYTHING_STR "Deprecated alias for 'no logging level force-all'\n"
 
 /*! \file logging_vty.c
  *  Configuration of logging from VTY
@@ -58,8 +78,6 @@
  *
  */
 
-extern const struct log_info *osmo_log_info;
-
 static void _vty_output(struct log_target *tgt,
 			unsigned int level, const char *line)
 {
@@ -268,6 +286,46 @@ DEFUN(logging_prnt_file,
 	return CMD_SUCCESS;
 }
 
+static void add_category_strings(char **cmd_str_p, char **doc_str_p,
+				 const struct log_info *categories)
+{
+	int i;
+	for (i = 0; i < categories->num_cat; i++) {
+		if (categories->cat[i].name == NULL)
+			continue;
+		/* skip the leading 'D' in each category name, hence '+ 1' */
+		osmo_talloc_asprintf(tall_log_ctx, *cmd_str_p, "%s%s",
+				     i ? "|" : "",
+				     osmo_str_tolower(categories->cat[i].name + 1));
+		osmo_talloc_asprintf(tall_log_ctx, *doc_str_p, "%s\n",
+				     categories->cat[i].description);
+	}
+}
+
+static void gen_logging_level_cmd_strs(struct cmd_element *cmd,
+				       const char *level_args, const char *level_strs)
+{
+	char *cmd_str = NULL;
+	char *doc_str = NULL;
+
+	assert_loginfo(__func__);
+
+	OSMO_ASSERT(cmd->string == NULL);
+	OSMO_ASSERT(cmd->doc == NULL);
+
+	osmo_talloc_asprintf(tall_log_ctx, cmd_str, "logging level (");
+	osmo_talloc_asprintf(tall_log_ctx, doc_str,
+			     LOGGING_STR
+			     LEVEL_STR);
+	add_category_strings(&cmd_str, &doc_str, osmo_log_info);
+	osmo_talloc_asprintf(tall_log_ctx, cmd_str, ") %s", level_args);
+	osmo_talloc_asprintf(tall_log_ctx, doc_str, "%s", level_strs);
+
+	cmd->string = cmd_str;
+	cmd->doc = doc_str;
+}
+
+/* logging level (<categories>) (debug|...|fatal) */
 DEFUN(logging_level,
       logging_level_cmd,
       NULL, /* cmdstr is dynamically set in logging_vty_add_cmds(). */
@@ -285,17 +343,6 @@ DEFUN(logging_level,
 		return CMD_WARNING;
 	}
 
-	if (strcmp(argv[1], "everything") == 0) { /* FIXME: remove this check once 'everything' is phased out */
-		vty_out(vty, "%% Ignoring deprecated logging level %s%s", argv[1], VTY_NEWLINE);
-		return CMD_SUCCESS;
-	}
-
-	/* Check for special case where we want to set global log level */
-	if (!strcmp(argv[0], "all")) {
-		log_set_log_level(tgt, level);
-		return CMD_SUCCESS;
-	}
-
 	if (category < 0) {
 		vty_out(vty, "Invalid category `%s'%s", argv[0], VTY_NEWLINE);
 		return CMD_WARNING;
@@ -307,6 +354,74 @@ DEFUN(logging_level,
 	return CMD_SUCCESS;
 }
 
+DEFUN(logging_level_set_all, logging_level_set_all_cmd,
+      "logging level set-all " LOG_LEVEL_ARGS,
+      LOGGING_STR LEVEL_STR
+      "Once-off set all categories to the given log level. There is no single command"
+      " to take back these changes -- each category is set to the given level, period.\n"
+      LOG_LEVEL_STRS)
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+	int level = log_parse_level(argv[0]);
+	int i;
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	for (i = 0; i < osmo_log_info->num_cat; i++) {
+		struct log_category *cat = &tgt->categories[i];
+		/* skip empty entries in the array */
+		if (!osmo_log_info->cat[i].name)
+			continue;
+
+		cat->enabled = 1;
+		cat->loglevel = level;
+	}
+	return CMD_SUCCESS;
+}
+
+/* logging level (<categories>) everything */
+DEFUN_DEPRECATED(deprecated_logging_level_everything, deprecated_logging_level_everything_cmd,
+		 NULL, /* cmdstr is dynamically set in logging_vty_add_cmds(). */
+		 NULL) /* same thing for helpstr. */
+{
+	vty_out(vty, "%% Ignoring deprecated logging level 'everything' keyword%s", VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+DEFUN(logging_level_force_all, logging_level_force_all_cmd,
+      "logging level force-all " LOG_LEVEL_ARGS,
+      LOGGING_STR LEVEL_STR FORCE_ALL_STR LOG_LEVEL_STRS)
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+	int level = log_parse_level(argv[0]);
+	if (!tgt)
+		return CMD_WARNING;
+	log_set_log_level(tgt, level);
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_logging_level_force_all, no_logging_level_force_all_cmd,
+      "no logging level force-all",
+      NO_STR LOGGING_STR LEVEL_STR NO_FORCE_ALL_STR)
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+	if (!tgt)
+		return CMD_WARNING;
+	log_set_log_level(tgt, 0);
+	return CMD_SUCCESS;
+}
+
+/* 'logging level all (debug|...|fatal)' */
+ALIAS_DEPRECATED(logging_level_force_all, deprecated_logging_level_all_cmd,
+		 "logging level all " LOG_LEVEL_ARGS,
+		 LOGGING_STR LEVEL_STR CATEGORY_ALL_STR LOG_LEVEL_STRS);
+
+/* 'logging level all everything' */
+ALIAS_DEPRECATED(no_logging_level_force_all, deprecated_logging_level_all_everything_cmd,
+		 "logging level all everything",
+		 LOGGING_STR LEVEL_STR CATEGORY_ALL_STR EVERYTHING_STR);
+
 DEFUN(logging_set_category_mask,
       logging_set_category_mask_cmd,
       "logging set-log-mask MASK",
@@ -754,7 +869,6 @@ DEFUN(cfg_no_log_alarms, cfg_no_log_alarms_cmd,
 static int config_write_log_single(struct vty *vty, struct log_target *tgt)
 {
 	int i;
-	char level_lower[32];
 
 	switch (tgt->type) {
 	case LOG_TGT_TYPE_VTY:
@@ -784,43 +898,59 @@ static int config_write_log_single(struct vty *vty, struct log_target *tgt)
 		break;
 	}
 
-	vty_out(vty, "  logging filter all %u%s",
+	vty_out(vty, " logging filter all %u%s",
 		tgt->filter_map & (1 << LOG_FLT_ALL) ? 1 : 0, VTY_NEWLINE);
 	/* save filters outside of libosmocore, i.e. in app code */
 	if (osmo_log_info->save_fn)
 		osmo_log_info->save_fn(vty, osmo_log_info, tgt);
 
-	vty_out(vty, "  logging color %u%s", tgt->use_color ? 1 : 0,
+	vty_out(vty, " logging color %u%s", tgt->use_color ? 1 : 0,
 		VTY_NEWLINE);
-	vty_out(vty, "  logging print category %d%s",
+	vty_out(vty, " logging print category %d%s",
 		tgt->print_category ? 1 : 0, VTY_NEWLINE);
 	if (tgt->print_ext_timestamp)
-		vty_out(vty, "  logging print extended-timestamp 1%s", VTY_NEWLINE);
+		vty_out(vty, " logging print extended-timestamp 1%s", VTY_NEWLINE);
 	else
-		vty_out(vty, "  logging timestamp %u%s",
+		vty_out(vty, " logging timestamp %u%s",
 			tgt->print_timestamp ? 1 : 0, VTY_NEWLINE);
 	if (tgt->print_level)
-		vty_out(vty, "  logging print level 1%s", VTY_NEWLINE);
-	vty_out(vty, "  logging print file %s%s",
+		vty_out(vty, " logging print level 1%s", VTY_NEWLINE);
+	vty_out(vty, " logging print file %s%s",
 		get_value_string(logging_print_file_args, tgt->print_filename2),
 		VTY_NEWLINE);
 
-	/* stupid old osmo logging API uses uppercase strings... */
-	osmo_str2lower(level_lower, log_level_str(tgt->loglevel));
-	vty_out(vty, "  logging level all %s%s", level_lower, VTY_NEWLINE);
+	if (tgt->loglevel) {
+		const char *level_str = get_value_string_or_null(loglevel_strs, tgt->loglevel);
+		level_str = osmo_str_tolower(level_str);
+		if (!level_str)
+			vty_out(vty, "%% Invalid log level %u for 'force-all'%s",
+				tgt->loglevel, VTY_NEWLINE);
+		else
+			vty_out(vty, " logging level force-all %s%s", level_str, VTY_NEWLINE);
+	}
 
 	for (i = 0; i < osmo_log_info->num_cat; i++) {
 		const struct log_category *cat = &tgt->categories[i];
-		char cat_lower[32];
+		const char *cat_name;
+		const char *level_str;
 
 		/* skip empty entries in the array */
 		if (!osmo_log_info->cat[i].name)
 			continue;
 
-		/* stupid old osmo logging API uses uppercase strings... */
-		osmo_str2lower(cat_lower, osmo_log_info->cat[i].name+1);
-		osmo_str2lower(level_lower, log_level_str(cat->loglevel));
-		vty_out(vty, "  logging level %s %s%s", cat_lower, level_lower, VTY_NEWLINE);
+		/* Note: cat_name references the static buffer returned by osmo_str_tolower(), will
+		 * become invalid after next osmo_str_tolower() invocation. */
+		cat_name = osmo_str_tolower(osmo_log_info->cat[i].name+1);
+
+		level_str = get_value_string_or_null(loglevel_strs, cat->loglevel);
+		if (!level_str) {
+			vty_out(vty, "%% Invalid log level %u for %s%s", cat->loglevel, cat_name,
+				VTY_NEWLINE);
+			continue;
+		}
+
+		vty_out(vty, " logging level %s", cat_name);
+		vty_out(vty, " %s%s", osmo_str_tolower(level_str), VTY_NEWLINE);
 	}
 
 	return 1;
@@ -846,11 +976,11 @@ void logging_vty_add_deprecated_subsys(void *ctx, const char *name)
 {
 	struct cmd_element *cmd = talloc_zero(ctx, struct cmd_element);
 	OSMO_ASSERT(cmd);
-	cmd->string = talloc_asprintf(cmd, "logging level %s (everything|debug|info|notice|error|fatal)",
+	cmd->string = talloc_asprintf(cmd, "logging level %s (debug|info|notice|error|fatal)",
 				    name);
 	printf("%s\n", cmd->string);
 	cmd->func = log_deprecated_func;
-	cmd->doc = "Set the log level for a specified category\n"
+	cmd->doc = LEVEL_STR
 		   "Deprecated Category\n";
 	cmd->attr = CMD_ATTR_DEPRECATED;
 
@@ -874,10 +1004,21 @@ void logging_vty_add_cmds()
 	install_element_ve(&logging_set_category_mask_cmd);
 	install_element_ve(&logging_set_category_mask_old_cmd);
 
-	/* Logging level strings are generated dynamically. */
-	logging_level_cmd.string = log_vty_command_string();
-	logging_level_cmd.doc = log_vty_command_description();
+	/* logging level (<categories>) (debug|...|fatal) */
+	gen_logging_level_cmd_strs(&logging_level_cmd,
+				   LOG_LEVEL_ARGS,
+				   LOG_LEVEL_STRS);
+	/* logging level (<categories>) everything */
+	gen_logging_level_cmd_strs(&deprecated_logging_level_everything_cmd,
+				   "everything", EVERYTHING_STR);
+
 	install_element_ve(&logging_level_cmd);
+	install_element_ve(&logging_level_set_all_cmd);
+	install_element_ve(&logging_level_force_all_cmd);
+	install_element_ve(&no_logging_level_force_all_cmd);
+	install_element_ve(&deprecated_logging_level_everything_cmd);
+	install_element_ve(&deprecated_logging_level_all_cmd);
+	install_element_ve(&deprecated_logging_level_all_everything_cmd);
 	install_element_ve(&show_logging_vty_cmd);
 	install_element_ve(&show_alarms_cmd);
 
@@ -891,6 +1032,12 @@ void logging_vty_add_cmds()
 	install_element(CFG_LOG_NODE, &logging_prnt_level_cmd);
 	install_element(CFG_LOG_NODE, &logging_prnt_file_cmd);
 	install_element(CFG_LOG_NODE, &logging_level_cmd);
+	install_element(CFG_LOG_NODE, &logging_level_set_all_cmd);
+	install_element(CFG_LOG_NODE, &logging_level_force_all_cmd);
+	install_element(CFG_LOG_NODE, &no_logging_level_force_all_cmd);
+	install_element(CFG_LOG_NODE, &deprecated_logging_level_everything_cmd);
+	install_element(CFG_LOG_NODE, &deprecated_logging_level_all_cmd);
+	install_element(CFG_LOG_NODE, &deprecated_logging_level_all_everything_cmd);
 
 	install_element(CONFIG_NODE, &cfg_log_stderr_cmd);
 	install_element(CONFIG_NODE, &cfg_no_log_stderr_cmd);
diff --git a/src/vty/stats_vty.c b/src/vty/stats_vty.c
index 5ded7a44..c9110879 100644
--- a/src/vty/stats_vty.c
+++ b/src/vty/stats_vty.c
@@ -533,6 +533,7 @@ DEFUN(show_stats_asciidoc_table,
 static int rate_ctr_group_handler(struct rate_ctr_group *ctrg, void *sctx_)
 {
 	struct vty *vty = sctx_;
+	vty_out(vty, "%s %u:%s", ctrg->desc->group_description, ctrg->idx, VTY_NEWLINE);
 	vty_out_rate_ctr_group_fmt(vty, "%25n: %10c (%S/s %M/m %H/h %D/d) %d", ctrg);
 	return 0;
 }
diff --git a/src/vty/telnet_interface.c b/src/vty/telnet_interface.c
index 0ccf8dc6..fcb4c8db 100644
--- a/src/vty/telnet_interface.c
+++ b/src/vty/telnet_interface.c
@@ -101,7 +101,7 @@ int telnet_init_dynif(void *tall_ctx, void *priv, const char *ip, int port)
 		return -1;
 	}
 
-	LOGP(DLGLOBAL, LOGL_NOTICE, "telnet at %s %d\n", ip, port);
+	LOGP(DLGLOBAL, LOGL_NOTICE, "Available via telnet %s %d\n", ip, port);
 	return 0;
 }
 
@@ -177,7 +177,7 @@ static int telnet_new_connection(struct osmo_fd *fd, unsigned int what)
 	connection->vty = vty_create(new_connection, connection);
 	if (!connection->vty) {
 		LOGP(0, LOGL_ERROR, "couldn't create VTY\n");
-		close(new_connection);
+		/* vty_create() is already closing the fd if it returns NULL */
 		talloc_free(connection);
 		return -1;
 	}
diff --git a/src/vty/utils.c b/src/vty/utils.c
index 0d663c6e..0358d9bd 100644
--- a/src/vty/utils.c
+++ b/src/vty/utils.c
@@ -214,9 +214,6 @@ void vty_out_rate_ctr_group_fmt(struct vty *vty, const char *fmt,
 				struct rate_ctr_group *ctrg)
 {
 	struct vty_out_context vctx = {vty, fmt};
-
-	vty_out(vty, "%s:%s", ctrg->desc->group_description, VTY_NEWLINE);
-
 	rate_ctr_for_each_counter(ctrg, rate_ctr_handler_fmt, &vctx);
 }
 
diff --git a/src/vty/vty.c b/src/vty/vty.c
index ad535371..70f6811a 100644
--- a/src/vty/vty.c
+++ b/src/vty/vty.c
@@ -221,8 +221,10 @@ void vty_close(struct vty *vty)
 	vector_unset(vtyvec, vty->fd);
 
 	/* Close socket. */
-	if (vty->fd > 0)
+	if (vty->fd > 0) {
 		close(vty->fd);
+		vty->fd = -1;
+	}
 
 	if (vty->buf) {
 		talloc_free(vty->buf);