libmsc/gsm_09_11.c: implement network-initiated sessions

This change introduces a possibility to establish network-initiated
SS/USSD transactions with a subscriber in either IDLE, or DEDICATED
state. In the first case, a new transaction is established using
Paging procedure. If a subscriber already has an active connection,
a separate new transaction is established.

TTCN-3 test case: I073893c6e11be27e9e36f98f11c1491d0c173985
Change-Id: Ief14f8914ef013bd6efd7be842f81fbf053f02e2

5 files changed, 500 insertions, 10 deletions

diff --git a/include/osmocom/msc/transaction.h b/include/osmocom/msc/transaction.h
index 63b1cc519..4ffb468bb 100644
--- a/include/osmocom/msc/transaction.h
+++ b/include/osmocom/msc/transaction.h
@@ -77,6 +77,13 @@ struct gsm_trans {
 
 			struct gsm_sms *sms;
 		} sms;
+		struct {
+			/**
+			 * Stores a GSM 04.80 message to be sent to
+			 * a subscriber after successful Paging Response
+			 */
+			struct msgb *msg;
+		} ss;
 	};
 
 	struct {
diff --git a/src/libmsc/gsm_09_11.c b/src/libmsc/gsm_09_11.c
index 219325ed1..9423ec732 100644
--- a/src/libmsc/gsm_09_11.c
+++ b/src/libmsc/gsm_09_11.c
@@ -30,6 +30,7 @@
 #include <errno.h>
 #include <stdbool.h>
 
+#include <osmocom/core/linuxlist.h>
 #include <osmocom/core/utils.h>
 #include <osmocom/core/msgb.h>
 #include <osmocom/gsm/tlv.h>
@@ -195,6 +196,163 @@ error:
 	return rc;
 }
 
+/* Call-back from paging the B-end of the connection */
+static int handle_paging_event(unsigned int hooknum, unsigned int event,
+			      struct msgb *msg, void *_conn, void *_transt)
+{
+	struct gsm_subscriber_connection *conn = _conn;
+	enum gsm_paging_event paging_event = event;
+	struct gsm_trans *transt = _transt;
+	struct gsm48_hdr *gh;
+	struct msgb *ss_msg;
+
+	OSMO_ASSERT(!transt->conn);
+	OSMO_ASSERT(transt->ss.msg);
+
+	switch (paging_event) {
+	case GSM_PAGING_SUCCEEDED:
+		DEBUGP(DMM, "Paging subscr %s succeeded!\n",
+			vlr_subscr_msisdn_or_name(transt->vsub));
+
+		/* Assign connection */
+		transt->conn = msc_subscr_conn_get(conn, MSC_CONN_USE_TRANS_NC_SS);
+		transt->paging_request = NULL;
+
+		/* Send stored message */
+		ss_msg = transt->ss.msg;
+		OSMO_ASSERT(ss_msg);
+
+		gh = (struct gsm48_hdr *) msgb_push(ss_msg, sizeof(*gh));
+		gh->proto_discr  = GSM48_PDISC_NC_SS;
+		gh->proto_discr |= transt->transaction_id << 4;
+		gh->msg_type = GSM0480_MTYPE_REGISTER;
+
+		/* Sent to the MS, give ownership of ss_msg */
+		msc_tx_dtap(transt->conn, ss_msg);
+		transt->ss.msg = NULL;
+		break;
+	case GSM_PAGING_EXPIRED:
+	case GSM_PAGING_BUSY:
+		DEBUGP(DMM, "Paging subscr %s %s!\n",
+			vlr_subscr_msisdn_or_name(transt->vsub),
+			paging_event == GSM_PAGING_EXPIRED ? "expired" : "busy");
+
+		/* TODO: inform HLR about this failure */
+
+		msgb_free(transt->ss.msg);
+		transt->ss.msg = NULL;
+
+		transt->callref = 0;
+		transt->paging_request = NULL;
+		trans_free(transt);
+		break;
+	}
+
+	return 0;
+}
+
+static struct gsm_trans *establish_nc_ss_trans(struct gsm_network *net,
+	struct vlr_subscr *vsub, struct osmo_gsup_message *gsup_msg)
+{
+	struct gsm_subscriber_connection *conn;
+	struct gsm_trans *trans, *transt;
+	int tid;
+
+	if (gsup_msg->session_state != OSMO_GSUP_SESSION_STATE_BEGIN) {
+		LOGP(DMM, LOGL_ERROR, "Received non-BEGIN message "
+			"for non-existing transaction\n");
+		return NULL;
+	}
+
+	if (!gsup_msg->ss_info || gsup_msg->ss_info_len < 2) {
+		LOGP(DMM, LOGL_ERROR, "Missing mandatory Facility IE\n");
+		return NULL;
+	}
+
+	/* If subscriber is not "attached" */
+	if (!vsub->lac) {
+		LOGP(DMM, LOGL_ERROR, "Network-originated session "
+			"rejected - subscriber is not attached\n");
+		return NULL;
+	}
+
+	DEBUGP(DMM, "Establishing network-originated session\n");
+
+	/* Allocate a new transaction */
+	trans = trans_alloc(net, vsub, GSM48_PDISC_NC_SS,
+		0xff, gsup_msg->session_id);
+	if (!trans) {
+		DEBUGP(DMM, " -> No memory for trans\n");
+		return NULL;
+	}
+
+	/* Assign transaction ID */
+	tid = trans_assign_trans_id(trans->net,
+		trans->vsub, GSM48_PDISC_NC_SS, 0);
+	if (tid < 0) {
+		LOGP(DMM, LOGL_ERROR, "No free transaction ID\n");
+		/* TODO: inform HLR about this */
+		/* TODO: release connection with subscriber */
+		trans->callref = 0;
+		trans_free(trans);
+		return NULL;
+	}
+	trans->transaction_id = tid;
+
+	/* Attempt to find connection */
+	conn = connection_for_subscr(vsub);
+	if (conn) {
+		/* Assign connection */
+		trans->conn = msc_subscr_conn_get(conn, MSC_CONN_USE_TRANS_NC_SS);
+		trans->dlci = 0x00; /* SAPI=0, not SACCH */
+		return trans;
+	}
+
+	DEBUGP(DMM, "Triggering Paging Request\n");
+
+	/* Find transaction with this subscriber already paging */
+	llist_for_each_entry(transt, &net->trans_list, entry) {
+		/* Transaction of our conn? */
+		if (transt == trans || transt->vsub != vsub)
+			continue;
+
+		LOGP(DMM, LOGL_ERROR, "Paging already started, "
+			"rejecting message...\n");
+		trans_free(trans);
+		return NULL;
+	}
+
+	/* Trigger Paging Request */
+	trans->paging_request = subscr_request_conn(vsub,
+		&handle_paging_event, trans, "GSM 09.11 SS/USSD");
+	if (!trans->paging_request) {
+		LOGP(DMM, LOGL_ERROR, "Failed to allocate paging token\n");
+		trans_free(trans);
+		return NULL;
+	}
+
+	/* Store the Facility IE to be sent */
+	OSMO_ASSERT(trans->ss.msg == NULL);
+	trans->ss.msg = gsm48_msgb_alloc_name("GSM 04.08 SS/USSD");
+	msgb_tlv_put(trans->ss.msg, GSM0480_IE_FACILITY,
+		gsup_msg->ss_info_len, gsup_msg->ss_info);
+
+	return NULL;
+}
+
+/* NC SS specific transaction release.
+ * Gets called by trans_free, DO NOT CALL YOURSELF! */
+void _gsm911_nc_ss_trans_free(struct gsm_trans *trans)
+{
+	/**
+	 * TODO: if transaction wasn't properly terminated,
+	 * we need to do it here by releasing the subscriber
+	 * connection and sending notification via GSUP...
+	 */
+	if (trans->ss.msg != NULL)
+		msgb_free(trans->ss.msg);
+}
+
 int gsm0911_gsup_handler(struct vlr_subscr *vsub,
 			 struct osmo_gsup_message *gsup_msg)
 {
@@ -225,10 +383,16 @@ int gsm0911_gsup_handler(struct vlr_subscr *vsub,
 	/* Attempt to find DTAP-transaction */
 	trans = trans_find_by_callref(net, gsup_msg->session_id);
 	if (!trans) {
-		/* FIXME: network-originated sessions are not supported yet */
-		LOGP(DMM, LOGL_ERROR, "Network-originated sessions "
-			"are not supported, dropping request...\n");
-		return -ENOTSUP;
+		/* Attempt to establish a new transaction */
+		trans = establish_nc_ss_trans(net, vsub, gsup_msg);
+		if (!trans) {
+			/* FIXME: send ERROR back to the HLR */
+			return -EINVAL;
+		}
+
+		/* Wait for Paging Response */
+		if (trans->paging_request)
+			return 0;
 	}
 
 	/* Allocate and prepare a new MT message */
diff --git a/src/libmsc/transaction.c b/src/libmsc/transaction.c
index f2c80d744..4c351d3b8 100644
--- a/src/libmsc/transaction.c
+++ b/src/libmsc/transaction.c
@@ -31,6 +31,7 @@
 void *tall_trans_ctx;
 
 void _gsm48_cc_trans_free(struct gsm_trans *trans);
+void _gsm911_nc_ss_trans_free(struct gsm_trans *trans);
 
 /*! Find a transaction in connection for given protocol + transaction ID
  * \param[in] conn Connection in whihc we want to find transaction
@@ -129,6 +130,7 @@ void trans_free(struct gsm_trans *trans)
 		conn_usage_token = MSC_CONN_USE_TRANS_SMS;
 		break;
 	case GSM48_PDISC_NC_SS:
+		_gsm911_nc_ss_trans_free(trans);
 		conn_usage_token = MSC_CONN_USE_TRANS_NC_SS;
 		break;
 	}
diff --git a/tests/msc_vlr/msc_vlr_test_ss.c b/tests/msc_vlr/msc_vlr_test_ss.c
index f0652b07b..88e80366c 100644
--- a/tests/msc_vlr/msc_vlr_test_ss.c
+++ b/tests/msc_vlr/msc_vlr_test_ss.c
@@ -75,7 +75,7 @@ static void perform_lu(void)
 	EXPECT_CONN_COUNT(0);
 }
 
-static void _test_ss_ussd(enum ran_type via_ran)
+static void _test_ss_ussd_mo(enum ran_type via_ran)
 {
 	/* TODO: UTRAN requires auth and ciph */
 	rx_from_ran = via_ran;
@@ -117,16 +117,99 @@ static void _test_ss_ussd(enum ran_type via_ran)
 	EXPECT_CONN_COUNT(0);
 }
 
-static void test_ss_ussd_geran()
+static void _test_ss_ussd_no(enum ran_type via_ran)
+{
+	struct vlr_subscr *vsub;
+
+	/* TODO: UTRAN requires auth and ciph */
+	rx_from_ran = via_ran;
+
+	/* Perform Location Update */
+	perform_lu();
+
+	BTW("after a while, HLR initiates SS/USSD session");
+
+	paging_expect_imsi(IMSI);
+	paging_sent = false;
+	vsub = vlr_subscr_find_by_imsi(net->vlr, IMSI);
+	OSMO_ASSERT(vsub);
+	VERBOSE_ASSERT(llist_count(&vsub->cs.requests), == 0, "%d");
+
+	/* MT: GSM 04.80 REGISTER with request */
+	gsup_rx("20" /* OSMO_GSUP_MSGT_PROC_SS_REQUEST */
+		"0108" "09710000004026f0" /* IMSI TLV */
+		"3004" "20000101" /* Session ID TLV */
+		"3101" "01" /* Session state: BEGIN */
+		"3515" FACILITY_IE_REQ, NULL);
+
+	VERBOSE_ASSERT(llist_count(&vsub->cs.requests), == 1, "%d");
+	vlr_subscr_put(vsub);
+	vsub = NULL;
+	VERBOSE_ASSERT(paging_sent, == true, "%d");
+	VERBOSE_ASSERT(paging_stopped, == false, "%d");
+
+	btw("the subscriber and its pending request should remain");
+	vsub = vlr_subscr_find_by_imsi(net->vlr, IMSI);
+	OSMO_ASSERT(vsub);
+	VERBOSE_ASSERT(llist_count(&vsub->cs.requests), == 1, "%d");
+	vlr_subscr_put(vsub);
+
+	btw("MS replies with Paging Response, we deliver the NC/USSD");
+
+	dtap_expect_tx("0b3b" "1c15" FACILITY_IE_REQ);
+	ms_sends_msg("06270703305882089910070000006402");
+	VERBOSE_ASSERT(dtap_tx_confirmed, == true, "%d");
+	VERBOSE_ASSERT(paging_stopped, == true, "%d");
+
+	btw("MS responds to SS/USSD request");
+
+	/* MO: GSM 04.80 FACILITY with response */
+	gsup_expect_tx("20" /* OSMO_GSUP_MSGT_PROC_SS_REQUEST */
+		"0108" "09710000004026f0" /* IMSI TLV */
+		"3004" "20000101" /* Session ID TLV */
+		"3101" "02" /* Session state: CONTINUE */
+		"3527" FACILITY_IE_RSP);
+	ms_sends_msg("8b3a" "27" FACILITY_IE_RSP);
+	VERBOSE_ASSERT(dtap_tx_confirmed, == true, "%d");
+	VERBOSE_ASSERT(paging_stopped, == true, "%d");
+
+	btw("HLR terminates the session");
+
+	/* MT: GSM 04.80 RELEASE COMPLETE without Facility IE */
+	dtap_expect_tx("0b2a");
+	expect_release_clear(via_ran);
+	gsup_rx("20" /* OSMO_GSUP_MSGT_PROC_SS_REQUEST */
+		"0108" "09710000004026f0" /* IMSI TLV */
+		"3004" "20000101" /* Session ID TLV */
+		"3101" "03", /* Session state: END */
+		NULL);
+	VERBOSE_ASSERT(dtap_tx_confirmed, == true, "%d");
+	ASSERT_RELEASE_CLEAR(via_ran);
+
+	btw("all requests serviced, conn has been released");
+	bss_sends_clear_complete();
+	EXPECT_CONN_COUNT(0);
+}
+
+static void test_ss_ussd_mo_geran()
+{
+	comment_start();
+	_test_ss_ussd_mo(RAN_GERAN_A);
+	clear_vlr();
+	comment_end();
+}
+
+static void test_ss_ussd_no_geran()
 {
 	comment_start();
-	_test_ss_ussd(RAN_GERAN_A);
+	_test_ss_ussd_no(RAN_GERAN_A);
 	clear_vlr();
 	comment_end();
 }
 
 msc_vlr_test_func_t msc_vlr_tests[] = {
 	/* TODO: UTRAN requires auth and enc */
-	test_ss_ussd_geran,
+	test_ss_ussd_mo_geran, /* MS-originated */
+	test_ss_ussd_no_geran, /* Network-originated */
 	NULL
 };
diff --git a/tests/msc_vlr/msc_vlr_test_ss.err b/tests/msc_vlr/msc_vlr_test_ss.err
index fce5bb6a6..338b5aa07 100644
--- a/tests/msc_vlr/msc_vlr_test_ss.err
+++ b/tests/msc_vlr/msc_vlr_test_ss.err
@@ -1,7 +1,7 @@
 full talloc report on 'msgb' (total      0 bytes in   1 blocks)
 talloc_total_blocks(tall_bsc_ctx) == 12
 
-===== test_ss_ussd_geran
+===== test_ss_ussd_mo_geran
 - Location Update request causes a GSUP LU request to HLR
   MSC <--RAN_GERAN_A-- MS: GSM48_MT_MM_LOC_UPD_REQUEST
   new conn
@@ -201,7 +201,241 @@ DMM Subscr_Conn(CM_SERVICE_REQ:901700000004620){SUBSCR_CONN_S_RELEASED}: Freeing
 DMM Subscr_Conn(CM_SERVICE_REQ:901700000004620){SUBSCR_CONN_S_RELEASED}: Deallocated
   llist_count(&net->subscr_conns) == 0
 DREF freeing VLR subscr MSISDN:46071
-===== test_ss_ussd_geran: SUCCESS
+===== test_ss_ussd_mo_geran: SUCCESS
+
+full talloc report on 'msgb' (total      0 bytes in   1 blocks)
+talloc_total_blocks(tall_bsc_ctx) == 12
+
+===== test_ss_ussd_no_geran
+- Location Update request causes a GSUP LU request to HLR
+  MSC <--RAN_GERAN_A-- MS: GSM48_MT_MM_LOC_UPD_REQUEST
+  new conn
+DMM Subscr_Conn{SUBSCR_CONN_S_NEW}: Allocated
+DREF unknown: MSC conn use + compl_l3 == 1 (0x1: compl_l3)
+DRLL Dispatching 04.08 message GSM48_MT_MM_LOC_UPD_REQUEST (0x5:0x8)
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_NEW}: Updated ID
+DMM LOCATION UPDATING REQUEST: MI(IMSI)=901700000004620 type=IMSI ATTACH
+DMM LU/new-LAC: 1/23
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_IDLE}: Allocated
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_IDLE}: is child of Subscr_Conn(LU:901700000004620)
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_IDLE}: rev=GSM net=GERAN (no Auth)
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_IDLE}: Received Event VLR_ULA_E_UPDATE_LA
+DREF VLR subscr unknown usage increases to: 1
+DVLR set IMSI on subscriber; IMSI=901700000004620 id=901700000004620
+DVLR New subscr, IMSI: 901700000004620
+DREF VLR subscr IMSI:901700000004620 usage increases to: 2
+DREF VLR subscr IMSI:901700000004620 usage decreases to: 1
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_IDLE}: vlr_loc_upd_node1()
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_IDLE}: vlr_loc_upd_post_auth()
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_IDLE}: vlr_loc_upd_post_ciph()
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_IDLE}: vlr_loc_upd_node_4()
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_IDLE}: state_chg to VLR_ULA_S_WAIT_HLR_UPD
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_INIT}: Allocated
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_INIT}: is child of vlr_lu_fsm(LU:901700000004620)
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_INIT}: Received Event UPD_HLR_VLR_E_START
+DVLR GSUP tx: 04010809710000004026f0
+GSUP --> HLR: OSMO_GSUP_MSGT_UPDATE_LOCATION_REQUEST: 04010809710000004026f0
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_INIT}: state_chg to UPD_HLR_VLR_S_WAIT_FOR_DATA
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_NEW}: Received Event SUBSCR_CONN_E_COMPLETE_LAYER_3
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_NEW}: state_chg to SUBSCR_CONN_S_AUTH_CIPH
+DREF IMSI:901700000004620: MSC conn use - compl_l3 == 0 (0x0: )
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_AUTH_CIPH}: Received Event SUBSCR_CONN_E_UNUSED
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_AUTH_CIPH}: Awaiting results for Auth+Ciph, overruling event SUBSCR_CONN_E_UNUSED
+  lu_result_sent == 0
+- HLR sends _INSERT_DATA_REQUEST, VLR responds with _INSERT_DATA_RESULT
+<-- GSUP rx OSMO_GSUP_MSGT_INSERT_DATA_REQUEST: 10010809710000004026f00804036470f1
+DVLR GSUP rx 17: 10010809710000004026f00804036470f1
+DREF VLR subscr IMSI:901700000004620 usage increases to: 2
+DVLR IMSI:901700000004620 has MSISDN:46071
+DVLR SUBSCR(MSISDN:46071) VLR: update for IMSI=901700000004620 (MSISDN=46071, used=2)
+DVLR GSUP tx: 12010809710000004026f0
+GSUP --> HLR: OSMO_GSUP_MSGT_INSERT_DATA_RESULT: 12010809710000004026f0
+DREF VLR subscr MSISDN:46071 usage decreases to: 1
+<-- GSUP rx OSMO_GSUP_MSGT_INSERT_DATA_REQUEST: vlr_gsupc_read_cb() returns 0
+  lu_result_sent == 0
+- HLR also sends GSUP _UPDATE_LOCATION_RESULT
+<-- GSUP rx OSMO_GSUP_MSGT_UPDATE_LOCATION_RESULT: 06010809710000004026f0
+DVLR GSUP rx 11: 06010809710000004026f0
+DREF VLR subscr MSISDN:46071 usage increases to: 2
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_WAIT_HLR_UPD}: Received Event VLR_ULA_E_HLR_LU_RES
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_WAIT_FOR_DATA}: Received Event UPD_HLR_VLR_E_UPD_LOC_ACK
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_WAIT_FOR_DATA}: state_chg to UPD_HLR_VLR_S_DONE
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_DONE}: Terminating (cause = OSMO_FSM_TERM_REGULAR)
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_DONE}: Removing from parent vlr_lu_fsm(LU:901700000004620)
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_DONE}: Freeing instance
+DVLR upd_hlr_vlr_fsm(LU:901700000004620){UPD_HLR_VLR_S_DONE}: Deallocated
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_WAIT_HLR_UPD}: Received Event VLR_ULA_E_UPD_HLR_COMPL
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_WAIT_HLR_UPD}: state_chg to VLR_ULA_S_WAIT_LU_COMPL
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_INIT}: Allocated
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_INIT}: is child of vlr_lu_fsm(LU:901700000004620)
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_INIT}: Received Event LU_COMPL_VLR_E_START
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_INIT}: state_chg to LU_COMPL_VLR_S_WAIT_SUB_PRES
+DVLR sub_pres_vlr_fsm(LU:901700000004620){SUB_PRES_VLR_S_INIT}: Allocated
+DVLR sub_pres_vlr_fsm(LU:901700000004620){SUB_PRES_VLR_S_INIT}: is child of lu_compl_vlr_fsm(LU:901700000004620)
+DVLR sub_pres_vlr_fsm(LU:901700000004620){SUB_PRES_VLR_S_INIT}: Received Event SUB_PRES_VLR_E_START
+DVLR sub_pres_vlr_fsm(LU:901700000004620){SUB_PRES_VLR_S_INIT}: state_chg to SUB_PRES_VLR_S_DONE
+DVLR sub_pres_vlr_fsm(LU:901700000004620){SUB_PRES_VLR_S_DONE}: Terminating (cause = OSMO_FSM_TERM_REGULAR)
+DVLR sub_pres_vlr_fsm(LU:901700000004620){SUB_PRES_VLR_S_DONE}: Removing from parent lu_compl_vlr_fsm(LU:901700000004620)
+DVLR sub_pres_vlr_fsm(LU:901700000004620){SUB_PRES_VLR_S_DONE}: Freeing instance
+DVLR sub_pres_vlr_fsm(LU:901700000004620){SUB_PRES_VLR_S_DONE}: Deallocated
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_WAIT_SUB_PRES}: Received Event LU_COMPL_VLR_E_SUB_PRES_COMPL
+- sending LU Accept for MSISDN:46071
+DREF VLR subscr MSISDN:46071 usage increases to: 3
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_WAIT_SUB_PRES}: state_chg to LU_COMPL_VLR_S_DONE
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_WAIT_LU_COMPL}: Received Event VLR_ULA_E_LU_COMPL_SUCCESS
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_DONE}: Terminating (cause = OSMO_FSM_TERM_PARENT)
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_DONE}: Removing from parent vlr_lu_fsm(LU:901700000004620)
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_DONE}: Freeing instance
+DVLR lu_compl_vlr_fsm(LU:901700000004620){LU_COMPL_VLR_S_DONE}: Deallocated
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_WAIT_LU_COMPL}: state_chg to VLR_ULA_S_DONE
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_AUTH_CIPH}: Received Event SUBSCR_CONN_E_ACCEPTED
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_AUTH_CIPH}: state_chg to SUBSCR_CONN_S_ACCEPTED
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_ACCEPTED}: Received Event SUBSCR_CONN_E_UNUSED
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_ACCEPTED}: state_chg to SUBSCR_CONN_S_RELEASING
+DREF MSISDN:46071: MSC conn use + release == 1 (0x100: release)
+DREF VLR subscr MSISDN:46071 usage increases to: 4
+DREF VLR subscr MSISDN:46071 usage decreases to: 3
+- BSSAP Clear --RAN_GERAN_A--> MS
+DREF VLR subscr MSISDN:46071 usage decreases to: 2
+<-- GSUP rx OSMO_GSUP_MSGT_UPDATE_LOCATION_RESULT: vlr_gsupc_read_cb() returns 0
+- LU was successful, and the conn has already been closed
+  lu_result_sent == 1
+  bssap_clear_sent == 1
+DREF VLR subscr MSISDN:46071 usage increases to: 3
+  vsub != NULL == 1
+  strcmp(vsub->imsi, IMSI) == 0
+  vsub->lac == 23
+DREF VLR subscr MSISDN:46071 usage decreases to: 2
+- BSS sends BSSMAP Clear Complete
+DREF MSISDN:46071: MSC conn use - release == 0 (0x0: )
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_RELEASING}: Received Event SUBSCR_CONN_E_UNUSED
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_RELEASING}: state_chg to SUBSCR_CONN_S_RELEASED
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_RELEASED}: Terminating (cause = OSMO_FSM_TERM_REGULAR)
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_DONE}: Terminating (cause = OSMO_FSM_TERM_PARENT)
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_DONE}: Removing from parent Subscr_Conn(LU:901700000004620)
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_DONE}: fsm_lu_cleanup called with cause OSMO_FSM_TERM_PARENT
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_DONE}: Freeing instance
+DVLR vlr_lu_fsm(LU:901700000004620){VLR_ULA_S_DONE}: Deallocated
+DRLL MSISDN:46071: Freeing subscriber connection
+DREF VLR subscr MSISDN:46071 usage decreases to: 1
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_RELEASED}: Freeing instance
+DMM Subscr_Conn(LU:901700000004620){SUBSCR_CONN_S_RELEASED}: Deallocated
+  llist_count(&net->subscr_conns) == 0
+---
+- after a while, HLR initiates SS/USSD session
+DREF VLR subscr MSISDN:46071 usage increases to: 2
+  llist_count(&vsub->cs.requests) == 0
+<-- GSUP rx OSMO_GSUP_MSGT_PROC_SS_REQUEST: 20010809710000004026f03004200001013101013515a11302010102013b300b04010f0406aa510c061b01
+DVLR GSUP rx 43: 20010809710000004026f03004200001013101013515a11302010102013b300b04010f0406aa510c061b01
+DREF VLR subscr MSISDN:46071 usage increases to: 3
+DMSC Routed to GSM 09.11 SS/USSD handler
+DMM Establishing network-originated session
+DCC (ti ff sub MSISDN:46071 callref 20000101) New transaction
+DREF VLR subscr MSISDN:46071 usage increases to: 4
+DMM Triggering Paging Request
+DMM Subscriber MSISDN:46071 not paged yet, start paging.
+  RAN_GERAN_A sends out paging request to IMSI 901700000004620, TMSI 0xffffffff, LAC 23
+  strcmp(paging_expecting_imsi, imsi) == 0
+DREF VLR subscr MSISDN:46071 usage increases to: 5
+DREF VLR subscr MSISDN:46071 usage decreases to: 4
+<-- GSUP rx OSMO_GSUP_MSGT_PROC_SS_REQUEST: vlr_gsupc_read_cb() returns -22
+  llist_count(&vsub->cs.requests) == 1
+DREF VLR subscr MSISDN:46071 usage decreases to: 3
+  paging_sent == 1
+  paging_stopped == 0
+- the subscriber and its pending request should remain
+DREF VLR subscr MSISDN:46071 usage increases to: 4
+  llist_count(&vsub->cs.requests) == 1
+DREF VLR subscr MSISDN:46071 usage decreases to: 3
+- MS replies with Paging Response, we deliver the NC/USSD
+  MSC <--RAN_GERAN_A-- MS: GSM48_MT_RR_PAG_RESP
+  new conn
+DMM Subscr_Conn{SUBSCR_CONN_S_NEW}: Allocated
+DREF unknown: MSC conn use + compl_l3 == 1 (0x1: compl_l3)
+DRLL Dispatching 04.08 message GSM48_MT_RR_PAG_RESP (0x6:0x27)
+DRR PAGING RESPONSE: MI(IMSI)=901700000004620
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_NEW}: Updated ID
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: Allocated
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: is child of Subscr_Conn(PAGING_RESP:901700000004620)
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: rev=GSM net=GERAN (no Auth)
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: Received Event PR_ARQ_E_START
+DREF VLR subscr MSISDN:46071 usage increases to: 4
+DREF VLR subscr MSISDN:46071 usage increases to: 5
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: proc_arq_vlr_fn_post_imsi()
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: _proc_arq_vlr_node2()
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: _proc_arq_vlr_node2_post_ciph()
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: _proc_arq_vlr_node2_post_vlr()
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: _proc_arq_vlr_post_pres()
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: _proc_arq_vlr_post_trace()
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: _proc_arq_vlr_post_imei()
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: proc_arq_fsm_done(PASSED)
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_INIT}: state_chg to PR_ARQ_S_DONE
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_DONE}: Process Access Request result: PASSED
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_NEW}: Received Event SUBSCR_CONN_E_ACCEPTED
+DPAG Paging success for MSISDN:46071 (event=0)
+DPAG Calling paging cbfn.
+DMM Paging subscr 46071 succeeded!
+DREF MSISDN:46071: MSC conn use + trans_nc_ss == 2 (0x41: compl_l3,trans_nc_ss)
+DMSC msc_tx 25 bytes to MSISDN:46071 via RAN_GERAN_A
+- DTAP --RAN_GERAN_A--> MS: GSM0480_MTYPE_REGISTER: 0b3b1c15a11302010102013b300b04010f0406aa510c061b01
+- DTAP matches expected message
+DREF VLR subscr MSISDN:46071 usage decreases to: 4
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_NEW}: state_chg to SUBSCR_CONN_S_ACCEPTED
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_ACCEPTED}: subscr_conn_fsm_has_active_transactions: connection still has active transaction: NCSS
+DREF VLR subscr MSISDN:46071 usage decreases to: 3
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_ACCEPTED}: Received Event SUBSCR_CONN_E_COMPLETE_LAYER_3
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_ACCEPTED}: Event SUBSCR_CONN_E_COMPLETE_LAYER_3 not permitted
+DREF MSISDN:46071: MSC conn use - compl_l3 == 1 (0x40: trans_nc_ss)
+  dtap_tx_confirmed == 1
+  paging_stopped == 1
+- MS responds to SS/USSD request
+  MSC <--RAN_GERAN_A-- MS: GSM0480_MTYPE_FACILITY
+DREF MSISDN:46071: MSC conn use + dtap == 2 (0x42: dtap,trans_nc_ss)
+DRLL Dispatching 04.08 message GSM0480_MTYPE_FACILITY (0xb:0x3a)
+DMM Received SS/USSD data (trans_id=0, msg_type=GSM0480_MTYPE_FACILITY)
+GSUP --> HLR: OSMO_GSUP_MSGT_PROC_SS_REQUEST: 20010809710000004026f03004200001013101023527a225020101302002013b301b04010f0416d9775d0e2ae3e965f73cfd7683d27310cd06bbc51a0d
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_ACCEPTED}: Received Event SUBSCR_CONN_E_COMMUNICATING
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_ACCEPTED}: state_chg to SUBSCR_CONN_S_COMMUNICATING
+DREF MSISDN:46071: MSC conn use - dtap == 1 (0x40: trans_nc_ss)
+  dtap_tx_confirmed == 1
+  paging_stopped == 1
+- HLR terminates the session
+<-- GSUP rx OSMO_GSUP_MSGT_PROC_SS_REQUEST: 20010809710000004026f0300420000101310103
+DVLR GSUP rx 20: 20010809710000004026f0300420000101310103
+DREF VLR subscr MSISDN:46071 usage increases to: 4
+DMSC Routed to GSM 09.11 SS/USSD handler
+DMSC msc_tx 2 bytes to MSISDN:46071 via RAN_GERAN_A
+- DTAP --RAN_GERAN_A--> MS: GSM0480_MTYPE_RELEASE_COMPLETE: 0b2a
+- DTAP matches expected message
+DREF VLR subscr MSISDN:46071 usage decreases to: 3
+DREF MSISDN:46071: MSC conn use - trans_nc_ss == 0 (0x0: )
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_COMMUNICATING}: Received Event SUBSCR_CONN_E_UNUSED
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_COMMUNICATING}: state_chg to SUBSCR_CONN_S_RELEASING
+DREF MSISDN:46071: MSC conn use + release == 1 (0x100: release)
+DREF VLR subscr MSISDN:46071 usage increases to: 4
+DREF VLR subscr MSISDN:46071 usage decreases to: 3
+- BSSAP Clear --RAN_GERAN_A--> MS
+DREF VLR subscr MSISDN:46071 usage decreases to: 2
+<-- GSUP rx OSMO_GSUP_MSGT_PROC_SS_REQUEST: vlr_gsupc_read_cb() returns 0
+  dtap_tx_confirmed == 1
+  bssap_clear_sent == 1
+- all requests serviced, conn has been released
+- BSS sends BSSMAP Clear Complete
+DREF MSISDN:46071: MSC conn use - release == 0 (0x0: )
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_RELEASING}: Received Event SUBSCR_CONN_E_UNUSED
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_RELEASING}: state_chg to SUBSCR_CONN_S_RELEASED
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_RELEASED}: Terminating (cause = OSMO_FSM_TERM_REGULAR)
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_DONE}: Terminating (cause = OSMO_FSM_TERM_PARENT)
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_DONE}: Removing from parent Subscr_Conn(PAGING_RESP:901700000004620)
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_DONE}: Freeing instance
+DVLR Process_Access_Request_VLR(PAGING_RESP:901700000004620){PR_ARQ_S_DONE}: Deallocated
+DRLL MSISDN:46071: Freeing subscriber connection
+DREF VLR subscr MSISDN:46071 usage decreases to: 1
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_RELEASED}: Freeing instance
+DMM Subscr_Conn(PAGING_RESP:901700000004620){SUBSCR_CONN_S_RELEASED}: Deallocated
+  llist_count(&net->subscr_conns) == 0
+DREF freeing VLR subscr MSISDN:46071
+===== test_ss_ussd_no_geran: SUCCESS
 
 full talloc report on 'msgb' (total      0 bytes in   1 blocks)
 talloc_total_blocks(tall_bsc_ctx) == 12