large refactoring: support inter-BSC and inter-MSC Handover

3GPP TS 49.008 '4.3 Roles of MSC-A, MSC-I and MSC-T' defines distinct roles:
- MSC-A is responsible for managing subscribers,
- MSC-I is the gateway to the RAN.
- MSC-T is a second transitory gateway to another RAN during Handover.

After inter-MSC Handover, the MSC-I is handled by a remote MSC instance, while
the original MSC-A retains the responsibility of subscriber management.

MSC-T exists in this patch but is not yet used, since Handover is only prepared
for, not yet implemented.

Facilitate Inter-MSC and inter-BSC Handover by the same internal split of MSC
roles.

Compared to inter-MSC Handover, mere inter-BSC has the obvious simplifications:
- all of MSC-A, MSC-I and MSC-T roles will be served by the same osmo-msc
  instance,
- messages between MSC-A and MSC-{I,T} don't need to be routed via E-interface
  (GSUP),
- no call routing between MSC-A and -I via MNCC necessary.

This is the largest code bomb I have submitted, ever. Out of principle, I
apologize to everyone trying to read this as a whole. Unfortunately, I see no
sense in trying to split this patch into smaller bits. It would be a huge
amount of work to introduce these changes in separate chunks, especially if
each should in turn be useful and pass all test suites. So, unfortunately, we
are stuck with this code bomb.

The following are some details and rationale for this rather huge refactoring:

* separate MSC subscriber management from ran_conn

struct ran_conn is reduced from the pivotal subscriber management entity it has
been so far to a mere storage for an SCCP connection ID and an MSC subscriber
reference.

The new pivotal subscriber management entity is struct msc_a -- struct msub
lists the msc_a, msc_i, msc_t roles, the vast majority of code paths however
use msc_a, since MSC-A is where all the interesting stuff happens.

Before handover, msc_i is an FSM implementation that encodes to the local
ran_conn. After inter-MSC Handover, msc_i is a compatible but different FSM
implementation that instead forwards via/from GSUP. Same goes for the msc_a
struct: if osmo-msc is the MSC-I "RAN proxy" for a remote MSC-A role, the
msc_a->fi is an FSM implementation that merely forwards via/from GSUP.

* New SCCP implementation for RAN access

To be able to forward BSSAP and RANAP messages via the GSUP interface, the
individual message layers need to be cleanly separated. The IuCS implementation
used until now (iu_client from libosmo-ranap) did not provide this level of
separation, and needed a complete rewrite. It was trivial to implement this in
such a way that both BSSAP and RANAP can be handled by the same SCCP code,
hence the new SCCP-RAN layer also replaces BSSAP handling.

sccp_ran.h: struct sccp_ran_inst provides an abstract handler for incoming RAN
connections. A set of callback functions provides implementation specific
details.

* RAN Abstraction (BSSAP vs. RANAP)

The common SCCP implementation did set the theme for the remaining refactoring:
make all other MSC code paths entirely RAN-implementation-agnostic.

ran_infra.c provides data structures that list RAN implementation specifics,
from logging to RAN de-/encoding to SCCP callbacks and timers. A ran_infra
pointer hence allows complete abstraction of RAN implementations:

- managing connected RAN peers (BSC, RNC) in ran_peer.c,
- classifying and de-/encoding RAN PDUs,
- recording connected LACs and cell IDs and sending out Paging requests to
  matching RAN peers.

* RAN RESET now also for RANAP

ran_peer.c absorbs the reset_fsm from a_reset.c; in consequence, RANAP also
supports proper RESET semantics now. Hence osmo-hnbgw now also needs to provide
proper RESET handling, which it so far duly ignores. (TODO)

* RAN de-/encoding abstraction

The RAN abstraction mentioned above serves not only to separate RANAP and BSSAP
implementations transparently, but also to be able to optionally handle RAN on
distinct levels. Before Handover, all RAN messages are handled by the MSC-A
role.  However, after an inter-MSC Handover, a standalone MSC-I will need to
decode RAN PDUs, at least in order to manage Assignment of RTP streams between
BSS/RNC and MNCC call forwarding.

ran_msg.h provides a common API with abstraction for:

- receiving events from RAN, i.e. passing RAN decode from the BSC/RNC and
  MS/UE: struct ran_dec_msg represents RAN messages decoded from either BSSMAP
  or RANAP;
- sending RAN events: ran_enc_msg is the counterpart to compose RAN messages
  that should be encoded to either BSSMAP or RANAP and passed down to the
  BSC/RNC and MS/UE.

The RAN-specific implementations are completely contained by ran_msg_a.c and
ran_msg_iu.c.

In particular, Assignment and Ciphering have so far been distinct code paths
for BSSAP and RANAP, with switch(via_ran){...} statements all over the place.
Using RAN_DEC_* and RAN_ENC_* abstractions, these are now completely unified.

Note that SGs does not qualify for RAN abstraction: the SGs interface always
remains with the MSC-A role, and SGs messages follow quite distinct semantics
from the fairly similar GERAN and UTRAN.

* MGW and RTP stream management

So far, managing MGW endpoints via MGCP was tightly glued in-between
GSM-04.08-CC on the one and MNCC on the other side. Prepare for switching RTP
streams between different RAN peers by moving to object-oriented
implementations: implement struct call_leg and struct rtp_stream with distinct
FSMs each. For MGW communication, use the osmo_mgcpc_ep API that has originated
from osmo-bsc and recently moved to libosmo-mgcp-client for this purpose.
Instead of implementing a sequence of events with code duplication for the RAN
and CN sides, the idea is to manage each RTP stream separately by firing and
receiving events as soon as codecs and RTP ports are negotiated, and letting
the individual FSMs take care of the MGW management "asynchronously". The
caller provides event IDs and an FSM instance that should be notified of RTP
stream setup progress. Hence it becomes possible to reconnect RTP streams from
one GSM-04.08-CC to another (inter-BSC Handover) or between CC and MNCC RTP
peers (inter-MSC Handover) without duplicating the MGCP code for each
transition.

The number of FSM implementations used for MGCP handling may seem a bit of an
overkill. But in fact, the number of perspectives on RTP forwarding are far
from trivial:
- an MGW endpoint is an entity with N connections, and MGCP "sessions" for
  configuring them by talking to the MGW;
- an RTP stream is a remote peer connected to one of the endpoint's
  connections, which is asynchronously notified of codec and RTP port choices;
- a call leg is the higher level view on either an MT or MO side of a voice
  call, a combination of two RTP streams to forward between two remote peers.

  BSC                 MGW                PBX
                CI          CI
                [MGW-endpoint]
  [--rtp_stream--]          [--rtp_stream--]
  [----------------call_leg----------------]

* Use counts

Introduce using the new osmo_use_count API added to libosmocore for this
purpose. Each use token has a distinct name in the logging, which can be a
globally constant name or ad-hoc, like the local __func__ string constant.  Use
in the new struct msc_a, as well as change vlr_subscr to the new osmo_use_count
API.

* FSM Timeouts

Introduce using the new osmo_tdef API, which provides a common VTY
implementation for all timer numbers, and FSM state transitions with the
correct timeout. Originated in osmo-bsc, recently moved to libosmocore.

Depends: Ife31e6798b4e728a23913179e346552a7dd338c0 (libosmocore)
         Ib9af67b100c4583342a2103669732dab2e577b04 (libosmocore)
	 Id617265337f09dfb6ddfe111ef5e578cd3dc9f63 (libosmocore)
	 Ie9e2add7bbfae651c04e230d62e37cebeb91b0f5 (libosmo-sccp)
	 I26be5c4b06a680f25f19797407ab56a5a4880ddc (osmo-mgw)
	 Ida0e59f9a1f2dd18efea0a51680a67b69f141efa (osmo-mgw)
	 I9a3effd38e72841529df6c135c077116981dea36 (osmo-mgw)
Change-Id: I27e4988e0371808b512c757d2b52ada1615067bd

1 files changed, 410 insertions, 361 deletions

diff --git a/tests/msc_vlr/msc_vlr_tests.c b/tests/msc_vlr/msc_vlr_tests.c
index ffe35f7cc..9c3ecb740 100644
--- a/tests/msc_vlr/msc_vlr_tests.c
+++ b/tests/msc_vlr/msc_vlr_tests.c
@@ -30,19 +30,17 @@
 #include <osmocom/core/application.h>
 #include <osmocom/gsm/protocol/gsm_04_11.h>
 #include <osmocom/gsm/gsup.h>
-#include <osmocom/gsupclient/gsup_client.h>
+#include <osmocom/msc/gsup_client_mux.h>
 #include <osmocom/msc/gsm_04_11.h>
 #include <osmocom/msc/debug.h>
 #include <osmocom/msc/gsm_04_08.h>
 #include <osmocom/msc/transaction.h>
-#include <osmocom/msc/a_iface_bssap.h>
-
-#if BUILD_IU
-#include <osmocom/msc/iucs_ranap.h>
-#include <osmocom/ranap/iu_client.h>
-#else
-#include <osmocom/msc/iu_dummy.h>
-#endif
+#include <osmocom/msc/ran_msg.h>
+#include <osmocom/msc/msc_a.h>
+#include <osmocom/msc/msc_i.h>
+#include <osmocom/msc/msc_t.h>
+#include <osmocom/msc/call_leg.h>
+#include <osmocom/msc/rtp_stream.h>
 
 #include "msc_vlr_tests.h"
 
@@ -80,7 +78,7 @@ const char *cc_to_mncc_tx_expected_imsi = NULL;
 bool cc_to_mncc_tx_confirmed = false;
 uint32_t cc_to_mncc_tx_got_callref = 0;
 
-extern int gsm0407_pdisc_ctr_bin(uint8_t pdisc);
+extern int ran_dec_dtap_undup_pdisc_ctr_bin(uint8_t pdisc);
 
 /* static state variables for the L3 send sequence numbers */
 static uint8_t n_sd[4];
@@ -91,7 +89,7 @@ static void patch_l3_seq_nr(struct msgb *msg)
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	uint8_t pdisc = gsm48_hdr_pdisc(gh);
 	uint8_t *msg_type_oct = &msg->l3h[1];
-	int bin = gsm0407_pdisc_ctr_bin(pdisc);
+	int bin = ran_dec_dtap_undup_pdisc_ctr_bin(pdisc);
 
 	if (bin >= 0 && bin < ARRAY_SIZE(n_sd)) {
 		/* patch in n_sd into the msg_type octet */
@@ -126,21 +124,6 @@ static const char *gh_type_name(struct gsm48_hdr *gh)
 					gsm48_hdr_msg_type(gh));
 }
 
-void dtap_expect_tx(const char *hex)
-{
-	/* Has the previously expected dtap been received? */
-	OSMO_ASSERT(!dtap_tx_expected);
-	if (!hex)
-		return;
-	dtap_tx_expected = msgb_from_hex("dtap_tx_expected", 1024, hex);
-	/* Mask the sequence number out */
-	if (msgb_length(dtap_tx_expected) >= 2)
-		dtap_tx_expected->data[1] &= 0x3f;
-	dtap_tx_confirmed = false;
-}
-
-int vlr_gsupc_read_cb(struct osmo_gsup_client *gsupc, struct msgb *msg);
-
 void gsup_rx(const char *rx_hex, const char *expect_tx_hex)
 {
 	int rc;
@@ -154,97 +137,303 @@ void gsup_rx(const char *rx_hex, const char *expect_tx_hex)
 	fprintf(stderr, "<-- GSUP rx %s: %s\n", label,
 		osmo_hexdump_nospc(msgb_l2(msg), msgb_l2len(msg)));
 	/* GSUP read cb takes ownership of msgb */
-	rc = vlr_gsupc_read_cb(net->vlr->gsup_client, msg);
+	rc = gsup_client_mux_rx(net->gcm->gsup_client, msg);
 	fprintf(stderr, "<-- GSUP rx %s: vlr_gsupc_read_cb() returns %d\n",
 		label, rc);
 	if (expect_tx_hex)
 		OSMO_ASSERT(gsup_tx_confirmed);
 }
 
-bool conn_exists(const struct ran_conn *conn)
+bool conn_exists(const struct msub *msub)
 {
-	struct ran_conn *c;
+	struct msub *i;
 
-	if (!conn)
+	if (!msub)
 		return false;
 
-	llist_for_each_entry(c, &net->ran_conns, entry) {
-		if (c == conn)
+	llist_for_each_entry(i, &msub_list, entry) {
+		if (i == msub)
 			return true;
 	}
 
+	btw("msub gone");
 	return false;
 }
 
 /* Simplified version of the cm_service_request_concludes() */
-void conn_conclude_cm_service_req(struct ran_conn *conn,
-				  enum osmo_rat_type via_ran)
+void conn_conclude_cm_service_req(struct msub *msub, const char *cm_service_use)
 {
+	int32_t count;
+	struct msc_a *msc_a = msub_msc_a(msub);
 	btw("Concluding CM Service Request");
 
-	OSMO_ASSERT(conn);
-	OSMO_ASSERT(conn->received_cm_service_request);
+	OSMO_ASSERT(conn_exists(msub));
+	count = osmo_use_count_by(&msc_a->use_count, cm_service_use);
+	OSMO_ASSERT(count > 0);
 
-	conn->received_cm_service_request = false;
-	ran_conn_put(conn, RAN_CONN_USE_CM_SERVICE);
+	OSMO_ASSERT(osmo_use_count_get_put(&msc_a->use_count, cm_service_use, -count) == 0)
 
-	ASSERT_RELEASE_CLEAR(via_ran);
+	ASSERT_RELEASE_CLEAR(msc_a->c.ran->type);
 }
 
-enum osmo_rat_type rx_from_ran = OSMO_RAT_GERAN_A;
+void dummy_msc_i_action(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+}
+
+static const struct osmo_fsm_state dummy_msc_i_states[] = {
+	{
+		.name = "0",
+		.in_event_mask = 0xffffffff,
+		.action = dummy_msc_i_action,
+	},
+};
 
-/* SCCP user stub to make a_iface_tx_bssap() happy during test case execution */
-struct osmo_sccp_user {
-	uint8_t foo;
+struct osmo_fsm dummy_msc_i_fsm = {
+	.name = "dummy_msc_i",
+	.states = dummy_msc_i_states,
+	.num_states = ARRAY_SIZE(dummy_msc_i_states),
+	.log_subsys = DMSC,
+	.event_names = msc_i_fsm_event_names,
 };
-static struct osmo_sccp_user g_scu;
 
-struct ran_conn *conn_new(void)
+struct msc_i *dummy_msc_i_alloc(struct msub *msub, struct ran_infra *ran)
 {
-	struct ran_conn *conn;
-	conn = ran_conn_alloc(net, rx_from_ran, 23);
-	if (conn->via_ran == OSMO_RAT_UTRAN_IU) {
-		struct ranap_ue_conn_ctx *ue_ctx = talloc_zero(conn, struct ranap_ue_conn_ctx);
-		*ue_ctx = (struct ranap_ue_conn_ctx){
-			.conn_id = 42,
-		};
-		conn->iu.ue_ctx = ue_ctx;
-	} else {
-		conn->a.scu = &g_scu;
+	return msub_role_alloc(g_msub, MSC_ROLE_I, &dummy_msc_i_fsm, struct msc_i, ran);
+}
+
+enum osmo_rat_type rx_from_ran = OSMO_RAT_GERAN_A;
+
+struct msub *g_msub = NULL;
+
+void dtap_expect_tx(const char *hex)
+{
+	/* Has the previously expected dtap been received? */
+	OSMO_ASSERT(!dtap_tx_expected);
+	if (!hex)
+		return;
+	dtap_tx_expected = msgb_from_hex("dtap_tx_expected", 1024, hex);
+	/* Mask the sequence number out */
+	if (msgb_length(dtap_tx_expected) >= 2)
+		dtap_tx_expected->data[1] &= 0x3f;
+	dtap_tx_confirmed = false;
+}
+
+static int _validate_dtap(struct msgb *msg, enum osmo_rat_type to_ran)
+{
+	struct gsm48_hdr *gh = (void*)msg->data;
+	uint8_t pdisc = gsm48_hdr_pdisc(gh);
+	uint8_t msgt = gsm48_hdr_msg_type(gh);
+
+	btw("DTAP --%s--> MS: %s: %s",
+	    osmo_rat_type_name(to_ran), gh_type_name((void*)msg->data),
+	    osmo_hexdump_nospc(msg->data, msg->len));
+
+	if (pdisc == GSM48_PDISC_MM
+	    && msgt == GSM48_MT_MM_CM_SERV_ACC) {
+		cm_service_result_sent |= RES_ACCEPT;
+		talloc_free(msg);
+		return 0;
+	}
+
+	if (pdisc == GSM48_PDISC_MM
+	    && msgt == GSM48_MT_MM_CM_SERV_REJ) {
+		cm_service_result_sent |= RES_REJECT;
+		talloc_free(msg);
+		return 0;
+	}
+
+	OSMO_ASSERT(dtap_tx_expected);
+
+	/* Mask the sequence number out before comparing */
+	msg->data[1] &= 0x3f;
+	if (!msgb_eq_data_print(msg, dtap_tx_expected->data, dtap_tx_expected->len))
+		abort();
+
+	btw("DTAP matches expected message");
+
+	talloc_free(msg);
+	dtap_tx_confirmed = true;
+	talloc_free(dtap_tx_expected);
+	dtap_tx_expected = NULL;
+
+	return 0;
+}
+
+static void bssap_validate_clear_cmd()
+{
+	OSMO_ASSERT(bssap_clear_expected);
+	bssap_clear_expected = false;
+	bssap_clear_sent = true;
+}
+
+static void iucs_validate_clear_cmd()
+{
+	OSMO_ASSERT(iu_release_expected);
+	iu_release_expected = false;
+	iu_release_sent = true;
+}
+
+static int bssap_validate_cipher_mode_cmd(const struct ran_cipher_mode_command *cmd)
+{
+	int i;
+	const char *got_key;
+	cipher_mode_cmd_sent = true;
+	cipher_mode_cmd_sent_with_imeisv = cmd->geran.retrieve_imeisv;
+	btw("sending Ciphering Mode Command: retrieve_imeisv=%d", cipher_mode_cmd_sent_with_imeisv);
+	for (i = 0; i < 7; i++) {
+		if (!(cmd->geran.a5_encryption_mask & (1 << i)))
+			continue;
+		btw("...perm algo: A5/%d", i);
+	}
+	got_key = osmo_hexdump_nospc(cmd->vec->kc, sizeof(cmd->vec->kc));
+	btw("...key: %s", got_key);
+
+	if (!cipher_mode_expect_kc
+	    || strcmp(cipher_mode_expect_kc, got_key)) {
+		log("FAILURE: expected kc=%s", cipher_mode_expect_kc ? : "NULL");
+		OSMO_ASSERT(false);
 	}
-	return conn;
+	return 0;
 }
 
-struct ran_conn *g_conn = NULL;
+static int iucs_validate_security_mode_ctrl(const struct ran_cipher_mode_command *cmd)
+{
+	const char *got_ik;
+	got_ik = osmo_hexdump_nospc(cmd->vec->ik, sizeof(cmd->vec->ik));
+	btw("sending SecurityModeControl: ik=%s", got_ik);
+	security_mode_ctrl_sent = true;
+	if (!security_mode_expect_ik
+	    || strcmp(security_mode_expect_ik, got_ik)) {
+		log("FAILURE: expected ik=%s", security_mode_expect_ik ? : "NULL");
+		OSMO_ASSERT(false);
+	}
+	return 0;
+}
 
-void rx_from_ms(struct msgb *msg)
+struct msgb *dont_ran_encode(struct osmo_fsm_inst *caller_fi, const struct ran_msg *ran_enc_msg)
 {
-	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct msc_role_common *c = caller_fi->priv;
+	enum osmo_rat_type ran_type = c->ran->type;
+	const char *ran_name = osmo_rat_type_name(ran_type);
+	LOG_RAN_ENC(caller_fi, DMSC, LOGL_INFO, "%s on %s\n", ran_msg_type_name(ran_enc_msg->msg_type),
+		     ran_name);
+
+	switch (ran_enc_msg->msg_type) {
+	case RAN_MSG_DTAP:
+		_validate_dtap(ran_enc_msg->dtap, ran_type);
+		break;
+	case RAN_MSG_CLEAR_COMMAND:
+		switch (ran_type) {
+		case OSMO_RAT_GERAN_A:
+			bssap_validate_clear_cmd();
+			break;
+		case OSMO_RAT_UTRAN_IU:
+			iucs_validate_clear_cmd();
+			break;
+		default:
+			OSMO_ASSERT(false);
+		}
+		break;
+	case RAN_MSG_CIPHER_MODE_COMMAND:
+		switch (ran_type) {
+		case OSMO_RAT_GERAN_A:
+			bssap_validate_cipher_mode_cmd(&ran_enc_msg->cipher_mode_command);
+			break;
+		case OSMO_RAT_UTRAN_IU:
+			iucs_validate_security_mode_ctrl(&ran_enc_msg->cipher_mode_command);
+			break;
+		default:
+			OSMO_ASSERT(false);
+		}
+		break;
+	default:
+		break;
+	}
 
-	log("MSC <--%s-- MS: %s",
-	    osmo_rat_type_name(rx_from_ran),
-	    gh_type_name(gh));
+	/* We're testing MSC and VLR interaction, not message encoding.
+	 * Return whatever. The test msc_i instance is a dummy and drops these.
+	 * But it must be msg_free()-able.
+	 */
+	return msgb_alloc(1, "unused dummy msg");
+}
+
+struct ran_infra test_ran_infra[] = {
+	[OSMO_RAT_GERAN_A] = {
+		.type = OSMO_RAT_GERAN_A,
+		.an_proto = OSMO_GSUP_ACCESS_NETWORK_PROTOCOL_TS3G_48006,
+		.log_subsys = DBSSAP,
+		.tdefs = msc_tdefs_geran,
+		.ran_encode = dont_ran_encode,
+	},
+	[OSMO_RAT_UTRAN_IU] = {
+		.type = OSMO_RAT_UTRAN_IU,
+		.an_proto = OSMO_GSUP_ACCESS_NETWORK_PROTOCOL_TS3G_25413,
+		.log_subsys = DIUCS,
+		.tdefs = msc_tdefs_utran,
+		.ran_encode = dont_ran_encode,
+	},
+};
 
-	if (!conn_exists(g_conn))
-		g_conn = NULL;
+static int fake_msc_a_ran_dec(const struct ran_msg *ran_dec_msg)
+{
+	struct msc_a_ran_dec_data d = {
+		.from_role = MSC_ROLE_I,
+	};
+	return msc_a_ran_decode_cb(g_msub->role[MSC_ROLE_A], &d, ran_dec_msg);
+}
 
-	if (!g_conn) {
+void rx_from_ms(struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct ran_msg ran_dec_msg;
+	struct gsm0808_cell_id cell_id = {
+		.id_discr = CELL_IDENT_LAI_AND_LAC,
+		.id.lai_and_lac = {
+			.plmn = {
+				.mcc = 1,
+				.mnc = 2,
+			},
+			.lac = 23,
+		},
+	};
+	struct msc_a *msc_a;
+
+	log("MSC <--%s-- MS: %s", osmo_rat_type_name(rx_from_ran), gh_type_name(gh));
+
+	if (!conn_exists(g_msub))
+		g_msub = NULL;
+
+	if (!g_msub) {
 		log("new conn");
-		g_conn = conn_new();
+		g_msub = msub_alloc(net);
+		msc_a_alloc(g_msub, &test_ran_infra[rx_from_ran]);
+		dummy_msc_i_alloc(g_msub, &test_ran_infra[rx_from_ran]);
+
 		reset_l3_seq_nr();
-		patch_l3_seq_nr(msg);
-		ran_conn_compl_l3(g_conn, msg, 23);
+		ran_dec_msg = (struct ran_msg){
+			.msg_type = RAN_MSG_COMPL_L3,
+			.compl_l3 = {
+				.cell_id = &cell_id,
+				.msg = msg,
+			},
+		};
 	} else {
-		patch_l3_seq_nr(msg);
-		if ((gsm48_hdr_pdisc(gh) == GSM48_PDISC_RR)
-		    && (gsm48_hdr_msg_type(gh) == GSM48_MT_RR_CIPH_M_COMPL))
-			ran_conn_cipher_mode_compl(g_conn, msg, 0);
-		else
-			ran_conn_dtap(g_conn, msg);
+		ran_dec_msg = (struct ran_msg){
+			.msg_type = RAN_MSG_DTAP,
+			.dtap = msg,
+		};
 	}
 
-	if (!conn_exists(g_conn))
-		g_conn = NULL;
+	msc_a = msub_msc_a(g_msub);
+	msc_a_get(msc_a, __func__);
+
+	patch_l3_seq_nr(msg);
+	fake_msc_a_ran_dec(&ran_dec_msg);
+
+	msc_a_put(msc_a, __func__);
+
+	if (!conn_exists(g_msub))
+		g_msub = NULL;
 }
 
 void ms_sends_msg(const char *hex)
@@ -257,34 +446,21 @@ void ms_sends_msg(const char *hex)
 	msgb_free(msg);
 }
 
-void bss_sends_bssap_mgmt(const char *hex)
+void ms_sends_classmark_update(const struct osmo_gsm48_classmark *classmark)
 {
-	struct msgb *msg;
-	struct bssmap_header *bh;
-	struct a_conn_info a_conn_info;
-
-	msg = msgb_from_hex("bss_sends_bssap_mgmt", 1024, hex);
-	msg->l3h = msg->data;
-
-	msg->l2h = msgb_push(msg, sizeof(*bh));
-	bh = (void*)msg->l2h;
-	bh->type = BSSAP_MSG_BSS_MANAGEMENT;
-	bh->length = msgb_l3len(msg);
-
-	if (!conn_exists(g_conn))
-		g_conn = NULL;
-
-	OSMO_ASSERT(g_conn);
-	a_conn_info.network = net;
-	a_conn_info.conn_id = g_conn->a.conn_id;
-
-	a_sccp_rx_dt((struct osmo_sccp_user*)0x1, &a_conn_info, msg);
-	msgb_free(msg);
+	struct ran_msg ran_dec = {
+		.msg_type = RAN_MSG_CLASSMARK_UPDATE,
+		.classmark_update = {
+			.classmark = classmark,
+		},
+	};
+	fake_msc_a_ran_dec(&ran_dec);
 }
 
 static int ms_sends_msg_fake(uint8_t pdisc, uint8_t msg_type)
 {
 	int rc;
+	struct ran_msg ran_dec;
 	struct msgb *msg;
 	struct gsm48_hdr *gh;
 
@@ -298,7 +474,12 @@ static int ms_sends_msg_fake(uint8_t pdisc, uint8_t msg_type)
 	msgb_put(msg, 123);
 
 	patch_l3_seq_nr(msg);
-	rc = gsm0408_dispatch(g_conn, msg);
+
+	ran_dec = (struct ran_msg){
+		.msg_type = RAN_MSG_DTAP,
+		.dtap = msg,
+	};
+	rc = fake_msc_a_ran_dec(&ran_dec);
 
 	talloc_free(msg);
 	return rc;
@@ -352,7 +533,6 @@ void __wrap_gsm340_gen_scts(uint8_t *scts, time_t time)
 const char *paging_expecting_imsi = NULL;
 uint32_t paging_expecting_tmsi;
 bool paging_sent;
-bool paging_stopped;
 
 void paging_expect_imsi(const char *imsi)
 {
@@ -366,69 +546,25 @@ void paging_expect_tmsi(uint32_t tmsi)
 	paging_expecting_imsi = NULL;
 }
 
-static int _paging_sent(enum osmo_rat_type via_ran, const char *imsi, uint32_t tmsi, uint32_t lac)
+/* override, requires '-Wl,--wrap=ran_peers_down_paging' */
+int __real_ran_peers_down_paging(struct sccp_ran_inst *sri, enum CELL_IDENT page_where, struct vlr_subscr *vsub,
+				 enum paging_cause cause);
+int __wrap_ran_peers_down_paging(struct sccp_ran_inst *sri, enum CELL_IDENT page_where, struct vlr_subscr *vsub,
+				 enum paging_cause cause)
 {
-	log("%s sends out paging request to IMSI %s, TMSI 0x%08x, LAC %u",
-	    osmo_rat_type_name(via_ran), imsi, tmsi, lac);
+	log("paging request (%s) to %s on %s", paging_cause_name(cause), vlr_subscr_name(vsub),
+	    osmo_rat_type_name(sri->ran->type));
+
 	OSMO_ASSERT(paging_expecting_imsi || (paging_expecting_tmsi != GSM_RESERVED_TMSI));
 	if (paging_expecting_imsi)
-		VERBOSE_ASSERT(strcmp(paging_expecting_imsi, imsi), == 0, "%d");
+		VERBOSE_ASSERT(strcmp(paging_expecting_imsi, vsub->imsi), == 0, "%d");
 	if (paging_expecting_tmsi != GSM_RESERVED_TMSI) {
-		VERBOSE_ASSERT(paging_expecting_tmsi, == tmsi, "0x%08x");
+		VERBOSE_ASSERT(paging_expecting_tmsi, == vsub->tmsi, "0x%08x");
 	}
 	paging_sent = true;
-	paging_stopped = false;
 	return 1;
 }
 
-/* override, requires '-Wl,--wrap=ranap_iu_page_cs' */
-int __real_ranap_iu_page_cs(const char *imsi, const uint32_t *tmsi, uint16_t lac);
-int __wrap_ranap_iu_page_cs(const char *imsi, const uint32_t *tmsi, uint16_t lac)
-{
-	return _paging_sent(OSMO_RAT_UTRAN_IU, imsi, tmsi ? *tmsi : GSM_RESERVED_TMSI, lac);
-}
-
-/* override, requires '-Wl,--wrap=a_iface_tx_paging' */
-int __real_a_iface_tx_paging(const char *imsi, uint32_t tmsi, uint16_t lac);
-int __wrap_a_iface_tx_paging(const char *imsi, uint32_t tmsi, uint16_t lac)
-{
-	return _paging_sent(OSMO_RAT_GERAN_A, imsi, tmsi, lac);
-}
-
-/* override, requires '-Wl,--wrap=msc_stop_paging' */
-void __real_msc_stop_paging(struct vlr_subscr *vsub);
-void __wrap_msc_stop_paging(struct vlr_subscr *vsub)
-{
-	paging_stopped = true;
-}
-
-
-/* override, requires '-Wl,--wrap=osmo_sccp_tx_data_msg' */
-int __real_osmo_sccp_tx_data_msg(struct osmo_sccp_user *scu, uint32_t conn_id,
-				 struct msgb *msg);
-int __wrap_osmo_sccp_tx_data_msg(struct osmo_sccp_user *scu, uint32_t conn_id,
-				 struct msgb *msg)
-{
-	const char *proto_str;
-	const char *msg_str = gsm0808_bssmap_name(msg->l3h[2]);
-	switch (*msg->l3h) {
-	case BSSAP_MSG_BSS_MANAGEMENT:
-		proto_str = "BSSAP-BSS-MANAGEMENT";
-		break;
-	case BSSAP_MSG_DTAP:
-		proto_str = "BSSAP-DTAP";
-		break;
-	default:
-		proto_str = "";
-		msg_str = "";
-		break;
-	}
-
-	log("BSC <--%s-- MSC: %s %s", proto_str, msg_str, msgb_hexdump(msg));
-	msgb_free(msg);
-	return 0;
-}
-
 void clear_vlr()
 {
 	struct vlr_subscr *vsub, *n;
@@ -531,12 +667,26 @@ static struct log_info info = {
 	.num_cat = ARRAY_SIZE(test_categories),
 };
 
+struct gsm_mncc *on_call_release_mncc_sends_to_cc_data = NULL;
+
 int mncc_recv(struct gsm_network *net, struct msgb *msg)
 {
 	struct gsm_mncc *mncc = (void*)msg->data;
 	log("MSC --> MNCC: callref 0x%x: %s", mncc->callref,
 	    get_mncc_name(mncc->msg_type));
 
+	if (mncc->msg_type == MNCC_REL_IND && on_call_release_mncc_sends_to_cc_data) {
+
+		log("MNCC: callref 0x%x: Call Release triggering %s", mncc->callref,
+		    get_mncc_name(on_call_release_mncc_sends_to_cc_data->msg_type));
+
+		mncc_tx_to_cc(net, on_call_release_mncc_sends_to_cc_data->msg_type,
+			      on_call_release_mncc_sends_to_cc_data);
+
+		on_call_release_mncc_sends_to_cc_data = NULL;
+		return 0;
+	}
+
 	OSMO_ASSERT(cc_to_mncc_tx_expected_msg_type);
 	if (cc_to_mncc_tx_expected_msg_type != mncc->msg_type) {
 		log("Mismatch! Expected MNCC msg type: %s",
@@ -600,129 +750,40 @@ int __wrap_osmo_gsup_client_send(struct osmo_gsup_client *gsupc, struct msgb *ms
 	return 0;
 }
 
-static int _validate_dtap(struct msgb *msg, enum osmo_rat_type to_ran)
-{
-	btw("DTAP --%s--> MS: %s: %s",
-	    osmo_rat_type_name(to_ran), gh_type_name((void*)msg->data),
-	    osmo_hexdump_nospc(msg->data, msg->len));
-
-	OSMO_ASSERT(dtap_tx_expected);
-
-	/* Mask the sequence number out before comparing */
-	msg->data[1] &= 0x3f;
-	if (!msgb_eq_data_print(msg, dtap_tx_expected->data, dtap_tx_expected->len))
-		abort();
-
-	btw("DTAP matches expected message");
-
-	talloc_free(msg);
-	dtap_tx_confirmed = true;
-	talloc_free(dtap_tx_expected);
-	dtap_tx_expected = NULL;
-	return 0;
-}
-
-/* override, requires '-Wl,--wrap=ranap_iu_tx' */
-int __real_ranap_iu_tx(struct msgb *msg, uint8_t sapi);
-int __wrap_ranap_iu_tx(struct msgb *msg, uint8_t sapi)
-{
-	return _validate_dtap(msg, OSMO_RAT_UTRAN_IU);
-}
-
-/* override, requires '-Wl,--wrap=ranap_iu_tx_release' */
-int __real_ranap_iu_tx_release(struct ranap_ue_conn_ctx *ctx, const struct RANAP_Cause *cause);
-int __wrap_ranap_iu_tx_release(struct ranap_ue_conn_ctx *ctx, const struct RANAP_Cause *cause)
-{
-	btw("Iu Release --%s--> MS", osmo_rat_type_name(OSMO_RAT_UTRAN_IU));
-	OSMO_ASSERT(iu_release_expected);
-	iu_release_expected = false;
-	iu_release_sent = true;
-	return 0;
-}
-
-/* override, requires '-Wl,--wrap=iu_tx_common_id' */
-int __real_ranap_iu_tx_common_id(struct ranap_ue_conn_ctx *ue_ctx, const char *imsi);
-int __wrap_ranap_iu_tx_common_id(struct ranap_ue_conn_ctx *ue_ctx, const char *imsi)
+/* override, requires '-Wl,--wrap=call_leg_ensure_ci' */
+int __real_call_leg_ensure_ci(struct call_leg *cl, enum rtp_direction dir, uint32_t call_id, struct gsm_trans *for_trans);
+int __wrap_call_leg_ensure_ci(struct call_leg *cl, enum rtp_direction dir, uint32_t call_id, struct gsm_trans *for_trans)
 {
-	btw("Iu Common ID --%s--> MS (IMSI=%s)", osmo_rat_type_name(OSMO_RAT_UTRAN_IU), imsi);
+	log("MS <--Call Assignment-- MSC: callref=0x%x", call_id);
 	return 0;
 }
 
-/* override, requires '-Wl,--wrap=a_iface_tx_dtap' */
-int __real_a_iface_tx_dtap(struct msgb *msg);
-int __wrap_a_iface_tx_dtap(struct msgb *msg)
-{
-	return _validate_dtap(msg, OSMO_RAT_GERAN_A);
-}
-
-/* override, requires '-Wl,--wrap=a_iface_tx_clear_cmd' */
-int __real_a_iface_tx_clear_cmd(struct ran_conn *conn);
-int __wrap_a_iface_tx_clear_cmd(struct ran_conn *conn)
-{
-	btw("BSSAP Clear --%s--> MS", osmo_rat_type_name(OSMO_RAT_GERAN_A));
-	OSMO_ASSERT(bssap_clear_expected);
-	bssap_clear_expected = false;
-	bssap_clear_sent = true;
-	return 0;
-}
-
-/* override, requires '-Wl,--wrap=msc_mgcp_try_call_assignment' */
-int __real_msc_mgcp_try_call_assignment(struct gsm_trans *trans);
-int __wrap_msc_mgcp_try_call_assignment(struct gsm_trans *trans)
-{
-	log("MS <--Call Assignment-- MSC: subscr=%s callref=0x%x",
-	    vlr_subscr_name(trans->vsub), trans->callref);
-	return 0;
-}
-
-struct gsm_mncc *on_call_release_mncc_sends_to_cc_data = NULL;
-
-/* override, requires '-Wl,--wrap=msc_mgcp_call_release' */
-void __real_msc_mgcp_call_release(struct gsm_trans *trans);
-void __wrap_msc_mgcp_call_release(struct gsm_trans *trans)
-{
-	log("MS <--Call Release-- MSC: subscr=%s callref=0x%x",
-	    vlr_subscr_name(trans->vsub), trans->callref);
-	if (on_call_release_mncc_sends_to_cc_data) {
-		mncc_tx_to_cc(trans->net, on_call_release_mncc_sends_to_cc_data->msg_type,
-			      on_call_release_mncc_sends_to_cc_data);
-		on_call_release_mncc_sends_to_cc_data = NULL;
-	}
-}
-
 static int fake_vlr_tx_lu_acc(void *msc_conn_ref, uint32_t send_tmsi)
 {
-	struct ran_conn *conn = msc_conn_ref;
+	struct msc_a *msc_a = msc_conn_ref;
 	if (send_tmsi == GSM_RESERVED_TMSI)
-		btw("sending LU Accept for %s", vlr_subscr_name(conn->vsub));
+		btw("sending LU Accept for %s", msc_a->c.fi->id);
 	else
 		btw("sending LU Accept for %s, with TMSI 0x%08x",
-		    vlr_subscr_name(conn->vsub), send_tmsi);
+		    msc_a->c.fi->id, send_tmsi);
 	lu_result_sent |= RES_ACCEPT;
 	return 0;
 }
 
 static int fake_vlr_tx_lu_rej(void *msc_conn_ref, enum gsm48_reject_value cause)
 {
-	struct ran_conn *conn = msc_conn_ref;
-	btw("sending LU Reject for %s, cause %u", vlr_subscr_name(conn->vsub), cause);
+	struct msc_a *msc_a = msc_conn_ref;
+	btw("sending LU Reject for %s, cause %u", msc_a->c.fi->id, cause);
 	lu_result_sent |= RES_REJECT;
 	return 0;
 }
 
-static int fake_vlr_tx_cm_serv_acc(void *msc_conn_ref)
-{
-	struct ran_conn *conn = msc_conn_ref;
-	btw("sending CM Service Accept for %s", vlr_subscr_name(conn->vsub));
-	cm_service_result_sent |= RES_ACCEPT;
-	return 0;
-}
-
-static int fake_vlr_tx_cm_serv_rej(void *msc_conn_ref, enum gsm48_reject_value cause)
+static int fake_vlr_tx_cm_serv_rej(void *msc_conn_ref, enum osmo_cm_service_type cm_service_type,
+				   enum gsm48_reject_value cause)
 {
-	struct ran_conn *conn = msc_conn_ref;
-	btw("sending CM Service Reject for %s, cause: %s",
-	    vlr_subscr_name(conn->vsub), gsm48_reject_value_name(cause));
+	struct msc_a *msc_a = msc_conn_ref;
+	btw("sending CM Service Reject (%s) for %s, cause: %s",
+	    osmo_cm_service_type_name(cm_service_type), msc_a->c.fi->id, gsm48_reject_value_name(cause));
 	cm_service_result_sent |= RES_REJECT;
 	return 0;
 }
@@ -730,11 +791,11 @@ static int fake_vlr_tx_cm_serv_rej(void *msc_conn_ref, enum gsm48_reject_value c
 static int fake_vlr_tx_auth_req(void *msc_conn_ref, struct vlr_auth_tuple *at,
 				bool send_autn)
 {
-	struct ran_conn *conn = msc_conn_ref;
+	struct msc_a *msc_a = msc_conn_ref;
 	char *hex;
 	bool ok = true;
 	btw("sending %s Auth Request for %s: tuple use_count=%d key_seq=%d auth_types=0x%x and...",
-	    send_autn? "UMTS" : "GSM", vlr_subscr_name(conn->vsub),
+	    send_autn? "UMTS" : "GSM", msc_a->c.fi->id,
 	    at->use_count, at->key_seq, at->vec.auth_types);
 
 	hex = osmo_hexdump_nospc((void*)&at->vec.rand, sizeof(at->vec.rand));
@@ -774,104 +835,64 @@ static int fake_vlr_tx_auth_req(void *msc_conn_ref, struct vlr_auth_tuple *at,
 
 static int fake_vlr_tx_auth_rej(void *msc_conn_ref)
 {
-	struct ran_conn *conn = msc_conn_ref;
-	btw("sending Auth Reject for %s", vlr_subscr_name(conn->vsub));
+	struct msc_a *msc_a = msc_conn_ref;
+	btw("sending Auth Reject for %s", msc_a->c.fi->id);
 	return 0;
 }
 
-/* override, requires '-Wl,--wrap=a_iface_tx_cipher_mode' */
-int __real_a_iface_tx_cipher_mode(const struct ran_conn *conn,
-				  struct gsm0808_encrypt_info *ei, int include_imeisv);
-int __wrap_a_iface_tx_cipher_mode(const struct ran_conn *conn,
-				  struct gsm0808_encrypt_info *ei, int include_imeisv)
+void ms_sends_ciphering_mode_complete(const char *inner_ran_msg)
 {
-	int i;
-	btw("sending Ciphering Mode Command for %s: include_imeisv=%d",
-	    vlr_subscr_name(conn->vsub), include_imeisv);
-	for (i = 0; i < ei->perm_algo_len; i++)
-		btw("...perm algo: A5/%u", ei->perm_algo[i] - 1);
-	OSMO_ASSERT(ei->key_len <= sizeof(ei->key));
-	btw("...key: %s", osmo_hexdump_nospc(ei->key, ei->key_len));
-	cipher_mode_cmd_sent = true;
-	cipher_mode_cmd_sent_with_imeisv = include_imeisv;
+	struct ran_msg ran_dec;
 
-	if (!cipher_mode_expect_kc
-	    || strcmp(cipher_mode_expect_kc, osmo_hexdump_nospc(ei->key, ei->key_len))) {
-		log("FAILURE: expected kc=%s", cipher_mode_expect_kc ? : "NULL");
-		OSMO_ASSERT(false);
-	}
-	return 0;
-}
+	msc_a_get(msub_msc_a(g_msub), __func__);
 
-/* override, requires '-Wl,--wrap=ranap_iu_tx_sec_mode_cmd' */
-int __real_ranap_iu_tx_sec_mode_cmd(struct ranap_ue_conn_ctx *uectx, struct osmo_auth_vector *vec,
-				    int send_ck, int new_key);
-int __wrap_ranap_iu_tx_sec_mode_cmd(struct ranap_ue_conn_ctx *uectx, struct osmo_auth_vector *vec,
-				    int send_ck, int new_key)
-{
-	btw("sending SecurityModeControl for UE ctx %u send_ck=%d new_key=%d",
-	    uectx->conn_id, send_ck, new_key);
-	btw("...ik=%s", osmo_hexdump_nospc(vec->ik, sizeof(vec->ik)));
-	if (send_ck)
-		btw("...ck=%s", osmo_hexdump_nospc(vec->ck, sizeof(vec->ck)));
-	security_mode_ctrl_sent = true;
-	if (!security_mode_expect_ik
-	    || strcmp(security_mode_expect_ik, osmo_hexdump_nospc(vec->ik, sizeof(vec->ik)))) {
-		log("FAILURE: expected ik=%s", security_mode_expect_ik ? : "NULL");
-		OSMO_ASSERT(false);
-	}
-	if (((!!send_ck) != (!!security_mode_expect_ck))
-	    || (security_mode_expect_ck
-		&& strcmp(security_mode_expect_ck, osmo_hexdump_nospc(vec->ck, sizeof(vec->ck))))) {
-		log("FAILURE: expected ck=%s", security_mode_expect_ck ? : "NULL");
-		OSMO_ASSERT(false);
+	ran_dec = (struct ran_msg){
+		.msg_type = RAN_MSG_CIPHER_MODE_COMPLETE,
+	};
+	fake_msc_a_ran_dec(&ran_dec);
+
+	if (inner_ran_msg) {
+		struct msgb *msg = msgb_from_hex("cipher_mode_complete_ran", 1024, inner_ran_msg);
+		msg->l1h = msg->l2h = msg->l3h = msg->data;
+		ran_dec = (struct ran_msg){
+			.msg_type = RAN_MSG_DTAP,
+			.dtap = msg,
+		};
+		patch_l3_seq_nr(msg);
+		fake_msc_a_ran_dec(&ran_dec);
+		msgb_free(msg);
 	}
-	return 0;
-}
 
-extern int msc_vlr_set_ciph_mode(void *msc_conn_ref, bool umts_aka, bool retrieve_imeisv);
+	msc_a_put(msub_msc_a(g_msub), __func__);
 
-static int fake_vlr_tx_ciph_mode_cmd(void *msc_conn_ref, bool umts_aka, bool retrieve_imeisv)
-{
-	int rc;
-#ifndef BUILD_IU
-	/* If we built without support for IU, fake the IU part here. The root cause is that we don't
-	 * have differing sets of expected outputs for --enable-iu and --disable-iu. */
-	struct ran_conn *conn = msc_conn_ref;
-	if (conn->via_ran == OSMO_RAT_UTRAN_IU) {
-		DEBUGP(DMM, "-> SECURITY MODE CONTROL %s\n", vlr_subscr_name(conn->vsub));
-		rc = __wrap_ranap_iu_tx_sec_mode_cmd(conn->iu.ue_ctx, &conn->vsub->last_tuple->vec,
-						     0, 1);
-	} else
-#endif
-	rc = msc_vlr_set_ciph_mode(msc_conn_ref, umts_aka, retrieve_imeisv);
-	if (rc)
-		btw("ERROR sending ciphering mode command: rc=%d", rc);
-	return rc;
+	if (!conn_exists(g_msub))
+		g_msub = NULL;
 }
 
 void ms_sends_security_mode_complete()
 {
-	OSMO_ASSERT(g_conn);
-	OSMO_ASSERT(g_conn->via_ran == OSMO_RAT_UTRAN_IU);
-	OSMO_ASSERT(g_conn->iu.ue_ctx);
-	ran_conn_rx_sec_mode_compl(g_conn);
-}
+	struct ran_msg ran_dec;
 
-void bss_sends_clear_complete()
-{
-	btw("BSS sends BSSMAP Clear Complete");
-	OSMO_ASSERT(g_conn);
-	OSMO_ASSERT(g_conn->via_ran == OSMO_RAT_GERAN_A);
-	ran_conn_rx_bssmap_clear_complete(g_conn);
+	ran_dec = (struct ran_msg){
+		.msg_type = RAN_MSG_CIPHER_MODE_COMPLETE,
+	};
+	fake_msc_a_ran_dec(&ran_dec);
+
+	if (!conn_exists(g_msub))
+		g_msub = NULL;
 }
 
-void rnc_sends_release_complete()
+void ran_sends_clear_complete()
 {
-	btw("RNC sends Iu Release Complete");
-	OSMO_ASSERT(g_conn);
-	OSMO_ASSERT(g_conn->via_ran == OSMO_RAT_UTRAN_IU);
-	ran_conn_rx_iu_release_complete(g_conn);
+	struct ran_msg ran_dec;
+
+	ran_dec = (struct ran_msg){
+		.msg_type = RAN_MSG_CLEAR_COMPLETE,
+	};
+	fake_msc_a_ran_dec(&ran_dec);
+
+	if (!conn_exists(g_msub))
+		g_msub = NULL;
 }
 
 const struct timeval fake_time_start_time = { 123, 456 };
@@ -895,25 +916,29 @@ static void check_talloc(void *msgb_ctx, void *msc_vlr_tests_ctx)
 	/* Verifying that the msgb context is empty */
 	talloc_report_full(msgb_ctx, stderr);
 	/* Expecting these to stick around in msc_vlr_tests_ctx:
-	 * talloc_total_blocks(tall_bsc_ctx) == 13
-	 * full talloc report on 'msc_vlr_tests_ctx' (total   4638 bytes in  13 blocks)
-	 *     struct osmo_gsup_client        contains    256 bytes in   1 blocks (ref 0) 0x61300000dd20
-	 *     struct gsm_network             contains   2983 bytes in   5 blocks (ref 0) 0x61400000fea0
-	 *         struct vlr_instance            contains    320 bytes in   2 blocks (ref 0) 0x61300000dee0
-	 *             struct ipaccess_unit           contains     64 bytes in   1 blocks (ref 0) 0x60e0000244c0
-	 *         no_gsup_server                 contains     15 bytes in   1 blocks (ref 0) 0x60b00000af40
-	 *         rate_ctr.c:234                 contains   2352 bytes in   1 blocks (ref 0) 0x61e00000f0e0
-	 *     logging                        contains   1399 bytes in   5 blocks (ref 0) 0x60b00000aff0
-	 *         struct log_target              contains    238 bytes in   2 blocks (ref 0) 0x61200000bf20
-	 *             struct log_category            contains     70 bytes in   1 blocks (ref 0) 0x60f00000efb0
-	 *         struct log_info                contains   1160 bytes in   2 blocks (ref 0) 0x60d00000cfd0
-	 *             struct log_info_cat            contains   1120 bytes in   1 blocks (ref 0) 0x61a00001f2e0
-	 *     msgb                           contains      0 bytes in   1 blocks (ref 0) 0x60800000bf80
-	 * (That's 13 counting the root ctx)
+	 * full talloc report on 'msgb' (total      0 bytes in   1 blocks)
+	 * talloc_total_blocks(tall_bsc_ctx) == 17
+	 * full talloc report on 'msc_vlr_tests_ctx' (total   6336 bytes in  17 blocks)
+	 *     struct osmo_gsup_client        contains    256 bytes in   1 blocks (ref 0) 0x613000000260
+	 *     struct gsm_network             contains   4647 bytes in   9 blocks (ref 0) 0x6190000000e0
+	 * 	struct mgcp_client             contains    688 bytes in   1 blocks (ref 0) 0x6180000000e0
+	 * 	struct sccp_ran_inst           contains    152 bytes in   1 blocks (ref 0) 0x611000000460
+	 * 	struct sccp_ran_inst           contains    152 bytes in   1 blocks (ref 0) 0x611000000320
+	 * 	struct gsup_client_mux         contains    200 bytes in   2 blocks (ref 0) 0x6110000001e0
+	 * 	    struct ipaccess_unit           contains     64 bytes in   1 blocks (ref 0) 0x60e000023180
+	 * 	struct vlr_instance            contains    248 bytes in   1 blocks (ref 0) 0x6130000000a0
+	 * 	no_gsup_server                 contains     15 bytes in   1 blocks (ref 0) 0x60b000000150
+	 * 	../../../src/libosmocore/src/rate_ctr.c:234 contains   2352 bytes in   1 blocks (ref 0) 0x61e0000000e0
+	 *     logging                        contains   1433 bytes in   5 blocks (ref 0) 0x60b0000000a0
+	 * 	struct log_target              contains    240 bytes in   2 blocks (ref 0) 0x6120000000a0
+	 * 	    struct log_category            contains     72 bytes in   1 blocks (ref 0) 0x60f0000000a0
+	 * 	struct log_info                contains   1192 bytes in   2 blocks (ref 0) 0x60d0000000a0
+	 * 	    struct log_info_cat            contains   1152 bytes in   1 blocks (ref 0) 0x61a0000000e0
+	 *     msgb                           contains      0 bytes in   1 blocks (ref 0) 0x608000000100
 	 */
 	fprintf(stderr, "talloc_total_blocks(tall_bsc_ctx) == %zu\n",
 		talloc_total_blocks(msc_vlr_tests_ctx));
-	if (talloc_total_blocks(msc_vlr_tests_ctx) != 13)
+	if (talloc_total_blocks(msc_vlr_tests_ctx) != 17)
 		talloc_report_full(msc_vlr_tests_ctx, stderr);
 	fprintf(stderr, "\n");
 }
@@ -1002,17 +1027,38 @@ struct gsm_network *test_net(void *ctx)
 	net->gsup_server_port = 0;
 
 	OSMO_ASSERT(msc_vlr_alloc(net) == 0);
-	OSMO_ASSERT(msc_vlr_start(net) == 0);
 	OSMO_ASSERT(net->vlr);
-	OSMO_ASSERT(net->vlr->gsup_client);
+	OSMO_ASSERT(msc_gsup_client_start(net) == 0);
+	OSMO_ASSERT(net->gcm);
+	OSMO_ASSERT(msc_vlr_start(net) == 0);
 
 	net->vlr->ops.tx_lu_acc = fake_vlr_tx_lu_acc;
 	net->vlr->ops.tx_lu_rej = fake_vlr_tx_lu_rej;
-	net->vlr->ops.tx_cm_serv_acc = fake_vlr_tx_cm_serv_acc;
+	net->vlr->ops.tx_cm_serv_acc = msc_vlr_tx_cm_serv_acc;
 	net->vlr->ops.tx_cm_serv_rej = fake_vlr_tx_cm_serv_rej;
 	net->vlr->ops.tx_auth_req = fake_vlr_tx_auth_req;
 	net->vlr->ops.tx_auth_rej = fake_vlr_tx_auth_rej;
-	net->vlr->ops.set_ciph_mode = fake_vlr_tx_ciph_mode_cmd;
+	net->vlr->ops.set_ciph_mode = msc_a_vlr_set_cipher_mode;
+
+	/* Allocate fake SCCP Ran Instances */
+	net->a.sri = talloc_zero(net, struct sccp_ran_inst);
+	*net->a.sri = (struct sccp_ran_inst){
+		.ran = &test_ran_infra[OSMO_RAT_GERAN_A],
+	};
+	INIT_LLIST_HEAD(&net->a.sri->ran_peers);
+	INIT_LLIST_HEAD(&net->a.sri->ran_conns);
+
+	net->iu.sri = talloc_zero(net, struct sccp_ran_inst);
+	*net->iu.sri = (struct sccp_ran_inst){
+		.ran = &test_ran_infra[OSMO_RAT_UTRAN_IU],
+	};
+	INIT_LLIST_HEAD(&net->iu.sri->ran_peers);
+	INIT_LLIST_HEAD(&net->iu.sri->ran_conns);
+
+	net->mgw.tdefs = g_mgw_tdefs;
+	mgcp_client_conf_init(&net->mgw.conf);
+	net->mgw.tdefs = g_mgw_tdefs;
+	net->mgw.client = mgcp_client_init(net, &net->mgw.conf);
 
 	return net;
 }
@@ -1046,8 +1092,11 @@ int main(int argc, char **argv)
 	net = test_net(msc_vlr_tests_ctx);
 
 	osmo_fsm_log_addr(false);
+	osmo_fsm_log_timeouts(cmdline_opts.verbose);
+
+	call_leg_init(net);
 
-	ran_conn_init();
+	OSMO_ASSERT(osmo_fsm_register(&dummy_msc_i_fsm) == 0);
 
 	clear_vlr();