Merge remote branch 'origin/master'

14 files changed, 233 insertions, 100 deletions

diff --git a/openbsc/src/abis_nm.c b/openbsc/src/abis_nm.c
index 088794e0f..03d9deff0 100755
--- a/openbsc/src/abis_nm.c
+++ b/openbsc/src/abis_nm.c
@@ -410,6 +410,8 @@ static const enum abis_nm_chan_comb chcomb4pchan[] = {
 	[GSM_PCHAN_TCH_F]	= NM_CHANC_TCHFull,
 	[GSM_PCHAN_TCH_H]	= NM_CHANC_TCHHalf,
 	[GSM_PCHAN_SDCCH8_SACCH8C] = NM_CHANC_SDCCH,
+	[GSM_PCHAN_PDCH]	= NM_CHANC_IPAC_PDCH,
+	[GSM_PCHAN_TCH_F_PDCH]	= NM_CHANC_IPAC_TCHFull_PDCH,
 	/* FIXME: bounds check */
 };
 
@@ -585,6 +587,14 @@ const char *nm_adm_name(u_int8_t adm)
 	}
 }
 
+static void debugp_foh(struct abis_om_fom_hdr *foh)
+{
+	DEBUGP(DNM, "OC=%s(%02x) INST=(%02x,%02x,%02x) ",
+		obj_class_name(foh->obj_class), foh->obj_class, 
+		foh->obj_inst.bts_nr, foh->obj_inst.trx_nr,
+		foh->obj_inst.ts_nr);
+}
+
 /* obtain the gsm_nm_state data structure for a given object instance */
 static struct gsm_nm_state *
 objclass2nmstate(struct gsm_bts *bts, u_int8_t obj_class,
@@ -648,6 +658,17 @@ objclass2nmstate(struct gsm_bts *bts, u_int8_t obj_class,
 			return NULL;
 		nm_state = &bts->bs11.envabtse[obj_inst->trx_nr].nm_state;
 		break;
+	case NM_OC_GPRS_NSE:
+		nm_state = &bts->gprs.nse.nm_state;
+		break;
+	case NM_OC_GPRS_CELL:
+		nm_state = &bts->gprs.cell.nm_state;
+		break;
+	case NM_OC_GPRS_NSVC:
+		if (obj_inst->trx_nr > ARRAY_SIZE(bts->gprs.nsvc))
+			return NULL;
+		nm_state = &bts->gprs.nsvc[obj_inst->trx_nr].nm_state;
+		break;
 	}
 	return nm_state;
 }
@@ -687,6 +708,17 @@ objclass2obj(struct gsm_bts *bts, u_int8_t obj_class,
 	case NM_OC_SITE_MANAGER:
 		obj = &bts->site_mgr;
 		break;
+	case NM_OC_GPRS_NSE:
+		obj = &bts->gprs.nse;
+		break;
+	case NM_OC_GPRS_CELL:
+		obj = &bts->gprs.cell;
+		break;
+	case NM_OC_GPRS_NSVC:
+		if (obj_inst->trx_nr > ARRAY_SIZE(bts->gprs.nsvc))
+			return NULL;
+		obj = &bts->gprs.nsvc[obj_inst->trx_nr];
+		break;
 	}
 	return obj;
 }
@@ -751,7 +783,7 @@ static int abis_nm_rx_statechg_rep(struct msgb *mb)
 	}
 	if (TLVP_PRESENT(&tp, NM_ATT_ADM_STATE)) {
 		new_state.administrative = *TLVP_VAL(&tp, NM_ATT_ADM_STATE);
-		DEBUGPC(DNM, "ADM=%02s ", nm_adm_name(new_state.administrative));
+		DEBUGPC(DNM, "ADM=%2s ", nm_adm_name(new_state.administrative));
 	}
 	DEBUGPC(DNM, "\n");
 
@@ -799,10 +831,7 @@ static int abis_nm_rcvmsg_report(struct msgb *mb)
 	struct abis_om_fom_hdr *foh = msgb_l3(mb);
 	u_int8_t mt = foh->msg_type;
 
-	DEBUGP(DNM, "OC=%s(%02x) INST=(%02x,%02x,%02x) ",
-		obj_class_name(foh->obj_class), foh->obj_class, 
-		foh->obj_inst.bts_nr, foh->obj_inst.trx_nr,
-		foh->obj_inst.ts_nr);
+	debugp_foh(foh);
 
 	//nmh->cfg->report_cb(mb, foh);
 
@@ -860,7 +889,9 @@ static int abis_nm_rx_sw_act_req(struct msgb *mb)
 	int nack = 0;
 	int ret;
 
-	DEBUGP(DNM, "Software Activate Request ");
+	debugp_foh(foh);
+
+	DEBUGPC(DNM, "SW Activate Request: ");
 
 	if (foh->obj_class >= 0xf0 && foh->obj_class <= 0xf3) {
 		DEBUGPC(DNM, "NACKing for GPRS obj_class 0x%02x\n", foh->obj_class);
@@ -965,10 +996,7 @@ static int abis_nm_rcvmsg_fom(struct msgb *mb)
 	if (is_in_arr(mt, nacks, ARRAY_SIZE(nacks))) {
 		struct tlv_parsed tp;
 
-		DEBUGP(DNM, "OC=%s(%02x) INST=(%02x,%02x,%02x) ",
-			obj_class_name(foh->obj_class), foh->obj_class,
-			foh->obj_inst.bts_nr, foh->obj_inst.trx_nr,
-			foh->obj_inst.ts_nr);
+		debugp_foh(foh);
 
 		if (nack_names[mt])
 			DEBUGPC(DNM, "%s NACK ", nack_names[mt]);
@@ -1851,11 +1879,12 @@ int abis_nm_opstart(struct gsm_bts *bts, u_int8_t obj_class, u_int8_t i0, u_int8
 	struct abis_om_hdr *oh;
 	struct msgb *msg = nm_msgb_alloc();
 
-	DEBUGP(DNM, "Sending OPSTART obj_class=0x%02x obj_inst=(0x%02x, 0x%02x, 0x%02x)\n",
-		obj_class, i0, i1, i2);
 	oh = (struct abis_om_hdr *) msgb_put(msg, ABIS_OM_FOM_HDR_SIZE);
 	fill_om_fom_hdr(oh, 0, NM_MT_OPSTART, obj_class, i0, i1, i2);
 
+	debugp_foh((struct abis_om_fom_hdr *) oh->data);
+	DEBUGPC(DNM, "Sending OPSTART\n");
+
 	return abis_nm_sendmsg(bts, msg);
 }
 
@@ -2474,10 +2503,7 @@ static int abis_nm_rx_ipacc(struct msgb *msg)
 	foh = (struct abis_om_fom_hdr *) (oh->data + 1 + idstrlen);
 	abis_nm_tlv_parse(&tp, foh->data, oh->length-sizeof(*foh));
 
-	DEBUGP(DNM, "OC=%s(%02x) INST=(%02x,%02x,%02x) ",
-		obj_class_name(foh->obj_class), foh->obj_class,
-		foh->obj_inst.bts_nr, foh->obj_inst.trx_nr,
-		foh->obj_inst.ts_nr);
+	debugp_foh(foh);
 
 	DEBUGPC(DNM, "IPACCESS(0x%02x): ", foh->msg_type);
 
@@ -2638,3 +2664,12 @@ int abis_nm_ipaccess_restart(struct gsm_bts *bts)
 {
 	return __simple_cmd(bts, NM_MT_IPACC_RESTART);
 }
+
+int abis_nm_ipaccess_set_attr(struct gsm_bts *bts, u_int8_t obj_class,
+				u_int8_t bts_nr, u_int8_t trx_nr, u_int8_t ts_nr,
+				u_int8_t *attr, u_int8_t attr_len)
+{
+	return abis_nm_ipaccess_msg(bts, NM_MT_IPACC_SET_ATTR,
+				    obj_class, bts_nr, trx_nr, ts_nr,
+				     attr, attr_len);
+}
diff --git a/openbsc/src/abis_rsl.c b/openbsc/src/abis_rsl.c
index 800f2027f..6b328bb28 100644
--- a/openbsc/src/abis_rsl.c
+++ b/openbsc/src/abis_rsl.c
@@ -202,7 +202,9 @@ struct gsm_lchan *lchan_lookup(struct gsm_bts_trx *trx, u_int8_t chan_nr)
 
 	if (cbits == 0x01) {
 		lch_idx = 0;	/* TCH/F */	
-		if (ts->pchan != GSM_PCHAN_TCH_F)
+		if (ts->pchan != GSM_PCHAN_TCH_F &&
+		    ts->pchan != GSM_PCHAN_PDCH &&
+		    ts->pchan != GSM_PCHAN_TCH_F_PDCH)
 			fprintf(stderr, "chan_nr=0x%02x but pchan=%u\n",
 				chan_nr, ts->pchan);
 	} else if ((cbits & 0x1e) == 0x02) {
@@ -244,6 +246,8 @@ u_int8_t lchan2chan_nr(struct gsm_lchan *lchan)
 
 	switch (ts->pchan) {
 	case GSM_PCHAN_TCH_F:
+	case GSM_PCHAN_PDCH:
+	case GSM_PCHAN_TCH_F_PDCH:
 		cbits = 0x01;
 		break;
 	case GSM_PCHAN_TCH_H:
@@ -971,7 +975,7 @@ static int rsl_rx_meas_res(struct msgb *msg)
 	}
 	if (TLVP_PRESENT(&tp, RSL_IE_L3_INFO)) {
 		DEBUGPC(DMEAS, "L3\n");
-		msg->l3h = TLVP_VAL(&tp, RSL_IE_L3_INFO);
+		msg->l3h = (u_int8_t *) TLVP_VAL(&tp, RSL_IE_L3_INFO);
 		return gsm0408_rcvmsg(msg, 0);
 	} else
 		DEBUGPC(DMEAS, "\n");
@@ -1016,6 +1020,18 @@ static int abis_rsl_rx_dchan(struct msgb *msg)
 	case RSL_MT_MODE_MODIFY_NACK:
 		DEBUGPC(DRSL, "CHANNEL MODE MODIFY NACK\n");
 		break;
+	case RSL_MT_IPAC_PDCH_ACT_ACK:
+		DEBUGPC(DRSL, "IPAC PDCH ACT ACK\n");
+		break;
+	case RSL_MT_IPAC_PDCH_ACT_NACK:
+		DEBUGPC(DRSL, "IPAC PDCH ACT NACK\n");
+		break;
+	case RSL_MT_IPAC_PDCH_DEACT_ACK:
+		DEBUGPC(DRSL, "IPAC PDCH DEACT ACK\n");
+		break;
+	case RSL_MT_IPAC_PDCH_DEACT_NACK:
+		DEBUGPC(DRSL, "IPAC PDCH DEACT NACK\n");
+		break;
 	case RSL_MT_PHY_CONTEXT_CONF:
 	case RSL_MT_PREPROC_MEAS_RES:
 	case RSL_MT_TALKER_DET:
@@ -1414,6 +1430,24 @@ int rsl_ipacc_connect(struct gsm_lchan *lchan, u_int32_t ip, u_int16_t port,
 	return abis_rsl_sendmsg(msg);
 }
 
+int rsl_ipacc_pdch_activate(struct gsm_lchan *lchan)
+{
+	struct msgb *msg = rsl_msgb_alloc();
+	struct abis_rsl_dchan_hdr *dh;
+
+	dh = (struct abis_rsl_dchan_hdr *) msgb_put(msg, sizeof(*dh));
+	init_dchan_hdr(dh, RSL_MT_IPAC_PDCH_ACT);
+	dh->c.msg_discr = ABIS_RSL_MDISC_DED_CHAN;
+	dh->chan_nr = lchan2chan_nr(lchan);
+
+	DEBUGP(DRSL, "channel=%s chan_nr=0x%02x IPAC_PDCH_ACT\n",
+		gsm_ts_name(lchan->ts), dh->chan_nr);
+
+	msg->trx = lchan->ts->trx;
+
+	return abis_rsl_sendmsg(msg);
+}
+
 static int abis_rsl_rx_ipacc_bindack(struct msgb *msg)
 {
 	struct abis_rsl_dchan_hdr *dh = msgb_l2(msg);
diff --git a/openbsc/src/bsc_init.c b/openbsc/src/bsc_init.c
index 4010a7f31..1394dd89c 100644
--- a/openbsc/src/bsc_init.c
+++ b/openbsc/src/bsc_init.c
@@ -346,51 +346,84 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 	struct gsm_bts_trx *trx;
 	struct gsm_bts_trx_ts *ts;
 
-	/* This is currently only required on nanoBTS */
-
-	switch (evt) {
-	case EVT_STATECHG_OPER:
-		switch (obj_class) {
-		case NM_OC_SITE_MANAGER:
-			bts = container_of(obj, struct gsm_bts, site_mgr);
-			if (old_state->operational != 2 && new_state->operational == 2) {
-				abis_nm_opstart(bts, NM_OC_SITE_MANAGER, 0xff, 0xff, 0xff);
-			}
-			break;
-		case NM_OC_BTS:
-			bts = obj;
-			if (new_state->availability == NM_AVSTATE_DEPENDENCY) {
-				patch_nm_tables(bts);
-				abis_nm_set_bts_attr(bts, nanobts_attr_bts,
-							sizeof(nanobts_attr_bts));
-				abis_nm_opstart(bts, NM_OC_BTS,
-						bts->bts_nr, 0xff, 0xff);
-				abis_nm_chg_adm_state(bts, NM_OC_BTS,
-						      bts->bts_nr, 0xff, 0xff,
-						      NM_STATE_UNLOCKED);
-			}
-			break;
-		case NM_OC_CHANNEL:
-			ts = obj;
-			trx = ts->trx;
-			if (new_state->availability == NM_AVSTATE_DEPENDENCY) {
-				if (ts->nr == 0 && trx == trx->bts->c0)
-					abis_nm_set_channel_attr(ts, NM_CHANC_BCCHComb);
-				else
-					abis_nm_set_channel_attr(ts, NM_CHANC_TCHFull);
-				abis_nm_opstart(trx->bts, NM_OC_CHANNEL,
-						trx->bts->bts_nr, trx->nr, ts->nr);
-				abis_nm_chg_adm_state(trx->bts, NM_OC_CHANNEL,
-						      trx->bts->bts_nr, trx->nr, ts->nr,
-						      NM_STATE_UNLOCKED);
-			}
-			break;
-		default:
-			break;
+	/* This event-driven BTS setup is currently only required on nanoBTS */
+
+	/* EVT_STATECHG_ADM is called after we call chg_adm_state() and would create
+	 * endless loop */
+	if (evt != EVT_STATECHG_OPER)
+		return 0;
+
+	switch (obj_class) {
+	case NM_OC_SITE_MANAGER:
+		bts = container_of(obj, struct gsm_bts, site_mgr);
+		if (new_state->operational == 2 &&
+		    new_state->availability == NM_AVSTATE_OK)
+			abis_nm_opstart(bts, obj_class, 0xff, 0xff, 0xff);
+		break;
+	case NM_OC_BTS:
+		bts = obj;
+		if (new_state->availability == NM_AVSTATE_DEPENDENCY) {
+			patch_nm_tables(bts);
+			abis_nm_set_bts_attr(bts, nanobts_attr_bts,
+					     sizeof(nanobts_attr_bts));
+			abis_nm_chg_adm_state(bts, obj_class,
+					      bts->bts_nr, 0xff, 0xff,
+					      NM_STATE_UNLOCKED);
+			abis_nm_opstart(bts, obj_class,
+					bts->bts_nr, 0xff, 0xff);
+		}
+		break;
+	case NM_OC_CHANNEL:
+		ts = obj;
+		trx = ts->trx;
+		if (new_state->operational == 1 &&
+		    new_state->availability == NM_AVSTATE_DEPENDENCY) {
+			patch_nm_tables(bts);
+			enum abis_nm_chan_comb ccomb =
+						abis_nm_chcomb4pchan(ts->pchan);
+			abis_nm_set_channel_attr(ts, ccomb);
+			abis_nm_chg_adm_state(trx->bts, obj_class,
+					      trx->bts->bts_nr, trx->nr, ts->nr,
+					      NM_STATE_UNLOCKED);
+			abis_nm_opstart(trx->bts, obj_class,
+					trx->bts->bts_nr, trx->nr, ts->nr);
+		}
+		break;
+	case NM_OC_RADIO_CARRIER:
+		trx = obj;
+		if (new_state->operational == 1 &&
+		    new_state->availability == NM_AVSTATE_OFF_LINE) {
+			/* Patch ARFCN into radio attribute */
+			nanobts_attr_radio[5] &= 0xf0;
+			nanobts_attr_radio[5] |= trx->arfcn >> 8;
+			nanobts_attr_radio[6] = trx->arfcn & 0xff;
+			abis_nm_set_radio_attr(trx, nanobts_attr_radio,
+						sizeof(nanobts_attr_radio));
+			abis_nm_chg_adm_state(trx->bts, obj_class,
+					      trx->bts->bts_nr, trx->nr, 0xff,
+					      NM_STATE_UNLOCKED);
+			abis_nm_opstart(trx->bts, obj_class, trx->bts->bts_nr,
+					trx->nr, 0xff);
+		}
+		if (new_state->operational == 1 &&
+		    new_state->availability == NM_AVSTATE_OK)
+			abis_nm_opstart(trx->bts, obj_class, trx->bts->bts_nr,
+					trx->nr, 0xff);
+		break;
+	case NM_OC_BASEB_TRANSC:
+		trx = container_of(obj, struct gsm_bts_trx, bb_transc);
+		if (new_state->operational == 1 &&
+		    new_state->availability == NM_AVSTATE_DEPENDENCY) {
+			abis_nm_chg_adm_state(trx->bts, obj_class,
+					trx->bts->bts_nr, trx->nr, 0xff,
+					NM_STATE_UNLOCKED);
+			abis_nm_opstart(trx->bts, obj_class,
+					trx->bts->bts_nr, trx->nr, 0xff);
+			/* TRX software is active, tell it to initiate RSL Link */
+			abis_nm_ipaccess_rsl_connect(trx, 0, 3003, trx->rsl_tei);
 		}
 		break;
 	default:
-		//DEBUGP(DMM, "Unhandled state change in %s:%d\n", __func__, __LINE__);
 		break;
 	}
 	return 0;
@@ -403,29 +436,8 @@ static int sw_activ_rep(struct msgb *mb)
 	struct gsm_bts *bts = mb->trx->bts;
 	struct gsm_bts_trx *trx = gsm_bts_trx_num(bts, foh->obj_inst.trx_nr);
 
-	if (!trx)
-		return -ENODEV;
 
 	switch (foh->obj_class) {
-	case NM_OC_BASEB_TRANSC:
-		/* TRX software is active, tell it to initiate RSL Link */
-		abis_nm_ipaccess_rsl_connect(trx, 0, 3003, trx->rsl_tei);
-		abis_nm_opstart(trx->bts, NM_OC_BASEB_TRANSC,
-				trx->bts->bts_nr, trx->nr, 0xff);
-		abis_nm_chg_adm_state(trx->bts, NM_OC_BASEB_TRANSC,
-					trx->bts->bts_nr, trx->nr, 0xff,
-					NM_STATE_UNLOCKED);
-		break;
-	case NM_OC_RADIO_CARRIER:
-		patch_nm_tables(trx->bts);
-		abis_nm_set_radio_attr(trx, nanobts_attr_radio,
-					sizeof(nanobts_attr_radio));
-		abis_nm_opstart(trx->bts, NM_OC_RADIO_CARRIER,
-				trx->bts->bts_nr, trx->nr, 0xff);
-		abis_nm_chg_adm_state(trx->bts, NM_OC_RADIO_CARRIER,
-				      trx->bts->bts_nr, trx->nr, 0xff,
-				      NM_STATE_UNLOCKED);
-		break;
 	}
 	return 0;
 }
@@ -533,7 +545,7 @@ static void nm_reconfig_trx(struct gsm_bts_trx *trx)
 		case GSM_BAND_1900:
 			trx->nominal_power = 23;
 			break;
-		dedfault:
+		default:
 			fprintf(stderr, "Unsupported nanoBTS GSM band %s\n",
 				gsm_band_name(trx->bts->band));
 			break;
@@ -881,9 +893,6 @@ static void patch_nm_tables(struct gsm_bts *bts)
 	bs11_attr_radio[2] &= 0xf0;
 	bs11_attr_radio[2] |= arfcn_high;
 	bs11_attr_radio[3] = arfcn_low;
-	nanobts_attr_radio[5] &= 0xf0;
-	nanobts_attr_radio[5] |= arfcn_high;
-	nanobts_attr_radio[6] = arfcn_low;
 
 	/* patch BSIC */
 	bs11_attr_bts[1] = bts->bsic;
diff --git a/openbsc/src/db.c b/openbsc/src/db.c
index 270d4d90b..b86348c55 100644
--- a/openbsc/src/db.c
+++ b/openbsc/src/db.c
@@ -439,9 +439,11 @@ int db_sync_equipment(struct gsm_equipment *equip)
 {
 	dbi_result result;
 	unsigned char *cm2, *cm3;
+	u_int8_t classmark1;
 
+	memcpy(&classmark1, &equip->classmark1, sizeof(classmark1));
 	printf("DB: Sync Equipment IMEI=%s, classmark1=%02x",
-		equip->imei, equip->classmark1);
+		equip->imei, classmark1);
 	if (equip->classmark2_len)
  		printf(", classmark2=%s",
 			hexdump(equip->classmark2, equip->classmark2_len));
@@ -462,7 +464,7 @@ int db_sync_equipment(struct gsm_equipment *equip)
 			"classmark2 = %s, "
 			"classmark3 = %s "
 		"WHERE imei = '%s' ",
-		equip->classmark1, cm2, cm3, equip->imei);
+		classmark1, cm2, cm3, equip->imei);
 
 	free(cm2);
 	free(cm3);
@@ -853,7 +855,7 @@ int db_apdu_blob_store(struct gsm_subscriber *subscr,
 			u_int8_t *apdu)
 {
 	dbi_result result;
-	char *q_apdu;
+	unsigned char *q_apdu;
 
 	dbi_conn_quote_binary_copy(conn, apdu, len, &q_apdu);
 
diff --git a/openbsc/src/gsm_04_08.c b/openbsc/src/gsm_04_08.c
index 9467d79a6..cd883a3fa 100644
--- a/openbsc/src/gsm_04_08.c
+++ b/openbsc/src/gsm_04_08.c
@@ -1128,9 +1128,7 @@ int gsm48_tx_mm_info(struct gsm_lchan *lchan)
 	struct gsm48_hdr *gh;
 	struct gsm_network *net = lchan->ts->trx->bts->network;
 	u_int8_t *ptr8;
-	u_int16_t *ptr16;
 	int name_len, name_pad;
-	int i;
 #if 0
 	time_t cur_t;
 	struct tm* cur_time;
@@ -1458,7 +1456,7 @@ static int gsm0408_rcv_mm(struct msgb *msg)
 }
 
 /* Receive a PAGING RESPONSE message from the MS */
-static int gsm48_rr_rx_pag_resp(struct msgb *msg)
+static int gsm48_rx_rr_pag_resp(struct msgb *msg)
 {
 	struct gsm_bts *bts = msg->lchan->ts->trx->bts;
 	struct gsm48_hdr *gh = msgb_l3(msg);
@@ -1613,7 +1611,7 @@ static int gsm0408_rcv_rr(struct msgb *msg)
 		DEBUGP(DRR, "GRPS SUSPEND REQUEST\n");
 		break;
 	case GSM48_MT_RR_PAG_RESP:
-		rc = gsm48_rr_rx_pag_resp(msg);
+		rc = gsm48_rx_rr_pag_resp(msg);
 		break;
 	case GSM48_MT_RR_CHAN_MODE_MODIF_ACK:
 		DEBUGP(DRR, "CHANNEL MODE MODIFY ACK\n");
@@ -1645,7 +1643,7 @@ static int gsm0408_rcv_rr(struct msgb *msg)
 }
 
 int gsm48_send_rr_app_info(struct gsm_lchan *lchan, u_int8_t apdu_id,
-			   u_int8_t apdu_len, u_int8_t *apdu)
+			   u_int8_t apdu_len, const u_int8_t *apdu)
 {
 	struct msgb *msg = gsm48_msgb_alloc();
 	struct gsm48_hdr *gh;
diff --git a/openbsc/src/gsm_04_11.c b/openbsc/src/gsm_04_11.c
index 59020746f..6e59eafe4 100644
--- a/openbsc/src/gsm_04_11.c
+++ b/openbsc/src/gsm_04_11.c
@@ -674,7 +674,7 @@ static int gsm411_rx_rp_error(struct msgb *msg, struct gsm_trans *trans,
 	 * successfully receive the SMS.  We need to investigate
 	 * the cause and take action depending on it */
 
-	DEBUGP(DSMS, "RX SMS RP-ERROR, cause %d (%s)\n", cause,
+	DEBUGP(DSMS, "RX SMS RP-ERROR, cause %d:%d (%s)\n", cause_len, cause,
 		get_value_string(rp_cause_strs, cause));
 
 	if (!trans->sms.is_mt) {
@@ -1068,8 +1068,6 @@ static int subscr_sig_cb(unsigned int subsys, unsigned int signal,
 	struct gsm_lchan *lchan;
 	struct gsm_sms *sms;
 
-	u_int32_t token;
-
 	switch (signal) {
 	case S_SUBSCR_ATTACHED:
 		/* A subscriber has attached. Check if there are
diff --git a/openbsc/src/gsm_data.c b/openbsc/src/gsm_data.c
index 6767c3fd5..34642900b 100644
--- a/openbsc/src/gsm_data.c
+++ b/openbsc/src/gsm_data.c
@@ -45,6 +45,8 @@ static const char *pchan_names[] = {
 	[GSM_PCHAN_TCH_F]	= "TCH/F",
 	[GSM_PCHAN_TCH_H]	= "TCH/H",
 	[GSM_PCHAN_SDCCH8_SACCH8C] = "SDCCH8",
+	[GSM_PCHAN_PDCH]	= "PDCH",
+	[GSM_PCHAN_TCH_F_PDCH]	= "TCH/F_PDCH",
 	[GSM_PCHAN_UNKNOWN]	= "UNKNOWN",
 };
 
@@ -139,6 +141,7 @@ struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type,
 			      u_int8_t tsc, u_int8_t bsic)
 {
 	struct gsm_bts *bts = talloc(net, struct gsm_bts);
+	int i;
 
 	if (!bts)
 		return NULL;
@@ -153,6 +156,11 @@ struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type,
 	INIT_LLIST_HEAD(&bts->trx_list);
 	bts->ms_max_power = 15;	/* dBm */
 
+	for (i = 0; i < ARRAY_SIZE(bts->gprs.nsvc); i++) {
+		bts->gprs.nsvc[i].bts = bts;
+		bts->gprs.nsvc[i].id = i;
+	}
+
 	/* create our primary TRX */
 	bts->c0 = gsm_bts_trx_alloc(bts);
 	if (!bts->c0) {
diff --git a/openbsc/src/input/ipaccess.c b/openbsc/src/input/ipaccess.c
index 386d2374e..1265982d2 100644
--- a/openbsc/src/input/ipaccess.c
+++ b/openbsc/src/input/ipaccess.c
@@ -236,7 +236,6 @@ static int ipaccess_rcvmsg(struct e1inp_line *line, struct msgb *msg,
 			trx->rsl_link = e1inp_sign_link_create(e1i_ts,
 							E1INP_SIGN_RSL, trx,
 							trx->rsl_tei, 0);
-			e1inp_event(e1i_ts, EVT_E1_TEI_UP, trx->rsl_tei, 0);
 			/* get rid of our old temporary bfd */
 			memcpy(newbfd, bfd, sizeof(*newbfd));
 			bsc_unregister_fd(bfd);
@@ -250,6 +249,7 @@ static int ipaccess_rcvmsg(struct e1inp_line *line, struct msgb *msg,
 
 /* FIXME: this is per BTS */
 static int oml_up = 0;
+static int rsl_up = 0;
 
 /*
  * read one ipa message from the socket
@@ -347,6 +347,10 @@ static int handle_ts1_read(struct bsc_fd *bfd)
 
 	switch (link->type) {
 	case E1INP_SIGN_RSL:
+		if (!rsl_up) {
+			e1inp_event(e1i_ts, EVT_E1_TEI_UP, link->tei, link->sapi);
+			rsl_up = 1;
+		}
 		ret = abis_rsl_rcvmsg(msg);
 		break;
 	case E1INP_SIGN_OML:
diff --git a/openbsc/src/msgb.c b/openbsc/src/msgb.c
index 52edf2dcd..edeb975a9 100644
--- a/openbsc/src/msgb.c
+++ b/openbsc/src/msgb.c
@@ -74,6 +74,26 @@ struct msgb *msgb_dequeue(struct llist_head *queue)
 	return llist_entry(lh, struct msgb, list);
 }
 
+void msgb_reset(struct msgb *msg)
+{
+	msg->len = 0;
+	msg->len = 0;
+	msg->data = msg->_data;
+
+	msg->head = msg->data;
+	msg->data = msg->data;
+	/* reset tail pointer */
+	msg->tail = msg->data;
+
+	/* reset pointers */
+	msg->bts_link = NULL;
+	msg->trx = NULL;
+	msg->lchan = NULL;
+	msg->l2h = NULL;
+	msg->l3h = NULL;
+	msg->smsh = NULL;
+}
+
 static __attribute__((constructor)) void on_dso_load_trau_msgb(void)
 {
 	tall_msgb_ctx = talloc_named_const(tall_bsc_ctx, 1, "msgb");
diff --git a/openbsc/src/rrlp.c b/openbsc/src/rrlp.c
index 61bb20244..523b53f0b 100644
--- a/openbsc/src/rrlp.c
+++ b/openbsc/src/rrlp.c
@@ -26,6 +26,7 @@
 #include <openbsc/gsm_04_08.h>
 #include <openbsc/signal.h>
 #include <openbsc/gsm_subscriber.h>
+#include <openbsc/chan_alloc.h>
 
 /* RRLP MS based position request */
 static const u_int8_t ms_based_pos_req[] = { 0x40, 0x01, 0x78, 0xa8 };
diff --git a/openbsc/src/timer.c b/openbsc/src/timer.c
index 6f974a2c3..ffeb4aba3 100644
--- a/openbsc/src/timer.c
+++ b/openbsc/src/timer.c
@@ -176,7 +176,7 @@ restart:
 int bsc_timer_check(void)
 {
 	struct timer_list *timer;
-	int i;
+	int i = 0;
 
 	llist_for_each_entry(timer, &timer_list, entry) {
 		i++;
diff --git a/openbsc/src/tlv_parser.c b/openbsc/src/tlv_parser.c
index e835f951f..8321b880e 100644
--- a/openbsc/src/tlv_parser.c
+++ b/openbsc/src/tlv_parser.c
@@ -1,5 +1,8 @@
 #include <stdio.h>
 #include <openbsc/tlv.h>
+#include <openbsc/gsm_data.h>
+
+struct tlv_definition tvlv_att_def;
 
 int tlv_dump(struct tlv_parsed *dec)
 {
@@ -87,6 +90,20 @@ int tlv_parse(struct tlv_parsed *dec, const struct tlv_definition *def,
 				return -2;
 			num_parsed++;
 			break;
+		case TLV_TYPE_TvLV:
+			if (*(pos+1) & 0x80) {
+				/* like TLV, but without highest bit of len */
+				if (pos + 1 > buf + buf_len)
+					return -1;
+				dec->lv[tag].val = pos+2;
+				dec->lv[tag].len = *(pos+1) & 0x7f;
+				len = dec->lv[tag].len + 2;
+				if (pos + len > buf + buf_len)
+					return -2;
+				num_parsed++;
+				break;
+			}
+			/* like TL16V, fallthrough */
 		case TLV_TYPE_TL16V:
 			if (pos + 2 > buf + buf_len)
 				return -1;
@@ -103,3 +120,9 @@ int tlv_parse(struct tlv_parsed *dec, const struct tlv_definition *def,
 	return num_parsed;
 }
 
+static __attribute__((constructor)) void on_dso_load_tlv(void)
+{
+	int i;
+	for (i = 0; i < ARRAY_SIZE(tvlv_att_def.def); i++)
+		tvlv_att_def.def[i].type = TLV_TYPE_TvLV;
+}
diff --git a/openbsc/src/token_auth.c b/openbsc/src/token_auth.c
index 695b55243..0931007ef 100644
--- a/openbsc/src/token_auth.c
+++ b/openbsc/src/token_auth.c
@@ -33,6 +33,9 @@
 #define TOKEN_SMS_TEXT "HAR 2009 GSM.  Register at http://har2009.gnumonks.org/ " \
 			"Your IMSI is %s, auth token is %08X, phone no is %s."
 
+extern struct gsm_sms *sms_from_text(struct gsm_subscriber *receiver,
+				     const char *text);
+
 static char *build_sms_string(struct gsm_subscriber *subscr, u_int32_t token)
 {
 	char *sms_str;
diff --git a/openbsc/src/transaction.c b/openbsc/src/transaction.c
index 950faa2f1..04eaa3c99 100644
--- a/openbsc/src/transaction.c
+++ b/openbsc/src/transaction.c
@@ -86,8 +86,6 @@ struct gsm_trans *trans_alloc(struct gsm_subscriber *subscr,
 
 void trans_free(struct gsm_trans *trans)
 {
-	struct gsm_bts *bts;
-
 	switch (trans->protocol) {
 	case GSM48_PDISC_CC:
 		_gsm48_cc_trans_free(trans);