Merge libosmocore commit '972b502ecaf3b919b7e89c13257dd6ec97aaafb7' into master

this updates libosmocore to the current libosmocore.git master, mainly to import
the msgb_get() / msgb_pull() fixes.

51 files changed, 5015 insertions, 135 deletions

diff --git a/src/shared/libosmocore/src/Makefile.am b/src/shared/libosmocore/src/Makefile.am
index 079d0b4c..d719df7c 100644
--- a/src/shared/libosmocore/src/Makefile.am
+++ b/src/shared/libosmocore/src/Makefile.am
@@ -1,11 +1,9 @@
-SUBDIRS=. vty codec gsm
-
 # This is _NOT_ the library release version, it's an API version.
 # Please read Chapter 6 "Library interface versions" of the libtool documentation before making any modification
 LIBVERSION=4:0:0
 
 INCLUDES = $(all_includes) -I$(top_srcdir)/include -I$(top_builddir)/include
-AM_CFLAGS = -fPIC -Wall
+AM_CFLAGS = -Wall
 
 lib_LTLIBRARIES = libosmocore.la
 
@@ -17,6 +15,8 @@ libosmocore_la_SOURCES = timer.c select.c signal.c msgb.c bits.c \
 			 conv.c application.c rbtree.c \
 			 crc8gen.c crc16gen.c crc32gen.c crc64gen.c
 
+BUILT_SOURCES = crc8gen.c crc16gen.c crc32gen.c crc64gen.c
+
 if ENABLE_PLUGIN
 libosmocore_la_SOURCES += plugin.c
 libosmocore_la_LDFLAGS = -version-info $(LIBVERSION) $(LIBRARY_DL)
@@ -39,5 +39,4 @@ libosmocore_la_SOURCES += serial.c
 endif
 
 crc%gen.c: crcXXgen.c.tpl
-	@echo "  SED    $< -> $@"
-	@sed -e's/XX/$*/g' $< > $@
+	$(AM_V_GEN)sed -e's/XX/$*/g' $< > $@
diff --git a/src/shared/libosmocore/src/backtrace.c b/src/shared/libosmocore/src/backtrace.c
index 023671c2..4ca7adb8 100644
--- a/src/shared/libosmocore/src/backtrace.c
+++ b/src/shared/libosmocore/src/backtrace.c
@@ -1,8 +1,6 @@
 /*
- * (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
  * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
- * (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
- * (C) 2010 by Nico Golde <nico@ngolde.de>
+ * (C) 2012 by Harald Welte <laforge@gnumonks.org>
  *
  * All Rights Reserved
  *
@@ -29,36 +27,64 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <osmocom/core/utils.h>
+#include <osmocom/core/logging.h>
 #include "config.h"
 
 #ifdef HAVE_EXECINFO_H
 #include <execinfo.h>
 
-/*! \brief Generate and print a call back-trace
- *
- * This function will generate a function call back-trace of the
- * current process and print it to stdout
- */
-void osmo_generate_backtrace(void)
+static void _osmo_backtrace(int use_printf, int subsys, int level)
 {
 	int i, nptrs;
 	void *buffer[100];
 	char **strings;
 
 	nptrs = backtrace(buffer, ARRAY_SIZE(buffer));
-	printf("backtrace() returned %d addresses\n", nptrs);
+	if (use_printf)
+		printf("backtrace() returned %d addresses\n", nptrs);
+	else
+		LOGP(subsys, level, "backtrace() returned %d addresses\n",
+		     nptrs);
 
 	strings = backtrace_symbols(buffer, nptrs);
 	if (!strings)
 		return;
 
-	for (i = 1; i < nptrs; i++)
-		printf("%s\n", strings[i]);
+	for (i = 1; i < nptrs; i++) {
+		if (use_printf)
+			printf("%s\n", strings[i]);
+		else
+			LOGP(subsys, level, "\t%s\n", strings[i]);
+	}
 
 	free(strings);
 }
+
+/*! \brief Generate and print a call back-trace
+ *
+ * This function will generate a function call back-trace of the
+ * current process and print it to stdout. */
+void osmo_generate_backtrace(void)
+{
+	_osmo_backtrace(1, 0, 0);
+}
+
+/*! \brief Generate and log a call back-trace
+ *
+ * This function will generate a function call back-trace of the
+ * current process and log it to the specified subsystem and
+ * level using the libosmocore logging subsystem */
+void osmo_log_backtrace(int subsys, int level)
+{
+	_osmo_backtrace(0, subsys, level);
+}
 #else
 void osmo_generate_backtrace(void)
 {
+	fprintf(stderr, "This platform has no backtrace function\n");
+}
+void osmo_log_backtrace(int subsys, int level)
+{
+	LOGP(subsys, level, "This platform has no backtrace function\n");
 }
 #endif
diff --git a/src/shared/libosmocore/src/bits.c b/src/shared/libosmocore/src/bits.c
index 9eb2d690..4c67bddb 100644
--- a/src/shared/libosmocore/src/bits.c
+++ b/src/shared/libosmocore/src/bits.c
@@ -185,4 +185,4 @@ void osmo_revbytebits_buf(uint8_t *buf, int len)
 	}
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/bitvec.c b/src/shared/libosmocore/src/bitvec.c
index 8a086b81..714c11b7 100644
--- a/src/shared/libosmocore/src/bitvec.c
+++ b/src/shared/libosmocore/src/bitvec.c
@@ -261,4 +261,4 @@ int bitvec_find_bit_pos(const struct bitvec *bv, unsigned int n,
 	return -1;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/codec/Makefile.am b/src/shared/libosmocore/src/codec/Makefile.am
index 5a54c42d..665768c6 100644
--- a/src/shared/libosmocore/src/codec/Makefile.am
+++ b/src/shared/libosmocore/src/codec/Makefile.am
@@ -3,9 +3,9 @@
 LIBVERSION=0:0:0
 
 INCLUDES = $(all_includes) -I$(top_srcdir)/include
-AM_CFLAGS = -fPIC -Wall
+AM_CFLAGS = -Wall
 
 lib_LTLIBRARIES = libosmocodec.la
 
 libosmocodec_la_SOURCES = gsm610.c gsm620.c gsm660.c gsm690.c
-libosmocodec_la_LDFALGS = -version-info $(LIBVERSION)
+libosmocodec_la_LDFLAGS = -version-info $(LIBVERSION)
diff --git a/src/shared/libosmocore/src/codec/gsm610.c b/src/shared/libosmocore/src/codec/gsm610.c
index 09fbeb5a..35f6011d 100644
--- a/src/shared/libosmocore/src/codec/gsm610.c
+++ b/src/shared/libosmocore/src/codec/gsm610.c
@@ -30,7 +30,7 @@
 	 * It converts between serial parameter output by the encoder and the
 	 * order needed before channel encoding.
 	 */
-uint16_t gsm610_bitorder[260] = {
+const uint16_t gsm610_bitorder[260] = {
 	0,	/* LARc0:5 */
 	47,	/* Xmaxc0:5 */
 	103,	/* Xmaxc1:5 */
diff --git a/src/shared/libosmocore/src/codec/gsm620.c b/src/shared/libosmocore/src/codec/gsm620.c
index 09aca502..fa570e4f 100644
--- a/src/shared/libosmocore/src/codec/gsm620.c
+++ b/src/shared/libosmocore/src/codec/gsm620.c
@@ -27,7 +27,7 @@
 	/* This array encode mapping between GSM 05.03 Table 3a (bits
 	 * ordering before channel coding on TCH) and GSM 06.20 Table B.1
 	 * (bit ordering on A-bis */
-uint16_t gsm620_unvoiced_bitorder[112] = {
+const uint16_t gsm620_unvoiced_bitorder[112] = {
 	3,	/* R0:1 */
 	25,	/* LPC 3:7 */
 	52,	/* GSP 0-1:2 */
@@ -146,7 +146,7 @@ uint16_t gsm620_unvoiced_bitorder[112] = {
 	/* This array encode mapping between GSM 05.03 Table 3b (bits
 	 * ordering before channel coding on TCH) and GSM 06.20 Table B.2
 	 * (bit ordering on A-bis */
-uint16_t gsm620_voiced_bitorder[112] = {
+const uint16_t gsm620_voiced_bitorder[112] = {
 	13,	/* LPC 1:2 */
 	14,	/* LPC 1:1 */
 	20,	/* LPC 2:4 */
diff --git a/src/shared/libosmocore/src/codec/gsm660.c b/src/shared/libosmocore/src/codec/gsm660.c
index 4fff5ffc..c044a2ab 100644
--- a/src/shared/libosmocore/src/codec/gsm660.c
+++ b/src/shared/libosmocore/src/codec/gsm660.c
@@ -32,7 +32,7 @@
 	 * applied prior to this table, as in GSM 05.03 3.1.1, to get 260
 	 * bits from a 244 bits raw EFR frame.
 	 */
-uint16_t gsm660_bitorder[260] = {
+const uint16_t gsm660_bitorder[260] = {
 	 38,  39,  40,  41,  42,  43,		/*   0 -> LTP-LAG 1: b8..b3 */
 	145, 146, 147, 148, 149, 150,		/*   6 -> LTP-LAG 3: b8..b3 */
 	 93,  94,				/*  12 -> LTP-LAG 2: b5..b4 */
diff --git a/src/shared/libosmocore/src/codec/gsm690.c b/src/shared/libosmocore/src/codec/gsm690.c
index e5b9bd49..fdf3302f 100644
--- a/src/shared/libosmocore/src/codec/gsm690.c
+++ b/src/shared/libosmocore/src/codec/gsm690.c
@@ -33,7 +33,7 @@
 	/* This array encodes GSM 05.03 Table 7
 	 * It's also TS 26.101 Table B.8
 	 */
-uint16_t gsm690_12_2_bitorder[244] = {
+const uint16_t gsm690_12_2_bitorder[244] = {
 	  0,   1,   2,   3,   4,   5,   6,   7,   8,   9,
 	 10,  11,  12,  13,  14,  23,  15,  16,  17,  18,
 	 19,  20,  21,  22,  24,  25,  26,  27,  28,  38,
@@ -65,7 +65,7 @@ uint16_t gsm690_12_2_bitorder[244] = {
 	/* This array encodes GSM 05.03 Table 8
 	 * It's also TS 26.101 Table B.7
 	 */
-uint16_t gsm690_10_2_bitorder[204] = {
+const uint16_t gsm690_10_2_bitorder[204] = {
 	  7,   6,   5,   4,   3,   2,   1,   0,  16,  15,
 	 14,  13,  12,  11,  10,   9,   8,  26,  27,  28,
 	 29,  30,  31, 115, 116, 117, 118, 119, 120,  72,
@@ -93,7 +93,7 @@ uint16_t gsm690_10_2_bitorder[204] = {
 	/* This array encodes GSM 05.03 Table 9
 	 * It's also TS 26.101 Table B.6
 	 */
-uint16_t gsm690_7_95_bitorder[159] = {
+const uint16_t gsm690_7_95_bitorder[159] = {
 	  8,   7,   6,   5,   4,   3,   2,  14,  16,   9,
 	 10,  12,  13,  15,  11,  17,  20,  22,  24,  23,
 	 19,  18,  21,  56,  88, 122, 154,  57,  89, 123,
@@ -116,7 +116,7 @@ uint16_t gsm690_7_95_bitorder[159] = {
 	/* This array encodes GSM 05.03 Table 10
 	 * It's also TS 26.101 Table B.5
 	 */
-uint16_t gsm690_7_4_bitorder[148] = {
+const uint16_t gsm690_7_4_bitorder[148] = {
 	  0,   1,   2,   3,   4,   5,   6,   7,   8,   9,
 	 10,  11,  12,  13,  14,  15,  16,  26,  87,  27,
 	 88,  28,  89,  29,  90,  30,  91,  51,  80, 112,
@@ -138,7 +138,7 @@ uint16_t gsm690_7_4_bitorder[148] = {
 	/* This array encodes GSM 05.03 Table 11
 	 * It's also TS 26.101 Table B.4
 	 */
-uint16_t gsm690_6_7_bitorder[134] = {
+const uint16_t gsm690_6_7_bitorder[134] = {
 	  0,   1,   4,   3,   5,   6,  13,   7,   2,   8,
 	  9,  11,  15,  12,  14,  10,  28,  82,  29,  83,
 	 27,  81,  26,  80,  30,  84,  16,  55, 109,  56,
@@ -159,7 +159,7 @@ uint16_t gsm690_6_7_bitorder[134] = {
 	/* This array encodes GSM 05.03 Table 12
 	 * It's also TS 26.101 Table B.3
 	 */
-uint16_t gsm690_5_9_bitorder[118] = {
+const uint16_t gsm690_5_9_bitorder[118] = {
 	  0,   1,   4,   5,   3,   6,   7,   2,  13,  15,
 	  8,   9,  11,  12,  14,  10,  16,  28,  74,  29,
 	 75,  27,  73,  26,  72,  30,  76,  51,  97,  50,
@@ -178,7 +178,7 @@ uint16_t gsm690_5_9_bitorder[118] = {
 	/* This array encodes GSM 05.03 Table 13
 	 * It's also TS 26.101 Table B.2
 	 */
-uint16_t gsm690_5_15_bitorder[103] = {
+const uint16_t gsm690_5_15_bitorder[103] = {
 	  7,   6,   5,   4,   3,   2,   1,   0,  15,  14,
 	 13,  12,  11,  10,   9,   8,  23,  24,  25,  26,
 	 27,  46,  65,  84,  45,  44,  43,  64,  63,  62,
@@ -196,7 +196,7 @@ uint16_t gsm690_5_15_bitorder[103] = {
 	/* This array encodes GSM 05.03 Table 14
 	 * It's also TS 26.101 Table B.1
 	 */
-uint16_t gsm690_4_75_bitorder[95] = {
+const uint16_t gsm690_4_75_bitorder[95] = {
 	  0,   1,   2,   3,   4,   5,   6,   7,   8,   9,
 	 10,  11,  12,  13,  14,  15,  23,  24,  25,  26,
 	 27,  28,  48,  49,  61,  62,  82,  83,  47,  46,
diff --git a/src/shared/libosmocore/src/conv.c b/src/shared/libosmocore/src/conv.c
index ac39e29f..ebc3eda7 100644
--- a/src/shared/libosmocore/src/conv.c
+++ b/src/shared/libosmocore/src/conv.c
@@ -628,4 +628,4 @@ osmo_conv_decode(const struct osmo_conv_code *code,
 	return rv;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/crcXXgen.c.tpl b/src/shared/libosmocore/src/crcXXgen.c.tpl
index 5d70753a..80bf1e2a 100644
--- a/src/shared/libosmocore/src/crcXXgen.c.tpl
+++ b/src/shared/libosmocore/src/crcXXgen.c.tpl
@@ -115,6 +115,6 @@ osmo_crcXXgen_set_bits(const struct osmo_crcXXgen_code *code,
 		crc_bits[i] = ((crc >> (code->bits-i-1)) & 1);
 }
 
-/*! }@ */
+/*! @} */
 
 /* vim: set syntax=c: */
diff --git a/src/shared/libosmocore/src/gb/Makefile.am b/src/shared/libosmocore/src/gb/Makefile.am
new file mode 100644
index 00000000..71d47364
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/Makefile.am
@@ -0,0 +1,24 @@
+# This is _NOT_ the library release version, it's an API version.
+# Please read Chapter 6 "Library interface versions" of the libtool documentation before making any modification
+LIBVERSION=2:0:0
+
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS = -Wall ${GCC_FVISIBILITY_HIDDEN} -fno-strict-aliasing
+
+# FIXME: this should eventually go into a milenage/Makefile.am
+noinst_HEADERS = common_vty.h
+
+lib_LTLIBRARIES = libosmogb.la
+
+libosmogb_la_LDFLAGS = -Wl,--version-script=$(srcdir)/libosmogb.map -version-info $(LIBVERSION)
+libosmogb_la_LIBADD = \
+		$(top_builddir)/src/libosmocore.la \
+		$(top_builddir)/src/vty/libosmovty.la \
+		$(top_builddir)/src/gsm/libosmogsm.la
+
+libosmogb_la_SOURCES = gprs_ns.c gprs_ns_frgre.c gprs_ns_vty.c \
+		  gprs_bssgp.c gprs_bssgp_util.c gprs_bssgp_vty.c \
+		  gprs_bssgp_bss.c common_vty.c
+
+EXTRA_DIST = libosmogb.map
+
diff --git a/src/shared/libosmocore/src/gb/common_vty.c b/src/shared/libosmocore/src/gb/common_vty.c
new file mode 100644
index 00000000..0bd0b6c3
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/common_vty.c
@@ -0,0 +1,90 @@
+/* OpenBSC VTY common helpers */
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2009-2010 by Holger Hans Peter Freyther
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/logging.h>
+
+#include <osmocom/vty/telnet_interface.h>
+#include <osmocom/vty/command.h>
+#include <osmocom/vty/buffer.h>
+#include <osmocom/vty/vty.h>
+
+#include <osmocom/gprs/gprs_msgb.h>
+
+#include "common_vty.h"
+
+/* Down vty node level. */
+gDEFUN(libgb_exit,
+       libgb_exit_cmd, "exit", "Exit current mode and down to previous mode\n")
+{
+	switch (vty->node) {
+	case L_NS_NODE:
+	case L_BSSGP_NODE:
+		vty->node = CONFIG_NODE;
+		vty->index = NULL;
+		break;
+	default:
+		break;
+	}
+	return CMD_SUCCESS;
+}
+
+/* End of configuration. */
+gDEFUN(libgb_end,
+       libgb_end_cmd, "end", "End current mode and change to enable mode.")
+{
+	switch (vty->node) {
+	case L_NS_NODE:
+	case L_BSSGP_NODE:
+		vty_config_unlock(vty);
+		vty->node = ENABLE_NODE;
+		vty->index = NULL;
+		vty->index_sub = NULL;
+		break;
+	default:
+		break;
+	}
+	return CMD_SUCCESS;
+}
+
+int gprs_log_filter_fn(const struct log_context *ctx,
+			struct log_target *tar)
+{
+	const struct gprs_nsvc *nsvc = ctx->ctx[GPRS_CTX_NSVC];
+	const struct gprs_bvc *bvc = ctx->ctx[GPRS_CTX_BVC];
+
+	/* Filter on the NS Virtual Connection */
+	if ((tar->filter_map & (1 << FLT_NSVC)) != 0
+	    && nsvc && (nsvc == tar->filter_data[FLT_NSVC]))
+		return 1;
+
+	/* Filter on the NS Virtual Connection */
+	if ((tar->filter_map & (1 << FLT_BVC)) != 0
+	    && bvc && (bvc == tar->filter_data[FLT_BVC]))
+		return 1;
+
+	return 0;
+}
+
+
+int DNS, DBSSGP;
diff --git a/src/shared/libosmocore/src/gb/common_vty.h b/src/shared/libosmocore/src/gb/common_vty.h
new file mode 100644
index 00000000..d8d00407
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/common_vty.h
@@ -0,0 +1,14 @@
+#include <osmocom/vty/command.h>
+#include <osmocom/core/logging.h>
+
+extern int DNS, DBSSGP;
+
+enum log_filter {
+	_FLT_ALL = LOG_FILTER_ALL,	/* libosmocore */
+	FLT_NSVC = 1,
+	FLT_BVC  = 2,
+};
+
+extern struct cmd_element libgb_exit_cmd;
+extern struct cmd_element libgb_end_cmd;
+
diff --git a/src/shared/libosmocore/src/gb/gprs_bssgp.c b/src/shared/libosmocore/src/gb/gprs_bssgp.c
new file mode 100644
index 00000000..e41c7efb
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_bssgp.c
@@ -0,0 +1,1159 @@
+/* GPRS BSSGP protocol implementation as per 3GPP TS 08.18 */
+
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * TODO:
+ *  o  properly count incoming BVC-RESET packets in counter group
+ *  o  set log context as early as possible for outgoing packets
+ */
+
+#include <errno.h>
+#include <stdint.h>
+
+#include <netinet/in.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/rate_ctr.h>
+
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+#include "common_vty.h"
+
+void *bssgp_tall_ctx = NULL;
+
+static const struct rate_ctr_desc bssgp_ctr_description[] = {
+	{ "packets.in",	"Packets at BSSGP Level ( In)" },
+	{ "packets.out","Packets at BSSGP Level (Out)" },
+	{ "bytes.in",	"Bytes at BSSGP Level   ( In)" },
+	{ "bytes.out",	"Bytes at BSSGP Level   (Out)" },
+	{ "blocked",	"BVC Blocking count" },
+	{ "discarded",	"BVC LLC Discarded count" },
+};
+
+static const struct rate_ctr_group_desc bssgp_ctrg_desc = {
+	.group_name_prefix = "bssgp.bss_ctx",
+	.group_description = "BSSGP Peer Statistics",
+	.num_ctr = ARRAY_SIZE(bssgp_ctr_description),
+	.ctr_desc = bssgp_ctr_description,
+};
+
+LLIST_HEAD(bssgp_bvc_ctxts);
+
+static int _bssgp_tx_dl_ud(struct bssgp_flow_control *fc, struct msgb *msg,
+			   uint32_t llc_pdu_len, void *priv);
+
+/* Find a BTS Context based on parsed RA ID and Cell ID */
+struct bssgp_bvc_ctx *btsctx_by_raid_cid(const struct gprs_ra_id *raid, uint16_t cid)
+{
+	struct bssgp_bvc_ctx *bctx;
+
+	llist_for_each_entry(bctx, &bssgp_bvc_ctxts, list) {
+		if (!memcmp(&bctx->ra_id, raid, sizeof(bctx->ra_id)) &&
+		    bctx->cell_id == cid)
+			return bctx;
+	}
+	return NULL;
+}
+
+/* Find a BTS context based on BVCI+NSEI tuple */
+struct bssgp_bvc_ctx *btsctx_by_bvci_nsei(uint16_t bvci, uint16_t nsei)
+{
+	struct bssgp_bvc_ctx *bctx;
+
+	llist_for_each_entry(bctx, &bssgp_bvc_ctxts, list) {
+		if (bctx->nsei == nsei && bctx->bvci == bvci)
+			return bctx;
+	}
+	return NULL;
+}
+
+struct bssgp_bvc_ctx *btsctx_alloc(uint16_t bvci, uint16_t nsei)
+{
+	struct bssgp_bvc_ctx *ctx;
+
+	ctx = talloc_zero(bssgp_tall_ctx, struct bssgp_bvc_ctx);
+	if (!ctx)
+		return NULL;
+	ctx->bvci = bvci;
+	ctx->nsei = nsei;
+	/* FIXME: BVCI is not unique, only BVCI+NSEI ?!? */
+	ctx->ctrg = rate_ctr_group_alloc(ctx, &bssgp_ctrg_desc, bvci);
+	ctx->fc = talloc_zero(ctx, struct bssgp_flow_control);
+	/* cofigure for 2Mbit, 30 packets in queue */
+	bssgp_fc_init(ctx->fc, 100000, 2*1024*1024/8, 30, &_bssgp_tx_dl_ud);
+
+	llist_add(&ctx->list, &bssgp_bvc_ctxts);
+
+	return ctx;
+}
+
+/* Chapter 10.4.5: Flow Control BVC ACK */
+static int bssgp_tx_fc_bvc_ack(uint16_t nsei, uint8_t tag, uint16_t ns_bvci)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = ns_bvci;
+
+	bgph->pdu_type = BSSGP_PDUT_FLOW_CONTROL_BVC_ACK;
+	msgb_tvlv_put(msg, BSSGP_IE_TAG, 1, &tag);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* 10.3.7 SUSPEND-ACK PDU */
+int bssgp_tx_suspend_ack(uint16_t nsei, uint32_t tlli,
+			 const struct gprs_ra_id *ra_id, uint8_t suspend_ref)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint32_t _tlli;
+	uint8_t ra[6];
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_SUSPEND_ACK;
+
+	_tlli = htonl(tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+	msgb_tvlv_put(msg, BSSGP_IE_SUSPEND_REF_NR, 1, &suspend_ref);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* 10.3.8 SUSPEND-NACK PDU */
+int bssgp_tx_suspend_nack(uint16_t nsei, uint32_t tlli,
+			  const struct gprs_ra_id *ra_id,
+			  uint8_t *cause)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint32_t _tlli;
+	uint8_t ra[6];
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_SUSPEND_NACK;
+
+	_tlli = htonl(tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+	if (cause)
+		msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, cause);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* 10.3.10 RESUME-ACK PDU */
+int bssgp_tx_resume_ack(uint16_t nsei, uint32_t tlli,
+			const struct gprs_ra_id *ra_id)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint32_t _tlli;
+	uint8_t ra[6];
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_RESUME_ACK;
+
+	_tlli = htonl(tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* 10.3.11 RESUME-NACK PDU */
+int bssgp_tx_resume_nack(uint16_t nsei, uint32_t tlli,
+			 const struct gprs_ra_id *ra_id, uint8_t *cause)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint32_t _tlli;
+	uint8_t ra[6];
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_SUSPEND_NACK;
+
+	_tlli = htonl(tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+	if (cause)
+		msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, cause);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+uint16_t bssgp_parse_cell_id(struct gprs_ra_id *raid, const uint8_t *buf)
+{
+	/* 6 octets RAC */
+	gsm48_parse_ra(raid, buf);
+	/* 2 octets CID */
+	return ntohs(*(uint16_t *) (buf+6));
+}
+
+int bssgp_create_cell_id(uint8_t *buf, const struct gprs_ra_id *raid,
+			 uint16_t cid)
+{
+	uint16_t *out_cid = (uint16_t *) (buf + 6);
+	/* 6 octets RAC */
+	gsm48_construct_ra(buf, raid);
+	/* 2 octets CID */
+	*out_cid = htons(cid);
+
+	return 8;
+}
+
+/* Chapter 8.4 BVC-Reset Procedure */
+static int bssgp_rx_bvc_reset(struct msgb *msg, struct tlv_parsed *tp,	
+			      uint16_t ns_bvci)
+{
+	struct osmo_bssgp_prim nmp;
+	struct bssgp_bvc_ctx *bctx;
+	uint16_t nsei = msgb_nsei(msg);
+	uint16_t bvci;
+
+	bvci = ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BVCI));
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx RESET cause=%s\n", bvci,
+		bssgp_cause_str(*TLVP_VAL(tp, BSSGP_IE_CAUSE)));
+
+	/* look-up or create the BTS context for this BVC */
+	bctx = btsctx_by_bvci_nsei(bvci, nsei);
+	if (!bctx)
+		bctx = btsctx_alloc(bvci, nsei);
+
+	/* As opposed to NS-VCs, BVCs are NOT blocked after RESET */
+	bctx->state &= ~BVC_S_BLOCKED;
+
+	/* When we receive a BVC-RESET PDU (at least of a PTP BVCI), the BSS
+	 * informs us about its RAC + Cell ID, so we can create a mapping */
+	if (bvci != 0 && bvci != 1) {
+		if (!TLVP_PRESENT(tp, BSSGP_IE_CELL_ID)) {
+			LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx RESET "
+				"missing mandatory IE\n", bvci);
+			return -EINVAL;
+		}
+		/* actually extract RAC / CID */
+		bctx->cell_id = bssgp_parse_cell_id(&bctx->ra_id,
+						TLVP_VAL(tp, BSSGP_IE_CELL_ID));
+		LOGP(DBSSGP, LOGL_NOTICE, "Cell %u-%u-%u-%u CI %u on BVCI %u\n",
+			bctx->ra_id.mcc, bctx->ra_id.mnc, bctx->ra_id.lac,
+			bctx->ra_id.rac, bctx->cell_id, bvci);
+	}
+
+	/* Send NM_BVC_RESET.ind to NM */
+	memset(&nmp, 0, sizeof(nmp));
+	nmp.nsei = nsei;
+	nmp.bvci = bvci;
+	nmp.tp = tp;
+	nmp.ra_id = &bctx->ra_id;
+	osmo_prim_init(&nmp.oph, SAP_BSSGP_NM, PRIM_NM_BVC_RESET,
+			PRIM_OP_INDICATION, msg);
+	bssgp_prim_cb(&nmp.oph, NULL);
+
+	/* Acknowledge the RESET to the BTS */
+	bssgp_tx_simple_bvci(BSSGP_PDUT_BVC_RESET_ACK,
+			     nsei, bvci, ns_bvci);
+	return 0;
+}
+
+static int bssgp_rx_bvc_block(struct msgb *msg, struct tlv_parsed *tp)
+{
+	struct osmo_bssgp_prim nmp;
+	uint16_t bvci;
+	struct bssgp_bvc_ctx *ptp_ctx;
+
+	bvci = ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BVCI));
+	if (bvci == BVCI_SIGNALLING) {
+		/* 8.3.2: Signalling BVC shall never be blocked */
+		LOGP(DBSSGP, LOGL_ERROR, "NSEI=%u/BVCI=%u "
+			"received block for signalling BVC!?!\n",
+			msgb_nsei(msg), msgb_bvci(msg));
+		return 0;
+	}
+
+	LOGP(DBSSGP, LOGL_INFO, "BSSGP Rx BVCI=%u BVC-BLOCK\n", bvci);
+
+	ptp_ctx = btsctx_by_bvci_nsei(bvci, msgb_nsei(msg));
+	if (!ptp_ctx)
+		return bssgp_tx_status(BSSGP_CAUSE_UNKNOWN_BVCI, &bvci, msg);
+
+	ptp_ctx->state |= BVC_S_BLOCKED;
+	rate_ctr_inc(&ptp_ctx->ctrg->ctr[BSSGP_CTR_BLOCKED]);
+
+	/* Send NM_BVC_BLOCK.ind to NM */
+	memset(&nmp, 0, sizeof(nmp));
+	nmp.nsei = msgb_nsei(msg);
+	nmp.bvci = bvci;
+	nmp.tp = tp;
+	osmo_prim_init(&nmp.oph, SAP_BSSGP_NM, PRIM_NM_BVC_BLOCK,
+			PRIM_OP_INDICATION, msg);
+	bssgp_prim_cb(&nmp.oph, NULL);
+
+	/* We always acknowledge the BLOCKing */
+	return bssgp_tx_simple_bvci(BSSGP_PDUT_BVC_BLOCK_ACK, msgb_nsei(msg),
+				    bvci, msgb_bvci(msg));
+};
+
+static int bssgp_rx_bvc_unblock(struct msgb *msg, struct tlv_parsed *tp)
+{
+	struct osmo_bssgp_prim nmp;
+	uint16_t bvci;
+	struct bssgp_bvc_ctx *ptp_ctx;
+
+	bvci = ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BVCI));
+	if (bvci == BVCI_SIGNALLING) {
+		/* 8.3.2: Signalling BVC shall never be blocked */
+		LOGP(DBSSGP, LOGL_ERROR, "NSEI=%u/BVCI=%u "
+			"received unblock for signalling BVC!?!\n",
+			msgb_nsei(msg), msgb_bvci(msg));
+		return 0;
+	}
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx BVC-UNBLOCK\n", bvci);
+
+	ptp_ctx = btsctx_by_bvci_nsei(bvci, msgb_nsei(msg));
+	if (!ptp_ctx)
+		return bssgp_tx_status(BSSGP_CAUSE_UNKNOWN_BVCI, &bvci, msg);
+
+	ptp_ctx->state &= ~BVC_S_BLOCKED;
+
+	/* Send NM_BVC_UNBLOCK.ind to NM */
+	memset(&nmp, 0, sizeof(nmp));
+	nmp.nsei = msgb_nsei(msg);
+	nmp.bvci = bvci;
+	nmp.tp = tp;
+	osmo_prim_init(&nmp.oph, SAP_BSSGP_NM, PRIM_NM_BVC_UNBLOCK,
+			PRIM_OP_INDICATION, msg);
+	bssgp_prim_cb(&nmp.oph, NULL);
+
+	/* We always acknowledge the unBLOCKing */
+	return bssgp_tx_simple_bvci(BSSGP_PDUT_BVC_UNBLOCK_ACK, msgb_nsei(msg),
+				    bvci, msgb_bvci(msg));
+};
+
+/* Uplink unit-data */
+static int bssgp_rx_ul_ud(struct msgb *msg, struct tlv_parsed *tp,
+			  struct bssgp_bvc_ctx *ctx)
+{
+	struct osmo_bssgp_prim gbp;
+	struct bssgp_ud_hdr *budh = (struct bssgp_ud_hdr *) msgb_bssgph(msg);
+
+	/* extract TLLI and parse TLV IEs */
+	msgb_tlli(msg) = ntohl(budh->tlli);
+
+	DEBUGP(DBSSGP, "BSSGP TLLI=0x%08x Rx UPLINK-UNITDATA\n", msgb_tlli(msg));
+
+	/* Cell ID and LLC_PDU are the only mandatory IE */
+	if (!TLVP_PRESENT(tp, BSSGP_IE_CELL_ID) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_LLC_PDU)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP TLLI=0x%08x Rx UL-UD "
+			"missing mandatory IE\n", msgb_tlli(msg));
+		return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+	}
+
+	/* store pointer to LLC header and CELL ID in msgb->cb */
+	msgb_llch(msg) = (uint8_t *) TLVP_VAL(tp, BSSGP_IE_LLC_PDU);
+	msgb_bcid(msg) = (uint8_t *) TLVP_VAL(tp, BSSGP_IE_CELL_ID);
+
+	/* Send BSSGP_UL_UD.ind to NM */
+	memset(&gbp, 0, sizeof(gbp));
+	gbp.nsei = ctx->nsei;
+	gbp.bvci = ctx->bvci;
+	gbp.tlli = msgb_tlli(msg);
+	gbp.tp = tp;
+	osmo_prim_init(&gbp.oph, SAP_BSSGP_LL, PRIM_BSSGP_UL_UD,
+			PRIM_OP_INDICATION, msg);
+	return bssgp_prim_cb(&gbp.oph, NULL);
+}
+
+static int bssgp_rx_suspend(struct msgb *msg, struct tlv_parsed *tp,
+			    struct bssgp_bvc_ctx *ctx)
+{
+	struct osmo_bssgp_prim gbp;
+	struct gprs_ra_id raid;
+	uint32_t tlli;
+	int rc;
+
+	if (!TLVP_PRESENT(tp, BSSGP_IE_TLLI) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_ROUTEING_AREA)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx SUSPEND "
+			"missing mandatory IE\n", ctx->bvci);
+		return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+	}
+
+	tlli = ntohl(*(uint32_t *)TLVP_VAL(tp, BSSGP_IE_TLLI));
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u TLLI=0x%08x Rx SUSPEND\n",
+		ctx->bvci, tlli);
+
+	gsm48_parse_ra(&raid, TLVP_VAL(tp, BSSGP_IE_ROUTEING_AREA));
+
+	/* Inform GMM about the SUSPEND request */
+	memset(&gbp, 0, sizeof(gbp));
+	gbp.nsei = msgb_nsei(msg);
+	gbp.bvci = ctx->bvci;
+	gbp.tlli = tlli;
+	gbp.ra_id = &raid;
+	osmo_prim_init(&gbp.oph, SAP_BSSGP_GMM, PRIM_BSSGP_GMM_SUSPEND,
+			PRIM_OP_REQUEST, msg);
+
+	rc = bssgp_prim_cb(&gbp.oph, NULL);
+	if (rc < 0)
+		return bssgp_tx_suspend_nack(msgb_nsei(msg), tlli, &raid, NULL);
+
+	bssgp_tx_suspend_ack(msgb_nsei(msg), tlli, &raid, 0);
+
+	return 0;
+}
+
+static int bssgp_rx_resume(struct msgb *msg, struct tlv_parsed *tp,
+			   struct bssgp_bvc_ctx *ctx)
+{
+	struct osmo_bssgp_prim gbp;
+	struct gprs_ra_id raid;
+	uint32_t tlli;
+	uint8_t suspend_ref;
+	int rc;
+
+	if (!TLVP_PRESENT(tp, BSSGP_IE_TLLI) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_ROUTEING_AREA) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_SUSPEND_REF_NR)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx RESUME "
+			"missing mandatory IE\n", ctx->bvci);
+		return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+	}
+
+	tlli = ntohl(*(uint32_t *)TLVP_VAL(tp, BSSGP_IE_TLLI));
+	suspend_ref = *TLVP_VAL(tp, BSSGP_IE_SUSPEND_REF_NR);
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u TLLI=0x%08x Rx RESUME\n", ctx->bvci, tlli);
+
+	gsm48_parse_ra(&raid, TLVP_VAL(tp, BSSGP_IE_ROUTEING_AREA));
+
+	/* Inform GMM about the RESUME request */
+	memset(&gbp, 0, sizeof(gbp));
+	gbp.nsei = msgb_nsei(msg);
+	gbp.bvci = ctx->bvci;
+	gbp.tlli = tlli;
+	gbp.ra_id = &raid;
+	gbp.u.resume.suspend_ref = suspend_ref;
+	osmo_prim_init(&gbp.oph, SAP_BSSGP_GMM, PRIM_BSSGP_GMM_RESUME,
+			PRIM_OP_REQUEST, msg);
+
+	rc = bssgp_prim_cb(&gbp.oph, NULL);
+	if (rc < 0)
+		return bssgp_tx_resume_nack(msgb_nsei(msg), tlli, &raid,
+					    NULL);
+
+	bssgp_tx_resume_ack(msgb_nsei(msg), tlli, &raid);
+	return 0;
+}
+
+
+static int bssgp_rx_llc_disc(struct msgb *msg, struct tlv_parsed *tp,
+			     struct bssgp_bvc_ctx *ctx)
+{
+	struct osmo_bssgp_prim nmp;
+	uint32_t tlli = 0;
+
+	if (!TLVP_PRESENT(tp, BSSGP_IE_TLLI) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_LLC_FRAMES_DISCARDED) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_BVCI) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_NUM_OCT_AFF)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx LLC DISCARDED "
+			"missing mandatory IE\n", ctx->bvci);
+	}
+
+	if (TLVP_PRESENT(tp, BSSGP_IE_TLLI))
+		tlli = ntohl(*(uint32_t *)TLVP_VAL(tp, BSSGP_IE_TLLI));
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u TLLI=%08x Rx LLC DISCARDED\n",
+		ctx->bvci, tlli);
+
+	rate_ctr_inc(&ctx->ctrg->ctr[BSSGP_CTR_DISCARDED]);
+
+	/* send NM_LLC_DISCARDED to NM */
+	memset(&nmp, 0, sizeof(nmp));
+	nmp.nsei = msgb_nsei(msg);
+	nmp.bvci = ctx->bvci;
+	nmp.tlli = tlli;
+	nmp.tp = tp;
+	osmo_prim_init(&nmp.oph, SAP_BSSGP_NM, PRIM_NM_LLC_DISCARDED,
+			PRIM_OP_INDICATION, msg);
+
+	return bssgp_prim_cb(&nmp.oph, NULL);
+}
+
+/* One element (msgb) in a BSSGP Flow Control queue */
+struct bssgp_fc_queue_element {
+	/* linked list of queue elements */
+	struct llist_head list;
+	/* The message that we have enqueued */
+	struct msgb *msg;
+	/* Length of the LLC PDU part of the contained message */
+	uint32_t llc_pdu_len;
+	/* private pointer passed to the flow control out_cb function */
+	void *priv;
+};
+
+static int fc_queue_timer_cfg(struct bssgp_flow_control *fc);
+static int bssgp_fc_needs_queueing(struct bssgp_flow_control *fc, uint32_t pdu_len);
+
+static void fc_timer_cb(void *data)
+{
+	struct bssgp_flow_control *fc = data;
+	struct bssgp_fc_queue_element *fcqe;
+	struct timeval time_now;
+
+	/* if the queue is empty, we return without sending something
+	 * and without re-starting the timer */
+	if (llist_empty(&fc->queue))
+		return;
+
+	/* get the first entry from the queue */
+	fcqe = llist_entry(fc->queue.next, struct bssgp_fc_queue_element,
+			   list);
+
+	if (bssgp_fc_needs_queueing(fc, fcqe->llc_pdu_len)) {
+		LOGP(DBSSGP, LOGL_NOTICE, "BSSGP-FC: fc_timer_cb() but still "
+			"not able to send PDU of %u bytes\n", fcqe->llc_pdu_len);
+		/* make sure we re-start the timer */
+		fc_queue_timer_cfg(fc);
+		return;
+	}
+
+	/* remove from the queue */
+	llist_del(&fcqe->list);
+
+	fc->queue_depth--;
+
+	/* record the time we transmitted this PDU */
+	gettimeofday(&time_now, NULL);
+	fc->time_last_pdu = time_now;
+
+	/* call the output callback for this FC instance */
+	fc->out_cb(fcqe->priv, fcqe->msg, fcqe->llc_pdu_len, NULL);
+
+	/* we expect that out_cb will in the end free the msgb once
+	 * it is no longer needed */
+
+	/* but we have to free the queue element ourselves */
+	talloc_free(fcqe);
+
+	/* re-configure the timer for the next PDU */
+	fc_queue_timer_cfg(fc);
+}
+
+/* configure/schedule the flow control timer to expire once the bucket
+ * will have leaked a sufficient number of bytes to transmit the next
+ * PDU in the queue */
+static int fc_queue_timer_cfg(struct bssgp_flow_control *fc)
+{
+	struct bssgp_fc_queue_element *fcqe;
+	uint32_t msecs;
+
+	if (llist_empty(&fc->queue))
+		return 0;
+
+	fcqe = llist_entry(&fc->queue.next, struct bssgp_fc_queue_element,
+			   list);
+
+	/* Calculate the point in time at which we will have leaked
+	 * a sufficient number of bytes from the bucket to transmit
+	 * the first PDU in the queue */
+	msecs = (fcqe->llc_pdu_len * 1000) / fc->bucket_leak_rate;
+	/* FIXME: add that time to fc->time_last_pdu and subtract it from
+	 * current time */
+
+	fc->timer.data = fc;
+	fc->timer.cb = &fc_timer_cb;
+	osmo_timer_schedule(&fc->timer, msecs / 1000, (msecs % 1000) * 1000);
+
+	return 0;
+}
+
+/* Enqueue a PDU in the flow control queue for delayed transmission */
+static int fc_enqueue(struct bssgp_flow_control *fc, struct msgb *msg,
+		      uint32_t llc_pdu_len, void *priv)
+{
+	struct bssgp_fc_queue_element *fcqe;
+
+	if (fc->queue_depth >= fc->max_queue_depth)
+		return -ENOSPC;
+
+	fcqe = talloc_zero(fc, struct bssgp_fc_queue_element);
+	if (!fcqe)
+		return -ENOMEM;
+	fcqe->msg = msg;
+	fcqe->llc_pdu_len = llc_pdu_len;
+	fcqe->priv = priv;
+
+	llist_add_tail(&fcqe->list, &fc->queue);
+
+	fc->queue_depth++;
+
+	/* re-configure the timer for dequeueing the pdu */
+	fc_queue_timer_cfg(fc);
+
+	return 0;
+}
+
+/* According to Section 8.2 */
+static int bssgp_fc_needs_queueing(struct bssgp_flow_control *fc, uint32_t pdu_len)
+{
+	struct timeval time_now, time_diff;
+	int64_t bucket_predicted;
+	uint32_t csecs_elapsed, leaked;
+
+	/* B' = B + L(p) - (Tc - Tp)*R */
+
+	/* compute number of centi-seconds that have elapsed since transmitting
+	 * the last PDU (Tc - Tp) */
+	gettimeofday(&time_now, NULL);
+	timersub(&time_now, &fc->time_last_pdu, &time_diff);
+	csecs_elapsed = time_diff.tv_sec*100 + time_diff.tv_usec/10000;
+
+	/* compute number of bytes that have leaked in the elapsed number
+	 * of centi-seconds */
+	leaked = csecs_elapsed * (fc->bucket_leak_rate / 100);
+	/* add the current PDU length to the last bucket level */
+	bucket_predicted = fc->bucket_counter + pdu_len;
+	/* ... and subtract the number of leaked bytes */
+	bucket_predicted -= leaked;
+
+	if (bucket_predicted < pdu_len) {
+		/* this is just to make sure the bucket doesn't underflow */
+		bucket_predicted = pdu_len;
+		goto pass;
+	}
+
+	if (bucket_predicted <= fc->bucket_size_max) {
+		/* the bucket is not full yet, we can pass the packet */
+		fc->bucket_counter = bucket_predicted;
+		goto pass;
+	}
+
+	/* bucket is full, PDU needs to be delayed */
+	return 1;
+
+pass:
+	/* if we reach here, the PDU can pass */
+	return 0;
+}
+
+/* output callback for BVC flow control */
+static int _bssgp_tx_dl_ud(struct bssgp_flow_control *fc, struct msgb *msg,
+			   uint32_t llc_pdu_len, void *priv)
+{
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* input function of the flow control implementation, called first
+ * for the MM flow control, and then as the MM flow control output
+ * callback in order to perform BVC flow control */
+int bssgp_fc_in(struct bssgp_flow_control *fc, struct msgb *msg,
+		uint32_t llc_pdu_len, void *priv)
+{
+	struct timeval time_now;
+
+	if (llc_pdu_len > fc->bucket_size_max) {
+		LOGP(DBSSGP, LOGL_NOTICE, "Single PDU (size=%u) is larger "
+		     "than maximum bucket size (%u)!\n", llc_pdu_len,
+		     fc->bucket_size_max);
+		return -EIO;
+	}
+
+	if (bssgp_fc_needs_queueing(fc, llc_pdu_len)) {
+		return fc_enqueue(fc, msg, llc_pdu_len, priv);
+	} else {
+		/* record the time we transmitted this PDU */
+		gettimeofday(&time_now, NULL);
+		fc->time_last_pdu = time_now;
+		return fc->out_cb(priv, msg, llc_pdu_len, NULL);
+	}
+}
+
+
+/* Initialize the Flow Control structure */
+void bssgp_fc_init(struct bssgp_flow_control *fc,
+		   uint32_t bucket_size_max, uint32_t bucket_leak_rate,
+		   uint32_t max_queue_depth,
+		   int (*out_cb)(struct bssgp_flow_control *fc, struct msgb *msg,
+				 uint32_t llc_pdu_len, void *priv))
+{
+	fc->out_cb = out_cb;
+	fc->bucket_size_max = bucket_size_max;
+	fc->bucket_leak_rate = bucket_leak_rate;
+	fc->max_queue_depth = max_queue_depth;
+	INIT_LLIST_HEAD(&fc->queue);
+	gettimeofday(&fc->time_last_pdu, NULL);
+}
+
+/* Initialize the Flow Control parameters for a new MS according to
+ * default values for the BVC specified by BVCI and NSEI */
+int bssgp_fc_ms_init(struct bssgp_flow_control *fc_ms, uint16_t bvci,
+		     uint16_t nsei, uint32_t max_queue_depth)
+{
+	struct bssgp_bvc_ctx *ctx;
+
+	ctx = btsctx_by_bvci_nsei(bvci, nsei);
+	if (!ctx)
+		return -ENODEV;
+
+	/* output call-back of per-MS FC is per-CTX FC */
+	bssgp_fc_init(fc_ms, ctx->bmax_default_ms, ctx->r_default_ms,
+			max_queue_depth, bssgp_fc_in);
+
+	return 0;
+}
+
+static int bssgp_rx_fc_bvc(struct msgb *msg, struct tlv_parsed *tp,
+			   struct bssgp_bvc_ctx *bctx)
+{
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx Flow Control BVC\n",
+		bctx->bvci);
+
+	if (!TLVP_PRESENT(tp, BSSGP_IE_TAG) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_BVC_BUCKET_SIZE) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_BUCKET_LEAK_RATE) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_BMAX_DEFAULT_MS) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_R_DEFAULT_MS)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx FC BVC "
+			"missing mandatory IE\n", bctx->bvci);
+		return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+	}
+
+	/* 11.3.5 Bucket Size in 100 octets unit */
+	bctx->fc->bucket_size_max = 100 *
+		ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BVC_BUCKET_SIZE));
+	/* 11.3.4 Bucket Leak Rate in 100 bits/sec unit */
+	bctx->fc->bucket_leak_rate = 100 *
+		ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BUCKET_LEAK_RATE)) / 8;
+	/* 11.3.2 in octets */
+	bctx->bmax_default_ms =
+		ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BMAX_DEFAULT_MS));
+	/* 11.3.32 Bucket Leak rate in 100bits/sec unit */
+	bctx->r_default_ms = 100 *
+		ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_R_DEFAULT_MS)) / 8;
+
+	/* Send FLOW_CONTROL_BVC_ACK */
+	return bssgp_tx_fc_bvc_ack(msgb_nsei(msg), *TLVP_VAL(tp, BSSGP_IE_TAG),
+				   msgb_bvci(msg));
+}
+
+/* Receive a BSSGP PDU from a BSS on a PTP BVCI */
+static int bssgp_rx_ptp(struct msgb *msg, struct tlv_parsed *tp,
+			struct bssgp_bvc_ctx *bctx)
+{
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	uint8_t pdu_type = bgph->pdu_type;
+	int rc = 0;
+
+	/* If traffic is received on a BVC that is marked as blocked, the
+	 * received PDU shall not be accepted and a STATUS PDU (Cause value:
+	 * BVC Blocked) shall be sent to the peer entity on the signalling BVC */
+	if (bctx->state & BVC_S_BLOCKED && pdu_type != BSSGP_PDUT_STATUS) {
+		uint16_t bvci = msgb_bvci(msg);
+		return bssgp_tx_status(BSSGP_CAUSE_BVCI_BLOCKED, &bvci, msg);
+	}
+
+	switch (pdu_type) {
+	case BSSGP_PDUT_UL_UNITDATA:
+		/* some LLC data from the MS */
+		rc = bssgp_rx_ul_ud(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_RA_CAPABILITY:
+		/* BSS requests RA capability or IMSI */
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx RA CAPABILITY UPDATE\n",
+			bctx->bvci);
+		/* FIXME: send GMM_RA_CAPABILITY_UPDATE.ind to GMM */
+		/* FIXME: send RA_CAPA_UPDATE_ACK */
+		break;
+	case BSSGP_PDUT_RADIO_STATUS:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx RADIO STATUS\n", bctx->bvci);
+		/* BSS informs us of some exception */
+		/* FIXME: send GMM_RADIO_STATUS.ind to GMM */
+		break;
+	case BSSGP_PDUT_FLOW_CONTROL_BVC:
+		/* BSS informs us of available bandwidth in Gb interface */
+		rc = bssgp_rx_fc_bvc(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_FLOW_CONTROL_MS:
+		/* BSS informs us of available bandwidth to one MS */
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx Flow Control MS\n",
+			bctx->bvci);
+		/* FIXME: actually implement flow control */
+		/* FIXME: Send FLOW_CONTROL_MS_ACK */
+		break;
+	case BSSGP_PDUT_STATUS:
+		/* Some exception has occurred */
+		/* FIXME: send NM_STATUS.ind to NM */
+	case BSSGP_PDUT_DOWNLOAD_BSS_PFC:
+	case BSSGP_PDUT_CREATE_BSS_PFC_ACK:
+	case BSSGP_PDUT_CREATE_BSS_PFC_NACK:
+	case BSSGP_PDUT_MODIFY_BSS_PFC:
+	case BSSGP_PDUT_DELETE_BSS_PFC_ACK:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx PDU type 0x%02x not [yet] "
+			"implemented\n", bctx->bvci, pdu_type);
+		rc = bssgp_tx_status(BSSGP_CAUSE_PDU_INCOMP_FEAT, NULL, msg);
+		break;
+	/* those only exist in the SGSN -> BSS direction */
+	case BSSGP_PDUT_DL_UNITDATA:
+	case BSSGP_PDUT_PAGING_PS:
+	case BSSGP_PDUT_PAGING_CS:
+	case BSSGP_PDUT_RA_CAPA_UPDATE_ACK:
+	case BSSGP_PDUT_FLOW_CONTROL_BVC_ACK:
+	case BSSGP_PDUT_FLOW_CONTROL_MS_ACK:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u PDU type 0x%02x only exists "
+			"in DL\n", bctx->bvci, pdu_type);
+		bssgp_tx_status(BSSGP_CAUSE_PROTO_ERR_UNSPEC, NULL, msg);
+		rc = -EINVAL;
+		break;
+	default:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u PDU type 0x%02x unknown\n",
+			bctx->bvci, pdu_type);
+		rc = bssgp_tx_status(BSSGP_CAUSE_PROTO_ERR_UNSPEC, NULL, msg);
+		break;
+	}
+
+	return rc;
+}
+
+/* Receive a BSSGP PDU from a BSS on a SIGNALLING BVCI */
+static int bssgp_rx_sign(struct msgb *msg, struct tlv_parsed *tp,
+			 struct bssgp_bvc_ctx *bctx)
+{
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	uint8_t pdu_type = bgph->pdu_type;
+	int rc = 0;
+	uint16_t ns_bvci = msgb_bvci(msg);
+
+	switch (bgph->pdu_type) {
+	case BSSGP_PDUT_SUSPEND:
+		/* MS wants to suspend */
+		rc = bssgp_rx_suspend(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_RESUME:
+		/* MS wants to resume */
+		rc = bssgp_rx_resume(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_FLUSH_LL_ACK:
+		/* BSS informs us it has performed LL FLUSH */
+		DEBUGP(DBSSGP, "BSSGP Rx BVCI=%u FLUSH LL ACK\n", bctx->bvci);
+		/* FIXME: send NM_FLUSH_LL.res to NM */
+		break;
+	case BSSGP_PDUT_LLC_DISCARD:
+		/* BSS informs that some LLC PDU's have been discarded */
+		rc = bssgp_rx_llc_disc(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_BVC_BLOCK:
+		/* BSS tells us that BVC shall be blocked */
+		if (!TLVP_PRESENT(tp, BSSGP_IE_BVCI) ||
+		    !TLVP_PRESENT(tp, BSSGP_IE_CAUSE)) {
+			LOGP(DBSSGP, LOGL_ERROR, "BSSGP Rx BVC-BLOCK "
+				"missing mandatory IE\n");
+			goto err_mand_ie;
+		}
+		rc = bssgp_rx_bvc_block(msg, tp);
+		break;
+	case BSSGP_PDUT_BVC_UNBLOCK:
+		/* BSS tells us that BVC shall be unblocked */
+		if (!TLVP_PRESENT(tp, BSSGP_IE_BVCI)) {
+			LOGP(DBSSGP, LOGL_ERROR, "BSSGP Rx BVC-UNBLOCK "
+				"missing mandatory IE\n");
+			goto err_mand_ie;
+		}
+		rc = bssgp_rx_bvc_unblock(msg, tp);
+		break;
+	case BSSGP_PDUT_BVC_RESET:
+		/* BSS tells us that BVC init is required */
+		if (!TLVP_PRESENT(tp, BSSGP_IE_BVCI) ||
+		    !TLVP_PRESENT(tp, BSSGP_IE_CAUSE)) {
+			LOGP(DBSSGP, LOGL_ERROR, "BSSGP Rx BVC-RESET "
+				"missing mandatory IE\n");
+			goto err_mand_ie;
+		}
+		rc = bssgp_rx_bvc_reset(msg, tp, ns_bvci);
+		break;
+	case BSSGP_PDUT_STATUS:
+		/* Some exception has occurred */
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx BVC STATUS\n", bctx->bvci);
+		/* FIXME: send NM_STATUS.ind to NM */
+		break;
+	/* those only exist in the SGSN -> BSS direction */
+	case BSSGP_PDUT_PAGING_PS:
+	case BSSGP_PDUT_PAGING_CS:
+	case BSSGP_PDUT_SUSPEND_ACK:
+	case BSSGP_PDUT_SUSPEND_NACK:
+	case BSSGP_PDUT_RESUME_ACK:
+	case BSSGP_PDUT_RESUME_NACK:
+	case BSSGP_PDUT_FLUSH_LL:
+	case BSSGP_PDUT_BVC_BLOCK_ACK:
+	case BSSGP_PDUT_BVC_UNBLOCK_ACK:
+	case BSSGP_PDUT_SGSN_INVOKE_TRACE:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx PDU type 0x%02x only exists "
+			"in DL\n", bctx->bvci, pdu_type);
+		bssgp_tx_status(BSSGP_CAUSE_PROTO_ERR_UNSPEC, NULL, msg);
+		rc = -EINVAL;
+		break;
+	default:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx PDU type 0x%02x unknown\n",
+			bctx->bvci, pdu_type);
+		rc = bssgp_tx_status(BSSGP_CAUSE_PROTO_ERR_UNSPEC, NULL, msg);
+		break;
+	}
+
+	return rc;
+err_mand_ie:
+	return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+}
+
+/* We expect msgb_bssgph() to point to the BSSGP header */
+int bssgp_rcvmsg(struct msgb *msg)
+{
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	struct bssgp_ud_hdr *budh = (struct bssgp_ud_hdr *) msgb_bssgph(msg);
+	struct tlv_parsed tp;
+	struct bssgp_bvc_ctx *bctx;
+	uint8_t pdu_type = bgph->pdu_type;
+	uint16_t ns_bvci = msgb_bvci(msg);
+	int data_len;
+	int rc = 0;
+
+	/* Identifiers from DOWN: NSEI, BVCI (both in msg->cb) */
+
+	/* UNITDATA BSSGP headers have TLLI in front */
+	if (pdu_type != BSSGP_PDUT_UL_UNITDATA &&
+	    pdu_type != BSSGP_PDUT_DL_UNITDATA) {
+		data_len = msgb_bssgp_len(msg) - sizeof(*bgph);
+		rc = bssgp_tlv_parse(&tp, bgph->data, data_len);
+	} else {
+		data_len = msgb_bssgp_len(msg) - sizeof(*budh);
+		rc = bssgp_tlv_parse(&tp, budh->data, data_len);
+	}
+
+	/* look-up or create the BTS context for this BVC */
+	bctx = btsctx_by_bvci_nsei(ns_bvci, msgb_nsei(msg));
+	/* Only a RESET PDU can create a new BVC context */
+	if (!bctx && pdu_type != BSSGP_PDUT_BVC_RESET) {
+		LOGP(DBSSGP, LOGL_NOTICE, "NSEI=%u/BVCI=%u Rejecting PDU "
+			"type %u for unknown BVCI\n", msgb_nsei(msg), ns_bvci,
+			pdu_type);
+		return bssgp_tx_status(BSSGP_CAUSE_UNKNOWN_BVCI, NULL, msg);
+	}
+
+	if (bctx) {
+		log_set_context(GPRS_CTX_BVC, bctx);
+		rate_ctr_inc(&bctx->ctrg->ctr[BSSGP_CTR_PKTS_IN]);
+		rate_ctr_add(&bctx->ctrg->ctr[BSSGP_CTR_BYTES_IN],
+			     msgb_bssgp_len(msg));
+	}
+
+	if (ns_bvci == BVCI_SIGNALLING)
+		rc = bssgp_rx_sign(msg, &tp, bctx);
+	else if (ns_bvci == BVCI_PTM)
+		rc = bssgp_tx_status(BSSGP_CAUSE_PDU_INCOMP_FEAT, NULL, msg);
+	else
+		rc = bssgp_rx_ptp(msg, &tp, bctx);
+
+	return rc;
+}
+
+int bssgp_tx_dl_ud(struct msgb *msg, uint16_t pdu_lifetime,
+		   struct bssgp_dl_ud_par *dup)
+{
+	struct bssgp_bvc_ctx *bctx;
+	struct bssgp_ud_hdr *budh;
+	uint8_t llc_pdu_tlv_hdr_len = 2;
+	uint8_t *llc_pdu_tlv;
+	uint16_t msg_len = msg->len;
+	uint16_t bvci = msgb_bvci(msg);
+	uint16_t nsei = msgb_nsei(msg);
+	uint16_t _pdu_lifetime = htons(pdu_lifetime); /* centi-seconds */
+	uint16_t drx_params;
+
+	/* Identifiers from UP: TLLI, BVCI, NSEI (all in msgb->cb) */
+	if (bvci <= BVCI_PTM ) {
+		LOGP(DBSSGP, LOGL_ERROR, "Cannot send DL-UD to BVCI %u\n",
+			bvci);
+		return -EINVAL;
+	}
+
+	bctx = btsctx_by_bvci_nsei(bvci, nsei);
+	if (!bctx) {
+		LOGP(DBSSGP, LOGL_ERROR, "Cannot send DL-UD to unknown BVCI %u\n",
+			bvci);
+		return -ENODEV;
+	}
+
+	if (msg->len > TVLV_MAX_ONEBYTE)
+		llc_pdu_tlv_hdr_len += 1;
+
+	/* prepend the tag and length of the LLC-PDU TLV */
+	llc_pdu_tlv = msgb_push(msg, llc_pdu_tlv_hdr_len);
+	llc_pdu_tlv[0] = BSSGP_IE_LLC_PDU;
+	if (llc_pdu_tlv_hdr_len > 2) {
+		llc_pdu_tlv[1] = msg_len >> 8;
+		llc_pdu_tlv[2] = msg_len & 0xff;
+	} else {
+		llc_pdu_tlv[1] = msg_len & 0x7f;
+		llc_pdu_tlv[1] |= 0x80;
+	}
+
+	/* FIXME: optional elements: Alignment, UTRAN CCO, LSA, PFI */
+
+	if (dup) {
+		/* Old TLLI to help BSS map from old->new */
+		if (dup->tlli) {
+			uint32_t tlli = htonl(*dup->tlli);
+			msgb_tvlv_push(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &tlli);
+		}
+
+		/* IMSI */
+		if (dup->imsi && strlen(dup->imsi)) {
+			uint8_t mi[10];
+			int imsi_len = gsm48_generate_mid_from_imsi(mi, dup->imsi);
+			if (imsi_len > 2)
+				msgb_tvlv_push(msg, BSSGP_IE_IMSI,
+						imsi_len-2, mi+2);
+		}
+
+		/* DRX parameters */
+		drx_params = htons(dup->drx_parms);
+		msgb_tvlv_push(msg, BSSGP_IE_DRX_PARAMS, 2,
+				(uint8_t *) &drx_params);
+
+		/* FIXME: Priority */
+
+		/* MS Radio Access Capability */
+		if (dup->ms_ra_cap.len)
+			msgb_tvlv_push(msg, BSSGP_IE_MS_RADIO_ACCESS_CAP,
+					dup->ms_ra_cap.len, dup->ms_ra_cap.v);
+
+	}
+
+	/* prepend the pdu lifetime */
+	msgb_tvlv_push(msg, BSSGP_IE_PDU_LIFETIME, 2, (uint8_t *)&_pdu_lifetime);
+
+	/* prepend the QoS profile, TLLI and pdu type */
+	budh = (struct bssgp_ud_hdr *) msgb_push(msg, sizeof(*budh));
+	memcpy(budh->qos_profile, dup->qos_profile, sizeof(budh->qos_profile));
+	budh->tlli = htonl(msgb_tlli(msg));
+	budh->pdu_type = BSSGP_PDUT_DL_UNITDATA;
+
+	rate_ctr_inc(&bctx->ctrg->ctr[BSSGP_CTR_PKTS_OUT]);
+	rate_ctr_add(&bctx->ctrg->ctr[BSSGP_CTR_BYTES_OUT], msg->len);
+
+	/* Identifiers down: BVCI, NSEI (in msgb->cb) */
+
+	/* check if we have to go through per-ms flow control or can go
+	 * directly to the per-BSS flow control */
+	if (dup->fc)
+		return bssgp_fc_in(dup->fc, msg, msg_len, bctx->fc);
+	else
+		return bssgp_fc_in(bctx->fc, msg, msg_len, NULL);
+}
+
+/* Send a single GMM-PAGING.req to a given NSEI/NS-BVCI */
+int bssgp_tx_paging(uint16_t nsei, uint16_t ns_bvci,
+		     struct bssgp_paging_info *pinfo)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t drx_params = htons(pinfo->drx_params);
+	uint8_t mi[10];
+	int imsi_len = gsm48_generate_mid_from_imsi(mi, pinfo->imsi);
+	uint8_t ra[6];
+
+	if (imsi_len < 2)
+		return -EINVAL;
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = ns_bvci;
+
+	if (pinfo->mode == BSSGP_PAGING_PS)
+		bgph->pdu_type = BSSGP_PDUT_PAGING_PS;
+	else
+		bgph->pdu_type = BSSGP_PDUT_PAGING_CS;
+	/* IMSI */
+	msgb_tvlv_put(msg, BSSGP_IE_IMSI, imsi_len-2, mi+2);
+	/* DRX Parameters */
+	msgb_tvlv_put(msg, BSSGP_IE_DRX_PARAMS, 2,
+			(uint8_t *) &drx_params);
+	/* Scope */
+	switch (pinfo->scope) {
+	case BSSGP_PAGING_BSS_AREA:
+		{
+			uint8_t null = 0;
+			msgb_tvlv_put(msg, BSSGP_IE_BSS_AREA_ID, 1, &null);
+		}
+		break;
+	case BSSGP_PAGING_LOCATION_AREA:
+		gsm48_construct_ra(ra, &pinfo->raid);
+		msgb_tvlv_put(msg, BSSGP_IE_LOCATION_AREA, 4, ra);
+		break;
+	case BSSGP_PAGING_ROUTEING_AREA:
+		gsm48_construct_ra(ra, &pinfo->raid);
+		msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+		break;
+	case BSSGP_PAGING_BVCI:
+		{
+			uint16_t bvci = htons(pinfo->bvci);
+			msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *)&bvci);
+		}
+		break;
+	}
+	/* QoS profile mandatory for PS */
+	if (pinfo->mode == BSSGP_PAGING_PS)
+		msgb_tvlv_put(msg, BSSGP_IE_QOS_PROFILE, 3, pinfo->qos);
+
+	/* Optional (P-)TMSI */
+	if (pinfo->ptmsi) {
+		uint32_t ptmsi = htonl(*pinfo->ptmsi);
+		msgb_tvlv_put(msg, BSSGP_IE_TMSI, 4, (uint8_t *) &ptmsi);
+	}
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+void bssgp_set_log_ss(int ss)
+{
+	DBSSGP = ss;
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_bssgp_bss.c b/src/shared/libosmocore/src/gb/gprs_bssgp_bss.c
new file mode 100644
index 00000000..9d0325a2
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_bssgp_bss.c
@@ -0,0 +1,425 @@
+/* GPRS BSSGP protocol implementation as per 3GPP TS 08.18 */
+
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <errno.h>
+#include <stdint.h>
+
+#include <netinet/in.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+#include "common_vty.h"
+
+uint8_t *bssgp_msgb_tlli_put(struct msgb *msg, uint32_t tlli)
+{
+	uint32_t _tlli = htonl(tlli);
+	return msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+}
+
+/*! \brief GMM-SUSPEND.req (Chapter 10.3.6) */
+int bssgp_tx_suspend(uint16_t nsei, uint32_t tlli,
+		     const struct gprs_ra_id *ra_id)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint8_t ra[6];
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=0) Tx SUSPEND (TLLI=0x%04x)\n",
+		tlli);
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_SUSPEND;
+
+	bssgp_msgb_tlli_put(msg, tlli);
+
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief GMM-RESUME.req (Chapter 10.3.9) */
+int bssgp_tx_resume(uint16_t nsei, uint32_t tlli,
+		    const struct gprs_ra_id *ra_id, uint8_t suspend_ref)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint8_t ra[6];
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=0) Tx RESUME (TLLI=0x%04x)\n",
+		tlli);
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_RESUME;
+
+	bssgp_msgb_tlli_put(msg, tlli);
+
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+
+	msgb_tvlv_put(msg, BSSGP_IE_SUSPEND_REF_NR, 1, &suspend_ref);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit RA-CAPABILITY-UPDATE (10.3.3) */
+int bssgp_tx_ra_capa_upd(struct bssgp_bvc_ctx *bctx, uint32_t tlli, uint8_t tag)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx RA-CAPA-UPD (TLLI=0x%04x)\n",
+		bctx->bvci, tlli);
+
+	/* set NSEI and BVCI in msgb cb */
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = bctx->bvci;
+
+	bgph->pdu_type = BSSGP_PDUT_RA_CAPA_UDPATE;
+	bssgp_msgb_tlli_put(msg, tlli);
+
+	msgb_tvlv_put(msg, BSSGP_IE_TAG, 1, &tag);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* first common part of RADIO-STATUS */
+static struct msgb *common_tx_radio_status(struct bssgp_bvc_ctx *bctx)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx RADIO-STATUS ",
+		bctx->bvci);
+
+	/* set NSEI and BVCI in msgb cb */
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = bctx->bvci;
+
+	bgph->pdu_type = BSSGP_PDUT_RADIO_STATUS;
+
+	return msg;
+}
+
+/* second common part of RADIO-STATUS */
+static int common_tx_radio_status2(struct msgb *msg, uint8_t cause)
+{
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, &cause);
+	LOGPC(DBSSGP, LOGL_NOTICE, "CAUSE=%u\n", cause);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit RADIO-STATUS for TLLI (10.3.5) */
+int bssgp_tx_radio_status_tlli(struct bssgp_bvc_ctx *bctx, uint8_t cause,
+				uint32_t tlli)
+{
+	struct msgb *msg = common_tx_radio_status(bctx);
+
+	if (!msg)
+		return -ENOMEM;
+	bssgp_msgb_tlli_put(msg, tlli);
+	LOGPC(DBSSGP, LOGL_NOTICE, "TLLI=0x%08x ", tlli);
+
+	return common_tx_radio_status2(msg, cause);
+}
+
+/*! \brief Transmit RADIO-STATUS for TMSI (10.3.5) */
+int bssgp_tx_radio_status_tmsi(struct bssgp_bvc_ctx *bctx, uint8_t cause,
+				uint32_t tmsi)
+{
+	struct msgb *msg = common_tx_radio_status(bctx);
+	uint32_t _tmsi = htonl(tmsi);
+
+	if (!msg)
+		return -ENOMEM;
+	msgb_tvlv_put(msg, BSSGP_IE_TMSI, 4, (uint8_t *)&_tmsi);
+	LOGPC(DBSSGP, LOGL_NOTICE, "TMSI=0x%08x ", tmsi);
+
+	return common_tx_radio_status2(msg, cause);
+}
+
+/*! \brief Transmit RADIO-STATUS for IMSI (10.3.5) */
+int bssgp_tx_radio_status_imsi(struct bssgp_bvc_ctx *bctx, uint8_t cause,
+				const char *imsi)
+{
+	struct msgb *msg = common_tx_radio_status(bctx);
+	uint8_t mi[10];
+	int imsi_len = gsm48_generate_mid_from_imsi(mi, imsi);
+
+	if (!msg)
+		return -ENOMEM;
+
+	/* strip the MI type and length values (2 bytes) */
+	if (imsi_len > 2)
+		msgb_tvlv_put(msg, BSSGP_IE_IMSI, imsi_len-2, mi+2);
+	LOGPC(DBSSGP, LOGL_NOTICE, "IMSI=%s ", imsi);
+
+	return common_tx_radio_status2(msg, cause);
+}
+
+/*! \brief Transmit FLUSH-LL-ACK (Chapter 10.4.2) */
+int bssgp_tx_flush_ll_ack(struct bssgp_bvc_ctx *bctx, uint32_t tlli,
+			   uint8_t action, uint16_t bvci_new,
+			   uint32_t num_octets)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci_new = htons(bvci_new);
+	uint32_t _oct_aff = htonl(num_octets & 0xFFFFFF);
+
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_FLUSH_LL_ACK;
+
+	bssgp_msgb_tlli_put(msg, tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_FLUSH_ACTION, 1, &action);
+	if (action == 1) /* transferred */
+		msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci_new);
+	msgb_tvlv_put(msg, BSSGP_IE_NUM_OCT_AFF, 3, (uint8_t *) &_oct_aff);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit LLC-DISCARDED (Chapter 10.4.3) */
+int bssgp_tx_llc_discarded(struct bssgp_bvc_ctx *bctx, uint32_t tlli,
+			   uint8_t num_frames, uint32_t num_octets)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci = htons(bctx->bvci);
+	uint32_t _oct_aff = htonl(num_octets & 0xFFFFFF);
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx LLC-DISCARDED "
+	     "TLLI=0x%04x, FRAMES=%u, OCTETS=%u\n", bctx->bvci, tlli,
+	     num_frames, num_octets);
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_LLC_DISCARD;
+
+	bssgp_msgb_tlli_put(msg, tlli);
+
+	msgb_tvlv_put(msg, BSSGP_IE_LLC_FRAMES_DISCARDED, 1, &num_frames);
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_NUM_OCT_AFF, 3, ((uint8_t *) &_oct_aff) + 1);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit a BVC-BLOCK message (Chapter 10.4.8) */
+int bssgp_tx_bvc_block(struct bssgp_bvc_ctx *bctx, uint8_t cause)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci = htons(bctx->bvci);
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx BVC-BLOCK "
+	     "CAUSE=%u\n", bctx->bvci, cause);
+
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_BVC_BLOCK;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, &cause);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit a BVC-UNBLOCK message (Chapter 10.4.10) */
+int bssgp_tx_bvc_unblock(struct bssgp_bvc_ctx *bctx)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci = htons(bctx->bvci);
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx BVC-BLOCK\n", bctx->bvci);
+
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_BVC_UNBLOCK;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit a BVC-RESET message (Chapter 10.4.12) */
+int bssgp_tx_bvc_reset(struct bssgp_bvc_ctx *bctx, uint16_t bvci, uint8_t cause)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci = htons(bvci);
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx BVC-RESET "
+	     "CAUSE=%u\n", bvci, cause);
+
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_BVC_RESET;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, &cause);
+	if (bvci != BVCI_PTM) {
+		uint8_t bssgp_cid[8];
+		bssgp_create_cell_id(bssgp_cid, &bctx->ra_id, bctx->cell_id);
+		msgb_tvlv_put(msg, BSSGP_IE_CELL_ID, sizeof(bssgp_cid), bssgp_cid);
+	}
+	/* Optional: Feature Bitmap */
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+
+/*! \brief RL-UL-UNITDATA.req (Chapter 10.2.2) */
+int bssgp_tx_ul_ud(struct bssgp_bvc_ctx *bctx, uint32_t tlli,
+		   const uint8_t *qos_profile, struct msgb *llc_pdu)
+{
+	struct msgb *msg = llc_pdu;
+	uint8_t bssgp_cid[8];
+	struct bssgp_ud_hdr *budh;
+
+	/* FIXME: First push alignment octets, if rqd */
+
+	/* FIXME: Optional LSA Identifier List, PFI */
+
+	/* Cell Identifier */
+	bssgp_create_cell_id(bssgp_cid, &bctx->ra_id, bctx->cell_id);
+	msgb_tvlv_push(msg, BSSGP_IE_CELL_ID, sizeof(bssgp_cid), bssgp_cid);
+
+	/* User Data Header */
+	budh = (struct bssgp_ud_hdr *) msgb_push(msg, sizeof(*budh));
+	budh->tlli = htonl(tlli);
+	memcpy(budh->qos_profile, qos_profile, 3);
+	budh->pdu_type = BSSGP_PDUT_UL_UNITDATA;
+
+	/* set NSEI and BVCI in msgb cb */
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = bctx->bvci;
+
+	rate_ctr_inc(&bctx->ctrg->ctr[BSSGP_CTR_PKTS_OUT]);
+	rate_ctr_add(&bctx->ctrg->ctr[BSSGP_CTR_BYTES_OUT], msg->len);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* Parse a single GMM-PAGING.req to a given NSEI/NS-BVCI */
+int bssgp_rx_paging(struct bssgp_paging_info *pinfo,
+		    struct msgb *msg)
+{
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	struct tlv_parsed tp;
+	uint8_t ra[6];
+	int rc, data_len;
+
+	memset(ra, 0, sizeof(ra));
+
+	data_len = msgb_bssgp_len(msg) - sizeof(*bgph);
+	rc = bssgp_tlv_parse(&tp, bgph->data, data_len);
+	if (rc < 0)
+		goto err_mand_ie;
+
+	switch (bgph->pdu_type) {
+	case BSSGP_PDUT_PAGING_PS:
+		pinfo->mode = BSSGP_PAGING_PS;
+		break;
+	case BSSGP_PDUT_PAGING_CS:
+		pinfo->mode = BSSGP_PAGING_CS;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* IMSI */
+	if (!TLVP_PRESENT(&tp, BSSGP_IE_IMSI))
+		goto err_mand_ie;
+	if (!pinfo->imsi)
+		pinfo->imsi = talloc_zero_size(pinfo, 16);
+	gsm48_mi_to_string(pinfo->imsi, sizeof(pinfo->imsi),
+			   TLVP_VAL(&tp, BSSGP_IE_IMSI),
+			   TLVP_LEN(&tp, BSSGP_IE_IMSI));
+
+	/* DRX Parameters */
+	if (!TLVP_PRESENT(&tp, BSSGP_IE_DRX_PARAMS))
+		goto err_mand_ie;
+	pinfo->drx_params = ntohs(*(uint16_t *)TLVP_VAL(&tp, BSSGP_IE_DRX_PARAMS));
+
+	/* Scope */
+	if (TLVP_PRESENT(&tp, BSSGP_IE_BSS_AREA_ID)) {
+		pinfo->scope = BSSGP_PAGING_BSS_AREA;
+	} else if (TLVP_PRESENT(&tp, BSSGP_IE_LOCATION_AREA)) {
+		pinfo->scope = BSSGP_PAGING_LOCATION_AREA;
+		memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA),
+			TLVP_LEN(&tp, BSSGP_IE_LOCATION_AREA));
+		gsm48_parse_ra(&pinfo->raid, ra);
+	} else if (TLVP_PRESENT(&tp, BSSGP_IE_ROUTEING_AREA)) {
+		pinfo->scope = BSSGP_PAGING_ROUTEING_AREA;
+		memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA),
+			TLVP_LEN(&tp, BSSGP_IE_ROUTEING_AREA));
+		gsm48_parse_ra(&pinfo->raid, ra);
+	} else if (TLVP_PRESENT(&tp, BSSGP_IE_BVCI)) {
+		pinfo->scope = BSSGP_PAGING_BVCI;
+		pinfo->bvci = ntohs(*(uint16_t *)TLVP_VAL(&tp, BSSGP_IE_BVCI));
+	} else
+		return -EINVAL;
+
+	/* QoS profile mandatory for PS */
+	if (pinfo->mode == BSSGP_PAGING_PS) {
+		if (!TLVP_PRESENT(&tp, BSSGP_IE_QOS_PROFILE))
+			goto err_cond_ie;
+		if (TLVP_LEN(&tp, BSSGP_IE_QOS_PROFILE) < 3)
+			goto err;
+
+		memcpy(&pinfo->qos, TLVP_VAL(&tp, BSSGP_IE_QOS_PROFILE),
+			3);
+	}
+
+	/* Optional (P-)TMSI */
+	if (TLVP_PRESENT(&tp, BSSGP_IE_TMSI) &&
+	    TLVP_LEN(&tp, BSSGP_IE_TMSI) >= 4)
+		if (!pinfo->ptmsi)
+			pinfo->ptmsi = talloc_zero_size(pinfo, sizeof(uint32_t));
+		*(pinfo->ptmsi) = ntohl(*(uint32_t *)
+					TLVP_VAL(&tp, BSSGP_IE_TMSI));
+
+	return 0;
+
+err_mand_ie:
+err_cond_ie:
+err:
+	/* FIXME */
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_bssgp_util.c b/src/shared/libosmocore/src/gb/gprs_bssgp_util.c
new file mode 100644
index 00000000..ae4647ef
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_bssgp_util.c
@@ -0,0 +1,117 @@
+/* GPRS BSSGP protocol implementation as per 3GPP TS 08.18 */
+
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <errno.h>
+#include <stdint.h>
+
+#include <netinet/in.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+#include "common_vty.h"
+
+struct gprs_ns_inst *bssgp_nsi;
+
+/* BSSGP Protocol specific, not implementation specific */
+/* FIXME: This needs to go into libosmocore after finished */
+
+/* Chapter 11.3.9 / Table 11.10: Cause coding */
+static const struct value_string bssgp_cause_strings[] = {
+	{ BSSGP_CAUSE_PROC_OVERLOAD,	"Processor overload" },
+	{ BSSGP_CAUSE_EQUIP_FAIL,	"Equipment Failure" },
+	{ BSSGP_CAUSE_TRASIT_NET_FAIL,	"Transit netowkr service failure" },
+	{ BSSGP_CAUSE_CAPA_GREATER_0KPBS,"Transmission capacity modified" },
+	{ BSSGP_CAUSE_UNKNOWN_MS,	"Unknown MS" },
+	{ BSSGP_CAUSE_UNKNOWN_BVCI,	"Unknown BVCI" },
+	{ BSSGP_CAUSE_CELL_TRAF_CONG,	"Cell traffic congestion" },
+	{ BSSGP_CAUSE_SGSN_CONG,	"SGSN congestion" },
+	{ BSSGP_CAUSE_OML_INTERV,	"O&M intervention" },
+	{ BSSGP_CAUSE_BVCI_BLOCKED,	"BVCI blocked" },
+	{ BSSGP_CAUSE_PFC_CREATE_FAIL,	"PFC create failure" },
+	{ BSSGP_CAUSE_SEM_INCORR_PDU,	"Semantically incorrect PDU" },
+	{ BSSGP_CAUSE_INV_MAND_INF,	"Invalid mandatory information" },
+	{ BSSGP_CAUSE_MISSING_MAND_IE,	"Missing mandatory IE" },
+	{ BSSGP_CAUSE_MISSING_COND_IE,	"Missing conditional IE" },
+	{ BSSGP_CAUSE_UNEXP_COND_IE,	"Unexpected conditional IE" },
+	{ BSSGP_CAUSE_COND_IE_ERR,	"Conditional IE error" },
+	{ BSSGP_CAUSE_PDU_INCOMP_STATE,	"PDU incompatible with protocol state" },
+	{ BSSGP_CAUSE_PROTO_ERR_UNSPEC,	"Protocol error - unspecified" },
+	{ BSSGP_CAUSE_PDU_INCOMP_FEAT, 	"PDU not compatible with feature set" },
+	{ 0, NULL },
+};
+
+const char *bssgp_cause_str(enum gprs_bssgp_cause cause)
+{
+	return get_value_string(bssgp_cause_strings, cause);
+}
+
+
+struct msgb *bssgp_msgb_alloc(void)
+{
+	return msgb_alloc_headroom(4096, 128, "BSSGP");
+}
+
+/* Transmit a simple response such as BLOCK/UNBLOCK/RESET ACK/NACK */
+int bssgp_tx_simple_bvci(uint8_t pdu_type, uint16_t nsei,
+			 uint16_t bvci, uint16_t ns_bvci)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci;
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = ns_bvci;
+
+	bgph->pdu_type = pdu_type;
+	_bvci = htons(bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* Chapter 10.4.14: Status */
+int bssgp_tx_status(uint8_t cause, uint16_t *bvci, struct msgb *orig_msg)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP BVCI=%u Tx STATUS, cause=%s\n",
+		bvci ? *bvci : 0, bssgp_cause_str(cause));
+	msgb_nsei(msg) = msgb_nsei(orig_msg);
+	msgb_bvci(msg) = 0;
+
+	bgph->pdu_type = BSSGP_PDUT_STATUS;
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, &cause);
+	if (bvci) {
+		uint16_t _bvci = htons(*bvci);
+		msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	}
+	msgb_tvlv_put(msg, BSSGP_IE_PDU_IN_ERROR,
+		      msgb_bssgp_len(orig_msg), msgb_bssgph(orig_msg));
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_bssgp_vty.c b/src/shared/libosmocore/src/gb/gprs_bssgp_vty.c
new file mode 100644
index 00000000..d8e1d32f
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_bssgp_vty.c
@@ -0,0 +1,198 @@
+/* VTY interface for our GPRS BSS Gateway Protocol (BSSGP) implementation */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stdint.h>
+
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/gprs/gprs_ns.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+
+#include <osmocom/vty/vty.h>
+#include <osmocom/vty/command.h>
+#include <osmocom/vty/logging.h>
+#include <osmocom/vty/telnet_interface.h>
+#include <osmocom/vty/misc.h>
+
+#include "common_vty.h"
+
+/* FIXME: this should go to some common file as it is copied
+ * in vty_interface.c of the BSC */
+static const struct value_string gprs_bssgp_timer_strs[] = {
+	{ 0, NULL }
+};
+
+static void log_set_bvc_filter(struct log_target *target,
+				struct bssgp_bvc_ctx *bctx)
+{
+	if (bctx) {
+		target->filter_map |= (1 << FLT_BVC);
+		target->filter_data[FLT_BVC] = bctx;
+	} else if (target->filter_data[FLT_NSVC]) {
+		target->filter_map = ~(1 << FLT_BVC);
+		target->filter_data[FLT_BVC] = NULL;
+	}
+}
+
+static struct cmd_node bssgp_node = {
+	L_BSSGP_NODE,
+	"%s(bssgp)#",
+	1,
+};
+
+static int config_write_bssgp(struct vty *vty)
+{
+	vty_out(vty, "bssgp%s", VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_bssgp, cfg_bssgp_cmd,
+      "bssgp",
+      "Configure the GPRS BSS Gateway Protocol")
+{
+	vty->node = L_BSSGP_NODE;
+	return CMD_SUCCESS;
+}
+
+static void dump_bvc(struct vty *vty, struct bssgp_bvc_ctx *bvc, int stats)
+{
+	vty_out(vty, "NSEI %5u, BVCI %5u, RA-ID: %u-%u-%u-%u, CID: %u, "
+		"STATE: %s%s", bvc->nsei, bvc->bvci, bvc->ra_id.mcc,
+		bvc->ra_id.mnc, bvc->ra_id.lac, bvc->ra_id.rac, bvc->cell_id,
+		bvc->state & BVC_S_BLOCKED ? "BLOCKED" : "UNBLOCKED",
+		VTY_NEWLINE);
+
+	if (stats) {
+		struct bssgp_flow_control *fc = bvc->fc;
+
+		vty_out_rate_ctr_group(vty, " ", bvc->ctrg);
+
+		if (fc)
+			vty_out(vty, "FC-BVC(bucket_max: %uoct, leak_rate: "
+				"%uoct/s, cur_tokens: %uoct, max_q_d: %u, "
+				"cur_q_d: %u)\n", fc->bucket_size_max,
+				fc->bucket_leak_rate, fc->bucket_counter,
+				fc->max_queue_depth, fc->queue_depth);
+	}
+}
+
+static void dump_bssgp(struct vty *vty, int stats)
+{
+	struct bssgp_bvc_ctx *bvc;
+
+	llist_for_each_entry(bvc, &bssgp_bvc_ctxts, list) {
+		dump_bvc(vty, bvc, stats);
+	}
+}
+
+#define BSSGP_STR "Show information about the BSSGP protocol\n"
+
+DEFUN(show_bssgp, show_bssgp_cmd, "show bssgp",
+	SHOW_STR BSSGP_STR)
+{
+	dump_bssgp(vty, 0);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_bssgp_stats, show_bssgp_stats_cmd, "show bssgp stats",
+	SHOW_STR BSSGP_STR
+	"Include statistics\n")
+{
+	dump_bssgp(vty, 1);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_bvc, show_bvc_cmd, "show bssgp nsei <0-65535> [stats]",
+	SHOW_STR BSSGP_STR
+	"Show all BVCs on one NSE\n"
+	"The NSEI\n" "Include Statistics\n")
+{
+	struct bssgp_bvc_ctx *bvc;
+	uint16_t nsei = atoi(argv[1]);
+	int show_stats = 0;
+
+	if (argc >= 2)
+		show_stats = 1;
+
+	llist_for_each_entry(bvc, &bssgp_bvc_ctxts, list) {
+		if (bvc->nsei != nsei)
+			continue;
+		dump_bvc(vty, bvc, show_stats);
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(logging_fltr_bvc,
+      logging_fltr_bvc_cmd,
+      "logging filter bvc nsei <0-65535> bvci <0-65535>",
+	LOGGING_STR FILTER_STR
+	"Filter based on BSSGP Virtual Connection\n"
+	"NSEI of the BVC to be filtered\n"
+	"Network Service Entity Identifier (NSEI)\n"
+	"BVCI of the BVC to be filtered\n"
+	"BSSGP Virtual Connection Identifier (BVCI)\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+	struct bssgp_bvc_ctx *bvc;
+	uint16_t nsei = atoi(argv[0]);
+	uint16_t bvci = atoi(argv[1]);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	bvc = btsctx_by_bvci_nsei(bvci, nsei);
+	if (!bvc) {
+		vty_out(vty, "No BVC by that identifier%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	log_set_bvc_filter(tgt, bvc);
+	return CMD_SUCCESS;
+}
+
+int bssgp_vty_init(void)
+{
+	install_element_ve(&show_bssgp_cmd);
+	install_element_ve(&show_bssgp_stats_cmd);
+	install_element_ve(&show_bvc_cmd);
+	install_element_ve(&logging_fltr_bvc_cmd);
+
+	install_element(CFG_LOG_NODE, &logging_fltr_bvc_cmd);
+
+	install_element(CONFIG_NODE, &cfg_bssgp_cmd);
+	install_node(&bssgp_node, config_write_bssgp);
+	install_default(L_BSSGP_NODE);
+	install_element(L_BSSGP_NODE, &libgb_exit_cmd);
+	install_element(L_BSSGP_NODE, &libgb_end_cmd);
+	//install_element(L_BSSGP_NODE, &cfg_bssgp_timer_cmd);
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_ns.c b/src/shared/libosmocore/src/gb/gprs_ns.c
new file mode 100644
index 00000000..aa7ff939
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_ns.c
@@ -0,0 +1,1105 @@
+/* GPRS Networks Service (NS) messages on the Gb interface
+ * 3GPP TS 08.16 version 8.0.1 Release 1999 / ETSI TS 101 299 V8.0.1 (2002-05) */
+
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/*! \addtogroup libgb
+ *  @{
+ */
+
+/*! \file gprs_ns.c */
+
+/*!
+ * GPRS Networks Service (NS) messages on the Gb interface
+ * 3GPP TS 08.16 version 8.0.1 Release 1999 / ETSI TS 101 299 V8.0.1 (2002-05) 
+ *
+ * Some introduction into NS:  NS is used typically on top of frame relay,
+ * but in the ip.access world it is encapsulated in UDP packets.  It serves
+ * as an intermediate shim betwen BSSGP and the underlying medium.  It doesn't
+ * do much, apart from providing congestion notification and status indication.
+ *
+ * Terms:
+ * 	NS		Network Service
+ *	NSVC		NS Virtual Connection
+ *	NSEI		NS Entity Identifier
+ *	NSVL		NS Virtual Link
+ *	NSVLI		NS Virtual Link Identifier
+ *	BVC		BSSGP Virtual Connection
+ *	BVCI		BSSGP Virtual Connection Identifier
+ *	NSVCG		NS Virtual Connection Goup
+ *	Blocked		NS-VC cannot be used for user traffic
+ *	Alive		Ability of a NS-VC to provide communication
+ *
+ *  There can be multiple BSSGP virtual connections over one (group of) NSVC's.  BSSGP will
+ * therefore identify the BSSGP virtual connection by a BVCI passed down to NS.
+ * NS then has to firgure out which NSVC's are responsible for this BVCI.
+ * Those mappings are administratively configured.
+ */
+
+/* This implementation has the following limitations:
+ *  o Only one NS-VC for each NSE: No load-sharing function
+ *  o NSVCI 65535 and 65534 are reserved for internal use
+ *  o Only UDP is supported as of now, no frame relay support
+ *  o The IP Sub-Network-Service (SNS) as specified in 48.016 is not implemented
+ *  o There are no BLOCK and UNBLOCK timers (yet?)
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stdint.h>
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/gprs/gprs_ns.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_ns_frgre.h>
+
+#include "common_vty.h"
+
+static const struct tlv_definition ns_att_tlvdef = {
+	.def = {
+		[NS_IE_CAUSE]	= { TLV_TYPE_TvLV, 0 },
+		[NS_IE_VCI]	= { TLV_TYPE_TvLV, 0 },
+		[NS_IE_PDU]	= { TLV_TYPE_TvLV, 0 },
+		[NS_IE_BVCI]	= { TLV_TYPE_TvLV, 0 },
+		[NS_IE_NSEI]	= { TLV_TYPE_TvLV, 0 },
+	},
+};
+
+enum ns_ctr {
+	NS_CTR_PKTS_IN,
+	NS_CTR_PKTS_OUT,
+	NS_CTR_BYTES_IN,
+	NS_CTR_BYTES_OUT,
+	NS_CTR_BLOCKED,
+	NS_CTR_DEAD,
+};
+
+static const struct rate_ctr_desc nsvc_ctr_description[] = {
+	{ "packets.in", "Packets at NS Level ( In)" },
+	{ "packets.out","Packets at NS Level (Out)" },
+	{ "bytes.in",	"Bytes at NS Level   ( In)" },
+	{ "bytes.out",	"Bytes at NS Level   (Out)" },
+	{ "blocked",	"NS-VC Block count        " },
+	{ "dead",	"NS-VC gone dead count    " },
+};
+
+static const struct rate_ctr_group_desc nsvc_ctrg_desc = {
+	.group_name_prefix = "ns.nsvc",
+	.group_description = "NSVC Peer Statistics",
+	.num_ctr = ARRAY_SIZE(nsvc_ctr_description),
+	.ctr_desc = nsvc_ctr_description,
+};
+
+/*! \brief Lookup struct gprs_nsvc based on NSVCI
+ *  \param[in] nsi NS instance in which to search
+ *  \param[in] nsvci NSVCI to be searched
+ *  \returns gprs_nsvc of respective NSVCI
+ */
+struct gprs_nsvc *gprs_nsvc_by_nsvci(struct gprs_ns_inst *nsi, uint16_t nsvci)
+{
+	struct gprs_nsvc *nsvc;
+	llist_for_each_entry(nsvc, &nsi->gprs_nsvcs, list) {
+		if (nsvc->nsvci == nsvci)
+			return nsvc;
+	}
+	return NULL;
+}
+
+/*! \brief Lookup struct gprs_nsvc based on NSEI
+ *  \param[in] nsi NS instance in which to search
+ *  \param[in] nsei NSEI to be searched
+ *  \returns gprs_nsvc of respective NSEI
+ */
+struct gprs_nsvc *gprs_nsvc_by_nsei(struct gprs_ns_inst *nsi, uint16_t nsei)
+{
+	struct gprs_nsvc *nsvc;
+	llist_for_each_entry(nsvc, &nsi->gprs_nsvcs, list) {
+		if (nsvc->nsei == nsei)
+			return nsvc;
+	}
+	return NULL;
+}
+
+/* Lookup struct gprs_nsvc based on remote peer socket addr */
+static struct gprs_nsvc *nsvc_by_rem_addr(struct gprs_ns_inst *nsi,
+					  struct sockaddr_in *sin)
+{
+	struct gprs_nsvc *nsvc;
+	llist_for_each_entry(nsvc, &nsi->gprs_nsvcs, list) {
+		if (nsvc->ip.bts_addr.sin_addr.s_addr ==
+					sin->sin_addr.s_addr &&
+		    nsvc->ip.bts_addr.sin_port == sin->sin_port)
+			return nsvc;
+	}
+	return NULL;
+}
+
+static void gprs_ns_timer_cb(void *data);
+
+struct gprs_nsvc *gprs_nsvc_create(struct gprs_ns_inst *nsi, uint16_t nsvci)
+{
+	struct gprs_nsvc *nsvc;
+
+	LOGP(DNS, LOGL_INFO, "NSVCI=%u Creating NS-VC\n", nsvci);
+
+	nsvc = talloc_zero(nsi, struct gprs_nsvc);
+	nsvc->nsvci = nsvci;
+	/* before RESET procedure: BLOCKED and DEAD */
+	nsvc->state = NSE_S_BLOCKED;
+	nsvc->nsi = nsi;
+	nsvc->timer.cb = gprs_ns_timer_cb;
+	nsvc->timer.data = nsvc;
+	nsvc->ctrg = rate_ctr_group_alloc(nsvc, &nsvc_ctrg_desc, nsvci);
+
+	llist_add(&nsvc->list, &nsi->gprs_nsvcs);
+
+	return nsvc;
+}
+
+/*! \brief Delete given NS-VC
+ *  \param[in] nsvc gprs_nsvc to be deleted
+ */
+void gprs_nsvc_delete(struct gprs_nsvc *nsvc)
+{
+	if (osmo_timer_pending(&nsvc->timer))
+		osmo_timer_del(&nsvc->timer);
+	llist_del(&nsvc->list);
+	talloc_free(nsvc);
+}
+
+static void ns_osmo_signal_dispatch(struct gprs_nsvc *nsvc, unsigned int signal,
+			       uint8_t cause)
+{
+	struct ns_signal_data nssd;
+
+	nssd.nsvc = nsvc;
+	nssd.cause = cause;
+
+	osmo_signal_dispatch(SS_L_NS, signal, &nssd);
+}
+
+/* Section 10.3.2, Table 13 */
+static const struct value_string ns_cause_str[] = {
+	{ NS_CAUSE_TRANSIT_FAIL,	"Transit network failure" },
+	{ NS_CAUSE_OM_INTERVENTION, 	"O&M intervention" },
+	{ NS_CAUSE_EQUIP_FAIL,		"Equipment failure" },
+	{ NS_CAUSE_NSVC_BLOCKED,	"NS-VC blocked" },
+	{ NS_CAUSE_NSVC_UNKNOWN,	"NS-VC unknown" },
+	{ NS_CAUSE_BVCI_UNKNOWN,	"BVCI unknown" },
+	{ NS_CAUSE_SEM_INCORR_PDU,	"Semantically incorrect PDU" },
+	{ NS_CAUSE_PDU_INCOMP_PSTATE,	"PDU not compatible with protocol state" },
+	{ NS_CAUSE_PROTO_ERR_UNSPEC,	"Protocol error, unspecified" },
+	{ NS_CAUSE_INVAL_ESSENT_IE,	"Invalid essential IE" },
+	{ NS_CAUSE_MISSING_ESSENT_IE,	"Missing essential IE" },
+	{ 0, NULL }
+};
+
+/*! \brief Obtain a human-readable string for NS cause value */
+const char *gprs_ns_cause_str(enum ns_cause cause)
+{
+	return get_value_string(ns_cause_str, cause);
+}
+
+static int nsip_sendmsg(struct gprs_nsvc *nsvc, struct msgb *msg);
+extern int grps_ns_frgre_sendmsg(struct gprs_nsvc *nsvc, struct msgb *msg);
+
+static int gprs_ns_tx(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	int ret;
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	/* Increment number of Uplink bytes */
+	rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_PKTS_OUT]);
+	rate_ctr_add(&nsvc->ctrg->ctr[NS_CTR_BYTES_OUT], msgb_l2len(msg));
+
+	switch (nsvc->ll) {
+	case GPRS_NS_LL_UDP:
+		ret = nsip_sendmsg(nsvc, msg);
+		break;
+	case GPRS_NS_LL_FR_GRE:
+		ret = gprs_ns_frgre_sendmsg(nsvc, msg);
+		break;
+	default:
+		LOGP(DNS, LOGL_ERROR, "unsupported NS linklayer %u\n", nsvc->ll);
+		msgb_free(msg);
+		ret = -EIO;
+		break;
+	}
+	return ret;
+}
+
+static int gprs_ns_tx_simple(struct gprs_nsvc *nsvc, uint8_t pdu_type)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	if (!msg)
+		return -ENOMEM;
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+
+	nsh->pdu_type = pdu_type;
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/*! \brief Transmit a NS-RESET on a given NSVC
+ *  \param[in] nsvc NS-VC used for transmission
+ *  \paam[in] cause Numeric NS cause value
+ */
+int gprs_ns_tx_reset(struct gprs_nsvc *nsvc, uint8_t cause)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+	uint16_t nsvci = htons(nsvc->nsvci);
+	uint16_t nsei = htons(nsvc->nsei);
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	if (!msg)
+		return -ENOMEM;
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Tx NS RESET (NSVCI=%u, cause=%s)\n",
+		nsvc->nsei, nsvc->nsvci, gprs_ns_cause_str(cause));
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+	nsh->pdu_type = NS_PDUT_RESET;
+
+	msgb_tvlv_put(msg, NS_IE_CAUSE, 1, &cause);
+	msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *) &nsvci);
+	msgb_tvlv_put(msg, NS_IE_NSEI, 2, (uint8_t *) &nsei);
+
+	return gprs_ns_tx(nsvc, msg);
+
+}
+
+/*! \brief Transmit a NS-STATUS on a given NSVC
+ *  \param[in] nsvc NS-VC to be used for transmission
+ *  \param[in] cause Numeric NS cause value
+ *  \param[in] bvci BVCI to be reset within NSVC
+ *  \param[in] orig_msg message causing the STATUS */
+int gprs_ns_tx_status(struct gprs_nsvc *nsvc, uint8_t cause,
+		      uint16_t bvci, struct msgb *orig_msg)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+	uint16_t nsvci = htons(nsvc->nsvci);
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	bvci = htons(bvci);
+
+	if (!msg)
+		return -ENOMEM;
+
+	LOGP(DNS, LOGL_NOTICE, "NSEI=%u Tx NS STATUS (NSVCI=%u, cause=%s)\n",
+		nsvc->nsei, nsvc->nsvci, gprs_ns_cause_str(cause));
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+	nsh->pdu_type = NS_PDUT_STATUS;
+
+	msgb_tvlv_put(msg, NS_IE_CAUSE, 1, &cause);
+
+	/* Section 9.2.7.1: Static conditions for NS-VCI */
+	if (cause == NS_CAUSE_NSVC_BLOCKED ||
+	    cause == NS_CAUSE_NSVC_UNKNOWN)
+		msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *)&nsvci);
+
+	/* Section 9.2.7.2: Static conditions for NS PDU */
+	switch (cause) {
+	case NS_CAUSE_SEM_INCORR_PDU:
+	case NS_CAUSE_PDU_INCOMP_PSTATE:
+	case NS_CAUSE_PROTO_ERR_UNSPEC:
+	case NS_CAUSE_INVAL_ESSENT_IE:
+	case NS_CAUSE_MISSING_ESSENT_IE:
+		msgb_tvlv_put(msg, NS_IE_PDU, msgb_l2len(orig_msg),
+			      orig_msg->l2h);
+		break;
+	default:
+		break;
+	}
+
+	/* Section 9.2.7.3: Static conditions for BVCI */
+	if (cause == NS_CAUSE_BVCI_UNKNOWN)
+		msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *)&bvci);
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/*! \brief Transmit a NS-BLOCK on a tiven NS-VC
+ *  \param[in] nsvc NS-VC on which the NS-BLOCK is to be transmitted
+ *  \param[in] cause Numeric NS Cause value
+ *  \returns 0 in case of success
+ */
+int gprs_ns_tx_block(struct gprs_nsvc *nsvc, uint8_t cause)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+	uint16_t nsvci = htons(nsvc->nsvci);
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	if (!msg)
+		return -ENOMEM;
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Tx NS BLOCK (NSVCI=%u, cause=%s)\n",
+		nsvc->nsei, nsvc->nsvci, gprs_ns_cause_str(cause));
+
+	/* be conservative and mark it as blocked even now! */
+	nsvc->state |= NSE_S_BLOCKED;
+	rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_BLOCKED]);
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+	nsh->pdu_type = NS_PDUT_BLOCK;
+
+	msgb_tvlv_put(msg, NS_IE_CAUSE, 1, &cause);
+	msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *) &nsvci);
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/*! \brief Transmit a NS-UNBLOCK on a given NS-VC
+ *  \param[in] nsvc NS-VC on which the NS-UNBLOCK is to be transmitted
+ *  \returns 0 in case of success
+ */
+int gprs_ns_tx_unblock(struct gprs_nsvc *nsvc)
+{
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Tx NS UNBLOCK (NSVCI=%u)\n",
+		nsvc->nsei, nsvc->nsvci);
+
+	return gprs_ns_tx_simple(nsvc, NS_PDUT_UNBLOCK);
+}
+
+/*! \brief Transmit a NS-ALIVE on a given NS-VC
+ *  \param[in] nsvc NS-VC on which the NS-ALIVE is to be transmitted
+ *  \returns 0 in case of success
+ */
+int gprs_ns_tx_alive(struct gprs_nsvc *nsvc)
+{
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	LOGP(DNS, LOGL_DEBUG, "NSEI=%u Tx NS ALIVE (NSVCI=%u)\n",
+		nsvc->nsei, nsvc->nsvci);
+
+	return gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE);
+}
+
+/*! \brief Transmit a NS-ALIVE-ACK on a given NS-VC
+ *  \param[in] nsvc NS-VC on which the NS-ALIVE-ACK is to be transmitted
+ *  \returns 0 in case of success
+ */
+int gprs_ns_tx_alive_ack(struct gprs_nsvc *nsvc)
+{
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	LOGP(DNS, LOGL_DEBUG, "NSEI=%u Tx NS ALIVE_ACK (NSVCI=%u)\n",
+		nsvc->nsei, nsvc->nsvci);
+
+	return gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE_ACK);
+}
+
+static const enum ns_timeout timer_mode_tout[_NSVC_TIMER_NR] = {
+	[NSVC_TIMER_TNS_RESET]	= NS_TOUT_TNS_RESET,
+	[NSVC_TIMER_TNS_ALIVE]	= NS_TOUT_TNS_ALIVE,
+	[NSVC_TIMER_TNS_TEST]	= NS_TOUT_TNS_TEST,
+};
+
+static const struct value_string timer_mode_strs[] = {
+	{ NSVC_TIMER_TNS_RESET, "tns-reset" },
+	{ NSVC_TIMER_TNS_ALIVE, "tns-alive" },
+	{ NSVC_TIMER_TNS_TEST, "tns-test" },
+	{ 0, NULL }
+};
+
+static void nsvc_start_timer(struct gprs_nsvc *nsvc, enum nsvc_timer_mode mode)
+{
+	enum ns_timeout tout = timer_mode_tout[mode];
+	unsigned int seconds = nsvc->nsi->timeout[tout];
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	DEBUGP(DNS, "NSEI=%u Starting timer in mode %s (%u seconds)\n",
+		nsvc->nsei, get_value_string(timer_mode_strs, mode),
+		seconds);
+		
+	if (osmo_timer_pending(&nsvc->timer))
+		osmo_timer_del(&nsvc->timer);
+
+	nsvc->timer_mode = mode;
+	osmo_timer_schedule(&nsvc->timer, seconds, 0);
+}
+
+static void gprs_ns_timer_cb(void *data)
+{
+	struct gprs_nsvc *nsvc = data;
+	enum ns_timeout tout = timer_mode_tout[nsvc->timer_mode];
+	unsigned int seconds = nsvc->nsi->timeout[tout];
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	DEBUGP(DNS, "NSEI=%u Timer expired in mode %s (%u seconds)\n",
+		nsvc->nsei, get_value_string(timer_mode_strs, nsvc->timer_mode),
+		seconds);
+		
+	switch (nsvc->timer_mode) {
+	case NSVC_TIMER_TNS_ALIVE:
+		/* Tns-alive case: we expired without response ! */
+		nsvc->alive_retries++;
+		if (nsvc->alive_retries >
+			nsvc->nsi->timeout[NS_TOUT_TNS_ALIVE_RETRIES]) {
+			/* mark as dead and blocked */
+			nsvc->state = NSE_S_BLOCKED;
+			rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_BLOCKED]);
+			rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_DEAD]);
+			LOGP(DNS, LOGL_NOTICE,
+				"NSEI=%u Tns-alive expired more then "
+				"%u times, blocking NS-VC\n", nsvc->nsei,
+				nsvc->nsi->timeout[NS_TOUT_TNS_ALIVE_RETRIES]);
+			ns_osmo_signal_dispatch(nsvc, S_NS_ALIVE_EXP, 0);
+			ns_osmo_signal_dispatch(nsvc, S_NS_BLOCK, NS_CAUSE_NSVC_BLOCKED);
+			return;
+		}
+		/* Tns-test case: send NS-ALIVE PDU */
+		gprs_ns_tx_alive(nsvc);
+		/* start Tns-alive timer */
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_ALIVE);
+		break;
+	case NSVC_TIMER_TNS_TEST:
+		/* Tns-test case: send NS-ALIVE PDU */
+		gprs_ns_tx_alive(nsvc);
+		/* start Tns-alive timer (transition into faster
+		 * alive retransmissions) */
+		nsvc->alive_retries = 0;
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_ALIVE);
+		break;
+	case NSVC_TIMER_TNS_RESET:
+		/* Chapter 7.3: Re-send the RESET */
+		gprs_ns_tx_reset(nsvc, NS_CAUSE_OM_INTERVENTION);
+		/* Re-start Tns-reset timer */
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_RESET);
+		break;
+	case _NSVC_TIMER_NR:
+		break;
+	}
+}
+
+/* Section 9.2.6 */
+static int gprs_ns_tx_reset_ack(struct gprs_nsvc *nsvc)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+	uint16_t nsvci, nsei;
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	if (!msg)
+		return -ENOMEM;
+
+	nsvci = htons(nsvc->nsvci);
+	nsei = htons(nsvc->nsei);
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+
+	nsh->pdu_type = NS_PDUT_RESET_ACK;
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Tx NS RESET ACK (NSVCI=%u)\n",
+		nsvc->nsei, nsvc->nsvci);
+
+	msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *)&nsvci);
+	msgb_tvlv_put(msg, NS_IE_NSEI, 2, (uint8_t *)&nsei);
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/*! \brief High-level function for transmitting a NS-UNITDATA messsage
+ *  \param[in] nsi NS-instance on which we shall transmit
+ *  \param[in] msg struct msgb to be trasnmitted
+ *
+ * This function obtains the NS-VC by the msgb_nsei(msg) and then checks
+ * if the NS-VC is ALIVEV and not BLOCKED.  After that, it adds a NS
+ * header for the NS-UNITDATA message type and sends it off.
+ *
+ * Section 9.2.10: transmit side / NS-UNITDATA-REQUEST primitive 
+ */
+int gprs_ns_sendmsg(struct gprs_ns_inst *nsi, struct msgb *msg)
+{
+	struct gprs_nsvc *nsvc;
+	struct gprs_ns_hdr *nsh;
+	uint16_t bvci = msgb_bvci(msg);
+
+	nsvc = gprs_nsvc_by_nsei(nsi, msgb_nsei(msg));
+	if (!nsvc) {
+		LOGP(DNS, LOGL_ERROR, "Unable to resolve NSEI %u "
+			"to NS-VC!\n", msgb_nsei(msg));
+		msgb_free(msg);
+		return -EINVAL;
+	}
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	if (!(nsvc->state & NSE_S_ALIVE)) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u is not alive, cannot send\n",
+			nsvc->nsei);
+		msgb_free(msg);
+		return -EBUSY;
+	}
+	if (nsvc->state & NSE_S_BLOCKED) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u is blocked, cannot send\n",
+			nsvc->nsei);
+		msgb_free(msg);
+		return -EBUSY;
+	}
+
+	msg->l2h = msgb_push(msg, sizeof(*nsh) + 3);
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+	if (!nsh) {
+		LOGP(DNS, LOGL_ERROR, "Not enough headroom for NS header\n");
+		msgb_free(msg);
+		return -EIO;
+	}
+
+	nsh->pdu_type = NS_PDUT_UNITDATA;
+	/* spare octet in data[0] */
+	nsh->data[1] = bvci >> 8;
+	nsh->data[2] = bvci & 0xff;
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/* Section 9.2.10: receive side */
+static int gprs_ns_rx_unitdata(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *)msg->l2h;
+	uint16_t bvci;
+
+	if (nsvc->state & NSE_S_BLOCKED)
+		return gprs_ns_tx_status(nsvc, NS_CAUSE_NSVC_BLOCKED,
+					 0, msg);
+
+	/* spare octet in data[0] */
+	bvci = nsh->data[1] << 8 | nsh->data[2];
+	msgb_bssgph(msg) = &nsh->data[3];
+	msgb_bvci(msg) = bvci;
+
+	/* call upper layer (BSSGP) */
+	return nsvc->nsi->cb(GPRS_NS_EVT_UNIT_DATA, nsvc, msg, bvci);
+}
+
+/* Section 9.2.7 */
+static int gprs_ns_rx_status(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	struct tlv_parsed tp;
+	uint8_t cause;
+	int rc;
+
+	LOGP(DNS, LOGL_NOTICE, "NSEI=%u Rx NS STATUS ", nsvc->nsei);
+
+	rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
+			msgb_l2len(msg) - sizeof(*nsh), 0, 0);
+	if (rc < 0) {
+		LOGPC(DNS, LOGL_NOTICE, "Error during TLV Parse\n");
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx NS STATUS: "
+			"Error during TLV Parse\n", nsvc->nsei);
+		return rc;
+	}
+
+	if (!TLVP_PRESENT(&tp, NS_IE_CAUSE)) {
+		LOGPC(DNS, LOGL_INFO, "missing cause IE\n");
+		return -EINVAL;
+	}
+
+	cause = *TLVP_VAL(&tp, NS_IE_CAUSE);
+	LOGPC(DNS, LOGL_NOTICE, "cause=%s\n", gprs_ns_cause_str(cause));
+
+	return 0;
+}
+
+/* Section 7.3 */
+static int gprs_ns_rx_reset(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	struct tlv_parsed tp;
+	uint8_t *cause;
+	uint16_t *nsvci, *nsei;
+	int rc;
+
+	rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
+			msgb_l2len(msg) - sizeof(*nsh), 0, 0);
+	if (rc < 0) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx NS RESET "
+			"Error during TLV Parse\n", nsvc->nsei);
+		return rc;
+	}
+
+	if (!TLVP_PRESENT(&tp, NS_IE_CAUSE) ||
+	    !TLVP_PRESENT(&tp, NS_IE_VCI) ||
+	    !TLVP_PRESENT(&tp, NS_IE_NSEI)) {
+		LOGP(DNS, LOGL_ERROR, "NS RESET Missing mandatory IE\n");
+		gprs_ns_tx_status(nsvc, NS_CAUSE_MISSING_ESSENT_IE, 0, msg);
+		return -EINVAL;
+	}
+
+	cause = (uint8_t *) TLVP_VAL(&tp, NS_IE_CAUSE);
+	nsvci = (uint16_t *) TLVP_VAL(&tp, NS_IE_VCI);
+	nsei = (uint16_t *) TLVP_VAL(&tp, NS_IE_NSEI);
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS RESET (NSVCI=%u, cause=%s)\n",
+		nsvc->nsvci, nsvc->nsei, gprs_ns_cause_str(*cause));
+
+	/* Mark NS-VC as blocked and alive */
+	nsvc->state = NSE_S_BLOCKED | NSE_S_ALIVE;
+
+	nsvc->nsei = ntohs(*nsei);
+	nsvc->nsvci = ntohs(*nsvci);
+
+	/* start the test procedure */
+	gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE);
+	nsvc_start_timer(nsvc, NSVC_TIMER_TNS_TEST);
+
+	/* inform interested parties about the fact that this NSVC
+	 * has received RESET */
+	ns_osmo_signal_dispatch(nsvc, S_NS_RESET, *cause);
+
+	return gprs_ns_tx_reset_ack(nsvc);
+}
+
+static int gprs_ns_rx_block(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	struct tlv_parsed tp;
+	uint8_t *cause;
+	int rc;
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS BLOCK\n", nsvc->nsei);
+
+	nsvc->state |= NSE_S_BLOCKED;
+
+	rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
+			msgb_l2len(msg) - sizeof(*nsh), 0, 0);
+	if (rc < 0) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx NS BLOCK "
+			"Error during TLV Parse\n", nsvc->nsei);
+		return rc;
+	}
+
+	if (!TLVP_PRESENT(&tp, NS_IE_CAUSE) ||
+	    !TLVP_PRESENT(&tp, NS_IE_VCI)) {
+		LOGP(DNS, LOGL_ERROR, "NS RESET Missing mandatory IE\n");
+		gprs_ns_tx_status(nsvc, NS_CAUSE_MISSING_ESSENT_IE, 0, msg);
+		return -EINVAL;
+	}
+
+	cause = (uint8_t *) TLVP_VAL(&tp, NS_IE_CAUSE);
+	//nsvci = (uint16_t *) TLVP_VAL(&tp, NS_IE_VCI);
+
+	ns_osmo_signal_dispatch(nsvc, S_NS_BLOCK, *cause);
+	rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_BLOCKED]);
+
+	return gprs_ns_tx_simple(nsvc, NS_PDUT_BLOCK_ACK);
+}
+
+/*! \brief Receive incoming NS message from underlying transport layer
+ *  \param nsi NS instance to which the data belongs
+ *  \param[in] msg message buffer containing newly-received data
+ *  \param[in] saddr socketaddr from which data was received
+ *  \param[in] ll link-layer type in which data was received
+ *  \returns 0 in case of success, < 0 in case of error
+ *
+ * This is the main entry point int othe NS imlementation where frames
+ * from the underlying transport (normally UDP) enter.
+ */
+int gprs_ns_rcvmsg(struct gprs_ns_inst *nsi, struct msgb *msg,
+		   struct sockaddr_in *saddr, enum gprs_ns_ll ll)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	struct gprs_nsvc *nsvc;
+	int rc = 0;
+
+	/* look up the NSVC based on source address */
+	nsvc = nsvc_by_rem_addr(nsi, saddr);
+	if (!nsvc) {
+		struct tlv_parsed tp;
+		uint16_t nsei;
+		if (nsh->pdu_type == NS_PDUT_STATUS) {
+			LOGP(DNS, LOGL_INFO, "Ignoring NS STATUS from %s:%u "
+			     "for non-existing NS-VC\n",
+			     inet_ntoa(saddr->sin_addr), ntohs(saddr->sin_port));
+			return 0;
+		}
+		/* Only the RESET procedure creates a new NSVC */
+		if (nsh->pdu_type != NS_PDUT_RESET) {
+			/* Since we have no NSVC, we have to use a fake */
+			nsvc = nsi->unknown_nsvc;
+			log_set_context(GPRS_CTX_NSVC, nsvc);
+			LOGP(DNS, LOGL_INFO, "Rejecting NS PDU type 0x%0x "
+				"from %s:%u for non-existing NS-VC\n",
+				nsh->pdu_type, inet_ntoa(saddr->sin_addr),
+				ntohs(saddr->sin_port));
+			nsvc->nsvci = nsvc->nsei = 0xfffe;
+			nsvc->ip.bts_addr = *saddr;
+			nsvc->state = NSE_S_ALIVE;
+			nsvc->ll = ll;
+#if 0
+			return gprs_ns_tx_reset(nsvc, NS_CAUSE_PDU_INCOMP_PSTATE);
+#else
+			return gprs_ns_tx_status(nsvc,
+						NS_CAUSE_PDU_INCOMP_PSTATE, 0,
+						msg);
+#endif
+		}
+		rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
+				msgb_l2len(msg) - sizeof(*nsh), 0, 0);
+		if (rc < 0) {
+			LOGP(DNS, LOGL_ERROR, "Rx NS RESET Error %d during "
+				"TLV Parse\n", rc);
+			return rc;
+		}
+		if (!TLVP_PRESENT(&tp, NS_IE_CAUSE) ||
+		    !TLVP_PRESENT(&tp, NS_IE_VCI) ||
+		    !TLVP_PRESENT(&tp, NS_IE_NSEI)) {
+			LOGP(DNS, LOGL_ERROR, "NS RESET Missing mandatory IE\n");
+			gprs_ns_tx_status(nsvc, NS_CAUSE_MISSING_ESSENT_IE, 0,
+					  msg);
+			return -EINVAL;
+		}
+		nsei = ntohs(*(uint16_t *)TLVP_VAL(&tp, NS_IE_NSEI));
+		/* Check if we already know this NSEI, the remote end might
+		 * simply have changed addresses, or it is a SGSN */
+		nsvc = gprs_nsvc_by_nsei(nsi, nsei);
+		if (!nsvc) {
+			nsvc = gprs_nsvc_create(nsi, 0xffff);
+			nsvc->ll = ll;
+			log_set_context(GPRS_CTX_NSVC, nsvc);
+			LOGP(DNS, LOGL_INFO, "Creating NS-VC for BSS at %s:%u\n",
+				inet_ntoa(saddr->sin_addr), ntohs(saddr->sin_port));
+		}
+		/* Update the remote peer IP address/port */
+		nsvc->ip.bts_addr = *saddr;
+	} else
+		msgb_nsei(msg) = nsvc->nsei;
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	/* Increment number of Incoming bytes */
+	rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_PKTS_IN]);
+	rate_ctr_add(&nsvc->ctrg->ctr[NS_CTR_BYTES_IN], msgb_l2len(msg));
+
+	switch (nsh->pdu_type) {
+	case NS_PDUT_ALIVE:
+		/* If we're dead and blocked and suddenly receive a
+		 * NS-ALIVE out of the blue, we might have been re-started
+		 * and should send a NS-RESET to make sure everything recovers
+		 * fine. */
+		if (nsvc->state == NSE_S_BLOCKED)
+			rc = gprs_ns_tx_reset(nsvc, NS_CAUSE_PDU_INCOMP_PSTATE);
+		else
+			rc = gprs_ns_tx_alive_ack(nsvc);
+		break;
+	case NS_PDUT_ALIVE_ACK:
+		/* stop Tns-alive and start Tns-test */
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_TEST);
+		if (nsvc->remote_end_is_sgsn) {
+			/* FIXME: this should be one level higher */
+			if (nsvc->state & NSE_S_BLOCKED)
+				rc = gprs_ns_tx_unblock(nsvc);
+		}
+		break;
+	case NS_PDUT_UNITDATA:
+		/* actual user data */
+		rc = gprs_ns_rx_unitdata(nsvc, msg);
+		break;
+	case NS_PDUT_STATUS:
+		rc = gprs_ns_rx_status(nsvc, msg);
+		break;
+	case NS_PDUT_RESET:
+		rc = gprs_ns_rx_reset(nsvc, msg);
+		break;
+	case NS_PDUT_RESET_ACK:
+		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS RESET ACK\n", nsvc->nsei);
+		/* mark NS-VC as blocked + active */
+		nsvc->state = NSE_S_BLOCKED | NSE_S_ALIVE;
+		nsvc->remote_state = NSE_S_BLOCKED | NSE_S_ALIVE;
+		rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_BLOCKED]);
+		if (nsvc->persistent || nsvc->remote_end_is_sgsn) {
+			/* stop RESET timer */
+			osmo_timer_del(&nsvc->timer);
+		}
+		/* Initiate TEST proc.: Send ALIVE and start timer */
+		rc = gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE);
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_TEST);
+		break;
+	case NS_PDUT_UNBLOCK:
+		/* Section 7.2: unblocking procedure */
+		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS UNBLOCK\n", nsvc->nsei);
+		nsvc->state &= ~NSE_S_BLOCKED;
+		ns_osmo_signal_dispatch(nsvc, S_NS_UNBLOCK, 0);
+		rc = gprs_ns_tx_simple(nsvc, NS_PDUT_UNBLOCK_ACK);
+		break;
+	case NS_PDUT_UNBLOCK_ACK:
+		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS UNBLOCK ACK\n", nsvc->nsei);
+		/* mark NS-VC as unblocked + active */
+		nsvc->state = NSE_S_ALIVE;
+		nsvc->remote_state = NSE_S_ALIVE;
+		ns_osmo_signal_dispatch(nsvc, S_NS_UNBLOCK, 0);
+		break;
+	case NS_PDUT_BLOCK:
+		rc = gprs_ns_rx_block(nsvc, msg);
+		break;
+	case NS_PDUT_BLOCK_ACK:
+		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS BLOCK ACK\n", nsvc->nsei);
+		/* mark remote NS-VC as blocked + active */
+		nsvc->remote_state = NSE_S_BLOCKED | NSE_S_ALIVE;
+		break;
+	default:
+		LOGP(DNS, LOGL_NOTICE, "NSEI=%u Rx Unknown NS PDU type 0x%02x\n",
+			nsvc->nsei, nsh->pdu_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+/*! \brief Create a new GPRS NS instance
+ *  \param[in] cb Call-back function for incoming BSSGP data
+ *  \returns dynamically allocated gprs_ns_inst
+ */
+struct gprs_ns_inst *gprs_ns_instantiate(gprs_ns_cb_t *cb, void *ctx)
+{
+	struct gprs_ns_inst *nsi = talloc_zero(ctx, struct gprs_ns_inst);
+
+	nsi->cb = cb;
+	INIT_LLIST_HEAD(&nsi->gprs_nsvcs);
+	nsi->timeout[NS_TOUT_TNS_BLOCK] = 3;
+	nsi->timeout[NS_TOUT_TNS_BLOCK_RETRIES] = 3;
+	nsi->timeout[NS_TOUT_TNS_RESET] = 3;
+	nsi->timeout[NS_TOUT_TNS_RESET_RETRIES] = 3;
+	nsi->timeout[NS_TOUT_TNS_TEST] = 30;
+	nsi->timeout[NS_TOUT_TNS_ALIVE] = 3;
+	nsi->timeout[NS_TOUT_TNS_ALIVE_RETRIES] = 10;
+
+	/* Create the dummy NSVC that we use for sending
+	 * messages to non-existant/unknown NS-VC's */
+	nsi->unknown_nsvc = gprs_nsvc_create(nsi, 0xfffe);
+	llist_del(&nsi->unknown_nsvc->list);
+
+	return nsi;
+}
+
+/*! \brief Destroy an entire NS instance
+ *  \param nsi gprs_ns_inst that is to be destroyed
+ *
+ *  This function SHOULD release all resources associated with the
+ *  NS-instance but is actually not completely implemented!
+ */
+void gprs_ns_destroy(struct gprs_ns_inst *nsi)
+{
+	/* FIXME: clear all timers */
+
+	/* recursively free the NSI and all its NSVCs */
+	talloc_free(nsi);
+}
+
+
+/* NS-over-IP code, according to 3GPP TS 48.016 Chapter 6.2
+ * We don't support Size Procedure, Configuration Procedure, ChangeWeight Procedure */
+
+/* Read a single NS-over-IP message */
+static struct msgb *read_nsip_msg(struct osmo_fd *bfd, int *error,
+				  struct sockaddr_in *saddr)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	int ret = 0;
+	socklen_t saddr_len = sizeof(*saddr);
+
+	if (!msg) {
+		*error = -ENOMEM;
+		return NULL;
+	}
+
+	ret = recvfrom(bfd->fd, msg->data, NS_ALLOC_SIZE - NS_ALLOC_HEADROOM, 0,
+			(struct sockaddr *)saddr, &saddr_len);
+	if (ret < 0) {
+		LOGP(DNS, LOGL_ERROR, "recv error %s during NSIP recv\n",
+			strerror(errno));
+		msgb_free(msg);
+		*error = ret;
+		return NULL;
+	} else if (ret == 0) {
+		msgb_free(msg);
+		*error = ret;
+		return NULL;
+	}
+
+	msg->l2h = msg->data;
+	msgb_put(msg, ret);
+
+	return msg;
+}
+
+static int handle_nsip_read(struct osmo_fd *bfd)
+{
+	int error;
+	struct sockaddr_in saddr;
+	struct gprs_ns_inst *nsi = bfd->data;
+	struct msgb *msg = read_nsip_msg(bfd, &error, &saddr);
+
+	if (!msg)
+		return error;
+
+	error = gprs_ns_rcvmsg(nsi, msg, &saddr, GPRS_NS_LL_UDP);
+
+	msgb_free(msg);
+
+	return error;
+}
+
+static int handle_nsip_write(struct osmo_fd *bfd)
+{
+	/* FIXME: actually send the data here instead of nsip_sendmsg() */
+	return -EIO;
+}
+
+static int nsip_sendmsg(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	int rc;
+	struct gprs_ns_inst *nsi = nsvc->nsi;
+	struct sockaddr_in *daddr = &nsvc->ip.bts_addr;
+
+	rc = sendto(nsi->nsip.fd.fd, msg->data, msg->len, 0,
+		  (struct sockaddr *)daddr, sizeof(*daddr));
+
+	msgb_free(msg);
+
+	return rc;
+}
+
+/* UDP Port 23000 carries the LLC-in-BSSGP-in-NS protocol stack */
+static int nsip_fd_cb(struct osmo_fd *bfd, unsigned int what)
+{
+	int rc = 0;
+
+	if (what & BSC_FD_READ)
+		rc = handle_nsip_read(bfd);
+	if (what & BSC_FD_WRITE)
+		rc = handle_nsip_write(bfd);
+
+	return rc;
+}
+
+/*! \brief Create a listening socket for GPRS NS/UDP/IP
+ *  \param[in] nsi NS protocol instance to listen
+ *  \returns >=0 (fd) in case of success, negative in case of error
+ *
+ *  A call to this function will create a UDP socket bound to the port
+ *  number and IP address specified in the NS protocol instance. The
+ *  file descriptor of the socket will be stored in nsi->nsip.fd.
+ */
+int gprs_ns_nsip_listen(struct gprs_ns_inst *nsi)
+{
+	struct in_addr in;
+	int ret;
+
+	in.s_addr = htonl(nsi->nsip.local_ip);
+
+	nsi->nsip.fd.cb = nsip_fd_cb;
+	nsi->nsip.fd.data = nsi;
+	ret = osmo_sock_init_ofd(&nsi->nsip.fd, AF_INET, SOCK_DGRAM,
+				 IPPROTO_UDP, inet_ntoa(in),
+				 nsi->nsip.local_port, OSMO_SOCK_F_BIND);
+	if (ret < 0)
+		return ret;
+
+
+	return ret;
+}
+
+/*! \brief Initiate a RESET procedure
+ *  \param[in] nsvc NS-VC in which to start the procedure
+ *  \param[in] cause Numeric NS cause value
+ *
+ * This is a high-level function initiating a NS-RESET procedure. It
+ * will not only send a NS-RESET, but also set the state to BLOCKED and
+ * start the Tns-reset timer.
+ */
+void gprs_nsvc_reset(struct gprs_nsvc *nsvc, uint8_t cause)
+{
+	LOGP(DNS, LOGL_INFO, "NSEI=%u RESET procedure based on API request\n",
+		nsvc->nsei);
+
+	/* Mark NS-VC locally as blocked and dead */
+	nsvc->state = NSE_S_BLOCKED;
+	/* Send NS-RESET PDU */
+	if (gprs_ns_tx_reset(nsvc, cause) < 0) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u, error resetting NS-VC\n",
+			nsvc->nsei);
+	}
+	/* Start Tns-reset */
+	nsvc_start_timer(nsvc, NSVC_TIMER_TNS_RESET);
+}
+
+/*! \brief Establish a NS connection (from the BSS) to the SGSN
+ *  \param nsi NS-instance
+ *  \param[in] dest Destination IP/Port
+ *  \param[in] nsei NSEI of the to-be-established NS-VC
+ *  \param[in] nsvci NSVCI of the to-be-established NS-VC
+ *  \returns struct gprs_nsvc representing the new NS-VC
+ *
+ * This function will establish a single NS/UDP/IP connection in uplink
+ * (BSS to SGSN) direction.
+ */
+struct gprs_nsvc *gprs_ns_nsip_connect(struct gprs_ns_inst *nsi,
+				struct sockaddr_in *dest, uint16_t nsei,
+				uint16_t nsvci)
+{
+	struct gprs_nsvc *nsvc;
+
+	nsvc = nsvc_by_rem_addr(nsi, dest);
+	if (!nsvc)
+		nsvc = gprs_nsvc_create(nsi, nsvci);
+	nsvc->ip.bts_addr = *dest;
+	nsvc->nsei = nsei;
+	nsvc->nsvci = nsvci;
+	nsvc->remote_end_is_sgsn = 1;
+
+	gprs_nsvc_reset(nsvc, NS_CAUSE_OM_INTERVENTION);
+	return nsvc;
+}
+
+void gprs_ns_set_log_ss(int ss)
+{
+	DNS = ss;
+}
+
+/*! }@ */
diff --git a/src/shared/libosmocore/src/gb/gprs_ns_frgre.c b/src/shared/libosmocore/src/gb/gprs_ns_frgre.c
new file mode 100644
index 00000000..23443812
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_ns_frgre.c
@@ -0,0 +1,346 @@
+/* GPRS Networks Service (NS) messages on the Gb interface
+ * 3GPP TS 08.16 version 8.0.1 Release 1999 / ETSI TS 101 299 V8.0.1 (2002-05) */
+
+/* NS-over-FR-over-GRE implementation */
+
+/* (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/select.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+#include "common_vty.h"
+
+#define GRE_PTYPE_FR	0x6559
+#define GRE_PTYPE_IPv4	0x0800
+#define GRE_PTYPE_KAR	0x0000	/* keepalive response */
+
+struct gre_hdr {
+	uint16_t flags;
+	uint16_t ptype;
+} __attribute__ ((packed));
+
+#if defined(__FreeBSD__)
+/**
+ * On BSD the IPv4 struct is called struct ip and instead of iXX
+ * the members are called ip_XX. One could change this code to use
+ * struct ip but that would require to define _BSD_SOURCE and that
+ * might have other complications. Instead make sure struct iphdr
+ * is present on FreeBSD. The below is taken from GLIBC.
+ *
+ * The GNU C Library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ */
+struct iphdr
+  {
+#if BYTE_ORDER == LITTLE_ENDIAN
+    unsigned int ihl:4;
+    unsigned int version:4;
+#elif BYTE_ORDER == BIG_ENDIAN
+    unsigned int version:4;
+    unsigned int ihl:4;
+#endif
+    u_int8_t tos;
+    u_int16_t tot_len;
+    u_int16_t id;
+    u_int16_t frag_off;
+    u_int8_t ttl;
+    u_int8_t protocol;
+    u_int16_t check;
+    u_int32_t saddr;
+    u_int32_t daddr;
+    /*The options start here. */
+  };
+#endif
+
+
+/* IPv4 messages inside the GRE tunnel might be GRE keepalives */
+static int handle_rx_gre_ipv4(struct osmo_fd *bfd, struct msgb *msg,
+				struct iphdr *iph, struct gre_hdr *greh)
+{
+	struct gprs_ns_inst *nsi = bfd->data;
+	int gre_payload_len;
+	struct iphdr *inner_iph;
+	struct gre_hdr *inner_greh;
+	struct sockaddr_in daddr;
+	struct in_addr ia;
+
+	gre_payload_len = msg->len - (iph->ihl*4 + sizeof(*greh));
+
+	inner_iph = (struct iphdr *) ((uint8_t *)greh + sizeof(*greh));
+
+	if (gre_payload_len < inner_iph->ihl*4 + sizeof(*inner_greh)) {
+		LOGP(DNS, LOGL_ERROR, "GRE keepalive too short\n");
+		return -EIO;
+	}
+
+	if (inner_iph->saddr != iph->daddr ||
+	    inner_iph->daddr != iph->saddr) {
+		LOGP(DNS, LOGL_ERROR,
+			"GRE keepalive with wrong tunnel addresses\n");
+		return -EIO;
+	}
+
+	if (inner_iph->protocol != IPPROTO_GRE) {
+		LOGP(DNS, LOGL_ERROR, "GRE keepalive with wrong protocol\n");
+		return -EIO;
+	}
+
+	inner_greh = (struct gre_hdr *) ((uint8_t *)inner_iph + iph->ihl*4);
+	if (inner_greh->ptype != htons(GRE_PTYPE_KAR)) {
+		LOGP(DNS, LOGL_ERROR, "GRE keepalive inner GRE type != 0\n");
+		return -EIO;
+	}
+
+	/* Actually send the response back */
+
+	daddr.sin_family = AF_INET;
+	daddr.sin_addr.s_addr = inner_iph->daddr;
+	daddr.sin_port = IPPROTO_GRE;
+
+	ia.s_addr = iph->saddr;
+	LOGP(DNS, LOGL_DEBUG, "GRE keepalive from %s, responding\n",
+		inet_ntoa(ia));
+
+	return sendto(nsi->frgre.fd.fd, inner_greh,
+		      gre_payload_len - inner_iph->ihl*4, 0,
+		      (struct sockaddr *)&daddr, sizeof(daddr));
+}
+
+static struct msgb *read_nsfrgre_msg(struct osmo_fd *bfd, int *error,
+					struct sockaddr_in *saddr)
+{
+	struct msgb *msg = msgb_alloc(NS_ALLOC_SIZE, "Gb/NS/FR/GRE Rx");
+	int ret = 0;
+	socklen_t saddr_len = sizeof(*saddr);
+	struct iphdr *iph;
+	struct gre_hdr *greh;
+	uint8_t *frh;
+	uint16_t dlci;
+
+	if (!msg) {
+		*error = -ENOMEM;
+		return NULL;
+	}
+
+	ret = recvfrom(bfd->fd, msg->data, NS_ALLOC_SIZE, 0,
+			(struct sockaddr *)saddr, &saddr_len);
+	if (ret < 0) {
+		LOGP(DNS, LOGL_ERROR, "recv error %s during NS-FR-GRE recv\n",
+			strerror(errno));
+		*error = ret;
+		goto out_err;
+	} else if (ret == 0) {
+		*error = ret;
+		goto out_err;
+	}
+
+	msgb_put(msg, ret);
+
+	if (msg->len < sizeof(*iph) + sizeof(*greh) + 2) {
+		LOGP(DNS, LOGL_ERROR, "Short IP packet: %u bytes\n", msg->len);
+		*error = -EIO;
+		goto out_err;
+	}
+
+	iph = (struct iphdr *) msg->data;
+	if (msg->len < (iph->ihl*4 + sizeof(*greh) + 2)) {
+		LOGP(DNS, LOGL_ERROR, "Short IP packet: %u bytes\n", msg->len);
+		*error = -EIO;
+		goto out_err;
+	}
+
+	greh = (struct gre_hdr *) (msg->data + iph->ihl*4);
+	if (greh->flags) {
+		LOGP(DNS, LOGL_NOTICE, "Unknown GRE flags 0x%04x\n",
+			ntohs(greh->flags));
+	}
+
+	switch (ntohs(greh->ptype)) {
+	case GRE_PTYPE_IPv4:
+		/* IPv4 messages might be GRE keepalives */
+		*error = handle_rx_gre_ipv4(bfd, msg, iph, greh);
+		goto out_err;
+		break;
+	case GRE_PTYPE_FR:
+		/* continue as usual */
+		break;
+	default:
+		LOGP(DNS, LOGL_NOTICE, "Unknown GRE protocol 0x%04x != FR\n",
+			ntohs(greh->ptype));
+		*error = -EIO;
+		goto out_err;
+		break;
+	}
+
+	if (msg->len < sizeof(*greh) + 2) {
+		LOGP(DNS, LOGL_ERROR, "Short FR header: %u bytes\n", msg->len);
+		*error = -EIO;
+		goto out_err;
+	}
+
+	frh = (uint8_t *)greh + sizeof(*greh);
+	if (frh[0] & 0x01) {
+		LOGP(DNS, LOGL_NOTICE, "Unsupported single-byte FR address\n");
+		*error = -EIO;
+		goto out_err;
+	}
+	dlci = ((frh[0] & 0xfc) << 2);
+	if ((frh[1] & 0x0f) != 0x01) {
+		LOGP(DNS, LOGL_NOTICE, "Unknown second FR octet 0x%02x\n",
+			frh[1]);
+		*error = -EIO;
+		goto out_err;
+	}
+	dlci |= (frh[1] >> 4);
+
+	msg->l2h = frh+2;
+
+	/* Store DLCI in NETWORK BYTEORDER in sockaddr port member */
+	saddr->sin_port = htons(dlci);
+
+	return msg;
+
+out_err:
+	msgb_free(msg);
+	return NULL;
+}
+
+int gprs_ns_rcvmsg(struct gprs_ns_inst *nsi, struct msgb *msg,
+		   struct sockaddr_in *saddr, enum gprs_ns_ll ll);
+
+static int handle_nsfrgre_read(struct osmo_fd *bfd)
+{
+	int rc;
+	struct sockaddr_in saddr;
+	struct gprs_ns_inst *nsi = bfd->data;
+	struct msgb *msg;
+	uint16_t dlci;
+
+	msg = read_nsfrgre_msg(bfd, &rc, &saddr);
+	if (!msg)
+		return rc;
+
+	dlci = ntohs(saddr.sin_port);
+	if (dlci == 0 || dlci == 1023) {
+		LOGP(DNS, LOGL_INFO, "Received FR on LMI DLCI %u - ignoring\n",
+			dlci);
+		rc = 0;
+		goto out;
+	}
+
+	rc = gprs_ns_rcvmsg(nsi, msg, &saddr, GPRS_NS_LL_FR_GRE);
+out:
+	msgb_free(msg);
+
+	return rc;
+}
+
+static int handle_nsfrgre_write(struct osmo_fd *bfd)
+{
+	/* FIXME: actually send the data here instead of nsip_sendmsg() */
+	return -EIO;
+}
+
+int gprs_ns_frgre_sendmsg(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	int rc;
+	struct gprs_ns_inst *nsi = nsvc->nsi;
+	struct sockaddr_in daddr;
+	uint16_t dlci = ntohs(nsvc->frgre.bts_addr.sin_port);
+	uint8_t *frh;
+	struct gre_hdr *greh;
+
+	/* Build socket address for the packet destionation */
+	daddr.sin_family = AF_INET;
+	daddr.sin_addr = nsvc->frgre.bts_addr.sin_addr;
+	daddr.sin_port = IPPROTO_GRE;
+
+	/* Prepend the FR header */
+	frh = msgb_push(msg, 2);
+	frh[0] = (dlci >> 2) & 0xfc;
+	frh[1] = ((dlci & 0xf)<<4) | 0x01;
+
+	/* Prepend the GRE header */
+	greh = (struct gre_hdr *) msgb_push(msg, sizeof(*greh));
+	greh->flags = 0;
+	greh->ptype = htons(GRE_PTYPE_FR);
+
+	rc = sendto(nsi->frgre.fd.fd, msg->data, msg->len, 0,
+		  (struct sockaddr *)&daddr, sizeof(daddr));
+
+	msgb_free(msg);
+
+	return rc;
+}
+
+static int nsfrgre_fd_cb(struct osmo_fd *bfd, unsigned int what)
+{
+	int rc = 0;
+
+	if (what & BSC_FD_READ)
+		rc = handle_nsfrgre_read(bfd);
+	if (what & BSC_FD_WRITE)
+		rc = handle_nsfrgre_write(bfd);
+
+	return rc;
+}
+
+int gprs_ns_frgre_listen(struct gprs_ns_inst *nsi)
+{
+	struct in_addr in;
+	int rc;
+
+	in.s_addr = htonl(nsi->frgre.local_ip);
+
+	/* Make sure we close any existing socket before changing it */
+	if (nsi->frgre.fd.fd)
+		close(nsi->frgre.fd.fd);
+
+	if (!nsi->frgre.enabled)
+		return 0;
+
+	nsi->frgre.fd.cb = nsfrgre_fd_cb;
+	nsi->frgre.fd.data = nsi;
+	rc = osmo_sock_init_ofd(&nsi->frgre.fd, AF_INET, SOCK_RAW,
+				IPPROTO_GRE, inet_ntoa(in), 0,
+				OSMO_SOCK_F_BIND);
+	if (rc < 0) {
+		LOGP(DNS, LOGL_ERROR, "Error creating GRE socket (%s)\n",
+			strerror(errno));
+		return rc;
+	}
+	nsi->frgre.fd.data = nsi;
+
+	return rc;
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_ns_vty.c b/src/shared/libosmocore/src/gb/gprs_ns_vty.c
new file mode 100644
index 00000000..fac431cb
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_ns_vty.c
@@ -0,0 +1,581 @@
+/* VTY interface for our GPRS Networks Service (NS) implementation */
+
+/* (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stdint.h>
+
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/gprs/gprs_ns.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+
+#include <osmocom/vty/vty.h>
+#include <osmocom/vty/command.h>
+#include <osmocom/vty/logging.h>
+#include <osmocom/vty/telnet_interface.h>
+#include <osmocom/vty/misc.h>
+
+#include "common_vty.h"
+
+static struct gprs_ns_inst *vty_nsi = NULL;
+
+/* FIXME: this should go to some common file as it is copied
+ * in vty_interface.c of the BSC */
+static const struct value_string gprs_ns_timer_strs[] = {
+	{ 0, "tns-block" },
+	{ 1, "tns-block-retries" },
+	{ 2, "tns-reset" },
+	{ 3, "tns-reset-retries" },
+	{ 4, "tns-test" },
+	{ 5, "tns-alive" },
+	{ 6, "tns-alive-retries" },
+	{ 0, NULL }
+};
+
+static void log_set_nsvc_filter(struct log_target *target,
+				struct gprs_nsvc *nsvc)
+{
+	if (nsvc) {
+		target->filter_map |= (1 << FLT_NSVC);
+		target->filter_data[FLT_NSVC] = nsvc;
+	} else if (target->filter_data[FLT_NSVC]) {
+		target->filter_map = ~(1 << FLT_NSVC);
+		target->filter_data[FLT_NSVC] = NULL;
+	}
+}
+
+static struct cmd_node ns_node = {
+	L_NS_NODE,
+	"%s(ns)#",
+	1,
+};
+
+static int config_write_ns(struct vty *vty)
+{
+	struct gprs_nsvc *nsvc;
+	unsigned int i;
+	struct in_addr ia;
+
+	vty_out(vty, "ns%s", VTY_NEWLINE);
+
+	llist_for_each_entry(nsvc, &vty_nsi->gprs_nsvcs, list) {
+		if (!nsvc->persistent)
+			continue;
+		vty_out(vty, " nse %u nsvci %u%s",
+			nsvc->nsei, nsvc->nsvci, VTY_NEWLINE);
+		vty_out(vty, " nse %u remote-role %s%s",
+			nsvc->nsei, nsvc->remote_end_is_sgsn ? "sgsn" : "bss",
+			VTY_NEWLINE);
+		switch (nsvc->ll) {
+		case GPRS_NS_LL_UDP:
+			vty_out(vty, " nse %u encapsulation udp%s", nsvc->nsei,
+				VTY_NEWLINE);
+			vty_out(vty, " nse %u remote-ip %s%s",
+				nsvc->nsei,
+				inet_ntoa(nsvc->ip.bts_addr.sin_addr),
+				VTY_NEWLINE);
+			vty_out(vty, " nse %u remote-port %u%s",
+				nsvc->nsei, ntohs(nsvc->ip.bts_addr.sin_port),
+				VTY_NEWLINE);
+			break;
+		case GPRS_NS_LL_FR_GRE:
+			vty_out(vty, " nse %u encapsulation framerelay-gre%s",
+				nsvc->nsei, VTY_NEWLINE);
+			vty_out(vty, " nse %u remote-ip %s%s",
+				nsvc->nsei,
+				inet_ntoa(nsvc->frgre.bts_addr.sin_addr),
+				VTY_NEWLINE);
+			vty_out(vty, " nse %u fr-dlci %u%s",
+				nsvc->nsei, ntohs(nsvc->frgre.bts_addr.sin_port),
+				VTY_NEWLINE);
+		default:
+			break;
+		}
+	}
+
+	for (i = 0; i < ARRAY_SIZE(vty_nsi->timeout); i++)
+		vty_out(vty, " timer %s %u%s",
+			get_value_string(gprs_ns_timer_strs, i),
+			vty_nsi->timeout[i], VTY_NEWLINE);
+
+	if (vty_nsi->nsip.local_ip) {
+		ia.s_addr = htonl(vty_nsi->nsip.local_ip);
+		vty_out(vty, " encapsulation udp local-ip %s%s",
+			inet_ntoa(ia), VTY_NEWLINE);
+	}
+	if (vty_nsi->nsip.local_port)
+		vty_out(vty, " encapsulation udp local-port %u%s",
+			vty_nsi->nsip.local_port, VTY_NEWLINE);
+
+	vty_out(vty, " encapsulation framerelay-gre enabled %u%s",
+		vty_nsi->frgre.enabled ? 1 : 0, VTY_NEWLINE);
+	if (vty_nsi->frgre.local_ip) {
+		ia.s_addr = htonl(vty_nsi->frgre.local_ip);
+		vty_out(vty, " encapsulation framerelay-gre local-ip %s%s",
+			inet_ntoa(ia), VTY_NEWLINE);
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ns, cfg_ns_cmd,
+      "ns",
+      "Configure the GPRS Network Service")
+{
+	vty->node = L_NS_NODE;
+	return CMD_SUCCESS;
+}
+
+static void dump_nse(struct vty *vty, struct gprs_nsvc *nsvc, int stats)
+{
+	vty_out(vty, "NSEI %5u, NS-VC %5u, Remote: %-4s, %5s %9s",
+		nsvc->nsei, nsvc->nsvci,
+		nsvc->remote_end_is_sgsn ? "SGSN" : "BSS",
+		nsvc->state & NSE_S_ALIVE ? "ALIVE" : "DEAD",
+		nsvc->state & NSE_S_BLOCKED ? "BLOCKED" : "UNBLOCKED");
+	if (nsvc->ll == GPRS_NS_LL_UDP || nsvc->ll == GPRS_NS_LL_FR_GRE)
+		vty_out(vty, ", %s %15s:%u",
+			nsvc->ll == GPRS_NS_LL_UDP ? "UDP   " : "FR-GRE",
+			inet_ntoa(nsvc->ip.bts_addr.sin_addr),
+			ntohs(nsvc->ip.bts_addr.sin_port));
+	vty_out(vty, "%s", VTY_NEWLINE);
+	if (stats)
+		vty_out_rate_ctr_group(vty, " ", nsvc->ctrg);
+}
+
+static void dump_ns(struct vty *vty, struct gprs_ns_inst *nsi, int stats)
+{
+	struct gprs_nsvc *nsvc;
+	struct in_addr ia;
+
+	ia.s_addr = htonl(vty_nsi->nsip.local_ip);
+	vty_out(vty, "Encapsulation NS-UDP-IP     Local IP: %s, UDP Port: %u%s",
+		inet_ntoa(ia), vty_nsi->nsip.local_port, VTY_NEWLINE);
+
+	ia.s_addr = htonl(vty_nsi->frgre.local_ip);
+	vty_out(vty, "Encapsulation NS-FR-GRE-IP  Local IP: %s%s",
+		inet_ntoa(ia), VTY_NEWLINE);
+
+	llist_for_each_entry(nsvc, &nsi->gprs_nsvcs, list) {
+		if (nsvc == nsi->unknown_nsvc)
+			continue;
+		dump_nse(vty, nsvc, stats);
+	}
+}
+
+DEFUN(show_ns, show_ns_cmd, "show ns",
+	SHOW_STR "Display information about the NS protocol")
+{
+	struct gprs_ns_inst *nsi = vty_nsi;
+	dump_ns(vty, nsi, 0);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_ns_stats, show_ns_stats_cmd, "show ns stats",
+	SHOW_STR
+	"Display information about the NS protocol\n"
+	"Include statistics\n")
+{
+	struct gprs_ns_inst *nsi = vty_nsi;
+	dump_ns(vty, nsi, 1);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_nse, show_nse_cmd, "show ns (nsei|nsvc) <0-65535> [stats]",
+	SHOW_STR "Display information about the NS protocol\n"
+	"Select one NSE by its NSE Identifier\n"
+	"Select one NSE by its NS-VC Identifier\n"
+	"The Identifier of selected type\n"
+	"Include Statistics\n")
+{
+	struct gprs_ns_inst *nsi = vty_nsi;
+	struct gprs_nsvc *nsvc;
+	uint16_t id = atoi(argv[1]);
+	int show_stats = 0;
+
+	if (!strcmp(argv[0], "nsei"))
+		nsvc = gprs_nsvc_by_nsei(nsi, id);
+	else
+		nsvc = gprs_nsvc_by_nsvci(nsi, id);
+
+	if (!nsvc) {
+		vty_out(vty, "No such NS Entity%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (argc >= 3)
+		show_stats = 1;
+
+	dump_nse(vty, nsvc, show_stats);
+	return CMD_SUCCESS;
+}
+
+#define NSE_CMD_STR "Persistent NS Entity\n" "NS Entity ID (NSEI)\n"
+
+DEFUN(cfg_nse_nsvc, cfg_nse_nsvci_cmd,
+	"nse <0-65535> nsvci <0-65534>",
+	NSE_CMD_STR
+	"NS Virtual Connection\n"
+	"NS Virtual Connection ID (NSVCI)\n"
+	)
+{
+	uint16_t nsei = atoi(argv[0]);
+	uint16_t nsvci = atoi(argv[1]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		nsvc = gprs_nsvc_create(vty_nsi, nsvci);
+		nsvc->nsei = nsei;
+	}
+	nsvc->nsvci = nsvci;
+	/* All NSVCs that are explicitly configured by VTY are
+	 * marked as persistent so we can write them to the config
+	 * file at some later point */
+	nsvc->persistent = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nse_remoteip, cfg_nse_remoteip_cmd,
+	"nse <0-65535> remote-ip A.B.C.D",
+	NSE_CMD_STR
+	"Remote IP Address\n"
+	"Remote IP Address\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	inet_aton(argv[1], &nsvc->ip.bts_addr.sin_addr);
+
+	return CMD_SUCCESS;
+
+}
+
+DEFUN(cfg_nse_remoteport, cfg_nse_remoteport_cmd,
+	"nse <0-65535> remote-port <0-65535>",
+	NSE_CMD_STR
+	"Remote UDP Port\n"
+	"Remote UDP Port Number\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	uint16_t port = atoi(argv[1]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (nsvc->ll != GPRS_NS_LL_UDP) {
+		vty_out(vty, "Cannot set UDP Port on non-UDP NSE%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	nsvc->ip.bts_addr.sin_port = htons(port);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nse_fr_dlci, cfg_nse_fr_dlci_cmd,
+	"nse <0-65535> fr-dlci <16-1007>",
+	NSE_CMD_STR
+	"Frame Relay DLCI\n"
+	"Frame Relay DLCI Number\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	uint16_t dlci = atoi(argv[1]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (nsvc->ll != GPRS_NS_LL_FR_GRE) {
+		vty_out(vty, "Cannot set FR DLCI on non-FR NSE%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	nsvc->frgre.bts_addr.sin_port = htons(dlci);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nse_encaps, cfg_nse_encaps_cmd,
+	"nse <0-65535> encapsulation (udp|framerelay-gre)",
+	NSE_CMD_STR
+	"Encapsulation for NS\n"
+	"UDP/IP Encapsulation\n" "Frame-Relay/GRE/IP Encapsulation\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!strcmp(argv[1], "udp"))
+		nsvc->ll = GPRS_NS_LL_UDP;
+	else
+		nsvc->ll = GPRS_NS_LL_FR_GRE;
+
+	return CMD_SUCCESS;
+}
+
+
+DEFUN(cfg_nse_remoterole, cfg_nse_remoterole_cmd,
+	"nse <0-65535> remote-role (sgsn|bss)",
+	NSE_CMD_STR
+	"Remote NSE Role\n"
+	"Remote Peer is SGSN\n"
+	"Remote Peer is BSS\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!strcmp(argv[1], "sgsn"))
+		nsvc->remote_end_is_sgsn = 1;
+	else
+		nsvc->remote_end_is_sgsn = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_nse, cfg_no_nse_cmd,
+	"no nse <0-65535>",
+	"Delete Persistent NS Entity\n"
+	"Delete " NSE_CMD_STR)
+{
+	uint16_t nsei = atoi(argv[0]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!nsvc->persistent) {
+		vty_out(vty, "NSEI %u is not a persistent NSE%s",
+			nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	nsvc->persistent = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ns_timer, cfg_ns_timer_cmd,
+	"timer " NS_TIMERS " <0-65535>",
+	"Network Service Timer\n"
+	NS_TIMERS_HELP "Timer Value\n")
+{
+	int idx = get_string_value(gprs_ns_timer_strs, argv[0]);
+	int val = atoi(argv[1]);
+
+	if (idx < 0 || idx >= ARRAY_SIZE(vty_nsi->timeout))
+		return CMD_WARNING;
+
+	vty_nsi->timeout[idx] = val;
+
+	return CMD_SUCCESS;
+}
+
+#define ENCAPS_STR "NS encapsulation options\n"
+
+DEFUN(cfg_nsip_local_ip, cfg_nsip_local_ip_cmd,
+      "encapsulation udp local-ip A.B.C.D",
+	ENCAPS_STR "NS over UDP Encapsulation\n"
+	"Set the IP address on which we listen for NS/UDP\n"
+	"IP Address\n")
+{
+	struct in_addr ia;
+
+	inet_aton(argv[0], &ia);
+	vty_nsi->nsip.local_ip = ntohl(ia.s_addr);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nsip_local_port, cfg_nsip_local_port_cmd,
+      "encapsulation udp local-port <0-65535>",
+	ENCAPS_STR "NS over UDP Encapsulation\n"
+	"Set the UDP port on which we listen for NS/UDP\n"
+	"UDP port number\n")
+{
+	unsigned int port = atoi(argv[0]);
+
+	vty_nsi->nsip.local_port = port;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_frgre_local_ip, cfg_frgre_local_ip_cmd,
+      "encapsulation framerelay-gre local-ip A.B.C.D",
+	ENCAPS_STR "NS over Frame Relay over GRE Encapsulation\n"
+	"Set the IP address on which we listen for NS/FR/GRE\n"
+	"IP Address\n")
+{
+	struct in_addr ia;
+
+	if (!vty_nsi->frgre.enabled) {
+		vty_out(vty, "FR/GRE is not enabled%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	inet_aton(argv[0], &ia);
+	vty_nsi->frgre.local_ip = ntohl(ia.s_addr);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_frgre_enable, cfg_frgre_enable_cmd,
+      "encapsulation framerelay-gre enabled (1|0)",
+	ENCAPS_STR "NS over Frame Relay over GRE Encapsulation\n"
+	"Enable or disable Frame Relay over GRE\n"
+	"Enable\n" "Disable\n")
+{
+	int enabled = atoi(argv[0]);
+
+	vty_nsi->frgre.enabled = enabled;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(nsvc_nsei, nsvc_nsei_cmd,
+	"nsvc nsei <0-65535> (block|unblock|reset)",
+	"Perform an operation on a NSVC\n"
+	"NSEI to identify NS-VC Identifier (NS-VCI)\n"
+	"The NSEI\n"
+	"Initiate BLOCK procedure\n"
+	"Initiate UNBLOCK procedure\n"
+	"Initiate RESET procedure\n")
+{
+	uint16_t nsvci = atoi(argv[0]);
+	const char *operation = argv[1];
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsvci);
+	if (!nsvc) {
+		vty_out(vty, "No such NSVCI (%u)%s", nsvci, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!strcmp(operation, "block"))
+		gprs_ns_tx_block(nsvc, NS_CAUSE_OM_INTERVENTION);
+	else if (!strcmp(operation, "unblock"))
+		gprs_ns_tx_unblock(nsvc);
+	else if (!strcmp(operation, "reset"))
+		gprs_nsvc_reset(nsvc, NS_CAUSE_OM_INTERVENTION);
+	else
+		return CMD_WARNING;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(logging_fltr_nsvc,
+      logging_fltr_nsvc_cmd,
+      "logging filter nsvc (nsei|nsvci) <0-65535>",
+	LOGGING_STR FILTER_STR
+	"Filter based on NS Virtual Connection\n"
+	"Identify NS-VC by NSEI\n"
+	"Identify NS-VC by NSVCI\n"
+	"Numeric identifier\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+	struct gprs_nsvc *nsvc;
+	uint16_t id = atoi(argv[1]);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	if (!strcmp(argv[0], "nsei"))
+		nsvc = gprs_nsvc_by_nsei(vty_nsi, id);
+	else
+		nsvc = gprs_nsvc_by_nsvci(vty_nsi, id);
+
+	if (!nsvc) {
+		vty_out(vty, "No NS-VC by that identifier%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	log_set_nsvc_filter(tgt, nsvc);
+	return CMD_SUCCESS;
+}
+
+int gprs_ns_vty_init(struct gprs_ns_inst *nsi)
+{
+	vty_nsi = nsi;
+
+	install_element_ve(&show_ns_cmd);
+	install_element_ve(&show_ns_stats_cmd);
+	install_element_ve(&show_nse_cmd);
+	install_element_ve(&logging_fltr_nsvc_cmd);
+
+	install_element(CFG_LOG_NODE, &logging_fltr_nsvc_cmd);
+
+	install_element(CONFIG_NODE, &cfg_ns_cmd);
+	install_node(&ns_node, config_write_ns);
+	install_default(L_NS_NODE);
+	install_element(L_NS_NODE, &libgb_exit_cmd);
+	install_element(L_NS_NODE, &libgb_end_cmd);
+	install_element(L_NS_NODE, &cfg_nse_nsvci_cmd);
+	install_element(L_NS_NODE, &cfg_nse_remoteip_cmd);
+	install_element(L_NS_NODE, &cfg_nse_remoteport_cmd);
+	install_element(L_NS_NODE, &cfg_nse_fr_dlci_cmd);
+	install_element(L_NS_NODE, &cfg_nse_encaps_cmd);
+	install_element(L_NS_NODE, &cfg_nse_remoterole_cmd);
+	install_element(L_NS_NODE, &cfg_no_nse_cmd);
+	install_element(L_NS_NODE, &cfg_ns_timer_cmd);
+	install_element(L_NS_NODE, &cfg_nsip_local_ip_cmd);
+	install_element(L_NS_NODE, &cfg_nsip_local_port_cmd);
+	install_element(L_NS_NODE, &cfg_frgre_enable_cmd);
+	install_element(L_NS_NODE, &cfg_frgre_local_ip_cmd);
+
+	install_element(ENABLE_NODE, &nsvc_nsei_cmd);
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gb/libosmogb.map b/src/shared/libosmocore/src/gb/libosmogb.map
new file mode 100644
index 00000000..d0f76f86
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/libosmogb.map
@@ -0,0 +1,68 @@
+LIBOSMOGB_1.0 {
+global:
+bssgp_cause_str;
+bssgp_create_cell_id;
+bssgp_fc_in;
+bssgp_fc_init;
+bssgp_fc_ms_init;
+bssgp_msgb_alloc;
+bssgp_msgb_tlli_put;
+bssgp_parse_cell_id;
+bssgp_tx_bvc_block;
+bssgp_tx_bvc_reset;
+bssgp_tx_bvc_unblock;
+bssgp_tx_flush_ll_ack;
+bssgp_tx_llc_discarded;
+bssgp_tx_ra_capa_upd;
+bssgp_tx_radio_status_imsi;
+bssgp_tx_radio_status_tlli;
+bssgp_tx_radio_status_tmsi;
+bssgp_tx_resume;
+bssgp_tx_resume_ack;
+bssgp_tx_resume_nack;
+bssgp_tx_simple_bvci;
+bssgp_tx_status;
+bssgp_tx_suspend;
+bssgp_tx_suspend_ack;
+bssgp_tx_suspend_nack;
+bssgp_tx_ul_ud;
+bssgp_rcvmsg;
+bssgp_rx_paging;
+bssgp_set_log_ss;
+bssgp_tx_dl_ud;
+bssgp_tx_paging;
+bssgp_vty_init;
+bssgp_nsi;
+
+gprs_ns_cause_str;
+gprs_ns_destroy;
+gprs_ns_frgre_listen;
+gprs_ns_frgre_sendmsg;
+gprs_ns_instantiate;
+gprs_ns_nsip_listen;
+gprs_ns_nsip_connect;
+gprs_ns_rcvmsg;
+gprs_ns_sendmsg;
+gprs_ns_set_log_ss;
+gprs_ns_tx_alive;
+gprs_ns_tx_alive_ack;
+gprs_ns_tx_block;
+gprs_ns_tx_reset;
+gprs_ns_tx_status;
+gprs_ns_tx_unblock;
+gprs_ns_vty_init;
+
+gprs_nsvc_create;
+gprs_nsvc_delete;
+gprs_nsvc_reset;
+gprs_nsvc_by_nsvci;
+gprs_nsvc_by_nsei;
+
+gprs_log_filter_fn;
+
+btsctx_alloc;
+btsctx_by_bvci_nsei;
+btsctx_by_raid_cid;
+
+local: *;
+};
diff --git a/src/shared/libosmocore/src/gsm/Makefile.am b/src/shared/libosmocore/src/gsm/Makefile.am
index 46d40a11..b72a8d43 100644
--- a/src/shared/libosmocore/src/gsm/Makefile.am
+++ b/src/shared/libosmocore/src/gsm/Makefile.am
@@ -1,9 +1,9 @@
 # This is _NOT_ the library release version, it's an API version.
 # Please read Chapter 6 "Library interface versions" of the libtool documentation before making any modification
-LIBVERSION=2:0:1
+LIBVERSION=3:0:0
 
 INCLUDES = $(all_includes) -I$(top_srcdir)/include
-AM_CFLAGS = -fPIC -Wall
+AM_CFLAGS = -Wall ${GCC_FVISIBILITY_HIDDEN}
 
 # FIXME: this should eventually go into a milenage/Makefile.am
 noinst_HEADERS = milenage/aes.h milenage/aes_i.h milenage/aes_wrap.h \
@@ -19,7 +19,9 @@ libosmogsm_la_SOURCES = a5.c rxlev_stat.c tlv_parser.c comp128.c gsm_utils.c \
 			lapd_core.c lapdm.c \
 			auth_core.c auth_comp128v1.c auth_milenage.c \
 			milenage/aes-encblock.c milenage/aes-internal.c \
-			milenage/aes-internal-enc.c milenage/milenage.c
+			milenage/aes-internal-enc.c milenage/milenage.c gan.c
 
-libosmogsm_la_LDFLAGS = -version-info $(LIBVERSION)
+libosmogsm_la_LDFLAGS = -Wl,--version-script=$(srcdir)/libosmogsm.map -version-info $(LIBVERSION)
 libosmogsm_la_LIBADD = $(top_builddir)/src/libosmocore.la
+
+EXTRA_DIST = libosmogsm.map
diff --git a/src/shared/libosmocore/src/gsm/a5.c b/src/shared/libosmocore/src/gsm/a5.c
index 34f271a8..356060ab 100644
--- a/src/shared/libosmocore/src/gsm/a5.c
+++ b/src/shared/libosmocore/src/gsm/a5.c
@@ -364,4 +364,4 @@ osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul)
 	}
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/abis_nm.c b/src/shared/libosmocore/src/gsm/abis_nm.c
index 5c3647ca..f6d4003e 100644
--- a/src/shared/libosmocore/src/gsm/abis_nm.c
+++ b/src/shared/libosmocore/src/gsm/abis_nm.c
@@ -452,4 +452,4 @@ enum abis_nm_chan_comb abis_nm_pchan4chcomb(uint8_t chcomb)
 	return GSM_PCHAN_NONE;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/auth_core.c b/src/shared/libosmocore/src/gsm/auth_core.c
index f790ff5b..5cf8dfcf 100644
--- a/src/shared/libosmocore/src/gsm/auth_core.c
+++ b/src/shared/libosmocore/src/gsm/auth_core.c
@@ -1,6 +1,6 @@
 /* GSM/GPRS/3G authentication core infrastructure */
 
-/* (C) 2010-2011 by Harald Welte <laforge@gnumonks.org>
+/* (C) 2010-2012 by Harald Welte <laforge@gnumonks.org>
  *
  * All Rights Reserved
  *
@@ -30,11 +30,23 @@
 
 #include <osmocom/crypt/auth.h>
 
+/*! \addtogroup auth
+ *  @{
+ */
+
+/* \file auth_core.c
+ */
+
 static LLIST_HEAD(osmo_auths);
 
 static struct osmo_auth_impl *selected_auths[_OSMO_AUTH_ALG_NUM];
 
-/* register a cipher with the core */
+/*! \brief Register an authentication algorithm implementation with the core
+ *  \param[in] impl Structure describing implementation and it's callbacks
+ *
+ * This function is called by an authentication implementation plugin to
+ * register itself with the authentication core.
+ */
 int osmo_auth_register(struct osmo_auth_impl *impl)
 {
 	if (impl->algo >= ARRAY_SIZE(selected_auths))
@@ -50,13 +62,23 @@ int osmo_auth_register(struct osmo_auth_impl *impl)
 	return 0;
 }
 
-/* load all available GPRS cipher plugins */
+/*! \brief Load all available authentication plugins from the given path
+ *  \param[in] path Path name of the directory containing the plugins
+ *
+ * This function will load all plugins contained in the specified path.
+ */
 int osmo_auth_load(const char *path)
 {
 	/* load all plugins available from path */
 	return osmo_plugin_load_all(path);
 }
 
+/*! \brief Determine if a given authentication algorithm is supported
+ *  \param[in] algo Algorithm which should be checked
+ *
+ * This function is used by an application to determine at runtime if a
+ * given authentication algorithm is supported or not.
+ */
 int osmo_auth_supported(enum osmo_auth_algo algo)
 {
 	if (algo >= ARRAY_SIZE(selected_auths))
@@ -68,6 +90,17 @@ int osmo_auth_supported(enum osmo_auth_algo algo)
 	return 0;
 }
 
+/*! \brief Generate authentication vector
+ *  \param[out] vec Generated authentication vector
+ *  \param[in] aud Subscriber-specific key material
+ *  \param[in] rand Random challenge to be used
+ *
+ * This function performs the core cryptographic function of the AUC,
+ * computing authentication triples/quintuples based on the permanent
+ * subscriber data and a random value.  The result is what is forwarded
+ * by the AUC via HLR and VLR to the MSC which will then be able to
+ * invoke authentication with the MS
+ */
 int osmo_auth_gen_vec(struct osmo_auth_vector *vec,
 		      struct osmo_sub_auth_data *aud,
 		      const uint8_t *_rand)
@@ -87,6 +120,20 @@ int osmo_auth_gen_vec(struct osmo_auth_vector *vec,
 	return 0;
 }
 
+/*! \brief Generate authentication vector and re-sync sequence
+ *  \param[out] vec Generated authentication vector
+ *  \param[in] aud Subscriber-specific key material
+ *  \param[in] rand_auts RAND value sent by the SIM/MS
+ *  \param[in] auts AUTS value sent by the SIM/MS
+ *  \param[in] rand Random challenge to be used to generate vector
+ *
+ * This function performs a special variant of the  core cryptographic
+ * function of the AUC: computing authentication triples/quintuples
+ * based on the permanent subscriber data, a random value as well as the
+ * AUTS and RAND values returned by the SIM/MS.  This special variant is
+ * needed if the sequence numbers between MS and AUC have for some
+ * reason become diffrent.
+ */
 int osmo_auth_gen_vec_auts(struct osmo_auth_vector *vec,
 			   struct osmo_sub_auth_data *aud,
 			   const uint8_t *rand_auts, const uint8_t *auts,
@@ -100,7 +147,7 @@ int osmo_auth_gen_vec_auts(struct osmo_auth_vector *vec,
 	return impl->gen_vec_auts(vec, aud, rand_auts, auts, _rand);
 }
 
-const struct value_string auth_alg_vals[] = {
+static const struct value_string auth_alg_vals[] = {
 	{ OSMO_AUTH_ALG_NONE, "None" },
 	{ OSMO_AUTH_ALG_COMP128v1, "COMP128v1" },
 	{ OSMO_AUTH_ALG_COMP128v2, "COMP128v2" },
@@ -110,12 +157,16 @@ const struct value_string auth_alg_vals[] = {
 	{ 0, NULL }
 };
 
+/*! \brief Get human-readable name of authentication algorithm */
 const char *osmo_auth_alg_name(enum osmo_auth_algo alg)
 {
 	return get_value_string(auth_alg_vals, alg);
 }
 
+/*! \brief Parse human-readable name of authentication algorithm */
 enum osmo_auth_algo osmo_auth_alg_parse(const char *name)
 {
 	return get_string_value(auth_alg_vals, name);
 }
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/gan.c b/src/shared/libosmocore/src/gsm/gan.c
new file mode 100644
index 00000000..e041936e
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gan.c
@@ -0,0 +1,77 @@
+/* (C) 2012 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <unistd.h>
+#include <osmocom/core/utils.h>
+
+#include <osmocom/gsm/protocol/gsm_44_318.h>
+
+
+const struct value_string gan_msgt_vals[] = {
+	{ GA_MT_RC_DISCOVERY_REQUEST,	"GA-RC DISCOVERY REQUEST" },
+	{ GA_MT_RC_DISCOVERY_ACCEPT,	"GA-RC DISCOVERY ACCEPT" },
+	{ GA_MT_RC_DISCOVERY_REJECT,	"GA-RC DISCOVERY REJECT" },
+	{ GA_MT_RC_REGISTER_REQUEST,	"GA-RC REGISTER REQUEST" },
+	{ GA_MT_RC_REGISTER_ACCEPT,	"GA-RC REGISTER ACCEPT" },
+	{ GA_MT_RC_REGISTER_REDIRECT,	"GA-RC REGISTER REDIRECT" },
+	{ GA_MT_RC_REGISTER_REJECT,	"GA-RC REGISTER REJECT" },
+	{ GA_MT_RC_DEREGISTER,		"GA-RC DEREGISTER" },
+	{ GA_MT_RC_REGISTER_UPDATE_UL,	"GA-RC REGISTER UPDATE UL" },
+	{ GA_MT_RC_REGISTER_UPDATE_DL,	"GA-RC REGISTER UPDATE DL" },
+	{ GA_MT_RC_CELL_BCAST_INFO,	"GA-RC CELL BROADCAST INFO" },
+	{ GA_MT_CSR_CIPH_MODE_CMD,	"GA-CSR CIPHER MDOE COMMAND" },
+	{ GA_MT_CSR_CIPH_MODE_COMPL,	"GA-CSR CIPHER MODE COMPLETE" },
+	{ GA_MT_CSR_ACT_CHAN,		"GA-CSR ACTIVATE CHANNEL" },
+	{ GA_MT_CSR_ACT_CHAN_ACK,	"GA-CSR ACTIVATE CHANNEL ACK" },
+	{ GA_MT_CSR_ACT_CHAN_COMPL,	"GA-CSR ACTIVATE CHANNEL COMPLETE" },
+	{ GA_MT_CSR_ACT_CHAN_FAIL,	"GA-CSR ACTIVATE CHANNEL FAIL" },
+	{ GA_MT_CSR_CHAN_MODE_MOD,	"GA-CSR CHANNEL MODE MODIFY" },
+	{ GA_MT_CSR_CHAN_MODE_MOD_ACK,	"GA-CSR CHANNEL MODE MODIFY ACK" },
+	{ GA_MT_CSR_RELEASE,		"GA-CSR RELEASE" },
+	{ GA_MT_CSR_RELEASE_COMPL,	"GA-CSR RELEASE COMPLETE" },
+	{ GA_MT_CSR_CLEAR_REQ,		"GA-CSR CLEAR REQUEST" },
+	{ GA_MT_CSR_HO_ACCESS,		"GA-CSR HANDOVER ACCESS" },
+	{ GA_MT_CSR_HO_COMPL,		"GA-CSR HANDOVER COMPLETE" },
+	{ GA_MT_CSR_UL_QUAL_IND,	"GA-CSR UL QUALITY INDICATION" },
+	{ GA_MT_CSR_HO_INFO,		"GA-CSR HANDOVER INFO" },
+	{ GA_MT_CSR_HO_CMD,		"GA-CSR HANDOVER COMMAND" },
+	{ GA_MT_CSR_HO_FAIL,		"GA-CSR HANDOVER FAILURE" },
+	{ GA_MT_CSR_PAGING_REQ,		"GA-CSR PAGING REQUEST" },
+	{ GA_MT_CSR_PAGING_RESP,	"GA-CSR PAGING RESPONSE" },
+	{ GA_MT_CSR_UL_DIRECT_XFER,	"GA-CSR UL DIRECT TRANSFER" },
+	{ GA_MT_CSR_DL_DIRECT_XFER,	"GA-CSR DL DIRECT TRANSFER" },
+	{ GA_MT_CSR_STATUS,		"GA-CSR STATUS" },
+	{ GA_MT_RC_KEEPALIVE,		"GA-CSR KEEPALIVE" },
+	{ GA_MT_CSR_CM_ENQ,		"GA-CSR CLASSMARK ENQUIRY" },
+	{ GA_MT_CSR_CM_CHANGE,		"GA-CSR CLASSMARK CHANGE" },
+	{ GA_MT_PSR_GPRS_SUSPEND_REQ,	"GA-PSR GPRS SUSPEND REQUEST" },
+	{ GA_RC_SYNC_INFO,		"GA-RC SYNCH INFORMATION" },
+	{ GA_CSR_UTRAN_CM_CHG,		"GA-CSR UTRAN CLASSMARK CHANGE" },
+	{ GA_MT_CSR_REQUEST,		"GA-CSR REQUEST" },
+	{ GA_MT_CSR_REQUEST_ACCEPT,	"GA-CSR REQUEST ACCEPT" },
+	{ GA_MT_CSR_REQUEST_REJECT,	"GA-CSR REQUEST REJECT" },
+	{ 0, NULL }
+};
+
+static const struct value_string gan_pdisc_vals[] = {
+	{ GA_PDISC_RC,			"RC" },
+	{ GA_PDISC_CSR,			"CSR" },
+	{ GA_PDISC_PSR,			"PSR" },
+	{ 0, NULL }
+};
+
diff --git a/src/shared/libosmocore/src/gsm/gsm0411_utils.c b/src/shared/libosmocore/src/gsm/gsm0411_utils.c
index 5076ec82..ebde8fca 100644
--- a/src/shared/libosmocore/src/gsm/gsm0411_utils.c
+++ b/src/shared/libosmocore/src/gsm/gsm0411_utils.c
@@ -25,6 +25,7 @@
  *
  */
 
+#include "../../config.h"
 
 #include <time.h>
 #include <string.h>
@@ -80,7 +81,12 @@ void gsm340_gen_scts(uint8_t *scts, time_t time)
 	*scts++ = gsm411_bcdify(tm->tm_hour);
 	*scts++ = gsm411_bcdify(tm->tm_min);
 	*scts++ = gsm411_bcdify(tm->tm_sec);
-	*scts++ = gsm411_bcdify(0); /* GMT */
+#ifdef HAVE_TM_GMTOFF_IN_TM
+	*scts++ = gsm411_bcdify(tm->tm_gmtoff/(60*15));
+#else
+#warning find a portable way to obtain timezone offset
+	*scts++ = 0;
+#endif
 }
 
 /* Decode 03.40 TP-SCTS (into utc/gmt timestamp) */
@@ -101,6 +107,9 @@ time_t gsm340_scts(uint8_t *scts)
 	tm.tm_hour = gsm411_unbcdify(*scts++);
 	tm.tm_min  = gsm411_unbcdify(*scts++);
 	tm.tm_sec  = gsm411_unbcdify(*scts++);
+#ifdef HAVE_TM_GMTOFF_IN_TM
+	tm.tm_gmtoff = gsm411_unbcdify(*scts++) * 15*60;
+#endif
 
 	/* according to gsm 03.40 time zone is
 	   "expressed in quarters of an hour" */
diff --git a/src/shared/libosmocore/src/gsm/gsm48.c b/src/shared/libosmocore/src/gsm/gsm48.c
index 379ed65c..fe62dee7 100644
--- a/src/shared/libosmocore/src/gsm/gsm48.c
+++ b/src/shared/libosmocore/src/gsm/gsm48.c
@@ -285,6 +285,27 @@ void gsm48_generate_lai(struct gsm48_loc_area_id *lai48, uint16_t mcc,
 	lai48->lac = htons(lac);
 }
 
+/* Attention: this function retunrs true integers, not hex! */
+int gsm48_decode_lai(struct gsm48_loc_area_id *lai, uint16_t *mcc,
+		     uint16_t *mnc, uint16_t *lac)
+{
+	*mcc = (lai->digits[0] & 0x0f) * 100
+	     + (lai->digits[0] >> 4) * 10
+	     + (lai->digits[1] & 0x0f);
+
+	if ((lai->digits[1] & 0xf0) == 0xf0) {
+		*mnc = (lai->digits[2] & 0x0f) * 10
+		     + (lai->digits[2] >> 4);
+	} else {
+		*mnc = (lai->digits[2] & 0x0f) * 100
+		     + (lai->digits[2] >> 4) * 10
+		     + (lai->digits[1] >> 4);
+	}
+	*lac = ntohs(lai->lac);
+
+	return 0;
+}
+
 int gsm48_generate_mid_from_tmsi(uint8_t *buf, uint32_t tmsi)
 {
 	uint32_t *tptr = (uint32_t *) &buf[3];
diff --git a/src/shared/libosmocore/src/gsm/gsm48_ie.c b/src/shared/libosmocore/src/gsm/gsm48_ie.c
index c10d0ed7..78619b97 100644
--- a/src/shared/libosmocore/src/gsm/gsm48_ie.c
+++ b/src/shared/libosmocore/src/gsm/gsm48_ie.c
@@ -110,7 +110,7 @@ int gsm48_encode_bcd_number(uint8_t *bcd_lv, uint8_t max_len,
 	return (bcd_cur - bcd_lv);
 }
 
-/* decode 'bearer capability' */
+/* TS 04.08 10.5.4.5: decode 'bearer capability' */
 int gsm48_decode_bearer_cap(struct gsm_mncc_bearer_cap *bcap,
 			     const uint8_t *lv)
 {
@@ -128,7 +128,8 @@ int gsm48_decode_bearer_cap(struct gsm_mncc_bearer_cap *bcap,
 	bcap->coding = (lv[1] & 0x10) >> 4;
 	bcap->radio = (lv[1] & 0x60) >> 5;
 
-	if (bcap->transfer == GSM_MNCC_BCAP_SPEECH) {
+	switch (bcap->transfer) {
+	case GSM_MNCC_BCAP_SPEECH:
 		i = 1;
 		s = 0;
 		while(!(lv[i] & 0x80)) {
@@ -142,7 +143,68 @@ int gsm48_decode_bearer_cap(struct gsm_mncc_bearer_cap *bcap,
 			if (s == 7) /* maximum speech versions + end of list */
 				return 0;
 		}
-	} else {
+		break;
+	case GSM_MNCC_BCAP_UNR_DIG:
+	case GSM_MNCC_BCAP_FAX_G3:
+		i = 1;
+		while(!(lv[i] & 0x80)) {
+			i++; /* octet 3a etc */
+			if (in_len < i)
+				return 0;
+			/* ignore them */
+		}
+		/* octet 4: skip */
+		i++;
+		/* octet 5 */
+		i++;
+		if (in_len < i)
+			return 0;
+		bcap->data.rate_adaption = (lv[i] >> 3) & 3;
+		bcap->data.sig_access = lv[i] & 7;
+		while(!(lv[i] & 0x80)) {
+			i++; /* octet 5a etc */
+			if (in_len < i)
+				return 0;
+			/* ignore them */
+		}
+		/* octet 6 */
+		i++;
+		if (in_len < i)
+			return 0;
+		bcap->data.async = lv[i] & 1;
+		if (!(lv[i] & 0x80)) {
+			i++;
+			if (in_len < i)
+				return 0;
+			/* octet 6a */
+			bcap->data.nr_stop_bits = ((lv[i] >> 7) & 1) + 1;
+			if (lv[i] & 0x10)
+				bcap->data.nr_data_bits = 8;
+			else
+				bcap->data.nr_data_bits = 7;
+			bcap->data.user_rate = lv[i]  & 0xf;
+
+			if (!(lv[i] & 0x80)) {
+				i++;
+				if (in_len < i)
+					return 0;
+				/* octet 6b */
+				bcap->data.parity = lv[i] & 7;
+				bcap->data.interm_rate = (lv[i] >> 5) & 3;
+
+				/* octet 6c */
+				if (!(lv[i] & 0x80)) {
+					i++;
+					if (in_len < i)
+						return 0;
+					bcap->data.transp = (lv[i] >> 5) & 3;
+					bcap->data.modem_type = lv[i] & 0x1F;
+				}
+			}
+
+		}
+		break;
+	default:
 		i = 1;
 		while (!(lv[i] & 0x80)) {
 			i++; /* octet 3a etc */
@@ -151,12 +213,13 @@ int gsm48_decode_bearer_cap(struct gsm_mncc_bearer_cap *bcap,
 			/* ignore them */
 		}
 		/* FIXME: implement OCTET 4+ parsing */
+		break;
 	}
 
 	return 0;
 }
 
-/* encode 'bearer capability' */
+/* TS 04.08 10.5.4.5: encode 'bearer capability' */
 int gsm48_encode_bearer_cap(struct msgb *msg, int lv_only,
 			     const struct gsm_mncc_bearer_cap *bcap)
 {
@@ -168,7 +231,8 @@ int gsm48_encode_bearer_cap(struct msgb *msg, int lv_only,
 	lv[1] |= bcap->coding << 4;
 	lv[1] |= bcap->radio << 5;
 
-	if (bcap->transfer == GSM_MNCC_BCAP_SPEECH) {
+	switch (bcap->transfer) {
+	case GSM_MNCC_BCAP_SPEECH:
 		for (s = 0; bcap->speech_ver[s] >= 0; s++) {
 			i++; /* octet 3a etc */
 			lv[i] = bcap->speech_ver[s];
@@ -176,8 +240,29 @@ int gsm48_encode_bearer_cap(struct msgb *msg, int lv_only,
 				lv[i] |= bcap->speech_ctm << 5;
 		}
 		lv[i] |= 0x80; /* last IE of octet 3 etc */
-	} else {
-		/* FIXME: implement OCTET 4+ encoding */
+		break;
+	case GSM48_BCAP_ITCAP_UNR_DIG_INF:
+	case GSM48_BCAP_ITCAP_FAX_G3:
+		lv[i++] |= 0x80; /* last IE of octet 3 etc */
+		/* octet 4 */
+		lv[i++] = 0xb8;
+		/* octet 5 */
+		lv[i++] = 0x80 | ((bcap->data.rate_adaption & 3) << 3)
+			  | (bcap->data.sig_access & 7);
+		/* octet 6 */
+		lv[i++] = 0x20 | (bcap->data.async & 1);
+		/* octet 6a */
+		lv[i++] = (bcap->data.user_rate & 0xf) |
+			  (bcap->data.nr_data_bits == 8 ? 0x10 : 0x00) |
+			  (bcap->data.nr_stop_bits == 2 ? 0x40 : 0x00);
+		/* octet 6b */
+		lv[i++] = (bcap->data.parity & 7) |
+			  ((bcap->data.interm_rate & 3) << 5);
+		/* octet 6c */
+		lv[i] = 0x80 | (bcap->data.modem_type & 0x1f);
+		break;
+	default:
+		return -EINVAL;
 	}
 
 	lv[0] = i;
@@ -189,7 +274,7 @@ int gsm48_encode_bearer_cap(struct msgb *msg, int lv_only,
 	return 0;
 }
 
-/* decode 'call control cap' */
+/* TS 04.08 10.5.4.5a: decode 'call control cap' */
 int gsm48_decode_cccap(struct gsm_mncc_cccap *ccap, const uint8_t *lv)
 {
 	uint8_t in_len = lv[0];
@@ -204,7 +289,7 @@ int gsm48_decode_cccap(struct gsm_mncc_cccap *ccap, const uint8_t *lv)
 	return 0;
 }
 
-/* encode 'call control cap' */
+/* TS 04.08 10.5.4.5a: encode 'call control cap' */
 int gsm48_encode_cccap(struct msgb *msg,
 			const struct gsm_mncc_cccap *ccap)
 {
@@ -222,7 +307,7 @@ int gsm48_encode_cccap(struct msgb *msg,
 	return 0;
 }
 
-/* decode 'called party BCD number' */
+/* TS 04.08 10.5.4.7: decode 'called party BCD number' */
 int gsm48_decode_called(struct gsm_mncc_number *called,
 			 const uint8_t *lv)
 {
@@ -241,7 +326,7 @@ int gsm48_decode_called(struct gsm_mncc_number *called,
 	return 0;
 }
 
-/* encode 'called party BCD number' */
+/* TS 04.08 10.5.4.7: encode 'called party BCD number' */
 int gsm48_encode_called(struct msgb *msg,
 			 const struct gsm_mncc_number *called)
 {
@@ -321,7 +406,7 @@ int gsm48_encode_callerid(struct msgb *msg, int ie, int max_len,
 	return 0;
 }
 
-/* decode 'cause' */
+/* TS 04.08 10.5.4.11: decode 'cause' */
 int gsm48_decode_cause(struct gsm_mncc_cause *cause,
 			const uint8_t *lv)
 {
@@ -364,7 +449,7 @@ int gsm48_decode_cause(struct gsm_mncc_cause *cause,
 	return 0;
 }
 
-/* encode 'cause' */
+/* TS 04.08 10.5.4.11: encode 'cause' */
 int gsm48_encode_cause(struct msgb *msg, int lv_only,
 			const struct gsm_mncc_cause *cause)
 {
@@ -404,49 +489,49 @@ int gsm48_encode_cause(struct msgb *msg, int lv_only,
 	return 0;
 }
 
-/* decode 'calling number' */
+/* TS 04.08 10.5.4.9: decode 'calling number' */
 int gsm48_decode_calling(struct gsm_mncc_number *calling,
 			 const uint8_t *lv)
 {
 	return gsm48_decode_callerid(calling, lv);
 }
 
-/* encode 'calling number' */
+/* TS 04.08 10.5.4.9: encode 'calling number' */
 int gsm48_encode_calling(struct msgb *msg, 
 			  const struct gsm_mncc_number *calling)
 {
 	return gsm48_encode_callerid(msg, GSM48_IE_CALLING_BCD, 14, calling);
 }
 
-/* decode 'connected number' */
+/* TS 04.08 10.5.4.13: decode 'connected number' */
 int gsm48_decode_connected(struct gsm_mncc_number *connected,
 			 const uint8_t *lv)
 {
 	return gsm48_decode_callerid(connected, lv);
 }
 
-/* encode 'connected number' */
+/* TS 04.08 10.5.4.13: encode 'connected number' */
 int gsm48_encode_connected(struct msgb *msg,
 			    const struct gsm_mncc_number *connected)
 {
 	return gsm48_encode_callerid(msg, GSM48_IE_CONN_BCD, 14, connected);
 }
 
-/* decode 'redirecting number' */
+/* TS 04.08 10.5.4.21b: decode 'redirecting number' */
 int gsm48_decode_redirecting(struct gsm_mncc_number *redirecting,
 			 const uint8_t *lv)
 {
 	return gsm48_decode_callerid(redirecting, lv);
 }
 
-/* encode 'redirecting number' */
+/* TS 04.08 10.5.4.21b: encode 'redirecting number' */
 int gsm48_encode_redirecting(struct msgb *msg,
 			      const struct gsm_mncc_number *redirecting)
 {
 	return gsm48_encode_callerid(msg, GSM48_IE_REDIR_BCD, 19, redirecting);
 }
 
-/* decode 'facility' */
+/* TS 04.08 10.5.4.15: decode 'facility' */
 int gsm48_decode_facility(struct gsm_mncc_facility *facility,
 			   const uint8_t *lv)
 {
@@ -464,7 +549,7 @@ int gsm48_decode_facility(struct gsm_mncc_facility *facility,
 	return 0;
 }
 
-/* encode 'facility' */
+/* TS 04.08 10.5.4.15: encode 'facility' */
 int gsm48_encode_facility(struct msgb *msg, int lv_only,
 			   const struct gsm_mncc_facility *facility)
 {
@@ -483,7 +568,7 @@ int gsm48_encode_facility(struct msgb *msg, int lv_only,
 	return 0;
 }
 
-/* decode 'notify' */
+/* TS 04.08 10.5.4.20: decode 'notify' */
 int gsm48_decode_notify(int *notify, const uint8_t *v)
 {
 	*notify = v[0] & 0x7f;
@@ -491,7 +576,7 @@ int gsm48_decode_notify(int *notify, const uint8_t *v)
 	return 0;
 }
 
-/* encode 'notify' */
+/* TS 04.08 10.5.4.20: encode 'notify' */
 int gsm48_encode_notify(struct msgb *msg, int notify)
 {
 	msgb_v_put(msg, notify | 0x80);
@@ -499,7 +584,7 @@ int gsm48_encode_notify(struct msgb *msg, int notify)
 	return 0;
 }
 
-/* decode 'signal' */
+/* TS 04.08 10.5.4.23: decode 'signal' */
 int gsm48_decode_signal(int *signal, const uint8_t *v)
 {
 	*signal = v[0];
@@ -507,7 +592,7 @@ int gsm48_decode_signal(int *signal, const uint8_t *v)
 	return 0;
 }
 
-/* encode 'signal' */
+/* TS 04.08 10.5.4.23: encode 'signal' */
 int gsm48_encode_signal(struct msgb *msg, int signal)
 {
 	msgb_tv_put(msg, GSM48_IE_SIGNAL, signal);
@@ -515,7 +600,7 @@ int gsm48_encode_signal(struct msgb *msg, int signal)
 	return 0;
 }
 
-/* decode 'keypad' */
+/* TS 04.08 10.5.4.17: decode 'keypad' */
 int gsm48_decode_keypad(int *keypad, const uint8_t *lv)
 {
 	uint8_t in_len = lv[0];
@@ -528,7 +613,7 @@ int gsm48_decode_keypad(int *keypad, const uint8_t *lv)
 	return 0;
 }
 
-/* encode 'keypad' */
+/* TS 04.08 10.5.4.17: encode 'keypad' */
 int gsm48_encode_keypad(struct msgb *msg, int keypad)
 {
 	msgb_tv_put(msg, GSM48_IE_KPD_FACILITY, keypad);
@@ -536,7 +621,7 @@ int gsm48_encode_keypad(struct msgb *msg, int keypad)
 	return 0;
 }
 
-/* decode 'progress' */
+/* TS 04.08 10.5.4.21: decode 'progress' */
 int gsm48_decode_progress(struct gsm_mncc_progress *progress,
 			   const uint8_t *lv)
 {
@@ -552,7 +637,7 @@ int gsm48_decode_progress(struct gsm_mncc_progress *progress,
 	return 0;
 }
 
-/* encode 'progress' */
+/* TS 04.08 10.5.4.21: encode 'progress' */
 int gsm48_encode_progress(struct msgb *msg, int lv_only,
 			   const struct gsm_mncc_progress *p)
 {
@@ -569,7 +654,7 @@ int gsm48_encode_progress(struct msgb *msg, int lv_only,
 	return 0;
 }
 
-/* decode 'user-user' */
+/* TS 04.08 10.5.4.25: decode 'user-user' */
 int gsm48_decode_useruser(struct gsm_mncc_useruser *uu,
 			   const uint8_t *lv)
 {
@@ -595,7 +680,7 @@ int gsm48_decode_useruser(struct gsm_mncc_useruser *uu,
 	return 0;
 }
 
-/* encode 'useruser' */
+/* TS 04.08 10.5.4.25: encode 'useruser' */
 int gsm48_encode_useruser(struct msgb *msg, int lv_only,
 			   const struct gsm_mncc_useruser *uu)
 {
@@ -615,7 +700,7 @@ int gsm48_encode_useruser(struct msgb *msg, int lv_only,
 	return 0;
 }
 
-/* decode 'ss version' */
+/* TS 04.08 10.5.4.24: decode 'ss version' */
 int gsm48_decode_ssversion(struct gsm_mncc_ssversion *ssv,
 			    const uint8_t *lv)
 {
@@ -630,7 +715,7 @@ int gsm48_decode_ssversion(struct gsm_mncc_ssversion *ssv,
 	return 0;
 }
 
-/* encode 'ss version' */
+/* TS 04.08 10.5.4.24: encode 'ss version' */
 int gsm48_encode_ssversion(struct msgb *msg,
 			   const struct gsm_mncc_ssversion *ssv)
 {
@@ -648,7 +733,7 @@ int gsm48_encode_ssversion(struct msgb *msg,
 
 /* decode 'more data' does not require a function, because it has no value */
 
-/* encode 'more data' */
+/* TS 04.08 10.5.4.19: encode 'more data' */
 int gsm48_encode_more(struct msgb *msg)
 {
 	uint8_t *ie;
diff --git a/src/shared/libosmocore/src/gsm/lapdm.c b/src/shared/libosmocore/src/gsm/lapdm.c
index e9ce881b..1c08113e 100644
--- a/src/shared/libosmocore/src/gsm/lapdm.c
+++ b/src/shared/libosmocore/src/gsm/lapdm.c
@@ -391,7 +391,6 @@ static int rsl_rll_error(uint8_t cause, struct lapdm_msg_ctx *mctx)
 
 	LOGP(DLLAPD, LOGL_NOTICE, "sending MDL-ERROR-IND %d\n", cause);
 	msg = rsl_rll_simple(RSL_MT_ERROR_IND, mctx->chan_nr, mctx->link_id, 1);
-	msg->l2h = msgb_put(msg, sizeof(struct abis_rsl_rll_hdr));
 	msgb_tlv_put(msg, RSL_IE_RLM_CAUSE, 1, &cause);
 	return rslms_sendmsg(msg, mctx->dl->entity);
 }
@@ -960,7 +959,12 @@ static int rslms_rx_rll_rel_req(struct msgb *msg, struct lapdm_datalink *dl)
 		mode = rllh->data[1] & 1;
 
 	/* Pull rllh */
-	msgb_pull(msg, msg->tail - msg->l2h);
+	msgb_pull_l2h(msg);
+
+	/* 04.06 3.8.3: No information field is permitted with the DISC
+	 * command. */
+	msg->len = 0;
+	msg->tail = msg->l3h = msg->data;
 
 	/* prepare prim */
 	osmo_prim_init(&dp.oph, 0, PRIM_DL_REL, PRIM_OP_REQUEST, msg);
@@ -1242,4 +1246,4 @@ void lapdm_channel_set_flags(struct lapdm_channel *lc, unsigned int flags)
 	lapdm_entity_set_flags(&lc->lapdm_acch, flags);
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/libosmogsm.map b/src/shared/libosmocore/src/gsm/libosmogsm.map
new file mode 100644
index 00000000..33738881
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/libosmogsm.map
@@ -0,0 +1,236 @@
+LIBOSMOGSM_1.0 {
+global:
+
+abis_nm_adm_state_names;
+abis_nm_att_settable;
+abis_nm_avail_name;
+abis_nm_chcomb4pchan;
+abis_nm_debugp_foh;
+abis_nm_event_type_name;
+abis_nm_nack_cause_name;
+abis_nm_nack_name;
+abis_nm_att_tlvdef;
+abis_nm_obj_class_names;
+abis_nm_opstate_name;
+abis_nm_nacks;
+abis_nm_no_ack_nack;
+abis_nm_pchan4chcomb;
+abis_nm_reports;
+abis_nm_severity_name;
+abis_nm_sw_load_msgs;
+abis_nm_test_name;
+
+osmo_sitype_strs;
+
+comp128;
+dbm2rxlev;
+
+gprs_cipher_gen_input_i;
+gprs_cipher_gen_input_ui;
+gprs_cipher_load;
+gprs_cipher_register;
+gprs_cipher_run;
+gprs_cipher_supported;
+gprs_tlli_type;
+gprs_tmsi2tlli;
+
+gsm0480_create_notifySS;
+gsm0480_create_unstructuredSS_Notify;
+gsm0480_create_ussd_resp;
+gsm0480_decode_ussd_request;
+gsm0480_wrap_facility;
+gsm0480_wrap_invoke;
+
+gsm0502_calc_paging_group;
+
+gsm0808_att_tlvdef;
+gsm0808_bssap_name;
+gsm0808_bssmap_name;
+gsm0808_create_assignment_completed;
+gsm0808_create_assignment_failure;
+gsm0808_create_cipher_complete;
+gsm0808_create_cipher_reject;
+gsm0808_create_classmark_update;
+gsm0808_create_clear_command;
+gsm0808_create_clear_complete;
+gsm0808_create_clear_rqst;
+gsm0808_create_dtap;
+gsm0808_create_layer3;
+gsm0808_create_reset;
+gsm0808_create_sapi_reject;
+gsm0808_prepend_dtap_header;
+
+gsm338_get_sms_alphabet;
+
+gsm340_gen_oa;
+gsm340_gen_scts;
+gsm340_scts;
+gsm340_validity_period;
+
+gsm411_bcdify;
+gsm411_msgb_alloc;
+gsm411_push_cp_header;
+gsm411_push_rp_header;
+gsm411_smc_clear;
+gsm411_smc_init;
+gsm411_smc_recv;
+gsm411_smc_send;
+gsm411_smr_clear;
+gsm411_smr_init;
+gsm411_smr_recv;
+gsm411_smr_send;
+gsm411_unbcdify;
+gsm411_cp_cause_strs;
+gsm411_rp_cause_strs;
+
+gsm48_att_tlvdef;
+gsm48_cc_msg_name;
+gsm48_cc_state_name;
+gsm48_construct_ra;
+gsm48_decode_bcd_number;
+gsm48_decode_bearer_cap;
+gsm48_decode_called;
+gsm48_decode_callerid;
+gsm48_decode_calling;
+gsm48_decode_cause;
+gsm48_decode_cccap;
+gsm48_decode_connected;
+gsm48_decode_facility;
+gsm48_decode_freq_list;
+gsm48_decode_keypad;
+gsm48_decode_lai;
+gsm48_decode_notify;
+gsm48_decode_progress;
+gsm48_decode_redirecting;
+gsm48_decode_signal;
+gsm48_decode_ssversion;
+gsm48_decode_useruser;
+gsm48_encode_bcd_number;
+gsm48_encode_bearer_cap;
+gsm48_encode_called;
+gsm48_encode_callerid;
+gsm48_encode_calling;
+gsm48_encode_cause;
+gsm48_encode_cccap;
+gsm48_encode_connected;
+gsm48_encode_facility;
+gsm48_encode_keypad;
+gsm48_encode_more;
+gsm48_encode_notify;
+gsm48_encode_progress;
+gsm48_encode_redirecting;
+gsm48_encode_signal;
+gsm48_encode_ssversion;
+gsm48_encode_useruser;
+gsm48_generate_lai;
+gsm48_generate_mid_from_imsi;
+gsm48_generate_mid_from_tmsi;
+gsm48_mi_to_string;
+gsm48_mm_att_tlvdef;
+gsm48_number_of_paging_subchannels;
+gsm48_parse_ra;
+gsm48_rr_att_tlvdef;
+
+gsm_7bit_decode;
+gsm_7bit_decode_hdr;
+gsm_7bit_encode;
+
+gsm_arfcn2band;
+gsm_arfcn2freq10;
+gsm_band_name;
+gsm_band_parse;
+gsm_fn2gsmtime;
+gsm_get_octet_len;
+gsm_gsmtime2fn;
+
+gsm_milenage;
+gsm_septet_encode;
+gsm_septets2octets;
+
+lapd_dl_exit;
+lapd_dl_init;
+lapd_dl_reset;
+lapd_msgb_alloc;
+lapd_ph_data_ind;
+lapd_recv_dlsap;
+lapd_set_mode;
+lapd_state_names;
+
+lapdm_channel_exit;
+lapdm_channel_init;
+lapdm_channel_reset;
+lapdm_channel_set_flags;
+lapdm_channel_set_l1;
+lapdm_channel_set_l3;
+lapdm_channel_set_mode;
+lapdm_entity_exit;
+lapdm_entity_init;
+lapdm_entity_reset;
+lapdm_entity_set_flags;
+lapdm_entity_set_mode;
+lapdm_phsap_dequeue_prim;
+lapdm_phsap_up;
+lapdm_rslms_recvmsg;
+
+milenage_auts;
+milenage_check;
+milenage_f1;
+milenage_f2345;
+milenage_generate;
+milenage_opc_gen;
+
+ms_class_gmsk_dbm;
+ms_pwr_ctl_lvl;
+ms_pwr_dbm;
+
+osmo_a5;
+osmo_a5_1;
+osmo_a5_2;
+
+osmo_auth_alg_name;
+osmo_auth_alg_parse;
+osmo_auth_gen_vec;
+osmo_auth_gen_vec_auts;
+osmo_auth_load;
+osmo_auth_register;
+osmo_auth_supported;
+
+osmo_rsl2sitype;
+osmo_sitype2rsl;
+
+rr_cause_name;
+
+rsl_att_tlvdef;
+rsl_ccch_conf_to_bs_cc_chans;
+rsl_ccch_conf_to_bs_ccch_sdcch_comb;
+rsl_chan_nr_str;
+rsl_dec_chan_nr;
+rsl_enc_chan_nr;
+rsl_err_name;
+rsl_init_cchan_hdr;
+rsl_init_rll_hdr;
+rsl_ipac_msg_name;
+rsl_msg_name;
+rsl_rll_push_hdr;
+rsl_rll_push_l3;
+rsl_rll_simple;
+rsl_rlm_cause_name;
+
+rxlev2dbm;
+rxlev_stat_dump;
+rxlev_stat_get_next;
+rxlev_stat_input;
+rxlev_stat_reset;
+
+tlv_def_patch;
+tlv_dump;
+tlv_parse;
+tlv_parse_one;
+tvlv_att_def;
+vtvlv_gan_att_def;
+
+gan_msgt_vals;
+gan_pdisc_vals;
+
+local: *;
+};
diff --git a/src/shared/libosmocore/src/gsm/rsl.c b/src/shared/libosmocore/src/gsm/rsl.c
index db276a2a..5693b4f0 100644
--- a/src/shared/libosmocore/src/gsm/rsl.c
+++ b/src/shared/libosmocore/src/gsm/rsl.c
@@ -504,4 +504,4 @@ struct msgb *rsl_rll_simple(uint8_t msg_type, uint8_t chan_nr,
 	return msg;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/tlv_parser.c b/src/shared/libosmocore/src/gsm/tlv_parser.c
index c832d56f..d18a6bfd 100644
--- a/src/shared/libosmocore/src/gsm/tlv_parser.c
+++ b/src/shared/libosmocore/src/gsm/tlv_parser.c
@@ -9,6 +9,7 @@
 /*! \file tlv.c */
 
 struct tlv_definition tvlv_att_def;
+struct tlv_definition vtvlv_gan_att_def;
 
 /*! \brief Dump pasred TLV structure to stdout */
 int tlv_dump(struct tlv_parsed *dec)
@@ -69,7 +70,7 @@ int tlv_parse_one(uint8_t *o_tag, uint16_t *o_len, const uint8_t **o_val,
 		len = def->def[tag].fixed_len + 1;
 		break;
 	case TLV_TYPE_TLV:
-		/* GSM TS 04.07 11.2.4: Type 4 TLV */
+tlv:		/* GSM TS 04.07 11.2.4: Type 4 TLV */
 		if (buf + 1 > buf + buf_len)
 			return -1;
 		*o_val = buf+2;
@@ -78,6 +79,22 @@ int tlv_parse_one(uint8_t *o_tag, uint16_t *o_len, const uint8_t **o_val,
 		if (len > buf_len)
 			return -2;
 		break;
+	case TLV_TYPE_vTvLV_GAN:	/* 44.318 / 11.1.4 */
+		/* FIXME: variable-length TAG! */
+		if (*(buf+1) & 0x80) {
+			/* like TL16Vbut without highest bit of len */
+			if (2 > buf_len)
+				return -1;
+			*o_val = buf+3;
+			*o_len = (*(buf+1) & 0x7F) << 8 | *(buf+2);
+			len = *o_len + 3;
+			if (len > buf_len)
+				return -2;
+		} else {
+			/* like TLV */
+			goto tlv;
+		}
+		break;
 	case TLV_TYPE_TvLV:
 		if (*(buf+1) & 0x80) {
 			/* like TLV, but without highest bit of len */
@@ -184,6 +201,9 @@ static __attribute__((constructor)) void on_dso_load_tlv(void)
 	int i;
 	for (i = 0; i < ARRAY_SIZE(tvlv_att_def.def); i++)
 		tvlv_att_def.def[i].type = TLV_TYPE_TvLV;
+
+	for (i = 0; i < ARRAY_SIZE(vtvlv_gan_att_def.def); i++)
+		vtvlv_gan_att_def.def[i].type = TLV_TYPE_vTvLV_GAN;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/logging.c b/src/shared/libosmocore/src/logging.c
index f8ed4cb1..1ab8767f 100644
--- a/src/shared/libosmocore/src/logging.c
+++ b/src/shared/libosmocore/src/logging.c
@@ -214,7 +214,7 @@ static const char* color(int subsys)
 }
 
 static void _output(struct log_target *target, unsigned int subsys,
-		    unsigned int level, char *file, int line, int cont,
+		    unsigned int level, const char *file, int line, int cont,
 		    const char *format, va_list ap)
 {
 	char buf[4096];
@@ -264,7 +264,7 @@ err:
 }
 
 /*! \brief vararg version of logging function */
-void osmo_vlogp(int subsys, int level, char *file, int line,
+void osmo_vlogp(int subsys, int level, const char *file, int line,
 		int cont, const char *format, va_list ap)
 {
 	struct log_target *tar;
@@ -314,7 +314,7 @@ void osmo_vlogp(int subsys, int level, char *file, int line,
 	}
 }
 
-void logp(int subsys, char *file, int line, int cont,
+void logp(int subsys, const char *file, int line, int cont,
 	  const char *format, ...)
 {
 	va_list ap;
@@ -324,7 +324,7 @@ void logp(int subsys, char *file, int line, int cont,
 	va_end(ap);
 }
 
-void logp2(int subsys, unsigned int level, char *file, int line, int cont, const char *format, ...)
+void logp2(int subsys, unsigned int level, const char *file, int line, int cont, const char *format, ...)
 {
 	va_list ap;
 
@@ -754,4 +754,4 @@ int log_init(const struct log_info *inf, void *ctx)
 	return 0;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/logging_syslog.c b/src/shared/libosmocore/src/logging_syslog.c
index 119dd740..5b0ae5ff 100644
--- a/src/shared/libosmocore/src/logging_syslog.c
+++ b/src/shared/libosmocore/src/logging_syslog.c
@@ -89,4 +89,4 @@ struct log_target *log_target_create_syslog(const char *ident, int option,
 
 #endif /* HAVE_SYSLOG_H */
 
-/* }@ */
+/* @} */
diff --git a/src/shared/libosmocore/src/msgb.c b/src/shared/libosmocore/src/msgb.c
index a403580b..c8564dbb 100644
--- a/src/shared/libosmocore/src/msgb.c
+++ b/src/shared/libosmocore/src/msgb.c
@@ -153,4 +153,4 @@ void msgb_set_talloc_ctx(void *ctx)
 	tall_msgb_ctx = ctx;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/rate_ctr.c b/src/shared/libosmocore/src/rate_ctr.c
index 24166b84..8a232e86 100644
--- a/src/shared/libosmocore/src/rate_ctr.c
+++ b/src/shared/libosmocore/src/rate_ctr.c
@@ -177,4 +177,4 @@ const struct rate_ctr *rate_ctr_get_by_name(const struct rate_ctr_group *ctrg, c
 	return NULL;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/select.c b/src/shared/libosmocore/src/select.c
index c0705d31..6b73377a 100644
--- a/src/shared/libosmocore/src/select.c
+++ b/src/shared/libosmocore/src/select.c
@@ -167,6 +167,6 @@ restart:
 	return work;
 }
 
-/*! }@ */
+/*! @} */
 
 #endif /* _HAVE_SYS_SELECT_H */
diff --git a/src/shared/libosmocore/src/serial.c b/src/shared/libosmocore/src/serial.c
index bc64b8ab..a025ae91 100644
--- a/src/shared/libosmocore/src/serial.c
+++ b/src/shared/libosmocore/src/serial.c
@@ -63,7 +63,7 @@ osmo_serial_init(const char *dev, speed_t baudrate)
 	struct termios tio;
 
 	/* Open device */
-	fd = open(dev, O_RDWR | O_NOCTTY | O_NDELAY);
+	fd = open(dev, O_RDWR | O_NOCTTY);
 	if (fd < 0) {
 		dbg_perror("open");
 		return -errno;
@@ -226,4 +226,4 @@ osmo_serial_clear_custom_baudrate(int fd)
 	return 0;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/signal.c b/src/shared/libosmocore/src/signal.c
index 7ddc2e04..63843849 100644
--- a/src/shared/libosmocore/src/signal.c
+++ b/src/shared/libosmocore/src/signal.c
@@ -106,4 +106,4 @@ void osmo_signal_dispatch(unsigned int subsys, unsigned int signal,
 	}
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/socket.c b/src/shared/libosmocore/src/socket.c
index 8a8829b7..53205cd2 100644
--- a/src/shared/libosmocore/src/socket.c
+++ b/src/shared/libosmocore/src/socket.c
@@ -225,7 +225,7 @@ static int sockaddr_equal(const struct sockaddr *a,
  *  \param[in] addrlen Length of socket address in bytes
  *  \returns 1 if address is local, 0 otherwise.
  */
-int osmo_sockaddr_is_local(struct sockaddr *addr, socklen_t addrlen)
+int osmo_sockaddr_is_local(struct sockaddr *addr, unsigned int addrlen)
 {
 	struct ifaddrs *ifaddr, *ifa;
 
@@ -246,4 +246,4 @@ int osmo_sockaddr_is_local(struct sockaddr *addr, socklen_t addrlen)
 
 #endif /* HAVE_SYS_SOCKET_H */
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/timer.c b/src/shared/libosmocore/src/timer.c
index 79d4ad6d..6d4abc26 100644
--- a/src/shared/libosmocore/src/timer.c
+++ b/src/shared/libosmocore/src/timer.c
@@ -126,6 +126,34 @@ int osmo_timer_pending(struct osmo_timer_list *timer)
 	return timer->active;
 }
 
+/*! \brief compute the remaining time of a timer
+ *  \param[in] timer the to-be-checked timer
+ *  \param[in] the current time (NULL if not known)
+ *  \param[out] remaining remaining time until timer fires
+ *  \return 0 if timer has not expired yet, -1 if it has
+ *
+ *  This function can be used to determine the amount of time
+ *  remaining until the expiration of the timer.
+ */
+int osmo_timer_remaining(const struct osmo_timer_list *timer,
+			 const struct timeval *now,
+			 struct timeval *remaining)
+{
+	struct timeval current_time;
+
+	if (!now) {
+		gettimeofday(&current_time, NULL);
+		now = &current_time;
+	}
+
+	timersub(&timer->timeout, &current_time, remaining);
+
+	if (remaining->tv_sec < 0)
+		return -1;
+
+	return 0;
+}
+
 /*
  * if we have a nearest time return the delta between the current
  * time and the time of the nearest timer.
@@ -233,4 +261,4 @@ int osmo_timers_check(void)
 	return i;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/utils.c b/src/shared/libosmocore/src/utils.c
index 0a970ac8..cf0c9344 100644
--- a/src/shared/libosmocore/src/utils.c
+++ b/src/shared/libosmocore/src/utils.c
@@ -212,4 +212,4 @@ void osmo_str2upper(char *out, const char *in)
 }
 #endif /* HAVE_CTYPE_H */
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/vty/Makefile.am b/src/shared/libosmocore/src/vty/Makefile.am
index b7be6f84..61111235 100644
--- a/src/shared/libosmocore/src/vty/Makefile.am
+++ b/src/shared/libosmocore/src/vty/Makefile.am
@@ -3,7 +3,7 @@
 LIBVERSION=0:0:0
 
 INCLUDES = $(all_includes) -I$(top_srcdir)/include
-AM_CFLAGS = -fPIC -Wall
+AM_CFLAGS = -Wall
 
 if ENABLE_VTY
 lib_LTLIBRARIES = libosmovty.la
diff --git a/src/shared/libosmocore/src/vty/command.c b/src/shared/libosmocore/src/vty/command.c
index fda2e17f..7f83a5e4 100644
--- a/src/shared/libosmocore/src/vty/command.c
+++ b/src/shared/libosmocore/src/vty/command.c
@@ -405,6 +405,145 @@ const char *cmd_prompt(enum node_type node)
 	return cnode->prompt;
 }
 
+static char *xml_escape(const char *inp)
+{
+	int _strlen;
+	char *out, *out_ptr;
+	int len = 0, i, j;
+
+	if (!inp)
+		return NULL;
+	_strlen = strlen(inp);
+
+	for (i = 0; i < _strlen; ++i) {
+		switch (inp[i]) {
+		case '"':
+			len += 6;
+			break;
+		case '\'':
+			len += 6;
+			break;
+		case '<':
+			len += 4;
+			break;
+		case '>':
+			len += 4;
+			break;
+		case '&':
+			len += 5;
+			break;
+		default:
+			len += 1;
+			break;
+		}
+	}
+
+	out = talloc_size(NULL, len + 1);
+	if (!out)
+		return NULL;
+
+	out_ptr = out;
+
+#define ADD(out, str) \
+	for (j = 0; j < strlen(str); ++j) \
+		*(out++) = str[j];
+
+	for (i = 0; i < _strlen; ++i) {
+		switch (inp[i]) {
+		case '"':
+			ADD(out_ptr, "&quot;");
+			break;
+		case '\'':
+			ADD(out_ptr, "&apos;");
+			break;
+		case '<':
+			ADD(out_ptr, "&lt;");
+			break;
+		case '>':
+			ADD(out_ptr, "&gt;");
+			break;
+		case '&':
+			ADD(out_ptr, "&amp;");
+			break;
+		default:
+			*(out_ptr++) = inp[i];
+			break;
+		}
+	}
+
+#undef ADD
+
+	out_ptr[0] = '\0';
+	return out;
+}
+
+/*
+ * Write one cmd_element as XML to the given VTY.
+ */
+static int vty_dump_element(struct cmd_element *cmd, struct vty *vty)
+{
+	char *xml_string = xml_escape(cmd->string);
+
+	vty_out(vty, "    <command id='%s'>%s", xml_string, VTY_NEWLINE);
+	vty_out(vty, "      <params>%s", VTY_NEWLINE);
+
+	int j;
+	for (j = 0; j < vector_count(cmd->strvec); ++j) {
+		vector descvec = vector_slot(cmd->strvec, j);
+		int i;
+		for (i = 0; i < vector_active(descvec); ++i) {
+			char *xml_param, *xml_doc;
+			struct desc *desc = vector_slot(descvec, i);
+			if (desc == NULL)
+				continue;
+
+			xml_param = xml_escape(desc->cmd);
+			xml_doc = xml_escape(desc->str);
+			vty_out(vty, "        <param name='%s' doc='%s' />%s",
+				xml_param, xml_doc, VTY_NEWLINE);
+			talloc_free(xml_param);
+			talloc_free(xml_doc);
+		}
+	}
+
+	vty_out(vty, "      </params>%s", VTY_NEWLINE);
+	vty_out(vty, "    </command>%s", VTY_NEWLINE);
+
+	talloc_free(xml_string);
+	return 0;
+}
+
+/*
+ * Dump all nodes and commands associated with a given node as XML to the VTY.
+ */
+static int vty_dump_nodes(struct vty *vty)
+{
+	int i, j;
+
+	vty_out(vty, "<vtydoc xmlns='urn:osmocom:xml:libosmocore:vty:doc:1.0'>%s", VTY_NEWLINE);
+
+	for (i = 0; i < vector_active(cmdvec); ++i) {
+		struct cmd_node *cnode;
+		cnode = vector_slot(cmdvec, i);
+		if (!cnode)
+			continue;
+
+		vty_out(vty, "  <node id='%d'>%s", i, VTY_NEWLINE);
+
+		for (j = 0; j < vector_active(cnode->cmd_vector); ++j) {
+			struct cmd_element *elem;
+			elem = vector_slot(cnode->cmd_vector, j);
+			vty_dump_element(elem, vty);
+		}
+
+		vty_out(vty, "  </node>%s", VTY_NEWLINE);
+	}
+
+	vty_out(vty, "</vtydoc>%s", VTY_NEWLINE);
+
+	return 0;
+}
+
 /*! \brief Install a command into a node
  *  \param[in] ntype Node Type
  *  \param[cmd] element to be installed
@@ -2232,6 +2371,13 @@ DEFUN(show_version,
 	return CMD_SUCCESS;
 }
 
+DEFUN(show_online_help,
+      show_online_help_cmd, "show online-help", SHOW_STR "Online help\n")
+{
+	vty_dump_nodes(vty);
+	return CMD_SUCCESS;
+}
+
 /* Help display function for all node. */
 gDEFUN(config_help,
       config_help_cmd, "help", "Description of the interactive help system\n")
@@ -3269,6 +3415,7 @@ void cmd_init(int terminal)
 
 	/* Each node's basic commands. */
 	install_element(VIEW_NODE, &show_version_cmd);
+	install_element(VIEW_NODE, &show_online_help_cmd);
 	if (terminal) {
 		install_element(VIEW_NODE, &config_list_cmd);
 		install_element(VIEW_NODE, &config_exit_cmd);
@@ -3288,6 +3435,7 @@ void cmd_init(int terminal)
 	}
 	install_element (ENABLE_NODE, &show_startup_config_cmd);
 	install_element(ENABLE_NODE, &show_version_cmd);
+	install_element(ENABLE_NODE, &show_online_help_cmd);
 
 	if (terminal) {
 		install_element(ENABLE_NODE, &config_terminal_length_cmd);
@@ -3322,4 +3470,4 @@ void cmd_init(int terminal)
 	srand(time(NULL));
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/vty/logging_vty.c b/src/shared/libosmocore/src/vty/logging_vty.c
index 6be30b4a..6166f1f2 100644
--- a/src/shared/libosmocore/src/vty/logging_vty.c
+++ b/src/shared/libosmocore/src/vty/logging_vty.c
@@ -269,7 +269,8 @@ DEFUN(show_logging_vty,
 
 gDEFUN(cfg_description, cfg_description_cmd,
 	"description .TEXT",
-	"Save human-readable decription of the object\n")
+	"Save human-readable decription of the object\n"
+	"Text until the end of the line\n")
 {
 	char **dptr = vty->index_sub;
 
diff --git a/src/shared/libosmocore/src/vty/telnet_interface.c b/src/shared/libosmocore/src/vty/telnet_interface.c
index 001b016e..1abf141d 100644
--- a/src/shared/libosmocore/src/vty/telnet_interface.c
+++ b/src/shared/libosmocore/src/vty/telnet_interface.c
@@ -90,23 +90,6 @@ int telnet_init_dynif(void *tall_ctx, void *priv, const char *ip, int port)
 
 extern struct host host;
 
-static void print_welcome(int fd)
-{
-	static const char *msg1 = "Welcome to the ";
-	static const char *msg2 = " control interface\r\n";
-	const char *app_name = "<unnamed>";
-
-	if (host.app_info->name)
-		app_name = host.app_info->name;
-
-	write(fd, msg1, strlen(msg1));
-	write(fd, app_name, strlen(app_name));
-	write(fd, msg2, strlen(msg2));
-
-	if (host.app_info->copyright)
-		write(fd, host.app_info->copyright, strlen(host.app_info->copyright));
-}
-
 /*! \brief close a telnet connection */
 int telnet_close_client(struct osmo_fd *fd)
 {
@@ -169,8 +152,6 @@ static int telnet_new_connection(struct osmo_fd *fd, unsigned int what)
 	osmo_fd_register(&connection->fd);
 	llist_add_tail(&connection->entry, &active_connections);
 
-	print_welcome(new_connection);
-
 	connection->vty = vty_create(new_connection, connection);
 	if (!connection->vty) {
 		LOGP(0, LOGL_ERROR, "couldn't create VTY\n");
@@ -220,4 +201,4 @@ void telnet_exit(void)
 	talloc_free(tall_telnet_ctx);
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/vty/utils.c b/src/shared/libosmocore/src/vty/utils.c
index 47b9931f..abf0ac49 100644
--- a/src/shared/libosmocore/src/vty/utils.c
+++ b/src/shared/libosmocore/src/vty/utils.c
@@ -22,11 +22,13 @@
 
 #include <stdint.h>
 #include <inttypes.h>
+#include <string.h>
 
 #include <osmocom/core/linuxlist.h>
 #include <osmocom/core/talloc.h>
 #include <osmocom/core/timer.h>
 #include <osmocom/core/rate_ctr.h>
+#include <osmocom/core/utils.h>
 
 #include <osmocom/vty/vty.h>
 
@@ -60,4 +62,56 @@ void vty_out_rate_ctr_group(struct vty *vty, const char *prefix,
 	};
 }
 
-/*! }@ */
+/*! \brief Generate a VTY command string from value_string */
+char *vty_cmd_string_from_valstr(void *ctx, const struct value_string *vals,
+				 const char *prefix, const char *sep,
+				 const char *end, int do_lower)
+{
+	int len = 0, offset = 0, ret, rem;
+	int size = strlen(prefix);
+	const struct value_string *vs;
+	char *str;
+
+	for (vs = vals; vs->value || vs->str; vs++)
+		size += strlen(vs->str) + 1;
+
+	rem = size;
+	str = talloc_zero_size(ctx, size);
+	if (!str)
+		return NULL;
+
+	ret = snprintf(str + offset, rem, prefix);
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+
+	for (vs = vals; vs->value || vs->str; vs++) {
+		if (vs->str) {
+			int j, name_len = strlen(vs->str)+1;
+			char name[name_len];
+
+			for (j = 0; j < name_len; j++)
+				name[j] = do_lower ?
+					tolower(vs->str[j]) : vs->str[j];
+
+			name[name_len-1] = '\0';
+			ret = snprintf(str + offset, rem, "%s%s", name, sep);
+			if (ret < 0)
+				goto err;
+			OSMO_SNPRINTF_RET(ret, rem, offset, len);
+		}
+	}
+	offset--;	/* to remove the trailing | */
+	rem++;
+
+	ret = snprintf(str + offset, rem, end);
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+err:
+	str[size-1] = '\0';
+	return str;
+}
+
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/vty/vty.c b/src/shared/libosmocore/src/vty/vty.c
index da035969..eda3699c 100644
--- a/src/shared/libosmocore/src/vty/vty.c
+++ b/src/shared/libosmocore/src/vty/vty.c
@@ -78,7 +78,7 @@ char *vty_cwd = NULL;
 /* Configure lock. */
 static int vty_config;
 
-static int no_password_check = 1;
+static int password_check;
 
 void *tall_vty_ctx;
 
@@ -339,6 +339,17 @@ int vty_config_unlock(struct vty *vty)
 /* Say hello to vty interface. */
 void vty_hello(struct vty *vty)
 {
+	const char *app_name = "<unnamed>";
+
+	if (host.app_info->name)
+		app_name = host.app_info->name;
+
+	vty_out(vty, "Welcome to the %s control interface%s%s",
+		app_name, VTY_NEWLINE, VTY_NEWLINE);
+
+	if (host.app_info->copyright)
+		vty_out(vty, "%s", host.app_info->copyright);
+
 	if (host.motdfile) {
 		FILE *f;
 		char buf[4096];
@@ -1481,7 +1492,7 @@ vty_create (int vty_sock, void *priv)
   vty->fd = vty_sock;
   vty->priv = priv;
   vty->type = VTY_TERM;
-  if (no_password_check)
+  if (!password_check)
     {
       if (host.advanced)
 	vty->node = ENABLE_NODE;
@@ -1504,7 +1515,7 @@ vty_create (int vty_sock, void *priv)
   else
     vty->lines = -1;
 
-  if (! no_password_check)
+  if (password_check)
     {
       /* Vty is not available if password isn't set. */
       if (host.password == NULL && host.password_encrypt == NULL)
@@ -1518,7 +1529,7 @@ vty_create (int vty_sock, void *priv)
 
   /* Say hello to the world. */
   vty_hello (vty);
-  if (! no_password_check)
+  if (password_check)
     vty_out (vty, "%sUser Access Verification%s%s", VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE);
 
   /* Setting up terminal. */
@@ -1562,14 +1573,14 @@ DEFUN(line_vty,
 /* vty login. */
 DEFUN(vty_login, vty_login_cmd, "login", "Enable password checking\n")
 {
-	no_password_check = 0;
+	password_check = 1;
 	return CMD_SUCCESS;
 }
 
 DEFUN(no_vty_login,
       no_vty_login_cmd, "no login", NO_STR "Enable password checking\n")
 {
-	no_password_check = 1;
+	password_check = 0;
 	return CMD_SUCCESS;
 }
 
@@ -1639,7 +1650,7 @@ static int vty_config_write(struct vty *vty)
 	vty_out(vty, "line vty%s", VTY_NEWLINE);
 
 	/* login */
-	if (no_password_check)
+	if (!password_check)
 		vty_out(vty, " no login%s", VTY_NEWLINE);
 
 	vty_out(vty, "!%s", VTY_NEWLINE);
@@ -1768,4 +1779,4 @@ int vty_read_config_file(const char *file_name, void *priv)
 	return rc;
 }
 
-/*! }@ */
+/*! @} */
diff --git a/src/shared/libosmocore/src/write_queue.c b/src/shared/libosmocore/src/write_queue.c
index 9ddc3af4..cef40f83 100644
--- a/src/shared/libosmocore/src/write_queue.c
+++ b/src/shared/libosmocore/src/write_queue.c
@@ -115,4 +115,4 @@ void osmo_wqueue_clear(struct osmo_wqueue *queue)
 	queue->bfd.when &= ~BSC_FD_WRITE;
 }
 
-/*! }@ */
+/*! @} */