CBSP (Cell Broadcast Service Protocol; 3GPP TS 48.049) support

This introduces definitions as well as a parser+encoder for the
Cell Broadcast Service Protocol (CBSP) as specified in 3GPP TS 48.049.

CBSP is used on the interface between CBC and BSC.

Related: OS#3537
Change-Id: I5b7ae08f67e415967b60ac4b824db9e22ca00935

7 files changed, 1954 insertions, 1 deletions

diff --git a/include/Makefile.am b/include/Makefile.am
index 7b9e3479..7835fab8 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -72,6 +72,7 @@ nobase_include_HEADERS = \
                        osmocom/gsm/abis_nm.h \
                        osmocom/gsm/apn.h \
                        osmocom/gsm/bts_features.h \
+                       osmocom/gsm/cbsp.h \
                        osmocom/gsm/comp128.h \
                        osmocom/gsm/comp128v23.h \
                        osmocom/gsm/bitvec_gsm.h \
@@ -124,6 +125,7 @@ nobase_include_HEADERS = \
 		       osmocom/gsm/protocol/gsm_23_003.h \
 		       osmocom/gsm/protocol/gsm_29_118.h \
                        osmocom/gsm/protocol/gsm_44_318.h \
+                       osmocom/gsm/protocol/gsm_48_049.h \
                        osmocom/gsm/protocol/ipaccess.h \
                        osmocom/gsm/protocol/smpp34_osmocom.h \
                        osmocom/gsm/rsl.h \
diff --git a/include/osmocom/gsm/cbsp.h b/include/osmocom/gsm/cbsp.h
new file mode 100644
index 00000000..d47b37bb
--- /dev/null
+++ b/include/osmocom/gsm/cbsp.h
@@ -0,0 +1,292 @@
+#pragma once
+
+#include <stdint.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/gsm/protocol/gsm_48_049.h>
+#include <osmocom/gsm/gsm0808_utils.h>
+
+/* Definitions for parsed / abstract representation of messages in the
+ * CBSP (Cell Broadcast Service Protocol).  Data here is *not* formatted
+ * like the * on-the-wire format.  Any similarities are coincidetial ;) */
+
+/* Copyright (C) 2019  Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/* Decoded 8.2.3 Message Content */
+struct osmo_cbsp_content {
+	struct llist_head list;
+	uint8_t user_len;
+	uint8_t data[82];
+};
+
+/* Decoded Entry in a 8.2.6 Cell List */
+struct osmo_cbsp_cell_ent {
+	struct llist_head list;		/* entry in osmo_cbsp_cell_list.list */
+	union gsm0808_cell_id_u cell_id;
+};
+struct osmo_cbsp_cell_list {
+	enum CELL_IDENT id_discr;
+	struct llist_head list;		/* list of osmo_cbsp_cell_ent */
+};
+
+/* Decoded Entry in a 8.2.10 Completed List */
+struct osmo_cbsp_num_compl_ent {
+	struct llist_head list;		/* entry in osmo_cbsp_num_compl_list.list */
+	union gsm0808_cell_id_u cell_id;
+	uint16_t num_compl;
+	uint8_t num_bcast_info;
+};
+struct osmo_cbsp_num_compl_list {
+	enum CELL_IDENT id_discr;
+	struct llist_head list;		/* list of osmo_cbsp_num_compl_ent */
+};
+
+/* Decoded Entry in a 8.2.12 Radio Resource Loading List */
+struct osmo_cbsp_loading_ent {
+	struct llist_head list;		/* entry in osmo_cbsp_loading_list */
+	union gsm0808_cell_id_u cell_id;
+	uint8_t load[2];
+};
+struct osmo_cbsp_loading_list {
+	enum CELL_IDENT id_discr;
+	struct llist_head list;		/* list of osmo_cbsp_loading_ent */
+};
+
+/* Decoded Entry in a 8.2.11 Failure List */
+struct osmo_cbsp_fail_ent {
+	struct llist_head list;		/* entry in a fail_list below */
+	enum CELL_IDENT id_discr;
+	union gsm0808_cell_id_u cell_id;
+	uint8_t cause;
+};
+
+
+/* 8.1.3.1 */
+struct osmo_cbsp_write_replace {
+	uint16_t msg_id;		/* 8.2.16 M */
+	uint16_t new_serial_nr;		/* 8.2.5 M */
+	uint16_t *old_serial_nr;	/* 8.2.4 */
+	struct osmo_cbsp_cell_list cell_list;
+
+	bool is_cbs;
+	union {
+		struct {
+			enum cbsp_channel_ind channel_ind;
+			enum cbsp_category category;
+			uint16_t rep_period;
+			uint16_t num_bcast_req;
+			/* num_of_pages implicit as llist_count(msg_content) */
+			uint8_t dcs;
+			struct llist_head msg_content;
+		} cbs;
+		struct {
+			uint8_t indicator;
+			uint16_t warning_type;
+			uint8_t warning_sec_info[50];
+			uint32_t warning_period;	/* in seconds; 0xffffffff = unlimited */
+		} emergency;
+	} u;
+};
+
+/* 8.1.3.2 */
+struct osmo_cbsp_write_replace_complete {
+	uint16_t msg_id;
+	uint16_t new_serial_nr;
+	uint16_t *old_serial_nr;
+	struct osmo_cbsp_num_compl_list num_compl_list;
+	struct osmo_cbsp_cell_list cell_list;
+	enum cbsp_channel_ind *channel_ind;
+};
+
+/* 8.1.3.3 */
+struct osmo_cbsp_write_replace_failure {
+	uint16_t msg_id;
+	uint16_t new_serial_nr;
+	uint16_t *old_serial_nr;
+	struct llist_head fail_list;		/* list of osmo_cbsp_fail_ent */
+	struct osmo_cbsp_num_compl_list num_compl_list;
+	struct osmo_cbsp_cell_list cell_list;
+	enum cbsp_channel_ind *channel_ind;
+};
+
+/* 8.1.3.4 */
+struct osmo_cbsp_kill {
+	uint16_t msg_id;
+	uint16_t old_serial_nr;
+	struct osmo_cbsp_cell_list cell_list;
+	enum cbsp_channel_ind *channel_ind;
+};
+
+/* 8.1.3.5 */
+struct osmo_cbsp_kill_complete {
+	uint16_t msg_id;
+	uint16_t old_serial_nr;
+	struct osmo_cbsp_num_compl_list num_compl_list;
+	struct osmo_cbsp_cell_list cell_list;
+	enum cbsp_channel_ind *channel_ind;
+};
+
+/* 8.1.3.6 */
+struct osmo_cbsp_kill_failure {
+	uint16_t msg_id;
+	uint16_t old_serial_nr;
+	struct llist_head fail_list;		/* list of osmo_cbsp_fail_ent */
+	struct osmo_cbsp_num_compl_list num_compl_list;
+	struct osmo_cbsp_cell_list cell_list;
+	enum cbsp_channel_ind *channel_ind;
+};
+
+/* 8.1.3.7 */
+struct osmo_cbsp_load_query {
+	struct osmo_cbsp_cell_list cell_list;
+	enum cbsp_channel_ind channel_ind;
+};
+
+/* 8.1.3.8 */
+struct osmo_cbsp_load_query_complete {
+	struct osmo_cbsp_loading_list loading_list;
+	enum cbsp_channel_ind channel_ind;
+};
+
+/* 8.1.3.9 */
+struct osmo_cbsp_load_query_failure {
+	struct llist_head fail_list;		/* list of osmo_cbsp_fail_ent */
+	enum cbsp_channel_ind channel_ind;
+	struct osmo_cbsp_loading_list loading_list;
+};
+
+/* 8.1.3.10 */
+struct osmo_cbsp_msg_status_query {
+	uint16_t msg_id;
+	uint16_t old_serial_nr;
+	struct osmo_cbsp_cell_list cell_list;
+	enum cbsp_channel_ind channel_ind;
+};
+
+/* 8.1.3.11 */
+struct osmo_cbsp_msg_status_query_complete {
+	uint16_t msg_id;
+	uint16_t old_serial_nr;
+	struct osmo_cbsp_num_compl_list num_compl_list;
+	enum cbsp_channel_ind channel_ind;
+};
+
+/* 8.1.3.12 */
+struct osmo_cbsp_msg_status_query_failure {
+	uint16_t msg_id;
+	uint16_t old_serial_nr;
+	struct llist_head fail_list;		/* list of osmo_cbsp_fail_ent */
+	enum cbsp_channel_ind channel_ind;
+	struct osmo_cbsp_num_compl_list num_compl_list;
+};
+
+/* 8.1.3.16 */
+struct osmo_cbsp_reset {
+	struct osmo_cbsp_cell_list cell_list;
+};
+
+/* 8.1.3.17 */
+struct osmo_cbsp_reset_complete {
+	struct osmo_cbsp_cell_list cell_list;
+};
+
+/* 8.1.3.18 */
+struct osmo_cbsp_reset_failure {
+	struct llist_head fail_list;		/* list of osmo_cbsp_fail_ent */
+	struct osmo_cbsp_cell_list cell_list;
+};
+
+/* 8.1.3.18a */
+struct osmo_cbsp_keep_alive {
+	uint8_t repetition_period;
+};
+
+/* 8.1.3.18b */
+struct osmo_cbsp_keep_alive_complete {
+};
+
+/* 8.1.3.19 */
+struct osmo_cbsp_restart {
+	struct osmo_cbsp_cell_list cell_list;
+	uint8_t bcast_msg_type;
+	uint8_t recovery_ind;
+};
+
+/* 8.1.3.20 */
+struct osmo_cbsp_failure {
+	struct llist_head fail_list;		/* list of osmo_cbsp_fail_ent */
+	uint8_t bcast_msg_type;
+};
+
+/* 8.1.3.21 */
+struct osmo_cbsp_error_ind {
+	enum cbsp_cell_id_cause cause;
+	uint16_t *msg_id;
+	uint16_t *new_serial_nr;
+	uint16_t *old_serial_nr;
+	enum cbsp_channel_ind *channel_ind;
+};
+
+
+/* decoded CBSP message */
+struct osmo_cbsp_decoded {
+	enum cbsp_msg_type msg_type;
+	union {
+		struct osmo_cbsp_write_replace write_replace;
+		struct osmo_cbsp_write_replace_complete write_replace_compl;
+		struct osmo_cbsp_write_replace_failure write_replace_fail;
+
+		struct osmo_cbsp_kill kill;
+		struct osmo_cbsp_kill_complete kill_compl;
+		struct osmo_cbsp_kill_failure kill_fail;
+
+		struct osmo_cbsp_load_query load_query;
+		struct osmo_cbsp_load_query_complete load_query_compl;
+		struct osmo_cbsp_load_query_failure load_query_fail;
+
+		struct osmo_cbsp_msg_status_query msg_status_query;
+		struct osmo_cbsp_msg_status_query_complete msg_status_query_compl;
+		struct osmo_cbsp_msg_status_query_failure msg_status_query_fail;
+
+		/* TODO: set DRX */
+
+		struct osmo_cbsp_reset reset;
+		struct osmo_cbsp_reset_complete reset_compl;
+		struct osmo_cbsp_reset_failure reset_fail;
+
+		struct osmo_cbsp_restart restart;
+
+		struct osmo_cbsp_failure failure;
+
+		struct osmo_cbsp_error_ind error_ind;
+
+		struct osmo_cbsp_keep_alive keep_alive;
+		struct osmo_cbsp_keep_alive_complete keep_alive_compl;
+	} u;
+};
+
+struct msgb *osmo_cbsp_msgb_alloc(void *ctx, const char *name);
+struct msgb *osmo_cbsp_encode(void *ctx, const struct osmo_cbsp_decoded *in);
+struct osmo_cbsp_decoded *osmo_cbsp_decode(void *ctx, struct msgb *in);
+void osmo_cbsp_init_struct(struct osmo_cbsp_decoded *cbsp, enum cbsp_msg_type msg_type);
+struct osmo_cbsp_decoded *osmo_cbsp_decoded_alloc(void *ctx,  enum cbsp_msg_type msg_type);
+
+int osmo_cbsp_recv_buffered(void *ctx, int fd, struct msgb **rmsg, struct msgb **tmp_msg);
diff --git a/include/osmocom/gsm/protocol/gsm_48_049.h b/include/osmocom/gsm/protocol/gsm_48_049.h
new file mode 100644
index 00000000..27fc9d0c
--- /dev/null
+++ b/include/osmocom/gsm/protocol/gsm_48_049.h
@@ -0,0 +1,128 @@
+#pragma once
+#include <stdint.h>
+#include <osmocom/core/utils.h>
+
+/* CBSP is an ETSI/3GPP standard protocol used between CBC (Cell
+ * Brodadcast Centre) and BSC (Base Station Controller) in 2G/GSM/GERAN
+ * networks.  It is specified in 3GPP TS 48.049.
+ *
+ * (C) 2019 by Harald Welte <laforge@gnumonks.org>
+ * All rights reserved.
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * Released under the terms of the GNU General Public License, Version 2 or
+ * (at your option) any later version.
+ */
+
+/* 5.2 TCP/IP */
+#define CBSP_TCP_PORT 48049
+
+/* 8.2.1 Information Element Identifiers */
+enum cbsp_iei {
+	CBSP_IEI_MSG_CONTENT		= 0x01,
+	CBSP_IEI_OLD_SERIAL_NR		= 0x02,
+	CBSP_IEI_NEW_SERIAL_NR		= 0x03,
+	CBSP_IEI_CELL_LIST		= 0x04,
+	CBSP_IEI_CATEGORY		= 0x05,
+	CBSP_IEI_REP_PERIOD		= 0x06,
+	CBSP_IEI_NUM_BCAST_REQ		= 0x07,
+	CBSP_IEI_NUM_BCAST_COMPL_LIST	= 0x08,
+	CBSP_IEI_FAILURE_LIST		= 0x09,
+	CBSP_IEI_RR_LOADING_LIST	= 0x0a,
+	CBSP_IEI_CAUSE			= 0x0b,
+	CBSP_IEI_DCS			= 0x0c,
+	CBSP_IEI_RECOVERY_IND		= 0x0d,
+	CBSP_IEI_MSG_ID			= 0x0e,
+	CBSP_IEI_EMERG_IND		= 0x0f,
+	CBSP_IEI_WARN_TYPE		= 0x10,
+	CBSP_IEI_WARN_SEC_INFO		= 0x11,
+	CBSP_IEI_CHANNEL_IND		= 0x12,
+	CBSP_IEI_NUM_OF_PAGES		= 0x13,
+	CBSP_IEI_SCHEDULE_PERIOD	= 0x14,
+	CBSP_IEI_NUM_OF_RES_SLOTS	= 0x15,
+	CBSP_IEI_BCAST_MSG_TYPE		= 0x16,
+	CBSP_IEI_WARNING_PERIOD		= 0x17,
+	CBSP_IEI_KEEP_ALIVE_REP_PERIOD	= 0x18,
+};
+
+/* 8.2.2 Message Type */
+enum cbsp_msg_type {
+	CBSP_MSGT_WRITE_REPLACE		= 0x01,
+	CBSP_MSGT_WRITE_REPLACE_COMPL	= 0x02,
+	CBSP_MSGT_WRITE_REPLACE_FAIL	= 0x03,
+	CBSP_MSGT_KILL			= 0x04,
+	CBSP_MSGT_KILL_COMPL		= 0x05,
+	CBSP_MSGT_KILL_FAIL		= 0x06,
+	CBSP_MSGT_LOAD_QUERY		= 0x07,
+	CBSP_MSGT_LOAD_QUERY_COMPL	= 0x08,
+	CBSP_MSGT_LOAD_QUERY_FAIL	= 0x09,
+	CBSP_MSGT_MSG_STATUS_QUERY	= 0x0a,
+	CBSP_MSGT_MSG_STATUS_QUERY_COMPL= 0x0b,
+	CBSP_MSGT_MSG_STATUS_QUERY_FAIL	= 0x0c,
+	CBSP_MSGT_SET_DRX		= 0x0d,
+	CBSP_MSGT_SET_DRX_COMPL		= 0x0e,
+	CBSP_MSGT_SET_DRX_FAIL		= 0x0f,
+	CBSP_MSGT_RESET			= 0x10,
+	CBSP_MSGT_RESET_COMPL		= 0x11,
+	CBSP_MSGT_RESET_FAIL		= 0x12,
+	CBSP_MSGT_RESTART		= 0x13,
+	CBSP_MSGT_FAILURE		= 0x14,
+	CBSP_MSGT_ERROR_IND		= 0x15,
+	CBSP_MSGT_KEEP_ALIVE		= 0x16,
+	CBSP_MSGT_KEEP_ALIVE_COMPL	= 0x17,
+};
+
+/* 8.2.7 Category */
+enum cbsp_category {
+	CBSP_CATEG_HIGH_PRIO		= 0x00,
+	CBSP_CATEG_BACKGROUND		= 0x01,
+	CBSP_CATEG_NORMAL		= 0x02,
+};
+
+/* Cell ID Discriminator (8.2.11, ...) */
+enum cbsp_cell_id_disc {
+	CBSP_CIDD_WHOLE_CGI		= 0x0,
+	CBSP_CIDD_LAC_CI		= 0x1,
+	CBSP_CIDD_CI			= 0x2,
+	CBSP_CIDD_LAI			= 0x4,
+	CBSP_CIDD_LAC			= 0x5,
+	CBSP_CIDD_ALL_IN_BSC		= 0x6,
+};
+
+/* 8.2.13 Cause */
+enum cbsp_cell_id_cause {
+	CBSP_CAUSE_PARAM_NOT_RECOGNISED			= 0x00,
+	CBSP_CAUSE_PARAM_VAL_INVALID			= 0x01,
+	CBSP_CAUSE_MSG_REF_NOT_IDENTIFIED		= 0x02,
+	CBSP_CAUSE_CELL_ID_NOT_VALID			= 0x03,
+	CBSP_CAUSE_UNRECOGNISED_MSG			= 0x04,
+	CBSP_CAUSE_MISSING_MAND_IE			= 0x05,
+	CBSP_CAUSE_BSC_CAPACITY_EXCEEDED		= 0x06,
+	CBSP_CAUSE_CELL_MEMORY_EXCEEDED			= 0x07,
+	CBSP_CAUSE_BSC_MEMORY_EXCEEDED			= 0x08,
+	CBSP_CAUSE_CB_NOT_SUPPORTED			= 0x09,
+	CBSP_CAUSE_CB_NOT_OPERATIONAL			= 0x0a,
+	CBSP_CAUSE_INCOMPATIBLE_DRX_PARAM		= 0x0b,
+	CBSP_CAUSE_EXT_CHAN_NOT_SUPPORTED		= 0x0c,
+	CBSP_CAUSE_MSG_REF_ALREADY_USED			= 0x0d,
+	CBSP_CAUSE_UNSPECIFIED_ERROR			= 0x0e,
+	CBSP_CAUSE_LAI_OR_LAC_NPT_VALID			= 0x0f,
+};
+
+/* 8.2.20 Chanel Indicator */
+enum cbsp_channel_ind {
+	CBSP_CHAN_IND_BASIC	= 0,
+	CBSP_CHAN_IND_EXTENDED	= 1,
+};
+
+/* not explicitly specified, but every message starts with those mandatory elements */
+struct cbsp_header {
+	uint8_t msg_type;
+	uint8_t len[3]; /* excluding the header */
+} __attribute__((packed));
+
+extern const struct value_string cbsp_msg_type_names[];
+extern const struct value_string cbsp_iei_names[];
+extern const struct value_string cbsp_category_names[];
+extern const struct tlv_definition cbsp_att_tlvdef;
diff --git a/src/gsm/Makefile.am b/src/gsm/Makefile.am
index 5740b670..006e78c8 100644
--- a/src/gsm/Makefile.am
+++ b/src/gsm/Makefile.am
@@ -32,7 +32,7 @@ libgsmint_la_SOURCES =  a5.c rxlev_stat.c tlv_parser.c comp128.c comp128v23.c \
 			milenage/milenage.c gan.c ipa.c gsm0341.c apn.c \
 			gsup.c gsup_sms.c gprs_gea.c gsm0503_conv.c oap.c gsm0808_utils.c \
 			gsm23003.c mncc.c bts_features.c oap_client.c \
-			gsm29118.c gsm48_rest_octets.c
+			gsm29118.c gsm48_rest_octets.c cbsp.c gsm48049.c
 libgsmint_la_LDFLAGS = -no-undefined
 libgsmint_la_LIBADD = $(top_builddir)/src/libosmocore.la
 
diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c
new file mode 100644
index 00000000..a891c52a
--- /dev/null
+++ b/src/gsm/cbsp.c
@@ -0,0 +1,1409 @@
+/*
+ * Copyright (C) 2019  Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+
+#include <errno.h>
+
+#include <sys/types.h>
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/msgb.h>
+
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/cbsp.h>
+#include <osmocom/gsm/gsm0808_utils.h>
+
+struct msgb *osmo_cbsp_msgb_alloc(void *ctx, const char *name)
+{
+	/* make the messages rather large as the cell lists can be long! */
+	return msgb_alloc_headroom_c(ctx, 65535, 16, name);
+}
+
+/***********************************************************************
+ * IE Encoding
+ ***********************************************************************/
+
+/* 8.2.6 Cell List */
+static void msgb_put_cbsp_cell_list(struct msgb *msg, const struct osmo_cbsp_cell_list *cl)
+{
+	const struct osmo_cbsp_cell_ent *ent;
+	uint8_t *lenptr;
+
+	/* put tag; reserve space for length; put discriminator */
+	msgb_put_u8(msg, CBSP_IEI_CELL_LIST);
+	lenptr = msgb_put(msg, sizeof(uint16_t));
+	msgb_put_u8(msg, cl->id_discr);
+	/* put list elements */
+	llist_for_each_entry(ent, &cl->list, list) {
+		gsm0808_msgb_put_cell_id_u(msg, cl->id_discr, &ent->cell_id);
+	}
+	/* update IE length */
+	osmo_store16be(msg->tail - (lenptr+2), lenptr);
+}
+
+/* 8.2.11 Failure List (discriminator per entry) */
+static void msgb_put_cbsp_fail_list(struct msgb *msg, const struct llist_head *fl)
+{
+	const struct osmo_cbsp_fail_ent *ent;
+	uint8_t *lenptr;
+
+	/* put tag; reserve space for length; put discriminator */
+	msgb_put_u8(msg, CBSP_IEI_FAILURE_LIST);
+	lenptr = msgb_put(msg, sizeof(uint16_t));
+	/* put list elements */
+	llist_for_each_entry(ent, fl, list) {
+		msgb_put_u8(msg, ent->id_discr);
+		gsm0808_msgb_put_cell_id_u(msg, ent->id_discr, &ent->cell_id);
+		msgb_put_u8(msg, ent->cause);
+	}
+	/* update IE length */
+	osmo_store16be(msg->tail - (lenptr+2), lenptr);
+}
+
+/* 8.2.12 Radio Resource Loading List */
+static void msgb_put_cbsp_loading_list(struct msgb *msg, const struct osmo_cbsp_loading_list *ll)
+{
+	const struct osmo_cbsp_loading_ent *ent;
+	uint8_t *lenptr;
+
+	/* put tag; reserve space for length; put discriminator */
+	msgb_put_u8(msg, CBSP_IEI_RR_LOADING_LIST);
+	lenptr = msgb_put(msg, sizeof(uint16_t));
+	msgb_put_u8(msg, ll->id_discr);
+	/* put list elements */
+	llist_for_each_entry(ent, &ll->list, list) {
+		gsm0808_msgb_put_cell_id_u(msg, ll->id_discr, &ent->cell_id);
+		msgb_put_u8(msg, ent->load[0]);
+		msgb_put_u8(msg, ent->load[1]);
+	}
+	/* update IE length */
+	osmo_store16be(msg->tail - (lenptr+2), lenptr);
+}
+
+/* 8.2.10 Completed List */
+static void msgb_put_cbsp_num_compl_list(struct msgb *msg, const struct osmo_cbsp_num_compl_list *cl)
+{
+	const struct osmo_cbsp_num_compl_ent *ent;
+	uint8_t *lenptr;
+
+	/* put tag; reserve space for length; put discriminator */
+	msgb_put_u8(msg, CBSP_IEI_NUM_BCAST_COMPL_LIST);
+	lenptr = msgb_put(msg, sizeof(uint16_t));
+	msgb_put_u8(msg, cl->id_discr);
+	/* put list elements */
+	llist_for_each_entry(ent, &cl->list, list) {
+		gsm0808_msgb_put_cell_id_u(msg, cl->id_discr, &ent->cell_id);
+		msgb_put_u16(msg, ent->num_compl);
+		msgb_put_u8(msg, ent->num_bcast_info);
+	}
+	/* update IE length */
+	osmo_store16be(msg->tail - (lenptr+2), lenptr);
+}
+
+static int encode_wperiod(uint32_t secs)
+{
+	if (secs == 0xffffffff)
+		return 0; /* infinite */
+	if (secs <= 10)
+		return secs;
+	if (secs <= 30)
+		return (secs-10)/2;
+	if (secs <= 120)
+		return (secs-30)/5;
+	if (secs <= 600)
+		return (secs-120)/10;
+	if (secs <= 60*60)
+		return (secs-600)/30;
+	return -1;
+}
+
+/***********************************************************************
+ * Message Encoding
+ ***********************************************************************/
+
+/* 8.1.3.1 WRITE REPLACE */
+static int cbsp_enc_write_repl(struct msgb *msg, const struct osmo_cbsp_write_replace *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_NEW_SERIAL_NR, in->new_serial_nr);
+	if (in->old_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, *in->old_serial_nr);
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->is_cbs) {
+		int num_of_pages = llist_count(&in->u.cbs.msg_content);
+		struct osmo_cbsp_content *ce;
+		if (num_of_pages == 0 || num_of_pages > 15)
+			return -EINVAL;
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->u.cbs.channel_ind);
+		msgb_tv_put(msg, CBSP_IEI_CATEGORY, in->u.cbs.category);
+		msgb_tv16_put(msg, CBSP_IEI_REP_PERIOD, in->u.cbs.rep_period);
+		msgb_tv16_put(msg, CBSP_IEI_NUM_BCAST_REQ, in->u.cbs.num_bcast_req);
+		msgb_tv_put(msg, CBSP_IEI_NUM_OF_PAGES, num_of_pages);
+		msgb_tv_put(msg, CBSP_IEI_DCS, in->u.cbs.dcs);
+		llist_for_each_entry(ce, &in->u.cbs.msg_content, list) {
+			uint8_t *out;
+			/* cannot use msgb_tlv_put() as 'len' isn't actually the length of
+			 * the data field */
+			msgb_put_u8(msg, CBSP_IEI_MSG_CONTENT);
+			msgb_put_u8(msg, ce->user_len);
+			out = msgb_put(msg, sizeof(ce->data));
+			memcpy(out, ce->data, sizeof(ce->data));
+		}
+	} else {
+		int wperiod = encode_wperiod(in->u.emergency.warning_period);
+		if (wperiod < 0)
+			return -EINVAL;
+		msgb_tv_put(msg, CBSP_IEI_EMERG_IND, in->u.emergency.indicator);
+		msgb_tv16_put(msg, CBSP_IEI_WARN_TYPE, in->u.emergency.warning_type);
+		msgb_tlv_put(msg, CBSP_IEI_WARN_SEC_INFO, sizeof(in->u.emergency.warning_sec_info),
+			     in->u.emergency.warning_sec_info);
+		msgb_tv_put(msg, CBSP_IEI_WARNING_PERIOD, wperiod);
+	}
+	return 0;
+}
+
+/* 8.1.3.2 WRITE REPLACE COMPLETE*/
+static int cbsp_enc_write_repl_compl(struct msgb *msg, const struct osmo_cbsp_write_replace_complete *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_NEW_SERIAL_NR, in->new_serial_nr);
+	if (in->old_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, *in->old_serial_nr);
+
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.3 WRITE REPLACE FAILURE */
+static int cbsp_enc_write_repl_fail(struct msgb *msg, const struct osmo_cbsp_write_replace_failure *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_NEW_SERIAL_NR, in->new_serial_nr);
+	if (in->old_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, *in->old_serial_nr);
+
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.4 KILL */
+static int cbsp_enc_kill(struct msgb *msg, const struct osmo_cbsp_kill *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.5 KILL COMPLETE */
+static int cbsp_enc_kill_compl(struct msgb *msg, const struct osmo_cbsp_kill_complete *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.6 KILL FAILURE */
+static int cbsp_enc_kill_fail(struct msgb *msg, const struct osmo_cbsp_kill_failure *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.7 LOAD QUERY */
+static int cbsp_enc_load_query(struct msgb *msg, const struct osmo_cbsp_load_query *in)
+{
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.8 LOAD QUERY COMPLETE */
+static int cbsp_enc_load_query_compl(struct msgb *msg, const struct osmo_cbsp_load_query_complete *in)
+{
+	msgb_put_cbsp_loading_list(msg, &in->loading_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.9 LOAD QUERY FAILURE */
+static int cbsp_enc_load_query_fail(struct msgb *msg, const struct osmo_cbsp_load_query_failure *in)
+{
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	if (!llist_empty(&in->loading_list.list))
+		msgb_put_cbsp_loading_list(msg, &in->loading_list);
+	return 0;
+}
+
+/* 8.1.3.10 STATUS QUERY */
+static int cbsp_enc_msg_status_query(struct msgb *msg, const struct osmo_cbsp_msg_status_query *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.11 STATUS QUERY COMPLETE */
+static int cbsp_enc_msg_status_query_compl(struct msgb *msg,
+					   const struct osmo_cbsp_msg_status_query_complete *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.12 STATUS QUERY FAILURE */
+static int cbsp_enc_msg_status_query_fail(struct msgb *msg,
+					  const struct osmo_cbsp_msg_status_query_failure *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	return 0;
+}
+
+/* 8.1.3.16 RESET */
+static int cbsp_enc_reset(struct msgb *msg, const struct osmo_cbsp_reset *in)
+{
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	return 0;
+}
+
+/* 8.1.3.17 RESET COMPLETE */
+static int cbsp_enc_reset_compl(struct msgb *msg, const struct osmo_cbsp_reset_complete *in)
+{
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	return 0;
+}
+
+/* 8.1.3.18 RESET FAILURE */
+static int cbsp_enc_reset_fail(struct msgb *msg, const struct osmo_cbsp_reset_failure *in)
+{
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	return 0;
+}
+
+/* 8.1.3.18a KEEP ALIVE */
+static int cbsp_enc_keep_alive(struct msgb *msg, const struct osmo_cbsp_keep_alive *in)
+{
+	msgb_tv_put(msg, CBSP_IEI_KEEP_ALIVE_REP_PERIOD, in->repetition_period);
+	return 0;
+}
+
+/* 8.1.3.18b KEEP ALIVE COMPLETE */
+static int cbsp_enc_keep_alive_compl(struct msgb *msg, const struct osmo_cbsp_keep_alive_complete *in)
+{
+	return 0;
+}
+
+/* 8.1.3.19 RESTART */
+static int cbsp_enc_restart(struct msgb *msg, const struct osmo_cbsp_restart *in)
+{
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	msgb_tv_put(msg, CBSP_IEI_BCAST_MSG_TYPE, in->bcast_msg_type);
+	msgb_tv_put(msg, CBSP_IEI_RECOVERY_IND, in->recovery_ind);
+	return 0;
+}
+
+/* 8.1.3.20 FAILURE */
+static int cbsp_enc_failure(struct msgb *msg, const struct osmo_cbsp_failure *in)
+{
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	msgb_tv_put(msg, CBSP_IEI_BCAST_MSG_TYPE, in->bcast_msg_type);
+	return 0;
+}
+
+/* 8.1.3.21 ERROR INDICATION */
+static int cbsp_enc_error_ind(struct msgb *msg, const struct osmo_cbsp_error_ind *in)
+{
+	msgb_tv_put(msg, CBSP_IEI_CAUSE, in->cause);
+	if (in->msg_id)
+		msgb_tv16_put(msg, CBSP_IEI_MSG_ID, *in->msg_id);
+	if (in->new_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_NEW_SERIAL_NR, *in->new_serial_nr);
+	if (in->old_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, *in->old_serial_nr);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/*! Encode a CBSP message from the decoded/parsed structure representation to binary PDU.
+ *  \param[in] ctx talloc context from which to allocate returned msgb.
+ *  \param[in] in decoded CBSP message which is to be encoded.  Ownership not transferred.
+ *  \return callee-allocated message buffer containing binary CBSP PDU; NULL on error */
+struct msgb *osmo_cbsp_encode(void *ctx, const struct osmo_cbsp_decoded *in)
+{
+	struct msgb *msg = osmo_cbsp_msgb_alloc(ctx, __func__);
+	unsigned int len;
+	int rc;
+
+	if (!msg)
+		return NULL;
+
+	switch (in->msg_type) {
+	case CBSP_MSGT_WRITE_REPLACE:
+		rc = cbsp_enc_write_repl(msg, &in->u.write_replace);
+		break;
+	case CBSP_MSGT_WRITE_REPLACE_COMPL:
+		rc = cbsp_enc_write_repl_compl(msg, &in->u.write_replace_compl);
+		break;
+	case CBSP_MSGT_WRITE_REPLACE_FAIL:
+		rc = cbsp_enc_write_repl_fail(msg, &in->u.write_replace_fail);
+		break;
+	case CBSP_MSGT_KILL:
+		rc = cbsp_enc_kill(msg, &in->u.kill);
+		break;
+	case CBSP_MSGT_KILL_COMPL:
+		rc = cbsp_enc_kill_compl(msg, &in->u.kill_compl);
+		break;
+	case CBSP_MSGT_KILL_FAIL:
+		rc = cbsp_enc_kill_fail(msg, &in->u.kill_fail);
+		break;
+	case CBSP_MSGT_LOAD_QUERY:
+		rc = cbsp_enc_load_query(msg, &in->u.load_query);
+		break;
+	case CBSP_MSGT_LOAD_QUERY_COMPL:
+		rc = cbsp_enc_load_query_compl(msg, &in->u.load_query_compl);
+		break;
+	case CBSP_MSGT_LOAD_QUERY_FAIL:
+		rc = cbsp_enc_load_query_fail(msg, &in->u.load_query_fail);
+		break;
+	case CBSP_MSGT_MSG_STATUS_QUERY:
+		rc = cbsp_enc_msg_status_query(msg, &in->u.msg_status_query);
+		break;
+	case CBSP_MSGT_MSG_STATUS_QUERY_COMPL:
+		rc = cbsp_enc_msg_status_query_compl(msg, &in->u.msg_status_query_compl);
+		break;
+	case CBSP_MSGT_MSG_STATUS_QUERY_FAIL:
+		rc = cbsp_enc_msg_status_query_fail(msg, &in->u.msg_status_query_fail);
+		break;
+	case CBSP_MSGT_RESET:
+		rc = cbsp_enc_reset(msg, &in->u.reset);
+		break;
+	case CBSP_MSGT_RESET_COMPL:
+		rc = cbsp_enc_reset_compl(msg, &in->u.reset_compl);
+		break;
+	case CBSP_MSGT_RESET_FAIL:
+		rc = cbsp_enc_reset_fail(msg, &in->u.reset_fail);
+		break;
+	case CBSP_MSGT_RESTART:
+		rc = cbsp_enc_restart(msg, &in->u.restart);
+		break;
+	case CBSP_MSGT_FAILURE:
+		rc = cbsp_enc_failure(msg, &in->u.failure);
+		break;
+	case CBSP_MSGT_ERROR_IND:
+		rc = cbsp_enc_error_ind(msg, &in->u.error_ind);
+		break;
+	case CBSP_MSGT_KEEP_ALIVE:
+		rc = cbsp_enc_keep_alive(msg, &in->u.keep_alive);
+		break;
+	case CBSP_MSGT_KEEP_ALIVE_COMPL:
+		rc = cbsp_enc_keep_alive_compl(msg, &in->u.keep_alive_compl);
+		break;
+	case CBSP_MSGT_SET_DRX:
+	case CBSP_MSGT_SET_DRX_COMPL:
+	case CBSP_MSGT_SET_DRX_FAIL:
+		rc = -1;
+		break;
+	default:
+		rc = -1;
+		break;
+	}
+
+	if (rc < 0) {
+		msgb_free(msg);
+		return NULL;
+	}
+
+	/* push header in front */
+	len = msgb_length(msg);
+	msgb_push_u8(msg, len & 0xff);
+	msgb_push_u8(msg, (len >> 8) & 0xff);
+	msgb_push_u8(msg, (len >> 16) & 0xff);
+	msgb_push_u8(msg, in->msg_type);
+
+	return msg;
+}
+
+/***********************************************************************
+ * IE Decoding
+ ***********************************************************************/
+
+/* 8.2.6 Cell List */
+static int cbsp_decode_cell_list(struct osmo_cbsp_cell_list *cl, void *ctx,
+				 const uint8_t *buf, unsigned int len)
+{
+	const uint8_t *cur = buf;
+	int rc;
+
+	cl->id_discr = *cur++;
+
+	while (cur < buf + len) {
+		struct osmo_cbsp_cell_ent *ent = talloc_zero(ctx, struct osmo_cbsp_cell_ent);
+		unsigned int len_remain = len - (cur - buf);
+		OSMO_ASSERT(ent);
+		rc = gsm0808_decode_cell_id_u(&ent->cell_id, cl->id_discr, cur, len_remain);
+		if (rc < 0)
+			return rc;
+		cur += rc;
+		llist_add_tail(&ent->list, &cl->list);
+	}
+	return 0;
+}
+
+/* 8.2.11 Failure List (discriminator per entry) */
+static int cbsp_decode_fail_list(struct llist_head *fl, void *ctx,
+				 const uint8_t *buf, unsigned int len)
+{
+	const uint8_t *cur = buf;
+	int rc;
+
+	while (cur < buf + len) {
+		struct osmo_cbsp_fail_ent *ent = talloc_zero(ctx, struct osmo_cbsp_fail_ent);
+		unsigned int len_remain = len - (cur - buf);
+		OSMO_ASSERT(ent);
+		ent->id_discr = cur[0];
+		rc = gsm0808_decode_cell_id_u(&ent->cell_id, ent->id_discr, cur+1, len_remain-1);
+		if (rc < 0)
+			return rc;
+		cur += rc;
+		ent->cause = *cur++;
+		llist_add_tail(&ent->list, fl);
+	}
+	return 0;
+}
+
+/* 8.2.12 Radio Resource Loading List */
+static int cbsp_decode_loading_list(struct osmo_cbsp_loading_list *ll, void *ctx,
+				    const uint8_t *buf, unsigned int len)
+{
+	const uint8_t *cur = buf;
+	int rc;
+
+	ll->id_discr = *cur++;
+	while (cur < buf + len) {
+		struct osmo_cbsp_loading_ent *ent = talloc_zero(ctx, struct osmo_cbsp_loading_ent);
+		unsigned int len_remain = len - (cur - buf);
+		OSMO_ASSERT(ent);
+		rc = gsm0808_decode_cell_id_u(&ent->cell_id, ll->id_discr, cur, len_remain);
+		if (rc < 0)
+			return rc;
+		cur += rc;
+		if (cur + 2 > buf + len) {
+			talloc_free(ent);
+			return -EINVAL;
+		}
+		ent->load[0] = *cur++;
+		ent->load[1] = *cur++;
+		llist_add_tail(&ent->list, &ll->list);
+	}