CBSP (Cell Broadcast Service Protocol; 3GPP TS 48.049) support

This introduces definitions as well as a parser+encoder for the
Cell Broadcast Service Protocol (CBSP) as specified in 3GPP TS 48.049.

CBSP is used on the interface between CBC and BSC.

Related: OS#3537
Change-Id: I5b7ae08f67e415967b60ac4b824db9e22ca00935

4 files changed, 1532 insertions, 1 deletions

diff --git a/src/gsm/Makefile.am b/src/gsm/Makefile.am
index 5740b670..006e78c8 100644
--- a/src/gsm/Makefile.am
+++ b/src/gsm/Makefile.am
@@ -32,7 +32,7 @@ libgsmint_la_SOURCES =  a5.c rxlev_stat.c tlv_parser.c comp128.c comp128v23.c \
 			milenage/milenage.c gan.c ipa.c gsm0341.c apn.c \
 			gsup.c gsup_sms.c gprs_gea.c gsm0503_conv.c oap.c gsm0808_utils.c \
 			gsm23003.c mncc.c bts_features.c oap_client.c \
-			gsm29118.c gsm48_rest_octets.c
+			gsm29118.c gsm48_rest_octets.c cbsp.c gsm48049.c
 libgsmint_la_LDFLAGS = -no-undefined
 libgsmint_la_LIBADD = $(top_builddir)/src/libosmocore.la
 
diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c
new file mode 100644
index 00000000..a891c52a
--- /dev/null
+++ b/src/gsm/cbsp.c
@@ -0,0 +1,1409 @@
+/*
+ * Copyright (C) 2019  Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+
+#include <errno.h>
+
+#include <sys/types.h>
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/msgb.h>
+
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/cbsp.h>
+#include <osmocom/gsm/gsm0808_utils.h>
+
+struct msgb *osmo_cbsp_msgb_alloc(void *ctx, const char *name)
+{
+	/* make the messages rather large as the cell lists can be long! */
+	return msgb_alloc_headroom_c(ctx, 65535, 16, name);
+}
+
+/***********************************************************************
+ * IE Encoding
+ ***********************************************************************/
+
+/* 8.2.6 Cell List */
+static void msgb_put_cbsp_cell_list(struct msgb *msg, const struct osmo_cbsp_cell_list *cl)
+{
+	const struct osmo_cbsp_cell_ent *ent;
+	uint8_t *lenptr;
+
+	/* put tag; reserve space for length; put discriminator */
+	msgb_put_u8(msg, CBSP_IEI_CELL_LIST);
+	lenptr = msgb_put(msg, sizeof(uint16_t));
+	msgb_put_u8(msg, cl->id_discr);
+	/* put list elements */
+	llist_for_each_entry(ent, &cl->list, list) {
+		gsm0808_msgb_put_cell_id_u(msg, cl->id_discr, &ent->cell_id);
+	}
+	/* update IE length */
+	osmo_store16be(msg->tail - (lenptr+2), lenptr);
+}
+
+/* 8.2.11 Failure List (discriminator per entry) */
+static void msgb_put_cbsp_fail_list(struct msgb *msg, const struct llist_head *fl)
+{
+	const struct osmo_cbsp_fail_ent *ent;
+	uint8_t *lenptr;
+
+	/* put tag; reserve space for length; put discriminator */
+	msgb_put_u8(msg, CBSP_IEI_FAILURE_LIST);
+	lenptr = msgb_put(msg, sizeof(uint16_t));
+	/* put list elements */
+	llist_for_each_entry(ent, fl, list) {
+		msgb_put_u8(msg, ent->id_discr);
+		gsm0808_msgb_put_cell_id_u(msg, ent->id_discr, &ent->cell_id);
+		msgb_put_u8(msg, ent->cause);
+	}
+	/* update IE length */
+	osmo_store16be(msg->tail - (lenptr+2), lenptr);
+}
+
+/* 8.2.12 Radio Resource Loading List */
+static void msgb_put_cbsp_loading_list(struct msgb *msg, const struct osmo_cbsp_loading_list *ll)
+{
+	const struct osmo_cbsp_loading_ent *ent;
+	uint8_t *lenptr;
+
+	/* put tag; reserve space for length; put discriminator */
+	msgb_put_u8(msg, CBSP_IEI_RR_LOADING_LIST);
+	lenptr = msgb_put(msg, sizeof(uint16_t));
+	msgb_put_u8(msg, ll->id_discr);
+	/* put list elements */
+	llist_for_each_entry(ent, &ll->list, list) {
+		gsm0808_msgb_put_cell_id_u(msg, ll->id_discr, &ent->cell_id);
+		msgb_put_u8(msg, ent->load[0]);
+		msgb_put_u8(msg, ent->load[1]);
+	}
+	/* update IE length */
+	osmo_store16be(msg->tail - (lenptr+2), lenptr);
+}
+
+/* 8.2.10 Completed List */
+static void msgb_put_cbsp_num_compl_list(struct msgb *msg, const struct osmo_cbsp_num_compl_list *cl)
+{
+	const struct osmo_cbsp_num_compl_ent *ent;
+	uint8_t *lenptr;
+
+	/* put tag; reserve space for length; put discriminator */
+	msgb_put_u8(msg, CBSP_IEI_NUM_BCAST_COMPL_LIST);
+	lenptr = msgb_put(msg, sizeof(uint16_t));
+	msgb_put_u8(msg, cl->id_discr);
+	/* put list elements */
+	llist_for_each_entry(ent, &cl->list, list) {
+		gsm0808_msgb_put_cell_id_u(msg, cl->id_discr, &ent->cell_id);
+		msgb_put_u16(msg, ent->num_compl);
+		msgb_put_u8(msg, ent->num_bcast_info);
+	}
+	/* update IE length */
+	osmo_store16be(msg->tail - (lenptr+2), lenptr);
+}
+
+static int encode_wperiod(uint32_t secs)
+{
+	if (secs == 0xffffffff)
+		return 0; /* infinite */
+	if (secs <= 10)
+		return secs;
+	if (secs <= 30)
+		return (secs-10)/2;
+	if (secs <= 120)
+		return (secs-30)/5;
+	if (secs <= 600)
+		return (secs-120)/10;
+	if (secs <= 60*60)
+		return (secs-600)/30;
+	return -1;
+}
+
+/***********************************************************************
+ * Message Encoding
+ ***********************************************************************/
+
+/* 8.1.3.1 WRITE REPLACE */
+static int cbsp_enc_write_repl(struct msgb *msg, const struct osmo_cbsp_write_replace *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_NEW_SERIAL_NR, in->new_serial_nr);
+	if (in->old_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, *in->old_serial_nr);
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->is_cbs) {
+		int num_of_pages = llist_count(&in->u.cbs.msg_content);
+		struct osmo_cbsp_content *ce;
+		if (num_of_pages == 0 || num_of_pages > 15)
+			return -EINVAL;
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->u.cbs.channel_ind);
+		msgb_tv_put(msg, CBSP_IEI_CATEGORY, in->u.cbs.category);
+		msgb_tv16_put(msg, CBSP_IEI_REP_PERIOD, in->u.cbs.rep_period);
+		msgb_tv16_put(msg, CBSP_IEI_NUM_BCAST_REQ, in->u.cbs.num_bcast_req);
+		msgb_tv_put(msg, CBSP_IEI_NUM_OF_PAGES, num_of_pages);
+		msgb_tv_put(msg, CBSP_IEI_DCS, in->u.cbs.dcs);
+		llist_for_each_entry(ce, &in->u.cbs.msg_content, list) {
+			uint8_t *out;
+			/* cannot use msgb_tlv_put() as 'len' isn't actually the length of
+			 * the data field */
+			msgb_put_u8(msg, CBSP_IEI_MSG_CONTENT);
+			msgb_put_u8(msg, ce->user_len);
+			out = msgb_put(msg, sizeof(ce->data));
+			memcpy(out, ce->data, sizeof(ce->data));
+		}
+	} else {
+		int wperiod = encode_wperiod(in->u.emergency.warning_period);
+		if (wperiod < 0)
+			return -EINVAL;
+		msgb_tv_put(msg, CBSP_IEI_EMERG_IND, in->u.emergency.indicator);
+		msgb_tv16_put(msg, CBSP_IEI_WARN_TYPE, in->u.emergency.warning_type);
+		msgb_tlv_put(msg, CBSP_IEI_WARN_SEC_INFO, sizeof(in->u.emergency.warning_sec_info),
+			     in->u.emergency.warning_sec_info);
+		msgb_tv_put(msg, CBSP_IEI_WARNING_PERIOD, wperiod);
+	}
+	return 0;
+}
+
+/* 8.1.3.2 WRITE REPLACE COMPLETE*/
+static int cbsp_enc_write_repl_compl(struct msgb *msg, const struct osmo_cbsp_write_replace_complete *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_NEW_SERIAL_NR, in->new_serial_nr);
+	if (in->old_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, *in->old_serial_nr);
+
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.3 WRITE REPLACE FAILURE */
+static int cbsp_enc_write_repl_fail(struct msgb *msg, const struct osmo_cbsp_write_replace_failure *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_NEW_SERIAL_NR, in->new_serial_nr);
+	if (in->old_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, *in->old_serial_nr);
+
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.4 KILL */
+static int cbsp_enc_kill(struct msgb *msg, const struct osmo_cbsp_kill *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.5 KILL COMPLETE */
+static int cbsp_enc_kill_compl(struct msgb *msg, const struct osmo_cbsp_kill_complete *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.6 KILL FAILURE */
+static int cbsp_enc_kill_fail(struct msgb *msg, const struct osmo_cbsp_kill_failure *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.7 LOAD QUERY */
+static int cbsp_enc_load_query(struct msgb *msg, const struct osmo_cbsp_load_query *in)
+{
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.8 LOAD QUERY COMPLETE */
+static int cbsp_enc_load_query_compl(struct msgb *msg, const struct osmo_cbsp_load_query_complete *in)
+{
+	msgb_put_cbsp_loading_list(msg, &in->loading_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.9 LOAD QUERY FAILURE */
+static int cbsp_enc_load_query_fail(struct msgb *msg, const struct osmo_cbsp_load_query_failure *in)
+{
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	if (!llist_empty(&in->loading_list.list))
+		msgb_put_cbsp_loading_list(msg, &in->loading_list);
+	return 0;
+}
+
+/* 8.1.3.10 STATUS QUERY */
+static int cbsp_enc_msg_status_query(struct msgb *msg, const struct osmo_cbsp_msg_status_query *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.11 STATUS QUERY COMPLETE */
+static int cbsp_enc_msg_status_query_compl(struct msgb *msg,
+					   const struct osmo_cbsp_msg_status_query_complete *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	return 0;
+}
+
+/* 8.1.3.12 STATUS QUERY FAILURE */
+static int cbsp_enc_msg_status_query_fail(struct msgb *msg,
+					  const struct osmo_cbsp_msg_status_query_failure *in)
+{
+	msgb_tv16_put(msg, CBSP_IEI_MSG_ID, in->msg_id);
+	msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, in->old_serial_nr);
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, in->channel_ind);
+	if (!llist_empty(&in->num_compl_list.list))
+		msgb_put_cbsp_num_compl_list(msg, &in->num_compl_list);
+	return 0;
+}
+
+/* 8.1.3.16 RESET */
+static int cbsp_enc_reset(struct msgb *msg, const struct osmo_cbsp_reset *in)
+{
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	return 0;
+}
+
+/* 8.1.3.17 RESET COMPLETE */
+static int cbsp_enc_reset_compl(struct msgb *msg, const struct osmo_cbsp_reset_complete *in)
+{
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	return 0;
+}
+
+/* 8.1.3.18 RESET FAILURE */
+static int cbsp_enc_reset_fail(struct msgb *msg, const struct osmo_cbsp_reset_failure *in)
+{
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	if (!llist_empty(&in->cell_list.list))
+		msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	return 0;
+}
+
+/* 8.1.3.18a KEEP ALIVE */
+static int cbsp_enc_keep_alive(struct msgb *msg, const struct osmo_cbsp_keep_alive *in)
+{
+	msgb_tv_put(msg, CBSP_IEI_KEEP_ALIVE_REP_PERIOD, in->repetition_period);
+	return 0;
+}
+
+/* 8.1.3.18b KEEP ALIVE COMPLETE */
+static int cbsp_enc_keep_alive_compl(struct msgb *msg, const struct osmo_cbsp_keep_alive_complete *in)
+{
+	return 0;
+}
+
+/* 8.1.3.19 RESTART */
+static int cbsp_enc_restart(struct msgb *msg, const struct osmo_cbsp_restart *in)
+{
+	msgb_put_cbsp_cell_list(msg, &in->cell_list);
+	msgb_tv_put(msg, CBSP_IEI_BCAST_MSG_TYPE, in->bcast_msg_type);
+	msgb_tv_put(msg, CBSP_IEI_RECOVERY_IND, in->recovery_ind);
+	return 0;
+}
+
+/* 8.1.3.20 FAILURE */
+static int cbsp_enc_failure(struct msgb *msg, const struct osmo_cbsp_failure *in)
+{
+	msgb_put_cbsp_fail_list(msg, &in->fail_list);
+	msgb_tv_put(msg, CBSP_IEI_BCAST_MSG_TYPE, in->bcast_msg_type);
+	return 0;
+}
+
+/* 8.1.3.21 ERROR INDICATION */
+static int cbsp_enc_error_ind(struct msgb *msg, const struct osmo_cbsp_error_ind *in)
+{
+	msgb_tv_put(msg, CBSP_IEI_CAUSE, in->cause);
+	if (in->msg_id)
+		msgb_tv16_put(msg, CBSP_IEI_MSG_ID, *in->msg_id);
+	if (in->new_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_NEW_SERIAL_NR, *in->new_serial_nr);
+	if (in->old_serial_nr)
+		msgb_tv16_put(msg, CBSP_IEI_OLD_SERIAL_NR, *in->old_serial_nr);
+	if (in->channel_ind)
+		msgb_tv_put(msg, CBSP_IEI_CHANNEL_IND, *in->channel_ind);
+	return 0;
+}
+
+/*! Encode a CBSP message from the decoded/parsed structure representation to binary PDU.
+ *  \param[in] ctx talloc context from which to allocate returned msgb.
+ *  \param[in] in decoded CBSP message which is to be encoded.  Ownership not transferred.
+ *  \return callee-allocated message buffer containing binary CBSP PDU; NULL on error */
+struct msgb *osmo_cbsp_encode(void *ctx, const struct osmo_cbsp_decoded *in)
+{
+	struct msgb *msg = osmo_cbsp_msgb_alloc(ctx, __func__);
+	unsigned int len;
+	int rc;
+
+	if (!msg)
+		return NULL;
+
+	switch (in->msg_type) {
+	case CBSP_MSGT_WRITE_REPLACE:
+		rc = cbsp_enc_write_repl(msg, &in->u.write_replace);
+		break;
+	case CBSP_MSGT_WRITE_REPLACE_COMPL:
+		rc = cbsp_enc_write_repl_compl(msg, &in->u.write_replace_compl);
+		break;
+	case CBSP_MSGT_WRITE_REPLACE_FAIL:
+		rc = cbsp_enc_write_repl_fail(msg, &in->u.write_replace_fail);
+		break;
+	case CBSP_MSGT_KILL:
+		rc = cbsp_enc_kill(msg, &in->u.kill);
+		break;
+	case CBSP_MSGT_KILL_COMPL:
+		rc = cbsp_enc_kill_compl(msg, &in->u.kill_compl);
+		break;
+	case CBSP_MSGT_KILL_FAIL:
+		rc = cbsp_enc_kill_fail(msg, &in->u.kill_fail);
+		break;
+	case CBSP_MSGT_LOAD_QUERY:
+		rc = cbsp_enc_load_query(msg, &in->u.load_query);
+		break;
+	case CBSP_MSGT_LOAD_QUERY_COMPL:
+		rc = cbsp_enc_load_query_compl(msg, &in->u.load_query_compl);
+		break;
+	case CBSP_MSGT_LOAD_QUERY_FAIL:
+		rc = cbsp_enc_load_query_fail(msg, &in->u.load_query_fail);
+		break;
+	case CBSP_MSGT_MSG_STATUS_QUERY:
+		rc = cbsp_enc_msg_status_query(msg, &in->u.msg_status_query);
+		break;
+	case CBSP_MSGT_MSG_STATUS_QUERY_COMPL:
+		rc = cbsp_enc_msg_status_query_compl(msg, &in->u.msg_status_query_compl);
+		break;
+	case CBSP_MSGT_MSG_STATUS_QUERY_FAIL:
+		rc = cbsp_enc_msg_status_query_fail(msg, &in->u.msg_status_query_fail);
+		break;
+	case CBSP_MSGT_RESET:
+		rc = cbsp_enc_reset(msg, &in->u.reset);
+		break;
+	case CBSP_MSGT_RESET_COMPL:
+		rc = cbsp_enc_reset_compl(msg, &in->u.reset_compl);
+		break;
+	case CBSP_MSGT_RESET_FAIL:
+		rc = cbsp_enc_reset_fail(msg, &in->u.reset_fail);
+		break;
+	case CBSP_MSGT_RESTART:
+		rc = cbsp_enc_restart(msg, &in->u.restart);
+		break;
+	case CBSP_MSGT_FAILURE:
+		rc = cbsp_enc_failure(msg, &in->u.failure);
+		break;
+	case CBSP_MSGT_ERROR_IND:
+		rc = cbsp_enc_error_ind(msg, &in->u.error_ind);
+		break;
+	case CBSP_MSGT_KEEP_ALIVE:
+		rc = cbsp_enc_keep_alive(msg, &in->u.keep_alive);
+		break;
+	case CBSP_MSGT_KEEP_ALIVE_COMPL:
+		rc = cbsp_enc_keep_alive_compl(msg, &in->u.keep_alive_compl);
+		break;
+	case CBSP_MSGT_SET_DRX:
+	case CBSP_MSGT_SET_DRX_COMPL:
+	case CBSP_MSGT_SET_DRX_FAIL:
+		rc = -1;
+		break;
+	default:
+		rc = -1;
+		break;
+	}
+
+	if (rc < 0) {
+		msgb_free(msg);
+		return NULL;
+	}
+
+	/* push header in front */
+	len = msgb_length(msg);
+	msgb_push_u8(msg, len & 0xff);
+	msgb_push_u8(msg, (len >> 8) & 0xff);
+	msgb_push_u8(msg, (len >> 16) & 0xff);
+	msgb_push_u8(msg, in->msg_type);
+
+	return msg;
+}
+
+/***********************************************************************
+ * IE Decoding
+ ***********************************************************************/
+
+/* 8.2.6 Cell List */
+static int cbsp_decode_cell_list(struct osmo_cbsp_cell_list *cl, void *ctx,
+				 const uint8_t *buf, unsigned int len)
+{
+	const uint8_t *cur = buf;
+	int rc;
+
+	cl->id_discr = *cur++;
+
+	while (cur < buf + len) {
+		struct osmo_cbsp_cell_ent *ent = talloc_zero(ctx, struct osmo_cbsp_cell_ent);
+		unsigned int len_remain = len - (cur - buf);
+		OSMO_ASSERT(ent);
+		rc = gsm0808_decode_cell_id_u(&ent->cell_id, cl->id_discr, cur, len_remain);
+		if (rc < 0)
+			return rc;
+		cur += rc;
+		llist_add_tail(&ent->list, &cl->list);
+	}
+	return 0;
+}
+
+/* 8.2.11 Failure List (discriminator per entry) */
+static int cbsp_decode_fail_list(struct llist_head *fl, void *ctx,
+				 const uint8_t *buf, unsigned int len)
+{
+	const uint8_t *cur = buf;
+	int rc;
+
+	while (cur < buf + len) {
+		struct osmo_cbsp_fail_ent *ent = talloc_zero(ctx, struct osmo_cbsp_fail_ent);
+		unsigned int len_remain = len - (cur - buf);
+		OSMO_ASSERT(ent);
+		ent->id_discr = cur[0];
+		rc = gsm0808_decode_cell_id_u(&ent->cell_id, ent->id_discr, cur+1, len_remain-1);
+		if (rc < 0)
+			return rc;
+		cur += rc;
+		ent->cause = *cur++;
+		llist_add_tail(&ent->list, fl);
+	}
+	return 0;
+}
+
+/* 8.2.12 Radio Resource Loading List */
+static int cbsp_decode_loading_list(struct osmo_cbsp_loading_list *ll, void *ctx,
+				    const uint8_t *buf, unsigned int len)
+{
+	const uint8_t *cur = buf;
+	int rc;
+
+	ll->id_discr = *cur++;
+	while (cur < buf + len) {
+		struct osmo_cbsp_loading_ent *ent = talloc_zero(ctx, struct osmo_cbsp_loading_ent);
+		unsigned int len_remain = len - (cur - buf);
+		OSMO_ASSERT(ent);
+		rc = gsm0808_decode_cell_id_u(&ent->cell_id, ll->id_discr, cur, len_remain);
+		if (rc < 0)
+			return rc;
+		cur += rc;
+		if (cur + 2 > buf + len) {
+			talloc_free(ent);
+			return -EINVAL;
+		}
+		ent->load[0] = *cur++;
+		ent->load[1] = *cur++;
+		llist_add_tail(&ent->list, &ll->list);
+	}
+	return 0;
+}
+
+/* 8.2.10 Completed List */
+static int cbsp_decode_num_compl_list(struct osmo_cbsp_num_compl_list *cl, void *ctx,
+					const uint8_t *buf, unsigned int len)
+{
+	const uint8_t *cur = buf;
+	int rc;
+
+	cl->id_discr = *cur++;
+	while (cur < buf + len) {
+		struct osmo_cbsp_num_compl_ent *ent = talloc_zero(ctx, struct osmo_cbsp_num_compl_ent);
+		unsigned int len_remain = len - (cur - buf);
+		OSMO_ASSERT(ent);
+		rc = gsm0808_decode_cell_id_u(&ent->cell_id, cl->id_discr, cur, len_remain);
+		if (rc < 0)
+			return rc;
+		cur += rc;
+		if (cur + 3 > buf + len) {
+			talloc_free(ent);
+			return -EINVAL;
+		}
+		ent->num_compl = osmo_load16be(cur); cur += 2;
+		ent->num_bcast_info = *cur++;
+		llist_add_tail(&ent->list, &cl->list);
+	}
+	return 0;
+}
+
+/* 8.2.25 */
+static uint32_t decode_wperiod(uint8_t in)
+{
+	if (in == 0x00)
+		return 0xffffffff; /* infinite */
+	if (in <= 10)
+		return in;
+	if (in <= 20)
+		return 10 + (in - 10)*2;
+	if (in <= 38)
+		return 30 + (in - 20)*5;
+	if (in <= 86)
+		return 120 + (in - 38)*10;
+	if (in <= 186)
+		return 600 + (in - 86)*30;
+	else
+		return 0;
+}
+
+
+/***********************************************************************
+ * Message Decoding
+ ***********************************************************************/
+
+/* 8.1.3.1 WRITE REPLACE */
+static int cbsp_dec_write_repl(struct osmo_cbsp_write_replace *out, const struct tlv_parsed *tp,
+				struct msgb *in, void *ctx)
+{
+	unsigned int i;
+
+	/* check for mandatory IEs */
+	if (!TLVP_PRESENT(tp, CBSP_IEI_MSG_ID) ||
+	    !TLVP_PRESENT(tp, CBSP_IEI_NEW_SERIAL_NR) ||
+	    !TLVP_PRESENT(tp, CBSP_IEI_CELL_LIST))
+		return -EINVAL;
+
+	out->msg_id = tlvp_val16be(tp, CBSP_IEI_MSG_ID);
+	out->new_serial_nr = tlvp_val16be(tp, CBSP_IEI_NEW_SERIAL_NR);
+	if (TLVP_PRESENT(tp, CBSP_IEI_OLD_SERIAL_NR)) {
+		out->old_serial_nr = talloc(ctx, uint16_t);
+		*out->old_serial_nr = tlvp_val16be(tp, CBSP_IEI_OLD_SERIAL_NR);
+	}
+
+	INIT_LLIST_HEAD(&out->cell_list.list);
+	cbsp_decode_cell_list(&out->cell_list, ctx, TLVP_VAL(tp, CBSP_IEI_CELL_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_CELL_LIST));
+
+	if (TLVP_PRESENT(tp, CBSP_IEI_CHANNEL_IND)) {
+		uint8_t num_of_pages;
+		INIT_LLIST_HEAD(&out->u.cbs.msg_content);
+		if (TLVP_PRESENT(tp, CBSP_IEI_EMERG_IND))
+			return -EINVAL;
+		if (!TLVP_PRESENT(tp, CBSP_IEI_CATEGORY) ||
+		    !TLVP_PRESENT(tp, CBSP_IEI_REP_PERIOD) ||
+		    !TLVP_PRESENT(tp, CBSP_IEI_NUM_BCAST_REQ) ||
+		    !TLVP_PRESENT(tp, CBSP_IEI_NUM_OF_PAGES) ||
+		    !TLVP_PRESENT(tp, CBSP_IEI_DCS))
+			return -EINVAL;
+		out->is_cbs = true;
+		out->u.cbs.channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+		out->u.cbs.category = *TLVP_VAL(tp, CBSP_IEI_CATEGORY);
+		out->u.cbs.rep_period = tlvp_val16be(tp, CBSP_IEI_REP_PERIOD);
+		out->u.cbs.num_bcast_req = tlvp_val16be(tp, CBSP_IEI_NUM_BCAST_REQ);
+		num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES);
+		if (num_of_pages < 1)
+			return -EINVAL;
+		/* parse pages */
+		for (i = 0; i < num_of_pages; i++) {
+			const uint8_t *ie = TLVP_VAL(&tp[i], CBSP_IEI_MSG_CONTENT);
+			struct osmo_cbsp_content *page;
+			if (!ie)
+				return -EINVAL;
+			page = talloc_zero(ctx, struct osmo_cbsp_content);
+			OSMO_ASSERT(page);
+			page->user_len = *(ie-1); /* length byte before payload */
+			memcpy(page->data, ie, sizeof(page->data));
+			llist_add_tail(&page->list, &out->u.cbs.msg_content);
+		}
+	} else {
+		if (!TLVP_PRES_LEN(tp, CBSP_IEI_EMERG_IND, 1) ||
+		    !TLVP_PRES_LEN(tp, CBSP_IEI_WARN_TYPE, 2) ||
+		    !TLVP_PRES_LEN(tp, CBSP_IEI_WARN_SEC_INFO, 50) ||
+		    !TLVP_PRES_LEN(tp, CBSP_IEI_WARNING_PERIOD, 1))
+			return -EINVAL;
+		out->u.emergency.indicator = *TLVP_VAL(tp, CBSP_IEI_EMERG_IND);
+		out->u.emergency.warning_type = tlvp_val16be(tp, CBSP_IEI_WARN_TYPE);
+		memcpy(&out->u.emergency.warning_sec_info, TLVP_VAL(tp, CBSP_IEI_WARN_SEC_INFO),
+			sizeof(out->u.emergency.warning_sec_info));
+		out->u.emergency.warning_period = decode_wperiod(*TLVP_VAL(tp, CBSP_IEI_WARNING_PERIOD));
+	}
+	return 0;
+}
+
+/* 8.1.3.2 WRITE REPLACE COMPLETE*/
+static int cbsp_dec_write_repl_compl(struct osmo_cbsp_write_replace_complete *out,
+				     const struct tlv_parsed *tp, struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_MSG_ID, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_NEW_SERIAL_NR, 2))
+		return -EINVAL;
+
+	out->msg_id = tlvp_val16be(tp, CBSP_IEI_MSG_ID);
+	out->new_serial_nr = tlvp_val16be(tp, CBSP_IEI_NEW_SERIAL_NR);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_OLD_SERIAL_NR, 2)) {
+		out->old_serial_nr = talloc(ctx, uint16_t);
+		*out->old_serial_nr = tlvp_val16be(tp, CBSP_IEI_OLD_SERIAL_NR);
+	}
+
+	INIT_LLIST_HEAD(&out->num_compl_list.list);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST, 7)) {
+		cbsp_decode_num_compl_list(&out->num_compl_list, ctx,
+					   TLVP_VAL(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST),
+					   TLVP_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST));
+	}
+
+	INIT_LLIST_HEAD(&out->cell_list.list);
+	cbsp_decode_cell_list(&out->cell_list, ctx, TLVP_VAL(tp, CBSP_IEI_CELL_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_CELL_LIST));
+
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1)) {
+		out->channel_ind = talloc(ctx, enum cbsp_channel_ind);
+		*out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+	}
+	return 0;
+}
+
+/* 8.1.3.3 WRITE REPLACE FAILURE */
+static int cbsp_dec_write_repl_fail(struct osmo_cbsp_write_replace_failure *out,
+				    const struct tlv_parsed *tp, struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_MSG_ID, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_NEW_SERIAL_NR, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_FAILURE_LIST, 5))
+		return -EINVAL;
+
+	out->msg_id = tlvp_val16be(tp, CBSP_IEI_MSG_ID);
+	out->new_serial_nr = tlvp_val16be(tp, CBSP_IEI_NEW_SERIAL_NR);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_OLD_SERIAL_NR, 2)) {
+		out->old_serial_nr = talloc(ctx, uint16_t);
+		*out->old_serial_nr = tlvp_val16be(tp, CBSP_IEI_OLD_SERIAL_NR);
+	}
+
+	INIT_LLIST_HEAD(&out->fail_list);
+	cbsp_decode_fail_list(&out->fail_list, ctx,
+			      TLVP_VAL(tp, CBSP_IEI_FAILURE_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_FAILURE_LIST));
+
+	INIT_LLIST_HEAD(&out->num_compl_list.list);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST, 7)) {
+		cbsp_decode_num_compl_list(&out->num_compl_list, ctx,
+					   TLVP_VAL(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST),
+					   TLVP_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST));
+	}
+
+	INIT_LLIST_HEAD(&out->cell_list.list);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_CELL_LIST, 1)) {
+		cbsp_decode_cell_list(&out->cell_list, ctx, TLVP_VAL(tp, CBSP_IEI_CELL_LIST),
+				      TLVP_LEN(tp, CBSP_IEI_CELL_LIST));
+	}
+
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1)) {
+		out->channel_ind = talloc(ctx, enum cbsp_channel_ind);
+		*out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+	}
+	return 0;
+}
+
+/* 8.1.3.4 KILL */
+static int cbsp_dec_kill(struct osmo_cbsp_kill *out, const struct tlv_parsed *tp,
+			 struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_MSG_ID, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_OLD_SERIAL_NR, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_CELL_LIST, 1))
+		return -EINVAL;
+	out->msg_id = tlvp_val16be(tp, CBSP_IEI_MSG_ID);
+	out->old_serial_nr = tlvp_val16be(tp, CBSP_IEI_OLD_SERIAL_NR);
+
+	INIT_LLIST_HEAD(&out->cell_list.list);
+	cbsp_decode_cell_list(&out->cell_list, ctx, TLVP_VAL(tp, CBSP_IEI_CELL_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_CELL_LIST));
+
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1)) {
+		out->channel_ind = talloc(ctx, enum cbsp_channel_ind);
+		*out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+	}
+	return 0;
+}
+
+/* 8.1.3.5 KILL COMPLETE */
+static int cbsp_dec_kill_compl(struct osmo_cbsp_kill_complete *out, const struct tlv_parsed *tp,
+				struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_MSG_ID, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_OLD_SERIAL_NR, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_CELL_LIST, 1))
+		return -EINVAL;
+
+	out->msg_id = tlvp_val16be(tp, CBSP_IEI_MSG_ID);
+	out->old_serial_nr = tlvp_val16be(tp, CBSP_IEI_OLD_SERIAL_NR);
+
+	INIT_LLIST_HEAD(&out->num_compl_list.list);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST, 7)) {
+		cbsp_decode_num_compl_list(&out->num_compl_list, ctx,
+					   TLVP_VAL(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST),
+					   TLVP_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST));
+	}
+
+	INIT_LLIST_HEAD(&out->cell_list.list);
+	cbsp_decode_cell_list(&out->cell_list, ctx, TLVP_VAL(tp, CBSP_IEI_CELL_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_CELL_LIST));
+
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1)) {
+		out->channel_ind = talloc(ctx, enum cbsp_channel_ind);
+		*out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+	}
+	return 0;
+}
+
+/* 8.1.3.6 KILL FAILURE */
+static int cbsp_dec_kill_fail(struct osmo_cbsp_kill_failure *out, const struct tlv_parsed *tp,
+			      struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_MSG_ID, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_OLD_SERIAL_NR, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_FAILURE_LIST, 5))
+		return -EINVAL;
+
+	out->msg_id = tlvp_val16be(tp, CBSP_IEI_MSG_ID);
+	out->old_serial_nr = tlvp_val16be(tp, CBSP_IEI_OLD_SERIAL_NR);
+
+	INIT_LLIST_HEAD(&out->fail_list);
+	cbsp_decode_fail_list(&out->fail_list, ctx,
+			      TLVP_VAL(tp, CBSP_IEI_FAILURE_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_FAILURE_LIST));
+
+	INIT_LLIST_HEAD(&out->num_compl_list.list);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST, 7)) {
+		cbsp_decode_num_compl_list(&out->num_compl_list, ctx,
+					   TLVP_VAL(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST),
+					   TLVP_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST));
+	}
+
+	INIT_LLIST_HEAD(&out->cell_list.list);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_CELL_LIST, 1)) {
+		cbsp_decode_cell_list(&out->cell_list, ctx, TLVP_VAL(tp, CBSP_IEI_CELL_LIST),
+				      TLVP_LEN(tp, CBSP_IEI_CELL_LIST));
+	}
+
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1)) {
+		out->channel_ind = talloc(ctx, enum cbsp_channel_ind);
+		*out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+	}
+	return 0;
+}
+
+/* 8.1.3.7 LOAD QUERY */
+static int cbsp_dec_load_query(struct osmo_cbsp_load_query *out, const struct tlv_parsed *tp,
+				struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_CELL_LIST, 1) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1))
+		return -EINVAL;
+
+	INIT_LLIST_HEAD(&out->cell_list.list);
+	cbsp_decode_cell_list(&out->cell_list, ctx, TLVP_VAL(tp, CBSP_IEI_CELL_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_CELL_LIST));
+
+	out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+	return 0;
+}
+
+/* 8.1.3.8 LOAD QUERY COMPLETE */
+static int cbsp_dec_load_query_compl(struct osmo_cbsp_load_query_complete *out,
+				     const struct tlv_parsed *tp, struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_RR_LOADING_LIST, 6) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1))
+		return -EINVAL;
+
+	INIT_LLIST_HEAD(&out->loading_list.list);
+	cbsp_decode_loading_list(&out->loading_list, ctx,
+				 TLVP_VAL(tp, CBSP_IEI_RR_LOADING_LIST),
+				 TLVP_LEN(tp, CBSP_IEI_RR_LOADING_LIST));
+
+	out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+	return 0;
+}
+
+/* 8.1.3.9 LOAD QUERY FAILURE */
+static int cbsp_dec_load_query_fail(struct osmo_cbsp_load_query_failure *out,
+				    const struct tlv_parsed *tp, struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_FAILURE_LIST, 5) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1))
+		return -EINVAL;
+
+	INIT_LLIST_HEAD(&out->fail_list);
+	cbsp_decode_fail_list(&out->fail_list, ctx,
+			      TLVP_VAL(tp, CBSP_IEI_FAILURE_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_FAILURE_LIST));
+
+	out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+
+	INIT_LLIST_HEAD(&out->loading_list.list);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_RR_LOADING_LIST, 6)) {
+		cbsp_decode_loading_list(&out->loading_list, ctx,
+					 TLVP_VAL(tp, CBSP_IEI_RR_LOADING_LIST),
+					 TLVP_LEN(tp, CBSP_IEI_RR_LOADING_LIST));
+	}
+	return 0;
+}
+
+/* 8.1.3.10 STATUS QUERY */
+static int cbsp_dec_msg_status_query(struct osmo_cbsp_msg_status_query *out,
+				     const struct tlv_parsed *tp, struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_MSG_ID, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_OLD_SERIAL_NR, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_CELL_LIST, 1) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1))
+		return -EINVAL;
+	out->msg_id = tlvp_val16be(tp, CBSP_IEI_MSG_ID);
+	out->old_serial_nr = tlvp_val16be(tp, CBSP_IEI_OLD_SERIAL_NR);
+
+	INIT_LLIST_HEAD(&out->cell_list.list);
+	cbsp_decode_cell_list(&out->cell_list, ctx, TLVP_VAL(tp, CBSP_IEI_CELL_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_CELL_LIST));
+
+	out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+	return 0;
+}
+
+/* 8.1.3.11 STATUS QUERY COMPLETE */
+static int cbsp_dec_msg_status_query_compl(struct osmo_cbsp_msg_status_query_complete *out,
+					   const struct tlv_parsed *tp, struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_MSG_ID, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_OLD_SERIAL_NR, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST, 7) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1))
+		return -EINVAL;
+
+	out->msg_id = tlvp_val16be(tp, CBSP_IEI_MSG_ID);
+	out->old_serial_nr = tlvp_val16be(tp, CBSP_IEI_OLD_SERIAL_NR);
+
+	INIT_LLIST_HEAD(&out->num_compl_list.list);
+	cbsp_decode_num_compl_list(&out->num_compl_list, ctx,
+				   TLVP_VAL(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST),
+				   TLVP_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST));
+	out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+	return 0;
+}
+
+/* 8.1.3.12 STATUS QUERY FAILURE */
+static int cbsp_dec_msg_status_query_fail(struct osmo_cbsp_msg_status_query_failure *out,
+					  const struct tlv_parsed *tp, struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_MSG_ID, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_OLD_SERIAL_NR, 2) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_FAILURE_LIST, 5) ||
+	    !TLVP_PRES_LEN(tp, CBSP_IEI_CHANNEL_IND, 1))
+		return -EINVAL;
+
+	out->msg_id = tlvp_val16be(tp, CBSP_IEI_MSG_ID);
+	out->old_serial_nr = tlvp_val16be(tp, CBSP_IEI_OLD_SERIAL_NR);
+
+	INIT_LLIST_HEAD(&out->fail_list);
+	cbsp_decode_fail_list(&out->fail_list, ctx,
+			      TLVP_VAL(tp, CBSP_IEI_FAILURE_LIST),
+			      TLVP_LEN(tp, CBSP_IEI_FAILURE_LIST));
+
+	out->channel_ind = *TLVP_VAL(tp, CBSP_IEI_CHANNEL_IND);
+
+	INIT_LLIST_HEAD(&out->num_compl_list.list);
+	if (TLVP_PRES_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST, 7)) {
+		cbsp_decode_num_compl_list(&out->num_compl_list, ctx,
+					   TLVP_VAL(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST),
+					   TLVP_LEN(tp, CBSP_IEI_NUM_BCAST_COMPL_LIST));
+	}
+	return 0;
+}
+
+/* 8.1.3.16 RESET */
+static int cbsp_dec_reset(struct osmo_cbsp_reset *out, const struct tlv_parsed *tp,
+			  struct msgb *in, void *ctx)
+{
+	if (!TLVP_PRES_LEN(tp, CBSP_IEI_CELL_LIST, 1))
+		return -EINVAL;
+
+	INIT_LLIST_HEAD(&a