pcu/PCU_Tests_RAW.ttcn

module PCU_Tests_RAW {

/* "RAW" PCU tests: Talk directly to the PCU socket of OsmoPCU on the one hand side (emulating
   the BTS/BSC side PCU socket server) and the Gb interface on the other hand side.  No NS/BSSGP
   Emulation is used; rather, we simply use the NS_CodecPort to implement both standard and non-
   standard procedures on the NS and BSSGP level.  The goal of these tests is to test exactly
   those NS and BSSGP implementations on the BSS (PCU) side. */

/* (C) 2018-2019 Harald Welte <laforge@gnumonks.org>
 * (C) 2019 Vadim Yanitskiy <axilirator@gmail.com>
 * All rights reserved.
 *
 * Released under the terms of GNU General Public License, Version 2 or
 * (at your option) any later version.
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

import from General_Types all;
import from Osmocom_Types all;
import from GSM_Types all;
import from GSM_RR_Types all;

import from Osmocom_VTY_Functions all;
import from TELNETasp_PortType all;

import from RLCMAC_CSN1_Types all;
import from RLCMAC_Types all;

import from NS_Types all;
import from BSSGP_Types all;
import from Osmocom_Gb_Types all;

import from BSSGP_Emulation all; /* BssgpConfig */
import from NS_Emulation all; /* NSConfiguration */

import from UD_Types all;
import from PCUIF_Types all;
import from PCUIF_CodecPort all;
import from PCUIF_RAW_Components all;
import from IPL4asp_Types all;
import from NS_CodecPort all;
import from NS_CodecPort_CtrlFunct all;
import from Native_Functions all;
import from PCU_Tests all;

modulepar {
	charstring mp_pcu_sock_path := PCU_SOCK_DEFAULT;

	float X2002 := 0.2; /* Timer -2002, IMM ASSIGN confirm delay */
}

type component RAW_NS_CT {
	/* UDP port towards the bottom (IUT) */
	port NS_CODEC_PT NSCP[4];
	var ConnectionId g_ns_conn_id[4] := {-1, -1, -1, -1};
	var NSConfiguration g_nsconfig[4];
	timer g_T_guard;
}

type component RAW_PCU_CT {
	/* PCUIF (we emulate the BTS part) */
	port PCUIF_CODEC_PT PCU;
	var ConnectionId g_pcu_conn_id := -1;
}

type component RAW_Test_CT extends RAW_NS_CT, RAW_PCU_CT {
}

private altstep as_Tguard() runs on RAW_NS_CT {
	[] g_T_guard.timeout {
		setverdict(fail, "Timeout of T_guard");
		mtc.stop;
		}
}

/* FIXME: make sure to use parameters from mp_gb_cfg.cell_id in the PCU INFO IND */
template (value) PCUIF_info_ind ts_PCUIF_INFO_default := {
	version := PCU_IF_VERSION,
	flags := c_PCUIF_Flags_default,
	trx := valueof(ts_PCUIF_InfoTrxs_def),
	bsic := 7,
	mcc := 262,
	mnc := 42,
	mnc_3_digits := 0,
	lac := 13135,
	rac := 0,
	nsei := mp_nsconfig.nsei,
	nse_timer := { 3, 3, 3, 3, 30, 3, 10 },
	cell_timer := { 3, 3, 3, 3, 3, 10, 3, 10, 3, 10, 3 },
	cell_id := 20960,
	repeat_time := 5 * 50,
	repeat_count := 3,
	bvci := mp_gb_cfg.bvci,
	t3142 := 20,
	t3169 := 5,
	t3191 := 5,
	t3193_10ms := 160,
	t3195 := 5,
	t3101 := 10,
	t3103 := 4,
	t3105 := 8,
	cv_countdown := 15,
	dl_tbf_ext := 250 * 10, /* ms */
	ul_tbf_ext := 250 * 10, /* ms */
	initial_cs := 2,
	initial_mcs := 6,
	nsvci := { mp_nsconfig.nsvci, 0 },
	local_pprt := { mp_nsconfig.remote_udp_port, 0 },
	remote_port := { mp_nsconfig.local_udp_port, 0 },
	remote_ip := { f_inet_haddr(mp_nsconfig.local_ip) , '00000000'O }
}

function f_init_pcuif() runs on RAW_PCU_CT {
	var PCUIF_info_ind info_ind;
	map(self:PCU, system:PCU);


	info_ind := valueof(ts_PCUIF_INFO_default);

	/* Connect the Unix Domain Socket */
	g_pcu_conn_id := f_pcuif_listen(PCU, mp_pcu_sock_path);
	PCU.receive(UD_connected:?);

	/* Wait for PCU_VERSION and return INFO_IND */
	PCU.receive(t_SD_PCUIF(g_pcu_conn_id, tr_PCUIF_TXT_IND(0, PCU_VERSION, ?)));
	/* FIXME: make sure to use parameters from mp_gb_cfg.cell_id in the PCU INFO IND */
	var template PCUIF_Message info_ind_msg := ts_PCUIF_INFO_IND(0, info_ind);
	PCU.send(t_SD_PCUIF(g_pcu_conn_id, info_ind_msg));
}

function f_pcuif_tx(template (value) PCUIF_Message msg) runs on RAW_PCU_CT {
	PCU.send(t_SD_PCUIF(g_pcu_conn_id, msg));
}

function f_init_ns_codec(integer idx := 0, float guard_secs := 60.0) runs on RAW_NS_CT {
	var Result res;

	if (not g_T_guard.running) {
		g_T_guard.start(guard_secs);
		activate(as_Tguard());
	}

	if (not isbound(g_nsconfig) or not isbound(g_nsconfig[idx])) {
		/* copy most parts from mp_nsconfig */
		g_nsconfig[idx] := mp_nsconfig;
		/* adjust those parts different for each NS-VC */
		g_nsconfig[idx].nsvci := mp_nsconfig.nsvci + idx;
		g_nsconfig[idx].local_udp_port := mp_nsconfig.local_udp_port + idx;
	}

	map(self:NSCP[idx], system:NSCP);
	/* Connect the UDP socket */
	log("connecting NSCP[", idx, "] to ", g_nsconfig[idx]);
	res := f_IPL4_connect(NSCP[idx], g_nsconfig[idx].remote_ip, g_nsconfig[idx].remote_udp_port,
				g_nsconfig[idx].local_ip, g_nsconfig[idx].local_udp_port, 0, { udp := {}});
	if (not ispresent(res.connId)) {
		setverdict(fail, "Could not connect NS UDP socket, check your configuration ", g_nsconfig[idx]);
		mtc.stop;
	}
	g_ns_conn_id[idx] := res.connId;

}

function f_ns_exp(template PDU_NS exp_rx, integer idx := 0) runs on RAW_NS_CT return PDU_NS {
	var NS_RecvFrom nrf;
	log("f_ns_exp() expecting ", exp_rx);
	alt {
	[] NSCP[idx].receive(t_NS_RecvFrom(exp_rx)) -> value nrf { }
	[] NSCP[idx].receive {
		setverdict(fail, "Received unexpected NS: ", nrf);
		mtc.stop;
		}
	}
	return nrf.msg;
}

/* perform outbound NS-ALIVE procedure */
function f_outgoing_ns_alive(integer idx := 0) runs on RAW_NS_CT {
	NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], t_NS_ALIVE));
	alt {
	[] NSCP[idx].receive(t_NS_RecvFrom(t_NS_ALIVE_ACK));
	[] NSCP[idx].receive { repeat; }
	}
}

/* perform outbound NS-ALIVE procedure */
function f_outgoing_ns_alive_no_ack(integer idx := 0, float tout := 10.0) runs on RAW_NS_CT {
	timer T := tout;
	NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], t_NS_ALIVE));
	T.start;
	alt {
	[] NSCP[idx].receive(t_NS_RecvFrom(t_NS_ALIVE_ACK)) {
		setverdict(fail, "Received unexpected NS-ALIVE ACK");
		}
	[] NSCP[idx].receive { repeat; }
	[] T.timeout {
		setverdict(pass);
		}
	}
}

/* ensure no matching message is received within 'tout' */
function f_ensure_no_ns(template PDU_NS ns := ?, integer idx := 0, float tout := 3.0)
runs on RAW_Test_CT {
	timer T := tout;
	T.start;
	alt {
	[] NSCP[idx].receive(t_NS_RecvFrom(ns)) {
		setverdict(fail, "NS-ALIVE from unconfigured (possibly initial) endpoint");
		}
	[] T.timeout {
		setverdict(pass);
		}
	}
}

/* perform outbound NS-BLOCK procedure */
function f_outgoing_ns_block(NsCause cause, integer idx := 0) runs on RAW_NS_CT {
	NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], ts_NS_BLOCK(cause, g_nsconfig[idx].nsvci)));
	alt {
	[] NSCP[idx].receive(t_NS_RecvFrom(tr_NS_BLOCK_ACK(g_nsconfig[idx].nsvci)));
	[] NSCP[idx].receive { repeat; }
	}
}

/* receive NS-ALIVE and ACK it */
altstep as_rx_alive_tx_ack(boolean oneshot := false, integer idx := 0) runs on RAW_NS_CT {
	[] NSCP[idx].receive(t_NS_RecvFrom(t_NS_ALIVE)) {
		NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], t_NS_ALIVE_ACK));
		if (not oneshot) { repeat; }
		}
}

/* Transmit BSSGP RESET for given BVCI and expect ACK */
function f_tx_bvc_reset_rx_ack(BssgpBvci bvci, integer idx := 0, boolean exp_ack := true)
runs on RAW_NS_CT {
	var PDU_BSSGP bssgp_tx := valueof(ts_BVC_RESET(BSSGP_CAUSE_NET_SV_CAP_MOD_GT_ZERO_KBPS, bvci,
							mp_gb_cfg.cell_id));
	timer T := 5.0;
	NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], ts_NS_UNITDATA(t_SduCtrlB, 0, enc_PDU_BSSGP(bssgp_tx))));
	T.start;
	alt {
	[exp_ack] NSCP[idx].receive(t_NS_RecvFrom(tr_NS_UNITDATA(t_SduCtrlB, 0,
						  decmatch tr_BVC_RESET_ACK(bvci, ?)))) {
		setverdict(pass);
		}
	[exp_ack] T.timeout {
		setverdict(fail, "No response to BVC-RESET");
		}
	[not exp_ack] T.timeout {
		setverdict(pass);
		}
	[] NSCP[idx].receive { repeat; }
	}
}

/* Receive a BSSGP RESET for given BVCI and ACK it */
altstep as_rx_bvc_reset_tx_ack(BssgpBvci bvci, boolean oneshot := false, integer idx := 0) runs on RAW_NS_CT {
	var NS_RecvFrom ns_rf;
	/* FIXME: nail down received cell_id in match */
	[] NSCP[idx].receive(t_NS_RecvFrom(tr_NS_UNITDATA(t_SduCtrlB, 0,
						  decmatch tr_BVC_RESET(?, bvci, ?))))
								-> value ns_rf {
		var PDU_BSSGP bssgp_rx := dec_PDU_BSSGP(ns_rf.msg.pDU_NS_Unitdata.nS_SDU);
		var PDU_BSSGP bssgp_tx := valueof(ts_BVC_RESET_ACK(bvci, mp_gb_cfg.cell_id));
		NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], ts_NS_UNITDATA(t_SduCtrlB, 0, enc_PDU_BSSGP(bssgp_tx))));
		if (not oneshot) { repeat; }
		}
}


/* Receive a BSSGP UNBLOCK for given BVCI and ACK it */
altstep as_rx_bvc_unblock_tx_ack(BssgpBvci bvci, boolean oneshot := false, integer idx := 0) runs on RAW_NS_CT {
	var NS_RecvFrom ns_rf;
	[] NSCP[idx].receive(t_NS_RecvFrom(tr_NS_UNITDATA(t_SduCtrlB, 0,
						  decmatch t_BVC_UNBLOCK(bvci))))
								-> value ns_rf {
		var PDU_BSSGP bssgp_rx := dec_PDU_BSSGP(ns_rf.msg.pDU_NS_Unitdata.nS_SDU);
		var PDU_BSSGP bssgp_tx := valueof(t_BVC_UNBLOCK_ACK(bvci));
		NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], ts_NS_UNITDATA(t_SduCtrlB, 0, enc_PDU_BSSGP(bssgp_tx))));
		if (not oneshot) { repeat; }
		}
}

/* Receive a BSSGP FLOW-CONTROL-BVC and ACK it */
altstep as_rx_bvc_fc_tx_ack(BssgpBvci bvci, boolean oneshot := false, integer idx := 0) runs on RAW_NS_CT {
	var NS_RecvFrom ns_rf;
	[] NSCP[idx].receive(t_NS_RecvFrom(tr_NS_UNITDATA(t_SduCtrlB, bvci,
						  decmatch tr_BVC_FC_BVC)))
								-> value ns_rf {
		var PDU_BSSGP bssgp_rx := dec_PDU_BSSGP(ns_rf.msg.pDU_NS_Unitdata.nS_SDU);
		var OCT1 tag := bssgp_rx.pDU_BSSGP_FLOW_CONTROL_BVC.tag.unstructured_Value;
		var PDU_BSSGP bssgp_tx := valueof(t_BVC_FC_BVC_ACK(tag));
		NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], ts_NS_UNITDATA(t_SduCtrlB, bvci, enc_PDU_BSSGP(bssgp_tx))));
		if (not oneshot) { repeat; }
		}
}

/**********************************************************************************
 * Classic Gb/IP bring-up test cases using NS-{RESET,BLOCK,UNBLOCK} and no IP-SNS *
 **********************************************************************************/

/* Receive a NS-RESET and ACK it */
private altstep as_rx_ns_reset_ack(boolean oneshot := false, integer idx := 0) runs on RAW_NS_CT {
	var NS_RecvFrom ns_rf;
	[] NSCP[idx].receive(t_NS_RecvFrom(tr_NS_RESET(NS_CAUSE_OM_INTERVENTION, g_nsconfig[idx].nsvci,
						  g_nsconfig[idx].nsei))) -> value ns_rf {
		NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], ts_NS_RESET_ACK(g_nsconfig[idx].nsvci,
									    g_nsconfig[idx].nsei)));
		if (not oneshot) { repeat; }
		}
}
/* Receive a NS-UNBLOCK and ACK it */
private altstep as_rx_ns_unblock_ack(boolean oneshot := false, integer idx := 0) runs on RAW_NS_CT {
	var NS_RecvFrom ns_rf;
	[] NSCP[idx].receive(t_NS_RecvFrom(t_NS_UNBLOCK)) -> value ns_rf {
		NSCP[idx].send(t_NS_Send(g_ns_conn_id[idx], t_NS_UNBLOCK_ACK));
		if (not oneshot) { repeat; }
		}
}

/* test the NS-RESET procedure */
testcase TC_ns_reset() runs on RAW_Test_CT {
	f_init_ns_codec();
	f_init_pcuif();


	/* Expect inbound NS-RESET procedure */
	as_rx_ns_reset_ack(oneshot := true);
	setverdict(pass);
}

/* ensure NS-RESET are re-transmitted */
testcase TC_ns_reset_retrans() runs on RAW_Test_CT {
	f_init_ns_codec();
	f_init_pcuif();

	var integer i;
	for (i := 0; i < 3; i := i+1) {
		NSCP[0].receive(t_NS_RecvFrom(tr_NS_RESET(NS_CAUSE_OM_INTERVENTION,
							g_nsconfig[0].nsvci, g_nsconfig[0].nsei)));
	}

	/* Expect inbound NS-RESET procedure */
	as_rx_ns_reset_ack(oneshot := true);
	setverdict(pass);
}

/* test the inbound NS-ALIVE procedure after NS-RESET */
testcase TC_ns_alive() runs on RAW_Test_CT {
	f_init_ns_codec();
	f_init_pcuif();

	/* Expect inbound NS-RESET procedure */
	as_rx_ns_reset_ack(oneshot := true);

	/* wait for one ALIVE cycle, then ACK any further ALIVE in the background */
	as_rx_alive_tx_ack(oneshot := true);
	setverdict(pass);
}

/* Test for NS-RESET after NS-ALIVE timeout */
testcase TC_ns_alive_timeout_reset() runs on RAW_Test_CT {
	f_init_ns_codec(guard_secs := 100.0);
	f_init_pcuif();

	/* Expect inbound NS-RESET procedure */
	as_rx_ns_reset_ack(oneshot := true);

	/* wait for at least one NS-ALIVE */
	NSCP[0].receive(t_NS_RecvFrom(t_NS_ALIVE));

	/* wait for NS-RESET to re-appear, ignoring any NS-ALIVE until then */
	alt {
	[] as_rx_ns_reset_ack(oneshot := true) { setverdict(pass); }
	[] NSCP[0].receive(t_NS_RecvFrom(t_NS_ALIVE)) { repeat; }
	}
}

/* test for NS-RESET/NS-ALIVE/NS-UNBLOCK */
testcase TC_ns_unblock() runs on RAW_Test_CT {
	f_init_ns_codec();
	f_init_pcuif();

	/* Expect inbound NS-RESET procedure */
	as_rx_ns_reset_ack(oneshot := true);

	/* wait for one ALIVE cycle, then ACK any further ALIVE in the background */
	as_rx_alive_tx_ack(oneshot := true);
	activate(as_rx_alive_tx_ack());

	as_rx_ns_unblock_ack(oneshot := true);
	setverdict(pass);
}

/* test for NS-UNBLOCK re-transmissions */
testcase TC_ns_unblock_retrans() runs on RAW_Test_CT {
	f_init_ns_codec();
	f_init_pcuif();

	/* Expect inbound NS-RESET procedure */
	as_rx_ns_reset_ack(oneshot := true);

	/* wait for one ALIVE cycle, then ACK any further ALIVE in the background */
	as_rx_alive_tx_ack(oneshot := true);
	activate(as_rx_alive_tx_ack());

	/* wait for first NS-UNBLOCK, don't respond */
	NSCP[0].receive(t_NS_RecvFrom(t_NS_UNBLOCK));

	/* wait for re-transmission of NS-UNBLOCK */
	as_rx_ns_unblock_ack(oneshot := true);
	setverdict(pass);
}

/* full bring-up of the Gb link for NS and BSSGP layer up to BVC-FC */
testcase TC_ns_full_bringup() runs on RAW_Test_CT {
	f_init_ns_codec();
	f_init_pcuif();

	/* Expect inbound NS-RESET procedure */
	as_rx_ns_reset_ack(oneshot := true);

	/* wait for one ALIVE cycle, then ACK any further ALIVE in the background */
	as_rx_alive_tx_ack(oneshot := true);
	activate(as_rx_alive_tx_ack());

	as_rx_ns_unblock_ack(oneshot := true);

	f_outgoing_ns_alive();

	/* Expect BVC-RESET for signaling (0) and ptp BVCI */
	as_rx_bvc_reset_tx_ack(0, oneshot := true);
	as_rx_bvc_reset_tx_ack(mp_gb_cfg.bvci, oneshot := true);
	as_rx_bvc_unblock_tx_ack(mp_gb_cfg.bvci, oneshot := true);

	/* wait for one FLOW-CONTROL BVC and then ACK any further in the future */
	as_rx_bvc_fc_tx_ack(mp_gb_cfg.bvci, oneshot := true);
	activate(as_rx_bvc_fc_tx_ack(mp_gb_cfg.bvci));
	setverdict(pass);
}

/* test outbound (SGSN-originated) NS-BLOCK procedure */
testcase TC_ns_so_block() runs on RAW_Test_CT {
	f_init_ns_codec();
	f_init_pcuif();

	/* Expect inbound NS-RESET procedure */
	as_rx_ns_reset_ack(oneshot := true);

	/* wait for one ALIVE cycle, then ACK any further ALIVE in the background */
	as_rx_alive_tx_ack(oneshot := true);
	activate(as_rx_alive_tx_ack());

	as_rx_ns_unblock_ack(oneshot := true);

	f_outgoing_ns_alive();

	f_outgoing_ns_block(NS_CAUSE_EQUIPMENT_FAILURE);
	setverdict(pass);
}

type record lqual_range {
	/* component reference to the IPA_Client component used for RSL */
	uint8_t low,
	uint8_t high
}

type component RAW_PCU_Test_CT extends bssgp_CT {
	/* Connection to the BTS component (one for now) */
	port RAW_PCU_MSG_PT BTS;
	/* Connection to the PCUIF component */
	port RAW_PCU_MSG_PT PCUIF;
	/* VTY connection to the PCU */
	port TELNETasp_PT PCUVTY;

	/* Uplink CS/MCS thresholds, default from pcu_main.c: */
	var lqual_range g_cs_lqual_ranges[4] := {{low := 0, high := 6},
						 {low := 5, high := 8},
						 {low := 7, high := 13},
						 {low := 12,high := 35}};
	var lqual_range g_mcs_lqual_ranges[9] := {{low := 0, high := 6},
						 {low := 5, high := 8},
						 {low := 7, high := 13},
						 {low := 12,high := 15},
						 {low := 14, high := 17},
						 {low := 16, high := 18},
						 {low := 17,high := 20},
						 {low := 19, high := 24},
						 {low := 23,high := 35}};
	var uint8_t g_cs_initial_dl := 1;
	var uint8_t g_cs_initial_ul := 1;
	var uint8_t g_mcs_initial_dl := 1;
	var uint8_t g_mcs_initial_ul := 1;
	var uint8_t g_cs_max_dl := 4;
	var uint8_t g_cs_max_ul := 4;
	var uint8_t g_mcs_max_dl := 9;
	var uint8_t g_mcs_max_ul := 9;

	/* Guard timeout */
	timer g_T_guard := 60.0;
};

private altstep as_Tguard_RAW() runs on RAW_PCU_Test_CT {
	[] g_T_guard.timeout {
		setverdict(fail, "Timeout of T_guard");
		mtc.stop;
		}
}

private function f_pcuvty_set_allowed_cs_mcs() runs on RAW_PCU_Test_CT {
	f_vty_config2(PCUVTY, {"pcu"}, "cs " & int2str(g_cs_initial_dl) & " " & int2str(g_cs_initial_ul));
	f_vty_config2(PCUVTY, {"pcu"}, "cs max " & int2str(g_cs_max_dl) & " " & int2str(g_cs_max_ul));

	f_vty_config2(PCUVTY, {"pcu"}, "mcs " & int2str(g_mcs_initial_dl) & " " & int2str(g_mcs_initial_ul));
	f_vty_config2(PCUVTY, {"pcu"}, "mcs max " & int2str(g_mcs_max_dl) & " " & int2str(g_mcs_max_ul));
}

private function f_pcuvty_set_link_quality_ranges() runs on RAW_PCU_Test_CT {
	var charstring cmd;

	cmd := "cs link-quality-ranges" &
	       " cs1 " & int2str(g_cs_lqual_ranges[0].high) &
	       " cs2 " & int2str(g_cs_lqual_ranges[1].low) & " " & int2str(g_cs_lqual_ranges[1].high) &
	       " cs3 " & int2str(g_cs_lqual_ranges[2].low) & " " & int2str(g_cs_lqual_ranges[2].high) &
	       " cs4 " & int2str(g_cs_lqual_ranges[3].low);
	f_vty_config2(PCUVTY, {"pcu"}, cmd);

	cmd := "mcs link-quality-ranges" &
	       " mcs1 " & int2str(g_mcs_lqual_ranges[0].high) &
	       " mcs2 " & int2str(g_mcs_lqual_ranges[1].low) & " " & int2str(g_mcs_lqual_ranges[1].high) &
	       " mcs3 " & int2str(g_mcs_lqual_ranges[2].low) & " " & int2str(g_mcs_lqual_ranges[2].high) &
	       " mcs4 " & int2str(g_mcs_lqual_ranges[3].low) & " " & int2str(g_mcs_lqual_ranges[3].high) &
	       " mcs5 " & int2str(g_mcs_lqual_ranges[4].low) & " " & int2str(g_mcs_lqual_ranges[4].high) &
	       " mcs6 " & int2str(g_mcs_lqual_ranges[5].low) & " " & int2str(g_mcs_lqual_ranges[5].high) &
	       " mcs7 " & int2str(g_mcs_lqual_ranges[6].low) & " " & int2str(g_mcs_lqual_ranges[6].high) &
	       " mcs8 " & int2str(g_mcs_lqual_ranges[7].low) & " " & int2str(g_mcs_lqual_ranges[7].high) &
	       " mcs9 " & int2str(g_mcs_lqual_ranges[8].low);
	f_vty_config2(PCUVTY, {"pcu"}, cmd);
}

private function f_init_vty(charstring id) runs on RAW_PCU_Test_CT {
	map(self:PCUVTY, system:PCUVTY);
	f_vty_set_prompts(PCUVTY);
	f_vty_transceive(PCUVTY, "enable");
}

private function f_init_raw(charstring id, template (value) PCUIF_info_ind info_ind := ts_PCUIF_INFO_default)
runs on RAW_PCU_Test_CT {
	var RAW_PCUIF_CT vc_PCUIF;
	var RAW_PCU_BTS_CT vc_BTS;

	/* Start the guard timer */
	g_T_guard.start;
	activate(as_Tguard_RAW());

	/* Init PCU interface component */
	vc_PCUIF := RAW_PCUIF_CT.create("PCUIF-" & id);
	connect(vc_PCUIF:MTC, self:PCUIF);
	map(vc_PCUIF:PCU, system:PCU);

	/* Create one BTS component (we may want more some day) */
	vc_BTS := RAW_PCU_BTS_CT.create("BTS-" & id);
	connect(vc_BTS:PCUIF, vc_PCUIF:BTS);
	connect(vc_BTS:TC, self:BTS);

	f_init_vty(id);

	vc_PCUIF.start(f_PCUIF_CT_handler(mp_pcu_sock_path));
	vc_BTS.start(f_BTS_CT_handler(0, valueof(info_ind)));

	/* Wait until the BTS is ready (SI13 negotiated) */
	BTS.receive(tr_RAW_PCU_EV(BTS_EV_SI13_NEGO));
}

/* FIXME: properly encode RA (see TS 24.060, table 11.2.5.2) */
private function f_establish_tbf(out GsmRrMessage rr_imm_ass, uint8_t bts_nr := 0,
				 uint16_t ra := oct2int('3A'O), uint8_t is_11bit := 0,
				 PCUIF_BurstType burst_type := BURST_TYPE_0,
				 TimingAdvance ta := 0)
runs on RAW_PCU_Test_CT return boolean {
	var PCUIF_Message pcu_msg;
	var GsmRrMessage rr_msg;
	var uint32_t fn;
	timer T;

	/* FIXME: ask the BTS component to give us the current TDMA fn */
	fn := 1337 + ta;

	/* Send RACH.ind */
	log("Sending RACH.ind on fn=", fn, " with RA=", ra, ", TA=", ta);
	BTS.send(ts_PCUIF_RACH_IND(bts_nr := bts_nr, trx_nr := 0, ts_nr := 0,
				   ra := ra, is_11bit := is_11bit,
				   burst_type := burst_type,
				   fn := fn, arfcn := 871,
				   qta := ta * 4));

	/* Expect Immediate (TBF) Assignment on TS0/AGCH */
	T.start(2.0);
	alt {
	[] BTS.receive(tr_PCUIF_DATA_REQ(bts_nr := bts_nr, trx_nr := 0, ts_nr := 0,
					 sapi := PCU_IF_SAPI_AGCH, data := ?))
					-> value pcu_msg {
		rr_imm_ass := dec_GsmRrMessage(pcu_msg.u.data_req.data);
		log("Rx Immediate Assignment: ", rr_imm_ass);

		/* Make sure this assignment is for us
		 * TODO: Uplink or Downlink TBF? */
		if (match(rr_imm_ass, tr_IMM_TBF_ASS(?, ra, fn))) {
			setverdict(pass);
			return true;
		}

		/* Not for us? Wait for more. */
		repeat;
		}
	[] BTS.receive { repeat; }
	[] T.timeout {
		setverdict(fail, "Timeout waiting for Immediate Assignment");
		}
	}

	return false;
}

private function f_imm_ass_verify_ul_tbf_ass(GsmRrMessage rr_imm_ass, out PacketUlAssign ul_tbf_ass)
runs on RAW_PCU_Test_CT return boolean {

	/* Make sure we received an UL TBF Assignment */
	if (match(rr_imm_ass, tr_IMM_TBF_ASS(dl := false, rest := tr_IaRestOctets_ULAss(?)))) {
		ul_tbf_ass := rr_imm_ass.payload.imm_ass.rest_octets.hh.pa.uldl.ass.ul;
		log("Rx Uplink TBF assignment: ", ul_tbf_ass);
		setverdict(pass);
	} else {
		setverdict(fail, "Failed to match UL TBF Assignment");
		return false;
	}

	/* Make sure we have got a TBF with Dynamic Block Allocation */
	if (ul_tbf_ass.dynamic == omit) {
		setverdict(fail, "Single Block Allocation is not handled by ", testcasename());
		return false;
	}

	return true;
}

private function f_imm_ass_verify_dl_tbf_ass(GsmRrMessage rr_imm_ass, out PacketDlAssign dl_tbf_ass)
runs on RAW_PCU_Test_CT return boolean {

	/* Make sure we received a DL TBF Assignment */
	if (match(rr_imm_ass, tr_IMM_TBF_ASS(dl := true, rest := tr_IaRestOctets_DLAss(?)))) {
		dl_tbf_ass := rr_imm_ass.payload.imm_ass.rest_octets.hh.pa.uldl.ass.dl;
		log("Rx Downlink TBF assignment: ", dl_tbf_ass);
		setverdict(pass);
	} else {
		setverdict(fail, "Failed to match DL TBF Assignment");
		return false;
	}

	return true;
}

/* Enqueue DATA.ind (both TDMA frame and block numbers to be patched) */
private function f_pcuif_tx_data_ind(octetstring data, int16_t lqual_cb := 0, uint32_t fn := 0)
runs on RAW_PCU_Test_CT {
	var template RAW_PCU_EventParam ev_param := {tdma_fn := ? };
	BTS.send(ts_PCUIF_DATA_IND(bts_nr := 0, trx_nr := 0, ts_nr := 7, block_nr := 0,
				   sapi := PCU_IF_SAPI_PDTCH, data := data,
				   fn := fn, arfcn := 871, lqual_cb := lqual_cb));
	if (fn != 0) {
		ev_param := {tdma_fn := fn };
	}
	BTS.receive(tr_RAW_PCU_EV(TDMA_EV_PDTCH_BLOCK_SENT, ev_param));
}

/* Enqueue RTS.req, expect DATA.req with UL ACK from the PCU */
private function f_pcuif_rx_data_req(out PCUIF_Message pcu_msg)
runs on RAW_PCU_Test_CT {
	BTS.send(ts_PCUIF_RTS_REQ(bts_nr := 0, trx_nr := 0, ts_nr := 7,
				  sapi := PCU_IF_SAPI_PDTCH, fn := 0,
				  arfcn := 871, block_nr := 0));
	BTS.receive(tr_PCUIF_DATA_REQ(bts_nr := 0, trx_nr := 0, ts_nr := 7,
				      sapi := PCU_IF_SAPI_PDTCH)) -> value pcu_msg;
}

/* Expect an Immediate Assignment (paging) from PCU on PCUIF on specified sapi.  */
private function f_pcuif_rx_pch_imm_tbf_ass(out GsmRrMessage rr_imm_ass)
runs on RAW_PCU_Test_CT {
	var PCUIF_Message pcu_msg;
	var octetstring macblock;
	BTS.receive(tr_PCUIF_DATA_REQ(bts_nr := 0, trx_nr := 0, ts_nr := 0,
				      sapi := PCU_IF_SAPI_PCH)) -> value pcu_msg;
	/* First 3 bytes contain paging group: */
	macblock := substr(pcu_msg.u.data_req.data, 3, pcu_msg.u.data_req.len - 3);
	rr_imm_ass := dec_GsmRrMessage(macblock);
	if (not match(rr_imm_ass, tr_IMM_TBF_ASS())) {
		setverdict(fail, "Failed to match Immediate Assignment: ", rr_imm_ass);
		mtc.stop;
	}
	BTS.send(ts_PCUIF_DATA_CNF(bts_nr := 0, trx_nr := 0, ts_nr := 0, block_nr := 0,
				   fn := 0, arfcn := 871, sapi := PCU_IF_SAPI_PCH, data := macblock));
}

private function f_tx_rlcmac_ul_block(template (value) RlcmacUlBlock ul_data, int16_t lqual_cb := 0, uint32_t fn := 0)
runs on RAW_PCU_Test_CT {
	var octetstring data;
	/* Encode the payload of DATA.ind */
	data := enc_RlcmacUlBlock(valueof(ul_data));
	data := f_pad_oct(data, 23, '00'O); /* CS-1 */

	/* Enqueue DATA.ind (both TDMA frame and block numbers to be patched) */
	f_pcuif_tx_data_ind(data, lqual_cb, fn);
}

private function f_tx_rlcmac_ul_n_blocks(PacketUlAssign ul_tbf_ass, integer num_blocks := 1)
runs on RAW_PCU_Test_CT {
	var template (value) RlcmacUlBlock ul_data := t_RLCMAC_UL_DATA(
		tfi := ul_tbf_ass.dynamic.tfi_assignment,
		cv := num_blocks - 1, /* num UL blocks to be sent (to be overridden in loop) */
		bsn := 0, /* TODO: what should be here? */
		blocks := { /* To be generated in loop */ });

	/* HACK: patch missing TLLI; otherwise OsmoPCU rejects DATA.req */
	ul_data.data.tlli := '00000001'O;

	for (var integer i := 0; i < num_blocks; i := i + 1) {
		/* Prepare a new UL block (CV, random payload) */
		ul_data.data.mac_hdr.countdown := (num_blocks - i - 1);
		ul_data.data.blocks := { valueof(t_RLCMAC_LLCBLOCK(f_rnd_octstring(10))) };
		f_tx_rlcmac_ul_block(ul_data);
	}
}

private function f_rx_rlcmac_dl_block(out RlcmacDlBlock dl_block, out uint32_t dl_fn)
runs on RAW_PCU_Test_CT {
	var PCUIF_Message pcu_msg;
	f_pcuif_rx_data_req(pcu_msg);
	dl_block := dec_RlcmacDlBlock(pcu_msg.u.data_req.data);
	dl_fn := pcu_msg.u.data_req.fn;
}

private function f_rx_rlcmac_dl_block_exp_ack_nack(out RlcmacDlBlock dl_block)
runs on RAW_PCU_Test_CT {
	var uint32_t dl_fn;

	f_rx_rlcmac_dl_block(dl_block, dl_fn);
	if (not match(dl_block, tr_RLCMAC_UL_ACK_NACK(ul_tfi := ?, tlli := ?))) {
		setverdict(fail, "Failed to match Packet Uplink ACK / NACK");
		mtc.stop;
	}
}

private function f_rx_rlcmac_dl_block_exp_dummy(out RlcmacDlBlock dl_block)
runs on RAW_PCU_Test_CT {
	var uint32_t dl_fn;

	f_rx_rlcmac_dl_block(dl_block, dl_fn);
	if (not match(dl_block, tr_RLCMAC_DUMMY_CTRL())) {
		setverdict(fail, "Failed to match Packet DUMMY DL");
		mtc.stop;
	}
}

private function f_rx_rlcmac_dl_block_exp_data(out RlcmacDlBlock dl_block, out uint32_t ack_fn, octetstring data)
runs on RAW_PCU_Test_CT {
	var PCUIF_Message pcu_msg;
	var uint32_t dl_fn;
	var template RlcmacDlBlock dl_template := tr_RLCMAC_DATA_RRBP;
	dl_template.data.blocks := ?;

	f_rx_rlcmac_dl_block(dl_block, dl_fn);
	if (not match(dl_block, dl_template)) {
		setverdict(fail, "Failed to match Packet data: ", dl_block, " vs ", dl_template);
		mtc.stop;
	}

	ack_fn := dl_fn + f_rrbp_fn_delay(dl_block.data.mac_hdr.mac_hdr.rrbp);

	if (lengthof(dl_block.data.blocks) < 1) {
		setverdict(fail, "DL block has no LLC payload: ", dl_block);
		mtc.stop;
	}

	if (ispresent(dl_block.data.blocks[0].hdr) and dl_block.data.blocks[0].hdr.length_ind != lengthof(data)) {
		setverdict(fail, "DL block has LLC header with wrong expected size: ",
			   dl_block.data.blocks[0].hdr.length_ind, " vs ", lengthof(data));
		mtc.stop;
	}

	if (dl_block.data.blocks[0].payload != data) {
		setverdict(fail, "Failed to match content of LLC payload in DL Block: ", dl_block, " vs ", data);
		mtc.stop;
	}

	/* Check next data blocks contain dummy frames */
	if (lengthof(dl_block.data.blocks) > 1 and substr(dl_block.data.blocks[1].payload, 0, 3) != '43C001'O) {
		setverdict(fail, "Second data payload is not a dummy frame: ", dl_block.data.blocks[1].payload);
		mtc.stop;
	}
}

testcase TC_pcuif_suspend() runs on RAW_PCU_Test_CT {
	var octetstring ra_id := enc_RoutingAreaIdentification(mp_gb_cfg.cell_id.ra_id);
	var GprsTlli tlli := 'FFFFFFFF'O;
	timer T;

	/* Initialize NS/BSSGP side */
	f_init_bssgp();

	/* Initialize the PCU interface abstraction */
	f_init_raw(testcasename());

	/* Establish BSSGP connection to the PCU */
	f_bssgp_establish();

	BTS.send(ts_PCUIF_SUSP_REQ(0, tlli, ra_id, 0));

	T.start(2.0);
	alt {
	[] BSSGP_SIG[0].receive(tr_BSSGP_SUSPEND(tlli, mp_gb_cfg.cell_id.ra_id)) {
		setverdict(pass);
		}
	[] T.timeout {
		setverdict(fail, "Timeout waiting for BSSGP SUSPEND");
		}
	}
}

/* Test of correct Timing Advance at the time of TBF establishment
 * (derived from timing offset of the Access Burst). */
testcase TC_ta_rach_imm_ass() runs on RAW_PCU_Test_CT {
	var GsmRrMessage rr_msg;
	var boolean ok;

	/* Initialize the PCU interface abstraction */
	f_init_raw(testcasename());

	/* We cannot send too many TBF requests in a short time because
	 * at some point the PCU will fail to allocate a new TBF. */
	for (var TimingAdvance ta := 0; ta < 64; ta := ta + 16) {
		/* Establish an Uplink TBF (send RACH.ind with current TA) */
		ok := f_establish_tbf(rr_msg, bts_nr := 0, ta := ta);
		if (not ok) {
			setverdict(fail, "Failed to establish an Uplink TBF");
			mtc.stop;
		}

		/* Make sure Timing Advance IE matches out expectations */
		if (match(rr_msg, tr_IMM_TBF_ASS(dl := false, ta := ta))) {
			setverdict(pass);
		}
	}
}

/* Verify that the PCU generates valid PTCCH/D messages
 * while neither Uplink nor Downlink TBF is established. */
testcase TC_ta_ptcch_idle() runs on RAW_PCU_Test_CT {
	var PTCCHDownlinkMsg ptcch_msg;
	var PCUIF_Message pcu_msg;
	timer T;

	/* Initialize the PCU interface abstraction */
	f_init_raw(testcasename());

	/* Sent an RTS.req for PTCCH/D */
	BTS.send(ts_PCUIF_RTS_REQ(bts_nr := 0, trx_nr := 0, ts_nr := 7,
				  sapi := PCU_IF_SAPI_PTCCH, fn := 0,
				  arfcn := 871, block_nr := 0));
	T.start(5.0);
	alt {
	[] BTS.receive(tr_PCUIF_DATA_REQ(bts_nr := 0, trx_nr := 0, ts_nr := 7,
					 sapi := PCU_IF_SAPI_PTCCH)) -> value pcu_msg {
		log("Rx DATA.req message: ", pcu_msg);
		setverdict(pass);
		}
	[] BTS.receive(PCUIF_Message:?) { repeat; }
	[] T.timeout {
		setverdict(fail, "Timeout waiting for a PTCCH/D block");
		mtc.stop;
		}
	}

	ptcch_msg := dec_PTCCHDownlinkMsg(pcu_msg.u.data_req.data);
	log("Decoded PTCCH/D message: ", ptcch_msg);

	/* Make sure the message is encoded correctly
	 * TODO: do we expect all TA values to be equal '1111111'B? */
	if (not match(ptcch_msg, tr_PTCCHDownlinkMsg)) {
		setverdict(fail, "Malformed PTCCH/D message");
		mtc.stop;
	}
}

/* Test of correct Timing Advance during an active Uplink TBF.
 *
 * Unlike the circuit-switched domain, Uplink transmissions on PDCH time-slots
 * are not continuous and there can be long time gaps between them. This happens
 * due to a bursty nature of packet data. The actual Timing Advance of a MS may
 * significantly change between such rare Uplink transmissions, so GPRS introduces
 * additional mechanisms to control Timing Advance, and thus reduce interference
 * between neighboring TDMA time-slots.
 *
 * At the moment of Uplink TBF establishment, initial Timing Advance is measured
 * from ToA (Timing of Arrival) of an Access Burst. This is covered by another
 * test case - TC_ta_rach_imm_ass. In response to that Access Burst the network
 * sends Immediate Assignment on AGCH, which _may_ contain Timing Advance Index
 * among with the initial Timing Advance value. And here PTCCH comes to play.
 *
 * PTCCH is a unidirectional channel on which the network can instruct a sub-set
 * of 16 MS (whether TBFs are active or not) to adjust their Timing Advance
 * continuously. To ensure continuous measurements of the signal propagation
 * delay, the MSs shall transmit Access Bursts on Uplink (PTCCH/U) on sub-slots
 * defined by an assigned Timing Advance Index (see 3GPP TS 45.002).
 *
 * The purpose of this test case is to verify the assignment of Timing Advance
 * Index, and the process of Timing Advance notification on PTCCH/D. The MTC
 * first establishes several Uplink TBFs, but does not transmit any Uplink
 * blocks on them. During 4 TDMA multi-frame periods the MTC is sending RACH
 * indications to the PCU, checking the correctness of two received PTCCH/D
 * messages (period of PTCCH/D is two multi-frames).
 */

/* List of ToA values for Access Bursts to be sent on PTCCH/U,
 * each ToA (Timing of Arrival) value is in units of 1/4 of
 * a symbol (i.e. 1 symbol is 4 QTA units). */
type record length(16) of int16_t PTCCH_TAI_ToA_MAP;
const PTCCH_TAI_ToA_MAP ptcch_toa_map_def := {
	0, 0, 0, 0,
	0, 0, 0, 0,
	0, 0, 0, 0,
	0, 0, 0, 0
};

private altstep as_ta_ptcch(uint8_t bts_nr := 0, uint8_t trx_nr := 0, uint8_t ts_nr := 7,
			    in PTCCH_TAI_ToA_MAP toa_map := ptcch_toa_map_def)
runs on RAW_PCU_Test_CT {
	var RAW_PCU_Event event;
	var integer ss;

	/* Send Access Bursts on PTCCH/U for every TA Index */
	[] BTS.receive(tr_RAW_PCU_EV(TDMA_EV_PTCCH_UL_BURST)) -> value event {
		ss := f_tdma_ptcch_fn2ss(event.data.tdma_fn);
		if (ss < 0) { mtc.stop; } /* Shall not happen */

		log("Sending an Access Burst on PTCCH/U",
		    ", sub-slot=", ss, " (TAI)",
		    ", fn=", event.data.tdma_fn,
		    ", ToA=", toa_map[ss], " (QTA)");
		/* TODO: do we care about RA and burst format? */
		BTS.send(ts_PCUIF_RACH_IND(bts_nr, trx_nr, ts_nr,
					   ra := oct2int('3A'O),
					   is_11bit := 0,
					   burst_type := BURST_TYPE_0,
					   fn := event.data.tdma_fn,
					   arfcn := 871,
					   qta := toa_map[ss],
					   sapi := PCU_IF_SAPI_PTCCH));
		repeat;
		}
}

private function f_TC_ta_ptcch_ul_multi_tbf(in PTCCH_TAI_ToA_MAP ptcch_toa_map,
					    template PTCCHDownlinkMsg t_ta_msg)
runs on RAW_PCU_Test_CT {
	var PTCCHDownlinkMsg ta_msg;
	var PCUIF_Message pcu_msg;
	timer T;

	/* First, send an RTS.req for the upcoming PTCCH/D block */
	BTS.send(ts_PCUIF_RTS_REQ(bts_nr := 0, trx_nr := 0, ts_nr := 7,
				  sapi := PCU_IF_SAPI_PTCCH, fn := 0,
				  arfcn := 871, block_nr := 0));
	T.start(2.0);
	alt {
	/* Keep sending of Access Bursts during two multi-frames (period of PTCCH/D)
	 * with increasing ToA (Timing of Arrival) values: 0, 7, 14, 28, 35... */
	[] as_ta_ptcch(bts_nr := 0, trx_nr := 0, ts_nr := 7, toa_map := ptcch_toa_map);
	/* In the end of 2nd multi-frame we should receive a PTCCH/D block */
	[] BTS.receive(tr_PCUIF_DATA_REQ(bts_nr := 0, trx_nr := 0, ts_nr := 7,
					 sapi := PCU_IF_SAPI_PTCCH)) -> value pcu_msg {
		ta_msg := dec_PTCCHDownlinkMsg(pcu_msg.u.data_req.data);
		log("Rx PTCCH/D message: ", ta_msg);

		/* Make sure Timing Advance values match our expectations */
		if (match(ta_msg, t_ta_msg)) {
			setverdict(pass);
		} else {
			setverdict(fail, "PTCCH/D message does not match: ", t_ta_msg);
		}
		}
	[] BTS.receive { repeat; }
	[] T.timeout {
		setverdict(fail, "Timeout waiting for a PTCCH/D block");
		mtc.stop;
		}
	}
}

testcase TC_ta_ptcch_ul_multi_tbf() runs on RAW_PCU_Test_CT {
	var template PacketUlAssign t_ul_tbf_ass;
	var PacketUlAssign ul_tbf_ass[7];
	var GsmRrMessage rr_msg[7];
	var boolean ok;

	/* Initialize the PCU interface abstraction */
	f_init_raw(testcasename());

	/* Enable forwarding of PTCCH/U TDMA events to us */
	BTS.send(ts_RAW_PCU_CMD(TDMA_CMD_ENABLE_PTCCH_UL_FWD));

	/* Establish 7 Uplink TBFs (USF flag is 3 bits long, '111'B is reserved) */
	for (var integer i := 0; i < 7; i := i + 1) {
		ok := f_establish_tbf(rr_msg[i], ta := 0);
		if (not ok) {
			setverdict(fail, "Failed to establish an Uplink TBF #", i);
			mtc.stop;
		}

		/* Make sure we received an UL TBF Assignment */
		if (match(rr_msg[i], tr_IMM_TBF_ASS(dl := false, rest := tr_IaRestOctets_ULAss(?)))) {
			ul_tbf_ass[i] := rr_msg[i].payload.imm_ass.rest_octets.hh.pa.uldl.ass.ul;
			log("Rx Uplink TBF assignment for #", i, ": ", ul_tbf_ass[i]);
		} else {
			setverdict(fail, "Failed to match UL TBF Assignment for #", i);
			mtc.stop;
		}

		/* We expect incremental TFI/USF assignment (dynamic allocation) */
		t_ul_tbf_ass := tr_PacketUlDynAssign(tfi := i, usf := i);
		if (not match(ul_tbf_ass[i], t_ul_tbf_ass)) {
			setverdict(fail, "Failed to match Packet Uplink Assignment for #", i);
			mtc.stop;
		}

		/* We also expect Timing Advance Index to be a part of the assignment */
		if (ul_tbf_ass[i].dynamic.ta_index != i) {
			setverdict(fail, "Failed to match Timing Advance Index for #", i);
			/* Keep going, the current OsmoPCU does not assign TA Index */
		}
	}

	/* Prepare a list of ToA values for Access Bursts to be sent on PTCCH/U */
	var PTCCH_TAI_ToA_MAP toa_map := ptcch_toa_map_def;
	for (var integer i := 0; i < 7; i := i + 1) {
		/* ToA in units of 1/4 of a symbol */
		toa_map[i] := (i + 1) * 7 * 4;
	}

	/* Now we have all 7 TBFs established in one-phase access mode,
	 * however we will not be sending any data on them. Instead, we
	 * will be sending RACH.ind on PTCCH/U during 4 multi-frame
	 * periods (TAI 0..8), and then will check two PTCCH/D blocks.
	 *
	 * Why not 4 TBFs at once? Because Uplink is delayed by 3 TDMA
	 * time-slots, so at the moment of scheduling a PTCCH/D block
	 * the PCU has odd number of PTCCH/U Access Bursts received. */
	f_TC_ta_ptcch_ul_multi_tbf(toa_map, tr_PTCCHDownlinkMsg(
		tai0_ta :=  7, tai1_ta := 14, tai2_ta := 21,
		/* Other values are not known (yet) */
		tai3_ta := ?));
	f_TC_ta_ptcch_ul_multi_tbf(toa_map, tr_PTCCHDownlinkMsg(
		tai0_ta :=  7, tai1_ta := 14, tai2_ta := 21,
		tai3_ta := 28, tai4_ta := 35, tai5_ta := 42,
		/* Other values are out of our interest */
		tai6_ta := ?));
}

/* Default link quality adaptation (Coding Scheme) ranges (inclusive).
 * OsmoPCU (VTY): cs link-quality-ranges cs1 6 cs2 5 8 cs3 7 13 cs4 12
 *
 * NOTE: the ranges are intentionally overlapping because OsmoPCU
 * does not change CS/MCS on the range borders (5-6, 7-8, 12-13). */
private template integer CS1_lqual_dB_range := (-infinity .. 6);
private template integer CS2_lqual_dB_range := (5 .. 8);
private template integer CS3_lqual_dB_range := (7 .. 13);
private template integer CS4_lqual_dB_range := (12 .. infinity);

testcase TC_cs_lqual_ul_tbf() runs on RAW_PCU_Test_CT {
	var GsmRrMessage rr_imm_ass;
	var PacketUlAssign ul_tbf_ass;
	var RlcmacDlBlock dl_block;
	var PCUIF_Message pcu_msg;
	var octetstring data;
	var boolean ok;

	/* Initialize the PCU interface abstraction */
	f_init_raw(testcasename());

	f_pcuvty_set_allowed_cs_mcs();
	f_pcuvty_set_link_quality_ranges();

	/* Establish an Uplink TBF */
	ok := f_establish_tbf(rr_imm_ass);
	if (not ok) {
		setverdict(fail, "Failed to establish TBF");
		mtc.stop;
	}

	ok := f_imm_ass_verify_ul_tbf_ass(rr_imm_ass, ul_tbf_ass);
	if (not ok) {
		setverdict(fail, "Immediate Assignment not an Uplink TBF");
		mtc.stop;
	}

	var template (value) RlcmacUlBlock ul_data := t_RLCMAC_UL_DATA(
		tfi := ul_tbf_ass.dynamic.tfi_assignment,
		cv := 15, /* 16 UL blocks to be sent (to be overridden in loop) */
		bsn := 0, /* TODO: what should be here? */
		blocks := { /* To be generated in loop */ });

	/* HACK: patch missing TLLI; otherwise OsmoPCU rejects DATA.req */
	ul_data.data.tlli := '00000001'O;

	/* The actual / old link quality values. We need to keep track of the old
	 * (basically previous) link quality value, because OsmoPCU actually
	 * changes the coding scheme if not only the actual, but also the old
	 * value leaves the current link quality range (window). */
	var integer lqual := 0;
	var integer lqual_old;

	/* 16 UL blocks (0 .. 15 dB, step = 1 dB) */
	for (var integer i := 0; i < 16; i := i + 1) {
		/* Prepare a new UL block (CV, random payload) */
		ul_data.data.mac_hdr.countdown := (15 - i);
		ul_data.data.blocks := { valueof(t_RLCMAC_LLCBLOCK(f_rnd_octstring(10))) };

		/* Update the old / actual link quality */
		lqual_old := lqual;
		lqual := i;

		/* Enqueue DATA.ind (both TDMA frame and block numbers to be patched) */
		log("Sending DATA.ind with link quality (dB): ", lqual);
		f_tx_rlcmac_ul_block(ul_data, lqual * 10);

		/* Enqueue RTS.req, expect DATA.req with UL ACK from the PCU */
		f_rx_rlcmac_dl_block_exp_ack_nack(dl_block);

		log("Rx Packet Uplink ACK / NACK with Channel Coding Command: ",
		    dl_block.ctrl.payload.u.ul_ack_nack.gprs.ch_coding_cmd);

		/* Match the received Channel Coding Command. Since we are increasing
		 * the link quality value on each iteration and not decreasing, there
		 * is no need to check the both old and current link quality values. */
		var template ChCodingCommand ch_coding;
		select (lqual_old) {
		case (CS1_lqual_dB_range) { ch_coding := CH_CODING_CS1; }
		case (CS2_lqual_dB_range) { ch_coding := CH_CODING_CS2; }
		case (CS3_lqual_dB_range) { ch_coding := CH_CODING_CS3; }
		case (CS4_lqual_dB_range) { ch_coding := CH_CODING_CS4; }
		}

		if (not match(dl_block.ctrl.payload.u.ul_ack_nack.gprs.ch_coding_cmd, ch_coding)) {
			setverdict(fail, "Channel Coding does not match our expectations: ", ch_coding);
		} else {
			setverdict(pass);
		}
	}
}

/* Test the max UL CS set by VTY works fine */
testcase TC_cs_initial_ul() runs on RAW_PCU_Test_CT {
	var GsmRrMessage rr_imm_ass;
	var PacketUlAssign ul_tbf_ass;
	var RlcmacDlBlock dl_block;
	var boolean ok;
	var integer lqual_cb;
	var ChCodingCommand last_ch_coding;

	/* Initialize the PCU interface abstraction */
	f_init_raw(testcasename());

	/* Set initial UL CS to 3 */
	g_cs_initial_ul := 3;
	f_pcuvty_set_allowed_cs_mcs();
	f_pcuvty_set_link_quality_ranges();

	/* Take lqual (dB->cB) so that we stay in that CS */
	lqual_cb := g_cs_lqual_ranges[2].low * 10;

	/* Establish an Uplink TBF */
	ok := f_establish_tbf(rr_imm_ass);
	if (not ok) {
		setverdict(fail, "Failed to establish TBF");
		mtc.stop;
	}

	ok := f_imm_ass_verify_ul_tbf_ass(rr_imm_ass, ul_tbf_ass);
	if (not ok) {
		setverdict(fail, "Immediate Assignment not an Uplink TBF");
		mtc.stop;
	}

	var template (value) RlcmacUlBlock ul_data := t_RLCMAC_UL_DATA(
		tfi := ul_tbf_ass.dynamic.tfi_assignment,
		cv := 3, /* 8 UL blocks to be sent (to be overridden in loop) */
		bsn := 0, /* TODO: what should be here? */
		blocks := { /* To be generated in loop */ });

	/* HACK: patch missing TLLI; otherwise OsmoPCU rejects DATA.req */
	ul_data.data.tlli := '00000001'O;

	/* 3 UL blocks, check we are in same initial CS: */
	for (var integer i := 0; i < 3; i := i + 1) {
		/* Prepare a new UL block (CV, random payload) */
		ul_data.data.mac_hdr.countdown := (7 - i);
		ul_data.data.blocks := { valueof(t_RLCMAC_LLCBLOCK(f_rnd_octstring(10))) };

		/* Enqueue DATA.ind (both TDMA frame and block numbers to be patched) */
		f_tx_rlcmac_ul_block(ul_data, lqual_cb);

		/* Enqueue RTS.req, expect DATA.req with UL ACK from the PCU */
		f_rx_rlcmac_dl_block_exp_ack_nack(dl_block);
		last_ch_coding := dl_block.ctrl.payload.u.ul_ack_nack.gprs.ch_coding_cmd;
	}

	if (last_ch_coding != CH_CODING_CS3) {
		setverdict(fail, "Channel Coding does not match our expectations (CS-3): ", last_ch_coding);
		mtc.stop;
	}

	setverdict(pass);

	/* Remaining UL blocks are used to make sure regardless of initial
	/* lqual, we can go lower at any time */

	/* 5 UL blocks, check we are in same initial CS: */
	for (var integer i := 3; i < 8; i := i + 1) {
		/* Prepare a new UL block (CV, random payload) */
		ul_data.data.mac_hdr.countdown := (7 - i);
		ul_data.data.blocks := { valueof(t_RLCMAC_LLCBLOCK(f_rnd_octstring(10))) };

		/* Enqueue DATA.ind (both TDMA frame and block numbers to be patched) */
		f_tx_rlcmac_ul_block(ul_data, 0); /* 0 dB, make sure we downgrade CS */

		/* Enqueue RTS.req, expect DATA.req with UL ACK from the PCU */
		f_rx_rlcmac_dl_block_exp_ack_nack(dl_block);

		last_ch_coding := dl_block.ctrl.payload.u.ul_ack_nack.gprs.ch_coding_cmd;
	}

	if (last_ch_coding != CH_CODING_CS1) {
		setverdict(fail, "Channel Coding does not match our expectations (CS-1): ", last_ch_coding);
	} else {
		setverdict(pass);
	}
}

/* Test the max UL CS set by VTY works fine */
testcase TC_cs_max_ul() runs on RAW_PCU_Test_CT {
	var GsmRrMessage rr_imm_ass;
	var PacketUlAssign ul_tbf_ass;
	var RlcmacDlBlock dl_block;
	var boolean ok;
	var ChCodingCommand last_ch_coding;

	/* Initialize the PCU interface abstraction */
	f_init_raw(testcasename());

	/* Set maximum allowed UL CS to 3 */
	g_cs_max_ul := 3;
	f_pcuvty_set_allowed_cs_mcs();
	f_pcuvty_set_link_quality_ranges();

	/* Establish an Uplink TBF */
	ok := f_establish_tbf(rr_imm_ass);
	if (not ok) {
		setverdict(fail, "Failed to establish TBF");
		mtc.stop;
	}

	ok := f_imm_ass_verify_ul_tbf_ass(rr_imm_ass, ul_tbf_ass);
	if (not ok) {
		setverdict(fail, "Immediate Assignment not an Uplink TBF");
		mtc.stop;
	}

	var template (value) RlcmacUlBlock ul_data := t_RLCMAC_UL_DATA(
		tfi := ul_tbf_ass.dynamic.tfi_assignment,
		cv := 15, /* 16 UL blocks to be sent (to be overridden in loop) */
		bsn := 0, /* TODO: what should be here? */
		blocks := { /* To be generated in loop */ });

	/* HACK: patch missing TLLI; otherwise OsmoPCU rejects DATA.req */
	ul_data.data.tlli := '00000001'O;

	/* 16 UL blocks */
	for (var integer i := 0; i < 16; i := i + 1) {
		/* Prepare a new UL block (CV, random payload) */
		ul_data.data.mac_hdr.countdown := (15 - i);
		ul_data.data.blocks := { valueof(t_RLCMAC_LLCBLOCK(f_rnd_octstring(10))) };

		/* Enqueue DATA.ind (both TDMA frame and block numbers to be patched) */
		f_tx_rlcmac_ul_block(ul_data, 40*10); /* 40 dB */

		/* Enqueue RTS.req, expect DATA.req with UL ACK from the PCU */
		f_rx_rlcmac_dl_block_exp_ack_nack(dl_block);

		last_ch_coding := dl_block.ctrl.payload.u.ul_ack_nack.gprs.ch_coding_cmd;
	}

	if (last_ch_coding != CH_CODING_CS3) {
		setverdict(fail, "Channel Coding does not match our expectations (CS-3): ", last_ch_coding);
	} else {
		setverdict(pass);
	}
}

/* Verify PCU drops TBF after some time of inactivity. */
testcase TC_t3169() runs on RAW_PCU_Test_CT {
	var PCUIF_info_ind info_ind;
	var GsmRrMessage rr_imm_ass;
	var PacketUlAssign ul_tbf_ass;
	var RlcmacDlBlock dl_block;
	var PCUIF_Message pcu_msg;
	var octetstring data;
	var boolean ok;
	var OCT4 tlli := '00000001'O;

	/* Initialize NS/BSSGP side */
	f_init_bssgp();

	info_ind := valueof(ts_PCUIF_INFO_default);
	/* Set timer to 1 sec (default 5) to speedup test: */
	info_ind.t3169 := 1;

	/* Initialize the PCU interface abstraction */
	f_init_raw(testcasename(), info_ind);

	/* Establish BSSGP connection to the PCU */
	f_bssgp_establish();
	f_bssgp_client_llgmm_assign('FFFFFFFF'O, tlli);

	/* Establish an Uplink TBF */
	ok := f_establish_tbf(rr_imm_ass);
	if (not ok) {
		setverdict(fail, "Failed to establish TBF");
		mtc.stop;
	}

	ok := f_imm_ass_verify_ul_tbf_ass(rr_imm_ass, ul_tbf_ass);
	if (not ok) {
		setverdict(fail, "Immediate Assignment not an Uplink TBF");
		mtc.stop;
	}

	/* Send one UL block and make sure it is ACKED fine */
	f_tx_rlcmac_ul_n_blocks(ul_tbf_ass, 1);
	f_rx_rlcmac_dl_block_exp_ack_nack(dl_block);
	/* UL block should be received in SGSN */
	BSSGP[0].receive(tr_BSSGP_UL_UD(tlli, mp_gb_cfg.cell_id));

	/* Wait until T3169 fires (plus 1 extra sec to make sure) */
	f_sleep(int2float(info_ind.t3169) + 1.0);

	/* Send an UL block once again, the TBF should be gone by now so no ACK */
	f_tx_rlcmac_ul_n_blocks(ul_tbf_ass, 1);
	f_rx_rlcmac_dl_block_exp_dummy(dl_block);
}

/* Test scenario where MS wants to send some data on PDCH against SGSN and it is
 * answered, so TBFs for uplink and later for downlink are created.
 */
testcase TC_mo_ping_pong() runs on RAW_PCU_Test_CT {
	var GsmRrMessage rr_imm_ass;
	var PacketUlAssign ul_tbf_ass;
	var PacketDlAssign dl_tbf_ass;
	var RlcmacDlBlock dl_block;
	var PCUIF_Message pcu_msg;
	var octetstring data := f_rnd_octstring(10);
	var boolean ok;
	var uint32_t sched_fn;
	var OCT4 tlli := '00000001'O;
	var AckNackDescription ack_nack_desc;

	ack_nack_desc.final_ack := '0'B;
	ack_nack_desc.starting_seq_nr := 0;
	ack_nack_desc.receive_block_bitmap := '0000000000000000000000000000000000000000000000000000000000000000'B;


	/* Initialize NS/BSSGP side */
	f_init_bssgp();

	/* Initialize the PCU interface abstraction */
	f_init_raw(testcasename());

	/* Establish BSSGP connection to the PCU */
	f_bssgp_establish();
	f_bssgp_client_llgmm_assign('FFFFFFFF'O, tlli);

	/* Establish an Uplink TBF */
	ok := f_establish_tbf(rr_imm_ass);
	if (not ok) {
		setverdict(fail, "Failed to establish TBF");
		mtc.stop;
	}
	ok := f_imm_ass_verify_ul_tbf_ass(rr_imm_ass, ul_tbf_ass);
	if (not ok) {
		setverdict(fail, "Immediate Assignment not an Uplink TBF");
		mtc.stop;
	}

	/* Send one UL block and make sure it is ACKED fine */
	f_tx_rlcmac_ul_n_blocks(ul_tbf_ass, 1);
	f_rx_rlcmac_dl_block_exp_ack_nack(dl_block);

	/* UL block should be received in SGSN */
	BSSGP[0].receive(tr_BSSGP_UL_UD(tlli, mp_gb_cfg.cell_id));

	/* Now SGSN sends some DL data, PCU will page on CCCH (PCH) */
	BSSGP[0].send(ts_BSSGP_DL_UD(tlli, data));
	f_pcuif_rx_pch_imm_tbf_ass(rr_imm_ass);

	ok := f_imm_ass_verify_dl_tbf_ass(rr_imm_ass, dl_tbf_ass);
	if (not ok) {
		setverdict(fail, "Immediate Assignment not a Downlink TBF");
		mtc.stop;
	}

	/* Wait timer X2002 and DL block is available after CCCH IMM ASS: */
	f_sleep(X2002);
	f_rx_rlcmac_dl_block_exp_data(dl_block, sched_fn, data);

	/* ACK the DL block */
	f_tx_rlcmac_ul_block(ts_RLCMAC_DL_ACK_NACK(dl_block.data.mac_hdr.hdr_ext.tfi, ack_nack_desc), 0, sched_fn);
}

control {
	execute( TC_ns_reset() );
	execute( TC_ns_reset_retrans() );
	execute( TC_ns_alive() );
	execute( TC_ns_alive_timeout_reset() );
	execute( TC_ns_unblock() );
	execute( TC_ns_unblock_retrans() );
	execute( TC_ns_full_bringup() );
	execute( TC_ns_so_block() );

	execute( TC_pcuif_suspend() );
	execute( TC_ta_ptcch_idle() );
	execute( TC_ta_rach_imm_ass() );
	execute( TC_ta_ptcch_ul_multi_tbf() );
	execute( TC_cs_lqual_ul_tbf() );
	execute( TC_cs_initial_ul() );
	execute( TC_cs_max_ul() );
	execute( TC_t3169() );
	execute( TC_mo_ping_pong() );
}






}